npm - decocms - Versions diffs - 2.393.1 → 2.393.2 - Mend

decocms 2.393.1 → 2.393.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (459) hide show

package/dist/server/cli.js CHANGED Viewed

@@ -75398,7 +75398,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 `);if(W===-1)return;let G=Q.subarray(0,W).toString("utf8"),F=Q.subarray(W+4),B=G.split(`\r
 `,1)[0]??"";if(!/^HTTP\/1\.[01] 101(?:\s|$)/.test(B)){Mj($,1011,u.upstreamErrorReason);try{E.end()}catch{}return}Y=!0,$.data.upstream=E;let v=Piu((N,O)=>{try{if(N===1)$.send(O.toString("utf8"));else if(N===2)$.send(O);else if(N===8){let{code:z,reason:H}=_iu(O);Mj($,z,H);try{E.end()}catch{}}}catch{}});if(E.removeAllListeners("data"),F.length>0)v(F);E.on("data",(N)=>v(N));for(let N of $.data.pending)try{E.write(uY1(N,!0))}catch{}$.data.pending.length=0})}function Hiu($,u){let f=[`GET ${$} HTTP/1.1`];for(let[X,J]of Object.entries(u))f.push(`${X}: ${J}`);return f.push("",""),f.join(`\r
 `)}function Mj($,u,f){try{if(u!==void 0)$.close(u,f??"");else $.close()}catch{}}function uY1($,u,f){let X,J;if(typeof $==="string")X=Buffer.from($,"utf8"),J=1;else if($ instanceof ArrayBuffer)X=Buffer.from($),J=2;else if(Buffer.isBuffer($))X=$,J=2;else X=Buffer.from($),J=2;let w=f??J,E=X.length,Q=[];Q.push(128|w&15);let Y=u?128:0;if(E<126)Q.push(Y|E);else if(E<65536)Q.push(Y|126,E>>8&255,E&255);else Q.push(Y|127,0,0,0,0),Q.push(E>>>24&255,E>>>16&255,E>>>8&255,E&255);if(u){let Z=hT4(4),W=Buffer.alloc(E);for(let G=0;G<E;G++)W[G]=X[G]^Z[G&3];return Buffer.concat([Buffer.from(Q),Z,W])}return Buffer.concat([Buffer.from(Q),X])}function _iu($){if($.length<2)return{code:1000,reason:""};return{code:$.readUInt16BE(0),reason:$.subarray(2).toString("utf8")}}function Piu($){let u=Buffer.alloc(0);return(f)=>{u=u.length===0?f:Buffer.concat([u,f]);while(!0){if(u.length<2)return;let X=u[0],J=u[1],w=X&15,E=(J&128)!==0,Q=J&127,Y=2;if(Q===126){if(u.length<Y+2)return;Q=u[Y]<<8|u[Y+1],Y+=2}else if(Q===127){if(u.length<Y+8)return;Q=u[Y+4]*16777216+(u[Y+5]<<16|u[Y+6]<<8|u[Y+7]),Y+=8}let Z=null;if(E){if(u.length<Y+4)return;Z=u.subarray(Y,Y+4),Y+=4}if(u.length<Y+Q)return;let W=u.subarray(Y,Y+Q);if(Z){let G=Buffer.alloc(Q);for(let F=0;F<Q;F++)G[F]=W[F]^Z[F&3];W=G}u=u.subarray(Y+Q),$(w,W)}}}var ziu=256;var bT4=U(()=>{MT4()});function iT4($){if(typeof $!=="string"||$.length===0)return null;let u=$.lastIndexOf(":");if($.startsWith("["))return null;let X=(u>=0?$.slice(0,u):$).replace(/\.$/,"").toLowerCase(),J=".localhost";if(!X.endsWith(J))return null;let w=X.slice(0,-J.length);if(w.length===0)return null;if(w.includes("."))return null;return w}async function xT4($){let u=VT4({maxPendingFrames:$.maxPendingWsFrames??jiu,backlogOverflowReason:"ingress backlog overflow"}),f=Bun.serve({port:$.port,hostname:"127.0.0.1",async fetch(X,J){let w=X.headers.get("host"),E=iT4(w);if(!E)return new Response("not found",{status:404});let Q=$.lookupSandboxPort(E);if(!Q){if(X.headers.get("upgrade")==="websocket")return new Response("unknown handle",{status:404});return new Response(Liu,{status:503,headers:{"Content-Type":"text/html; charset=utf-8","Cache-Control":"no-store","Retry-After":"1"}})}if(X.headers.get("upgrade")==="websocket"){let G=new URL(X.url);if(!J.upgrade(X,{data:gT4({port:Q,pathQuery:`${G.pathname}${G.search}`,protocols:yT4(X.headers)})}))return new Response("ws upgrade failed",{status:400});return}let Y=new URL(X.url),Z=`http://127.0.0.1:${Q}${Y.pathname}${Y.search}`,W=new Headers(X.headers);return W.set("host",`127.0.0.1:${Q}`),fetch(Z,{method:X.method,headers:W,body:X.body,redirect:"manual"})},websocket:{open:u.open,message:u.message,close:u.close}});return{port:f.port??0,async stop(){f.stop(!0)}}}var jiu=256,Liu='<!DOCTYPE html><html><head><meta charset="utf-8"><title>Connecting\u2026</title><style>body{font-family:system-ui,sans-serif;display:flex;align-items:center;justify-content:center;min-height:100vh;margin:0;background:#fafafa;color:#555}div{text-align:center;max-width:420px;padding:24px}h3{margin:0 0 8px}p{margin:0;font-size:14px;color:#999;line-height:1.5}</style></head><body><div><h3>Connecting to sandbox\u2026</h3><p>Waiting for the local sandbox to come online. This page refreshes automatically.</p></div><script>setTimeout(function(){window.location.reload()},1500)</script></body></html>';var lT4=U(()=>{bT4()});import{randomBytes as Tiu}from"crypto";import{mkdir as Aiu,readFile as Iiu,writeFile as Siu}from"fs/promises";import{dirname as kiu,join as Riu}from"path";function Ciu($){return Riu($,"machine-id")}async function cT4($){let u=Ciu($);try{let J=(await Iiu(u,"utf8")).trim();if(J)return J}catch{}let f=Tiu(16).toString("hex");return await Aiu(kiu(u),{recursive:!0}),await Siu(u,f),f}var dT4=()=>{};import{randomBytes as qiu}from"crypto";import{mkdir as Miu}from"fs/promises";import{createServer as hiu}from"net";import{join as yiu}from"path";function mT4($,u){return Error(`sandbox failed to start: ${$}`,{cause:u})}function giu($){if(!($ instanceof Error))return!1;return $.name==="TimeoutError"||/timed out|timeout|operation was aborted|aborted/i.test($.message)}function Viu($){if($ instanceof Error){let u=$.cause;if(u instanceof Error&&u.message)return u.message;return $.message}return String($)}function nT4($){let u=$.maxSandboxes??20,f=new Map,X=$.pickPort??biu,J=$.fetchImpl??fetch,w=$.resolvePreviewUrl??((F,B)=>`http://127.0.0.1:${B}`),E=(F)=>{try{$.onEvent?.(F)}catch{}},Q=async(F)=>{let B=new AbortController,v=setTimeout(()=>B.abort(),1500);try{let N=await J(`${F}/health`,{signal:B.signal});if(!N.ok)console.warn(`[user-desktop] probe ${F}/health \u2192 ${N.status} (treating as dead)`);return N.ok}catch(N){return console.warn(`[user-desktop] probe ${F}/health failed: ${N instanceof Error?N.message:String(N)} (treating as dead)`),!1}finally{clearTimeout(v)}},Y=(F)=>{console.warn(`[user-desktop] evicting dead daemon handle=${F.handle} port=${F.port}`);try{F.process.kill("SIGTERM")}catch{}if(f.get(F.handle)===F)f.delete(F.handle),E({handle:F.handle,phase:"evicted"})},Z=new Map;function W(){if(f.size<u)return;let F=[...f.values()].filter((v)=>v.activeDispatchCount===0).sort((v,N)=>v.lastUsedAt-N.lastUsedAt);if(F.length===0){console.warn(`[user-desktop] at cap ${f.size}/${u} but every sandbox is pinned (active dispatch) \u2014 exceeding cap temporarily`);return}let B=F[0];console.log(`[user-desktop] evicting LRU victim handle=${B.handle} port=${B.port} (cap ${u} reached, size=${f.size})`);try{B.process.kill("SIGTERM")}catch{}f.delete(B.handle),E({handle:B.handle,phase:"evicted"})}let G=async(F)=>{E({handle:F.handle,phase:"spawning"}),W();let B=yiu($.dataDir,"sandboxes",F.handle);await Miu(B,{recursive:!0}),console.log(`[user-desktop] ensure handle=${F.handle} repo=${F.repo?.cloneUrl??"(none)"} branch=${F.repo?.branch??"(none)"} runtime=${F.workload?.runtime??"(autodetect)"} pm=${F.workload?.packageManager??"(autodetect)"}`);let v=qiu(24).toString("hex"),[N,O]=await Promise.all([X(),X()]);console.log(`[user-desktop] spawn handle=${F.handle} port=${N} devPort=${O} workdir=${B}`);let z=await Promise.resolve($.spawnDaemon({workdir:B,handle:F.handle,port:N,daemonToken:v,offloadAllowedHosts:F.offloadAllowedHosts??[],offloadAllowSameHostDev:F.offloadAllowSameHostDev??!1}));try{try{await $.waitForHealth(N)}catch(j){throw mT4("the sandbox didn't come online in time",j)}console.log(`[user-desktop] healthy handle=${F.handle} port=${N} \u2014 posting config`);try{await $.postConfig(N,O,{repo:F.repo,workload:F.workload},v)}catch(j){throw mT4(giu(j)?"configuration timed out":"the sandbox rejected its configuration",j)}}catch(j){console.error(`[user-desktop] sandbox bring-up failed handle=${F.handle} port=${N} (killing daemon):`,j);try{z.kill("SIGKILL")}catch{}throw E({handle:F.handle,phase:"failed",error:Viu(j)}),j}let H=`http://127.0.0.1:${N}`,_=w(F.handle,N);console.log(`[user-desktop] ready handle=${F.handle} port=${N} sandboxApiUrl=${H} previewUrl=${_}`);let T={handle:F.handle,port:N,process:z,sandboxApiUrl:H,previewUrl:_,lastUsedAt:Date.now(),activeDispatchCount:0,daemonToken:v};if(f.set(F.handle,T),E({handle:F.handle,phase:"ready",port:N,previewUrl:_}),z.exited)z.exited.then(()=>{if(f.get(F.handle)===T)console.warn(`[user-desktop] daemon process exited unexpectedly handle=${F.handle} port=${N} \u2014 removing from cache`),f.delete(F.handle),E({handle:F.handle,phase:"evicted"});else console.log(`[user-desktop] daemon process exited handle=${F.handle} port=${N} (already replaced/removed)`)});return{sandboxApiUrl:H,previewUrl:_,port:N}};return{async ensureSandbox(F){let B=f.get(F.handle);if(B){if(await Q(B.sandboxApiUrl))return console.log(`[user-desktop] cache hit handle=${F.handle} port=${B.port} (alive)`),B.lastUsedAt=Date.now(),{sandboxApiUrl:B.sandboxApiUrl,previewUrl:B.previewUrl,port:B.port};console.warn(`[user-desktop] cache stale handle=${F.handle} port=${B.port} \u2014 respawning`),Y(B)}let v=Z.get(F.handle);if(v)return console.log(`[user-desktop] joining in-flight ensure handle=${F.handle}`),v;let N=G(F).finally(()=>{Z.delete(F.handle)});return Z.set(F.handle,N),N},proxyPort(F){let B=f.get(F);if(B)B.lastUsedAt=Date.now();return B?.port??null},getDaemonToken(F){return f.get(F)?.daemonToken??null},hasHandle(F){return f.has(F)||Z.has(F)},recordHit(F){let B=f.get(F);if(B)B.lastUsedAt=Date.now()},acquireDispatch(F){let B=f.get(F);if(!B)return()=>{};B.activeDispatchCount+=1;let v=!1;return()=>{if(v)return;v=!0;let N=f.get(F);if(N)N.activeDispatchCount=Math.max(0,N.activeDispatchCount-1)}},listSandboxes(){return[...f.values()]},async deleteSandbox(F){let B=f.get(F);if(!B){console.log(`[user-desktop] delete handle=${F} (not found, no-op)`);return}console.log(`[user-desktop] delete handle=${F} port=${B.port}`);try{B.process.kill("SIGTERM")}catch{}f.delete(F),E({handle:F,phase:"deleted"})},async shutdown(){console.log(`[user-desktop] shutdown \u2014 killing ${f.size} sandbox(es)`);for(let F of f.values())try{F.process.kill("SIGTERM")}catch{}f.clear()}}}function biu(){return new Promise(($,u)=>{let f=hiu();f.unref(),f.on("error",u),f.listen(0,"127.0.0.1",()=>{let X=f.address();if(X&&typeof X==="object"){let J=X.port;f.close(()=>$(J))}else f.close(()=>u(Error("could not allocate port")))})})}var tT4=()=>{};import{randomUUID as iiu}from"crypto";import{hostname as xiu}from"os";async function rT4($){let u=$.session,f=await cT4($.dataDir),X=process.env.npm_package_version??"0.0.0",J=xiu()||void 0;$.monitor?.onMachine?.(J??"this machine");let w=Kj4($.dataDir,{outFd:$.logFd}),E=0,Q=nT4({dataDir:$.dataDir,resolvePreviewUrl:(O,z)=>E>0?`http://${O}.localhost:${E}`:`http://127.0.0.1:${z}`,spawnDaemon:(O)=>{let z={DAEMON_BOOT_ID:iiu(),APP_ROOT:O.workdir,PROXY_PORT:String(O.port),DAEMON_TOKEN:O.daemonToken,OFFLOAD_ALLOWED_HOSTS:O.offloadAllowedHosts.join(","),...O.offloadAllowSameHostDev?{OFFLOAD_ALLOW_SAME_HOST_DEV:"1"}:{}};return w({workdir:O.workdir,env:z,daemonPort:O.port}).then((H)=>({port:O.port,kill:(_)=>H.kill(_),exited:H.exited.then(()=>{return})}))},postConfig:async(O,z,H,_)=>{let T={port:z};if(H.workload)T.runtime=H.workload.runtime,T.packageManager={name:H.workload.packageManager,...H.workload.packageManagerPath?{path:H.workload.packageManagerPath}:{}};let j={application:T};if(H.repo)j.git={repository:{cloneUrl:H.repo.cloneUrl,branch:H.repo.branch},...H.repo.userName&&H.repo.userEmail?{identity:{userName:H.repo.userName,userEmail:H.repo.userEmail}}:{}};await _m(`http://127.0.0.1:${O}`,_,j)},waitForHealth:async(O)=>{await jB0(`http://127.0.0.1:${O}`)},maxSandboxes:20,onEvent:$.monitor?.onEvent}),Y=await xT4({port:$.port,lookupSandboxPort:(O)=>Q.proxyPort(O)});E=Y.port,console.log(`Local ingress listening on http://127.0.0.1:${Y.port} (use http://<handle>.localhost:${Y.port}/)`),$.monitor?.onIngress?.(Y.port);let Z=jj4({provider:Q}),W=(()=>{let O=new URL("/api/links/connect",$.clusterBaseUrl);return O.protocol=O.protocol==="https:"?"wss:":"ws:",O.toString()})(),G=await ST4({url:W,accessToken:u.accessToken,hello:{previewPort:Y.port,machineId:f,hostname:J,cliVersion:X,capabilities:await _j4()},controlHandler:Z,onConnected:()=>{$.monitor?.onCluster?.("linked"),console.log(`Linked to ${$.clusterBaseUrl}`)}}),F,B=new Promise((O)=>{F=O}),v=!1,N=async()=>{if(v)return;v=!0,console.log(`
-Shutting down\u2026`);try{await G.close()}catch{}try{await Y.stop()}catch{}try{await Q.shutdown()}catch{}F(0)};return process.on("SIGINT",()=>void N()),process.on("SIGTERM",()=>void N()),G.closed.then(()=>{if($.monitor?.onCluster?.("closed"),!v)console.error("Cluster connection closed permanently; exiting."),N()}),{stopped:B,stop:N}}var aT4=U(()=>{l91();Hj4();Pj4();Lj4();kT4();lT4();dT4();tT4()});function fY1($){return $.map((u)=>typeof u==="string"?u:String(u)).join(" ")}var gN0;var XY1=U(()=>{gN0={name:"decocms",version:"2.393.1",description:"Deco CMS \u2014 Self-hostable MCP Gateway for managing AI connections and tools",author:"Deco team",repository:{type:"git",url:"git+https://github.com/decocms/studio.git",directory:"apps/mesh"},bugs:{url:"https://github.com/decocms/studio/issues"},type:"module",bin:{deco:"./dist/server/cli.js"},files:["dist/**/*"],scripts:{dev:'bun run migrate && concurrently "bun run dev:client" "bun run dev:server"',"dev:servers":'concurrently "bun run dev:client" "bun run dev:server"',"dev:client":"bun --bun vite dev","dev:server":"bun run --cwd=../../packages/sandbox build && NODE_ENV=development bun --env-file=.env --hot run src/index.ts","build:client":"bun --bun vite build","build:server":"bun run scripts/bundle-server-script.ts --dist ./dist/server","db:migrate":"bun run ./dist/server/migrate.js",check:"tsc --noEmit",start:"bun run ./dist/server/server.js",migrate:"bun run src/database/migrate.ts",test:"bun test","test:e2e":"playwright test","test:e2e:ui":"playwright test --ui","better-auth:migrate":"bunx --bun @better-auth/cli migrate -y --config src/auth/index.ts","smoke:link":"bun run scripts/smoke-link.ts",prepublishOnly:"bun run build:client && bun run build:server"},optionalDependencies:{"@anthropic-ai/claude-agent-sdk":"^0.2.141","@duckdb/node-api":"^1.5.0-r.1"},dependencies:{"@ai-sdk/anthropic":"^3.0.80","@ai-sdk/google":"^3.0.80","@ai-sdk/openai":"^3.0.65","@anthropic-ai/sdk":"^0.96.0","@aws-sdk/client-s3":"^3.1013.0","@aws-sdk/lib-storage":"^3.1013.0","@aws-sdk/s3-request-presigner":"^3.1013.0","@clickhouse/client":"^1.8.1","@dbos-inc/dbos-sdk":"^4.17.6","@dnd-kit/core":"^6.3.1","@dnd-kit/sortable":"^10.0.0","@dnd-kit/utilities":"^3.2.2","@inkjs/ui":"^2.0.0","@modelcontextprotocol/ext-apps":"^1.7.1","@openrouter/ai-sdk-provider":"^2.9.0","@opentelemetry/core":"^2.6.0","@tanstack/react-virtual":"3.13.24","@xterm/addon-fit":"^0.11.0","@xterm/xterm":"^6.0.0","ai-sdk-provider-claude-code":"^3.4.4","ai-sdk-provider-codex-cli":"^1.1.0","embedded-postgres":"^18.3.0-beta.16",ink:"^6.8.0",kysely:"^0.28.12",nats:"^2.29.3","node-pty":"^1.0.0","posthog-js":"^1.371.1","posthog-node":"^5.0.0",react:"^19.2.6","react-dom":"^19.2.6"},devDependencies:{"@ai-sdk/provider":"^3.0.10","@ai-sdk/react":"^3.0.193","@better-auth/sso":"1.4.1","@daveyplate/better-auth-ui":"^3.2.7","@deco/ui":"workspace:*","@decocms/better-auth":"1.5.17","@decocms/bindings":"workspace:*","@decocms/mcp-utils":"workspace:*","@decocms/mesh-sdk":"workspace:*","@decocms/runtime":"workspace:*","@decocms/std":"workspace:*","@decocms/vite-plugin":"workspace:*","@floating-ui/react":"^0.27.16","@happy-dom/global-registrator":"^20.9.0","@hookform/resolvers":"^5.2.2","@jitl/quickjs-wasmfile-release-sync":"0.31.0","@modelcontextprotocol/sdk":"1.29.0","@monaco-editor/react":"^4.7.0","@opentelemetry/api":"^1.9.0","@opentelemetry/api-logs":"^0.211.0","@opentelemetry/exporter-logs-otlp-proto":"^0.211.0","@opentelemetry/exporter-prometheus":"^0.208.0","@opentelemetry/exporter-trace-otlp-proto":"^0.207.0","@opentelemetry/instrumentation-runtime-node":"^0.24.0","@opentelemetry/resources":"^2.6.0","@opentelemetry/sdk-logs":"^0.211.0","@opentelemetry/sdk-metrics":"^2.2.0","@opentelemetry/sdk-node":"^0.207.0","@opentelemetry/sdk-trace-base":"^2.5.0","@playwright/test":"^1.58.2","@radix-ui/react-avatar":"^1.1.10","@radix-ui/react-checkbox":"^1.3.3","@radix-ui/react-dialog":"^1.1.15","@radix-ui/react-dropdown-menu":"^2.1.16","@radix-ui/react-label":"^2.1.7","@radix-ui/react-select":"^2.2.6","@radix-ui/react-separator":"^1.1.7","@radix-ui/react-slot":"^1.2.3","@radix-ui/react-tabs":"^1.1.13","@rjsf/core":"^6.1.2","@rjsf/shadcn":"^6.1.2","@rjsf/utils":"^6.1.2","@rjsf/validator-ajv8":"^6.1.2","@tailwindcss/vite":"^4.1.17","@tanstack/react-query":"5.100.10","@tanstack/react-router":"1.169.2","@testing-library/jest-dom":"^6.9.1","@testing-library/react":"^16.3.2","@tiptap/core":"3.20.2","@tiptap/extension-mention":"3.20.2","@tiptap/extension-placeholder":"3.20.2","@tiptap/pm":"3.20.2","@tiptap/react":"3.20.2","@tiptap/starter-kit":"3.20.2","@tiptap/suggestion":"3.20.2","@types/bun":"^1.3.1","@types/pg":"^8.15.6","@types/react-syntax-highlighter":"^15.5.13","@untitledui/icons":"^0.0.19","@vercel/nft":"^1.1.1","@vitejs/plugin-react":"^5.1.0",ai:"^6.0.191","babel-plugin-react-compiler":"^1.0.0","better-auth":"1.4.22","class-variance-authority":"^0.7.1",clsx:"^2.1.1",concurrently:"^9.2.1",croner:"^9.1.0","date-fns":"^4.1.0",degit:"^2.8.4",hono:"^4.10.7","input-otp":"^1.4.2",jose:"^6.0.11","lucide-react":"^0.468.0",marked:"^15.0.6","@decocms/sandbox":"workspace:*","mesh-plugin-workflows":"workspace:*",nanoid:"^5.1.6",pg:"^8.16.3",prettier:"^3.4.2","react-hook-form":"^7.66.0","react-markdown":"^10.1.0","react-resizable-panels":"^2.1.7","react-syntax-highlighter":"^15.6.1",recharts:"^3.6.0","rehype-raw":"^7.0.0","remark-gfm":"^4.0.0","sass-embedded":"^1.97.2",sonner:"^2.0.7","tailwind-merge":"^3.3.1",tailwindcss:"^4.1.17",typescript:"^5.9.3",vite:"^7.2.1","vite-tsconfig-paths":"^5.1.4",zod:"^4.0.0",zustand:"^5.0.9"},homepage:"https://github.com/decocms/studio",keywords:["mcp","model-context-protocol","ai","gateway","self-hosted","mesh","tools"],license:"MIT",publishConfig:{access:"public"}}});var Pu0={};Y1(Pu0,{printBanner:()=>diu,bannerLines:()=>pT4,BANNER_LINES:()=>VN0,BANNER_GRADIENT:()=>bN0});function ciu($){let u=Number.parseInt($.slice(1),16);return[u>>16&255,u>>8&255,u&255]}function pT4($){let u=VN0.map((f,X)=>{let[J,w,E]=ciu(bN0[X]);return`\x1B[38;2;${J};${w};${E}m${f}\x1B[39m`});if($!==void 0)u.push(`\x1B[2m  v${$}\x1B[22m`);return u}function diu($){console.log("");for(let u of pT4($))console.log(u);console.log("")}var VN0,bN0;var $n=U(()=>{VN0=[" \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588     \u2588\u2588\u2588\u2588\u2588\u2588\u2588   ","\u2591\u2591\u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2588\u2588\u2588 \u2591\u2591\u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2591\u2588  \u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2591\u2588\u2588\u2588  \u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2591\u2588\u2588\u2588 "," \u2591\u2588\u2588\u2588   \u2591\u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588  \u2588 \u2591  \u2588\u2588\u2588     \u2591\u2591\u2591  \u2588\u2588\u2588     \u2591\u2591\u2588\u2588\u2588"," \u2591\u2588\u2588\u2588    \u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588\u2588\u2588\u2588   \u2591\u2588\u2588\u2588         \u2591\u2588\u2588\u2588      \u2591\u2588\u2588\u2588"," \u2591\u2588\u2588\u2588    \u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588\u2591\u2591\u2588   \u2591\u2588\u2588\u2588         \u2591\u2588\u2588\u2588      \u2591\u2588\u2588\u2588"," \u2591\u2588\u2588\u2588    \u2588\u2588\u2588  \u2591\u2588\u2588\u2588 \u2591   \u2588\u2591\u2591\u2588\u2588\u2588     \u2588\u2588\u2588\u2591\u2591\u2588\u2588\u2588     \u2588\u2588\u2588 "," \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588 \u2591\u2591\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588  \u2591\u2591\u2591\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2591  ","\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591   \u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591   \u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591     \u2591\u2591\u2591\u2591\u2591\u2591\u2591   "],bN0=["#00ff64","#00ee5e","#00dc56","#00c84e","#00b444","#00a03c","#008832","#006e28"]});import{Box as miu,Text as oT4}from"ink";import{jsx as niu,jsxs as sT4}from"react/jsx-runtime";function iN0({version:$}){return sT4(miu,{flexDirection:"column",marginTop:1,children:[VN0.map((u,f)=>niu(oT4,{color:bN0[f],children:u},f)),sT4(oT4,{dimColor:!0,children:[" v",$]})]})}var JY1=U(()=>{$n()});var $A4={};Y1($A4,{subscribeLinkState:()=>QY1,setMachine:()=>piu,setLogPath:()=>siu,setIngress:()=>aiu,setDaemonError:()=>oiu,setClusterUrl:()=>riu,setCluster:()=>tiu,pushSandboxEvent:()=>eiu,getLinkState:()=>EY1,applySandboxEvent:()=>eT4});function eT4($,u){let f=new Map($);if(u.phase==="evicted"||u.phase==="deleted")return f.delete(u.handle),f;let X=f.get(u.handle);return f.set(u.handle,{handle:u.handle,port:u.port??X?.port??null,previewUrl:u.previewUrl??X?.previewUrl??null,status:u.phase,error:u.phase==="failed"?u.error??"failed":null}),f}function hj(){for(let $ of wY1)$()}function EY1(){return C9}function QY1($){return wY1.add($),()=>wY1.delete($)}function tiu($){C9={...C9,cluster:$},hj()}function riu($){C9={...C9,clusterUrl:$},hj()}function aiu($,u){C9={...C9,ingressPort:$,ingressUrl:u},hj()}function piu($){C9={...C9,machine:$},hj()}function oiu($){C9={...C9,daemonError:$},hj()}function siu($){C9={...C9,logPath:$},hj()}function eiu($){C9={...C9,sandboxes:eT4(C9.sandboxes,$)},hj()}var C9,wY1;var YY1=U(()=>{C9={cluster:"connecting",clusterUrl:null,ingressUrl:null,ingressPort:null,machine:null,cap:20,sandboxes:new Map,daemonError:null,logPath:null},wY1=new Set});var uA4={};Y1(uA4,{LinkApp:()=>fxu});import{Box as q9,Text as M9}from"ink";import{useSyncExternalStore as $xu}from"react";import{jsx as mf,jsxs as tW}from"react/jsx-runtime";function uxu($){if($.status==="ready")return{color:"green",text:"\u25CF Live"};if($.status==="spawning")return{color:"yellow",text:"\u25CC Starting\u2026"};return{color:"red",text:`\u2717 Error: ${$.error??""}`}}function fxu(){let $=$xu(QY1,EY1),u=[...$.sandboxes.values()].sort((f,X)=>f.handle.localeCompare(X.handle));return tW(q9,{flexDirection:"column",children:[mf(iN0,{version:gN0.version}),mf(q9,{marginBottom:1,children:mf(M9,{dimColor:!0,children:"\u2500".repeat(80)})}),mf(q9,{children:$.cluster==="linked"?tW(M9,{color:"green",children:["\u2713 Connected to ",$.clusterUrl??"deco"]}):$.cluster==="connecting"?tW(M9,{color:"yellow",children:["\u25CC Connecting to ",$.clusterUrl??"deco","\u2026"]}):tW(M9,{color:"red",children:["\u2717 Disconnected from ",$.clusterUrl??"deco"]})}),mf(q9,{children:$.ingressUrl?tW(M9,{color:"green",children:["\u2713 Serving at ",$.ingressUrl]}):mf(M9,{dimColor:!0,children:"\u25CC Starting local server\u2026"})}),mf(q9,{marginBottom:1,children:mf(M9,{dimColor:!0,children:`${"Computer".padEnd(16)}${$.machine??"this computer"} \xB7 ${u.length} of ${$.cap} previews`})}),u.length===0?mf(M9,{dimColor:!0,children:"No previews running yet."}):tW(q9,{flexDirection:"column",children:[tW(q9,{children:[mf(q9,{width:xN0.project,flexShrink:0,marginRight:1,children:mf(M9,{dimColor:!0,wrap:"truncate-end",children:"PROJECT"})}),mf(q9,{width:xN0.status,flexShrink:0,marginRight:1,children:mf(M9,{dimColor:!0,wrap:"truncate-end",children:"STATUS"})}),mf(q9,{flexGrow:1,children:mf(M9,{dimColor:!0,wrap:"truncate-end",children:"PREVIEW URL"})})]}),u.map((f)=>{let X=uxu(f);return tW(q9,{children:[mf(q9,{width:xN0.project,flexShrink:0,marginRight:1,children:mf(M9,{wrap:"truncate-end",children:f.handle})}),mf(q9,{width:xN0.status,flexShrink:0,marginRight:1,children:mf(M9,{color:X.color,wrap:"truncate-end",children:X.text})}),mf(q9,{flexGrow:1,children:mf(M9,{dimColor:!0,wrap:"truncate-end",children:f.previewUrl??"\u2014"})})]},f.handle)})]}),$.daemonError?mf(q9,{marginTop:1,children:tW(M9,{color:"red",children:["\u26A0 ",$.daemonError]})}):null,$.logPath?mf(q9,{marginTop:1,children:tW(M9,{dimColor:!0,children:["Logs: ",$.logPath]})}):null]})}var xN0;var fA4=U(()=>{XY1();JY1();YY1();xN0={project:18,status:14}});var JA4={};Y1(JA4,{runLinkCommand:()=>Zxu});import{closeSync as Xxu,mkdirSync as Jxu,openSync as wxu,writeSync as Exu}from"fs";import{homedir as Qxu}from"os";import{join as XA4}from"path";function Yxu($,u){let f={log:console.log,warn:console.warn,error:console.error},X=(J)=>{if(u===void 0)return;try{Exu(u,`${fY1(J)}
+Shutting down\u2026`);try{await G.close()}catch{}try{await Y.stop()}catch{}try{await Q.shutdown()}catch{}F(0)};return process.on("SIGINT",()=>void N()),process.on("SIGTERM",()=>void N()),G.closed.then(()=>{if($.monitor?.onCluster?.("closed"),!v)console.error("Cluster connection closed permanently; exiting."),N()}),{stopped:B,stop:N}}var aT4=U(()=>{l91();Hj4();Pj4();Lj4();kT4();lT4();dT4();tT4()});function fY1($){return $.map((u)=>typeof u==="string"?u:String(u)).join(" ")}var gN0;var XY1=U(()=>{gN0={name:"decocms",version:"2.393.2",description:"Deco CMS \u2014 Self-hostable MCP Gateway for managing AI connections and tools",author:"Deco team",repository:{type:"git",url:"git+https://github.com/decocms/studio.git",directory:"apps/mesh"},bugs:{url:"https://github.com/decocms/studio/issues"},type:"module",bin:{deco:"./dist/server/cli.js"},files:["dist/**/*"],scripts:{dev:'bun run migrate && concurrently "bun run dev:client" "bun run dev:server"',"dev:servers":'concurrently "bun run dev:client" "bun run dev:server"',"dev:client":"bun --bun vite dev","dev:server":"bun run --cwd=../../packages/sandbox build && NODE_ENV=development bun --env-file=.env --hot run src/index.ts","build:client":"bun --bun vite build","build:server":"bun run scripts/bundle-server-script.ts --dist ./dist/server","db:migrate":"bun run ./dist/server/migrate.js",check:"tsc --noEmit",start:"bun run ./dist/server/server.js",migrate:"bun run src/database/migrate.ts",test:"bun test","test:e2e":"playwright test","test:e2e:ui":"playwright test --ui","better-auth:migrate":"bunx --bun @better-auth/cli migrate -y --config src/auth/index.ts","smoke:link":"bun run scripts/smoke-link.ts",prepublishOnly:"bun run build:client && bun run build:server"},optionalDependencies:{"@anthropic-ai/claude-agent-sdk":"^0.2.141","@duckdb/node-api":"^1.5.0-r.1"},dependencies:{"@ai-sdk/anthropic":"^3.0.80","@ai-sdk/google":"^3.0.80","@ai-sdk/openai":"^3.0.65","@anthropic-ai/sdk":"^0.96.0","@aws-sdk/client-s3":"^3.1013.0","@aws-sdk/lib-storage":"^3.1013.0","@aws-sdk/s3-request-presigner":"^3.1013.0","@clickhouse/client":"^1.8.1","@dbos-inc/dbos-sdk":"^4.17.6","@dnd-kit/core":"^6.3.1","@dnd-kit/sortable":"^10.0.0","@dnd-kit/utilities":"^3.2.2","@inkjs/ui":"^2.0.0","@modelcontextprotocol/ext-apps":"^1.7.1","@openrouter/ai-sdk-provider":"^2.9.0","@opentelemetry/core":"^2.6.0","@tanstack/react-virtual":"3.13.24","@xterm/addon-fit":"^0.11.0","@xterm/xterm":"^6.0.0","ai-sdk-provider-claude-code":"^3.4.4","ai-sdk-provider-codex-cli":"^1.1.0","embedded-postgres":"^18.3.0-beta.16",ink:"^6.8.0",kysely:"^0.28.12",nats:"^2.29.3","node-pty":"^1.0.0","posthog-js":"^1.371.1","posthog-node":"^5.0.0",react:"^19.2.6","react-dom":"^19.2.6"},devDependencies:{"@ai-sdk/provider":"^3.0.10","@ai-sdk/react":"^3.0.193","@better-auth/sso":"1.4.1","@daveyplate/better-auth-ui":"^3.2.7","@deco/ui":"workspace:*","@decocms/better-auth":"1.5.17","@decocms/bindings":"workspace:*","@decocms/mcp-utils":"workspace:*","@decocms/mesh-sdk":"workspace:*","@decocms/runtime":"workspace:*","@decocms/std":"workspace:*","@decocms/vite-plugin":"workspace:*","@floating-ui/react":"^0.27.16","@happy-dom/global-registrator":"^20.9.0","@hookform/resolvers":"^5.2.2","@jitl/quickjs-wasmfile-release-sync":"0.31.0","@modelcontextprotocol/sdk":"1.29.0","@monaco-editor/react":"^4.7.0","@opentelemetry/api":"^1.9.0","@opentelemetry/api-logs":"^0.211.0","@opentelemetry/exporter-logs-otlp-proto":"^0.211.0","@opentelemetry/exporter-prometheus":"^0.208.0","@opentelemetry/exporter-trace-otlp-proto":"^0.207.0","@opentelemetry/instrumentation-runtime-node":"^0.24.0","@opentelemetry/resources":"^2.6.0","@opentelemetry/sdk-logs":"^0.211.0","@opentelemetry/sdk-metrics":"^2.2.0","@opentelemetry/sdk-node":"^0.207.0","@opentelemetry/sdk-trace-base":"^2.5.0","@playwright/test":"^1.58.2","@radix-ui/react-avatar":"^1.1.10","@radix-ui/react-checkbox":"^1.3.3","@radix-ui/react-dialog":"^1.1.15","@radix-ui/react-dropdown-menu":"^2.1.16","@radix-ui/react-label":"^2.1.7","@radix-ui/react-select":"^2.2.6","@radix-ui/react-separator":"^1.1.7","@radix-ui/react-slot":"^1.2.3","@radix-ui/react-tabs":"^1.1.13","@rjsf/core":"^6.1.2","@rjsf/shadcn":"^6.1.2","@rjsf/utils":"^6.1.2","@rjsf/validator-ajv8":"^6.1.2","@tailwindcss/vite":"^4.1.17","@tanstack/react-query":"5.100.10","@tanstack/react-router":"1.169.2","@testing-library/jest-dom":"^6.9.1","@testing-library/react":"^16.3.2","@tiptap/core":"3.20.2","@tiptap/extension-mention":"3.20.2","@tiptap/extension-placeholder":"3.20.2","@tiptap/pm":"3.20.2","@tiptap/react":"3.20.2","@tiptap/starter-kit":"3.20.2","@tiptap/suggestion":"3.20.2","@types/bun":"^1.3.1","@types/pg":"^8.15.6","@types/react-syntax-highlighter":"^15.5.13","@untitledui/icons":"^0.0.19","@vercel/nft":"^1.1.1","@vitejs/plugin-react":"^5.1.0",ai:"^6.0.191","babel-plugin-react-compiler":"^1.0.0","better-auth":"1.4.22","class-variance-authority":"^0.7.1",clsx:"^2.1.1",concurrently:"^9.2.1",croner:"^9.1.0","date-fns":"^4.1.0",degit:"^2.8.4",hono:"^4.10.7","input-otp":"^1.4.2",jose:"^6.0.11","lucide-react":"^0.468.0",marked:"^15.0.6","@decocms/sandbox":"workspace:*","mesh-plugin-workflows":"workspace:*",nanoid:"^5.1.6",pg:"^8.16.3",prettier:"^3.4.2","react-hook-form":"^7.66.0","react-markdown":"^10.1.0","react-resizable-panels":"^2.1.7","react-syntax-highlighter":"^15.6.1",recharts:"^3.6.0","rehype-raw":"^7.0.0","remark-gfm":"^4.0.0","sass-embedded":"^1.97.2",sonner:"^2.0.7","tailwind-merge":"^3.3.1",tailwindcss:"^4.1.17",typescript:"^5.9.3",vite:"^7.2.1","vite-tsconfig-paths":"^5.1.4",zod:"^4.0.0",zustand:"^5.0.9"},homepage:"https://github.com/decocms/studio",keywords:["mcp","model-context-protocol","ai","gateway","self-hosted","mesh","tools"],license:"MIT",publishConfig:{access:"public"}}});var Pu0={};Y1(Pu0,{printBanner:()=>diu,bannerLines:()=>pT4,BANNER_LINES:()=>VN0,BANNER_GRADIENT:()=>bN0});function ciu($){let u=Number.parseInt($.slice(1),16);return[u>>16&255,u>>8&255,u&255]}function pT4($){let u=VN0.map((f,X)=>{let[J,w,E]=ciu(bN0[X]);return`\x1B[38;2;${J};${w};${E}m${f}\x1B[39m`});if($!==void 0)u.push(`\x1B[2m  v${$}\x1B[22m`);return u}function diu($){console.log("");for(let u of pT4($))console.log(u);console.log("")}var VN0,bN0;var $n=U(()=>{VN0=[" \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588     \u2588\u2588\u2588\u2588\u2588\u2588\u2588   ","\u2591\u2591\u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2588\u2588\u2588 \u2591\u2591\u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2591\u2588  \u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2591\u2588\u2588\u2588  \u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2591\u2588\u2588\u2588 "," \u2591\u2588\u2588\u2588   \u2591\u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588  \u2588 \u2591  \u2588\u2588\u2588     \u2591\u2591\u2591  \u2588\u2588\u2588     \u2591\u2591\u2588\u2588\u2588"," \u2591\u2588\u2588\u2588    \u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588\u2588\u2588\u2588   \u2591\u2588\u2588\u2588         \u2591\u2588\u2588\u2588      \u2591\u2588\u2588\u2588"," \u2591\u2588\u2588\u2588    \u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588\u2591\u2591\u2588   \u2591\u2588\u2588\u2588         \u2591\u2588\u2588\u2588      \u2591\u2588\u2588\u2588"," \u2591\u2588\u2588\u2588    \u2588\u2588\u2588  \u2591\u2588\u2588\u2588 \u2591   \u2588\u2591\u2591\u2588\u2588\u2588     \u2588\u2588\u2588\u2591\u2591\u2588\u2588\u2588     \u2588\u2588\u2588 "," \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588 \u2591\u2591\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588  \u2591\u2591\u2591\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2591  ","\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591   \u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591   \u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591     \u2591\u2591\u2591\u2591\u2591\u2591\u2591   "],bN0=["#00ff64","#00ee5e","#00dc56","#00c84e","#00b444","#00a03c","#008832","#006e28"]});import{Box as miu,Text as oT4}from"ink";import{jsx as niu,jsxs as sT4}from"react/jsx-runtime";function iN0({version:$}){return sT4(miu,{flexDirection:"column",marginTop:1,children:[VN0.map((u,f)=>niu(oT4,{color:bN0[f],children:u},f)),sT4(oT4,{dimColor:!0,children:[" v",$]})]})}var JY1=U(()=>{$n()});var $A4={};Y1($A4,{subscribeLinkState:()=>QY1,setMachine:()=>piu,setLogPath:()=>siu,setIngress:()=>aiu,setDaemonError:()=>oiu,setClusterUrl:()=>riu,setCluster:()=>tiu,pushSandboxEvent:()=>eiu,getLinkState:()=>EY1,applySandboxEvent:()=>eT4});function eT4($,u){let f=new Map($);if(u.phase==="evicted"||u.phase==="deleted")return f.delete(u.handle),f;let X=f.get(u.handle);return f.set(u.handle,{handle:u.handle,port:u.port??X?.port??null,previewUrl:u.previewUrl??X?.previewUrl??null,status:u.phase,error:u.phase==="failed"?u.error??"failed":null}),f}function hj(){for(let $ of wY1)$()}function EY1(){return C9}function QY1($){return wY1.add($),()=>wY1.delete($)}function tiu($){C9={...C9,cluster:$},hj()}function riu($){C9={...C9,clusterUrl:$},hj()}function aiu($,u){C9={...C9,ingressPort:$,ingressUrl:u},hj()}function piu($){C9={...C9,machine:$},hj()}function oiu($){C9={...C9,daemonError:$},hj()}function siu($){C9={...C9,logPath:$},hj()}function eiu($){C9={...C9,sandboxes:eT4(C9.sandboxes,$)},hj()}var C9,wY1;var YY1=U(()=>{C9={cluster:"connecting",clusterUrl:null,ingressUrl:null,ingressPort:null,machine:null,cap:20,sandboxes:new Map,daemonError:null,logPath:null},wY1=new Set});var uA4={};Y1(uA4,{LinkApp:()=>fxu});import{Box as q9,Text as M9}from"ink";import{useSyncExternalStore as $xu}from"react";import{jsx as mf,jsxs as tW}from"react/jsx-runtime";function uxu($){if($.status==="ready")return{color:"green",text:"\u25CF Live"};if($.status==="spawning")return{color:"yellow",text:"\u25CC Starting\u2026"};return{color:"red",text:`\u2717 Error: ${$.error??""}`}}function fxu(){let $=$xu(QY1,EY1),u=[...$.sandboxes.values()].sort((f,X)=>f.handle.localeCompare(X.handle));return tW(q9,{flexDirection:"column",children:[mf(iN0,{version:gN0.version}),mf(q9,{marginBottom:1,children:mf(M9,{dimColor:!0,children:"\u2500".repeat(80)})}),mf(q9,{children:$.cluster==="linked"?tW(M9,{color:"green",children:["\u2713 Connected to ",$.clusterUrl??"deco"]}):$.cluster==="connecting"?tW(M9,{color:"yellow",children:["\u25CC Connecting to ",$.clusterUrl??"deco","\u2026"]}):tW(M9,{color:"red",children:["\u2717 Disconnected from ",$.clusterUrl??"deco"]})}),mf(q9,{children:$.ingressUrl?tW(M9,{color:"green",children:["\u2713 Serving at ",$.ingressUrl]}):mf(M9,{dimColor:!0,children:"\u25CC Starting local server\u2026"})}),mf(q9,{marginBottom:1,children:mf(M9,{dimColor:!0,children:`${"Computer".padEnd(16)}${$.machine??"this computer"} \xB7 ${u.length} of ${$.cap} previews`})}),u.length===0?mf(M9,{dimColor:!0,children:"No previews running yet."}):tW(q9,{flexDirection:"column",children:[tW(q9,{children:[mf(q9,{width:xN0.project,flexShrink:0,marginRight:1,children:mf(M9,{dimColor:!0,wrap:"truncate-end",children:"PROJECT"})}),mf(q9,{width:xN0.status,flexShrink:0,marginRight:1,children:mf(M9,{dimColor:!0,wrap:"truncate-end",children:"STATUS"})}),mf(q9,{flexGrow:1,children:mf(M9,{dimColor:!0,wrap:"truncate-end",children:"PREVIEW URL"})})]}),u.map((f)=>{let X=uxu(f);return tW(q9,{children:[mf(q9,{width:xN0.project,flexShrink:0,marginRight:1,children:mf(M9,{wrap:"truncate-end",children:f.handle})}),mf(q9,{width:xN0.status,flexShrink:0,marginRight:1,children:mf(M9,{color:X.color,wrap:"truncate-end",children:X.text})}),mf(q9,{flexGrow:1,children:mf(M9,{dimColor:!0,wrap:"truncate-end",children:f.previewUrl??"\u2014"})})]},f.handle)})]}),$.daemonError?mf(q9,{marginTop:1,children:tW(M9,{color:"red",children:["\u26A0 ",$.daemonError]})}):null,$.logPath?mf(q9,{marginTop:1,children:tW(M9,{dimColor:!0,children:["Logs: ",$.logPath]})}):null]})}var xN0;var fA4=U(()=>{XY1();JY1();YY1();xN0={project:18,status:14}});var JA4={};Y1(JA4,{runLinkCommand:()=>Zxu});import{closeSync as Xxu,mkdirSync as Jxu,openSync as wxu,writeSync as Exu}from"fs";import{homedir as Qxu}from"os";import{join as XA4}from"path";function Yxu($,u){let f={log:console.log,warn:console.warn,error:console.error},X=(J)=>{if(u===void 0)return;try{Exu(u,`${fY1(J)}
