npm - decocms - Versions diffs - 2.389.2 → 2.389.3 - Mend

decocms 2.389.2 → 2.389.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (1746) hide show

package/dist/server/cli.js CHANGED Viewed

@@ -75391,7 +75391,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 `);if(G===-1)return;let W=Q.subarray(0,G).toString("utf8"),F=Q.subarray(G+4),B=W.split(`\r
 `,1)[0]??"";if(!/^HTTP\/1\.[01] 101(?:\s|$)/.test(B)){qj($,1011,u.upstreamErrorReason);try{E.end()}catch{}return}Y=!0,$.data.upstream=E;let v=fiu((N,O)=>{try{if(N===1)$.send(O.toString("utf8"));else if(N===2)$.send(O);else if(N===8){let{code:z,reason:H}=uiu(O);qj($,z,H);try{E.end()}catch{}}}catch{}});if(E.removeAllListeners("data"),F.length>0)v(F);E.on("data",(N)=>v(N));for(let N of $.data.pending)try{E.write(tQ1(N,!0))}catch{}$.data.pending.length=0})}function $iu($,u){let f=[`GET ${$} HTTP/1.1`];for(let[X,J]of Object.entries(u))f.push(`${X}: ${J}`);return f.push("",""),f.join(`\r
 `)}function qj($,u,f){try{if(u!==void 0)$.close(u,f??"");else $.close()}catch{}}function tQ1($,u,f){let X,J;if(typeof $==="string")X=Buffer.from($,"utf8"),J=1;else if($ instanceof ArrayBuffer)X=Buffer.from($),J=2;else if(Buffer.isBuffer($))X=$,J=2;else X=Buffer.from($),J=2;let w=f??J,E=X.length,Q=[];Q.push(128|w&15);let Y=u?128:0;if(E<126)Q.push(Y|E);else if(E<65536)Q.push(Y|126,E>>8&255,E&255);else Q.push(Y|127,0,0,0,0),Q.push(E>>>24&255,E>>>16&255,E>>>8&255,E&255);if(u){let Z=_T4(4),G=Buffer.alloc(E);for(let W=0;W<E;W++)G[W]=X[W]^Z[W&3];return Buffer.concat([Buffer.from(Q),Z,G])}return Buffer.concat([Buffer.from(Q),X])}function uiu($){if($.length<2)return{code:1000,reason:""};return{code:$.readUInt16BE(0),reason:$.subarray(2).toString("utf8")}}function fiu($){let u=Buffer.alloc(0);return(f)=>{u=u.length===0?f:Buffer.concat([u,f]);while(!0){if(u.length<2)return;let X=u[0],J=u[1],w=X&15,E=(J&128)!==0,Q=J&127,Y=2;if(Q===126){if(u.length<Y+2)return;Q=u[Y]<<8|u[Y+1],Y+=2}else if(Q===127){if(u.length<Y+8)return;Q=u[Y+4]*16777216+(u[Y+5]<<16|u[Y+6]<<8|u[Y+7]),Y+=8}let Z=null;if(E){if(u.length<Y+4)return;Z=u.subarray(Y,Y+4),Y+=4}if(u.length<Y+Q)return;let G=u.subarray(Y,Y+Q);if(Z){let W=Buffer.alloc(Q);for(let F=0;F<Q;F++)W[F]=G[F]^Z[F&3];G=W}u=u.subarray(Y+Q),$(w,G)}}}var sbu=256;var TT4=U(()=>{HT4()});function AT4($){if(typeof $!=="string"||$.length===0)return null;let u=$.lastIndexOf(":");if($.startsWith("["))return null;let X=(u>=0?$.slice(0,u):$).replace(/\.$/,"").toLowerCase(),J=".localhost";if(!X.endsWith(J))return null;let w=X.slice(0,-J.length);if(w.length===0)return null;if(w.includes("."))return null;return w}async function IT4($){let u=LT4({maxPendingFrames:$.maxPendingWsFrames??Xiu,backlogOverflowReason:"ingress backlog overflow"}),f=Bun.serve({port:$.port,hostname:"127.0.0.1",async fetch(X,J){let w=X.headers.get("host"),E=AT4(w);if(!E)return new Response("not found",{status:404});let Q=$.lookupSandboxPort(E);if(!Q){if(X.headers.get("upgrade")==="websocket")return new Response("unknown handle",{status:404});return new Response(Jiu,{status:503,headers:{"Content-Type":"text/html; charset=utf-8","Cache-Control":"no-store","Retry-After":"1"}})}if(X.headers.get("upgrade")==="websocket"){let W=new URL(X.url);if(!J.upgrade(X,{data:jT4({port:Q,pathQuery:`${W.pathname}${W.search}`,protocols:PT4(X.headers)})}))return new Response("ws upgrade failed",{status:400});return}let Y=new URL(X.url),Z=`http://127.0.0.1:${Q}${Y.pathname}${Y.search}`,G=new Headers(X.headers);return G.set("host",`127.0.0.1:${Q}`),fetch(Z,{method:X.method,headers:G,body:X.body,redirect:"manual"})},websocket:{open:u.open,message:u.message,close:u.close}});return{port:f.port??0,async stop(){f.stop(!0)}}}var Xiu=256,Jiu='<!DOCTYPE html><html><head><meta charset="utf-8"><title>Connecting\u2026</title><style>body{font-family:system-ui,sans-serif;display:flex;align-items:center;justify-content:center;min-height:100vh;margin:0;background:#fafafa;color:#555}div{text-align:center;max-width:420px;padding:24px}h3{margin:0 0 8px}p{margin:0;font-size:14px;color:#999;line-height:1.5}</style></head><body><div><h3>Connecting to sandbox\u2026</h3><p>Waiting for the local sandbox to come online. This page refreshes automatically.</p></div><script>setTimeout(function(){window.location.reload()},1500)</script></body></html>';var ST4=U(()=>{TT4()});import{randomBytes as wiu}from"crypto";import{mkdir as Eiu,readFile as Qiu,writeFile as Yiu}from"fs/promises";import{dirname as Diu,join as Ziu}from"path";function Giu($){return Ziu($,"machine-id")}async function kT4($){let u=Giu($);try{let J=(await Qiu(u,"utf8")).trim();if(J)return J}catch{}let f=wiu(16).toString("hex");return await Eiu(Diu(u),{recursive:!0}),await Yiu(u,f),f}var RT4=()=>{};import{randomBytes as Wiu}from"crypto";import{mkdir as Fiu}from"fs/promises";import{createServer as Biu}from"net";import{join as viu}from"path";function CT4($,u){return Error(`sandbox failed to start: ${$}`,{cause:u})}function Uiu($){if(!($ instanceof Error))return!1;return $.name==="TimeoutError"||/timed out|timeout|operation was aborted|aborted/i.test($.message)}function Niu($){if($ instanceof Error){let u=$.cause;if(u instanceof Error&&u.message)return u.message;return $.message}return String($)}function qT4($){let u=$.maxSandboxes??20,f=new Map,X=$.pickPort??Oiu,J=$.fetchImpl??fetch,w=$.resolvePreviewUrl??((F,B)=>`http://127.0.0.1:${B}`),E=(F)=>{try{$.onEvent?.(F)}catch{}},Q=async(F)=>{let B=new AbortController,v=setTimeout(()=>B.abort(),1500);try{let N=await J(`${F}/health`,{signal:B.signal});if(!N.ok)console.warn(`[user-desktop] probe ${F}/health \u2192 ${N.status} (treating as dead)`);return N.ok}catch(N){return console.warn(`[user-desktop] probe ${F}/health failed: ${N instanceof Error?N.message:String(N)} (treating as dead)`),!1}finally{clearTimeout(v)}},Y=(F)=>{console.warn(`[user-desktop] evicting dead daemon handle=${F.handle} port=${F.port}`);try{F.process.kill("SIGTERM")}catch{}if(f.get(F.handle)===F)f.delete(F.handle),E({handle:F.handle,phase:"evicted"})},Z=new Map;function G(){if(f.size<u)return;let F=[...f.values()].filter((v)=>v.activeDispatchCount===0).sort((v,N)=>v.lastUsedAt-N.lastUsedAt);if(F.length===0){console.warn(`[user-desktop] at cap ${f.size}/${u} but every sandbox is pinned (active dispatch) \u2014 exceeding cap temporarily`);return}let B=F[0];console.log(`[user-desktop] evicting LRU victim handle=${B.handle} port=${B.port} (cap ${u} reached, size=${f.size})`);try{B.process.kill("SIGTERM")}catch{}f.delete(B.handle),E({handle:B.handle,phase:"evicted"})}let W=async(F)=>{E({handle:F.handle,phase:"spawning"}),G();let B=viu($.dataDir,"sandboxes",F.handle);await Fiu(B,{recursive:!0}),console.log(`[user-desktop] ensure handle=${F.handle} repo=${F.repo?.cloneUrl??"(none)"} branch=${F.repo?.branch??"(none)"} runtime=${F.workload?.runtime??"(autodetect)"} pm=${F.workload?.packageManager??"(autodetect)"}`);let v=Wiu(24).toString("hex"),[N,O]=await Promise.all([X(),X()]);console.log(`[user-desktop] spawn handle=${F.handle} port=${N} devPort=${O} workdir=${B}`);let z=await Promise.resolve($.spawnDaemon({workdir:B,handle:F.handle,port:N,daemonToken:v,offloadAllowedHosts:F.offloadAllowedHosts??[],offloadAllowSameHostDev:F.offloadAllowSameHostDev??!1}));try{try{await $.waitForHealth(N)}catch(j){throw CT4("the sandbox didn't come online in time",j)}console.log(`[user-desktop] healthy handle=${F.handle} port=${N} \u2014 posting config`);try{await $.postConfig(N,O,{repo:F.repo,workload:F.workload},v)}catch(j){throw CT4(Uiu(j)?"configuration timed out":"the sandbox rejected its configuration",j)}}catch(j){console.error(`[user-desktop] sandbox bring-up failed handle=${F.handle} port=${N} (killing daemon):`,j);try{z.kill("SIGKILL")}catch{}throw E({handle:F.handle,phase:"failed",error:Niu(j)}),j}let H=`http://127.0.0.1:${N}`,_=w(F.handle,N);console.log(`[user-desktop] ready handle=${F.handle} port=${N} sandboxApiUrl=${H} previewUrl=${_}`);let T={handle:F.handle,port:N,process:z,sandboxApiUrl:H,previewUrl:_,lastUsedAt:Date.now(),activeDispatchCount:0,daemonToken:v};if(f.set(F.handle,T),E({handle:F.handle,phase:"ready",port:N,previewUrl:_}),z.exited)z.exited.then(()=>{if(f.get(F.handle)===T)console.warn(`[user-desktop] daemon process exited unexpectedly handle=${F.handle} port=${N} \u2014 removing from cache`),f.delete(F.handle),E({handle:F.handle,phase:"evicted"});else console.log(`[user-desktop] daemon process exited handle=${F.handle} port=${N} (already replaced/removed)`)});return{sandboxApiUrl:H,previewUrl:_,port:N}};return{async ensureSandbox(F){let B=f.get(F.handle);if(B){if(await Q(B.sandboxApiUrl))return console.log(`[user-desktop] cache hit handle=${F.handle} port=${B.port} (alive)`),B.lastUsedAt=Date.now(),{sandboxApiUrl:B.sandboxApiUrl,previewUrl:B.previewUrl,port:B.port};console.warn(`[user-desktop] cache stale handle=${F.handle} port=${B.port} \u2014 respawning`),Y(B)}let v=Z.get(F.handle);if(v)return console.log(`[user-desktop] joining in-flight ensure handle=${F.handle}`),v;let N=W(F).finally(()=>{Z.delete(F.handle)});return Z.set(F.handle,N),N},proxyPort(F){let B=f.get(F);if(B)B.lastUsedAt=Date.now();return B?.port??null},getDaemonToken(F){return f.get(F)?.daemonToken??null},hasHandle(F){return f.has(F)||Z.has(F)},recordHit(F){let B=f.get(F);if(B)B.lastUsedAt=Date.now()},acquireDispatch(F){let B=f.get(F);if(!B)return()=>{};B.activeDispatchCount+=1;let v=!1;return()=>{if(v)return;v=!0;let N=f.get(F);if(N)N.activeDispatchCount=Math.max(0,N.activeDispatchCount-1)}},listSandboxes(){return[...f.values()]},async deleteSandbox(F){let B=f.get(F);if(!B){console.log(`[user-desktop] delete handle=${F} (not found, no-op)`);return}console.log(`[user-desktop] delete handle=${F} port=${B.port}`);try{B.process.kill("SIGTERM")}catch{}f.delete(F),E({handle:F,phase:"deleted"})},async shutdown(){console.log(`[user-desktop] shutdown \u2014 killing ${f.size} sandbox(es)`);for(let F of f.values())try{F.process.kill("SIGTERM")}catch{}f.clear()}}}function Oiu(){return new Promise(($,u)=>{let f=Biu();f.unref(),f.on("error",u),f.listen(0,"127.0.0.1",()=>{let X=f.address();if(X&&typeof X==="object"){let J=X.port;f.close(()=>$(J))}else f.close(()=>u(Error("could not allocate port")))})})}var MT4=()=>{};import{randomUUID as ziu}from"crypto";import{hostname as Kiu}from"os";async function hT4($){let u=$.session,f=await kT4($.dataDir),X=process.env.npm_package_version??"0.0.0",J=Kiu()||void 0;$.monitor?.onMachine?.(J??"this machine");let w=Qj4($.dataDir,{outFd:$.logFd}),E=0,Q=qT4({dataDir:$.dataDir,resolvePreviewUrl:(O,z)=>E>0?`http://${O}.localhost:${E}`:`http://127.0.0.1:${z}`,spawnDaemon:(O)=>{let z={DAEMON_BOOT_ID:ziu(),APP_ROOT:O.workdir,PROXY_PORT:String(O.port),DAEMON_TOKEN:O.daemonToken,OFFLOAD_ALLOWED_HOSTS:O.offloadAllowedHosts.join(","),...O.offloadAllowSameHostDev?{OFFLOAD_ALLOW_SAME_HOST_DEV:"1"}:{}};return w({workdir:O.workdir,env:z,daemonPort:O.port}).then((H)=>({port:O.port,kill:(_)=>H.kill(_),exited:H.exited.then(()=>{return})}))},postConfig:async(O,z,H,_)=>{let T={port:z};if(H.workload)T.runtime=H.workload.runtime,T.packageManager={name:H.workload.packageManager,...H.workload.packageManagerPath?{path:H.workload.packageManagerPath}:{}};let j={application:T};if(H.repo)j.git={repository:{cloneUrl:H.repo.cloneUrl,branch:H.repo.branch},...H.repo.userName&&H.repo.userEmail?{identity:{userName:H.repo.userName,userEmail:H.repo.userEmail}}:{}};await zm(`http://127.0.0.1:${O}`,_,j)},waitForHealth:async(O)=>{await zB0(`http://127.0.0.1:${O}`)},maxSandboxes:20,onEvent:$.monitor?.onEvent}),Y=await IT4({port:$.port,lookupSandboxPort:(O)=>Q.proxyPort(O)});E=Y.port,console.log(`Local ingress listening on http://127.0.0.1:${Y.port} (use http://<handle>.localhost:${Y.port}/)`),$.monitor?.onIngress?.(Y.port);let Z=Gj4({provider:Q}),G=(()=>{let O=new URL("/api/links/connect",$.clusterBaseUrl);return O.protocol=O.protocol==="https:"?"wss:":"ws:",O.toString()})(),W=await UT4({url:G,accessToken:u.accessToken,hello:{previewPort:Y.port,machineId:f,hostname:J,cliVersion:X,capabilities:await Dj4()},controlHandler:Z,onConnected:()=>{$.monitor?.onCluster?.("linked"),console.log(`Linked to ${$.clusterBaseUrl}`)}}),F,B=new Promise((O)=>{F=O}),v=!1,N=async()=>{if(v)return;v=!0,console.log(`
-Shutting down\u2026`);try{await W.close()}catch{}try{await Y.stop()}catch{}try{await Q.shutdown()}catch{}F(0)};return process.on("SIGINT",()=>void N()),process.on("SIGTERM",()=>void N()),W.closed.then(()=>{if($.monitor?.onCluster?.("closed"),!v)console.error("Cluster connection closed permanently; exiting."),N()}),{stopped:B,stop:N}}var yT4=U(()=>{M91();Yj4();Zj4();Wj4();NT4();ST4();RT4();MT4()});function rQ1($){return $.map((u)=>typeof u==="string"?u:String(u)).join(" ")}var CN0;var aQ1=U(()=>{CN0={name:"decocms",version:"2.389.2",description:"Deco CMS \u2014 Self-hostable MCP Gateway for managing AI connections and tools",author:"Deco team",repository:{type:"git",url:"git+https://github.com/decocms/studio.git",directory:"apps/mesh"},bugs:{url:"https://github.com/decocms/studio/issues"},type:"module",bin:{deco:"./dist/server/cli.js"},files:["dist/**/*"],scripts:{dev:'bun run migrate && concurrently "bun run dev:client" "bun run dev:server"',"dev:servers":'concurrently "bun run dev:client" "bun run dev:server"',"dev:client":"bun --bun vite dev","dev:server":"bun run --cwd=../../packages/sandbox build && NODE_ENV=development bun --env-file=.env --hot run src/index.ts","build:client":"bun --bun vite build","build:server":"bun run scripts/bundle-server-script.ts --dist ./dist/server","db:migrate":"bun run ./dist/server/migrate.js",check:"tsc --noEmit",start:"bun run ./dist/server/server.js",migrate:"bun run src/database/migrate.ts",test:"bun test","test:e2e":"playwright test","test:e2e:ui":"playwright test --ui","better-auth:migrate":"bunx --bun @better-auth/cli migrate -y --config src/auth/index.ts","smoke:link":"bun run scripts/smoke-link.ts",prepublishOnly:"bun run build:client && bun run build:server"},optionalDependencies:{"@anthropic-ai/claude-agent-sdk":"^0.2.141","@duckdb/node-api":"^1.5.0-r.1"},dependencies:{"@ai-sdk/anthropic":"^3.0.80","@ai-sdk/google":"^3.0.80","@ai-sdk/openai":"^3.0.65","@anthropic-ai/sdk":"^0.96.0","@aws-sdk/client-s3":"^3.1013.0","@aws-sdk/lib-storage":"^3.1013.0","@aws-sdk/s3-request-presigner":"^3.1013.0","@clickhouse/client":"^1.8.1","@dbos-inc/dbos-sdk":"^4.17.6","@dnd-kit/core":"^6.3.1","@dnd-kit/sortable":"^10.0.0","@dnd-kit/utilities":"^3.2.2","@inkjs/ui":"^2.0.0","@modelcontextprotocol/ext-apps":"^1.7.1","@openrouter/ai-sdk-provider":"^2.9.0","@opentelemetry/core":"^2.6.0","@tanstack/react-virtual":"3.13.24","@xterm/addon-fit":"^0.11.0","@xterm/xterm":"^6.0.0","ai-sdk-provider-claude-code":"^3.4.4","ai-sdk-provider-codex-cli":"^1.1.0","embedded-postgres":"^18.3.0-beta.16",ink:"^6.8.0",kysely:"^0.28.12",nats:"^2.29.3","node-pty":"^1.0.0","posthog-js":"^1.371.1","posthog-node":"^5.0.0",react:"^19.2.6","react-dom":"^19.2.6"},devDependencies:{"@ai-sdk/provider":"^3.0.10","@ai-sdk/react":"^3.0.193","@better-auth/sso":"1.4.1","@daveyplate/better-auth-ui":"^3.2.7","@deco/ui":"workspace:*","@decocms/better-auth":"1.5.17","@decocms/bindings":"workspace:*","@decocms/mcp-utils":"workspace:*","@decocms/mesh-sdk":"workspace:*","@decocms/runtime":"workspace:*","@decocms/std":"workspace:*","@decocms/vite-plugin":"workspace:*","@floating-ui/react":"^0.27.16","@happy-dom/global-registrator":"^20.9.0","@hookform/resolvers":"^5.2.2","@jitl/quickjs-wasmfile-release-sync":"0.31.0","@modelcontextprotocol/sdk":"1.29.0","@monaco-editor/react":"^4.7.0","@opentelemetry/api":"^1.9.0","@opentelemetry/api-logs":"^0.211.0","@opentelemetry/exporter-logs-otlp-proto":"^0.211.0","@opentelemetry/exporter-prometheus":"^0.208.0","@opentelemetry/exporter-trace-otlp-proto":"^0.207.0","@opentelemetry/instrumentation-runtime-node":"^0.24.0","@opentelemetry/resources":"^2.6.0","@opentelemetry/sdk-logs":"^0.211.0","@opentelemetry/sdk-metrics":"^2.2.0","@opentelemetry/sdk-node":"^0.207.0","@opentelemetry/sdk-trace-base":"^2.5.0","@playwright/test":"^1.58.2","@radix-ui/react-avatar":"^1.1.10","@radix-ui/react-checkbox":"^1.3.3","@radix-ui/react-dialog":"^1.1.15","@radix-ui/react-dropdown-menu":"^2.1.16","@radix-ui/react-label":"^2.1.7","@radix-ui/react-select":"^2.2.6","@radix-ui/react-separator":"^1.1.7","@radix-ui/react-slot":"^1.2.3","@radix-ui/react-tabs":"^1.1.13","@rjsf/core":"^6.1.2","@rjsf/shadcn":"^6.1.2","@rjsf/utils":"^6.1.2","@rjsf/validator-ajv8":"^6.1.2","@tailwindcss/vite":"^4.1.17","@tanstack/react-query":"5.100.10","@tanstack/react-router":"1.169.2","@testing-library/jest-dom":"^6.9.1","@testing-library/react":"^16.3.2","@tiptap/core":"3.20.2","@tiptap/extension-mention":"3.20.2","@tiptap/extension-placeholder":"3.20.2","@tiptap/pm":"3.20.2","@tiptap/react":"3.20.2","@tiptap/starter-kit":"3.20.2","@tiptap/suggestion":"3.20.2","@types/bun":"^1.3.1","@types/pg":"^8.15.6","@types/react-syntax-highlighter":"^15.5.13","@untitledui/icons":"^0.0.19","@vercel/nft":"^1.1.1","@vitejs/plugin-react":"^5.1.0",ai:"^6.0.191","babel-plugin-react-compiler":"^1.0.0","better-auth":"1.4.22","class-variance-authority":"^0.7.1",clsx:"^2.1.1",concurrently:"^9.2.1",croner:"^9.1.0","date-fns":"^4.1.0",degit:"^2.8.4",hono:"^4.10.7","input-otp":"^1.4.2",jose:"^6.0.11","lucide-react":"^0.468.0",marked:"^15.0.6","@decocms/sandbox":"workspace:*","mesh-plugin-workflows":"workspace:*",nanoid:"^5.1.6",pg:"^8.16.3",prettier:"^3.4.2","react-hook-form":"^7.66.0","react-markdown":"^10.1.0","react-resizable-panels":"^2.1.7","react-syntax-highlighter":"^15.6.1",recharts:"^3.6.0","rehype-raw":"^7.0.0","remark-gfm":"^4.0.0","sass-embedded":"^1.97.2",sonner:"^2.0.7","tailwind-merge":"^3.3.1",tailwindcss:"^4.1.17",typescript:"^5.9.3",vite:"^7.2.1","vite-tsconfig-paths":"^5.1.4",zod:"^4.0.0",zustand:"^5.0.9"},homepage:"https://github.com/decocms/studio",keywords:["mcp","model-context-protocol","ai","gateway","self-hosted","mesh","tools"],license:"MIT",publishConfig:{access:"public"}}});var zu0={};Y1(zu0,{printBanner:()=>Piu,bannerLines:()=>gT4,BANNER_LINES:()=>qN0,BANNER_GRADIENT:()=>MN0});function _iu($){let u=Number.parseInt($.slice(1),16);return[u>>16&255,u>>8&255,u&255]}function gT4($){let u=qN0.map((f,X)=>{let[J,w,E]=_iu(MN0[X]);return`\x1B[38;2;${J};${w};${E}m${f}\x1B[39m`});if($!==void 0)u.push(`\x1B[2m  v${$}\x1B[22m`);return u}function Piu($){console.log("");for(let u of gT4($))console.log(u);console.log("")}var qN0,MN0;var om=U(()=>{qN0=[" \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588     \u2588\u2588\u2588\u2588\u2588\u2588\u2588   ","\u2591\u2591\u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2588\u2588\u2588 \u2591\u2591\u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2591\u2588  \u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2591\u2588\u2588\u2588  \u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2591\u2588\u2588\u2588 "," \u2591\u2588\u2588\u2588   \u2591\u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588  \u2588 \u2591  \u2588\u2588\u2588     \u2591\u2591\u2591  \u2588\u2588\u2588     \u2591\u2591\u2588\u2588\u2588"," \u2591\u2588\u2588\u2588    \u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588\u2588\u2588\u2588   \u2591\u2588\u2588\u2588         \u2591\u2588\u2588\u2588      \u2591\u2588\u2588\u2588"," \u2591\u2588\u2588\u2588    \u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588\u2591\u2591\u2588   \u2591\u2588\u2588\u2588         \u2591\u2588\u2588\u2588      \u2591\u2588\u2588\u2588"," \u2591\u2588\u2588\u2588    \u2588\u2588\u2588  \u2591\u2588\u2588\u2588 \u2591   \u2588\u2591\u2591\u2588\u2588\u2588     \u2588\u2588\u2588\u2591\u2591\u2588\u2588\u2588     \u2588\u2588\u2588 "," \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588 \u2591\u2591\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588  \u2591\u2591\u2591\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2591  ","\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591   \u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591   \u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591     \u2591\u2591\u2591\u2591\u2591\u2591\u2591   "],MN0=["#00ff64","#00ee5e","#00dc56","#00c84e","#00b444","#00a03c","#008832","#006e28"]});import{Box as jiu,Text as VT4}from"ink";import{jsx as Liu,jsxs as bT4}from"react/jsx-runtime";function hN0({version:$}){return bT4(jiu,{flexDirection:"column",marginTop:1,children:[qN0.map((u,f)=>Liu(VT4,{color:MN0[f],children:u},f)),bT4(VT4,{dimColor:!0,children:[" v",$]})]})}var pQ1=U(()=>{om()});var xT4={};Y1(xT4,{subscribeLinkState:()=>eQ1,setMachine:()=>Siu,setLogPath:()=>Riu,setIngress:()=>Iiu,setDaemonError:()=>kiu,setClusterUrl:()=>Aiu,setCluster:()=>Tiu,pushSandboxEvent:()=>Ciu,getLinkState:()=>sQ1,applySandboxEvent:()=>iT4});function iT4($,u){let f=new Map($);if(u.phase==="evicted"||u.phase==="deleted")return f.delete(u.handle),f;let X=f.get(u.handle);return f.set(u.handle,{handle:u.handle,port:u.port??X?.port??null,previewUrl:u.previewUrl??X?.previewUrl??null,status:u.phase,error:u.phase==="failed"?u.error??"failed":null}),f}function Mj(){for(let $ of oQ1)$()}function sQ1(){return C9}function eQ1($){return oQ1.add($),()=>oQ1.delete($)}function Tiu($){C9={...C9,cluster:$},Mj()}function Aiu($){C9={...C9,clusterUrl:$},Mj()}function Iiu($,u){C9={...C9,ingressPort:$,ingressUrl:u},Mj()}function Siu($){C9={...C9,machine:$},Mj()}function kiu($){C9={...C9,daemonError:$},Mj()}function Riu($){C9={...C9,logPath:$},Mj()}function Ciu($){C9={...C9,sandboxes:iT4(C9.sandboxes,$)},Mj()}var C9,oQ1;var $Y1=U(()=>{C9={cluster:"connecting",clusterUrl:null,ingressUrl:null,ingressPort:null,machine:null,cap:20,sandboxes:new Map,daemonError:null,logPath:null},oQ1=new Set});var lT4={};Y1(lT4,{LinkApp:()=>hiu});import{Box as q9,Text as M9}from"ink";import{useSyncExternalStore as qiu}from"react";import{jsx as mf,jsxs as tG}from"react/jsx-runtime";function Miu($){if($.status==="ready")return{color:"green",text:"\u25CF Live"};if($.status==="spawning")return{color:"yellow",text:"\u25CC Starting\u2026"};return{color:"red",text:`\u2717 Error: ${$.error??""}`}}function hiu(){let $=qiu(eQ1,sQ1),u=[...$.sandboxes.values()].sort((f,X)=>f.handle.localeCompare(X.handle));return tG(q9,{flexDirection:"column",children:[mf(hN0,{version:CN0.version}),mf(q9,{marginBottom:1,children:mf(M9,{dimColor:!0,children:"\u2500".repeat(80)})}),mf(q9,{children:$.cluster==="linked"?tG(M9,{color:"green",children:["\u2713 Connected to ",$.clusterUrl??"deco"]}):$.cluster==="connecting"?tG(M9,{color:"yellow",children:["\u25CC Connecting to ",$.clusterUrl??"deco","\u2026"]}):tG(M9,{color:"red",children:["\u2717 Disconnected from ",$.clusterUrl??"deco"]})}),mf(q9,{children:$.ingressUrl?tG(M9,{color:"green",children:["\u2713 Serving at ",$.ingressUrl]}):mf(M9,{dimColor:!0,children:"\u25CC Starting local server\u2026"})}),mf(q9,{marginBottom:1,children:mf(M9,{dimColor:!0,children:`${"Computer".padEnd(16)}${$.machine??"this computer"} \xB7 ${u.length} of ${$.cap} previews`})}),u.length===0?mf(M9,{dimColor:!0,children:"No previews running yet."}):tG(q9,{flexDirection:"column",children:[tG(q9,{children:[mf(q9,{width:yN0.project,flexShrink:0,marginRight:1,children:mf(M9,{dimColor:!0,wrap:"truncate-end",children:"PROJECT"})}),mf(q9,{width:yN0.status,flexShrink:0,marginRight:1,children:mf(M9,{dimColor:!0,wrap:"truncate-end",children:"STATUS"})}),mf(q9,{flexGrow:1,children:mf(M9,{dimColor:!0,wrap:"truncate-end",children:"PREVIEW URL"})})]}),u.map((f)=>{let X=Miu(f);return tG(q9,{children:[mf(q9,{width:yN0.project,flexShrink:0,marginRight:1,children:mf(M9,{wrap:"truncate-end",children:f.handle})}),mf(q9,{width:yN0.status,flexShrink:0,marginRight:1,children:mf(M9,{color:X.color,wrap:"truncate-end",children:X.text})}),mf(q9,{flexGrow:1,children:mf(M9,{dimColor:!0,wrap:"truncate-end",children:f.previewUrl??"\u2014"})})]},f.handle)})]}),$.daemonError?mf(q9,{marginTop:1,children:tG(M9,{color:"red",children:["\u26A0 ",$.daemonError]})}):null,$.logPath?mf(q9,{marginTop:1,children:tG(M9,{dimColor:!0,children:["Logs: ",$.logPath]})}):null]})}var yN0;var cT4=U(()=>{aQ1();pQ1();$Y1();yN0={project:18,status:14}});var mT4={};Y1(mT4,{runLinkCommand:()=>ciu});import{closeSync as yiu,mkdirSync as giu,openSync as Viu,writeSync as biu}from"fs";import{homedir as iiu}from"os";import{join as dT4}from"path";function xiu($,u){let f={log:console.log,warn:console.warn,error:console.error},X=(J)=>{if(u===void 0)return;try{biu(u,`${rQ1(J)}
