decocms 2.393.0 → 2.393.2

package/dist/server/server.js

@@ -2968,7 +2968,7 @@ Hint: Configure a valid Google account email in Monitor Configuration > Contexto
 `);let G=X.pax;if(G)for(let Q in G)Y+=rA0(" "+Q+"="+G[Q]+`
 `);return n8.from(Y)};Sf8.decodePax=function(X){let Y={};while(X.length){let G=0;while(G<X.length&&X[G]!==32)G++;let Q=parseInt(n8.toString(X.subarray(0,G)),10);if(!Q)return Y;let J=n8.toString(X.subarray(G+1,Q-1)),Z=J.indexOf("=");if(Z===-1)return Y;Y[J.slice(0,Z)]=J.slice(Z+1),X=X.subarray(Q)}return Y};Sf8.encode=function(X){let Y=n8.alloc(512),G=X.name,Q="";if(X.typeflag===5&&G[G.length-1]!=="/")G+="/";if(n8.byteLength(G)!==G.length)return null;while(n8.byteLength(G)>100){let J=G.indexOf("/");if(J===-1)return null;Q+=Q?"/"+G.slice(0,J):G.slice(0,J),G=G.slice(J+1)}if(n8.byteLength(G)>100||n8.byteLength(Q)>155)return null;if(X.linkname&&n8.byteLength(X.linkname)>100)return null;if(n8.write(Y,G),n8.write(Y,RP(X.mode&4095,6),100),n8.write(Y,RP(X.uid,6),108),n8.write(Y,RP(X.gid,6),116),If8(X.size,Y,124),n8.write(Y,RP(X.mtime.getTime()/1000|0,11),136),Y[156]=48+Vf8(X.type),X.linkname)n8.write(Y,X.linkname,157);if(n8.copy(MF6,Y,257),n8.copy(Lf8,Y,263),X.uname)n8.write(Y,X.uname,265);if(X.gname)n8.write(Y,X.gname,297);if(n8.write(Y,RP(X.devmajor||0,6),329),n8.write(Y,RP(X.devminor||0,6),337),Q)n8.write(Y,Q,345);return n8.write(Y,RP(RF6(Y),6),148),Y};Sf8.decode=function(X,Y,G){let Q=X[156]===0?0:X[156]-48,J=zt(X,0,100,Y),Z=IP(X,100,8),W=IP(X,108,8),K=IP(X,116,8),F=IP(X,124,12),U=IP(X,136,12),B=Tf8(Q),N=X[157]===0?null:zt(X,157,100,Y),w=zt(X,265,32),z=zt(X,297,32),O=IP(X,329,8),L=IP(X,337,8),j=RF6(X);if(j===256)return null;if(j!==IP(X,148,8))throw Error("Invalid tar header. Maybe the tar is corrupted or it needs to be gunzipped?");if(Pf8(X)){if(X[345])J=zt(X,345,155,Y)+"/"+J}else if(qf8(X));else if(!G)throw Error("Invalid tar header: unknown format.");if(Q===0&&J&&J[J.length-1]==="/")Q=5;return{name:J,mode:Z,uid:W,gid:K,size:F,mtime:new Date(1000*U),type:B,linkname:N,uname:w,gname:z,devmajor:O,devminor:L,pax:null}};function Pf8($){return n8.equals(MF6,$.subarray(257,263))}function qf8($){return n8.equals(Ef8,$.subarray(257,263))&&n8.equals(jf8,$.subarray(263,265))}function Af8($,X,Y){if(typeof $!=="number")return Y;if($=~~$,$>=X)return X;if($>=0)return $;if($+=X,$>=0)return $;return 0}function Tf8($){switch($){case 0:return"file";case 1:return"link";case 2:return"symlink";case 3:return"character-device";case 4:return"block-device";case 5:return"directory";case 6:return"fifo";case 7:return"contiguous-file";case 72:return"pax-header";case 55:return"pax-global-header";case 27:return"gnu-long-link-path";case 28:case 30:return"gnu-long-path"}return null}function Vf8($){switch($){case"file":return 0;case"link":return 1;case"symlink":return 2;case"character-device":return 3;case"block-device":return 4;case"directory":return 5;case"fifo":return 6;case"contiguous-file":return 7;case"pax-header":return 72}return 0}function IF6($,X,Y,G){for(;Y<G;Y++)if($[Y]===X)return Y;return G}function RF6($){let X=256;for(let Y=0;Y<148;Y++)X+=$[Y];for(let Y=156;Y<512;Y++)X+=$[Y];return X}function RP($,X){if($=$.toString(8),$.length>X)return"7777777777777777777".slice(0,X)+" ";return"0000000000000000000".slice(0,X-$.length)+$+" "}function Mf8($,X,Y){X[Y]=128;for(let G=11;G>0;G--)X[Y+G]=$&255,$=Math.floor($/256)}function If8($,X,Y){if($.toString(8).length>11)Mf8($,X,Y);else n8.write(X,RP($,11),Y)}function Rf8($){let X;if($[0]===128)X=!0;else if($[0]===255)X=!1;else return null;let Y=[],G;for(G=$.length-1;G>0;G--){let Z=$[G];if(X)Y.push(Z);else Y.push(255-Z)}let Q=0,J=Y.length;for(G=0;G<J;G++)Q+=Y[G]*Math.pow(256,G);return X?Q:-1*Q}function IP($,X,Y){if($=$.subarray(X,X+Y),X=0,$[X]&128)return Rf8($);else{while(X<$.length&&$[X]===32)X++;let G=Af8(IF6($,32,X,$.length),$.length,$.length);while(X<G&&$[X]===0)X++;if(G===X)return 0;return parseInt(n8.toString($.subarray(X,G)),8)}}function zt($,X,Y,G){return n8.toString($.subarray(X,IF6($,0,X,X+Y)),G)}function rA0($){let X=n8.byteLength($),Y=Math.floor(Math.log(X)/Math.log(10))+1;if(X+Y>=Math.pow(10,Y))Y++;return X+Y+$}});var yF6=h((RdY,fF6)=>{var{Writable:ff8,Readable:yf8,getStreamError:SF6}=nA0(),xf8=mA0(),kF6=wt(),Dt=tA0(),gf8=kF6.alloc(0);class CF6{constructor(){this.buffered=0,this.shifted=0,this.queue=new xf8,this._offset=0}push($){this.buffered+=$.byteLength,this.queue.push($)}shiftFirst($){return this._buffered===0?null:this._next($)}shift($){if($>this.buffered)return null;if($===0)return gf8;let X=this._next($);if($===X.byteLength)return X;let Y=[X];while(($-=X.byteLength)>0)X=this._next($),Y.push(X);return kF6.concat(Y)}_next($){let X=this.queue.peek(),Y=X.byteLength-this._offset;if($>=Y){let G=this._offset?X.subarray(this._offset,X.byteLength):X;return this.queue.shift(),this._offset=0,this.buffered-=Y,this.shifted+=Y,G}return this.buffered-=$,this.shifted+=$,X.subarray(this._offset,this._offset+=$)}}class vF6 extends yf8{constructor($,X,Y){super();this.header=X,this.offset=Y,this._parent=$}_read($){if(this.header.size===0)this.push(null);if(this._parent._stream===this)this._parent._update();$(null)}_predestroy(){this._parent.destroy(SF6(this))}_detach(){if(this._parent._stream===this)this._parent._stream=null,this._parent._missing=bF6(this.header.size),this._parent._update()}_destroy($){this._detach(),$(null)}}class _F6 extends ff8{constructor($){super($);if(!$)$={};this._buffer=new CF6,this._offset=0,this._header=null,this._stream=null,this._missing=0,this._longHeader=!1,this._callback=aA0,this._locked=!1,this._finished=!1,this._pax=null,this._paxGlobal=null,this._gnuLongPath=null,this._gnuLongLinkPath=null,this._filenameEncoding=$.filenameEncoding||"utf-8",this._allowUnknownFormat=!!$.allowUnknownFormat,this._unlockBound=this._unlock.bind(this)}_unlock($){if(this._locked=!1,$){this.destroy($),this._continueWrite($);return}this._update()}_consumeHeader(){if(this._locked)return!1;this._offset=this._buffer.shifted;try{this._header=Dt.decode(this._buffer.shift(512),this._filenameEncoding,this._allowUnknownFormat)}catch($){return this._continueWrite($),!1}if(!this._header)return!0;switch(this._header.type){case"gnu-long-path":case"gnu-long-link-path":case"pax-global-header":case"pax-header":return this._longHeader=!0,this._missing=this._header.size,!0}if(this._locked=!0,this._applyLongHeaders(),this._header.size===0||this._header.type==="directory")return this.emit("entry",this._header,this._createStream(),this._unlockBound),!0;return this._stream=this._createStream(),this._missing=this._header.size,this.emit("entry",this._header,this._stream,this._unlockBound),!0}_applyLongHeaders(){if(this._gnuLongPath)this._header.name=this._gnuLongPath,this._gnuLongPath=null;if(this._gnuLongLinkPath)this._header.linkname=this._gnuLongLinkPath,this._gnuLongLinkPath=null;if(this._pax){if(this._pax.path)this._header.name=this._pax.path;if(this._pax.linkpath)this._header.linkname=this._pax.linkpath;if(this._pax.size)this._header.size=parseInt(this._pax.size,10);this._header.pax=this._pax,this._pax=null}}_decodeLongHeader($){switch(this._header.type){case"gnu-long-path":this._gnuLongPath=Dt.decodeLongPath($,this._filenameEncoding);break;case"gnu-long-link-path":this._gnuLongLinkPath=Dt.decodeLongPath($,this._filenameEncoding);break;case"pax-global-header":this._paxGlobal=Dt.decodePax($);break;case"pax-header":this._pax=this._paxGlobal===null?Dt.decodePax($):Object.assign({},this._paxGlobal,Dt.decodePax($));break}}_consumeLongHeader(){this._longHeader=!1,this._missing=bF6(this._header.size);let $=this._buffer.shift(this._header.size);try{this._decodeLongHeader($)}catch(X){return this._continueWrite(X),!1}return!0}_consumeStream(){let $=this._buffer.shiftFirst(this._missing);if($===null)return!1;this._missing-=$.byteLength;let X=this._stream.push($);if(this._missing===0){if(this._stream.push(null),X)this._stream._detach();return X&&this._locked===!1}return X}_createStream(){return new vF6(this,this._header,this._offset)}_update(){while(this._buffer.buffered>0&&!this.destroying){if(this._missing>0){if(this._stream!==null){if(this._consumeStream()===!1)return;continue}if(this._longHeader===!0){if(this._missing>this._buffer.buffered)break;if(this._consumeLongHeader()===!1)return!1;continue}let $=this._buffer.shiftFirst(this._missing);if($!==null)this._missing-=$.byteLength;continue}if(this._buffer.buffered<512)break;if(this._stream!==null||this._consumeHeader()===!1)return}this._continueWrite(null)}_continueWrite($){let X=this._callback;this._callback=aA0,X($)}_write($,X){this._callback=X,this._buffer.push($),this._update()}_final($){this._finished=this._missing===0&&this._buffer.buffered===0,$(this._finished?null:Error("Unexpected end of data"))}_predestroy(){this._continueWrite(null)}_destroy($){if(this._stream)this._stream.destroy(SF6(this));$(null)}[Symbol.asyncIterator](){let $=null,X=null,Y=null,G=null,Q=null,J=this;return this.on("entry",K),this.on("error",(B)=>{$=B}),this.on("close",F),{[Symbol.asyncIterator](){return this},next(){return new Promise(W)},return(){return U(null)},throw(B){return U(B)}};function Z(B){if(!Q)return;let N=Q;Q=null,N(B)}function W(B,N){if($)return N($);if(G){B({value:G,done:!1}),G=null;return}if(X=B,Y=N,Z(null),J._finished&&X)X({value:void 0,done:!0}),X=Y=null}function K(B,N,w){if(Q=w,N.on("error",aA0),X)X({value:N,done:!1}),X=Y=null;else G=N}function F(){if(Z($),!X)return;if($)Y($);else X({value:void 0,done:!0});X=Y=null}function U(B){return J.destroy(B),Z(B),new Promise((N,w)=>{if(J.destroyed)return N({value:void 0,done:!0});J.once("close",function(){if(B)w(B);else N({value:void 0,done:!0})})})}}}fF6.exports=function(X){return new _F6(X)};function aA0(){}function bF6($){return $&=511,$&&512-$}});var gF6=h((SdY,oA0)=>{var xF6={S_IFMT:61440,S_IFDIR:16384,S_IFCHR:8192,S_IFBLK:24576,S_IFIFO:4096,S_IFLNK:40960};try{oA0.exports=z1("fs").constants||xF6}catch{oA0.exports=xF6}});var iF6=h((kdY,dF6)=>{var{Readable:hf8,Writable:uf8,getStreamError:hF6}=nA0(),yh=wt(),Ot=gF6(),jg1=tA0(),uF6=yh.alloc(1024);class mF6 extends uf8{constructor($,X,Y){super({mapWritable:lf8,eagerOpen:!0});if(this.written=0,this.header=X,this._callback=Y,this._linkname=null,this._isLinkname=X.type==="symlink"&&!X.linkname,this._isVoid=X.type!=="file"&&X.type!=="contiguous-file",this._finished=!1,this._pack=$,this._openCallback=null,this._pack._stream===null)this._pack._stream=this;else this._pack._pending.push(this)}_open($){if(this._openCallback=$,this._pack._stream===this)this._continueOpen()}_continuePack($){if(this._callback===null)return;let X=this._callback;this._callback=null,X($)}_continueOpen(){if(this._pack._stream===null)this._pack._stream=this;let $=this._openCallback;if(this._openCallback=null,$===null)return;if(this._pack.destroying)return $(Error("pack stream destroyed"));if(this._pack._finalized)return $(Error("pack stream is already finalized"));if(this._pack._stream=this,!this._isLinkname)this._pack._encode(this.header);if(this._isVoid)this._finish(),this._continuePack(null);$(null)}_write($,X){if(this._isLinkname)return this._linkname=this._linkname?yh.concat([this._linkname,$]):$,X(null);if(this._isVoid){if($.byteLength>0)return X(Error("No body allowed for this entry"));return X()}if(this.written+=$.byteLength,this._pack.push($))return X();this._pack._drain=X}_finish(){if(this._finished)return;if(this._finished=!0,this._isLinkname)this.header.linkname=this._linkname?yh.toString(this._linkname,"utf-8"):"",this._pack._encode(this.header);cF6(this._pack,this.header.size),this._pack._done(this)}_final($){if(this.written!==this.header.size)return $(Error("Size mismatch"));this._finish(),$(null)}_getError(){return hF6(this)||Error("tar entry destroyed")}_predestroy(){this._pack.destroy(this._getError())}_destroy($){this._pack._done(this),this._continuePack(this._finished?null:this._getError()),$()}}class lF6 extends hf8{constructor($){super($);this._drain=sA0,this._finalized=!1,this._finalizing=!1,this._pending=[],this._stream=null}entry($,X,Y){if(this._finalized||this.destroying)throw Error("already finalized or destroyed");if(typeof X==="function")Y=X,X=null;if(!Y)Y=sA0;if(!$.size||$.type==="symlink")$.size=0;if(!$.type)$.type=mf8($.mode);if(!$.mode)$.mode=$.type==="directory"?493:420;if(!$.uid)$.uid=0;if(!$.gid)$.gid=0;if(!$.mtime)$.mtime=new Date;if(typeof X==="string")X=yh.from(X);let G=new mF6(this,$,Y);if(yh.isBuffer(X))return $.size=X.byteLength,G.write(X),G.end(),G;if(G._isVoid)return G;return G}finalize(){if(this._stream||this._pending.length>0){this._finalizing=!0;return}if(this._finalized)return;this._finalized=!0,this.push(uF6),this.push(null)}_done($){if($!==this._stream)return;if(this._stream=null,this._finalizing)this.finalize();if(this._pending.length)this._pending.shift()._continueOpen()}_encode($){if(!$.pax){let X=jg1.encode($);if(X){this.push(X);return}}this._encodePax($)}_encodePax($){let X=jg1.encodePax({name:$.name,linkname:$.linkname,pax:$.pax}),Y={name:"PaxHeader",mode:$.mode,uid:$.uid,gid:$.gid,size:X.byteLength,mtime:$.mtime,type:"pax-header",linkname:$.linkname&&"PaxHeader",uname:$.uname,gname:$.gname,devmajor:$.devmajor,devminor:$.devminor};this.push(jg1.encode(Y)),this.push(X),cF6(this,X.byteLength),Y.size=$.size,Y.type=$.type,this.push(jg1.encode(Y))}_doDrain(){let $=this._drain;this._drain=sA0,$()}_predestroy(){let $=hF6(this);if(this._stream)this._stream.destroy($);while(this._pending.length){let X=this._pending.shift();X.destroy($),X._continueOpen()}this._doDrain()}_read($){this._doDrain(),$()}}dF6.exports=function(X){return new lF6(X)};function mf8($){switch($&Ot.S_IFMT){case Ot.S_IFBLK:return"block-device";case Ot.S_IFCHR:return"character-device";case Ot.S_IFDIR:return"directory";case Ot.S_IFIFO:return"fifo";case Ot.S_IFLNK:return"symlink"}return"file"}function sA0(){}function cF6($,X){if(X&=511,X)$.push(uF6.subarray(0,512-X))}function lf8($){return yh.isBuffer($)?$:yh.from($)}});var pF6=h((cf8)=>{cf8.extract=yF6();cf8.pack=iF6()});var tF6=h((vdY,rF6)=>{rF6.exports=nF6;function nF6($,X){if($&&X)return nF6($)(X);if(typeof $!=="function")throw TypeError("need wrapper function");return Object.keys($).forEach(function(G){Y[G]=$[G]}),Y;function Y(){var G=Array(arguments.length);for(var Q=0;Q<G.length;Q++)G[Q]=arguments[Q];var J=$.apply(this,G),Z=G[G.length-1];if(typeof J==="function"&&J!==Z)Object.keys(Z).forEach(function(W){J[W]=Z[W]});return J}}});var $20=h((_dY,eA0)=>{var aF6=tF6();eA0.exports=aF6(Pg1);eA0.exports.strict=aF6(oF6);Pg1.proto=Pg1(function(){Object.defineProperty(Function.prototype,"once",{value:function(){return Pg1(this)},configurable:!0}),Object.defineProperty(Function.prototype,"onceStrict",{value:function(){return oF6(this)},configurable:!0})});function Pg1($){var X=function(){if(X.called)return X.value;return X.called=!0,X.value=$.apply(this,arguments)};return X.called=!1,X}function oF6($){var X=function(){if(X.called)throw Error(X.onceError);return X.called=!0,X.value=$.apply(this,arguments)},Y=$.name||"Function wrapped with `once`";return X.onceError=Y+" shouldn't be called more than once",X.called=!1,X}});var $U6=h((bdY,eF6)=>{var pf8=$20(),nf8=function(){},rf8=global.Bare?queueMicrotask:process.nextTick.bind(process),tf8=function($){return $.setHeader&&typeof $.abort==="function"},af8=function($){return $.stdio&&Array.isArray($.stdio)&&$.stdio.length===3},sF6=function($,X,Y){if(typeof X==="function")return sF6($,null,X);if(!X)X={};Y=pf8(Y||nf8);var{_writableState:G,_readableState:Q}=$,J=X.readable||X.readable!==!1&&$.readable,Z=X.writable||X.writable!==!1&&$.writable,W=!1,K=function(){if(!$.writable)F()},F=function(){if(Z=!1,!J)Y.call($)},U=function(){if(J=!1,!Z)Y.call($)},B=function(L){Y.call($,L?Error("exited with error code: "+L):null)},N=function(L){Y.call($,L)},w=function(){rf8(z)},z=function(){if(W)return;if(J&&!(Q&&(Q.ended&&!Q.destroyed)))return Y.call($,Error("premature close"));if(Z&&!(G&&(G.ended&&!G.destroyed)))return Y.call($,Error("premature close"))},O=function(){$.req.on("finish",F)};if(tf8($))if($.on("complete",F),$.on("abort",w),$.req)O();else $.on("request",O);else if(Z&&!G)$.on("end",K),$.on("close",K);if(af8($))$.on("exit",B);if($.on("end",U),$.on("finish",F),X.error!==!1)$.on("error",N);return $.on("close",w),function(){if(W=!0,$.removeListener("complete",F),$.removeListener("abort",w),$.removeListener("request",O),$.req)$.req.removeListener("finish",F);$.removeListener("end",K),$.removeListener("close",K),$.removeListener("finish",F),$.removeListener("exit",B),$.removeListener("end",U),$.removeListener("error",N),$.removeListener("close",w)}};eF6.exports=sF6});var GU6=h((fdY,YU6)=>{var of8=$20(),sf8=$U6(),qg1;try{qg1=z1("fs")}catch($){}var B71=function(){},ef8=typeof process>"u"?!1:/^v?\.0/.test(process.version),Ag1=function($){return typeof $==="function"},$y8=function($){if(!ef8)return!1;if(!qg1)return!1;return($ instanceof(qg1.ReadStream||B71)||$ instanceof(qg1.WriteStream||B71))&&Ag1($.close)},Xy8=function($){return $.setHeader&&Ag1($.abort)},Yy8=function($,X,Y,G){G=of8(G);var Q=!1;$.on("close",function(){Q=!0}),sf8($,{readable:X,writable:Y},function(Z){if(Z)return G(Z);Q=!0,G()});var J=!1;return function(Z){if(Q)return;if(J)return;if(J=!0,$y8($))return $.close(B71);if(Xy8($))return $.abort();if(Ag1($.destroy))return $.destroy();G(Z||Error("stream was destroyed"))}},XU6=function($){$()},Gy8=function($,X){return $.pipe(X)},Qy8=function(){var $=Array.prototype.slice.call(arguments),X=Ag1($[$.length-1]||B71)&&$.pop()||B71;if(Array.isArray($[0]))$=$[0];if($.length<2)throw Error("pump requires two streams per minimum");var Y,G=$.map(function(Q,J){var Z=J<$.length-1,W=J>0;return Yy8(Q,Z,W,function(K){if(!Y)Y=K;if(K)G.forEach(XU6);if(Z)return;G.forEach(XU6),X(Y)})});return $.reduce(Gy8)};YU6.exports=Qy8});var BU6=h((Ky8)=>{var QU6=pF6(),JU6=GU6(),ZU6=z1("fs"),$Y=z1("path"),N71=(global.Bare?global.Bare.platform:process.platform)==="win32";Ky8.pack=function(X,Y){if(!X)X=".";if(!Y)Y={};let G=Y.fs||ZU6,Q=Y.ignore||Y.filter||w71,J=Y.mapStream||FU6,Z=Wy8(G,Y.dereference?G.stat:G.lstat,X,Q,Y.entries,Y.sort),W=Y.strict!==!1,K=typeof Y.umask==="number"?~Y.umask:~WU6(),F=Y.pack||QU6.pack(),U=Y.finish||w71,B=Y.map||w71,N=typeof Y.dmode==="number"?Y.dmode:0,w=typeof Y.fmode==="number"?Y.fmode:0;if(Y.strip)B=UU6(B,Y.strip);if(Y.readable)N|=parseInt(555,8),w|=parseInt(444,8);if(Y.writable)N|=parseInt(333,8),w|=parseInt(222,8);L();function z(j,P){G.readlink($Y.join(X,j),function(T,I){if(T)return F.destroy(T);P.linkname=X20(I),F.entry(P,L)})}function O(j,P,T){if(F.destroyed)return;if(j)return F.destroy(j);if(!P){if(Y.finalize!==!1)F.finalize();return U(F)}if(T.isSocket())return L();let I={name:X20(P),mode:(T.mode|(T.isDirectory()?N:w))&K,mtime:T.mtime,size:T.size,type:"file",uid:T.uid,gid:T.gid};if(T.isDirectory())return I.size=0,I.type="directory",I=B(I)||I,F.entry(I,L);if(T.isSymbolicLink())return I.size=0,I.type="symlink",I=B(I)||I,z(P,I);if(I=B(I)||I,!T.isFile()){if(W)return F.destroy(Error("unsupported type for "+P));return L()}let V=F.entry(I,L),R=J(G.createReadStream($Y.join(X,P),{start:0,end:I.size>0?I.size-1:I.size}),I);R.on("error",function(v){V.destroy(v)}),JU6(R,V)}function L(j){if(j)return F.destroy(j);Z(O)}return F};function Jy8($){return $.length?$[$.length-1]:null}function Zy8(){return!global.Bare&&process.getuid?process.getuid():-1}function WU6(){return!global.Bare&&process.umask?process.umask():0}Ky8.extract=function(X,Y){if(!X)X=".";if(!Y)Y={};X=$Y.resolve(X);let G=Y.fs||ZU6,Q=Y.ignore||Y.filter||w71,J=Y.mapStream||FU6,Z=Y.chown!==!1&&!N71&&Zy8()===0,W=Y.extract||QU6.extract(),K=[],F=new Date,U=typeof Y.umask==="number"?~Y.umask:~WU6(),B=Y.strict!==!1,N=Y.validateSymlinks!==!1,w=Y.map||w71,z=typeof Y.dmode==="number"?Y.dmode:0,O=typeof Y.fmode==="number"?Y.fmode:0;if(Y.strip)w=UU6(w,Y.strip);if(Y.readable)z|=parseInt(555,8),O|=parseInt(444,8);if(Y.writable)z|=parseInt(333,8),O|=parseInt(222,8);if(W.on("entry",L),Y.finish)W.on("finish",Y.finish);return W;function L(V,R,v){V=w(V)||V,V.name=X20(V.name);let S=$Y.join(X,$Y.join("/",V.name));if(Q(S,V))return R.resume(),v();let _=$Y.join(S,".")===$Y.join(X,".")?X:$Y.dirname(S);HU6(G,_,$Y.join(X,"."),function(d,t){if(d)return v(d);if(!t)return v(Error(_+" is not a valid path"));if(V.type==="directory")return K.push([S,V.mtime]),I(S,{fs:G,own:Z,uid:V.uid,gid:V.gid,mode:V.mode},y);I(_,{fs:G,own:Z,uid:V.uid,gid:V.gid,mode:493},function(e){if(e)return v(e);switch(V.type){case"file":return b();case"link":return l();case"symlink":return f()}if(B)return v(Error("unsupported type for "+S+" ("+V.type+")"));R.resume(),v()})});function y(d){if(d)return v(d);P(S,V,function(t){if(t)return v(t);if(N71)return v();T(S,V,v)})}function f(){if(N71)return v();G.unlink(S,function(){let d=$Y.resolve($Y.dirname(S),V.linkname);if(!c(d)&&N)return v(Error(S+" is not a valid symlink"));KU6(G,d,$Y.join(X,"."),function(t,e){if(t)return v(t);if(!e&&N)return v(Error(S+" is not a valid symlink"));G.symlink(V.linkname,S,y)})})}function l(){if(N71)return v();G.unlink(S,function(){let d=$Y.join(X,$Y.join("/",V.linkname));G.realpath(d,function(t,e){if(t||!c(e))return v(Error(S+" is not a valid hardlink"));G.link(e,S,function(W1){if(W1&&W1.code==="EPERM"&&Y.hardlinkAsFilesFallback)return R=G.createReadStream(e),b();y(W1)})})})}function c(d){return d===X||d.startsWith(X+$Y.sep)}function b(){let d=G.createWriteStream(S),t=J(R,V);d.on("error",function(e){t.destroy(e)}),JU6(t,d,function(e){if(e)return v(e);d.on("close",y)})}}function j(V,R){let v;while((v=Jy8(K))&&V.slice(0,v[0].length)!==v[0])K.pop();if(!v)return R();G.utimes(v[0],F,v[1],R)}function P(V,R,v){if(Y.utimes===!1)return v();if(R.type==="directory")return G.utimes(V,F,R.mtime,v);if(R.type==="symlink")return j(V,v);G.utimes(V,F,R.mtime,function(S){if(S)return v(S);j(V,v)})}function T(V,R,v){let S=R.type==="symlink",_=S?G.lchmod:G.chmod,y=S?G.lchown:G.chown;if(!_)return v();let f=(R.mode|(R.type==="directory"?z:O))&U;if(y&&Z)y.call(G,V,R.uid,R.gid,l);else l(null);function l(c){if(c)return v(c);if(!_)return v();_.call(G,V,f,v)}}function I(V,R,v){G.stat(V,function(S){if(!S)return v(null);if(S.code!=="ENOENT")return v(S);G.mkdir(V,{mode:R.mode,recursive:!0},function(_,y){if(_)return v(_);T(V,R,v)})})}};function KU6($,X,Y,G){if(X===Y)return G(null,!0);if(!X.startsWith(Y+$Y.sep))return G(null,!1);$.lstat(X,function(Q,J){if(Q&&Q.code!=="ENOENT"&&Q.code!=="EPERM")return G(Q);if(Q||!J.isSymbolicLink())return KU6($,$Y.join(X,".."),Y,G);G(null,!1)})}function HU6($,X,Y,G){if(X===Y)return G(null,!0);$.lstat(X,function(Q,J){if(Q&&Q.code!=="ENOENT"&&Q.code!=="EPERM")return G(Q);if(Q||J.isDirectory())return HU6($,$Y.join(X,".."),Y,G);G(null,!1)})}function w71(){}function FU6($){return $}function X20($){return N71?$.replace(/\\/g,"/").replace(/[:?<>|]/g,"_"):$}function Wy8($,X,Y,G,Q,J){if(!Q)Q=["."];let Z=Q.slice(0);return function(K){if(!Z.length)return K(null);let F=Z.shift(),U=$Y.join(Y,F);X.call($,U,function(B,N){if(B)return K(Q.indexOf(F)===-1&&B.code==="ENOENT"?null:B);if(!N.isDirectory())return K(null,F,N);$.readdir(U,function(w,z){if(w)return K(w);if(J)z.sort();for(let O=0;O<z.length;O++)if(!G($Y.join(Y,F,z[O])))Z.push($Y.join(F,z[O]));K(null,F,N)})})}}function UU6($,X){return function(Y){Y.name=Y.name.split("/").slice(X).join("/");let G=Y.linkname;if(G&&(Y.type==="link"||$Y.isAbsolute(G)))Y.linkname=G.split("/").slice(X).join("/");return $(Y)}}});var Uy8,By8;var NU6=D(()=>{hA0();Uy8=G1($F6(),1),By8=G1(BU6(),1)});var Tg1=()=>{};var wU6=D(()=>{gx1()});var zU6=D(()=>{Ug1();Fg1();Tg1()});var DU6=()=>{};var OU6=()=>{};var Y20=D(()=>{fH6();xA0();Ug1();uH6();fA0();hA0();mH6();lH6();cH6();dH6();yA0();iH6();NU6();Tg1();wU6();zU6();DU6();OU6();Tg1()});var a7,mY,xh,z71;var D71=D(()=>{a7={CLAIM_API_GROUP:"extensions.agents.x-k8s.io",CLAIM_API_VERSION:"v1alpha1",CLAIM_PLURAL:"sandboxclaims",SANDBOX_API_GROUP:"agents.x-k8s.io",SANDBOX_API_VERSION:"v1alpha1",SANDBOX_PLURAL:"sandboxes",POD_NAME_ANNOTATION:"agents.x-k8s.io/pod-name"};mY=class mY extends Error{cause;constructor($,X){super($);if(this.name="SandboxError",this.cause=X,X instanceof Error&&X.stack)this.stack=`${this.stack}
 Caused by: ${X.stack}`}};xh=class xh extends mY{constructor($,X){super($,X);this.name="SandboxTimeoutError"}};z71=class z71 extends mY{constructor($,X){super($,X);this.name="SandboxAlreadyExistsError"}}});async function Ny8($){let X=$.getCurrentCluster();if(!X)throw new mY("No active cluster in kubeconfig");let Y={};await $.applyToHTTPSOptions(Y);let G={},Q=Y.headers??{};for(let[J,Z]of Object.entries(Q))if(Array.isArray(Z))G[J]=Z.join(", ");else if(Z!==void 0)G[J]=String(Z);if(typeof Y.auth==="string"&&!G.Authorization)G.Authorization=`Basic ${Buffer.from(Y.auth).toString("base64")}`;return{server:X.server.replace(/\/+$/,""),headers:G,tls:{cert:G20(Y.cert),key:G20(Y.key),ca:G20(Y.ca),rejectUnauthorized:X.skipTLSVerify?!1:void 0}}}function G20($){if($==null)return;if(typeof $==="string")return $;if(Buffer.isBuffer($))return $.toString("utf8");return String($)}async function gh($,X){let Y=await Ny8($),G={...Y.headers,...X.headers};if(X.method==="PATCH")G["content-type"]=X.patchType==="apply"?"application/apply-patch+yaml":X.patchType==="strategic-merge"?"application/strategic-merge-patch+json":"application/merge-patch+json";else if(X.body!==void 0&&!("content-type"in G))G["content-type"]="application/json";let Q={method:X.method,headers:G,body:X.body===void 0?void 0:JSON.stringify(X.body),signal:X.signal,tls:Y.tls};return fetch(`${Y.server}${X.path}`,Q)}async function J20($){try{return await $.json()}catch{return null}}async function Z20($,X){if($.ok)return;let Y=await J20($),G=Y?.message??`${X} failed: ${$.status} ${$.statusText}`;throw new Q20($.status,Y,G)}async function O71($,X,Y,G,Q="none"){try{let J=await gh($,X);if(J.status===404)return null;if(await Z20(J,Y),Q==="json")return await J.json();return null}catch(J){throw new mY(G,J)}}async function L71($,X,Y){let G=`${LU6}/${encodeURIComponent(X)}/${a7.CLAIM_PLURAL}`,Q;try{Q=await gh($,{method:"POST",path:G,body:Y})}catch(F){let U=F instanceof Error?F.message:String(F);throw console.warn(`[agent-sandbox/client] createSandboxClaim ${Y.metadata.name} transport error: ${U}`),new mY(`Failed to create SandboxClaim: ${Y.metadata.name} (transport error: ${U})`,F)}if(Q.ok)return;let J=await J20(Q),Z=J?.reason?` ${J.reason}`:"",W=J?.message??Q.statusText,K=`Failed to create SandboxClaim: ${Y.metadata.name} (${Q.status}${Z}: ${W})`;if(console.warn(`[agent-sandbox/client] createSandboxClaim ${Y.metadata.name} rejected: status=${Q.status} reason=${J?.reason??"<none>"} message=${W}`),Q.status===409)throw new z71(K);throw new mY(K)}async function Vg1($,X,Y,G=60000){let Q=Date.now()+G,J=500,Z;while(!0){let W=await kP($,X,Y).catch(()=>{return});if(!W)return;if(Z=W,Date.now()>=Q){let K=Z.metadata?.finalizers??[],F=Z.metadata?.deletionTimestamp??"<unknown>";throw new xh(`SandboxClaim ${Y} still terminating after ${G}ms (deletionTimestamp=${F}, finalizers=[${K.join(", ")}])`)}await new Promise((K)=>setTimeout(K,500))}}function W20($,X){return`${LU6}/${encodeURIComponent($)}/${a7.CLAIM_PLURAL}/${encodeURIComponent(X)}`}async function EU6($,X,Y,G){await O71($,{method:"PATCH",path:W20(X,Y),patchType:"merge",body:{spec:{lifecycle:{shutdownPolicy:"Delete",shutdownTime:G}}}},"patchSandboxClaimShutdown",`Failed to patch SandboxClaim shutdownTime: ${Y}`)}async function SP($,X,Y){await O71($,{method:"DELETE",path:W20(X,Y)},"deleteSandboxClaim",`Failed to delete SandboxClaim: ${Y}`)}async function kP($,X,Y){return await O71($,{method:"GET",path:W20(X,Y)},"getSandboxClaim",`Failed to get SandboxClaim: ${Y}`,"json")??void 0}async function jU6($,X,Y,G=60){let Q=Date.now()+G*1000,J=200;while(Date.now()<Q){let W=(await kP($,X,Y).catch(()=>{return}))?.status?.sandbox?.name;if(W)return W;await new Promise((K)=>setTimeout(K,200))}throw new xh(`SandboxClaim ${Y} did not record an adopted Sandbox (status.sandbox.name) within ${G}s`)}function TU6($,X){return`${AU6}/${encodeURIComponent($)}/${K20}/${encodeURIComponent(X)}`}function wy8($){return`${AU6}/${encodeURIComponent($)}/${K20}`}async function Mg1($,X,Y){try{let G=await gh($,{method:"POST",path:wy8(X),body:Y});if(G.status===409)return;await Z20(G,"createHttpRoute")}catch(G){if(G instanceof Q20&&G.status===409)return;throw new mY(`Failed to create HTTPRoute: ${Y.metadata.name}`,G)}}async function Ig1($,X,Y){await O71($,{method:"DELETE",path:TU6(X,Y)},"deleteHttpRoute",`Failed to delete HTTPRoute: ${Y}`)}async function VU6($,X,Y){return await O71($,{method:"GET",path:TU6(X,Y)},"getHttpRoute",`Failed to get HTTPRoute: ${Y}`,"json")??void 0}async function MU6($,X,Y,G){let Q={apiVersion:"v1",kind:"Service",metadata:{name:Y},spec:{ports:[{name:G.name,port:G.port,targetPort:G.targetPort,protocol:G.protocol??"TCP"}]}},J=new URLSearchParams({fieldManager:zy8,force:"true"}),Z=`/api/v1/namespaces/${encodeURIComponent(X)}/services/${encodeURIComponent(Y)}?${J}`;try{let W=await gh($,{method:"PATCH",path:Z,patchType:"apply",body:Q});await Z20(W,"ensureServicePort")}catch(W){throw new mY(`Failed to apply Service ports: ${Y}`,W)}}function Rg1($,X,Y,G=180){let Q=`/apis/${a7.SANDBOX_API_GROUP}/${a7.SANDBOX_API_VERSION}/namespaces/${encodeURIComponent(X)}/${a7.SANDBOX_PLURAL}?watch=true&fieldSelector=${encodeURIComponent(`metadata.name=${Y}`)}`,{resolve:J,reject:Z,promise:W}=Promise.withResolvers(),K=new AbortController,F=!1,U=setTimeout(()=>{if(F)return;F=!0,K.abort(),Z(new xh(`Sandbox did not become ready within ${G} seconds`))},G*1000),B=(N)=>{if(F)return;F=!0,clearTimeout(U),K.abort(),N()};return(async()=>{let N;try{N=await gh($,{method:"GET",path:Q,signal:K.signal,headers:{accept:"application/json"}})}catch(w){B(()=>Z(new mY("Failed to start watch for sandbox readiness",w)));return}if(!N.ok||!N.body){let w=await J20(N).catch(()=>null);B(()=>Z(new mY(`Watch handshake failed (${N.status}): ${w?.message??N.statusText}`)));return}try{for await(let w of H20(N.body)){if(F)return;if(w.type==="ERROR"){let P=w.object;B(()=>Z(new mY(`Watch stream error while waiting for sandbox: ${P.message??"unknown"}`)));return}if(w.type!=="ADDED"&&w.type!=="MODIFIED")continue;let z=w.object;if(!z.status?.conditions?.find((P)=>P.type==="Ready"&&P.status==="True"))continue;let L=z.metadata?.name;if(!L){B(()=>Z(new mY("Sandbox metadata or name is missing")));return}let j=z.metadata?.annotations?.[a7.POD_NAME_ANNOTATION]??L;B(()=>J({sandboxName:L,podName:j}));return}B(()=>Z(new mY("Watch stream closed before sandbox became ready")))}catch(w){if(F)return;if(w instanceof Error&&(w.name==="AbortError"||K.signal.aborted))return;B(()=>Z(new mY("Watch stream error while waiting for sandbox",w)))}})(),W}async function*H20($){let X=$.getReader(),Y=new TextDecoder,G="";try{while(!0){let{value:J,done:Z}=await X.read();if(Z)break;G+=Y.decode(J,{stream:!0});let W;while((W=G.indexOf(`
-`))>=0){let K=G.slice(0,W).trim();if(G=G.slice(W+1),!K)continue;yield JSON.parse(K)}}let Q=G.trim();if(Q)yield JSON.parse(Q)}finally{X.releaseLock()}}var Q20,LU6,PU6="gateway.networking.k8s.io",qU6="v1",K20="httproutes",AU6,E71,zy8="mesh-sandbox-runner";var Sg1=D(()=>{D71();Q20=class Q20 extends Error{status;body;constructor($,X,Y){super(Y);this.status=$;this.body=X;this.name="KubeHttpError"}};LU6=`/apis/${a7.CLAIM_API_GROUP}/${a7.CLAIM_API_VERSION}/namespaces`;AU6=`/apis/${PU6}/${qU6}/namespaces`;E71={API_GROUP:PU6,API_VERSION:qU6,PLURAL:K20}});var IU6=D(()=>{kF()});async function kg1($){try{let X=await fetch(`${$}/health`,{signal:AbortSignal.timeout(Dy8)});if(!X.ok)return null;let Y=await X.json();if(typeof Y==="object"&&Y!==null&&typeof Y.bootId==="string"&&typeof Y.ready==="boolean"&&Y.setup&&typeof Y.setup.running==="boolean"&&typeof Y.setup.done==="boolean")return Y;return null}catch{return null}}async function kU6($){for(let X=0;X<RU6;X++){if(await kg1($)!==null)return;let Y=(Math.random()*2-1)*Ly8;await J7(SU6+Y)}throw Error(`sandbox daemon at ${$} did not respond on /health within ${RU6*SU6/1000}s`)}async function Cg1($,X,Y,G){return Ey8($,X,"POST",Y,G)}async function Ey8($,X,Y,G,Q){let J={...G};if(Q&&Q.rotateToken!==void 0)J.auth=Q;let Z=await fetch(`${$}/_sandbox/config`,{method:Y,headers:{"Content-Type":"application/json",Authorization:`Bearer ${X}`},body:JSON.stringify(J),signal:AbortSignal.timeout(Oy8)}),W=await Z.text();if(!Z.ok)throw Error(`sandbox daemon /_sandbox/config returned ${Z.status}: ${W}`);return JSON.parse(W)}async function vg1($,X,Y,G){let Q=new Headers(G.headers);for(let W of jy8)Q.delete(W);Q.set("authorization",`Bearer ${X}`);let J=G.method!=="GET"&&G.method!=="HEAD",Z=`${$}${Y.startsWith("/")?Y:`/${Y}`}`;return fetch(Z,{method:G.method,headers:Q,body:J?G.body:void 0,redirect:"manual",signal:G.signal,duplex:J?"half":void 0})}var Dy8=500,Oy8=1e4,RU6=25,SU6=200,Ly8=50,jy8;var CU6=D(()=>{IU6();jy8=["cookie","host","connection","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","accept-encoding","content-length"]});async function*bU6($){let X=$.now??(()=>Date.now()),Y=X(),G=$.schedulingTimeoutMs??Ay8,Q={pod:{},sandbox:{},events:{hasPulling:!1,hasPulled:!1},startedAt:Y},J=[],Z=null,W=!1,K=(P)=>{if(W)return;if(Z){let T=Z;Z=null,T(P)}else J.push(P)},F=()=>{if(J.length>0)return Promise.resolve(J.shift());if(W)return Promise.resolve(null);return new Promise((P)=>{Z=P})},U=()=>{if(W)return;if(W=!0,Z){let P=Z;Z=null,P(null)}},B=new AbortController,N=()=>{B.abort(),U()};if($.signal)if($.signal.aborted)B.abort(),U();else $.signal.addEventListener("abort",N,{once:!0});let w=Math.max(0,G-(X()-Y)),z=setTimeout(()=>K("tick"),w+100),O,L=new Promise((P)=>{O=P}),j=Promise.allSettled([Ty8($.kc,$.namespace,$.claimName,B.signal,Q,K,X,O),My8($.kc,$.namespace,$.claimName,B.signal,Q,K),Iy8($.kc,$.namespace,$.claimName,L,B.signal,Q,K,X)]);try{let P=null,T=-1,I=vU6(Q,G,X);if(P=U20(I),!F20(I))T=_U6(I);if(yield I,F20(I))return;while(!W){if(await F()===null)break;let R=vU6(Q,G,X);if(F20(R)){let _=U20(R);if(_!==P)P=_,yield R;return}let v=_U6(R);if(v<T)continue;let S=U20(R);if(S!==P)P=S,T=v,yield R}}finally{if(clearTimeout(z),B.abort(),$.signal)$.signal.removeEventListener("abort",N);U(),await j.catch(()=>{})}}function vU6($,X,Y){let{pod:G,sandbox:Q,events:J,startedAt:Z}=$;if(Q.ready)return{kind:"ready"};let W=G.containerWaitingReason;if(W==="ImagePullBackOff"||W==="ErrImagePull")return{kind:"failed",reason:"image-pull-backoff",message:"Sandbox image failed to download. The cluster may be missing pull credentials or the image tag may not exist."};if(W==="CrashLoopBackOff")return{kind:"failed",reason:"crash-loop-backoff",message:"Sandbox crashed during startup and is now in CrashLoopBackOff. Check pod logs."};if(!G.scheduled&&J.lastFailedSchedulingAt!==void 0&&Y()-Z>X)return{kind:"failed",reason:"scheduling-timeout",message:J.failedSchedulingMessage??`Pod could not be scheduled within ${Math.round(X/1000)}s.`};if(G.containerRunning&&!G.containerReady)return{kind:"warming-daemon",since:Z};if(J.hasPulling&&!J.hasPulled)return{kind:"pulling-image",since:Z};if(W==="ContainerCreating"||W==="PodInitializing"||G.scheduled&&!G.containerRunning)return{kind:"starting-container",since:Z};if(G.scheduledFalseReason==="Unschedulable"||J.lastFailedSchedulingAt!==void 0&&!G.scheduled)return{kind:"waiting-for-capacity",since:Z,message:J.failedSchedulingMessage??G.scheduledFalseMessage,nodeClaim:J.nominatedNodeClaim};return{kind:"claiming",since:Z}}function F20($){return $.kind==="ready"||$.kind==="failed"}function _U6($){switch($.kind){case"claiming":return 0;case"waiting-for-capacity":return 1;case"pulling-image":return 2;case"starting-container":return 3;case"warming-daemon":return 4;case"ready":case"failed":return 99}}function U20($){switch($.kind){case"claiming":case"pulling-image":case"starting-container":case"warming-daemon":return $.kind;case"waiting-for-capacity":return`waiting-for-capacity:${$.message??""}:${$.nodeClaim??""}`;case"ready":return"ready";case"failed":return`failed:${$.reason}:${$.message}`}}async function Ty8($,X,Y,G,Q,J,Z,W){let K=`/api/v1/namespaces/${encodeURIComponent(X)}/pods?watch=true&labelSelector=${encodeURIComponent(`${Py8}=${Y}`)}`;return B20({kc:$,path:K,signal:G,label:`pod/${Y}`,onEvent:(F)=>{if(F.type!=="ADDED"&&F.type!=="MODIFIED")return;let U=F.object;if(U.metadata?.name)W(U.metadata.name);Vy8(U,Q,Z),J("pod")}})}function Vy8($,X,Y){let Q=($.status?.conditions??[]).find((Z)=>Z.type==="PodScheduled");if(Q?.status==="True")X.pod.scheduled=!0,X.pod.scheduledFalseReason=void 0,X.pod.scheduledFalseMessage=void 0;else if(Q?.status==="False")X.pod.scheduled=!1,X.pod.scheduledFalseReason=Q.reason,X.pod.scheduledFalseMessage=Q.message;let J=($.status?.containerStatuses??[]).find((Z)=>Z.name===qy8);if(J)X.pod.containerWaitingReason=J.state?.waiting?.reason,X.pod.containerRunning=!!J.state?.running,X.pod.containerReady=J.ready===!0}async function My8($,X,Y,G,Q,J){let Z=`/apis/${a7.CLAIM_API_GROUP}/${a7.CLAIM_API_VERSION}/namespaces/${encodeURIComponent(X)}/${a7.CLAIM_PLURAL}?watch=true&fieldSelector=${encodeURIComponent(`metadata.name=${Y}`)}`;return B20({kc:$,path:Z,signal:G,label:`sandboxclaim/${Y}`,onEvent:(W)=>{if(W.type!=="ADDED"&&W.type!=="MODIFIED")return;let F=W.object.status?.conditions?.find((U)=>U.type==="Ready");if(!F)return;if(F.status==="True")Q.sandbox.ready=!0,Q.sandbox.notReadyReason=void 0,Q.sandbox.notReadyMessage=void 0;else Q.sandbox.ready=!1,Q.sandbox.notReadyReason=F.reason,Q.sandbox.notReadyMessage=F.message;J("sandbox")}})}async function Iy8($,X,Y,G,Q,J,Z,W){let K=await Promise.race([G,new Promise((U)=>{if(Q.aborted){U(Y);return}Q.addEventListener("abort",()=>U(Y),{once:!0})})]);if(Q.aborted)return;let F=`/api/v1/namespaces/${encodeURIComponent(X)}/events?watch=true&fieldSelector=${encodeURIComponent(`involvedObject.name=${K},involvedObject.kind=Pod`)}`;return B20({kc:$,path:F,signal:Q,label:`events/${Y}`,onEvent:(U)=>{if(U.type!=="ADDED"&&U.type!=="MODIFIED")return;let B=U.object,N=B.reason;if(!N)return;switch(N){case"Pulling":J.events.hasPulling=!0;break;case"Pulled":J.events.hasPulling=!0,J.events.hasPulled=!0;break;case"FailedScheduling":J.events.lastFailedSchedulingAt=W(),J.events.failedSchedulingMessage=B.message;break;case"Nominated":{let w=B.message?.match(/nodeclaim\/([\w-]+)/);if(w)J.events.nominatedNodeClaim=w[1];break}default:return}Z("event")}})}async function B20($){let{kc:X,path:Y,signal:G,label:Q,onEvent:J}=$,Z=0;while(!G.aborted){try{let K=await gh(X,{method:"GET",path:Y,signal:G,headers:{accept:"application/json"}});if(!K.ok||!K.body){try{await K.body?.cancel()}catch{}throw Error(`watch handshake failed: ${K.status} ${K.statusText}`)}Z=0;for await(let F of H20(K.body)){if(G.aborted)return;try{J(F)}catch(U){console.warn(`[lifecycle-watcher] ${Q} onEvent threw: ${U instanceof Error?U.message:String(U)}`)}}}catch(K){if(G.aborted)return;let F=K instanceof Error?K.message:String(K);console.warn(`[lifecycle-watcher] ${Q} watch ended: ${F}`)}if(G.aborted)return;let W=SF(5000,250,Z,2,0);Z+=1,await J7(W,{signal:G}).catch(()=>{})}}var Py8="studio.decocms.com/sandbox-handle",qy8="sandbox",Ay8=300000;var fU6=D(()=>{kF();D71();Sg1()});import{createHash as Ry8,randomBytes as Sy8,randomUUID as ky8}from"crypto";import*as hU6 from"net";import{PassThrough as Cy8}from"stream";class L20{kind=x3;records=new Map;inflight=new GT1;stateStore;previewUrlPattern;kubeConfig;portForward;namespace;sandboxTemplateName;envName;tokenGenerator;idleTtlMs;metrics;previewGateway;sentinelToken;closed=!1;constructor($={}){this.stateStore=$.stateStore??null,this.previewUrlPattern=$.previewUrlPattern??null,this.kubeConfig=$.kubeConfig??my8(),this.portForward=new uA0(this.kubeConfig),this.namespace=$.namespace??vy8,this.sandboxTemplateName=$.sandboxTemplateName??_y8,this.envName=ny8($.envName),this.tokenGenerator=$.tokenGenerator??(()=>Sy8(fy8).toString("hex")),this.idleTtlMs=$.idleTtlMs??xy8,this.metrics=$.meter?uy8($.meter):null,this.previewGateway=$.previewGateway&&$.previewUrlPattern?{...$.previewGateway}:null;let X=$.sentinelToken?.trim()??"";this.sentinelToken=X.length>0?X:null}async ensure($,X={}){let Y=DP($,X.branch??X.repo?.branch??null);return this.inflight.run(Y,()=>Zq0(this.stateStore,$,x3,(G)=>this.ensureLocked($,Y,X,G)))}async delete($){let X=await this.getRecord($);if(this.records.delete($),X)this.closeForwarder(X.daemonForward),this.metrics?.active.add(-1,D20(X.tenant));if(await this.deleteHttpRouteIfManaged($).catch((Y)=>{console.warn(`[${rQ}] HTTPRoute delete failed for ${$}: ${Y instanceof Error?Y.message:String(Y)}`)}),await SP(this.kubeConfig,this.namespace,$),this.stateStore)if(X)await this.stateStore.delete(X.id,x3);else await this.stateStore.deleteByHandle(x3,$)}async alive($){return await kP(this.kubeConfig,this.namespace,$)!==void 0}watchClaimLifecycle($,X){return bU6({kc:this.kubeConfig,namespace:this.namespace,claimName:$,signal:X})}async getPreviewUrl($){let X=await this.getRecord($);if(!X)return null;return this.composePreviewUrl(X)}async proxyDaemonRequest($,X,Y){let G=await this.getRecord($);if(!G&&this.previewUrlPattern&&this.stateStore){let W=await this.stateStore.getByHandle(x3,$),K=W?.state,F=K?.token;if(W&&F){let B=`http://${K?.adoptedSandboxName??$}.${this.namespace}.svc.cluster.local:${CP}`;return vg1(B,F,X,Y)}}if(!G)G=await this.resurrectByHandle($);if(!G)return new Response(JSON.stringify({error:"sandbox not found"}),{status:404,headers:{"content-type":"application/json"}});let Q=G,J=performance.now(),Z=0;try{let W=await vg1(G.daemonUrl,G.token,X,Y);if(W.status===401&&!(Y.body instanceof ReadableStream)){this.invalidateRecord($);let K=await this.getRecord($).catch(()=>null);if(K)Q=K,W=await vg1(K.daemonUrl,K.token,X,Y)}return Z=W.status,W}finally{this.recordProxyDuration("daemon",Z,Q,performance.now()-J)}}async resolvePreviewUpstreamUrl($){if(this.previewUrlPattern)return`http://${await this.resolveServiceNameForHandle($)}.