 `)}catch{}};return console.log=(...J)=>X(J),console.warn=(...J)=>X(J),console.error=(...J)=>{X(J),$(fY1(J))},()=>{console.log=f.log,console.warn=f.warn,console.error=f.error}}async function Dxu($,u){let f;try{f=await fetch(`${$}/api/links/me`,{headers:{authorization:`Bearer ${u}`},signal:AbortSignal.timeout(1e4)})}catch{return}if(f.status===401||f.status===403)throw Error(`Authentication rejected by ${$} \u2014 the session token was not accepted. `+`Run \`deco auth login --target ${$}\` and try again.`)}async function Zxu($={}){let u=$.port??5174,f=$.dataDir??process.env.DATA_DIR??process.env.DECOCMS_HOME??XA4(Qxu(),"deco"),X=$.clusterBaseUrl??process.env.MESH_CLUSTER_URL??"https://studio.decocms.com",J,w;try{let E=await Dj4({dataDir:f,intent:"Link",target:X});if(process.env.DECOCMS_LINK_MANAGED!=="1")await Dxu(X,E.accessToken);let Q;if($.tui){let{render:Z}=await import("ink"),{createElement:W}=await import("react"),{LinkApp:G}=await Promise.resolve().then(() => (fA4(),uA4)),{pushSandboxEvent:F,setCluster:B,setClusterUrl:v,setDaemonError:N,setIngress:O,setLogPath:z,setMachine:H}=await Promise.resolve().then(() => (YY1(),$A4));Jxu(f,{recursive:!0});let _=XA4(f,"link.log");w=wxu(_,"a"),z(_),v(X),B("connecting"),Q={onEvent:(T)=>F(T),onIngress:(T)=>O(T,`http://127.0.0.1:${T}`),onCluster:(T)=>B(T),onMachine:(T)=>H(T)},J=Yxu(N,w),Z(W(G),{patchConsole:!1})}else if($.banner!==!1){let{printBanner:Z}=await Promise.resolve().then(() => ($n(),Pu0));Z($.version??"0.0.0")}return await(await rT4({port:u,clusterBaseUrl:X,dataDir:f,session:E,monitor:Q,logFd:w})).stopped}catch(E){return J?.(),console.error(E instanceof Error?E.message:String(E)),1}finally{if(J?.(),w!==void 0)try{Xxu(w)}catch{}}}var wA4=U(()=>{Zj4();aT4()});var ju0,Wxu,Gxu,Fxu,QA4=($,u)=>{let f={};for(var X in $)ju0(f,X,{get:$[X],enumerable:!0});if(u)ju0(f,Symbol.toStringTag,{value:"Module"});return f},EA4=($,u,f,X)=>{if(u&&typeof u==="object"||typeof u==="function"){for(var J=Gxu(u),w=0,E=J.length,Q;w<E;w++)if(Q=J[w],!Fxu.call($,Q)&&Q!==f)ju0($,Q,{get:((Y)=>u[Y]).bind(null,Q),enumerable:!(X=Wxu(u,Q))||X.enumerable})}return $},YA4=($,u,f,X)=>{if(X)ju0($,Symbol.toStringTag,{value:"Module"}),f&&ju0(f,Symbol.toStringTag,{value:"Module"});EA4($,u,"default"),f&&EA4(f,u,"default")};var DA4=U(()=>{ju0=Object.defineProperty,Wxu=Object.getOwnPropertyDescriptor,Gxu=Object.getOwnPropertyNames,Fxu=Object.prototype.hasOwnProperty});var ZE=($)=>{let u=($.plugins??[]).reduce((W,G)=>{let F=G.schema;if(!F)return W;for(let[B,v]of Object.entries(F))W[B]={fields:{...W[B]?.fields,...v.fields},modelName:v.modelName||B};return W},{}),f=$.rateLimit?.storage==="database",X={rateLimit:{modelName:$.rateLimit?.modelName||"rateLimit",fields:{key:{type:"string",unique:!0,required:!0,fieldName:$.rateLimit?.fields?.key||"key"},count:{type:"number",required:!0,fieldName:$.rateLimit?.fields?.count||"count"},lastRequest:{type:"number",bigint:!0,required:!0,fieldName:$.rateLimit?.fields?.lastRequest||"lastRequest",defaultValue:()=>Date.now()}}}},{user:J,session:w,account:E,verification:Q,...Y}=u,Z={session:{modelName:$.session?.modelName||"session",fields:{expiresAt:{type:"date",required:!0,fieldName:$.session?.fields?.expiresAt||"expiresAt"},token:{type:"string",required:!0,fieldName:$.session?.fields?.token||"token",unique:!0},createdAt:{type:"date",required:!0,fieldName:$.session?.fields?.createdAt||"createdAt",defaultValue:()=>new Date},updatedAt:{type:"date",required:!0,fieldName:$.session?.fields?.updatedAt||"updatedAt",onUpdate:()=>new Date},ipAddress:{type:"string",required:!1,fieldName:$.session?.fields?.ipAddress||"ipAddress"},userAgent:{type:"string",required:!1,fieldName:$.session?.fields?.userAgent||"userAgent"},userId:{type:"string",fieldName:$.session?.fields?.userId||"userId",references:{model:$.user?.modelName||"user",field:"id",onDelete:"cascade"},required:!0,index:!0},...w?.fields,...$.session?.additionalFields},order:2}};return{user:{modelName:$.user?.modelName||"user",fields:{name:{type:"string",required:!0,fieldName:$.user?.fields?.name||"name",sortable:!0},email:{type:"string",unique:!0,required:!0,fieldName:$.user?.fields?.email||"email",sortable:!0},emailVerified:{type:"boolean",defaultValue:!1,required:!0,fieldName:$.user?.fields?.emailVerified||"emailVerified",input:!1},image:{type:"string",required:!1,fieldName:$.user?.fields?.image||"image"},createdAt:{type:"date",defaultValue:()=>new Date,required:!0,fieldName:$.user?.fields?.createdAt||"createdAt"},updatedAt:{type:"date",defaultValue:()=>new Date,onUpdate:()=>new Date,required:!0,fieldName:$.user?.fields?.updatedAt||"updatedAt"},...J?.fields,...$.user?.additionalFields},order:1},...!$.secondaryStorage||$.session?.storeSessionInDatabase?Z:{},account:{modelName:$.account?.modelName||"account",fields:{accountId:{type:"string",required:!0,fieldName:$.account?.fields?.accountId||"accountId"},providerId:{type:"string",required:!0,fieldName:$.account?.fields?.providerId||"providerId"},userId:{type:"string",references:{model:$.user?.modelName||"user",field:"id",onDelete:"cascade"},required:!0,fieldName:$.account?.fields?.userId||"userId",index:!0},accessToken:{type:"string",required:!1,returned:!1,fieldName:$.account?.fields?.accessToken||"accessToken"},refreshToken:{type:"string",required:!1,returned:!1,fieldName:$.account?.fields?.refreshToken||"refreshToken"},idToken:{type:"string",required:!1,returned:!1,fieldName:$.account?.fields?.idToken||"idToken"},accessTokenExpiresAt:{type:"date",required:!1,returned:!1,fieldName:$.account?.fields?.accessTokenExpiresAt||"accessTokenExpiresAt"},refreshTokenExpiresAt:{type:"date",required:!1,returned:!1,fieldName:$.account?.fields?.refreshTokenExpiresAt||"refreshTokenExpiresAt"},scope:{type:"string",required:!1,fieldName:$.account?.fields?.scope||"scope"},password:{type:"string",required:!1,returned:!1,fieldName:$.account?.fields?.password||"password"},createdAt:{type:"date",required:!0,fieldName:$.account?.fields?.createdAt||"createdAt",defaultValue:()=>new Date},updatedAt:{type:"date",required:!0,fieldName:$.account?.fields?.updatedAt||"updatedAt",onUpdate:()=>new Date},...E?.fields,...$.account?.additionalFields},order:3},verification:{modelName:$.verification?.modelName||"verification",fields:{identifier:{type:"string",required:!0,fieldName:$.verification?.fields?.identifier||"identifier",index:!0},value:{type:"string",required:!0,fieldName:$.verification?.fields?.value||"value"},expiresAt:{type:"date",required:!0,fieldName:$.verification?.fields?.expiresAt||"expiresAt"},createdAt:{type:"date",required:!0,defaultValue:()=>new Date,fieldName:$.verification?.fields?.createdAt||"createdAt"},updatedAt:{type:"date",required:!0,defaultValue:()=>new Date,onUpdate:()=>new Date,fieldName:$.verification?.fields?.updatedAt||"updatedAt"},...Q?.fields,...$.verification?.additionalFields},order:4},...Y,...f?X:{}}};var DY1=()=>{};var rW;var un=U(()=>{c0();rW=f0({id:C(),createdAt:q$().default(()=>new Date),updatedAt:q$().default(()=>new Date)})});var ZA4;var WA4=U(()=>{un();c0();ZA4=rW.extend({providerId:C(),accountId:C(),userId:V4.string(),accessToken:C().nullish(),refreshToken:C().nullish(),idToken:C().nullish(),accessTokenExpiresAt:q$().nullish(),refreshTokenExpiresAt:q$().nullish(),scope:C().nullish(),password:C().nullish()})});var GA4;var FA4=U(()=>{c0();GA4=f0({key:C(),count:i1(),lastRequest:i1()})});var BA4;var vA4=U(()=>{un();c0();BA4=rW.extend({userId:V4.string(),expiresAt:q$(),token:C(),ipAddress:C().nullish(),userAgent:C().nullish()})});var UA4;var NA4=U(()=>{un();c0();UA4=rW.extend({email:C().transform(($)=>$.toLowerCase()),emailVerified:R1().default(!1),name:C(),image:C().nullish()})});var OA4;var zA4=U(()=>{un();c0();OA4=rW.extend({value:C(),expiresAt:q$(),identifier:C()})});var ZY1={};Y1(ZY1,{verificationSchema:()=>OA4,userSchema:()=>UA4,sessionSchema:()=>BA4,rateLimitSchema:()=>GA4,getAuthTables:()=>ZE,coreSchema:()=>rW,accountSchema:()=>ZA4});var aO=U(()=>{DY1();un();WA4();FA4();vA4();NA4();zA4()});function Bxu($){return $?$!=="false":!1}function _3($,u){if(typeof process<"u"&&process.env)return process.env[$]??u;if(typeof Deno<"u")return Deno.env.get($)??u;if(typeof Bun<"u")return Bun.env[$]??u;return u}function cN0($,u=!0){let f=_3($);if(!f)return u;return f!=="0"&&f.toLowerCase()!=="false"&&f!==""}var lN0,Lu0=($)=>globalThis.process?.env||globalThis.Deno?.env.toObject()||globalThis.__env__||($?lN0:globalThis),j6,Tu0,xB,yj=()=>Tu0==="dev"||Tu0==="development",lB=()=>Tu0==="test"||Bxu(j6.TEST),WY1;var GY1=U(()=>{lN0=Object.create(null),j6=new Proxy(lN0,{get($,u){return Lu0()[u]??lN0[u]},has($,u){return u in Lu0()||u in lN0},set($,u,f){let X=Lu0(!0);return X[u]=f,!0},deleteProperty($,u){if(!u)return!1;let f=Lu0(!0);return delete f[u],!0},ownKeys(){let $=Lu0(!0);return Object.keys($)}});Tu0=typeof process<"u"&&process.env&&"production"||"",xB=Tu0==="production";WY1=Object.freeze({get BETTER_AUTH_SECRET(){return _3("BETTER_AUTH_SECRET")},get AUTH_SECRET(){return _3("AUTH_SECRET")},get BETTER_AUTH_TELEMETRY(){return _3("BETTER_AUTH_TELEMETRY")},get BETTER_AUTH_TELEMETRY_ID(){return _3("BETTER_AUTH_TELEMETRY_ID")},get NODE_ENV(){return _3("NODE_ENV","development")},get PACKAGE_VERSION(){return _3("PACKAGE_VERSION","0.0.0")},get BETTER_AUTH_TELEMETRY_ENDPOINT(){return _3("BETTER_AUTH_TELEMETRY_ENDPOINT","")}})});function Iu0(){if(_3("FORCE_COLOR")!==void 0)switch(_3("FORCE_COLOR")){case"":case"1":case"true":return aX;case"2":return aW;case"3":return kQ;default:return Au0}if(_3("NODE_DISABLE_COLORS")!==void 0&&_3("NODE_DISABLE_COLORS")!==""||_3("NO_COLOR")!==void 0&&_3("NO_COLOR")!==""||_3("TERM")==="dumb")return Au0;if(_3("TMUX"))return kQ;if("TF_BUILD"in j6&&"AGENT_NAME"in j6)return aX;if("CI"in j6){for(let{0:$,1:u}of vxu)if($ in j6)return u;if(_3("CI_NAME")==="codeship")return aW;return Au0}if("TEAMCITY_VERSION"in j6)return/^(9\.(0*[1-9]\d*)\.|\d{2,}\.)/.exec(_3("TEAMCITY_VERSION"))!==null?aX:Au0;switch(_3("TERM_PROGRAM")){case"iTerm.app":if(!_3("TERM_PROGRAM_VERSION")||/^[0-2]\./.exec(_3("TERM_PROGRAM_VERSION"))!==null)return aW;return kQ;case"HyperTerm":case"MacTerm":return kQ;case"Apple_Terminal":return aW}if(_3("COLORTERM")==="truecolor"||_3("COLORTERM")==="24bit")return kQ;if(_3("TERM")){if(/truecolor/.exec(_3("TERM"))!==null)return kQ;if(/^xterm-256/.exec(_3("TERM"))!==null)return aW;let $=_3("TERM").toLowerCase();if(KA4[$])return KA4[$];if(Uxu.some((u)=>u.exec($)!==null))return aX}if(_3("COLORTERM"))return aX;return Au0}var Au0=1,aX=4,aW=8,kQ=24,KA4,vxu,Uxu;var dN0=U(()=>{GY1();KA4={eterm:aX,cons25:aX,console:aX,cygwin:aX,dtterm:aX,gnome:aX,hurd:aX,jfbterm:aX,konsole:aX,kterm:aX,mlterm:aX,mosh:kQ,putty:aX,st:aX,"rxvt-unicode-24bit":kQ,terminator:kQ,"xterm-kitty":kQ},vxu=new Map(Object.entries({APPVEYOR:aW,BUILDKITE:aW,CIRCLECI:kQ,DRONE:aW,GITEA_ACTIONS:kQ,GITHUB_ACTIONS:kQ,GITLAB_CI:aW,TRAVIS:aW})),Uxu=[/ansi/,/color/,/linux/,/direct/,/^con[0-9]*x[0-9]/,/^rxvt/,/^screen/,/^xterm/,/^vt100/,/^vt220/]});function Xn($,u){return mN0.indexOf(u)>=mN0.indexOf($)}var H8,mN0,Nxu,Oxu=($,u,f)=>{let X=new Date().toISOString();if(f)return`${H8.dim}${X}${H8.reset} ${Nxu[$]}${$.toUpperCase()}${H8.reset} ${H8.bright}[Better Auth]:${H8.reset} ${u}`;return`${X} ${$.toUpperCase()} [Better Auth]: ${u}`},cB=($)=>{let u=$?.disabled!==!0,f=$?.level??"warn",X=$?.disableColors!==void 0?!$.disableColors:Iu0()!==1,J=(w,E,Q=[])=>{if(!u||!Xn(f,w))return;let Y=Oxu(w,E,X);if(!$||typeof $.log!=="function"){if(w==="error")console.error(Y,...Q);else if(w==="warn")console.warn(Y,...Q);else console.log(Y,...Q);return}$.log(w==="success"?"info":w,E,...Q)};return{...Object.fromEntries(mN0.map((w)=>[w,(...[E,...Q])=>J(w,E,Q)])),get level(){return f}}},F$;var h9=U(()=>{dN0();H8={reset:"\x1B[0m",bright:"\x1B[1m",dim:"\x1B[2m",undim:"\x1B[22m",underscore:"\x1B[4m",blink:"\x1B[5m",reverse:"\x1B[7m",hidden:"\x1B[8m",fg:{black:"\x1B[30m",red:"\x1B[31m",green:"\x1B[32m",yellow:"\x1B[33m",blue:"\x1B[34m",magenta:"\x1B[35m",cyan:"\x1B[36m",white:"\x1B[37m"},bg:{black:"\x1B[40m",red:"\x1B[41m",green:"\x1B[42m",yellow:"\x1B[43m",blue:"\x1B[44m",magenta:"\x1B[45m",cyan:"\x1B[46m",white:"\x1B[47m"}},mN0=["debug","info","success","warn","error"];Nxu={info:H8.fg.blue,success:H8.fg.green,warn:H8.fg.yellow,error:H8.fg.red,debug:H8.fg.magenta},F$=cB()});var P3=U(()=>{GY1();dN0();h9()});function x3($){return $}var FY1=()=>{};function nN0($,u){if(!$||!u)return $;let f=Object.entries(u).filter(([,{returned:X}])=>X===!1).map(([X])=>X);return Object.entries(structuredClone($)).filter(([X])=>!f.includes(X)).reduce((X,[J,w])=>({...X,[J]:w}),{})}var HA4=()=>{};function gj($,u,f){let X=!1;return function(...J){if(!X)(f?.warn??console.warn)(`[Deprecation] ${u}`),X=!0;return $.apply(this,J)}}var _A4=()=>{};function PA4($){switch($){case"a-z":return"abcdefghijklmnopqrstuvwxyz";case"A-Z":return"ABCDEFGHIJKLMNOPQRSTUVWXYZ";case"0-9":return"0123456789";case"-_":return"-_";default:throw Error(`Unsupported alphabet: ${$}`)}}function pW(...$){let u=$.map(PA4).join("");if(u.length===0)throw Error("No valid characters provided for random string generation.");let f=u.length;return(X,...J)=>{if(X<=0)throw Error("Length must be a positive integer.");let w=u,E=f;if(J.length>0)w=J.map(PA4).join(""),E=w.length;let Q=Math.floor(256/E)*E,Y=new Uint8Array(X*2),Z=Y.length,W="",G=Z,F;while(W.length<X){if(G>=Z)crypto.getRandomValues(Y),G=0;if(F=Y[G++],F<Q)W+=w[F%E]}return W}}var Jn=()=>{};var X8=($)=>{return pW("a-z","A-Z","0-9")($||32)};var BY1=U(()=>{Jn()});function vY1($){return nW().safeParse($).success||nO().safeParse($).success}function zxu($){return nO().safeParse($).success}function Kxu($){let u=$.toLowerCase();if(u.startsWith("::ffff:")){let X=u.substring(7);if(nW().safeParse(X).success)return X}let f=$.split(":");if(f.length===7&&f[5]?.toLowerCase()==="ffff"){let X=f[6];if(X&&nW().safeParse(X).success)return X}if(u.includes("::ffff:")||u.includes(":ffff:")){let X=jA4($);if(X.length===8&&X[0]==="0000"&&X[1]==="0000"&&X[2]==="0000"&&X[3]==="0000"&&X[4]==="0000"&&X[5]==="ffff"&&X[6]&&X[7])return`${Number.parseInt(X[6].substring(0,2),16)}.${Number.parseInt(X[6].substring(2,4),16)}.${Number.parseInt(X[7].substring(0,2),16)}.${Number.parseInt(X[7].substring(2,4),16)}`}return null}function jA4($){if($.includes("::")){let u=$.split("::"),f=u[0]?u[0].split(":"):[],X=u[1]?u[1].split(":"):[],J=8-f.length-X.length,w=Array(J).fill("0000"),E=f.map((Y)=>Y.padStart(4,"0")),Q=X.map((Y)=>Y.padStart(4,"0"));return[...E,...w,...Q]}return $.split(":").map((u)=>u.padStart(4,"0"))}function Hxu($,u){let f=jA4($);if(u&&u<128){let X=u;return f.map((J)=>{if(X<=0)return"0000";if(X>=16)return X-=16,J;let w=Number.parseInt(J,16)&(65535<<16-X&65535);return X=0,w.toString(16).padStart(4,"0")}).join(":").toLowerCase()}return f.join(":").toLowerCase()}function UY1($,u={}){if(nW().safeParse($).success)return $.toLowerCase();if(!zxu($))return $.toLowerCase();let f=Kxu($);if(f)return f.toLowerCase();return Hxu($,u.ipv6Subnet||64)}function NY1($,u){return`${$}|${u}`}var LA4=U(()=>{c0()});function Vu($){function u(f,X){if(typeof X==="string"){if(/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?Z$/.test(X)){let J=new Date(X);if(!isNaN(J.getTime()))return J}}return X}try{if(typeof $!=="string")return $;return JSON.parse($,u)}catch(f){return F$.error("Error parsing JSON",{error:f}),null}}var OY1=U(()=>{h9();P3()});var TA4=()=>{};function Vj($,u){let f;try{f=new URL($).pathname.replace(/\/+$/,"")||"/"}catch{return"/"}if(u==="/"||u==="")return f;if(f===u)return"/";if(f.startsWith(u+"/"))return f.slice(u.length).replace(/\/+$/,"")||"/";return f}var AA4=()=>{};var f6=U(()=>{HA4();_A4();FY1();BY1();LA4();OY1();TA4();AA4()});var Y4;var IA4=U(()=>{FY1();f6();Y4=x3({USER_NOT_FOUND:"User not found",FAILED_TO_CREATE_USER:"Failed to create user",FAILED_TO_CREATE_SESSION:"Failed to create session",FAILED_TO_UPDATE_USER:"Failed to update user",FAILED_TO_GET_SESSION:"Failed to get session",INVALID_PASSWORD:"Invalid password",INVALID_EMAIL:"Invalid email",INVALID_EMAIL_OR_PASSWORD:"Invalid email or password",SOCIAL_ACCOUNT_ALREADY_LINKED:"Social account already linked",PROVIDER_NOT_FOUND:"Provider not found",INVALID_TOKEN:"Invalid token",ID_TOKEN_NOT_SUPPORTED:"id_token not supported",FAILED_TO_GET_USER_INFO:"Failed to get user info",USER_EMAIL_NOT_FOUND:"User email not found",EMAIL_NOT_VERIFIED:"Email not verified",PASSWORD_TOO_SHORT:"Password too short",PASSWORD_TOO_LONG:"Password too long",USER_ALREADY_EXISTS:"User already exists.",USER_ALREADY_EXISTS_USE_ANOTHER_EMAIL:"User already exists. Use another email.",EMAIL_CAN_NOT_BE_UPDATED:"Email can not be updated",CREDENTIAL_ACCOUNT_NOT_FOUND:"Credential account not found",SESSION_EXPIRED:"Session expired. Re-authenticate to perform this action.",FAILED_TO_UNLINK_LAST_ACCOUNT:"You can't unlink your last account",ACCOUNT_NOT_FOUND:"Account not found",USER_ALREADY_HAS_PASSWORD:"User already has a password. Provide that to delete the account.",CROSS_SITE_NAVIGATION_LOGIN_BLOCKED:"Cross-site navigation login blocked. This request appears to be a CSRF attack.",VERIFICATION_EMAIL_NOT_ENABLED:"Verification email isn't enabled",EMAIL_ALREADY_VERIFIED:"Email is already verified",EMAIL_MISMATCH:"Email mismatch",SESSION_NOT_FRESH:"Session is not fresh",LINKED_ACCOUNT_ALREADY_EXISTS:"Linked account already exists",INVALID_ORIGIN:"Invalid origin",INVALID_CALLBACK_URL:"Invalid callbackURL",INVALID_REDIRECT_URL:"Invalid redirectURL",INVALID_ERROR_CALLBACK_URL:"Invalid errorCallbackURL",INVALID_NEW_USER_CALLBACK_URL:"Invalid newUserCallbackURL",MISSING_OR_NULL_ORIGIN:"Missing or null Origin",CALLBACK_URL_REQUIRED:"callbackURL is required",FAILED_TO_CREATE_VERIFICATION:"Unable to create verification",FIELD_NOT_ALLOWED:"Field not allowed to be set",ASYNC_VALIDATION_NOT_SUPPORTED:"Async validation is not supported",VALIDATION_ERROR:"Validation Error",MISSING_FIELD:"Field is required"})});var h4;var vu=U(()=>{IA4();h4=class extends Error{constructor($,u){super($,u);this.name="BetterAuthError",this.message=$,this.stack=""}}});var RQ=({usePlural:$,schema:u})=>{return(X)=>{if($&&X.charAt(X.length-1)==="s"){let w=X.slice(0,-1),E=u[w]?w:void 0;if(!E)E=Object.entries(u).find(([Q,Y])=>Y.modelName===w)?.[0];if(E)return E}let J=u[X]?X:void 0;if(!J)J=Object.entries(u).find(([w,E])=>E.modelName===X)?.[0];if(!J)throw new h4(`Model "${X}" not found in schema`);return J}};var pO=U(()=>{vu()});var bj=({schema:$,usePlural:u})=>{let f=RQ({schema:$,usePlural:u});return({field:J,model:w})=>{if(J==="id"||J==="_id")return"id";let E=f(w),Q=$[E]?.fields[J];if(!Q){let Y=Object.entries($[E].fields).find(([Z,W])=>W.fieldName===J);if(Y)Q=Y[1],J=Y[0]}if(!Q)throw new h4(`Field ${J} not found in model ${E}`);return J}};var Su0=U(()=>{vu();pO()});var ku0=({usePlural:$,schema:u,disableIdGeneration:f,options:X,customIdGenerator:J,supportsUUIDs:w})=>{let E=RQ({usePlural:$,schema:u});return({customModelName:Y,forceAllowId:Z})=>{let W=X.advanced?.database?.useNumberId||X.advanced?.database?.generateId==="serial",G=X.advanced?.database?.generateId==="uuid",F=(()=>{if(f)return!1;else if(W&&!Z)return!1;else if(G)return!w;else return!0})(),B=E(Y??"id");return{type:W?"number":"string",required:F?!0:!1,...F?{defaultValue(){if(f)return;let v=X.advanced?.database?.generateId;if(v===!1||W)return;if(typeof v==="function")return v({model:B});if(J)return J({model:B});if(v==="uuid")return crypto.randomUUID();return X8()}}:{},transform:{input:(v)=>{if(!v)return;if(W){let N=Number(v);if(isNaN(N))return;return N}if(G){if(F&&!Z)return v;if(f)return;if(w)return;if(Z&&typeof v==="string")if(/^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(v))return v;else{let N=Error().stack?.split(`
 `).filter((O,z)=>z!==1).join(`
 `).replace("Error:","");F$.warn("[Adapter Factory] - Invalid UUID value for field `id` provided when `forceAllowId` is true. Generating a new UUID.",N)}if(typeof v!=="string"&&!w)return crypto.randomUUID();return}return v},output:(v)=>{if(!v)return;return String(v)}}}}};var tN0=U(()=>{h9();P3();BY1();f6();pO()});var zY1=({usePlural:$,schema:u,options:f,customIdGenerator:X,disableIdGeneration:J})=>{let w=RQ({usePlural:$,schema:u}),E=bj({usePlural:$,schema:u}),Q=ku0({usePlural:$,schema:u,options:f,customIdGenerator:X,disableIdGeneration:J});return({model:Z,field:W})=>{let G=w(Z),F=E({field:W,model:G}),B=u[G].fields;B.id=Q({customModelName:G});let v=B[F];if(!v)throw new h4(`Field ${W} not found in model ${Z}`);return v}};var KY1=U(()=>{vu();pO();Su0();tN0()});var Ru0=({schema:$,usePlural:u})=>{let f=RQ({schema:$,usePlural:u}),X=bj({schema:$,usePlural:u});function J({model:w,field:E}){let Q=f(w),Y=X({model:Q,field:E});return $[Q]?.fields[Y]?.fieldName||Y}return J};var HY1=U(()=>{pO();Su0()});var Cu0=({usePlural:$,schema:u})=>{let f=RQ({schema:u,usePlural:$});return(J)=>{let w=f(J);if(u&&u[w]&&u[w].modelName!==J)return $?`${u[w].modelName}s`:u[w].modelName;return $?`${J}s`:J}};var _Y1=U(()=>{pO()});function PY1($,u,f){if(f==="update"){if($===void 0&&u.onUpdate!==void 0){if(typeof u.onUpdate==="function")return u.onUpdate();return u.onUpdate}return $}if(f==="create"){if($===void 0||u.required===!0&&$===null){if(u.defaultValue!==void 0){if(typeof u.defaultValue==="function")return u.defaultValue();return u.defaultValue}}}return $}var jY1=()=>{};function Hf($){if(Iu0()<8)return`#${$}`;return`${H8.fg.magenta}#${$}${H8.reset}`}function _f($,u){return`${H8.bg.black}${H8.fg.yellow}[${$}/${u}]${H8.reset}`}function Pf($){return`${H8.bright}${$}${H8.reset}`}function WX($){return`${H8.dim}(${$})${H8.reset}`}var rN0,y9=-1,_xu=($)=>(u)=>u($),wn=({adapter:$,config:u})=>(f)=>{let X=Math.random().toString(36).substring(2,15),J={...u,supportsBooleans:u.supportsBooleans??!0,supportsDates:u.supportsDates??!0,supportsJSON:u.supportsJSON??!1,adapterName:u.adapterName??u.adapterId,supportsNumericIds:u.supportsNumericIds??!0,supportsUUIDs:u.supportsUUIDs??!1,supportsArrays:u.supportsArrays??!1,transaction:u.transaction??!1,disableTransformInput:u.disableTransformInput??!1,disableTransformOutput:u.disableTransformOutput??!1,disableTransformJoin:u.disableTransformJoin??!1};if((f.advanced?.database?.useNumberId===!0||f.advanced?.database?.generateId==="serial")&&J.supportsNumericIds===!1)throw new h4(`[${J.adapterName}] Your database or database adapter does not support numeric ids. Please disable "useNumberId" in your config.`);let w=ZE(f),E=(...I)=>{if(J.debugLogs===!0||typeof J.debugLogs==="object"){let k=cB({level:"info"});if(typeof J.debugLogs==="object"&&"isRunningAdapterTests"in J.debugLogs){if(J.debugLogs.isRunningAdapterTests)I.shift(),rN0.push({instance:X,args:I});return}if(typeof J.debugLogs==="object"&&J.debugLogs.logCondition&&!J.debugLogs.logCondition?.())return;if(typeof I[0]==="object"&&"method"in I[0]){let S=I.shift().method;if(typeof J.debugLogs==="object"){if(S==="create"&&!J.debugLogs.create)return;else if(S==="update"&&!J.debugLogs.update)return;else if(S==="updateMany"&&!J.debugLogs.updateMany)return;else if(S==="findOne"&&!J.debugLogs.findOne)return;else if(S==="findMany"&&!J.debugLogs.findMany)return;else if(S==="delete"&&!J.debugLogs.delete)return;else if(S==="deleteMany"&&!J.debugLogs.deleteMany)return;else if(S==="count"&&!J.debugLogs.count)return}k.info(`[${J.adapterName}]`,...I)}else k.info(`[${J.adapterName}]`,...I)}},Q=cB(f.logger),Y=RQ({usePlural:J.usePlural,schema:w}),Z=bj({usePlural:J.usePlural,schema:w}),W=Cu0({usePlural:J.usePlural,schema:w}),G=Ru0({schema:w,usePlural:J.usePlural}),F=ku0({schema:w,options:f,usePlural:J.usePlural,disableIdGeneration:J.disableIdGeneration,customIdGenerator:J.customIdGenerator,supportsUUIDs:J.supportsUUIDs}),B=zY1({schema:w,options:f,usePlural:J.usePlural,disableIdGeneration:J.disableIdGeneration,customIdGenerator:J.customIdGenerator}),v=async(I,k,S,q)=>{let y={},h=w[k].fields,i=J.mapKeysTransformInput??{},l=f.advanced?.database?.useNumberId||f.advanced?.database?.generateId==="serial";h.id=F({customModelName:k,forceAllowId:q&&"id"in I});for(let M in h){let x=I[M],r=h[M],o=i[M]||h[M].fieldName||M;if(x===void 0&&(r.defaultValue===void 0&&!r.transform?.input&&!(S==="update"&&r.onUpdate)||S==="update"&&!r.onUpdate))continue;if(r&&r.type==="date"&&!(x instanceof Date)&&typeof x==="string")try{x=new Date(x)}catch{Q.error("[Adapter Factory] Failed to convert string to date",{value:x,field:M})}let w0=PY1(x,r,S);if(r.transform?.input)w0=await r.transform.input(w0);if(r.references?.field==="id"&&l)if(Array.isArray(w0))w0=w0.map(($0)=>$0!==null?Number($0):null);else w0=w0!==null?Number(w0):null;else if(J.supportsJSON===!1&&typeof w0==="object"&&r.type==="json")w0=JSON.stringify(w0);else if(J.supportsArrays===!1&&Array.isArray(w0)&&(r.type==="string[]"||r.type==="number[]"))w0=JSON.stringify(w0);else if(J.supportsDates===!1&&w0 instanceof Date&&r.type==="date")w0=w0.toISOString();else if(J.supportsBooleans===!1&&typeof w0==="boolean")w0=w0?1:0;if(J.customTransformInput)w0=J.customTransformInput({data:w0,action:S,field:o,fieldAttributes:r,model:W(k),schema:w,options:f});if(w0!==void 0)y[o]=w0}return y},N=async(I,k,S=[],q)=>{let y=async(l,M,x=[])=>{if(!l)return null;let r=J.mapKeysTransformOutput??{},o={},w0=w[Y(M)].fields,$0=Object.entries(r).find(([E0,X0])=>X0==="id")?.[0];w0[$0??"id"]={type:f.advanced?.database?.useNumberId||f.advanced?.database?.generateId==="serial"?"number":"string"};for(let E0 in w0){if(x.length&&!x.includes(E0))continue;let X0=w0[E0];if(X0){let O0=X0.fieldName||E0,K0=l[Object.entries(r).find(([S0,W0])=>W0===O0)?.[0]||O0];if(X0.transform?.output)K0=await X0.transform.output(K0);let L0=r[E0]||E0;if(O0==="id"||X0.references?.field==="id"){if(typeof K0<"u"&&K0!==null)K0=String(K0)}else if(J.supportsJSON===!1&&typeof K0==="string"&&X0.type==="json")K0=Vu(K0);else if(J.supportsArrays===!1&&typeof K0==="string"&&(X0.type==="string[]"||X0.type==="number[]"))K0=Vu(K0);else if(J.supportsDates===!1&&typeof K0==="string"&&X0.type==="date")K0=new Date(K0);else if(J.supportsBooleans===!1&&typeof K0==="number"&&X0.type==="boolean")K0=K0===1;if(J.customTransformOutput)K0=J.customTransformOutput({data:K0,field:L0,fieldAttributes:X0,select:x,model:W(M),schema:w,options:f});o[L0]=K0}}return o};if(!q||Object.keys(q).length===0)return await y(I,k,S);k=Y(k);let h=await y(I,k,S),i=Object.entries(q).map(([l,M])=>({modelName:W(l),defaultModelName:Y(l),joinConfig:M}));if(!I)return null;for(let{modelName:l,defaultModelName:M,joinConfig:x}of i){let r=await(async()=>{if(f.experimental?.joins)return I[l];else return await H({baseModel:k,baseData:h,joinModel:l,specificJoinConfig:x})})();if(r===void 0||r===null)r=x.relation==="one-to-one"?null:[];if(x.relation==="one-to-many"&&!Array.isArray(r))r=[r];let o=[];if(Array.isArray(r))for(let w0 of r){let $0=await y(w0,l,[]);o.push($0)}else{let w0=await y(r,l,[]);o.push(w0)}h[M]=(x.relation==="one-to-one"?o[0]:o)??null}return h},O=({model:I,where:k,action:S})=>{if(!k)return;let q=J.mapKeysTransformInput??{};return k.map((y)=>{let{field:h,value:i,operator:l="eq",connector:M="AND"}=y;if(l==="in"){if(!Array.isArray(i))throw new h4("Value must be an array")}let x=i,r=Y(I),o=Z({field:h,model:I}),w0=q[o]||G({field:o,model:r}),$0=B({field:o,model:r}),E0=f.advanced?.database?.useNumberId||f.advanced?.database?.generateId==="serial";if(o==="id"||$0.references?.field==="id"){if(E0)if(Array.isArray(i))x=i.map(Number);else x=Number(i)}if($0.type==="date"&&i instanceof Date&&!J.supportsDates)x=i.toISOString();if($0.type==="boolean"&&typeof i==="boolean"&&!J.supportsBooleans)x=i?1:0;if($0.type==="json"&&typeof i==="object"&&!J.supportsJSON)try{x=JSON.stringify(i)}catch(X0){throw Error(`Failed to stringify JSON value for field ${w0}`,{cause:X0})}if(J.customTransformInput)x=J.customTransformInput({data:x,fieldAttributes:$0,field:w0,model:W(I),schema:w,options:f,action:S});return{operator:l,connector:M,field:w0,value:x}})},z=(I,k,S)=>{if(!k)return;if(Object.keys(k).length===0)return;let q={};for(let[y,h]of Object.entries(k)){if(!h)continue;let i=Y(y),l=Y(I),M=Object.entries(w[i].fields).filter(([K0,L0])=>L0.references&&Y(L0.references.model)===l),x=!0;if(!M.length)M=Object.entries(w[l].fields).filter(([K0,L0])=>L0.references&&Y(L0.references.model)===i),x=!1;if(!M.length)throw new h4(`No foreign key found for model ${y} and base model ${I} while performing join operation.`);else if(M.length>1)throw new h4(`Multiple foreign keys found for model ${y} and base model ${I} while performing join operation. Only one foreign key is supported.`);let[r,o]=M[0];if(!o.references)throw new h4(`No references found for foreign key ${r} on model ${y} while performing join operation.`);let w0,$0,E0;if(x)E0=o.references.field,w0=G({model:I,field:E0}),$0=G({model:y,field:r});else E0=r,w0=G({model:I,field:E0}),$0=G({model:y,field:o.references.field});if(S&&!S.includes(E0))S.push(E0);let X0=$0==="id"?!0:o.unique??!1,O0=f.advanced?.database?.defaultFindManyLimit??100;if(X0)O0=1;else if(typeof h==="object"&&typeof h.limit==="number")O0=h.limit;q[W(y)]={on:{from:w0,to:$0},limit:O0,relation:X0?"one-to-one":"one-to-many"}}return{join:q,select:S}},H=async({baseModel:I,baseData:k,joinModel:S,specificJoinConfig:q})=>{if(!k)return k;let y=W(S),h=q.on.to,i=k[Z({field:q.on.from,model:I})];if(i===null||i===void 0)return q.relation==="one-to-one"?null:[];let l,M=O({model:y,where:[{field:h,value:i,operator:"eq",connector:"AND"}],action:"findOne"});try{if(q.relation==="one-to-one")l=await _.findOne({model:y,where:M});else{let x=q.limit??f.advanced?.database?.defaultFindManyLimit??100;l=await _.findMany({model:y,where:M,limit:x})}}catch(x){throw Q.error(`Failed to query fallback join for model ${y}:`,{where:M,limit:q.limit}),console.error(x),x}return l},_=$({options:f,schema:w,debugLog:E,getFieldName:G,getModelName:W,getDefaultModelName:Y,getDefaultFieldName:Z,getFieldAttributes:B,transformInput:v,transformOutput:N,transformWhereClause:O}),T=null,j={transaction:async(I)=>{if(!T)if(!J.transaction)T=_xu(j);else Q.debug(`[${J.adapterName}] - Using provided transaction implementation.`),T=J.transaction;return T(I)},create:async({data:I,model:k,select:S,forceAllowId:q=!1})=>{y9++;let y=y9,h=W(k);if(k=Y(k),"id"in I&&typeof I.id<"u"&&!q){Q.warn(`[${J.adapterName}] - You are trying to create a record with an id. This is not allowed as we handle id generation for you, unless you pass in the \`forceAllowId\` parameter. The id will be ignored.`);let x=Error().stack?.split(`