+Shutting down\u2026`);try{await W.close()}catch{}try{await Y.stop()}catch{}try{await Q.shutdown()}catch{}F(0)};return process.on("SIGINT",()=>void N()),process.on("SIGTERM",()=>void N()),W.closed.then(()=>{if($.monitor?.onCluster?.("closed"),!v)console.error("Cluster connection closed permanently; exiting."),N()}),{stopped:B,stop:N}}var yT4=U(()=>{M91();Yj4();Zj4();Wj4();NT4();ST4();RT4();MT4()});function rQ1($){return $.map((u)=>typeof u==="string"?u:String(u)).join(" ")}var CN0;var aQ1=U(()=>{CN0={name:"decocms",version:"2.389.3",description:"Deco CMS \u2014 Self-hostable MCP Gateway for managing AI connections and tools",author:"Deco team",repository:{type:"git",url:"git+https://github.com/decocms/studio.git",directory:"apps/mesh"},bugs:{url:"https://github.com/decocms/studio/issues"},type:"module",bin:{deco:"./dist/server/cli.js"},files:["dist/**/*"],scripts:{dev:'bun run migrate && concurrently "bun run dev:client" "bun run dev:server"',"dev:servers":'concurrently "bun run dev:client" "bun run dev:server"',"dev:client":"bun --bun vite dev","dev:server":"bun run --cwd=../../packages/sandbox build && NODE_ENV=development bun --env-file=.env --hot run src/index.ts","build:client":"bun --bun vite build","build:server":"bun run scripts/bundle-server-script.ts --dist ./dist/server","db:migrate":"bun run ./dist/server/migrate.js",check:"tsc --noEmit",start:"bun run ./dist/server/server.js",migrate:"bun run src/database/migrate.ts",test:"bun test","test:e2e":"playwright test","test:e2e:ui":"playwright test --ui","better-auth:migrate":"bunx --bun @better-auth/cli migrate -y --config src/auth/index.ts","smoke:link":"bun run scripts/smoke-link.ts",prepublishOnly:"bun run build:client && bun run build:server"},optionalDependencies:{"@anthropic-ai/claude-agent-sdk":"^0.2.141","@duckdb/node-api":"^1.5.0-r.1"},dependencies:{"@ai-sdk/anthropic":"^3.0.80","@ai-sdk/google":"^3.0.80","@ai-sdk/openai":"^3.0.65","@anthropic-ai/sdk":"^0.96.0","@aws-sdk/client-s3":"^3.1013.0","@aws-sdk/lib-storage":"^3.1013.0","@aws-sdk/s3-request-presigner":"^3.1013.0","@clickhouse/client":"^1.8.1","@dbos-inc/dbos-sdk":"^4.17.6","@dnd-kit/core":"^6.3.1","@dnd-kit/sortable":"^10.0.0","@dnd-kit/utilities":"^3.2.2","@inkjs/ui":"^2.0.0","@modelcontextprotocol/ext-apps":"^1.7.1","@openrouter/ai-sdk-provider":"^2.9.0","@opentelemetry/core":"^2.6.0","@tanstack/react-virtual":"3.13.24","@xterm/addon-fit":"^0.11.0","@xterm/xterm":"^6.0.0","ai-sdk-provider-claude-code":"^3.4.4","ai-sdk-provider-codex-cli":"^1.1.0","embedded-postgres":"^18.3.0-beta.16",ink:"^6.8.0",kysely:"^0.28.12",nats:"^2.29.3","node-pty":"^1.0.0","posthog-js":"^1.371.1","posthog-node":"^5.0.0",react:"^19.2.6","react-dom":"^19.2.6"},devDependencies:{"@ai-sdk/provider":"^3.0.10","@ai-sdk/react":"^3.0.193","@better-auth/sso":"1.4.1","@daveyplate/better-auth-ui":"^3.2.7","@deco/ui":"workspace:*","@decocms/better-auth":"1.5.17","@decocms/bindings":"workspace:*","@decocms/mcp-utils":"workspace:*","@decocms/mesh-sdk":"workspace:*","@decocms/runtime":"workspace:*","@decocms/std":"workspace:*","@decocms/vite-plugin":"workspace:*","@floating-ui/react":"^0.27.16","@happy-dom/global-registrator":"^20.9.0","@hookform/resolvers":"^5.2.2","@jitl/quickjs-wasmfile-release-sync":"0.31.0","@modelcontextprotocol/sdk":"1.29.0","@monaco-editor/react":"^4.7.0","@opentelemetry/api":"^1.9.0","@opentelemetry/api-logs":"^0.211.0","@opentelemetry/exporter-logs-otlp-proto":"^0.211.0","@opentelemetry/exporter-prometheus":"^0.208.0","@opentelemetry/exporter-trace-otlp-proto":"^0.207.0","@opentelemetry/instrumentation-runtime-node":"^0.24.0","@opentelemetry/resources":"^2.6.0","@opentelemetry/sdk-logs":"^0.211.0","@opentelemetry/sdk-metrics":"^2.2.0","@opentelemetry/sdk-node":"^0.207.0","@opentelemetry/sdk-trace-base":"^2.5.0","@playwright/test":"^1.58.2","@radix-ui/react-avatar":"^1.1.10","@radix-ui/react-checkbox":"^1.3.3","@radix-ui/react-dialog":"^1.1.15","@radix-ui/react-dropdown-menu":"^2.1.16","@radix-ui/react-label":"^2.1.7","@radix-ui/react-select":"^2.2.6","@radix-ui/react-separator":"^1.1.7","@radix-ui/react-slot":"^1.2.3","@radix-ui/react-tabs":"^1.1.13","@rjsf/core":"^6.1.2","@rjsf/shadcn":"^6.1.2","@rjsf/utils":"^6.1.2","@rjsf/validator-ajv8":"^6.1.2","@tailwindcss/vite":"^4.1.17","@tanstack/react-query":"5.100.10","@tanstack/react-router":"1.169.2","@testing-library/jest-dom":"^6.9.1","@testing-library/react":"^16.3.2","@tiptap/core":"3.20.2","@tiptap/extension-mention":"3.20.2","@tiptap/extension-placeholder":"3.20.2","@tiptap/pm":"3.20.2","@tiptap/react":"3.20.2","@tiptap/starter-kit":"3.20.2","@tiptap/suggestion":"3.20.2","@types/bun":"^1.3.1","@types/pg":"^8.15.6","@types/react-syntax-highlighter":"^15.5.13","@untitledui/icons":"^0.0.19","@vercel/nft":"^1.1.1","@vitejs/plugin-react":"^5.1.0",ai:"^6.0.191","babel-plugin-react-compiler":"^1.0.0","better-auth":"1.4.22","class-variance-authority":"^0.7.1",clsx:"^2.1.1",concurrently:"^9.2.1",croner:"^9.1.0","date-fns":"^4.1.0",degit:"^2.8.4",hono:"^4.10.7","input-otp":"^1.4.2",jose:"^6.0.11","lucide-react":"^0.468.0",marked:"^15.0.6","@decocms/sandbox":"workspace:*","mesh-plugin-workflows":"workspace:*",nanoid:"^5.1.6",pg:"^8.16.3",prettier:"^3.4.2","react-hook-form":"^7.66.0","react-markdown":"^10.1.0","react-resizable-panels":"^2.1.7","react-syntax-highlighter":"^15.6.1",recharts:"^3.6.0","rehype-raw":"^7.0.0","remark-gfm":"^4.0.0","sass-embedded":"^1.97.2",sonner:"^2.0.7","tailwind-merge":"^3.3.1",tailwindcss:"^4.1.17",typescript:"^5.9.3",vite:"^7.2.1","vite-tsconfig-paths":"^5.1.4",zod:"^4.0.0",zustand:"^5.0.9"},homepage:"https://github.com/decocms/studio",keywords:["mcp","model-context-protocol","ai","gateway","self-hosted","mesh","tools"],license:"MIT",publishConfig:{access:"public"}}});var zu0={};Y1(zu0,{printBanner:()=>Piu,bannerLines:()=>gT4,BANNER_LINES:()=>qN0,BANNER_GRADIENT:()=>MN0});function _iu($){let u=Number.parseInt($.slice(1),16);return[u>>16&255,u>>8&255,u&255]}function gT4($){let u=qN0.map((f,X)=>{let[J,w,E]=_iu(MN0[X]);return`\x1B[38;2;${J};${w};${E}m${f}\x1B[39m`});if($!==void 0)u.push(`\x1B[2m  v${$}\x1B[22m`);return u}function Piu($){console.log("");for(let u of gT4($))console.log(u);console.log("")}var qN0,MN0;var om=U(()=>{qN0=[" \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588     \u2588\u2588\u2588\u2588\u2588\u2588\u2588   ","\u2591\u2591\u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2588\u2588\u2588 \u2591\u2591\u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2591\u2588  \u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2591\u2588\u2588\u2588  \u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2591\u2588\u2588\u2588 "," \u2591\u2588\u2588\u2588   \u2591\u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588  \u2588 \u2591  \u2588\u2588\u2588     \u2591\u2591\u2591  \u2588\u2588\u2588     \u2591\u2591\u2588\u2588\u2588"," \u2591\u2588\u2588\u2588    \u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588\u2588\u2588\u2588   \u2591\u2588\u2588\u2588         \u2591\u2588\u2588\u2588      \u2591\u2588\u2588\u2588"," \u2591\u2588\u2588\u2588    \u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588\u2591\u2591\u2588   \u2591\u2588\u2588\u2588         \u2591\u2588\u2588\u2588      \u2591\u2588\u2588\u2588"," \u2591\u2588\u2588\u2588    \u2588\u2588\u2588  \u2591\u2588\u2588\u2588 \u2591   \u2588\u2591\u2591\u2588\u2588\u2588     \u2588\u2588\u2588\u2591\u2591\u2588\u2588\u2588     \u2588\u2588\u2588 "," \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588 \u2591\u2591\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588  \u2591\u2591\u2591\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2591  ","\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591   \u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591   \u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591     \u2591\u2591\u2591\u2591\u2591\u2591\u2591   "],MN0=["#00ff64","#00ee5e","#00dc56","#00c84e","#00b444","#00a03c","#008832","#006e28"]});import{Box as jiu,Text as VT4}from"ink";import{jsx as Liu,jsxs as bT4}from"react/jsx-runtime";function hN0({version:$}){return bT4(jiu,{flexDirection:"column",marginTop:1,children:[qN0.map((u,f)=>Liu(VT4,{color:MN0[f],children:u},f)),bT4(VT4,{dimColor:!0,children:[" v",$]})]})}var pQ1=U(()=>{om()});var xT4={};Y1(xT4,{subscribeLinkState:()=>eQ1,setMachine:()=>Siu,setLogPath:()=>Riu,setIngress:()=>Iiu,setDaemonError:()=>kiu,setClusterUrl:()=>Aiu,setCluster:()=>Tiu,pushSandboxEvent:()=>Ciu,getLinkState:()=>sQ1,applySandboxEvent:()=>iT4});function iT4($,u){let f=new Map($);if(u.phase==="evicted"||u.phase==="deleted")return f.delete(u.handle),f;let X=f.get(u.handle);return f.set(u.handle,{handle:u.handle,port:u.port??X?.port??null,previewUrl:u.previewUrl??X?.previewUrl??null,status:u.phase,error:u.phase==="failed"?u.error??"failed":null}),f}function Mj(){for(let $ of oQ1)$()}function sQ1(){return C9}function eQ1($){return oQ1.add($),()=>oQ1.delete($)}function Tiu($){C9={...C9,cluster:$},Mj()}function Aiu($){C9={...C9,clusterUrl:$},Mj()}function Iiu($,u){C9={...C9,ingressPort:$,ingressUrl:u},Mj()}function Siu($){C9={...C9,machine:$},Mj()}function kiu($){C9={...C9,daemonError:$},Mj()}function Riu($){C9={...C9,logPath:$},Mj()}function Ciu($){C9={...C9,sandboxes:iT4(C9.sandboxes,$)},Mj()}var C9,oQ1;var $Y1=U(()=>{C9={cluster:"connecting",clusterUrl:null,ingressUrl:null,ingressPort:null,machine:null,cap:20,sandboxes:new Map,daemonError:null,logPath:null},oQ1=new Set});var lT4={};Y1(lT4,{LinkApp:()=>hiu});import{Box as q9,Text as M9}from"ink";import{useSyncExternalStore as qiu}from"react";import{jsx as mf,jsxs as tG}from"react/jsx-runtime";function Miu($){if($.status==="ready")return{color:"green",text:"\u25CF Live"};if($.status==="spawning")return{color:"yellow",text:"\u25CC Starting\u2026"};return{color:"red",text:`\u2717 Error: ${$.error??""}`}}function hiu(){let $=qiu(eQ1,sQ1),u=[...$.sandboxes.values()].sort((f,X)=>f.handle.localeCompare(X.handle));return tG(q9,{flexDirection:"column",children:[mf(hN0,{version:CN0.version}),mf(q9,{marginBottom:1,children:mf(M9,{dimColor:!0,children:"\u2500".repeat(80)})}),mf(q9,{children:$.cluster==="linked"?tG(M9,{color:"green",children:["\u2713 Connected to ",$.clusterUrl??"deco"]}):$.cluster==="connecting"?tG(M9,{color:"yellow",children:["\u25CC Connecting to ",$.clusterUrl??"deco","\u2026"]}):tG(M9,{color:"red",children:["\u2717 Disconnected from ",$.clusterUrl??"deco"]})}),mf(q9,{children:$.ingressUrl?tG(M9,{color:"green",children:["\u2713 Serving at ",$.ingressUrl]}):mf(M9,{dimColor:!0,children:"\u25CC Starting local server\u2026"})}),mf(q9,{marginBottom:1,children:mf(M9,{dimColor:!0,children:`${"Computer".padEnd(16)}${$.machine??"this computer"} \xB7 ${u.length} of ${$.cap} previews`})}),u.length===0?mf(M9,{dimColor:!0,children:"No previews running yet."}):tG(q9,{flexDirection:"column",children:[tG(q9,{children:[mf(q9,{width:yN0.project,flexShrink:0,marginRight:1,children:mf(M9,{dimColor:!0,wrap:"truncate-end",children:"PROJECT"})}),mf(q9,{width:yN0.status,flexShrink:0,marginRight:1,children:mf(M9,{dimColor:!0,wrap:"truncate-end",children:"STATUS"})}),mf(q9,{flexGrow:1,children:mf(M9,{dimColor:!0,wrap:"truncate-end",children:"PREVIEW URL"})})]}),u.map((f)=>{let X=Miu(f);return tG(q9,{children:[mf(q9,{width:yN0.project,flexShrink:0,marginRight:1,children:mf(M9,{wrap:"truncate-end",children:f.handle})}),mf(q9,{width:yN0.status,flexShrink:0,marginRight:1,children:mf(M9,{color:X.color,wrap:"truncate-end",children:X.text})}),mf(q9,{flexGrow:1,children:mf(M9,{dimColor:!0,wrap:"truncate-end",children:f.previewUrl??"\u2014"})})]},f.handle)})]}),$.daemonError?mf(q9,{marginTop:1,children:tG(M9,{color:"red",children:["\u26A0 ",$.daemonError]})}):null,$.logPath?mf(q9,{marginTop:1,children:tG(M9,{dimColor:!0,children:["Logs: ",$.logPath]})}):null]})}var yN0;var cT4=U(()=>{aQ1();pQ1();$Y1();yN0={project:18,status:14}});var mT4={};Y1(mT4,{runLinkCommand:()=>ciu});import{closeSync as yiu,mkdirSync as giu,openSync as Viu,writeSync as biu}from"fs";import{homedir as iiu}from"os";import{join as dT4}from"path";function xiu($,u){let f={log:console.log,warn:console.warn,error:console.error},X=(J)=>{if(u===void 0)return;try{biu(u,`${rQ1(J)}
 `)}catch{}};return console.log=(...J)=>X(J),console.warn=(...J)=>X(J),console.error=(...J)=>{X(J),$(rQ1(J))},()=>{console.log=f.log,console.warn=f.warn,console.error=f.error}}async function liu($,u){let f;try{f=await fetch(`${$}/api/links/me`,{headers:{authorization:`Bearer ${u}`},signal:AbortSignal.timeout(1e4)})}catch{return}if(f.status===401||f.status===403)throw Error(`Authentication rejected by ${$} \u2014 the session token was not accepted. `+`Run \`deco auth login --target ${$}\` and try again.`)}async function ciu($={}){let u=$.port??5174,f=$.dataDir??process.env.DATA_DIR??process.env.DECOCMS_HOME??dT4(iiu(),"deco"),X=$.clusterBaseUrl??process.env.MESH_CLUSTER_URL??"https://studio.decocms.com",J,w;try{let E=await pP4({dataDir:f,intent:"Link",target:X});if(process.env.DECOCMS_LINK_MANAGED!=="1")await liu(X,E.accessToken);let Q;if($.tui){let{render:Z}=await import("ink"),{createElement:G}=await import("react"),{LinkApp:W}=await Promise.resolve().then(() => (cT4(),lT4)),{pushSandboxEvent:F,setCluster:B,setClusterUrl:v,setDaemonError:N,setIngress:O,setLogPath:z,setMachine:H}=await Promise.resolve().then(() => ($Y1(),xT4));giu(f,{recursive:!0});let _=dT4(f,"link.log");w=Viu(_,"a"),z(_),v(X),B("connecting"),Q={onEvent:(T)=>F(T),onIngress:(T)=>O(T,`http://127.0.0.1:${T}`),onCluster:(T)=>B(T),onMachine:(T)=>H(T)},J=xiu(N,w),Z(G(W),{patchConsole:!1})}else if($.banner!==!1){let{printBanner:Z}=await Promise.resolve().then(() => (om(),zu0));Z($.version??"0.0.0")}return await(await hT4({port:u,clusterBaseUrl:X,dataDir:f,session:E,monitor:Q,logFd:w})).stopped}catch(E){return J?.(),console.error(E instanceof Error?E.message:String(E)),1}finally{if(J?.(),w!==void 0)try{yiu(w)}catch{}}}var nT4=U(()=>{oP4();yT4()});var Ku0,diu,miu,niu,rT4=($,u)=>{let f={};for(var X in $)Ku0(f,X,{get:$[X],enumerable:!0});if(u)Ku0(f,Symbol.toStringTag,{value:"Module"});return f},tT4=($,u,f,X)=>{if(u&&typeof u==="object"||typeof u==="function"){for(var J=miu(u),w=0,E=J.length,Q;w<E;w++)if(Q=J[w],!niu.call($,Q)&&Q!==f)Ku0($,Q,{get:((Y)=>u[Y]).bind(null,Q),enumerable:!(X=diu(u,Q))||X.enumerable})}return $},aT4=($,u,f,X)=>{if(X)Ku0($,Symbol.toStringTag,{value:"Module"}),f&&Ku0(f,Symbol.toStringTag,{value:"Module"});tT4($,u,"default"),f&&tT4(f,u,"default")};var pT4=U(()=>{Ku0=Object.defineProperty,diu=Object.getOwnPropertyDescriptor,miu=Object.getOwnPropertyNames,niu=Object.prototype.hasOwnProperty});var ZE=($)=>{let u=($.plugins??[]).reduce((G,W)=>{let F=W.schema;if(!F)return G;for(let[B,v]of Object.entries(F))G[B]={fields:{...G[B]?.fields,...v.fields},modelName:v.modelName||B};return G},{}),f=$.rateLimit?.storage==="database",X={rateLimit:{modelName:$.rateLimit?.modelName||"rateLimit",fields:{key:{type:"string",unique:!0,required:!0,fieldName:$.rateLimit?.fields?.key||"key"},count:{type:"number",required:!0,fieldName:$.rateLimit?.fields?.count||"count"},lastRequest:{type:"number",bigint:!0,required:!0,fieldName:$.rateLimit?.fields?.lastRequest||"lastRequest",defaultValue:()=>Date.now()}}}},{user:J,session:w,account:E,verification:Q,...Y}=u,Z={session:{modelName:$.session?.modelName||"session",fields:{expiresAt:{type:"date",required:!0,fieldName:$.session?.fields?.expiresAt||"expiresAt"},token:{type:"string",required:!0,fieldName:$.session?.fields?.token||"token",unique:!0},createdAt:{type:"date",required:!0,fieldName:$.session?.fields?.createdAt||"createdAt",defaultValue:()=>new Date},updatedAt:{type:"date",required:!0,fieldName:$.session?.fields?.updatedAt||"updatedAt",onUpdate:()=>new Date},ipAddress:{type:"string",required:!1,fieldName:$.session?.fields?.ipAddress||"ipAddress"},userAgent:{type:"string",required:!1,fieldName:$.session?.fields?.userAgent||"userAgent"},userId:{type:"string",fieldName:$.session?.fields?.userId||"userId",references:{model:$.user?.modelName||"user",field:"id",onDelete:"cascade"},required:!0,index:!0},...w?.fields,...$.session?.additionalFields},order:2}};return{user:{modelName:$.user?.modelName||"user",fields:{name:{type:"string",required:!0,fieldName:$.user?.fields?.name||"name",sortable:!0},email:{type:"string",unique:!0,required:!0,fieldName:$.user?.fields?.email||"email",sortable:!0},emailVerified:{type:"boolean",defaultValue:!1,required:!0,fieldName:$.user?.fields?.emailVerified||"emailVerified",input:!1},image:{type:"string",required:!1,fieldName:$.user?.fields?.image||"image"},createdAt:{type:"date",defaultValue:()=>new Date,required:!0,fieldName:$.user?.fields?.createdAt||"createdAt"},updatedAt:{type:"date",defaultValue:()=>new Date,onUpdate:()=>new Date,required:!0,fieldName:$.user?.fields?.updatedAt||"updatedAt"},...J?.fields,...$.user?.additionalFields},order:1},...!$.secondaryStorage||$.session?.storeSessionInDatabase?Z:{},account:{modelName:$.account?.modelName||"account",fields:{accountId:{type:"string",required:!0,fieldName:$.account?.fields?.accountId||"accountId"},providerId:{type:"string",required:!0,fieldName:$.account?.fields?.providerId||"providerId"},userId:{type:"string",references:{model:$.user?.modelName||"user",field:"id",onDelete:"cascade"},required:!0,fieldName:$.account?.fields?.userId||"userId",index:!0},accessToken:{type:"string",required:!1,returned:!1,fieldName:$.account?.fields?.accessToken||"accessToken"},refreshToken:{type:"string",required:!1,returned:!1,fieldName:$.account?.fields?.refreshToken||"refreshToken"},idToken:{type:"string",required:!1,returned:!1,fieldName:$.account?.fields?.idToken||"idToken"},accessTokenExpiresAt:{type:"date",required:!1,returned:!1,fieldName:$.account?.fields?.accessTokenExpiresAt||"accessTokenExpiresAt"},refreshTokenExpiresAt:{type:"date",required:!1,returned:!1,fieldName:$.account?.fields?.refreshTokenExpiresAt||"refreshTokenExpiresAt"},scope:{type:"string",required:!1,fieldName:$.account?.fields?.scope||"scope"},password:{type:"string",required:!1,returned:!1,fieldName:$.account?.fields?.password||"password"},createdAt:{type:"date",required:!0,fieldName:$.account?.fields?.createdAt||"createdAt",defaultValue:()=>new Date},updatedAt:{type:"date",required:!0,fieldName:$.account?.fields?.updatedAt||"updatedAt",onUpdate:()=>new Date},...E?.fields,...$.account?.additionalFields},order:3},verification:{modelName:$.verification?.modelName||"verification",fields:{identifier:{type:"string",required:!0,fieldName:$.verification?.fields?.identifier||"identifier",index:!0},value:{type:"string",required:!0,fieldName:$.verification?.fields?.value||"value"},expiresAt:{type:"date",required:!0,fieldName:$.verification?.fields?.expiresAt||"expiresAt"},createdAt:{type:"date",required:!0,defaultValue:()=>new Date,fieldName:$.verification?.fields?.createdAt||"createdAt"},updatedAt:{type:"date",required:!0,defaultValue:()=>new Date,onUpdate:()=>new Date,fieldName:$.verification?.fields?.updatedAt||"updatedAt"},...Q?.fields,...$.verification?.additionalFields},order:4},...Y,...f?X:{}}};var uY1=()=>{};var rG;var sm=U(()=>{m0();rG=f0({id:C(),createdAt:q$().default(()=>new Date),updatedAt:q$().default(()=>new Date)})});var oT4;var sT4=U(()=>{sm();m0();oT4=rG.extend({providerId:C(),accountId:C(),userId:V4.string(),accessToken:C().nullish(),refreshToken:C().nullish(),idToken:C().nullish(),accessTokenExpiresAt:q$().nullish(),refreshTokenExpiresAt:q$().nullish(),scope:C().nullish(),password:C().nullish()})});var eT4;var $A4=U(()=>{m0();eT4=f0({key:C(),count:i1(),lastRequest:i1()})});var uA4;var fA4=U(()=>{sm();m0();uA4=rG.extend({userId:V4.string(),expiresAt:q$(),token:C(),ipAddress:C().nullish(),userAgent:C().nullish()})});var XA4;var JA4=U(()=>{sm();m0();XA4=rG.extend({email:C().transform(($)=>$.toLowerCase()),emailVerified:R1().default(!1),name:C(),image:C().nullish()})});var wA4;var EA4=U(()=>{sm();m0();wA4=rG.extend({value:C(),expiresAt:q$(),identifier:C()})});var fY1={};Y1(fY1,{verificationSchema:()=>wA4,userSchema:()=>XA4,sessionSchema:()=>uA4,rateLimitSchema:()=>eT4,getAuthTables:()=>ZE,coreSchema:()=>rG,accountSchema:()=>oT4});var rO=U(()=>{uY1();sm();sT4();$A4();fA4();JA4();EA4()});function tiu($){return $?$!=="false":!1}function H3($,u){if(typeof process<"u"&&process.env)return process.env[$]??u;if(typeof Deno<"u")return Deno.env.get($)??u;if(typeof Bun<"u")return Bun.env[$]??u;return u}function VN0($,u=!0){let f=H3($);if(!f)return u;return f!=="0"&&f.toLowerCase()!=="false"&&f!==""}var gN0,Hu0=($)=>globalThis.process?.env||globalThis.Deno?.env.toObject()||globalThis.__env__||($?gN0:globalThis),P6,_u0,xB,hj=()=>_u0==="dev"||_u0==="development",lB=()=>_u0==="test"||tiu(P6.TEST),XY1;var JY1=U(()=>{gN0=Object.create(null),P6=new Proxy(gN0,{get($,u){return Hu0()[u]??gN0[u]},has($,u){return u in Hu0()||u in gN0},set($,u,f){let X=Hu0(!0);return X[u]=f,!0},deleteProperty($,u){if(!u)return!1;let f=Hu0(!0);return delete f[u],!0},ownKeys(){let $=Hu0(!0);return Object.keys($)}});_u0=typeof process<"u"&&process.env&&"production"||"",xB=_u0==="production";XY1=Object.freeze({get BETTER_AUTH_SECRET(){return H3("BETTER_AUTH_SECRET")},get AUTH_SECRET(){return H3("AUTH_SECRET")},get BETTER_AUTH_TELEMETRY(){return H3("BETTER_AUTH_TELEMETRY")},get BETTER_AUTH_TELEMETRY_ID(){return H3("BETTER_AUTH_TELEMETRY_ID")},get NODE_ENV(){return H3("NODE_ENV","development")},get PACKAGE_VERSION(){return H3("PACKAGE_VERSION","0.0.0")},get BETTER_AUTH_TELEMETRY_ENDPOINT(){return H3("BETTER_AUTH_TELEMETRY_ENDPOINT","")}})});function ju0(){if(H3("FORCE_COLOR")!==void 0)switch(H3("FORCE_COLOR")){case"":case"1":case"true":return aX;case"2":return aG;case"3":return kQ;default:return Pu0}if(H3("NODE_DISABLE_COLORS")!==void 0&&H3("NODE_DISABLE_COLORS")!==""||H3("NO_COLOR")!==void 0&&H3("NO_COLOR")!==""||H3("TERM")==="dumb")return Pu0;if(H3("TMUX"))return kQ;if("TF_BUILD"in P6&&"AGENT_NAME"in P6)return aX;if("CI"in P6){for(let{0:$,1:u}of riu)if($ in P6)return u;if(H3("CI_NAME")==="codeship")return aG;return Pu0}if("TEAMCITY_VERSION"in P6)return/^(9\.(0*[1-9]\d*)\.|\d{2,}\.)/.exec(H3("TEAMCITY_VERSION"))!==null?aX:Pu0;switch(H3("TERM_PROGRAM")){case"iTerm.app":if(!H3("TERM_PROGRAM_VERSION")||/^[0-2]\./.exec(H3("TERM_PROGRAM_VERSION"))!==null)return aG;return kQ;case"HyperTerm":case"MacTerm":return kQ;case"Apple_Terminal":return aG}if(H3("COLORTERM")==="truecolor"||H3("COLORTERM")==="24bit")return kQ;if(H3("TERM")){if(/truecolor/.exec(H3("TERM"))!==null)return kQ;if(/^xterm-256/.exec(H3("TERM"))!==null)return aG;let $=H3("TERM").toLowerCase();if(QA4[$])return QA4[$];if(aiu.some((u)=>u.exec($)!==null))return aX}if(H3("COLORTERM"))return aX;return Pu0}var Pu0=1,aX=4,aG=8,kQ=24,QA4,riu,aiu;var bN0=U(()=>{JY1();QA4={eterm:aX,cons25:aX,console:aX,cygwin:aX,dtterm:aX,gnome:aX,hurd:aX,jfbterm:aX,konsole:aX,kterm:aX,mlterm:aX,mosh:kQ,putty:aX,st:aX,"rxvt-unicode-24bit":kQ,terminator:kQ,"xterm-kitty":kQ},riu=new Map(Object.entries({APPVEYOR:aG,BUILDKITE:aG,CIRCLECI:kQ,DRONE:aG,GITEA_ACTIONS:kQ,GITHUB_ACTIONS:kQ,GITLAB_CI:aG,TRAVIS:aG})),aiu=[/ansi/,/color/,/linux/,/direct/,/^con[0-9]*x[0-9]/,/^rxvt/,/^screen/,/^xterm/,/^vt100/,/^vt220/]});function em($,u){return iN0.indexOf(u)>=iN0.indexOf($)}var H8,iN0,piu,oiu=($,u,f)=>{let X=new Date().toISOString();if(f)return`${H8.dim}${X}${H8.reset} ${piu[$]}${$.toUpperCase()}${H8.reset} ${H8.bright}[Better Auth]:${H8.reset} ${u}`;return`${X} ${$.toUpperCase()} [Better Auth]: ${u}`},cB=($)=>{let u=$?.disabled!==!0,f=$?.level??"warn",X=$?.disableColors!==void 0?!$.disableColors:ju0()!==1,J=(w,E,Q=[])=>{if(!u||!em(f,w))return;let Y=oiu(w,E,X);if(!$||typeof $.log!=="function"){if(w==="error")console.error(Y,...Q);else if(w==="warn")console.warn(Y,...Q);else console.log(Y,...Q);return}$.log(w==="success"?"info":w,E,...Q)};return{...Object.fromEntries(iN0.map((w)=>[w,(...[E,...Q])=>J(w,E,Q)])),get level(){return f}}},F$;var h9=U(()=>{bN0();H8={reset:"\x1B[0m",bright:"\x1B[1m",dim:"\x1B[2m",undim:"\x1B[22m",underscore:"\x1B[4m",blink:"\x1B[5m",reverse:"\x1B[7m",hidden:"\x1B[8m",fg:{black:"\x1B[30m",red:"\x1B[31m",green:"\x1B[32m",yellow:"\x1B[33m",blue:"\x1B[34m",magenta:"\x1B[35m",cyan:"\x1B[36m",white:"\x1B[37m"},bg:{black:"\x1B[40m",red:"\x1B[41m",green:"\x1B[42m",yellow:"\x1B[43m",blue:"\x1B[44m",magenta:"\x1B[45m",cyan:"\x1B[46m",white:"\x1B[47m"}},iN0=["debug","info","success","warn","error"];piu={info:H8.fg.blue,success:H8.fg.green,warn:H8.fg.yellow,error:H8.fg.red,debug:H8.fg.magenta},F$=cB()});var _3=U(()=>{JY1();bN0();h9()});function i3($){return $}var wY1=()=>{};function xN0($,u){if(!$||!u)return $;let f=Object.entries(u).filter(([,{returned:X}])=>X===!1).map(([X])=>X);return Object.entries(structuredClone($)).filter(([X])=>!f.includes(X)).reduce((X,[J,w])=>({...X,[J]:w}),{})}var YA4=()=>{};function yj($,u,f){let X=!1;return function(...J){if(!X)(f?.warn??console.warn)(`[Deprecation] ${u}`),X=!0;return $.apply(this,J)}}var DA4=()=>{};function ZA4($){switch($){case"a-z":return"abcdefghijklmnopqrstuvwxyz";case"A-Z":return"ABCDEFGHIJKLMNOPQRSTUVWXYZ";case"0-9":return"0123456789";case"-_":return"-_";default:throw Error(`Unsupported alphabet: ${$}`)}}function pG(...