${this.namespace}.svc.cluster.local:${CP}`;let X=await this.getRecord($);if(X)return X.daemonUrl;let Y=await this.resurrectByHandle($);return Y?Y.daemonUrl:null}async resolveServiceNameForHandle($){let X=this.records.get($);if(X)return X.adoptedSandboxName;if(this.stateStore){let G=(await this.stateStore.getByHandle(x3,$).catch(()=>null))?.state?.adoptedSandboxName;if(G)return G}return $}async proxyPreviewRequest($,X){let Y=performance.now(),G=this.records.get($)??null,Q=0;try{let J=await this.resolvePreviewUpstreamUrl($);if(!J){Q=404;let z=w20(404,{error:"sandbox not found"});return z.headers.set(hh,"1"),z}let Z=new URL(X.url);if((Z.pathname==="/_sandbox"||Z.pathname.startsWith("/_sandbox/")||Z.pathname==="/_decopilot_vm"||Z.pathname.startsWith("/_decopilot_vm/"))&&X.method!=="GET")return Q=404,w20(404,{error:"not found"});let K=(z)=>`${z}${Z.pathname}${Z.search}`,F=new Headers(X.headers);for(let z of gy8)F.delete(z);let U=X.method!=="GET"&&X.method!=="HEAD",B={method:X.method,headers:F,body:U?X.body:void 0,redirect:"manual",signal:X.signal,duplex:U?"half":void 0},N;try{N=await fetch(K(J),B)}catch(z){let O=`${J}${Z.pathname}`;if(console.warn(`[${rQ}] preview fetch to ${O} failed: ${z instanceof Error?z.message:String(z)}`),X.method==="GET"||X.method==="HEAD"){if(this.invalidateRecord($),await this.resurrectByHandle($).catch(()=>null)){let P=await this.resolvePreviewUpstreamUrl($);if(P)try{N=await fetch(K(P),B);let T=new Headers;for(let[I,V]of N.headers.entries())if(!yU6.includes(I.toLowerCase()))T.set(I,V);return Q=N.status,new Response(N.body,{status:N.status,statusText:N.statusText,headers:T})}catch(T){console.warn(`[${rQ}] preview fetch retry to ${O} failed: ${T instanceof Error?T.message:String(T)}`)}}}else this.invalidateRecord($);Q=502;let L=w20(502,{error:"sandbox daemon unreachable"});return L.headers.set(hh,"1"),L}let w=new Headers;for(let[z,O]of N.headers.entries())if(!yU6.includes(z.toLowerCase()))w.set(z,O);return Q=N.status,new Response(N.body,{status:N.status,statusText:N.statusText,headers:w})}finally{this.recordProxyDuration("preview",Q,G,performance.now()-Y,$)}}async ensureLocked($,X,Y,G){if(Y.image)console.warn(`[${rQ}] opts.image ignored (template ${this.sandboxTemplateName} pins image): got ${Y.image}`);if(G){let Z=await G.get($,x3);if(Z){let W=await this.rehydrate($,X,Z);if(W)return this.finish(W,G,!1,!0,"resume");await G.delete($,x3)}}let Q=await kP(this.kubeConfig,this.namespace,X).catch(()=>{return});if(Q)if(Q.metadata?.deletionTimestamp)await Vg1(this.kubeConfig,this.namespace,X).catch((Z)=>{console.warn(`[${rQ}] wait for terminating claim ${X} failed: ${Z instanceof Error?Z.message:String(Z)}`)});else{let Z=await this.adopt($,X,Q).catch((W)=>{return console.warn(`[${rQ}] adopt ${X} failed, recreating: ${W instanceof Error?W.message:String(W)}`),null});if(Z)return this.finish(Z,G,!0,!0,"adopt");await SP(this.kubeConfig,this.namespace,X).catch(()=>{}),await Vg1(this.kubeConfig,this.namespace,X).catch((W)=>{console.warn(`[${rQ}] wait for deleted claim ${X} failed: ${W instanceof Error?W.message:String(W)}`)})}let J=await this.provision($,X,Y);return this.finish(J,G,!0,!1,"fresh")}async finish($,X,Y,G,Q){let J=this.records.has($.handle);if(this.records.set($.handle,$),Y)await this.persist(X,$);if(G)await EU6(this.kubeConfig,this.namespace,$.handle,this.computeShutdownTime()).catch((Z)=>console.warn(`[${rQ}] TTL refresh failed for ${$.handle}: ${Z instanceof Error?Z.message:String(Z)}`));if(this.metrics){let Z=D20($.tenant);if(this.metrics.ensureOutcome.add(1,{...Z,outcome:Q}),!J)this.metrics.active.add(1,Z)}return this.toSandbox($)}buildEnvMap($,X){let Y={},G=[];for(let[Q,J]of Object.entries($.env??{}))if(yy8.has(Q))G.push(Q);else Y[Q]=J;if(G.length>0)console.warn(`[${rQ}] opts.env keys overlap reserved bootstrap names and were dropped: ${G.join(",")}`);return{...Y,DAEMON_TOKEN:X.token,DAEMON_BOOT_ID:X.daemonBootId,APP_ROOT:X.workdir,PROXY_PORT:String(CP)}}buildClaim($,X,Y){let G=this.sentinelToken!==null,Q=G?[]:Object.entries(this.buildEnvMap(X,Y)).sort(([J],[Z])=>J<Z?-1:J>Z?1:0).map(([J,Z])=>({name:J,value:Z}));return{apiVersion:`${a7.CLAIM_API_GROUP}/${a7.CLAIM_API_VERSION}`,kind:"SandboxClaim",metadata:{name:$,namespace:this.namespace,labels:{"app.kubernetes.io/name":"studio-sandbox","app.kubernetes.io/managed-by":"studio",...this.envName?{[ZU.env]:this.envName}:{},...z20(X.tenant)}},spec:{sandboxTemplateRef:{name:this.sandboxTemplateName},additionalPodMetadata:{labels:z20(X.tenant,{[ZU.role]:"claimed",[ZU.sandboxHandle]:$,...this.envName?{[ZU.env]:this.envName}:{}})},env:Q,warmpool:G?"default":"none",lifecycle:{shutdownPolicy:"Delete",shutdownTime:this.computeShutdownTime()}}}}async provision($,X,Y){let G=this.tokenGenerator(),Q=ky8(),J=N20,Z=this.buildClaim(X,Y,{token:G,daemonBootId:Q,workdir:J});try{await L71(this.kubeConfig,this.namespace,Z)}catch(N){if(N instanceof z71)await Vg1(this.kubeConfig,this.namespace,X),await L71(this.kubeConfig,this.namespace,Z);else throw N}let W;try{W=await jU6(this.kubeConfig,this.namespace,X),await Rg1(this.kubeConfig,this.namespace,W)}catch(N){throw await SP(this.kubeConfig,this.namespace,X).catch(()=>{}),N}try{await this.ensureServicePortForAdoptedSandbox(W),await this.ensureHttpRouteForHandle(X,W,Y.tenant??null)}catch(N){throw await SP(this.kubeConfig,this.namespace,X).catch(()=>{}),N}let K=await this.openForwarder(W,CP,X),F=`http://127.0.0.1:${K.localPort}`,U=this.workloadConfigPayload(Y),B=Q;try{if(await kU6(F),this.sentinelToken!==null){let N=await kg1(F);if(N)B=N.bootId;await Cg1(F,this.sentinelToken,U??{},{rotateToken:G})}else if(U)await Cg1(F,G,U)}catch(N){throw this.closeForwarder(K),await this.deleteHttpRouteIfManaged(X).catch(()=>{}),await SP(this.kubeConfig,this.namespace,X).catch(()=>{}),N}return{id:$,handle:X,adoptedSandboxName:W,token:G,workdir:J,daemonUrl:F,daemonForward:K,workload:Y.workload??null,daemonBootId:B,tenant:Y.tenant??null,ensureOpts:ty8(Y)}}workloadConfigPayload($){return Wq0({runtime:$?.workload?.runtime??"node",packageManager:$?.workload?.packageManager?{name:$.workload.packageManager,...$.workload.packageManagerPath?{path:$.workload.packageManagerPath}:{}}:null,repo:$?.repo??null,port:$?.workload?.devPort??by8})}async rebootstrapDaemon($,X,Y){if(this.sentinelToken===null)return!1;try{return await Cg1($,this.sentinelToken,this.workloadConfigPayload(Y)??{},{rotateToken:X}),!0}catch(G){return console.warn(`[${rQ}] re-bootstrap failed: ${G instanceof Error?G.message:String(G)}`),!1}}async ensureServicePortForAdoptedSandbox($){if(!this.previewGateway||!this.previewUrlPattern)return;await MU6(this.kubeConfig,this.namespace,$,{name:"daemon",port:CP,targetPort:CP})}async ensureHttpRouteForHandle($,X,Y){if(!this.previewGateway||!this.previewUrlPattern)return;let G=ay8(this.previewUrlPattern,$);if(!G)throw new mY(`Unable to derive preview hostname for ${$} from pattern: ${this.previewUrlPattern}`);let Q={apiVersion:`${E71.API_GROUP}/${E71.API_VERSION}`,kind:"HTTPRoute",metadata:{name:$,namespace:this.namespace,labels:z20(Y??void 0,{[ZU.role]:"claimed",[ZU.sandboxHandle]:$,"app.kubernetes.io/name":"studio-sandbox","app.kubernetes.io/managed-by":"studio",...this.envName?{[ZU.env]:this.envName}:{}})},spec:{parentRefs:[{kind:"Gateway",group:"gateway.networking.k8s.io",name:this.previewGateway.name,namespace:this.previewGateway.namespace}],hostnames:[G],rules:[{backendRefs:[{group:"",kind:"Service",name:X,port:CP}]}]}};await Mg1(this.kubeConfig,this.namespace,Q)}async deleteHttpRouteIfManaged($){if(!this.previewGateway)return;await Ig1(this.kubeConfig,this.namespace,$)}async rehydrate($,X,Y){let G=Y.state;if(!G.adoptedSandboxName&&!G.podName||!G.token)return null;let Q=await kP(this.kubeConfig,this.namespace,X).catch(()=>{return});if(!Q||!xU6(Q))return null;let J=Q.status?.sandbox?.name??G.adoptedSandboxName??G.podName??X,Z=await this.openAndProbeDaemon(J,X);if(!Z)return null;if(G.daemonBootId&&G.daemonBootId!==Z.bootId){if(this.sentinelToken!==null){if(!await this.rebootstrapDaemon(Z.daemonUrl,G.token,G.ensureOpts??null))return this.closeForwarder(Z.daemonForward),null}else console.warn(`[${rQ}] daemon restart detected (handle=${X}): stored bootId=${G.daemonBootId} live bootId=${Z.bootId}`);await this.stateStore?.put($,x3,{handle:X,state:{...G,daemonBootId:Z.bootId}}).catch((W)=>console.warn(`[${rQ}] bootId persist failed for ${X}: ${W instanceof Error?W.message:String(W)}`))}return{id:$,handle:X,adoptedSandboxName:J,token:G.token,workdir:G.workdir??N20,daemonUrl:Z.daemonUrl,daemonForward:Z.daemonForward,workload:G.workload??null,daemonBootId:Z.bootId,tenant:G.tenant??null,ensureOpts:G.ensureOpts??null}}async adopt($,X,Y){if(!xU6(Y))return null;let G=Y.status?.sandbox?.name??X;if(this.sentinelToken!==null)return null;let Q=ly8(Y);if(!Q)return null;let J=await this.openAndProbeDaemon(G,X);if(!J)return null;let Z=ry8(Y);if(this.previewGateway)await this.ensureServicePortForAdoptedSandbox(G).catch((W)=>{console.warn(`[${rQ}] Service port backfill failed for ${X}: ${W instanceof Error?W.message:String(W)}`)}),await this.ensureHttpRouteForHandle(X,G,Z).catch((W)=>{console.warn(`[${rQ}] HTTPRoute backfill failed for ${X}: ${W instanceof Error?W.message:String(W)}`)});return{id:$,handle:X,adoptedSandboxName:G,token:Q,workdir:N20,daemonUrl:J.daemonUrl,daemonForward:J.daemonForward,workload:null,daemonBootId:J.bootId,tenant:Z,ensureOpts:null}}async openAndProbeDaemon($,X){let Y=await this.openForwarder($,CP,X).catch(()=>null);if(!Y)return null;let G=`http://127.0.0.1:${Y.localPort}`,Q=await kg1(G);if(!Q)return this.closeForwarder(Y),null;return{daemonForward:Y,daemonUrl:G,bootId:Q.bootId}}async getRecord($){let X=this.records.get($);if(X)return X;if(!this.stateStore)return null;let Y=await this.stateStore.getByHandle(x3,$);if(!Y)return null;let G=await this.rehydrate(Y.id,$,Y);if(G)this.records.set($,G);return G}async resurrectByHandle($){if(!this.stateStore)return null;let X=await this.stateStore.getByHandle(x3,$);if(!X)return null;let Y=X.state.ensureOpts;if(!Y)return null;return await this.ensure(X.id,Y),this.records.get($)??null}invalidateRecord($){let X=this.records.get($);if(!X)return;this.records.delete($),this.closeForwarder(X.daemonForward)}recordProxyDuration($,X,Y,G,Q){if(!this.metrics)return;this.metrics.proxyDurationMs.record(G,{...D20(Y?.tenant??null),source:$,sandbox_handle:Y?.handle??Q??"",status_code:X||0})}composePreviewUrl($){if(this.previewUrlPattern)return QT1(this.previewUrlPattern,$.handle);return`http://127.0.0.1:${$.daemonForward.localPort}/`}toSandbox($){return{handle:$.handle,workdir:$.workdir,previewUrl:this.composePreviewUrl($)}}async persist($,X){if(!$)return;let Y={adoptedSandboxName:X.adoptedSandboxName,token:X.token,workdir:X.workdir,workload:X.workload,daemonBootId:X.daemonBootId,tenant:X.tenant,...X.ensureOpts?{ensureOpts:X.ensureOpts}:{}};await $.put(X.id,x3,{handle:X.handle,state:Y})}computeShutdownTime(){return new Date(Date.now()+this.idleTtlMs).toISOString()}openForwarder($,X,Y=$){let G=cy8(Y,X);return new Promise((Q,J)=>{let Z=(W,K)=>{let F=hU6.createServer((U)=>this.handleForwardedConnection(U,$,X,Y));F.once("error",(U)=>{if(U.code==="EADDRINUSE"&&K<hy8){try{F.close()}catch{}let B=O20+(W-O20+1)%uU6;Z(B,K+1);return}J(U)}),F.listen(W,"127.0.0.1",()=>{let U=F.address();if(!U||typeof U==="string"){F.close(),J(Error("port-forward listener failed to bind"));return}Q({server:F,localPort:U.port})})};Z(G,0)})}handleForwardedConnection($,X,Y,G){let Q=new Cy8,J=null,Z=!1,W=()=>{if(Z)return;if(Z=!0,Q.destroy(),J)try{J.close()}catch{}if(!$.destroyed)$.destroy()};$.pipe(Q),$.on("error",W),$.on("close",W),this.portForward.portForward(this.namespace,X,[Y],$,null,Q).then((K)=>{let F=typeof K==="function"?K():K;if(!F){W();return}if(J=F,J.on("close",W),J.on("error",()=>{this.invalidateRecord(G),W()}),Z)try{J.close()}catch{}}).catch((K)=>{console.warn(`[${rQ}] port-forward to ${X}:${Y} failed: ${K instanceof Error?K.message:String(K)}`),this.invalidateRecord(G),W()})}closeForwarder($){$.server.close((X)=>{if(X)console.warn(`[${rQ}] port-forward close on :${$.localPort} errored: ${X instanceof Error?X.message:String(X)}`)})}close(){if(this.closed)return;this.closed=!0;for(let $ of this.records.values())this.closeForwarder($.daemonForward);this.records.clear()}}function uy8($){return{active:$.createUpDownCounter("studio.sandbox.active",{description:"Active sandbox count, by runner kind and owning org. Cross-checks the cAdvisor-derived count from the cluster \u2014 divergence between the two indicates orphaned claims (mesh deleted but K8s didn't reap) or unattributed pods.",unit:"{sandbox}"}),ensureOutcome:$.createCounter("studio.sandbox.ensure.outcome",{description:"Outcome of each ensure() call: fresh provision, resume from state-store after restart, or adopt of a cluster-side claim mesh didn't know about. Cold-start ratio is the primary input for warm-pool sizing.",unit:"{call}"}),proxyDurationMs:$.createHistogram("studio.sandbox.proxy.duration_ms",{description:"Wall-clock latency of mesh-mediated requests to the sandbox daemon: tool exec proxies (source=daemon) and preview iframe traffic (source=preview).",unit:"ms"})}}function my8(){let $=new Nt;return $.loadFromDefault(),$}function xU6($){return Boolean($.status?.conditions?.some((X)=>X.type==="Ready"&&X.status==="True"))}function ly8($){let X=$.spec?.env;if(!X)return null;for(let Y of X)if(Y.name==="DAEMON_TOKEN"&&Y.value)return Y.value;return null}function cy8($,X){let Y=Ry8("sha256").update(`${$}:${X}`).digest();return O20+Y.readUInt32BE(0)%uU6}function w20($,X){return new Response(JSON.stringify(X),{status:$,headers:{"content-type":"application/json","access-control-allow-origin":"*"}})}function gU6($){let X=$.slice(0,iy8);return dy8.test(X)?X:""}function ny8($){if($===void 0)return null;let X=$.trim();if(X==="")return null;if(!py8.test(X))throw Error(`AgentSandboxProvider: envName=${JSON.stringify(X)} is not a valid DNS-label-safe environment name (lowercase alphanumeric or '-', starts with a letter, ends alphanumeric, \u226432 chars). Mesh sets this from STUDIO_ENV; check the studio chart's configMap.`);return X}function z20($,X={}){let Y={...X};if($){let G=gU6($.orgId),Q=gU6($.userId);if(G)Y[ZU.orgId]=G;if(Q)Y[ZU.userId]=Q}return Y}function ry8($){let X=$.metadata?.labels;if(!X)return null;let Y=X[ZU.orgId],G=X[ZU.userId];if(!Y||!G)return null;return{orgId:Y,userId:G}}function D20($){return{org_id:$?.orgId??"",user_id:$?.userId??"",runner_kind:x3}}function ty8($){let X={};if($.repo)X.repo=$.repo;if($.workload)X.workload=$.workload;if($.env&&Object.keys($.env).length>0)X.env=$.env;if($.tenant)X.tenant=$.tenant;return Object.keys(X).length>0?X:null}function ay8($,X){try{return new URL(QT1($,X)).hostname||null}catch{return null}}var x3="cluster",rQ="AgentSandboxProvider",hh="x-sandbox-preview-not-ready",vy8="agent-sandbox-system",_y8="studio-sandbox",CP=9000,by8=3000,N20="/app",fy8=32,yy8,xy8=900000,gy8,yU6,O20=40000,uU6=1e4,hy8=256,ZU,dy8,iy8=63,py8;var mU6=D(()=>{Y20();CU6();JT1();Sg1();D71();fU6();yy8=new Set(["DAEMON_TOKEN","DAEMON_BOOT_ID","APP_ROOT","PROXY_PORT"]),gy8=["cookie","host","connection","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","accept-encoding","content-length","upgrade"],yU6=["connection","keep-alive","transfer-encoding","content-encoding","content-length"];ZU={role:"studio.decocms.com/role",sandboxHandle:"studio.decocms.com/sandbox-handle",orgId:"studio.decocms.com/org-id",userId:"studio.decocms.com/user-id",env:"studio.decocms.com/env"},dy8=/^([A-Za-z0-9]([-A-Za-z0-9_.]*[A-Za-z0-9])?)?$/;py8=/^[a-z]([a-z0-9-]{0,30}[a-z0-9])?$/});var lU6={};g6(lU6,{waitForSandboxReady:()=>Rg1,getSandboxClaim:()=>kP,getHttpRoute:()=>VU6,deleteSandboxClaim:()=>SP,deleteHttpRoute:()=>Ig1,createSandboxClaim:()=>L71,createHttpRoute:()=>Mg1,SandboxTimeoutError:()=>xh,SandboxError:()=>mY,PREVIEW_NOT_READY_HEADER:()=>hh,KubeConfig:()=>Nt,K8S_CONSTANTS:()=>a7,HTTPROUTE_CONSTANTS:()=>E71,AgentSandboxProvider:()=>L20});var E20=D(()=>{Y20();D71();Sg1();mU6()});class _g1{kind=vP;userSub;dispatch;stateStore;records=new Map;constructor($){if(!$.userSub)throw Error("DesktopSandboxProvider requires userSub");if(!$.dispatch)throw Error("DesktopSandboxProvider requires dispatch");this.userSub=$.userSub,this.dispatch=$.dispatch,this.stateStore=$.stateStore??null}async ensure($,X={}){let Y=X.branch??X.repo?.branch,G=DP($,Y),Q=this.records.get(G);if(Q){if(await this.probeHealth(G))return this.toSandbox(Q);if(this.records.delete(G),this.stateStore)await this.stateStore.deleteByHandle(vP,G).catch(()=>{})}else if(this.stateStore){let B=(await this.stateStore.getByHandle(vP,G))?.state,N=B?.sandboxApiUrl;if(N){if(await this.probeHealth(G)){let w={handle:G,sandboxApiUrl:N,previewUrl:B?.previewUrl??N};return this.records.set(G,w),this.toSandbox(w)}await this.stateStore.deleteByHandle(vP,G).catch(()=>{})}}let J=JSON.stringify({handle:G,repo:X.repo,branch:Y,...X.workload?{workload:X.workload}:{},...X.offloadAllowedHosts?{offloadAllowedHosts:X.offloadAllowedHosts}:{},...X.offloadAllowSameHostDev!==void 0?{offloadAllowSameHostDev:X.offloadAllowSameHostDev}:{}}),Z=await this.dispatchJson("POST","/api/sandboxes",J),W=JSON.parse(Z);if(typeof W.sandboxApiUrl!=="string")throw Error("desktop ensure: daemon did not return a sandboxApiUrl string");let K=typeof W.previewUrl==="string"?W.previewUrl:W.sandboxApiUrl,F={handle:G,sandboxApiUrl:W.sandboxApiUrl,previewUrl:K};if(this.records.set(G,F),this.stateStore)await this.stateStore.put($,vP,{handle:G,state:{handle:G,sandboxApiUrl:W.sandboxApiUrl,previewUrl:K}});return this.toSandbox(F)}async proxyDaemonRequest($,X,Y){let G=X.startsWith("/")?X:`/${X}`,Q=G.startsWith("/_sandbox/")?G.slice(9):G,J=`/_sandbox/${encodeURIComponent($)}${Q}`,Z=new Headers(Y.headers);for(let j of["host","cookie","connection","keep-alive","transfer-encoding","upgrade","authorization"])Z.delete(j);let W={};Z.forEach((j,P)=>{W[P]=j});let K;if(Y.body!=null)K=await oy8(Y.body);let U=this.dispatch(this.userSub,{method:Y.method,path:J,headers:W,body:K},{signal:Y.signal})[Symbol.asyncIterator](),B=200,N={"content-type":"application/octet-stream"},w=[];try{while(!0){let j=await U.next();if(j.done)break;let P=j.value;if(P.headers){B=P.headers.status,N=P.headers.headers;break}if(P.data!=null)w.push(P.data)}}catch(j){let P=j instanceof Error?j.message:"dispatch error";return new Response(JSON.stringify({error:P}),{status:502,headers:{"content-type":"application/json"}})}let z=!1,O=new TextEncoder,L=new ReadableStream({async start(j){for(let P of w)j.enqueue(O.encode(P))},async pull(j){try{let P=await U.next();if(z)return;if(P.done){j.close();return}let T=P.value;if(T.data!=null)j.enqueue(O.encode(T.data))}catch(P){if(!z)j.error(P)}},cancel(){z=!0,U.return?.()}});return new Response(L,{status:B,headers:N})}async alive($){return this.probeHealth($)}async probeHealth($){let X=new AbortController,Y=setTimeout(()=>X.abort(),1500);try{return await this.dispatchJson("GET",`/api/sandboxes/${encodeURIComponent($)}`,void 0,X.signal),!0}catch{return!1}finally{clearTimeout(Y)}}async forgetHandle($){if(this.records.delete($),this.stateStore)await this.stateStore.deleteByHandle(vP,$).catch(()=>{})}async delete($){if(this.records.delete($),this.stateStore)await this.stateStore.deleteByHandle(vP,$).catch(()=>{});try{await this.dispatchJson("DELETE",`/api/sandboxes/${encodeURIComponent($)}`)}catch(X){if(!(X instanceof Error?X.message:String(X)).includes("404"))throw X}}async getPreviewUrl($){return(await this.resolveRecord($))?.previewUrl??null}async localWorkdir($){return null}async*watchClaimLifecycle($,X){yield{kind:"ready"}}toSandbox($){return{handle:$.handle,workdir:$.sandboxApiUrl,previewUrl:$.previewUrl}}async resolveRecord($){let X=this.records.get($);if(X)return X;if(!this.stateStore)return null;let G=(await this.stateStore.getByHandle(vP,$))?.state,Q=G?.sandboxApiUrl;if(!Q)return null;let J={handle:$,sandboxApiUrl:Q,previewUrl:G?.previewUrl??Q};return this.records.set($,J),J}async dispatchJson($,X,Y,G){let Q={accept:"application/json"};if(Y!==void 0)Q["content-type"]="application/json";let J=this.dispatch(this.userSub,{method:$,path:X,headers:Q,body:Y},{signal:G}),Z=null,W="";for await(let K of J)if(K.headers)Z=K.headers.status;else if(K.data!=null)W+=K.data;if(Z!=null&&(Z<200||Z>=300))throw Error(`daemon returned ${Z}: ${W}`);return W}}function cU6($){return new _g1($)}async function oy8($){if(typeof $==="string")return $;if($ instanceof ArrayBuffer)return Buffer.from($).toString("utf8");if(ArrayBuffer.isView($))return Buffer.from($.buffer,$.byteOffset,$.byteLength).toString("utf8");if($ instanceof URLSearchParams)return $.toString();return await new Response($).text()}var vP="user-desktop";var dU6=D(()=>{JT1()});var iU6={};g6(iU6,{createDesktopProvider:()=>cU6,DesktopSandboxProvider:()=>_g1});var pU6=D(()=>{dU6()});var sU6={};g6(sU6,{subscribeLifecycle:()=>P71,getSandboxProviderByKind:()=>j71,getOrInitSharedRunner:()=>Jx8,buildDesktopProvider:()=>Lt,__resetSharedLifecyclesForTesting:()=>Fx8});function aU6($,X){let Y=nU6[$];if(Y)return Promise.resolve(Y);let G=j20[$];if(G)return G;let Q=X().then((J)=>{return nU6[$]=J,J}).finally(()=>{delete j20[$]});return j20[$]=Q,Q}function $x8(){let $=process.env.STUDIO_SANDBOX_PREVIEW_URL_PATTERN;return $&&$.trim()!==""?$:void 0}function Xx8(){let $=process.env.STUDIO_SANDBOX_TEMPLATE_NAME;return $&&$.trim()!==""?$:void 0}function Yx8(){let $=process.env.STUDIO_ENV;return $&&$.trim()!==""?$:void 0}function Gx8(){let $=process.env.STUDIO_SANDBOX_SENTINEL_TOKEN;return $&&$.trim()!==""?$:void 0}function Qx8(){let $=process.env.STUDIO_SANDBOX_PREVIEW_GATEWAY_NAME?.trim(),X=process.env.STUDIO_SANDBOX_PREVIEW_GATEWAY_NAMESPACE?.trim();if(!$&&!X)return;if(!$||!X)throw Error("STUDIO_SANDBOX_PREVIEW_GATEWAY_NAME and STUDIO_SANDBOX_PREVIEW_GATEWAY_NAMESPACE must both be set, or both unset. Half-configured per-claim HTTPRoute routing would silently fail to attach.");return{name:$,namespace:X}}async function oU6($,X){let Y=new LP(X),G=$x8();switch($){case"cluster":{let{AgentSandboxProvider:Q}=await Promise.resolve().then(() => (E20(),lU6));return new Q({stateStore:Y,previewUrlPattern:G,sandboxTemplateName:Xx8(),envName:Yx8(),previewGateway:Qx8(),sentinelToken:Gx8(),meter:CW})}case"user-desktop":throw Error("user-desktop runner cannot be instantiated without a per-run link claim \u2014 call resolveSandboxProvider, which binds the link before constructing the provider.");default:throw Error(`Unknown runner kind: ${String($)}`)}}async function Lt($,X){let{DesktopSandboxProvider:Y}=await Promise.resolve().then(() => (pU6(),iU6)),{getDispatch:G}=await Promise.resolve().then(() => (q20(),P20)),Q=new LP($.db);if(!X)throw Error("buildDesktopProvider: userSub must be a non-empty string");return new Y({userSub:X,dispatch:G(),stateStore:Q})}function j71($,X){return aU6(X,()=>oU6(X,$.db))}async function Jx8(){let $;try{$=DN()}catch(Y){return console.warn("[lifecycle] cannot resolve sandbox runner:",Y instanceof Error?Y.message:String(Y)),null}return await aU6($,()=>oU6($,q5().db))}function P71($,X,Y){let G=_P.get(X);if(G){if(G.terminated){if(G.lastPhase)try{Y(G.lastPhase)}catch{}return{unsubscribe:Kx8}}if(G.listeners.add(Y),G.lastPhase)try{Y(G.lastPhase)}catch{}return rU6(X,G,Y)}let Q=new AbortController,J={lastPhase:null,terminated:!1,listeners:new Set([Y]),abort:Q};return _P.set(X,J),Hx8($,X,J),rU6(X,J,Y)}function Kx8(){}function rU6($,X,Y){return{unsubscribe(){if(_P.get($)!==X)return;if(X.listeners.delete(Y),X.listeners.size===0)_P.delete($),X.abort.abort()}}}async function Hx8($,X,Y){let G=null;try{for await(let Q of $.watchClaimLifecycle(X,Y.abort.signal)){if(Y.abort.signal.aborted)break;Y.lastPhase=Q;let J=Q.kind==="ready"||Q.kind==="failed";if(J)Y.terminated=!0;let Z=Array.from(Y.listeners);for(let W of Z)try{W(Q)}catch{}if(J)break}}catch(Q){G=Q}finally{if(!Y.terminated&&!Y.abort.signal.aborted&&Y.listeners.size>0){let Q={kind:"failed",reason:"unknown",message:G instanceof Error?G.message:"Lifecycle watcher ended unexpectedly"};Y.lastPhase=Q,Y.terminated=!0;for(let J of Array.from(Y.listeners))try{J(Q)}catch{}}if(_P.get(X)===Y)_P.delete(X)}}function Fx8(){for(let $ of _P.values())$.abort.abort();_P.clear()}var sy8,ey8,tU6,nU6,j20,Zx8,Wx8,_P;var uh=D(()=>{RD();CB();ZZ();HT1();sy8=Symbol.for("decocms.sandbox.lifecycle.runners"),ey8=Symbol.for("decocms.sandbox.lifecycle.inflight"),tU6=globalThis,nU6=tU6[sy8]??={},j20=tU6[ey8]??={};Zx8=Symbol.for("decocms.sandbox.lifecycle.shared-lifecycles"),Wx8=globalThis,_P=Wx8[Zx8]??=new Map});async function bg1($,X){if(await X.linkClaimRegistry.get($))return"user-desktop";return X.resolveEnvKind()}async function yD($,X){let{userId:Y,branch:G,virtualMcpMetadata:Q,explicitKind:J}=X;if(J)return{provider:await fg1($,Y,J),kind:J};if($.sandboxPreference==="user-desktop"&&$.linkForCurrentRun)return{provider:await Lt($,Y),kind:"user-desktop"};if($.sandboxPreference==="cluster-default"){let U=DN();return{provider:await fg1($,Y,U),kind:U}}let[Z,...W]=Ux8(Q,Y,G);if(Z){let U=W.length===0?Z:await Bx8($,Y,Z,W);return{provider:await fg1($,Y,U),kind:U}}let K=await eU6($,Y);return{provider:await fg1($,Y,K),kind:K}}function Ux8($,X,Y){let G=ZH($)[X]?.[Y];if(!G)return[];let Q=kw(G);return Object.keys(Q)}async function Bx8($,X,Y,G){let Q=await eU6($,X);if(Q===Y||G.includes(Q))return Q;return Y}async function eU6($,X){if(!$.linkClaimRegistry)return DN();return bg1(X,{linkClaimRegistry:$.linkClaimRegistry,resolveEnvKind:DN})}async function fg1($,X,Y){if(Y!=="user-desktop")return j71($,Y);if(!$.linkClaimRegistry)throw Error("user-desktop sandbox provider requires ctx.linkClaimRegistry to be wired (set on MeshContextConfig).");if(!await $.linkClaimRegistry.get(X))throw Error(`No link daemon registered for user "${X}". Start one with \`deco link\` (or run \`bun run dev --local-sandbox-provider\` for dev).`);return Lt($,X)}var q71=D(()=>{b$();RD();SD();uh()});async function $B6($,X){if(!$)return{hosts:[],allowSameHostDev:!1};let Y;try{Y=await $.presignedGetUrl("link-dispatch/_allowlist_probe",60,{requireFetchable:!0})}catch{return{hosts:[],allowSameHostDev:!1}}let G;try{G=new URL(Y)}catch{return{hosts:[],allowSameHostDev:!1}}if(G.protocol!=="https:"&&G.protocol!=="http:")return{hosts:[],allowSameHostDev:!1};let Q=G.hostname,J=Nx8.has(Q);return{hosts:[Q],allowSameHostDev:J&&!X.isProduction}}var Nx8;var XB6=D(()=>{Nx8=new Set(["127.0.0.1","localhost","::1","[::1]","0.0.0.0"])});async function yg1($,X){G0(X);let Y=r1(X),G=K6(X);if(!G)throw Error("User ID required");let Q=await X.storage.virtualMcps.findById($.virtualMcpId);if(!Q||Q.organization_id!==Y.id)throw Error("Virtual MCP not found");let J=Q.metadata??{},Z=OP(ZH(J),G,$.branch,$.sandboxProviderKind),W=$.sandboxProviderKind,{provider:K}=await yD(X,{userId:G,branch:$.branch,virtualMcpMetadata:J,explicitKind:W});if(Z){if(W!=="user-desktop")return Z;if(await K.alive(Z.sandboxHandle).catch(()=>!1))return Z;await Yt(X.storage.virtualMcps,$.virtualMcpId,G,G,$.branch,W).catch((N)=>{console.warn("[ensureSandbox] failed to reap stale user-desktop entry",N)})}let F=J.githubRepo??null,{entry:U}=await YB6({ctx:X,userId:G,orgId:Y.id,virtualMcpId:$.virtualMcpId,branch:$.branch,metadata:J,githubRepo:F,existing:null,providerKind:W,runner:K});return U}async function YB6($){let{ctx:X,userId:Y,orgId:G,virtualMcpId:Q,branch:J,metadata:Z,githubRepo:W,existing:K,runner:F}=$,{runtime:U,packageManager:B,port:N,packageManagerPath:w}=vJ6(Z),z;if(W){let{cloneUrl:f,gitUserName:l,gitUserEmail:c}=W.connectionId?await bJ6(W.connectionId,W.owner,W.name,X.db,X.vault):_J6(W.owner,W.name);if(!B){let b=W.connectionId?await gJ6(W.connectionId,W.owner,W.name,X.db,X.vault):await hJ6(W.owner,W.name);if(b)B=b.packageManager,U=aY1[b.packageManager].runtime,N=b.devPort??N,await wx8(X,Q,Y,b.packageManager,b.devPort)}z={cloneUrl:f,userName:l,userEmail:c,branch:J,displayName:`${W.owner}/${W.name}`}}let O=U&&B?{runtime:U,packageManager:B,...N!==null?{devPort:Number(N)}:{},...w?{packageManagerPath:w}:{}}:void 0,L=HM({orgId:G,virtualMcpId:Q,branch:J}),j=F.kind==="user-desktop"?await $B6(X.objectStorage,{isProduction:_4().nodeEnv==="production"}):null,P=await F.ensure({userId:Y,projectRef:L},{branch:J,repo:z,workload:O,tenant:{orgId:G,userId:Y},...j?{offloadAllowedHosts:j.hosts,offloadAllowSameHostDev:j.allowSameHostDev}:{}}),T=Z.runtime?.env??null;await KT1({ctx:X,runner:F,handle:P.handle,orgId:G,userId:Y,entries:T});let V=!!K&&K.sandboxHandle===P.handle&&K?.createdAt?K.createdAt:Date.now(),R=Z.runtime?.selected??null,v=Z.runtime?.port??null,S=Z.runtime?.path??null,_={sandboxHandle:P.handle,previewUrl:P.previewUrl,sandboxApiUrl:P.previewUrl,sandboxProviderKind:F.kind,createdAt:V,startedWith:{packageManager:R,port:v,path:S}};await kJ6(X.storage.virtualMcps,Q,Y,Y,J,$.providerKind,_);let y=!K||K.sandboxHandle!==P.handle;return{entry:_,isNewVm:y}}async function wx8($,X,Y,G,Q){let J=await $.storage.virtualMcps.findById(X);if(!J)return;let Z=J.metadata??{};await $.storage.virtualMcps.update(X,Y,{metadata:{...Z,runtime:{selected:G,port:Q}}})}var A20;var xg1=D(()=>{l1();RD();k0();WT1();Hq0();SD();fJ6();mJ6();SE0();Kq0();q71();XB6();F5();SD();A20=f1({name:"SANDBOX_START",description:"Start a sandbox with the connected GitHub repo and dev server.",annotations:{title:"Start VM Preview",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!1,openWorldHint:!0},_meta:{ui:{visibility:"app"}},inputSchema:H.object({virtualMcpId:H.string().describe("Virtual MCP ID"),branch:H.string().min(1).optional().describe("Optional git branch to check out. When omitted the handler generates `deco/<adjective>-<noun>` and uses it. The resolved branch is returned in the response so callers can persist it."),sandboxProviderKind:H.enum(["cluster","user-desktop"]).optional().describe("Explicit runtime choice. When omitted, defaults to `user-desktop` if the acting user's link daemon is online, else the cluster env kind.")}),outputSchema:H.object({previewUrl:H.string().nullable(),sandboxHandle:H.string(),branch:H.string(),isNewVm:H.boolean(),sandboxProviderKind:H.enum(["cluster","user-desktop"])}),handler:async($,X)=>{G0(X);let Y=$.branch??$21(),G=K6(X);if(!G)throw Error("User ID required");let{provider:Q,kind:J}=await yD(X,{userId:G,branch:Y,virtualMcpMetadata:null,explicitKind:$.sandboxProviderKind}),{metadata:Z,userId:W,organization:K,entry:F}=await ZT1({virtualMcpId:$.virtualMcpId,branch:Y,sandboxProviderKind:J},X),U=Z.githubRepo??null,{entry:B,isNewVm:N}=await YB6({ctx:X,userId:W,orgId:K.id,virtualMcpId:$.virtualMcpId,branch:Y,metadata:Z,githubRepo:U,existing:F,providerKind:J,runner:Q});return{...B,branch:Y,isNewVm:N,sandboxProviderKind:J}}})});var T20;var GB6=D(()=>{l1();k0();WT1();uh();SD();T20=f1({name:"SANDBOX_DELETE",description:"Delete a sandbox.",annotations:{title:"Delete VM Preview",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!0},_meta:{ui:{visibility:"app"}},inputSchema:H.object({virtualMcpId:H.string().describe("Virtual MCP ID that owns this VM"),branch:H.string().min(1).describe("Branch whose vm should be deleted (sandboxMap[userId][branch])"),sandboxProviderKind:H.enum(["cluster","user-desktop"]).describe("Kind of sandbox provider the VM was started with. Used to locate the correct 3-level sandboxMap entry.")}),outputSchema:H.object({success:H.boolean()}),handler:async($,X)=>{let Y=$.sandboxProviderKind,G;try{G=await ZT1($,X)}catch(W){if(W instanceof Error&&W.message==="Virtual MCP not found")return{success:!0};throw W}let{entry:Q,userId:J}=G;if(!Q)return{success:!0};return await Yt(X.storage.virtualMcps,$.virtualMcpId,J,J,$.branch,Y),await(await j71(X,Y)).delete(Q.sandboxHandle).catch((W)=>console.error(`[SANDBOX_DELETE] ${Y} ${Q.sandboxHandle}: ${W instanceof Error?W.message:String(W)}`)),{success:!0}}})});var QB6=D(()=>{xg1();GB6()});var Dx8="https://api.github.com",V20;var JB6=D(()=>{l1();k0();PP1();YP();V20=f1({name:"GITHUB_LIST_USER_ORGS",description:"List GitHub App installations (orgs/accounts) accessible to the authenticated user.",annotations:{title:"List GitHub User Orgs",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!0},_meta:{ui:{visibility:"app"}},inputSchema:H.object({connectionId:H.string().describe("ID of the mcp-github connection to use")}),outputSchema:H.object({installations:H.array(H.object({installationId:H.number(),login:H.string(),avatarUrl:H.string(),type:H.string()})),appSlug:H.string().optional()}),handler:async($,X)=>{await X.access.check();let Y=new dG(X.db,X.vault),G=await Y.get($.connectionId);if(!G)throw Error("No GitHub token found. Ensure the mcp-github connection is authenticated.");let Q=G.accessToken;if(I91(G)&&Y.isExpired(G,jP1)){let U=await R91(G,Y);if(!U)throw Error($V);Q=U,G=await Y.get($.connectionId)??G}let J=[],Z,W=1,K=100,F=async(U)=>fetch(`${Dx8}/user/installations?per_page=${K}&page=${W}`,{headers:{Authorization:`Bearer ${U}`,Accept:"application/vnd.github+json","X-GitHub-Api-Version":"2022-11-28"}});while(!0){let U=await F(Q);if(U.status===401){let N=await Y.get($.connectionId);if(!N||!I91(N))throw Error($V);let w=await R91(N,Y);if(!w)throw Error($V);if(Q=w,U=await F(Q),U.status===401)throw Error($V)}if(!U.ok)throw Error(`GitHub /user/installations failed: ${U.status}`);let B=await U.json();for(let N of B.installations){if(!Z)Z=N.app_slug??N.app?.slug;J.push({installationId:N.id,login:N.account.login,avatarUrl:N.account.avatar_url,type:N.account.type})}if(B.installations.length<K)break;W++}return{installations:J,...Z?{appSlug:Z}:{}}}})});var ZB6=D(()=>{JB6()});var M20,WB6,KB6,Lx8,Ex8,ypY;var I20=D(()=>{l1();M20=H.enum(["claude-code","codex","decopilot-sandbox","body-offload"]),WB6=H.array(H.string()).catch([]).transform(($)=>$.filter((X)=>M20.safeParse(X).success)),KB6=H.discriminatedUnion("type",[H.object({type:H.literal("ui-message-chunk"),chunk:H.unknown()}),H.object({type:H.literal("error"),code:H.string(),message:H.string()}),H.object({type:H.literal("done")})]),Lx8=H.record(H.string(),H.unknown()),Ex8=H.object({credentialId:H.string(),thinking:H.object({id:H.string(),title:H.string(),provider:H.string().optional()}),coding:H.object({id:H.string(),title:H.string()}).optional(),fast:H.object({id:H.string(),title:H.string()}).optional(),image:H.object({id:H.string(),title:H.string()}).optional(),deepResearch:H.object({id:H.string(),title:H.string()}).optional()}),ypY=H.object({threadId:H.string(),runId:H.string(),taskId:H.string(),resumeSessionRef:H.string().optional(),messages:H.array(Lx8),models:Ex8,mcp:H.object({url:H.string().url(),headers:H.record(H.string(),H.string()),expiresAt:H.number().int().positive()}),mode:H.string(),temperature:H.number(),toolApprovalLevel:H.string(),user:H.object({id:H.string(),email:H.string()}),organizationId:H.string(),organizationSlug:H.string().optional(),virtualMcp:H.record(H.string(),H.unknown()),agent:H.object({id:H.string()}),branch:H.string().nullable().optional(),triggerId:H.string().optional(),currentThreadTitle:H.string().optional(),traceparent:H.string().optional()}).strip()});var HB6=()=>{};var R20=D(()=>{HB6();I20()});var S20;var FB6=D(()=>{l1();R20();k0();S20=f1({name:"LINK_CURRENT_GET",description:"Return the calling user's currently registered desktop link, or `online: false` if no link is registered or the TTL has expired.",inputSchema:s1.object({}),outputSchema:s1.object({online:s1.boolean(),machineId:s1.string().optional(),hostname:s1.string().optional(),cliVersion:s1.string().optional(),capabilities:s1.array(M20).default([])}),handler:async($,X)=>{G0(X),await X.access.check();let Y=X.linkClaimRegistry;if(!Y)return{online:!1,capabilities:[]};let G=await Y.get(X.auth.user.id);if(!G)return{online:!1,capabilities:[]};return{online:!0,machineId:G.machineId,hostname:G.hostname,cliVersion:G.cliVersion,capabilities:G.capabilities}}})});var UB6=D(()=>{FB6()});function BB6($){if(!$)return"";return typeof $==="string"?$:$.toISOString()}var qx8,Ax8,Tx8,Vx8,Mx8,k20;var NB6=D(()=>{l1();k0();qx8=["thread"],Ax8=H.object({type:H.literal("thread"),id:H.string(),title:H.string(),created_at:H.string(),updated_at:H.string(),virtual_mcp_id:H.string().nullable(),run_config:H.record(H.string(),H.unknown()).nullable(),status:H.string().nullable()}),Tx8=H.discriminatedUnion("type",[Ax8]),Vx8=H.object({query:H.string().min(1).describe("Free-text search query."),limit:H.number().int().min(1).max(50).optional().describe("Maximum results per resource type (default: 20)."),types:H.array(H.enum(qx8)).optional().describe("Restrict the search to specific resource types. Omit to search across all available types.")}),Mx8=H.object({items:H.array(Tx8),totalCount:H.number()});k20=f1({name:"GLOBAL_SEARCH",description:"Search across organization resources by free-text query. Returns a typed union of matches (currently: threads). New resource types may be added over time without changes to the call shape.",annotations:{title:"Global Search",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:Vx8,outputSchema:Mx8,handler:async($,X)=>{await X.access.check(),r1(X);let Y=$.limit??20,G=$.types?.length?new Set($.types):null,Q=!G||G.has("thread"),J=[],Z=0;if(Q){let{threads:W,total:K}=await X.storage.threads.list(void 0,{limit:Y,offset:0,search:$.query,includeArchived:!1});Z+=K;for(let F of W)J.push({type:"thread",id:F.id,title:F.title??"",created_at:BB6(F.created_at),updated_at:BB6(F.updated_at),virtual_mcp_id:F.virtual_mcp_id??null,run_config:F.run_config??null,status:F.status??null})}return{items:J,totalCount:Z}}})});var wB6=D(()=>{NB6()});var tA1={};g6(tA1,{managementMCP:()=>mr,listManagementTools:()=>kx8,ALL_TOOLS:()=>zB6});async function kx8($){let X=await mr($),[Y,G]=c81.createLinkedPair();await X.connect(G);let Q=new AY({name:"tools-hydration",version:"1.0.0"});try{return await Q.connect(Y),(await Q.listTools()).tools}finally{await Q.close().catch(()=>{})}}var Rx8,Sx8,zB6,mr=async($)=>{let X=null;if($.organization){let Z=await $.storage.organizationSettings.get($.organization.id),W=await $.storage.virtualMcps.list($.organization.id),K=new Set(Z?.enabled_plugins??[]);for(let F of W){let U=F.metadata?.enabled_plugins;if(U&&Array.isArray(U))for(let B of U)K.add(B)}X=K.size>0?[...K]:null}let Y=Tm4(zB6,X),G=new vw({name:"mcp-cms-management",version:"1.0.0"},{capabilities:{tools:{},prompts:{},resources:{}}});for(let Z of Y){let W=Z.inputSchema&&typeof Z.inputSchema==="object"&&"shape"in Z.inputSchema?Z.inputSchema:H.object({}),K=Z.outputSchema&&typeof Z.outputSchema==="object"&&"shape"in Z.outputSchema?Z.outputSchema:void 0,F=W.shape,U=K?.shape;G.registerTool(Z.name,{description:Z.description??"",inputSchema:F,outputSchema:U,annotations:Z.annotations,_meta:Z._meta},async(B)=>{$.access.setToolName(Z.name);try{let N=await Z.execute(B,$);return{content:[{type:"text",text:Z.modelSummary?Z.modelSummary(N):JSON.stringify(N)}],structuredContent:N}}catch(N){return{content:[{type:"text",text:`Error: ${N.message}`}],isError:!0}}})}let Q=V21();for(let Z of Q){let W=Z.arguments?.length?Object.fromEntries(Z.arguments.map((K)=>{let F=K.required?H.string():H.string().optional();return[K.name,K.description?F.describe(K.description):F]})):void 0;G.registerPrompt(Z.name,{title:Z.title,description:Z.description,...W?{argsSchema:W}:{}},(K)=>{return{messages:[{role:"user",content:{type:"text",text:typeof Z.text==="function"?Z.text(K??{}):Z.text}}]}})}if($.organization?.id){let Z=await $.storage.brandContext.list($.organization.id),W=new Set;for(let K of Z){let F=K.name.toLowerCase().replace(/[^a-z0-9]+/g,"-").replace(/^-|-$/g,""),U=F?`brand-${F}`:`brand-${K.id}`;if(W.has(U))U=`${U}-${K.id.slice(0,8)}`;W.add(U);let B=[`# Brand: ${K.name}`,"",`**Domain:** ${K.domain}`,"","## Overview",K.overview];if(K.colors){let w=Object.entries(K.colors).filter(([,z])=>z);if(w.length>0){B.push("","## Colors");for(let[z,O]of w)B.push(`- **${z}:** ${O}`)}}if(K.fonts){let w=Object.entries(K.fonts).filter(([,z])=>z);if(w.length>0){B.push("","## Fonts");for(let[z,O]of w)B.push(`- ${O} (${z})`)}}if(K.logo)B.push("",`**Logo:** ${K.logo}`);if(K.favicon)B.push(`**Favicon:** ${K.favicon}`);if(K.ogImage)B.push(`**OG Image:** ${K.ogImage}`);if(K.images&&K.images.length>0){B.push("","## Images");for(let w of K.images){let z=Object.entries(w).map(([O,L])=>`${O}: ${L}`).join(", ");B.push(`- ${z}`)}}let N=B.join(`