@@ -79098,7 +79098,7 @@ Hint: Configure a valid Google account email in Monitor Configuration > Contexto
 `);let X=u.pax;if(X)for(let J in X)f+=HM1(" "+J+"="+X[J]+`
 `);return e6.from(f)};A83.decodePax=function(u){let f={};while(u.length){let X=0;while(X<u.length&&u[X]!==32)X++;let J=parseInt(e6.toString(u.subarray(0,X)),10);if(!J)return f;let w=e6.toString(u.subarray(X+1,J-1)),E=w.indexOf("=");if(E===-1)return f;f[w.slice(0,E)]=w.slice(E+1),u=u.subarray(J)}return f};A83.encode=function(u){let f=e6.alloc(512),X=u.name,J="";if(u.typeflag===5&&X[X.length-1]!=="/")X+="/";if(e6.byteLength(X)!==X.length)return null;while(e6.byteLength(X)>100){let w=X.indexOf("/");if(w===-1)return null;J+=J?"/"+X.slice(0,w):X.slice(0,w),X=X.slice(w+1)}if(e6.byteLength(X)>100||e6.byteLength(J)>155)return null;if(u.linkname&&e6.byteLength(u.linkname)>100)return null;if(e6.write(f,X),e6.write(f,f_(u.mode&4095,6),100),e6.write(f,f_(u.uid,6),108),e6.write(f,f_(u.gid,6),116),L83(u.size,f,124),e6.write(f,f_(u.mtime.getTime()/1000|0,11),136),f[156]=48+P83(u.type),u.linkname)e6.write(f,u.linkname,157);if(e6.copy(rS$,f,257),e6.copy(U83,f,263),u.uname)e6.write(f,u.uname,265);if(u.gname)e6.write(f,u.gname,297);if(e6.write(f,f_(u.devmajor||0,6),329),e6.write(f,f_(u.devminor||0,6),337),J)e6.write(f,J,345);return e6.write(f,f_(pS$(f),6),148),f};A83.decode=function(u,f,X){let J=u[156]===0?0:u[156]-48,w=fs(u,0,100,f),E=u_(u,100,8),Q=u_(u,108,8),Y=u_(u,116,8),Z=u_(u,124,12),W=u_(u,136,12),G=_83(J),F=u[157]===0?null:fs(u,157,100,f),B=fs(u,265,32),v=fs(u,297,32),N=u_(u,329,8),O=u_(u,337,8),z=pS$(u);if(z===256)return null;if(z!==u_(u,148,8))throw Error("Invalid tar header. Maybe the tar is corrupted or it needs to be gunzipped?");if(z83(u)){if(u[345])w=fs(u,345,155,f)+"/"+w}else if(K83(u));else if(!X)throw Error("Invalid tar header: unknown format.");if(J===0&&w&&w[w.length-1]==="/")J=5;return{name:w,mode:E,uid:Q,gid:Y,size:Z,mtime:new Date(1000*W),type:G,linkname:F,uname:B,gname:v,devmajor:N,devminor:O,pax:null}};function z83($){return e6.equals(rS$,$.subarray(257,263))}function K83($){return e6.equals(N83,$.subarray(257,263))&&e6.equals(O83,$.subarray(263,265))}function H83($,u,f){if(typeof $!=="number")return f;if($=~~$,$>=u)return u;if($>=0)return $;if($+=u,$>=0)return $;return 0}function _83($){switch($){case 0:return"file";case 1:return"link";case 2:return"symlink";case 3:return"character-device";case 4:return"block-device";case 5:return"directory";case 6:return"fifo";case 7:return"contiguous-file";case 72:return"pax-header";case 55:return"pax-global-header";case 27:return"gnu-long-link-path";case 28:case 30:return"gnu-long-path"}return null}function P83($){switch($){case"file":return 0;case"link":return 1;case"symlink":return 2;case"character-device":return 3;case"block-device":return 4;case"directory":return 5;case"fifo":return 6;case"contiguous-file":return 7;case"pax-header":return 72}return 0}function aS$($,u,f,X){for(;f<X;f++)if($[f]===u)return f;return X}function pS$($){let u=256;for(let f=0;f<148;f++)u+=$[f];for(let f=156;f<512;f++)u+=$[f];return u}function f_($,u){if($=$.toString(8),$.length>u)return"7777777777777777777".slice(0,u)+" ";return"0000000000000000000".slice(0,u-$.length)+$+" "}function j83($,u,f){u[f]=128;for(let X=11;X>0;X--)u[f+X]=$&255,$=Math.floor($/256)}function L83($,u,f){if($.toString(8).length>11)j83($,u,f);else e6.write(u,f_($,11),f)}function T83($){let u;if($[0]===128)u=!0;else if($[0]===255)u=!1;else return null;let f=[],X;for(X=$.length-1;X>0;X--){let E=$[X];if(u)f.push(E);else f.push(255-E)}let J=0,w=f.length;for(X=0;X<w;X++)J+=f[X]*Math.pow(256,X);return u?J:-1*J}function u_($,u,f){if($=$.subarray(u,u+f),u=0,$[u]&128)return T83($);else{while(u<$.length&&$[u]===32)u++;let X=H83(aS$($,32,u,$.length),$.length,$.length);while(u<X&&$[u]===0)u++;if(X===u)return 0;return parseInt(e6.toString($.subarray(u,X)),8)}}function fs($,u,f,X){return e6.toString($.subarray(u,aS$($,0,u,u+f)),X)}function HM1($){let u=e6.byteLength($),f=Math.floor(Math.log(u)/Math.log(10))+1;if(u+f>=Math.pow(10,f))f++;return u+f+$}});var Jk$=b((CGX,Xk$)=>{var{Writable:q83,Readable:M83,getStreamError:oS$}=KM1(),h83=BM1(),sS$=us(),Xs=_M1(),y83=sS$.alloc(0);class eS${constructor(){this.buffered=0,this.shifted=0,this.queue=new h83,this._offset=0}push($){this.buffered+=$.byteLength,this.queue.push($)}shiftFirst($){return this._buffered===0?null:this._next($)}shift($){if($>this.buffered)return null;if($===0)return y83;let u=this._next($);if($===u.byteLength)return u;let f=[u];while(($-=u.byteLength)>0)u=this._next($),f.push(u);return sS$.concat(f)}_next($){let u=this.queue.peek(),f=u.byteLength-this._offset;if($>=f){let X=this._offset?u.subarray(this._offset,u.byteLength):u;return this.queue.shift(),this._offset=0,this.buffered-=f,this.shifted+=f,X}return this.buffered-=$,this.shifted+=$,u.subarray(this._offset,this._offset+=$)}}class $k$ extends M83{constructor($,u,f){super();this.header=u,this.offset=f,this._parent=$}_read($){if(this.header.size===0)this.push(null);if(this._parent._stream===this)this._parent._update();$(null)}_predestroy(){this._parent.destroy(oS$(this))}_detach(){if(this._parent._stream===this)this._parent._stream=null,this._parent._missing=fk$(this.header.size),this._parent._update()}_destroy($){this._detach(),$(null)}}class uk$ extends q83{constructor($){super($);if(!$)$={};this._buffer=new eS$,this._offset=0,this._header=null,this._stream=null,this._missing=0,this._longHeader=!1,this._callback=PM1,this._locked=!1,this._finished=!1,this._pax=null,this._paxGlobal=null,this._gnuLongPath=null,this._gnuLongLinkPath=null,this._filenameEncoding=$.filenameEncoding||"utf-8",this._allowUnknownFormat=!!$.allowUnknownFormat,this._unlockBound=this._unlock.bind(this)}_unlock($){if(this._locked=!1,$){this.destroy($),this._continueWrite($);return}this._update()}_consumeHeader(){if(this._locked)return!1;this._offset=this._buffer.shifted;try{this._header=Xs.decode(this._buffer.shift(512),this._filenameEncoding,this._allowUnknownFormat)}catch($){return this._continueWrite($),!1}if(!this._header)return!0;switch(this._header.type){case"gnu-long-path":case"gnu-long-link-path":case"pax-global-header":case"pax-header":return this._longHeader=!0,this._missing=this._header.size,!0}if(this._locked=!0,this._applyLongHeaders(),this._header.size===0||this._header.type==="directory")return this.emit("entry",this._header,this._createStream(),this._unlockBound),!0;return this._stream=this._createStream(),this._missing=this._header.size,this.emit("entry",this._header,this._stream,this._unlockBound),!0}_applyLongHeaders(){if(this._gnuLongPath)this._header.name=this._gnuLongPath,this._gnuLongPath=null;if(this._gnuLongLinkPath)this._header.linkname=this._gnuLongLinkPath,this._gnuLongLinkPath=null;if(this._pax){if(this._pax.path)this._header.name=this._pax.path;if(this._pax.linkpath)this._header.linkname=this._pax.linkpath;if(this._pax.size)this._header.size=parseInt(this._pax.size,10);this._header.pax=this._pax,this._pax=null}}_decodeLongHeader($){switch(this._header.type){case"gnu-long-path":this._gnuLongPath=Xs.decodeLongPath($,this._filenameEncoding);break;case"gnu-long-link-path":this._gnuLongLinkPath=Xs.decodeLongPath($,this._filenameEncoding);break;case"pax-global-header":this._paxGlobal=Xs.decodePax($);break;case"pax-header":this._pax=this._paxGlobal===null?Xs.decodePax($):Object.assign({},this._paxGlobal,Xs.decodePax($));break}}_consumeLongHeader(){this._longHeader=!1,this._missing=fk$(this._header.size);let $=this._buffer.shift(this._header.size);try{this._decodeLongHeader($)}catch(u){return this._continueWrite(u),!1}return!0}_consumeStream(){let $=this._buffer.shiftFirst(this._missing);if($===null)return!1;this._missing-=$.byteLength;let u=this._stream.push($);if(this._missing===0){if(this._stream.push(null),u)this._stream._detach();return u&&this._locked===!1}return u}_createStream(){return new $k$(this,this._header,this._offset)}_update(){while(this._buffer.buffered>0&&!this.destroying){if(this._missing>0){if(this._stream!==null){if(this._consumeStream()===!1)return;continue}if(this._longHeader===!0){if(this._missing>this._buffer.buffered)break;if(this._consumeLongHeader()===!1)return!1;continue}let $=this._buffer.shiftFirst(this._missing);if($!==null)this._missing-=$.byteLength;continue}if(this._buffer.buffered<512)break;if(this._stream!==null||this._consumeHeader()===!1)return}this._continueWrite(null)}_continueWrite($){let u=this._callback;this._callback=PM1,u($)}_write($,u){this._callback=u,this._buffer.push($),this._update()}_final($){this._finished=this._missing===0&&this._buffer.buffered===0,$(this._finished?null:Error("Unexpected end of data"))}_predestroy(){this._continueWrite(null)}_destroy($){if(this._stream)this._stream.destroy(oS$(this));$(null)}[Symbol.asyncIterator](){let $=null,u=null,f=null,X=null,J=null,w=this;return this.on("entry",Y),this.on("error",(G)=>{$=G}),this.on("close",Z),{[Symbol.asyncIterator](){return this},next(){return new Promise(Q)},return(){return W(null)},throw(G){return W(G)}};function E(G){if(!J)return;let F=J;J=null,F(G)}function Q(G,F){if($)return F($);if(X){G({value:X,done:!1}),X=null;return}if(u=G,f=F,E(null),w._finished&&u)u({value:void 0,done:!0}),u=f=null}function Y(G,F,B){if(J=B,F.on("error",PM1),u)u({value:F,done:!1}),u=f=null;else X=F}function Z(){if(E($),!u)return;if($)f($);else u({value:void 0,done:!0});u=f=null}function W(G){return w.destroy(G),E(G),new Promise((F,B)=>{if(w.destroyed)return F({value:void 0,done:!0});w.once("close",function(){if(G)B(G);else F({value:void 0,done:!0})})})}}}Xk$.exports=function(u){return new uk$(u)};function PM1(){}function fk$($){return $&=511,$&&512-$}});var Ek$=b((qGX,jM1)=>{var wk$={S_IFMT:61440,S_IFDIR:16384,S_IFCHR:8192,S_IFBLK:24576,S_IFIFO:4096,S_IFLNK:40960};try{jM1.exports=Z0("fs").constants||wk$}catch{jM1.exports=wk$}});var Fk$=b((MGX,Gk$)=>{var{Readable:g83,Writable:V83,getStreamError:Qk$}=KM1(),qx=us(),Js=Ek$(),wm0=_M1(),Yk$=qx.alloc(1024);class Dk$ extends V83{constructor($,u,f){super({mapWritable:i83,eagerOpen:!0});if(this.written=0,this.header=u,this._callback=f,this._linkname=null,this._isLinkname=u.type==="symlink"&&!u.linkname,this._isVoid=u.type!=="file"&&u.type!=="contiguous-file",this._finished=!1,this._pack=$,this._openCallback=null,this._pack._stream===null)this._pack._stream=this;else this._pack._pending.push(this)}_open($){if(this._openCallback=$,this._pack._stream===this)this._continueOpen()}_continuePack($){if(this._callback===null)return;let u=this._callback;this._callback=null,u($)}_continueOpen(){if(this._pack._stream===null)this._pack._stream=this;let $=this._openCallback;if(this._openCallback=null,$===null)return;if(this._pack.destroying)return $(Error("pack stream destroyed"));if(this._pack._finalized)return $(Error("pack stream is already finalized"));if(this._pack._stream=this,!this._isLinkname)this._pack._encode(this.header);if(this._isVoid)this._finish(),this._continuePack(null);$(null)}_write($,u){if(this._isLinkname)return this._linkname=this._linkname?qx.concat([this._linkname,$]):$,u(null);if(this._isVoid){if($.byteLength>0)return u(Error("No body allowed for this entry"));return u()}if(this.written+=$.byteLength,this._pack.push($))return u();this._pack._drain=u}_finish(){if(this._finished)return;if(this._finished=!0,this._isLinkname)this.header.linkname=this._linkname?qx.toString(this._linkname,"utf-8"):"",this._pack._encode(this.header);Wk$(this._pack,this.header.size),this._pack._done(this)}_final($){if(this.written!==this.header.size)return $(Error("Size mismatch"));this._finish(),$(null)}_getError(){return Qk$(this)||Error("tar entry destroyed")}_predestroy(){this._pack.destroy(this._getError())}_destroy($){this._pack._done(this),this._continuePack(this._finished?null:this._getError()),$()}}class Zk$ extends g83{constructor($){super($);this._drain=LM1,this._finalized=!1,this._finalizing=!1,this._pending=[],this._stream=null}entry($,u,f){if(this._finalized||this.destroying)throw Error("already finalized or destroyed");if(typeof u==="function")f=u,u=null;if(!f)f=LM1;if(!$.size||$.type==="symlink")$.size=0;if(!$.type)$.type=b83($.mode);if(!$.mode)$.mode=$.type==="directory"?493:420;if(!$.uid)$.uid=0;if(!$.gid)$.gid=0;if(!$.mtime)$.mtime=new Date;if(typeof u==="string")u=qx.from(u);let X=new Dk$(this,$,f);if(qx.isBuffer(u))return $.size=u.byteLength,X.write(u),X.end(),X;if(X._isVoid)return X;return X}finalize(){if(this._stream||this._pending.length>0){this._finalizing=!0;return}if(this._finalized)return;this._finalized=!0,this.push(Yk$),this.push(null)}_done($){if($!==this._stream)return;if(this._stream=null,this._finalizing)this.finalize();if(this._pending.length)this._pending.shift()._continueOpen()}_encode($){if(!$.pax){let u=wm0.encode($);if(u){this.push(u);return}}this._encodePax($)}_encodePax($){let u=wm0.encodePax({name:$.name,linkname:$.linkname,pax:$.pax}),f={name:"PaxHeader",mode:$.mode,uid:$.uid,gid:$.gid,size:u.byteLength,mtime:$.mtime,type:"pax-header",linkname:$.linkname&&"PaxHeader",uname:$.uname,gname:$.gname,devmajor:$.devmajor,devminor:$.devminor};this.push(wm0.encode(f)),this.push(u),Wk$(this,u.byteLength),f.size=$.size,f.type=$.type,this.push(wm0.encode(f))}_doDrain(){let $=this._drain;this._drain=LM1,$()}_predestroy(){let $=Qk$(this);if(this._stream)this._stream.destroy($);while(this._pending.length){let u=this._pending.shift();u.destroy($),u._continueOpen()}this._doDrain()}_read($){this._doDrain(),$()}}Gk$.exports=function(u){return new Zk$(u)};function b83($){switch($&Js.S_IFMT){case Js.S_IFBLK:return"block-device";case Js.S_IFCHR:return"character-device";case Js.S_IFDIR:return"directory";case Js.S_IFIFO:return"fifo";case Js.S_IFLNK:return"symlink"}return"file"}function LM1(){}function Wk$($,u){if(u&=511,u)$.push(Yk$.subarray(0,512-u))}function i83($){return qx.isBuffer($)?$:qx.from($)}});var Bk$=b((x83)=>{x83.extract=Jk$();x83.pack=Fk$()});var Nk$=b((yGX,Uk$)=>{Uk$.exports=vk$;function vk$($,u){if($&&u)return vk$($)(u);if(typeof $!=="function")throw TypeError("need wrapper function");return Object.keys($).forEach(function(X){f[X]=$[X]}),f;function f(){var X=Array(arguments.length);for(var J=0;J<X.length;J++)X[J]=arguments[J];var w=$.apply(this,X),E=X[X.length-1];if(typeof w==="function"&&w!==E)Object.keys(E).forEach(function(Q){w[Q]=E[Q]});return w}}});var AM1=b((gGX,TM1)=>{var Ok$=Nk$();TM1.exports=Ok$(Em0);TM1.exports.strict=Ok$(zk$);Em0.proto=Em0(function(){Object.defineProperty(Function.prototype,"once",{value:function(){return Em0(this)},configurable:!0}),Object.defineProperty(Function.prototype,"onceStrict",{value:function(){return zk$(this)},configurable:!0})});function Em0($){var u=function(){if(u.called)return u.value;return u.called=!0,u.value=$.apply(this,arguments)};return u.called=!1,u}function zk$($){var u=function(){if(u.called)throw Error(u.onceError);return u.called=!0,u.value=$.apply(this,arguments)},f=$.name||"Function wrapped with `once`";return u.onceError=f+" shouldn't be called more than once",u.called=!1,u}});var _k$=b((VGX,Hk$)=>{var d83=AM1(),m83=function(){},n83=global.Bare?queueMicrotask:process.nextTick.bind(process),t83=function($){return $.setHeader&&typeof $.abort==="function"},r83=function($){return $.stdio&&Array.isArray($.stdio)&&$.stdio.length===3},Kk$=function($,u,f){if(typeof u==="function")return Kk$($,null,u);if(!u)u={};f=d83(f||m83);var{_writableState:X,_readableState:J}=$,w=u.readable||u.readable!==!1&&$.readable,E=u.writable||u.writable!==!1&&$.writable,Q=!1,Y=function(){if(!$.writable)Z()},Z=function(){if(E=!1,!w)f.call($)},W=function(){if(w=!1,!E)f.call($)},G=function(O){f.call($,O?Error("exited with error code: "+O):null)},F=function(O){f.call($,O)},B=function(){n83(v)},v=function(){if(Q)return;if(w&&!(J&&(J.ended&&!J.destroyed)))return f.call($,Error("premature close"));if(E&&!(X&&(X.ended&&!X.destroyed)))return f.call($,Error("premature close"))},N=function(){$.req.on("finish",Z)};if(t83($))if($.on("complete",Z),$.on("abort",B),$.req)N();else $.on("request",N);else if(E&&!X)$.on("end",Y),$.on("close",Y);if(r83($))$.on("exit",G);if($.on("end",W),$.on("finish",Z),u.error!==!1)$.on("error",F);return $.on("close",B),function(){if(Q=!0,$.removeListener("complete",Z),$.removeListener("abort",B),$.removeListener("request",N),$.req)$.req.removeListener("finish",Z);$.removeListener("end",Y),$.removeListener("close",Y),$.removeListener("finish",Z),$.removeListener("exit",G),$.removeListener("end",W),$.removeListener("error",F),$.removeListener("close",B)}};Hk$.exports=Kk$});var Lk$=b((bGX,jk$)=>{var a83=AM1(),p83=_k$(),Qm0;try{Qm0=Z0("fs")}catch($){}var lJ0=function(){},o83=typeof process>"u"?!1:/^v?\.0/.test(process.version),Ym0=function($){return typeof $==="function"},s83=function($){if(!o83)return!1;if(!Qm0)return!1;return($ instanceof(Qm0.ReadStream||lJ0)||$ instanceof(Qm0.WriteStream||lJ0))&&Ym0($.close)},e83=function($){return $.setHeader&&Ym0($.abort)},$X3=function($,u,f,X){X=a83(X);var J=!1;$.on("close",function(){J=!0}),p83($,{readable:u,writable:f},function(E){if(E)return X(E);J=!0,X()});var w=!1;return function(E){if(J)return;if(w)return;if(w=!0,s83($))return $.close(lJ0);if(e83($))return $.abort();if(Ym0($.destroy))return $.destroy();X(E||Error("stream was destroyed"))}},Pk$=function($){$()},uX3=function($,u){return $.pipe(u)},fX3=function(){var $=Array.prototype.slice.call(arguments),u=Ym0($[$.length-1]||lJ0)&&$.pop()||lJ0;if(Array.isArray($[0]))$=$[0];if($.length<2)throw Error("pump requires two streams per minimum");var f,X=$.map(function(J,w){var E=w<$.length-1,Q=w>0;return $X3(J,E,Q,function(Y){if(!f)f=Y;if(Y)X.forEach(Pk$);if(E)return;X.forEach(Pk$),u(f)})});return $.reduce(uX3)};jk$.exports=fX3});var Mk$=b((EX3)=>{var Tk$=Bk$(),Ak$=Lk$(),Ik$=Z0("fs"),B8=Z0("path"),cJ0=(global.Bare?global.Bare.platform:process.platform)==="win32";EX3.pack=function(u,f){if(!u)u=".";if(!f)f={};let X=f.fs||Ik$,J=f.ignore||f.filter||dJ0,w=f.mapStream||Ck$,E=wX3(X,f.dereference?X.stat:X.lstat,u,J,f.entries,f.sort),Q=f.strict!==!1,Y=typeof f.umask==="number"?~f.umask:~Sk$(),Z=f.pack||Tk$.pack(),W=f.finish||dJ0,G=f.map||dJ0,F=typeof f.dmode==="number"?f.dmode:0,B=typeof f.fmode==="number"?f.fmode:0;if(f.strip)G=qk$(G,f.strip);if(f.readable)F|=parseInt(555,8),B|=parseInt(444,8);if(f.writable)F|=parseInt(333,8),B|=parseInt(222,8);O();function v(z,H){X.readlink(B8.join(u,z),function(_,T){if(_)return Z.destroy(_);H.linkname=IM1(T),Z.entry(H,O)})}function N(z,H,_){if(Z.destroyed)return;if(z)return Z.destroy(z);if(!H){if(f.finalize!==!1)Z.finalize();return W(Z)}if(_.isSocket())return O();let T={name:IM1(H),mode:(_.mode|(_.isDirectory()?F:B))&Y,mtime:_.mtime,size:_.size,type:"file",uid:_.uid,gid:_.gid};if(_.isDirectory())return T.size=0,T.type="directory",T=G(T)||T,Z.entry(T,O);if(_.isSymbolicLink())return T.size=0,T.type="symlink",T=G(T)||T,v(H,T);if(T=G(T)||T,!_.isFile()){if(Q)return Z.destroy(Error("unsupported type for "+H));return O()}let j=Z.entry(T,O),I=w(X.createReadStream(B8.join(u,H),{start:0,end:T.size>0?T.size-1:T.size}),T);I.on("error",function(k){j.destroy(k)}),Ak$(I,j)}function O(z){if(z)return Z.destroy(z);E(N)}return Z};function XX3($){return $.length?$[$.length-1]:null}function JX3(){return!global.Bare&&process.getuid?process.getuid():-1}function Sk$(){return!global.Bare&&process.umask?process.umask():0}EX3.extract=function(u,f){if(!u)u=".";if(!f)f={};u=B8.resolve(u);let X=f.fs||Ik$,J=f.ignore||f.filter||dJ0,w=f.mapStream||Ck$,E=f.chown!==!1&&!cJ0&&JX3()===0,Q=f.extract||Tk$.extract(),Y=[],Z=new Date,W=typeof f.umask==="number"?~f.umask:~Sk$(),G=f.strict!==!1,F=f.validateSymlinks!==!1,B=f.map||dJ0,v=typeof f.dmode==="number"?f.dmode:0,N=typeof f.fmode==="number"?f.fmode:0;if(f.strip)B=qk$(B,f.strip);if(f.readable)v|=parseInt(555,8),N|=parseInt(444,8);if(f.writable)v|=parseInt(333,8),N|=parseInt(222,8);if(Q.on("entry",O),f.finish)Q.on("finish",f.finish);return Q;function O(j,I,k){j=B(j)||j,j.name=IM1(j.name);let S=B8.join(u,B8.join("/",j.name));if(J(S,j))return I.resume(),k();let q=B8.join(S,".")===B8.join(u,".")?u:B8.dirname(S);Rk$(X,q,B8.join(u,"."),function(x,r){if(x)return k(x);if(!r)return k(Error(q+" is not a valid path"));if(j.type==="directory")return Y.push([S,j.mtime]),T(S,{fs:X,own:E,uid:j.uid,gid:j.gid,mode:j.mode},y);T(q,{fs:X,own:E,uid:j.uid,gid:j.gid,mode:493},function(o){if(o)return k(o);switch(j.type){case"file":return M();case"link":return i();case"symlink":return h()}if(G)return k(Error("unsupported type for "+S+" ("+j.type+")"));I.resume(),k()})});function y(x){if(x)return k(x);H(S,j,function(r){if(r)return k(r);if(cJ0)return k();_(S,j,k)})}function h(){if(cJ0)return k();X.unlink(S,function(){let x=B8.resolve(B8.dirname(S),j.linkname);if(!l(x)&&F)return k(Error(S+" is not a valid symlink"));kk$(X,x,B8.join(u,"."),function(r,o){if(r)return k(r);if(!o&&F)return k(Error(S+" is not a valid symlink"));X.symlink(j.linkname,S,y)})})}function i(){if(cJ0)return k();X.unlink(S,function(){let x=B8.join(u,B8.join("/",j.linkname));X.realpath(x,function(r,o){if(r||!l(o))return k(Error(S+" is not a valid hardlink"));X.link(o,S,function(w0){if(w0&&w0.code==="EPERM"&&f.hardlinkAsFilesFallback)return I=X.createReadStream(o),M();y(w0)})})})}function l(x){return x===u||x.startsWith(u+B8.sep)}function M(){let x=X.createWriteStream(S),r=w(I,j);x.on("error",function(o){r.destroy(o)}),Ak$(r,x,function(o){if(o)return k(o);x.on("close",y)})}}function z(j,I){let k;while((k=XX3(Y))&&j.slice(0,k[0].length)!==k[0])Y.pop();if(!k)return I();X.utimes(k[0],Z,k[1],I)}function H(j,I,k){if(f.utimes===!1)return k();if(I.type==="directory")return X.utimes(j,Z,I.mtime,k);if(I.type==="symlink")return z(j,k);X.utimes(j,Z,I.mtime,function(S){if(S)return k(S);z(j,k)})}function _(j,I,k){let S=I.type==="symlink",q=S?X.lchmod:X.chmod,y=S?X.lchown:X.chown;if(!q)return k();let h=(I.mode|(I.type==="directory"?v:N))&W;if(y&&E)y.call(X,j,I.uid,I.gid,i);else i(null);function i(l){if(l)return k(l);if(!q)return k();q.call(X,j,h,k)}}function T(j,I,k){X.stat(j,function(S){if(!S)return k(null);if(S.code!=="ENOENT")return k(S);X.mkdir(j,{mode:I.mode,recursive:!0},function(q,y){if(q)return k(q);_(j,I,k)})})}};function kk$($,u,f,X){if(u===f)return X(null,!0);if(!u.startsWith(f+B8.sep))return X(null,!1);$.lstat(u,function(J,w){if(J&&J.code!=="ENOENT"&&J.code!=="EPERM")return X(J);if(J||!w.isSymbolicLink())return kk$($,B8.join(u,".."),f,X);X(null,!1)})}function Rk$($,u,f,X){if(u===f)return X(null,!0);$.lstat(u,function(J,w){if(J&&J.code!=="ENOENT"&&J.code!=="EPERM")return X(J);if(J||w.isDirectory())return Rk$($,B8.join(u,".."),f,X);X(null,!1)})}function dJ0(){}function Ck$($){return $}function IM1($){return cJ0?$.replace(/\\/g,"/").replace(/[:?<>|]/g,"_"):$}function wX3($,u,f,X,J,w){if(!J)J=["."];let E=J.slice(0);return function(Y){if(!E.length)return Y(null);let Z=E.shift(),W=B8.join(f,Z);u.call($,W,function(G,F){if(G)return Y(J.indexOf(Z)===-1&&G.code==="ENOENT"?null:G);if(!F.isDirectory())return Y(null,Z,F);$.readdir(W,function(B,v){if(B)return Y(B);if(w)v.sort();for(let N=0;N<v.length;N++)if(!X(B8.join(f,Z,v[N])))E.push(B8.join(Z,v[N]));Y(null,Z,F)})})}}function qk$($,u){return function(f){f.name=f.name.split("/").slice(u).join("/");let X=f.linkname;if(X&&(f.type==="link"||B8.isAbsolute(X)))f.linkname=X.split("/").slice(u).join("/");return $(f)}}});var DX3,ZX3;var hk$=U(()=>{GM1();DX3=Q0(_S$(),1),ZX3=Q0(Mk$(),1)});var Dm0=()=>{};var yk$=U(()=>{Pd0()});var gk$=U(()=>{pd0();ad0();Dm0()});var Vk$=()=>{};var bk$=()=>{};var SM1=U(()=>{XS$();ZM1();pd0();YS$();YM1();GM1();DS$();ZS$();WS$();GS$();DM1();FS$();hk$();Dm0();yk$();gk$();Vk$();bk$();Dm0()});var U7,fX,Mx,mJ0;var nJ0=U(()=>{U7={CLAIM_API_GROUP:"extensions.agents.x-k8s.io",CLAIM_API_VERSION:"v1alpha1",CLAIM_PLURAL:"sandboxclaims",SANDBOX_API_GROUP:"agents.x-k8s.io",SANDBOX_API_VERSION:"v1alpha1",SANDBOX_PLURAL:"sandboxes",POD_NAME_ANNOTATION:"agents.x-k8s.io/pod-name"};fX=class fX extends Error{cause;constructor($,u){super($);if(this.name="SandboxError",this.cause=u,u instanceof Error&&u.stack)this.stack=`${this.stack}
 Caused by: ${u.stack}`}};Mx=class Mx extends fX{constructor($,u){super($,u);this.name="SandboxTimeoutError"}};mJ0=class mJ0 extends fX{constructor($,u){super($,u);this.name="SandboxAlreadyExistsError"}}});async function WX3($){let u=$.getCurrentCluster();if(!u)throw new fX("No active cluster in kubeconfig");let f={};await $.applyToHTTPSOptions(f);let X={},J=f.headers??{};for(let[w,E]of Object.entries(J))if(Array.isArray(E))X[w]=E.join(", ");else if(E!==void 0)X[w]=String(E);if(typeof f.auth==="string"&&!X.Authorization)X.Authorization=`Basic ${Buffer.from(f.auth).toString("base64")}`;return{server:u.server.replace(/\/+$/,""),headers:X,tls:{cert:kM1(f.cert),key:kM1(f.key),ca:kM1(f.ca),rejectUnauthorized:u.skipTLSVerify?!1:void 0}}}function kM1($){if($==null)return;if(typeof $==="string")return $;if(Buffer.isBuffer($))return $.toString("utf8");return String($)}async function hx($,u){let f=await WX3($),X={...f.headers,...u.headers};if(u.method==="PATCH")X["content-type"]=u.patchType==="apply"?"application/apply-patch+yaml":u.patchType==="strategic-merge"?"application/strategic-merge-patch+json":"application/merge-patch+json";else if(u.body!==void 0&&!("content-type"in X))X["content-type"]="application/json";let J={method:u.method,headers:X,body:u.body===void 0?void 0:JSON.stringify(u.body),signal:u.signal,tls:f.tls};return fetch(`${f.server}${u.path}`,J)}async function CM1($){try{return await $.json()}catch{return null}}async function qM1($,u){if($.ok)return;let f=await CM1($),X=f?.message??`${u} failed: ${$.status} ${$.statusText}`;throw new RM1($.status,f,X)}async function tJ0($,u,f,X,J="none"){try{let w=await hx($,u);if(w.status===404)return null;if(await qM1(w,f),J==="json")return await w.json();return null}catch(w){throw new fX(X,w)}}async function rJ0($,u,f){let X=`${ik$}/${encodeURIComponent(u)}/${U7.CLAIM_PLURAL}`,J;try{J=await hx($,{method:"POST",path:X,body:f})}catch(Z){let W=Z instanceof Error?Z.message:String(Z);throw console.warn(`[agent-sandbox/client] createSandboxClaim ${f.metadata.name} transport error: ${W}`),new fX(`Failed to create SandboxClaim: ${f.metadata.name} (transport error: ${W})`,Z)}if(J.ok)return;let w=await CM1(J),E=w?.reason?` ${w.reason}`:"",Q=w?.message??J.statusText,Y=`Failed to create SandboxClaim: ${f.metadata.name} (${J.status}${E}: ${Q})`;if(console.warn(`[agent-sandbox/client] createSandboxClaim ${f.metadata.name} rejected: status=${J.status} reason=${w?.reason??"<none>"} message=${Q}`),J.status===409)throw new mJ0(Y);throw new fX(Y)}async function Zm0($,u,f,X=60000){let J=Date.now()+X,w=500,E;while(!0){let Q=await J_($,u,f).catch(()=>{return});if(!Q)return;if(E=Q,Date.now()>=J){let Y=E.metadata?.finalizers??[],Z=E.metadata?.deletionTimestamp??"<unknown>";throw new Mx(`SandboxClaim ${f} still terminating after ${X}ms (deletionTimestamp=${Z}, finalizers=[${Y.join(", ")}])`)}await new Promise((Y)=>setTimeout(Y,500))}}function MM1($,u){return`${ik$}/${encodeURIComponent($)}/${U7.CLAIM_PLURAL}/${encodeURIComponent(u)}`}async function xk$($,u,f,X){await tJ0($,{method:"PATCH",path:MM1(u,f),patchType:"merge",body:{spec:{lifecycle:{shutdownPolicy:"Delete",shutdownTime:X}}}},"patchSandboxClaimShutdown",`Failed to patch SandboxClaim shutdownTime: ${f}`)}async function X_($,u,f){await tJ0($,{method:"DELETE",path:MM1(u,f)},"deleteSandboxClaim",`Failed to delete SandboxClaim: ${f}`)}async function J_($,u,f){return await tJ0($,{method:"GET",path:MM1(u,f)},"getSandboxClaim",`Failed to get SandboxClaim: ${f}`,"json")??void 0}async function lk$($,u,f,X=60){let J=Date.now()+X*1000,w=200;while(Date.now()<J){let Q=(await J_($,u,f).catch(()=>{return}))?.status?.sandbox?.name;if(Q)return Q;await new Promise((Y)=>setTimeout(Y,200))}throw new Mx(`SandboxClaim ${f} did not record an adopted Sandbox (status.sandbox.name) within ${X}s`)}function nk$($,u){return`${mk$}/${encodeURIComponent($)}/${hM1}/${encodeURIComponent(u)}`}function GX3($){return`${mk$}/${encodeURIComponent($)}/${hM1}`}async function Wm0($,u,f){try{let X=await hx($,{method:"POST",path:GX3(u),body:f});if(X.status===409)return;await qM1(X,"createHttpRoute")}catch(X){if(X instanceof RM1&&X.status===409)return;throw new fX(`Failed to create HTTPRoute: ${f.metadata.name}`,X)}}async function Gm0($,u,f){await tJ0($,{method:"DELETE",path:nk$(u,f)},"deleteHttpRoute",`Failed to delete HTTPRoute: ${f}`)}async function tk$($,u,f){return await tJ0($,{method:"GET",path:nk$(u,f)},"getHttpRoute",`Failed to get HTTPRoute: ${f}`,"json")??void 0}async function rk$($,u,f,X){let J={apiVersion:"v1",kind:"Service",metadata:{name:f},spec:{ports:[{name:X.name,port:X.port,targetPort:X.targetPort,protocol:X.protocol??"TCP"}]}},w=new URLSearchParams({fieldManager:FX3,force:"true"}),E=`/api/v1/namespaces/${encodeURIComponent(u)}/services/${encodeURIComponent(f)}?${w}`;try{let Q=await hx($,{method:"PATCH",path:E,patchType:"apply",body:J});await qM1(Q,"ensureServicePort")}catch(Q){throw new fX(`Failed to apply Service ports: ${f}`,Q)}}function Fm0($,u,f,X=180){let J=`/apis/${U7.SANDBOX_API_GROUP}/${U7.SANDBOX_API_VERSION}/namespaces/${encodeURIComponent(u)}/${U7.SANDBOX_PLURAL}?watch=true&fieldSelector=${encodeURIComponent(`metadata.name=${f}`)}`,{resolve:w,reject:E,promise:Q}=Promise.withResolvers(),Y=new AbortController,Z=!1,W=setTimeout(()=>{if(Z)return;Z=!0,Y.abort(),E(new Mx(`Sandbox did not become ready within ${X} seconds`))},X*1000),G=(F)=>{if(Z)return;Z=!0,clearTimeout(W),Y.abort(),F()};return(async()=>{let F;try{F=await hx($,{method:"GET",path:J,signal:Y.signal,headers:{accept:"application/json"}})}catch(B){G(()=>E(new fX("Failed to start watch for sandbox readiness",B)));return}if(!F.ok||!F.body){let B=await CM1(F).catch(()=>null);G(()=>E(new fX(`Watch handshake failed (${F.status}): ${B?.message??F.statusText}`)));return}try{for await(let B of yM1(F.body)){if(Z)return;if(B.type==="ERROR"){let H=B.object;G(()=>E(new fX(`Watch stream error while waiting for sandbox: ${H.message??"unknown"}`)));return}if(B.type!=="ADDED"&&B.type!=="MODIFIED")continue;let v=B.object;if(!v.status?.conditions?.find((H)=>H.type==="Ready"&&H.status==="True"))continue;let O=v.metadata?.name;if(!O){G(()=>E(new fX("Sandbox metadata or name is missing")));return}let z=v.metadata?.annotations?.[U7.POD_NAME_ANNOTATION]??O;G(()=>w({sandboxName:O,podName:z}));return}G(()=>E(new fX("Watch stream closed before sandbox became ready")))}catch(B){if(Z)return;if(B instanceof Error&&(B.name==="AbortError"||Y.signal.aborted))return;G(()=>E(new fX("Watch stream error while waiting for sandbox",B)))}})(),Q}async function*yM1($){let u=$.getReader(),f=new TextDecoder,X="";try{while(!0){let{value:w,done:E}=await u.read();if(E)break;X+=f.decode(w,{stream:!0});let Q;while((Q=X.indexOf(`