$){let u=$.map(ZA4).join("");if(u.length===0)throw Error("No valid characters provided for random string generation.");let f=u.length;return(X,...J)=>{if(X<=0)throw Error("Length must be a positive integer.");let w=u,E=f;if(J.length>0)w=J.map(ZA4).join(""),E=w.length;let Q=Math.floor(256/E)*E,Y=new Uint8Array(X*2),Z=Y.length,G="",W=Z,F;while(G.length<X){if(W>=Z)crypto.getRandomValues(Y),W=0;if(F=Y[W++],F<Q)G+=w[F%E]}return G}}var $n=()=>{};var X8=($)=>{return pG("a-z","A-Z","0-9")($||32)};var EY1=U(()=>{$n()});function QY1($){return nG().safeParse($).success||mO().safeParse($).success}function siu($){return mO().safeParse($).success}function eiu($){let u=$.toLowerCase();if(u.startsWith("::ffff:")){let X=u.substring(7);if(nG().safeParse(X).success)return X}let f=$.split(":");if(f.length===7&&f[5]?.toLowerCase()==="ffff"){let X=f[6];if(X&&nG().safeParse(X).success)return X}if(u.includes("::ffff:")||u.includes(":ffff:")){let X=GA4($);if(X.length===8&&X[0]==="0000"&&X[1]==="0000"&&X[2]==="0000"&&X[3]==="0000"&&X[4]==="0000"&&X[5]==="ffff"&&X[6]&&X[7])return`${Number.parseInt(X[6].substring(0,2),16)}.${Number.parseInt(X[6].substring(2,4),16)}.${Number.parseInt(X[7].substring(0,2),16)}.${Number.parseInt(X[7].substring(2,4),16)}`}return null}function GA4($){if($.includes("::")){let u=$.split("::"),f=u[0]?u[0].split(":"):[],X=u[1]?u[1].split(":"):[],J=8-f.length-X.length,w=Array(J).fill("0000"),E=f.map((Y)=>Y.padStart(4,"0")),Q=X.map((Y)=>Y.padStart(4,"0"));return[...E,...w,...Q]}return $.split(":").map((u)=>u.padStart(4,"0"))}function $xu($,u){let f=GA4($);if(u&&u<128){let X=u;return f.map((J)=>{if(X<=0)return"0000";if(X>=16)return X-=16,J;let w=Number.parseInt(J,16)&(65535<<16-X&65535);return X=0,w.toString(16).padStart(4,"0")}).join(":").toLowerCase()}return f.join(":").toLowerCase()}function YY1($,u={}){if(nG().safeParse($).success)return $.toLowerCase();if(!siu($))return $.toLowerCase();let f=eiu($);if(f)return f.toLowerCase();return $xu($,u.ipv6Subnet||64)}function DY1($,u){return`${$}|${u}`}var WA4=U(()=>{m0()});function Vu($){function u(f,X){if(typeof X==="string"){if(/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?Z$/.test(X)){let J=new Date(X);if(!isNaN(J.getTime()))return J}}return X}try{if(typeof $!=="string")return $;return JSON.parse($,u)}catch(f){return F$.error("Error parsing JSON",{error:f}),null}}var ZY1=U(()=>{h9();_3()});var FA4=()=>{};function gj($,u){let f;try{f=new URL($).pathname.replace(/\/+$/,"")||"/"}catch{return"/"}if(u==="/"||u==="")return f;if(f===u)return"/";if(f.startsWith(u+"/"))return f.slice(u.length).replace(/\/+$/,"")||"/";return f}var BA4=()=>{};var u6=U(()=>{YA4();DA4();wY1();EY1();WA4();ZY1();FA4();BA4()});var Y4;var vA4=U(()=>{wY1();u6();Y4=i3({USER_NOT_FOUND:"User not found",FAILED_TO_CREATE_USER:"Failed to create user",FAILED_TO_CREATE_SESSION:"Failed to create session",FAILED_TO_UPDATE_USER:"Failed to update user",FAILED_TO_GET_SESSION:"Failed to get session",INVALID_PASSWORD:"Invalid password",INVALID_EMAIL:"Invalid email",INVALID_EMAIL_OR_PASSWORD:"Invalid email or password",SOCIAL_ACCOUNT_ALREADY_LINKED:"Social account already linked",PROVIDER_NOT_FOUND:"Provider not found",INVALID_TOKEN:"Invalid token",ID_TOKEN_NOT_SUPPORTED:"id_token not supported",FAILED_TO_GET_USER_INFO:"Failed to get user info",USER_EMAIL_NOT_FOUND:"User email not found",EMAIL_NOT_VERIFIED:"Email not verified",PASSWORD_TOO_SHORT:"Password too short",PASSWORD_TOO_LONG:"Password too long",USER_ALREADY_EXISTS:"User already exists.",USER_ALREADY_EXISTS_USE_ANOTHER_EMAIL:"User already exists. Use another email.",EMAIL_CAN_NOT_BE_UPDATED:"Email can not be updated",CREDENTIAL_ACCOUNT_NOT_FOUND:"Credential account not found",SESSION_EXPIRED:"Session expired. Re-authenticate to perform this action.",FAILED_TO_UNLINK_LAST_ACCOUNT:"You can't unlink your last account",ACCOUNT_NOT_FOUND:"Account not found",USER_ALREADY_HAS_PASSWORD:"User already has a password. Provide that to delete the account.",CROSS_SITE_NAVIGATION_LOGIN_BLOCKED:"Cross-site navigation login blocked. This request appears to be a CSRF attack.",VERIFICATION_EMAIL_NOT_ENABLED:"Verification email isn't enabled",EMAIL_ALREADY_VERIFIED:"Email is already verified",EMAIL_MISMATCH:"Email mismatch",SESSION_NOT_FRESH:"Session is not fresh",LINKED_ACCOUNT_ALREADY_EXISTS:"Linked account already exists",INVALID_ORIGIN:"Invalid origin",INVALID_CALLBACK_URL:"Invalid callbackURL",INVALID_REDIRECT_URL:"Invalid redirectURL",INVALID_ERROR_CALLBACK_URL:"Invalid errorCallbackURL",INVALID_NEW_USER_CALLBACK_URL:"Invalid newUserCallbackURL",MISSING_OR_NULL_ORIGIN:"Missing or null Origin",CALLBACK_URL_REQUIRED:"callbackURL is required",FAILED_TO_CREATE_VERIFICATION:"Unable to create verification",FIELD_NOT_ALLOWED:"Field not allowed to be set",ASYNC_VALIDATION_NOT_SUPPORTED:"Async validation is not supported",VALIDATION_ERROR:"Validation Error",MISSING_FIELD:"Field is required"})});var h4;var Bu=U(()=>{vA4();h4=class extends Error{constructor($,u){super($,u);this.name="BetterAuthError",this.message=$,this.stack=""}}});var RQ=({usePlural:$,schema:u})=>{return(X)=>{if($&&X.charAt(X.length-1)==="s"){let w=X.slice(0,-1),E=u[w]?w:void 0;if(!E)E=Object.entries(u).find(([Q,Y])=>Y.modelName===w)?.[0];if(E)return E}let J=u[X]?X:void 0;if(!J)J=Object.entries(u).find(([w,E])=>E.modelName===X)?.[0];if(!J)throw new h4(`Model "${X}" not found in schema`);return J}};var aO=U(()=>{Bu()});var Vj=({schema:$,usePlural:u})=>{let f=RQ({schema:$,usePlural:u});return({field:J,model:w})=>{if(J==="id"||J==="_id")return"id";let E=f(w),Q=$[E]?.fields[J];if(!Q){let Y=Object.entries($[E].fields).find(([Z,G])=>G.fieldName===J);if(Y)Q=Y[1],J=Y[0]}if(!Q)throw new h4(`Field ${J} not found in model ${E}`);return J}};var Lu0=U(()=>{Bu();aO()});var Tu0=({usePlural:$,schema:u,disableIdGeneration:f,options:X,customIdGenerator:J,supportsUUIDs:w})=>{let E=RQ({usePlural:$,schema:u});return({customModelName:Y,forceAllowId:Z})=>{let G=X.advanced?.database?.useNumberId||X.advanced?.database?.generateId==="serial",W=X.advanced?.database?.generateId==="uuid",F=(()=>{if(f)return!1;else if(G&&!Z)return!1;else if(W)return!w;else return!0})(),B=E(Y??"id");return{type:G?"number":"string",required:F?!0:!1,...F?{defaultValue(){if(f)return;let v=X.advanced?.database?.generateId;if(v===!1||G)return;if(typeof v==="function")return v({model:B});if(J)return J({model:B});if(v==="uuid")return crypto.randomUUID();return X8()}}:{},transform:{input:(v)=>{if(!v)return;if(G){let N=Number(v);if(isNaN(N))return;return N}if(W){if(F&&!Z)return v;if(f)return;if(w)return;if(Z&&typeof v==="string")if(/^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(v))return v;else{let N=Error().stack?.split(`
 `).filter((O,z)=>z!==1).join(`
 `).replace("Error:","");F$.warn("[Adapter Factory] - Invalid UUID value for field `id` provided when `forceAllowId` is true. Generating a new UUID.",N)}if(typeof v!=="string"&&!w)return crypto.randomUUID();return}return v},output:(v)=>{if(!v)return;return String(v)}}}}};var lN0=U(()=>{h9();_3();EY1();u6();aO()});var GY1=({usePlural:$,schema:u,options:f,customIdGenerator:X,disableIdGeneration:J})=>{let w=RQ({usePlural:$,schema:u}),E=Vj({usePlural:$,schema:u}),Q=Tu0({usePlural:$,schema:u,options:f,customIdGenerator:X,disableIdGeneration:J});return({model:Z,field:G})=>{let W=w(Z),F=E({field:G,model:W}),B=u[W].fields;B.id=Q({customModelName:W});let v=B[F];if(!v)throw new h4(`Field ${G} not found in model ${Z}`);return v}};var WY1=U(()=>{Bu();aO();Lu0();lN0()});var Au0=({schema:$,usePlural:u})=>{let f=RQ({schema:$,usePlural:u}),X=Vj({schema:$,usePlural:u});function J({model:w,field:E}){let Q=f(w),Y=X({model:Q,field:E});return $[Q]?.fields[Y]?.fieldName||Y}return J};var FY1=U(()=>{aO();Lu0()});var Iu0=({usePlural:$,schema:u})=>{let f=RQ({schema:u,usePlural:$});return(J)=>{let w=f(J);if(u&&u[w]&&u[w].modelName!==J)return $?`${u[w].modelName}s`:u[w].modelName;return $?`${J}s`:J}};var BY1=U(()=>{aO()});function vY1($,u,f){if(f==="update"){if($===void 0&&u.onUpdate!==void 0){if(typeof u.onUpdate==="function")return u.onUpdate();return u.onUpdate}return $}if(f==="create"){if($===void 0||u.required===!0&&$===null){if(u.defaultValue!==void 0){if(typeof u.defaultValue==="function")return u.defaultValue();return u.defaultValue}}}return $}var UY1=()=>{};function Hf($){if(ju0()<8)return`#${$}`;return`${H8.fg.magenta}#${$}${H8.reset}`}function _f($,u){return`${H8.bg.black}${H8.fg.yellow}[${$}/${u}]${H8.reset}`}function Pf($){return`${H8.bright}${$}${H8.reset}`}function GX($){return`${H8.dim}(${$})${H8.reset}`}var cN0,y9=-1,uxu=($)=>(u)=>u($),un=({adapter:$,config:u})=>(f)=>{let X=Math.random().toString(36).substring(2,15),J={...u,supportsBooleans:u.supportsBooleans??!0,supportsDates:u.supportsDates??!0,supportsJSON:u.supportsJSON??!1,adapterName:u.adapterName??u.adapterId,supportsNumericIds:u.supportsNumericIds??!0,supportsUUIDs:u.supportsUUIDs??!1,supportsArrays:u.supportsArrays??!1,transaction:u.transaction??!1,disableTransformInput:u.disableTransformInput??!1,disableTransformOutput:u.disableTransformOutput??!1,disableTransformJoin:u.disableTransformJoin??!1};if((f.advanced?.database?.useNumberId===!0||f.advanced?.database?.generateId==="serial")&&J.supportsNumericIds===!1)throw new h4(`[${J.adapterName}] Your database or database adapter does not support numeric ids. Please disable "useNumberId" in your config.`);let w=ZE(f),E=(...I)=>{if(J.debugLogs===!0||typeof J.debugLogs==="object"){let R=cB({level:"info"});if(typeof J.debugLogs==="object"&&"isRunningAdapterTests"in J.debugLogs){if(J.debugLogs.isRunningAdapterTests)I.shift(),cN0.push({instance:X,args:I});return}if(typeof J.debugLogs==="object"&&J.debugLogs.logCondition&&!J.debugLogs.logCondition?.())return;if(typeof I[0]==="object"&&"method"in I[0]){let S=I.shift().method;if(typeof J.debugLogs==="object"){if(S==="create"&&!J.debugLogs.create)return;else if(S==="update"&&!J.debugLogs.update)return;else if(S==="updateMany"&&!J.debugLogs.updateMany)return;else if(S==="findOne"&&!J.debugLogs.findOne)return;else if(S==="findMany"&&!J.debugLogs.findMany)return;else if(S==="delete"&&!J.debugLogs.delete)return;else if(S==="deleteMany"&&!J.debugLogs.deleteMany)return;else if(S==="count"&&!J.debugLogs.count)return}R.info(`[${J.adapterName}]`,...I)}else R.info(`[${J.adapterName}]`,...I)}},Q=cB(f.logger),Y=RQ({usePlural:J.usePlural,schema:w}),Z=Vj({usePlural:J.usePlural,schema:w}),G=Iu0({usePlural:J.usePlural,schema:w}),W=Au0({schema:w,usePlural:J.usePlural}),F=Tu0({schema:w,options:f,usePlural:J.usePlural,disableIdGeneration:J.disableIdGeneration,customIdGenerator:J.customIdGenerator,supportsUUIDs:J.supportsUUIDs}),B=GY1({schema:w,options:f,usePlural:J.usePlural,disableIdGeneration:J.disableIdGeneration,customIdGenerator:J.customIdGenerator}),v=async(I,R,S,q)=>{let y={},h=w[R].fields,i=J.mapKeysTransformInput??{},l=f.advanced?.database?.useNumberId||f.advanced?.database?.generateId==="serial";h.id=F({customModelName:R,forceAllowId:q&&"id"in I});for(let M in h){let x=I[M],r=h[M],p=i[M]||h[M].fieldName||M;if(x===void 0&&(r.defaultValue===void 0&&!r.transform?.input&&!(S==="update"&&r.onUpdate)||S==="update"&&!r.onUpdate))continue;if(r&&r.type==="date"&&!(x instanceof Date)&&typeof x==="string")try{x=new Date(x)}catch{Q.error("[Adapter Factory] Failed to convert string to date",{value:x,field:M})}let w0=vY1(x,r,S);if(r.transform?.input)w0=await r.transform.input(w0);if(r.references?.field==="id"&&l)if(Array.isArray(w0))w0=w0.map(($0)=>$0!==null?Number($0):null);else w0=w0!==null?Number(w0):null;else if(J.supportsJSON===!1&&typeof w0==="object"&&r.type==="json")w0=JSON.stringify(w0);else if(J.supportsArrays===!1&&Array.isArray(w0)&&(r.type==="string[]"||r.type==="number[]"))w0=JSON.stringify(w0);else if(J.supportsDates===!1&&w0 instanceof Date&&r.type==="date")w0=w0.toISOString();else if(J.supportsBooleans===!1&&typeof w0==="boolean")w0=w0?1:0;if(J.customTransformInput)w0=J.customTransformInput({data:w0,action:S,field:p,fieldAttributes:r,model:G(R),schema:w,options:f});if(w0!==void 0)y[p]=w0}return y},N=async(I,R,S=[],q)=>{let y=async(l,M,x=[])=>{if(!l)return null;let r=J.mapKeysTransformOutput??{},p={},w0=w[Y(M)].fields,$0=Object.entries(r).find(([E0,X0])=>X0==="id")?.[0];w0[$0??"id"]={type:f.advanced?.database?.useNumberId||f.advanced?.database?.generateId==="serial"?"number":"string"};for(let E0 in w0){if(x.length&&!x.includes(E0))continue;let X0=w0[E0];if(X0){let N0=X0.fieldName||E0,K0=l[Object.entries(r).find(([S0,G0])=>G0===N0)?.[0]||N0];if(X0.transform?.output)K0=await X0.transform.output(K0);let L0=r[E0]||E0;if(N0==="id"||X0.references?.field==="id"){if(typeof K0<"u"&&K0!==null)K0=String(K0)}else if(J.supportsJSON===!1&&typeof K0==="string"&&X0.type==="json")K0=Vu(K0);else if(J.supportsArrays===!1&&typeof K0==="string"&&(X0.type==="string[]"||X0.type==="number[]"))K0=Vu(K0);else if(J.supportsDates===!1&&typeof K0==="string"&&X0.type==="date")K0=new Date(K0);else if(J.supportsBooleans===!1&&typeof K0==="number"&&X0.type==="boolean")K0=K0===1;if(J.customTransformOutput)K0=J.customTransformOutput({data:K0,field:L0,fieldAttributes:X0,select:x,model:G(M),schema:w,options:f});p[L0]=K0}}return p};if(!q||Object.keys(q).length===0)return await y(I,R,S);R=Y(R);let h=await y(I,R,S),i=Object.entries(q).map(([l,M])=>({modelName:G(l),defaultModelName:Y(l),joinConfig:M}));if(!I)return null;for(let{modelName:l,defaultModelName:M,joinConfig:x}of i){let r=await(async()=>{if(f.experimental?.joins)return I[l];else return await H({baseModel:R,baseData:h,joinModel:l,specificJoinConfig:x})})();if(r===void 0||r===null)r=x.relation==="one-to-one"?null:[];if(x.relation==="one-to-many"&&!Array.isArray(r))r=[r];let p=[];if(Array.isArray(r))for(let w0 of r){let $0=await y(w0,l,[]);p.push($0)}else{let w0=await y(r,l,[]);p.push(w0)}h[M]=(x.relation==="one-to-one"?p[0]:p)??null}return h},O=({model:I,where:R,action:S})=>{if(!R)return;let q=J.mapKeysTransformInput??{};return R.map((y)=>{let{field:h,value:i,operator:l="eq",connector:M="AND"}=y;if(l==="in"){if(!Array.isArray(i))throw new h4("Value must be an array")}let x=i,r=Y(I),p=Z({field:h,model:I}),w0=q[p]||W({field:p,model:r}),$0=B({field:p,model:r}),E0=f.advanced?.database?.useNumberId||f.advanced?.database?.generateId==="serial";if(p==="id"||$0.references?.field==="id"){if(E0)if(Array.isArray(i))x=i.map(Number);else x=Number(i)}if($0.type==="date"&&i instanceof Date&&!J.supportsDates)x=i.toISOString();if($0.type==="boolean"&&typeof i==="boolean"&&!J.supportsBooleans)x=i?1:0;if($0.type==="json"&&typeof i==="object"&&!J.supportsJSON)try{x=JSON.stringify(i)}catch(X0){throw Error(`Failed to stringify JSON value for field ${w0}`,{cause:X0})}if(J.customTransformInput)x=J.customTransformInput({data:x,fieldAttributes:$0,field:w0,model:G(I),schema:w,options:f,action:S});return{operator:l,connector:M,field:w0,value:x}})},z=(I,R,S)=>{if(!R)return;if(Object.keys(R).length===0)return;let q={};for(let[y,h]of Object.entries(R)){if(!h)continue;let i=Y(y),l=Y(I),M=Object.entries(w[i].fields).filter(([K0,L0])=>L0.references&&Y(L0.references.model)===l),x=!0;if(!M.length)M=Object.entries(w[l].fields).filter(([K0,L0])=>L0.references&&Y(L0.references.model)===i),x=!1;if(!M.length)throw new h4(`No foreign key found for model ${y} and base model ${I} while performing join operation.`);else if(M.length>1)throw new h4(`Multiple foreign keys found for model ${y} and base model ${I} while performing join operation. Only one foreign key is supported.`);let[r,p]=M[0];if(!p.references)throw new h4(`No references found for foreign key ${r} on model ${y} while performing join operation.`);let w0,$0,E0;if(x)E0=p.references.field,w0=W({model:I,field:E0}),$0=W({model:y,field:r});else E0=r,w0=W({model:I,field:E0}),$0=W({model:y,field:p.references.field});if(S&&!S.includes(E0))S.push(E0);let X0=$0==="id"?!0:p.unique??!1,N0=f.advanced?.database?.defaultFindManyLimit??100;if(X0)N0=1;else if(typeof h==="object"&&typeof h.limit==="number")N0=h.limit;q[G(y)]={on:{from:w0,to:$0},limit:N0,relation:X0?"one-to-one":"one-to-many"}}return{join:q,select:S}},H=async({baseModel:I,baseData:R,joinModel:S,specificJoinConfig:q})=>{if(!R)return R;let y=G(S),h=q.on.to,i=R[Z({field:q.on.from,model:I})];if(i===null||i===void 0)return q.relation==="one-to-one"?null:[];let l,M=O({model:y,where:[{field:h,value:i,operator:"eq",connector:"AND"}],action:"findOne"});try{if(q.relation==="one-to-one")l=await _.findOne({model:y,where:M});else{let x=q.limit??f.advanced?.database?.defaultFindManyLimit??100;l=await _.findMany({model:y,where:M,limit:x})}}catch(x){throw Q.error(`Failed to query fallback join for model ${y}:`,{where:M,limit:q.limit}),console.error(x),x}return l},_=$({options:f,schema:w,debugLog:E,getFieldName:W,getModelName:G,getDefaultModelName:Y,getDefaultFieldName:Z,getFieldAttributes:B,transformInput:v,transformOutput:N,transformWhereClause:O}),T=null,j={transaction:async(I)=>{if(!T)if(!J.transaction)T=uxu(j);else Q.debug(`[${J.adapterName}] - Using provided transaction implementation.`),T=J.transaction;return T(I)},create:async({data:I,model:R,select:S,forceAllowId:q=!1})=>{y9++;let y=y9,h=G(R);if(R=Y(R),"id"in I&&typeof I.id<"u"&&!q){Q.warn(`[${J.adapterName}] - You are trying to create a record with an id. This is not allowed as we handle id generation for you, unless you pass in the \`forceAllowId\` parameter. The id will be ignored.`);let x=Error().stack?.split(`
@@ -79156,7 +79156,7 @@ Hint: Configure a valid Google account email in Monitor Configuration > Contexto
 `);let X=u.pax;if(X)for(let J in X)f+=BM1(" "+J+"="+X[J]+`
 `);return s6.from(f)};Q83.decodePax=function(u){let f={};while(u.length){let X=0;while(X<u.length&&u[X]!==32)X++;let J=parseInt(s6.toString(u.subarray(0,X)),10);if(!J)return f;let w=s6.toString(u.subarray(X+1,J-1)),E=w.indexOf("=");if(E===-1)return f;f[w.slice(0,E)]=w.slice(E+1),u=u.subarray(J)}return f};Q83.encode=function(u){let f=s6.alloc(512),X=u.name,J="";if(u.typeflag===5&&X[X.length-1]!=="/")X+="/";if(s6.byteLength(X)!==X.length)return null;while(s6.byteLength(X)>100){let w=X.indexOf("/");if(w===-1)return null;J+=J?"/"+X.slice(0,w):X.slice(0,w),X=X.slice(w+1)}if(s6.byteLength(X)>100||s6.byteLength(J)>155)return null;if(u.linkname&&s6.byteLength(u.linkname)>100)return null;if(s6.write(f,X),s6.write(f,u_(u.mode&4095,6),100),s6.write(f,u_(u.uid,6),108),s6.write(f,u_(u.gid,6),116),w83(u.size,f,124),s6.write(f,u_(u.mtime.getTime()/1000|0,11),136),f[156]=48+X83(u.type),u.linkname)s6.write(f,u.linkname,157);if(s6.copy(MS$,f,257),s6.copy(pf3,f,263),u.uname)s6.write(f,u.uname,265);if(u.gname)s6.write(f,u.gname,297);if(s6.write(f,u_(u.devmajor||0,6),329),s6.write(f,u_(u.devminor||0,6),337),J)s6.write(f,J,345);return s6.write(f,u_(yS$(f),6),148),f};Q83.decode=function(u,f,X){let J=u[156]===0?0:u[156]-48,w=eo(u,0,100,f),E=$_(u,100,8),Q=$_(u,108,8),Y=$_(u,116,8),Z=$_(u,124,12),G=$_(u,136,12),W=f83(J),F=u[157]===0?null:eo(u,157,100,f),B=eo(u,265,32),v=eo(u,297,32),N=$_(u,329,8),O=$_(u,337,8),z=yS$(u);if(z===256)return null;if(z!==$_(u,148,8))throw Error("Invalid tar header. Maybe the tar is corrupted or it needs to be gunzipped?");if(ef3(u)){if(u[345])w=eo(u,345,155,f)+"/"+w}else if($83(u));else if(!X)throw Error("Invalid tar header: unknown format.");if(J===0&&w&&w[w.length-1]==="/")J=5;return{name:w,mode:E,uid:Q,gid:Y,size:Z,mtime:new Date(1000*G),type:W,linkname:F,uname:B,gname:v,devmajor:N,devminor:O,pax:null}};function ef3($){return s6.equals(MS$,$.subarray(257,263))}function $83($){return s6.equals(of3,$.subarray(257,263))&&s6.equals(sf3,$.subarray(263,265))}function u83($,u,f){if(typeof $!=="number")return f;if($=~~$,$>=u)return u;if($>=0)return $;if($+=u,$>=0)return $;return 0}function f83($){switch($){case 0:return"file";case 1:return"link";case 2:return"symlink";case 3:return"character-device";case 4:return"block-device";case 5:return"directory";case 6:return"fifo";case 7:return"contiguous-file";case 72:return"pax-header";case 55:return"pax-global-header";case 27:return"gnu-long-link-path";case 28:case 30:return"gnu-long-path"}return null}function X83($){switch($){case"file":return 0;case"link":return 1;case"symlink":return 2;case"character-device":return 3;case"block-device":return 4;case"directory":return 5;case"fifo":return 6;case"contiguous-file":return 7;case"pax-header":return 72}return 0}function hS$($,u,f,X){for(;f<X;f++)if($[f]===u)return f;return X}function yS$($){let u=256;for(let f=0;f<148;f++)u+=$[f];for(let f=156;f<512;f++)u+=$[f];return u}function u_($,u){if($=$.toString(8),$.length>u)return"7777777777777777777".slice(0,u)+" ";return"0000000000000000000".slice(0,u-$.length)+$+" "}function J83($,u,f){u[f]=128;for(let X=11;X>0;X--)u[f+X]=$&255,$=Math.floor($/256)}function w83($,u,f){if($.toString(8).length>11)J83($,u,f);else s6.write(u,u_($,11),f)}function E83($){let u;if($[0]===128)u=!0;else if($[0]===255)u=!1;else return null;let f=[],X;for(X=$.length-1;X>0;X--){let E=$[X];if(u)f.push(E);else f.push(255-E)}let J=0,w=f.length;for(X=0;X<w;X++)J+=f[X]*Math.pow(256,X);return u?J:-1*J}function $_($,u,f){if($=$.subarray(u,u+f),u=0,$[u]&128)return E83($);else{while(u<$.length&&$[u]===32)u++;let X=u83(hS$($,32,u,$.length),$.length,$.length);while(u<X&&$[u]===0)u++;if(X===u)return 0;return parseInt(s6.toString($.subarray(u,X)),8)}}function eo($,u,f,X){return s6.toString($.subarray(u,hS$($,0,u,u+f)),X)}function BM1($){let u=s6.byteLength($),f=Math.floor(Math.log(u)/Math.log(10))+1;if(u+f>=Math.pow(10,f))f++;return u+f+$}});var dS$=b((pGX,cS$)=>{var{Writable:F83,Readable:B83,getStreamError:gS$}=FM1(),v83=QM1(),VS$=so(),$s=vM1(),U83=VS$.alloc(0);class bS${constructor(){this.buffered=0,this.shifted=0,this.queue=new v83,this._offset=0}push($){this.buffered+=$.byteLength,this.queue.push($)}shiftFirst($){return this._buffered===0?null:this._next($)}shift($){if($>this.buffered)return null;if($===0)return U83;let u=this._next($);if($===u.byteLength)return u;let f=[u];while(($-=u.byteLength)>0)u=this._next($),f.push(u);return VS$.concat(f)}_next($){let u=this.queue.peek(),f=u.byteLength-this._offset;if($>=f){let X=this._offset?u.subarray(this._offset,u.byteLength):u;return this.queue.shift(),this._offset=0,this.buffered-=f,this.shifted+=f,X}return this.buffered-=$,this.shifted+=$,u.subarray(this._offset,this._offset+=$)}}class iS$ extends B83{constructor($,u,f){super();this.header=u,this.offset=f,this._parent=$}_read($){if(this.header.size===0)this.push(null);if(this._parent._stream===this)this._parent._update();$(null)}_predestroy(){this._parent.destroy(gS$(this))}_detach(){if(this._parent._stream===this)this._parent._stream=null,this._parent._missing=lS$(this.header.size),this._parent._update()}_destroy($){this._detach(),$(null)}}class xS$ extends F83{constructor($){super($);if(!$)$={};this._buffer=new bS$,this._offset=0,this._header=null,this._stream=null,this._missing=0,this._longHeader=!1,this._callback=UM1,this._locked=!1,this._finished=!1,this._pax=null,this._paxGlobal=null,this._gnuLongPath=null,this._gnuLongLinkPath=null,this._filenameEncoding=$.filenameEncoding||"utf-8",this._allowUnknownFormat=!!$.allowUnknownFormat,this._unlockBound=this._unlock.bind(this)}_unlock($){if(this._locked=!1,$){this.destroy($),this._continueWrite($);return}this._update()}_consumeHeader(){if(this._locked)return!1;this._offset=this._buffer.shifted;try{this._header=$s.decode(this._buffer.shift(512),this._filenameEncoding,this._allowUnknownFormat)}catch($){return this._continueWrite($),!1}if(!this._header)return!0;switch(this._header.type){case"gnu-long-path":case"gnu-long-link-path":case"pax-global-header":case"pax-header":return this._longHeader=!0,this._missing=this._header.size,!0}if(this._locked=!0,this._applyLongHeaders(),this._header.size===0||this._header.type==="directory")return this.emit("entry",this._header,this._createStream(),this._unlockBound),!0;return this._stream=this._createStream(),this._missing=this._header.size,this.emit("entry",this._header,this._stream,this._unlockBound),!0}_applyLongHeaders(){if(this._gnuLongPath)this._header.name=this._gnuLongPath,this._gnuLongPath=null;if(this._gnuLongLinkPath)this._header.linkname=this._gnuLongLinkPath,this._gnuLongLinkPath=null;if(this._pax){if(this._pax.path)this._header.name=this._pax.path;if(this._pax.linkpath)this._header.linkname=this._pax.linkpath;if(this._pax.size)this._header.size=parseInt(this._pax.size,10);this._header.pax=this._pax,this._pax=null}}_decodeLongHeader($){switch(this._header.type){case"gnu-long-path":this._gnuLongPath=$s.decodeLongPath($,this._filenameEncoding);break;case"gnu-long-link-path":this._gnuLongLinkPath=$s.decodeLongPath($,this._filenameEncoding);break;case"pax-global-header":this._paxGlobal=$s.decodePax($);break;case"pax-header":this._pax=this._paxGlobal===null?