+`))>=0){let K=G.slice(0,W).trim();if(G=G.slice(W+1),!K)continue;yield JSON.parse(K)}}let Q=G.trim();if(Q)yield JSON.parse(Q)}finally{X.releaseLock()}}var Q20,LU6,PU6="gateway.networking.k8s.io",qU6="v1",K20="httproutes",AU6,E71,zy8="mesh-sandbox-runner";var Sg1=D(()=>{D71();Q20=class Q20 extends Error{status;body;constructor($,X,Y){super(Y);this.status=$;this.body=X;this.name="KubeHttpError"}};LU6=`/apis/${a7.CLAIM_API_GROUP}/${a7.CLAIM_API_VERSION}/namespaces`;AU6=`/apis/${PU6}/${qU6}/namespaces`;E71={API_GROUP:PU6,API_VERSION:qU6,PLURAL:K20}});var IU6=D(()=>{kF()});async function kg1($){try{let X=await fetch(`${$}/health`,{signal:AbortSignal.timeout(Dy8)});if(!X.ok)return null;let Y=await X.json();if(typeof Y==="object"&&Y!==null&&typeof Y.bootId==="string"&&typeof Y.ready==="boolean"&&Y.setup&&typeof Y.setup.running==="boolean"&&typeof Y.setup.done==="boolean")return Y;return null}catch{return null}}async function kU6($){for(let X=0;X<RU6;X++){if(await kg1($)!==null)return;let Y=(Math.random()*2-1)*Ly8;await J7(SU6+Y)}throw Error(`sandbox daemon at ${$} did not respond on /health within ${RU6*SU6/1000}s`)}async function Cg1($,X,Y,G){return Ey8($,X,"POST",Y,G)}async function Ey8($,X,Y,G,Q){let J={...G};if(Q&&Q.rotateToken!==void 0)J.auth=Q;let Z=await fetch(`${$}/_sandbox/config`,{method:Y,headers:{"Content-Type":"application/json",Authorization:`Bearer ${X}`},body:JSON.stringify(J),signal:AbortSignal.timeout(Oy8)}),W=await Z.text();if(!Z.ok)throw Error(`sandbox daemon /_sandbox/config returned ${Z.status}: ${W}`);return JSON.parse(W)}async function vg1($,X,Y,G){let Q=new Headers(G.headers);for(let W of jy8)Q.delete(W);Q.set("authorization",`Bearer ${X}`);let J=G.method!=="GET"&&G.method!=="HEAD",Z=`${$}${Y.startsWith("/")?Y:`/${Y}`}`;return fetch(Z,{method:G.method,headers:Q,body:J?G.body:void 0,redirect:"manual",signal:G.signal,duplex:J?"half":void 0})}var Dy8=500,Oy8=1e4,RU6=25,SU6=200,Ly8=50,jy8;var CU6=D(()=>{IU6();jy8=["cookie","host","connection","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","accept-encoding","content-length"]});async function*bU6($){let X=$.now??(()=>Date.now()),Y=X(),G=$.schedulingTimeoutMs??Ay8,Q={pod:{},sandbox:{},events:{hasPulling:!1,hasPulled:!1},startedAt:Y},J=[],Z=null,W=!1,K=(P)=>{if(W)return;if(Z){let T=Z;Z=null,T(P)}else J.push(P)},F=()=>{if(J.length>0)return Promise.resolve(J.shift());if(W)return Promise.resolve(null);return new Promise((P)=>{Z=P})},U=()=>{if(W)return;if(W=!0,Z){let P=Z;Z=null,P(null)}},B=new AbortController,N=()=>{B.abort(),U()};if($.signal)if($.signal.aborted)B.abort(),U();else $.signal.addEventListener("abort",N,{once:!0});let w=Math.max(0,G-(X()-Y)),z=setTimeout(()=>K("tick"),w+100),O,L=new Promise((P)=>{O=P}),j=Promise.allSettled([Ty8($.kc,$.namespace,$.claimName,B.signal,Q,K,X,O),My8($.kc,$.namespace,$.claimName,B.signal,Q,K),Iy8($.kc,$.namespace,$.claimName,L,B.signal,Q,K,X)]);try{let P=null,T=-1,I=vU6(Q,G,X);if(P=U20(I),!F20(I))T=_U6(I);if(yield I,F20(I))return;while(!W){if(await F()===null)break;let R=vU6(Q,G,X);if(F20(R)){let _=U20(R);if(_!==P)P=_,yield R;return}let v=_U6(R);if(v<T)continue;let S=U20(R);if(S!==P)P=S,T=v,yield R}}finally{if(clearTimeout(z),B.abort(),$.signal)$.signal.removeEventListener("abort",N);U(),await j.catch(()=>{})}}function vU6($,X,Y){let{pod:G,sandbox:Q,events:J,startedAt:Z}=$;if(Q.ready)return{kind:"ready"};let W=G.containerWaitingReason;if(W==="ImagePullBackOff"||W==="ErrImagePull")return{kind:"failed",reason:"image-pull-backoff",message:"Sandbox image failed to download. The cluster may be missing pull credentials or the image tag may not exist."};if(W==="CrashLoopBackOff")return{kind:"failed",reason:"crash-loop-backoff",message:"Sandbox crashed during startup and is now in CrashLoopBackOff. Check pod logs."};if(!G.scheduled&&J.lastFailedSchedulingAt!==void 0&&Y()-Z>X)return{kind:"failed",reason:"scheduling-timeout",message:J.failedSchedulingMessage??`Pod could not be scheduled within ${Math.round(X/1000)}s.`};if(G.containerRunning&&!G.containerReady)return{kind:"warming-daemon",since:Z};if(J.hasPulling&&!J.hasPulled)return{kind:"pulling-image",since:Z};if(W==="ContainerCreating"||W==="PodInitializing"||G.scheduled&&!G.containerRunning)return{kind:"starting-container",since:Z};if(G.scheduledFalseReason==="Unschedulable"||J.lastFailedSchedulingAt!==void 0&&!G.scheduled)return{kind:"waiting-for-capacity",since:Z,message:J.failedSchedulingMessage??G.scheduledFalseMessage,nodeClaim:J.nominatedNodeClaim};return{kind:"claiming",since:Z}}function F20($){return $.kind==="ready"||$.kind==="failed"}function _U6($){switch($.kind){case"claiming":return 0;case"waiting-for-capacity":return 1;case"pulling-image":return 2;case"starting-container":return 3;case"warming-daemon":return 4;case"ready":case"failed":return 99}}function U20($){switch($.kind){case"claiming":case"pulling-image":case"starting-container":case"warming-daemon":return $.kind;case"waiting-for-capacity":return`waiting-for-capacity:${$.message??""}:${$.nodeClaim??""}`;case"ready":return"ready";case"failed":return`failed:${$.reason}:${$.message}`}}async function Ty8($,X,Y,G,Q,J,Z,W){let K=`/api/v1/namespaces/${encodeURIComponent(X)}/pods?watch=true&labelSelector=${encodeURIComponent(`${Py8}=${Y}`)}`;return B20({kc:$,path:K,signal:G,label:`pod/${Y}`,onEvent:(F)=>{if(F.type!=="ADDED"&&F.type!=="MODIFIED")return;let U=F.object;if(U.metadata?.name)W(U.metadata.name);Vy8(U,Q,Z),J("pod")}})}function Vy8($,X,Y){let Q=($.status?.conditions??[]).find((Z)=>Z.type==="PodScheduled");if(Q?.status==="True")X.pod.scheduled=!0,X.pod.scheduledFalseReason=void 0,X.pod.scheduledFalseMessage=void 0;else if(Q?.status==="False")X.pod.scheduled=!1,X.pod.scheduledFalseReason=Q.reason,X.pod.scheduledFalseMessage=Q.message;let J=($.status?.containerStatuses??[]).find((Z)=>Z.name===qy8);if(J)X.pod.containerWaitingReason=J.state?.waiting?.reason,X.pod.containerRunning=!!J.state?.running,X.pod.containerReady=J.ready===!0}async function My8($,X,Y,G,Q,J){let Z=`/apis/${a7.CLAIM_API_GROUP}/${a7.CLAIM_API_VERSION}/namespaces/${encodeURIComponent(X)}/${a7.CLAIM_PLURAL}?watch=true&fieldSelector=${encodeURIComponent(`metadata.name=${Y}`)}`;return B20({kc:$,path:Z,signal:G,label:`sandboxclaim/${Y}`,onEvent:(W)=>{if(W.type!=="ADDED"&&W.type!=="MODIFIED")return;let F=W.object.status?.conditions?.find((U)=>U.type==="Ready");if(!F)return;if(F.status==="True")Q.sandbox.ready=!0,Q.sandbox.notReadyReason=void 0,Q.sandbox.notReadyMessage=void 0;else Q.sandbox.ready=!1,Q.sandbox.notReadyReason=F.reason,Q.sandbox.notReadyMessage=F.message;J("sandbox")}})}async function Iy8($,X,Y,G,Q,J,Z,W){let K=await Promise.race([G,new Promise((U)=>{if(Q.aborted){U(Y);return}Q.addEventListener("abort",()=>U(Y),{once:!0})})]);if(Q.aborted)return;let F=`/api/v1/namespaces/${encodeURIComponent(X)}/events?watch=true&fieldSelector=${encodeURIComponent(`involvedObject.name=${K},involvedObject.kind=Pod`)}`;return B20({kc:$,path:F,signal:Q,label:`events/${Y}`,onEvent:(U)=>{if(U.type!=="ADDED"&&U.type!=="MODIFIED")return;let B=U.object,N=B.reason;if(!N)return;switch(N){case"Pulling":J.events.hasPulling=!0;break;case"Pulled":J.events.hasPulling=!0,J.events.hasPulled=!0;break;case"FailedScheduling":J.events.lastFailedSchedulingAt=W(),J.events.failedSchedulingMessage=B.message;break;case"Nominated":{let w=B.message?.match(/nodeclaim\/([\w-]+)/);if(w)J.events.nominatedNodeClaim=w[1];break}default:return}Z("event")}})}async function B20($){let{kc:X,path:Y,signal:G,label:Q,onEvent:J}=$,Z=0;while(!G.aborted){try{let K=await gh(X,{method:"GET",path:Y,signal:G,headers:{accept:"application/json"}});if(!K.ok||!K.body){try{await K.body?.cancel()}catch{}throw Error(`watch handshake failed: ${K.status} ${K.statusText}`)}Z=0;for await(let F of H20(K.body)){if(G.aborted)return;try{J(F)}catch(U){console.warn(`[lifecycle-watcher] ${Q} onEvent threw: ${U instanceof Error?U.message:String(U)}`)}}}catch(K){if(G.aborted)return;let F=K instanceof Error?K.message:String(K);console.warn(`[lifecycle-watcher] ${Q} watch ended: ${F}`)}if(G.aborted)return;let W=SF(5000,250,Z,2,0);Z+=1,await J7(W,{signal:G}).catch(()=>{})}}var Py8="studio.decocms.com/sandbox-handle",qy8="sandbox",Ay8=300000;var fU6=D(()=>{kF();D71();Sg1()});import{createHash as Ry8,randomBytes as Sy8,randomUUID as ky8}from"crypto";import*as hU6 from"net";import{PassThrough as Cy8}from"stream";class L20{kind=x3;records=new Map;inflight=new GT1;stateStore;previewUrlPattern;kubeConfig;portForward;namespace;sandboxTemplateName;envName;tokenGenerator;idleTtlMs;metrics;previewGateway;sentinelToken;closed=!1;constructor($={}){this.stateStore=$.stateStore??null,this.previewUrlPattern=$.previewUrlPattern??null,this.kubeConfig=$.kubeConfig??my8(),this.portForward=new uA0(this.kubeConfig),this.namespace=$.namespace??vy8,this.sandboxTemplateName=$.sandboxTemplateName??_y8,this.envName=ny8($.envName),this.tokenGenerator=$.tokenGenerator??(()=>Sy8(fy8).toString("hex")),this.idleTtlMs=$.idleTtlMs??xy8,this.metrics=$.meter?uy8($.meter):null,this.previewGateway=$.previewGateway&&$.previewUrlPattern?{...$.previewGateway}:null;let X=$.sentinelToken?.trim()??"";this.sentinelToken=X.length>0?X:null}async ensure($,X={}){let Y=DP($,X.branch??X.repo?.branch??null);return this.inflight.run(Y,()=>Zq0(this.stateStore,$,x3,(G)=>this.ensureLocked($,Y,X,G)))}async delete($){let X=await this.getRecord($);if(this.records.delete($),X)this.closeForwarder(X.daemonForward),this.metrics?.active.add(-1,D20(X.tenant));if(await this.deleteHttpRouteIfManaged($).catch((Y)=>{console.warn(`[${rQ}] HTTPRoute delete failed for ${$}: ${Y instanceof Error?Y.message:String(Y)}`)}),await SP(this.kubeConfig,this.namespace,$),this.stateStore)if(X)await this.stateStore.delete(X.id,x3);else await this.stateStore.deleteByHandle(x3,$)}async alive($){return await kP(this.kubeConfig,this.namespace,$)!==void 0}watchClaimLifecycle($,X){return bU6({kc:this.kubeConfig,namespace:this.namespace,claimName:$,signal:X})}async getPreviewUrl($){let X=await this.getRecord($);if(!X)return null;return this.composePreviewUrl(X)}async proxyDaemonRequest($,X,Y){let G=await this.getRecord($);if(!G&&this.previewUrlPattern&&this.stateStore){let W=await this.stateStore.getByHandle(x3,$),K=W?.state,F=K?.token;if(W&&F){let B=`http://${K?.adoptedSandboxName??$}.${this.namespace}.svc.cluster.local:${CP}`;return vg1(B,F,X,Y)}}if(!G)G=await this.resurrectByHandle($);if(!G)return new Response(JSON.stringify({error:"sandbox not found"}),{status:404,headers:{"content-type":"application/json"}});let Q=G,J=performance.now(),Z=0;try{let W=await vg1(G.daemonUrl,G.token,X,Y);if(W.status===401&&!(Y.body instanceof ReadableStream)){this.invalidateRecord($);let K=await this.getRecord($).catch(()=>null);if(K)Q=K,W=await vg1(K.daemonUrl,K.token,X,Y)}return Z=W.status,W}finally{this.recordProxyDuration("daemon",Z,Q,performance.now()-J)}}async resolvePreviewUpstreamUrl($){if(this.previewUrlPattern)return`http://${await this.resolveServiceNameForHandle($)}.${this.namespace}.svc.cluster.local:${CP}`;let X=await this.getRecord($);if(X)return X.daemonUrl;let Y=await this.resurrectByHandle($);return Y?Y.daemonUrl:null}async resolveServiceNameForHandle($){let X=this.records.get($);if(X)return X.adoptedSandboxName;if(this.stateStore){let G=(await this.stateStore.getByHandle(x3,$).catch(()=>null))?.state?.adoptedSandboxName;if(G)return G}return $}async proxyPreviewRequest($,X){let Y=performance.now(),G=this.records.get($)??null,Q=0;try{let J=await this.resolvePreviewUpstreamUrl($);if(!J){Q=404;let z=w20(404,{error:"sandbox not found"});return z.headers.set(hh,"1"),z}let Z=new URL(X.url);if((Z.pathname==="/_sandbox"||Z.pathname.startsWith("/_sandbox/")||Z.pathname==="/_decopilot_vm"||Z.pathname.startsWith("/_decopilot_vm/"))&&X.method!=="GET")return Q=404,w20(404,{error:"not found"});let K=(z)=>`${z}${Z.pathname}${Z.search}`,F=new Headers(X.headers);for(let z of gy8)F.delete(z);let U=X.method!=="GET"&&X.method!=="HEAD",B={method:X.method,headers:F,body:U?X.body:void 0,redirect:"manual",signal:X.signal,duplex:U?"half":void 0},N;try{N=await fetch(K(J),B)}catch(z){let O=`${J}${Z.pathname}`;if(console.warn(`[${rQ}] preview fetch to ${O} failed: ${z instanceof Error?z.message:String(z)}`),X.method==="GET"||X.method==="HEAD"){if(this.invalidateRecord($),await this.resurrectByHandle($).catch(()=>null)){let P=await this.resolvePreviewUpstreamUrl($);if(P)try{N=await fetch(K(P),B);let T=new Headers;for(let[I,V]of N.headers.entries())if(!yU6.includes(I.toLowerCase()))T.set(I,V);return Q=N.status,new Response(N.body,{status:N.status,statusText:N.statusText,headers:T})}catch(T){console.warn(`[${rQ}] preview fetch retry to ${O} failed: ${T instanceof Error?T.message:String(T)}`)}}}else this.invalidateRecord($);Q=502;let L=w20(502,{error:"sandbox daemon unreachable"});return L.headers.set(hh,"1"),L}let w=new Headers;for(let[z,O]of N.headers.entries())if(!yU6.includes(z.toLowerCase()))w.set(z,O);return Q=N.status,new Response(N.body,{status:N.status,statusText:N.statusText,headers:w})}finally{this.recordProxyDuration("preview",Q,G,performance.now()-Y,$)}}async ensureLocked($,X,Y,G){if(Y.image)console.warn(`[${rQ}] opts.image ignored (template ${this.sandboxTemplateName} pins image): got ${Y.image}`);if(G){let Z=await G.get($,x3);if(Z){let W=await this.rehydrate($,X,Z);if(W)return this.finish(W,G,!1,!0,"resume");await G.delete($,x3)}}let Q=await kP(this.kubeConfig,this.namespace,X).catch(()=>{return});if(Q)if(Q.metadata?.deletionTimestamp)await Vg1(this.kubeConfig,this.namespace,X).catch((Z)=>{console.warn(`[${rQ}] wait for terminating claim ${X} failed: ${Z instanceof Error?Z.message:String(Z)}`)});else{let Z=await this.adopt($,X,Q).catch((W)=>{return console.warn(`[${rQ}] adopt ${X} failed, recreating: ${W instanceof Error?W.message:String(W)}`),null});if(Z)return this.finish(Z,G,!0,!0,"adopt");await SP(this.kubeConfig,this.namespace,X).catch(()=>{}),await Vg1(this.kubeConfig,this.namespace,X).catch((W)=>{console.warn(`[${rQ}] wait for deleted claim ${X} failed: ${W instanceof Error?W.message:String(W)}`)})}let J=await this.provision($,X,Y);return this.finish(J,G,!0,!1,"fresh")}async finish($,X,Y,G,Q){let J=this.records.has($.handle);if(this.records.set($.handle,$),Y)await this.persist(X,$);if(G)await EU6(this.kubeConfig,this.namespace,$.handle,this.computeShutdownTime()).catch((Z)=>console.warn(`[${rQ}] TTL refresh failed for ${$.handle}: ${Z instanceof Error?Z.message:String(Z)}`));if(this.metrics){let Z=D20($.tenant);if(this.metrics.ensureOutcome.add(1,{...Z,outcome:Q}),!J)this.metrics.active.add(1,Z)}return this.toSandbox($)}buildEnvMap($,X){let Y={},G=[];for(let[Q,J]of Object.entries($.env??{}))if(yy8.has(Q))G.push(Q);else Y[Q]=J;if(G.length>0)console.warn(`[${rQ}] opts.env keys overlap reserved bootstrap names and were dropped: ${G.join(",")}`);return{...Y,DAEMON_TOKEN:X.token,DAEMON_BOOT_ID:X.daemonBootId,APP_ROOT:X.workdir,PROXY_PORT:String(CP)}}buildClaim($,X,Y){let G=this.sentinelToken!==null,Q=G?[]:Object.entries(this.buildEnvMap(X,Y)).sort(([J],[Z])=>J<Z?-1:J>Z?1:0).map(([J,Z])=>({name:J,value:Z}));return{apiVersion:`${a7.CLAIM_API_GROUP}/${a7.CLAIM_API_VERSION}`,kind:"SandboxClaim",metadata:{name:$,namespace:this.namespace,labels:{"app.kubernetes.io/name":"studio-sandbox","app.kubernetes.io/managed-by":"studio",...this.envName?{[ZU.env]:this.envName}:{},...z20(X.tenant)}},spec:{sandboxTemplateRef:{name:this.sandboxTemplateName},additionalPodMetadata:{labels:z20(X.tenant,{[ZU.role]:"claimed",[ZU.sandboxHandle]:$,...this.envName?{[ZU.env]:this.envName}:{}})},env:Q,warmpool:G?"default":"none",lifecycle:{shutdownPolicy:"Delete",shutdownTime:this.computeShutdownTime()}}}}async provision($,X,Y){let G=this.tokenGenerator(),Q=ky8(),J=N20,Z=this.buildClaim(X,Y,{token:G,daemonBootId:Q,workdir:J});try{await L71(this.kubeConfig,this.namespace,Z)}catch(N){if(N instanceof z71)await Vg1(this.kubeConfig,this.namespace,X),await L71(this.kubeConfig,this.namespace,Z);else throw N}let W;try{W=await jU6(this.kubeConfig,this.namespace,X),await Rg1(this.kubeConfig,this.namespace,W)}catch(N){throw await SP(this.kubeConfig,this.namespace,X).catch(()=>{}),N}try{await this.ensureServicePortForAdoptedSandbox(W),await this.ensureHttpRouteForHandle(X,W,Y.tenant??null)}catch(N){throw await SP(this.kubeConfig,this.namespace,X).catch(()=>{}),N}let K=await this.openForwarder(W,CP,X),F=`http://127.0.0.1:${K.localPort}`,U=this.workloadConfigPayload(Y),B=Q;try{if(await kU6(F),this.sentinelToken!==null){let N=await kg1(F);if(N)B=N.bootId;await Cg1(F,this.sentinelToken,U??{},{rotateToken:G})}else if(U)await Cg1(F,G,U)}catch(N){throw this.closeForwarder(K),await this.deleteHttpRouteIfManaged(X).catch(()=>{}),await SP(this.kubeConfig,this.namespace,X).catch(()=>{}),N}return{id:$,handle:X,adoptedSandboxName:W,token:G,workdir:J,daemonUrl:F,daemonForward:K,workload:Y.workload??null,daemonBootId:B,tenant:Y.tenant??null,ensureOpts:ty8(Y)}}workloadConfigPayload($){return Wq0({runtime:$?.workload?.runtime??"node",packageManager:$?.workload?.packageManager?{name:$.workload.packageManager,...$.workload.packageManagerPath?{path:$.workload.packageManagerPath}:{}}:null,repo:$?.repo??null,port:$?.workload?.devPort??by8})}async rebootstrapDaemon($,X,Y){if(this.sentinelToken===null)return!1;try{return await Cg1($,this.sentinelToken,this.workloadConfigPayload(Y)??{},{rotateToken:X}),!0}catch(G){return console.warn(`[${rQ}] re-bootstrap failed: ${G instanceof Error?G.message:String(G)}`),!1}}async ensureServicePortForAdoptedSandbox($){if(!this.previewGateway||!this.previewUrlPattern)return;await MU6(this.kubeConfig,this.namespace,$,{name:"daemon",port:CP,targetPort:CP})}async ensureHttpRouteForHandle($,X,Y){if(!this.previewGateway||!this.previewUrlPattern)return;let G=ay8(this.previewUrlPattern,$);if(!G)throw new mY(`Unable to derive preview hostname for ${$} from pattern: ${this.previewUrlPattern}`);let Q={apiVersion:`${E71.API_GROUP}/${E71.API_VERSION}`,kind:"HTTPRoute",metadata:{name:$,namespace:this.namespace,labels:z20(Y??void 0,{[ZU.role]:"claimed",[ZU.sandboxHandle]:$,"app.kubernetes.io/name":"studio-sandbox","app.kubernetes.io/managed-by":"studio",...this.envName?{[ZU.env]:this.envName}:{}})},spec:{parentRefs:[{kind:"Gateway",group:"gateway.networking.k8s.io",name:this.previewGateway.name,namespace:this.previewGateway.namespace}],hostnames:[G],rules:[{backendRefs:[{group:"",kind:"Service",name:X,port:CP}]}]}};await Mg1(this.kubeConfig,this.namespace,Q)}async deleteHttpRouteIfManaged($){if(!this.previewGateway)return;await Ig1(this.kubeConfig,this.namespace,$)}async rehydrate($,X,Y){let G=Y.state;if(!G.adoptedSandboxName&&!G.podName||!G.token)return null;let Q=await kP(this.kubeConfig,this.namespace,X).catch(()=>{return});if(!Q||!xU6(Q))return null;let J=Q.status?.sandbox?.name??G.adoptedSandboxName??G.podName??X,Z=await this.openAndProbeDaemon(J,X);if(!Z)return null;if(G.daemonBootId&&G.daemonBootId!==Z.bootId){if(this.sentinelToken!==null){if(!await this.rebootstrapDaemon(Z.daemonUrl,G.token,G.ensureOpts??null))return this.closeForwarder(Z.daemonForward),null}else console.warn(`[${rQ}] daemon restart detected (handle=${X}): stored bootId=${G.daemonBootId} live bootId=${Z.bootId}`);await this.stateStore?.put($,x3,{handle:X,state:{...G,daemonBootId:Z.bootId}}).catch((W)=>console.warn(`[${rQ}] bootId persist failed for ${X}: ${W instanceof Error?W.message:String(W)}`))}return{id:$,handle:X,adoptedSandboxName:J,token:G.token,workdir:G.workdir??N20,daemonUrl:Z.daemonUrl,daemonForward:Z.daemonForward,workload:G.workload??null,daemonBootId:Z.bootId,tenant:G.tenant??null,ensureOpts:G.ensureOpts??null}}async adopt($,X,Y){if(!xU6(Y))return null;let G=Y.status?.sandbox?.name??X;if(this.sentinelToken!==null)return null;let Q=ly8(Y);if(!Q)return null;let J=await this.openAndProbeDaemon(G,X);if(!J)return null;let Z=ry8(Y);if(this.previewGateway)await this.ensureServicePortForAdoptedSandbox(G).catch((W)=>{console.warn(`[${rQ}] Service port backfill failed for ${X}: ${W instanceof Error?W.message:String(W)}`)}),await this.ensureHttpRouteForHandle(X,G,Z).catch((W)=>{console.warn(`[${rQ}] HTTPRoute backfill failed for ${X}: ${W instanceof Error?W.message:String(W)}`)});return{id:$,handle:X,adoptedSandboxName:G,token:Q,workdir:N20,daemonUrl:J.daemonUrl,daemonForward:J.daemonForward,workload:null,daemonBootId:J.bootId,tenant:Z,ensureOpts:null}}async openAndProbeDaemon($,X){let Y=await this.openForwarder($,CP,X).catch(()=>null);if(!Y)return null;let G=`http://127.0.0.1:${Y.localPort}`,Q=await kg1(G);if(!Q)return this.closeForwarder(Y),null;return{daemonForward:Y,daemonUrl:G,bootId:Q.bootId}}async getRecord($){let X=this.records.get($);if(X)return X;if(!this.stateStore)return null;let Y=await this.stateStore.getByHandle(x3,$);if(!Y)return null;let G=await this.rehydrate(Y.id,$,Y);if(G)this.records.set($,G);return G}async resurrectByHandle($){if(!this.stateStore)return null;let X=await this.stateStore.getByHandle(x3,$);if(!X)return null;let Y=X.state.ensureOpts;if(!Y)return null;return await this.ensure(X.id,Y),this.records.get($)??null}invalidateRecord($){let X=this.records.get($);if(!X)return;this.records.delete($),this.closeForwarder(X.daemonForward)}recordProxyDuration($,X,Y,G,Q){if(!this.metrics)return;this.metrics.proxyDurationMs.record(G,{...D20(Y?.tenant??null),source:$,sandbox_handle:Y?.handle??Q??"",status_code:X||0})}composePreviewUrl($){if(this.previewUrlPattern)return QT1(this.previewUrlPattern,$.handle);return`http://127.0.0.1:${$.daemonForward.localPort}/`}toSandbox($){return{handle:$.handle,workdir:$.workdir,previewUrl:this.composePreviewUrl($)}}async persist($,X){if(!$)return;let Y={adoptedSandboxName:X.adoptedSandboxName,token:X.token,workdir:X.workdir,workload:X.workload,daemonBootId:X.daemonBootId,tenant:X.tenant,...X.ensureOpts?{ensureOpts:X.ensureOpts}:{}};await $.put(X.id,x3,{handle:X.handle,state:Y})}computeShutdownTime(){return new Date(Date.now()+this.idleTtlMs).toISOString()}openForwarder($,X,Y=$){let G=cy8(Y,X);return new Promise((Q,J)=>{let Z=(W,K)=>{let F=hU6.createServer((U)=>this.handleForwardedConnection(U,$,X,Y));F.once("error",(U)=>{if(U.code==="EADDRINUSE"&&K<hy8){try{F.close()}catch{}let B=O20+(W-O20+1)%uU6;Z(B,K+1);return}J(U)}),F.listen(W,"127.0.0.1",()=>{let U=F.address();if(!U||typeof U==="string"){F.close(),J(Error("port-forward listener failed to bind"));return}Q({server:F,localPort:U.port})})};Z(G,0)})}handleForwardedConnection($,X,Y,G){let Q=new Cy8,J=null,Z=!1,W=()=>{if(Z)return;if(Z=!0,Q.destroy(),J)try{J.close()}catch{}if(!$.destroyed)$.destroy()};$.pipe(Q),$.on("error",W),$.on("close",W),this.portForward.portForward(this.namespace,X,[Y],$,null,Q).then((K)=>{let F=typeof K==="function"?K():K;if(!F){W();return}if(J=F,J.on("close",W),J.on("error",()=>{this.invalidateRecord(G),W()}),Z)try{J.close()}catch{}}).catch((K)=>{console.warn(`[${rQ}] port-forward to ${X}:${Y} failed: ${K instanceof Error?K.message:String(K)}`),this.invalidateRecord(G),W()})}closeForwarder($){$.server.close((X)=>{if(X)console.warn(`[${rQ}] port-forward close on :${$.localPort} errored: ${X instanceof Error?X.message:String(X)}`)})}close(){if(this.closed)return;this.closed=!0;for(let $ of this.records.values())this.closeForwarder($.daemonForward);this.records.clear()}}function uy8($){return{active:$.createUpDownCounter("studio.sandbox.active",{description:"Active sandbox count, by runner kind and owning org. Cross-checks the cAdvisor-derived count from the cluster \u2014 divergence between the two indicates orphaned claims (mesh deleted but K8s didn't reap) or unattributed pods.",unit:"{sandbox}"}),ensureOutcome:$.createCounter("studio.sandbox.ensure.outcome",{description:"Outcome of each ensure() call: fresh provision, resume from state-store after restart, or adopt of a cluster-side claim mesh didn't know about. Cold-start ratio is the primary input for warm-pool sizing.",unit:"{call}"}),proxyDurationMs:$.createHistogram("studio.sandbox.proxy.duration_ms",{description:"Wall-clock latency of mesh-mediated requests to the sandbox daemon: tool exec proxies (source=daemon) and preview iframe traffic (source=preview).",unit:"ms"})}}function my8(){let $=new Nt;return $.loadFromDefault(),$}function xU6($){return Boolean($.status?.conditions?.some((X)=>X.type==="Ready"&&X.status==="True"))}function ly8($){let X=$.spec?.env;if(!X)return null;for(let Y of X)if(Y.name==="DAEMON_TOKEN"&&Y.value)return Y.value;return null}function cy8($,X){let Y=Ry8("sha256").update(`${$}:${X}`).digest();return O20+Y.readUInt32BE(0)%uU6}function w20($,X){return new Response(JSON.stringify(X),{status:$,headers:{"content-type":"application/json","access-control-allow-origin":"*"}})}function gU6($){let X=$.slice(0,iy8);return dy8.test(X)?X:""}function ny8($){if($===void 0)return null;let X=$.trim();if(X==="")return null;if(!py8.test(X))throw Error(`AgentSandboxProvider: envName=${JSON.stringify(X)} is not a valid DNS-label-safe environment name (lowercase alphanumeric or '-', starts with a letter, ends alphanumeric, \u226432 chars). Mesh sets this from STUDIO_ENV; check the studio chart's configMap.`);return X}function z20($,X={}){let Y={...X};if($){let G=gU6($.orgId),Q=gU6($.userId);if(G)Y[ZU.orgId]=G;if(Q)Y[ZU.userId]=Q}return Y}function ry8($){let X=$.metadata?.labels;if(!X)return null;let Y=X[ZU.orgId],G=X[ZU.userId];if(!Y||!G)return null;return{orgId:Y,userId:G}}function D20($){return{org_id:$?.orgId??"",user_id:$?.userId??"",runner_kind:x3}}function ty8($){let X={};if($.repo)X.repo=$.repo;if($.workload)X.workload=$.workload;if($.env&&Object.keys($.env).length>0)X.env=$.env;if($.tenant)X.tenant=$.tenant;return Object.keys(X).length>0?X:null}function ay8($,X){try{return new URL(QT1($,X)).hostname||null}catch{return null}}var x3="cluster",rQ="AgentSandboxProvider",hh="x-sandbox-preview-not-ready",vy8="agent-sandbox-system",_y8="studio-sandbox",CP=9000,by8=3000,N20="/app",fy8=32,yy8,xy8=900000,gy8,yU6,O20=40000,uU6=1e4,hy8=256,ZU,dy8,iy8=63,py8;var mU6=D(()=>{Y20();CU6();JT1();Sg1();D71();fU6();yy8=new Set(["DAEMON_TOKEN","DAEMON_BOOT_ID","APP_ROOT","PROXY_PORT"]),gy8=["cookie","host","connection","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","accept-encoding","content-length","upgrade"],yU6=["connection","keep-alive","transfer-encoding","content-encoding","content-length"];ZU={role:"studio.decocms.com/role",sandboxHandle:"studio.decocms.com/sandbox-handle",orgId:"studio.decocms.com/org-id",userId:"studio.decocms.com/user-id",env:"studio.decocms.com/env"},dy8=/^([A-Za-z0-9]([-A-Za-z0-9_.]*[A-Za-z0-9])?)?$/;py8=/^[a-z]([a-z0-9-]{0,30}[a-z0-9])?$/});var lU6={};g6(lU6,{waitForSandboxReady:()=>Rg1,getSandboxClaim:()=>kP,getHttpRoute:()=>VU6,deleteSandboxClaim:()=>SP,deleteHttpRoute:()=>Ig1,createSandboxClaim:()=>L71,createHttpRoute:()=>Mg1,SandboxTimeoutError:()=>xh,SandboxError:()=>mY,PREVIEW_NOT_READY_HEADER:()=>hh,KubeConfig:()=>Nt,K8S_CONSTANTS:()=>a7,HTTPROUTE_CONSTANTS:()=>E71,AgentSandboxProvider:()=>L20});var E20=D(()=>{Y20();D71();Sg1();mU6()});class _g1{kind=vP;userSub;dispatch;stateStore;records=new Map;constructor($){if(!$.userSub)throw Error("DesktopSandboxProvider requires userSub");if(!$.dispatch)throw Error("DesktopSandboxProvider requires dispatch");this.userSub=$.userSub,this.dispatch=$.dispatch,this.stateStore=$.stateStore??null}async ensure($,X={}){let Y=X.branch??X.repo?.branch,G=DP($,Y),Q=this.records.get(G);if(Q){if(await this.probeHealth(G))return this.toSandbox(Q);if(this.records.delete(G),this.stateStore)await this.stateStore.deleteByHandle(vP,G).catch(()=>{})}else if(this.stateStore){let B=(await this.stateStore.getByHandle(vP,G))?.state,N=B?.sandboxApiUrl;if(N){if(await this.probeHealth(G)){let w={handle:G,sandboxApiUrl:N,previewUrl:B?.previewUrl??N};return this.records.set(G,w),this.toSandbox(w)}await this.stateStore.deleteByHandle(vP,G).catch(()=>{})}}let J=JSON.stringify({handle:G,repo:X.repo,branch:Y,...X.workload?{workload:X.workload}:{},...X.offloadAllowedHosts?{offloadAllowedHosts:X.offloadAllowedHosts}:{},...X.offloadAllowSameHostDev!==void 0?{offloadAllowSameHostDev:X.offloadAllowSameHostDev}:{}}),Z=await this.dispatchJson("POST","/api/sandboxes",J),W=JSON.parse(Z);if(typeof W.sandboxApiUrl!=="string")throw Error("desktop ensure: daemon did not return a sandboxApiUrl string");let K=typeof W.previewUrl==="string"?W.previewUrl:W.sandboxApiUrl,F={handle:G,sandboxApiUrl:W.sandboxApiUrl,previewUrl:K};if(this.records.set(G,F),this.stateStore)await this.stateStore.put($,vP,{handle:G,state:{handle:G,sandboxApiUrl:W.sandboxApiUrl,previewUrl:K}});return this.toSandbox(F)}async proxyDaemonRequest($,X,Y){let G=X.startsWith("/")?X:`/${X}`,Q=G.startsWith("/_sandbox/")?G.slice(9):G,J=`/_sandbox/${encodeURIComponent($)}${Q}`,Z=new Headers(Y.headers);for(let j of["host","cookie","connection","keep-alive","transfer-encoding","upgrade","authorization"])Z.delete(j);let W={};Z.forEach((j,P)=>{W[P]=j});let K;if(Y.body!=null)K=await oy8(Y.body);let U=this.dispatch(this.userSub,{method:Y.method,path:J,headers:W,body:K},{signal:Y.signal})[Symbol.asyncIterator](),B=200,N={"content-type":"application/octet-stream"},w=[];try{while(!0){let j=await U.next();if(j.done)break;let P=j.value;if(P.headers){B=P.headers.status,N=P.headers.headers;break}if(P.data!=null)w.push(P.data)}}catch(j){let P=j instanceof Error?j.message:"dispatch error";return new Response(JSON.stringify({error:P}),{status:502,headers:{"content-type":"application/json"}})}let z=!1,O=new TextEncoder,L=new ReadableStream({async start(j){for(let P of w)j.enqueue(O.encode(P))},async pull(j){try{let P=await U.next();if(z)return;if(P.done){j.close();return}let T=P.value;if(T.data!=null)j.enqueue(O.encode(T.data))}catch(P){if(!z)j.error(P)}},cancel(){z=!0,U.return?.()}});return new Response(L,{status:B,headers:N})}async alive($){return this.probeHealth($)}async probeHealth($){let X=new AbortController,Y=setTimeout(()=>X.abort(),1500);try{return await this.dispatchJson("GET",`/api/sandboxes/${encodeURIComponent($)}`,void 0,X.signal),!0}catch{return!1}finally{clearTimeout(Y)}}async forgetHandle($){if(this.records.delete($),this.stateStore)await this.stateStore.deleteByHandle(vP,$).catch(()=>{})}async delete($){if(this.records.delete($),this.stateStore)await this.stateStore.deleteByHandle(vP,$).catch(()=>{});try{await this.dispatchJson("DELETE",`/api/sandboxes/${encodeURIComponent($)}`)}catch(X){if(!(X instanceof Error?X.message:String(X)).includes("404"))throw X}}async getPreviewUrl($){return(await this.resolveRecord($))?.previewUrl??null}async localWorkdir($){return null}async*watchClaimLifecycle($,X){yield{kind:"ready"}}toSandbox($){return{handle:$.handle,workdir:$.sandboxApiUrl,previewUrl:$.previewUrl}}async resolveRecord($){let X=this.records.get($);if(X)return X;if(!this.stateStore)return null;let G=(await this.stateStore.getByHandle(vP,$))?.state,Q=G?.sandboxApiUrl;if(!Q)return null;let J={handle:$,sandboxApiUrl:Q,previewUrl:G?.previewUrl??Q};return this.records.set($,J),J}async dispatchJson($,X,Y,G){let Q={accept:"application/json"};if(Y!==void 0)Q["content-type"]="application/json";let J=this.dispatch(this.userSub,{method:$,path:X,headers:Q,body:Y},{signal:G}),Z=null,W="";for await(let K of J)if(K.headers)Z=K.headers.status;else if(K.data!=null)W+=K.data;if(Z!=null&&(Z<200||Z>=300))throw Error(`daemon returned ${Z}: ${W}`);return W}}function cU6($){return new _g1($)}async function oy8($){if(typeof $==="string")return $;if($ instanceof ArrayBuffer)return Buffer.from($).toString("utf8");if(ArrayBuffer.isView($))return Buffer.from($.buffer,$.byteOffset,$.byteLength).toString("utf8");if($ instanceof URLSearchParams)return $.toString();return await new Response($).text()}var vP="user-desktop";var dU6=D(()=>{JT1()});var iU6={};g6(iU6,{createDesktopProvider:()=>cU6,DesktopSandboxProvider:()=>_g1});var pU6=D(()=>{dU6()});var sU6={};g6(sU6,{subscribeLifecycle:()=>P71,getSandboxProviderByKind:()=>j71,getOrInitSharedRunner:()=>Jx8,buildDesktopProvider:()=>Lt,__resetSharedLifecyclesForTesting:()=>Fx8});function aU6($,X){let Y=nU6[$];if(Y)return Promise.resolve(Y);let G=j20[$];if(G)return G;let Q=X().then((J)=>{return nU6[$]=J,J}).finally(()=>{delete j20[$]});return j20[$]=Q,Q}function $x8(){let $=process.env.STUDIO_SANDBOX_PREVIEW_URL_PATTERN;return $&&$.trim()!==""?$:void 0}function Xx8(){let $=process.env.STUDIO_SANDBOX_TEMPLATE_NAME;return $&&$.trim()!==""?$:void 0}function Yx8(){let $=process.env.STUDIO_ENV;return $&&$.trim()!==""?$:void 0}function Gx8(){let $=process.env.STUDIO_SANDBOX_SENTINEL_TOKEN;return $&&$.trim()!==""?$:void 0}function Qx8(){let $=process.env.STUDIO_SANDBOX_PREVIEW_GATEWAY_NAME?.trim(),X=process.env.STUDIO_SANDBOX_PREVIEW_GATEWAY_NAMESPACE?.trim();if(!$&&!X)return;if(!$||!X)throw Error("STUDIO_SANDBOX_PREVIEW_GATEWAY_NAME and STUDIO_SANDBOX_PREVIEW_GATEWAY_NAMESPACE must both be set, or both unset. Half-configured per-claim HTTPRoute routing would silently fail to attach.");return{name:$,namespace:X}}async function oU6($,X){let Y=new LP(X),G=$x8();switch($){case"cluster":{let{AgentSandboxProvider:Q}=await Promise.resolve().then(() => (E20(),lU6));return new Q({stateStore:Y,previewUrlPattern:G,sandboxTemplateName:Xx8(),envName:Yx8(),previewGateway:Qx8(),sentinelToken:Gx8(),meter:CW})}case"user-desktop":throw Error("user-desktop runner cannot be instantiated without a per-run link claim \u2014 call resolveSandboxProvider, which binds the link before constructing the provider.");default:throw Error(`Unknown runner kind: ${String($)}`)}}async function Lt($,X){let{DesktopSandboxProvider:Y}=await Promise.resolve().then(() => (pU6(),iU6)),{getDispatch:G}=await Promise.resolve().then(() => (q20(),P20)),Q=new LP($.db);if(!X)throw Error("buildDesktopProvider: userSub must be a non-empty string");return new Y({userSub:X,dispatch:G(),stateStore:Q})}function j71($,X){return aU6(X,()=>oU6(X,$.db))}async function Jx8(){let $;try{$=DN()}catch(Y){return console.warn("[lifecycle] cannot resolve sandbox runner:",Y instanceof Error?Y.message:String(Y)),null}return await aU6($,()=>oU6($,q5().db))}function P71($,X,Y){let G=_P.get(X);if(G){if(G.terminated){if(G.lastPhase)try{Y(G.lastPhase)}catch{}return{unsubscribe:Kx8}}if(G.listeners.add(Y),G.lastPhase)try{Y(G.lastPhase)}catch{}return rU6(X,G,Y)}let Q=new AbortController,J={lastPhase:null,terminated:!1,listeners:new Set([Y]),abort:Q};return _P.set(X,J),Hx8($,X,J),rU6(X,J,Y)}function Kx8(){}function rU6($,X,Y){return{unsubscribe(){if(_P.get($)!==X)return;if(X.listeners.delete(Y),X.listeners.size===0)_P.delete($),X.abort.abort()}}}async function Hx8($,X,Y){let G=null;try{for await(let Q of $.watchClaimLifecycle(X,Y.abort.signal)){if(Y.abort.signal.aborted)break;Y.lastPhase=Q;let J=Q.kind==="ready"||Q.kind==="failed";if(J)Y.terminated=!0;let Z=Array.from(Y.listeners);for(let W of Z)try{W(Q)}catch{}if(J)break}}catch(Q){G=Q}finally{if(!Y.terminated&&!Y.abort.signal.aborted&&Y.listeners.size>0){let Q={kind:"failed",reason:"unknown",message:G instanceof Error?G.message:"Lifecycle watcher ended unexpectedly"};Y.lastPhase=Q,Y.terminated=!0;for(let J of Array.from(Y.listeners))try{J(Q)}catch{}}if(_P.get(X)===Y)_P.delete(X)}}function Fx8(){for(let $ of _P.values())$.abort.abort();_P.clear()}var sy8,ey8,tU6,nU6,j20,Zx8,Wx8,_P;var uh=D(()=>{RD();CB();ZZ();HT1();sy8=Symbol.for("decocms.sandbox.lifecycle.runners"),ey8=Symbol.for("decocms.sandbox.lifecycle.inflight"),tU6=globalThis,nU6=tU6[sy8]??={},j20=tU6[ey8]??={};Zx8=Symbol.for("decocms.sandbox.lifecycle.shared-lifecycles"),Wx8=globalThis,_P=Wx8[Zx8]??=new Map});async function bg1($,X){if(await X.linkClaimRegistry.get($))return"user-desktop";return X.resolveEnvKind()}async function yD($,X){let{userId:Y,branch:G,virtualMcpMetadata:Q,explicitKind:J}=X;if(J)return{provider:await fg1($,Y,J),kind:J};if($.sandboxPreference==="user-desktop"&&$.linkForCurrentRun)return{provider:await Lt($,Y),kind:"user-desktop"};if($.sandboxPreference==="cluster-default"){let U=DN();return{provider:await fg1($,Y,U),kind:U}}let[Z,...W]=Ux8(Q,Y,G);if(Z){let U=W.length===0?Z:await Bx8($,Y,Z,W);return{provider:await fg1($,Y,U),kind:U}}let K=await eU6($,Y);return{provider:await fg1($,Y,K),kind:K}}function Ux8($,X,Y){let G=ZH($)[X]?.[Y];if(!G)return[];let Q=kw(G);return Object.keys(Q)}async function Bx8($,X,Y,G){let Q=await eU6($,X);if(Q===Y||G.includes(Q))return Q;return Y}async function eU6($,X){if(!$.linkClaimRegistry)return DN();return bg1(X,{linkClaimRegistry:$.linkClaimRegistry,resolveEnvKind:DN})}async function fg1($,X,Y){if(Y!=="user-desktop")return j71($,Y);if(!$.linkClaimRegistry)throw Error("user-desktop sandbox provider requires ctx.linkClaimRegistry to be wired (set on StudioContextConfig).");if(!await $.linkClaimRegistry.get(X))throw Error(`No link daemon registered for user "${X}". Start one with \`deco link\` (or run \`bun run dev --local-sandbox-provider\` for dev).`);return Lt($,X)}var q71=D(()=>{b$();RD();SD();uh()});async function $B6($,X){if(!$)return{hosts:[],allowSameHostDev:!1};let Y;try{Y=await $.presignedGetUrl("link-dispatch/_allowlist_probe",60,{requireFetchable:!0})}catch{return{hosts:[],allowSameHostDev:!1}}let G;try{G=new URL(Y)}catch{return{hosts:[],allowSameHostDev:!1}}if(G.protocol!=="https:"&&G.protocol!=="http:")return{hosts:[],allowSameHostDev:!1};let Q=G.hostname,J=Nx8.has(Q);return{hosts:[Q],allowSameHostDev:J&&!X.isProduction}}var Nx8;var XB6=D(()=>{Nx8=new Set(["127.0.0.1","localhost","::1","[::1]","0.0.0.0"])});async function yg1($,X){G0(X);let Y=r1(X),G=K6(X);if(!G)throw Error("User ID required");let Q=await X.storage.virtualMcps.findById($.virtualMcpId);if(!Q||Q.organization_id!==Y.id)throw Error("Virtual MCP not found");let J=Q.metadata??{},Z=OP(ZH(J),G,$.branch,$.sandboxProviderKind),W=$.sandboxProviderKind,{provider:K}=await yD(X,{userId:G,branch:$.branch,virtualMcpMetadata:J,explicitKind:W});if(Z){if(W!=="user-desktop")return Z;if(await K.alive(Z.sandboxHandle).catch(()=>!1))return Z;await Yt(X.storage.virtualMcps,$.virtualMcpId,G,G,$.branch,W).catch((N)=>{console.warn("[ensureSandbox] failed to reap stale user-desktop entry",N)})}let F=J.githubRepo??null,{entry:U}=await YB6({ctx:X,userId:G,orgId:Y.id,virtualMcpId:$.virtualMcpId,branch:$.branch,metadata:J,githubRepo:F,existing:null,providerKind:W,runner:K});return U}async function YB6($){let{ctx:X,userId:Y,orgId:G,virtualMcpId:Q,branch:J,metadata:Z,githubRepo:W,existing:K,runner:F}=$,{runtime:U,packageManager:B,port:N,packageManagerPath:w}=vJ6(Z),z;if(W){let{cloneUrl:f,gitUserName:l,gitUserEmail:c}=W.connectionId?await bJ6(W.connectionId,W.owner,W.name,X.db,X.vault):_J6(W.owner,W.name);if(!B){let b=W.connectionId?await gJ6(W.connectionId,W.owner,W.name,X.db,X.vault):await hJ6(W.owner,W.name);if(b)B=b.packageManager,U=aY1[b.packageManager].runtime,N=b.devPort??N,await wx8(X,Q,Y,b.packageManager,b.devPort)}z={cloneUrl:f,userName:l,userEmail:c,branch:J,displayName:`${W.owner}/${W.name}`}}let O=U&&B?{runtime:U,packageManager:B,...N!==null?{devPort:Number(N)}:{},...w?{packageManagerPath:w}:{}}:void 0,L=HM({orgId:G,virtualMcpId:Q,branch:J}),j=F.kind==="user-desktop"?await $B6(X.objectStorage,{isProduction:_4().nodeEnv==="production"}):null,P=await F.ensure({userId:Y,projectRef:L},{branch:J,repo:z,workload:O,tenant:{orgId:G,userId:Y},...j?{offloadAllowedHosts:j.hosts,offloadAllowSameHostDev:j.allowSameHostDev}:{}}),T=Z.runtime?.env??null;await KT1({ctx:X,runner:F,handle:P.handle,orgId:G,userId:Y,entries:T});let V=!!K&&K.sandboxHandle===P.handle&&K?.createdAt?K.createdAt:Date.now(),R=Z.runtime?.selected??null,v=Z.runtime?.port??null,S=Z.runtime?.path??null,_={sandboxHandle:P.handle,previewUrl:P.previewUrl,sandboxApiUrl:P.previewUrl,sandboxProviderKind:F.kind,createdAt:V,startedWith:{packageManager:R,port:v,path:S}};await kJ6(X.storage.virtualMcps,Q,Y,Y,J,$.providerKind,_);let y=!K||K.sandboxHandle!==P.handle;return{entry:_,isNewVm:y}}async function wx8($,X,Y,G,Q){let J=await $.storage.virtualMcps.findById(X);if(!J)return;let Z=J.metadata??{};await $.storage.virtualMcps.update(X,Y,{metadata:{...Z,runtime:{selected:G,port:Q}}})}var A20;var xg1=D(()=>{l1();RD();k0();WT1();Hq0();SD();fJ6();mJ6();SE0();Kq0();q71();XB6();F5();SD();A20=f1({name:"SANDBOX_START",description:"Start a sandbox with the connected GitHub repo and dev server.",annotations:{title:"Start VM Preview",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!1,openWorldHint:!0},_meta:{ui:{visibility:"app"}},inputSchema:H.object({virtualMcpId:H.string().describe("Virtual MCP ID"),branch:H.string().min(1).optional().describe("Optional git branch to check out. When omitted the handler generates `deco/<adjective>-<noun>` and uses it. The resolved branch is returned in the response so callers can persist it."),sandboxProviderKind:H.enum(["cluster","user-desktop"]).optional().describe("Explicit runtime choice. When omitted, defaults to `user-desktop` if the acting user's link daemon is online, else the cluster env kind.")}),outputSchema:H.object({previewUrl:H.string().nullable(),sandboxHandle:H.string(),branch:H.string(),isNewVm:H.boolean(),sandboxProviderKind:H.enum(["cluster","user-desktop"])}),handler:async($,X)=>{G0(X);let Y=$.branch??$21(),G=K6(X);if(!G)throw Error("User ID required");let{provider:Q,kind:J}=await yD(X,{userId:G,branch:Y,virtualMcpMetadata:null,explicitKind:$.sandboxProviderKind}),{metadata:Z,userId:W,organization:K,entry:F}=await ZT1({virtualMcpId:$.virtualMcpId,branch:Y,sandboxProviderKind:J},X),U=Z.githubRepo??null,{entry:B,isNewVm:N}=await YB6({ctx:X,userId:W,orgId:K.id,virtualMcpId:$.virtualMcpId,branch:Y,metadata:Z,githubRepo:U,existing:F,providerKind:J,runner:Q});return{...B,branch:Y,isNewVm:N,sandboxProviderKind:J}}})});var T20;var GB6=D(()=>{l1();k0();WT1();uh();SD();T20=f1({name:"SANDBOX_DELETE",description:"Delete a sandbox.",annotations:{title:"Delete VM Preview",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!0},_meta:{ui:{visibility:"app"}},inputSchema:H.object({virtualMcpId:H.string().describe("Virtual MCP ID that owns this VM"),branch:H.string().min(1).describe("Branch whose vm should be deleted (sandboxMap[userId][branch])"),sandboxProviderKind:H.enum(["cluster","user-desktop"]).describe("Kind of sandbox provider the VM was started with. Used to locate the correct 3-level sandboxMap entry.")}),outputSchema:H.object({success:H.boolean()}),handler:async($,X)=>{let Y=$.sandboxProviderKind,G;try{G=await ZT1($,X)}catch(W){if(W instanceof Error&&W.message==="Virtual MCP not found")return{success:!0};throw W}let{entry:Q,userId:J}=G;if(!Q)return{success:!0};return await Yt(X.storage.virtualMcps,$.virtualMcpId,J,J,$.branch,Y),await(await j71(X,Y)).delete(Q.sandboxHandle).catch((W)=>console.error(`[SANDBOX_DELETE] ${Y} ${Q.sandboxHandle}: ${W instanceof Error?W.message:String(W)}`)),{success:!0}}})});var QB6=D(()=>{xg1();GB6()});var Dx8="https://api.github.com",V20;var JB6=D(()=>{l1();k0();PP1();YP();V20=f1({name:"GITHUB_LIST_USER_ORGS",description:"List GitHub App installations (orgs/accounts) accessible to the authenticated user.",annotations:{title:"List GitHub User Orgs",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!0},_meta:{ui:{visibility:"app"}},inputSchema:H.object({connectionId:H.string().describe("ID of the mcp-github connection to use")}),outputSchema:H.object({installations:H.array(H.object({installationId:H.number(),login:H.string(),avatarUrl:H.string(),type:H.string()})),appSlug:H.string().optional()}),handler:async($,X)=>{await X.access.check();let Y=new dG(X.db,X.vault),G=await Y.get($.connectionId);if(!G)throw Error("No GitHub token found. Ensure the mcp-github connection is authenticated.");let Q=G.accessToken;if(I91(G)&&Y.isExpired(G,jP1)){let U=await R91(G,Y);if(!U)throw Error($V);Q=U,G=await Y.get($.connectionId)??G}let J=[],Z,W=1,K=100,F=async(U)=>fetch(`${Dx8}/user/installations?per_page=${K}&page=${W}`,{headers:{Authorization:`Bearer ${U}`,Accept:"application/vnd.github+json","X-GitHub-Api-Version":"2022-11-28"}});while(!0){let U=await F(Q);if(U.status===401){let N=await Y.get($.connectionId);if(!N||!I91(N))throw Error($V);let w=await R91(N,Y);if(!w)throw Error($V);if(Q=w,U=await F(Q),U.status===401)throw Error($V)}if(!U.ok)throw Error(`GitHub /user/installations failed: ${U.status}`);let B=await U.json();for(let N of B.installations){if(!Z)Z=N.app_slug??N.app?.slug;J.push({installationId:N.id,login:N.account.login,avatarUrl:N.account.avatar_url,type:N.account.type})}if(B.installations.length<K)break;W++}return{installations:J,...Z?