-`))>=0){let Y=X.slice(0,Q).trim();if(X=X.slice(Q+1),!Y)continue;yield JSON.parse(Y)}}let J=X.trim();if(J)yield JSON.parse(J)}finally{u.releaseLock()}}var RM1,ik$,ck$="gateway.networking.k8s.io",dk$="v1",hM1="httproutes",mk$,aJ0,FX3="mesh-sandbox-runner";var Bm0=U(()=>{nJ0();RM1=class RM1 extends Error{status;body;constructor($,u,f){super(f);this.status=$;this.body=u;this.name="KubeHttpError"}};ik$=`/apis/${U7.CLAIM_API_GROUP}/${U7.CLAIM_API_VERSION}/namespaces`;mk$=`/apis/${ck$}/${dk$}/namespaces`;aJ0={API_GROUP:ck$,API_VERSION:dk$,PLURAL:hM1}});async function*ok$($){let u=$.now??(()=>Date.now()),f=u(),X=$.schedulingTimeoutMs??UX3,J={pod:{},sandbox:{},events:{hasPulling:!1,hasPulled:!1},startedAt:f},w=[],E=null,Q=!1,Y=(H)=>{if(Q)return;if(E){let _=E;E=null,_(H)}else w.push(H)},Z=()=>{if(w.length>0)return Promise.resolve(w.shift());if(Q)return Promise.resolve(null);return new Promise((H)=>{E=H})},W=()=>{if(Q)return;if(Q=!0,E){let H=E;E=null,H(null)}},G=new AbortController,F=()=>{G.abort(),W()};if($.signal)if($.signal.aborted)G.abort(),W();else $.signal.addEventListener("abort",F,{once:!0});let B=Math.max(0,X-(u()-f)),v=setTimeout(()=>Y("tick"),B+100),N,O=new Promise((H)=>{N=H}),z=Promise.allSettled([NX3($.kc,$.namespace,$.claimName,G.signal,J,Y,u,N),zX3($.kc,$.namespace,$.claimName,G.signal,J,Y),KX3($.kc,$.namespace,$.claimName,O,G.signal,J,Y,u)]);try{let H=null,_=-1,T=ak$(J,X,u);if(H=VM1(T),!gM1(T))_=pk$(T);if(yield T,gM1(T))return;while(!Q){if(await Z()===null)break;let I=ak$(J,X,u);if(gM1(I)){let q=VM1(I);if(q!==H)H=q,yield I;return}let k=pk$(I);if(k<_)continue;let S=VM1(I);if(S!==H)H=S,_=k,yield I}}finally{if(clearTimeout(v),G.abort(),$.signal)$.signal.removeEventListener("abort",F);W(),await z.catch(()=>{})}}function ak$($,u,f){let{pod:X,sandbox:J,events:w,startedAt:E}=$;if(J.ready)return{kind:"ready"};let Q=X.containerWaitingReason;if(Q==="ImagePullBackOff"||Q==="ErrImagePull")return{kind:"failed",reason:"image-pull-backoff",message:"Sandbox image failed to download. The cluster may be missing pull credentials or the image tag may not exist."};if(Q==="CrashLoopBackOff")return{kind:"failed",reason:"crash-loop-backoff",message:"Sandbox crashed during startup and is now in CrashLoopBackOff. Check pod logs."};if(!X.scheduled&&w.lastFailedSchedulingAt!==void 0&&f()-E>u)return{kind:"failed",reason:"scheduling-timeout",message:w.failedSchedulingMessage??`Pod could not be scheduled within ${Math.round(u/1000)}s.`};if(X.containerRunning&&!X.containerReady)return{kind:"warming-daemon",since:E};if(w.hasPulling&&!w.hasPulled)return{kind:"pulling-image",since:E};if(Q==="ContainerCreating"||Q==="PodInitializing"||X.scheduled&&!X.containerRunning)return{kind:"starting-container",since:E};if(X.scheduledFalseReason==="Unschedulable"||w.lastFailedSchedulingAt!==void 0&&!X.scheduled)return{kind:"waiting-for-capacity",since:E,message:w.failedSchedulingMessage??X.scheduledFalseMessage,nodeClaim:w.nominatedNodeClaim};return{kind:"claiming",since:E}}function gM1($){return $.kind==="ready"||$.kind==="failed"}function pk$($){switch($.kind){case"claiming":return 0;case"waiting-for-capacity":return 1;case"pulling-image":return 2;case"starting-container":return 3;case"warming-daemon":return 4;case"ready":case"failed":return 99}}function VM1($){switch($.kind){case"claiming":case"pulling-image":case"starting-container":case"warming-daemon":return $.kind;case"waiting-for-capacity":return`waiting-for-capacity:${$.message??""}:${$.nodeClaim??""}`;case"ready":return"ready";case"failed":return`failed:${$.reason}:${$.message}`}}async function NX3($,u,f,X,J,w,E,Q){let Y=`/api/v1/namespaces/${encodeURIComponent(u)}/pods?watch=true&labelSelector=${encodeURIComponent(`${BX3}=${f}`)}`;return bM1({kc:$,path:Y,signal:X,label:`pod/${f}`,onEvent:(Z)=>{if(Z.type!=="ADDED"&&Z.type!=="MODIFIED")return;let W=Z.object;if(W.metadata?.name)Q(W.metadata.name);OX3(W,J,E),w("pod")}})}function OX3($,u,f){let J=($.status?.conditions??[]).find((E)=>E.type==="PodScheduled");if(J?.status==="True")u.pod.scheduled=!0,u.pod.scheduledFalseReason=void 0,u.pod.scheduledFalseMessage=void 0;else if(J?.status==="False")u.pod.scheduled=!1,u.pod.scheduledFalseReason=J.reason,u.pod.scheduledFalseMessage=J.message;let w=($.status?.containerStatuses??[]).find((E)=>E.name===vX3);if(w)u.pod.containerWaitingReason=w.state?.waiting?.reason,u.pod.containerRunning=!!w.state?.running,u.pod.containerReady=w.ready===!0}async function zX3($,u,f,X,J,w){let E=`/apis/${U7.CLAIM_API_GROUP}/${U7.CLAIM_API_VERSION}/namespaces/${encodeURIComponent(u)}/${U7.CLAIM_PLURAL}?watch=true&fieldSelector=${encodeURIComponent(`metadata.name=${f}`)}`;return bM1({kc:$,path:E,signal:X,label:`sandboxclaim/${f}`,onEvent:(Q)=>{if(Q.type!=="ADDED"&&Q.type!=="MODIFIED")return;let Z=Q.object.status?.conditions?.find((W)=>W.type==="Ready");if(!Z)return;if(Z.status==="True")J.sandbox.ready=!0,J.sandbox.notReadyReason=void 0,J.sandbox.notReadyMessage=void 0;else J.sandbox.ready=!1,J.sandbox.notReadyReason=Z.reason,J.sandbox.notReadyMessage=Z.message;w("sandbox")}})}async function KX3($,u,f,X,J,w,E,Q){let Y=await Promise.race([X,new Promise((W)=>{if(J.aborted){W(f);return}J.addEventListener("abort",()=>W(f),{once:!0})})]);if(J.aborted)return;let Z=`/api/v1/namespaces/${encodeURIComponent(u)}/events?watch=true&fieldSelector=${encodeURIComponent(`involvedObject.name=${Y},involvedObject.kind=Pod`)}`;return bM1({kc:$,path:Z,signal:J,label:`events/${f}`,onEvent:(W)=>{if(W.type!=="ADDED"&&W.type!=="MODIFIED")return;let G=W.object,F=G.reason;if(!F)return;switch(F){case"Pulling":w.events.hasPulling=!0;break;case"Pulled":w.events.hasPulling=!0,w.events.hasPulled=!0;break;case"FailedScheduling":w.events.lastFailedSchedulingAt=Q(),w.events.failedSchedulingMessage=G.message;break;case"Nominated":{let B=G.message?.match(/nodeclaim\/([\w-]+)/);if(B)w.events.nominatedNodeClaim=B[1];break}default:return}E("event")}})}async function bM1($){let{kc:u,path:f,signal:X,label:J,onEvent:w}=$,E=0;while(!X.aborted){try{let Y=await hx(u,{method:"GET",path:f,signal:X,headers:{accept:"application/json"}});if(!Y.ok||!Y.body){try{await Y.body?.cancel()}catch{}throw Error(`watch handshake failed: ${Y.status} ${Y.statusText}`)}E=0;for await(let Z of yM1(Y.body)){if(X.aborted)return;try{w(Z)}catch(W){console.warn(`[lifecycle-watcher] ${J} onEvent threw: ${W instanceof Error?W.message:String(W)}`)}}}catch(Y){if(X.aborted)return;let Z=Y instanceof Error?Y.message:String(Y);console.warn(`[lifecycle-watcher] ${J} watch ended: ${Z}`)}if(X.aborted)return;let Q=PJ(5000,250,E,2,0);E+=1,await k3(Q,{signal:X}).catch(()=>{})}}var BX3="studio.decocms.com/sandbox-handle",vX3="sandbox",UX3=300000;var sk$=U(()=>{bw();nJ0();Bm0()});import{createHash as HX3,randomBytes as _X3,randomUUID as PX3}from"crypto";import*as fR$ from"net";import{PassThrough as jX3}from"stream";class mM1{kind=HY;records=new Map;inflight=new lk0;stateStore;previewUrlPattern;kubeConfig;portForward;namespace;sandboxTemplateName;envName;tokenGenerator;idleTtlMs;metrics;previewGateway;sentinelToken;closed=!1;constructor($={}){this.stateStore=$.stateStore??null,this.previewUrlPattern=$.previewUrlPattern??null,this.kubeConfig=$.kubeConfig??MX3(),this.portForward=new FM1(this.kubeConfig),this.namespace=$.namespace??LX3,this.sandboxTemplateName=$.sandboxTemplateName??TX3,this.envName=iX3($.envName),this.tokenGenerator=$.tokenGenerator??(()=>_X3(IX3).toString("hex")),this.idleTtlMs=$.idleTtlMs??kX3,this.metrics=$.meter?qX3($.meter):null,this.previewGateway=$.previewGateway&&$.previewUrlPattern?{...$.previewGateway}:null;let u=$.sentinelToken?.trim()??"";this.sentinelToken=u.length>0?u:null}async ensure($,u={}){let f=dH($,u.branch??u.repo?.branch??null);return this.inflight.run(f,()=>qC1(this.stateStore,$,HY,(X)=>this.ensureLocked($,f,u,X)))}async delete($){let u=await this.getRecord($);if(this.records.delete($),u)this.closeForwarder(u.daemonForward),this.metrics?.active.add(-1,cM1(u.tenant));if(await this.deleteHttpRouteIfManaged($).catch((f)=>{console.warn(`[${zJ}] HTTPRoute delete failed for ${$}: ${f instanceof Error?f.message:String(f)}`)}),await X_(this.kubeConfig,this.namespace,$),this.stateStore)if(u)await this.stateStore.delete(u.id,HY);else await this.stateStore.deleteByHandle(HY,$)}async alive($){return await J_(this.kubeConfig,this.namespace,$)!==void 0}watchClaimLifecycle($,u){return ok$({kc:this.kubeConfig,namespace:this.namespace,claimName:$,signal:u})}async getPreviewUrl($){let u=await this.getRecord($);if(!u)return null;return this.composePreviewUrl(u)}async proxyDaemonRequest($,u,f){let X=await this.getRecord($);if(!X&&this.previewUrlPattern&&this.stateStore){let Q=await this.stateStore.getByHandle(HY,$),Y=Q?.state,Z=Y?.token;if(Q&&Z){let G=`http://${Y?.adoptedSandboxName??$}.${this.namespace}.svc.cluster.local:${w_}`;return LB0(G,Z,u,f)}}if(!X)X=await this.resurrectByHandle($);if(!X)return new Response(JSON.stringify({error:"sandbox not found"}),{status:404,headers:{"content-type":"application/json"}});let J=X,w=performance.now(),E=0;try{let Q=await LB0(X.daemonUrl,X.token,u,f);if(Q.status===401&&!(f.body instanceof ReadableStream)){this.invalidateRecord($);let Y=await this.getRecord($).catch(()=>null);if(Y)J=Y,Q=await LB0(Y.daemonUrl,Y.token,u,f)}return E=Q.status,Q}finally{this.recordProxyDuration("daemon",E,J,performance.now()-w)}}async resolvePreviewUpstreamUrl($){if(this.previewUrlPattern)return`http://${await this.resolveServiceNameForHandle($)}.${this.namespace}.svc.cluster.local:${w_}`;let u=await this.getRecord($);if(u)return u.daemonUrl;let f=await this.resurrectByHandle($);return f?f.daemonUrl:null}async resolveServiceNameForHandle($){let u=this.records.get($);if(u)return u.adoptedSandboxName;if(this.stateStore){let X=(await this.stateStore.getByHandle(HY,$).catch(()=>null))?.state?.adoptedSandboxName;if(X)return X}return $}async proxyPreviewRequest($,u){let f=performance.now(),X=this.records.get($)??null,J=0;try{let w=await this.resolvePreviewUpstreamUrl($);if(!w){J=404;let v=xM1(404,{error:"sandbox not found"});return v.headers.set(yx,"1"),v}let E=new URL(u.url);if((E.pathname==="/_sandbox"||E.pathname.startsWith("/_sandbox/")||E.pathname==="/_decopilot_vm"||E.pathname.startsWith("/_decopilot_vm/"))&&u.method!=="GET")return J=404,xM1(404,{error:"not found"});let Y=(v)=>`${v}${E.pathname}${E.search}`,Z=new Headers(u.headers);for(let v of RX3)Z.delete(v);let W=u.method!=="GET"&&u.method!=="HEAD",G={method:u.method,headers:Z,body:W?u.body:void 0,redirect:"manual",signal:u.signal,duplex:W?"half":void 0},F;try{F=await fetch(Y(w),G)}catch(v){let N=`${w}${E.pathname}`;if(console.warn(`[${zJ}] preview fetch to ${N} failed: ${v instanceof Error?v.message:String(v)}`),u.method==="GET"||u.method==="HEAD"){if(this.invalidateRecord($),await this.resurrectByHandle($).catch(()=>null)){let H=await this.resolvePreviewUpstreamUrl($);if(H)try{F=await fetch(Y(H),G);let _=new Headers;for(let[T,j]of F.headers.entries())if(!ek$.includes(T.toLowerCase()))_.set(T,j);return J=F.status,new Response(F.body,{status:F.status,statusText:F.statusText,headers:_})}catch(_){console.warn(`[${zJ}] preview fetch retry to ${N} failed: ${_ instanceof Error?_.message:String(_)}`)}}}else this.invalidateRecord($);J=502;let O=xM1(502,{error:"sandbox daemon unreachable"});return O.headers.set(yx,"1"),O}let B=new Headers;for(let[v,N]of F.headers.entries())if(!ek$.includes(v.toLowerCase()))B.set(v,N);return J=F.status,new Response(F.body,{status:F.status,statusText:F.statusText,headers:B})}finally{this.recordProxyDuration("preview",J,X,performance.now()-f,$)}}async ensureLocked($,u,f,X){if(f.image)console.warn(`[${zJ}] opts.image ignored (template ${this.sandboxTemplateName} pins image): got ${f.image}`);if(X){let E=await X.get($,HY);if(E){let Q=await this.rehydrate($,u,E);if(Q)return this.finish(Q,X,!1,!0,"resume");await X.delete($,HY)}}let J=await J_(this.kubeConfig,this.namespace,u).catch(()=>{return});if(J)if(J.metadata?.deletionTimestamp)await Zm0(this.kubeConfig,this.namespace,u).catch((E)=>{console.warn(`[${zJ}] wait for terminating claim ${u} failed: ${E instanceof Error?E.message:String(E)}`)});else{let E=await this.adopt($,u,J).catch((Q)=>{return console.warn(`[${zJ}] adopt ${u} failed, recreating: ${Q instanceof Error?Q.message:String(Q)}`),null});if(E)return this.finish(E,X,!0,!0,"adopt");await X_(this.kubeConfig,this.namespace,u).catch(()=>{}),await Zm0(this.kubeConfig,this.namespace,u).catch((Q)=>{console.warn(`[${zJ}] wait for deleted claim ${u} failed: ${Q instanceof Error?Q.message:String(Q)}`)})}let w=await this.provision($,u,f);return this.finish(w,X,!0,!1,"fresh")}async finish($,u,f,X,J){let w=this.records.has($.handle);if(this.records.set($.handle,$),f)await this.persist(u,$);if(X)await xk$(this.kubeConfig,this.namespace,$.handle,this.computeShutdownTime()).catch((E)=>console.warn(`[${zJ}] TTL refresh failed for ${$.handle}: ${E instanceof Error?E.message:String(E)}`));if(this.metrics){let E=cM1($.tenant);if(this.metrics.ensureOutcome.add(1,{...E,outcome:J}),!w)this.metrics.active.add(1,E)}return this.toSandbox($)}buildEnvMap($,u){let f={},X=[];for(let[J,w]of Object.entries($.env??{}))if(SX3.has(J))X.push(J);else f[J]=w;if(X.length>0)console.warn(`[${zJ}] opts.env keys overlap reserved bootstrap names and were dropped: ${X.join(",")}`);return{...f,DAEMON_TOKEN:u.token,DAEMON_BOOT_ID:u.daemonBootId,APP_ROOT:u.workdir,PROXY_PORT:String(w_)}}buildClaim($,u,f){let X=this.sentinelToken!==null,J=X?[]:Object.entries(this.buildEnvMap(u,f)).sort(([w],[E])=>w<E?-1:w>E?1:0).map(([w,E])=>({name:w,value:E}));return{apiVersion:`${U7.CLAIM_API_GROUP}/${U7.CLAIM_API_VERSION}`,kind:"SandboxClaim",metadata:{name:$,namespace:this.namespace,labels:{"app.kubernetes.io/name":"studio-sandbox","app.kubernetes.io/managed-by":"studio",...this.envName?{[fW.env]:this.envName}:{},...lM1(u.tenant)}},spec:{sandboxTemplateRef:{name:this.sandboxTemplateName},additionalPodMetadata:{labels:lM1(u.tenant,{[fW.role]:"claimed",[fW.sandboxHandle]:$,...this.envName?{[fW.env]:this.envName}:{}})},env:J,warmpool:X?"default":"none",lifecycle:{shutdownPolicy:"Delete",shutdownTime:this.computeShutdownTime()}}}}async provision($,u,f){let X=this.tokenGenerator(),J=PX3(),w=iM1,E=this.buildClaim(u,f,{token:X,daemonBootId:J,workdir:w});try{await rJ0(this.kubeConfig,this.namespace,E)}catch(F){if(F instanceof mJ0)await Zm0(this.kubeConfig,this.namespace,u),await rJ0(this.kubeConfig,this.namespace,E);else throw F}let Q;try{Q=await lk$(this.kubeConfig,this.namespace,u),await Fm0(this.kubeConfig,this.namespace,Q)}catch(F){throw await X_(this.kubeConfig,this.namespace,u).catch(()=>{}),F}try{await this.ensureServicePortForAdoptedSandbox(Q),await this.ensureHttpRouteForHandle(u,Q,f.tenant??null)}catch(F){throw await X_(this.kubeConfig,this.namespace,u).catch(()=>{}),F}let Y=await this.openForwarder(Q,w_,u),Z=`http://127.0.0.1:${Y.localPort}`,W=this.workloadConfigPayload(f),G=J;try{if(await jB0(Z),this.sentinelToken!==null){let F=await PB0(Z);if(F)G=F.bootId;await _m(Z,this.sentinelToken,W??{},{rotateToken:X})}else if(W)await _m(Z,X,W)}catch(F){throw this.closeForwarder(Y),await this.deleteHttpRouteIfManaged(u).catch(()=>{}),await X_(this.kubeConfig,this.namespace,u).catch(()=>{}),F}return{id:$,handle:u,adoptedSandboxName:Q,token:X,workdir:w,daemonUrl:Z,daemonForward:Y,workload:f.workload??null,daemonBootId:G,tenant:f.tenant??null,ensureOpts:lX3(f)}}workloadConfigPayload($){return MC1({runtime:$?.workload?.runtime??"node",packageManager:$?.workload?.packageManager?{name:$.workload.packageManager,...$.workload.packageManagerPath?{path:$.workload.packageManagerPath}:{}}:null,repo:$?.repo??null,port:$?.workload?.devPort??AX3})}async rebootstrapDaemon($,u,f){if(this.sentinelToken===null)return!1;try{return await _m($,this.sentinelToken,this.workloadConfigPayload(f)??{},{rotateToken:u}),!0}catch(X){return console.warn(`[${zJ}] re-bootstrap failed: ${X instanceof Error?X.message:String(X)}`),!1}}async ensureServicePortForAdoptedSandbox($){if(!this.previewGateway||!this.previewUrlPattern)return;await rk$(this.kubeConfig,this.namespace,$,{name:"daemon",port:w_,targetPort:w_})}async ensureHttpRouteForHandle($,u,f){if(!this.previewGateway||!this.previewUrlPattern)return;let X=cX3(this.previewUrlPattern,$);if(!X)throw new fX(`Unable to derive preview hostname for ${$} from pattern: ${this.previewUrlPattern}`);let J={apiVersion:`${aJ0.API_GROUP}/${aJ0.API_VERSION}`,kind:"HTTPRoute",metadata:{name:$,namespace:this.namespace,labels:lM1(f??void 0,{[fW.role]:"claimed",[fW.sandboxHandle]:$,"app.kubernetes.io/name":"studio-sandbox","app.kubernetes.io/managed-by":"studio",...this.envName?{[fW.env]:this.envName}:{}})},spec:{parentRefs:[{kind:"Gateway",group:"gateway.networking.k8s.io",name:this.previewGateway.name,namespace:this.previewGateway.namespace}],hostnames:[X],rules:[{backendRefs:[{group:"",kind:"Service",name:u,port:w_}]}]}};await Wm0(this.kubeConfig,this.namespace,J)}async deleteHttpRouteIfManaged($){if(!this.previewGateway)return;await Gm0(this.kubeConfig,this.namespace,$)}async rehydrate($,u,f){let X=f.state;if(!X.adoptedSandboxName&&!X.podName||!X.token)return null;let J=await J_(this.kubeConfig,this.namespace,u).catch(()=>{return});if(!J||!$R$(J))return null;let w=J.status?.sandbox?.name??X.adoptedSandboxName??X.podName??u,E=await this.openAndProbeDaemon(w,u);if(!E)return null;if(X.daemonBootId&&X.daemonBootId!==E.bootId){if(this.sentinelToken!==null){if(!await this.rebootstrapDaemon(E.daemonUrl,X.token,X.ensureOpts??null))return this.closeForwarder(E.daemonForward),null}else console.warn(`[${zJ}] daemon restart detected (handle=${u}): stored bootId=${X.daemonBootId} live bootId=${E.bootId}`);await this.stateStore?.put($,HY,{handle:u,state:{...X,daemonBootId:E.bootId}}).catch((Q)=>console.warn(`[${zJ}] bootId persist failed for ${u}: ${Q instanceof Error?Q.message:String(Q)}`))}return{id:$,handle:u,adoptedSandboxName:w,token:X.token,workdir:X.workdir??iM1,daemonUrl:E.daemonUrl,daemonForward:E.daemonForward,workload:X.workload??null,daemonBootId:E.bootId,tenant:X.tenant??null,ensureOpts:X.ensureOpts??null}}async adopt($,u,f){if(!$R$(f))return null;let X=f.status?.sandbox?.name??u;if(this.sentinelToken!==null)return null;let J=hX3(f);if(!J)return null;let w=await this.openAndProbeDaemon(X,u);if(!w)return null;let E=xX3(f);if(this.previewGateway)await this.ensureServicePortForAdoptedSandbox(X).catch((Q)=>{console.warn(`[${zJ}] Service port backfill failed for ${u}: ${Q instanceof Error?Q.message:String(Q)}`)}),await this.ensureHttpRouteForHandle(u,X,E).catch((Q)=>{console.warn(`[${zJ}] HTTPRoute backfill failed for ${u}: ${Q instanceof Error?Q.message:String(Q)}`)});return{id:$,handle:u,adoptedSandboxName:X,token:J,workdir:iM1,daemonUrl:w.daemonUrl,daemonForward:w.daemonForward,workload:null,daemonBootId:w.bootId,tenant:E,ensureOpts:null}}async openAndProbeDaemon($,u){let f=await this.openForwarder($,w_,u).catch(()=>null);if(!f)return null;let X=`http://127.0.0.1:${f.localPort}`,J=await PB0(X);if(!J)return this.closeForwarder(f),null;return{daemonForward:f,daemonUrl:X,bootId:J.bootId}}async getRecord($){let u=this.records.get($);if(u)return u;if(!this.stateStore)return null;let f=await this.stateStore.getByHandle(HY,$);if(!f)return null;let X=await this.rehydrate(f.id,$,f);if(X)this.records.set($,X);return X}async resurrectByHandle($){if(!this.stateStore)return null;let u=await this.stateStore.getByHandle(HY,$);if(!u)return null;let f=u.state.ensureOpts;if(!f)return null;return await this.ensure(u.id,f),this.records.get($)??null}invalidateRecord($){let u=this.records.get($);if(!u)return;this.records.delete($),this.closeForwarder(u.daemonForward)}recordProxyDuration($,u,f,X,J){if(!this.metrics)return;this.metrics.proxyDurationMs.record(X,{...cM1(f?.tenant??null),source:$,sandbox_handle:f?.handle??J??"",status_code:u||0})}composePreviewUrl($){if(this.previewUrlPattern)return ck0(this.previewUrlPattern,$.handle);return`http://127.0.0.1:${$.daemonForward.localPort}/`}toSandbox($){return{handle:$.handle,workdir:$.workdir,previewUrl:this.composePreviewUrl($)}}async persist($,u){if(!$)return;let f={adoptedSandboxName:u.adoptedSandboxName,token:u.token,workdir:u.workdir,workload:u.workload,daemonBootId:u.daemonBootId,tenant:u.tenant,...u.ensureOpts?{ensureOpts:u.ensureOpts}:{}};await $.put(u.id,HY,{handle:u.handle,state:f})}computeShutdownTime(){return new Date(Date.now()+this.idleTtlMs).toISOString()}openForwarder($,u,f=$){let X=yX3(f,u);return new Promise((J,w)=>{let E=(Q,Y)=>{let Z=fR$.createServer((W)=>this.handleForwardedConnection(W,$,u,f));Z.once("error",(W)=>{if(W.code==="EADDRINUSE"&&Y<CX3){try{Z.close()}catch{}let G=dM1+(Q-dM1+1)%XR$;E(G,Y+1);return}w(W)}),Z.listen(Q,"127.0.0.1",()=>{let W=Z.address();if(!W||typeof W==="string"){Z.close(),w(Error("port-forward listener failed to bind"));return}J({server:Z,localPort:W.port})})};E(X,0)})}handleForwardedConnection($,u,f,X){let J=new jX3,w=null,E=!1,Q=()=>{if(E)return;if(E=!0,J.destroy(),w)try{w.close()}catch{}if(!$.destroyed)$.destroy()};$.pipe(J),$.on("error",Q),$.on("close",Q),this.portForward.portForward(this.namespace,u,[f],$,null,J).then((Y)=>{let Z=typeof Y==="function"?Y():Y;if(!Z){Q();return}if(w=Z,w.on("close",Q),w.on("error",()=>{this.invalidateRecord(X),Q()}),E)try{w.close()}catch{}}).catch((Y)=>{console.warn(`[${zJ}] port-forward to ${u}:${f} failed: ${Y instanceof Error?Y.message:String(Y)}`),this.invalidateRecord(X),Q()})}closeForwarder($){$.server.close((u)=>{if(u)console.warn(`[${zJ}] port-forward close on :${$.localPort} errored: ${u instanceof Error?u.message:String(u)}`)})}close(){if(this.closed)return;this.closed=!0;for(let $ of this.records.values())this.closeForwarder($.daemonForward);this.records.clear()}}function qX3($){return{active:$.createUpDownCounter("studio.sandbox.active",{description:"Active sandbox count, by runner kind and owning org. Cross-checks the cAdvisor-derived count from the cluster \u2014 divergence between the two indicates orphaned claims (mesh deleted but K8s didn't reap) or unattributed pods.",unit:"{sandbox}"}),ensureOutcome:$.createCounter("studio.sandbox.ensure.outcome",{description:"Outcome of each ensure() call: fresh provision, resume from state-store after restart, or adopt of a cluster-side claim mesh didn't know about. Cold-start ratio is the primary input for warm-pool sizing.",unit:"{call}"}),proxyDurationMs:$.createHistogram("studio.sandbox.proxy.duration_ms",{description:"Wall-clock latency of mesh-mediated requests to the sandbox daemon: tool exec proxies (source=daemon) and preview iframe traffic (source=preview).",unit:"ms"})}}function MX3(){let $=new $s;return $.loadFromDefault(),$}function $R$($){return Boolean($.status?.conditions?.some((u)=>u.type==="Ready"&&u.status==="True"))}function hX3($){let u=$.spec?.env;if(!u)return null;for(let f of u)if(f.name==="DAEMON_TOKEN"&&f.value)return f.value;return null}function yX3($,u){let f=HX3("sha256").update(`${$}:${u}`).digest();return dM1+f.readUInt32BE(0)%XR$}function xM1($,u){return new Response(JSON.stringify(u),{status:$,headers:{"content-type":"application/json","access-control-allow-origin":"*"}})}function uR$($){let u=$.slice(0,VX3);return gX3.test(u)?u:""}function iX3($){if($===void 0)return null;let u=$.trim();if(u==="")return null;if(!bX3.test(u))throw Error(`AgentSandboxProvider: envName=${JSON.stringify(u)} is not a valid DNS-label-safe environment name (lowercase alphanumeric or '-', starts with a letter, ends alphanumeric, \u226432 chars). Mesh sets this from STUDIO_ENV; check the studio chart's configMap.`);return u}function lM1($,u={}){let f={...u};if($){let X=uR$($.orgId),J=uR$($.userId);if(X)f[fW.orgId]=X;if(J)f[fW.userId]=J}return f}function xX3($){let u=$.metadata?.labels;if(!u)return null;let f=u[fW.orgId],X=u[fW.userId];if(!f||!X)return null;return{orgId:f,userId:X}}function cM1($){return{org_id:$?.orgId??"",user_id:$?.userId??"",runner_kind:HY}}function lX3($){let u={};if($.repo)u.repo=$.repo;if($.workload)u.workload=$.workload;if($.env&&Object.keys($.env).length>0)u.env=$.env;if($.tenant)u.tenant=$.tenant;return Object.keys(u).length>0?u:null}function cX3($,u){try{return new URL(ck0($,u)).hostname||null}catch{return null}}var HY="cluster",zJ="AgentSandboxProvider",yx="x-sandbox-preview-not-ready",LX3="agent-sandbox-system",TX3="studio-sandbox",w_=9000,AX3=3000,iM1="/app",IX3=32,SX3,kX3=900000,RX3,ek$,dM1=40000,XR$=1e4,CX3=256,fW,gX3,VX3=63,bX3;var JR$=U(()=>{SM1();l91();dk0();Bm0();nJ0();sk$();SX3=new Set(["DAEMON_TOKEN","DAEMON_BOOT_ID","APP_ROOT","PROXY_PORT"]),RX3=["cookie","host","connection","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","accept-encoding","content-length","upgrade"],ek$=["connection","keep-alive","transfer-encoding","content-encoding","content-length"];fW={role:"studio.decocms.com/role",sandboxHandle:"studio.decocms.com/sandbox-handle",orgId:"studio.decocms.com/org-id",userId:"studio.decocms.com/user-id",env:"studio.decocms.com/env"},gX3=/^([A-Za-z0-9]([-A-Za-z0-9_.]*[A-Za-z0-9])?)?$/;bX3=/^[a-z]([a-z0-9-]{0,30}[a-z0-9])?$/});var wR$={};Y1(wR$,{waitForSandboxReady:()=>Fm0,getSandboxClaim:()=>J_,getHttpRoute:()=>tk$,deleteSandboxClaim:()=>X_,deleteHttpRoute:()=>Gm0,createSandboxClaim:()=>rJ0,createHttpRoute:()=>Wm0,SandboxTimeoutError:()=>Mx,SandboxError:()=>fX,PREVIEW_NOT_READY_HEADER:()=>yx,KubeConfig:()=>$s,K8S_CONSTANTS:()=>U7,HTTPROUTE_CONSTANTS:()=>aJ0,AgentSandboxProvider:()=>mM1});var nM1=U(()=>{SM1();nJ0();Bm0();JR$()});class vm0{kind=E_;userSub;dispatch;stateStore;records=new Map;constructor($){if(!$.userSub)throw Error("DesktopSandboxProvider requires userSub");if(!$.dispatch)throw Error("DesktopSandboxProvider requires dispatch");this.userSub=$.userSub,this.dispatch=$.dispatch,this.stateStore=$.stateStore??null}async ensure($,u={}){let f=u.branch??u.repo?.branch,X=dH($,f),J=this.records.get(X);if(J){if(await this.probeHealth(X))return this.toSandbox(J);if(this.records.delete(X),this.stateStore)await this.stateStore.deleteByHandle(E_,X).catch(()=>{})}else if(this.stateStore){let G=(await this.stateStore.getByHandle(E_,X))?.state,F=G?.sandboxApiUrl;if(F){if(await this.probeHealth(X)){let B={handle:X,sandboxApiUrl:F,previewUrl:G?.previewUrl??F};return this.records.set(X,B),this.toSandbox(B)}await this.stateStore.deleteByHandle(E_,X).catch(()=>{})}}let w=JSON.stringify({handle:X,repo:u.repo,branch:f,...u.workload?{workload:u.workload}:{},...u.offloadAllowedHosts?{offloadAllowedHosts:u.offloadAllowedHosts}:{},...u.offloadAllowSameHostDev!==void 0?{offloadAllowSameHostDev:u.offloadAllowSameHostDev}:{}}),E=await this.dispatchJson("POST","/api/sandboxes",w),Q=JSON.parse(E);if(typeof Q.sandboxApiUrl!=="string")throw Error("desktop ensure: daemon did not return a sandboxApiUrl string");let Y=typeof Q.previewUrl==="string"?Q.previewUrl:Q.sandboxApiUrl,Z={handle:X,sandboxApiUrl:Q.sandboxApiUrl,previewUrl:Y};if(this.records.set(X,Z),this.stateStore)await this.stateStore.put($,E_,{handle:X,state:{handle:X,sandboxApiUrl:Q.sandboxApiUrl,previewUrl:Y}});return this.toSandbox(Z)}async proxyDaemonRequest($,u,f){let X=u.startsWith("/")?u:`/${u}`,J=X.startsWith("/_sandbox/")?X.slice(9):X,w=`/_sandbox/${encodeURIComponent($)}${J}`,E=new Headers(f.headers);for(let z of["host","cookie","connection","keep-alive","transfer-encoding","upgrade","authorization"])E.delete(z);let Q={};E.forEach((z,H)=>{Q[H]=z});let Y;if(f.body!=null)Y=await dX3(f.body);let W=this.dispatch(this.userSub,{method:f.method,path:w,headers:Q,body:Y},{signal:f.signal})[Symbol.asyncIterator](),G=200,F={"content-type":"application/octet-stream"},B=[];try{while(!0){let z=await W.next();if(z.done)break;let H=z.value;if(H.headers){G=H.headers.status,F=H.headers.headers;break}if(H.data!=null)B.push(H.data)}}catch(z){let H=z instanceof Error?z.message:"dispatch error";return new Response(JSON.stringify({error:H}),{status:502,headers:{"content-type":"application/json"}})}let v=!1,N=new TextEncoder,O=new ReadableStream({async start(z){for(let H of B)z.enqueue(N.encode(H))},async pull(z){try{let H=await W.next();if(v)return;if(H.done){z.close();return}let _=H.value;if(_.data!=null)z.enqueue(N.encode(_.data))}catch(H){if(!v)z.error(H)}},cancel(){v=!0,W.return?.()}});return new Response(O,{status:G,headers:F})}async alive($){return this.probeHealth($)}async probeHealth($){let u=new AbortController,f=setTimeout(()=>u.abort(),1500);try{return await this.dispatchJson("GET",`/api/sandboxes/${encodeURIComponent($)}`,void 0,u.signal),!0}catch{return!1}finally{clearTimeout(f)}}async forgetHandle($){if(this.records.delete($),this.stateStore)await this.stateStore.deleteByHandle(E_,$).catch(()=>{})}async delete($){if(this.records.delete($),this.stateStore)await this.stateStore.deleteByHandle(E_,$).catch(()=>{});try{await this.dispatchJson("DELETE",`/api/sandboxes/${encodeURIComponent($)}`)}catch(u){if(!(u instanceof Error?u.message:String(u)).includes("404"))throw u}}async getPreviewUrl($){return(await this.resolveRecord($))?.previewUrl??null}async localWorkdir($){return null}async*watchClaimLifecycle($,u){yield{kind:"ready"}}toSandbox($){return{handle:$.handle,workdir:$.sandboxApiUrl,previewUrl:$.previewUrl}}async resolveRecord($){let u=this.records.get($);if(u)return u;if(!this.stateStore)return null;let X=(await this.stateStore.getByHandle(E_,$))?.state,J=X?.sandboxApiUrl;if(!J)return null;let w={handle:$,sandboxApiUrl:J,previewUrl:X?.previewUrl??J};return this.records.set($,w),w}async dispatchJson($,u,f,X){let J={accept:"application/json"};if(f!==void 0)J["content-type"]="application/json";let w=this.dispatch(this.userSub,{method:$,path:u,headers:J,body:f},{signal:X}),E=null,Q="";for await(let Y of w)if(Y.headers)E=Y.headers.status;else if(Y.data!=null)Q+=Y.data;if(E!=null&&(E<200||E>=300))throw Error(`daemon returned ${E}: ${Q}`);return Q}}function ER$($){return new vm0($)}async function dX3($){if(typeof $==="string")return $;if($ instanceof ArrayBuffer)return Buffer.from($).toString("utf8");if(ArrayBuffer.isView($))return Buffer.from($.buffer,$.byteOffset,$.byteLength).toString("utf8");if($ instanceof URLSearchParams)return $.toString();return await new Response($).text()}var E_="user-desktop";var QR$=U(()=>{dk0()});var YR$={};Y1(YR$,{createDesktopProvider:()=>ER$,DesktopSandboxProvider:()=>vm0});var DR$=U(()=>{QR$()});var vR$={};Y1(vR$,{subscribeLifecycle:()=>oJ0,getSandboxProviderByKind:()=>pJ0,getOrInitSharedRunner:()=>sX3,buildDesktopProvider:()=>ws,__resetSharedLifecyclesForTesting:()=>X73});function FR$($,u){let f=ZR$[$];if(f)return Promise.resolve(f);let X=tM1[$];if(X)return X;let J=u().then((w)=>{return ZR$[$]=w,w}).finally(()=>{delete tM1[$]});return tM1[$]=J,J}function tX3(){let $=process.env.STUDIO_SANDBOX_PREVIEW_URL_PATTERN;return $&&$.trim()!==""?$:void 0}function rX3(){let $=process.env.STUDIO_SANDBOX_TEMPLATE_NAME;return $&&$.trim()!==""?$:void 0}function aX3(){let $=process.env.STUDIO_ENV;return $&&$.trim()!==""?$:void 0}function pX3(){let $=process.env.STUDIO_SANDBOX_SENTINEL_TOKEN;return $&&$.trim()!==""?$:void 0}function oX3(){let $=process.env.STUDIO_SANDBOX_PREVIEW_GATEWAY_NAME?.trim(),u=process.env.STUDIO_SANDBOX_PREVIEW_GATEWAY_NAMESPACE?.trim();if(!$&&!u)return;if(!$||!u)throw Error("STUDIO_SANDBOX_PREVIEW_GATEWAY_NAME and STUDIO_SANDBOX_PREVIEW_GATEWAY_NAMESPACE must both be set, or both unset. Half-configured per-claim HTTPRoute routing would silently fail to attach.");return{name:$,namespace:u}}async function BR$($,u){let f=new nH(u),X=tX3();switch($){case"cluster":{let{AgentSandboxProvider:J}=await Promise.resolve().then(() => (nM1(),wR$));return new J({stateStore:f,previewUrlPattern:X,sandboxTemplateName:rX3(),envName:aX3(),previewGateway:oX3(),sentinelToken:pX3(),meter:IQ})}case"user-desktop":throw Error("user-desktop runner cannot be instantiated without a per-run link claim \u2014 call resolveSandboxProvider, which binds the link before constructing the provider.");default:throw Error(`Unknown runner kind: ${String($)}`)}}async function ws($,u){let{DesktopSandboxProvider:f}=await Promise.resolve().then(() => (DR$(),YR$)),{getDispatch:X}=await Promise.resolve().then(() => (aM1(),rM1)),J=new nH($.db);if(!u)throw Error("buildDesktopProvider: userSub must be a non-empty string");return new f({userSub:u,dispatch:X(),stateStore:J})}function pJ0($,u){return FR$(u,()=>BR$(u,$.db))}async function sX3(){let $;try{$=zF()}catch(f){return console.warn("[lifecycle] cannot resolve sandbox runner:",f instanceof Error?f.message:String(f)),null}return await FR$($,()=>BR$($,l6().db))}function oJ0($,u,f){let X=Q_.get(u);if(X){if(X.terminated){if(X.lastPhase)try{f(X.lastPhase)}catch{}return{unsubscribe:u73}}if(X.listeners.add(f),X.lastPhase)try{f(X.lastPhase)}catch{}return WR$(u,X,f)}let J=new AbortController,w={lastPhase:null,terminated:!1,listeners:new Set([f]),abort:J};return Q_.set(u,w),f73($,u,w),WR$(u,w,f)}function u73(){}function WR$($,u,f){return{unsubscribe(){if(Q_.get($)!