$s.decodePax($):Object.assign({},this._paxGlobal,$s.decodePax($));break}}_consumeLongHeader(){this._longHeader=!1,this._missing=lS$(this._header.size);let $=this._buffer.shift(this._header.size);try{this._decodeLongHeader($)}catch(u){return this._continueWrite(u),!1}return!0}_consumeStream(){let $=this._buffer.shiftFirst(this._missing);if($===null)return!1;this._missing-=$.byteLength;let u=this._stream.push($);if(this._missing===0){if(this._stream.push(null),u)this._stream._detach();return u&&this._locked===!1}return u}_createStream(){return new iS$(this,this._header,this._offset)}_update(){while(this._buffer.buffered>0&&!this.destroying){if(this._missing>0){if(this._stream!==null){if(this._consumeStream()===!1)return;continue}if(this._longHeader===!0){if(this._missing>this._buffer.buffered)break;if(this._consumeLongHeader()===!1)return!1;continue}let $=this._buffer.shiftFirst(this._missing);if($!==null)this._missing-=$.byteLength;continue}if(this._buffer.buffered<512)break;if(this._stream!==null||this._consumeHeader()===!1)return}this._continueWrite(null)}_continueWrite($){let u=this._callback;this._callback=UM1,u($)}_write($,u){this._callback=u,this._buffer.push($),this._update()}_final($){this._finished=this._missing===0&&this._buffer.buffered===0,$(this._finished?null:Error("Unexpected end of data"))}_predestroy(){this._continueWrite(null)}_destroy($){if(this._stream)this._stream.destroy(gS$(this));$(null)}[Symbol.asyncIterator](){let $=null,u=null,f=null,X=null,J=null,w=this;return this.on("entry",Y),this.on("error",(W)=>{$=W}),this.on("close",Z),{[Symbol.asyncIterator](){return this},next(){return new Promise(Q)},return(){return G(null)},throw(W){return G(W)}};function E(W){if(!J)return;let F=J;J=null,F(W)}function Q(W,F){if($)return F($);if(X){W({value:X,done:!1}),X=null;return}if(u=W,f=F,E(null),w._finished&&u)u({value:void 0,done:!0}),u=f=null}function Y(W,F,B){if(J=B,F.on("error",UM1),u)u({value:F,done:!1}),u=f=null;else X=F}function Z(){if(E($),!u)return;if($)f($);else u({value:void 0,done:!0});u=f=null}function G(W){return w.destroy(W),E(W),new Promise((F,B)=>{if(w.destroyed)return F({value:void 0,done:!0});w.once("close",function(){if(W)B(W);else F({value:void 0,done:!0})})})}}}cS$.exports=function(u){return new xS$(u)};function UM1(){}function lS$($){return $&=511,$&&512-$}});var nS$=b((oGX,NM1)=>{var mS$={S_IFMT:61440,S_IFDIR:16384,S_IFCHR:8192,S_IFBLK:24576,S_IFIFO:4096,S_IFLNK:40960};try{NM1.exports=Z0("fs").constants||mS$}catch{NM1.exports=mS$}});var eS$=b((sGX,sS$)=>{var{Readable:N83,Writable:O83,getStreamError:tS$}=FM1(),kx=so(),us=nS$(),$m0=vM1(),rS$=kx.alloc(1024);class aS$ extends O83{constructor($,u,f){super({mapWritable:K83,eagerOpen:!0});if(this.written=0,this.header=u,this._callback=f,this._linkname=null,this._isLinkname=u.type==="symlink"&&!u.linkname,this._isVoid=u.type!=="file"&&u.type!=="contiguous-file",this._finished=!1,this._pack=$,this._openCallback=null,this._pack._stream===null)this._pack._stream=this;else this._pack._pending.push(this)}_open($){if(this._openCallback=$,this._pack._stream===this)this._continueOpen()}_continuePack($){if(this._callback===null)return;let u=this._callback;this._callback=null,u($)}_continueOpen(){if(this._pack._stream===null)this._pack._stream=this;let $=this._openCallback;if(this._openCallback=null,$===null)return;if(this._pack.destroying)return $(Error("pack stream destroyed"));if(this._pack._finalized)return $(Error("pack stream is already finalized"));if(this._pack._stream=this,!this._isLinkname)this._pack._encode(this.header);if(this._isVoid)this._finish(),this._continuePack(null);$(null)}_write($,u){if(this._isLinkname)return this._linkname=this._linkname?kx.concat([this._linkname,$]):$,u(null);if(this._isVoid){if($.byteLength>0)return u(Error("No body allowed for this entry"));return u()}if(this.written+=$.byteLength,this._pack.push($))return u();this._pack._drain=u}_finish(){if(this._finished)return;if(this._finished=!0,this._isLinkname)this.header.linkname=this._linkname?kx.toString(this._linkname,"utf-8"):"",this._pack._encode(this.header);oS$(this._pack,this.header.size),this._pack._done(this)}_final($){if(this.written!==this.header.size)return $(Error("Size mismatch"));this._finish(),$(null)}_getError(){return tS$(this)||Error("tar entry destroyed")}_predestroy(){this._pack.destroy(this._getError())}_destroy($){this._pack._done(this),this._continuePack(this._finished?null:this._getError()),$()}}class pS$ extends N83{constructor($){super($);this._drain=OM1,this._finalized=!1,this._finalizing=!1,this._pending=[],this._stream=null}entry($,u,f){if(this._finalized||this.destroying)throw Error("already finalized or destroyed");if(typeof u==="function")f=u,u=null;if(!f)f=OM1;if(!$.size||$.type==="symlink")$.size=0;if(!$.type)$.type=z83($.mode);if(!$.mode)$.mode=$.type==="directory"?493:420;if(!$.uid)$.uid=0;if(!$.gid)$.gid=0;if(!$.mtime)$.mtime=new Date;if(typeof u==="string")u=kx.from(u);let X=new aS$(this,$,f);if(kx.isBuffer(u))return $.size=u.byteLength,X.write(u),X.end(),X;if(X._isVoid)return X;return X}finalize(){if(this._stream||this._pending.length>0){this._finalizing=!0;return}if(this._finalized)return;this._finalized=!0,this.push(rS$),this.push(null)}_done($){if($!==this._stream)return;if(this._stream=null,this._finalizing)this.finalize();if(this._pending.length)this._pending.shift()._continueOpen()}_encode($){if(!$.pax){let u=$m0.encode($);if(u){this.push(u);return}}this._encodePax($)}_encodePax($){let u=$m0.encodePax({name:$.name,linkname:$.linkname,pax:$.pax}),f={name:"PaxHeader",mode:$.mode,uid:$.uid,gid:$.gid,size:u.byteLength,mtime:$.mtime,type:"pax-header",linkname:$.linkname&&"PaxHeader",uname:$.uname,gname:$.gname,devmajor:$.devmajor,devminor:$.devminor};this.push($m0.encode(f)),this.push(u),oS$(this,u.byteLength),f.size=$.size,f.type=$.type,this.push($m0.encode(f))}_doDrain(){let $=this._drain;this._drain=OM1,$()}_predestroy(){let $=tS$(this);if(this._stream)this._stream.destroy($);while(this._pending.length){let u=this._pending.shift();u.destroy($),u._continueOpen()}this._doDrain()}_read($){this._doDrain(),$()}}sS$.exports=function(u){return new pS$(u)};function z83($){switch($&us.S_IFMT){case us.S_IFBLK:return"block-device";case us.S_IFCHR:return"character-device";case us.S_IFDIR:return"directory";case us.S_IFIFO:return"fifo";case us.S_IFLNK:return"symlink"}return"file"}function OM1(){}function oS$($,u){if(u&=511,u)$.push(rS$.subarray(0,512-u))}function K83($){return kx.isBuffer($)?$:kx.from($)}});var $k$=b((H83)=>{H83.extract=dS$();H83.pack=eS$()});var Xk$=b(($WX,fk$)=>{fk$.exports=uk$;function uk$($,u){if($&&u)return uk$($)(u);if(typeof $!=="function")throw TypeError("need wrapper function");return Object.keys($).forEach(function(X){f[X]=$[X]}),f;function f(){var X=Array(arguments.length);for(var J=0;J<X.length;J++)X[J]=arguments[J];var w=$.apply(this,X),E=X[X.length-1];if(typeof w==="function"&&w!==E)Object.keys(E).forEach(function(Q){w[Q]=E[Q]});return w}}});var KM1=b((uWX,zM1)=>{var Jk$=Xk$();zM1.exports=Jk$(um0);zM1.exports.strict=Jk$(wk$);um0.proto=um0(function(){Object.defineProperty(Function.prototype,"once",{value:function(){return um0(this)},configurable:!0}),Object.defineProperty(Function.prototype,"onceStrict",{value:function(){return wk$(this)},configurable:!0})});function um0($){var u=function(){if(u.called)return u.value;return u.called=!0,u.value=$.apply(this,arguments)};return u.called=!1,u}function wk$($){var u=function(){if(u.called)throw Error(u.onceError);return u.called=!0,u.value=$.apply(this,arguments)},f=$.name||"Function wrapped with `once`";return u.onceError=f+" shouldn't be called more than once",u.called=!1,u}});var Yk$=b((fWX,Qk$)=>{var j83=KM1(),L83=function(){},T83=global.Bare?queueMicrotask:process.nextTick.bind(process),A83=function($){return $.setHeader&&typeof $.abort==="function"},I83=function($){return $.stdio&&Array.isArray($.stdio)&&$.stdio.length===3},Ek$=function($,u,f){if(typeof u==="function")return Ek$($,null,u);if(!u)u={};f=j83(f||L83);var{_writableState:X,_readableState:J}=$,w=u.readable||u.readable!==!1&&$.readable,E=u.writable||u.writable!==!1&&$.writable,Q=!1,Y=function(){if(!$.writable)Z()},Z=function(){if(E=!1,!w)f.call($)},G=function(){if(w=!1,!E)f.call($)},W=function(O){f.call($,O?Error("exited with error code: "+O):null)},F=function(O){f.call($,O)},B=function(){T83(v)},v=function(){if(Q)return;if(w&&!(J&&(J.ended&&!J.destroyed)))return f.call($,Error("premature close"));if(E&&!(X&&(X.ended&&!X.destroyed)))return f.call($,Error("premature close"))},N=function(){$.req.on("finish",Z)};if(A83($))if($.on("complete",Z),$.on("abort",B),$.req)N();else $.on("request",N);else if(E&&!X)$.on("end",Y),$.on("close",Y);if(I83($))$.on("exit",W);if($.on("end",G),$.on("finish",Z),u.error!==!1)$.on("error",F);return $.on("close",B),function(){if(Q=!0,$.removeListener("complete",Z),$.removeListener("abort",B),$.removeListener("request",N),$.req)$.req.removeListener("finish",Z);$.removeListener("end",Y),$.removeListener("close",Y),$.removeListener("finish",Z),$.removeListener("exit",W),$.removeListener("end",G),$.removeListener("error",F),$.removeListener("close",B)}};Qk$.exports=Ek$});var Gk$=b((XWX,Zk$)=>{var S83=KM1(),k83=Yk$(),fm0;try{fm0=Z0("fs")}catch($){}var VJ0=function(){},R83=typeof process>"u"?!1:/^v?\.0/.test(process.version),Xm0=function($){return typeof $==="function"},C83=function($){if(!R83)return!1;if(!fm0)return!1;return($ instanceof(fm0.ReadStream||VJ0)||$ instanceof(fm0.WriteStream||VJ0))&&Xm0($.close)},q83=function($){return $.setHeader&&Xm0($.abort)},M83=function($,u,f,X){X=S83(X);var J=!1;$.on("close",function(){J=!0}),k83($,{readable:u,writable:f},function(E){if(E)return X(E);J=!0,X()});var w=!1;return function(E){if(J)return;if(w)return;if(w=!0,C83($))return $.close(VJ0);if(q83($))return $.abort();if(Xm0($.destroy))return $.destroy();X(E||Error("stream was destroyed"))}},Dk$=function($){$()},h83=function($,u){return $.pipe(u)},y83=function(){var $=Array.prototype.slice.call(arguments),u=Xm0($[$.length-1]||VJ0)&&$.pop()||VJ0;if(Array.isArray($[0]))$=$[0];if($.length<2)throw Error("pump requires two streams per minimum");var f,X=$.map(function(J,w){var E=w<$.length-1,Q=w>0;return M83(J,E,Q,function(Y){if(!f)f=Y;if(Y)X.forEach(Dk$);if(E)return;X.forEach(Dk$),u(f)})});return $.reduce(h83)};Zk$.exports=y83});var Kk$=b((i83)=>{var Wk$=$k$(),Fk$=Gk$(),Bk$=Z0("fs"),B8=Z0("path"),bJ0=(global.Bare?global.Bare.platform:process.platform)==="win32";i83.pack=function(u,f){if(!u)u=".";if(!f)f={};let X=f.fs||Bk$,J=f.ignore||f.filter||iJ0,w=f.mapStream||Ok$,E=b83(X,f.dereference?X.stat:X.lstat,u,J,f.entries,f.sort),Q=f.strict!==!1,Y=typeof f.umask==="number"?~f.umask:~vk$(),Z=f.pack||Wk$.pack(),G=f.finish||iJ0,W=f.map||iJ0,F=typeof f.dmode==="number"?f.dmode:0,B=typeof f.fmode==="number"?f.fmode:0;if(f.strip)W=zk$(W,f.strip);if(f.readable)F|=parseInt(555,8),B|=parseInt(444,8);if(f.writable)F|=parseInt(333,8),B|=parseInt(222,8);O();function v(z,H){X.readlink(B8.join(u,z),function(_,T){if(_)return Z.destroy(_);H.linkname=HM1(T),Z.entry(H,O)})}function N(z,H,_){if(Z.destroyed)return;if(z)return Z.destroy(z);if(!H){if(f.finalize!==!1)Z.finalize();return G(Z)}if(_.isSocket())return O();let T={name:HM1(H),mode:(_.mode|(_.isDirectory()?F:B))&Y,mtime:_.mtime,size:_.size,type:"file",uid:_.uid,gid:_.gid};if(_.isDirectory())return T.size=0,T.type="directory",T=W(T)||T,Z.entry(T,O);if(_.isSymbolicLink())return T.size=0,T.type="symlink",T=W(T)||T,v(H,T);if(T=W(T)||T,!_.isFile()){if(Q)return Z.destroy(Error("unsupported type for "+H));return O()}let j=Z.entry(T,O),I=w(X.createReadStream(B8.join(u,H),{start:0,end:T.size>0?T.size-1:T.size}),T);I.on("error",function(R){j.destroy(R)}),Fk$(I,j)}function O(z){if(z)return Z.destroy(z);E(N)}return Z};function g83($){return $.length?$[$.length-1]:null}function V83(){return!global.Bare&&process.getuid?process.getuid():-1}function vk$(){return!global.Bare&&process.umask?process.umask():0}i83.extract=function(u,f){if(!u)u=".";if(!f)f={};u=B8.resolve(u);let X=f.fs||Bk$,J=f.ignore||f.filter||iJ0,w=f.mapStream||Ok$,E=f.chown!==!1&&!bJ0&&V83()===0,Q=f.extract||Wk$.extract(),Y=[],Z=new Date,G=typeof f.umask==="number"?~f.umask:~vk$(),W=f.strict!==!1,F=f.validateSymlinks!==!1,B=f.map||iJ0,v=typeof f.dmode==="number"?f.dmode:0,N=typeof f.fmode==="number"?f.fmode:0;if(f.strip)B=zk$(B,f.strip);if(f.readable)v|=parseInt(555,8),N|=parseInt(444,8);if(f.writable)v|=parseInt(333,8),N|=parseInt(222,8);if(Q.on("entry",O),f.finish)Q.on("finish",f.finish);return Q;function O(j,I,R){j=B(j)||j,j.name=HM1(j.name);let S=B8.join(u,B8.join("/",j.name));if(J(S,j))return I.resume(),R();let q=B8.join(S,".")===B8.join(u,".")?u:B8.dirname(S);Nk$(X,q,B8.join(u,"."),function(x,r){if(x)return R(x);if(!r)return R(Error(q+" is not a valid path"));if(j.type==="directory")return Y.push([S,j.mtime]),T(S,{fs:X,own:E,uid:j.uid,gid:j.gid,mode:j.mode},y);T(q,{fs:X,own:E,uid:j.uid,gid:j.gid,mode:493},function(p){if(p)return R(p);switch(j.type){case"file":return M();case"link":return i();case"symlink":return h()}if(W)return R(Error("unsupported type for "+S+" ("+j.type+")"));I.resume(),R()})});function y(x){if(x)return R(x);H(S,j,function(r){if(r)return R(r);if(bJ0)return R();_(S,j,R)})}function h(){if(bJ0)return R();X.unlink(S,function(){let x=B8.resolve(B8.dirname(S),j.linkname);if(!l(x)&&F)return R(Error(S+" is not a valid symlink"));Uk$(X,x,B8.join(u,"."),function(r,p){if(r)return R(r);if(!p&&F)return R(Error(S+" is not a valid symlink"));X.symlink(j.linkname,S,y)})})}function i(){if(bJ0)return R();X.unlink(S,function(){let x=B8.join(u,B8.join("/",j.linkname));X.realpath(x,function(r,p){if(r||!l(p))return R(Error(S+" is not a valid hardlink"));X.link(p,S,function(w0){if(w0&&w0.code==="EPERM"&&f.hardlinkAsFilesFallback)return I=X.createReadStream(p),M();y(w0)})})})}function l(x){return x===u||x.startsWith(u+B8.sep)}function M(){let x=X.createWriteStream(S),r=w(I,j);x.on("error",function(p){r.destroy(p)}),Fk$(r,x,function(p){if(p)return R(p);x.on("close",y)})}}function z(j,I){let R;while((R=g83(Y))&&j.slice(0,R[0].length)!==R[0])Y.pop();if(!R)return I();X.utimes(R[0],Z,R[1],I)}function H(j,I,R){if(f.utimes===!1)return R();if(I.type==="directory")return X.utimes(j,Z,I.mtime,R);if(I.type==="symlink")return z(j,R);X.utimes(j,Z,I.mtime,function(S){if(S)return R(S);z(j,R)})}function _(j,I,R){let S=I.type==="symlink",q=S?X.lchmod:X.chmod,y=S?X.lchown:X.chown;if(!q)return R();let h=(I.mode|(I.type==="directory"?v:N))&G;if(y&&E)y.call(X,j,I.uid,I.gid,i);else i(null);function i(l){if(l)return R(l);if(!q)return R();q.call(X,j,h,R)}}function T(j,I,R){X.stat(j,function(S){if(!S)return R(null);if(S.code!=="ENOENT")return R(S);X.mkdir(j,{mode:I.mode,recursive:!0},function(q,y){if(q)return R(q);_(j,I,R)})})}};function Uk$($,u,f,X){if(u===f)return X(null,!0);if(!u.startsWith(f+B8.sep))return X(null,!1);$.lstat(u,function(J,w){if(J&&J.code!=="ENOENT"&&J.code!=="EPERM")return X(J);if(J||!w.isSymbolicLink())return Uk$($,B8.join(u,".."),f,X);X(null,!1)})}function Nk$($,u,f,X){if(u===f)return X(null,!0);$.lstat(u,function(J,w){if(J&&J.code!=="ENOENT"&&J.code!=="EPERM")return X(J);if(J||w.isDirectory())return Nk$($,B8.join(u,".."),f,X);X(null,!1)})}function iJ0(){}function Ok$($){return $}function HM1($){return bJ0?$.replace(/\\/g,"/").replace(/[:?<>|]/g,"_"):$}function b83($,u,f,X,J,w){if(!J)J=["."];let E=J.slice(0);return function(Y){if(!E.length)return Y(null);let Z=E.shift(),G=B8.join(f,Z);u.call($,G,function(W,F){if(W)return Y(J.indexOf(Z)===-1&&W.code==="ENOENT"?null:W);if(!F.isDirectory())return Y(null,Z,F);$.readdir(G,function(B,v){if(B)return Y(B);if(w)v.sort();for(let N=0;N<v.length;N++)if(!X(B8.join(f,Z,v[N])))E.push(B8.join(Z,v[N]));Y(null,Z,F)})})}}function zk$($,u){return function(f){f.name=f.name.split("/").slice(u).join("/");let X=f.linkname;if(X&&(f.type==="link"||B8.isAbsolute(X)))f.linkname=X.split("/").slice(u).join("/");return $(f)}}});var c83,d83;var Hk$=U(()=>{wM1();c83=Q0(YS$(),1),d83=Q0(Kk$(),1)});var Jm0=()=>{};var _k$=U(()=>{Od0()});var Pk$=U(()=>{md0();dd0();Jm0()});var jk$=()=>{};var Lk$=()=>{};var _M1=U(()=>{cI$();XM1();md0();rI$();uM1();wM1();aI$();pI$();oI$();sI$();fM1();eI$();Hk$();Jm0();_k$();Pk$();jk$();Lk$();Jm0()});var U7,fX,Rx,xJ0;var lJ0=U(()=>{U7={CLAIM_API_GROUP:"extensions.agents.x-k8s.io",CLAIM_API_VERSION:"v1alpha1",CLAIM_PLURAL:"sandboxclaims",SANDBOX_API_GROUP:"agents.x-k8s.io",SANDBOX_API_VERSION:"v1alpha1",SANDBOX_PLURAL:"sandboxes",POD_NAME_ANNOTATION:"agents.x-k8s.io/pod-name"};fX=class fX extends Error{cause;constructor($,u){super($);if(this.name="SandboxError",this.cause=u,u instanceof Error&&u.stack)this.stack=`${this.stack}
 Caused by: ${u.stack}`}};Rx=class Rx extends fX{constructor($,u){super($,u);this.name="SandboxTimeoutError"}};xJ0=class xJ0 extends fX{constructor($,u){super($,u);this.name="SandboxAlreadyExistsError"}}});async function m83($){let u=$.getCurrentCluster();if(!u)throw new fX("No active cluster in kubeconfig");let f={};await $.applyToHTTPSOptions(f);let X={},J=f.headers??{};for(let[w,E]of Object.entries(J))if(Array.isArray(E))X[w]=E.join(", ");else if(E!==void 0)X[w]=String(E);if(typeof f.auth==="string"&&!X.Authorization)X.Authorization=`Basic ${Buffer.from(f.auth).toString("base64")}`;return{server:u.server.replace(/\/+$/,""),headers:X,tls:{cert:PM1(f.cert),key:PM1(f.key),ca:PM1(f.ca),rejectUnauthorized:u.skipTLSVerify?!1:void 0}}}function PM1($){if($==null)return;if(typeof $==="string")return $;if(Buffer.isBuffer($))return $.toString("utf8");return String($)}async function Cx($,u){let f=await m83($),X={...f.headers,...u.headers};if(u.method==="PATCH")X["content-type"]=u.patchType==="apply"?"application/apply-patch+yaml":u.patchType==="strategic-merge"?"application/strategic-merge-patch+json":"application/merge-patch+json";else if(u.body!==void 0&&!("content-type"in X))X["content-type"]="application/json";let J={method:u.method,headers:X,body:u.body===void 0?void 0:JSON.stringify(u.body),signal:u.signal,tls:f.tls};return fetch(`${f.server}${u.path}`,J)}async function LM1($){try{return await $.json()}catch{return null}}async function TM1($,u){if($.ok)return;let f=await LM1($),X=f?.message??`${u} failed: ${$.status} ${$.statusText}`;throw new jM1($.status,f,X)}async function cJ0($,u,f,X,J="none"){try{let w=await Cx($,u);if(w.status===404)return null;if(await TM1(w,f),J==="json")return await w.json();return null}catch(w){throw new fX(X,w)}}async function dJ0($,u,f){let X=`${Tk$}/${encodeURIComponent(u)}/${U7.CLAIM_PLURAL}`,J;try{J=await Cx($,{method:"POST",path:X,body:f})}catch(Z){let G=Z instanceof Error?Z.message:String(Z);throw console.warn(`[agent-sandbox/client] createSandboxClaim ${f.metadata.name} transport error: ${G}`),new fX(`Failed to create SandboxClaim: ${f.metadata.name} (transport error: ${G})`,Z)}if(J.ok)return;let w=await LM1(J),E=w?.reason?` ${w.reason}`:"",Q=w?.message??J.statusText,Y=`Failed to create SandboxClaim: ${f.metadata.name} (${J.status}${E}: ${Q})`;if(console.warn(`[agent-sandbox/client] createSandboxClaim ${f.metadata.name} rejected: status=${J.status} reason=${w?.reason??"<none>"} message=${Q}`),J.status===409)throw new xJ0(Y);throw new fX(Y)}async function wm0($,u,f,X=60000){let J=Date.now()+X,w=500,E;while(!0){let Q=await X_($,u,f).catch(()=>{return});if(!Q)return;if(E=Q,Date.now()>=J){let Y=E.metadata?.finalizers??[],Z=E.metadata?.deletionTimestamp??"<unknown>";throw new Rx(`SandboxClaim ${f} still terminating after ${X}ms (deletionTimestamp=${Z}, finalizers=[${Y.join(", ")}])`)}await new Promise((Y)=>setTimeout(Y,500))}}function AM1($,u){return`${Tk$}/${encodeURIComponent($)}/${U7.CLAIM_PLURAL}/${encodeURIComponent(u)}`}async function Ak$($,u,f,X){await cJ0($,{method:"PATCH",path:AM1(u,f),patchType:"merge",body:{spec:{lifecycle:{shutdownPolicy:"Delete",shutdownTime:X}}}},"patchSandboxClaimShutdown",`Failed to patch SandboxClaim shutdownTime: ${f}`)}async function f_($,u,f){await cJ0($,{method:"DELETE",path:AM1(u,f)},"deleteSandboxClaim",`Failed to delete SandboxClaim: ${f}`)}async function X_($,u,f){return await cJ0($,{method:"GET",path:AM1(u,f)},"getSandboxClaim",`Failed to get SandboxClaim: ${f}`,"json")??void 0}async function Ik$($,u,f,X=60){let J=Date.now()+X*1000,w=200;while(Date.now()<J){let Q=(await X_($,u,f).catch(()=>{return}))?.status?.sandbox?.name;if(Q)return Q;await new Promise((Y)=>setTimeout(Y,200))}throw new Rx(`SandboxClaim ${f} did not record an adopted Sandbox (status.sandbox.name) within ${X}s`)}function Ck$($,u){return`${Rk$}/${encodeURIComponent($)}/${IM1}/${encodeURIComponent(u)}`}function n83($){return`${Rk$}/${encodeURIComponent($)}/${IM1}`}async function Em0($,u,f){try{let X=await Cx($,{method:"POST",path:n83(u),body:f});if(X.status===409)return;await TM1(X,"createHttpRoute")}catch(X){if(X instanceof jM1&&X.status===409)return;throw new fX(`Failed to create HTTPRoute: ${f.metadata.name}`,X)}}async function Qm0($,u,f){await cJ0($,{method:"DELETE",path:Ck$(u,f)},"deleteHttpRoute",`Failed to delete HTTPRoute: ${f}`)}async function qk$($,u,f){return await cJ0($,{method:"GET",path:Ck$(u,f)},"getHttpRoute",`Failed to get HTTPRoute: ${f}`,"json")??void 0}async function Mk$($,u,f,X){let J={apiVersion:"v1",kind:"Service",metadata:{name:f},spec:{ports:[{name:X.name,port:X.port,targetPort:X.targetPort,protocol:X.protocol??"TCP"}]}},w=new URLSearchParams({fieldManager:t83,force:"true"}),E=`/api/v1/namespaces/${encodeURIComponent(u)}/services/${encodeURIComponent(f)}?${w}`;try{let Q=await Cx($,{method:"PATCH",path:E,patchType:"apply",body:J});await TM1(Q,"ensureServicePort")}catch(Q){throw new fX(`Failed to apply Service ports: ${f}`,Q)}}function Ym0($,u,f,X=180){let J=`/apis/${U7.SANDBOX_API_GROUP}/${U7.SANDBOX_API_VERSION}/namespaces/${encodeURIComponent(u)}/${U7.SANDBOX_PLURAL}?watch=true&fieldSelector=${encodeURIComponent(`metadata.name=${f}`)}`,{resolve:w,reject:E,promise:Q}=Promise.withResolvers(),Y=new AbortController,Z=!1,G=setTimeout(()=>{if(Z)return;Z=!0,Y.abort(),E(new Rx(`Sandbox did not become ready within ${X} seconds`))},X*1000),W=(F)=>{if(Z)return;Z=!0,clearTimeout(G),Y.abort(),F()};return(async()=>{let F;try{F=await Cx($,{method:"GET",path:J,signal:Y.signal,headers:{accept:"application/json"}})}catch(B){W(()=>E(new fX("Failed to start watch for sandbox readiness",B)));return}if(!F.ok||!F.body){let B=await LM1(F).catch(()=>null);W(()=>E(new fX(`Watch handshake failed (${F.status}): ${B?.message??F.statusText}`)));return}try{for await(let B of SM1(F.body)){if(Z)return;if(B.type==="ERROR"){let H=B.object;W(()=>E(new fX(`Watch stream error while waiting for sandbox: ${H.message??"unknown"}`)));return}if(B.type!=="ADDED"&&B.type!=="MODIFIED")continue;let v=B.object;if(!v.status?.conditions?.find((H)=>H.type==="Ready"&&H.status==="True"))continue;let O=v.metadata?.name;if(!O){W(()=>E(new fX("Sandbox metadata or name is missing")));return}let z=v.metadata?.annotations?.[U7.POD_NAME_ANNOTATION]??O;W(()=>w({sandboxName:O,podName:z}));return}W(()=>E(new fX("Watch stream closed before sandbox became ready")))}catch(B){if(Z)return;if(B instanceof Error&&(B.name==="AbortError"||Y.signal.aborted))return;W(()=>E(new fX("Watch stream error while waiting for sandbox",B)))}})(),Q}async function*SM1($){let u=$.getReader(),f=new TextDecoder,X="";try{while(!0){let{value:w,done:E}=await u.read();if(E)break;X+=f.decode(w,{stream:!0});let Q;while((Q=X.indexOf(`