{appSlug:Z}:{}}}})});var ZB6=D(()=>{JB6()});var M20,WB6,KB6,Lx8,Ex8,ypY;var I20=D(()=>{l1();M20=H.enum(["claude-code","codex","decopilot-sandbox","body-offload"]),WB6=H.array(H.string()).catch([]).transform(($)=>$.filter((X)=>M20.safeParse(X).success)),KB6=H.discriminatedUnion("type",[H.object({type:H.literal("ui-message-chunk"),chunk:H.unknown()}),H.object({type:H.literal("error"),code:H.string(),message:H.string()}),H.object({type:H.literal("done")})]),Lx8=H.record(H.string(),H.unknown()),Ex8=H.object({credentialId:H.string(),thinking:H.object({id:H.string(),title:H.string(),provider:H.string().optional()}),coding:H.object({id:H.string(),title:H.string()}).optional(),fast:H.object({id:H.string(),title:H.string()}).optional(),image:H.object({id:H.string(),title:H.string()}).optional(),deepResearch:H.object({id:H.string(),title:H.string()}).optional()}),ypY=H.object({threadId:H.string(),runId:H.string(),taskId:H.string(),resumeSessionRef:H.string().optional(),messages:H.array(Lx8),models:Ex8,mcp:H.object({url:H.string().url(),headers:H.record(H.string(),H.string()),expiresAt:H.number().int().positive()}),mode:H.string(),temperature:H.number(),toolApprovalLevel:H.string(),user:H.object({id:H.string(),email:H.string()}),organizationId:H.string(),organizationSlug:H.string().optional(),virtualMcp:H.record(H.string(),H.unknown()),agent:H.object({id:H.string()}),branch:H.string().nullable().optional(),triggerId:H.string().optional(),currentThreadTitle:H.string().optional(),traceparent:H.string().optional()}).strip()});var HB6=()=>{};var R20=D(()=>{HB6();I20()});var S20;var FB6=D(()=>{l1();R20();k0();S20=f1({name:"LINK_CURRENT_GET",description:"Return the calling user's currently registered desktop link, or `online: false` if no link is registered or the TTL has expired.",inputSchema:s1.object({}),outputSchema:s1.object({online:s1.boolean(),machineId:s1.string().optional(),hostname:s1.string().optional(),cliVersion:s1.string().optional(),capabilities:s1.array(M20).default([])}),handler:async($,X)=>{G0(X),await X.access.check();let Y=X.linkClaimRegistry;if(!Y)return{online:!1,capabilities:[]};let G=await Y.get(X.auth.user.id);if(!G)return{online:!1,capabilities:[]};return{online:!0,machineId:G.machineId,hostname:G.hostname,cliVersion:G.cliVersion,capabilities:G.capabilities}}})});var UB6=D(()=>{FB6()});function BB6($){if(!$)return"";return typeof $==="string"?$:$.toISOString()}var qx8,Ax8,Tx8,Vx8,Mx8,k20;var NB6=D(()=>{l1();k0();qx8=["thread"],Ax8=H.object({type:H.literal("thread"),id:H.string(),title:H.string(),created_at:H.string(),updated_at:H.string(),virtual_mcp_id:H.string().nullable(),run_config:H.record(H.string(),H.unknown()).nullable(),status:H.string().nullable()}),Tx8=H.discriminatedUnion("type",[Ax8]),Vx8=H.object({query:H.string().min(1).describe("Free-text search query."),limit:H.number().int().min(1).max(50).optional().describe("Maximum results per resource type (default: 20)."),types:H.array(H.enum(qx8)).optional().describe("Restrict the search to specific resource types. Omit to search across all available types.")}),Mx8=H.object({items:H.array(Tx8),totalCount:H.number()});k20=f1({name:"GLOBAL_SEARCH",description:"Search across organization resources by free-text query. Returns a typed union of matches (currently: threads). New resource types may be added over time without changes to the call shape.",annotations:{title:"Global Search",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:Vx8,outputSchema:Mx8,handler:async($,X)=>{await X.access.check(),r1(X);let Y=$.limit??20,G=$.types?.length?new Set($.types):null,Q=!G||G.has("thread"),J=[],Z=0;if(Q){let{threads:W,total:K}=await X.storage.threads.list(void 0,{limit:Y,offset:0,search:$.query,includeArchived:!1});Z+=K;for(let F of W)J.push({type:"thread",id:F.id,title:F.title??"",created_at:BB6(F.created_at),updated_at:BB6(F.updated_at),virtual_mcp_id:F.virtual_mcp_id??null,run_config:F.run_config??null,status:F.status??null})}return{items:J,totalCount:Z}}})});var wB6=D(()=>{NB6()});var tA1={};g6(tA1,{managementMCP:()=>mr,listManagementTools:()=>kx8,ALL_TOOLS:()=>zB6});async function kx8($){let X=await mr($),[Y,G]=c81.createLinkedPair();await X.connect(G);let Q=new AY({name:"tools-hydration",version:"1.0.0"});try{return await Q.connect(Y),(await Q.listTools()).tools}finally{await Q.close().catch(()=>{})}}var Rx8,Sx8,zB6,mr=async($)=>{let X=null;if($.organization){let Z=await $.storage.organizationSettings.get($.organization.id),W=await $.storage.virtualMcps.list($.organization.id),K=new Set(Z?.enabled_plugins??[]);for(let F of W){let U=F.metadata?.enabled_plugins;if(U&&Array.isArray(U))for(let B of U)K.add(B)}X=K.size>0?[...K]:null}let Y=Tm4(zB6,X),G=new vw({name:"mcp-cms-management",version:"1.0.0"},{capabilities:{tools:{},prompts:{},resources:{}}});for(let Z of Y){let W=Z.inputSchema&&typeof Z.inputSchema==="object"&&"shape"in Z.inputSchema?Z.inputSchema:H.object({}),K=Z.outputSchema&&typeof Z.outputSchema==="object"&&"shape"in Z.outputSchema?Z.outputSchema:void 0,F=W.shape,U=K?.shape;G.registerTool(Z.name,{description:Z.description??"",inputSchema:F,outputSchema:U,annotations:Z.annotations,_meta:Z._meta},async(B)=>{$.access.setToolName(Z.name);try{let N=await Z.execute(B,$);return{content:[{type:"text",text:Z.modelSummary?Z.modelSummary(N):JSON.stringify(N)}],structuredContent:N}}catch(N){return{content:[{type:"text",text:`Error: ${N.message}`}],isError:!0}}})}let Q=V21();for(let Z of Q){let W=Z.arguments?.length?Object.fromEntries(Z.arguments.map((K)=>{let F=K.required?H.string():H.string().optional();return[K.name,K.description?F.describe(K.description):F]})):void 0;G.registerPrompt(Z.name,{title:Z.title,description:Z.description,...W?{argsSchema:W}:{}},(K)=>{return{messages:[{role:"user",content:{type:"text",text:typeof Z.text==="function"?Z.text(K??{}):Z.text}}]}})}if($.organization?.id){let Z=await $.storage.brandContext.list($.organization.id),W=new Set;for(let K of Z){let F=K.name.toLowerCase().replace(/[^a-z0-9]+/g,"-").replace(/^-|-$/g,""),U=F?`brand-${F}`:`brand-${K.id}`;if(W.has(U))U=`${U}-${K.id.slice(0,8)}`;W.add(U);let B=[`# Brand: ${K.name}`,"",`**Domain:** ${K.domain}`,"","## Overview",K.overview];if(K.colors){let w=Object.entries(K.colors).filter(([,z])=>z);if(w.length>0){B.push("","## Colors");for(let[z,O]of w)B.push(`- **${z}:** ${O}`)}}if(K.fonts){let w=Object.entries(K.fonts).filter(([,z])=>z);if(w.length>0){B.push("","## Fonts");for(let[z,O]of w)B.push(`- ${O} (${z})`)}}if(K.logo)B.push("",`**Logo:** ${K.logo}`);if(K.favicon)B.push(`**Favicon:** ${K.favicon}`);if(K.ogImage)B.push(`**OG Image:** ${K.ogImage}`);if(K.images&&K.images.length>0){B.push("","## Images");for(let w of K.images){let z=Object.entries(w).map(([O,L])=>`${O}: ${L}`).join(", ");B.push(`- ${z}`)}}let N=B.join(`
 `);G.prompt(U,`Brand context for ${K.name}`,()=>({messages:[{role:"user",content:{type:"text",text:N}}]}))}}let J=w56();for(let Z of J)G.resource(Z.name,Z.uri,{description:Z.description,mimeType:Z.mimeType??"text/markdown"},async(W)=>{return{contents:[{uri:typeof W==="string"?W:W.href,mimeType:Z.mimeType??"text/markdown",text:Z.text}]}});return G};var fr=D(()=>{Gj1();hU();L01();l1();dm4();N$6();O$6();I$6();h$6();c$6();U86();O86();v86();H96();U96();_96();y96();i96();_j0();h56();RJ6();QB6();ZB6();UB6();wB6();Rx8=[$E0,XE0,YE0,GE0,QE0,JE0,ZE0,WE0,KE0,HE0,FE0,UE0,NE0,wE0,zE0,DE0,OE0,LE0,EE0,jE0,PE0,qE0,AE0,vN0,RL0,SL0,kL0,CL0,vL0,mL0,cL0,dL0,iL0,pL0,D$6,oL0,sL0,eL0,lU0,dU0,iU0,cU0,_L0,bL0,fL0,yL0,xL0,gL0,hL0,Zj0,kE0,CE0,vE0,_E0,bE0,fE0,TE0,VE0,ME0,IE0,RE0,yE0,xE0,gE0,$j0,Xj0,Yj0,Gj0,Qj0,Jj0,nL0,rL0,tL0,aL0,Wj0,Fj0,Uj0,Bj0,Nj0,wj0,zj0,Dj0,Oj0,Lj0,Ej0,jj0,Pj0,Aj0,Tj0,Vj0,Mj0,Ij0,Rj0,vj0,bj0,fj0,yj0,xj0,gj0,hj0,...IJ6,A20,T20,V20,S20,k20],Sx8=Vm4(),zB6=[...Rx8,...Sx8]});function Cx8($){return[{permissions:{self:["*"]},getTools:async()=>{let{ALL_TOOLS:X}=await Promise.resolve().then(() => (fr(),tA1));return X.map((Y)=>{return{name:Y.name,inputSchema:H.toJSONSchema(Y.inputSchema,{unrepresentable:"any"}),outputSchema:Y.outputSchema?H.toJSONSchema(Y.outputSchema,{unrepresentable:"any"}):void 0,description:Y.description}})},data:T50(aZ(),$)},{data:A50()},{data:q50($)}]}async function DB6($,X){try{let Y=q5(),G=_4(),Q=new DT(G.encryptionKey),J=new o$1(Y.db,Q),Z=Cx8($);await Promise.all(Z.map(async(W)=>{let K=null;if(W.permissions)K=(await Z5.api.createApiKey({body:{name:`${W.data.app_name??crypto.randomUUID()}-mcp`,userId:X,permissions:W.permissions,rateLimitEnabled:!1,metadata:{organization:{id:$},purpose:"default-org-connections"}}}))?.key;let F=await dE({id:"pending",title:W.data.title,connection_type:W.data.connection_type,connection_url:W.data.connection_url,connection_token:W.data.connection_token??K,connection_headers:W.data.connection_headers}).catch(()=>null),U=await W.getTools?.()??F?.tools??null,B=F?.scopes?.length?F.scopes:null,N=W.data.id?W.data.id.startsWith(`${$}_`)?W.data.id:`${$}_${W.data.id}`:void 0;await J.create({...W.data,id:N,tools:U,configuration_scopes:B,organization_id:$,created_by:X,connection_token:W.data.connection_token??K})}));try{await yH0({orgId:$,createdBy:X})}catch(W){console.error("Failed to enqueue studio pack install:",W)}if(G.aiGatewayEnabled&&G.studioProvisionSecretKey&&r$1.provisionKey)try{let W=await iE(X),K=await r$1.provisionKey(W,$);await new a$1(Y.db,Q).upsert({providerId:"deco",label:"Auto-provisioned",apiKey:K,organizationId:$,createdBy:X})}catch(W){console.error("Failed to auto-provision Deco AI Gateway key:",W)}}catch(Y){console.error("Error creating default MCP connections:",Y)}}var OB6=D(()=>{b$();KH0();kz();CB();nL1();FH0();UH0();Q81();l1();F5();VD();YE1();PT()});function vx8($,X){let Y=$.email.split("@")[1]?.toLowerCase()??null;return{distinctId:$.id,properties:{$set:{email:$.email,name:$.name,email_verified:$.emailVerified},$set_once:{first_seen_at:X.toISOString(),signup_email_domain:Y}}}}function C20($){E6.identify(vx8($,new Date))}var LB6=D(()=>{YX()});async function fx8($){let{user:X,token:Y}=$;if(!Y?.idToken)return;let G;try{G=U8(Y.idToken)}catch{return}let{preferred_username:Q,upn:J}=G,Z=[Q,J].filter((F)=>typeof F==="string"&&F.length>0&&F.toLowerCase()!==X.email.toLowerCase()).map((F)=>F.toLowerCase());if(Z.length===0)return;let{db:W}=q5(),K=await W.selectFrom("user").selectAll().where("email","in",Z).where("id","!=",X.id).executeTakeFirst();if(!K)return;try{await W.transaction().execute(async(F)=>{await p1`UPDATE "account" SET "userId" = ${K.id} WHERE "userId" = ${X.id}`.execute(F),await p1`UPDATE "session" SET "userId" = ${K.id} WHERE "userId" = ${X.id}`.execute(F),await p1`
         UPDATE "member" SET "userId" = ${K.id}
         WHERE "userId" = ${X.id}
@@ -3242,7 +3242,7 @@ Usage notes:
 - Built-in tools (user_ask, subtask, read_tool_output, read_prompt, read_resource, sandbox) are always available and do not need enabling.`,inputSchema:bc8,execute:async({tools:G})=>{let Q=[],J=[],Z=[];for(let W of G){if(!X.has(W)){J.push(W);continue}if(Y?.isPlanMode){if(Y.toolAnnotations?.get(W)?.readOnlyHint!==!0){Z.push(W);continue}}$.add(W),Q.push(W)}return{enabled:Q,...J.length>0&&{not_found:J},...Z.length>0&&{blocked:Z,blocked_reason:"These tools cannot be enabled in plan mode \u2014 they have side effects."}}}})}var bc8;var EO6=D(()=>{u9();l1();bc8=H.object({tools:H.array(H.string()).min(1).describe("Tool ids to enable, taken verbatim from <available-connections>.")})});function It($){if($ instanceof Error)return $.message;if(typeof $==="object"&&$!==null)try{return JSON.stringify($)}catch{return"[unserializable object]"}return String($)}function fc8($){let Y=$.split(/\.\s+/).filter((Q)=>!/https?:\/\//i.test(Q)&&!/openrouter/i.test(Q));if(Y.length===0)return $;let G=Y.join(". ").trim();return G.endsWith(".")?G:`${G}.`}function x71($){if($ instanceof Error){let X=$.statusCode,Y=$.message.toLowerCase();if(X===402||Y.includes("credit")||Y.includes("insufficient funds")||Y.includes("insufficient balance")||Y.includes("billing")||Y.includes("quota exceeded")||Y.includes("payment required"))return`[CREDITS] ${fc8($.message)}`;return $.message}return It($)}function yc8($,X){let Y=new Set;for(let G of $){if(G.role!=="assistant")continue;for(let Q of G.parts)if("toolName"in Q&&(Q.toolName==="enable_tool"||Q.toolName==="enable_tools")&&"result"in Q&&Q.result){let J=Q.result;if(Array.isArray(J.enabled))for(let Z of J.enabled){let W=Z.replace(/[^a-zA-Z0-9_]/g,"_");if(X.has(W))Y.add(W);else if(X.has(Z))Y.add(Z)}}}return Y}function xc8(){let $=[],X=!1,Y=null;return{push(G){if(X)return;if(Y){let Q=Y;Y=null,Q({done:!1,value:G})}else $.push(G)},next(){if($.length>0){let G=$.shift();return Promise.resolve({done:!1,value:G})}if(X)return Promise.resolve({done:!0});return new Promise((G)=>{Y=G})},close(){if(X=!0,Y){let G=Y;Y=null,G({done:!0})}}}}async function*jO6($,X,Y,G,Q){let{provider:J,titleProvider:Z,titleModel:W,registrySignal:K,processedSystemMessages:F,processedMessages:U,originalMessages:B,threadId:N,writer:w}=Q,z=y71($.mode,{isCliAgent:!1}),O,L=!1,j=xc8(),P=JSON.stringify(U[0]?.content??""),T=Pt({abortSignal:K,model:Uh1(Z??J,W??$.models.fast??$.models.thinking),userMessage:P}),I=T.promise.then((L1)=>{return L1?jt(L1):null}).catch((L1)=>{return console.warn("[decopilot:title] title generation failed",L1),null}),V=null,R=qt();O=Date.now();let v=new Set(Object.keys(Y.passthroughTools)),S=Object.keys(Y.builtInTools),_=yc8(B,v),y={...Y.tools,...Y.connectionsBlockTools.length>0?{enable_tool:LO6(_,v,{isPlanMode:z.isPlanMode,toolAnnotations:Y.toolAnnotations})}:{}},f=(()=>{let L1=z.forcedFirstStepTool&&z.forcedFirstStepTool in y?z.forcedFirstStepTool:null,A1=0;return(I1)=>{let H1=I1.messages,S1=A1===0;A1++;let c1=H1,X0=Q.pendingImages;if(X0.length>0){let n1=X0.splice(0,X0.length),T1=[];for(let C0 of n1)if(T1.push({type:"text",text:C0.label??(C0.pageUrl?`[Screenshot of ${C0.pageUrl}]`:"[Image]")}),C0.url.startsWith("data:")){let e1=C0.url.match(/^data:([^;]+);base64,(.+)$/s);if(e1)T1.push({type:"image",image:e1[2],mimeType:e1[1]})}else T1.push({type:"image",image:new URL(C0.url)});c1=[...H1,{role:"user",content:T1}]}let w1=c1,N1=Y.connectionsBlockTools.length>0,D1=[...S,...N1?["enable_tool"]:[],..._];if(z.isPlanMode)D1=D1.filter((n1)=>{if(S.includes(n1)||N1&&n1==="enable_tool")return!0;return Y.toolAnnotations.get(n1)?.readOnlyHint===!0});let U1=L1&&S1?L1:null;return{activeTools:D1,messages:w1,...U1&&{toolChoice:{type:"tool",toolName:U1}}}}})(),l=_.size>0?{role:"system",content:`<currently-enabled-tools>
 ${[..._].sort().join(`
 `)}
-</currently-enabled-tools>`}:null,c=$.virtualMcp.metadata,b=await wh1({kind:"agent",ctx:X,organization:{id:$.organizationId},virtualMcp:{id:$.agent.id,repo:c?.githubRepo??void 0},mcpClient:Y.passthroughClient,provider:J,models:$.models,messages:U,abortSignal:K,temperature:$.temperature,planMode:z.isPlanMode,isDecopilot:UK($.agent.id)!==null,systemAgentInstructions:Y.serverInstructions,currentThreadId:N,writer:w,subtaskParams:{provider:J,organization:{id:$.organizationId},models:$.models},prepareStep:f,passthroughClient:Y.passthroughClient,connectionsData:{tools:Y.connectionsBlockTools,connectionTitleMap:Y.connectionTitleMap},extraTools:{...Y.builtInTools,...Y.connectionsBlockTools.length>0&&y.enable_tool?{enable_tool:y.enable_tool}:{}},additionalSystemMessages:[...F,...l?[l]:[]]}),d=b.result;Promise.resolve(d.finishReason).then(async(L1)=>{let[A1,I1,H1,S1]=await Promise.all([d.totalUsage,d.usage,d.request,d.response]);if(await b.error!==void 0)return;b.span.setAttribute("decopilot.llm.inputTokens",A1.inputTokens??0),b.span.setAttribute("decopilot.llm.outputTokens",A1.outputTokens??0),b.span.setAttribute("decopilot.llm.finishReason",L1);let X0=R.cacheTotals();b.span.setAttribute("decopilot.cache.read_tokens",X0.read),b.span.setAttribute("decopilot.cache.write_tokens",X0.write);let w1=X0.input>0?X0.read/X0.input:0;b.span.setAttribute("decopilot.cache.hit_ratio",w1);let N1=Date.now()-(O??Date.now());if(L=!0,Dh1({ctx:X,organizationId:$.organizationId,modelId:$.models.thinking.id,durationMs:N1,isError:!1,inputTokens:A1.inputTokens,outputTokens:A1.outputTokens,cacheReadTokens:X0.read,cacheWriteTokens:X0.write}),Q.onUsageAggregated({inputTokens:A1.inputTokens??0,outputTokens:A1.outputTokens??0,totalTokens:A1.totalTokens??0}),zh1({ctx:X,organizationId:$.organizationId,agentId:$.agent.id,modelId:$.models.thinking.id,modelTitle:$.models.thinking.title??$.models.thinking.id,credentialId:$.models.credentialId,taskId:N,durationMs:N1,isError:!1,finishReason:L1,usage:{inputTokens:I1.inputTokens??0,outputTokens:I1.outputTokens??0,totalTokens:I1.totalTokens??0},totalUsage:{inputTokens:A1.inputTokens??0,outputTokens:A1.outputTokens??0,totalTokens:A1.totalTokens??0},request:H1,response:S1,userId:$.user.id,requestId:X.metadata.requestId,userAgent:X.metadata.userAgent??null}),K.aborted)return}).catch(async(L1)=>{let A1=L1 instanceof Error?L1:Error(It(L1));if(console.error("[decopilot:stream] Error",A1),K.aborted)return;if(!L){let I1=Date.now()-(O??Date.now());L=!0,Dh1({ctx:X,organizationId:$.organizationId,modelId:$.models.thinking.id,durationMs:I1,isError:!0,errorType:A1.name}),zh1({ctx:X,organizationId:$.organizationId,agentId:$.agent.id,modelId:$.models.thinking.id,modelTitle:$.models.thinking.title??$.models.thinking.id,credentialId:$.models.credentialId,taskId:N,durationMs:I1,isError:!0,errorMessage:A1.message,userId:$.user.id,requestId:X.metadata.requestId,userAgent:X.metadata.userAgent??null})}}),b.error.then(async(L1)=>{if(!K.aborted||L)return;let A1=await d.steps;if(!A1.length||L)return;L=!0;let I1=Date.now()-(O??Date.now()),H1=A1.reduce((X0,w1)=>({inputTokens:X0.inputTokens+(w1.usage.inputTokens??0),outputTokens:X0.outputTokens+(w1.usage.outputTokens??0),totalTokens:X0.totalTokens+(w1.usage.totalTokens??0)}),{inputTokens:0,outputTokens:0,totalTokens:0}),S1=A1[A1.length-1].usage,c1=R.cacheTotals();if(Dh1({ctx:X,organizationId:$.organizationId,modelId:$.models.thinking.id,durationMs:I1,isError:!1,inputTokens:H1.inputTokens,outputTokens:H1.outputTokens,cacheReadTokens:c1.read,cacheWriteTokens:c1.write}),zh1({ctx:X,organizationId:$.organizationId,agentId:$.agent.id,modelId:$.models.thinking.id,modelTitle:$.models.thinking.title??$.models.thinking.id,credentialId:$.models.credentialId,taskId:N,durationMs:I1,isError:!1,finishReason:"abort",usage:{inputTokens:S1.inputTokens??0,outputTokens:S1.outputTokens??0,totalTokens:S1.totalTokens??0},totalUsage:H1,request:void 0,response:void 0,userId:$.user.id,requestId:X.metadata.requestId,userAgent:X.metadata.userAgent??null}),H1.totalTokens>0){let X0=R.cost();j.push({type:"message-metadata",messageMetadata:{usage:{inputTokens:H1.inputTokens,outputTokens:H1.outputTokens,totalTokens:H1.totalTokens,cachedInputTokens:c1.read,inputTokenDetails:{cacheReadTokens:c1.read,cacheWriteTokens:c1.write,noCacheTokens:H1.inputTokens-c1.read-c1.write},...X0>0&&{providerMetadata:{openrouter:{usage:{cost:X0}}}}}}})}});let e=d.toUIMessageStream({originalMessages:B,generateMessageId:bq1,onError:(L1)=>x71(L1),messageMetadata:({part:L1})=>{if(L1.type==="start")return{agent:{id:$.agent.id??null},models:{credentialId:$.models.credentialId,thinking:{...$.models.thinking,title:$.models.thinking.title??$.models.thinking.id,provider:$.models.thinking.provider??void 0}},created_at:new Date,_request:{systemSections:G.systemMessages.map((A1)=>({chars:A1.content.length,preview:A1.content.slice(0,80).replace(/\s+/g," ")})),tools:Object.keys(y).length,activeTools:S.length+("enable_tool"in y?1:0)+_.size},thread_id:N};if(L1.type==="reasoning-start"){if(V===null)V=new Date;return{reasoning_start_at:V}}if(L1.type==="reasoning-end")return{reasoning_end_at:new Date};if(L1.type==="finish-step")return R.addStep(L1.usage,L1.providerMetadata),{usage:R.buildStepUsage()};if(L1.type==="finish"){let A1=R.buildFinalUsage({totalUsage:L1.totalUsage,providerKey:$.models.thinking.provider,fallbackProviderMetadata:L1.providerMetadata});return A1?{usage:A1}:{}}return}})[Symbol.asyncIterator](),W1=!1,$1=!1,K1=e.next().then((L1)=>({kind:"main",value:L1})),Z1=j.next().then((L1)=>({kind:"queue",value:L1})),O1=I.then((L1)=>({kind:"title",value:L1}));try{while(!0){if(W1&&$1){j.close();while(!0){let I1=await j.next();if(I1.done)break;yield I1.value}break}let L1=[Z1];if(!W1)L1.push(K1);if(!$1)L1.push(O1);let A1=await Promise.race(L1);if(A1.kind==="main"){if(A1.value.done){if(W1=!0,!$1)T.finish();continue}yield A1.value.value,K1=e.next().then((I1)=>({kind:"main",value:I1}))}else if(A1.kind==="title"){if($1=!0,A1.value)yield A1.value}else{if(!A1.value.done)yield A1.value.value;Z1=j.next().then((I1)=>({kind:"queue",value:I1}))}}}finally{if(!$1)T.finish();j.close()}}var PO6=D(()=>{DO6();OO6();EO6();Qh1();nK();Nh1();Gh1();nT0();b$()});var qO6;var AO6=D(()=>{ng1();nK();zO6();iT0();PO6();J81();qO6={id:"decopilot",create($){if(!("storage"in $)||!("db"in $))throw Error("decopilot harness requires MeshContext (cluster-side only); got narrow HarnessContext");let X=$;return{id:"decopilot",async*stream(Y){let G=Y.processLocal,Q=Y;if(!G)throw Error("Decopilot harness requires HarnessStreamInput.processLocal in this build. Remote dispatch is not yet supported.");if(!G.provider)throw Error("Decopilot harness requires processLocal.provider to be activated.");let J=eL1(Y.agent.id),Z=Y;if(J){let K=await Ny4(J,{orgId:X.organization.id,ctx:X}),F=Q.virtualMcp,U=K.selectedTools?[...K.selectedTools]:null;Z={...Y,virtualMcp:{...F,metadata:{...F.metadata??{},instructions:K.instructions},connections:F.connections.map((B)=>({...B,selected_tools:U}))}}}let W=await wO6(Z,X,{writer:G.writer,toolOutputMap:G.toolOutputMap,pendingImages:G.pendingImages,threadId:G.threadId,provider:G.provider,imageProvider:G.imageProvider??G.provider,deepResearchProvider:G.deepResearchProvider??G.provider,htmlPageBuffer:G.htmlPageBuffer});try{let{systemMessages:K,messages:F,originalMessages:U}=await qN6(Q.messages,{windowSize:uj,models:Y.models,tools:W.tools}),B=F,N=await lD6(Z,X,W);yield*jO6(Z,X,W,N,{provider:G.provider,titleProvider:G.titleProvider??G.provider,titleModel:G.titleModel??Y.models.fast??Y.models.thinking,registrySignal:G.registrySignal,runRegistry:G.runRegistry,processedSystemMessages:K,processedMessages:B,originalMessages:U,threadId:G.threadId,currentThreadTitle:G.currentThreadTitle,registerPendingOp:G.registerPendingOp,isStreamFinished:G.isStreamFinished,onUsageAggregated:G.onUsageAggregated,pendingImages:G.pendingImages,onTitleUpdated:G.onTitleUpdated,writer:G.writer})}finally{await W.close().catch(()=>{})}}}}}});function Oh1($){TO6.set($.id,$)}function VO6($){return TO6.get($)}var TO6;var eT0=D(()=>{TO6=new Map});function $V0($,X,Y){let G=VO6($);if(!G)throw Error(`No harness factory registered for id "${$}". Available ids must be registered in apps/mesh/src/harnesses/index.ts.`);return G.create(Y).stream(X)}var MO6=D(()=>{eT0()});var IO6=D(()=>{Uz6();KD6();AO6();eT0();MO6();Oh1(qO6);Oh1(Fz6);Oh1(WD6)});function RO6($,X,Y){let G=X-Y;if(G<=0)throw Error("frame overhead exceeds maxBytes");let Q=Math.max(1,Math.floor(G/6));if($.length<=Q)return[$];let J=[],Z=0;while(Z<$.length){let W=Math.min(Z+Q,$.length);if(W<$.length){let K=$.charCodeAt(W-1);if(K>=55296&&K<=56319)W-=1}if(W<=Z)W=Z+1;J.push($.slice(Z,W)),Z=W}return J}var VN=786432;function Lh1($){return`link-dispatch/${$}`}function SO6($){return $>VN}async function kO6($){let X=await crypto.subtle.digest("SHA-256",$);return Array.from(new Uint8Array(X)).map((Y)=>Y.toString(16).padStart(2,"0")).join("")}var XV0=()=>{};function CO6($,X,Y,G){let{signal:Q,processLocal:J,...Z}=X;return{async*[Symbol.asyncIterator](){let W=function*(U){let B=U.split(`
+</currently-enabled-tools>`}:null,c=$.virtualMcp.metadata,b=await wh1({kind:"agent",ctx:X,organization:{id:$.organizationId},virtualMcp:{id:$.agent.id,repo:c?.githubRepo??void 0},mcpClient:Y.passthroughClient,provider:J,models:$.models,messages:U,abortSignal:K,temperature:$.temperature,planMode:z.isPlanMode,isDecopilot:UK($.agent.id)!==null,systemAgentInstructions:Y.serverInstructions,currentThreadId:N,writer:w,subtaskParams:{provider:J,organization:{id:$.organizationId},models:$.models},prepareStep:f,passthroughClient:Y.passthroughClient,connectionsData:{tools:Y.connectionsBlockTools,connectionTitleMap:Y.connectionTitleMap},extraTools:{...Y.builtInTools,...Y.connectionsBlockTools.length>0&&y.enable_tool?{enable_tool:y.enable_tool}:{}},additionalSystemMessages:[...F,...l?[l]:[]]}),d=b.result;Promise.resolve(d.finishReason).then(async(L1)=>{let[A1,I1,H1,S1]=await Promise.all([d.totalUsage,d.usage,d.request,d.response]);if(await b.error!==void 0)return;b.span.setAttribute("decopilot.llm.inputTokens",A1.inputTokens??0),b.span.setAttribute("decopilot.llm.outputTokens",A1.outputTokens??0),b.span.setAttribute("decopilot.llm.finishReason",L1);let X0=R.cacheTotals();b.span.setAttribute("decopilot.cache.read_tokens",X0.read),b.span.setAttribute("decopilot.cache.write_tokens",X0.write);let w1=X0.input>0?X0.read/X0.input:0;b.span.setAttribute("decopilot.cache.hit_ratio",w1);let N1=Date.now()-(O??Date.now());if(L=!0,Dh1({ctx:X,organizationId:$.organizationId,modelId:$.models.thinking.id,durationMs:N1,isError:!1,inputTokens:A1.inputTokens,outputTokens:A1.outputTokens,cacheReadTokens:X0.read,cacheWriteTokens:X0.write}),Q.onUsageAggregated({inputTokens:A1.inputTokens??0,outputTokens:A1.outputTokens??0,totalTokens:A1.totalTokens??0}),zh1({ctx:X,organizationId:$.organizationId,agentId:$.agent.id,modelId:$.models.thinking.id,modelTitle:$.models.thinking.title??$.models.thinking.id,credentialId:$.models.credentialId,taskId:N,durationMs:N1,isError:!1,finishReason:L1,usage:{inputTokens:I1.inputTokens??0,outputTokens:I1.outputTokens??0,totalTokens:I1.totalTokens??0},totalUsage:{inputTokens:A1.inputTokens??0,outputTokens:A1.outputTokens??0,totalTokens:A1.totalTokens??0},request:H1,response:S1,userId:$.user.id,requestId:X.metadata.requestId,userAgent:X.metadata.userAgent??null}),K.aborted)return}).catch(async(L1)=>{let A1=L1 instanceof Error?L1:Error(It(L1));if(console.error("[decopilot:stream] Error",A1),K.aborted)return;if(!L){let I1=Date.now()-(O??Date.now());L=!0,Dh1({ctx:X,organizationId:$.organizationId,modelId:$.models.thinking.id,durationMs:I1,isError:!0,errorType:A1.name}),zh1({ctx:X,organizationId:$.organizationId,agentId:$.agent.id,modelId:$.models.thinking.id,modelTitle:$.models.thinking.title??$.models.thinking.id,credentialId:$.models.credentialId,taskId:N,durationMs:I1,isError:!0,errorMessage:A1.message,userId:$.user.id,requestId:X.metadata.requestId,userAgent:X.metadata.userAgent??null})}}),b.error.then(async(L1)=>{if(!K.aborted||L)return;let A1=await d.steps;if(!A1.length||L)return;L=!0;let I1=Date.now()-(O??Date.now()),H1=A1.reduce((X0,w1)=>({inputTokens:X0.inputTokens+(w1.usage.inputTokens??0),outputTokens:X0.outputTokens+(w1.usage.outputTokens??0),totalTokens:X0.totalTokens+(w1.usage.totalTokens??0)}),{inputTokens:0,outputTokens:0,totalTokens:0}),S1=A1[A1.length-1].usage,c1=R.cacheTotals();if(Dh1({ctx:X,organizationId:$.organizationId,modelId:$.models.thinking.id,durationMs:I1,isError:!1,inputTokens:H1.inputTokens,outputTokens:H1.outputTokens,cacheReadTokens:c1.read,cacheWriteTokens:c1.write}),zh1({ctx:X,organizationId:$.organizationId,agentId:$.agent.id,modelId:$.models.thinking.id,modelTitle:$.models.thinking.title??$.models.thinking.id,credentialId:$.models.credentialId,taskId:N,durationMs:I1,isError:!1,finishReason:"abort",usage:{inputTokens:S1.inputTokens??0,outputTokens:S1.outputTokens??0,totalTokens:S1.totalTokens??0},totalUsage:H1,request:void 0,response:void 0,userId:$.user.id,requestId:X.metadata.requestId,userAgent:X.metadata.userAgent??null}),H1.totalTokens>0){let X0=R.cost();j.push({type:"message-metadata",messageMetadata:{usage:{inputTokens:H1.inputTokens,outputTokens:H1.outputTokens,totalTokens:H1.totalTokens,cachedInputTokens:c1.read,inputTokenDetails:{cacheReadTokens:c1.read,cacheWriteTokens:c1.write,noCacheTokens:H1.inputTokens-c1.read-c1.write},...X0>0&&{providerMetadata:{openrouter:{usage:{cost:X0}}}}}}})}});let e=d.toUIMessageStream({originalMessages:B,generateMessageId:bq1,onError:(L1)=>x71(L1),messageMetadata:({part:L1})=>{if(L1.type==="start")return{agent:{id:$.agent.id??null},models:{credentialId:$.models.credentialId,thinking:{...$.models.thinking,title:$.models.thinking.title??$.models.thinking.id,provider:$.models.thinking.provider??void 0}},created_at:new Date,_request:{systemSections:G.systemMessages.map((A1)=>({chars:A1.content.length,preview:A1.content.slice(0,80).replace(/\s+/g," ")})),tools:Object.keys(y).length,activeTools:S.length+("enable_tool"in y?1:0)+_.size},thread_id:N};if(L1.type==="reasoning-start"){if(V===null)V=new Date;return{reasoning_start_at:V}}if(L1.type==="reasoning-end")return{reasoning_end_at:new Date};if(L1.type==="finish-step")return R.addStep(L1.usage,L1.providerMetadata),{usage:R.buildStepUsage()};if(L1.type==="finish"){let A1=R.buildFinalUsage({totalUsage:L1.totalUsage,providerKey:$.models.thinking.provider,fallbackProviderMetadata:L1.providerMetadata});return A1?{usage:A1}:{}}return}})[Symbol.asyncIterator](),W1=!1,$1=!1,K1=e.next().then((L1)=>({kind:"main",value:L1})),Z1=j.next().then((L1)=>({kind:"queue",value:L1})),O1=I.then((L1)=>({kind:"title",value:L1}));try{while(!0){if(W1&&$1){j.close();while(!0){let I1=await j.next();if(I1.done)break;yield I1.value}break}let L1=[Z1];if(!W1)L1.push(K1);if(!$1)L1.push(O1);let A1=await Promise.race(L1);if(A1.kind==="main"){if(A1.value.done){if(W1=!0,!$1)T.finish();continue}yield A1.value.value,K1=e.next().then((I1)=>({kind:"main",value:I1}))}else if(A1.kind==="title"){if($1=!0,A1.value)yield A1.value}else{if(!A1.value.done)yield A1.value.value;Z1=j.next().then((I1)=>({kind:"queue",value:I1}))}}}finally{if(!$1)T.finish();j.close()}}var PO6=D(()=>{DO6();OO6();EO6();Qh1();nK();Nh1();Gh1();nT0();b$()});var qO6;var AO6=D(()=>{ng1();nK();zO6();iT0();PO6();J81();qO6={id:"decopilot",create($){if(!("storage"in $)||!("db"in $))throw Error("decopilot harness requires StudioContext (cluster-side only); got narrow HarnessContext");let X=$;return{id:"decopilot",async*stream(Y){let G=Y.processLocal,Q=Y;if(!G)throw Error("Decopilot harness requires HarnessStreamInput.processLocal in this build. Remote dispatch is not yet supported.");if(!G.provider)throw Error("Decopilot harness requires processLocal.provider to be activated.");let J=eL1(Y.agent.id),Z=Y;if(J){let K=await Ny4(J,{orgId:X.organization.id,ctx:X}),F=Q.virtualMcp,U=K.selectedTools?[...K.selectedTools]:null;Z={...Y,virtualMcp:{...F,metadata:{...F.metadata??{},instructions:K.instructions},connections:F.connections.map((B)=>({...B,selected_tools:U}))}}}let W=await wO6(Z,X,{writer:G.writer,toolOutputMap:G.toolOutputMap,pendingImages:G.pendingImages,threadId:G.threadId,provider:G.provider,imageProvider:G.imageProvider??G.provider,deepResearchProvider:G.deepResearchProvider??G.provider,htmlPageBuffer:G.htmlPageBuffer});try{let{systemMessages:K,messages:F,originalMessages:U}=await qN6(Q.messages,{windowSize:uj,models:Y.models,tools:W.tools}),B=F,N=await lD6(Z,X,W);yield*jO6(Z,X,W,N,{provider:G.provider,titleProvider:G.titleProvider??G.provider,titleModel:G.titleModel??Y.models.fast??Y.models.thinking,registrySignal:G.registrySignal,runRegistry:G.runRegistry,processedSystemMessages:K,processedMessages:B,originalMessages:U,threadId:G.threadId,currentThreadTitle:G.currentThreadTitle,registerPendingOp:G.registerPendingOp,isStreamFinished:G.isStreamFinished,onUsageAggregated:G.onUsageAggregated,pendingImages:G.pendingImages,onTitleUpdated:G.onTitleUpdated,writer:G.writer})}finally{await W.close().catch(()=>{})}}}}}});function Oh1($){TO6.set($.id,$)}function VO6($){return TO6.get($)}var TO6;var eT0=D(()=>{TO6=new Map});function $V0($,X,Y){let G=VO6($);if(!G)throw Error(`No harness factory registered for id "${$}". Available ids must be registered in apps/mesh/src/harnesses/index.ts.`);return G.create(Y).stream(X)}var MO6=D(()=>{eT0()});var IO6=D(()=>{Uz6();KD6();AO6();eT0();MO6();Oh1(qO6);Oh1(Fz6);Oh1(WD6)});function RO6($,X,Y){let G=X-Y;if(G<=0)throw Error("frame overhead exceeds maxBytes");let Q=Math.max(1,Math.floor(G/6));if($.length<=Q)return[$];let J=[],Z=0;while(Z<$.length){let W=Math.min(Z+Q,$.length);if(W<$.length){let K=$.charCodeAt(W-1);if(K>=55296&&K<=56319)W-=1}if(W<=Z)W=Z+1;J.push($.slice(Z,W)),Z=W}return J}var VN=786432;function Lh1($){return`link-dispatch/${$}`}function SO6($){return $>VN}async function kO6($){let X=await crypto.subtle.digest("SHA-256",$);return Array.from(new Uint8Array(X)).map((Y)=>Y.toString(16).padStart(2,"0")).join("")}var XV0=()=>{};function CO6($,X,Y,G){let{signal:Q,processLocal:J,...Z}=X;return{async*[Symbol.asyncIterator](){let W=function*(U){let B=U.split(`
 `).filter((z)=>z.startsWith("data: ")).map((z)=>z.slice(6));if(B.length===0)return;let N;try{N=JSON.parse(B.join(`
 `))}catch{return}let w=KB6.safeParse(N);if(!w.success)return;if(w.data.type==="ui-message-chunk")yield w.data.chunk;else if(w.data.type==="error")throw Error(`[remoteDispatch] ${w.data.code}: ${w.data.message}`)},K=null,F=!1;try{let U=JSON.stringify({harnessId:$,input:Z}),B=U;if(SO6(Buffer.byteLength(U,"utf8"))){if(!G.offload?.supported)throw Error("[remoteDispatch] request too large and the remote sandbox cannot receive offloaded payloads (daemon too old or no object storage configured)");let P=crypto.randomUUID(),T=await G.offload.put(P,JSON.stringify(Z.messages));K=Lh1(P),B=JSON.stringify({harnessId:$,input:{...Z,messages:[]},messagesRef:T})}let N=await G.proxyDaemonRequest(Y,"/dispatch",{method:"POST",headers:{"content-type":"application/json",accept:"text/event-stream"},body:B,signal:Q});if(!N.ok){let P=`dispatch failed (${N.status})`;try{let T=await N.json();if(T&&typeof T==="object"&&"error"in T&&T.error)P=String(T.error)}catch{}throw Error(`[remoteDispatch] ${P}`)}let w=N.body;if(!w)throw Error("[remoteDispatch] response body is null");let z=w.getReader(),O=new TextDecoder,L="";while(!0){let{value:P,done:T}=await z.read();if(T)break;L+=O.decode(P,{stream:!0});let I=L.indexOf(`
 
@@ -3302,7 +3302,7 @@ ${Q}`:G}}catch{let Y=X.split(`
 Return ONLY valid JSON with this shape:
 {"title":"Short imperative commit title (max 72 chars)","body":"1-3 sentence PR description explaining what changed and why"}
 
-Use sentence case for the title. No markdown fences.`;var KP6=D(()=>{u9();LY1()});function A19($){if(!$||$.length>255||$.includes("..")||$.startsWith("/")||$.endsWith("/")||$.endsWith(".lock")||!q19.test($))throw Error(`Invalid branch name: ${$}`)}function mM0($){let{runner:X}=$.get("vmClaim");if(!X)return $.json({error:"No sandbox runner configured"},503);return X}async function JZ($,X,Y){let G=mM0($);if(G instanceof Response)return G;let{claimName:Q}=$.get("vmClaim"),J=Y?.method??"POST",Z=null,W=new Headers;if(Y?.forwardJsonBody)Z=await $.req.text(),W.set("content-type","application/json");let K;try{K=await G.proxyDaemonRequest(Q,X,{method:J,headers:W,body:Z,...Y?.signal?{signal:Y.signal}:{}})}catch(B){let N=B instanceof Error?B.message:String(B);return $.json({error:`Daemon unreachable: ${N}`},502)}if(Y?.map404to410&&K.status===404){try{await K.body?.cancel()}catch{}return $.json({error:"Sandbox handle is gone. The sandbox needs to be re-provisioned."},410,dt)}let F=await K.text(),U=K.headers.get("content-type")??"application/json";return new Response(F,{status:K.status,headers:{"content-type":U,...dt}})}async function HP6($,X,Y,G="GET"){let Q=await $.proxyDaemonRequest(X,Y,{method:G,headers:new Headers,body:null});if(Q.status===404){try{await Q.body?.cancel()}catch{}throw Error("SANDBOX_GONE")}let J=await Q.text();if(!Q.ok)try{let Z=JSON.parse(J);throw Error(Z.error??`Daemon error (${Q.status})`)}catch(Z){if(Z instanceof Error&&Z.message!==J)throw Z;throw Error(`Daemon error (${Q.status})`)}return JSON.parse(J)}function I19($){return FP6.includes($)}var q19,T19=524288,V19,dt,M19,FP6,UP6=()=>{let $=new u4;return $.use("/:virtualMcpId/:branch/*",V19),$.post("/:virtualMcpId/:branch/write",(X)=>JZ(X,"/_sandbox/write",{forwardJsonBody:!0})),$.post("/:virtualMcpId/:branch/unlink",(X)=>JZ(X,"/_sandbox/unlink",{forwardJsonBody:!0})),$.post("/:virtualMcpId/:branch/read",(X)=>JZ(X,"/_sandbox/read",{forwardJsonBody:!0})),$.post("/:virtualMcpId/:branch/glob",(X)=>JZ(X,"/_sandbox/glob",{forwardJsonBody:!0})),$.post("/:virtualMcpId/:branch/exec/:script",(X)=>{let Y=X.req.param("script");if(!Y)return X.json({error:"missing script name"},400);return JZ(X,`/_sandbox/exec/${encodeURIComponent(Y)}`)}),$.post("/:virtualMcpId/:branch/exec/:script/kill",(X)=>{let Y=X.req.param("script");if(!Y)return X.json({error:"missing script name"},400);return JZ(X,`/_sandbox/exec/${encodeURIComponent(Y)}/kill`)}),$.get("/:virtualMcpId/:branch/config",(X)=>JZ(X,"/_sandbox/config",{method:"GET",map404to410:!0})),$.put("/:virtualMcpId/:branch/config",(X)=>JZ(X,"/_sandbox/config",{method:"PUT",forwardJsonBody:!0,map404to410:!0})),$.post("/:virtualMcpId/:branch/setup/:step",async(X)=>{let Y=X.req.param("step");if(!Y||!I19(Y))return X.json({error:`step must be one of: ${FP6.join(", ")}`},400);if(Y==="start"){let G=X.get("vmClaim");if(G.runner){let Q=r1(X.var.meshContext),J=CJ6(G.virtualMcpMetadata);try{await KT1({ctx:X.var.meshContext,runner:G.runner,handle:G.claimName,orgId:Q.id,userId:G.userId,entries:J})}catch(Z){let W=Z instanceof Error?Z.message:String(Z);return X.json({error:`Failed to push env to daemon: ${W}`},502)}}}return JZ(X,`/_sandbox/setup/${Y}`,{signal:X.req.raw.signal,map404to410:!0})}),$.get("/:virtualMcpId/:branch/events",(X)=>{let Y=X.get("vmClaim");if(!Y.runner)return HH(X,async(G)=>{await G.writeSSE({event:"phase",data:JSON.stringify({kind:"failed",reason:"unknown",message:"No sandbox runner configured on this mesh."})})});return YP6(X,{ctx:X.var.meshContext,claimName:Y.claimName,runner:Y.runner,branch:Y.branch,userId:Y.userId,projectRef:Y.projectRef,virtualMcpMetadata:Y.virtualMcpMetadata})}),$.get("/:virtualMcpId/:branch/git/status",(X)=>JZ(X,"/_sandbox/git/status",{method:"GET",map404to410:!0})),$.post("/:virtualMcpId/:branch/git/status",(X)=>JZ(X,"/_sandbox/git/status",{map404to410:!0})),$.post("/:virtualMcpId/:branch/git/diff",(X)=>JZ(X,"/_sandbox/git/diff",{forwardJsonBody:!0,map404to410:!0})),$.post("/:virtualMcpId/:branch/git/publish",(X)=>JZ(X,"/_sandbox/git/publish",{forwardJsonBody:!0,map404to410:!0})),$.post("/:virtualMcpId/:branch/git/discard",(X)=>JZ(X,"/_sandbox/git/discard",{forwardJsonBody:!0,map404to410:!0})),$.post("/:virtualMcpId/:branch/git/rebase",(X)=>JZ(X,"/_sandbox/git/rebase",{forwardJsonBody:!0,map404to410:!0})),$.post("/:virtualMcpId/:branch/git/suggest-commit",fP({maxSize:T19,onError:(X)=>X.json({error:"Payload too large"},413,dt)}),async(X)=>{let Y=mM0(X);if(Y instanceof Response)return Y;let{claimName:G}=X.get("vmClaim"),Q=X.var.meshContext;try{let[J,Z]=await Promise.all([HP6(Y,G,"/_sandbox/git/status","GET"),HP6(Y,G,"/_sandbox/git/diff","GET")]),W=await WP6(Q,J,Z);return X.json(W,200,dt)}catch(J){let Z=J instanceof Error?J.message:String(J);if(Z==="SANDBOX_GONE")return X.json({error:"Sandbox handle is gone. The sandbox needs to be re-provisioned."},410,dt);return X.json({error:Z},502,dt)}}),$.get("/:virtualMcpId/:branch/preview-fetch",async(X)=>{let Y=mM0(X);if(Y instanceof Response)return Y;let{claimName:G}=X.get("vmClaim"),Q=X.req.query("path");if(!Q)return X.json({error:"path query parameter is required"},400);if(!M19.has(Q))return X.json({error:"Path not allowed"},403);let J=await Y.getPreviewUrl(G);if(!J)return X.json({error:"Preview not available"},502);let Z=J.replace(/\/+$/,""),W;try{W=await fetch(`${Z}${Q}`)}catch{return X.json({error:"Preview unreachable"},502)}let K=await W.text();return new Response(K,{status:W.status,headers:{"content-type":W.headers.get("content-type")??"application/json"}})}),$};var BP6=D(()=>{c5();h71();Gu();ej6();RD();hM0();q71();GP6();Hq0();WT1();KP6();q19=/^[a-zA-Z0-9][a-zA-Z0-9/._-]*$/;V19=sj6(async($,X)=>{let Y=$.var.meshContext;try{G0(Y)}catch{return $.json({error:"Unauthorized"},401)}let G=K6(Y);if(!G)return $.json({error:"Unauthorized"},401);let Q;try{Q=r1(Y)}catch{return $.json({error:"Organization scope required"},403)}let J=$.req.param("virtualMcpId"),Z=$.req.param("branch");if(!J||!Z)return $.json({error:"virtualMcpId and branch are required"},400);try{A19(Z)}catch(N){let w=N instanceof Error?N.message:String(N);return $.json({error:w},400)}let W=await Y.storage.virtualMcps.findById(J);if(!W||W.organization_id!==Q.id)return $.json({error:"Virtual MCP not found"},404);let K=HM({orgId:Q.id,virtualMcpId:J,branch:Z}),F=Yu1({userId:G,projectRef:K},Z),U=W.metadata??null,B;try{B=(await yD(Y,{userId:G,branch:Z,virtualMcpMetadata:U})).provider}catch{B=null}if(!B)return $.json({error:"No sandbox runner found"},404);return $.set("vmClaim",{claimName:F,runner:B,virtualMcpId:J,branch:Z,userId:G,projectRef:K,virtualMcpMetadata:U}),X()});dt={"Cache-Control":"no-store, no-cache, must-revalidate",Pragma:"no-cache"};M19=new Set(["/.decofile","/live/_meta"]),FP6=["clone","install","start"]});var NP6=($)=>{let X=new u4;if(X.use("*",nh),X.route("/",Eh1()),X.route("/",eh1()),X.route("/",oh1({kvStorage:$.kvStorage})),X.route("/",dj6()),X.route("/sandbox",UP6()),X.route("/",pj6()),X.route("/deco-sites",jh1()),X.route("/sso",pg1()),X.route("/",$u1({tokenStorage:$.tokenStorage,automationEventDispatcher:$.automationEventDispatcher})),X.route("/webhooks",JL6()),$.mountDevAssets)X.route("/dev-assets",Ph1({orgFromPath:!0}));return X.use("/mcp/:connectionId?",$.mcpAuth),X.use("/mcp/gateway/:virtualMcpId?",$.mcpAuth),X.use("/mcp/virtual-mcp/:virtualMcpId?",$.mcpAuth),X.use("/mcp/self",$.mcpAuth),X.route("/",f66()),X.get("/mcp/:gateway?