==u)return;if(u.listeners.delete(f),u.listeners.size===0)Q_.delete($),u.abort.abort()}}}async function f73($,u,f){let X=null;try{for await(let J of $.watchClaimLifecycle(u,f.abort.signal)){if(f.abort.signal.aborted)break;f.lastPhase=J;let w=J.kind==="ready"||J.kind==="failed";if(w)f.terminated=!0;let E=Array.from(f.listeners);for(let Q of E)try{Q(J)}catch{}if(w)break}}catch(J){X=J}finally{if(!f.terminated&&!f.abort.signal.aborted&&f.listeners.size>0){let J={kind:"failed",reason:"unknown",message:X instanceof Error?X.message:"Lifecycle watcher ended unexpectedly"};f.lastPhase=J,f.terminated=!0;for(let w of Array.from(f.listeners))try{w(J)}catch{}}if(Q_.get(u)===f)Q_.delete(u)}}function X73(){for(let $ of Q_.values())$.abort.abort();Q_.clear()}var mX3,nX3,GR$,ZR$,tM1,eX3,$73,Q_;var gx=U(()=>{bU();JE();ew();rk0();mX3=Symbol.for("decocms.sandbox.lifecycle.runners"),nX3=Symbol.for("decocms.sandbox.lifecycle.inflight"),GR$=globalThis,ZR$=GR$[mX3]??={},tM1=GR$[nX3]??={};eX3=Symbol.for("decocms.sandbox.lifecycle.shared-lifecycles"),$73=globalThis,Q_=$73[eX3]??=new Map});async function Um0($,u){if(await u.linkClaimRegistry.get($))return"user-desktop";return u.resolveEnvKind()}async function tU($,u){let{userId:f,branch:X,virtualMcpMetadata:J,explicitKind:w}=u;if(w)return{provider:await Nm0($,f,w),kind:w};if($.sandboxPreference==="user-desktop"&&$.linkForCurrentRun)return{provider:await ws($,f),kind:"user-desktop"};if($.sandboxPreference==="cluster-default"){let W=zF();return{provider:await Nm0($,f,W),kind:W}}let[E,...Q]=J73(J,f,X);if(E){let W=Q.length===0?E:await w73($,f,E,Q);return{provider:await Nm0($,f,W),kind:W}}let Y=await UR$($,f);return{provider:await Nm0($,f,Y),kind:Y}}function J73($,u,f){let X=u2($)[u]?.[f];if(!X)return[];let J=hv(X);return Object.keys(J)}async function w73($,u,f,X){let J=await UR$($,u);if(J===f||X.includes(J))return J;return f}async function UR$($,u){if(!$.linkClaimRegistry)return zF();return Um0(u,{linkClaimRegistry:$.linkClaimRegistry,resolveEnvKind:zF})}async function Nm0($,u,f){if(f!=="user-desktop")return pJ0($,f);if(!$.linkClaimRegistry)throw Error("user-desktop sandbox provider requires ctx.linkClaimRegistry to be wired (set on MeshContextConfig).");if(!await $.linkClaimRegistry.get(u))throw Error(`No link daemon registered for user "${u}". Start one with \`deco link\` (or run \`bun run dev --local-sandbox-provider\` for dev).`);return ws($,u)}var sJ0=U(()=>{iu();bU();iU();gx()});async function NR$($,u){if(!$)return{hosts:[],allowSameHostDev:!1};let f;try{f=await $.presignedGetUrl("link-dispatch/_allowlist_probe",60,{requireFetchable:!0})}catch{return{hosts:[],allowSameHostDev:!1}}let X;try{X=new URL(f)}catch{return{hosts:[],allowSameHostDev:!1}}if(X.protocol!=="https:"&&X.protocol!=="http:")return{hosts:[],allowSameHostDev:!1};let J=X.hostname,w=E73.has(J);return{hosts:[J],allowSameHostDev:w&&!u.isProduction}}var E73;var OR$=U(()=>{E73=new Set(["127.0.0.1","localhost","::1","[::1]","0.0.0.0"])});async function Om0($,u){X1(u);let f=r0(u),X=G$(u);if(!X)throw Error("User ID required");let J=await u.storage.virtualMcps.findById($.virtualMcpId);if(!J||J.organization_id!==f.id)throw Error("Virtual MCP not found");let w=J.metadata??{},E=mH(u2(w),X,$.branch,$.sandboxProviderKind),Q=$.sandboxProviderKind,{provider:Y}=await tU(u,{userId:X,branch:$.branch,virtualMcpMetadata:w,explicitKind:Q});if(E){if(Q!=="user-desktop")return E;if(await Y.alive(E.sandboxHandle).catch(()=>!1))return E;await lo(u.storage.virtualMcps,$.virtualMcpId,X,X,$.branch,Q).catch((F)=>{console.warn("[ensureSandbox] failed to reap stale user-desktop entry",F)})}let Z=w.githubRepo??null,{entry:W}=await zR$({ctx:u,userId:X,orgId:f.id,virtualMcpId:$.virtualMcpId,branch:$.branch,metadata:w,githubRepo:Z,existing:null,providerKind:Q,runner:Y});return W}async function zR$($){let{ctx:u,userId:f,orgId:X,virtualMcpId:J,branch:w,metadata:E,githubRepo:Q,existing:Y,runner:Z}=$,{runtime:W,packageManager:G,port:F,packageManagerPath:B}=$j$(E),v;if(Q){let{cloneUrl:h,gitUserName:i,gitUserEmail:l}=Q.connectionId?await fj$(Q.connectionId,Q.owner,Q.name,u.db,u.vault):uj$(Q.owner,Q.name);if(!G){let M=Q.connectionId?await Ej$(Q.connectionId,Q.owner,Q.name,u.db,u.vault):await Qj$(Q.owner,Q.name);if(M)G=M.packageManager,W=TJ0[M.packageManager].runtime,F=M.devPort??F,await Q73(u,J,f,M.packageManager,M.devPort)}v={cloneUrl:h,userName:i,userEmail:l,branch:w,displayName:`${Q.owner}/${Q.name}`}}let N=W&&G?{runtime:W,packageManager:G,...F!==null?{devPort:Number(F)}:{},...B?{packageManagerPath:B}:{}}:void 0,O=EI({orgId:X,virtualMcpId:J,branch:w}),z=Z.kind==="user-desktop"?await NR$(u.objectStorage,{isProduction:g4().nodeEnv==="production"}):null,H=await Z.ensure({userId:f,projectRef:O},{branch:w,repo:v,workload:N,tenant:{orgId:X,userId:f},...z?{offloadAllowedHosts:z.hosts,offloadAllowSameHostDev:z.allowSameHostDev}:{}}),_=E.runtime?.env??null;await tk0({ctx:u,runner:Z,handle:H.handle,orgId:X,userId:f,entries:_});let j=!!Y&&Y.sandboxHandle===H.handle&&Y?.createdAt?Y.createdAt:Date.now(),I=E.runtime?.selected??null,k=E.runtime?.port??null,S=E.runtime?.path??null,q={sandboxHandle:H.handle,previewUrl:H.previewUrl,sandboxApiUrl:H.previewUrl,sandboxProviderKind:Z.kind,createdAt:j,startedWith:{packageManager:I,port:k,path:S}};await sP$(u.storage.virtualMcps,J,f,f,w,$.providerKind,q);let y=!Y||Y.sandboxHandle!==H.handle;return{entry:q,isNewVm:y}}async function Q73($,u,f,X,J){let w=await $.storage.virtualMcps.findById(u);if(!w)return;let E=w.metadata??{};await $.storage.virtualMcps.update(u,f,{metadata:{...E,runtime:{selected:X,port:J}}})}var pM1;var zm0=U(()=>{c0();bU();C1();nk0();yC1();iU();Xj$();Dj$();fk1();hC1();sJ0();OR$();$5();iU();pM1=y0({name:"SANDBOX_START",description:"Start a sandbox with the connected GitHub repo and dev server.",annotations:{title:"Start VM Preview",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!1,openWorldHint:!0},_meta:{ui:{visibility:"app"}},inputSchema:D.object({virtualMcpId:D.string().describe("Virtual MCP ID"),branch:D.string().min(1).optional().describe("Optional git branch to check out. When omitted the handler generates `deco/<adjective>-<noun>` and uses it. The resolved branch is returned in the response so callers can persist it."),sandboxProviderKind:D.enum(["cluster","user-desktop"]).optional().describe("Explicit runtime choice. When omitted, defaults to `user-desktop` if the acting user's link daemon is online, else the cluster env kind.")}),outputSchema:D.object({previewUrl:D.string().nullable(),sandboxHandle:D.string(),branch:D.string(),isNewVm:D.boolean(),sandboxProviderKind:D.enum(["cluster","user-desktop"])}),handler:async($,u)=>{X1(u);let f=$.branch??bS0(),X=G$(u);if(!X)throw Error("User ID required");let{provider:J,kind:w}=await tU(u,{userId:X,branch:f,virtualMcpMetadata:null,explicitKind:$.sandboxProviderKind}),{metadata:E,userId:Q,organization:Y,entry:Z}=await mk0({virtualMcpId:$.virtualMcpId,branch:f,sandboxProviderKind:w},u),W=E.githubRepo??null,{entry:G,isNewVm:F}=await zR$({ctx:u,userId:Q,orgId:Y.id,virtualMcpId:$.virtualMcpId,branch:f,metadata:E,githubRepo:W,existing:Z,providerKind:w,runner:J});return{...G,branch:f,isNewVm:F,sandboxProviderKind:w}}})});var oM1;var KR$=U(()=>{c0();C1();nk0();gx();iU();oM1=y0({name:"SANDBOX_DELETE",description:"Delete a sandbox.",annotations:{title:"Delete VM Preview",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!0},_meta:{ui:{visibility:"app"}},inputSchema:D.object({virtualMcpId:D.string().describe("Virtual MCP ID that owns this VM"),branch:D.string().min(1).describe("Branch whose vm should be deleted (sandboxMap[userId][branch])"),sandboxProviderKind:D.enum(["cluster","user-desktop"]).describe("Kind of sandbox provider the VM was started with. Used to locate the correct 3-level sandboxMap entry.")}),outputSchema:D.object({success:D.boolean()}),handler:async($,u)=>{let f=$.sandboxProviderKind,X;try{X=await mk0($,u)}catch(Q){if(Q instanceof Error&&Q.message==="Virtual MCP not found")return{success:!0};throw Q}let{entry:J,userId:w}=X;if(!J)return{success:!0};return await lo(u.storage.virtualMcps,$.virtualMcpId,w,w,$.branch,f),await(await pJ0(u,f)).delete(J.sandboxHandle).catch((Q)=>console.error(`[SANDBOX_DELETE] ${f} ${J.sandboxHandle}: ${Q instanceof Error?Q.message:String(Q)}`)),{success:!0}}})});var HR$=U(()=>{zm0();KR$()});var D73="https://api.github.com",sM1;var _R$=U(()=>{c0();C1();DA0();kH();sM1=y0({name:"GITHUB_LIST_USER_ORGS",description:"List GitHub App installations (orgs/accounts) accessible to the authenticated user.",annotations:{title:"List GitHub User Orgs",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!0},_meta:{ui:{visibility:"app"}},inputSchema:D.object({connectionId:D.string().describe("ID of the mcp-github connection to use")}),outputSchema:D.object({installations:D.array(D.object({installationId:D.number(),login:D.string(),avatarUrl:D.string(),type:D.string()})),appSlug:D.string().optional()}),handler:async($,u)=>{await u.access.check();let f=new D9(u.db,u.vault),X=await f.get($.connectionId);if(!X)throw Error("No GitHub token found. Ensure the mcp-github connection is authenticated.");let J=X.accessToken;if(wX0(X)&&f.isExpired(X,YA0)){let W=await EX0(X,f);if(!W)throw Error(sT);J=W,X=await f.get($.connectionId)??X}let w=[],E,Q=1,Y=100,Z=async(W)=>fetch(`${D73}/user/installations?per_page=${Y}&page=${Q}`,{headers:{Authorization:`Bearer ${W}`,Accept:"application/vnd.github+json","X-GitHub-Api-Version":"2022-11-28"}});while(!0){let W=await Z(J);if(W.status===401){let F=await f.get($.connectionId);if(!F||!wX0(F))throw Error(sT);let B=await EX0(F,f);if(!B)throw Error(sT);if(J=B,W=await Z(J),W.status===401)throw Error(sT)}if(!W.ok)throw Error(`GitHub /user/installations failed: ${W.status}`);let G=await W.json();for(let F of G.installations){if(!E)E=F.app_slug??F.app?.slug;w.push({installationId:F.id,login:F.account.login,avatarUrl:F.account.avatar_url,type:F.account.type})}if(G.installations.length<Y)break;Q++}return{installations:w,...E?{appSlug:E}:{}}}})});var PR$=U(()=>{_R$()});var jR$=()=>{};var eM1=U(()=>{jR$();$Y1()});var $h1;var LR$=U(()=>{c0();eM1();C1();$h1=y0({name:"LINK_CURRENT_GET",description:"Return the calling user's currently registered desktop link, or `online: false` if no link is registered or the TTL has expired.",inputSchema:s0.object({}),outputSchema:s0.object({online:s0.boolean(),machineId:s0.string().optional(),hostname:s0.string().optional(),cliVersion:s0.string().optional(),capabilities:s0.array(eQ1).default([])}),handler:async($,u)=>{X1(u),await u.access.check();let f=u.linkClaimRegistry;if(!f)return{online:!1,capabilities:[]};let X=await f.get(u.auth.user.id);if(!X)return{online:!1,capabilities:[]};return{online:!0,machineId:X.machineId,hostname:X.hostname,cliVersion:X.cliVersion,capabilities:X.capabilities}}})});var TR$=U(()=>{LR$()});function AR$($){if(!$)return"";return typeof $==="string"?$:$.toISOString()}var F73,B73,v73,U73,N73,uh1;var IR$=U(()=>{c0();C1();F73=["thread"],B73=D.object({type:D.literal("thread"),id:D.string(),title:D.string(),created_at:D.string(),updated_at:D.string(),virtual_mcp_id:D.string().nullable(),run_config:D.record(D.string(),D.unknown()).nullable(),status:D.string().nullable()}),v73=D.discriminatedUnion("type",[B73]),U73=D.object({query:D.string().min(1).describe("Free-text search query."),limit:D.number().int().min(1).max(50).optional().describe("Maximum results per resource type (default: 20)."),types:D.array(D.enum(F73)).optional().describe("Restrict the search to specific resource types. Omit to search across all available types.")}),N73=D.object({items:D.array(v73),totalCount:D.number()});uh1=y0({name:"GLOBAL_SEARCH",description:"Search across organization resources by free-text query. Returns a typed union of matches (currently: threads). New resource types may be added over time without changes to the call shape.",annotations:{title:"Global Search",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:U73,outputSchema:N73,handler:async($,u)=>{await u.access.check(),r0(u);let f=$.limit??20,X=$.types?.length?new Set($.types):null,J=!X||X.has("thread"),w=[],E=0;if(J){let{threads:Q,total:Y}=await u.storage.threads.list(void 0,{limit:f,offset:0,search:$.query,includeArchived:!1});E+=Y;for(let Z of Q)w.push({type:"thread",id:Z.id,title:Z.title??"",created_at:AR$(Z.created_at),updated_at:AR$(Z.updated_at),virtual_mcp_id:Z.virtual_mcp_id??null,run_config:Z.run_config??null,status:Z.status??null})}return{items:w,totalCount:E}}})});var SR$=U(()=>{IR$()});var MS0={};Y1(MS0,{managementMCP:()=>Ao,listManagementTools:()=>H73,ALL_TOOLS:()=>kR$});async function H73($){let u=await Ao($),[f,X]=H80.createLinkedPair();await u.connect(X);let J=new m8({name:"tools-hydration",version:"1.0.0"});try{return await J.connect(f),(await J.listTools()).tools}finally{await J.close().catch(()=>{})}}var z73,K73,kR$,Ao=async($)=>{let u=null;if($.organization){let E=await $.storage.organizationSettings.get($.organization.id),Q=await $.storage.virtualMcps.list($.organization.id),Y=new Set(E?.enabled_plugins??[]);for(let Z of Q){let W=Z.metadata?.enabled_plugins;if(W&&Array.isArray(W))for(let G of W)Y.add(G)}u=Y.size>0?[...Y]:null}let f=N1$(kR$,u),X=new gv({name:"mcp-cms-management",version:"1.0.0"},{capabilities:{tools:{},prompts:{},resources:{}}});for(let E of f){let Q=E.inputSchema&&typeof E.inputSchema==="object"&&"shape"in E.inputSchema?E.inputSchema:D.object({}),Y=E.outputSchema&&typeof E.outputSchema==="object"&&"shape"in E.outputSchema?E.outputSchema:void 0,Z=Q.shape,W=Y?.shape;X.registerTool(E.name,{description:E.description??"",inputSchema:Z,outputSchema:W,annotations:E.annotations,_meta:E._meta},async(G)=>{$.access.setToolName(E.name);try{let F=await E.execute(G,$);return{content:[{type:"text",text:E.modelSummary?E.modelSummary(F):JSON.stringify(F)}],structuredContent:F}}catch(F){return{content:[{type:"text",text:`Error: ${F.message}`}],isError:!0}}})}let J=Zk0();for(let E of J){let Q=E.arguments?.length?Object.fromEntries(E.arguments.map((Y)=>{let Z=Y.required?D.string():D.string().optional();return[Y.name,Y.description?Z.describe(Y.description):Z]})):void 0;X.registerPrompt(E.name,{title:E.title,description:E.description,...Q?{argsSchema:Q}:{}},(Y)=>{return{messages:[{role:"user",content:{type:"text",text:typeof E.text==="function"?E.text(Y??{}):E.text}}]}})}if($.organization?.id){let E=await $.storage.brandContext.list($.organization.id),Q=new Set;for(let Y of E){let Z=Y.name.toLowerCase().replace(/[^a-z0-9]+/g,"-").replace(/^-|-$/g,""),W=Z?`brand-${Z}`:`brand-${Y.id}`;if(Q.has(W))W=`${W}-${Y.id.slice(0,8)}`;Q.add(W);let G=[`# Brand: ${Y.name}`,"",`**Domain:** ${Y.domain}`,"","## Overview",Y.overview];if(Y.colors){let B=Object.entries(Y.colors).filter(([,v])=>v);if(B.length>0){G.push("","## Colors");for(let[v,N]of B)G.push(`- **${v}:** ${N}`)}}if(Y.fonts){let B=Object.entries(Y.fonts).filter(([,v])=>v);if(B.length>0){G.push("","## Fonts");for(let[v,N]of B)G.push(`- ${N} (${v})`)}}if(Y.logo)G.push("",`**Logo:** ${Y.logo}`);if(Y.favicon)G.push(`**Favicon:** ${Y.favicon}`);if(Y.ogImage)G.push(`**OG Image:** ${Y.ogImage}`);if(Y.images&&Y.images.length>0){G.push("","## Images");for(let B of Y.images){let v=Object.entries(B).map(([N,O])=>`${N}: ${O}`).join(", ");G.push(`- ${v}`)}}let F=G.join(`
+`))>=0){let Y=X.slice(0,Q).trim();if(X=X.slice(Q+1),!Y)continue;yield JSON.parse(Y)}}let J=X.trim();if(J)yield JSON.parse(J)}finally{u.releaseLock()}}var RM1,ik$,ck$="gateway.networking.k8s.io",dk$="v1",hM1="httproutes",mk$,aJ0,FX3="mesh-sandbox-runner";var Bm0=U(()=>{nJ0();RM1=class RM1 extends Error{status;body;constructor($,u,f){super(f);this.status=$;this.body=u;this.name="KubeHttpError"}};ik$=`/apis/${U7.CLAIM_API_GROUP}/${U7.CLAIM_API_VERSION}/namespaces`;mk$=`/apis/${ck$}/${dk$}/namespaces`;aJ0={API_GROUP:ck$,API_VERSION:dk$,PLURAL:hM1}});async function*ok$($){let u=$.now??(()=>Date.now()),f=u(),X=$.schedulingTimeoutMs??UX3,J={pod:{},sandbox:{},events:{hasPulling:!1,hasPulled:!1},startedAt:f},w=[],E=null,Q=!1,Y=(H)=>{if(Q)return;if(E){let _=E;E=null,_(H)}else w.push(H)},Z=()=>{if(w.length>0)return Promise.resolve(w.shift());if(Q)return Promise.resolve(null);return new Promise((H)=>{E=H})},W=()=>{if(Q)return;if(Q=!0,E){let H=E;E=null,H(null)}},G=new AbortController,F=()=>{G.abort(),W()};if($.signal)if($.signal.aborted)G.abort(),W();else $.signal.addEventListener("abort",F,{once:!0});let B=Math.max(0,X-(u()-f)),v=setTimeout(()=>Y("tick"),B+100),N,O=new Promise((H)=>{N=H}),z=Promise.allSettled([NX3($.kc,$.namespace,$.claimName,G.signal,J,Y,u,N),zX3($.kc,$.namespace,$.claimName,G.signal,J,Y),KX3($.kc,$.namespace,$.claimName,O,G.signal,J,Y,u)]);try{let H=null,_=-1,T=ak$(J,X,u);if(H=VM1(T),!gM1(T))_=pk$(T);if(yield T,gM1(T))return;while(!Q){if(await Z()===null)break;let I=ak$(J,X,u);if(gM1(I)){let q=VM1(I);if(q!==H)H=q,yield I;return}let k=pk$(I);if(k<_)continue;let S=VM1(I);if(S!==H)H=S,_=k,yield I}}finally{if(clearTimeout(v),G.abort(),$.signal)$.signal.removeEventListener("abort",F);W(),await z.catch(()=>{})}}function ak$($,u,f){let{pod:X,sandbox:J,events:w,startedAt:E}=$;if(J.ready)return{kind:"ready"};let Q=X.containerWaitingReason;if(Q==="ImagePullBackOff"||Q==="ErrImagePull")return{kind:"failed",reason:"image-pull-backoff",message:"Sandbox image failed to download. The cluster may be missing pull credentials or the image tag may not exist."};if(Q==="CrashLoopBackOff")return{kind:"failed",reason:"crash-loop-backoff",message:"Sandbox crashed during startup and is now in CrashLoopBackOff. Check pod logs."};if(!X.scheduled&&w.lastFailedSchedulingAt!==void 0&&f()-E>u)return{kind:"failed",reason:"scheduling-timeout",message:w.failedSchedulingMessage??`Pod could not be scheduled within ${Math.round(u/1000)}s.`};if(X.containerRunning&&!X.containerReady)return{kind:"warming-daemon",since:E};if(w.hasPulling&&!w.hasPulled)return{kind:"pulling-image",since:E};if(Q==="ContainerCreating"||Q==="PodInitializing"||X.scheduled&&!X.containerRunning)return{kind:"starting-container",since:E};if(X.scheduledFalseReason==="Unschedulable"||w.lastFailedSchedulingAt!==void 0&&!X.scheduled)return{kind:"waiting-for-capacity",since:E,message:w.failedSchedulingMessage??X.scheduledFalseMessage,nodeClaim:w.nominatedNodeClaim};return{kind:"claiming",since:E}}function gM1($){return $.kind==="ready"||$.kind==="failed"}function pk$($){switch($.kind){case"claiming":return 0;case"waiting-for-capacity":return 1;case"pulling-image":return 2;case"starting-container":return 3;case"warming-daemon":return 4;case"ready":case"failed":return 99}}function VM1($){switch($.kind){case"claiming":case"pulling-image":case"starting-container":case"warming-daemon":return $.kind;case"waiting-for-capacity":return`waiting-for-capacity:${$.message??""}:${$.nodeClaim??""}`;case"ready":return"ready";case"failed":return`failed:${$.reason}:${$.message}`}}async function NX3($,u,f,X,J,w,E,Q){let Y=`/api/v1/namespaces/${encodeURIComponent(u)}/pods?watch=true&labelSelector=${encodeURIComponent(`${BX3}=${f}`)}`;return bM1({kc:$,path:Y,signal:X,label:`pod/${f}`,onEvent:(Z)=>{if(Z.type!=="ADDED"&&Z.type!=="MODIFIED")return;let W=Z.object;if(W.metadata?.name)Q(W.metadata.name);OX3(W,J,E),w("pod")}})}function OX3($,u,f){let J=($.status?.conditions??[]).find((E)=>E.type==="PodScheduled");if(J?.status==="True")u.pod.scheduled=!0,u.pod.scheduledFalseReason=void 0,u.pod.scheduledFalseMessage=void 0;else if(J?.status==="False")u.pod.scheduled=!1,u.pod.scheduledFalseReason=J.reason,u.pod.scheduledFalseMessage=J.message;let w=($.status?.containerStatuses??[]).find((E)=>E.name===vX3);if(w)u.pod.containerWaitingReason=w.state?.waiting?.reason,u.pod.containerRunning=!!w.state?.running,u.pod.containerReady=w.ready===!0}async function zX3($,u,f,X,J,w){let E=`/apis/${U7.CLAIM_API_GROUP}/${U7.CLAIM_API_VERSION}/namespaces/${encodeURIComponent(u)}/${U7.CLAIM_PLURAL}?watch=true&fieldSelector=${encodeURIComponent(`metadata.name=${f}`)}`;return bM1({kc:$,path:E,signal:X,label:`sandboxclaim/${f}`,onEvent:(Q)=>{if(Q.type!=="ADDED"&&Q.type!=="MODIFIED")return;let Z=Q.object.status?.conditions?.find((W)=>W.type==="Ready");if(!Z)return;if(Z.status==="True")J.sandbox.ready=!0,J.sandbox.notReadyReason=void 0,J.sandbox.notReadyMessage=void 0;else J.sandbox.ready=!1,J.sandbox.notReadyReason=Z.reason,J.sandbox.notReadyMessage=Z.message;w("sandbox")}})}async function KX3($,u,f,X,J,w,E,Q){let Y=await Promise.race([X,new Promise((W)=>{if(J.aborted){W(f);return}J.addEventListener("abort",()=>W(f),{once:!0})})]);if(J.aborted)return;let Z=`/api/v1/namespaces/${encodeURIComponent(u)}/events?watch=true&fieldSelector=${encodeURIComponent(`involvedObject.name=${Y},involvedObject.kind=Pod`)}`;return bM1({kc:$,path:Z,signal:J,label:`events/${f}`,onEvent:(W)=>{if(W.type!=="ADDED"&&W.type!=="MODIFIED")return;let G=W.object,F=G.reason;if(!F)return;switch(F){case"Pulling":w.events.hasPulling=!0;break;case"Pulled":w.events.hasPulling=!0,w.events.hasPulled=!0;break;case"FailedScheduling":w.events.lastFailedSchedulingAt=Q(),w.events.failedSchedulingMessage=G.message;break;case"Nominated":{let B=G.message?.match(/nodeclaim\/([\w-]+)/);if(B)w.events.nominatedNodeClaim=B[1];break}default:return}E("event")}})}async function bM1($){let{kc:u,path:f,signal:X,label:J,onEvent:w}=$,E=0;while(!X.aborted){try{let Y=await hx(u,{method:"GET",path:f,signal:X,headers:{accept:"application/json"}});if(!Y.ok||!Y.body){try{await Y.body?.cancel()}catch{}throw Error(`watch handshake failed: ${Y.status} ${Y.statusText}`)}E=0;for await(let Z of yM1(Y.body)){if(X.aborted)return;try{w(Z)}catch(W){console.warn(`[lifecycle-watcher] ${J} onEvent threw: ${W instanceof Error?W.message:String(W)}`)}}}catch(Y){if(X.aborted)return;let Z=Y instanceof Error?Y.message:String(Y);console.warn(`[lifecycle-watcher] ${J} watch ended: ${Z}`)}if(X.aborted)return;let Q=PJ(5000,250,E,2,0);E+=1,await k3(Q,{signal:X}).catch(()=>{})}}var BX3="studio.decocms.com/sandbox-handle",vX3="sandbox",UX3=300000;var sk$=U(()=>{bw();nJ0();Bm0()});import{createHash as HX3,randomBytes as _X3,randomUUID as PX3}from"crypto";import*as fR$ from"net";import{PassThrough as jX3}from"stream";class mM1{kind=HY;records=new Map;inflight=new lk0;stateStore;previewUrlPattern;kubeConfig;portForward;namespace;sandboxTemplateName;envName;tokenGenerator;idleTtlMs;metrics;previewGateway;sentinelToken;closed=!1;constructor($={}){this.stateStore=$.stateStore??null,this.previewUrlPattern=$.previewUrlPattern??null,this.kubeConfig=$.kubeConfig??MX3(),this.portForward=new FM1(this.kubeConfig),this.namespace=$.namespace??LX3,this.sandboxTemplateName=$.sandboxTemplateName??TX3,this.envName=iX3($.envName),this.tokenGenerator=$.tokenGenerator??(()=>_X3(IX3).toString("hex")),this.idleTtlMs=$.idleTtlMs??kX3,this.metrics=$.meter?qX3($.meter):null,this.previewGateway=$.previewGateway&&$.previewUrlPattern?{...$.previewGateway}:null;let u=$.sentinelToken?.trim()??"";this.sentinelToken=u.length>0?u:null}async ensure($,u={}){let f=dH($,u.branch??u.repo?.branch??null);return this.inflight.run(f,()=>qC1(this.stateStore,$,HY,(X)=>this.ensureLocked($,f,u,X)))}async delete($){let u=await this.getRecord($);if(this.records.delete($),u)this.closeForwarder(u.daemonForward),this.metrics?.active.add(-1,cM1(u.tenant));if(await this.deleteHttpRouteIfManaged($).catch((f)=>{console.warn(`[${zJ}] HTTPRoute delete failed for ${$}: ${f instanceof Error?f.message:String(f)}`)}),await X_(this.kubeConfig,this.namespace,$),this.stateStore)if(u)await this.stateStore.delete(u.id,HY);else await this.stateStore.deleteByHandle(HY,$)}async alive($){return await J_(this.kubeConfig,this.namespace,$)!==void 0}watchClaimLifecycle($,u){return ok$({kc:this.kubeConfig,namespace:this.namespace,claimName:$,signal:u})}async getPreviewUrl($){let u=await this.getRecord($);if(!u)return null;return this.composePreviewUrl(u)}async proxyDaemonRequest($,u,f){let X=await this.getRecord($);if(!X&&this.previewUrlPattern&&this.stateStore){let Q=await this.stateStore.getByHandle(HY,$),Y=Q?.state,Z=Y?.token;if(Q&&Z){let G=`http://${Y?.adoptedSandboxName??$}.${this.namespace}.svc.cluster.local:${w_}`;return LB0(G,Z,u,f)}}if(!X)X=await this.resurrectByHandle($);if(!X)return new Response(JSON.stringify({error:"sandbox not found"}),{status:404,headers:{"content-type":"application/json"}});let J=X,w=performance.now(),E=0;try{let Q=await LB0(X.daemonUrl,X.token,u,f);if(Q.status===401&&!(f.body instanceof ReadableStream)){this.invalidateRecord($);let Y=await this.getRecord($).catch(()=>null);if(Y)J=Y,Q=await LB0(Y.daemonUrl,Y.token,u,f)}return E=Q.status,Q}finally{this.recordProxyDuration("daemon",E,J,performance.now()-w)}}async resolvePreviewUpstreamUrl($){if(this.previewUrlPattern)return`http://${await this.resolveServiceNameForHandle($)}.${this.namespace}.svc.cluster.local:${w_}`;let u=await this.getRecord($);if(u)return u.daemonUrl;let f=await this.resurrectByHandle($);return f?f.daemonUrl:null}async resolveServiceNameForHandle($){let u=this.records.get($);if(u)return u.adoptedSandboxName;if(this.stateStore){let X=(await this.stateStore.getByHandle(HY,$).catch(()=>null))?.state?.adoptedSandboxName;if(X)return X}return $}async proxyPreviewRequest($,u){let f=performance.now(),X=this.records.get($)??null,J=0;try{let w=await this.resolvePreviewUpstreamUrl($);if(!w){J=404;let v=xM1(404,{error:"sandbox not found"});return v.headers.set(yx,"1"),v}let E=new URL(u.url);if((E.pathname==="/_sandbox"||E.pathname.startsWith("/_sandbox/")||E.pathname==="/_decopilot_vm"||E.pathname.startsWith("/_decopilot_vm/"))&&u.method!=="GET")return J=404,xM1(404,{error:"not found"});let Y=(v)=>`${v}${E.pathname}${E.search}`,Z=new Headers(u.headers);for(let v of RX3)Z.delete(v);let W=u.method!=="GET"&&u.method!=="HEAD",G={method:u.method,headers:Z,body:W?u.body:void 0,redirect:"manual",signal:u.signal,duplex:W?"half":void 0},F;try{F=await fetch(Y(w),G)}catch(v){let N=`${w}${E.pathname}`;if(console.warn(`[${zJ}] preview fetch to ${N} failed: ${v instanceof Error?v.message:String(v)}`),u.method==="GET"||u.method==="HEAD"){if(this.invalidateRecord($),await this.resurrectByHandle($).catch(()=>null)){let H=await this.resolvePreviewUpstreamUrl($);if(H)try{F=await fetch(Y(H),G);let _=new Headers;for(let[T,j]of F.headers.entries())if(!ek$.includes(T.toLowerCase()))_.set(T,j);return J=F.status,new Response(F.body,{status:F.status,statusText:F.statusText,headers:_})}catch(_){console.warn(`[${zJ}] preview fetch retry to ${N} failed: ${_ instanceof Error?_.message:String(_)}`)}}}else this.invalidateRecord($);J=502;let O=xM1(502,{error:"sandbox daemon unreachable"});return O.headers.set(yx,"1"),O}let B=new Headers;for(let[v,N]of F.headers.entries())if(!ek$.includes(v.toLowerCase()))B.set(v,N);return J=F.status,new Response(F.body,{status:F.status,statusText:F.statusText,headers:B})}finally{this.recordProxyDuration("preview",J,X,performance.now()-f,$)}}async ensureLocked($,u,f,X){if(f.image)console.warn(`[${zJ}] opts.image ignored (template ${this.sandboxTemplateName} pins image): got ${f.image}`);if(X){let E=await X.get($,HY);if(E){let Q=await this.rehydrate($,u,E);if(Q)return this.finish(Q,X,!1,!0,"resume");await X.delete($,HY)}}let J=await J_(this.kubeConfig,this.namespace,u).catch(()=>{return});if(J)if(J.metadata?.deletionTimestamp)await Zm0(this.kubeConfig,this.namespace,u).catch((E)=>{console.warn(`[${zJ}] wait for terminating claim ${u} failed: ${E instanceof Error?E.message:String(E)}`)});else{let E=await this.adopt($,u,J).catch((Q)=>{return console.warn(`[${zJ}] adopt ${u} failed, recreating: ${Q instanceof Error?Q.message:String(Q)}`),null});if(E)return this.finish(E,X,!0,!0,"adopt");await X_(this.kubeConfig,this.namespace,u).catch(()=>{}),await Zm0(this.kubeConfig,this.namespace,u).catch((Q)=>{console.warn(`[${zJ}] wait for deleted claim ${u} failed: ${Q instanceof Error?Q.message:String(Q)}`)})}let w=await this.provision($,u,f);return this.finish(w,X,!0,!1,"fresh")}async finish($,u,f,X,J){let w=this.records.has($.handle);if(this.records.set($.handle,$),f)await this.persist(u,$);if(X)await xk$(this.kubeConfig,this.namespace,$.handle,this.computeShutdownTime()).catch((E)=>console.warn(`[${zJ}] TTL refresh failed for ${$.handle}: ${E instanceof Error?E.message:String(E)}`));if(this.metrics){let E=cM1($.tenant);if(this.metrics.ensureOutcome.add(1,{...E,outcome:J}),!w)this.metrics.active.add(1,E)}return this.toSandbox($)}buildEnvMap($,u){let f={},X=[];for(let[J,w]of Object.entries($.env??{}))if(SX3.has(J))X.push(J);else f[J]=w;if(X.length>0)console.warn(`[${zJ}] opts.env keys overlap reserved bootstrap names and were dropped: ${X.join(",")}`);return{...f,DAEMON_TOKEN:u.token,DAEMON_BOOT_ID:u.daemonBootId,APP_ROOT:u.workdir,PROXY_PORT:String(w_)}}buildClaim($,u,f){let X=this.sentinelToken!==null,J=X?[]:Object.entries(this.buildEnvMap(u,f)).sort(([w],[E])=>w<E?-1:w>E?1:0).map(([w,E])=>({name:w,value:E}));return{apiVersion:`${U7.CLAIM_API_GROUP}/${U7.CLAIM_API_VERSION}`,kind:"SandboxClaim",metadata:{name:$,namespace:this.namespace,labels:{"app.kubernetes.io/name":"studio-sandbox","app.kubernetes.io/managed-by":"studio",...this.envName?{[fW.env]:this.envName}:{},...lM1(u.tenant)}},spec:{sandboxTemplateRef:{name:this.sandboxTemplateName},additionalPodMetadata:{labels:lM1(u.tenant,{[fW.role]:"claimed",[fW.sandboxHandle]:$,...this.envName?{[fW.env]:this.envName}:{}})},env:J,warmpool:X?"default":"none",lifecycle:{shutdownPolicy:"Delete",shutdownTime:this.computeShutdownTime()}}}}async provision($,u,f){let X=this.tokenGenerator(),J=PX3(),w=iM1,E=this.buildClaim(u,f,{token:X,daemonBootId:J,workdir:w});try{await rJ0(this.kubeConfig,this.namespace,E)}catch(F){if(F instanceof mJ0)await Zm0(this.kubeConfig,this.namespace,u),await rJ0(this.kubeConfig,this.namespace,E);else throw F}let Q;try{Q=await lk$(this.kubeConfig,this.namespace,u),await Fm0(this.kubeConfig,this.namespace,Q)}catch(F){throw await X_(this.kubeConfig,this.namespace,u).catch(()=>{}),F}try{await this.ensureServicePortForAdoptedSandbox(Q),await this.ensureHttpRouteForHandle(u,Q,f.tenant??null)}catch(F){throw await X_(this.kubeConfig,this.namespace,u).catch(()=>{}),F}let Y=await this.openForwarder(Q,w_,u),Z=`http://127.0.0.1:${Y.localPort}`,W=this.workloadConfigPayload(f),G=J;try{if(await jB0(Z),this.sentinelToken!==null){let F=await PB0(Z);if(F)G=F.bootId;await _m(Z,this.sentinelToken,W??{},{rotateToken:X})}else if(W)await _m(Z,X,W)}catch(F){throw this.closeForwarder(Y),await this.deleteHttpRouteIfManaged(u).catch(()=>{}),await X_(this.kubeConfig,this.namespace,u).catch(()=>{}),F}return{id:$,handle:u,adoptedSandboxName:Q,token:X,workdir:w,daemonUrl:Z,daemonForward:Y,workload:f.workload??null,daemonBootId:G,tenant:f.tenant??null,ensureOpts:lX3(f)}}workloadConfigPayload($){return MC1({runtime:$?.workload?.runtime??"node",packageManager:$?.workload?.packageManager?{name:$.workload.packageManager,...$.workload.packageManagerPath?{path:$.workload.packageManagerPath}:{}}:null,repo:$?.repo??null,port:$?.workload?.devPort??AX3})}async rebootstrapDaemon($,u,f){if(this.sentinelToken===null)return!1;try{return await _m($,this.sentinelToken,this.workloadConfigPayload(f)??{},{rotateToken:u}),!0}catch(X){return console.warn(`[${zJ}] re-bootstrap failed: ${X instanceof Error?X.message:String(X)}`),!1}}async ensureServicePortForAdoptedSandbox($){if(!this.previewGateway||!this.previewUrlPattern)return;await rk$(this.kubeConfig,this.namespace,$,{name:"daemon",port:w_,targetPort:w_})}async ensureHttpRouteForHandle($,u,f){if(!this.previewGateway||!this.previewUrlPattern)return;let X=cX3(this.previewUrlPattern,$);if(!X)throw new fX(`Unable to derive preview hostname for ${$} from pattern: ${this.previewUrlPattern}`);let J={apiVersion:`${aJ0.API_GROUP}/${aJ0.API_VERSION}`,kind:"HTTPRoute",metadata:{name:$,namespace:this.namespace,labels:lM1(f??void 0,{[fW.role]:"claimed",[fW.sandboxHandle]:$,"app.kubernetes.io/name":"studio-sandbox","app.kubernetes.io/managed-by":"studio",...this.envName?{[fW.env]:this.envName}:{}})},spec:{parentRefs:[{kind:"Gateway",group:"gateway.networking.k8s.io",name:this.previewGateway.name,namespace:this.previewGateway.namespace}],hostnames:[X],rules:[{backendRefs:[{group:"",kind:"Service",name:u,port:w_}]}]}};await Wm0(this.kubeConfig,this.namespace,J)}async deleteHttpRouteIfManaged($){if(!this.previewGateway)return;await Gm0(this.kubeConfig,this.namespace,$)}async rehydrate($,u,f){let X=f.state;if(!X.adoptedSandboxName&&!X.podName||!X.token)return null;let J=await J_(this.kubeConfig,this.namespace,u).catch(()=>{return});if(!J||!$R$(J))return null;let w=J.status?.sandbox?.name??X.adoptedSandboxName??X.podName??u,E=await this.openAndProbeDaemon(w,u);if(!E)return null;if(X.daemonBootId&&X.daemonBootId!==E.bootId){if(this.sentinelToken!