-`))>=0){let Y=X.slice(0,Q).trim();if(X=X.slice(Q+1),!Y)continue;yield JSON.parse(Y)}}let J=X.trim();if(J)yield JSON.parse(J)}finally{u.releaseLock()}}var jM1,Tk$,Sk$="gateway.networking.k8s.io",kk$="v1",IM1="httproutes",Rk$,mJ0,t83="mesh-sandbox-runner";var Dm0=U(()=>{lJ0();jM1=class jM1 extends Error{status;body;constructor($,u,f){super(f);this.status=$;this.body=u;this.name="KubeHttpError"}};Tk$=`/apis/${U7.CLAIM_API_GROUP}/${U7.CLAIM_API_VERSION}/namespaces`;Rk$=`/apis/${Sk$}/${kk$}/namespaces`;mJ0={API_GROUP:Sk$,API_VERSION:kk$,PLURAL:IM1}});async function*gk$($){let u=$.now??(()=>Date.now()),f=u(),X=$.schedulingTimeoutMs??p83,J={pod:{},sandbox:{},events:{hasPulling:!1,hasPulled:!1},startedAt:f},w=[],E=null,Q=!1,Y=(H)=>{if(Q)return;if(E){let _=E;E=null,_(H)}else w.push(H)},Z=()=>{if(w.length>0)return Promise.resolve(w.shift());if(Q)return Promise.resolve(null);return new Promise((H)=>{E=H})},G=()=>{if(Q)return;if(Q=!0,E){let H=E;E=null,H(null)}},W=new AbortController,F=()=>{W.abort(),G()};if($.signal)if($.signal.aborted)W.abort(),G();else $.signal.addEventListener("abort",F,{once:!0});let B=Math.max(0,X-(u()-f)),v=setTimeout(()=>Y("tick"),B+100),N,O=new Promise((H)=>{N=H}),z=Promise.allSettled([o83($.kc,$.namespace,$.claimName,W.signal,J,Y,u,N),e83($.kc,$.namespace,$.claimName,W.signal,J,Y),$X3($.kc,$.namespace,$.claimName,O,W.signal,J,Y,u)]);try{let H=null,_=-1,T=hk$(J,X,u);if(H=RM1(T),!kM1(T))_=yk$(T);if(yield T,kM1(T))return;while(!Q){if(await Z()===null)break;let I=hk$(J,X,u);if(kM1(I)){let q=RM1(I);if(q!==H)H=q,yield I;return}let R=yk$(I);if(R<_)continue;let S=RM1(I);if(S!==H)H=S,_=R,yield I}}finally{if(clearTimeout(v),W.abort(),$.signal)$.signal.removeEventListener("abort",F);G(),await z.catch(()=>{})}}function hk$($,u,f){let{pod:X,sandbox:J,events:w,startedAt:E}=$;if(J.ready)return{kind:"ready"};let Q=X.containerWaitingReason;if(Q==="ImagePullBackOff"||Q==="ErrImagePull")return{kind:"failed",reason:"image-pull-backoff",message:"Sandbox image failed to download. The cluster may be missing pull credentials or the image tag may not exist."};if(Q==="CrashLoopBackOff")return{kind:"failed",reason:"crash-loop-backoff",message:"Sandbox crashed during startup and is now in CrashLoopBackOff. Check pod logs."};if(!X.scheduled&&w.lastFailedSchedulingAt!==void 0&&f()-E>u)return{kind:"failed",reason:"scheduling-timeout",message:w.failedSchedulingMessage??`Pod could not be scheduled within ${Math.round(u/1000)}s.`};if(X.containerRunning&&!X.containerReady)return{kind:"warming-daemon",since:E};if(w.hasPulling&&!w.hasPulled)return{kind:"pulling-image",since:E};if(Q==="ContainerCreating"||Q==="PodInitializing"||X.scheduled&&!X.containerRunning)return{kind:"starting-container",since:E};if(X.scheduledFalseReason==="Unschedulable"||w.lastFailedSchedulingAt!==void 0&&!X.scheduled)return{kind:"waiting-for-capacity",since:E,message:w.failedSchedulingMessage??X.scheduledFalseMessage,nodeClaim:w.nominatedNodeClaim};return{kind:"claiming",since:E}}function kM1($){return $.kind==="ready"||$.kind==="failed"}function yk$($){switch($.kind){case"claiming":return 0;case"waiting-for-capacity":return 1;case"pulling-image":return 2;case"starting-container":return 3;case"warming-daemon":return 4;case"ready":case"failed":return 99}}function RM1($){switch($.kind){case"claiming":case"pulling-image":case"starting-container":case"warming-daemon":return $.kind;case"waiting-for-capacity":return`waiting-for-capacity:${$.message??""}:${$.nodeClaim??""}`;case"ready":return"ready";case"failed":return`failed:${$.reason}:${$.message}`}}async function o83($,u,f,X,J,w,E,Q){let Y=`/api/v1/namespaces/${encodeURIComponent(u)}/pods?watch=true&labelSelector=${encodeURIComponent(`${r83}=${f}`)}`;return CM1({kc:$,path:Y,signal:X,label:`pod/${f}`,onEvent:(Z)=>{if(Z.type!=="ADDED"&&Z.type!=="MODIFIED")return;let G=Z.object;if(G.metadata?.name)Q(G.metadata.name);s83(G,J,E),w("pod")}})}function s83($,u,f){let J=($.status?.conditions??[]).find((E)=>E.type==="PodScheduled");if(J?.status==="True")u.pod.scheduled=!0,u.pod.scheduledFalseReason=void 0,u.pod.scheduledFalseMessage=void 0;else if(J?.status==="False")u.pod.scheduled=!1,u.pod.scheduledFalseReason=J.reason,u.pod.scheduledFalseMessage=J.message;let w=($.status?.containerStatuses??[]).find((E)=>E.name===a83);if(w)u.pod.containerWaitingReason=w.state?.waiting?.reason,u.pod.containerRunning=!!w.state?.running,u.pod.containerReady=w.ready===!0}async function e83($,u,f,X,J,w){let E=`/apis/${U7.CLAIM_API_GROUP}/${U7.CLAIM_API_VERSION}/namespaces/${encodeURIComponent(u)}/${U7.CLAIM_PLURAL}?watch=true&fieldSelector=${encodeURIComponent(`metadata.name=${f}`)}`;return CM1({kc:$,path:E,signal:X,label:`sandboxclaim/${f}`,onEvent:(Q)=>{if(Q.type!=="ADDED"&&Q.type!=="MODIFIED")return;let Z=Q.object.status?.conditions?.find((G)=>G.type==="Ready");if(!Z)return;if(Z.status==="True")J.sandbox.ready=!0,J.sandbox.notReadyReason=void 0,J.sandbox.notReadyMessage=void 0;else J.sandbox.ready=!1,J.sandbox.notReadyReason=Z.reason,J.sandbox.notReadyMessage=Z.message;w("sandbox")}})}async function $X3($,u,f,X,J,w,E,Q){let Y=await Promise.race([X,new Promise((G)=>{if(J.aborted){G(f);return}J.addEventListener("abort",()=>G(f),{once:!0})})]);if(J.aborted)return;let Z=`/api/v1/namespaces/${encodeURIComponent(u)}/events?watch=true&fieldSelector=${encodeURIComponent(`involvedObject.name=${Y},involvedObject.kind=Pod`)}`;return CM1({kc:$,path:Z,signal:J,label:`events/${f}`,onEvent:(G)=>{if(G.type!=="ADDED"&&G.type!=="MODIFIED")return;let W=G.object,F=W.reason;if(!F)return;switch(F){case"Pulling":w.events.hasPulling=!0;break;case"Pulled":w.events.hasPulling=!0,w.events.hasPulled=!0;break;case"FailedScheduling":w.events.lastFailedSchedulingAt=Q(),w.events.failedSchedulingMessage=W.message;break;case"Nominated":{let B=W.message?.match(/nodeclaim\/([\w-]+)/);if(B)w.events.nominatedNodeClaim=B[1];break}default:return}E("event")}})}async function CM1($){let{kc:u,path:f,signal:X,label:J,onEvent:w}=$,E=0;while(!X.aborted){try{let Y=await Cx(u,{method:"GET",path:f,signal:X,headers:{accept:"application/json"}});if(!Y.ok||!Y.body){try{await Y.body?.cancel()}catch{}throw Error(`watch handshake failed: ${Y.status} ${Y.statusText}`)}E=0;for await(let Z of SM1(Y.body)){if(X.aborted)return;try{w(Z)}catch(G){console.warn(`[lifecycle-watcher] ${J} onEvent threw: ${G instanceof Error?G.message:String(G)}`)}}}catch(Y){if(X.aborted)return;let Z=Y instanceof Error?Y.message:String(Y);console.warn(`[lifecycle-watcher] ${J} watch ended: ${Z}`)}if(X.aborted)return;let Q=PJ(5000,250,E,2,0);E+=1,await S3(Q,{signal:X}).catch(()=>{})}}var r83="studio.decocms.com/sandbox-handle",a83="sandbox",p83=300000;var Vk$=U(()=>{bw();lJ0();Dm0()});import{createHash as uX3,randomBytes as fX3,randomUUID as XX3}from"crypto";import*as lk$ from"net";import{PassThrough as JX3}from"stream";class VM1{kind=HY;records=new Map;inflight=new gk0;stateStore;previewUrlPattern;kubeConfig;portForward;namespace;sandboxTemplateName;envName;tokenGenerator;idleTtlMs;metrics;previewGateway;sentinelToken;closed=!1;constructor($={}){this.stateStore=$.stateStore??null,this.previewUrlPattern=$.previewUrlPattern??null,this.kubeConfig=$.kubeConfig??BX3(),this.portForward=new EM1(this.kubeConfig),this.namespace=$.namespace??wX3,this.sandboxTemplateName=$.sandboxTemplateName??EX3,this.envName=KX3($.envName),this.tokenGenerator=$.tokenGenerator??(()=>fX3(YX3).toString("hex")),this.idleTtlMs=$.idleTtlMs??ZX3,this.metrics=$.meter?FX3($.meter):null,this.previewGateway=$.previewGateway&&$.previewUrlPattern?{...$.previewGateway}:null;let u=$.sentinelToken?.trim()??"";this.sentinelToken=u.length>0?u:null}async ensure($,u={}){let f=cH($,u.repo?.branch??null);return this.inflight.run(f,()=>TC1(this.stateStore,$,HY,(X)=>this.ensureLocked($,f,u,X)))}async delete($){let u=await this.getRecord($);if(this.records.delete($),u)this.closeForwarder(u.daemonForward),this.metrics?.active.add(-1,yM1(u.tenant));if(await this.deleteHttpRouteIfManaged($).catch((f)=>{console.warn(`[${zJ}] HTTPRoute delete failed for ${$}: ${f instanceof Error?f.message:String(f)}`)}),await f_(this.kubeConfig,this.namespace,$),this.stateStore)if(u)await this.stateStore.delete(u.id,HY);else await this.stateStore.deleteByHandle(HY,$)}async alive($){return await X_(this.kubeConfig,this.namespace,$)!==void 0}watchClaimLifecycle($,u){return gk$({kc:this.kubeConfig,namespace:this.namespace,claimName:$,signal:u})}async getPreviewUrl($){let u=await this.getRecord($);if(!u)return null;return this.composePreviewUrl(u)}async proxyDaemonRequest($,u,f){let X=await this.getRecord($);if(!X&&this.previewUrlPattern&&this.stateStore){let Q=await this.stateStore.getByHandle(HY,$),Y=Q?.state,Z=Y?.token;if(Q&&Z){let W=`http://${Y?.adoptedSandboxName??$}.${this.namespace}.svc.cluster.local:${J_}`;return KB0(W,Z,u,f)}}if(!X)X=await this.resurrectByHandle($);if(!X)return new Response(JSON.stringify({error:"sandbox not found"}),{status:404,headers:{"content-type":"application/json"}});let J=X,w=performance.now(),E=0;try{let Q=await KB0(X.daemonUrl,X.token,u,f);if(Q.status===401&&!(f.body instanceof ReadableStream)){this.invalidateRecord($);let Y=await this.getRecord($).catch(()=>null);if(Y)J=Y,Q=await KB0(Y.daemonUrl,Y.token,u,f)}return E=Q.status,Q}finally{this.recordProxyDuration("daemon",E,J,performance.now()-w)}}async resolvePreviewUpstreamUrl($){if(this.previewUrlPattern)return`http://${await this.resolveServiceNameForHandle($)}.${this.namespace}.svc.cluster.local:${J_}`;let u=await this.getRecord($);if(u)return u.daemonUrl;let f=await this.resurrectByHandle($);return f?f.daemonUrl:null}async resolveServiceNameForHandle($){let u=this.records.get($);if(u)return u.adoptedSandboxName;if(this.stateStore){let X=(await this.stateStore.getByHandle(HY,$).catch(()=>null))?.state?.adoptedSandboxName;if(X)return X}return $}async proxyPreviewRequest($,u){let f=performance.now(),X=this.records.get($)??null,J=0;try{let w=await this.resolvePreviewUpstreamUrl($);if(!w){J=404;let v=MM1(404,{error:"sandbox not found"});return v.headers.set(qx,"1"),v}let E=new URL(u.url);if((E.pathname==="/_sandbox"||E.pathname.startsWith("/_sandbox/")||E.pathname==="/_decopilot_vm"||E.pathname.startsWith("/_decopilot_vm/"))&&u.method!=="GET")return J=404,MM1(404,{error:"not found"});let Y=(v)=>`${v}${E.pathname}${E.search}`,Z=new Headers(u.headers);for(let v of GX3)Z.delete(v);let G=u.method!=="GET"&&u.method!=="HEAD",W={method:u.method,headers:Z,body:G?u.body:void 0,redirect:"manual",signal:u.signal,duplex:G?"half":void 0},F;try{F=await fetch(Y(w),W)}catch(v){let N=`${w}${E.pathname}`;if(console.warn(`[${zJ}] preview fetch to ${N} failed: ${v instanceof Error?v.message:String(v)}`),u.method==="GET"||u.method==="HEAD"){if(this.invalidateRecord($),await this.resurrectByHandle($).catch(()=>null)){let H=await this.resolvePreviewUpstreamUrl($);if(H)try{F=await fetch(Y(H),W);let _=new Headers;for(let[T,j]of F.headers.entries())if(!bk$.includes(T.toLowerCase()))_.set(T,j);return J=F.status,new Response(F.body,{status:F.status,statusText:F.statusText,headers:_})}catch(_){console.warn(`[${zJ}] preview fetch retry to ${N} failed: ${_ instanceof Error?_.message:String(_)}`)}}}else this.invalidateRecord($);J=502;let O=MM1(502,{error:"sandbox daemon unreachable"});return O.headers.set(qx,"1"),O}let B=new Headers;for(let[v,N]of F.headers.entries())if(!bk$.includes(v.toLowerCase()))B.set(v,N);return J=F.status,new Response(F.body,{status:F.status,statusText:F.statusText,headers:B})}finally{this.recordProxyDuration("preview",J,X,performance.now()-f,$)}}async ensureLocked($,u,f,X){if(f.image)console.warn(`[${zJ}] opts.image ignored (template ${this.sandboxTemplateName} pins image): got ${f.image}`);if(X){let E=await X.get($,HY);if(E){let Q=await this.rehydrate($,u,E);if(Q)return this.finish(Q,X,!1,!0,"resume");await X.delete($,HY)}}let J=await X_(this.kubeConfig,this.namespace,u).catch(()=>{return});if(J)if(J.metadata?.deletionTimestamp)await wm0(this.kubeConfig,this.namespace,u).catch((E)=>{console.warn(`[${zJ}] wait for terminating claim ${u} failed: ${E instanceof Error?E.message:String(E)}`)});else{let E=await this.adopt($,u,J).catch((Q)=>{return console.warn(`[${zJ}] adopt ${u} failed, recreating: ${Q instanceof Error?Q.message:String(Q)}`),null});if(E)return this.finish(E,X,!0,!0,"adopt");await f_(this.kubeConfig,this.namespace,u).catch(()=>{}),await wm0(this.kubeConfig,this.namespace,u).catch((Q)=>{console.warn(`[${zJ}] wait for deleted claim ${u} failed: ${Q instanceof Error?Q.message:String(Q)}`)})}let w=await this.provision($,u,f);return this.finish(w,X,!0,!1,"fresh")}async finish($,u,f,X,J){let w=this.records.has($.handle);if(this.records.set($.handle,$),f)await this.persist(u,$);if(X)await Ak$(this.kubeConfig,this.namespace,$.handle,this.computeShutdownTime()).catch((E)=>console.warn(`[${zJ}] TTL refresh failed for ${$.handle}: ${E instanceof Error?E.message:String(E)}`));if(this.metrics){let E=yM1($.tenant);if(this.metrics.ensureOutcome.add(1,{...E,outcome:J}),!w)this.metrics.active.add(1,E)}return this.toSandbox($)}buildEnvMap($,u){let f={},X=[];for(let[J,w]of Object.entries($.env??{}))if(DX3.has(J))X.push(J);else f[J]=w;if(X.length>0)console.warn(`[${zJ}] opts.env keys overlap reserved bootstrap names and were dropped: ${X.join(",")}`);return{...f,DAEMON_TOKEN:u.token,DAEMON_BOOT_ID:u.daemonBootId,APP_ROOT:u.workdir,PROXY_PORT:String(J_)}}buildClaim($,u,f){let X=this.sentinelToken!==null,J=X?[]:Object.entries(this.buildEnvMap(u,f)).sort(([w],[E])=>w<E?-1:w>E?1:0).map(([w,E])=>({name:w,value:E}));return{apiVersion:`${U7.CLAIM_API_GROUP}/${U7.CLAIM_API_VERSION}`,kind:"SandboxClaim",metadata:{name:$,namespace:this.namespace,labels:{"app.kubernetes.io/name":"studio-sandbox","app.kubernetes.io/managed-by":"studio",...this.envName?{[fG.env]:this.envName}:{},...hM1(u.tenant)}},spec:{sandboxTemplateRef:{name:this.sandboxTemplateName},additionalPodMetadata:{labels:hM1(u.tenant,{[fG.role]:"claimed",[fG.sandboxHandle]:$,...this.envName?{[fG.env]:this.envName}:{}})},env:J,warmpool:X?"default":"none",lifecycle:{shutdownPolicy:"Delete",shutdownTime:this.computeShutdownTime()}}}}async provision($,u,f){let X=this.tokenGenerator(),J=XX3(),w=qM1,E=this.buildClaim(u,f,{token:X,daemonBootId:J,workdir:w});try{await dJ0(this.kubeConfig,this.namespace,E)}catch(F){if(F instanceof xJ0)await wm0(this.kubeConfig,this.namespace,u),await dJ0(this.kubeConfig,this.namespace,E);else throw F}let Q;try{Q=await Ik$(this.kubeConfig,this.namespace,u),await Ym0(this.kubeConfig,this.namespace,Q)}catch(F){throw await f_(this.kubeConfig,this.namespace,u).catch(()=>{}),F}try{await this.ensureServicePortForAdoptedSandbox(Q),await this.ensureHttpRouteForHandle(u,Q,f.tenant??null)}catch(F){throw await f_(this.kubeConfig,this.namespace,u).catch(()=>{}),F}let Y=await this.openForwarder(Q,J_,u),Z=`http://127.0.0.1:${Y.localPort}`,G=this.workloadConfigPayload(f),W=J;try{if(await zB0(Z),this.sentinelToken!==null){let F=await OB0(Z);if(F)W=F.bootId;await zm(Z,this.sentinelToken,G??{},{rotateToken:X})}else if(G)await zm(Z,X,G)}catch(F){throw this.closeForwarder(Y),await this.deleteHttpRouteIfManaged(u).catch(()=>{}),await f_(this.kubeConfig,this.namespace,u).catch(()=>{}),F}return{id:$,handle:u,adoptedSandboxName:Q,token:X,workdir:w,daemonUrl:Z,daemonForward:Y,workload:f.workload??null,daemonBootId:W,tenant:f.tenant??null,ensureOpts:_X3(f)}}workloadConfigPayload($){return AC1({runtime:$?.workload?.runtime??"node",packageManager:$?.workload?.packageManager?{name:$.workload.packageManager,...$.workload.packageManagerPath?{path:$.workload.packageManagerPath}:{}}:null,repo:$?.repo??null,port:$?.workload?.devPort??QX3})}async rebootstrapDaemon($,u,f){if(this.sentinelToken===null)return!1;try{return await zm($,this.sentinelToken,this.workloadConfigPayload(f)??{},{rotateToken:u}),!0}catch(X){return console.warn(`[${zJ}] re-bootstrap failed: ${X instanceof Error?X.message:String(X)}`),!1}}async ensureServicePortForAdoptedSandbox($){if(!this.previewGateway||!this.previewUrlPattern)return;await Mk$(this.kubeConfig,this.namespace,$,{name:"daemon",port:J_,targetPort:J_})}async ensureHttpRouteForHandle($,u,f){if(!this.previewGateway||!this.previewUrlPattern)return;let X=PX3(this.previewUrlPattern,$);if(!X)throw new fX(`Unable to derive preview hostname for ${$} from pattern: ${this.previewUrlPattern}`);let J={apiVersion:`${mJ0.API_GROUP}/${mJ0.API_VERSION}`,kind:"HTTPRoute",metadata:{name:$,namespace:this.namespace,labels:hM1(f??void 0,{[fG.role]:"claimed",[fG.sandboxHandle]:$,"app.kubernetes.io/name":"studio-sandbox","app.kubernetes.io/managed-by":"studio",...this.envName?{[fG.env]:this.envName}:{}})},spec:{parentRefs:[{kind:"Gateway",group:"gateway.networking.k8s.io",name:this.previewGateway.name,namespace:this.previewGateway.namespace}],hostnames:[X],rules:[{backendRefs:[{group:"",kind:"Service",name:u,port:J_}]}]}};await Em0(this.kubeConfig,this.namespace,J)}async deleteHttpRouteIfManaged($){if(!this.previewGateway)return;await Qm0(this.kubeConfig,this.namespace,$)}async rehydrate($,u,f){let X=f.state;if(!X.adoptedSandboxName&&!X.podName||!X.token)return null;let J=await X_(this.kubeConfig,this.namespace,u).catch(()=>{return});if(!J||!ik$(J))return null;let w=J.status?.sandbox?.name??X.adoptedSandboxName??X.podName??u,E=await this.openAndProbeDaemon(w,u);if(!E)return null;if(X.daemonBootId&&X.daemonBootId!==E.bootId){if(this.sentinelToken!==null){if(!await this.rebootstrapDaemon(E.daemonUrl,X.token,X.ensureOpts??null))return this.closeForwarder(E.daemonForward),null}else console.warn(`[${zJ}] daemon restart detected (handle=${u}): stored bootId=${X.daemonBootId} live bootId=${E.bootId}`);await this.stateStore?.put($,HY,{handle:u,state:{...X,daemonBootId:E.bootId}}).catch((Q)=>console.warn(`[${zJ}] bootId persist failed for ${u}: ${Q instanceof Error?Q.message:String(Q)}`))}return{id:$,handle:u,adoptedSandboxName:w,token:X.token,workdir:X.workdir??qM1,daemonUrl:E.daemonUrl,daemonForward:E.daemonForward,workload:X.workload??null,daemonBootId:E.bootId,tenant:X.tenant??null,ensureOpts:X.ensureOpts??null}}async adopt($,u,f){if(!ik$(f))return null;let X=f.status?.sandbox?.name??u;if(this.sentinelToken!==null)return null;let J=vX3(f);if(!J)return null;let w=await this.openAndProbeDaemon(X,u);if(!w)return null;let E=HX3(f);if(this.previewGateway)await this.ensureServicePortForAdoptedSandbox(X).catch((Q)=>{console.warn(`[${zJ}] Service port backfill failed for ${u}: ${Q instanceof Error?Q.message:String(Q)}`)}),await this.ensureHttpRouteForHandle(u,X,E).catch((Q)=>{console.warn(`[${zJ}] HTTPRoute backfill failed for ${u}: ${Q instanceof Error?Q.message:String(Q)}`)});return{id:$,handle:u,adoptedSandboxName:X,token:J,workdir:qM1,daemonUrl:w.daemonUrl,daemonForward:w.daemonForward,workload:null,daemonBootId:w.bootId,tenant:E,ensureOpts:null}}async openAndProbeDaemon($,u){let f=await this.openForwarder($,J_,u).catch(()=>null);if(!f)return null;let X=`http://127.0.0.1:${f.localPort}`,J=await OB0(X);if(!J)return this.closeForwarder(f),null;return{daemonForward:f,daemonUrl:X,bootId:J.bootId}}async getRecord($){let u=this.records.get($);if(u)return u;if(!this.stateStore)return null;let f=await this.stateStore.getByHandle(HY,$);if(!f)return null;let X=await this.rehydrate(f.id,$,f);if(X)this.records.set($,X);return X}async resurrectByHandle($){if(!this.stateStore)return null;let u=await this.stateStore.getByHandle(HY,$);if(!u)return null;let f=u.state.ensureOpts;if(!f)return null;return await this.ensure(u.id,f),this.records.get($)??null}invalidateRecord($){let u=this.records.get($);if(!u)return;this.records.delete($),this.closeForwarder(u.daemonForward)}recordProxyDuration($,u,f,X,J){if(!this.metrics)return;this.metrics.proxyDurationMs.record(X,{...yM1(f?.tenant??null),source:$,sandbox_handle:f?.handle??J??"",status_code:u||0})}composePreviewUrl($){if(this.previewUrlPattern)return Vk0(this.previewUrlPattern,$.handle);return`http://127.0.0.1:${$.daemonForward.localPort}/`}toSandbox($){return{handle:$.handle,workdir:$.workdir,previewUrl:this.composePreviewUrl($)}}async persist($,u){if(!$)return;let f={adoptedSandboxName:u.adoptedSandboxName,token:u.token,workdir:u.workdir,workload:u.workload,daemonBootId:u.daemonBootId,tenant:u.tenant,...u.ensureOpts?{ensureOpts:u.ensureOpts}:{}};await $.put(u.id,HY,{handle:u.handle,state:f})}computeShutdownTime(){return new Date(Date.now()+this.idleTtlMs).toISOString()}openForwarder($,u,f=$){let X=UX3(f,u);return new Promise((J,w)=>{let E=(Q,Y)=>{let Z=lk$.createServer((G)=>this.handleForwardedConnection(G,$,u,f));Z.once("error",(G)=>{if(G.code==="EADDRINUSE"&&Y<WX3){try{Z.close()}catch{}let W=gM1+(Q-gM1+1)%ck$;E(W,Y+1);return}w(G)}),Z.listen(Q,"127.0.0.1",()=>{let G=Z.address();if(!G||typeof G==="string"){Z.close(),w(Error("port-forward listener failed to bind"));return}J({server:Z,localPort:G.port})})};E(X,0)})}handleForwardedConnection($,u,f,X){let J=new JX3,w=null,E=!1,Q=()=>{if(E)return;if(E=!0,J.destroy(),w)try{w.close()}catch{}if(!$.destroyed)$.destroy()};$.pipe(J),$.on("error",Q),$.on("close",Q),this.portForward.portForward(this.namespace,u,[f],$,null,J).then((Y)=>{let Z=typeof Y==="function"?Y():Y;if(!Z){Q();return}if(w=Z,w.on("close",Q),w.on("error",()=>{this.invalidateRecord(X),Q()}),E)try{w.close()}catch{}}).catch((Y)=>{console.warn(`[${zJ}] port-forward to ${u}:${f} failed: ${Y instanceof Error?Y.message:String(Y)}`),this.invalidateRecord(X),Q()})}closeForwarder($){$.server.close((u)=>{if(u)console.warn(`[${zJ}] port-forward close on :${$.localPort} errored: ${u instanceof Error?u.message:String(u)}`)})}close(){if(this.closed)return;this.closed=!0;for(let $ of this.records.values())this.closeForwarder($.daemonForward);this.records.clear()}}function FX3($){return{active:$.createUpDownCounter("studio.sandbox.active",{description:"Active sandbox count, by runner kind and owning org. Cross-checks the cAdvisor-derived count from the cluster \u2014 divergence between the two indicates orphaned claims (mesh deleted but K8s didn't reap) or unattributed pods.",unit:"{sandbox}"}),ensureOutcome:$.createCounter("studio.sandbox.ensure.outcome",{description:"Outcome of each ensure() call: fresh provision, resume from state-store after restart, or adopt of a cluster-side claim mesh didn't know about. Cold-start ratio is the primary input for warm-pool sizing.",unit:"{call}"}),proxyDurationMs:$.createHistogram("studio.sandbox.proxy.duration_ms",{description:"Wall-clock latency of mesh-mediated requests to the sandbox daemon: tool exec proxies (source=daemon) and preview iframe traffic (source=preview).",unit:"ms"})}}function BX3(){let $=new oo;return $.loadFromDefault(),$}function ik$($){return Boolean($.status?.conditions?.some((u)=>u.type==="Ready"&&u.status==="True"))}function vX3($){let u=$.spec?.env;if(!u)return null;for(let f of u)if(f.name==="DAEMON_TOKEN"&&f.value)return f.value;return null}function UX3($,u){let f=uX3("sha256").update(`${$}:${u}`).digest();return gM1+f.readUInt32BE(0)%ck$}function MM1($,u){return new Response(JSON.stringify(u),{status:$,headers:{"content-type":"application/json","access-control-allow-origin":"*"}})}function xk$($){let u=$.slice(0,OX3);return NX3.test(u)?u:""}function KX3($){if($===void 0)return null;let u=$.trim();if(u==="")return null;if(!zX3.test(u))throw Error(`AgentSandboxProvider: envName=${JSON.stringify(u)} is not a valid DNS-label-safe environment name (lowercase alphanumeric or '-', starts with a letter, ends alphanumeric, \u226432 chars). Mesh sets this from STUDIO_ENV; check the studio chart's configMap.`);return u}function hM1($,u={}){let f={...u};if($){let X=xk$($.orgId),J=xk$($.userId);if(X)f[fG.orgId]=X;if(J)f[fG.userId]=J}return f}function HX3($){let u=$.metadata?.labels;if(!u)return null;let f=u[fG.orgId],X=u[fG.userId];if(!f||!X)return null;return{orgId:f,userId:X}}function yM1($){return{org_id:$?.orgId??"",user_id:$?.userId??"",runner_kind:HY}}function _X3($){let u={};if($.repo)u.repo=$.repo;if($.workload)u.workload=$.workload;if($.env&&Object.keys($.env).length>0)u.env=$.env;if($.tenant)u.tenant=$.tenant;return Object.keys(u).length>0?u:null}function PX3($,u){try{return new URL(Vk0($,u)).hostname||null}catch{return null}}var HY="cluster",zJ="AgentSandboxProvider",qx="x-sandbox-preview-not-ready",wX3="agent-sandbox-system",EX3="studio-sandbox",J_=9000,QX3=3000,qM1="/app",YX3=32,DX3,ZX3=900000,GX3,bk$,gM1=40000,ck$=1e4,WX3=256,fG,NX3,OX3=63,zX3;var dk$=U(()=>{_M1();M91();bk0();Dm0();lJ0();Vk$();DX3=new Set(["DAEMON_TOKEN","DAEMON_BOOT_ID","APP_ROOT","PROXY_PORT"]),GX3=["cookie","host","connection","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","accept-encoding","content-length","upgrade"],bk$=["connection","keep-alive","transfer-encoding","content-encoding","content-length"];fG={role:"studio.decocms.com/role",sandboxHandle:"studio.decocms.com/sandbox-handle",orgId:"studio.decocms.com/org-id",userId:"studio.decocms.com/user-id",env:"studio.decocms.com/env"},NX3=/^([A-Za-z0-9]([-A-Za-z0-9_.]*[A-Za-z0-9])?)?$/;zX3=/^[a-z]([a-z0-9-]{0,30}[a-z0-9])?$/});var mk$={};Y1(mk$,{waitForSandboxReady:()=>Ym0,getSandboxClaim:()=>X_,getHttpRoute:()=>qk$,deleteSandboxClaim:()=>f_,deleteHttpRoute:()=>Qm0,createSandboxClaim:()=>dJ0,createHttpRoute:()=>Em0,SandboxTimeoutError:()=>Rx,SandboxError:()=>fX,PREVIEW_NOT_READY_HEADER:()=>qx,KubeConfig:()=>oo,K8S_CONSTANTS:()=>U7,HTTPROUTE_CONSTANTS:()=>mJ0,AgentSandboxProvider:()=>VM1});var bM1=U(()=>{_M1();lJ0();Dm0();dk$()});class Zm0{kind=w_;userSub;dispatch;stateStore;records=new Map;constructor($){if(!$.userSub)throw Error("DesktopSandboxProvider requires userSub");if(!$.dispatch)throw Error("DesktopSandboxProvider requires dispatch");this.userSub=$.userSub,this.dispatch=$.dispatch,this.stateStore=$.stateStore??null}async ensure($,u={}){let f=cH($,u.repo?.branch),X=this.records.get(f);if(X){if(await this.probeHealth(f))return this.toSandbox(X);if(this.records.delete(f),this.stateStore)await this.stateStore.deleteByHandle(w_,f).catch(()=>{})}else if(this.stateStore){let G=(await this.stateStore.getByHandle(w_,f))?.state,W=G?.sandboxApiUrl;if(W){if(await this.probeHealth(f)){let F={handle:f,sandboxApiUrl:W,previewUrl:G?.previewUrl??W};return this.records.set(f,F),this.toSandbox(F)}await this.stateStore.deleteByHandle(w_,f).catch(()=>{})}}let J=JSON.stringify({handle:f,repo:u.repo,branch:u.repo?.branch,...u.workload?