/:connectionId/.well-known/oauth-protected-resource/*",$.betterAuthProtectedResourceHandler),X.route("/mcp",B21()),X.route("/mcp/self",sh1()),X.route("/mcp",z21()),X.all("/oauth-proxy/:connectionId/*",$.oauthProxyHandler),X.post("/events/:type",$.eventsHandler),X.get("/watch",$.watchHandler),X};var wP6=D(()=>{c5();FV0();ZL6();zV0();qh1();KV0();ij6();vM0();WY1();s20();D21();_M0();nj6();bM0();fM0();N21();BP6()});async function k19($,X){try{return!await $.alive(X)}catch(Y){return console.warn(`[vm-events] alive probe failed for ${X}; assuming alive: ${Y instanceof Error?Y.message:String(Y)}`),!1}}async function C19($){let{ctx:X,runner:Y,claimName:G,userId:Q,projectRef:J,sandboxProviderKind:Z}=$;try{await Y.delete(G)}catch(W){console.warn(`[vm-events] runner.delete failed for ${G}: ${W instanceof Error?W.message:String(W)}`)}try{await new LP(X.db).delete({userId:Q,projectRef:J},Z)}catch(W){console.warn(`[vm-events] sandbox_runner_state delete failed for ${Q}/${J}/${Z}: ${W instanceof Error?W.message:String(W)}`)}}async function v19($){let{stream:X,claimName:Y,runner:G,signal:Q}=$;return new Promise((J)=>{let Z=!1,W=!1,K=null,F=(N)=>{if(Z)return;Z=!0,clearTimeout(U),Q.removeEventListener("abort",B),K?.unsubscribe(),J(N)},U=setTimeout(()=>{if(W||Z)return;X.writeSSE({event:"phase",data:JSON.stringify({kind:"failed",reason:"claim-never-created",message:"Sandbox claim was never created. The SANDBOX_START call may have failed earlier \u2014 check the start error."})}).catch(()=>{}),F(!1)},R19),B=()=>F(!1);Q.addEventListener("abort",B,{once:!0}),K=P71(G,Y,(N)=>{if(Z)return;if(N.kind!=="claiming")W=!0;if(X.writeSSE({event:"phase",data:JSON.stringify(N)}).catch(()=>{}),N.kind==="ready")F(!0);else if(N.kind==="failed")F(!1)})})}async function _19($){let{stream:X,runner:Y,claimName:G,signal:Q}=$,J=Date.now(),Z=null;while(!Q.aborted){let K=null;try{K=await Y.proxyDaemonRequest(G,"/_sandbox/events",{method:"GET",headers:new Headers({accept:"text/event-stream"}),body:null,signal:Q})}catch(F){if(Q.aborted)return;if(Date.now()-J<zP6){await J7(DP6,{signal:Q}).catch(()=>{});continue}let U=F instanceof Error?F.message:String(F);await X.writeSSE({event:"phase",data:JSON.stringify({kind:"failed",reason:"unknown",message:`Upstream daemon SSE error: ${U}`})}).catch(()=>{});return}if(K.status===404){try{await K.body?.cancel()}catch{}if(Date.now()-J<zP6){await J7(DP6,{signal:Q}).catch(()=>{});continue}await X.writeSSE({event:"gone",data:""}).catch(()=>{});return}if(!K.ok||!K.body){try{await K.body?.cancel()}catch{}await X.writeSSE({event:"phase",data:JSON.stringify({kind:"failed",reason:"unknown",message:`Upstream daemon SSE failed (${K.status}).`})}).catch(()=>{});return}Z=K;break}if(!Z||!Z.body)return;let W=Z.body.getReader();try{while(!Q.aborted){let{value:K,done:F}=await W.read();if(F)break;if(K)await X.write(K)}}catch{}finally{try{W.releaseLock()}catch{}}}var R19=90000,S19=15000,OP6=()=>{let $=new u4;return $.get("/",async(X)=>{let Y=X.var.meshContext;try{G0(Y)}catch{return X.json({error:"Unauthorized"},401)}let G=K6(Y);if(!G)return X.json({error:"Unauthorized"},401);let Q;try{Q=r1(Y)}catch{return X.json({error:"Organization scope required"},403)}let J=X.req.query("virtualMcpId"),Z=X.req.query("branch");if(!J||!Z)return X.json({error:"virtualMcpId and branch are required"},400);let W=await Y.storage.virtualMcps.findById(J);if(!W||W.organization_id!==Q.id)return X.json({error:"Virtual MCP not found"},404);let K=HM({orgId:Q.id,virtualMcpId:J,branch:Z}),F=Yu1({userId:G,projectRef:K},Z),U=W.metadata??null,B,N=null,w=null;try{let L=await yD(Y,{userId:G,branch:Z,virtualMcpMetadata:U});B=L.provider,N=L.kind}catch(L){w=L instanceof Error?L:Error(String(L)),B=null}let z=N&&OP(ZH(U),G,Z,N),O=!!z&&z.sandboxHandle===F;if(!B)return HH(X,async(L)=>{await L.writeSSE({event:"phase",data:JSON.stringify({kind:"failed",reason:"unknown",message:w?.message??"No sandbox runner configured on this mesh."})})});return X.header("X-Accel-Buffering","no"),X.header("Content-Encoding","identity"),HH(X,async(L)=>{let j=new AbortController,P=setInterval(()=>{L.writeSSE({event:"keepalive",data:""}).catch(()=>{clearInterval(P)})},S19);L.onAbort(()=>{j.abort(),clearInterval(P)});try{if(O&&N){if(await k19(B,F)){await C19({ctx:Y,runner:B,claimName:F,userId:G,projectRef:K,sandboxProviderKind:N}),await L.writeSSE({event:"gone",data:""}).catch(()=>{});return}}if(!await v19({stream:L,claimName:F,runner:B,signal:j.signal})||j.signal.aborted)return;await _19({stream:L,runner:B,claimName:F,signal:j.signal})}finally{clearInterval(P)}})}),$},zP6=60000,DP6=500;var LP6=D(()=>{c5();Gu();RD();kF();hM0();uh();q71();HT1();SD()});function kN($,X="invalid_request_error",Y=null,G=null){return{error:{message:$,type:X,param:Y,code:G}}}function l19($){if(!$)return null;let X=$.indexOf(":");if(X===-1)return{credentialId:null,modelId:$};let Y=$.substring(0,X),G=$.substring(X+1);if(!Y||!G)return null;return{credentialId:Y,modelId:G}}function c19($,X,Y){try{return JSON.parse($)}catch{throw new PP6(`Invalid JSON in tool call arguments for function '${Y}' (tool_call_id: ${X}): ${$}`)}}function d19($){let X={};for(let Y of $)if(Y.role==="assistant"&&Y.tool_calls)for(let G of Y.tool_calls)X[G.id]=G.function.name;return $.map((Y)=>{switch(Y.role){case"system":return{role:"system",content:Y.content};case"user":if(typeof Y.content==="string")return{role:"user",content:Y.content};return{role:"user",content:Y.content.map((Q)=>{if(Q.type==="text")return{type:"text",text:Q.text};return{type:"image",image:Q.image_url.url}})};case"assistant":if(Y.tool_calls&&Y.tool_calls.length>0)return{role:"assistant",content:Y.tool_calls.map((Q)=>({type:"tool-call",toolCallId:Q.id,toolName:Q.function.name,input:c19(Q.function.arguments,Q.id,Q.function.name)}))};return{role:"assistant",content:Y.content??""};case"tool":let G=X[Y.tool_call_id]??"unknown";return{role:"tool",content:[{type:"tool-result",toolCallId:Y.tool_call_id,toolName:G,output:{type:"text",value:Y.content}}]}}})}function i19($){let X=$.map((Y)=>{let G=Y.function.parameters?I3(Y.function.parameters):I3({type:"object",properties:{}});return[Y.function.name,o6({description:Y.function.description,inputSchema:G})]});return Object.fromEntries(X)}function p19($){if(!$)return;return{openai:{response_format:$}}}function n19(){return`chatcmpl-${crypto.randomUUID().replace(/-/g,"").substring(0,29)}`}function EP6($,X,Y,G,Q,J){let Z={model:$,messages:X,tools:Y,temperature:G.temperature,maxTokens:G.max_tokens,topP:G.top_p,frequencyPenalty:G.frequency_penalty,presencePenalty:G.presence_penalty,stopSequences:G.stop?Array.isArray(G.stop)?G.stop:[G.stop]:void 0,abortSignal:J};return Q?{...Z,providerOptions:Q}:Z}function jP6($){if($==="tool-calls")return"tool_calls";if($==="length")return"length";return"stop"}var b19,f19,y19,x19,g19,h19,u19,m19,PP6,qP6,AP6;var TP6=D(()=>{u9();c5();Gu();l1();b19=H.object({type:H.literal("function"),function:H.object({name:H.string(),description:H.string().optional(),parameters:H.record(H.string(),H.unknown()).optional()})}),f19=H.object({id:H.string(),type:H.literal("function"),function:H.object({name:H.string(),arguments:H.string()})}),y19=H.discriminatedUnion("role",[H.object({role:H.literal("system"),content:H.string(),name:H.string().optional()}),H.object({role:H.literal("user"),content:H.union([H.string(),H.array(H.union([H.object({type:H.literal("text"),text:H.string()}),H.object({type:H.literal("image_url"),image_url:H.object({url:H.string(),detail:H.string().optional()})})]))]),name:H.string().optional()}),H.object({role:H.literal("assistant"),content:H.string().nullable().optional(),name:H.string().optional(),tool_calls:H.array(f19).optional()}),H.object({role:H.literal("tool"),content:H.string(),tool_call_id:H.string()})]),x19=H.object({type:H.literal("text")}),g19=H.object({type:H.literal("json_object")}),h19=H.object({type:H.literal("json_schema"),json_schema:H.object({name:H.string(),description:H.string().optional(),schema:H.record(H.string(),H.unknown()),strict:H.boolean().optional()})}),u19=H.union([x19,g19,h19]),m19=H.object({model:H.string().describe("Format: 'model_id' or 'credential_id:model_id'"),messages:H.array(y19),stream:H.boolean().optional().default(!1),temperature:H.number().min(0).max(2).optional(),max_tokens:H.number().positive().optional(),top_p:H.number().min(0).max(1).optional(),frequency_penalty:H.number().min(-2).max(2).optional(),presence_penalty:H.number().min(-2).max(2).optional(),stop:H.union([H.string(),H.array(H.string())]).optional(),tools:H.array(b19).optional(),tool_choice:H.union([H.literal("auto"),H.literal("none"),H.literal("required"),H.object({type:H.literal("function"),function:H.object({name:H.string()})})]).optional(),response_format:u19.optional(),user:H.string().optional()});PP6=class PP6 extends Error{constructor($){super($);this.name="MessageConversionError"}};qP6=new u4;qP6.post("/:org/v1/chat/completions",async($)=>{let X=$.get("meshContext"),Y=$.req.param("org");try{if(!X.auth.apiKey?.id)return $.json(kN("API key authentication required. Provide a valid API key via Authorization header.","authentication_error"),401);if(!X.organization)return $.json(kN("Organization context is required. Ensure your API key has organization metadata.","invalid_request_error","organization"),400);if((X.organization.slug??X.organization.id)!==Y)return $.json(kN("Organization mismatch. The API key's organization does not match the requested organization.","invalid_request_error","organization"),403);let G=await $.req.json(),Q=m19.safeParse(G);if(!Q.success){let L=Q.error.issues[0]??{message:"Invalid request",path:[]};return $.json(kN(`Invalid request: ${L.message}`,"invalid_request_error",L.path.length>0?L.path.join("."):null),400)}let J=Q.data,Z=l19(J.model);if(!Z)return $.json(kN("Invalid model format. Expected 'model_id' or 'credential_id:model_id' (e.g., 'claude-sonnet-4-6' or 'key_abc123:claude-sonnet-4-6')","invalid_request_error","model"),400);let{credentialId:W}=Z,{modelId:K}=Z;if(!W){let L=await X.storage.aiProviderKeys.list({organizationId:X.organization.id});if(L.length===0)return $.json(kN("No AI provider credentials configured for this organization. Add a credential in settings or specify one explicitly via 'credential_id:model_id'.","invalid_request_error","model"),400);W=L[0].id}let F;try{F=await X.aiProviders.activate(W,X.organization.id)}catch{return $.json(kN(`AI provider credential not found or inaccessible: ${W}`,"invalid_request_error","model"),404)}let U=F.aiSdk.languageModel(K),B=d19(J.messages),N=J.tools?i19(J.tools):void 0,w=p19(J.response_format),z=n19(),O=Math.floor(Date.now()/1000);if(J.stream)return HH($,async(L)=>{let j=EP6(U,B,N,J,w,$.req.raw.signal);try{let P=QH(j),T=!1,I=0;for await(let V of P.fullStream){if(!T&&(V.type==="text-delta"||V.type==="tool-call"))await L.writeSSE({data:JSON.stringify({id:z,object:"chat.completion.chunk",created:O,model:J.model,choices:[{index:0,delta:{role:"assistant",content:""},finish_reason:null}]})}),T=!0;if(V.type==="text-delta")await L.writeSSE({data:JSON.stringify({id:z,object:"chat.completion.chunk",created:O,model:J.model,choices:[{index:0,delta:{content:V.text},finish_reason:null}]})});else if(V.type==="tool-call"){let R=I++;await L.writeSSE({data:JSON.stringify({id:z,object:"chat.completion.chunk",created:O,model:J.model,choices:[{index:0,delta:{tool_calls:[{index:R,id:V.toolCallId,type:"function",function:{name:V.toolName,arguments:JSON.stringify(V.input)}}]},finish_reason:null}]})})}else if(V.type==="finish")await L.writeSSE({data:JSON.stringify({id:z,object:"chat.completion.chunk",created:O,model:J.model,choices:[{index:0,delta:{},finish_reason:jP6(V.finishReason)}],usage:V.totalUsage?{prompt_tokens:V.totalUsage.inputTokens??0,completion_tokens:V.totalUsage.outputTokens??0,total_tokens:V.totalUsage.totalTokens??0}:void 0})})}await L.writeSSE({data:"[DONE]"})}catch(P){let T=P;console.error("[openai-compat:stream] Error:",T.message),await L.writeSSE({data:JSON.stringify({error:{message:T.message,type:"server_error"}})})}});else{let L=EP6(U,B,N,J,w,$.req.raw.signal),j=await wP(L),P={role:"assistant",content:j.text||null};if(j.toolCalls&&j.toolCalls.length>0)P.tool_calls=j.toolCalls.map((T)=>({id:T.toolCallId,type:"function",function:{name:T.toolName,arguments:JSON.stringify("input"in T?T.input:{})}})),P.content=null;return $.json({id:z,object:"chat.completion",created:O,model:J.model,choices:[{index:0,message:P,finish_reason:jP6(j.finishReason)}],usage:{prompt_tokens:j.usage?.inputTokens??0,completion_tokens:j.usage?.outputTokens??0,total_tokens:j.usage?.totalTokens??0}})}}catch(G){let Q=G;if(Q.name==="AbortError")return $.json(kN("Request aborted","invalid_request_error"),400);if(Q.name==="MessageConversionError")return $.json(kN(Q.message,"invalid_request_error","messages"),400);return console.error("[openai-compat] Error:",Q.message,Q.stack),$.json(kN(Q.message,"server_error"),500)}});AP6=qP6});function t19(){let $=process.env.POSTHOG_KEY;if(!$)return null;return{key:$,host:process.env.POSTHOG_HOST??r19}}var VP6,r19="https://us.i.posthog.com",MP6;var IP6=D(()=>{c5();HK0();mh();kz();F5();r20();VP6=new u4;VP6.get("/",($)=>{let X={theme:mk4(),...JT().logo&&{logo:JT().logo},...xD()&&{internalUrl:CL1()},..._4().enableDecoImport&&{enableDecoImport:!0},brandExtractEnabled:!!_4().firecrawlApiKey,auth:NN6(),posthog:t19()};return $.json({success:!0,config:X})});MP6=VP6});var RP6,SP6;var kP6=D(()=>{c5();cU();I71();jc();RP6=new u4;RP6.get("/:org/files/*",async($)=>{let X=$.get("meshContext"),Y=X.organization?.id;if(!X.auth?.user?.id){if(Rt($))return $.redirect(`/login?next=${encodeURIComponent($.req.path)}`,302);throw new D$(401,{message:"Authentication required"})}if(!Y)throw new D$(401,{message:"Organization context required"});let G=$.req.path.replace(/^.*\/files\//,"");if(!G)throw new D$(400,{message:"Missing file key"});let Q=await dh(G,X);if(!Q)throw new D$(503,{message:"Object storage not configured"});if(Q.startsWith("data:")&&pH()){let J=Q.match(/^data:([^;]+);base64,(.+)$/s);if(!J)throw new D$(500,{message:"Invalid data URL from storage"});let[,Z,W]=J,K=Buffer.from(W,"base64");return $.body(K,200,{"Content-Type":Z,"Cache-Control":"private, max-age=86400"})}return $.redirect(Q,302)});SP6=RP6});var _P6={};g6(_P6,{shouldSkipMeshContext:()=>lM0,isServerPath:()=>X09,SYSTEM_PATHS:()=>uP});function CP6($){return $===uP.HEALTH_LIVE||$===uP.HEALTH_READY||$===uP.METRICS||$.startsWith(it.WELL_KNOWN)}function vP6($){return $.startsWith(it.API)}function o19($){return $==="/mcp"||$.startsWith(it.MCP)}function s19($){return $.startsWith(it.OAUTH_PROXY)}function e19($){return a19.test($)}function $09($){return $.startsWith(it.ORG)}function X09($){return vP6($)||o19($)||s19($)||$09($)||CP6($)}function lM0($){return $==="/"||$.startsWith(it.API_AUTH)||$==="/api/trigger-callback"||CP6($)||!vP6($)&&e19($)}var uP,it,a19;var cM0=D(()=>{uP={HEALTH_LIVE:"/health/live",HEALTH_READY:"/health/ready",METRICS:"/metrics"},it={API:"/api/",API_AUTH:"/api/auth/",MCP:"/mcp/",OAUTH_PROXY:"/oauth-proxy/",WELL_KNOWN:"/.well-known",ORG:"/org/"},a19=/\.(html|css|js|ico|svg|png|jpg|jpeg|gif|webp|woff|woff2)$/});function bP6($){let X=$?.connectFn??J09,Y=null,G=null,Q=!1,J=!1,Z=!1,W=[];function K(){return Y!==null&&!Y.isClosed()&&!Y.isDraining()&&!Z}function F(){console.log(`[NatsProvider] fireReady: ${W.length} callbacks`);for(let N of W)try{N()}catch{}}function U(N){(async()=>{for await(let w of N.status())if(w.type===KG1.Events.Disconnect)console.log("[NatsProvider] Disconnected"),Z=!0;else if(w.type===KG1.Events.Reconnect)console.log("[NatsProvider] Reconnected, re-firing ready callbacks"),Z=!1,G=null,F()})().catch(()=>{})}async function B(N){let w=0;while(!J)try{Y=await X({servers:N,timeout:Q09,reconnect:!0,maxReconnectAttempts:-1}),console.log(`[NatsProvider] Connected to ${Y.getServer()} after ${w} attempt(s)`),G=null,Z=!1,U(Y),F();return}catch{w++;let z=SF(G09,Y09,w-1,2,0.5);await J7(z)}}return{init(N){if(Q)return;Q=!0,J=!1,B(N).catch(()=>{})},isConnected(){return K()},getConnection(){return K()?Y:null},getJetStream(){if(!K())return null;if(!G)G=Y.jetstream();return G},onReady(N){if(W.push(N),K())try{N()}catch{}},async drain(){if(J=!0,Q=!1,G=null,Z=!1,Y){let N=Y;Y=null,await N.drain().catch(()=>{})}}}}function J09($){return KG1.connect($)}var KG1,Y09=100,G09=3000,Q09=3000;var fP6=D(()=>{kF();KG1=G1(rp(),1)});function pt($){let X=$?.ttlMs??60000,Y=$?.maxSize??1e4,G=$?.updateRecencyOnGet??!1,Q=new Map;function J(){if(Q.size<=Y)return;let Z=Date.now();for(let[W,K]of Q)if(K.expiresAt<=Z)Q.delete(W);while(Q.size>Y){let W=Q.keys().next().value;if(W===void 0)break;Q.delete(W)}}return{get(Z){let W=Q.get(Z);if(!W)return;if(W.expiresAt<=Date.now()){Q.delete(Z);return}if(G)Q.delete(Z),Q.set(Z,W);return W.value},set(Z,W){Q.delete(Z),Q.set(Z,{value:W,expiresAt:Date.now()+X}),J()},delete(Z){Q.delete(Z)},clear(){Q.clear()},size(){return Q.size}}}function dM0($,X){return`${$}.${X}`}class iM0{cache;constructor($){this.cache=pt({ttlMs:$?.ttlMs??Z09,maxSize:$?.maxSize??W09})}async get($,X){return this.cache.get(dM0($,X))??null}async set($,X,Y){this.cache.set(dM0($,X),Y)}async invalidate($,X){this.cache.delete(dM0($,X))}teardown(){this.cache.clear()}}var Z09=600000,W09=5000;var yP6=()=>{};function Gu1($,X){return`${$}:${X}`}function pM0($){let X=pt({ttlMs:$?.ttlMs??K09,maxSize:$?.maxSize??H09}),Y=$?.getConnection,G=crypto.randomUUID(),Q=new TextEncoder,J=new TextDecoder,Z=null;function W(K,F){let U=Y?.();if(!U)return;try{U.publish(xP6,Q.encode(JSON.stringify({organizationId:K,keyId:F,originId:G})))}catch(B){console.warn("[ProviderKeyCache] Publish failed (non-critical):",B)}}return{get(K,F){return X.get(Gu1(K,F))},set(K,F,U){X.set(Gu1(K,F),U)},invalidate(K,F){X.delete(Gu1(K,F)),W(K,F)},start(){if(Z)return;let K=Y?.();if(!K)return;Z=K.subscribe(xP6),(async()=>{for await(let F of Z)try{let U=JSON.parse(J.decode(F.data));if(U.originId===G)continue;X.delete(Gu1(U.organizationId,U.keyId))}catch{}})().catch(console.error)},teardown(){Z?.unsubscribe(),Z=null,X.clear()}}}var xP6="studio.ai-provider-keys.invalidate",K09=30000,H09=5000;var gP6=()=>{};class nM0{options;sub=null;onCancel=null;encoder=new TextEncoder;originId=crypto.randomUUID();constructor($){this.options=$}async start($){if($)this.onCancel=$;if(this.sub)return;if(!this.onCancel)return;let X=this.options.getConnection();if(!X)return;this.sub=X.subscribe("mesh.decopilot.cancel");let Y=new TextDecoder;(async()=>{for await(let G of this.sub)try{let Q=JSON.parse(Y.decode(G.data));if(Q.originId===this.originId)continue;this.onCancel?.(Q.taskId)}catch{}})().catch(console.error)}broadcast($){if(/[.*>\s]/.test($)){console.warn("[NatsCancelBroadcast] Invalid threadId, skipping broadcast");return}this.onCancel?.($);try{let X=this.options.getConnection();if(!X)return;X.publish("mesh.decopilot.cancel",this.encoder.encode(JSON.stringify({taskId:$,originId:this.originId})))}catch(X){console.warn("[NatsCancelBroadcast] Publish failed (non-critical):",X)}}async stop(){this.sub?.unsubscribe(),this.sub=null,this.onCancel=null}}function N09($){if(/[.*>\s]/.test($))throw Error("Invalid NATS subject token")}function tM0($){return N09($),`${mP6}.${$}`}function w09($){let X=0;return{publish(Y,G,Q,J){Y.publish(G,Q,J?{headers:J}:void 0).catch((Z)=>{if(X++,X===1||X%100===0)console.warn(`[Decopilot] JetStream publish failed for thread ${$} (${X} total):`,Z)})},get errorCount(){return X}}}class aM0{options;js=null;jsm=null;encoder=new TextEncoder;constructor($){this.options=$}async init(){let $=this.options.getConnection();if(!$)return;let X=await $.jetstreamManager(),Y={name:Qu1,subjects:[`${mP6}.>`],storage:l3.StorageType.Memory,max_age:F09,max_bytes:U09,max_msgs_per_subject:B09,discard:l3.DiscardPolicy.Old,retention:l3.RetentionPolicy.Limits,num_replicas:1};try{await X.streams.info(Qu1),await X.streams.update(Qu1,Y)}catch(G){if(G instanceof Error&&G.message.includes("stream not found"))await X.streams.add(Y);else throw G}this.js=this.options.getJetStream(),this.jsm=X}pump($,X,Y){let G=this.js;if(!G)return;let Q=tM0(X),J=w09(X),Z=this.encoder,W=!1,K=()=>{if(W)return;W=!0,G.publish(Q,Z.encode(JSON.stringify({done:!0}))).catch(()=>{})};Y.addEventListener("abort",K,{once:!0});let F=(U)=>{let B=Z.encode(JSON.stringify({p:U}));if(B.length<=VN){J.publish(G,Q,B);return}if(B.length>hP6){console.warn(`[Decopilot] dropping oversized stream chunk for thread ${X}: ${(B.length/1048576).toFixed(1)} MiB exceeds ${hP6/1048576} MiB cap`);return}let N=Math.ceil(B.length/VN);for(let w=0;w<N;w++){let z=B.slice(w*VN,(w+1)*VN),O=l3.headers();O.set(uP6,String(w)),O.set(rM0,String(N)),J.publish(G,Q,z,O)}};(async()=>{let U=$.getReader();try{while(!0){let{done:B,value:N}=await U.read();if(B)break;F(N)}}catch(B){console.warn(`[Decopilot] stream pump error for thread ${X}:`,B?.message??B)}finally{U.releaseLock(),K()}})()}async createTailStream($,X,Y){let G=this.js;if(!G)return null;let Q=Y?.deliverPolicy==="new"?l3.DeliverPolicy.New:l3.DeliverPolicy.All,J=Y?.closeOnDone??!1,Z=tM0($),W;try{W=await G.subscribe(Z,{ordered:!0,config:{filter_subject:Z,ack_policy:l3.AckPolicy.None,deliver_policy:Q}})}catch(z){return console.warn("[Decopilot] JetStream tail unavailable (non-critical):",z?.message??z),null}let K=new TextDecoder,F=null,U=(z)=>{let O=z.headers?.get(rM0);if(!O)return null;let L=Number(O),j=Number(z.headers?.get(uP6)??"0");if(j===0)F={total:L,received:0,parts:Array(L)};else if(!F||F.total!==L)return null;if(!F.parts[j])F.received++;if(F.parts[j]=z.data,F.received<F.total)return null;let P=F.parts.reduce((V,R)=>V+(R?.length??0),0),T=new Uint8Array(P),I=0;for(let V of F.parts)T.set(V,I),I+=V.length;return F=null,T},B=async function*(){for await(let z of W)yield z}(),N=!1,w=()=>{if(N)return;N=!0,W.unsubscribe(),B.return(void 0).catch(()=>{})};return X?.addEventListener("abort",w,{once:!0}),new ReadableStream({async pull(z){while(!0){let O=await B.next();if(O.done){w(),z.close();return}let L=O.value,j=U(L);if(L.headers?.get(rM0)&&!j)continue;let P=j??L.data;try{let T=JSON.parse(K.decode(P));if(T.done){if(J){w(),z.close();return}continue}if(T.p){z.enqueue(T.p);return}}catch{}}},cancel(){w()}})}purge($){if(!this.jsm)return;this.jsm.streams.purge(Qu1,{filter:tM0($)}).catch(()=>{})}teardown(){this.js=null,this.jsm=null}}var l3,Qu1="DECOPILOT_STREAMS",mP6="decopilot.stream",F09=300000000000,U09=524288000,B09=20000,hP6=33554432,uP6="Dp-Frag-Idx",rM0="Dp-Frag-Total";var lP6=D(()=>{l3=G1(rp(),1)});function dP6(){let $=new Map,X=new Map;function Y(G){let Q=X.get(G);if(!Q)return;let J=$.get(G)??null;for(let Z of Q)try{Z(J)}catch{}}return{async get(G){return $.get(G)??null},async put(G,Q){$.set(G,Q),Y(G)},async delete(G){$.delete(G),Y(G)},watch(G,Q){let J=X.get(G);if(!J)J=new Set,X.set(G,J);J.add(Q);try{Q($.get(G)??null)}catch{}return()=>{let Z=X.get(G);if(!Z)return;if(Z.delete(Q),Z.size===0)X.delete(G)}}}}class oM0{options;kv=null;codec=Ju1.JSONCodec();constructor($){this.options=$}async init(){let $=this.options.getJetStream();if(!$)return;this.kv=await $.views.kv(z09,{history:1,ttl:cP6,storage:Ju1.StorageType.Memory})}async get($){if(!this.kv)return null;try{let X=await this.kv.get($);if(!X?.value)return null;if(X.operation==="DEL"||X.operation==="PURGE")return null;if(Date.now()-X.created.getTime()>cP6)return null;return this.codec.decode(X.value)}catch{return null}}async put($,X){if(!this.kv)return;await this.kv.put($,this.codec.encode(X))}async delete($){if(!this.kv)return;try{await this.kv.delete($)}catch{}}watch($,X){if(!this.kv){try{X(null)}catch{}return()=>{}}let Y=!1,G=null;return(async()=>{let Q=250;while(!Y){try{G=await this.kv.watch({key:$}),Q=250;for await(let J of G){if(Y)return;let W=J.operation==="DEL"||J.operation==="PURGE"||!J.value?null:this.codec.decode(J.value);try{X(W)}catch{}}if(Y)return}catch{}if(Y)return;await new Promise((J)=>setTimeout(J,Q)),Q=Math.min(Q*2,5000)}})(),()=>{Y=!0;try{G?.stop()}catch{}}}}var Ju1,z09="studio_links",cP6=60000;var iP6=D(()=>{Ju1=G1(rp(),1)});function FH($){return JSON.stringify($)}function nt($){let X;try{X=JSON.parse($)}catch{throw Error("dispatch-frames: malformed JSON")}if(typeof X!=="object"||X===null)throw Error("dispatch-frames: frame must be an object");let Y=X.type;if(typeof Y!=="string"||!A09.has(Y))throw Error(`dispatch-frames: unknown frame type "${String(Y)}"`);let G=pP6.safeParse(X);if(!G.success)throw Error(`dispatch-frames: ${G.error.message}`);return G.data}var D09,O09,L09,E09,j09,P09,q09,pP6,A09;var sM0=D(()=>{l1();I20();D09=H.object({type:H.literal("hello"),previewPort:H.number().int().min(1).max(65535),machineId:H.string().min(1),hostname:H.string().optional(),cliVersion:H.string().min(1),capabilities:WB6}),O09=H.object({type:H.literal("request"),reqId:H.string().min(1),method:H.string().min(1),path:H.string().min(1),headers:H.record(H.string(),H.string()),body:H.string().optional()}),L09=H.object({type:H.literal("cancel"),reqId:H.string().min(1)}),E09=H.object({type:H.literal("headers"),reqId:H.string().min(1),status:H.number().int().min(100).max(599),headers:H.record(H.string(),H.string())}),j09=H.object({type:H.literal("chunk"),reqId:H.string().min(1),data:H.string()}),P09=H.object({type:H.literal("end"),reqId:H.string().min(1)}),q09=H.object({type:H.literal("error"),reqId:H.string().min(1),code:H.string().min(1),message:H.string()}),pP6=H.discriminatedUnion("type",[D09,O09,L09,E09,j09,P09,q09]),A09=new Set(pP6.options.map(($)=>$.shape.type.value))});function rP6($,X){let Y=X.helloTimeoutMs??5000,G=X.refreshIntervalMs??20000,Q=new Map;$.get("/api/links/connect",async(J)=>{let Z=J.req.header("authorization")??"",W=/^Bearer\s+(.+)$/i.exec(Z);if(!W)return new Response("missing bearer",{status:401});let K=(W[1]??"").trim(),F=await X.validateBearer(K);if(!F)return new Response("invalid bearer",{status:401});let U=J.env?.server;if(!U||typeof U.upgrade!=="function")return new Response("ws upgrade not available",{status:500});if(!U.upgrade(J.req.raw,{data:{kind:"gateway",userSub:F,deps:X,helloTimeoutMs:Y,refreshIntervalMs:G,localOwners:Q}}))return new Response("ws upgrade failed",{status:400});return new Response(null,{status:101})}),$.get("/api/links/me",async(J)=>{let Z=J.req.header("authorization")??"",W=/^Bearer\s+(.+)$/i.exec(Z),K=null;if(W)K=await X.validateBearer((W[1]??"").trim());else K=J.get("meshContext")?.auth?.user?.id??null;if(!K)return J.json({error:"unauthorized"},401);let F=await X.registry.get(K);if(!F)return J.json(null);return J.json({machineId:F.machineId,hostname:F.hostname,cliVersion:F.cliVersion,previewPort:F.previewPort,connectedAt:F.connectedAt})})}function $I0($){if(!$.data._inflight)$.data._inflight=new Map;return $.data._inflight}async function V09($,X){let{userSub:Y,deps:G,refreshIntervalMs:Q,localOwners:J}=$.data,Z={podId:G.podId,machineId:X.machineId,...X.hostname?{hostname:X.hostname}:{},cliVersion:X.cliVersion,previewPort:X.previewPort,connectedAt:Date.now(),capabilities:X.capabilities},W=J.get(Y);if(W&&W!==$){if(W.data.state)W.data.state.lostOwnership=!0;try{W.close(nP6,"superseded")}catch{}}J.set(Y,$);let K={userSub:Y,hello:X,refreshTimer:setInterval(()=>{G.registry.put(Y,{...Z,connectedAt:Date.now()}).catch(()=>{})},Q),stopWatch:()=>{},unsubscribeDispatch:()=>{},unsubscribeCancel:()=>{},lostOwnership:!1};$.data.state=K;try{K.unsubscribeDispatch=G.nats.subscribe(`links.dispatch.${Y}`,(U,B)=>M09($,U,B)),K.unsubscribeCancel=G.nats.subscribe(`links.cancel.${Y}`,(U)=>I09($,U));let F=!0;K.stopWatch=G.registry.watch(Y,(U)=>{if(F){F=!1;return}if(!U||U.podId!==G.podId){K.lostOwnership=!0;try{$.close(nP6,"superseded")}catch{}}}),await G.registry.put(Y,Z)}catch(F){clearInterval(K.refreshTimer);try{K.stopWatch()}catch{}try{K.unsubscribeDispatch()}catch{}try{K.unsubscribeCancel()}catch{}if(J.get(Y)===$)J.delete(Y);$.data.state=void 0,$.close(T09,`init failed: ${F instanceof Error?F.message:String(F)}`)}}function M09($,X,Y){if(!Y)return;let G;try{G=nt(eM0.decode(X))}catch{return}if(G.type!=="request")return;$I0($).set(G.reqId,{reply:Y}),$.send(FH(G))}function I09($,X){let Y;try{Y=nt(eM0.decode(X))}catch{return}if(Y.type!=="cancel")return;if(!$I0($).has(Y.reqId))return;$.send(FH(Y))}function R09($,X,Y){let G=$.data.deps.nats;if(Y.type!=="chunk"){G.publish(X,rt.encode(FH(Y)));return}let Q=rt.encode(FH(Y));if(Q.length<=VN){G.publish(X,Q);return}let J=rt.encode(FH({type:"chunk",reqId:Y.reqId,data:""})).length;for(let Z of RO6(Y.data,VN,J))G.publish(X,rt.encode(FH({type:"chunk",reqId:Y.reqId,data:Z})))}function S09($,X,Y,G,Q="publish_failed"){try{return $.data.deps.nats.publish(X,rt.encode(FH({type:"error",reqId:Y,code:Q,message:G}))),!0}catch{return!1}}async function k09($,X){if(X.type==="hello"){$.close(Zu1,"duplicate hello");return}if(X.type==="request"||X.type==="cancel")return;let Y=$I0($),G=Y.get(X.reqId);if(!G)return;try{R09($,G.reply,X)}catch(Q){if(S09($,G.reply,X.reqId,Q instanceof Error?Q.message:String(Q)))Y.delete(X.reqId);return}if(X.type==="end"||X.type==="error")Y.delete(X.reqId)}var nP6=4001,Zu1=1008,T09=1011,rt,eM0,tP6;var aP6=D(()=>{sM0();rt=new TextEncoder,eM0=new TextDecoder;tP6={open($){$.data.helloTimer=setTimeout(()=>{$.close(Zu1,"hello timeout")},$.data.helloTimeoutMs)},async message($,X){let Y=typeof X==="string"?X:eM0.decode(X),G;try{G=nt(Y)}catch(Q){$.close(Zu1,`bad frame: ${Q instanceof Error?Q.message:String(Q)}`);return}if(!$.data.state){if(G.type!=="hello"){$.close(Zu1,"first frame must be hello");return}clearTimeout($.data.helloTimer),await V09($,G);return}await k09($,G)},close($,X,Y){clearTimeout($.data.helloTimer);let G=$.data._inflight;if(G&&G.size>0){for(let[Z,W]of G)try{$.data.deps.nats.publish(W.reply,rt.encode(FH({type:"error",reqId:Z,code:"ws_closed",message:"daemon WebSocket closed before response completed"})))}catch{}G.clear()}let Q=$.data.state;if(!Q)return;clearInterval(Q.refreshTimer);try{Q.stopWatch()}catch{}try{Q.unsubscribeDispatch()}catch{}try{Q.unsubscribeCancel()}catch{}let J=$.data.localOwners.get(Q.userSub)===$;if(J)$.data.localOwners.delete(Q.userSub);if(J&&!Q.lostOwnership)$.data.deps.registry.delete(Q.userSub).catch(()=>{})}}});function sP6($){let X=$.requestTimeoutMs??30000;return function(G,Q,J){return{async*[Symbol.asyncIterator](){if(J?.signal?.aborted)throw Error("dispatch aborted");let Z=crypto.randomUUID(),W=$.nats.createInbox(),K=[],F=null,U=!1,B=null,N=null,w=()=>{if(N)clearTimeout(N),N=null;let I=F;F=null,I?.()},z=$.nats.subscribe(W,(I)=>{if(U)return;try{K.push(nt(C09.decode(I)))}catch(V){B=V instanceof Error?V:Error(String(V)),U=!0}w()}),O=!1,L=()=>{if(O)return;O=!0,U=!0;try{z()}catch{}},j=()=>{$.nats.publish(`links.cancel.${G}`,oP6.encode(FH({type:"cancel",reqId:Z}))),B=Error("dispatch aborted"),L(),w()};J?.signal?.addEventListener("abort",j,{once:!0});try{$.nats.publish(`links.dispatch.${G}`,oP6.encode(FH({type:"request",reqId:Z,method:Q.method,path:Q.path,headers:Q.headers,...Q.body!==void 0?{body:Q.body}:{}})),{reply:W})}catch(I){throw J?.signal?.removeEventListener("abort",j),L(),I instanceof Error?I:Error(String(I))}let P=Date.now()+X,T=!1;try{while(!U){if(B)throw B;if(K.length===0){let V=P-Date.now();if(!T&&V<=0)throw Error("dispatch timeout: no reply from daemon");if(await new Promise((R)=>{if(F=R,!T)N=setTimeout(w,Math.max(0,V))}),B)throw B;continue}let I=K.shift();if(T=!0,I.type==="chunk")yield{data:I.data};else if(I.type==="headers")yield{headers:{status:I.status,headers:I.headers}};else if(I.type==="end")return;else if(I.type==="error")throw Error(`${I.code}: ${I.message}`)}if(B)throw B}finally{if(J?.signal?.removeEventListener("abort",j),N)clearTimeout(N),N=null;L()}}}}}var oP6,C09;var eP6=D(()=>{sM0();oP6=new TextEncoder,C09=new TextDecoder});function $q6($,X){switch($.type){case"START":{let Y={type:"RUN_STARTED",taskId:$.taskId,orgId:$.orgId,userId:$.userId,abortController:$.abortController,runConfig:$.runConfig,podId:$.podId};if(X?.status.tag==="running")return[{type:"PREVIOUS_RUN_ABORTED",taskId:$.taskId,orgId:X.orgId},Y];return[Y]}case"STEP_DONE":{if(X?.status.tag!=="running")return[];return[{type:"STEP_COMPLETED",taskId:$.taskId,orgId:X.orgId,stepCount:X.status.stepCount+1}]}case"FINISH":{if(X==null||X.status.tag!=="running")return[];let{stepCount:Y}=X.status;if($.threadStatus==="completed")return[{type:"RUN_COMPLETED",taskId:$.taskId,orgId:X.orgId,stepCount:Y}];if($.threadStatus==="requires_action")return[{type:"RUN_REQUIRES_ACTION",taskId:$.taskId,orgId:X.orgId,stepCount:Y}];return[{type:"RUN_FAILED",taskId:$.taskId,orgId:X.orgId,reason:"error"}]}case"CANCEL":{if(X?.status.tag!=="running")return[];return[{type:"RUN_FAILED",taskId:$.taskId,orgId:X.orgId,reason:"cancelled"}]}case"RESUME":{if(X?.status.tag==="running")return[];return[{type:"RUN_RESUMED",taskId:$.taskId,orgId:$.orgId,userId:$.userId,abortController:$.abortController,podId:$.podId}]}case"FORCE_FAIL":{if($.reason==="ghost")return[{type:"RUN_FAILED",taskId:$.taskId,orgId:X?.orgId??$.orgId,reason:$.reason}];if(X?.status.tag!=="running")return[];return[{type:"RUN_FAILED",taskId:$.taskId,orgId:X.orgId,reason:$.reason}]}}}function Xq6($,X,Y=new Date){switch(X.type){case"RUN_STARTED":return{taskId:X.taskId,orgId:X.orgId,userId:X.userId,status:{tag:"running",abortController:X.abortController,stepCount:0,startedAt:Y}};case"RUN_RESUMED":return{taskId:X.taskId,orgId:X.orgId,userId:X.userId,status:{tag:"running",abortController:X.abortController,stepCount:0,startedAt:Y}};case"STEP_COMPLETED":if($?.status.tag!=="running")return $;return{...$,status:{...$.status,stepCount:X.stepCount}};case"RUN_COMPLETED":return;case"RUN_REQUIRES_ACTION":return;case"RUN_FAILED":return;case"PREVIOUS_RUN_ABORTED":return}}async function Yq6($,X,Y,G){let{storage:Q,streamBuffer:J,sseHub:Z}=G,W=await Q.get($,X);await Q.update($,X,{status:Y,run_owner_pod:null,run_config:null,run_started_at:null}),J.purge($),Z.emit(X,Cw($,Y,{virtualMcpId:W?.virtual_mcp_id??void 0,createdBy:W?.created_by,triggerId:W?.trigger_id,title:W?.title,branch:W?.branch??null,createdAt:W?.created_at,updatedAt:W?.updated_at})),Z.emit(X,D01($,Y))}async function v09($,X){let{storage:Y,streamBuffer:G,sseHub:Q}=X;switch($.type){case"RUN_STARTED":{if(!await Y.claimRunStart($.taskId,$.orgId,{status:"in_progress",run_owner_pod:$.podId??null,run_config:$.runConfig??null,run_started_at:$.podId?new Date().toISOString():null},$.podId??null))throw new Gq6($.taskId);let Z=await Y.get($.taskId,$.orgId);Q.emit($.orgId,Cw($.taskId,"in_progress",{virtualMcpId:Z?.virtual_mcp_id??void 0,createdBy:Z?.created_by,triggerId:Z?.trigger_id,title:Z?.title,branch:Z?.branch??null,createdAt:Z?.created_at,updatedAt:Z?.updated_at}));return}case"RUN_RESUMED":{await Y.update($.taskId,$.orgId,{run_owner_pod:$.podId,run_started_at:new Date().toISOString()});let J=await Y.get($.taskId,$.orgId);Q.emit($.orgId,Cw($.taskId,"in_progress",{virtualMcpId:J?.virtual_mcp_id??void 0,createdBy:J?.created_by,triggerId:J?.trigger_id,title:J?.title,branch:J?.branch??null,createdAt:J?.created_at,updatedAt:J?.updated_at}));return}case"STEP_COMPLETED":Q.emit($.orgId,mB1($.taskId,$.stepCount));return;case"RUN_COMPLETED":await Yq6($.taskId,$.orgId,"completed",X);return;case"RUN_REQUIRES_ACTION":await Yq6($.taskId,$.orgId,"requires_action",X);return;case"RUN_FAILED":{if($.reason==="ghost"){if(!await Y.forceFailIfInProgress($.taskId,$.orgId))return;await Y.update($.taskId,$.orgId,{run_owner_pod:null,run_config:null,run_started_at:null})}else await Y.update($.taskId,$.orgId,{status:"failed",run_owner_pod:null,run_config:null,run_started_at:null});G.purge($.taskId);let J=await Y.get($.taskId,$.orgId);Q.emit($.orgId,Cw($.taskId,"failed",{virtualMcpId:J?.virtual_mcp_id??void 0,createdBy:J?.created_by,triggerId:J?.trigger_id,title:J?.title,branch:J?.branch??null,createdAt:J?.created_at,updatedAt:J?.updated_at})),Q.emit($.orgId,D01($.taskId,"failed"));return}case"PREVIOUS_RUN_ABORTED":return}}async function Qq6($,X){for(let{event:Y}of $)await v09(Y,X)}var Gq6;var Jq6=D(()=>{b$();Gq6=class Gq6 extends Error{constructor($){super(`Failed to claim run for thread ${$} \u2014 already running on another pod`);this.name="RunClaimError"}}});class XI0{deps;podId;clock;states=new Map;reaperTimer=null;constructor($,X,Y=()=>new Date){this.deps=$;this.podId=X;this.clock=Y;this.reaperTimer=setInterval(()=>this.reapStaleRuns(),_09)}async execute($){let X=this.dispatch($);return await this.react(X),X}dispatch($){let X=this.states.get($.taskId),Y=$q6($,X),G=[];for(let Q of Y){let J=this.states.get(Q.taskId);if(Q.type==="PREVIOUS_RUN_ABORTED"||Q.type==="RUN_FAILED"){if(J?.status.tag==="running")J.status.abortController.abort()}let Z=Xq6(J,Q,this.clock());if(Z===void 0)this.states.delete(Q.taskId);else this.states.set(Q.taskId,Z);if(G.push({event:Q,state:Z}),f09.has(Q.type))Zq6.add(1,{"org.id":Q.orgId});else if(y09.has(Q.type)&&J?.status.tag==="running")Zq6.add(-1,{"org.id":Q.orgId})}return G}react($){return Qq6($,this.deps)}getAbortSignal($){let X=this.states.get($);if(X?.status.tag==="running")return X.status.abortController.signal;return null}isRunning($){return this.states.get($)?.status.tag==="running"}async stopAll(){try{await this.deps.storage.orphanRunsByPod(this.podId)}catch($){console.error("[RunRegistry] Failed to orphan runs in DB:",$)}for(let[,$]of this.states)if($.status.tag==="running")$.status.abortController.abort();this.states.clear()}async recoverOrphanedRuns($){let X=await this.deps.storage.listOrphanedRuns(this.podId);if(X.length===0)return;let Y=5;for(let G=0;G<X.length;G+=Y){let Q=X.slice(G,G+Y);await Promise.allSettled(Q.map(async(J)=>{if(!await this.deps.storage.claimOrphanedRun(J.id,J.organization_id,this.podId))return;try{await $(J)}catch(W){console.error(`[RunRegistry] Failed to resume ${J.id}:`,W),await this.deps.storage.forceFailIfInProgress(J.id,J.organization_id).catch(()=>{})}}))}}async handlePodDeath($,X,Y){let G=await this.deps.storage.listOrphanedRunsByPod($);if(G.length===0)return;for(let J of G)Y?.broadcast(J.id);let Q=5;for(let J=0;J<G.length;J+=Q){let Z=G.slice(J,J+Q);await Promise.allSettled(Z.map(async(W)=>{if(this.isRunning(W.id))return;if(!await this.deps.storage.claimOrphanedRun(W.id,W.organization_id,this.podId))return;try{await X(W)}catch(F){console.error(`[RunRegistry] Failed to resume ${W.id}:`,F),await this.deps.storage.forceFailIfInProgress(W.id,W.organization_id).catch(()=>{})}}))}}dispose(){if(this.reaperTimer)clearInterval(this.reaperTimer),this.reaperTimer=null}reapStaleRuns(){let $=this.clock().getTime();for(let[X,Y]of this.states)if(Y.status.tag==="running"&&$-Y.status.startedAt.getTime()>b09)console.warn(`[RunRegistry] Reaping stale run for thread ${X} ...`),this.execute({type:"FORCE_FAIL",taskId:X,reason:"reaped"}).catch((G)=>{console.error("[RunRegistry] Reaper execute failed",G)})}}var _09=300000,b09=1800000,f09,y09,Zq6;var Wq6=D(()=>{Jq6();ZZ();f09=new Set(["RUN_STARTED","RUN_RESUMED"]),y09=new Set(["RUN_COMPLETED","RUN_FAILED","RUN_REQUIRES_ACTION","PREVIOUS_RUN_ABORTED"]),Zq6=CW.createUpDownCounter("decopilot.stream.inflight",{description:"Number of in-flight decopilot stream requests",unit:"{requests}"})});class YI0{storage;options;timer=null;constructor($,X={}){this.storage=$;this.options=X}start(){if(this.timer)return;let $=this.options.intervalMs??300000;this.timer=setInterval(()=>{this.runOnce()},$)}async runOnce(){let $=this.options.staleAfterMs??3600000;try{let X=await this.storage.sweepAbandoned($);if(X>0)console.log(`[async-research-sweeper] marked ${X} stale jobs as abandoned`);return X}catch(X){return console.error("[async-research-sweeper] sweep failed",X),0}}dispose(){if(this.timer)clearInterval(this.timer),this.timer=null}}import{readdir as x09,rm as Wu1}from"fs/promises";import{join as Ku1}from"path";async function Hu1($){let X=new Date;X.setUTCDate(X.getUTCDate()-g09),X.setUTCHours(0,0,0,0);let Y=0;try{let G=await Qu($);for(let Q of G)if(/^\d{4}$/.test(Q))Y+=await Kq6($,Q,X);else if(!Q.startsWith(".")){let J=Ku1($,Q),Z=await Qu(J);for(let K of Z){if(!/^\d{4}$/.test(K))continue;Y+=await Kq6(J,K,X)}if((await Qu(J)).length===0)await Wu1(J,{recursive:!0,force:!0})}}catch(G){console.warn("monitoring retention cleanup failed:",G)}return Y}async function Kq6($,X,Y){let G=0,Q=Ku1($,X),J=await Qu(Q);for(let W of J){if(!/^\d{2}$/.test(W))continue;let K=Ku1(Q,W),F=await Qu(K);for(let B of F){if(!/^\d{2}$/.test(B))continue;let N=new Date(`${X}-${W}-${B}T00:00:00Z`);if(isNaN(N.getTime()))continue;if(N<Y){let w=Ku1(K,B);await Wu1(w,{recursive:!0,force:!0}),G++}}if((await Qu(K)).length===0)await Wu1(K,{recursive:!0,force:!0})}if((await Qu(Q)).length===0)await Wu1(Q,{recursive:!0,force:!0});return G}async function Qu($){try{return(await x09($)).filter((Y)=>!Y.startsWith("."))}catch{return[]}}var g09=30;var GI0=()=>{};import{DBOS as QI0,SchedulerMode as h09}from"@dbos-inc/dbos-sdk";async function m09(){let $=[NH(),Du(),bN()],X=0;for(let Y of $)try{X+=await Hu1(Y)}catch(G){console.error("[monitoring-retention] cleanup failed:",G)}return console.log(`[monitoring-retention] deleted ${X} day-dir(s) across ${$.length} signal dir(s)`),{deleted:X,dirs:$.length}}async function l09($,X){await QI0.runStep(()=>m09(),{name:"monitoringRetention"})}function Fq6(){if(Hq6)return;Hq6=!0;let $=QI0.registerWorkflow(l09,{name:"monitoringRetentionWorkflow"});QI0.registerScheduled($,{name:"monitoringRetentionWorkflow",crontab:u09,mode:h09.ExactlyOncePerIntervalWhenActive})}var u09="23 4 * * *",Hq6=!1;var Uq6=D(()=>{RW();GI0()});function HG1($){return{...$,title:$.title??$.id}}function wq6($){let X=$.credentialId;return{credentialId:X,thinking:HG1($.thinking),...