==null){if(!await this.rebootstrapDaemon(E.daemonUrl,X.token,X.ensureOpts??null))return this.closeForwarder(E.daemonForward),null}else console.warn(`[${zJ}] daemon restart detected (handle=${u}): stored bootId=${X.daemonBootId} live bootId=${E.bootId}`);await this.stateStore?.put($,HY,{handle:u,state:{...X,daemonBootId:E.bootId}}).catch((Q)=>console.warn(`[${zJ}] bootId persist failed for ${u}: ${Q instanceof Error?Q.message:String(Q)}`))}return{id:$,handle:u,adoptedSandboxName:w,token:X.token,workdir:X.workdir??iM1,daemonUrl:E.daemonUrl,daemonForward:E.daemonForward,workload:X.workload??null,daemonBootId:E.bootId,tenant:X.tenant??null,ensureOpts:X.ensureOpts??null}}async adopt($,u,f){if(!$R$(f))return null;let X=f.status?.sandbox?.name??u;if(this.sentinelToken!==null)return null;let J=hX3(f);if(!J)return null;let w=await this.openAndProbeDaemon(X,u);if(!w)return null;let E=xX3(f);if(this.previewGateway)await this.ensureServicePortForAdoptedSandbox(X).catch((Q)=>{console.warn(`[${zJ}] Service port backfill failed for ${u}: ${Q instanceof Error?Q.message:String(Q)}`)}),await this.ensureHttpRouteForHandle(u,X,E).catch((Q)=>{console.warn(`[${zJ}] HTTPRoute backfill failed for ${u}: ${Q instanceof Error?Q.message:String(Q)}`)});return{id:$,handle:u,adoptedSandboxName:X,token:J,workdir:iM1,daemonUrl:w.daemonUrl,daemonForward:w.daemonForward,workload:null,daemonBootId:w.bootId,tenant:E,ensureOpts:null}}async openAndProbeDaemon($,u){let f=await this.openForwarder($,w_,u).catch(()=>null);if(!f)return null;let X=`http://127.0.0.1:${f.localPort}`,J=await PB0(X);if(!J)return this.closeForwarder(f),null;return{daemonForward:f,daemonUrl:X,bootId:J.bootId}}async getRecord($){let u=this.records.get($);if(u)return u;if(!this.stateStore)return null;let f=await this.stateStore.getByHandle(HY,$);if(!f)return null;let X=await this.rehydrate(f.id,$,f);if(X)this.records.set($,X);return X}async resurrectByHandle($){if(!this.stateStore)return null;let u=await this.stateStore.getByHandle(HY,$);if(!u)return null;let f=u.state.ensureOpts;if(!f)return null;return await this.ensure(u.id,f),this.records.get($)??null}invalidateRecord($){let u=this.records.get($);if(!u)return;this.records.delete($),this.closeForwarder(u.daemonForward)}recordProxyDuration($,u,f,X,J){if(!this.metrics)return;this.metrics.proxyDurationMs.record(X,{...cM1(f?.tenant??null),source:$,sandbox_handle:f?.handle??J??"",status_code:u||0})}composePreviewUrl($){if(this.previewUrlPattern)return ck0(this.previewUrlPattern,$.handle);return`http://127.0.0.1:${$.daemonForward.localPort}/`}toSandbox($){return{handle:$.handle,workdir:$.workdir,previewUrl:this.composePreviewUrl($)}}async persist($,u){if(!$)return;let f={adoptedSandboxName:u.adoptedSandboxName,token:u.token,workdir:u.workdir,workload:u.workload,daemonBootId:u.daemonBootId,tenant:u.tenant,...u.ensureOpts?{ensureOpts:u.ensureOpts}:{}};await $.put(u.id,HY,{handle:u.handle,state:f})}computeShutdownTime(){return new Date(Date.now()+this.idleTtlMs).toISOString()}openForwarder($,u,f=$){let X=yX3(f,u);return new Promise((J,w)=>{let E=(Q,Y)=>{let Z=fR$.createServer((W)=>this.handleForwardedConnection(W,$,u,f));Z.once("error",(W)=>{if(W.code==="EADDRINUSE"&&Y<CX3){try{Z.close()}catch{}let G=dM1+(Q-dM1+1)%XR$;E(G,Y+1);return}w(W)}),Z.listen(Q,"127.0.0.1",()=>{let W=Z.address();if(!W||typeof W==="string"){Z.close(),w(Error("port-forward listener failed to bind"));return}J({server:Z,localPort:W.port})})};E(X,0)})}handleForwardedConnection($,u,f,X){let J=new jX3,w=null,E=!1,Q=()=>{if(E)return;if(E=!0,J.destroy(),w)try{w.close()}catch{}if(!$.destroyed)$.destroy()};$.pipe(J),$.on("error",Q),$.on("close",Q),this.portForward.portForward(this.namespace,u,[f],$,null,J).then((Y)=>{let Z=typeof Y==="function"?Y():Y;if(!Z){Q();return}if(w=Z,w.on("close",Q),w.on("error",()=>{this.invalidateRecord(X),Q()}),E)try{w.close()}catch{}}).catch((Y)=>{console.warn(`[${zJ}] port-forward to ${u}:${f} failed: ${Y instanceof Error?Y.message:String(Y)}`),this.invalidateRecord(X),Q()})}closeForwarder($){$.server.close((u)=>{if(u)console.warn(`[${zJ}] port-forward close on :${$.localPort} errored: ${u instanceof Error?u.message:String(u)}`)})}close(){if(this.closed)return;this.closed=!0;for(let $ of this.records.values())this.closeForwarder($.daemonForward);this.records.clear()}}function qX3($){return{active:$.createUpDownCounter("studio.sandbox.active",{description:"Active sandbox count, by runner kind and owning org. Cross-checks the cAdvisor-derived count from the cluster \u2014 divergence between the two indicates orphaned claims (mesh deleted but K8s didn't reap) or unattributed pods.",unit:"{sandbox}"}),ensureOutcome:$.createCounter("studio.sandbox.ensure.outcome",{description:"Outcome of each ensure() call: fresh provision, resume from state-store after restart, or adopt of a cluster-side claim mesh didn't know about. Cold-start ratio is the primary input for warm-pool sizing.",unit:"{call}"}),proxyDurationMs:$.createHistogram("studio.sandbox.proxy.duration_ms",{description:"Wall-clock latency of mesh-mediated requests to the sandbox daemon: tool exec proxies (source=daemon) and preview iframe traffic (source=preview).",unit:"ms"})}}function MX3(){let $=new $s;return $.loadFromDefault(),$}function $R$($){return Boolean($.status?.conditions?.some((u)=>u.type==="Ready"&&u.status==="True"))}function hX3($){let u=$.spec?.env;if(!u)return null;for(let f of u)if(f.name==="DAEMON_TOKEN"&&f.value)return f.value;return null}function yX3($,u){let f=HX3("sha256").update(`${$}:${u}`).digest();return dM1+f.readUInt32BE(0)%XR$}function xM1($,u){return new Response(JSON.stringify(u),{status:$,headers:{"content-type":"application/json","access-control-allow-origin":"*"}})}function uR$($){let u=$.slice(0,VX3);return gX3.test(u)?u:""}function iX3($){if($===void 0)return null;let u=$.trim();if(u==="")return null;if(!bX3.test(u))throw Error(`AgentSandboxProvider: envName=${JSON.stringify(u)} is not a valid DNS-label-safe environment name (lowercase alphanumeric or '-', starts with a letter, ends alphanumeric, \u226432 chars). Mesh sets this from STUDIO_ENV; check the studio chart's configMap.`);return u}function lM1($,u={}){let f={...u};if($){let X=uR$($.orgId),J=uR$($.userId);if(X)f[fW.orgId]=X;if(J)f[fW.userId]=J}return f}function xX3($){let u=$.metadata?.labels;if(!u)return null;let f=u[fW.orgId],X=u[fW.userId];if(!f||!X)return null;return{orgId:f,userId:X}}function cM1($){return{org_id:$?.orgId??"",user_id:$?.userId??"",runner_kind:HY}}function lX3($){let u={};if($.repo)u.repo=$.repo;if($.workload)u.workload=$.workload;if($.env&&Object.keys($.env).length>0)u.env=$.env;if($.tenant)u.tenant=$.tenant;return Object.keys(u).length>0?u:null}function cX3($,u){try{return new URL(ck0($,u)).hostname||null}catch{return null}}var HY="cluster",zJ="AgentSandboxProvider",yx="x-sandbox-preview-not-ready",LX3="agent-sandbox-system",TX3="studio-sandbox",w_=9000,AX3=3000,iM1="/app",IX3=32,SX3,kX3=900000,RX3,ek$,dM1=40000,XR$=1e4,CX3=256,fW,gX3,VX3=63,bX3;var JR$=U(()=>{SM1();l91();dk0();Bm0();nJ0();sk$();SX3=new Set(["DAEMON_TOKEN","DAEMON_BOOT_ID","APP_ROOT","PROXY_PORT"]),RX3=["cookie","host","connection","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","accept-encoding","content-length","upgrade"],ek$=["connection","keep-alive","transfer-encoding","content-encoding","content-length"];fW={role:"studio.decocms.com/role",sandboxHandle:"studio.decocms.com/sandbox-handle",orgId:"studio.decocms.com/org-id",userId:"studio.decocms.com/user-id",env:"studio.decocms.com/env"},gX3=/^([A-Za-z0-9]([-A-Za-z0-9_.]*[A-Za-z0-9])?)?$/;bX3=/^[a-z]([a-z0-9-]{0,30}[a-z0-9])?$/});var wR$={};Y1(wR$,{waitForSandboxReady:()=>Fm0,getSandboxClaim:()=>J_,getHttpRoute:()=>tk$,deleteSandboxClaim:()=>X_,deleteHttpRoute:()=>Gm0,createSandboxClaim:()=>rJ0,createHttpRoute:()=>Wm0,SandboxTimeoutError:()=>Mx,SandboxError:()=>fX,PREVIEW_NOT_READY_HEADER:()=>yx,KubeConfig:()=>$s,K8S_CONSTANTS:()=>U7,HTTPROUTE_CONSTANTS:()=>aJ0,AgentSandboxProvider:()=>mM1});var nM1=U(()=>{SM1();nJ0();Bm0();JR$()});class vm0{kind=E_;userSub;dispatch;stateStore;records=new Map;constructor($){if(!$.userSub)throw Error("DesktopSandboxProvider requires userSub");if(!$.dispatch)throw Error("DesktopSandboxProvider requires dispatch");this.userSub=$.userSub,this.dispatch=$.dispatch,this.stateStore=$.stateStore??null}async ensure($,u={}){let f=u.branch??u.repo?.branch,X=dH($,f),J=this.records.get(X);if(J){if(await this.probeHealth(X))return this.toSandbox(J);if(this.records.delete(X),this.stateStore)await this.stateStore.deleteByHandle(E_,X).catch(()=>{})}else if(this.stateStore){let G=(await this.stateStore.getByHandle(E_,X))?.state,F=G?.sandboxApiUrl;if(F){if(await this.probeHealth(X)){let B={handle:X,sandboxApiUrl:F,previewUrl:G?.previewUrl??F};return this.records.set(X,B),this.toSandbox(B)}await this.stateStore.deleteByHandle(E_,X).catch(()=>{})}}let w=JSON.stringify({handle:X,repo:u.repo,branch:f,...u.workload?{workload:u.workload}:{},...u.offloadAllowedHosts?{offloadAllowedHosts:u.offloadAllowedHosts}:{},...u.offloadAllowSameHostDev!==void 0?{offloadAllowSameHostDev:u.offloadAllowSameHostDev}:{}}),E=await this.dispatchJson("POST","/api/sandboxes",w),Q=JSON.parse(E);if(typeof Q.sandboxApiUrl!=="string")throw Error("desktop ensure: daemon did not return a sandboxApiUrl string");let Y=typeof Q.previewUrl==="string"?Q.previewUrl:Q.sandboxApiUrl,Z={handle:X,sandboxApiUrl:Q.sandboxApiUrl,previewUrl:Y};if(this.records.set(X,Z),this.stateStore)await this.stateStore.put($,E_,{handle:X,state:{handle:X,sandboxApiUrl:Q.sandboxApiUrl,previewUrl:Y}});return this.toSandbox(Z)}async proxyDaemonRequest($,u,f){let X=u.startsWith("/")?u:`/${u}`,J=X.startsWith("/_sandbox/")?X.slice(9):X,w=`/_sandbox/${encodeURIComponent($)}${J}`,E=new Headers(f.headers);for(let z of["host","cookie","connection","keep-alive","transfer-encoding","upgrade","authorization"])E.delete(z);let Q={};E.forEach((z,H)=>{Q[H]=z});let Y;if(f.body!=null)Y=await dX3(f.body);let W=this.dispatch(this.userSub,{method:f.method,path:w,headers:Q,body:Y},{signal:f.signal})[Symbol.asyncIterator](),G=200,F={"content-type":"application/octet-stream"},B=[];try{while(!0){let z=await W.next();if(z.done)break;let H=z.value;if(H.headers){G=H.headers.status,F=H.headers.headers;break}if(H.data!=null)B.push(H.data)}}catch(z){let H=z instanceof Error?z.message:"dispatch error";return new Response(JSON.stringify({error:H}),{status:502,headers:{"content-type":"application/json"}})}let v=!1,N=new TextEncoder,O=new ReadableStream({async start(z){for(let H of B)z.enqueue(N.encode(H))},async pull(z){try{let H=await W.next();if(v)return;if(H.done){z.close();return}let _=H.value;if(_.data!=null)z.enqueue(N.encode(_.data))}catch(H){if(!v)z.error(H)}},cancel(){v=!0,W.return?.()}});return new Response(O,{status:G,headers:F})}async alive($){return this.probeHealth($)}async probeHealth($){let u=new AbortController,f=setTimeout(()=>u.abort(),1500);try{return await this.dispatchJson("GET",`/api/sandboxes/${encodeURIComponent($)}`,void 0,u.signal),!0}catch{return!1}finally{clearTimeout(f)}}async forgetHandle($){if(this.records.delete($),this.stateStore)await this.stateStore.deleteByHandle(E_,$).catch(()=>{})}async delete($){if(this.records.delete($),this.stateStore)await this.stateStore.deleteByHandle(E_,$).catch(()=>{});try{await this.dispatchJson("DELETE",`/api/sandboxes/${encodeURIComponent($)}`)}catch(u){if(!(u instanceof Error?u.message:String(u)).includes("404"))throw u}}async getPreviewUrl($){return(await this.resolveRecord($))?.previewUrl??null}async localWorkdir($){return null}async*watchClaimLifecycle($,u){yield{kind:"ready"}}toSandbox($){return{handle:$.handle,workdir:$.sandboxApiUrl,previewUrl:$.previewUrl}}async resolveRecord($){let u=this.records.get($);if(u)return u;if(!this.stateStore)return null;let X=(await this.stateStore.getByHandle(E_,$))?.state,J=X?.sandboxApiUrl;if(!J)return null;let w={handle:$,sandboxApiUrl:J,previewUrl:X?.previewUrl??J};return this.records.set($,w),w}async dispatchJson($,u,f,X){let J={accept:"application/json"};if(f!==void 0)J["content-type"]="application/json";let w=this.dispatch(this.userSub,{method:$,path:u,headers:J,body:f},{signal:X}),E=null,Q="";for await(let Y of w)if(Y.headers)E=Y.headers.status;else if(Y.data!=null)Q+=Y.data;if(E!=null&&(E<200||E>=300))throw Error(`daemon returned ${E}: ${Q}`);return Q}}function ER$($){return new vm0($)}async function dX3($){if(typeof $==="string")return $;if($ instanceof ArrayBuffer)return Buffer.from($).toString("utf8");if(ArrayBuffer.isView($))return Buffer.from($.buffer,$.byteOffset,$.byteLength).toString("utf8");if($ instanceof URLSearchParams)return $.toString();return await new Response($).text()}var E_="user-desktop";var QR$=U(()=>{dk0()});var YR$={};Y1(YR$,{createDesktopProvider:()=>ER$,DesktopSandboxProvider:()=>vm0});var DR$=U(()=>{QR$()});var vR$={};Y1(vR$,{subscribeLifecycle:()=>oJ0,getSandboxProviderByKind:()=>pJ0,getOrInitSharedRunner:()=>sX3,buildDesktopProvider:()=>ws,__resetSharedLifecyclesForTesting:()=>X73});function FR$($,u){let f=ZR$[$];if(f)return Promise.resolve(f);let X=tM1[$];if(X)return X;let J=u().then((w)=>{return ZR$[$]=w,w}).finally(()=>{delete tM1[$]});return tM1[$]=J,J}function tX3(){let $=process.env.STUDIO_SANDBOX_PREVIEW_URL_PATTERN;return $&&$.trim()!==""?$:void 0}function rX3(){let $=process.env.STUDIO_SANDBOX_TEMPLATE_NAME;return $&&$.trim()!==""?$:void 0}function aX3(){let $=process.env.STUDIO_ENV;return $&&$.trim()!==""?$:void 0}function pX3(){let $=process.env.STUDIO_SANDBOX_SENTINEL_TOKEN;return $&&$.trim()!==""?$:void 0}function oX3(){let $=process.env.STUDIO_SANDBOX_PREVIEW_GATEWAY_NAME?.trim(),u=process.env.STUDIO_SANDBOX_PREVIEW_GATEWAY_NAMESPACE?.trim();if(!$&&!u)return;if(!$||!u)throw Error("STUDIO_SANDBOX_PREVIEW_GATEWAY_NAME and STUDIO_SANDBOX_PREVIEW_GATEWAY_NAMESPACE must both be set, or both unset. Half-configured per-claim HTTPRoute routing would silently fail to attach.");return{name:$,namespace:u}}async function BR$($,u){let f=new nH(u),X=tX3();switch($){case"cluster":{let{AgentSandboxProvider:J}=await Promise.resolve().then(() => (nM1(),wR$));return new J({stateStore:f,previewUrlPattern:X,sandboxTemplateName:rX3(),envName:aX3(),previewGateway:oX3(),sentinelToken:pX3(),meter:IQ})}case"user-desktop":throw Error("user-desktop runner cannot be instantiated without a per-run link claim \u2014 call resolveSandboxProvider, which binds the link before constructing the provider.");default:throw Error(`Unknown runner kind: ${String($)}`)}}async function ws($,u){let{DesktopSandboxProvider:f}=await Promise.resolve().then(() => (DR$(),YR$)),{getDispatch:X}=await Promise.resolve().then(() => (aM1(),rM1)),J=new nH($.db);if(!u)throw Error("buildDesktopProvider: userSub must be a non-empty string");return new f({userSub:u,dispatch:X(),stateStore:J})}function pJ0($,u){return FR$(u,()=>BR$(u,$.db))}async function sX3(){let $;try{$=zF()}catch(f){return console.warn("[lifecycle] cannot resolve sandbox runner:",f instanceof Error?f.message:String(f)),null}return await FR$($,()=>BR$($,l6().db))}function oJ0($,u,f){let X=Q_.get(u);if(X){if(X.terminated){if(X.lastPhase)try{f(X.lastPhase)}catch{}return{unsubscribe:u73}}if(X.listeners.add(f),X.lastPhase)try{f(X.lastPhase)}catch{}return WR$(u,X,f)}let J=new AbortController,w={lastPhase:null,terminated:!1,listeners:new Set([f]),abort:J};return Q_.set(u,w),f73($,u,w),WR$(u,w,f)}function u73(){}function WR$($,u,f){return{unsubscribe(){if(Q_.get($)!==u)return;if(u.listeners.delete(f),u.listeners.size===0)Q_.delete($),u.abort.abort()}}}async function f73($,u,f){let X=null;try{for await(let J of $.watchClaimLifecycle(u,f.abort.signal)){if(f.abort.signal.aborted)break;f.lastPhase=J;let w=J.kind==="ready"||J.kind==="failed";if(w)f.terminated=!0;let E=Array.from(f.listeners);for(let Q of E)try{Q(J)}catch{}if(w)break}}catch(J){X=J}finally{if(!f.terminated&&!f.abort.signal.aborted&&f.listeners.size>0){let J={kind:"failed",reason:"unknown",message:X instanceof Error?X.message:"Lifecycle watcher ended unexpectedly"};f.lastPhase=J,f.terminated=!0;for(let w of Array.from(f.listeners))try{w(J)}catch{}}if(Q_.get(u)===f)Q_.delete(u)}}function X73(){for(let $ of Q_.values())$.abort.abort();Q_.clear()}var mX3,nX3,GR$,ZR$,tM1,eX3,$73,Q_;var gx=U(()=>{bU();JE();ew();rk0();mX3=Symbol.for("decocms.sandbox.lifecycle.runners"),nX3=Symbol.for("decocms.sandbox.lifecycle.inflight"),GR$=globalThis,ZR$=GR$[mX3]??={},tM1=GR$[nX3]??={};eX3=Symbol.for("decocms.sandbox.lifecycle.shared-lifecycles"),$73=globalThis,Q_=$73[eX3]??=new Map});async function Um0($,u){if(await u.linkClaimRegistry.get($))return"user-desktop";return u.resolveEnvKind()}async function tU($,u){let{userId:f,branch:X,virtualMcpMetadata:J,explicitKind:w}=u;if(w)return{provider:await Nm0($,f,w),kind:w};if($.sandboxPreference==="user-desktop"&&$.linkForCurrentRun)return{provider:await ws($,f),kind:"user-desktop"};if($.sandboxPreference==="cluster-default"){let W=zF();return{provider:await Nm0($,f,W),kind:W}}let[E,...Q]=J73(J,f,X);if(E){let W=Q.length===0?E:await w73($,f,E,Q);return{provider:await Nm0($,f,W),kind:W}}let Y=await UR$($,f);return{provider:await Nm0($,f,Y),kind:Y}}function J73($,u,f){let X=u2($)[u]?.[f];if(!X)return[];let J=hv(X);return Object.keys(J)}async function w73($,u,f,X){let J=await UR$($,u);if(J===f||X.includes(J))return J;return f}async function UR$($,u){if(!$.linkClaimRegistry)return zF();return Um0(u,{linkClaimRegistry:$.linkClaimRegistry,resolveEnvKind:zF})}async function Nm0($,u,f){if(f!=="user-desktop")return pJ0($,f);if(!$.linkClaimRegistry)throw Error("user-desktop sandbox provider requires ctx.linkClaimRegistry to be wired (set on StudioContextConfig).");if(!await $.linkClaimRegistry.get(u))throw Error(`No link daemon registered for user "${u}". Start one with \`deco link\` (or run \`bun run dev --local-sandbox-provider\` for dev).`);return ws($,u)}var sJ0=U(()=>{iu();bU();iU();gx()});async function NR$($,u){if(!$)return{hosts:[],allowSameHostDev:!1};let f;try{f=await $.presignedGetUrl("link-dispatch/_allowlist_probe",60,{requireFetchable:!0})}catch{return{hosts:[],allowSameHostDev:!1}}let X;try{X=new URL(f)}catch{return{hosts:[],allowSameHostDev:!1}}if(X.protocol!=="https:"&&X.protocol!=="http:")return{hosts:[],allowSameHostDev:!1};let J=X.hostname,w=E73.has(J);return{hosts:[J],allowSameHostDev:w&&!u.isProduction}}var E73;var OR$=U(()=>{E73=new Set(["127.0.0.1","localhost","::1","[::1]","0.0.0.0"])});async function Om0($,u){X1(u);let f=r0(u),X=G$(u);if(!X)throw Error("User ID required");let J=await u.storage.virtualMcps.findById($.virtualMcpId);if(!J||J.organization_id!==f.id)throw Error("Virtual MCP not found");let w=J.metadata??{},E=mH(u2(w),X,$.branch,$.sandboxProviderKind),Q=$.sandboxProviderKind,{provider:Y}=await tU(u,{userId:X,branch:$.branch,virtualMcpMetadata:w,explicitKind:Q});if(E){if(Q!=="user-desktop")return E;if(await Y.alive(E.sandboxHandle).catch(()=>!1))return E;await lo(u.storage.virtualMcps,$.virtualMcpId,X,X,$.branch,Q).catch((F)=>{console.warn("[ensureSandbox] failed to reap stale user-desktop entry",F)})}let Z=w.githubRepo??null,{entry:W}=await zR$({ctx:u,userId:X,orgId:f.id,virtualMcpId:$.virtualMcpId,branch:$.branch,metadata:w,githubRepo:Z,existing:null,providerKind:Q,runner:Y});return W}async function zR$($){let{ctx:u,userId:f,orgId:X,virtualMcpId:J,branch:w,metadata:E,githubRepo:Q,existing:Y,runner:Z}=$,{runtime:W,packageManager:G,port:F,packageManagerPath:B}=$j$(E),v;if(Q){let{cloneUrl:h,gitUserName:i,gitUserEmail:l}=Q.connectionId?await fj$(Q.connectionId,Q.owner,Q.name,u.db,u.vault):uj$(Q.owner,Q.name);if(!G){let M=Q.connectionId?await Ej$(Q.connectionId,Q.owner,Q.name,u.db,u.vault):await Qj$(Q.owner,Q.name);if(M)G=M.packageManager,W=TJ0[M.packageManager].runtime,F=M.devPort??F,await Q73(u,J,f,M.packageManager,M.devPort)}v={cloneUrl:h,userName:i,userEmail:l,branch:w,displayName:`${Q.owner}/${Q.name}`}}let N=W&&G?{runtime:W,packageManager:G,...F!==null?{devPort:Number(F)}:{},...B?{packageManagerPath:B}:{}}:void 0,O=EI({orgId:X,virtualMcpId:J,branch:w}),z=Z.kind==="user-desktop"?await NR$(u.objectStorage,{isProduction:g4().nodeEnv==="production"}):null,H=await Z.ensure({userId:f,projectRef:O},{branch:w,repo:v,workload:N,tenant:{orgId:X,userId:f},...z?{offloadAllowedHosts:z.hosts,offloadAllowSameHostDev:z.allowSameHostDev}:{}}),_=E.runtime?.env??null;await tk0({ctx:u,runner:Z,handle:H.handle,orgId:X,userId:f,entries:_});let j=!!Y&&Y.sandboxHandle===H.handle&&Y?.createdAt?Y.createdAt:Date.now(),I=E.runtime?.selected??null,k=E.runtime?.port??null,S=E.runtime?.path??null,q={sandboxHandle:H.handle,previewUrl:H.previewUrl,sandboxApiUrl:H.previewUrl,sandboxProviderKind:Z.kind,createdAt:j,startedWith:{packageManager:I,port:k,path:S}};await sP$(u.storage.virtualMcps,J,f,f,w,$.providerKind,q);let y=!Y||Y.sandboxHandle!==H.handle;return{entry:q,isNewVm:y}}async function Q73($,u,f,X,J){let w=await $.storage.virtualMcps.findById(u);if(!w)return;let E=w.metadata??{};await $.storage.virtualMcps.update(u,f,{metadata:{...E,runtime:{selected:X,port:J}}})}var pM1;var zm0=U(()=>{c0();bU();C1();nk0();yC1();iU();Xj$();Dj$();fk1();hC1();sJ0();OR$();$5();iU();pM1=y0({name:"SANDBOX_START",description:"Start a sandbox with the connected GitHub repo and dev server.",annotations:{title:"Start VM Preview",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!1,openWorldHint:!0},_meta:{ui:{visibility:"app"}},inputSchema:D.object({virtualMcpId:D.string().describe("Virtual MCP ID"),branch:D.string().min(1).optional().describe("Optional git branch to check out. When omitted the handler generates `deco/<adjective>-<noun>` and uses it. The resolved branch is returned in the response so callers can persist it."),sandboxProviderKind:D.enum(["cluster","user-desktop"]).optional().describe("Explicit runtime choice. When omitted, defaults to `user-desktop` if the acting user's link daemon is online, else the cluster env kind.")}),outputSchema:D.object({previewUrl:D.string().nullable(),sandboxHandle:D.string(),branch:D.string(),isNewVm:D.boolean(),sandboxProviderKind:D.enum(["cluster","user-desktop"])}),handler:async($,u)=>{X1(u);let f=$.branch??bS0(),X=G$(u);if(!X)throw Error("User ID required");let{provider:J,kind:w}=await tU(u,{userId:X,branch:f,virtualMcpMetadata:null,explicitKind:$.sandboxProviderKind}),{metadata:E,userId:Q,organization:Y,entry:Z}=await mk0({virtualMcpId:$.virtualMcpId,branch:f,sandboxProviderKind:w},u),W=E.githubRepo??null,{entry:G,isNewVm:F}=await zR$({ctx:u,userId:Q,orgId:Y.id,virtualMcpId:$.virtualMcpId,branch:f,metadata:E,githubRepo:W,existing:Z,providerKind:w,runner:J});return{...G,branch:f,isNewVm:F,sandboxProviderKind:w}}})});var oM1;var KR$=U(()=>{c0();C1();nk0();gx();iU();oM1=y0({name:"SANDBOX_DELETE",description:"Delete a sandbox.",annotations:{title:"Delete VM Preview",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!0},_meta:{ui:{visibility:"app"}},inputSchema:D.object({virtualMcpId:D.string().describe("Virtual MCP ID that owns this VM"),branch:D.string().min(1).describe("Branch whose vm should be deleted (sandboxMap[userId][branch])"),sandboxProviderKind:D.enum(["cluster","user-desktop"]).describe("Kind of sandbox provider the VM was started with. Used to locate the correct 3-level sandboxMap entry.")}),outputSchema:D.object({success:D.boolean()}),handler:async($,u)=>{let f=$.sandboxProviderKind,X;try{X=await mk0($,u)}catch(Q){if(Q instanceof Error&&Q.message==="Virtual MCP not found")return{success:!0};throw Q}let{entry:J,userId:w}=X;if(!J)return{success:!0};return await lo(u.storage.virtualMcps,$.virtualMcpId,w,w,$.branch,f),await(await pJ0(u,f)).delete(J.sandboxHandle).catch((Q)=>console.error(`[SANDBOX_DELETE] ${f} ${J.sandboxHandle}: ${Q instanceof Error?Q.message:String(Q)}`)),{success:!0}}})});var HR$=U(()=>{zm0();KR$()});var D73="https://api.github.com",sM1;var _R$=U(()=>{c0();C1();DA0();kH();sM1=y0({name:"GITHUB_LIST_USER_ORGS",description:"List GitHub App installations (orgs/accounts) accessible to the authenticated user.",annotations:{title:"List GitHub User Orgs",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!0},_meta:{ui:{visibility:"app"}},inputSchema:D.object({connectionId:D.string().describe("ID of the mcp-github connection to use")}),outputSchema:D.object({installations:D.array(D.object({installationId:D.number(),login:D.string(),avatarUrl:D.string(),type:D.string()})),appSlug:D.string().optional()}),handler:async($,u)=>{await u.access.check();let f=new D9(u.db,u.vault),X=await f.get($.connectionId);if(!X)throw Error("No GitHub token found. Ensure the mcp-github connection is authenticated.");let J=X.accessToken;if(wX0(X)&&f.isExpired(X,YA0)){let W=await EX0(X,f);if(!W)throw Error(sT);J=W,X=await f.get($.connectionId)??X}let w=[],E,Q=1,Y=100,Z=async(W)=>fetch(`${D73}/user/installations?per_page=${Y}&page=${Q}`,{headers:{Authorization:`Bearer ${W}`,Accept:"application/vnd.github+json","X-GitHub-Api-Version":"2022-11-28"}});while(!0){let W=await Z(J);if(W.status===401){let F=await f.get($.connectionId);if(!F||!wX0(F))throw Error(sT);let B=await EX0(F,f);if(!B)throw Error(sT);if(J=B,W=await Z(J),W.status===401)throw Error(sT)}if(!W.ok)throw Error(`GitHub /user/installations failed: ${W.status}`);let G=await W.json();for(let F of G.installations){if(!E)E=F.app_slug??F.app?.slug;w.push({installationId:F.id,login:F.account.login,avatarUrl:F.account.avatar_url,type:F.account.type})}if(G.installations.length<Y)break;Q++}return{installations:w,...E?{appSlug:E}:{}}}})});var PR$=U(()=>{_R$()});var jR$=()=>{};var eM1=U(()=>{jR$();$Y1()});var $h1;var LR$=U(()=>{c0();eM1();C1();$h1=y0({name:"LINK_CURRENT_GET",description:"Return the calling user's currently registered desktop link, or `online: false` if no link is registered or the TTL has expired.",inputSchema:s0.object({}),outputSchema:s0.object({online:s0.boolean(),machineId:s0.string().optional(),hostname:s0.string().optional(),cliVersion:s0.string().optional(),capabilities:s0.array(eQ1).default([])}),handler:async($,u)=>{X1(u),await u.access.check();let f=u.linkClaimRegistry;if(!f)return{online:!1,capabilities:[]};let X=await f.get(u.auth.user.id);if(!X)return{online:!1,capabilities:[]};return{online:!0,machineId:X.machineId,hostname:X.hostname,cliVersion:X.cliVersion,capabilities:X.capabilities}}})});var TR$=U(()=>{LR$()});function AR$($){if(!$)return"";return typeof $==="string"?$:$.toISOString()}var F73,B73,v73,U73,N73,uh1;var IR$=U(()=>{c0();C1();F73=["thread"],B73=D.object({type:D.literal("thread"),id:D.string(),title:D.string(),created_at:D.string(),updated_at:D.string(),virtual_mcp_id:D.string().nullable(),run_config:D.record(D.string(),D.unknown()).nullable(),status:D.string().nullable()}),v73=D.discriminatedUnion("type",[B73]),U73=D.object({query:D.string().min(1).describe("Free-text search query."),limit:D.number().int().min(1).max(50).optional().describe("Maximum results per resource type (default: 20)."),types:D.array(D.enum(F73)).optional().describe("Restrict the search to specific resource types. Omit to search across all available types.")}),N73=D.object({items:D.array(v73),totalCount:D.number()});uh1=y0({name:"GLOBAL_SEARCH",description:"Search across organization resources by free-text query. Returns a typed union of matches (currently: threads). New resource types may be added over time without changes to the call shape.",annotations:{title:"Global Search",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:U73,outputSchema:N73,handler:async($,u)=>{await u.access.check(),r0(u);let f=$.limit??20,X=$.types?.length?new Set($.types):null,J=!X||X.has("thread"),w=[],E=0;if(J){let{threads:Q,total:Y}=await u.storage.threads.list(void 0,{limit:f,offset:0,search:$.query,includeArchived:!1});E+=Y;for(let Z of Q)w.push({type:"thread",id:Z.id,title:Z.title??"",created_at:AR$(Z.created_at),updated_at:AR$(Z.updated_at),virtual_mcp_id:Z.virtual_mcp_id??null,run_config:Z.run_config??null,status:Z.status??null})}return{items:w,totalCount:E}}})});var SR$=U(()=>{IR$()});var MS0={};Y1(MS0,{managementMCP:()=>Ao,listManagementTools:()=>H73,ALL_TOOLS:()=>kR$});async function H73($){let u=await Ao($),[f,X]=H80.createLinkedPair();await u.connect(X);let J=new m8({name:"tools-hydration",version:"1.0.0"});try{return await J.connect(f),(await J.listTools()).tools}finally{await J.close().catch(()=>{})}}var z73,K73,kR$,Ao=async($)=>{let u=null;if($.organization){let E=await $.storage.organizationSettings.get($.organization.id),Q=await $.storage.virtualMcps.list($.organization.id),Y=new Set(E?.enabled_plugins??[]);for(let Z of Q){let W=Z.metadata?.enabled_plugins;if(W&&Array.isArray(W))for(let G of W)Y.add(G)}u=Y.size>0?[...Y]:null}let f=N1$(kR$,u),X=new gv({name:"mcp-cms-management",version:"1.0.0"},{capabilities:{tools:{},prompts:{},resources:{}}});for(let E of f){let Q=E.inputSchema&&typeof E.inputSchema==="object"&&"shape"in E.inputSchema?E.inputSchema:D.object({}),Y=E.outputSchema&&typeof E.outputSchema==="object"&&"shape"in E.outputSchema?E.outputSchema:void 0,Z=Q.shape,W=Y?.shape;X.registerTool(E.name,{description:E.description??"",inputSchema:Z,outputSchema:W,annotations:E.annotations,_meta:E._meta},async(G)=>{$.access.setToolName(E.name);try{let F=await E.execute(G,$);return{content:[{type:"text",text:E.modelSummary?E.modelSummary(F):JSON.stringify(F)}],structuredContent:F}}catch(F){return{content:[{type:"text",text:`Error: ${F.message}`}],isError:!0}}})}let J=Zk0();for(let E of J){let Q=E.arguments?.length?Object.fromEntries(E.arguments.map((Y)=>{let Z=Y.required?D.string():D.string().optional();return[Y.name,Y.description?Z.describe(Y.description):Z]})):void 0;X.registerPrompt(E.name,{title:E.title,description:E.description,...Q?{argsSchema:Q}:{}},(Y)=>{return{messages:[{role:"user",content:{type:"text",text:typeof E.text==="function"?E.text(Y??{}):E.text}}]}})}if($.organization?.id){let E=await $.storage.brandContext.list($.organization.id),Q=new Set;for(let Y of E){let Z=Y.name.toLowerCase().replace(/[^a-z0-9]+/g,"-").replace(/^-|-$/g,""),W=Z?`brand-${Z}`:`brand-${Y.id}`;if(Q.has(W))W=`${W}-${Y.id.slice(0,8)}`;Q.add(W);let G=[`# Brand: ${Y.name}`,"",`**Domain:** ${Y.domain}`,"","## Overview",Y.overview];if(Y.colors){let B=Object.entries(Y.colors).filter(([,v])=>v);if(B.length>0){G.push("","## Colors");for(let[v,N]of B)G.push(`- **${v}:** ${N}`)}}if(Y.fonts){let B=Object.entries(Y.fonts).filter(([,v])=>v);if(B.length>0){G.push("","## Fonts");for(let[v,N]of B)G.push(`- ${N} (${v})`)}}if(Y.logo)G.push("",`**Logo:** ${Y.logo}`);if(Y.favicon)G.push(`**Favicon:** ${Y.favicon}`);if(Y.ogImage)G.push(`**OG Image:** ${Y.ogImage}`);if(Y.images&&Y.images.length>0){G.push("","## Images");for(let B of Y.images){let v=Object.entries(B).map(([N,O])=>`${N}: ${O}`).join(", ");G.push(`- ${v}`)}}let F=G.join(`
 `);X.prompt(W,`Brand context for ${Y.name}`,()=>({messages:[{role:"user",content:{type:"text",text:F}}]}))}}let w=yN$();for(let E of w)X.resource(E.name,E.uri,{description:E.description,mimeType:E.mimeType??"text/markdown"},async(Q)=>{return{contents:[{uri:typeof Q==="string"?Q:Q.href,mimeType:E.mimeType??"text/markdown",text:E.text}]}});return X};var Ho=U(()=>{yf0();IG();n50();c0();Ff$();hB$();bB$();aB$();Qv$();Wv$();qv$();bv$();$U$();RU$();qU$();uN$();JN$();FN$();ER1();QO$();pP$();HR$();PR$();TR$();SR$();z73=[AS1,IS1,SS1,kS1,RS1,CS1,qS1,MS1,hS1,yS1,gS1,VS1,iS1,xS1,lS1,cS1,dS1,mS1,nS1,tS1,rS1,aS1,pS1,Ej1,uS1,fS1,XS1,JS1,wS1,BS1,US1,NS1,OS1,zS1,VB$,jS1,LS1,TS1,U_1,O_1,z_1,N_1,ES1,QS1,YS1,DS1,ZS1,WS1,GS1,qk1,Xk1,Jk1,wk1,Ek1,Qk1,Yk1,oS1,sS1,eS1,$k1,uk1,Dk1,Zk1,Wk1,Ak1,Ik1,Sk1,kk1,Rk1,Ck1,KS1,HS1,_S1,PS1,Mk1,gk1,Vk1,bk1,ik1,xk1,lk1,ck1,dk1,mk1,nk1,tk1,rk1,pk1,ok1,sk1,ek1,$R1,uR1,wR1,QR1,YR1,DR1,ZR1,WR1,GR1,...aP$,pM1,oM1,sM1,$h1,uh1],K73=O1$(),kR$=[...z73,...K73]});function _73($){return[{permissions:{self:["*"]},getTools:async()=>{let{ALL_TOOLS:u}=await Promise.resolve().then(() => (Ho(),MS0));return u.map((f)=>{return{name:f.name,inputSchema:D.toJSONSchema(f.inputSchema,{unrepresentable:"any"}),outputSchema:f.outputSchema?D.toJSONSchema(f.outputSchema,{unrepresentable:"any"}):void 0,description:f.description}})},data:MN1(I9(),$)},{data:qN1()},{data:CN1($)}]}async function RR$($,u){try{let f=l6(),X=g4(),J=new RT(X.encryptionKey),w=new U80(f.db,J),E=_73($);await Promise.all(E.map(async(Q)=>{let Y=null;if(Q.permissions)Y=(await U5.api.createApiKey({body:{name:`${Q.data.app_name??crypto.randomUUID()}-mcp`,userId:u,permissions:Q.permissions,rateLimitEnabled:!1,metadata:{organization:{id:$},purpose:"default-org-connections"}}}))?.key;let Z=await AK({id:"pending",title:Q.data.title,connection_type:Q.data.connection_type,connection_url:Q.data.connection_url,connection_token:Q.data.connection_token??Y,connection_headers:Q.data.connection_headers}).catch(()=>null),W=await Q.getTools?.()??Z?.tools??null,G=Z?.scopes?.length?Z.scopes:null,F=Q.data.id?Q.data.id.startsWith(`${$}_`)?Q.data.id:`${$}_${Q.data.id}`:void 0;await w.create({...Q.data,id:F,tools:W,configuration_scopes:G,organization_id:$,created_by:u,connection_token:Q.data.connection_token??Y})}));try{await v_1({orgId:$,createdBy:u})}catch(Q){console.error("Failed to enqueue studio pack install:",Q)}if(X.aiGatewayEnabled&&X.studioProvisionSecretKey&&F80.provisionKey)try{let Q=await IK(u),Y=await F80.provisionKey(Q,$);await new v80(f.db,J).upsert({providerId:"deco",label:"Auto-provisioned",apiKey:Y,organizationId:$,createdBy:u})}catch(Q){console.error("Failed to auto-provision Deco AI Gateway key:",Q)}}catch(f){console.error("Error creating default MCP connections:",f)}}var CR$=U(()=>{iu();oH1();lW();JE();VL0();eH1();$_1();O80();c0();$5();yU();mL0();MT()});function P73($,u){let f=$.email.split("@")[1]?.toLowerCase()??null;return{distinctId:$.id,properties:{$set:{email:$.email,name:$.name,email_verified:$.emailVerified},$set_once:{first_seen_at:u.toISOString(),signup_email_domain:f}}}}function fh1($){j$.identify(P73($,new Date))}var qR$=U(()=>{Bf()});async function T73($){let{user:u,token:f}=$;if(!f?.idToken)return;let X;try{X=v6(f.idToken)}catch{return}let{preferred_username:J,upn:w}=X,E=[J,w].filter((Z)=>typeof Z==="string"&&Z.length>0&&Z.toLowerCase()!==u.email.toLowerCase()).map((Z)=>Z.toLowerCase());if(E.length===0)return;let{db:Q}=l6(),Y=await Q.selectFrom("user").selectAll().where("email","in",E).where("id","!=",u.id).executeTakeFirst();if(!Y)return;try{await Q.transaction().execute(async(Z)=>{await u0`UPDATE "account" SET "userId" = ${Y.id} WHERE "userId" = ${u.id}`.execute(Z),await u0`UPDATE "session" SET "userId" = ${Y.id} WHERE "userId" = ${u.id}`.execute(Z),await u0`