{workload:u.workload}:{},...u.offloadAllowedHosts?{offloadAllowedHosts:u.offloadAllowedHosts}:{},...u.offloadAllowSameHostDev!==void 0?{offloadAllowSameHostDev:u.offloadAllowSameHostDev}:{}}),w=await this.dispatchJson("POST","/api/sandboxes",J),E=JSON.parse(w);if(typeof E.sandboxApiUrl!=="string")throw Error("desktop ensure: daemon did not return a sandboxApiUrl string");let Q=typeof E.previewUrl==="string"?E.previewUrl:E.sandboxApiUrl,Y={handle:f,sandboxApiUrl:E.sandboxApiUrl,previewUrl:Q};if(this.records.set(f,Y),this.stateStore)await this.stateStore.put($,w_,{handle:f,state:{handle:f,sandboxApiUrl:E.sandboxApiUrl,previewUrl:Q}});return this.toSandbox(Y)}async proxyDaemonRequest($,u,f){let X=u.startsWith("/")?u:`/${u}`,J=X.startsWith("/_sandbox/")?X.slice(9):X,w=`/_sandbox/${encodeURIComponent($)}${J}`,E=new Headers(f.headers);for(let z of["host","cookie","connection","keep-alive","transfer-encoding","upgrade","authorization"])E.delete(z);let Q={};E.forEach((z,H)=>{Q[H]=z});let Y;if(f.body!=null)Y=await jX3(f.body);let G=this.dispatch(this.userSub,{method:f.method,path:w,headers:Q,body:Y},{signal:f.signal})[Symbol.asyncIterator](),W=200,F={"content-type":"application/octet-stream"},B=[];try{while(!0){let z=await G.next();if(z.done)break;let H=z.value;if(H.headers){W=H.headers.status,F=H.headers.headers;break}if(H.data!=null)B.push(H.data)}}catch(z){let H=z instanceof Error?z.message:"dispatch error";return new Response(JSON.stringify({error:H}),{status:502,headers:{"content-type":"application/json"}})}let v=!1,N=new TextEncoder,O=new ReadableStream({async start(z){for(let H of B)z.enqueue(N.encode(H))},async pull(z){try{let H=await G.next();if(v)return;if(H.done){z.close();return}let _=H.value;if(_.data!=null)z.enqueue(N.encode(_.data))}catch(H){if(!v)z.error(H)}},cancel(){v=!0,G.return?.()}});return new Response(O,{status:W,headers:F})}async alive($){return this.probeHealth($)}async probeHealth($){let u=new AbortController,f=setTimeout(()=>u.abort(),1500);try{return await this.dispatchJson("GET",`/api/sandboxes/${encodeURIComponent($)}`,void 0,u.signal),!0}catch{return!1}finally{clearTimeout(f)}}async forgetHandle($){if(this.records.delete($),this.stateStore)await this.stateStore.deleteByHandle(w_,$).catch(()=>{})}async delete($){if(this.records.delete($),this.stateStore)await this.stateStore.deleteByHandle(w_,$).catch(()=>{});try{await this.dispatchJson("DELETE",`/api/sandboxes/${encodeURIComponent($)}`)}catch(u){if(!(u instanceof Error?u.message:String(u)).includes("404"))throw u}}async getPreviewUrl($){return(await this.resolveRecord($))?.previewUrl??null}async localWorkdir($){return null}async*watchClaimLifecycle($,u){yield{kind:"ready"}}toSandbox($){return{handle:$.handle,workdir:$.sandboxApiUrl,previewUrl:$.previewUrl}}async resolveRecord($){let u=this.records.get($);if(u)return u;if(!this.stateStore)return null;let X=(await this.stateStore.getByHandle(w_,$))?.state,J=X?.sandboxApiUrl;if(!J)return null;let w={handle:$,sandboxApiUrl:J,previewUrl:X?.previewUrl??J};return this.records.set($,w),w}async dispatchJson($,u,f,X){let J={accept:"application/json"};if(f!==void 0)J["content-type"]="application/json";let w=this.dispatch(this.userSub,{method:$,path:u,headers:J,body:f},{signal:X}),E=null,Q="";for await(let Y of w)if(Y.headers)E=Y.headers.status;else if(Y.data!=null)Q+=Y.data;if(E!=null&&(E<200||E>=300))throw Error(`daemon returned ${E}: ${Q}`);return Q}}function nk$($){return new Zm0($)}async function jX3($){if(typeof $==="string")return $;if($ instanceof ArrayBuffer)return Buffer.from($).toString("utf8");if(ArrayBuffer.isView($))return Buffer.from($.buffer,$.byteOffset,$.byteLength).toString("utf8");if($ instanceof URLSearchParams)return $.toString();return await new Response($).text()}var w_="user-desktop";var tk$=U(()=>{bk0()});var rk$={};Y1(rk$,{createDesktopProvider:()=>nk$,DesktopSandboxProvider:()=>Zm0});var ak$=U(()=>{tk$()});var uR$={};Y1(uR$,{subscribeLifecycle:()=>tJ0,getSandboxProviderByKind:()=>nJ0,getOrInitSharedRunner:()=>CX3,buildDesktopProvider:()=>fs,__resetSharedLifecyclesForTesting:()=>gX3});function ek$($,u){let f=pk$[$];if(f)return Promise.resolve(f);let X=iM1[$];if(X)return X;let J=u().then((w)=>{return pk$[$]=w,w}).finally(()=>{delete iM1[$]});return iM1[$]=J,J}function AX3(){let $=process.env.STUDIO_SANDBOX_PREVIEW_URL_PATTERN;return $&&$.trim()!==""?$:void 0}function IX3(){let $=process.env.STUDIO_SANDBOX_TEMPLATE_NAME;return $&&$.trim()!==""?$:void 0}function SX3(){let $=process.env.STUDIO_ENV;return $&&$.trim()!==""?$:void 0}function kX3(){let $=process.env.STUDIO_SANDBOX_SENTINEL_TOKEN;return $&&$.trim()!==""?$:void 0}function RX3(){let $=process.env.STUDIO_SANDBOX_PREVIEW_GATEWAY_NAME?.trim(),u=process.env.STUDIO_SANDBOX_PREVIEW_GATEWAY_NAMESPACE?.trim();if(!$&&!u)return;if(!$||!u)throw Error("STUDIO_SANDBOX_PREVIEW_GATEWAY_NAME and STUDIO_SANDBOX_PREVIEW_GATEWAY_NAMESPACE must both be set, or both unset. Half-configured per-claim HTTPRoute routing would silently fail to attach.");return{name:$,namespace:u}}async function $R$($,u){let f=new mH(u),X=AX3();switch($){case"cluster":{let{AgentSandboxProvider:J}=await Promise.resolve().then(() => (bM1(),mk$));return new J({stateStore:f,previewUrlPattern:X,sandboxTemplateName:IX3(),envName:SX3(),previewGateway:RX3(),sentinelToken:kX3(),meter:IQ})}case"user-desktop":throw Error("user-desktop runner cannot be instantiated without a per-run link claim \u2014 call resolveSandboxProvider, which binds the link before constructing the provider.");default:throw Error(`Unknown runner kind: ${String($)}`)}}async function fs($,u){let{DesktopSandboxProvider:f}=await Promise.resolve().then(() => (ak$(),rk$)),{getDispatch:X}=await Promise.resolve().then(() => (lM1(),xM1)),J=new mH($.db);if(!u)throw Error("buildDesktopProvider: userSub must be a non-empty string");return new f({userSub:u,dispatch:X(),stateStore:J})}function nJ0($,u){return ek$(u,()=>$R$(u,$.db))}async function CX3(){let $;try{$=zF()}catch(f){return console.warn("[lifecycle] cannot resolve sandbox runner:",f instanceof Error?f.message:String(f)),null}return await ek$($,()=>$R$($,x6().db))}function tJ0($,u,f){let X=E_.get(u);if(X){if(X.terminated){if(X.lastPhase)try{f(X.lastPhase)}catch{}return{unsubscribe:hX3}}if(X.listeners.add(f),X.lastPhase)try{f(X.lastPhase)}catch{}return ok$(u,X,f)}let J=new AbortController,w={lastPhase:null,terminated:!1,listeners:new Set([f]),abort:J};return E_.set(u,w),yX3($,u,w),ok$(u,w,f)}function hX3(){}function ok$($,u,f){return{unsubscribe(){if(E_.get($)!==u)return;if(u.listeners.delete(f),u.listeners.size===0)E_.delete($),u.abort.abort()}}}async function yX3($,u,f){let X=null;try{for await(let J of $.watchClaimLifecycle(u,f.abort.signal)){if(f.abort.signal.aborted)break;f.lastPhase=J;let w=J.kind==="ready"||J.kind==="failed";if(w)f.terminated=!0;let E=Array.from(f.listeners);for(let Q of E)try{Q(J)}catch{}if(w)break}}catch(J){X=J}finally{if(!f.terminated&&!f.abort.signal.aborted&&f.listeners.size>0){let J={kind:"failed",reason:"unknown",message:X instanceof Error?X.message:"Lifecycle watcher ended unexpectedly"};f.lastPhase=J,f.terminated=!0;for(let w of Array.from(f.listeners))try{w(J)}catch{}}if(E_.get(u)===f)E_.delete(u)}}function gX3(){for(let $ of E_.values())$.abort.abort();E_.clear()}var LX3,TX3,sk$,pk$,iM1,qX3,MX3,E_;var Mx=U(()=>{VU();JE();ew();ck0();LX3=Symbol.for("decocms.sandbox.lifecycle.runners"),TX3=Symbol.for("decocms.sandbox.lifecycle.inflight"),sk$=globalThis,pk$=sk$[LX3]??={},iM1=sk$[TX3]??={};qX3=Symbol.for("decocms.sandbox.lifecycle.shared-lifecycles"),MX3=globalThis,E_=MX3[qX3]??=new Map});async function Gm0($,u){if(await u.linkClaimRegistry.get($))return"user-desktop";return u.resolveEnvKind()}async function nU($,u){let{userId:f,branch:X,virtualMcpMetadata:J,explicitKind:w}=u;if(w)return{provider:await Wm0($,f,w),kind:w};if($.sandboxPreference==="user-desktop"&&$.linkForCurrentRun)return{provider:await fs($,f),kind:"user-desktop"};if($.sandboxPreference==="cluster-default"){let G=zF();return{provider:await Wm0($,f,G),kind:G}}let[E,...Q]=VX3(J,f,X);if(E){let G=Q.length===0?E:await bX3($,f,E,Q);return{provider:await Wm0($,f,G),kind:G}}let Y=await fR$($,f);return{provider:await Wm0($,f,Y),kind:Y}}function VX3($,u,f){let X=u2($)[u]?.[f];if(!X)return[];let J=hv(X);return Object.keys(J)}async function bX3($,u,f,X){let J=await fR$($,u);if(J===f||X.includes(J))return J;return f}async function fR$($,u){if(!$.linkClaimRegistry)return zF();return Gm0(u,{linkClaimRegistry:$.linkClaimRegistry,resolveEnvKind:zF})}async function Wm0($,u,f){if(f!=="user-desktop")return nJ0($,f);if(!$.linkClaimRegistry)throw Error("user-desktop sandbox provider requires ctx.linkClaimRegistry to be wired (set on MeshContextConfig).");if(!await $.linkClaimRegistry.get(u))throw Error(`No link daemon registered for user "${u}". Start one with \`deco link\` (or run \`bun run dev --local-sandbox-provider\` for dev).`);return fs($,u)}var rJ0=U(()=>{iu();VU();bU();Mx()});async function XR$($,u){if(!$)return{hosts:[],allowSameHostDev:!1};let f;try{f=await $.presignedGetUrl("link-dispatch/_allowlist_probe",60,{requireFetchable:!0})}catch{return{hosts:[],allowSameHostDev:!1}}let X;try{X=new URL(f)}catch{return{hosts:[],allowSameHostDev:!1}}if(X.protocol!=="https:"&&X.protocol!=="http:")return{hosts:[],allowSameHostDev:!1};let J=X.hostname,w=iX3.has(J);return{hosts:[J],allowSameHostDev:w&&!u.isProduction}}var iX3;var JR$=U(()=>{iX3=new Set(["127.0.0.1","localhost","::1","[::1]","0.0.0.0"])});async function Fm0($,u){X1(u);let f=r0(u),X=W$(u);if(!X)throw Error("User ID required");let J=await u.storage.virtualMcps.findById($.virtualMcpId);if(!J||J.organization_id!==f.id)throw Error("Virtual MCP not found");let w=J.metadata??{},E=dH(u2(w),X,$.branch,$.sandboxProviderKind),Q=$.sandboxProviderKind,{provider:Y}=await nU(u,{userId:X,branch:$.branch,virtualMcpMetadata:w,explicitKind:Q});if(E){if(Q!=="user-desktop")return E;if(await Y.alive(E.sandboxHandle).catch(()=>!1))return E;await bo(u.storage.virtualMcps,$.virtualMcpId,X,X,$.branch,Q).catch((F)=>{console.warn("[ensureSandbox] failed to reap stale user-desktop entry",F)})}let Z=w.githubRepo??null,{entry:G}=await wR$({ctx:u,userId:X,orgId:f.id,virtualMcpId:$.virtualMcpId,branch:$.branch,metadata:w,githubRepo:Z,existing:null,providerKind:Q,runner:Y});return G}async function wR$($){let{ctx:u,userId:f,orgId:X,virtualMcpId:J,branch:w,metadata:E,githubRepo:Q,existing:Y,runner:Z}=$,{runtime:G,packageManager:W,port:F,packageManagerPath:B}=iP$(E),v;if(Q){let{cloneUrl:h,gitUserName:i,gitUserEmail:l}=Q.connectionId?await lP$(Q.connectionId,Q.owner,Q.name,u.db,u.vault):xP$(Q.owner,Q.name);if(!W){let M=Q.connectionId?await nP$(Q.connectionId,Q.owner,Q.name,u.db,u.vault):await tP$(Q.owner,Q.name);if(M)W=M.packageManager,G=_J0[M.packageManager].runtime,F=M.devPort??F,await xX3(u,J,f,M.packageManager,M.devPort)}v={cloneUrl:h,userName:i,userEmail:l,branch:w,displayName:`${Q.owner}/${Q.name}`}}let N=G&&W?{runtime:G,packageManager:W,...F!==null?{devPort:Number(F)}:{},...B?{packageManagerPath:B}:{}}:void 0,O=XI({orgId:X,virtualMcpId:J,branch:w}),z=Z.kind==="user-desktop"?await XR$(u.objectStorage,{isProduction:g4().nodeEnv==="production"}):null,H=await Z.ensure({userId:f,projectRef:O},{repo:v,workload:N,tenant:{orgId:X,userId:f},...z?{offloadAllowedHosts:z.hosts,offloadAllowSameHostDev:z.allowSameHostDev}:{}}),_=E.runtime?.env??null;await lk0({ctx:u,runner:Z,handle:H.handle,orgId:X,userId:f,entries:_});let j=!!Y&&Y.sandboxHandle===H.handle&&Y?.createdAt?Y.createdAt:Date.now(),I=E.runtime?.selected??null,R=E.runtime?.port??null,S=E.runtime?.path??null,q={sandboxHandle:H.handle,previewUrl:H.previewUrl,sandboxApiUrl:H.previewUrl,sandboxProviderKind:Z.kind,createdAt:j,startedWith:{packageManager:I,port:R,path:S}};await VP$(u.storage.virtualMcps,J,f,f,w,$.providerKind,q);let y=!Y||Y.sandboxHandle!==H.handle;return{entry:q,isNewVm:y}}async function xX3($,u,f,X,J){let w=await $.storage.virtualMcps.findById(u);if(!w)return;let E=w.metadata??{};await $.storage.virtualMcps.update(u,f,{metadata:{...E,runtime:{selected:X,port:J}}})}var cM1;var Bm0=U(()=>{m0();VU();C1();xk0();SC1();bU();cP$();aP$();aS1();IC1();rJ0();JR$();e3();bU();cM1=y0({name:"SANDBOX_START",description:"Start a sandbox with the connected GitHub repo and dev server.",annotations:{title:"Start VM Preview",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!1,openWorldHint:!0},_meta:{ui:{visibility:"app"}},inputSchema:D.object({virtualMcpId:D.string().describe("Virtual MCP ID"),branch:D.string().min(1).optional().describe("Optional git branch to check out. When omitted the handler generates `deco/<adjective>-<noun>` and uses it. The resolved branch is returned in the response so callers can persist it."),sandboxProviderKind:D.enum(["cluster","user-desktop"]).optional().describe("Explicit runtime choice. When omitted, defaults to `user-desktop` if the acting user's link daemon is online, else the cluster env kind.")}),outputSchema:D.object({previewUrl:D.string().nullable(),sandboxHandle:D.string(),branch:D.string(),isNewVm:D.boolean(),sandboxProviderKind:D.enum(["cluster","user-desktop"])}),handler:async($,u)=>{X1(u);let f=$.branch??MS0(),X=W$(u);if(!X)throw Error("User ID required");let{provider:J,kind:w}=await nU(u,{userId:X,branch:f,virtualMcpMetadata:null,explicitKind:$.sandboxProviderKind}),{metadata:E,userId:Q,organization:Y,entry:Z}=await ik0({virtualMcpId:$.virtualMcpId,branch:f,sandboxProviderKind:w},u),G=E.githubRepo??null,{entry:W,isNewVm:F}=await wR$({ctx:u,userId:Q,orgId:Y.id,virtualMcpId:$.virtualMcpId,branch:f,metadata:E,githubRepo:G,existing:Z,providerKind:w,runner:J});return{...W,branch:f,isNewVm:F,sandboxProviderKind:w}}})});var dM1;var ER$=U(()=>{m0();C1();xk0();Mx();bU();dM1=y0({name:"SANDBOX_DELETE",description:"Delete a sandbox.",annotations:{title:"Delete VM Preview",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!0},_meta:{ui:{visibility:"app"}},inputSchema:D.object({virtualMcpId:D.string().describe("Virtual MCP ID that owns this VM"),branch:D.string().min(1).describe("Branch whose vm should be deleted (sandboxMap[userId][branch])"),sandboxProviderKind:D.enum(["cluster","user-desktop"]).describe("Kind of sandbox provider the VM was started with. Used to locate the correct 3-level sandboxMap entry.")}),outputSchema:D.object({success:D.boolean()}),handler:async($,u)=>{let f=$.sandboxProviderKind,X;try{X=await ik0($,u)}catch(Q){if(Q instanceof Error&&Q.message==="Virtual MCP not found")return{success:!0};throw Q}let{entry:J,userId:w}=X;if(!J)return{success:!0};return await bo(u.storage.virtualMcps,$.virtualMcpId,w,w,$.branch,f),await(await nJ0(u,f)).delete(J.sandboxHandle).catch((Q)=>console.error(`[SANDBOX_DELETE] ${f} ${J.sandboxHandle}: ${Q instanceof Error?Q.message:String(Q)}`)),{success:!0}}})});var QR$=U(()=>{Bm0();ER$()});var cX3="https://api.github.com",mM1;var YR$=U(()=>{m0();C1();PA0();SH();mM1=y0({name:"GITHUB_LIST_USER_ORGS",description:"List GitHub App installations (orgs/accounts) accessible to the authenticated user.",annotations:{title:"List GitHub User Orgs",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!0},_meta:{ui:{visibility:"app"}},inputSchema:D.object({connectionId:D.string().describe("ID of the mcp-github connection to use")}),outputSchema:D.object({installations:D.array(D.object({installationId:D.number(),login:D.string(),avatarUrl:D.string(),type:D.string()})),appSlug:D.string().optional()}),handler:async($,u)=>{await u.access.check();let f=new D9(u.db,u.vault),X=await f.get($.connectionId);if(!X)throw Error("No GitHub token found. Ensure the mcp-github connection is authenticated.");let J=X.accessToken;if(QX0(X)&&f.isExpired(X,_A0)){let G=await YX0(X,f);if(!G)throw Error(uA);J=G,X=await f.get($.connectionId)??X}let w=[],E,Q=1,Y=100,Z=async(G)=>fetch(`${cX3}/user/installations?per_page=${Y}&page=${Q}`,{headers:{Authorization:`Bearer ${G}`,Accept:"application/vnd.github+json","X-GitHub-Api-Version":"2022-11-28"}});while(!0){let G=await Z(J);if(G.status===401){let F=await f.get($.connectionId);if(!F||!QX0(F))throw Error(uA);let B=await YX0(F,f);if(!B)throw Error(uA);if(J=B,G=await Z(J),G.status===401)throw Error(uA)}if(!G.ok)throw Error(`GitHub /user/installations failed: ${G.status}`);let W=await G.json();for(let F of W.installations){if(!E)E=F.app_slug??F.app?.slug;w.push({installationId:F.id,login:F.account.login,avatarUrl:F.account.avatar_url,type:F.account.type})}if(W.installations.length<Y)break;Q++}return{installations:w,...E?{appSlug:E}:{}}}})});var DR$=U(()=>{YR$()});var ZR$=()=>{};var nM1=U(()=>{ZR$();nQ1()});var tM1;var GR$=U(()=>{m0();nM1();C1();tM1=y0({name:"LINK_CURRENT_GET",description:"Return the calling user's currently registered desktop link, or `online: false` if no link is registered or the TTL has expired.",inputSchema:s0.object({}),outputSchema:s0.object({online:s0.boolean(),machineId:s0.string().optional(),hostname:s0.string().optional(),cliVersion:s0.string().optional(),capabilities:s0.array(mQ1).default([])}),handler:async($,u)=>{X1(u),await u.access.check();let f=u.linkClaimRegistry;if(!f)return{online:!1,capabilities:[]};let X=await f.get(u.auth.user.id);if(!X)return{online:!1,capabilities:[]};return{online:!0,machineId:X.machineId,hostname:X.hostname,cliVersion:X.cliVersion,capabilities:X.capabilities}}})});var WR$=U(()=>{GR$()});function FR$($){if(!$)return"";return typeof $==="string"?$:$.toISOString()}var tX3,rX3,aX3,pX3,oX3,rM1;var BR$=U(()=>{m0();C1();tX3=["thread"],rX3=D.object({type:D.literal("thread"),id:D.string(),title:D.string(),created_at:D.string(),updated_at:D.string(),virtual_mcp_id:D.string().nullable(),run_config:D.record(D.string(),D.unknown()).nullable(),status:D.string().nullable()}),aX3=D.discriminatedUnion("type",[rX3]),pX3=D.object({query:D.string().min(1).describe("Free-text search query."),limit:D.number().int().min(1).max(50).optional().describe("Maximum results per resource type (default: 20)."),types:D.array(D.enum(tX3)).optional().describe("Restrict the search to specific resource types. Omit to search across all available types.")}),oX3=D.object({items:D.array(aX3),totalCount:D.number()});rM1=y0({name:"GLOBAL_SEARCH",description:"Search across organization resources by free-text query. Returns a typed union of matches (currently: threads). New resource types may be added over time without changes to the call shape.",annotations:{title:"Global Search",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:pX3,outputSchema:oX3,handler:async($,u)=>{await u.access.check(),r0(u);let f=$.limit??20,X=$.types?.length?new Set($.types):null,J=!X||X.has("thread"),w=[],E=0;if(J){let{threads:Q,total:Y}=await u.storage.threads.list(void 0,{limit:f,offset:0,search:$.query,includeArchived:!1});E+=Y;for(let Z of Q)w.push({type:"thread",id:Z.id,title:Z.title??"",created_at:FR$(Z.created_at),updated_at:FR$(Z.updated_at),virtual_mcp_id:Z.virtual_mcp_id??null,run_config:Z.run_config??null,status:Z.status??null})}return{items:w,totalCount:E}}})});var vR$=U(()=>{BR$()});var SS0={};Y1(SS0,{managementMCP:()=>jo,listManagementTools:()=>u73,ALL_TOOLS:()=>UR$});async function u73($){let u=await jo($),[f,X]=P80.createLinkedPair();await u.connect(X);let J=new m8({name:"tools-hydration",version:"1.0.0"});try{return await J.connect(f),(await J.listTools()).tools}finally{await J.close().catch(()=>{})}}var eX3,$73,UR$,jo=async($)=>{let u=null;if($.organization){let E=await $.storage.organizationSettings.get($.organization.id),Q=await $.storage.virtualMcps.list($.organization.id),Y=new Set(E?.enabled_plugins??[]);for(let Z of Q){let G=Z.metadata?.enabled_plugins;if(G&&Array.isArray(G))for(let W of G)Y.add(W)}u=Y.size>0?[...Y]:null}let f=J1$(UR$,u),X=new gv({name:"mcp-cms-management",version:"1.0.0"},{capabilities:{tools:{},prompts:{},resources:{}}});for(let E of f){let Q=E.inputSchema&&typeof E.inputSchema==="object"&&"shape"in E.inputSchema?E.inputSchema:D.object({}),Y=E.outputSchema&&typeof E.outputSchema==="object"&&"shape"in E.outputSchema?E.outputSchema:void 0,Z=Q.shape,G=Y?.shape;X.registerTool(E.name,{description:E.description??"",inputSchema:Z,outputSchema:G,annotations:E.annotations,_meta:E._meta},async(W)=>{$.access.setToolName(E.name);try{let F=await E.execute(W,$);return{content:[{type:"text",text:E.modelSummary?E.modelSummary(F):JSON.stringify(F)}],structuredContent:F}}catch(F){return{content:[{type:"text",text:`Error: ${F.message}`}],isError:!0}}})}let J=wk0();for(let E of J){let Q=E.arguments?.length?Object.fromEntries(E.arguments.map((Y)=>{let Z=Y.required?D.string():D.string().optional();return[Y.name,Y.description?Z.describe(Y.description):Z]})):void 0;X.registerPrompt(E.name,{title:E.title,description:E.description,...Q?{argsSchema:Q}:{}},(Y)=>{return{messages:[{role:"user",content:{type:"text",text:typeof E.text==="function"?E.text(Y??{}):E.text}}]}})}if($.organization?.id){let E=await $.storage.brandContext.list($.organization.id),Q=new Set;for(let Y of E){let Z=Y.name.toLowerCase().replace(/[^a-z0-9]+/g,"-").replace(/^-|-$/g,""),G=Z?`brand-${Z}`:`brand-${Y.id}`;if(Q.has(G))G=`${G}-${Y.id.slice(0,8)}`;Q.add(G);let W=[`# Brand: ${Y.name}`,"",`**Domain:** ${Y.domain}`,"","## Overview",Y.overview];if(Y.colors){let B=Object.entries(Y.colors).filter(([,v])=>v);if(B.length>0){W.push("","## Colors");for(let[v,N]of B)W.push(`- **${v}:** ${N}`)}}if(Y.fonts){let B=Object.entries(Y.fonts).filter(([,v])=>v);if(B.length>0){W.push("","## Fonts");for(let[v,N]of B)W.push(`- ${N} (${v})`)}}if(Y.logo)W.push("",`**Logo:** ${Y.logo}`);if(Y.favicon)W.push(`**Favicon:** ${Y.favicon}`);if(Y.ogImage)W.push(`**OG Image:** ${Y.ogImage}`);if(Y.images&&Y.images.length>0){W.push("","## Images");for(let B of Y.images){let v=Object.entries(B).map(([N,O])=>`${N}: ${O}`).join(", ");W.push(`- ${v}`)}}let F=W.join(`