$.coding&&{coding:HG1($.coding)},...$.fast&&{fast:HG1($.fast)},...$.image&&{image:{...HG1($.image),credentialId:$.image.credentialId??X}},...$.deepResearch&&{deepResearch:{...HG1($.deepResearch),credentialId:$.deepResearch.credentialId??X}}}}var Fu1,Bq6,c09,Nq6;var zq6=D(()=>{l1();Fu1=H.object({id:H.string(),title:H.string().optional(),capabilities:H.object({vision:H.boolean().optional(),text:H.boolean().optional(),tools:H.boolean().optional(),reasoning:H.boolean().optional(),file:H.boolean().optional()}).passthrough().optional(),limits:H.object({contextWindow:H.number().optional(),maxOutputTokens:H.number().optional()}).passthrough().optional(),provider:H.string().nullish()}),Bq6=Fu1.extend({credentialId:H.string().optional()}),c09=H.object({models:H.object({credentialId:H.string(),thinking:Fu1,coding:Fu1.optional(),fast:Fu1.optional(),image:Bq6.optional(),deepResearch:Bq6.optional()}),agent:H.object({id:H.string()}),temperature:H.number(),toolApprovalLevel:H.enum(["auto","readonly","plan"]).optional(),mode:H.enum(["default","plan","web-search","gen-image"]).optional(),windowSize:H.number().optional(),triggerId:H.string().optional()}),Nq6=c09.transform(($)=>{let X=$.mode??"default",Y="auto";if($.toolApprovalLevel==="plan")X="plan",Y="readonly";else if($.toolApprovalLevel==="readonly")Y="readonly";else if($.toolApprovalLevel==="auto")Y="auto";return{models:$.models,agent:$.agent,temperature:$.temperature,toolApprovalLevel:Y,mode:X,windowSize:$.windowSize,triggerId:$.triggerId}})});class JI0{deps;kv=null;podId=null;refreshTimer=null;watchAbortController=null;initPromise=null;pendingDeathCallback=null;constructor($){this.deps=$}async init(){if(this.watchAbortController)this.watchAbortController.abort(),this.watchAbortController=null;if(this.refreshTimer)clearInterval(this.refreshTimer),this.refreshTimer=null;this.kv=null,this.initPromise=null;let $=this.deps.getJetStream();if(!$)return;return this.initPromise=$.views.kv(d09,{ttl:i09,storage:Dq6.StorageType.Memory}).then((X)=>{this.kv=X}).catch((X)=>{throw this.initPromise=null,X}),this.initPromise}start($){if(!this.kv)return;if(this.refreshTimer)return;if(this.podId=$,this.kv.put($,new TextEncoder().encode(new Date().toISOString())),this.refreshTimer=setInterval(()=>{this.kv?.put($,new TextEncoder().encode(new Date().toISOString())).catch((X)=>{console.error("[PodHeartbeat] Refresh failed:",X)})},p09),this.pendingDeathCallback)this.startDeathWatcher(this.pendingDeathCallback),this.pendingDeathCallback=null}onPodDeath($){if(!this.kv){this.pendingDeathCallback=$;return}this.startDeathWatcher($)}startDeathWatcher($){if(!this.kv)return;this.watchAbortController=new AbortController;let X=this.kv,Y=this.podId,G=this.watchAbortController.signal;(async()=>{while(!G.aborted)try{let J=await X.watch({initializedFn:()=>{}});for await(let Z of J){if(G.aborted)break;if(Z.operation==="DEL"||Z.operation==="PURGE"){let W=Z.key;if(W!==Y)$(W)}}}catch(J){if(G.aborted)break;console.error("[PodHeartbeat] Watcher error, reconnecting in 1s:",J),await new Promise((Z)=>setTimeout(Z,1000))}})().catch((J)=>{if(!G.aborted)console.error("[PodHeartbeat] Watcher loop failed:",J)})}async stop(){if(this.refreshTimer)clearInterval(this.refreshTimer),this.refreshTimer=null;if(this.kv&&this.podId)try{await this.kv.delete(this.podId)}catch{}if(this.watchAbortController)this.watchAbortController.abort(),this.watchAbortController=null;this.kv=null,this.podId=null,this.initPromise=null,this.pendingDeathCallback=null}}var Dq6,d09="POD_HEARTBEATS",i09=45000,p09=1e4;var Oq6=D(()=>{Dq6=G1(rp(),1)});function Lq6($){return async(X,Y)=>{let G=await $.db.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["member.role","organization.id as orgId","organization.slug as orgSlug","organization.name as orgName"]).where("member.userId","=",Y).where("member.organizationId","=",X).executeTakeFirst();if(!G)return console.warn(`[automationContextFactory] User ${Y} not found in org ${X} \u2014 returning null`),null;let Q=await eF.create();Q.auth.user={id:Y,role:G.role},Q.organization={id:G.orgId,slug:G.orgSlug,name:G.orgName};let J=await BL0($.db,X,G.role);Q.boundAuth=UL0({auth:Q.authInstance,headers:new Headers,role:G.role,permissions:J,userId:Y}),Q.access=new IV(Q.authInstance,Y,void 0,Q.boundAuth,G.role,"self"),Q.storage.threads=new n51($.threadStorage,G.orgId),Q.storage.asyncResearchJobs=new t51($.asyncResearchJobStorage,G.orgId);let Z=VU();return Q.objectStorage=Z?XP(Z,G.orgId):new jD(G.orgId,Q.baseUrl),Ir(Q.storage,{objectStorage:Q.objectStorage,baseUrl:Q.baseUrl,orgSlug:G.orgSlug}),Q}}var Eq6=D(()=>{i51();QY1();mq1();cq1();em();XY1();dA1()});function r09(){for(let $ of n09)$()}function jq6($){let X=[...ZI0.logs,$];ZI0={...ZI0,logs:X.length>500?X.slice(-500):X},r09()}function WI0(){return t09}var ZI0,n09,t09=!1;var KI0=D(()=>{ZI0={services:[{name:"Postgres",status:"pending",port:0},{name:"NATS",status:"pending",port:0}],migrationsStatus:"pending",serverUrl:null,logs:[]},n09=new Set});import{EventEmitter as a09}from"events";var HI0;var Pq6=D(()=>{KI0();HI0=new a09;HI0.on("request",($)=>{jq6($)})});function qq6(){return async($,X)=>{let Y=Date.now(),G=$.req.method,Q=$.req.path;if(Q==="/api/auth/get-session"||Q.includes("favicon")){await X();return}let J="",Z=!1;if(Q.startsWith("/mcp")&&G==="POST"){Z=!0;try{if($.req.header("Content-Type")?.includes("application/json")){let N=await $.req.raw.clone().json();if(N.method==="tools/call"&&N.params?.name){let w=tD(N.params.name),z=N.params.arguments||{};if(w==="EVENT_PUBLISH"&&z.type){let O=tD(String(z.type));J=`${W8.tool}EVENT_PUBLISH${W8.reset} ${W8.bold}\u2192 ${O}${W8.reset}`}else if(w==="EVENT_SUBSCRIBE"&&z.eventType){let O=tD(String(z.eventType));J=`${W8.tool}EVENT_SUBSCRIBE${W8.reset} ${W8.bold}\u2190 ${O}${W8.reset}`}else if(w==="EVENT_UNSUBSCRIBE"&&z.eventType){let O=tD(String(z.eventType));J=`${W8.tool}EVENT_UNSUBSCRIBE${W8.reset} ${W8.dim}\u2715 ${O}${W8.reset}`}else{let O=Object.keys(z).map((j)=>tD(j)),L=O.length>0?O.slice(0,3).join(",")+(O.length>3?"\u2026":""):"";J=`${W8.tool}${w}${W8.dim}(${L})${W8.reset}`}}else if(N.method)J=`${W8.dim}${tD(N.method)}${W8.reset}`}}catch{}}let W=tD(Q);if(Q.startsWith("/mcp/conn_")){let U=Q.split("/")[2]??"";W=`/mcp/${W8.mcp}${tD(U.slice(0,12))}\u2026${W8.reset}`}else if(Q==="/mcp")W=`${W8.mcp}/mcp${W8.reset}`;else if(Q==="/mcp/registry")W=`${W8.mcp}/mcp/registry${W8.reset}`;let K=s09(G),F=Z?"\u25C0":"\u2190";if(!WI0())console.log(`${W8.dim}${F}${W8.reset} ${K}${G}${W8.reset} ${W}${J?` ${J}`:""}`);try{await X()}finally{let U=Date.now()-Y,B=$.res.status,N=o09(B),w=U<1000?`${U}ms`:`${(U/1000).toFixed(1)}s`,z=Z?"\u25B6":"\u2192";if(!WI0())console.log(`${W8.dim}${z}${W8.reset} ${K}${G}${W8.reset} ${W}${J?` ${J}`:""} ${N}${B}${W8.reset} ${W8.duration}${w}${W8.reset}`);HI0.emit("request",{method:G,path:tD(Q),status:B,duration:U,timestamp:new Date})}}}var W8,o09=($)=>{if($>=500)return W8.serverError;if($>=400)return W8.clientError;if($>=300)return W8.redirect;return W8.ok},s09=($)=>{return W8[$]||W8.reset},tD=($)=>{return $.replace(/\r/g,"").replace(/\n/g,"").replace(/\x1b\[[0-9;]*m/g,"").replace(/[\x00-\x1f\x7f-\x9f]/g,"")};var Aq6=D(()=>{KI0();Pq6();W8={reset:"\x1B[0m",dim:"\x1B[2m",bold:"\x1B[1m",GET:"\x1B[36m",POST:"\x1B[33m",PUT:"\x1B[35m",DELETE:"\x1B[31m",ok:"\x1B[32m",redirect:"\x1B[36m",clientError:"\x1B[33m",serverError:"\x1B[31m",mcp:"\x1B[35m",tool:"\x1B[96m",duration:"\x1B[90m"}});import{createHmac as Iq6}from"crypto";import{mkdir as e09,readdir as $49,rm as Tq6,stat as Rq6}from"fs/promises";import{join as UI0,relative as X49}from"path";function kq6($){let X=$.replace(/[^a-zA-Z0-9_-]/g,"_");return UI0(Y49,X)}function Cq6($){return $.replace(/^\/+/,"").replace(/\.\./g,"")}function FI0($,X){let Y=kq6($),G=Cq6(X);return UI0(Y,G)}function G49($,X,Y,G){let Q=_4().encryptionKey||"dev-secret",J=`${$}:${X}:${Y}:${G}`;return Iq6("sha256",Q).update(J).digest("hex")}function Mq6($,X,Y,G,Q){let J=Math.floor(Date.now()/1000)+G,Z=G49(X,Y,J,Q),W=new URL(`/api/dev-assets/${X}/${Cq6(Y)}`,$);return W.searchParams.set("expires",J.toString()),W.searchParams.set("signature",Z),W.searchParams.set("method",Q),W.toString()}function vq6($,X,Y){let G=`${$}:${X.getTime()}:${Y}`;return`"${Iq6("md5","etag").update(G).digest("hex")}"`}async function _q6($,X,Y,G,Q){try{let J=await $49($,{withFileTypes:!0});for(let Z of J){let W=UI0($,Z.name),F=X49(X,W).replace(/\\/g,"/");if(Y&&!F.startsWith(Y))continue;if(Z.isDirectory())if(G){let U=F+"/";if(!Y||U.startsWith(Y)){if(!(Y?F.slice(Y.length):F).includes("/"))Q.commonPrefixes.add(U)}}else await _q6(W,X,Y,G,Q);else if(Z.isFile()){if(G&&Y){let U=F.slice(Y.length);if(U.includes(G)){let B=U.indexOf(G),N=Y+U.slice(0,B+1);Q.commonPrefixes.add(N);continue}}try{let U=await Rq6(W);Q.objects.push({key:F,size:U.size,lastModified:U.mtime.toISOString(),etag:vq6(W,U.mtime,U.size)})}catch{}}}}catch{}}function bq6($,X){let G=r1($).id;return[{name:"LIST_OBJECTS",description:"List objects in the local assets directory with pagination support",inputSchema:H.object({prefix:H.string().optional(),maxKeys:H.number().optional().default(1000),continuationToken:H.string().optional(),delimiter:H.string().optional()}),outputSchema:H.object({objects:H.array(H.object({key:H.string(),size:H.number(),lastModified:H.string(),etag:H.string()})),nextContinuationToken:H.string().optional(),isTruncated:H.boolean(),commonPrefixes:H.array(H.string()).optional()}),handler:async(Q)=>{let J=Q,Z=J.prefix||"",W=J.maxKeys??1000,K=J.delimiter,F=J.continuationToken,U=kq6(G);await e09(U,{recursive:!0});let B={objects:[],commonPrefixes:new Set};await _q6(U,U,Z,K,B),B.objects.sort((L,j)=>L.key.localeCompare(j.key));let N=0;if(F){if(N=B.objects.findIndex((L)=>L.key>F),N===-1)N=B.objects.length}let w=B.objects.slice(N,N+W),z=N+W<B.objects.length,O=z?w[w.length-1]?.key:void 0;return{objects:w,isTruncated:z,nextContinuationToken:O,commonPrefixes:Array.from(B.commonPrefixes).sort()}}},{name:"GET_OBJECT_METADATA",description:"Get metadata for a file in the local assets directory",inputSchema:H.object({key:H.string()}),outputSchema:H.object({contentType:H.string().optional(),contentLength:H.number(),lastModified:H.string(),etag:H.string(),metadata:H.record(H.string(),H.string()).optional()}),handler:async(Q)=>{let J=Q,Z=FI0(G,J.key),W=await Rq6(Z);return{contentType:DV0(J.key),contentLength:W.size,lastModified:W.mtime.toISOString(),etag:vq6(Z,W.mtime,W.size)}}},{name:"GET_PRESIGNED_URL",description:"Generate a presigned URL for downloading a file from local storage",inputSchema:H.object({key:H.string(),expiresIn:H.number().optional()}),outputSchema:H.object({url:H.string(),expiresIn:H.number()}),handler:async(Q)=>{let J=Q,Z=J.expiresIn??Vq6;return{url:Mq6(X,G,J.key,Z,"GET"),expiresIn:Z}}},{name:"PUT_PRESIGNED_URL",description:"Generate a presigned URL for uploading a file to local storage",inputSchema:H.object({key:H.string(),expiresIn:H.number().optional(),contentType:H.string().optional()}),outputSchema:H.object({url:H.string(),expiresIn:H.number()}),handler:async(Q)=>{let J=Q,Z=J.expiresIn??Vq6;return{url:Mq6(X,G,J.key,Z,"PUT"),expiresIn:Z}}},{name:"DELETE_OBJECT",description:"Delete a single file from local storage",inputSchema:H.object({key:H.string()}),outputSchema:H.object({success:H.boolean(),key:H.string()}),handler:async(Q)=>{let J=Q,Z=FI0(G,J.key);try{return await Tq6(Z),{success:!0,key:J.key}}catch{return{success:!1,key:J.key}}}},{name:"DELETE_OBJECTS",description:"Delete multiple files from local storage",inputSchema:H.object({keys:H.array(H.string()).max(1000)}),outputSchema:H.object({deleted:H.array(H.string()),errors:H.array(H.object({key:H.string(),message:H.string()}))}),handler:async(Q)=>{let J=Q,Z=[],W=[];return await Promise.all(J.keys.map(async(K)=>{let F=FI0(G,K);try{await Tq6(F),Z.push(K)}catch(U){W.push({key:K,message:U instanceof Error?U.message:"Unknown error"})}})),{deleted:Z,errors:W}}}]}async function BI0($,X,Y){let G=bq6(X,Y),Q=new vw({name:"dev-assets-mcp",version:"1.0.0"},{capabilities:{tools:{}}});for(let Z of G){let W="shape"in Z.inputSchema?Z.inputSchema.shape:H.object({}).shape,K=Z.outputSchema&&"shape"in Z.outputSchema?Z.outputSchema.shape:H.object({}).shape;Q.registerTool(Z.name,{description:Z.description??"",inputSchema:W,outputSchema:K,annotations:Z.annotations,_meta:Z._meta},async(F)=>{try{let U=await Z.handler(F);return{content:[{type:"text",text:JSON.stringify(U)}],structuredContent:U}}catch(U){return{content:[{type:"text",text:`Error: ${U.message}`}],isError:!0}}})}let J=new XH({enableJsonResponse:$.headers.get("Accept")?.includes("application/json")??!1});return await Q.connect(J),J.handleRequest($)}async function fq6($,X,Y,G){let J=bq6(Y,G).find((Z)=>Z.name===$);if(!J)return{content:[{type:"text",text:`Tool not found: ${$}`}],isError:!0};try{let Z=await J.handler(X);return{content:[{type:"text",text:JSON.stringify(Z)}]}}catch(Z){return{content:[{type:"text",text:Z instanceof Error?Z.message:String(Z)}],isError:!0}}}var Y49="./data/assets",Vq6=3600,Sq6,yq6;var xq6=D(()=>{F5();c5();l1();L01();ur();qh1();Sq6=new u4;Sq6.all("/",async($)=>{let X=$.get("meshContext"),Y=new URL($.req.url),G=`${Y.protocol}//${Y.host}`;return BI0($.req.raw,X,G)});yq6=Sq6});var gq6={};g6(gq6,{mountDevRoutes:()=>Q49});function Q49($,X){$.all("/mcp/:connectionId{.*_dev-assets$}",X,async(G)=>{let Q=G.get("meshContext"),J=new URL(G.req.url),Z=`${J.protocol}//${J.host}`;return BI0(G.req.raw,Q,Z)}),$.all("/mcp/:connectionId{.*_dev-assets$}/call-tool/:toolName",X,async(G)=>{let Q=G.get("meshContext"),J=new URL(G.req.url),Z=`${J.protocol}//${J.host}`,W=G.req.param("toolName");if(!W)return G.json({error:"Missing tool name"},400);let K=await G.req.json(),F=await fq6(W,K,Q,Z);if(F.isError)return G.json(F.content,500);return G.json(F.content)}),$.use("/mcp/dev-assets",X),$.route("/mcp/dev-assets",yq6);let Y=new u4;Y.use("*",u3({mountPath:"/api/dev-assets"})),Y.route("/",Ph1({orgFromPath:!1})),$.route("/api/dev-assets",Y)}var hq6=D(()=>{c5();HV0();qh1();xq6()});var uq6=D(()=>{lH0();cH0();fz()});var Uu1=D(()=>{uq6()});var lq6={};g6(lq6,{streamAgent:()=>mq6,createDecopilotClient:()=>Z49});async function J49($){let{parseJsonEventStream:X,uiMessageChunkSchema:Y}=await Promise.resolve().then(() => (u9(),fP0));return X({stream:$,schema:Y}).pipeThrough(new TransformStream({transform(G,Q){if(!G.success)throw G.error;Q.enqueue(G.value)}}))}async function mq6($,X,Y,G,Q){let{readUIMessageStream:J}=await Promise.resolve().then(() => (u9(),fP0)),Z=Y.value??Y.id;if(!Z)throw Error("Agent binding has no id or value \u2014 cannot resolve agent");let W=G.credentialId??Y.credentialId,K=G.thinking??Y.thinking,F=K?.id,U={messages:G.messages,...F?{models:{credentialId:W,thinking:K,...G.coding??Y.coding?{coding:G.coding??Y.coding}:{},...G.fast??Y.fast?{fast:G.fast??Y.fast}:{}}}:{},agent:{id:Z},temperature:G.temperature??Y.temperature,toolApprovalLevel:G.toolApprovalLevel??Y.toolApprovalLevel,mode:G.mode??Y.mode??"default",...G.memory?{memory:G.memory}:{},...G.thread_id?{thread_id:G.thread_id}:{}},B=await fetch($,{method:"POST",headers:{"Content-Type":"application/json","x-mesh-token":X,Authorization:`Bearer ${X}`},body:JSON.stringify(U),signal:Q?.signal});if(!B.ok){let w=await B.text().catch(()=>""),z=`HTTP ${B.status}`;try{let O=JSON.parse(w);if(O?.error)z=O.error}catch{if(w)z=w}throw Error(z)}if(!B.body)throw Error("Empty response body from decopilot stream");let N=await J49(B.body);return J({stream:N})}function Z49($){let{baseUrl:X,orgSlug:Y,token:G}=$,Q=`${X}/${Y}/decopilot/runtime/stream`;return{stream(J,Z){let W={__type:"@deco/agent",id:J.agent.id,credentialId:J.credentialId??"",thinking:J.thinking??{id:"",title:""},coding:J.coding,fast:J.fast,toolApprovalLevel:J.toolApprovalLevel,mode:J.mode,temperature:J.temperature};return mq6(Q,G,W,J,Z)}}}function cq6($){let X=$.properties;if(!X)return $;for(let Y of Object.values(X)){let G=Y.properties;if(!G?.__type?.const)continue;let Q=G.__type.const,J=W49.get(Q);if(!J)continue;let Z=J.map((W)=>({name:String(W.name),...W.inputSchema&&{inputSchema:H.toJSONSchema(W.inputSchema)},...W.outputSchema&&{outputSchema:H.toJSONSchema(W.outputSchema)}}));G.__binding={const:Z}}return $}var W49,vX7,K49=($)=>{return typeof $==="object"&&$!==null&&$.__type==="@deco/agent"},wI0=($)=>{return typeof $==="object"&&$!==null&&typeof $.__type==="string"&&$.__type!=="@deco/agent"&&typeof $.value==="string"},Bu1=($,X,Y)=>{let G=Y?{"x-caller-app":Y}:void 0;if(X.cookie)G??={},G.cookie=X.cookie;if(X.token)G??={},G["x-mesh-token"]=X.token;return{type:"HTTP",url:new URL(`/mcp/${$}`,X.meshUrl).href,token:X.token,headers:G}},H49=($,X,Y)=>{let G=Bu1($,X,Y);return new Proxy(Zp.forConnection(G),{get(Q,J){if(J==="value")return $;if(J==="__type")return Y;return Q[J]}})},F49=($,X)=>{let Y=X.organizationSlug;if(!Y)throw Error("organizationSlug is required for agent bindings");let G=`${X.meshUrl}/api/${Y}/decopilot/runtime/stream`;return{STREAM:async(Q,J)=>{let{streamAgent:Z}=await Promise.resolve().then(() => lq6);return Z(G,X.token,$,Q,J)}}},NI0=($,X)=>{if($===null||$===void 0)return $;if(Array.isArray($))return $.map((Y)=>NI0(Y,X));if(typeof $==="object"){if(K49($))return F49($,X);if(wI0($))return H49($.value,X,$.__type);let Y={};for(let[G,Q]of Object.entries($))Y[G]=NI0(Q,X);return Y}return $},dq6=($)=>{return NI0($.state,$)};var tt=D(()=>{Uu1();l1();W49=new Map;vX7=H.object({id:H.string(),title:H.string(),capabilities:H.object({vision:H.boolean().optional(),text:H.boolean().optional(),tools:H.boolean().optional(),reasoning:H.boolean().optional()}).passthrough().optional(),provider:H.string().optional().nullable(),limits:H.object({contextWindow:H.number().optional(),maxOutputTokens:H.number().optional()}).passthrough().optional()})});var U49,iq6=($,X,Y)=>{if(!X)return null;if($===void 0||$==="*")return"*";if(typeof $==="string")return $===X?$:null;if(Array.isArray($))return $.includes(X)?X:null;if(typeof $==="function")return $(X,Y)??null;return null},B49=($,X,Y)=>{let G=X.headers.get("Origin"),Q=iq6(Y.origin,G,X);if(Q)$.set("Access-Control-Allow-Origin",Q);if(Y.credentials)$.set("Access-Control-Allow-Credentials","true");if(Y.exposeHeaders?.length)$.set("Access-Control-Expose-Headers",Y.exposeHeaders.join(", "))},pq6=($,X)=>{let Y=new Headers,G=$.headers.get("Origin"),Q=iq6(X.origin,G,$);if(Q)Y.set("Access-Control-Allow-Origin",Q);if(X.credentials)Y.set("Access-Control-Allow-Credentials","true");let J=X.allowMethods??U49;Y.set("Access-Control-Allow-Methods",J.join(", "));let Z=$.headers.get("Access-Control-Request-Headers");if(X.allowHeaders?.length)Y.set("Access-Control-Allow-Headers",X.allowHeaders.join(", "));else if(Z)Y.set("Access-Control-Allow-Headers",Z);if(X.maxAge!==void 0)Y.set("Access-Control-Max-Age",X.maxAge.toString());return new Response(null,{status:204,headers:Y})},nq6=($,X,Y)=>{let G=new Headers($.headers);return B49(G,X,Y),new Response($.body,{status:$.status,statusText:$.statusText,headers:G})};var rq6=D(()=>{U49=["GET","HEAD","PUT","POST","DELETE","PATCH"]});function tq6($=32){let Y=new Uint8Array($);return crypto.getRandomValues(Y),Array.from(Y,(G)=>"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789"[G%62]).join("")}function N49($){try{let X=new URL($);return X.protocol==="https:"||X.hostname==="localhost"||X.hostname.endsWith(".localhost")||X.hostname==="127.0.0.1"||!X.protocol.startsWith("http")}catch{return!1}}function aq6($){return btoa(JSON.stringify($)).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}function oq6($){try{let X=$.replace(/-/g,"+").replace(/_/g,"/");return JSON.parse(atob(X))}catch{return null}}function sq6($){return{handleProtectedResourceMetadata:(F)=>{let U=CN(new URL(F.url)),B=`${U.origin}/mcp`;return Response.json({resource:B,authorization_servers:[U.origin],scopes_supported:["*"],bearer_methods_supported:["header"],resource_signing_alg_values_supported:["RS256","none"]})},handleAuthorizationServerMetadata:(F)=>{let B=CN(new URL(F.url)).origin;return Response.json({issuer:B,authorization_endpoint:`${B}/authorize`,token_endpoint:`${B}/token`,registration_endpoint:`${B}/register`,scopes_supported:["*"],response_types_supported:["code"],response_modes_supported:["query"],grant_types_supported:["authorization_code","refresh_token"],token_endpoint_auth_methods_supported:["none","client_secret_post"],code_challenge_methods_supported:["S256","plain"]})},handleAuthorize:(F)=>{let U=CN(new URL(F.url)),B=U.searchParams.get("redirect_uri"),N=U.searchParams.get("response_type"),w=U.searchParams.get("state"),z=U.searchParams.get("code_challenge"),O=U.searchParams.get("code_challenge_method");if(!B)return Response.json({error:"invalid_request",error_description:"redirect_uri required"},{status:400});if(N!=="code")return Response.json({error:"unsupported_response_type",error_description:"Only 'code' is supported"},{status:400});let L=CN(new URL(`${U.origin}/oauth/callback`)),j=L.toString(),T=aq6({redirectUri:B,clientState:w??void 0,codeChallenge:z??void 0,codeChallengeMethod:O??void 0,oauthCallbackUri:j});L.searchParams.set("state",T);let I=$.authorizationUrl(L.toString());return Response.redirect(I,302)},handleOAuthCallback:async(F)=>{let U=CN(new URL(F.url)),B=U.searchParams.get("code"),N=U.searchParams.get("state"),w=U.searchParams.get("error"),z=N?oq6(N):null;if(w){let O=U.searchParams.get("error_description")??"Authorization failed";if(z?.redirectUri){let L=CN(new URL(z.redirectUri));if(L.searchParams.set("error",w),L.searchParams.set("error_description",O),z.clientState)L.searchParams.set("state",z.clientState);return Response.redirect(L.toString(),302)}return Response.json({error:w,error_description:O},{status:400})}if(!B||!z)return Response.json({error:"invalid_request",error_description:"Missing code or state"},{status:400});try{let O=z.oauthCallbackUri??CN(new URL(`${U.origin}/oauth/callback`)).toString(),L={code:B,redirect_uri:O},j=await $.exchangeCode(L),P={accessToken:j.access_token,tokenType:j.token_type,refreshToken:j.refresh_token,expiresIn:j.expires_in,scope:j.scope,codeChallenge:z.codeChallenge,codeChallengeMethod:z.codeChallengeMethod},T=aq6(P),I=CN(new URL(z.redirectUri));if(I.searchParams.set("code",T),z.clientState)I.searchParams.set("state",z.clientState);return Response.redirect(I.toString(),302)}catch(O){console.error("OAuth callback error:",O);let L=CN(new URL(z.redirectUri));if(L.searchParams.set("error","server_error"),L.searchParams.set("error_description","Failed to exchange authorization code"),z.clientState)L.searchParams.set("state",z.clientState);return Response.redirect(L.toString(),302)}},handleToken:async(F)=>{try{let U=F.headers.get("content-type")??"",B;if(U.includes("application/x-www-form-urlencoded")){let P=await F.formData();B=Object.fromEntries(P.entries())}else{let P=await F.json();if(typeof P!=="object"||P===null||Array.isArray(P))return Response.json({error:"invalid_request",error_description:"Request body must be a JSON object"},{status:400});B=P}let{code:N,code_verifier:w,grant_type:z,refresh_token:O}=B;if(z==="refresh_token"){if(typeof O!=="string"||!O)return Response.json({error:"invalid_request",error_description:"refresh_token is required and must be a string"},{status:400});if(!$.refreshToken)return Response.json({error:"unsupported_grant_type",error_description:"refresh_token grant not supported"},{status:400});let P;try{P=await $.refreshToken(O)}catch(I){if(I instanceof zI0)return Response.json({error:I.error,...I.errorDescription?{error_description:I.errorDescription}:{}},{status:400});throw I}let T={access_token:P.access_token,token_type:P.token_type};if(P.refresh_token)T.refresh_token=P.refresh_token;if(P.expires_in!==void 0)T.expires_in=P.expires_in;if(P.scope)T.scope=P.scope;return Response.json(T,{headers:{"Cache-Control":"no-store",Pragma:"no-cache"}})}if(z!=="authorization_code")return Response.json({error:"unsupported_grant_type",error_description:"Only authorization_code and refresh_token supported"},{status:400});if(typeof N!=="string"||!N)return Response.json({error:"invalid_request",error_description:"code is required and must be a string"},{status:400});let L=oq6(N);if(!L||!L.accessToken)return Response.json({error:"invalid_grant",error_description:"Invalid or expired code"},{status:400});if(L.codeChallenge){if(typeof w!=="string"||!w)return Response.json({error:"invalid_grant",error_description:"code_verifier required and must be a string"},{status:400});let P;if(L.codeChallengeMethod==="S256"){let I=new TextEncoder().encode(w),V=await crypto.subtle.digest("SHA-256",I);P=btoa(String.fromCharCode(...new Uint8Array(V))).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}else P=w;if(P!==L.codeChallenge)return Response.json({error:"invalid_grant",error_description:"Invalid code_verifier"},{status:400})}let j={access_token:L.accessToken,token_type:L.tokenType};if(L.refreshToken)j.refresh_token=L.refreshToken;if(L.expiresIn!==void 0)j.expires_in=L.expiresIn;if(L.scope)j.scope=L.scope;return Response.json(j,{headers:{"Cache-Control":"no-store",Pragma:"no-cache"}})}catch(U){return console.error("Token exchange error:",U),Response.json({error:"server_error",error_description:"Failed to process token request"},{status:500})}},handleClientRegistration:async(F)=>{try{let U=await F.json();if(!U.redirect_uris||U.redirect_uris.length===0)return Response.json({error:"invalid_redirect_uri",error_description:"At least one redirect_uri is required"},{status:400});for(let O of U.redirect_uris)if(!N49(O))return Response.json({error:"invalid_redirect_uri",error_description:`Invalid redirect URI: ${O}`},{status:400});let B=tq6(32),N=U.token_endpoint_auth_method!=="none"?tq6(32):void 0,w=Math.floor(Date.now()/1000),z={client_id:B,client_secret:N,client_name:U.client_name,redirect_uris:U.redirect_uris,grant_types:U.grant_types??["authorization_code"],response_types:U.response_types??["code"],token_endpoint_auth_method:U.token_endpoint_auth_method??"client_secret_post",scope:U.scope,client_id_issued_at:w,client_secret_expires_at:0};if($.persistence)await $.persistence.saveClient(z);return new Response(JSON.stringify(z),{status:201,headers:{"Content-Type":"application/json","Cache-Control":"no-store",Pragma:"no-cache"}})}catch(U){return console.error("Client registration error:",U),Response.json({error:"invalid_client_metadata",error_description:"Invalid client registration request"},{status:400})}},createUnauthorizedResponse:(F)=>{let N=`Bearer resource_metadata="${`${CN(new URL(F.url)).origin}/.well-known/oauth-protected-resource`}", scope="*"`;return Response.json({jsonrpc:"2.0",error:{code:-32000,message:"Unauthorized: Authentication required"},id:null},{status:401,headers:{"WWW-Authenticate":N,"Access-Control-Expose-Headers":"WWW-Authenticate"}})},hasAuth:(F)=>F.headers.has("Authorization")}}var zI0,CN=($)=>{if(!($.hostname==="localhost"||$.hostname.endsWith(".localhost")||$.hostname==="127.0.0.1"))$.protocol="https:";return $};var DI0=D(()=>{zI0=class zI0 extends Error{error;errorDescription;constructor($="invalid_grant",X){super(X??$);this.name="OAuthInvalidGrantError",this.error=$,this.errorDescription=X}}});import{AsyncLocalStorage as w49}from"async_hooks";var eq6,FG1;var OI0=D(()=>{eq6=new w49,FG1={getStore:()=>{return eq6.getStore()},run:($,X,...Y)=>eq6.run($,X,...Y)}});var XA6="SELF",wu1=($)=>{return typeof $==="object"&&$!==null&&"handler"in $&&"events"in $&&typeof $.handler==="function"&&Array.isArray($.events)},YA6=($)=>{return typeof $==="object"&&$!==null&&"handler"in $&&"events"in $&&typeof $.handler==="function"&&Array.isArray($.events)},$A6="::",GA6=($)=>{let X=$.indexOf($A6);if(X===-1)return null;let Y=$.substring(0,X),G=$.substring(X+$A6.length);return[Y,G]},z49=($)=>{if(!$.startsWith("cron/"))return null;let X=$.substring(5),Y=X.indexOf("/");if(Y===-1)return null;let G=X.substring(0,Y),Q=X.substring(Y+1);return[G,Q]},QA6=($)=>{if(wu1($))return[];return Object.keys($)},D49=($,X)=>{if(wu1($))return $.events;let Y=$[X];if(!Y)return[];if(YA6(Y))return Y.events;return Object.keys(Y)},Nu1=($,X,Y)=>{if($===XA6){if(!Y)return console.warn("[Event] SELF binding used but no connectionId available"),null;return Y}let G=X[$];if(!wI0(G))return console.warn(`[Event] Binding "${$}" not found in state`),null;return G.value},O49=($,X,Y)=>{let G=X;if(wu1($)){let J=[];for(let Z of $.events){let W=GA6(Z);if(!W){console.warn(`[Event] Global handler event "${Z}" must be prefixed with BINDING:: (e.g., "SELF::${Z}" or "DATABASE::${Z}")`);continue}let[K,F]=W,U=Nu1(K,G,Y);if(!U)continue;J.push({eventType:F,publisher:U})}return J}let Q=[];for(let J of QA6($)){let Z=Nu1(J,G,Y);if(!Z)continue;let W=D49($,J);for(let K of W)Q.push({eventType:K,publisher:Z})}return Q},L49=($)=>{let X=new Map;for(let Y of $){let G=Y.source,Q=X.get(G)||[];Q.push(Y),X.set(G,Q)}return X},E49=($)=>{let X=new Map;for(let Y of $){let G=Y.type,Q=X.get(G)||[];Q.push(Y),X.set(G,Q)}return X},j49=($)=>{let X={},Y={},G=!1,Q=0,J=[];for(let Z of $){if(Z.results)Object.assign(Y,Z.results);if(Z.success===!1){if(G=!0,Z.error)J.push(Z.error)}if(Z.processedCount!==void 0)Q+=Z.processedCount}if(Object.keys(Y).length>0)X.results=Y;if(X.success=!G,J.length>0)X.error=J.join("; ");if(Q>0)X.processedCount=Q;return X},P49=async($,X,Y,G,Q)=>{let J=G;if(wu1($)){let U=new Set;for(let N of $.events){let w=GA6(N);if(!w)continue;let[z,O]=w,L=Nu1(z,J,Q);if(!L)continue;U.add(`${L}:${O}`)}let B=X.filter((N)=>{let w=`${N.source}:${N.type}`;return U.has(w)});if(B.length===0)return{success:!0};try{return await $.handler({events:B},Y)}catch(N){return{success:!1,error:N instanceof Error?N.message:String(N)}}}let Z=new Map;for(let U of QA6($)){let B=Nu1(U,J,Q);if(B)Z.set(B,U)}let W=L49(X),K=[];for(let[U,B]of W){let N=Z.get(U);if(!N)continue;let w=$[N];if(!w)continue;if(YA6(w)){K.push((async()=>{try{return await w.handler({events:B},Y)}catch(L){let j={};for(let P of B)j[P.id]={success:!1,error:L instanceof Error?L.message:String(L)};return{results:j}}})());continue}let z=w,O=E49(B);for(let[L,j]of O){let P=z[L];if(!P)continue;K.push((async()=>{try{let T=await P({events:j},Y),I={};for(let V of j)I[V.id]=T;return{results:I}}catch(T){let I={};for(let V of j)I[V.id]={success:!1,error:T instanceof Error?T.message:String(T)};return{results:I}}})())}}let F=await Promise.all(K);if(F.length===0)return{success:!0};return j49(F)},zu1;var LI0=D(()=>{tt();zu1={subscriptions:O49,execute:P49,parseCron:z49}});function at($){return $.toLowerCase().trim().replace(/[^a-z0-9]+/g,"-").replace(/^-|-$/g,"")}function ZA6($,X){return`${$}::${at(X)}`}function EI0($){return`START_WORKFLOW_${at($).toUpperCase().replace(/-/g,"_")}`}function WA6($,X){let Y=Bu1("self",{meshUrl:$,token:X});return Zp.forConnection(Y)}function q49($,X){if(!Ju.has($)&&Ju.size>=KA6){let Y=Ju.keys().next().value;if(Y!==void 0)Ju.delete(Y)}Ju.set($,X)}function A49($){return`Workflows Agent (${$})`}function JA6($,X){if(!Zu.has($)&&Zu.size>=KA6){let Y=Zu.keys().next().value;if(Y!==void 0)Zu.delete(Y)}Zu.set($,X)}async function T49($,X,Y){let G=Zu.get($);if(G)return console.log(`${Y} Using cached default Virtual MCP: ${G}`),G;let Q=A49($);try{let J=await X.COLLECTION_VIRTUAL_MCP_LIST({where:{operator:"and",conditions:[{field:["connection_id"],operator:"eq",value:$},{field:["title"],operator:"eq",value:Q}]},limit:1});if(J.items.length>0){let Z=J.items[0].id;return JA6($,Z),console.log(`${Y} Found existing default Virtual MCP: ${Z}`),Z}}catch(J){console.warn(`${Y} Could not list Virtual MCPs \u2014 proceeding without default. Error: ${J instanceof Error?J.message:String(J)}`);return}try{let Z=(await X.COLLECTION_VIRTUAL_MCP_CREATE({data:{title:Q,connections:[{connection_id:$,selected_tools:null}]}})).item.id;return JA6($,Z),console.log(`${Y} Created default Virtual MCP: ${Z}`),Z}catch(J){console.warn(`${Y} Could not create default Virtual MCP \u2014 proceeding without default. Error: ${J instanceof Error?J.message:String(J)}`);return}}function V49($){return JSON.stringify($.map((X)=>({title:X.title,description:X.description??void 0,virtual_mcp_id:X.virtual_mcp_id??void 0,steps:X.steps,toolId:X.toolId??void 0,inputSchema:X.inputSchema??void 0})))}async function M49($,X,Y,G,Q){let J=`[Workflows][${Y}]`,Z=$.find((T)=>at(T.title)==="");if(Z!==void 0){console.warn(`${J} Workflow title "${Z.title}" produces an empty ID. Skipping sync.`);return}if($.length>0){let T=$.map((V)=>at(V.title));if(new Set(T).size!==T.length){let V=new Set(T.filter((v,S)=>T.indexOf(v)!==S)),R=$.filter((v)=>V.has(at(v.title))).map((v)=>v.title);console.warn(`${J} Workflow titles that produce duplicate IDs: ${[...new Set(R)].join(", ")}. Skipping sync.`);return}}let W=V49($),K=Ju.get(Y);if(K===W){console.log(`${J} Fingerprint unchanged \u2014 skipping sync. Declared: ${$.length} workflow(s): [${$.map((T)=>T.title).join(", ")}]`);return}console.log(`${J} Fingerprint changed (or first sync) \u2014 starting sync. Declared: ${$.length} workflow(s): [${$.map((T)=>T.title).join(", ")}]`,K?"(previous fingerprint existed)":"(no previous fingerprint)");let F=Q??WA6(X,G),B=$.some((T)=>T.virtual_mcp_id===void 0)?await T49(Y,F,J):void 0,N;try{let T=[],I=0,V=200;while(!0){let R=await F.COLLECTION_WORKFLOW_LIST({limit:V,offset:I});if(T.push(...R.items),!R.hasMore||R.items.length===0)break;I+=R.items.length}N=T,console.log(`${J} LIST returned ${N.length} total workflow(s). IDs owned by this connection: [${N.filter((R)=>R.id.startsWith(`${Y}::`)).map((R)=>R.id).join(", ")||"none"}]`)}catch(T){let I=T instanceof Error?T.message:String(T);console.warn(`${J} Could not list workflows (workflows plugin may not be enabled). Skipping sync. Error: ${I}`);return}let w=`${Y}::`,z=new Map(N.filter((T)=>T.id.startsWith(w)).map((T)=>[T.id,T])),O=$.map((T)=>[ZA6(Y,T.title),T]),L=new Set(O.map(([T])=>T)),j=!1;await Promise.all(O.map(async([T,I])=>{let V=z.has(T)?"UPDATE":"CREATE";console.log(`${J} ${V} "${I.title}" (id=${T})`);try{let R=I.virtual_mcp_id??B;if(V==="UPDATE"){let v=await F.COLLECTION_WORKFLOW_UPDATE({id:T,data:{title:I.title,description:I.description,...R!==void 0&&{virtual_mcp_id:R},steps:I.steps,input_schema:I.inputSchema===void 0?void 0:I.inputSchema??null}});if(!v.success)j=!0,console.warn(`${J} UPDATE "${I.title}" returned success=false:`,String(v.error??"(no error message)"));else console.log(`${J} UPDATE "${I.title}" OK`)}else await F.COLLECTION_WORKFLOW_CREATE({data:{id:T,title:I.title,description:I.description,virtual_mcp_id:R,steps:I.steps,input_schema:I.inputSchema??null}}),console.log(`${J} CREATE "${I.title}" OK`)}catch(R){j=!0,console.warn(`${J} Failed to ${V} workflow "${I.title}":`,R instanceof Error?R.message:String(R))}}));let P=[...z.keys()].filter((T)=>!L.has(T));if(P.length>0)console.log(`${J} Deleting ${P.length} orphaned workflow(s): [${P.join(", ")}]`);if(await Promise.all(P.map(async(T)=>{try{await F.COLLECTION_WORKFLOW_DELETE({id:T}),console.log(`${J} DELETE "${T}" OK`)}catch(I){j=!0,console.warn(`${J} Failed to delete orphaned workflow "${T}":`,I instanceof Error?I.message:String(I))}})),!j)q49(Y,W),console.log(`${J} Sync complete \u2014 fingerprint stored.`);else console.warn(`${J} Sync finished with errors \u2014 fingerprint NOT stored so the next call will retry.`)}async function I49($,X,Y,G,Q){let Z=(Du1.get(Y)??Promise.resolve()).catch(()=>{}).then(()=>M49($,X,Y,G,Q)).finally(()=>{if(Du1.get(Y)===Z)Du1.delete(Y)});return Du1.set(Y,Z),Z}var Du1,KA6=500,Ju,Zu,HA6,Ou1;var jI0=D(()=>{tt();Uu1();Du1=new Map,Ju=new Map;Zu=new Map;HA6=["SELF::COLLECTION_WORKFLOW_LIST","SELF::COLLECTION_WORKFLOW_CREATE","SELF::COLLECTION_WORKFLOW_UPDATE","SELF::COLLECTION_WORKFLOW_DELETE","SELF::COLLECTION_WORKFLOW_EXECUTION_CREATE","SELF::COLLECTION_VIRTUAL_MCP_LIST","SELF::COLLECTION_VIRTUAL_MCP_CREATE"],Ou1={sync:I49,slugify:at,workflowId:ZA6,toolId:EI0,createExecution:async($,X,Y)=>{return(await WA6($,X).COLLECTION_WORKFLOW_EXECUTION_CREATE(Y)).item.id},clearFingerprint:($)=>{Ju.delete($),Zu.delete($)}}});function vN($){return{...$,execute:(X)=>{let Y=UG1(X.runtimeContext);return $.execute({...X,runtimeContext:Y},Y)}}}var UG1=($)=>{let X=FG1.getStore();if(!X){if($)return $;throw Error("Missing context, did you forget to call State.bind?")}return X},R49=($,X)=>{let Y=X;return typeof Y[$]<"u"?Y[$]:X?.MESH_REQUEST_CONTEXT?.state?.[$]},Lu1=($)=>{let X=$.runtimeContext.env.MESH_REQUEST_CONTEXT;return{connectionId:X?.connectionId,meshUrl:X?.meshUrl,token:X?.token}},S49=({events:$,workflows:X,configuration:{state:Y,scopes:G,onChange:Q}={}}={})=>{let J=Y?cq6(H.toJSONSchema(Y)):{type:"object",properties:{}},Z=String($?.bus??"EVENT_BUS");return[...Q||$||X?.length?[vN({id:"ON_MCP_CONFIGURATION",description:"MCP Configuration On Change",inputSchema:H.object({state:Y??H.unknown(),scopes:H.array(H.string()).describe("Array of scopes in format 'KEY::SCOPE' (e.g., 'GMAIL::GetCurrentUser')")}),outputSchema:H.object({}),execute:async(W)=>{let K=W.context.state;await Q?.(W.runtimeContext.env,{state:K,scopes:W.context.scopes});let F=R49(Z,W.runtimeContext.env);if($&&K&&F){let{connectionId:U}=Lu1(W),B=zu1.subscriptions($?.handlers??{},K,U);if(await F.EVENT_SYNC_SUBSCRIPTIONS({subscriptions:B}),U){let N=B.filter((w)=>w.eventType.startsWith("cron/")&&w.publisher===U);await Promise.all(N.map(async(w)=>{let z=zu1.parseCron(w.eventType);if(z){let[,O]=z;await F.EVENT_PUBLISH({type:w.eventType,cron:O})}}))}}if(X?.length){let{connectionId:U,meshUrl:B,token:N}=Lu1(W);if(U&&B)await Ou1.sync(X,B,U,N)}return Promise.resolve({})}})]:[],...$?.handlers?[vN({id:"ON_EVENTS",description:"Receive and process CloudEvents from the event bus. Returns per-event or batch results.",inputSchema:FP1,outputSchema:UP1,execute:async(W)=>{let K=W.runtimeContext.env,F=K.MESH_REQUEST_CONTEXT?.state,{connectionId:U}=Lu1(W);return zu1.execute($.handlers,W.context.events,K,F,U)}})]:[],vN({id:"MCP_CONFIGURATION",description:"MCP Configuration",inputSchema:H.object({}),outputSchema:H.object({stateSchema:H.unknown(),scopes:H.array(H.string()).optional()}),execute:()=>{return Promise.resolve({stateSchema:J,scopes:[...G??[],...$?[`${Z}::EVENT_SYNC_SUBSCRIPTIONS`]:[],...X?.length?[...HA6]:[]]})}}),...X?.length?X.map((W)=>{let K=W.toolId??EI0(W.title),F=[W.description?`Run workflow: ${W.description}`:`Start the "${W.title}" workflow.`,"Returns an execution_id immediately. Use COLLECTION_WORKFLOW_EXECUTION_GET to track progress."].join(" ");return vN({id:K,description:(()=>{if(!W.inputSchema)return F;let U=JSON.stringify(W.inputSchema,null,2);return U.length<=2048?`${F}