         UPDATE "member" SET "userId" = ${Y.id}
         WHERE "userId" = ${u.id}
@@ -79372,7 +79372,7 @@ Usage notes:
 - Built-in tools (user_ask, subtask, read_tool_output, read_prompt, read_resource, sandbox) are always available and do not need enabling.`,inputSchema:LY3,execute:async({tools:X})=>{let J=[],w=[],E=[];for(let Q of X){if(!u.has(Q)){w.push(Q);continue}if(f?.isPlanMode){if(f.toolAnnotations?.get(Q)?.readOnlyHint!==!0){E.push(Q);continue}}$.add(Q),J.push(Q)}return{enabled:J,...w.length>0&&{not_found:w},...E.length>0&&{blocked:E,blocked_reason:"These tools cannot be enabled in plan mode \u2014 they have side effects."}}}})}var LY3;var My$=U(()=>{a3();c0();LY3=D.object({tools:D.array(D.string()).min(1).describe("Tool ids to enable, taken verbatim from <available-connections>.")})});function Bs($){if($ instanceof Error)return $.message;if(typeof $==="object"&&$!==null)try{return JSON.stringify($)}catch{return"[unserializable object]"}return String($)}function TY3($){let f=$.split(/\.\s+/).filter((J)=>!/https?:\/\//i.test(J)&&!/openrouter/i.test(J));if(f.length===0)return $;let X=f.join(". ").trim();return X.endsWith(".")?X:`${X}.`}function Fw0($){if($ instanceof Error){let u=$.statusCode,f=$.message.toLowerCase();if(u===402||f.includes("credit")||f.includes("insufficient funds")||f.includes("insufficient balance")||f.includes("billing")||f.includes("quota exceeded")||f.includes("payment required"))return`[CREDITS] ${TY3($.message)}`;return $.message}return Bs($)}function AY3($,u){let f=new Set;for(let X of $){if(X.role!=="assistant")continue;for(let J of X.parts)if("toolName"in J&&(J.toolName==="enable_tool"||J.toolName==="enable_tools")&&"result"in J&&J.result){let w=J.result;if(Array.isArray(w.enabled))for(let E of w.enabled){let Q=E.replace(/[^a-zA-Z0-9_]/g,"_");if(u.has(Q))f.add(Q);else if(u.has(E))f.add(E)}}}return f}function IY3(){let $=[],u=!1,f=null;return{push(X){if(u)return;if(f){let J=f;f=null,J({done:!1,value:X})}else $.push(X)},next(){if($.length>0){let X=$.shift();return Promise.resolve({done:!1,value:X})}if(u)return Promise.resolve({done:!0});return new Promise((X)=>{f=X})},close(){if(u=!0,f){let X=f;f=null,X({done:!0})}}}}async function*hy$($,u,f,X,J){let{provider:w,titleProvider:E,titleModel:Q,registrySignal:Y,processedSystemMessages:Z,processedMessages:W,originalMessages:G,threadId:F,writer:B}=J,v=Gw0($.mode,{isCliAgent:!1}),N,O=!1,z=IY3(),H=JSON.stringify(W[0]?.content??""),_=Ys({abortSignal:Y,model:tm0(E??w,Q??$.models.fast??$.models.thinking),userMessage:H}),T=_.promise.then((K0)=>{return K0?Qs(K0):null}).catch((K0)=>{return console.warn("[decopilot:title] title generation failed",K0),null}),j=null,I=Ds();N=Date.now();let k=new Set(Object.keys(f.passthroughTools)),S=Object.keys(f.builtInTools),q=AY3(G,k),y={...f.tools,...f.connectionsBlockTools.length>0?{enable_tool:qy$(q,k,{isPlanMode:v.isPlanMode,toolAnnotations:f.toolAnnotations})}:{}},h=(()=>{let K0=v.forcedFirstStepTool&&v.forcedFirstStepTool in y?v.forcedFirstStepTool:null,L0=0;return(S0)=>{let W0=S0.messages,R0=L0===0;L0++;let d0=W0,u1=J.pendingImages;if(u1.length>0){let t0=u1.splice(0,u1.length),T0=[];for(let q1 of t0)if(T0.push({type:"text",text:q1.label??(q1.pageUrl?`[Screenshot of ${q1.pageUrl}]`:"[Image]")}),q1.url.startsWith("data:")){let e0=q1.url.match(/^data:([^;]+);base64,(.+)$/s);if(e0)T0.push({type:"image",image:e0[2],mimeType:e0[1]})}else T0.push({type:"image",image:new URL(q1.url)});d0=[...W0,{role:"user",content:T0}]}let N0=d0,v0=f.connectionsBlockTools.length>0,z0=[...S,...v0?["enable_tool"]:[],...q];if(v.isPlanMode)z0=z0.filter((t0)=>{if(S.includes(t0)||v0&&t0==="enable_tool")return!0;return f.toolAnnotations.get(t0)?.readOnlyHint===!0});let F0=K0&&R0?K0:null;return{activeTools:z0,messages:N0,...F0&&{toolChoice:{type:"tool",toolName:F0}}}}})(),i=q.size>0?{role:"system",content:`<currently-enabled-tools>
 ${[...q].sort().join(`
 `)}
-</currently-enabled-tools>`}:null,l=$.virtualMcp.metadata,M=await pm0({kind:"agent",ctx:u,organization:{id:$.organizationId},virtualMcp:{id:$.agent.id,repo:l?.githubRepo??void 0},mcpClient:f.passthroughClient,provider:w,models:$.models,messages:W,abortSignal:Y,temperature:$.temperature,planMode:v.isPlanMode,isDecopilot:_D($.agent.id)!==null,systemAgentInstructions:f.serverInstructions,currentThreadId:F,writer:B,subtaskParams:{provider:w,organization:{id:$.organizationId},models:$.models},prepareStep:h,passthroughClient:f.passthroughClient,connectionsData:{tools:f.connectionsBlockTools,connectionTitleMap:f.connectionTitleMap},extraTools:{...f.builtInTools,...f.connectionsBlockTools.length>0&&y.enable_tool?{enable_tool:y.enable_tool}:{}},additionalSystemMessages:[...Z,...i?[i]:[]]}),x=M.result;Promise.resolve(x.finishReason).then(async(K0)=>{let[L0,S0,W0,R0]=await Promise.all([x.totalUsage,x.usage,x.request,x.response]);if(await M.error!==void 0)return;M.span.setAttribute("decopilot.llm.inputTokens",L0.inputTokens??0),M.span.setAttribute("decopilot.llm.outputTokens",L0.outputTokens??0),M.span.setAttribute("decopilot.llm.finishReason",K0);let u1=I.cacheTotals();M.span.setAttribute("decopilot.cache.read_tokens",u1.read),M.span.setAttribute("decopilot.cache.write_tokens",u1.write);let N0=u1.input>0?u1.read/u1.input:0;M.span.setAttribute("decopilot.cache.hit_ratio",N0);let v0=Date.now()-(N??Date.now());if(O=!0,sm0({ctx:u,organizationId:$.organizationId,modelId:$.models.thinking.id,durationMs:v0,isError:!1,inputTokens:L0.inputTokens,outputTokens:L0.outputTokens,cacheReadTokens:u1.read,cacheWriteTokens:u1.write}),J.onUsageAggregated({inputTokens:L0.inputTokens??0,outputTokens:L0.outputTokens??0,totalTokens:L0.totalTokens??0}),om0({ctx:u,organizationId:$.organizationId,agentId:$.agent.id,modelId:$.models.thinking.id,modelTitle:$.models.thinking.title??$.models.thinking.id,credentialId:$.models.credentialId,taskId:F,durationMs:v0,isError:!1,finishReason:K0,usage:{inputTokens:S0.inputTokens??0,outputTokens:S0.outputTokens??0,totalTokens:S0.totalTokens??0},totalUsage:{inputTokens:L0.inputTokens??0,outputTokens:L0.outputTokens??0,totalTokens:L0.totalTokens??0},request:W0,response:R0,userId:$.user.id,requestId:u.metadata.requestId,userAgent:u.metadata.userAgent??null}),Y.aborted)return}).catch(async(K0)=>{let L0=K0 instanceof Error?K0:Error(Bs(K0));if(console.error("[decopilot:stream] Error",L0),Y.aborted)return;if(!O){let S0=Date.now()-(N??Date.now());O=!0,sm0({ctx:u,organizationId:$.organizationId,modelId:$.models.thinking.id,durationMs:S0,isError:!0,errorType:L0.name}),om0({ctx:u,organizationId:$.organizationId,agentId:$.agent.id,modelId:$.models.thinking.id,modelTitle:$.models.thinking.title??$.models.thinking.id,credentialId:$.models.credentialId,taskId:F,durationMs:S0,isError:!0,errorMessage:L0.message,userId:$.user.id,requestId:u.metadata.requestId,userAgent:u.metadata.userAgent??null})}}),M.error.then(async(K0)=>{if(!Y.aborted||O)return;let L0=await x.steps;if(!L0.length||O)return;O=!0;let S0=Date.now()-(N??Date.now()),W0=L0.reduce((u1,N0)=>({inputTokens:u1.inputTokens+(N0.usage.inputTokens??0),outputTokens:u1.outputTokens+(N0.usage.outputTokens??0),totalTokens:u1.totalTokens+(N0.usage.totalTokens??0)}),{inputTokens:0,outputTokens:0,totalTokens:0}),R0=L0[L0.length-1].usage,d0=I.cacheTotals();if(sm0({ctx:u,organizationId:$.organizationId,modelId:$.models.thinking.id,durationMs:S0,isError:!1,inputTokens:W0.inputTokens,outputTokens:W0.outputTokens,cacheReadTokens:d0.read,cacheWriteTokens:d0.write}),om0({ctx:u,organizationId:$.organizationId,agentId:$.agent.id,modelId:$.models.thinking.id,modelTitle:$.models.thinking.title??$.models.thinking.id,credentialId:$.models.credentialId,taskId:F,durationMs:S0,isError:!1,finishReason:"abort",usage:{inputTokens:R0.inputTokens??0,outputTokens:R0.outputTokens??0,totalTokens:R0.totalTokens??0},totalUsage:W0,request:void 0,response:void 0,userId:$.user.id,requestId:u.metadata.requestId,userAgent:u.metadata.userAgent??null}),W0.totalTokens>0){let u1=I.cost();z.push({type:"message-metadata",messageMetadata:{usage:{inputTokens:W0.inputTokens,outputTokens:W0.outputTokens,totalTokens:W0.totalTokens,cachedInputTokens:d0.read,inputTokenDetails:{cacheReadTokens:d0.read,cacheWriteTokens:d0.write,noCacheTokens:W0.inputTokens-d0.read-d0.write},...u1>0&&{providerMetadata:{openrouter:{usage:{cost:u1}}}}}}})}});let o=x.toUIMessageStream({originalMessages:G,generateMessageId:_I0,onError:(K0)=>Fw0(K0),messageMetadata:({part:K0})=>{if(K0.type==="start")return{agent:{id:$.agent.id??null},models:{credentialId:$.models.credentialId,thinking:{...$.models.thinking,title:$.models.thinking.title??$.models.thinking.id,provider:$.models.thinking.provider??void 0}},created_at:new Date,_request:{systemSections:X.systemMessages.map((L0)=>({chars:L0.content.length,preview:L0.content.slice(0,80).replace(/\s+/g," ")})),tools:Object.keys(y).length,activeTools:S.length+("enable_tool"in y?1:0)+q.size},thread_id:F};if(K0.type==="reasoning-start"){if(j===null)j=new Date;return{reasoning_start_at:j}}if(K0.type==="reasoning-end")return{reasoning_end_at:new Date};if(K0.type==="finish-step")return I.addStep(K0.usage,K0.providerMetadata),{usage:I.buildStepUsage()};if(K0.type==="finish"){let L0=I.buildFinalUsage({totalUsage:K0.totalUsage,providerKey:$.models.thinking.provider,fallbackProviderMetadata:K0.providerMetadata});return L0?{usage:L0}:{}}return}})[Symbol.asyncIterator](),w0=!1,$0=!1,E0=o.next().then((K0)=>({kind:"main",value:K0})),X0=z.next().then((K0)=>({kind:"queue",value:K0})),O0=T.then((K0)=>({kind:"title",value:K0}));try{while(!0){if(w0&&$0){z.close();while(!0){let S0=await z.next();if(S0.done)break;yield S0.value}break}let K0=[X0];if(!w0)K0.push(E0);if(!$0)K0.push(O0);let L0=await Promise.race(K0);if(L0.kind==="main"){if(L0.value.done){if(w0=!0,!$0)_.finish();continue}yield L0.value.value,E0=o.next().then((S0)=>({kind:"main",value:S0}))}else if(L0.kind==="title"){if($0=!0,L0.value)yield L0.value}else{if(!L0.value.done)yield L0.value.value;X0=z.next().then((S0)=>({kind:"queue",value:S0}))}}}finally{if(!$0)_.finish();z.close()}}var yy$=U(()=>{Ry$();Cy$();My$();im0();lD();am0();bm0();Oy1();iu()});var gy$;var Vy$=U(()=>{Sm0();lD();ky$();Uy1();yy$();z80();gy$={id:"decopilot",create($){if(!("storage"in $)||!("db"in $))throw Error("decopilot harness requires MeshContext (cluster-side only); got narrow HarnessContext");let u=$;return{id:"decopilot",async*stream(f){let X=f.processLocal,J=f;if(!X)throw Error("Decopilot harness requires HarnessStreamInput.processLocal in this build. Remote dispatch is not yet supported.");if(!X.provider)throw Error("Decopilot harness requires processLocal.provider to be activated.");let w=lL0(f.agent.id),E=f;if(w){let Y=await t5$(w,{orgId:u.organization.id,ctx:u}),Z=J.virtualMcp,W=Y.selectedTools?[...Y.selectedTools]:null;E={...f,virtualMcp:{...Z,metadata:{...Z.metadata??{},instructions:Y.instructions},connections:Z.connections.map((G)=>({...G,selected_tools:W}))}}}let Q=await Sy$(E,u,{writer:X.writer,toolOutputMap:X.toolOutputMap,pendingImages:X.pendingImages,threadId:X.threadId,provider:X.provider,imageProvider:X.imageProvider??X.provider,deepResearchProvider:X.deepResearchProvider??X.provider,htmlPageBuffer:X.htmlPageBuffer});try{let{systemMessages:Y,messages:Z,originalMessages:W}=await gC$(J.messages,{windowSize:vH,models:f.models,tools:Q.tools}),G=Z,F=await Xy$(E,u,Q);yield*hy$(E,u,Q,F,{provider:X.provider,titleProvider:X.titleProvider??X.provider,titleModel:X.titleModel??f.models.fast??f.models.thinking,registrySignal:X.registrySignal,runRegistry:X.runRegistry,processedSystemMessages:Y,processedMessages:G,originalMessages:W,threadId:X.threadId,currentThreadTitle:X.currentThreadTitle,registerPendingOp:X.registerPendingOp,isStreamFinished:X.isStreamFinished,onUsageAggregated:X.onUsageAggregated,pendingImages:X.pendingImages,onTitleUpdated:X.onTitleUpdated,writer:X.writer})}finally{await Q.close().catch(()=>{})}}}}}});function em0($){by$.set($.id,$)}function iy$($){return by$.get($)}var by$;var jy1=U(()=>{by$=new Map});function Ly1($,u,f){let X=iy$($);if(!X)throw Error(`No harness factory registered for id "${$}". Available ids must be registered in apps/mesh/src/harnesses/index.ts.`);return X.create(f).stream(u)}var xy$=U(()=>{jy1()});var ly$=U(()=>{TM$();Ph$();Vy$();jy1();xy$();em0(gy$);em0(LM$);em0(_h$)});function cy$($,u,f){let X=u-f;if(X<=0)throw Error("frame overhead exceeds maxBytes");let J=Math.max(1,Math.floor(X/6));if($.length<=J)return[$];let w=[],E=0;while(E<$.length){let Q=Math.min(E+J,$.length);if(Q<$.length){let Y=$.charCodeAt(Q-1);if(Y>=55296&&Y<=56319)Q-=1}if(Q<=E)Q=E+1;w.push($.slice(E,Q)),E=Q}return w}var IF=786432;function $n0($){return`link-dispatch/${$}`}function dy$($){return $>IF}async function my$($){let u=await crypto.subtle.digest("SHA-256",$);return Array.from(new Uint8Array(u)).map((f)=>f.toString(16).padStart(2,"0")).join("")}var Ty1=()=>{};function ny$($,u,f,X){let{signal:J,processLocal:w,...E}=u;return{async*[Symbol.asyncIterator](){let Q=function*(W){let G=W.split(`
+</currently-enabled-tools>`}:null,l=$.virtualMcp.metadata,M=await pm0({kind:"agent",ctx:u,organization:{id:$.organizationId},virtualMcp:{id:$.agent.id,repo:l?.githubRepo??void 0},mcpClient:f.passthroughClient,provider:w,models:$.models,messages:W,abortSignal:Y,temperature:$.temperature,planMode:v.isPlanMode,isDecopilot:_D($.agent.id)!==null,systemAgentInstructions:f.serverInstructions,currentThreadId:F,writer:B,subtaskParams:{provider:w,organization:{id:$.organizationId},models:$.models},prepareStep:h,passthroughClient:f.passthroughClient,connectionsData:{tools:f.connectionsBlockTools,connectionTitleMap:f.connectionTitleMap},extraTools:{...f.builtInTools,...f.connectionsBlockTools.length>0&&y.enable_tool?{enable_tool:y.enable_tool}:{}},additionalSystemMessages:[...Z,...i?[i]:[]]}),x=M.result;Promise.resolve(x.finishReason).then(async(K0)=>{let[L0,S0,W0,R0]=await Promise.all([x.totalUsage,x.usage,x.request,x.response]);if(await M.error!==void 0)return;M.span.setAttribute("decopilot.llm.inputTokens",L0.inputTokens??0),M.span.setAttribute("decopilot.llm.outputTokens",L0.outputTokens??0),M.span.setAttribute("decopilot.llm.finishReason",K0);let u1=I.cacheTotals();M.span.setAttribute("decopilot.cache.read_tokens",u1.read),M.span.setAttribute("decopilot.cache.write_tokens",u1.write);let N0=u1.input>0?u1.read/u1.input:0;M.span.setAttribute("decopilot.cache.hit_ratio",N0);let v0=Date.now()-(N??Date.now());if(O=!0,sm0({ctx:u,organizationId:$.organizationId,modelId:$.models.thinking.id,durationMs:v0,isError:!1,inputTokens:L0.inputTokens,outputTokens:L0.outputTokens,cacheReadTokens:u1.read,cacheWriteTokens:u1.write}),J.onUsageAggregated({inputTokens:L0.inputTokens??0,outputTokens:L0.outputTokens??0,totalTokens:L0.totalTokens??0}),om0({ctx:u,organizationId:$.organizationId,agentId:$.agent.id,modelId:$.models.thinking.id,modelTitle:$.models.thinking.title??$.models.thinking.id,credentialId:$.models.credentialId,taskId:F,durationMs:v0,isError:!1,finishReason:K0,usage:{inputTokens:S0.inputTokens??0,outputTokens:S0.outputTokens??0,totalTokens:S0.totalTokens??0},totalUsage:{inputTokens:L0.inputTokens??0,outputTokens:L0.outputTokens??0,totalTokens:L0.totalTokens??0},request:W0,response:R0,userId:$.user.id,requestId:u.metadata.requestId,userAgent:u.metadata.userAgent??null}),Y.aborted)return}).catch(async(K0)=>{let L0=K0 instanceof Error?K0:Error(Bs(K0));if(console.error("[decopilot:stream] Error",L0),Y.aborted)return;if(!O){let S0=Date.now()-(N??Date.now());O=!0,sm0({ctx:u,organizationId:$.organizationId,modelId:$.models.thinking.id,durationMs:S0,isError:!0,errorType:L0.name}),om0({ctx:u,organizationId:$.organizationId,agentId:$.agent.id,modelId:$.models.thinking.id,modelTitle:$.models.thinking.title??$.models.thinking.id,credentialId:$.models.credentialId,taskId:F,durationMs:S0,isError:!0,errorMessage:L0.message,userId:$.user.id,requestId:u.metadata.requestId,userAgent:u.metadata.userAgent??null})}}),M.error.then(async(K0)=>{if(!Y.aborted||O)return;let L0=await x.steps;if(!L0.length||O)return;O=!0;let S0=Date.now()-(N??Date.now()),W0=L0.reduce((u1,N0)=>({inputTokens:u1.inputTokens+(N0.usage.inputTokens??0),outputTokens:u1.outputTokens+(N0.usage.outputTokens??0),totalTokens:u1.totalTokens+(N0.usage.totalTokens??0)}),{inputTokens:0,outputTokens:0,totalTokens:0}),R0=L0[L0.length-1].usage,d0=I.cacheTotals();if(sm0({ctx:u,organizationId:$.organizationId,modelId:$.models.thinking.id,durationMs:S0,isError:!1,inputTokens:W0.inputTokens,outputTokens:W0.outputTokens,cacheReadTokens:d0.read,cacheWriteTokens:d0.write}),om0({ctx:u,organizationId:$.organizationId,agentId:$.agent.id,modelId:$.models.thinking.id,modelTitle:$.models.thinking.title??$.models.thinking.id,credentialId:$.models.credentialId,taskId:F,durationMs:S0,isError:!1,finishReason:"abort",usage:{inputTokens:R0.inputTokens??0,outputTokens:R0.outputTokens??0,totalTokens:R0.totalTokens??0},totalUsage:W0,request:void 0,response:void 0,userId:$.user.id,requestId:u.metadata.requestId,userAgent:u.metadata.userAgent??null}),W0.totalTokens>0){let u1=I.cost();z.push({type:"message-metadata",messageMetadata:{usage:{inputTokens:W0.inputTokens,outputTokens:W0.outputTokens,totalTokens:W0.totalTokens,cachedInputTokens:d0.read,inputTokenDetails:{cacheReadTokens:d0.read,cacheWriteTokens:d0.write,noCacheTokens:W0.inputTokens-d0.read-d0.write},...u1>0&&{providerMetadata:{openrouter:{usage:{cost:u1}}}}}}})}});let o=x.toUIMessageStream({originalMessages:G,generateMessageId:_I0,onError:(K0)=>Fw0(K0),messageMetadata:({part:K0})=>{if(K0.type==="start")return{agent:{id:$.agent.id??null},models:{credentialId:$.models.credentialId,thinking:{...$.models.thinking,title:$.models.thinking.title??$.models.thinking.id,provider:$.models.thinking.provider??void 0}},created_at:new Date,_request:{systemSections:X.systemMessages.map((L0)=>({chars:L0.content.length,preview:L0.content.slice(0,80).replace(/\s+/g," ")})),tools:Object.keys(y).length,activeTools:S.length+("enable_tool"in y?1:0)+q.size},thread_id:F};if(K0.type==="reasoning-start"){if(j===null)j=new Date;return{reasoning_start_at:j}}if(K0.type==="reasoning-end")return{reasoning_end_at:new Date};if(K0.type==="finish-step")return I.addStep(K0.usage,K0.providerMetadata),{usage:I.buildStepUsage()};if(K0.type==="finish"){let L0=I.buildFinalUsage({totalUsage:K0.totalUsage,providerKey:$.models.thinking.provider,fallbackProviderMetadata:K0.providerMetadata});return L0?{usage:L0}:{}}return}})[Symbol.asyncIterator](),w0=!1,$0=!1,E0=o.next().then((K0)=>({kind:"main",value:K0})),X0=z.next().then((K0)=>({kind:"queue",value:K0})),O0=T.then((K0)=>({kind:"title",value:K0}));try{while(!0){if(w0&&$0){z.close();while(!0){let S0=await z.next();if(S0.done)break;yield S0.value}break}let K0=[X0];if(!w0)K0.push(E0);if(!$0)K0.push(O0);let L0=await Promise.race(K0);if(L0.kind==="main"){if(L0.value.done){if(w0=!0,!$0)_.finish();continue}yield L0.value.value,E0=o.next().then((S0)=>({kind:"main",value:S0}))}else if(L0.kind==="title"){if($0=!0,L0.value)yield L0.value}else{if(!L0.value.done)yield L0.value.value;X0=z.next().then((S0)=>({kind:"queue",value:S0}))}}}finally{if(!$0)_.finish();z.close()}}var yy$=U(()=>{Ry$();Cy$();My$();im0();lD();am0();bm0();Oy1();iu()});var gy$;var Vy$=U(()=>{Sm0();lD();ky$();Uy1();yy$();z80();gy$={id:"decopilot",create($){if(!("storage"in $)||!("db"in $))throw Error("decopilot harness requires StudioContext (cluster-side only); got narrow HarnessContext");let u=$;return{id:"decopilot",async*stream(f){let X=f.processLocal,J=f;if(!X)throw Error("Decopilot harness requires HarnessStreamInput.processLocal in this build. Remote dispatch is not yet supported.");if(!X.provider)throw Error("Decopilot harness requires processLocal.provider to be activated.");let w=lL0(f.agent.id),E=f;if(w){let Y=await t5$(w,{orgId:u.organization.id,ctx:u}),Z=J.virtualMcp,W=Y.selectedTools?[...Y.selectedTools]:null;E={...f,virtualMcp:{...Z,metadata:{...Z.metadata??{},instructions:Y.instructions},connections:Z.connections.map((G)=>({...G,selected_tools:W}))}}}let Q=await Sy$(E,u,{writer:X.writer,toolOutputMap:X.toolOutputMap,pendingImages:X.pendingImages,threadId:X.threadId,provider:X.provider,imageProvider:X.imageProvider??X.provider,deepResearchProvider:X.deepResearchProvider??X.provider,htmlPageBuffer:X.htmlPageBuffer});try{let{systemMessages:Y,messages:Z,originalMessages:W}=await gC$(J.messages,{windowSize:vH,models:f.models,tools:Q.tools}),G=Z,F=await Xy$(E,u,Q);yield*hy$(E,u,Q,F,{provider:X.provider,titleProvider:X.titleProvider??X.provider,titleModel:X.titleModel??f.models.fast??f.models.thinking,registrySignal:X.registrySignal,runRegistry:X.runRegistry,processedSystemMessages:Y,processedMessages:G,originalMessages:W,threadId:X.threadId,currentThreadTitle:X.currentThreadTitle,registerPendingOp:X.registerPendingOp,isStreamFinished:X.isStreamFinished,onUsageAggregated:X.onUsageAggregated,pendingImages:X.pendingImages,onTitleUpdated:X.onTitleUpdated,writer:X.writer})}finally{await Q.close().catch(()=>{})}}}}}});function em0($){by$.set($.id,$)}function iy$($){return by$.get($)}var by$;var jy1=U(()=>{by$=new Map});function Ly1($,u,f){let X=iy$($);if(!X)throw Error(`No harness factory registered for id "${$}". Available ids must be registered in apps/mesh/src/harnesses/index.ts.`);return X.create(f).stream(u)}var xy$=U(()=>{jy1()});var ly$=U(()=>{TM$();Ph$();Vy$();jy1();xy$();em0(gy$);em0(LM$);em0(_h$)});function cy$($,u,f){let X=u-f;if(X<=0)throw Error("frame overhead exceeds maxBytes");let J=Math.max(1,Math.floor(X/6));if($.length<=J)return[$];let w=[],E=0;while(E<$.length){let Q=Math.min(E+J,$.length);if(Q<$.length){let Y=$.charCodeAt(Q-1);if(Y>=55296&&Y<=56319)Q-=1}if(Q<=E)Q=E+1;w.push($.slice(E,Q)),E=Q}return w}var IF=786432;function $n0($){return`link-dispatch/${$}`}function dy$($){return $>IF}async function my$($){let u=await crypto.subtle.digest("SHA-256",$);return Array.from(new Uint8Array(u)).map((f)=>f.toString(16).padStart(2,"0")).join("")}var Ty1=()=>{};function ny$($,u,f,X){let{signal:J,processLocal:w,...E}=u;return{async*[Symbol.asyncIterator](){let Q=function*(W){let G=W.split(`
 `).filter((v)=>v.startsWith("data: ")).map((v)=>v.slice(6));if(G.length===0)return;let F;try{F=JSON.parse(G.join(`
 `))}catch{return}let B=AT4.safeParse(F);if(!B.success)return;if(B.data.type==="ui-message-chunk")yield B.data.chunk;else if(B.data.type==="error")throw Error(`[remoteDispatch] ${B.data.code}: ${B.data.message}`)},Y=null,Z=!1;try{let W=JSON.stringify({harnessId:$,input:E}),G=W;if(dy$(Buffer.byteLength(W,"utf8"))){if(!X.offload?.supported)throw Error("[remoteDispatch] request too large and the remote sandbox cannot receive offloaded payloads (daemon too old or no object storage configured)");let H=crypto.randomUUID(),_=await X.offload.put(H,JSON.stringify(E.messages));Y=$n0(H),G=JSON.stringify({harnessId:$,input:{...E,messages:[]},messagesRef:_})}let F=await X.proxyDaemonRequest(f,"/dispatch",{method:"POST",headers:{"content-type":"application/json",accept:"text/event-stream"},body:G,signal:J});if(!F.ok){let H=`dispatch failed (${F.status})`;try{let _=await F.json();if(_&&typeof _==="object"&&"error"in _&&_.error)H=String(_.error)}catch{}throw Error(`[remoteDispatch] ${H}`)}let B=F.body;if(!B)throw Error("[remoteDispatch] response body is null");let v=B.getReader(),N=new TextDecoder,O="";while(!0){let{value:H,done:_}=await v.read();if(_)break;O+=N.decode(H,{stream:!0});let T=O.indexOf(`
@@ -79432,7 +79432,7 @@ ${J}`:X}}catch{let f=u.split(`
 Return ONLY valid JSON with this shape:
 {"title":"Short imperative commit title (max 72 chars)","body":"1-3 sentence PR description explaining what changed and why"}
-Use sentence case for the title. No markdown fences.`;var Pi$=U(()=>{a3();r90()});function BO3($){if(!$||$.length>255||$.includes("..")||$.startsWith("/")||$.endsWith("/")||$.endsWith(".lock")||!FO3.test($))throw Error(`Invalid branch name: ${$}`)}function GV1($){let{runner:u}=$.get("vmClaim");if(!u)return $.json({error:"No sandbox runner configured"},503);return u}async function hw($,u,f){let X=GV1($);if(X instanceof Response)return X;let{claimName:J}=$.get("vmClaim"),w=f?.method??"POST",E=null,Q=new Headers;if(f?.forwardJsonBody)E=await $.req.text(),Q.set("content-type","application/json");let Y;try{Y=await X.proxyDaemonRequest(J,u,{method:w,headers:Q,body:E,...f?.signal?{signal:f.signal}:{}})}catch(G){let F=G instanceof Error?G.message:String(G);return $.json({error:`Daemon unreachable: ${F}`},502)}if(f?.map404to410&&Y.status===404){try{await Y.body?.cancel()}catch{}return $.json({error:"Sandbox handle is gone. The sandbox needs to be re-provisioned."},410,Rs)}let Z=await Y.text(),W=Y.headers.get("content-type")??"application/json";return new Response(Z,{status:Y.status,headers:{"content-type":W,...Rs}})}async function ji$($,u,f,X="GET"){let J=await $.proxyDaemonRequest(u,f,{method:X,headers:new Headers,body:null});if(J.status===404){try{await J.body?.cancel()}catch{}throw Error("SANDBOX_GONE")}let w=await J.text();if(!J.ok)try{let E=JSON.parse(w);throw Error(E.error??`Daemon error (${J.status})`)}catch(E){if(E instanceof Error&&E.message!==w)throw E;throw Error(`Daemon error (${J.status})`)}return JSON.parse(w)}function OO3($){return Li$.includes($)}var FO3,vO3=524288,UO3,Rs,NO3,Li$,Ti$=()=>{let $=new d4;return $.use("/:virtualMcpId/:branch/*",UO3),$.post("/:virtualMcpId/:branch/write",(u)=>hw(u,"/_sandbox/write",{forwardJsonBody:!0})),$.post("/:virtualMcpId/:branch/unlink",(u)=>hw(u,"/_sandbox/unlink",{forwardJsonBody:!0})),$.post("/:virtualMcpId/:branch/read",(u)=>hw(u,"/_sandbox/read",{forwardJsonBody:!0})),$.post("/:virtualMcpId/:branch/glob",(u)=>hw(u,"/_sandbox/glob",{forwardJsonBody:!0})),$.post("/:virtualMcpId/:branch/exec/:script",(u)=>{let f=u.req.param("script");if(!f)return u.json({error:"missing script name"},400);return hw(u,`/_sandbox/exec/${encodeURIComponent(f)}`)}),$.post("/:virtualMcpId/:branch/exec/:script/kill",(u)=>{let f=u.req.param("script");if(!f)return u.json({error:"missing script name"},400);return hw(u,`/_sandbox/exec/${encodeURIComponent(f)}/kill`)}),$.get("/:virtualMcpId/:branch/config",(u)=>hw(u,"/_sandbox/config",{method:"GET",map404to410:!0})),$.put("/:virtualMcpId/:branch/config",(u)=>hw(u,"/_sandbox/config",{method:"PUT",forwardJsonBody:!0,map404to410:!0})),$.post("/:virtualMcpId/:branch/setup/:step",async(u)=>{let f=u.req.param("step");if(!f||!OO3(f))return u.json({error:`step must be one of: ${Li$.join(", ")}`},400);if(f==="start"){let X=u.get("vmClaim");if(X.runner){let J=r0(u.var.meshContext),w=eP$(X.virtualMcpMetadata);try{await tk0({ctx:u.var.meshContext,runner:X.runner,handle:X.claimName,orgId:J.id,userId:X.userId,entries:w})}catch(E){let Q=E instanceof Error?E.message:String(E);return u.json({error:`Failed to push env to daemon: ${Q}`},502)}}}return hw(u,`/_sandbox/setup/${f}`,{signal:u.req.raw.signal,map404to410:!0})}),$.get("/:virtualMcpId/:branch/events",(u)=>{let f=u.get("vmClaim");if(!f.runner)return J2(u,async(X)=>{await X.writeSSE({event:"phase",data:JSON.stringify({kind:"failed",reason:"unknown",message:"No sandbox runner configured on this mesh."})})});return Ni$(u,{ctx:u.var.meshContext,claimName:f.claimName,runner:f.runner,branch:f.branch,userId:f.userId,projectRef:f.projectRef,virtualMcpMetadata:f.virtualMcpMetadata})}),$.get("/:virtualMcpId/:branch/git/status",(u)=>hw(u,"/_sandbox/git/status",{method:"GET",map404to410:!0})),$.post("/:virtualMcpId/:branch/git/status",(u)=>hw(u,"/_sandbox/git/status",{map404to410:!0})),$.post("/:virtualMcpId/:branch/git/diff",(u)=>hw(u,"/_sandbox/git/diff",{forwardJsonBody:!0,map404to410:!0})),$.post("/:virtualMcpId/:branch/git/publish",(u)=>hw(u,"/_sandbox/git/publish",{forwardJsonBody:!0,map404to410:!0})),$.post("/:virtualMcpId/:branch/git/discard",(u)=>hw(u,"/_sandbox/git/discard",{forwardJsonBody:!0,map404to410:!0})),$.post("/:virtualMcpId/:branch/git/rebase",(u)=>hw(u,"/_sandbox/git/rebase",{forwardJsonBody:!0,map404to410:!0})),$.post("/:virtualMcpId/:branch/git/suggest-commit",D_({maxSize:vO3,onError:(u)=>u.json({error:"Payload too large"},413,Rs)}),async(u)=>{let f=GV1(u);if(f instanceof Response)return f;let{claimName:X}=u.get("vmClaim"),J=u.var.meshContext;try{let[w,E]=await Promise.all([ji$(f,X,"/_sandbox/git/status","GET"),ji$(f,X,"/_sandbox/git/diff","GET")]),Q=await _i$(J,w,E);return u.json(Q,200,Rs)}catch(w){let E=w instanceof Error?w.message:String(w);if(E==="SANDBOX_GONE")return u.json({error:"Sandbox handle is gone. The sandbox needs to be re-provisioned."},410,Rs);return u.json({error:E},502,Rs)}}),$.get("/:virtualMcpId/:branch/preview-fetch",async(u)=>{let f=GV1(u);if(f instanceof Response)return f;let{claimName:X}=u.get("vmClaim"),J=u.req.query("path");if(!J)return u.json({error:"path query parameter is required"},400);if(!NO3.has(J))return u.json({error:"Path not allowed"},403);let w=await f.getPreviewUrl(X);if(!w)return u.json({error:"Preview not available"},502);let E=w.replace(/\/+$/,""),Q;try{Q=await fetch(`${E}${J}`)}catch{return u.json({error:"Preview unreachable"},502)}let Y=await Q.text();return new Response(Y,{status:Q.status,headers:{"content-type":Q.headers.get("content-type")??"application/json"}})}),$};var Ai$=U(()=>{uf();vw0();$l();Bi$();bU();ZV1();sJ0();Oi$();yC1();nk0();Pi$();FO3=/^[a-zA-Z0-9][a-zA-Z0-9/._-]*$/;UO3=Fi$(async($,u)=>{let f=$.var.meshContext;try{X1(f)}catch{return $.json({error:"Unauthorized"},401)}let X=G$(f);if(!X)return $.json({error:"Unauthorized"},401);let J;try{J=r0(f)}catch{return $.json({error:"Organization scope required"},403)}let w=$.req.param("virtualMcpId"),E=$.req.param("branch");if(!w||!E)return $.json({error:"virtualMcpId and branch are required"},400);try{BO3(E)}catch(F){let B=F instanceof Error?F.message:String(F);return $.json({error:B},400)}let Q=await f.storage.virtualMcps.findById(w);if(!Q||Q.organization_id!==J.id)return $.json({error:"Virtual MCP not found"},404);let Y=EI({orgId:J.id,virtualMcpId:w,branch:E}),Z=Vn0({userId:X,projectRef:Y},E),W=Q.metadata??null,G;try{G=(await tU(f,{userId:X,branch:E,virtualMcpMetadata:W})).provider}catch{G=null}if(!G)return $.json({error:"No sandbox runner found"},404);return $.set("vmClaim",{claimName:Z,runner:G,virtualMcpId:w,branch:E,userId:X,projectRef:Y,virtualMcpMetadata:W}),u()});Rs={"Cache-Control":"no-store, no-cache, must-revalidate",Pragma:"no-cache"};NO3=new Set(["/.decofile","/live/_meta"]),Li$=["clone","install","start"]});var Ii$=($)=>{let u=new d4;if(u.use("*",dx),u.route("/",un0()),u.route("/",hn0()),u.route("/",qn0({kvStorage:$.kvStorage})),u.route("/",wi$()),u.route("/sandbox",Ti$()),u.route("/",Qi$()),u.route("/deco-sites",fn0()),u.route("/sso",Im0()),u.route("/",yn0({tokenStorage:$.tokenStorage,automationEventDispatcher:$.automationEventDispatcher})),u.route("/webhooks",Kg$()),$.mountDevAssets)u.route("/dev-assets",Xn0({orgFromPath:!0}));return u.use("/mcp/:connectionId?",$.mcpAuth),u.use("/mcp/gateway/:virtualMcpId?",$.mcpAuth),u.use("/mcp/virtual-mcp/:virtualMcpId?",$.mcpAuth),u.use("/mcp/self",$.mcpAuth),u.route("/",XB$()),u.get("/mcp/:gateway?