+`))>=0){let Y=X.slice(0,Q).trim();if(X=X.slice(Q+1),!Y)continue;yield JSON.parse(Y)}}let J=X.trim();if(J)yield JSON.parse(J)}finally{u.releaseLock()}}var jM1,Tk$,Sk$="gateway.networking.k8s.io",kk$="v1",IM1="httproutes",Rk$,mJ0,t83="mesh-sandbox-runner";var Dm0=U(()=>{lJ0();jM1=class jM1 extends Error{status;body;constructor($,u,f){super(f);this.status=$;this.body=u;this.name="KubeHttpError"}};Tk$=`/apis/${U7.CLAIM_API_GROUP}/${U7.CLAIM_API_VERSION}/namespaces`;Rk$=`/apis/${Sk$}/${kk$}/namespaces`;mJ0={API_GROUP:Sk$,API_VERSION:kk$,PLURAL:IM1}});async function*gk$($){let u=$.now??(()=>Date.now()),f=u(),X=$.schedulingTimeoutMs??p83,J={pod:{},sandbox:{},events:{hasPulling:!1,hasPulled:!1},startedAt:f},w=[],E=null,Q=!1,Y=(H)=>{if(Q)return;if(E){let _=E;E=null,_(H)}else w.push(H)},Z=()=>{if(w.length>0)return Promise.resolve(w.shift());if(Q)return Promise.resolve(null);return new Promise((H)=>{E=H})},G=()=>{if(Q)return;if(Q=!0,E){let H=E;E=null,H(null)}},W=new AbortController,F=()=>{W.abort(),G()};if($.signal)if($.signal.aborted)W.abort(),G();else $.signal.addEventListener("abort",F,{once:!0});let B=Math.max(0,X-(u()-f)),v=setTimeout(()=>Y("tick"),B+100),N,O=new Promise((H)=>{N=H}),z=Promise.allSettled([o83($.kc,$.namespace,$.claimName,W.signal,J,Y,u,N),e83($.kc,$.namespace,$.claimName,W.signal,J,Y),$X3($.kc,$.namespace,$.claimName,O,W.signal,J,Y,u)]);try{let H=null,_=-1,T=hk$(J,X,u);if(H=RM1(T),!kM1(T))_=yk$(T);if(yield T,kM1(T))return;while(!Q){if(await Z()===null)break;let I=hk$(J,X,u);if(kM1(I)){let q=RM1(I);if(q!==H)H=q,yield I;return}let R=yk$(I);if(R<_)continue;let S=RM1(I);if(S!==H)H=S,_=R,yield I}}finally{if(clearTimeout(v),W.abort(),$.signal)$.signal.removeEventListener("abort",F);G(),await z.catch(()=>{})}}function hk$($,u,f){let{pod:X,sandbox:J,events:w,startedAt:E}=$;if(J.ready)return{kind:"ready"};let Q=X.containerWaitingReason;if(Q==="ImagePullBackOff"||Q==="ErrImagePull")return{kind:"failed",reason:"image-pull-backoff",message:"Sandbox image failed to download. The cluster may be missing pull credentials or the image tag may not exist."};if(Q==="CrashLoopBackOff")return{kind:"failed",reason:"crash-loop-backoff",message:"Sandbox crashed during startup and is now in CrashLoopBackOff. Check pod logs."};if(!X.scheduled&&w.lastFailedSchedulingAt!==void 0&&f()-E>u)return{kind:"failed",reason:"scheduling-timeout",message:w.failedSchedulingMessage??`Pod could not be scheduled within ${Math.round(u/1000)}s.`};if(X.containerRunning&&!X.containerReady)return{kind:"warming-daemon",since:E};if(w.hasPulling&&!w.hasPulled)return{kind:"pulling-image",since:E};if(Q==="ContainerCreating"||Q==="PodInitializing"||X.scheduled&&!X.containerRunning)return{kind:"starting-container",since:E};if(X.scheduledFalseReason==="Unschedulable"||w.lastFailedSchedulingAt!==void 0&&!X.scheduled)return{kind:"waiting-for-capacity",since:E,message:w.failedSchedulingMessage??X.scheduledFalseMessage,nodeClaim:w.nominatedNodeClaim};return{kind:"claiming",since:E}}function kM1($){return $.kind==="ready"||$.kind==="failed"}function yk$($){switch($.kind){case"claiming":return 0;case"waiting-for-capacity":return 1;case"pulling-image":return 2;case"starting-container":return 3;case"warming-daemon":return 4;case"ready":case"failed":return 99}}function RM1($){switch($.kind){case"claiming":case"pulling-image":case"starting-container":case"warming-daemon":return $.kind;case"waiting-for-capacity":return`waiting-for-capacity:${$.message??""}:${$.nodeClaim??""}`;case"ready":return"ready";case"failed":return`failed:${$.reason}:${$.message}`}}async function o83($,u,f,X,J,w,E,Q){let Y=`/api/v1/namespaces/${encodeURIComponent(u)}/pods?watch=true&labelSelector=${encodeURIComponent(`${r83}=${f}`)}`;return CM1({kc:$,path:Y,signal:X,label:`pod/${f}`,onEvent:(Z)=>{if(Z.type!=="ADDED"&&Z.type!=="MODIFIED")return;let G=Z.object;if(G.metadata?.name)Q(G.metadata.name);s83(G,J,E),w("pod")}})}function s83($,u,f){let J=($.status?.conditions??[]).find((E)=>E.type==="PodScheduled");if(J?.status==="True")u.pod.scheduled=!0,u.pod.scheduledFalseReason=void 0,u.pod.scheduledFalseMessage=void 0;else if(J?.status==="False")u.pod.scheduled=!1,u.pod.scheduledFalseReason=J.reason,u.pod.scheduledFalseMessage=J.message;let w=($.status?.containerStatuses??[]).find((E)=>E.name===a83);if(w)u.pod.containerWaitingReason=w.state?.waiting?.reason,u.pod.containerRunning=!!w.state?.running,u.pod.containerReady=w.ready===!0}async function e83($,u,f,X,J,w){let E=`/apis/${U7.CLAIM_API_GROUP}/${U7.CLAIM_API_VERSION}/namespaces/${encodeURIComponent(u)}/${U7.CLAIM_PLURAL}?watch=true&fieldSelector=${encodeURIComponent(`metadata.name=${f}`)}`;return CM1({kc:$,path:E,signal:X,label:`sandboxclaim/${f}`,onEvent:(Q)=>{if(Q.type!=="ADDED"&&Q.type!=="MODIFIED")return;let Z=Q.object.status?.conditions?.find((G)=>G.type==="Ready");if(!Z)return;if(Z.status==="True")J.sandbox.ready=!0,J.sandbox.notReadyReason=void 0,J.sandbox.notReadyMessage=void 0;else J.sandbox.ready=!1,J.sandbox.notReadyReason=Z.reason,J.sandbox.notReadyMessage=Z.message;w("sandbox")}})}async function $X3($,u,f,X,J,w,E,Q){let Y=await Promise.race([X,new Promise((G)=>{if(J.aborted){G(f);return}J.addEventListener("abort",()=>G(f),{once:!0})})]);if(J.aborted)return;let Z=`/api/v1/namespaces/${encodeURIComponent(u)}/events?watch=true&fieldSelector=${encodeURIComponent(`involvedObject.name=${Y},involvedObject.kind=Pod`)}`;return CM1({kc:$,path:Z,signal:J,label:`events/${f}`,onEvent:(G)=>{if(G.type!=="ADDED"&&G.type!=="MODIFIED")return;let W=G.object,F=W.reason;if(!F)return;switch(F){case"Pulling":w.events.hasPulling=!0;break;case"Pulled":w.events.hasPulling=!0,w.events.hasPulled=!0;break;case"FailedScheduling":w.events.lastFailedSchedulingAt=Q(),w.events.failedSchedulingMessage=W.message;break;case"Nominated":{let B=W.message?.match(/nodeclaim\/([\w-]+)/);if(B)w.events.nominatedNodeClaim=B[1];break}default:return}E("event")}})}async function CM1($){let{kc:u,path:f,signal:X,label:J,onEvent:w}=$,E=0;while(!X.aborted){try{let Y=await Cx(u,{method:"GET",path:f,signal:X,headers:{accept:"application/json"}});if(!Y.ok||!Y.body){try{await Y.body?.cancel()}catch{}throw Error(`watch handshake failed: ${Y.status} ${Y.statusText}`)}E=0;for await(let Z of SM1(Y.body)){if(X.aborted)return;try{w(Z)}catch(G){console.warn(`[lifecycle-watcher] ${J} onEvent threw: ${G instanceof Error?G.message:String(G)}`)}}}catch(Y){if(X.aborted)return;let Z=Y instanceof Error?Y.message:String(Y);console.warn(`[lifecycle-watcher] ${J} watch ended: ${Z}`)}if(X.aborted)return;let Q=PJ(5000,250,E,2,0);E+=1,await S3(Q,{signal:X}).catch(()=>{})}}var r83="studio.decocms.com/sandbox-handle",a83="sandbox",p83=300000;var Vk$=U(()=>{bw();lJ0();Dm0()});import{createHash as uX3,randomBytes as fX3,randomUUID as XX3}from"crypto";import*as lk$ from"net";import{PassThrough as JX3}from"stream";class VM1{kind=HY;records=new Map;inflight=new gk0;stateStore;previewUrlPattern;kubeConfig;portForward;namespace;sandboxTemplateName;envName;tokenGenerator;idleTtlMs;metrics;previewGateway;sentinelToken;closed=!1;constructor($={}){this.stateStore=$.stateStore??null,this.previewUrlPattern=$.previewUrlPattern??null,this.kubeConfig=$.kubeConfig??BX3(),this.portForward=new EM1(this.kubeConfig),this.namespace=$.namespace??wX3,this.sandboxTemplateName=$.sandboxTemplateName??EX3,this.envName=KX3($.envName),this.tokenGenerator=$.tokenGenerator??(()=>fX3(YX3).toString("hex")),this.idleTtlMs=$.idleTtlMs??ZX3,this.metrics=$.meter?FX3($.meter):null,this.previewGateway=$.previewGateway&&$.previewUrlPattern?{...$.previewGateway}:null;let u=$.sentinelToken?.trim()??"";this.sentinelToken=u.length>0?u:null}async ensure($,u={}){let f=cH($,u.branch??u.repo?.branch??null);return this.inflight.run(f,()=>TC1(this.stateStore,$,HY,(X)=>this.ensureLocked($,f,u,X)))}async delete($){let u=await this.getRecord($);if(this.records.delete($),u)this.closeForwarder(u.daemonForward),this.metrics?.active.add(-1,yM1(u.tenant));if(await this.deleteHttpRouteIfManaged($).catch((f)=>{console.warn(`[${zJ}] HTTPRoute delete failed for ${$}: ${f instanceof Error?f.message:String(f)}`)}),await f_(this.kubeConfig,this.namespace,$),this.stateStore)if(u)await this.stateStore.delete(u.id,HY);else await this.stateStore.deleteByHandle(HY,$)}async alive($){return await X_(this.kubeConfig,this.namespace,$)!==void 0}watchClaimLifecycle($,u){return gk$({kc:this.kubeConfig,namespace:this.namespace,claimName:$,signal:u})}async getPreviewUrl($){let u=await this.getRecord($);if(!u)return null;return this.composePreviewUrl(u)}async proxyDaemonRequest($,u,f){let X=await this.getRecord($);if(!X&&this.previewUrlPattern&&this.stateStore){let Q=await this.stateStore.getByHandle(HY,$),Y=Q?.state,Z=Y?.token;if(Q&&Z){let W=`http://${Y?.adoptedSandboxName??$}.${this.namespace}.svc.cluster.local:${J_}`;return KB0(W,Z,u,f)}}if(!X)X=await this.resurrectByHandle($);if(!X)return new Response(JSON.stringify({error:"sandbox not found"}),{status:404,headers:{"content-type":"application/json"}});let J=X,w=performance.now(),E=0;try{let Q=await KB0(X.daemonUrl,X.token,u,f);if(Q.status===401&&!(f.body instanceof ReadableStream)){this.invalidateRecord($);let Y=await this.getRecord($).catch(()=>null);if(Y)J=Y,Q=await KB0(Y.daemonUrl,Y.token,u,f)}return E=Q.status,Q}finally{this.recordProxyDuration("daemon",E,J,performance.now()-w)}}async resolvePreviewUpstreamUrl($){if(this.previewUrlPattern)return`http://${await this.resolveServiceNameForHandle($)}.${this.namespace}.svc.cluster.local:${J_}`;let u=await this.getRecord($);if(u)return u.daemonUrl;let f=await this.resurrectByHandle($);return f?f.daemonUrl:null}async resolveServiceNameForHandle($){let u=this.records.get($);if(u)return u.adoptedSandboxName;if(this.stateStore){let X=(await this.stateStore.getByHandle(HY,$).catch(()=>null))?.state?.adoptedSandboxName;if(X)return X}return $}async proxyPreviewRequest($,u){let f=performance.now(),X=this.records.get($)??null,J=0;try{let w=await this.resolvePreviewUpstreamUrl($);if(!w){J=404;let v=MM1(404,{error:"sandbox not found"});return v.headers.set(qx,"1"),v}let E=new URL(u.url);if((E.pathname==="/_sandbox"||E.pathname.startsWith("/_sandbox/")||E.pathname==="/_decopilot_vm"||E.pathname.startsWith("/_decopilot_vm/"))&&u.method!=="GET")return J=404,MM1(404,{error:"not found"});let Y=(v)=>`${v}${E.pathname}${E.search}`,Z=new Headers(u.headers);for(let v of GX3)Z.delete(v);let G=u.method!=="GET"&&u.method!=="HEAD",W={method:u.method,headers:Z,body:G?u.body:void 0,redirect:"manual",signal:u.signal,duplex:G?"half":void 0},F;try{F=await fetch(Y(w),W)}catch(v){let N=`${w}${E.pathname}`;if(console.warn(`[${zJ}] preview fetch to ${N} failed: ${v instanceof Error?v.message:String(v)}`),u.method==="GET"||u.method==="HEAD"){if(this.invalidateRecord($),await this.resurrectByHandle($).catch(()=>null)){let H=await this.resolvePreviewUpstreamUrl($);if(H)try{F=await fetch(Y(H),W);let _=new Headers;for(let[T,j]of F.headers.entries())if(!bk$.includes(T.toLowerCase()))_.set(T,j);return J=F.status,new Response(F.body,{status:F.status,statusText:F.statusText,headers:_})}catch(_){console.warn(`[${zJ}] preview fetch retry to ${N} failed: ${_ instanceof Error?_.message:String(_)}`)}}}else this.invalidateRecord($);J=502;let O=MM1(502,{error:"sandbox daemon unreachable"});return O.headers.set(qx,"1"),O}let B=new Headers;for(let[v,N]of F.headers.entries())if(!bk$.includes(v.toLowerCase()))B.set(v,N);return J=F.status,new Response(F.body,{status:F.status,statusText:F.statusText,headers:B})}finally{this.recordProxyDuration("preview",J,X,performance.now()-f,$)}}async ensureLocked($,u,f,X){if(f.image)console.warn(`[${zJ}] opts.image ignored (template ${this.sandboxTemplateName} pins image): got ${f.image}`);if(X){let E=await X.get($,HY);if(E){let Q=await this.rehydrate($,u,E);if(Q)return this.finish(Q,X,!1,!0,"resume");await X.delete($,HY)}}let J=await X_(this.kubeConfig,this.namespace,u).catch(()=>{return});if(J)if(J.metadata?.deletionTimestamp)await wm0(this.kubeConfig,this.namespace,u).catch((E)=>{console.warn(`[${zJ}] wait for terminating claim ${u} failed: ${E instanceof Error?E.message:String(E)}`)});else{let E=await this.adopt($,u,J).catch((Q)=>{return console.warn(`[${zJ}] adopt ${u} failed, recreating: ${Q instanceof Error?Q.message:String(Q)}`),null});if(E)return this.finish(E,X,!0,!0,"adopt");await f_(this.kubeConfig,this.namespace,u).catch(()=>{}),await wm0(this.kubeConfig,this.namespace,u).catch((Q)=>{console.warn(`[${zJ}] wait for deleted claim ${u} failed: ${Q instanceof Error?Q.message:String(Q)}`)})}let w=await this.provision($,u,f);return this.finish(w,X,!0,!1,"fresh")}async finish($,u,f,X,J){let w=this.records.has($.handle);if(this.records.set($.handle,$),f)await this.persist(u,$);if(X)await Ak$(this.kubeConfig,this.namespace,$.handle,this.computeShutdownTime()).catch((E)=>console.warn(`[${zJ}] TTL refresh failed for ${$.handle}: ${E instanceof Error?E.message:String(E)}`));if(this.metrics){let E=yM1($.tenant);if(this.metrics.ensureOutcome.add(1,{...E,outcome:J}),!w)this.metrics.active.add(1,E)}return this.toSandbox($)}buildEnvMap($,u){let f={},X=[];for(let[J,w]of Object.entries($.env??{}))if(DX3.has(J))X.push(J);else f[J]=w;if(X.length>0)console.warn(`[${zJ}] opts.env keys overlap reserved bootstrap names and were dropped: ${X.join(",")}`);return{...f,DAEMON_TOKEN:u.token,DAEMON_BOOT_ID:u.daemonBootId,APP_ROOT:u.workdir,PROXY_PORT:String(J_)}}buildClaim($,u,f){let X=this.sentinelToken!==null,J=X?[]:Object.entries(this.buildEnvMap(u,f)).sort(([w],[E])=>w<E?-1:w>E?1:0).map(([w,E])=>({name:w,value:E}));return{apiVersion:`${U7.CLAIM_API_GROUP}/${U7.CLAIM_API_VERSION}`,kind:"SandboxClaim",metadata:{name:$,namespace:this.namespace,labels:{"app.kubernetes.io/name":"studio-sandbox","app.kubernetes.io/managed-by":"studio",...this.envName?{[fG.env]:this.envName}:{},...hM1(u.tenant)}},spec:{sandboxTemplateRef:{name:this.sandboxTemplateName},additionalPodMetadata:{labels:hM1(u.tenant,{[fG.role]:"claimed",[fG.sandboxHandle]:$,...this.envName?{[fG.env]:this.envName}:{}})},env:J,warmpool:X?"default":"none",lifecycle:{shutdownPolicy:"Delete",shutdownTime:this.computeShutdownTime()}}}}async provision($,u,f){let X=this.tokenGenerator(),J=XX3(),w=qM1,E=this.buildClaim(u,f,{token:X,daemonBootId:J,workdir:w});try{await dJ0(this.kubeConfig,this.namespace,E)}catch(F){if(F instanceof xJ0)await wm0(this.kubeConfig,this.namespace,u),await dJ0(this.kubeConfig,this.namespace,E);else throw F}let Q;try{Q=await Ik$(this.kubeConfig,this.namespace,u),await Ym0(this.kubeConfig,this.namespace,Q)}catch(F){throw await f_(this.kubeConfig,this.namespace,u).catch(()=>{}),F}try{await this.ensureServicePortForAdoptedSandbox(Q),await this.ensureHttpRouteForHandle(u,Q,f.tenant??null)}catch(F){throw await f_(this.kubeConfig,this.namespace,u).catch(()=>{}),F}let Y=await this.openForwarder(Q,J_,u),Z=`http://127.0.0.1:${Y.localPort}`,G=this.workloadConfigPayload(f),W=J;try{if(await zB0(Z),this.sentinelToken!==null){let F=await OB0(Z);if(F)W=F.bootId;await zm(Z,this.sentinelToken,G??{},{rotateToken:X})}else if(G)await zm(Z,X,G)}catch(F){throw this.closeForwarder(Y),await this.deleteHttpRouteIfManaged(u).catch(()=>{}),await f_(this.kubeConfig,this.namespace,u).catch(()=>{}),F}return{id:$,handle:u,adoptedSandboxName:Q,token:X,workdir:w,daemonUrl:Z,daemonForward:Y,workload:f.workload??null,daemonBootId:W,tenant:f.tenant??null,ensureOpts:_X3(f)}}workloadConfigPayload($){return AC1({runtime:$?.workload?.runtime??"node",packageManager:$?.workload?.packageManager?{name:$.workload.packageManager,...$.workload.packageManagerPath?{path:$.workload.packageManagerPath}:{}}:null,repo:$?.repo??null,port:$?.workload?.devPort??QX3})}async rebootstrapDaemon($,u,f){if(this.sentinelToken===null)return!1;try{return await zm($,this.sentinelToken,this.workloadConfigPayload(f)??{},{rotateToken:u}),!0}catch(X){return console.warn(`[${zJ}] re-bootstrap failed: ${X instanceof Error?X.message:String(X)}`),!1}}async ensureServicePortForAdoptedSandbox($){if(!this.previewGateway||!this.previewUrlPattern)return;await Mk$(this.kubeConfig,this.namespace,$,{name:"daemon",port:J_,targetPort:J_})}async ensureHttpRouteForHandle($,u,f){if(!this.previewGateway||!this.previewUrlPattern)return;let X=PX3(this.previewUrlPattern,$);if(!X)throw new fX(`Unable to derive preview hostname for ${$} from pattern: ${this.previewUrlPattern}`);let J={apiVersion:`${mJ0.API_GROUP}/${mJ0.API_VERSION}`,kind:"HTTPRoute",metadata:{name:$,namespace:this.namespace,labels:hM1(f??void 0,{[fG.role]:"claimed",[fG.sandboxHandle]:$,"app.kubernetes.io/name":"studio-sandbox","app.kubernetes.io/managed-by":"studio",...this.envName?{[fG.env]:this.envName}:{}})},spec:{parentRefs:[{kind:"Gateway",group:"gateway.networking.k8s.io",name:this.previewGateway.name,namespace:this.previewGateway.namespace}],hostnames:[X],rules:[{backendRefs:[{group:"",kind:"Service",name:u,port:J_}]}]}};await Em0(this.kubeConfig,this.namespace,J)}async deleteHttpRouteIfManaged($){if(!this.previewGateway)return;await Qm0(this.kubeConfig,this.namespace,$)}async rehydrate($,u,f){let X=f.state;if(!X.adoptedSandboxName&&!X.podName||!X.token)return null;let J=await X_(this.kubeConfig,this.namespace,u).catch(()=>{return});if(!J||!ik$(J))return null;let w=J.status?.sandbox?.name??X.adoptedSandboxName??X.podName??u,E=await this.openAndProbeDaemon(w,u);if(!E)return null;if(X.daemonBootId&&X.daemonBootId!==E.bootId){if(this.sentinelToken!==null){if(!await this.rebootstrapDaemon(E.daemonUrl,X.token,X.ensureOpts??null))return this.closeForwarder(E.daemonForward),null}else console.warn(`[${zJ}] daemon restart detected (handle=${u}): stored bootId=${X.daemonBootId} live bootId=${E.bootId}`);await this.stateStore?.put($,HY,{handle:u,state:{...X,daemonBootId:E.bootId}}).catch((Q)=>console.warn(`[${zJ}] bootId persist failed for ${u}: ${Q instanceof Error?Q.message:String(Q)}`))}return{id:$,handle:u,adoptedSandboxName:w,token:X.token,workdir:X.workdir??qM1,daemonUrl:E.daemonUrl,daemonForward:E.daemonForward,workload:X.workload??null,daemonBootId:E.bootId,tenant:X.tenant??null,ensureOpts:X.ensureOpts??null}}async adopt($,u,f){if(!ik$(f))return null;let X=f.status?.sandbox?.name??u;if(this.sentinelToken!==null)return null;let J=vX3(f);if(!J)return null;let w=await this.openAndProbeDaemon(X,u);if(!w)return null;let E=HX3(f);if(this.previewGateway)await this.ensureServicePortForAdoptedSandbox(X).catch((Q)=>{console.warn(`[${zJ}] Service port backfill failed for ${u}: ${Q instanceof Error?Q.message:String(Q)}`)}),await this.ensureHttpRouteForHandle(u,X,E).catch((Q)=>{console.warn(`[${zJ}] HTTPRoute backfill failed for ${u}: ${Q instanceof Error?Q.message:String(Q)}`)});return{id:$,handle:u,adoptedSandboxName:X,token:J,workdir:qM1,daemonUrl:w.daemonUrl,daemonForward:w.daemonForward,workload:null,daemonBootId:w.bootId,tenant:E,ensureOpts:null}}async openAndProbeDaemon($,u){let f=await this.openForwarder($,J_,u).catch(()=>null);if(!f)return null;let X=`http://127.0.0.1:${f.localPort}`,J=await OB0(X);if(!J)return this.closeForwarder(f),null;return{daemonForward:f,daemonUrl:X,bootId:J.bootId}}async getRecord($){let u=this.records.get($);if(u)return u;if(!this.stateStore)return null;let f=await this.stateStore.getByHandle(HY,$);if(!f)return null;let X=await this.rehydrate(f.id,$,f);if(X)this.records.set($,X);return X}async resurrectByHandle($){if(!this.stateStore)return null;let u=await this.stateStore.getByHandle(HY,$);if(!u)return null;let f=u.state.ensureOpts;if(!f)return null;return await this.ensure(u.id,f),this.records.get($)??null}invalidateRecord($){let u=this.records.get($);if(!u)return;this.records.delete($),this.closeForwarder(u.daemonForward)}recordProxyDuration($,u,f,X,J){if(!this.metrics)return;this.metrics.proxyDurationMs.record(X,{...yM1(f?.tenant??null),source:$,sandbox_handle:f?.handle??J??"",status_code:u||0})}composePreviewUrl($){if(this.previewUrlPattern)return Vk0(this.previewUrlPattern,$.handle);return`http://127.0.0.1:${$.daemonForward.localPort}/`}toSandbox($){return{handle:$.handle,workdir:$.workdir,previewUrl:this.composePreviewUrl($)}}async persist($,u){if(!$)return;let f={adoptedSandboxName:u.adoptedSandboxName,token:u.token,workdir:u.workdir,workload:u.workload,daemonBootId:u.daemonBootId,tenant:u.tenant,...u.ensureOpts?{ensureOpts:u.ensureOpts}:{}};await $.put(u.id,HY,{handle:u.handle,state:f})}computeShutdownTime(){return new Date(Date.now()+this.idleTtlMs).toISOString()}openForwarder($,u,f=$){let X=UX3(f,u);return new Promise((J,w)=>{let E=(Q,Y)=>{let Z=lk$.createServer((G)=>this.handleForwardedConnection(G,$,u,f));Z.once("error",(G)=>{if(G.code==="EADDRINUSE"&&Y<WX3){try{Z.close()}catch{}let W=gM1+(Q-gM1+1)%ck$;E(W,Y+1);return}w(G)}),Z.listen(Q,"127.0.0.1",()=>{let G=Z.address();if(!G||typeof G==="string"){Z.close(),w(Error("port-forward listener failed to bind"));return}J({server:Z,localPort:G.port})})};E(X,0)})}handleForwardedConnection($,u,f,X){let J=new JX3,w=null,E=!1,Q=()=>{if(E)return;if(E=!0,J.destroy(),w)try{w.close()}catch{}if(!$.destroyed)$.destroy()};$.pipe(J),$.on("error",Q),$.on("close",Q),this.portForward.portForward(this.namespace,u,[f],$,null,J).then((Y)=>{let Z=typeof Y==="function"?Y():Y;if(!Z){Q();return}if(w=Z,w.on("close",Q),w.on("error",()=>{this.invalidateRecord(X),Q()}),E)try{w.close()}catch{}}).catch((Y)=>{console.warn(`[${zJ}] port-forward to ${u}:${f} failed: ${Y instanceof Error?Y.message:String(Y)}`),this.invalidateRecord(X),Q()})}closeForwarder($){$.server.close((u)=>{if(u)console.warn(`[${zJ}] port-forward close on :${$.localPort} errored: ${u instanceof Error?u.message:String(u)}`)})}close(){if(this.closed)return;this.closed=!0;for(let $ of this.records.values())this.closeForwarder($.daemonForward);this.records.clear()}}function FX3($){return{active:$.createUpDownCounter("studio.sandbox.active",{description:"Active sandbox count, by runner kind and owning org. Cross-checks the cAdvisor-derived count from the cluster \u2014 divergence between the two indicates orphaned claims (mesh deleted but K8s didn't reap) or unattributed pods.",unit:"{sandbox}"}),ensureOutcome:$.createCounter("studio.sandbox.ensure.outcome",{description:"Outcome of each ensure() call: fresh provision, resume from state-store after restart, or adopt of a cluster-side claim mesh didn't know about. Cold-start ratio is the primary input for warm-pool sizing.",unit:"{call}"}),proxyDurationMs:$.createHistogram("studio.sandbox.proxy.duration_ms",{description:"Wall-clock latency of mesh-mediated requests to the sandbox daemon: tool exec proxies (source=daemon) and preview iframe traffic (source=preview).",unit:"ms"})}}function BX3(){let $=new oo;return $.loadFromDefault(),$}function ik$($){return Boolean($.status?.conditions?.some((u)=>u.type==="Ready"&&u.status==="True"))}function vX3($){let u=$.spec?.env;if(!u)return null;for(let f of u)if(f.name==="DAEMON_TOKEN"&&f.value)return f.value;return null}function UX3($,u){let f=uX3("sha256").update(`${$}:${u}`).digest();return gM1+f.readUInt32BE(0)%ck$}function MM1($,u){return new Response(JSON.stringify(u),{status:$,headers:{"content-type":"application/json","access-control-allow-origin":"*"}})}function xk$($){let u=$.slice(0,OX3);return NX3.test(u)?u:""}function KX3($){if($===void 0)return null;let u=$.trim();if(u==="")return null;if(!zX3.test(u))throw Error(`AgentSandboxProvider: envName=${JSON.stringify(u)} is not a valid DNS-label-safe environment name (lowercase alphanumeric or '-', starts with a letter, ends alphanumeric, \u226432 chars). Mesh sets this from STUDIO_ENV; check the studio chart's configMap.`);return u}function hM1($,u={}){let f={...u};if($){let X=xk$($.orgId),J=xk$($.userId);if(X)f[fG.orgId]=X;if(J)f[fG.userId]=J}return f}function HX3($){let u=$.metadata?.labels;if(!u)return null;let f=u[fG.orgId],X=u[fG.userId];if(!f||!X)return null;return{orgId:f,userId:X}}function yM1($){return{org_id:$?.orgId??"",user_id:$?.userId??"",runner_kind:HY}}function _X3($){let u={};if($.repo)u.repo=$.repo;if($.workload)u.workload=$.workload;if($.env&&Object.keys($.env).length>0)u.env=$.env;if($.tenant)u.tenant=$.tenant;return Object.keys(u).length>0?u:null}function PX3($,u){try{return new URL(Vk0($,u)).hostname||null}catch{return null}}var HY="cluster",zJ="AgentSandboxProvider",qx="x-sandbox-preview-not-ready",wX3="agent-sandbox-system",EX3="studio-sandbox",J_=9000,QX3=3000,qM1="/app",YX3=32,DX3,ZX3=900000,GX3,bk$,gM1=40000,ck$=1e4,WX3=256,fG,NX3,OX3=63,zX3;var dk$=U(()=>{_M1();M91();bk0();Dm0();lJ0();Vk$();DX3=new Set(["DAEMON_TOKEN","DAEMON_BOOT_ID","APP_ROOT","PROXY_PORT"]),GX3=["cookie","host","connection","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","accept-encoding","content-length","upgrade"],bk$=["connection","keep-alive","transfer-encoding","content-encoding","content-length"];fG={role:"studio.decocms.com/role",sandboxHandle:"studio.decocms.com/sandbox-handle",orgId:"studio.decocms.com/org-id",userId:"studio.decocms.com/user-id",env:"studio.decocms.com/env"},NX3=/^([A-Za-z0-9]([-A-Za-z0-9_.]*[A-Za-z0-9])?)?$/;zX3=/^[a-z]([a-z0-9-]{0,30}[a-z0-9])?$/});var mk$={};Y1(mk$,{waitForSandboxReady:()=>Ym0,getSandboxClaim:()=>X_,getHttpRoute:()=>qk$,deleteSandboxClaim:()=>f_,deleteHttpRoute:()=>Qm0,createSandboxClaim:()=>dJ0,createHttpRoute:()=>Em0,SandboxTimeoutError:()=>Rx,SandboxError:()=>fX,PREVIEW_NOT_READY_HEADER:()=>qx,KubeConfig:()=>oo,K8S_CONSTANTS:()=>U7,HTTPROUTE_CONSTANTS:()=>mJ0,AgentSandboxProvider:()=>VM1});var bM1=U(()=>{_M1();lJ0();Dm0();dk$()});class Zm0{kind=w_;userSub;dispatch;stateStore;records=new Map;constructor($){if(!$.userSub)throw Error("DesktopSandboxProvider requires userSub");if(!$.dispatch)throw Error("DesktopSandboxProvider requires dispatch");this.userSub=$.userSub,this.dispatch=$.dispatch,this.stateStore=$.stateStore??null}async ensure($,u={}){let f=u.branch??u.repo?.branch,X=cH($,f),J=this.records.get(X);if(J){if(await this.probeHealth(X))return this.toSandbox(J);if(this.records.delete(X),this.stateStore)await this.stateStore.deleteByHandle(w_,X).catch(()=>{})}else if(this.stateStore){let W=(await this.stateStore.getByHandle(w_,X))?.state,F=W?.sandboxApiUrl;if(F){if(await this.probeHealth(X)){let B={handle:X,sandboxApiUrl:F,previewUrl:W?.previewUrl??F};return this.records.set(X,B),this.toSandbox(B)}await this.stateStore.deleteByHandle(w_,X).catch(()=>{})}}let w=JSON.stringify({handle:X,repo:u.repo,branch:f,...u.workload?{workload:u.workload}:{},...u.offloadAllowedHosts?{offloadAllowedHosts:u.offloadAllowedHosts}:{},...u.offloadAllowSameHostDev!==void 0?{offloadAllowSameHostDev:u.offloadAllowSameHostDev}:{}}),E=await this.dispatchJson("POST","/api/sandboxes",w),Q=JSON.parse(E);if(typeof Q.sandboxApiUrl!=="string")throw Error("desktop ensure: daemon did not return a sandboxApiUrl string");let Y=typeof Q.previewUrl==="string"?Q.previewUrl:Q.sandboxApiUrl,Z={handle:X,sandboxApiUrl:Q.sandboxApiUrl,previewUrl:Y};if(this.records.set(X,Z),this.stateStore)await this.stateStore.put($,w_,{handle:X,state:{handle:X,sandboxApiUrl:Q.sandboxApiUrl,previewUrl:Y}});return this.toSandbox(Z)}async proxyDaemonRequest($,u,f){let X=u.startsWith("/")?u:`/${u}`,J=X.startsWith("/_sandbox/")?X.slice(9):X,w=`/_sandbox/${encodeURIComponent($)}${J}`,E=new Headers(f.headers);for(let z of["host","cookie","connection","keep-alive","transfer-encoding","upgrade","authorization"])E.delete(z);let Q={};E.forEach((z,H)=>{Q[H]=z});let Y;if(f.body!