+Use sentence case for the title. No markdown fences.`;var KP6=D(()=>{u9();LY1()});function A19($){if(!$||$.length>255||$.includes("..")||$.startsWith("/")||$.endsWith("/")||$.endsWith(".lock")||!q19.test($))throw Error(`Invalid branch name: ${$}`)}function mM0($){let{runner:X}=$.get("vmClaim");if(!X)return $.json({error:"No sandbox runner configured"},503);return X}async function JZ($,X,Y){let G=mM0($);if(G instanceof Response)return G;let{claimName:Q}=$.get("vmClaim"),J=Y?.method??"POST",Z=null,W=new Headers;if(Y?.forwardJsonBody)Z=await $.req.text(),W.set("content-type","application/json");let K;try{K=await G.proxyDaemonRequest(Q,X,{method:J,headers:W,body:Z,...Y?.signal?{signal:Y.signal}:{}})}catch(B){let N=B instanceof Error?B.message:String(B);return $.json({error:`Daemon unreachable: ${N}`},502)}if(Y?.map404to410&&K.status===404){try{await K.body?.cancel()}catch{}return $.json({error:"Sandbox handle is gone. The sandbox needs to be re-provisioned."},410,dt)}let F=await K.text(),U=K.headers.get("content-type")??"application/json";return new Response(F,{status:K.status,headers:{"content-type":U,...dt}})}async function HP6($,X,Y,G="GET"){let Q=await $.proxyDaemonRequest(X,Y,{method:G,headers:new Headers,body:null});if(Q.status===404){try{await Q.body?.cancel()}catch{}throw Error("SANDBOX_GONE")}let J=await Q.text();if(!Q.ok)try{let Z=JSON.parse(J);throw Error(Z.error??`Daemon error (${Q.status})`)}catch(Z){if(Z instanceof Error&&Z.message!==J)throw Z;throw Error(`Daemon error (${Q.status})`)}return JSON.parse(J)}function I19($){return FP6.includes($)}var q19,T19=524288,V19,dt,M19,FP6,UP6=()=>{let $=new u4;return $.use("/:virtualMcpId/:branch/*",V19),$.post("/:virtualMcpId/:branch/write",(X)=>JZ(X,"/_sandbox/write",{forwardJsonBody:!0})),$.post("/:virtualMcpId/:branch/unlink",(X)=>JZ(X,"/_sandbox/unlink",{forwardJsonBody:!0})),$.post("/:virtualMcpId/:branch/read",(X)=>JZ(X,"/_sandbox/read",{forwardJsonBody:!0})),$.post("/:virtualMcpId/:branch/glob",(X)=>JZ(X,"/_sandbox/glob",{forwardJsonBody:!0})),$.post("/:virtualMcpId/:branch/exec/:script",(X)=>{let Y=X.req.param("script");if(!Y)return X.json({error:"missing script name"},400);return JZ(X,`/_sandbox/exec/${encodeURIComponent(Y)}`)}),$.post("/:virtualMcpId/:branch/exec/:script/kill",(X)=>{let Y=X.req.param("script");if(!Y)return X.json({error:"missing script name"},400);return JZ(X,`/_sandbox/exec/${encodeURIComponent(Y)}/kill`)}),$.get("/:virtualMcpId/:branch/config",(X)=>JZ(X,"/_sandbox/config",{method:"GET",map404to410:!0})),$.put("/:virtualMcpId/:branch/config",(X)=>JZ(X,"/_sandbox/config",{method:"PUT",forwardJsonBody:!0,map404to410:!0})),$.post("/:virtualMcpId/:branch/setup/:step",async(X)=>{let Y=X.req.param("step");if(!Y||!I19(Y))return X.json({error:`step must be one of: ${FP6.join(", ")}`},400);if(Y==="start"){let G=X.get("vmClaim");if(G.runner){let Q=r1(X.var.meshContext),J=CJ6(G.virtualMcpMetadata);try{await KT1({ctx:X.var.meshContext,runner:G.runner,handle:G.claimName,orgId:Q.id,userId:G.userId,entries:J})}catch(Z){let W=Z instanceof Error?Z.message:String(Z);return X.json({error:`Failed to push env to daemon: ${W}`},502)}}}return JZ(X,`/_sandbox/setup/${Y}`,{signal:X.req.raw.signal,map404to410:!0})}),$.get("/:virtualMcpId/:branch/events",(X)=>{let Y=X.get("vmClaim");if(!Y.runner)return HH(X,async(G)=>{await G.writeSSE({event:"phase",data:JSON.stringify({kind:"failed",reason:"unknown",message:"No sandbox runner configured on this mesh."})})});return YP6(X,{ctx:X.var.meshContext,claimName:Y.claimName,runner:Y.runner,branch:Y.branch,userId:Y.userId,projectRef:Y.projectRef,virtualMcpMetadata:Y.virtualMcpMetadata})}),$.get("/:virtualMcpId/:branch/git/status",(X)=>JZ(X,"/_sandbox/git/status",{method:"GET",map404to410:!0})),$.post("/:virtualMcpId/:branch/git/status",(X)=>JZ(X,"/_sandbox/git/status",{map404to410:!0})),$.post("/:virtualMcpId/:branch/git/diff",(X)=>JZ(X,"/_sandbox/git/diff",{forwardJsonBody:!0,map404to410:!0})),$.post("/:virtualMcpId/:branch/git/publish",(X)=>JZ(X,"/_sandbox/git/publish",{forwardJsonBody:!0,map404to410:!0})),$.post("/:virtualMcpId/:branch/git/discard",(X)=>JZ(X,"/_sandbox/git/discard",{forwardJsonBody:!0,map404to410:!0})),$.post("/:virtualMcpId/:branch/git/rebase",(X)=>JZ(X,"/_sandbox/git/rebase",{forwardJsonBody:!0,map404to410:!0})),$.post("/:virtualMcpId/:branch/git/suggest-commit",fP({maxSize:T19,onError:(X)=>X.json({error:"Payload too large"},413,dt)}),async(X)=>{let Y=mM0(X);if(Y instanceof Response)return Y;let{claimName:G}=X.get("vmClaim"),Q=X.var.meshContext;try{let[J,Z]=await Promise.all([HP6(Y,G,"/_sandbox/git/status","GET"),HP6(Y,G,"/_sandbox/git/diff","GET")]),W=await WP6(Q,J,Z);return X.json(W,200,dt)}catch(J){let Z=J instanceof Error?J.message:String(J);if(Z==="SANDBOX_GONE")return X.json({error:"Sandbox handle is gone. The sandbox needs to be re-provisioned."},410,dt);return X.json({error:Z},502,dt)}}),$.get("/:virtualMcpId/:branch/preview-fetch",async(X)=>{let Y=mM0(X);if(Y instanceof Response)return Y;let{claimName:G}=X.get("vmClaim"),Q=X.req.query("path");if(!Q)return X.json({error:"path query parameter is required"},400);if(!M19.has(Q))return X.json({error:"Path not allowed"},403);let J=await Y.getPreviewUrl(G);if(!J)return X.json({error:"Preview not available"},502);let Z=J.replace(/\/+$/,""),W;try{W=await fetch(`${Z}${Q}`)}catch{return X.json({error:"Preview unreachable"},502)}let K=await W.text();return new Response(K,{status:W.status,headers:{"content-type":W.headers.get("content-type")??"application/json"}})}),$};var BP6=D(()=>{c5();h71();Gu();ej6();RD();hM0();q71();GP6();Hq0();WT1();KP6();q19=/^[a-zA-Z0-9][a-zA-Z0-9/._-]*$/;V19=sj6(async($,X)=>{let Y=$.var.meshContext;try{G0(Y)}catch{return $.json({error:"Unauthorized"},401)}let G=K6(Y);if(!G)return $.json({error:"Unauthorized"},401);let Q;try{Q=r1(Y)}catch{return $.json({error:"Organization scope required"},403)}let J=$.req.param("virtualMcpId"),Z=$.req.param("branch");if(!J||!Z)return $.json({error:"virtualMcpId and branch are required"},400);try{A19(Z)}catch(N){let w=N instanceof Error?N.message:String(N);return $.json({error:w},400)}let W=await Y.storage.virtualMcps.findById(J);if(!W||W.organization_id!==Q.id)return $.json({error:"Virtual MCP not found"},404);let K=HM({orgId:Q.id,virtualMcpId:J,branch:Z}),F=Yu1({userId:G,projectRef:K},Z),U=W.metadata??null,B;try{B=(await yD(Y,{userId:G,branch:Z,virtualMcpMetadata:U})).provider}catch{B=null}if(!B)return $.json({error:"No sandbox runner found"},404);return $.set("vmClaim",{claimName:F,runner:B,virtualMcpId:J,branch:Z,userId:G,projectRef:K,virtualMcpMetadata:U}),X()});dt={"Cache-Control":"no-store, no-cache, must-revalidate",Pragma:"no-cache"};M19=new Set(["/.decofile","/live/_meta"]),FP6=["clone","install","start"]});var NP6=($)=>{let X=new u4;if(X.use("*",nh),X.route("/",Eh1()),X.route("/",eh1()),X.route("/",oh1({kvStorage:$.kvStorage})),X.route("/",dj6()),X.route("/sandbox",UP6()),X.route("/",pj6()),X.route("/deco-sites",jh1()),X.route("/sso",pg1()),X.route("/",$u1({tokenStorage:$.tokenStorage,automationEventDispatcher:$.automationEventDispatcher})),X.route("/webhooks",JL6()),$.mountDevAssets)X.route("/dev-assets",Ph1({orgFromPath:!0}));return X.use("/mcp/:connectionId?",$.mcpAuth),X.use("/mcp/gateway/:virtualMcpId?",$.mcpAuth),X.use("/mcp/virtual-mcp/:virtualMcpId?",$.mcpAuth),X.use("/mcp/self",$.mcpAuth),X.route("/",f66()),X.get("/mcp/:gateway?/:connectionId/.well-known/oauth-protected-resource/*",$.betterAuthProtectedResourceHandler),X.route("/mcp",B21()),X.route("/mcp/self",sh1()),X.route("/mcp",z21()),X.all("/oauth-proxy/:connectionId/*",$.oauthProxyHandler),X.post("/events/:type",$.eventsHandler),X.get("/watch",$.watchHandler),X};var wP6=D(()=>{c5();FV0();ZL6();zV0();qh1();KV0();ij6();vM0();WY1();s20();D21();_M0();nj6();bM0();fM0();N21();BP6()});async function k19($,X){try{return!await $.alive(X)}catch(Y){return console.warn(`[vm-events] alive probe failed for ${X}; assuming alive: ${Y instanceof Error?Y.message:String(Y)}`),!1}}async function C19($){let{ctx:X,runner:Y,claimName:G,userId:Q,projectRef:J,sandboxProviderKind:Z}=$;try{await Y.delete(G)}catch(W){console.warn(`[vm-events] runner.delete failed for ${G}: ${W instanceof Error?W.message:String(W)}`)}try{await new LP(X.db).delete({userId:Q,projectRef:J},Z)}catch(W){console.warn(`[vm-events] sandbox_runner_state delete failed for ${Q}/${J}/${Z}: ${W instanceof Error?W.message:String(W)}`)}}async function v19($){let{stream:X,claimName:Y,runner:G,signal:Q}=$;return new Promise((J)=>{let Z=!1,W=!1,K=null,F=(N)=>{if(Z)return;Z=!0,clearTimeout(U),Q.removeEventListener("abort",B),K?.unsubscribe(),J(N)},U=setTimeout(()=>{if(W||Z)return;X.writeSSE({event:"phase",data:JSON.stringify({kind:"failed",reason:"claim-never-created",message:"Sandbox claim was never created. The SANDBOX_START call may have failed earlier \u2014 check the start error."})}).catch(()=>{}),F(!1)},R19),B=()=>F(!1);Q.addEventListener("abort",B,{once:!0}),K=P71(G,Y,(N)=>{if(Z)return;if(N.kind!=="claiming")W=!0;if(X.writeSSE({event:"phase",data:JSON.stringify(N)}).catch(()=>{}),N.kind==="ready")F(!0);else if(N.kind==="failed")F(!1)})})}async function _19($){let{stream:X,runner:Y,claimName:G,signal:Q}=$,J=Date.now(),Z=null;while(!Q.aborted){let K=null;try{K=await Y.proxyDaemonRequest(G,"/_sandbox/events",{method:"GET",headers:new Headers({accept:"text/event-stream"}),body:null,signal:Q})}catch(F){if(Q.aborted)return;if(Date.now()-J<zP6){await J7(DP6,{signal:Q}).catch(()=>{});continue}let U=F instanceof Error?F.message:String(F);await X.writeSSE({event:"phase",data:JSON.stringify({kind:"failed",reason:"unknown",message:`Upstream daemon SSE error: ${U}`})}).catch(()=>{});return}if(K.status===404){try{await K.body?.cancel()}catch{}if(Date.now()-J<zP6){await J7(DP6,{signal:Q}).catch(()=>{});continue}await X.writeSSE({event:"gone",data:""}).catch(()=>{});return}if(!K.ok||!K.body){try{await K.body?.cancel()}catch{}await X.writeSSE({event:"phase",data:JSON.stringify({kind:"failed",reason:"unknown",message:`Upstream daemon SSE failed (${K.status}).`})}).catch(()=>{});return}Z=K;break}if(!Z||!Z.body)return;let W=Z.body.getReader();try{while(!Q.aborted){let{value:K,done:F}=await W.read();if(F)break;if(K)await X.write(K)}}catch{}finally{try{W.releaseLock()}catch{}}}var R19=90000,S19=15000,OP6=()=>{let $=new u4;return $.get("/",async(X)=>{let Y=X.var.meshContext;try{G0(Y)}catch{return X.json({error:"Unauthorized"},401)}let G=K6(Y);if(!G)return X.json({error:"Unauthorized"},401);let Q;try{Q=r1(Y)}catch{return X.json({error:"Organization scope required"},403)}let J=X.req.query("virtualMcpId"),Z=X.req.query("branch");if(!J||!Z)return X.json({error:"virtualMcpId and branch are required"},400);let W=await Y.storage.virtualMcps.findById(J);if(!W||W.organization_id!==Q.id)return X.json({error:"Virtual MCP not found"},404);let K=HM({orgId:Q.id,virtualMcpId:J,branch:Z}),F=Yu1({userId:G,projectRef:K},Z),U=W.metadata??null,B,N=null,w=null;try{let L=await yD(Y,{userId:G,branch:Z,virtualMcpMetadata:U});B=L.provider,N=L.kind}catch(L){w=L instanceof Error?L:Error(String(L)),B=null}let z=N&&OP(ZH(U),G,Z,N),O=!!z&&z.sandboxHandle===F;if(!B)return HH(X,async(L)=>{await L.writeSSE({event:"phase",data:JSON.stringify({kind:"failed",reason:"unknown",message:w?.message??"No sandbox runner configured on this mesh."})})});return X.header("X-Accel-Buffering","no"),X.header("Content-Encoding","identity"),HH(X,async(L)=>{let j=new AbortController,P=setInterval(()=>{L.writeSSE({event:"keepalive",data:""}).catch(()=>{clearInterval(P)})},S19);L.onAbort(()=>{j.abort(),clearInterval(P)});try{if(O&&N){if(await k19(B,F)){await C19({ctx:Y,runner:B,claimName:F,userId:G,projectRef:K,sandboxProviderKind:N}),await L.writeSSE({event:"gone",data:""}).catch(()=>{});return}}if(!await v19({stream:L,claimName:F,runner:B,signal:j.signal})||j.signal.aborted)return;await _19({stream:L,runner:B,claimName:F,signal:j.signal})}finally{clearInterval(P)}})}),$},zP6=60000,DP6=500;var LP6=D(()=>{c5();Gu();RD();kF();hM0();uh();q71();HT1();SD()});function kN($,X="invalid_request_error",Y=null,G=null){return{error:{message:$,type:X,param:Y,code:G}}}function l19($){if(!$)return null;let X=$.indexOf(":");if(X===-1)return{credentialId:null,modelId:$};let Y=$.substring(0,X),G=$.substring(X+1);if(!Y||!G)return null;return{credentialId:Y,modelId:G}}function c19($,X,Y){try{return JSON.parse($)}catch{throw new PP6(`Invalid JSON in tool call arguments for function '${Y}' (tool_call_id: ${X}): ${$}`)}}function d19($){let X={};for(let Y of $)if(Y.role==="assistant"&&Y.tool_calls)for(let G of Y.tool_calls)X[G.id]=G.function.name;return $.map((Y)=>{switch(Y.role){case"system":return{role:"system",content:Y.content};case"user":if(typeof Y.content==="string")return{role:"user",content:Y.content};return{role:"user",content:Y.content.map((Q)=>{if(Q.type==="text")return{type:"text",text:Q.text};return{type:"image",image:Q.image_url.url}})};case"assistant":if(Y.tool_calls&&Y.tool_calls.length>0)return{role:"assistant",content:Y.tool_calls.map((Q)=>({type:"tool-call",toolCallId:Q.id,toolName:Q.function.name,input:c19(Q.function.arguments,Q.id,Q.function.name)}))};return{role:"assistant",content:Y.content??""};case"tool":let G=X[Y.tool_call_id]??"unknown";return{role:"tool",content:[{type:"tool-result",toolCallId:Y.tool_call_id,toolName:G,output:{type:"text",value:Y.content}}]}}})}function i19($){let X=$.map((Y)=>{let G=Y.function.parameters?I3(Y.function.parameters):I3({type:"object",properties:{}});return[Y.function.name,o6({description:Y.function.description,inputSchema:G})]});return Object.fromEntries(X)}function p19($){if(!$)return;return{openai:{response_format:$}}}function n19(){return`chatcmpl-${crypto.randomUUID().replace(/-/g,"").substring(0,29)}`}function EP6($,X,Y,G,Q,J){let Z={model:$,messages:X,tools:Y,temperature:G.temperature,maxTokens:G.max_tokens,topP:G.top_p,frequencyPenalty:G.frequency_penalty,presencePenalty:G.presence_penalty,stopSequences:G.stop?Array.isArray(G.stop)?G.stop:[G.stop]:void 0,abortSignal:J};return Q?{...Z,providerOptions:Q}:Z}function jP6($){if($==="tool-calls")return"tool_calls";if($==="length")return"length";return"stop"}var b19,f19,y19,x19,g19,h19,u19,m19,PP6,qP6,AP6;var TP6=D(()=>{u9();c5();Gu();l1();b19=H.object({type:H.literal("function"),function:H.object({name:H.string(),description:H.string().optional(),parameters:H.record(H.string(),H.unknown()).optional()})}),f19=H.object({id:H.string(),type:H.literal("function"),function:H.object({name:H.string(),arguments:H.string()})}),y19=H.discriminatedUnion("role",[H.object({role:H.literal("system"),content:H.string(),name:H.string().optional()}),H.object({role:H.literal("user"),content:H.union([H.string(),H.array(H.union([H.object({type:H.literal("text"),text:H.string()}),H.object({type:H.literal("image_url"),image_url:H.object({url:H.string(),detail:H.string().optional()})})]))]),name:H.string().optional()}),H.object({role:H.literal("assistant"),content:H.string().nullable().optional(),name:H.string().optional(),tool_calls:H.array(f19).optional()}),H.object({role:H.literal("tool"),content:H.string(),tool_call_id:H.string()})]),x19=H.object({type:H.literal("text")}),g19=H.object({type:H.literal("json_object")}),h19=H.object({type:H.literal("json_schema"),json_schema:H.object({name:H.string(),description:H.string().optional(),schema:H.record(H.string(),H.unknown()),strict:H.boolean().optional()})}),u19=H.union([x19,g19,h19]),m19=H.object({model:H.string().describe("Format: 'model_id' or 'credential_id:model_id'"),messages:H.array(y19),stream:H.boolean().optional().default(!1),temperature:H.number().min(0).max(2).optional(),max_tokens:H.number().positive().optional(),top_p:H.number().min(0).max(1).optional(),frequency_penalty:H.number().min(-2).max(2).optional(),presence_penalty:H.number().min(-2).max(2).optional(),stop:H.union([H.string(),H.array(H.string())]).optional(),tools:H.array(b19).optional(),tool_choice:H.union([H.literal("auto"),H.literal("none"),H.literal("required"),H.object({type:H.literal("function"),function:H.object({name:H.string()})})]).optional(),response_format:u19.optional(),user:H.string().optional()});PP6=class PP6 extends Error{constructor($){super($);this.name="MessageConversionError"}};qP6=new u4;qP6.post("/:org/v1/chat/completions",async($)=>{let X=$.get("meshContext"),Y=$.req.param("org");try{if(!X.auth.apiKey?.id)return $.json(kN("API key authentication required. Provide a valid API key via Authorization header.","authentication_error"),401);if(!X.organization)return $.json(kN("Organization context is required. Ensure your API key has organization metadata.","invalid_request_error","organization"),400);if((X.organization.slug??X.organization.id)!==Y)return $.json(kN("Organization mismatch. The API key's organization does not match the requested organization.","invalid_request_error","organization"),403);let G=await $.req.json(),Q=m19.safeParse(G);if(!Q.success){let L=Q.error.issues[0]??{message:"Invalid request",path:[]};return $.json(kN(`Invalid request: ${L.message}`,"invalid_request_error",L.path.length>0?L.path.join("."):null),400)}let J=Q.data,Z=l19(J.model);if(!Z)return $.json(kN("Invalid model format. Expected 'model_id' or 'credential_id:model_id' (e.g., 'claude-sonnet-4-6' or 'key_abc123:claude-sonnet-4-6')","invalid_request_error","model"),400);let{credentialId:W}=Z,{modelId:K}=Z;if(!W){let L=await X.storage.aiProviderKeys.list({organizationId:X.organization.id});if(L.length===0)return $.json(kN("No AI provider credentials configured for this organization. Add a credential in settings or specify one explicitly via 'credential_id:model_id'.","invalid_request_error","model"),400);W=L[0].id}let F;try{F=await X.aiProviders.activate(W,X.organization.id)}catch{return $.json(kN(`AI provider credential not found or inaccessible: ${W}`,"invalid_request_error","model"),404)}let U=F.aiSdk.languageModel(K),B=d19(J.messages),N=J.tools?i19(J.tools):void 0,w=p19(J.response_format),z=n19(),O=Math.floor(Date.now()/1000);if(J.stream)return HH($,async(L)=>{let j=EP6(U,B,N,J,w,$.req.raw.signal);try{let P=QH(j),T=!1,I=0;for await(let V of P.fullStream){if(!T&&(V.type==="text-delta"||V.type==="tool-call"))await L.writeSSE({data:JSON.stringify({id:z,object:"chat.completion.chunk",created:O,model:J.model,choices:[{index:0,delta:{role:"assistant",content:""},finish_reason:null}]})}),T=!0;if(V.type==="text-delta")await L.writeSSE({data:JSON.stringify({id:z,object:"chat.completion.chunk",created:O,model:J.model,choices:[{index:0,delta:{content:V.text},finish_reason:null}]})});else if(V.type==="tool-call"){let R=I++;await L.writeSSE({data:JSON.stringify({id:z,object:"chat.completion.chunk",created:O,model:J.model,choices:[{index:0,delta:{tool_calls:[{index:R,id:V.toolCallId,type:"function",function:{name:V.toolName,arguments:JSON.stringify(V.input)}}]},finish_reason:null}]})})}else if(V.type==="finish")await L.writeSSE({data:JSON.stringify({id:z,object:"chat.completion.chunk",created:O,model:J.model,choices:[{index:0,delta:{},finish_reason:jP6(V.finishReason)}],usage:V.totalUsage?{prompt_tokens:V.totalUsage.inputTokens??0,completion_tokens:V.totalUsage.outputTokens??0,total_tokens:V.totalUsage.totalTokens??0}:void 0})})}await L.writeSSE({data:"[DONE]"})}catch(P){let T=P;console.error("[openai-compat:stream] Error:",T.message),await L.writeSSE({data:JSON.stringify({error:{message:T.message,type:"server_error"}})})}});else{let L=EP6(U,B,N,J,w,$.req.raw.signal),j=await wP(L),P={role:"assistant",content:j.text||null};if(j.toolCalls&&j.toolCalls.length>0)P.tool_calls=j.toolCalls.map((T)=>({id:T.toolCallId,type:"function",function:{name:T.toolName,arguments:JSON.stringify("input"in T?T.input:{})}})),P.content=null;return $.json({id:z,object:"chat.completion",created:O,model:J.model,choices:[{index:0,message:P,finish_reason:jP6(j.finishReason)}],usage:{prompt_tokens:j.usage?.inputTokens??0,completion_tokens:j.usage?.outputTokens??0,total_tokens:j.usage?.totalTokens??0}})}}catch(G){let Q=G;if(Q.name==="AbortError")return $.json(kN("Request aborted","invalid_request_error"),400);if(Q.name==="MessageConversionError")return $.json(kN(Q.message,"invalid_request_error","messages"),400);return console.error("[openai-compat] Error:",Q.message,Q.stack),$.json(kN(Q.message,"server_error"),500)}});AP6=qP6});function t19(){let $=process.env.POSTHOG_KEY;if(!$)return null;return{key:$,host:process.env.POSTHOG_HOST??r19}}var VP6,r19="https://us.i.posthog.com",MP6;var IP6=D(()=>{c5();HK0();mh();kz();F5();r20();VP6=new u4;VP6.get("/",($)=>{let X={theme:mk4(),...JT().logo&&{logo:JT().logo},...xD()&&{internalUrl:CL1()},..._4().enableDecoImport&&{enableDecoImport:!0},brandExtractEnabled:!!_4().firecrawlApiKey,auth:NN6(),posthog:t19()};return $.json({success:!0,config:X})});MP6=VP6});var RP6,SP6;var kP6=D(()=>{c5();cU();I71();jc();RP6=new u4;RP6.get("/:org/files/*",async($)=>{let X=$.get("meshContext"),Y=X.organization?.id;if(!X.auth?.user?.id){if(Rt($))return $.redirect(`/login?next=${encodeURIComponent($.req.path)}`,302);throw new D$(401,{message:"Authentication required"})}if(!Y)throw new D$(401,{message:"Organization context required"});let G=$.req.path.replace(/^.*\/files\//,"");if(!G)throw new D$(400,{message:"Missing file key"});let Q=await dh(G,X);if(!Q)throw new D$(503,{message:"Object storage not configured"});if(Q.startsWith("data:")&&pH()){let J=Q.match(/^data:([^;]+);base64,(.+)$/s);if(!J)throw new D$(500,{message:"Invalid data URL from storage"});let[,Z,W]=J,K=Buffer.from(W,"base64");return $.body(K,200,{"Content-Type":Z,"Cache-Control":"private, max-age=86400"})}return $.redirect(Q,302)});SP6=RP6});var _P6={};g6(_P6,{shouldSkipStudioContext:()=>lM0,isServerPath:()=>X09,SYSTEM_PATHS:()=>uP});function CP6($){return $===uP.HEALTH_LIVE||$===uP.HEALTH_READY||$===uP.METRICS||$.startsWith(it.WELL_KNOWN)}function vP6($){return $.startsWith(it.API)}function o19($){return $==="/mcp"||$.startsWith(it.MCP)}function s19($){return $.startsWith(it.OAUTH_PROXY)}function e19($){return a19.test($)}function $09($){return $.startsWith(it.ORG)}function X09($){return vP6($)||o19($)||s19($)||$09($)||CP6($)}function lM0($){return $==="/"||$.startsWith(it.API_AUTH)||$==="/api/trigger-callback"||CP6($)||!vP6($)&&e19($)}var uP,it,a19;var cM0=D(()=>{uP={HEALTH_LIVE:"/health/live",HEALTH_READY:"/health/ready",METRICS:"/metrics"},it={API:"/api/",API_AUTH:"/api/auth/",MCP:"/mcp/",OAUTH_PROXY:"/oauth-proxy/",WELL_KNOWN:"/.well-known",ORG:"/org/"},a19=/\.(html|css|js|ico|svg|png|jpg|jpeg|gif|webp|woff|woff2)$/});function bP6($){let X=$?.connectFn??J09,Y=null,G=null,Q=!1,J=!1,Z=!1,W=[];function K(){return Y!==null&&!Y.isClosed()&&!Y.isDraining()&&!Z}function F(){console.log(`[NatsProvider] fireReady: ${W.length} callbacks`);for(let N of W)try{N()}catch{}}function U(N){(async()=>{for await(let w of N.status())if(w.type===KG1.Events.Disconnect)console.log("[NatsProvider] Disconnected"),Z=!0;else if(w.type===KG1.Events.Reconnect)console.log("[NatsProvider] Reconnected, re-firing ready callbacks"),Z=!1,G=null,F()})().catch(()=>{})}async function B(N){let w=0;while(!J)try{Y=await X({servers:N,timeout:Q09,reconnect:!0,maxReconnectAttempts:-1}),console.log(`[NatsProvider] Connected to ${Y.getServer()} after ${w} attempt(s)`),G=null,Z=!1,U(Y),F();return}catch{w++;let z=SF(G09,Y09,w-1,2,0.5);await J7(z)}}return{init(N){if(Q)return;Q=!0,J=!1,B(N).catch(()=>{})},isConnected(){return K()},getConnection(){return K()?Y:null},getJetStream(){if(!K())return null;if(!G)G=Y.jetstream();return G},onReady(N){if(W.push(N),K())try{N()}catch{}},async drain(){if(J=!0,Q=!1,G=null,Z=!1,Y){let N=Y;Y=null,await N.drain().catch(()=>{})}}}}function J09($){return KG1.connect($)}var KG1,Y09=100,G09=3000,Q09=3000;var fP6=D(()=>{kF();KG1=G1(rp(),1)});function pt($){let X=$?.ttlMs??60000,Y=$?.maxSize??1e4,G=$?.updateRecencyOnGet??!1,Q=new Map;function J(){if(Q.size<=Y)return;let Z=Date.now();for(let[W,K]of Q)if(K.expiresAt<=Z)Q.delete(W);while(Q.size>Y){let W=Q.keys().next().value;if(W===void 0)break;Q.delete(W)}}return{get(Z){let W=Q.get(Z);if(!W)return;if(W.expiresAt<=Date.now()){Q.delete(Z);return}if(G)Q.delete(Z),Q.set(Z,W);return W.value},set(Z,W){Q.delete(Z),Q.set(Z,{value:W,expiresAt:Date.now()+X}),J()},delete(Z){Q.delete(Z)},clear(){Q.clear()},size(){return Q.size}}}function dM0($,X){return`${$}.${X}`}class iM0{cache;constructor($){this.cache=pt({ttlMs:$?.ttlMs??Z09,maxSize:$?.maxSize??W09})}async get($,X){return this.cache.get(dM0($,X))??null}async set($,X,Y){this.cache.set(dM0($,X),Y)}async invalidate($,X){this.cache.delete(dM0($,X))}teardown(){this.cache.clear()}}var Z09=600000,W09=5000;var yP6=()=>{};function Gu1($,X){return`${$}:${X}`}function pM0($){let X=pt({ttlMs:$?.ttlMs??K09,maxSize:$?.maxSize??H09}),Y=$?.getConnection,G=crypto.randomUUID(),Q=new TextEncoder,J=new TextDecoder,Z=null;function W(K,F){let U=Y?.();if(!U)return;try{U.publish(xP6,Q.encode(JSON.stringify({organizationId:K,keyId:F,originId:G})))}catch(B){console.warn("[ProviderKeyCache] Publish failed (non-critical):",B)}}return{get(K,F){return X.get(Gu1(K,F))},set(K,F,U){X.set(Gu1(K,F),U)},invalidate(K,F){X.delete(Gu1(K,F)),W(K,F)},start(){if(Z)return;let K=Y?.();if(!K)return;Z=K.subscribe(xP6),(async()=>{for await(let F of Z)try{let U=JSON.parse(J.decode(F.data));if(U.originId===G)continue;X.delete(Gu1(U.organizationId,U.keyId))}catch{}})().catch(console.error)},teardown(){Z?.unsubscribe(),Z=null,X.clear()}}}var xP6="studio.ai-provider-keys.invalidate",K09=30000,H09=5000;var gP6=()=>{};class nM0{options;sub=null;onCancel=null;encoder=new TextEncoder;originId=crypto.randomUUID();constructor($){this.options=$}async start($){if($)this.onCancel=$;if(this.sub)return;if(!this.onCancel)return;let X=this.options.getConnection();if(!X)return;this.sub=X.subscribe("mesh.decopilot.cancel");let Y=new TextDecoder;(async()=>{for await(let G of this.sub)try{let Q=JSON.parse(Y.decode(G.data));if(Q.originId===this.originId)continue;this.onCancel?.(Q.taskId)}catch{}})().catch(console.error)}broadcast($){if(/[.*>\s]/.test($)){console.warn("[NatsCancelBroadcast] Invalid threadId, skipping broadcast");return}this.onCancel?.($);try{let X=this.options.getConnection();if(!X)return;X.publish("mesh.decopilot.cancel",this.encoder.encode(JSON.stringify({taskId:$,originId:this.originId})))}catch(X){console.warn("[NatsCancelBroadcast] Publish failed (non-critical):",X)}}async stop(){this.sub?.unsubscribe(),this.sub=null,this.onCancel=null}}function N09($){if(/[.*>\s]/.test($))throw Error("Invalid NATS subject token")}function tM0($){return N09($),`${mP6}.${$}`}function w09($){let X=0;return{publish(Y,G,Q,J){Y.publish(G,Q,J?{headers:J}:void 0).catch((Z)=>{if(X++,X===1||X%100===0)console.warn(`[Decopilot] JetStream publish failed for thread ${$} (${X} total):`,Z)})},get errorCount(){return X}}}class aM0{options;js=null;jsm=null;encoder=new TextEncoder;constructor($){this.options=$}async init(){let $=this.options.getConnection();if(!$)return;let X=await $.jetstreamManager(),Y={name:Qu1,subjects:[`${mP6}.>`],storage:l3.StorageType.Memory,max_age:F09,max_bytes:U09,max_msgs_per_subject:B09,discard:l3.DiscardPolicy.Old,retention:l3.RetentionPolicy.Limits,num_replicas:1};try{await X.streams.info(Qu1),await X.streams.update(Qu1,Y)}catch(G){if(G instanceof Error&&G.message.includes("stream not found"))await X.streams.add(Y);else throw G}this.js=this.options.getJetStream(),this.jsm=X}pump($,X,Y){let G=this.js;if(!G)return;let Q=tM0(X),J=w09(X),Z=this.encoder,W=!1,K=()=>{if(W)return;W=!0,G.publish(Q,Z.encode(JSON.stringify({done:!0}))).catch(()=>{})};Y.addEventListener("abort",K,{once:!0});let F=(U)=>{let B=Z.encode(JSON.stringify({p:U}));if(B.length<=VN){J.publish(G,Q,B);return}if(B.length>hP6){console.warn(`[Decopilot] dropping oversized stream chunk for thread ${X}: ${(B.length/1048576).toFixed(1)} MiB exceeds ${hP6/1048576} MiB cap`);return}let N=Math.ceil(B.length/VN);for(let w=0;w<N;w++){let z=B.slice(w*VN,(w+1)*VN),O=l3.headers();O.set(uP6,String(w)),O.set(rM0,String(N)),J.publish(G,Q,z,O)}};(async()=>{let U=$.getReader();try{while(!0){let{done:B,value:N}=await U.read();if(B)break;F(N)}}catch(B){console.warn(`[Decopilot] stream pump error for thread ${X}:`,B?.message??B)}finally{U.releaseLock(),K()}})()}async createTailStream($,X,Y){let G=this.js;if(!G)return null;let Q=Y?.deliverPolicy==="new"?l3.DeliverPolicy.New:l3.DeliverPolicy.All,J=Y?.closeOnDone??!1,Z=tM0($),W;try{W=await G.subscribe(Z,{ordered:!0,config:{filter_subject:Z,ack_policy:l3.AckPolicy.None,deliver_policy:Q}})}catch(z){return console.warn("[Decopilot] JetStream tail unavailable (non-critical):",z?.message??z),null}let K=new TextDecoder,F=null,U=(z)=>{let O=z.headers?.get(rM0);if(!O)return null;let L=Number(O),j=Number(z.headers?.get(uP6)??"0");if(j===0)F={total:L,received:0,parts:Array(L)};else if(!F||F.total!==L)return null;if(!F.parts[j])F.received++;if(F.parts[j]=z.data,F.received<F.total)return null;let P=F.parts.reduce((V,R)=>V+(R?.length??0),0),T=new Uint8Array(P),I=0;for(let V of F.parts)T.set(V,I),I+=V.length;return F=null,T},B=async function*(){for await(let z of W)yield z}(),N=!1,w=()=>{if(N)return;N=!0,W.unsubscribe(),B.return(void 0).catch(()=>{})};return X?.addEventListener("abort",w,{once:!0}),new ReadableStream({async pull(z){while(!0){let O=await B.next();if(O.done){w(),z.close();return}let L=O.value,j=U(L);if(L.headers?.get(rM0)&&!j)continue;let P=j??L.data;try{let T=JSON.parse(K.decode(P));if(T.done){if(J){w(),z.close();return}continue}if(T.p){z.enqueue(T.p);return}}catch{}}},cancel(){w()}})}purge($){if(!this.jsm)return;this.jsm.streams.purge(Qu1,{filter:tM0($)}).catch(()=>{})}teardown(){this.js=null,this.jsm=null}}var l3,Qu1="DECOPILOT_STREAMS",mP6="decopilot.stream",F09=300000000000,U09=524288000,B09=20000,hP6=33554432,uP6="Dp-Frag-Idx",rM0="Dp-Frag-Total";var lP6=D(()=>{l3=G1(rp(),1)});function dP6(){let $=new Map,X=new Map;function Y(G){let Q=X.get(G);if(!Q)return;let J=$.get(G)??null;for(let Z of Q)try{Z(J)}catch{}}return{async get(G){return $.get(G)??null},async put(G,Q){$.set(G,Q),Y(G)},async delete(G){$.delete(G),Y(G)},watch(G,Q){let J=X.get(G);if(!J)J=new Set,X.set(G,J);J.add(Q);try{Q($.get(G)??null)}catch{}return()=>{let Z=X.get(G);if(!Z)return;if(Z.delete(Q),Z.size===0)X.delete(G)}}}}class oM0{options;kv=null;codec=Ju1.JSONCodec();constructor($){this.options=$}async init(){let $=this.options.getJetStream();if(!$)return;this.kv=await $.views.kv(z09,{history:1,ttl:cP6,storage:Ju1.StorageType.Memory})}async get($){if(!this.kv)return null;try{let X=await this.kv.get($);if(!X?.value)return null;if(X.operation==="DEL"||X.operation==="PURGE")return null;if(Date.now()-X.created.getTime()>cP6)return null;return this.codec.decode(X.value)}catch{return null}}async put($,X){if(!this.kv)return;await this.kv.put($,this.codec.encode(X))}async delete($){if(!this.kv)return;try{await this.kv.delete($)}catch{}}watch($,X){if(!this.kv){try{X(null)}catch{}return()=>{}}let Y=!1,G=null;return(async()=>{let Q=250;while(!Y){try{G=await this.kv.watch({key:$}),Q=250;for await(let J of G){if(Y)return;let W=J.operation==="DEL"||J.operation==="PURGE"||!J.value?null:this.codec.decode(J.value);try{X(W)}catch{}}if(Y)return}catch{}if(Y)return;await new Promise((J)=>setTimeout(J,Q)),Q=Math.min(Q*2,5000)}})(),()=>{Y=!0;try{G?.stop()}catch{}}}}var Ju1,z09="studio_links",cP6=60000;var iP6=D(()=>{Ju1=G1(rp(),1)});function FH($){return JSON.stringify($)}function nt($){let X;try{X=JSON.parse($)}catch{throw Error("dispatch-frames: malformed JSON")}if(typeof X!=="object"||X===null)throw Error("dispatch-frames: frame must be an object");let Y=X.type;if(typeof Y!=="string"||!A09.has(Y))throw Error(`dispatch-frames: unknown frame type "${String(Y)}"`);let G=pP6.safeParse(X);if(!G.success)throw Error(`dispatch-frames: ${G.error.message}`);return G.data}var D09,O09,L09,E09,j09,P09,q09,pP6,A09;var sM0=D(()=>{l1();I20();D09=H.object({type:H.literal("hello"),previewPort:H.number().int().min(1).max(65535),machineId:H.string().min(1),hostname:H.string().optional(),cliVersion:H.string().min(1),capabilities:WB6}),O09=H.object({type:H.literal("request"),reqId:H.string().min(1),method:H.string().min(1),path:H.string().min(1),headers:H.record(H.string(),H.string()),body:H.string().optional()}),L09=H.object({type:H.literal("cancel"),reqId:H.string().min(1)}),E09=H.object({type:H.literal("headers"),reqId:H.string().min(1),status:H.number().int().min(100).max(599),headers:H.record(H.string(),H.string())}),j09=H.object({type:H.literal("chunk"),reqId:H.string().min(1),data:H.string()}),P09=H.object({type:H.literal("end"),reqId:H.string().min(1)}),q09=H.object({type:H.literal("error"),reqId:H.string().min(1),code:H.string().min(1),message:H.string()}),pP6=H.discriminatedUnion("type",[D09,O09,L09,E09,j09,P09,q09]),A09=new Set(pP6.options.map(($)=>$.shape.type.value))});function rP6($,X){let Y=X.helloTimeoutMs??5000,G=X.refreshIntervalMs??20000,Q=new Map;$.get("/api/links/connect",async(J)=>{let Z=J.req.header("authorization")??"",W=/^Bearer\s+(.+)$/i.exec(Z);if(!W)return new Response("missing bearer",{status:401});let K=(W[1]??"").trim(),F=await X.validateBearer(K);if(!F)return new Response("invalid bearer",{status:401});let U=J.env?.server;if(!U||typeof U.upgrade!=="function")return new Response("ws upgrade not available",{status:500});if(!U.upgrade(J.req.raw,{data:{kind:"gateway",userSub:F,deps:X,helloTimeoutMs:Y,refreshIntervalMs:G,localOwners:Q}}))return new Response("ws upgrade failed",{status:400});return new Response(null,{status:101})}),$.get("/api/links/me",async(J)=>{let Z=J.req.header("authorization")??"",W=/^Bearer\s+(.+)$/i.exec(Z),K=null;if(W)K=await X.validateBearer((W[1]??"").trim());else K=J.get("meshContext")?.auth?.user?.id??null;if(!K)return J.json({error:"unauthorized"},401);let F=await X.registry.get(K);if(!F)return J.json(null);return J.json({machineId:F.machineId,hostname:F.hostname,cliVersion:F.cliVersion,previewPort:F.previewPort,connectedAt:F.connectedAt})})}function $I0($){if(!$.data._inflight)$.data._inflight=new Map;return $.data._inflight}async function V09($,X){let{userSub:Y,deps:G,refreshIntervalMs:Q,localOwners:J}=$.data,Z={podId:G.podId,machineId:X.machineId,...X.hostname?{hostname:X.hostname}:{},cliVersion:X.cliVersion,previewPort:X.previewPort,connectedAt:Date.now(),capabilities:X.capabilities},W=J.get(Y);if(W&&W!==$){if(W.data.state)W.data.state.lostOwnership=!0;try{W.close(nP6,"superseded")}catch{}}J.set(Y,$);let K={userSub:Y,hello:X,refreshTimer:setInterval(()=>{G.registry.put(Y,{...Z,connectedAt:Date.now()}).catch(()=>{})},Q),stopWatch:()=>{},unsubscribeDispatch:()=>{},unsubscribeCancel:()=>{},lostOwnership:!1};$.data.state=K;try{K.unsubscribeDispatch=G.nats.subscribe(`links.dispatch.${Y}`,(U,B)=>M09($,U,B)),K.unsubscribeCancel=G.nats.subscribe(`links.cancel.${Y}`,(U)=>I09($,U));let F=!0;K.stopWatch=G.registry.watch(Y,(U)=>{if(F){F=!1;return}if(!U||U.podId!==G.podId){K.lostOwnership=!0;try{$.close(nP6,"superseded")}catch{}}}),await G.registry.put(Y,Z)}catch(F){clearInterval(K.refreshTimer);try{K.stopWatch()}catch{}try{K.unsubscribeDispatch()}catch{}try{K.unsubscribeCancel()}catch{}if(J.get(Y)===$)J.delete(Y);$.data.state=void 0,$.close(T09,`init failed: ${F instanceof Error?F.message:String(F)}`)}}function M09($,X,Y){if(!Y)return;let G;try{G=nt(eM0.decode(X))}catch{return}if(G.type!=="request")return;$I0($).set(G.reqId,{reply:Y}),$.send(FH(G))}function I09($,X){let Y;try{Y=nt(eM0.decode(X))}catch{return}if(Y.type!=="cancel")return;if(!$I0($).has(Y.reqId))return;$.send(FH(Y))}function R09($,X,Y){let G=$.data.deps.nats;if(Y.type!=="chunk"){G.publish(X,rt.encode(FH(Y)));return}let Q=rt.encode(FH(Y));if(Q.length<=VN){G.publish(X,Q);return}let J=rt.encode(FH({type:"chunk",reqId:Y.reqId,data:""})).length;for(let Z of RO6(Y.data,VN,J))G.publish(X,rt.encode(FH({type:"chunk",reqId:Y.reqId,data:Z})))}function S09($,X,Y,G,Q="publish_failed"){try{return $.data.deps.nats.publish(X,rt.encode(FH({type:"error",reqId:Y,code:Q,message:G}))),!0}catch{return!1}}async function k09($,X){if(X.type==="hello"){$.close(Zu1,"duplicate hello");return}if(X.type==="request"||X.type==="cancel")return;let Y=$I0($),G=Y.get(X.reqId);if(!G)return;try{R09($,G.reply,X)}catch(Q){if(S09($,G.reply,X.reqId,Q instanceof Error?Q.message:String(Q)))Y.delete(X.reqId);return}if(X.type==="end"||X.type==="error")Y.delete(X.reqId)}var nP6=4001,Zu1=1008,T09=1011,rt,eM0,tP6;var aP6=D(()=>{sM0();rt=new TextEncoder,eM0=new TextDecoder;tP6={open($){$.data.helloTimer=setTimeout(()=>{$.close(Zu1,"hello timeout")},$.data.helloTimeoutMs)},async message($,X){let Y=typeof X==="string"?X:eM0.decode(X),G;try{G=nt(Y)}catch(Q){$.close(Zu1,`bad frame: ${Q instanceof Error?Q.message:String(Q)}`);return}if(!$.data.state){if(G.type!=="hello"){$.close(Zu1,"first frame must be hello");return}clearTimeout($.data.helloTimer),await V09($,G);return}await k09($,G)},close($,X,Y){clearTimeout($.data.helloTimer);let G=$.data._inflight;if(G&&G.size>0){for(let[Z,W]of G)try{$.data.deps.nats.publish(W.reply,rt.encode(FH({type:"error",reqId:Z,code:"ws_closed",message:"daemon WebSocket closed before response completed"})))}catch{}G.clear()}let Q=$.data.state;if(!Q)return;clearInterval(Q.refreshTimer);try{Q.stopWatch()}catch{}try{Q.unsubscribeDispatch()}catch{}try{Q.unsubscribeCancel()}catch{}let J=$.data.localOwners.get(Q.userSub)===$;if(J)$.data.localOwners.delete(Q.userSub);if(J&&!Q.lostOwnership)$.data.deps.registry.delete(Q.userSub).catch(()=>{})}}});function sP6($){let X=$.requestTimeoutMs??30000;return function(G,Q,J){return{async*[Symbol.asyncIterator](){if(J?.signal?.aborted)throw Error("dispatch aborted");let Z=crypto.randomUUID(),W=$.nats.createInbox(),K=[],F=null,U=!1,B=null,N=null,w=()=>{if(N)clearTimeout(N),N=null;let I=F;F=null,I?.()},z=$.nats.subscribe(W,(I)=>{if(U)return;try{K.push(nt(C09.decode(I)))}catch(V){B=V instanceof Error?V:Error(String(V)),U=!0}w()}),O=!1,L=()=>{if(O)return;O=!0,U=!0;try{z()}catch{}},j=()=>{$.nats.publish(`links.cancel.${G}`,oP6.encode(FH({type:"cancel",reqId:Z}))),B=Error("dispatch aborted"),L(),w()};J?.signal?.addEventListener("abort",j,{once:!0});try{$.nats.publish(`links.dispatch.${G}`,oP6.encode(FH({type:"request",reqId:Z,method:Q.method,path:Q.path,headers:Q.headers,...Q.body!==void 0?{body:Q.body}:{}})),{reply:W})}catch(I){throw J?.signal?.removeEventListener("abort",j),L(),I instanceof Error?I:Error(String(I))}let P=Date.now()+X,T=!1;try{while(!U){if(B)throw B;if(K.length===0){let V=P-Date.now();if(!T&&V<=0)throw Error("dispatch timeout: no reply from daemon");if(await new Promise((R)=>{if(F=R,!T)N=setTimeout(w,Math.max(0,V))}),B)throw B;continue}let I=K.shift();if(T=!0,I.type==="chunk")yield{data:I.data};else if(I.type==="headers")yield{headers:{status:I.status,headers:I.headers}};else if(I.type==="end")return;else if(I.type==="error")throw Error(`${I.code}: ${I.message}`)}if(B)throw B}finally{if(J?.signal?.removeEventListener("abort",j),N)clearTimeout(N),N=null;L()}}}}}var oP6,C09;var eP6=D(()=>{sM0();oP6=new TextEncoder,C09=new TextDecoder});function $q6($,X){switch($.type){case"START":{let Y={type:"RUN_STARTED",taskId:$.taskId,orgId:$.orgId,userId:$.userId,abortController:$.abortController,runConfig:$.runConfig,podId:$.podId};if(X?.status.tag==="running")return[{type:"PREVIOUS_RUN_ABORTED",taskId:$.taskId,orgId:X.orgId},Y];return[Y]}case"STEP_DONE":{if(X?.status.tag!=="running")return[];return[{type:"STEP_COMPLETED",taskId:$.taskId,orgId:X.orgId,stepCount:X.status.stepCount+1}]}case"FINISH":{if(X==null||X.status.tag!=="running")return[];let{stepCount:Y}=X.status;if($.threadStatus==="completed")return[{type:"RUN_COMPLETED",taskId:$.taskId,orgId:X.orgId,stepCount:Y}];if($.threadStatus==="requires_action")return[{type:"RUN_REQUIRES_ACTION",taskId:$.taskId,orgId:X.orgId,stepCount:Y}];return[{type:"RUN_FAILED",taskId:$.taskId,orgId:X.orgId,reason:"error"}]}case"CANCEL":{if(X?.status.tag!=="running")return[];return[{type:"RUN_FAILED",taskId:$.taskId,orgId:X.orgId,reason:"cancelled"}]}case"RESUME":{if(X?.status.tag==="running")return[];return[{type:"RUN_RESUMED",taskId:$.taskId,orgId:$.orgId,userId:$.userId,abortController:$.abortController,podId:$.podId}]}case"FORCE_FAIL":{if($.reason==="ghost")return[{type:"RUN_FAILED",taskId:$.taskId,orgId:X?.orgId??$.orgId,reason:$.reason}];if(X?.status.tag!=="running")return[];return[{type:"RUN_FAILED",taskId:$.taskId,orgId:X.orgId,reason:$.reason}]}}}function Xq6($,X,Y=new Date){switch(X.type){case"RUN_STARTED":return{taskId:X.taskId,orgId:X.orgId,userId:X.userId,status:{tag:"running",abortController:X.abortController,stepCount:0,startedAt:Y}};case"RUN_RESUMED":return{taskId:X.taskId,orgId:X.orgId,userId:X.userId,status:{tag:"running",abortController:X.abortController,stepCount:0,startedAt:Y}};case"STEP_COMPLETED":if($?.status.tag!=="running")return $;return{...$,status:{...$.status,stepCount:X.stepCount}};case"RUN_COMPLETED":return;case"RUN_REQUIRES_ACTION":return;case"RUN_FAILED":return;case"PREVIOUS_RUN_ABORTED":return}}async function Yq6($,X,Y,G){let{storage:Q,streamBuffer:J,sseHub:Z}=G,W=await Q.get($,X);await Q.update($,X,{status:Y,run_owner_pod:null,run_config:null,run_started_at:null}),J.purge($),Z.emit(X,Cw($,Y,{virtualMcpId:W?.virtual_mcp_id??void 0,createdBy:W?.created_by,triggerId:W?.trigger_id,title:W?.title,branch:W?.branch??null,createdAt:W?.created_at,updatedAt:W?.updated_at})),Z.emit(X,D01($,Y))}async function v09($,X){let{storage:Y,streamBuffer:G,sseHub:Q}=X;switch($.type){case"RUN_STARTED":{if(!await Y.claimRunStart($.taskId,$.orgId,{status:"in_progress",run_owner_pod:$.podId??null,run_config:$.runConfig??null,run_started_at:$.podId?new Date().toISOString():null},$.podId??null))throw new Gq6($.taskId);let Z=await Y.get($.taskId,$.orgId);Q.emit($.orgId,Cw($.taskId,"in_progress",{virtualMcpId:Z?.virtual_mcp_id??void 0,createdBy:Z?.created_by,triggerId:Z?.trigger_id,title:Z?.title,branch:Z?.branch??null,createdAt:Z?.created_at,updatedAt:Z?.updated_at}));return}case"RUN_RESUMED":{await Y.update($.taskId,$.orgId,{run_owner_pod:$.podId,run_started_at:new Date().toISOString()});let J=await Y.get($.taskId,$.orgId);Q.emit($.orgId,Cw($.taskId,"in_progress",{virtualMcpId:J?.virtual_mcp_id??void 0,createdBy:J?.created_by,triggerId:J?.trigger_id,title:J?.title,branch:J?.branch??null,createdAt:J?.created_at,updatedAt:J?.updated_at}));return}case"STEP_COMPLETED":Q.emit($.orgId,mB1($.taskId,$.stepCount));return;case"RUN_COMPLETED":await Yq6($.taskId,$.orgId,"completed",X);return;case"RUN_REQUIRES_ACTION":await Yq6($.taskId,$.orgId,"requires_action",X);return;case"RUN_FAILED":{if($.reason==="ghost"){if(!await Y.forceFailIfInProgress($.taskId,$.orgId))return;await Y.update($.taskId,$.orgId,{run_owner_pod:null,run_config:null,run_started_at:null})}else await Y.update($.taskId,$.orgId,{status:"failed",run_owner_pod:null,run_config:null,run_started_at:null});G.purge($.taskId);let J=await Y.get($.taskId,$.orgId);Q.emit($.orgId,Cw($.taskId,"failed",{virtualMcpId:J?.virtual_mcp_id??void 0,createdBy:J?.created_by,triggerId:J?.trigger_id,title:J?.title,branch:J?.branch??null,createdAt:J?.created_at,updatedAt:J?.updated_at})),Q.emit($.orgId,D01($.taskId,"failed"));return}case"PREVIOUS_RUN_ABORTED":return}}async function Qq6($,X){for(let{event:Y}of $)await v09(Y,X)}var Gq6;var Jq6=D(()=>{b$();Gq6=class Gq6 extends Error{constructor($){super(`Failed to claim run for thread ${$} \u2014 already running on another pod`);this.name="RunClaimError"}}});class XI0{deps;podId;clock;states=new Map;reaperTimer=null;constructor($,X,Y=()=>new Date){this.deps=$;this.podId=X;this.clock=Y;this.reaperTimer=setInterval(()=>this.reapStaleRuns(),_09)}async execute($){let X=this.dispatch($);return await this.react(X),X}dispatch($){let X=this.states.get($.taskId),Y=$q6($,X),G=[];for(let Q of Y){let J=this.states.get(Q.taskId);if(Q.type==="PREVIOUS_RUN_ABORTED"||Q.type==="RUN_FAILED"){if(J?.status.tag==="running")J.status.abortController.abort()}let Z=Xq6(J,Q,this.clock());if(Z===void 0)this.states.delete(Q.taskId);else this.states.set(Q.taskId,Z);if(G.push({event:Q,state:Z}),f09.has(Q.type))Zq6.add(1,{"org.id":Q.orgId});else if(y09.has(Q.type)&&J?.status.tag==="running")Zq6.add(-1,{"org.id":Q.orgId})}return G}react($){return Qq6($,this.deps)}getAbortSignal($){let X=this.states.get($);if(X?.status.tag==="running")return X.status.abortController.signal;return null}isRunning($){return this.states.get($)?.status.tag==="running"}async stopAll(){try{await this.deps.storage.orphanRunsByPod(this.podId)}catch($){console.error("[RunRegistry] Failed to orphan runs in DB:",$)}for(let[,$]of this.states)if($.status.tag==="running")$.status.abortController.abort();this.states.clear()}async recoverOrphanedRuns($){let X=await this.deps.storage.listOrphanedRuns(this.podId);if(X.length===0)return;let Y=5;for(let G=0;G<X.length;G+=Y){let Q=X.slice(G,G+Y);await Promise.allSettled(Q.map(async(J)=>{if(!await this.deps.storage.claimOrphanedRun(J.id,J.organization_id,this.podId))return;try{await $(J)}catch(W){console.error(`[RunRegistry] Failed to resume ${J.id}:`,W),await this.deps.storage.forceFailIfInProgress(J.id,J.organization_id).catch(()=>{})}}))}}async handlePodDeath($,X,Y){let G=await this.deps.storage.listOrphanedRunsByPod($);if(G.length===0)return;for(let J of G)Y?.broadcast(J.id);let Q=5;for(let J=0;J<G.length;J+=Q){let Z=G.slice(J,J+Q);await Promise.allSettled(Z.map(async(W)=>{if(this.isRunning(W.id))return;if(!await this.deps.storage.claimOrphanedRun(W.id,W.organization_id,this.podId))return;try{await X(W)}catch(F){console.error(`[RunRegistry] Failed to resume ${W.id}:`,F),await this.deps.storage.forceFailIfInProgress(W.id,W.organization_id).catch(()=>{})}}))}}dispose(){if(this.reaperTimer)clearInterval(this.reaperTimer),this.reaperTimer=null}reapStaleRuns(){let $=this.clock().getTime();for(let[X,Y]of this.states)if(Y.status.tag==="running"&&$-Y.status.startedAt.getTime()>b09)console.warn(`[RunRegistry] Reaping stale run for thread ${X} ...