=null)Y=await jX3(f.body);let G=this.dispatch(this.userSub,{method:f.method,path:w,headers:Q,body:Y},{signal:f.signal})[Symbol.asyncIterator](),W=200,F={"content-type":"application/octet-stream"},B=[];try{while(!0){let z=await G.next();if(z.done)break;let H=z.value;if(H.headers){W=H.headers.status,F=H.headers.headers;break}if(H.data!=null)B.push(H.data)}}catch(z){let H=z instanceof Error?z.message:"dispatch error";return new Response(JSON.stringify({error:H}),{status:502,headers:{"content-type":"application/json"}})}let v=!1,N=new TextEncoder,O=new ReadableStream({async start(z){for(let H of B)z.enqueue(N.encode(H))},async pull(z){try{let H=await G.next();if(v)return;if(H.done){z.close();return}let _=H.value;if(_.data!=null)z.enqueue(N.encode(_.data))}catch(H){if(!v)z.error(H)}},cancel(){v=!0,G.return?.()}});return new Response(O,{status:W,headers:F})}async alive($){return this.probeHealth($)}async probeHealth($){let u=new AbortController,f=setTimeout(()=>u.abort(),1500);try{return await this.dispatchJson("GET",`/api/sandboxes/${encodeURIComponent($)}`,void 0,u.signal),!0}catch{return!1}finally{clearTimeout(f)}}async forgetHandle($){if(this.records.delete($),this.stateStore)await this.stateStore.deleteByHandle(w_,$).catch(()=>{})}async delete($){if(this.records.delete($),this.stateStore)await this.stateStore.deleteByHandle(w_,$).catch(()=>{});try{await this.dispatchJson("DELETE",`/api/sandboxes/${encodeURIComponent($)}`)}catch(u){if(!(u instanceof Error?u.message:String(u)).includes("404"))throw u}}async getPreviewUrl($){return(await this.resolveRecord($))?.previewUrl??null}async localWorkdir($){return null}async*watchClaimLifecycle($,u){yield{kind:"ready"}}toSandbox($){return{handle:$.handle,workdir:$.sandboxApiUrl,previewUrl:$.previewUrl}}async resolveRecord($){let u=this.records.get($);if(u)return u;if(!this.stateStore)return null;let X=(await this.stateStore.getByHandle(w_,$))?.state,J=X?.sandboxApiUrl;if(!J)return null;let w={handle:$,sandboxApiUrl:J,previewUrl:X?.previewUrl??J};return this.records.set($,w),w}async dispatchJson($,u,f,X){let J={accept:"application/json"};if(f!==void 0)J["content-type"]="application/json";let w=this.dispatch(this.userSub,{method:$,path:u,headers:J,body:f},{signal:X}),E=null,Q="";for await(let Y of w)if(Y.headers)E=Y.headers.status;else if(Y.data!=null)Q+=Y.data;if(E!=null&&(E<200||E>=300))throw Error(`daemon returned ${E}: ${Q}`);return Q}}function nk$($){return new Zm0($)}async function jX3($){if(typeof $==="string")return $;if($ instanceof ArrayBuffer)return Buffer.from($).toString("utf8");if(ArrayBuffer.isView($))return Buffer.from($.buffer,$.byteOffset,$.byteLength).toString("utf8");if($ instanceof URLSearchParams)return $.toString();return await new Response($).text()}var w_="user-desktop";var tk$=U(()=>{bk0()});var rk$={};Y1(rk$,{createDesktopProvider:()=>nk$,DesktopSandboxProvider:()=>Zm0});var ak$=U(()=>{tk$()});var uR$={};Y1(uR$,{subscribeLifecycle:()=>tJ0,getSandboxProviderByKind:()=>nJ0,getOrInitSharedRunner:()=>CX3,buildDesktopProvider:()=>fs,__resetSharedLifecyclesForTesting:()=>gX3});function ek$($,u){let f=pk$[$];if(f)return Promise.resolve(f);let X=iM1[$];if(X)return X;let J=u().then((w)=>{return pk$[$]=w,w}).finally(()=>{delete iM1[$]});return iM1[$]=J,J}function AX3(){let $=process.env.STUDIO_SANDBOX_PREVIEW_URL_PATTERN;return $&&$.trim()!==""?$:void 0}function IX3(){let $=process.env.STUDIO_SANDBOX_TEMPLATE_NAME;return $&&$.trim()!==""?$:void 0}function SX3(){let $=process.env.STUDIO_ENV;return $&&$.trim()!==""?$:void 0}function kX3(){let $=process.env.STUDIO_SANDBOX_SENTINEL_TOKEN;return $&&$.trim()!==""?$:void 0}function RX3(){let $=process.env.STUDIO_SANDBOX_PREVIEW_GATEWAY_NAME?.trim(),u=process.env.STUDIO_SANDBOX_PREVIEW_GATEWAY_NAMESPACE?.trim();if(!$&&!u)return;if(!$||!u)throw Error("STUDIO_SANDBOX_PREVIEW_GATEWAY_NAME and STUDIO_SANDBOX_PREVIEW_GATEWAY_NAMESPACE must both be set, or both unset. Half-configured per-claim HTTPRoute routing would silently fail to attach.");return{name:$,namespace:u}}async function $R$($,u){let f=new mH(u),X=AX3();switch($){case"cluster":{let{AgentSandboxProvider:J}=await Promise.resolve().then(() => (bM1(),mk$));return new J({stateStore:f,previewUrlPattern:X,sandboxTemplateName:IX3(),envName:SX3(),previewGateway:RX3(),sentinelToken:kX3(),meter:IQ})}case"user-desktop":throw Error("user-desktop runner cannot be instantiated without a per-run link claim \u2014 call resolveSandboxProvider, which binds the link before constructing the provider.");default:throw Error(`Unknown runner kind: ${String($)}`)}}async function fs($,u){let{DesktopSandboxProvider:f}=await Promise.resolve().then(() => (ak$(),rk$)),{getDispatch:X}=await Promise.resolve().then(() => (lM1(),xM1)),J=new mH($.db);if(!u)throw Error("buildDesktopProvider: userSub must be a non-empty string");return new f({userSub:u,dispatch:X(),stateStore:J})}function nJ0($,u){return ek$(u,()=>$R$(u,$.db))}async function CX3(){let $;try{$=zF()}catch(f){return console.warn("[lifecycle] cannot resolve sandbox runner:",f instanceof Error?f.message:String(f)),null}return await ek$($,()=>$R$($,x6().db))}function tJ0($,u,f){let X=E_.get(u);if(X){if(X.terminated){if(X.lastPhase)try{f(X.lastPhase)}catch{}return{unsubscribe:hX3}}if(X.listeners.add(f),X.lastPhase)try{f(X.lastPhase)}catch{}return ok$(u,X,f)}let J=new AbortController,w={lastPhase:null,terminated:!1,listeners:new Set([f]),abort:J};return E_.set(u,w),yX3($,u,w),ok$(u,w,f)}function hX3(){}function ok$($,u,f){return{unsubscribe(){if(E_.get($)!==u)return;if(u.listeners.delete(f),u.listeners.size===0)E_.delete($),u.abort.abort()}}}async function yX3($,u,f){let X=null;try{for await(let J of $.watchClaimLifecycle(u,f.abort.signal)){if(f.abort.signal.aborted)break;f.lastPhase=J;let w=J.kind==="ready"||J.kind==="failed";if(w)f.terminated=!0;let E=Array.from(f.listeners);for(let Q of E)try{Q(J)}catch{}if(w)break}}catch(J){X=J}finally{if(!f.terminated&&!f.abort.signal.aborted&&f.listeners.size>0){let J={kind:"failed",reason:"unknown",message:X instanceof Error?X.message:"Lifecycle watcher ended unexpectedly"};f.lastPhase=J,f.terminated=!0;for(let w of Array.from(f.listeners))try{w(J)}catch{}}if(E_.get(u)===f)E_.delete(u)}}function gX3(){for(let $ of E_.values())$.abort.abort();E_.clear()}var LX3,TX3,sk$,pk$,iM1,qX3,MX3,E_;var Mx=U(()=>{VU();JE();ew();ck0();LX3=Symbol.for("decocms.sandbox.lifecycle.runners"),TX3=Symbol.for("decocms.sandbox.lifecycle.inflight"),sk$=globalThis,pk$=sk$[LX3]??={},iM1=sk$[TX3]??={};qX3=Symbol.for("decocms.sandbox.lifecycle.shared-lifecycles"),MX3=globalThis,E_=MX3[qX3]??=new Map});async function Gm0($,u){if(await u.linkClaimRegistry.get($))return"user-desktop";return u.resolveEnvKind()}async function nU($,u){let{userId:f,branch:X,virtualMcpMetadata:J,explicitKind:w}=u;if(w)return{provider:await Wm0($,f,w),kind:w};if($.sandboxPreference==="user-desktop"&&$.linkForCurrentRun)return{provider:await fs($,f),kind:"user-desktop"};if($.sandboxPreference==="cluster-default"){let G=zF();return{provider:await Wm0($,f,G),kind:G}}let[E,...Q]=VX3(J,f,X);if(E){let G=Q.length===0?E:await bX3($,f,E,Q);return{provider:await Wm0($,f,G),kind:G}}let Y=await fR$($,f);return{provider:await Wm0($,f,Y),kind:Y}}function VX3($,u,f){let X=u2($)[u]?.[f];if(!X)return[];let J=hv(X);return Object.keys(J)}async function bX3($,u,f,X){let J=await fR$($,u);if(J===f||X.includes(J))return J;return f}async function fR$($,u){if(!$.linkClaimRegistry)return zF();return Gm0(u,{linkClaimRegistry:$.linkClaimRegistry,resolveEnvKind:zF})}async function Wm0($,u,f){if(f!=="user-desktop")return nJ0($,f);if(!$.linkClaimRegistry)throw Error("user-desktop sandbox provider requires ctx.linkClaimRegistry to be wired (set on MeshContextConfig).");if(!await $.linkClaimRegistry.get(u))throw Error(`No link daemon registered for user "${u}". Start one with \`deco link\` (or run \`bun run dev --local-sandbox-provider\` for dev).`);return fs($,u)}var rJ0=U(()=>{iu();VU();bU();Mx()});async function XR$($,u){if(!$)return{hosts:[],allowSameHostDev:!1};let f;try{f=await $.presignedGetUrl("link-dispatch/_allowlist_probe",60,{requireFetchable:!0})}catch{return{hosts:[],allowSameHostDev:!1}}let X;try{X=new URL(f)}catch{return{hosts:[],allowSameHostDev:!1}}if(X.protocol!=="https:"&&X.protocol!=="http:")return{hosts:[],allowSameHostDev:!1};let J=X.hostname,w=iX3.has(J);return{hosts:[J],allowSameHostDev:w&&!u.isProduction}}var iX3;var JR$=U(()=>{iX3=new Set(["127.0.0.1","localhost","::1","[::1]","0.0.0.0"])});async function Fm0($,u){X1(u);let f=r0(u),X=W$(u);if(!X)throw Error("User ID required");let J=await u.storage.virtualMcps.findById($.virtualMcpId);if(!J||J.organization_id!==f.id)throw Error("Virtual MCP not found");let w=J.metadata??{},E=dH(u2(w),X,$.branch,$.sandboxProviderKind),Q=$.sandboxProviderKind,{provider:Y}=await nU(u,{userId:X,branch:$.branch,virtualMcpMetadata:w,explicitKind:Q});if(E){if(Q!=="user-desktop")return E;if(await Y.alive(E.sandboxHandle).catch(()=>!1))return E;await bo(u.storage.virtualMcps,$.virtualMcpId,X,X,$.branch,Q).catch((F)=>{console.warn("[ensureSandbox] failed to reap stale user-desktop entry",F)})}let Z=w.githubRepo??null,{entry:G}=await wR$({ctx:u,userId:X,orgId:f.id,virtualMcpId:$.virtualMcpId,branch:$.branch,metadata:w,githubRepo:Z,existing:null,providerKind:Q,runner:Y});return G}async function wR$($){let{ctx:u,userId:f,orgId:X,virtualMcpId:J,branch:w,metadata:E,githubRepo:Q,existing:Y,runner:Z}=$,{runtime:G,packageManager:W,port:F,packageManagerPath:B}=iP$(E),v;if(Q){let{cloneUrl:h,gitUserName:i,gitUserEmail:l}=Q.connectionId?await lP$(Q.connectionId,Q.owner,Q.name,u.db,u.vault):xP$(Q.owner,Q.name);if(!W){let M=Q.connectionId?await nP$(Q.connectionId,Q.owner,Q.name,u.db,u.vault):await tP$(Q.owner,Q.name);if(M)W=M.packageManager,G=_J0[M.packageManager].runtime,F=M.devPort??F,await xX3(u,J,f,M.packageManager,M.devPort)}v={cloneUrl:h,userName:i,userEmail:l,branch:w,displayName:`${Q.owner}/${Q.name}`}}let N=G&&W?{runtime:G,packageManager:W,...F!==null?{devPort:Number(F)}:{},...B?{packageManagerPath:B}:{}}:void 0,O=XI({orgId:X,virtualMcpId:J,branch:w}),z=Z.kind==="user-desktop"?await XR$(u.objectStorage,{isProduction:g4().nodeEnv==="production"}):null,H=await Z.ensure({userId:f,projectRef:O},{branch:w,repo:v,workload:N,tenant:{orgId:X,userId:f},...z?{offloadAllowedHosts:z.hosts,offloadAllowSameHostDev:z.allowSameHostDev}:{}}),_=E.runtime?.env??null;await lk0({ctx:u,runner:Z,handle:H.handle,orgId:X,userId:f,entries:_});let j=!!Y&&Y.sandboxHandle===H.handle&&Y?.createdAt?Y.createdAt:Date.now(),I=E.runtime?.selected??null,R=E.runtime?.port??null,S=E.runtime?.path??null,q={sandboxHandle:H.handle,previewUrl:H.previewUrl,sandboxApiUrl:H.previewUrl,sandboxProviderKind:Z.kind,createdAt:j,startedWith:{packageManager:I,port:R,path:S}};await VP$(u.storage.virtualMcps,J,f,f,w,$.providerKind,q);let y=!Y||Y.sandboxHandle!==H.handle;return{entry:q,isNewVm:y}}async function xX3($,u,f,X,J){let w=await $.storage.virtualMcps.findById(u);if(!w)return;let E=w.metadata??{};await $.storage.virtualMcps.update(u,f,{metadata:{...E,runtime:{selected:X,port:J}}})}var cM1;var Bm0=U(()=>{m0();VU();C1();xk0();SC1();bU();cP$();aP$();aS1();IC1();rJ0();JR$();e3();bU();cM1=y0({name:"SANDBOX_START",description:"Start a sandbox with the connected GitHub repo and dev server.",annotations:{title:"Start VM Preview",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!1,openWorldHint:!0},_meta:{ui:{visibility:"app"}},inputSchema:D.object({virtualMcpId:D.string().describe("Virtual MCP ID"),branch:D.string().min(1).optional().describe("Optional git branch to check out. When omitted the handler generates `deco/<adjective>-<noun>` and uses it. The resolved branch is returned in the response so callers can persist it."),sandboxProviderKind:D.enum(["cluster","user-desktop"]).optional().describe("Explicit runtime choice. When omitted, defaults to `user-desktop` if the acting user's link daemon is online, else the cluster env kind.")}),outputSchema:D.object({previewUrl:D.string().nullable(),sandboxHandle:D.string(),branch:D.string(),isNewVm:D.boolean(),sandboxProviderKind:D.enum(["cluster","user-desktop"])}),handler:async($,u)=>{X1(u);let f=$.branch??MS0(),X=W$(u);if(!X)throw Error("User ID required");let{provider:J,kind:w}=await nU(u,{userId:X,branch:f,virtualMcpMetadata:null,explicitKind:$.sandboxProviderKind}),{metadata:E,userId:Q,organization:Y,entry:Z}=await ik0({virtualMcpId:$.virtualMcpId,branch:f,sandboxProviderKind:w},u),G=E.githubRepo??null,{entry:W,isNewVm:F}=await wR$({ctx:u,userId:Q,orgId:Y.id,virtualMcpId:$.virtualMcpId,branch:f,metadata:E,githubRepo:G,existing:Z,providerKind:w,runner:J});return{...W,branch:f,isNewVm:F,sandboxProviderKind:w}}})});var dM1;var ER$=U(()=>{m0();C1();xk0();Mx();bU();dM1=y0({name:"SANDBOX_DELETE",description:"Delete a sandbox.",annotations:{title:"Delete VM Preview",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!0},_meta:{ui:{visibility:"app"}},inputSchema:D.object({virtualMcpId:D.string().describe("Virtual MCP ID that owns this VM"),branch:D.string().min(1).describe("Branch whose vm should be deleted (sandboxMap[userId][branch])"),sandboxProviderKind:D.enum(["cluster","user-desktop"]).describe("Kind of sandbox provider the VM was started with. Used to locate the correct 3-level sandboxMap entry.")}),outputSchema:D.object({success:D.boolean()}),handler:async($,u)=>{let f=$.sandboxProviderKind,X;try{X=await ik0($,u)}catch(Q){if(Q instanceof Error&&Q.message==="Virtual MCP not found")return{success:!0};throw Q}let{entry:J,userId:w}=X;if(!J)return{success:!0};return await bo(u.storage.virtualMcps,$.virtualMcpId,w,w,$.branch,f),await(await nJ0(u,f)).delete(J.sandboxHandle).catch((Q)=>console.error(`[SANDBOX_DELETE] ${f} ${J.sandboxHandle}: ${Q instanceof Error?Q.message:String(Q)}`)),{success:!0}}})});var QR$=U(()=>{Bm0();ER$()});var cX3="https://api.github.com",mM1;var YR$=U(()=>{m0();C1();PA0();SH();mM1=y0({name:"GITHUB_LIST_USER_ORGS",description:"List GitHub App installations (orgs/accounts) accessible to the authenticated user.",annotations:{title:"List GitHub User Orgs",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!0},_meta:{ui:{visibility:"app"}},inputSchema:D.object({connectionId:D.string().describe("ID of the mcp-github connection to use")}),outputSchema:D.object({installations:D.array(D.object({installationId:D.number(),login:D.string(),avatarUrl:D.string(),type:D.string()})),appSlug:D.string().optional()}),handler:async($,u)=>{await u.access.check();let f=new D9(u.db,u.vault),X=await f.get($.connectionId);if(!X)throw Error("No GitHub token found. Ensure the mcp-github connection is authenticated.");let J=X.accessToken;if(QX0(X)&&f.isExpired(X,_A0)){let G=await YX0(X,f);if(!G)throw Error(uA);J=G,X=await f.get($.connectionId)??X}let w=[],E,Q=1,Y=100,Z=async(G)=>fetch(`${cX3}/user/installations?per_page=${Y}&page=${Q}`,{headers:{Authorization:`Bearer ${G}`,Accept:"application/vnd.github+json","X-GitHub-Api-Version":"2022-11-28"}});while(!0){let G=await Z(J);if(G.status===401){let F=await f.get($.connectionId);if(!F||!QX0(F))throw Error(uA);let B=await YX0(F,f);if(!B)throw Error(uA);if(J=B,G=await Z(J),G.status===401)throw Error(uA)}if(!G.ok)throw Error(`GitHub /user/installations failed: ${G.status}`);let W=await G.json();for(let F of W.installations){if(!E)E=F.app_slug??F.app?.slug;w.push({installationId:F.id,login:F.account.login,avatarUrl:F.account.avatar_url,type:F.account.type})}if(W.installations.length<Y)break;Q++}return{installations:w,...E?{appSlug:E}:{}}}})});var DR$=U(()=>{YR$()});var ZR$=()=>{};var nM1=U(()=>{ZR$();nQ1()});var tM1;var GR$=U(()=>{m0();nM1();C1();tM1=y0({name:"LINK_CURRENT_GET",description:"Return the calling user's currently registered desktop link, or `online: false` if no link is registered or the TTL has expired.",inputSchema:s0.object({}),outputSchema:s0.object({online:s0.boolean(),machineId:s0.string().optional(),hostname:s0.string().optional(),cliVersion:s0.string().optional(),capabilities:s0.array(mQ1).default([])}),handler:async($,u)=>{X1(u),await u.access.check();let f=u.linkClaimRegistry;if(!f)return{online:!1,capabilities:[]};let X=await f.get(u.auth.user.id);if(!X)return{online:!1,capabilities:[]};return{online:!0,machineId:X.machineId,hostname:X.hostname,cliVersion:X.cliVersion,capabilities:X.capabilities}}})});var WR$=U(()=>{GR$()});function FR$($){if(!$)return"";return typeof $==="string"?$:$.toISOString()}var tX3,rX3,aX3,pX3,oX3,rM1;var BR$=U(()=>{m0();C1();tX3=["thread"],rX3=D.object({type:D.literal("thread"),id:D.string(),title:D.string(),created_at:D.string(),updated_at:D.string(),virtual_mcp_id:D.string().nullable(),run_config:D.record(D.string(),D.unknown()).nullable(),status:D.string().nullable()}),aX3=D.discriminatedUnion("type",[rX3]),pX3=D.object({query:D.string().min(1).describe("Free-text search query."),limit:D.number().int().min(1).max(50).optional().describe("Maximum results per resource type (default: 20)."),types:D.array(D.enum(tX3)).optional().describe("Restrict the search to specific resource types. Omit to search across all available types.")}),oX3=D.object({items:D.array(aX3),totalCount:D.number()});rM1=y0({name:"GLOBAL_SEARCH",description:"Search across organization resources by free-text query. Returns a typed union of matches (currently: threads). New resource types may be added over time without changes to the call shape.",annotations:{title:"Global Search",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:pX3,outputSchema:oX3,handler:async($,u)=>{await u.access.check(),r0(u);let f=$.limit??20,X=$.types?.length?new Set($.types):null,J=!X||X.has("thread"),w=[],E=0;if(J){let{threads:Q,total:Y}=await u.storage.threads.list(void 0,{limit:f,offset:0,search:$.query,includeArchived:!1});E+=Y;for(let Z of Q)w.push({type:"thread",id:Z.id,title:Z.title??"",created_at:FR$(Z.created_at),updated_at:FR$(Z.updated_at),virtual_mcp_id:Z.virtual_mcp_id??null,run_config:Z.run_config??null,status:Z.status??null})}return{items:w,totalCount:E}}})});var vR$=U(()=>{BR$()});var SS0={};Y1(SS0,{managementMCP:()=>jo,listManagementTools:()=>u73,ALL_TOOLS:()=>UR$});async function u73($){let u=await jo($),[f,X]=P80.createLinkedPair();await u.connect(X);let J=new m8({name:"tools-hydration",version:"1.0.0"});try{return await J.connect(f),(await J.listTools()).tools}finally{await J.close().catch(()=>{})}}var eX3,$73,UR$,jo=async($)=>{let u=null;if($.organization){let E=await $.storage.organizationSettings.get($.organization.id),Q=await $.storage.virtualMcps.list($.organization.id),Y=new Set(E?.enabled_plugins??[]);for(let Z of Q){let G=Z.metadata?.enabled_plugins;if(G&&Array.isArray(G))for(let W of G)Y.add(W)}u=Y.size>0?[...Y]:null}let f=J1$(UR$,u),X=new gv({name:"mcp-cms-management",version:"1.0.0"},{capabilities:{tools:{},prompts:{},resources:{}}});for(let E of f){let Q=E.inputSchema&&typeof E.inputSchema==="object"&&"shape"in E.inputSchema?E.inputSchema:D.object({}),Y=E.outputSchema&&typeof E.outputSchema==="object"&&"shape"in E.outputSchema?E.outputSchema:void 0,Z=Q.shape,G=Y?.shape;X.registerTool(E.name,{description:E.description??"",inputSchema:Z,outputSchema:G,annotations:E.annotations,_meta:E._meta},async(W)=>{$.access.setToolName(E.name);try{let F=await E.execute(W,$);return{content:[{type:"text",text:E.modelSummary?E.modelSummary(F):JSON.stringify(F)}],structuredContent:F}}catch(F){return{content:[{type:"text",text:`Error: ${F.message}`}],isError:!0}}})}let J=wk0();for(let E of J){let Q=E.arguments?.length?Object.fromEntries(E.arguments.map((Y)=>{let Z=Y.required?D.string():D.string().optional();return[Y.name,Y.description?Z.describe(Y.description):Z]})):void 0;X.registerPrompt(E.name,{title:E.title,description:E.description,...Q?{argsSchema:Q}:{}},(Y)=>{return{messages:[{role:"user",content:{type:"text",text:typeof E.text==="function"?E.text(Y??{}):E.text}}]}})}if($.organization?.id){let E=await $.storage.brandContext.list($.organization.id),Q=new Set;for(let Y of E){let Z=Y.name.toLowerCase().replace(/[^a-z0-9]+/g,"-").replace(/^-|-$/g,""),G=Z?`brand-${Z}`:`brand-${Y.id}`;if(Q.has(G))G=`${G}-${Y.id.slice(0,8)}`;Q.add(G);let W=[`# Brand: ${Y.name}`,"",`**Domain:** ${Y.domain}`,"","## Overview",Y.overview];if(Y.colors){let B=Object.entries(Y.colors).filter(([,v])=>v);if(B.length>0){W.push("","## Colors");for(let[v,N]of B)W.push(`- **${v}:** ${N}`)}}if(Y.fonts){let B=Object.entries(Y.fonts).filter(([,v])=>v);if(B.length>0){W.push("","## Fonts");for(let[v,N]of B)W.push(`- ${N} (${v})`)}}if(Y.logo)W.push("",`**Logo:** ${Y.logo}`);if(Y.favicon)W.push(`**Favicon:** ${Y.favicon}`);if(Y.ogImage)W.push(`**OG Image:** ${Y.ogImage}`);if(Y.images&&Y.images.length>0){W.push("","## Images");for(let B of Y.images){let v=Object.entries(B).map(([N,O])=>`${N}: ${O}`).join(", ");W.push(`- ${v}`)}}let F=W.join(`
 `);X.prompt(G,`Brand context for ${Y.name}`,()=>({messages:[{role:"user",content:{type:"text",text:F}}]}))}}let w=_N$();for(let E of w)X.resource(E.name,E.uri,{description:E.description,mimeType:E.mimeType??"text/markdown"},async(Q)=>{return{contents:[{uri:typeof Q==="string"?Q:Q.href,mimeType:E.mimeType??"text/markdown",text:E.text}]}});return X};var Oo=U(()=>{Cf0();IW();l50();m0();uX$();HB$();LB$();hB$();tB$();oB$();zv$();Lv$();iv$();NU$();zU$();xU$();dU$();eU$();ek1();tN$();yP$();QR$();DR$();WR$();vR$();eX3=[KS1,HS1,_S1,PS1,jS1,LS1,TS1,AS1,IS1,SS1,kS1,RS1,qS1,MS1,hS1,yS1,gS1,VS1,bS1,iS1,xS1,lS1,cS1,Rj1,rI1,aI1,pI1,oI1,sI1,QS1,DS1,ZS1,GS1,WS1,jB$,NS1,OS1,zS1,x_1,c_1,d_1,l_1,eI1,$S1,uS1,fS1,XS1,JS1,wS1,Tk1,pS1,oS1,sS1,eS1,$k1,uk1,dS1,mS1,nS1,tS1,rS1,fk1,Xk1,Jk1,Kk1,Hk1,_k1,Pk1,jk1,Lk1,FS1,BS1,vS1,US1,Ak1,kk1,Rk1,Ck1,qk1,Mk1,hk1,yk1,gk1,Vk1,bk1,ik1,xk1,ck1,dk1,mk1,nk1,tk1,rk1,sk1,$R1,uR1,fR1,XR1,JR1,wR1,...hP$,cM1,dM1,mM1,tM1,rM1],$73=w1$(),UR$=[...eX3,...$73]});function f73($){return[{permissions:{self:["*"]},getTools:async()=>{let{ALL_TOOLS:u}=await Promise.resolve().then(() => (Oo(),SS0));return u.map((f)=>{return{name:f.name,inputSchema:D.toJSONSchema(f.inputSchema,{unrepresentable:"any"}),outputSchema:f.outputSchema?D.toJSONSchema(f.outputSchema,{unrepresentable:"any"}):void 0,description:f.description}})},data:TN1(I9(),$)},{data:LN1()},{data:jN1($)}]}async function NR$($,u){try{let f=x6(),X=g4(),J=new MT(X.encryptionKey),w=new O80(f.db,J),E=f73($);await Promise.all(E.map(async(Q)=>{let Y=null;if(Q.permissions)Y=(await U5.api.createApiKey({body:{name:`${Q.data.app_name??crypto.randomUUID()}-mcp`,userId:u,permissions:Q.permissions,rateLimitEnabled:!1,metadata:{organization:{id:$},purpose:"default-org-connections"}}}))?.key;let Z=await SK({id:"pending",title:Q.data.title,connection_type:Q.data.connection_type,connection_url:Q.data.connection_url,connection_token:Q.data.connection_token??Y,connection_headers:Q.data.connection_headers}).catch(()=>null),G=await Q.getTools?.()??Z?.tools??null,W=Z?.scopes?.length?Z.scopes:null,F=Q.data.id?Q.data.id.startsWith(`${$}_`)?Q.data.id:`${$}_${Q.data.id}`:void 0;await w.create({...Q.data,id:F,tools:G,configuration_scopes:W,organization_id:$,created_by:u,connection_token:Q.data.connection_token??Y})}));try{await i_1({orgId:$,createdBy:u})}catch(Q){console.error("Failed to enqueue studio pack install:",Q)}if(X.aiGatewayEnabled&&X.studioProvisionSecretKey&&v80.provisionKey)try{let Q=await kK(u),Y=await v80.provisionKey(Q,$);await new N80(f.db,J).upsert({providerId:"deco",label:"Auto-provisioned",apiKey:Y,organizationId:$,createdBy:u})}catch(Q){console.error("Failed to auto-provision Deco AI Gateway key:",Q)}}catch(f){console.error("Error creating default MCP connections:",f)}}var OR$=U(()=>{iu();__1();lG();JE();sL0();j_1();L_1();K80();m0();e3();hU();wT0();gT()});function X73($,u){let f=$.email.split("@")[1]?.toLowerCase()??null;return{distinctId:$.id,properties:{$set:{email:$.email,name:$.name,email_verified:$.emailVerified},$set_once:{first_seen_at:u.toISOString(),signup_email_domain:f}}}}function aM1($){j$.identify(X73($,new Date))}var zR$=U(()=>{Bf()});async function E73($){let{user:u,token:f}=$;if(!f?.idToken)return;let X;try{X=B6(f.idToken)}catch{return}let{preferred_username:J,upn:w}=X,E=[J,w].filter((Z)=>typeof Z==="string"&&Z.length>0&&Z.toLowerCase()!==u.email.toLowerCase()).map((Z)=>Z.toLowerCase());if(E.length===0)return;let{db:Q}=x6(),Y=await Q.selectFrom("user").selectAll().where("email","in",E).where("id","!=",u.id).executeTakeFirst();if(!Y)return;try{await Q.transaction().execute(async(Z)=>{await u0`UPDATE "account" SET "userId" = ${Y.id} WHERE "userId" = ${u.id}`.execute(Z),await u0`UPDATE "session" SET "userId" = ${Y.id} WHERE "userId" = ${u.id}`.execute(Z),await u0`
         UPDATE "member" SET "userId" = ${Y.id}
         WHERE "userId" = ${u.id}