`),this.execute({type:"FORCE_FAIL",taskId:X,reason:"reaped"}).catch((G)=>{console.error("[RunRegistry] Reaper execute failed",G)})}}var _09=300000,b09=1800000,f09,y09,Zq6;var Wq6=D(()=>{Jq6();ZZ();f09=new Set(["RUN_STARTED","RUN_RESUMED"]),y09=new Set(["RUN_COMPLETED","RUN_FAILED","RUN_REQUIRES_ACTION","PREVIOUS_RUN_ABORTED"]),Zq6=CW.createUpDownCounter("decopilot.stream.inflight",{description:"Number of in-flight decopilot stream requests",unit:"{requests}"})});class YI0{storage;options;timer=null;constructor($,X={}){this.storage=$;this.options=X}start(){if(this.timer)return;let $=this.options.intervalMs??300000;this.timer=setInterval(()=>{this.runOnce()},$)}async runOnce(){let $=this.options.staleAfterMs??3600000;try{let X=await this.storage.sweepAbandoned($);if(X>0)console.log(`[async-research-sweeper] marked ${X} stale jobs as abandoned`);return X}catch(X){return console.error("[async-research-sweeper] sweep failed",X),0}}dispose(){if(this.timer)clearInterval(this.timer),this.timer=null}}import{readdir as x09,rm as Wu1}from"fs/promises";import{join as Ku1}from"path";async function Hu1($){let X=new Date;X.setUTCDate(X.getUTCDate()-g09),X.setUTCHours(0,0,0,0);let Y=0;try{let G=await Qu($);for(let Q of G)if(/^\d{4}$/.test(Q))Y+=await Kq6($,Q,X);else if(!Q.startsWith(".")){let J=Ku1($,Q),Z=await Qu(J);for(let K of Z){if(!/^\d{4}$/.test(K))continue;Y+=await Kq6(J,K,X)}if((await Qu(J)).length===0)await Wu1(J,{recursive:!0,force:!0})}}catch(G){console.warn("monitoring retention cleanup failed:",G)}return Y}async function Kq6($,X,Y){let G=0,Q=Ku1($,X),J=await Qu(Q);for(let W of J){if(!/^\d{2}$/.test(W))continue;let K=Ku1(Q,W),F=await Qu(K);for(let B of F){if(!/^\d{2}$/.test(B))continue;let N=new Date(`${X}-${W}-${B}T00:00:00Z`);if(isNaN(N.getTime()))continue;if(N<Y){let w=Ku1(K,B);await Wu1(w,{recursive:!0,force:!0}),G++}}if((await Qu(K)).length===0)await Wu1(K,{recursive:!0,force:!0})}if((await Qu(Q)).length===0)await Wu1(Q,{recursive:!0,force:!0});return G}async function Qu($){try{return(await x09($)).filter((Y)=>!Y.startsWith("."))}catch{return[]}}var g09=30;var GI0=()=>{};import{DBOS as QI0,SchedulerMode as h09}from"@dbos-inc/dbos-sdk";async function m09(){let $=[NH(),Du(),bN()],X=0;for(let Y of $)try{X+=await Hu1(Y)}catch(G){console.error("[monitoring-retention] cleanup failed:",G)}return console.log(`[monitoring-retention] deleted ${X} day-dir(s) across ${$.length} signal dir(s)`),{deleted:X,dirs:$.length}}async function l09($,X){await QI0.runStep(()=>m09(),{name:"monitoringRetention"})}function Fq6(){if(Hq6)return;Hq6=!0;let $=QI0.registerWorkflow(l09,{name:"monitoringRetentionWorkflow"});QI0.registerScheduled($,{name:"monitoringRetentionWorkflow",crontab:u09,mode:h09.ExactlyOncePerIntervalWhenActive})}var u09="23 4 * * *",Hq6=!1;var Uq6=D(()=>{RW();GI0()});function HG1($){return{...$,title:$.title??$.id}}function wq6($){let X=$.credentialId;return{credentialId:X,thinking:HG1($.thinking),...$.coding&&{coding:HG1($.coding)},...$.fast&&{fast:HG1($.fast)},...$.image&&{image:{...HG1($.image),credentialId:$.image.credentialId??X}},...$.deepResearch&&{deepResearch:{...HG1($.deepResearch),credentialId:$.deepResearch.credentialId??X}}}}var Fu1,Bq6,c09,Nq6;var zq6=D(()=>{l1();Fu1=H.object({id:H.string(),title:H.string().optional(),capabilities:H.object({vision:H.boolean().optional(),text:H.boolean().optional(),tools:H.boolean().optional(),reasoning:H.boolean().optional(),file:H.boolean().optional()}).passthrough().optional(),limits:H.object({contextWindow:H.number().optional(),maxOutputTokens:H.number().optional()}).passthrough().optional(),provider:H.string().nullish()}),Bq6=Fu1.extend({credentialId:H.string().optional()}),c09=H.object({models:H.object({credentialId:H.string(),thinking:Fu1,coding:Fu1.optional(),fast:Fu1.optional(),image:Bq6.optional(),deepResearch:Bq6.optional()}),agent:H.object({id:H.string()}),temperature:H.number(),toolApprovalLevel:H.enum(["auto","readonly","plan"]).optional(),mode:H.enum(["default","plan","web-search","gen-image"]).optional(),windowSize:H.number().optional(),triggerId:H.string().optional()}),Nq6=c09.transform(($)=>{let X=$.mode??"default",Y="auto";if($.toolApprovalLevel==="plan")X="plan",Y="readonly";else if($.toolApprovalLevel==="readonly")Y="readonly";else if($.toolApprovalLevel==="auto")Y="auto";return{models:$.models,agent:$.agent,temperature:$.temperature,toolApprovalLevel:Y,mode:X,windowSize:$.windowSize,triggerId:$.triggerId}})});class JI0{deps;kv=null;podId=null;refreshTimer=null;watchAbortController=null;initPromise=null;pendingDeathCallback=null;constructor($){this.deps=$}async init(){if(this.watchAbortController)this.watchAbortController.abort(),this.watchAbortController=null;if(this.refreshTimer)clearInterval(this.refreshTimer),this.refreshTimer=null;this.kv=null,this.initPromise=null;let $=this.deps.getJetStream();if(!$)return;return this.initPromise=$.views.kv(d09,{ttl:i09,storage:Dq6.StorageType.Memory}).then((X)=>{this.kv=X}).catch((X)=>{throw this.initPromise=null,X}),this.initPromise}start($){if(!this.kv)return;if(this.refreshTimer)return;if(this.podId=$,this.kv.put($,new TextEncoder().encode(new Date().toISOString())),this.refreshTimer=setInterval(()=>{this.kv?.put($,new TextEncoder().encode(new Date().toISOString())).catch((X)=>{console.error("[PodHeartbeat] Refresh failed:",X)})},p09),this.pendingDeathCallback)this.startDeathWatcher(this.pendingDeathCallback),this.pendingDeathCallback=null}onPodDeath($){if(!this.kv){this.pendingDeathCallback=$;return}this.startDeathWatcher($)}startDeathWatcher($){if(!this.kv)return;this.watchAbortController=new AbortController;let X=this.kv,Y=this.podId,G=this.watchAbortController.signal;(async()=>{while(!G.aborted)try{let J=await X.watch({initializedFn:()=>{}});for await(let Z of J){if(G.aborted)break;if(Z.operation==="DEL"||Z.operation==="PURGE"){let W=Z.key;if(W!==Y)$(W)}}}catch(J){if(G.aborted)break;console.error("[PodHeartbeat] Watcher error, reconnecting in 1s:",J),await new Promise((Z)=>setTimeout(Z,1000))}})().catch((J)=>{if(!G.aborted)console.error("[PodHeartbeat] Watcher loop failed:",J)})}async stop(){if(this.refreshTimer)clearInterval(this.refreshTimer),this.refreshTimer=null;if(this.kv&&this.podId)try{await this.kv.delete(this.podId)}catch{}if(this.watchAbortController)this.watchAbortController.abort(),this.watchAbortController=null;this.kv=null,this.podId=null,this.initPromise=null,this.pendingDeathCallback=null}}var Dq6,d09="POD_HEARTBEATS",i09=45000,p09=1e4;var Oq6=D(()=>{Dq6=G1(rp(),1)});function Lq6($){return async(X,Y)=>{let G=await $.db.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["member.role","organization.id as orgId","organization.slug as orgSlug","organization.name as orgName"]).where("member.userId","=",Y).where("member.organizationId","=",X).executeTakeFirst();if(!G)return console.warn(`[automationContextFactory] User ${Y} not found in org ${X} \u2014 returning null`),null;let Q=await eF.create();Q.auth.user={id:Y,role:G.role},Q.organization={id:G.orgId,slug:G.orgSlug,name:G.orgName};let J=await BL0($.db,X,G.role);Q.boundAuth=UL0({auth:Q.authInstance,headers:new Headers,role:G.role,permissions:J,userId:Y}),Q.access=new IV(Q.authInstance,Y,void 0,Q.boundAuth,G.role,"self"),Q.storage.threads=new n51($.threadStorage,G.orgId),Q.storage.asyncResearchJobs=new t51($.asyncResearchJobStorage,G.orgId);let Z=VU();return Q.objectStorage=Z?XP(Z,G.orgId):new jD(G.orgId,Q.baseUrl),Ir(Q.storage,{objectStorage:Q.objectStorage,baseUrl:Q.baseUrl,orgSlug:G.orgSlug}),Q}}var Eq6=D(()=>{i51();QY1();mq1();cq1();em();XY1();dA1()});function r09(){for(let $ of n09)$()}function jq6($){let X=[...ZI0.logs,$];ZI0={...ZI0,logs:X.length>500?X.slice(-500):X},r09()}function WI0(){return t09}var ZI0,n09,t09=!1;var KI0=D(()=>{ZI0={services:[{name:"Postgres",status:"pending",port:0},{name:"NATS",status:"pending",port:0}],migrationsStatus:"pending",serverUrl:null,logs:[]},n09=new Set});import{EventEmitter as a09}from"events";var HI0;var Pq6=D(()=>{KI0();HI0=new a09;HI0.on("request",($)=>{jq6($)})});function qq6(){return async($,X)=>{let Y=Date.now(),G=$.req.method,Q=$.req.path;if(Q==="/api/auth/get-session"||Q.includes("favicon")){await X();return}let J="",Z=!1;if(Q.startsWith("/mcp")&&G==="POST"){Z=!0;try{if($.req.header("Content-Type")?.includes("application/json")){let N=await $.req.raw.clone().json();if(N.method==="tools/call"&&N.params?.name){let w=tD(N.params.name),z=N.params.arguments||{};if(w==="EVENT_PUBLISH"&&z.type){let O=tD(String(z.type));J=`${W8.tool}EVENT_PUBLISH${W8.reset} ${W8.bold}\u2192 ${O}${W8.reset}`}else if(w==="EVENT_SUBSCRIBE"&&z.eventType){let O=tD(String(z.eventType));J=`${W8.tool}EVENT_SUBSCRIBE${W8.reset} ${W8.bold}\u2190 ${O}${W8.reset}`}else if(w==="EVENT_UNSUBSCRIBE"&&z.eventType){let O=tD(String(z.eventType));J=`${W8.tool}EVENT_UNSUBSCRIBE${W8.reset} ${W8.dim}\u2715 ${O}${W8.reset}`}else{let O=Object.keys(z).map((j)=>tD(j)),L=O.length>0?O.slice(0,3).join(",")+(O.length>3?"\u2026":""):"";J=`${W8.tool}${w}${W8.dim}(${L})${W8.reset}`}}else if(N.method)J=`${W8.dim}${tD(N.method)}${W8.reset}`}}catch{}}let W=tD(Q);if(Q.startsWith("/mcp/conn_")){let U=Q.split("/")[2]??"";W=`/mcp/${W8.mcp}${tD(U.slice(0,12))}\u2026${W8.reset}`}else if(Q==="/mcp")W=`${W8.mcp}/mcp${W8.reset}`;else if(Q==="/mcp/registry")W=`${W8.mcp}/mcp/registry${W8.reset}`;let K=s09(G),F=Z?"\u25C0":"\u2190";if(!WI0())console.log(`${W8.dim}${F}${W8.reset} ${K}${G}${W8.reset} ${W}${J?` ${J}`:""}`);try{await X()}finally{let U=Date.now()-Y,B=$.res.status,N=o09(B),w=U<1000?`${U}ms`:`${(U/1000).toFixed(1)}s`,z=Z?"\u25B6":"\u2192";if(!WI0())console.log(`${W8.dim}${z}${W8.reset} ${K}${G}${W8.reset} ${W}${J?` ${J}`:""} ${N}${B}${W8.reset} ${W8.duration}${w}${W8.reset}`);HI0.emit("request",{method:G,path:tD(Q),status:B,duration:U,timestamp:new Date})}}}var W8,o09=($)=>{if($>=500)return W8.serverError;if($>=400)return W8.clientError;if($>=300)return W8.redirect;return W8.ok},s09=($)=>{return W8[$]||W8.reset},tD=($)=>{return $.replace(/\r/g,"").replace(/\n/g,"").replace(/\x1b\[[0-9;]*m/g,"").replace(/[\x00-\x1f\x7f-\x9f]/g,"")};var Aq6=D(()=>{KI0();Pq6();W8={reset:"\x1B[0m",dim:"\x1B[2m",bold:"\x1B[1m",GET:"\x1B[36m",POST:"\x1B[33m",PUT:"\x1B[35m",DELETE:"\x1B[31m",ok:"\x1B[32m",redirect:"\x1B[36m",clientError:"\x1B[33m",serverError:"\x1B[31m",mcp:"\x1B[35m",tool:"\x1B[96m",duration:"\x1B[90m"}});import{createHmac as Iq6}from"crypto";import{mkdir as e09,readdir as $49,rm as Tq6,stat as Rq6}from"fs/promises";import{join as UI0,relative as X49}from"path";function kq6($){let X=$.replace(/[^a-zA-Z0-9_-]/g,"_");return UI0(Y49,X)}function Cq6($){return $.replace(/^\/+/,"").replace(/\.\./g,"")}function FI0($,X){let Y=kq6($),G=Cq6(X);return UI0(Y,G)}function G49($,X,Y,G){let Q=_4().encryptionKey||"dev-secret",J=`${$}:${X}:${Y}:${G}`;return Iq6("sha256",Q).update(J).digest("hex")}function Mq6($,X,Y,G,Q){let J=Math.floor(Date.now()/1000)+G,Z=G49(X,Y,J,Q),W=new URL(`/api/dev-assets/${X}/${Cq6(Y)}`,$);return W.searchParams.set("expires",J.toString()),W.searchParams.set("signature",Z),W.searchParams.set("method",Q),W.toString()}function vq6($,X,Y){let G=`${$}:${X.getTime()}:${Y}`;return`"${Iq6("md5","etag").update(G).digest("hex")}"`}async function _q6($,X,Y,G,Q){try{let J=await $49($,{withFileTypes:!0});for(let Z of J){let W=UI0($,Z.name),F=X49(X,W).replace(/\\/g,"/");if(Y&&!F.startsWith(Y))continue;if(Z.isDirectory())if(G){let U=F+"/";if(!Y||U.startsWith(Y)){if(!(Y?F.slice(Y.length):F).includes("/"))Q.commonPrefixes.add(U)}}else await _q6(W,X,Y,G,Q);else if(Z.isFile()){if(G&&Y){let U=F.slice(Y.length);if(U.includes(G)){let B=U.indexOf(G),N=Y+U.slice(0,B+1);Q.commonPrefixes.add(N);continue}}try{let U=await Rq6(W);Q.objects.push({key:F,size:U.size,lastModified:U.mtime.toISOString(),etag:vq6(W,U.mtime,U.size)})}catch{}}}}catch{}}function bq6($,X){let G=r1($).id;return[{name:"LIST_OBJECTS",description:"List objects in the local assets directory with pagination support",inputSchema:H.object({prefix:H.string().optional(),maxKeys:H.number().optional().default(1000),continuationToken:H.string().optional(),delimiter:H.string().optional()}),outputSchema:H.object({objects:H.array(H.object({key:H.string(),size:H.number(),lastModified:H.string(),etag:H.string()})),nextContinuationToken:H.string().optional(),isTruncated:H.boolean(),commonPrefixes:H.array(H.string()).optional()}),handler:async(Q)=>{let J=Q,Z=J.prefix||"",W=J.maxKeys??1000,K=J.delimiter,F=J.continuationToken,U=kq6(G);await e09(U,{recursive:!0});let B={objects:[],commonPrefixes:new Set};await _q6(U,U,Z,K,B),B.objects.sort((L,j)=>L.key.localeCompare(j.key));let N=0;if(F){if(N=B.objects.findIndex((L)=>L.key>F),N===-1)N=B.objects.length}let w=B.objects.slice(N,N+W),z=N+W<B.objects.length,O=z?w[w.length-1]?.key:void 0;return{objects:w,isTruncated:z,nextContinuationToken:O,commonPrefixes:Array.from(B.commonPrefixes).sort()}}},{name:"GET_OBJECT_METADATA",description:"Get metadata for a file in the local assets directory",inputSchema:H.object({key:H.string()}),outputSchema:H.object({contentType:H.string().optional(),contentLength:H.number(),lastModified:H.string(),etag:H.string(),metadata:H.record(H.string(),H.string()).optional()}),handler:async(Q)=>{let J=Q,Z=FI0(G,J.key),W=await Rq6(Z);return{contentType:DV0(J.key),contentLength:W.size,lastModified:W.mtime.toISOString(),etag:vq6(Z,W.mtime,W.size)}}},{name:"GET_PRESIGNED_URL",description:"Generate a presigned URL for downloading a file from local storage",inputSchema:H.object({key:H.string(),expiresIn:H.number().optional()}),outputSchema:H.object({url:H.string(),expiresIn:H.number()}),handler:async(Q)=>{let J=Q,Z=J.expiresIn??Vq6;return{url:Mq6(X,G,J.key,Z,"GET"),expiresIn:Z}}},{name:"PUT_PRESIGNED_URL",description:"Generate a presigned URL for uploading a file to local storage",inputSchema:H.object({key:H.string(),expiresIn:H.number().optional(),contentType:H.string().optional()}),outputSchema:H.object({url:H.string(),expiresIn:H.number()}),handler:async(Q)=>{let J=Q,Z=J.expiresIn??Vq6;return{url:Mq6(X,G,J.key,Z,"PUT"),expiresIn:Z}}},{name:"DELETE_OBJECT",description:"Delete a single file from local storage",inputSchema:H.object({key:H.string()}),outputSchema:H.object({success:H.boolean(),key:H.string()}),handler:async(Q)=>{let J=Q,Z=FI0(G,J.key);try{return await Tq6(Z),{success:!0,key:J.key}}catch{return{success:!1,key:J.key}}}},{name:"DELETE_OBJECTS",description:"Delete multiple files from local storage",inputSchema:H.object({keys:H.array(H.string()).max(1000)}),outputSchema:H.object({deleted:H.array(H.string()),errors:H.array(H.object({key:H.string(),message:H.string()}))}),handler:async(Q)=>{let J=Q,Z=[],W=[];return await Promise.all(J.keys.map(async(K)=>{let F=FI0(G,K);try{await Tq6(F),Z.push(K)}catch(U){W.push({key:K,message:U instanceof Error?U.message:"Unknown error"})}})),{deleted:Z,errors:W}}}]}async function BI0($,X,Y){let G=bq6(X,Y),Q=new vw({name:"dev-assets-mcp",version:"1.0.0"},{capabilities:{tools:{}}});for(let Z of G){let W="shape"in Z.inputSchema?Z.inputSchema.shape:H.object({}).shape,K=Z.outputSchema&&"shape"in Z.outputSchema?Z.outputSchema.shape:H.object({}).shape;Q.registerTool(Z.name,{description:Z.description??"",inputSchema:W,outputSchema:K,annotations:Z.annotations,_meta:Z._meta},async(F)=>{try{let U=await Z.handler(F);return{content:[{type:"text",text:JSON.stringify(U)}],structuredContent:U}}catch(U){return{content:[{type:"text",text:`Error: ${U.message}`}],isError:!0}}})}let J=new XH({enableJsonResponse:$.headers.get("Accept")?.includes("application/json")??!1});return await Q.connect(J),J.handleRequest($)}async function fq6($,X,Y,G){let J=bq6(Y,G).find((Z)=>Z.name===$);if(!J)return{content:[{type:"text",text:`Tool not found: ${$}`}],isError:!0};try{let Z=await J.handler(X);return{content:[{type:"text",text:JSON.stringify(Z)}]}}catch(Z){return{content:[{type:"text",text:Z instanceof Error?Z.message:String(Z)}],isError:!0}}}var Y49="./data/assets",Vq6=3600,Sq6,yq6;var xq6=D(()=>{F5();c5();l1();L01();ur();qh1();Sq6=new u4;Sq6.all("/",async($)=>{let X=$.get("meshContext"),Y=new URL($.req.url),G=`${Y.protocol}//${Y.host}`;return BI0($.req.raw,X,G)});yq6=Sq6});var gq6={};g6(gq6,{mountDevRoutes:()=>Q49});function Q49($,X){$.all("/mcp/:connectionId{.*_dev-assets$}",X,async(G)=>{let Q=G.get("meshContext"),J=new URL(G.req.url),Z=`${J.protocol}//${J.host}`;return BI0(G.req.raw,Q,Z)}),$.all("/mcp/:connectionId{.*_dev-assets$}/call-tool/:toolName",X,async(G)=>{let Q=G.get("meshContext"),J=new URL(G.req.url),Z=`${J.protocol}//${J.host}`,W=G.req.param("toolName");if(!W)return G.json({error:"Missing tool name"},400);let K=await G.req.json(),F=await fq6(W,K,Q,Z);if(F.isError)return G.json(F.content,500);return G.json(F.content)}),$.use("/mcp/dev-assets",X),$.route("/mcp/dev-assets",yq6);let Y=new u4;Y.use("*",u3({mountPath:"/api/dev-assets"})),Y.route("/",Ph1({orgFromPath:!1})),$.route("/api/dev-assets",Y)}var hq6=D(()=>{c5();HV0();qh1();xq6()});var uq6=D(()=>{lH0();cH0();fz()});var Uu1=D(()=>{uq6()});var lq6={};g6(lq6,{streamAgent:()=>mq6,createDecopilotClient:()=>Z49});async function J49($){let{parseJsonEventStream:X,uiMessageChunkSchema:Y}=await Promise.resolve().then(() => (u9(),fP0));return X({stream:$,schema:Y}).pipeThrough(new TransformStream({transform(G,Q){if(!G.success)throw G.error;Q.enqueue(G.value)}}))}async function mq6($,X,Y,G,Q){let{readUIMessageStream:J}=await Promise.resolve().then(() => (u9(),fP0)),Z=Y.value??Y.id;if(!Z)throw Error("Agent binding has no id or value \u2014 cannot resolve agent");let W=G.credentialId??Y.credentialId,K=G.thinking??Y.thinking,F=K?.id,U={messages:G.messages,...F?{models:{credentialId:W,thinking:K,...G.coding??Y.coding?{coding:G.coding??Y.coding}:{},...G.fast??Y.fast?{fast:G.fast??Y.fast}:{}}}:{},agent:{id:Z},temperature:G.temperature??Y.temperature,toolApprovalLevel:G.toolApprovalLevel??Y.toolApprovalLevel,mode:G.mode??Y.mode??"default",...G.memory?{memory:G.memory}:{},...G.thread_id?{thread_id:G.thread_id}:{}},B=await fetch($,{method:"POST",headers:{"Content-Type":"application/json","x-mesh-token":X,Authorization:`Bearer ${X}`},body:JSON.stringify(U),signal:Q?.signal});if(!B.ok){let w=await B.text().catch(()=>""),z=`HTTP ${B.status}`;try{let O=JSON.parse(w);if(O?.error)z=O.error}catch{if(w)z=w}throw Error(z)}if(!B.body)throw Error("Empty response body from decopilot stream");let N=await J49(B.body);return J({stream:N})}function Z49($){let{baseUrl:X,orgSlug:Y,token:G}=$,Q=`${X}/${Y}/decopilot/runtime/stream`;return{stream(J,Z){let W={__type:"@deco/agent",id:J.agent.id,credentialId:J.credentialId??"",thinking:J.thinking??{id:"",title:""},coding:J.coding,fast:J.fast,toolApprovalLevel:J.toolApprovalLevel,mode:J.mode,temperature:J.temperature};return mq6(Q,G,W,J,Z)}}}function cq6($){let X=$.properties;if(!X)return $;for(let Y of Object.values(X)){let G=Y.properties;if(!G?.__type?.const)continue;let Q=G.__type.const,J=W49.get(Q);if(!J)continue;let Z=J.map((W)=>({name:String(W.name),...W.inputSchema&&{inputSchema:H.toJSONSchema(W.inputSchema)},...W.outputSchema&&{outputSchema:H.toJSONSchema(W.outputSchema)}}));G.__binding={const:Z}}return $}var W49,vX7,K49=($)=>{return typeof $==="object"&&$!==null&&$.__type==="@deco/agent"},wI0=($)=>{return typeof $==="object"&&$!==null&&typeof $.__type==="string"&&$.__type!=="@deco/agent"&&typeof $.value==="string"},Bu1=($,X,Y)=>{let G=Y?{"x-caller-app":Y}:void 0;if(X.cookie)G??={},G.cookie=X.cookie;if(X.token)G??={},G["x-mesh-token"]=X.token;return{type:"HTTP",url:new URL(`/mcp/${$}`,X.meshUrl).href,token:X.token,headers:G}},H49=($,X,Y)=>{let G=Bu1($,X,Y);return new Proxy(Zp.forConnection(G),{get(Q,J){if(J==="value")return $;if(J==="__type")return Y;return Q[J]}})},F49=($,X)=>{let Y=X.organizationSlug;if(!Y)throw Error("organizationSlug is required for agent bindings");let G=`${X.meshUrl}/api/${Y}/decopilot/runtime/stream`;return{STREAM:async(Q,J)=>{let{streamAgent:Z}=await Promise.resolve().then(() => lq6);return Z(G,X.token,$,Q,J)}}},NI0=($,X)=>{if($===null||$===void 0)return $;if(Array.isArray($))return $.map((Y)=>NI0(Y,X));if(typeof $==="object"){if(K49($))return F49($,X);if(wI0($))return H49($.value,X,$.__type);let Y={};for(let[G,Q]of Object.entries($))Y[G]=NI0(Q,X);return Y}return $},dq6=($)=>{return NI0($.state,$)};var tt=D(()=>{Uu1();l1();W49=new Map;vX7=H.object({id:H.string(),title:H.string(),capabilities:H.object({vision:H.boolean().optional(),text:H.boolean().optional(),tools:H.boolean().optional(),reasoning:H.boolean().optional()}).passthrough().optional(),provider:H.string().optional().nullable(),limits:H.object({contextWindow:H.number().optional(),maxOutputTokens:H.number().optional()}).passthrough().optional()})});var U49,iq6=($,X,Y)=>{if(!X)return null;if($===void 0||$==="*")return"*";if(typeof $==="string")return $===X?$:null;if(Array.isArray($))return $.includes(X)?X:null;if(typeof $==="function")return $(X,Y)??null;return null},B49=($,X,Y)=>{let G=X.headers.get("Origin"),Q=iq6(Y.origin,G,X);if(Q)$.set("Access-Control-Allow-Origin",Q);if(Y.credentials)$.set("Access-Control-Allow-Credentials","true");if(Y.exposeHeaders?.length)$.set("Access-Control-Expose-Headers",Y.exposeHeaders.join(", "))},pq6=($,X)=>{let Y=new Headers,G=$.headers.get("Origin"),Q=iq6(X.origin,G,$);if(Q)Y.set("Access-Control-Allow-Origin",Q);if(X.credentials)Y.set("Access-Control-Allow-Credentials","true");let J=X.allowMethods??U49;Y.set("Access-Control-Allow-Methods",J.join(", "));let Z=$.headers.get("Access-Control-Request-Headers");if(X.allowHeaders?.length)Y.set("Access-Control-Allow-Headers",X.allowHeaders.join(", "));else if(Z)Y.set("Access-Control-Allow-Headers",Z);if(X.maxAge!==void 0)Y.set("Access-Control-Max-Age",X.maxAge.toString());return new Response(null,{status:204,headers:Y})},nq6=($,X,Y)=>{let G=new Headers($.headers);return B49(G,X,Y),new Response($.body,{status:$.status,statusText:$.statusText,headers:G})};var rq6=D(()=>{U49=["GET","HEAD","PUT","POST","DELETE","PATCH"]});function tq6($=32){let Y=new Uint8Array($);return crypto.getRandomValues(Y),Array.from(Y,(G)=>"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789"[G%62]).join("")}function N49($){try{let X=new URL($);return X.protocol==="https:"||X.hostname==="localhost"||X.hostname.endsWith(".localhost")||X.hostname==="127.0.0.1"||!X.protocol.startsWith("http")}catch{return!1}}function aq6($){return btoa(JSON.stringify($)).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}function oq6($){try{let X=$.replace(/-/g,"+").replace(/_/g,"/");return JSON.parse(atob(X))}catch{return null}}function sq6($){return{handleProtectedResourceMetadata:(F)=>{let U=CN(new URL(F.url)),B=`${U.origin}/mcp`;return Response.json({resource:B,authorization_servers:[U.origin],scopes_supported:["*"],bearer_methods_supported:["header"],resource_signing_alg_values_supported:["RS256","none"]})},handleAuthorizationServerMetadata:(F)=>{let B=CN(new URL(F.url)).origin;return Response.json({issuer:B,authorization_endpoint:`${B}/authorize`,token_endpoint:`${B}/token`,registration_endpoint:`${B}/register`,scopes_supported:["*"],response_types_supported:["code"],response_modes_supported:["query"],grant_types_supported:["authorization_code","refresh_token"],token_endpoint_auth_methods_supported:["none","client_secret_post"],code_challenge_methods_supported:["S256","plain"]})},handleAuthorize:(F)=>{let U=CN(new URL(F.url)),B=U.searchParams.get("redirect_uri"),N=U.searchParams.get("response_type"),w=U.searchParams.get("state"),z=U.searchParams.get("code_challenge"),O=U.searchParams.get("code_challenge_method");if(!B)return Response.json({error:"invalid_request",error_description:"redirect_uri required"},{status:400});if(N!=="code")return Response.json({error:"unsupported_response_type",error_description:"Only 'code' is supported"},{status:400});let L=CN(new URL(`${U.origin}/oauth/callback`)),j=L.toString(),T=aq6({redirectUri:B,clientState:w??void 0,codeChallenge:z??void 0,codeChallengeMethod:O??void 0,oauthCallbackUri:j});L.searchParams.set("state",T);let I=$.authorizationUrl(L.toString());return Response.redirect(I,302)},handleOAuthCallback:async(F)=>{let U=CN(new URL(F.url)),B=U.searchParams.get("code"),N=U.searchParams.get("state"),w=U.searchParams.get("error"),z=N?oq6(N):null;if(w){let O=U.searchParams.get("error_description")??"Authorization failed";if(z?.redirectUri){let L=CN(new URL(z.redirectUri));if(L.searchParams.set("error",w),L.searchParams.set("error_description",O),z.clientState)L.searchParams.set("state",z.clientState);return Response.redirect(L.toString(),302)}return Response.json({error:w,error_description:O},{status:400})}if(!B||!z)return Response.json({error:"invalid_request",error_description:"Missing code or state"},{status:400});try{let O=z.oauthCallbackUri??CN(new URL(`${U.origin}/oauth/callback`)).toString(),L={code:B,redirect_uri:O},j=await $.exchangeCode(L),P={accessToken:j.access_token,tokenType:j.token_type,refreshToken:j.refresh_token,expiresIn:j.expires_in,scope:j.scope,codeChallenge:z.codeChallenge,codeChallengeMethod:z.codeChallengeMethod},T=aq6(P),I=CN(new URL(z.redirectUri));if(I.searchParams.set("code",T),z.clientState)I.searchParams.set("state",z.clientState);return Response.redirect(I.toString(),302)}catch(O){console.error("OAuth callback error:",O);let L=CN(new URL(z.redirectUri));if(L.searchParams.set("error","server_error"),L.searchParams.set("error_description","Failed to exchange authorization code"),z.clientState)L.searchParams.set("state",z.clientState);return Response.redirect(L.toString(),302)}},handleToken:async(F)=>{try{let U=F.headers.get("content-type")??"",B;if(U.includes("application/x-www-form-urlencoded")){let P=await F.formData();B=Object.fromEntries(P.entries())}else{let P=await F.json();if(typeof P!=="object"||P===null||Array.isArray(P))return Response.json({error:"invalid_request",error_description:"Request body must be a JSON object"},{status:400});B=P}let{code:N,code_verifier:w,grant_type:z,refresh_token:O}=B;if(z==="refresh_token"){if(typeof O!=="string"||!O)return Response.json({error:"invalid_request",error_description:"refresh_token is required and must be a string"},{status:400});if(!$.refreshToken)return Response.json({error:"unsupported_grant_type",error_description:"refresh_token grant not supported"},{status:400});let P;try{P=await $.refreshToken(O)}catch(I){if(I instanceof zI0)return Response.json({error:I.error,...I.errorDescription?{error_description:I.errorDescription}:{}},{status:400});throw I}let T={access_token:P.access_token,token_type:P.token_type};if(P.refresh_token)T.refresh_token=P.refresh_token;if(P.expires_in!==void 0)T.expires_in=P.expires_in;if(P.scope)T.scope=P.scope;return Response.json(T,{headers:{"Cache-Control":"no-store",Pragma:"no-cache"}})}if(z!=="authorization_code")return Response.json({error:"unsupported_grant_type",error_description:"Only authorization_code and refresh_token supported"},{status:400});if(typeof N!=="string"||!N)return Response.json({error:"invalid_request",error_description:"code is required and must be a string"},{status:400});let L=oq6(N);if(!L||!L.accessToken)return Response.json({error:"invalid_grant",error_description:"Invalid or expired code"},{status:400});if(L.codeChallenge){if(typeof w!=="string"||!w)return Response.json({error:"invalid_grant",error_description:"code_verifier required and must be a string"},{status:400});let P;if(L.codeChallengeMethod==="S256"){let I=new TextEncoder().encode(w),V=await crypto.subtle.digest("SHA-256",I);P=btoa(String.fromCharCode(...new Uint8Array(V))).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}else P=w;if(P!==L.codeChallenge)return Response.json({error:"invalid_grant",error_description:"Invalid code_verifier"},{status:400})}let j={access_token:L.accessToken,token_type:L.tokenType};if(L.refreshToken)j.refresh_token=L.refreshToken;if(L.expiresIn!==void 0)j.expires_in=L.expiresIn;if(L.scope)j.scope=L.scope;return Response.json(j,{headers:{"Cache-Control":"no-store",Pragma:"no-cache"}})}catch(U){return console.error("Token exchange error:",U),Response.json({error:"server_error",error_description:"Failed to process token request"},{status:500})}},handleClientRegistration:async(F)=>{try{let U=await F.json();if(!U.redirect_uris||U.redirect_uris.length===0)return Response.json({error:"invalid_redirect_uri",error_description:"At least one redirect_uri is required"},{status:400});for(let O of U.redirect_uris)if(!N49(O))return Response.json({error:"invalid_redirect_uri",error_description:`Invalid redirect URI: ${O}`},{status:400});let B=tq6(32),N=U.token_endpoint_auth_method!=="none"?tq6(32):void 0,w=Math.floor(Date.now()/1000),z={client_id:B,client_secret:N,client_name:U.client_name,redirect_uris:U.redirect_uris,grant_types:U.grant_types??["authorization_code"],response_types:U.response_types??["code"],token_endpoint_auth_method:U.token_endpoint_auth_method??"client_secret_post",scope:U.scope,client_id_issued_at:w,client_secret_expires_at:0};if($.persistence)await $.persistence.saveClient(z);return new Response(JSON.stringify(z),{status:201,headers:{"Content-Type":"application/json","Cache-Control":"no-store",Pragma:"no-cache"}})}catch(U){return console.error("Client registration error:",U),Response.json({error:"invalid_client_metadata",error_description:"Invalid client registration request"},{status:400})}},createUnauthorizedResponse:(F)=>{let N=`Bearer resource_metadata="${`${CN(new URL(F.url)).origin}/.well-known/oauth-protected-resource`}", scope="*"`;return Response.json({jsonrpc:"2.0",error:{code:-32000,message:"Unauthorized: Authentication required"},id:null},{status:401,headers:{"WWW-Authenticate":N,"Access-Control-Expose-Headers":"WWW-Authenticate"}})},hasAuth:(F)=>F.headers.has("Authorization")}}var zI0,CN=($)=>{if(!($.hostname==="localhost"||$.hostname.endsWith(".localhost")||$.hostname==="127.0.0.1"))$.protocol="https:";return $};var DI0=D(()=>{zI0=class zI0 extends Error{error;errorDescription;constructor($="invalid_grant",X){super(X??$);this.name="OAuthInvalidGrantError",this.error=$,this.errorDescription=X}}});import{AsyncLocalStorage as w49}from"async_hooks";var eq6,FG1;var OI0=D(()=>{eq6=new w49,FG1={getStore:()=>{return eq6.getStore()},run:($,X,...Y)=>eq6.run($,X,...Y)}});var XA6="SELF",wu1=($)=>{return typeof $==="object"&&$!==null&&"handler"in $&&"events"in $&&typeof $.handler==="function"&&Array.isArray($.events)},YA6=($)=>{return typeof $==="object"&&$!==null&&"handler"in $&&"events"in $&&typeof $.handler==="function"&&Array.isArray($.events)},$A6="::",GA6=($)=>{let X=$.indexOf($A6);if(X===-1)return null;let Y=$.substring(0,X),G=$.substring(X+$A6.length);return[Y,G]},z49=($)=>{if(!$.startsWith("cron/"))return null;let X=$.substring(5),Y=X.indexOf("/");if(Y===-1)return null;let G=X.substring(0,Y),Q=X.substring(Y+1);return[G,Q]},QA6=($)=>{if(wu1($))return[];return Object.keys($)},D49=($,X)=>{if(wu1($))return $.events;let Y=$[X];if(!Y)return[];if(YA6(Y))return Y.events;return Object.keys(Y)},Nu1=($,X,Y)=>{if($===XA6){if(!Y)return console.warn("[Event] SELF binding used but no connectionId available"),null;return Y}let G=X[$];if(!wI0(G))return console.warn(`[Event] Binding "${$}" not found in state`),null;return G.value},O49=($,X,Y)=>{let G=X;if(wu1($)){let J=[];for(let Z of $.events){let W=GA6(Z);if(!W){console.warn(`[Event] Global handler event "${Z}" must be prefixed with BINDING:: (e.g., "SELF::${Z}" or "DATABASE::${Z}")`);continue}let[K,F]=W,U=Nu1(K,G,Y);if(!U)continue;J.push({eventType:F,publisher:U})}return J}let Q=[];for(let J of QA6($)){let Z=Nu1(J,G,Y);if(!Z)continue;let W=D49($,J);for(let K of W)Q.push({eventType:K,publisher:Z})}return Q},L49=($)=>{let X=new Map;for(let Y of $){let G=Y.source,Q=X.get(G)||[];Q.push(Y),X.set(G,Q)}return X},E49=($)=>{let X=new Map;for(let Y of $){let G=Y.type,Q=X.get(G)||[];Q.push(Y),X.set(G,Q)}return X},j49=($)=>{let X={},Y={},G=!1,Q=0,J=[];for(let Z of $){if(Z.results)Object.assign(Y,Z.results);if(Z.success===!1){if(G=!0,Z.error)J.push(Z.error)}if(Z.processedCount!==void 0)Q+=Z.processedCount}if(Object.keys(Y).length>0)X.results=Y;if(X.success=!G,J.length>0)X.error=J.join("; ");if(Q>0)X.processedCount=Q;return X},P49=async($,X,Y,G,Q)=>{let J=G;if(wu1($)){let U=new Set;for(let N of $.events){let w=GA6(N);if(!w)continue;let[z,O]=w,L=Nu1(z,J,Q);if(!L)continue;U.add(`${L}:${O}`)}let B=X.filter((N)=>{let w=`${N.source}:${N.type}`;return U.has(w)});if(B.length===0)return{success:!0};try{return await $.handler({events:B},Y)}catch(N){return{success:!1,error:N instanceof Error?N.message:String(N)}}}let Z=new Map;for(let U of QA6($)){let B=Nu1(U,J,Q);if(B)Z.set(B,U)}let W=L49(X),K=[];for(let[U,B]of W){let N=Z.get(U);if(!N)continue;let w=$[N];if(!w)continue;if(YA6(w)){K.push((async()=>{try{return await w.handler({events:B},Y)}catch(L){let j={};for(let P of B)j[P.id]={success:!1,error:L instanceof Error?L.message:String(L)};return{results:j}}})());continue}let z=w,O=E49(B);for(let[L,j]of O){let P=z[L];if(!P)continue;K.push((async()=>{try{let T=await P({events:j},Y),I={};for(let V of j)I[V.id]=T;return{results:I}}catch(T){let I={};for(let V of j)I[V.id]={success:!1,error:T instanceof Error?T.message:String(T)};return{results:I}}})())}}let F=await Promise.all(K);if(F.length===0)return{success:!0};return j49(F)},zu1;var LI0=D(()=>{tt();zu1={subscriptions:O49,execute:P49,parseCron:z49}});function at($){return $.toLowerCase().trim().replace(/[^a-z0-9]+/g,"-").replace(/^-|-$/g,"")}function ZA6($,X){return`${$}::${at(X)}`}function EI0($){return`START_WORKFLOW_${at($).toUpperCase().replace(/-/g,"_")}`}function WA6($,X){let Y=Bu1("self",{meshUrl:$,token:X});return Zp.forConnection(Y)}function q49($,X){if(!Ju.has($)&&Ju.size>=KA6){let Y=Ju.keys().next().value;if(Y!==void 0)Ju.delete(Y)}Ju.set($,X)}function A49($){return`Workflows Agent (${$})`}function JA6($,X){if(!Zu.has($)&&Zu.size>=KA6){let Y=Zu.keys().next().value;if(Y!==void 0)Zu.delete(Y)}Zu.set($,X)}async function T49($,X,Y){let G=Zu.get($);if(G)return console.log(`${Y} Using cached default Virtual MCP: ${G}`),G;let Q=A49($);try{let J=await X.COLLECTION_VIRTUAL_MCP_LIST({where:{operator:"and",conditions:[{field:["connection_id"],operator:"eq",value:$},{field:["title"],operator:"eq",value:Q}]},limit:1});if(J.items.length>0){let Z=J.items[0].id;return JA6($,Z),console.log(`${Y} Found existing default Virtual MCP: ${Z}`),Z}}catch(J){console.warn(`${Y} Could not list Virtual MCPs \u2014 proceeding without default. Error: ${J instanceof Error?J.message:String(J)}`);return}try{let Z=(await X.COLLECTION_VIRTUAL_MCP_CREATE({data:{title:Q,connections:[{connection_id:$,selected_tools:null}]}})).item.id;return JA6($,Z),console.log(`${Y} Created default Virtual MCP: ${Z}`),Z}catch(J){console.warn(`${Y} Could not create default Virtual MCP \u2014 proceeding without default. Error: ${J instanceof Error?J.message:String(J)}`);return}}function V49($){return JSON.stringify($.map((X)=>({title:X.title,description:X.description??void 0,virtual_mcp_id:X.virtual_mcp_id??void 0,steps:X.steps,toolId:X.toolId??void 0,inputSchema:X.inputSchema??void 0})))}async function M49($,X,Y,G,Q){let J=`[Workflows][${Y}]`,Z=$.find((T)=>at(T.title)==="");if(Z!==void 0){console.warn(`${J} Workflow title "${Z.title}" produces an empty ID. Skipping sync.`);return}if($.length>0){let T=$.map((V)=>at(V.title));if(new Set(T).size!==T.length){let V=new Set(T.filter((v,S)=>T.indexOf(v)!==S)),R=$.filter((v)=>V.has(at(v.title))).map((v)=>v.title);console.warn(`${J} Workflow titles that produce duplicate IDs: ${[...new Set(R)].join(", ")}. Skipping sync.`);return}}let W=V49($),K=Ju.get(Y);if(K===W){console.log(`${J} Fingerprint unchanged \u2014 skipping sync. Declared: ${$.length} workflow(s): [${$.map((T)=>T.title).join(", ")}]`);return}console.log(`${J} Fingerprint changed (or first sync) \u2014 starting sync. Declared: ${$.length} workflow(s): [${$.map((T)=>T.title).join(", ")}]`,K?"(previous fingerprint existed)":"(no previous fingerprint)");let F=Q??WA6(X,G),B=$.some((T)=>T.virtual_mcp_id===void 0)?await T49(Y,F,J):void 0,N;try{let T=[],I=0,V=200;while(!0){let R=await F.COLLECTION_WORKFLOW_LIST({limit:V,offset:I});if(T.push(...R.items),!R.hasMore||R.items.length===0)break;I+=R.items.length}N=T,console.log(`${J} LIST returned ${N.length} total workflow(s). IDs owned by this connection: [${N.filter((R)=>R.id.startsWith(`${Y}::`)).map((R)=>R.id).join(", ")||"none"}]`)}catch(T){let I=T instanceof Error?T.message:String(T);console.warn(`${J} Could not list workflows (workflows plugin may not be enabled). Skipping sync. Error: ${I}`);return}let w=`${Y}::`,z=new Map(N.filter((T)=>T.id.startsWith(w)).map((T)=>[T.id,T])),O=$.map((T)=>[ZA6(Y,T.title),T]),L=new Set(O.map(([T])=>T)),j=!1;await Promise.all(O.map(async([T,I])=>{let V=z.has(T)?"UPDATE":"CREATE";console.log(`${J} ${V} "${I.title}" (id=${T})`);try{let R=I.virtual_mcp_id??B;if(V==="UPDATE"){let v=await F.COLLECTION_WORKFLOW_UPDATE({id:T,data:{title:I.title,description:I.description,...R!==void 0&&{virtual_mcp_id:R},steps:I.steps,input_schema:I.inputSchema===void 0?void 0:I.inputSchema??null}});if(!v.success)j=!0,console.warn(`${J} UPDATE "${I.title}" returned success=false:`,String(v.error??"(no error message)"));else console.log(`${J} UPDATE "${I.title}" OK`)}else await F.COLLECTION_WORKFLOW_CREATE({data:{id:T,title:I.title,description:I.description,virtual_mcp_id:R,steps:I.steps,input_schema:I.inputSchema??null}}),console.log(`${J} CREATE "${I.title}" OK`)}catch(R){j=!0,console.warn(`${J} Failed to ${V} workflow "${I.title}":`,R instanceof Error?R.message:String(R))}}));let P=[...z.keys()].filter((T)=>!L.has(T));if(P.length>0)console.log(`${J} Deleting ${P.length} orphaned workflow(s): [${P.join(", ")}]`);if(await Promise.all(P.map(async(T)=>{try{await F.COLLECTION_WORKFLOW_DELETE({id:T}),console.log(`${J} DELETE "${T}" OK`)}catch(I){j=!0,console.warn(`${J} Failed to delete orphaned workflow "${T}":`,I instanceof Error?I.message:String(I))}})),!j)q49(Y,W),console.log(`${J} Sync complete \u2014 fingerprint stored.`);else console.warn(`${J} Sync finished with errors \u2014 fingerprint NOT stored so the next call will retry.`)}async function I49($,X,Y,G,Q){let Z=(Du1.get(Y)??Promise.resolve()).catch(()=>{}).then(()=>M49($,X,Y,G,Q)).finally(()=>{if(Du1.get(Y)===Z)Du1.delete(Y)});return Du1.set(Y,Z),Z}var Du1,KA6=500,Ju,Zu,HA6,Ou1;var jI0=D(()=>{tt();Uu1();Du1=new Map,Ju=new Map;Zu=new Map;HA6=["SELF::COLLECTION_WORKFLOW_LIST","SELF::COLLECTION_WORKFLOW_CREATE","SELF::COLLECTION_WORKFLOW_UPDATE","SELF::COLLECTION_WORKFLOW_DELETE","SELF::COLLECTION_WORKFLOW_EXECUTION_CREATE","SELF::COLLECTION_VIRTUAL_MCP_LIST","SELF::COLLECTION_VIRTUAL_MCP_CREATE"],Ou1={sync:I49,slugify:at,workflowId:ZA6,toolId:EI0,createExecution:async($,X,Y)=>{return(await WA6($,X).COLLECTION_WORKFLOW_EXECUTION_CREATE(Y)).item.id},clearFingerprint:($)=>{Ju.delete($),Zu.delete($)}}});function vN($){return{...$,execute:(X)=>{let Y=UG1(X.runtimeContext);return $.execute({...X,runtimeContext:Y},Y)}}}var UG1=($)=>{let X=FG1.getStore();if(!X){if($)return $;throw Error("Missing context, did you forget to call State.bind?")}return X},R49=($,X)=>{let Y=X;return typeof Y[$]<"u"?Y[$]:X?.MESH_REQUEST_CONTEXT?.state?.[$]},Lu1=($)=>{let X=$.runtimeContext.env.MESH_REQUEST_CONTEXT;return{connectionId:X?.connectionId,meshUrl:X?.meshUrl,token:X?.token}},S49=({events:$,workflows:X,configuration:{state:Y,scopes:G,onChange:Q}={}}={})=>{let J=Y?cq6(H.toJSONSchema(Y)):{type:"object",properties:{}},Z=String($?.bus??"EVENT_BUS");return[...Q||$||X?.length?[vN({id:"ON_MCP_CONFIGURATION",description:"MCP Configuration On Change",inputSchema:H.object({state:Y??H.unknown(),scopes:H.array(H.string()).describe("Array of scopes in format 'KEY::SCOPE' (e.g., 'GMAIL::GetCurrentUser')")}),outputSchema:H.object({}),execute:async(W)=>{let K=W.context.state;await Q?.(W.runtimeContext.env,{state:K,scopes:W.context.scopes});let F=R49(Z,W.runtimeContext.env);if($&&K&&F){let{connectionId:U}=Lu1(W),B=zu1.subscriptions($?.handlers??{},K,U);if(await F.EVENT_SYNC_SUBSCRIPTIONS({subscriptions:B}),U){let N=B.filter((w)=>w.eventType.startsWith("cron/")&&w.publisher===U);await Promise.all(N.map(async(w)=>{let z=zu1.parseCron(w.eventType);if(z){let[,O]=z;await F.EVENT_PUBLISH({type:w.eventType,cron:O})}}))}}if(X?.length){let{connectionId:U,meshUrl:B,token:N}=Lu1(W);if(U&&B)await Ou1.sync(X,B,U,N)}return Promise.resolve({})}})]:[],...$?.handlers?[vN({id:"ON_EVENTS",description:"Receive and process CloudEvents from the event bus. Returns per-event or batch results.",inputSchema:FP1,outputSchema:UP1,execute:async(W)=>{let K=W.runtimeContext.env,F=K.MESH_REQUEST_CONTEXT?.state,{connectionId:U}=Lu1(W);return zu1.execute($.handlers,W.context.events,K,F,U)}})]:[],vN({id:"MCP_CONFIGURATION",description:"MCP Configuration",inputSchema:H.object({}),outputSchema:H.object({stateSchema:H.unknown(),scopes:H.array(H.string()).optional()}),execute:()=>{return Promise.resolve({stateSchema:J,scopes:[...G??[],...$?[`${Z}::EVENT_SYNC_SUBSCRIPTIONS`]:[],...X?.length?[...HA6]:[]]})}}),...X?.length?X.map((W)=>{let K=W.toolId??EI0(W.title),F=[W.description?`Run workflow: ${W.description}`:`Start the "${W.title}" workflow.`,"Returns an execution_id immediately. Use COLLECTION_WORKFLOW_EXECUTION_GET to track progress."].join(" ");return vN({id:K,description:(()=>{if(!W.inputSchema)return F;let U=JSON.stringify(W.inputSchema,null,2);return U.length<=2048?`${F}
 
 Input schema:
 ${U}`:`${F}