/:connectionId/.well-known/oauth-protected-resource/*",$.betterAuthProtectedResourceHandler),u.route("/mcp",oS0()),u.route("/mcp/self",Mn0()),u.route("/mcp",$k0()),u.all("/oauth-proxy/:connectionId/*",$.oauthProxyHandler),u.post("/events/:type",$.eventsHandler),u.get("/watch",$.watchHandler),u};var Si$=U(()=>{uf();hy1();Hg$();iy1();Jn0();qy1();Ei$();XV1();g90();Ph1();uk0();JV1();Yi$();wV1();EV1();sS0();Ai$()});async function HO3($,u){try{return!await $.alive(u)}catch(f){return console.warn(`[vm-events] alive probe failed for ${u}; assuming alive: ${f instanceof Error?f.message:String(f)}`),!1}}async function _O3($){let{ctx:u,runner:f,claimName:X,userId:J,projectRef:w,sandboxProviderKind:E}=$;try{await f.delete(X)}catch(Q){console.warn(`[vm-events] runner.delete failed for ${X}: ${Q instanceof Error?Q.message:String(Q)}`)}try{await new nH(u.db).delete({userId:J,projectRef:w},E)}catch(Q){console.warn(`[vm-events] sandbox_runner_state delete failed for ${J}/${w}/${E}: ${Q instanceof Error?Q.message:String(Q)}`)}}async function PO3($){let{stream:u,claimName:f,runner:X,signal:J}=$;return new Promise((w)=>{let E=!1,Q=!1,Y=null,Z=(F)=>{if(E)return;E=!0,clearTimeout(W),J.removeEventListener("abort",G),Y?.unsubscribe(),w(F)},W=setTimeout(()=>{if(Q||E)return;u.writeSSE({event:"phase",data:JSON.stringify({kind:"failed",reason:"claim-never-created",message:"Sandbox claim was never created. The SANDBOX_START call may have failed earlier \u2014 check the start error."})}).catch(()=>{}),Z(!1)},zO3),G=()=>Z(!1);J.addEventListener("abort",G,{once:!0}),Y=oJ0(X,f,(F)=>{if(E)return;if(F.kind!=="claiming")Q=!0;if(u.writeSSE({event:"phase",data:JSON.stringify(F)}).catch(()=>{}),F.kind==="ready")Z(!0);else if(F.kind==="failed")Z(!1)})})}async function jO3($){let{stream:u,runner:f,claimName:X,signal:J}=$,w=Date.now(),E=null;while(!J.aborted){let Y=null;try{Y=await f.proxyDaemonRequest(X,"/_sandbox/events",{method:"GET",headers:new Headers({accept:"text/event-stream"}),body:null,signal:J})}catch(Z){if(J.aborted)return;if(Date.now()-w<ki$){await k3(Ri$,{signal:J}).catch(()=>{});continue}let W=Z instanceof Error?Z.message:String(Z);await u.writeSSE({event:"phase",data:JSON.stringify({kind:"failed",reason:"unknown",message:`Upstream daemon SSE error: ${W}`})}).catch(()=>{});return}if(Y.status===404){try{await Y.body?.cancel()}catch{}if(Date.now()-w<ki$){await k3(Ri$,{signal:J}).catch(()=>{});continue}await u.writeSSE({event:"gone",data:""}).catch(()=>{});return}if(!Y.ok||!Y.body){try{await Y.body?.cancel()}catch{}await u.writeSSE({event:"phase",data:JSON.stringify({kind:"failed",reason:"unknown",message:`Upstream daemon SSE failed (${Y.status}).`})}).catch(()=>{});return}E=Y;break}if(!E||!E.body)return;let Q=E.body.getReader();try{while(!J.aborted){let{value:Y,done:Z}=await Q.read();if(Z)break;if(Y)await u.write(Y)}}catch{}finally{try{Q.releaseLock()}catch{}}}var zO3=90000,KO3=15000,Ci$=()=>{let $=new d4;return $.get("/",async(u)=>{let f=u.var.meshContext;try{X1(f)}catch{return u.json({error:"Unauthorized"},401)}let X=G$(f);if(!X)return u.json({error:"Unauthorized"},401);let J;try{J=r0(f)}catch{return u.json({error:"Organization scope required"},403)}let w=u.req.query("virtualMcpId"),E=u.req.query("branch");if(!w||!E)return u.json({error:"virtualMcpId and branch are required"},400);let Q=await f.storage.virtualMcps.findById(w);if(!Q||Q.organization_id!==J.id)return u.json({error:"Virtual MCP not found"},404);let Y=EI({orgId:J.id,virtualMcpId:w,branch:E}),Z=Vn0({userId:X,projectRef:Y},E),W=Q.metadata??null,G,F=null,B=null;try{let O=await tU(f,{userId:X,branch:E,virtualMcpMetadata:W});G=O.provider,F=O.kind}catch(O){B=O instanceof Error?O:Error(String(O)),G=null}let v=F&&mH(u2(W),X,E,F),N=!!v&&v.sandboxHandle===Z;if(!G)return J2(u,async(O)=>{await O.writeSSE({event:"phase",data:JSON.stringify({kind:"failed",reason:"unknown",message:B?.message??"No sandbox runner configured on this mesh."})})});return u.header("X-Accel-Buffering","no"),u.header("Content-Encoding","identity"),J2(u,async(O)=>{let z=new AbortController,H=setInterval(()=>{O.writeSSE({event:"keepalive",data:""}).catch(()=>{clearInterval(H)})},KO3);O.onAbort(()=>{z.abort(),clearInterval(H)});try{if(N&&F){if(await HO3(G,Z)){await _O3({ctx:f,runner:G,claimName:Z,userId:X,projectRef:Y,sandboxProviderKind:F}),await O.writeSSE({event:"gone",data:""}).catch(()=>{});return}}if(!await PO3({stream:O,claimName:Z,runner:G,signal:z.signal})||z.signal.aborted)return;await jO3({stream:O,runner:G,claimName:Z,signal:z.signal})}finally{clearInterval(H)}})}),$},ki$=60000,Ri$=500;var qi$=U(()=>{uf();$l();bU();bw();ZV1();gx();sJ0();rk0();iU()});function qF($,u="invalid_request_error",f=null,X=null){return{error:{message:$,type:u,param:f,code:X}}}function qO3($){if(!$)return null;let u=$.indexOf(":");if(u===-1)return{credentialId:null,modelId:$};let f=$.substring(0,u),X=$.substring(u+1);if(!f||!X)return null;return{credentialId:f,modelId:X}}function MO3($,u,f){try{return JSON.parse($)}catch{throw new yi$(`Invalid JSON in tool call arguments for function '${f}' (tool_call_id: ${u}): ${$}`)}}function hO3($){let u={};for(let f of $)if(f.role==="assistant"&&f.tool_calls)for(let X of f.tool_calls)u[X.id]=X.function.name;return $.map((f)=>{switch(f.role){case"system":return{role:"system",content:f.content};case"user":if(typeof f.content==="string")return{role:"user",content:f.content};return{role:"user",content:f.content.map((J)=>{if(J.type==="text")return{type:"text",text:J.text};return{type:"image",image:J.image_url.url}})};case"assistant":if(f.tool_calls&&f.tool_calls.length>0)return{role:"assistant",content:f.tool_calls.map((J)=>({type:"tool-call",toolCallId:J.id,toolName:J.function.name,input:MO3(J.function.arguments,J.id,J.function.name)}))};return{role:"assistant",content:f.content??""};case"tool":let X=u[f.tool_call_id]??"unknown";return{role:"tool",content:[{type:"tool-result",toolCallId:f.tool_call_id,toolName:X,output:{type:"text",value:f.content}}]}}})}function yO3($){let u=$.map((f)=>{let X=f.function.parameters?WY(f.function.parameters):WY({type:"object",properties:{}});return[f.function.name,uu({description:f.function.description,inputSchema:X})]});return Object.fromEntries(u)}function gO3($){if(!$)return;return{openai:{response_format:$}}}function VO3(){return`chatcmpl-${crypto.randomUUID().replace(/-/g,"").substring(0,29)}`}function Mi$($,u,f,X,J,w){let E={model:$,messages:u,tools:f,temperature:X.temperature,maxTokens:X.max_tokens,topP:X.top_p,frequencyPenalty:X.frequency_penalty,presencePenalty:X.presence_penalty,stopSequences:X.stop?Array.isArray(X.stop)?X.stop:[X.stop]:void 0,abortSignal:w};return J?{...E,providerOptions:J}:E}function hi$($){if($==="tool-calls")return"tool_calls";if($==="length")return"length";return"stop"}var LO3,TO3,AO3,IO3,SO3,kO3,RO3,CO3,yi$,gi$,Vi$;var bi$=U(()=>{a3();uf();$l();c0();LO3=D.object({type:D.literal("function"),function:D.object({name:D.string(),description:D.string().optional(),parameters:D.record(D.string(),D.unknown()).optional()})}),TO3=D.object({id:D.string(),type:D.literal("function"),function:D.object({name:D.string(),arguments:D.string()})}),AO3=D.discriminatedUnion("role",[D.object({role:D.literal("system"),content:D.string(),name:D.string().optional()}),D.object({role:D.literal("user"),content:D.union([D.string(),D.array(D.union([D.object({type:D.literal("text"),text:D.string()}),D.object({type:D.literal("image_url"),image_url:D.object({url:D.string(),detail:D.string().optional()})})]))]),name:D.string().optional()}),D.object({role:D.literal("assistant"),content:D.string().nullable().optional(),name:D.string().optional(),tool_calls:D.array(TO3).optional()}),D.object({role:D.literal("tool"),content:D.string(),tool_call_id:D.string()})]),IO3=D.object({type:D.literal("text")}),SO3=D.object({type:D.literal("json_object")}),kO3=D.object({type:D.literal("json_schema"),json_schema:D.object({name:D.string(),description:D.string().optional(),schema:D.record(D.string(),D.unknown()),strict:D.boolean().optional()})}),RO3=D.union([IO3,SO3,kO3]),CO3=D.object({model:D.string().describe("Format: 'model_id' or 'credential_id:model_id'"),messages:D.array(AO3),stream:D.boolean().optional().default(!1),temperature:D.number().min(0).max(2).optional(),max_tokens:D.number().positive().optional(),top_p:D.number().min(0).max(1).optional(),frequency_penalty:D.number().min(-2).max(2).optional(),presence_penalty:D.number().min(-2).max(2).optional(),stop:D.union([D.string(),D.array(D.string())]).optional(),tools:D.array(LO3).optional(),tool_choice:D.union([D.literal("auto"),D.literal("none"),D.literal("required"),D.object({type:D.literal("function"),function:D.object({name:D.string()})})]).optional(),response_format:RO3.optional(),user:D.string().optional()});yi$=class yi$ extends Error{constructor($){super($);this.name="MessageConversionError"}};gi$=new d4;gi$.post("/:org/v1/chat/completions",async($)=>{let u=$.get("meshContext"),f=$.req.param("org");try{if(!u.auth.apiKey?.id)return $.json(qF("API key authentication required. Provide a valid API key via Authorization header.","authentication_error"),401);if(!u.organization)return $.json(qF("Organization context is required. Ensure your API key has organization metadata.","invalid_request_error","organization"),400);if((u.organization.slug??u.organization.id)!==f)return $.json(qF("Organization mismatch. The API key's organization does not match the requested organization.","invalid_request_error","organization"),403);let X=await $.req.json(),J=CO3.safeParse(X);if(!J.success){let O=J.error.issues[0]??{message:"Invalid request",path:[]};return $.json(qF(`Invalid request: ${O.message}`,"invalid_request_error",O.path.length>0?O.path.join("."):null),400)}let w=J.data,E=qO3(w.model);if(!E)return $.json(qF("Invalid model format. Expected 'model_id' or 'credential_id:model_id' (e.g., 'claude-sonnet-4-6' or 'key_abc123:claude-sonnet-4-6')","invalid_request_error","model"),400);let{credentialId:Q}=E,{modelId:Y}=E;if(!Q){let O=await u.storage.aiProviderKeys.list({organizationId:u.organization.id});if(O.length===0)return $.json(qF("No AI provider credentials configured for this organization. Add a credential in settings or specify one explicitly via 'credential_id:model_id'.","invalid_request_error","model"),400);Q=O[0].id}let Z;try{Z=await u.aiProviders.activate(Q,u.organization.id)}catch{return $.json(qF(`AI provider credential not found or inaccessible: ${Q}`,"invalid_request_error","model"),404)}let W=Z.aiSdk.languageModel(Y),G=hO3(w.messages),F=w.tools?yO3(w.tools):void 0,B=gO3(w.response_format),v=VO3(),N=Math.floor(Date.now()/1000);if(w.stream)return J2($,async(O)=>{let z=Mi$(W,G,F,w,B,$.req.raw.signal);try{let H=eD(z),_=!1,T=0;for await(let j of H.fullStream){if(!_&&(j.type==="text-delta"||j.type==="tool-call"))await O.writeSSE({data:JSON.stringify({id:v,object:"chat.completion.chunk",created:N,model:w.model,choices:[{index:0,delta:{role:"assistant",content:""},finish_reason:null}]})}),_=!0;if(j.type==="text-delta")await O.writeSSE({data:JSON.stringify({id:v,object:"chat.completion.chunk",created:N,model:w.model,choices:[{index:0,delta:{content:j.text},finish_reason:null}]})});else if(j.type==="tool-call"){let I=T++;await O.writeSSE({data:JSON.stringify({id:v,object:"chat.completion.chunk",created:N,model:w.model,choices:[{index:0,delta:{tool_calls:[{index:I,id:j.toolCallId,type:"function",function:{name:j.toolName,arguments:JSON.stringify(j.input)}}]},finish_reason:null}]})})}else if(j.type==="finish")await O.writeSSE({data:JSON.stringify({id:v,object:"chat.completion.chunk",created:N,model:w.model,choices:[{index:0,delta:{},finish_reason:hi$(j.finishReason)}],usage:j.totalUsage?{prompt_tokens:j.totalUsage.inputTokens??0,completion_tokens:j.totalUsage.outputTokens??0,total_tokens:j.totalUsage.totalTokens??0}:void 0})})}await O.writeSSE({data:"[DONE]"})}catch(H){let _=H;console.error("[openai-compat:stream] Error:",_.message),await O.writeSSE({data:JSON.stringify({error:{message:_.message,type:"server_error"}})})}});else{let O=Mi$(W,G,F,w,B,$.req.raw.signal),z=await lH(O),H={role:"assistant",content:z.text||null};if(z.toolCalls&&z.toolCalls.length>0)H.tool_calls=z.toolCalls.map((_)=>({id:_.toolCallId,type:"function",function:{name:_.toolName,arguments:JSON.stringify("input"in _?_.input:{})}})),H.content=null;return $.json({id:v,object:"chat.completion",created:N,model:w.model,choices:[{index:0,message:H,finish_reason:hi$(z.finishReason)}],usage:{prompt_tokens:z.usage?.inputTokens??0,completion_tokens:z.usage?.outputTokens??0,total_tokens:z.usage?.totalTokens??0}})}}catch(X){let J=X;if(J.name==="AbortError")return $.json(qF("Request aborted","invalid_request_error"),400);if(J.name==="MessageConversionError")return $.json(qF(J.message,"invalid_request_error","messages"),400);return console.error("[openai-compat] Error:",J.message,J.stack),$.json(qF(J.message,"server_error"),500)}});Vi$=gi$});function iO3(){let $=process.env.POSTHOG_KEY;if(!$)return null;return{key:$,host:process.env.POSTHOG_HOST??bO3}}var ii$,bO3="https://us.i.posthog.com",xi$;var li$=U(()=>{uf();sK1();Vx();lW();$5();zh1();ii$=new d4;ii$.get("/",($)=>{let u={theme:g4$(),...KT().logo&&{logo:KT().logo},...rU()&&{internalUrl:UB0()},...g4().enableDecoImport&&{enableDecoImport:!0},brandExtractEnabled:!!g4().firecrawlApiKey,auth:IC$(),posthog:iO3()};return $.json({success:!0,config:u})});xi$=ii$});var ci$,di$;var mi$=U(()=>{uf();VG();Xw0();fa();ci$=new d4;ci$.get("/:org/files/*",async($)=>{let u=$.get("meshContext"),f=u.organization?.id;if(!u.auth?.user?.id){if(vs($))return $.redirect(`/login?next=${encodeURIComponent($.req.path)}`,302);throw new Pu(401,{message:"Authentication required"})}if(!f)throw new Pu(401,{message:"Organization context required"});let X=$.req.path.replace(/^.*\/files\//,"");if(!X)throw new Pu(400,{message:"Missing file key"});let J=await xx(X,u);if(!J)throw new Pu(503,{message:"Object storage not configured"});if(J.startsWith("data:")&&AZ()){let w=J.match(/^data:([^;]+);base64,(.+)$/s);if(!w)throw new Pu(500,{message:"Invalid data URL from storage"});let[,E,Q]=w,Y=Buffer.from(Q,"base64");return $.body(Y,200,{"Content-Type":E,"Cache-Control":"private, max-age=86400"})}return $.redirect(J,302)});di$=ci$});var ri$={};Y1(ri$,{shouldSkipMeshContext:()=>FV1,isServerPath:()=>nO3,SYSTEM_PATHS:()=>B_});function ni$($){return $===B_.HEALTH_LIVE||$===B_.HEALTH_READY||$===B_.METRICS||$.startsWith(Cs.WELL_KNOWN)}function ti$($){return $.startsWith(Cs.API)}function lO3($){return $==="/mcp"||$.startsWith(Cs.MCP)}function cO3($){return $.startsWith(Cs.OAUTH_PROXY)}function dO3($){return xO3.test($)}function mO3($){return $.startsWith(Cs.ORG)}function nO3($){return ti$($)||lO3($)||cO3($)||mO3($)||ni$($)}function FV1($){return $==="/"||$.startsWith(Cs.API_AUTH)||$==="/api/trigger-callback"||ni$($)||!ti$($)&&dO3($)}var B_,Cs,xO3;var BV1=U(()=>{B_={HEALTH_LIVE:"/health/live",HEALTH_READY:"/health/ready",METRICS:"/metrics"},Cs={API:"/api/",API_AUTH:"/api/auth/",MCP:"/mcp/",OAUTH_PROXY:"/oauth-proxy/",WELL_KNOWN:"/.well-known",ORG:"/org/"},xO3=/\.(html|css|js|ico|svg|png|jpg|jpeg|gif|webp|woff|woff2)$/});function ai$($){let u=$?.connectFn??pO3,f=null,X=null,J=!1,w=!1,E=!1,Q=[];function Y(){return f!==null&&!f.isClosed()&&!f.isDraining()&&!E}function Z(){console.log(`[NatsProvider] fireReady: ${Q.length} callbacks`);for(let F of Q)try{F()}catch{}}function W(F){(async()=>{for await(let B of F.status())if(B.type===Vw0.Events.Disconnect)console.log("[NatsProvider] Disconnected"),E=!0;else if(B.type===Vw0.Events.Reconnect)console.log("[NatsProvider] Reconnected, re-firing ready callbacks"),E=!1,X=null,Z()})().catch(()=>{})}async function G(F){let B=0;while(!w)try{f=await u({servers:F,timeout:aO3,reconnect:!0,maxReconnectAttempts:-1}),console.log(`[NatsProvider] Connected to ${f.getServer()} after ${B} attempt(s)`),X=null,E=!1,W(f),Z();return}catch{B++;let v=PJ(rO3,tO3,B-1,2,0.5);await k3(v)}}return{init(F){if(J)return;J=!0,w=!1,G(F).catch(()=>{})},isConnected(){return Y()},getConnection(){return Y()?f:null},getJetStream(){if(!Y())return null;if(!X)X=f.jetstream();return X},onReady(F){if(Q.push(F),Y())try{F()}catch{}},async drain(){if(w=!0,J=!1,X=null,E=!1,f){let F=f;f=null,await F.drain().catch(()=>{})}}}}function pO3($){return Vw0.connect($)}var Vw0,tO3=100,rO3=3000,aO3=3000;var pi$=U(()=>{bw();Vw0=Q0(ga(),1)});function qs($){let u=$?.ttlMs??60000,f=$?.maxSize??1e4,X=$?.updateRecencyOnGet??!1,J=new Map;function w(){if(J.size<=f)return;let E=Date.now();for(let[Q,Y]of J)if(Y.expiresAt<=E)J.delete(Q);while(J.size>f){let Q=J.keys().next().value;if(Q===void 0)break;J.delete(Q)}}return{get(E){let Q=J.get(E);if(!Q)return;if(Q.expiresAt<=Date.now()){J.delete(E);return}if(X)J.delete(E),J.set(E,Q);return Q.value},set(E,Q){J.delete(E),J.set(E,{value:Q,expiresAt:Date.now()+u}),w()},delete(E){J.delete(E)},clear(){J.clear()},size(){return J.size}}}function vV1($,u){return`${$}.${u}`}class UV1{cache;constructor($){this.cache=qs({ttlMs:$?.ttlMs??oO3,maxSize:$?.maxSize??sO3})}async get($,u){return this.cache.get(vV1($,u))??null}async set($,u,f){this.cache.set(vV1($,u),f)}async invalidate($,u){this.cache.delete(vV1($,u))}teardown(){this.cache.clear()}}var oO3=600000,sO3=5000;var oi$=()=>{};function bn0($,u){return`${$}:${u}`}function NV1($){let u=qs({ttlMs:$?.ttlMs??eO3,maxSize:$?.maxSize??$z3}),f=$?.getConnection,X=crypto.randomUUID(),J=new TextEncoder,w=new TextDecoder,E=null;function Q(Y,Z){let W=f?.();if(!W)return;try{W.publish(si$,J.encode(JSON.stringify({organizationId:Y,keyId:Z,originId:X})))}catch(G){console.warn("[ProviderKeyCache] Publish failed (non-critical):",G)}}return{get(Y,Z){return u.get(bn0(Y,Z))},set(Y,Z,W){u.set(bn0(Y,Z),W)},invalidate(Y,Z){u.delete(bn0(Y,Z)),Q(Y,Z)},start(){if(E)return;let Y=f?.();if(!Y)return;E=Y.subscribe(si$),(async()=>{for await(let Z of E)try{let W=JSON.parse(w.decode(Z.data));if(W.originId===X)continue;u.delete(bn0(W.organizationId,W.keyId))}catch{}})().catch(console.error)},teardown(){E?.unsubscribe(),E=null,u.clear()}}}var si$="studio.ai-provider-keys.invalidate",eO3=30000,$z3=5000;var ei$=()=>{};class OV1{options;sub=null;onCancel=null;encoder=new TextEncoder;originId=crypto.randomUUID();constructor($){this.options=$}async start($){if($)this.onCancel=$;if(this.sub)return;if(!this.onCancel)return;let u=this.options.getConnection();if(!u)return;this.sub=u.subscribe("mesh.decopilot.cancel");let f=new TextDecoder;(async()=>{for await(let X of this.sub)try{let J=JSON.parse(f.decode(X.data));if(J.originId===this.originId)continue;this.onCancel?.(J.taskId)}catch{}})().catch(console.error)}broadcast($){if(/[.*>\s]/.test($)){console.warn("[NatsCancelBroadcast] Invalid threadId, skipping broadcast");return}this.onCancel?.($);try{let u=this.options.getConnection();if(!u)return;u.publish("mesh.decopilot.cancel",this.encoder.encode(JSON.stringify({taskId:$,originId:this.originId})))}catch(u){console.warn("[NatsCancelBroadcast] Publish failed (non-critical):",u)}}async stop(){this.sub?.unsubscribe(),this.sub=null,this.onCancel=null}}function Jz3($){if(/[.*>\s]/.test($))throw Error("Invalid NATS subject token")}function KV1($){return Jz3($),`${fx$}.${$}`}function wz3($){let u=0;return{publish(f,X,J,w){f.publish(X,J,w?{headers:w}:void 0).catch((E)=>{if(u++,u===1||u%100===0)console.warn(`[Decopilot] JetStream publish failed for thread ${$} (${u} total):`,E)})},get errorCount(){return u}}}class HV1{options;js=null;jsm=null;encoder=new TextEncoder;constructor($){this.options=$}async init(){let $=this.options.getConnection();if(!$)return;let u=await $.jetstreamManager(),f={name:in0,subjects:[`${fx$}.>`],storage:TY.StorageType.Memory,max_age:uz3,max_bytes:fz3,max_msgs_per_subject:Xz3,discard:TY.DiscardPolicy.Old,retention:TY.RetentionPolicy.Limits,num_replicas:1};try{await u.streams.info(in0),await u.streams.update(in0,f)}catch(X){if(X instanceof Error&&X.message.includes("stream not found"))await u.streams.add(f);else throw X}this.js=this.options.getJetStream(),this.jsm=u}pump($,u,f){let X=this.js;if(!X)return;let J=KV1(u),w=wz3(u),E=this.encoder,Q=!1,Y=()=>{if(Q)return;Q=!0,X.publish(J,E.encode(JSON.stringify({done:!0}))).catch(()=>{})};f.addEventListener("abort",Y,{once:!0});let Z=(W)=>{let G=E.encode(JSON.stringify({p:W}));if(G.length<=IF){w.publish(X,J,G);return}if(G.length>$x$){console.warn(`[Decopilot] dropping oversized stream chunk for thread ${u}: ${(G.length/1048576).toFixed(1)} MiB exceeds ${$x$/1048576} MiB cap`);return}let F=Math.ceil(G.length/IF);for(let B=0;B<F;B++){let v=G.slice(B*IF,(B+1)*IF),N=TY.headers();N.set(ux$,String(B)),N.set(zV1,String(F)),w.publish(X,J,v,N)}};(async()=>{let W=$.getReader();try{while(!0){let{done:G,value:F}=await W.read();if(G)break;Z(F)}}catch(G){console.warn(`[Decopilot] stream pump error for thread ${u}:`,G?.message??G)}finally{W.releaseLock(),Y()}})()}async createTailStream($,u,f){let X=this.js;if(!X)return null;let J=f?.deliverPolicy==="new"?TY.DeliverPolicy.New:TY.DeliverPolicy.All,w=f?.closeOnDone??!1,E=KV1($),Q;try{Q=await X.subscribe(E,{ordered:!0,config:{filter_subject:E,ack_policy:TY.AckPolicy.None,deliver_policy:J}})}catch(v){return console.warn("[Decopilot] JetStream tail unavailable (non-critical):",v?.message??v),null}let Y=new TextDecoder,Z=null,W=(v)=>{let N=v.headers?.get(zV1);if(!N)return null;let O=Number(N),z=Number(v.headers?.get(ux$)??"0");if(z===0)Z={total:O,received:0,parts:Array(O)};else if(!Z||Z.total!==O)return null;if(!Z.parts[z])Z.received++;if(Z.parts[z]=v.data,Z.received<Z.total)return null;let H=Z.parts.reduce((j,I)=>j+(I?.length??0),0),_=new Uint8Array(H),T=0;for(let j of Z.parts)_.set(j,T),T+=j.length;return Z=null,_},G=async function*(){for await(let v of Q)yield v}(),F=!1,B=()=>{if(F)return;F=!0,Q.unsubscribe(),G.return(void 0).catch(()=>{})};return u?.addEventListener("abort",B,{once:!0}),new ReadableStream({async pull(v){while(!0){let N=await G.next();if(N.done){B(),v.close();return}let O=N.value,z=W(O);if(O.headers?.get(zV1)&&!z)continue;let H=z??O.data;try{let _=JSON.parse(Y.decode(H));if(_.done){if(w){B(),v.close();return}continue}if(_.p){v.enqueue(_.p);return}}catch{}}},cancel(){B()}})}purge($){if(!this.jsm)return;this.jsm.streams.purge(in0,{filter:KV1($)}).catch(()=>{})}teardown(){this.js=null,this.jsm=null}}var TY,in0="DECOPILOT_STREAMS",fx$="decopilot.stream",uz3=300000000000,fz3=524288000,Xz3=20000,$x$=33554432,ux$="Dp-Frag-Idx",zV1="Dp-Frag-Total";var Xx$=U(()=>{TY=Q0(ga(),1)});function wx$(){let $=new Map,u=new Map;function f(X){let J=u.get(X);if(!J)return;let w=$.get(X)??null;for(let E of J)try{E(w)}catch{}}return{async get(X){return $.get(X)??null},async put(X,J){$.set(X,J),f(X)},async delete(X){$.delete(X),f(X)},watch(X,J){let w=u.get(X);if(!w)w=new Set,u.set(X,w);w.add(J);try{J($.get(X)??null)}catch{}return()=>{let E=u.get(X);if(!E)return;if(E.delete(J),E.size===0)u.delete(X)}}}}class _V1{options;kv=null;codec=xn0.JSONCodec();constructor($){this.options=$}async init(){let $=this.options.getJetStream();if(!$)return;this.kv=await $.views.kv(Ez3,{history:1,ttl:Jx$,storage:xn0.StorageType.Memory})}async get($){if(!this.kv)return null;try{let u=await this.kv.get($);if(!u?.value)return null;if(u.operation==="DEL"||u.operation==="PURGE")return null;if(Date.now()-u.created.getTime()>Jx$)return null;return this.codec.decode(u.value)}catch{return null}}async put($,u){if(!this.kv)return;await this.kv.put($,this.codec.encode(u))}async delete($){if(!this.kv)return;try{await this.kv.delete($)}catch{}}watch($,u){if(!this.kv){try{u(null)}catch{}return()=>{}}let f=!1,X=null;return(async()=>{let J=250;while(!f){try{X=await this.kv.watch({key:$}),J=250;for await(let w of X){if(f)return;let Q=w.operation==="DEL"||w.operation==="PURGE"||!w.value?null:this.codec.decode(w.value);try{u(Q)}catch{}}if(f)return}catch{}if(f)return;await new Promise((w)=>setTimeout(w,J)),J=Math.min(J*2,5000)}})(),()=>{f=!0;try{X?.stop()}catch{}}}}var xn0,Ez3="studio_links",Jx$=60000;var Ex$=U(()=>{xn0=Q0(ga(),1)});function Yx$($,u){let f=u.helloTimeoutMs??5000,X=u.refreshIntervalMs??20000,J=new Map;$.get("/api/links/connect",async(w)=>{let E=w.req.header("authorization")??"",Q=/^Bearer\s+(.+)$/i.exec(E);if(!Q)return new Response("missing bearer",{status:401});let Y=(Q[1]??"").trim(),Z=await u.validateBearer(Y);if(!Z)return new Response("invalid bearer",{status:401});let W=w.env?.server;if(!W||typeof W.upgrade!=="function")return new Response("ws upgrade not available",{status:500});if(!W.upgrade(w.req.raw,{data:{kind:"gateway",userSub:Z,deps:u,helloTimeoutMs:f,refreshIntervalMs:X,localOwners:J}}))return new Response("ws upgrade failed",{status:400});return new Response(null,{status:101})}),$.get("/api/links/me",async(w)=>{let E=w.req.header("authorization")??"",Q=/^Bearer\s+(.+)$/i.exec(E),Y=null;if(Q)Y=await u.validateBearer((Q[1]??"").trim());else Y=w.get("meshContext")?.auth?.user?.id??null;if(!Y)return w.json({error:"unauthorized"},401);let Z=await u.registry.get(Y);if(!Z)return w.json(null);return w.json({machineId:Z.machineId,hostname:Z.hostname,cliVersion:Z.cliVersion,previewPort:Z.previewPort,connectedAt:Z.connectedAt})})}function jV1($){if(!$.data._inflight)$.data._inflight=new Map;return $.data._inflight}async function Yz3($,u){let{userSub:f,deps:X,refreshIntervalMs:J,localOwners:w}=$.data,E={podId:X.podId,machineId:u.machineId,...u.hostname?{hostname:u.hostname}:{},cliVersion:u.cliVersion,previewPort:u.previewPort,connectedAt:Date.now(),capabilities:u.capabilities},Q=w.get(f);if(Q&&Q!==$){if(Q.data.state)Q.data.state.lostOwnership=!0;try{Q.close(Qx$,"superseded")}catch{}}w.set(f,$);let Y={userSub:f,hello:u,refreshTimer:setInterval(()=>{X.registry.put(f,{...E,connectedAt:Date.now()}).catch(()=>{})},J),stopWatch:()=>{},unsubscribeDispatch:()=>{},unsubscribeCancel:()=>{},lostOwnership:!1};$.data.state=Y;try{Y.unsubscribeDispatch=X.nats.subscribe(`links.dispatch.${f}`,(W,G)=>Dz3($,W,G)),Y.unsubscribeCancel=X.nats.subscribe(`links.cancel.${f}`,(W)=>Zz3($,W));let Z=!0;Y.stopWatch=X.registry.watch(f,(W)=>{if(Z){Z=!1;return}if(!W||W.podId!==X.podId){Y.lostOwnership=!0;try{$.close(Qx$,"superseded")}catch{}}}),await X.registry.put(f,E)}catch(Z){clearInterval(Y.refreshTimer);try{Y.stopWatch()}catch{}try{Y.unsubscribeDispatch()}catch{}try{Y.unsubscribeCancel()}catch{}if(w.get(f)===$)w.delete(f);$.data.state=void 0,$.close(Qz3,`init failed: ${Z instanceof Error?Z.message:String(Z)}`)}}function Dz3($,u,f){if(!f)return;let X;try{X=rO(PV1.decode(u))}catch{return}if(X.type!=="request")return;jV1($).set(X.reqId,{reply:f}),$.send(K8(X))}function Zz3($,u){let f;try{f=rO(PV1.decode(u))}catch{return}if(f.type!=="cancel")return;if(!jV1($).has(f.reqId))return;$.send(K8(f))}function Wz3($,u,f){let X=$.data.deps.nats;if(f.type!=="chunk"){X.publish(u,Ms.encode(K8(f)));return}let J=Ms.encode(K8(f));if(J.length<=IF){X.publish(u,J);return}let w=Ms.encode(K8({type:"chunk",reqId:f.reqId,data:""})).length;for(let E of cy$(f.data,IF,w))X.publish(u,Ms.encode(K8({type:"chunk",reqId:f.reqId,data:E})))}function Gz3($,u,f,X,J="publish_failed"){try{return $.data.deps.nats.publish(u,Ms.encode(K8({type:"error",reqId:f,code:J,message:X}))),!0}catch{return!1}}async function Fz3($,u){if(u.type==="hello"){$.close(ln0,"duplicate hello");return}if(u.type==="request"||u.type==="cancel")return;let f=jV1($),X=f.get(u.reqId);if(!X)return;try{Wz3($,X.reply,u)}catch(J){if(Gz3($,X.reply,u.reqId,J instanceof Error?J.message:String(J)))f.delete(u.reqId);return}if(u.type==="end"||u.type==="error")f.delete(u.reqId)}var Qx$=4001,ln0=1008,Qz3=1011,Ms,PV1,Dx$;var Zx$=U(()=>{yN0();Ms=new TextEncoder,PV1=new TextDecoder;Dx$={open($){$.data.helloTimer=setTimeout(()=>{$.close(ln0,"hello timeout")},$.data.helloTimeoutMs)},async message($,u){let f=typeof u==="string"?u:PV1.decode(u),X;try{X=rO(f)}catch(J){$.close(ln0,`bad frame: ${J instanceof Error?J.message:String(J)}`);return}if(!$.data.state){if(X.type!=="hello"){$.close(ln0,"first frame must be hello");return}clearTimeout($.data.helloTimer),await Yz3($,X);return}await Fz3($,X)},close($,u,f){clearTimeout($.data.helloTimer);let X=$.data._inflight;if(X&&X.size>0){for(let[E,Q]of X)try{$.data.deps.nats.publish(Q.reply,Ms.encode(K8({type:"error",reqId:E,code:"ws_closed",message:"daemon WebSocket closed before response completed"})))}catch{}X.clear()}let J=$.data.state;if(!J)return;clearInterval(J.refreshTimer);try{J.stopWatch()}catch{}try{J.unsubscribeDispatch()}catch{}try{J.unsubscribeCancel()}catch{}let w=$.data.localOwners.get(J.userSub)===$;if(w)$.data.localOwners.delete(J.userSub);if(w&&!J.lostOwnership)$.data.deps.registry.delete(J.userSub).catch(()=>{})}}});function Gx$($){let u=$.requestTimeoutMs??30000;return function(X,J,w){return{async*[Symbol.asyncIterator](){if(w?.signal?.aborted)throw Error("dispatch aborted");let E=crypto.randomUUID(),Q=$.nats.createInbox(),Y=[],Z=null,W=!1,G=null,F=null,B=()=>{if(F)clearTimeout(F),F=null;let T=Z;Z=null,T?.()},v=$.nats.subscribe(Q,(T)=>{if(W)return;try{Y.push(rO(Bz3.decode(T)))}catch(j){G=j instanceof Error?j:Error(String(j)),W=!0}B()}),N=!1,O=()=>{if(N)return;N=!0,W=!0;try{v()}catch{}},z=()=>{$.nats.publish(`links.cancel.${X}`,Wx$.encode(K8({type:"cancel",reqId:E}))),G=Error("dispatch aborted"),O(),B()};w?.signal?.addEventListener("abort",z,{once:!0});try{$.nats.publish(`links.dispatch.${X}`,Wx$.encode(K8({type:"request",reqId:E,method:J.method,path:J.path,headers:J.headers,...J.body!==void 0?{body:J.body}:{}})),{reply:Q})}catch(T){throw w?.signal?.removeEventListener("abort",z),O(),T instanceof Error?T:Error(String(T))}let H=Date.now()+u,_=!1;try{while(!W){if(G)throw G;if(Y.length===0){let j=H-Date.now();if(!_&&j<=0)throw Error("dispatch timeout: no reply from daemon");if(await new Promise((I)=>{if(Z=I,!_)F=setTimeout(B,Math.max(0,j))}),G)throw G;continue}let T=Y.shift();if(_=!0,T.type==="chunk")yield{data:T.data};else if(T.type==="headers")yield{headers:{status:T.status,headers:T.headers}};else if(T.type==="end")return;else if(T.type==="error")throw Error(`${T.code}: ${T.message}`)}if(G)throw G}finally{if(w?.signal?.removeEventListener("abort",z),F)clearTimeout(F),F=null;O()}}}}}var Wx$,Bz3;var Fx$=U(()=>{yN0();Wx$=new TextEncoder,Bz3=new TextDecoder});function Bx$($,u){switch($.type){case"START":{let f={type:"RUN_STARTED",taskId:$.taskId,orgId:$.orgId,userId:$.userId,abortController:$.abortController,runConfig:$.runConfig,podId:$.podId};if(u?.status.tag==="running")return[{type:"PREVIOUS_RUN_ABORTED",taskId:$.taskId,orgId:u.orgId},f];return[f]}case"STEP_DONE":{if(u?.status.tag!=="running")return[];return[{type:"STEP_COMPLETED",taskId:$.taskId,orgId:u.orgId,stepCount:u.status.stepCount+1}]}case"FINISH":{if(u==null||u.status.tag!=="running")return[];let{stepCount:f}=u.status;if($.threadStatus==="completed")return[{type:"RUN_COMPLETED",taskId:$.taskId,orgId:u.orgId,stepCount:f}];if($.threadStatus==="requires_action")return[{type:"RUN_REQUIRES_ACTION",taskId:$.taskId,orgId:u.orgId,stepCount:f}];return[{type:"RUN_FAILED",taskId:$.taskId,orgId:u.orgId,reason:"error"}]}case"CANCEL":{if(u?.status.tag!=="running")return[];return[{type:"RUN_FAILED",taskId:$.taskId,orgId:u.orgId,reason:"cancelled"}]}case"RESUME":{if(u?.status.tag==="running")return[];return[{type:"RUN_RESUMED",taskId:$.taskId,orgId:$.orgId,userId:$.userId,abortController:$.abortController,podId:$.podId}]}case"FORCE_FAIL":{if($.reason==="ghost")return[{type:"RUN_FAILED",taskId:$.taskId,orgId:u?.orgId??$.orgId,reason:$.reason}];if(u?.status.tag!=="running")return[];return[{type:"RUN_FAILED",taskId:$.taskId,orgId:u.orgId,reason:$.reason}]}}}function vx$($,u,f=new Date){switch(u.type){case"RUN_STARTED":return{taskId:u.taskId,orgId:u.orgId,userId:u.userId,status:{tag:"running",abortController:u.abortController,stepCount:0,startedAt:f}};case"RUN_RESUMED":return{taskId:u.taskId,orgId:u.orgId,userId:u.userId,status:{tag:"running",abortController:u.abortController,stepCount:0,startedAt:f}};case"STEP_COMPLETED":if($?.status.tag!=="running")return $;return{...$,status:{...$.status,stepCount:u.stepCount}};case"RUN_COMPLETED":return;case"RUN_REQUIRES_ACTION":return;case"RUN_FAILED":return;case"PREVIOUS_RUN_ABORTED":return}}async function Ux$($,u,f,X){let{storage:J,streamBuffer:w,sseHub:E}=X,Q=await J.get($,u);await J.update($,u,{status:f,run_owner_pod:null,run_config:null,run_started_at:null}),w.purge($),E.emit(u,yv($,f,{virtualMcpId:Q?.virtual_mcp_id??void 0,createdBy:Q?.created_by,triggerId:Q?.trigger_id,title:Q?.title,branch:Q?.branch??null,createdAt:Q?.created_at,updatedAt:Q?.updated_at})),E.emit(u,d50($,f))}async function vz3($,u){let{storage:f,streamBuffer:X,sseHub:J}=u;switch($.type){case"RUN_STARTED":{if(!await f.claimRunStart($.taskId,$.orgId,{status:"in_progress",run_owner_pod:$.podId??null,run_config:$.runConfig??null,run_started_at:$.podId?new Date().toISOString():null},$.podId??null))throw new Nx$($.taskId);let E=await f.get($.taskId,$.orgId);J.emit($.orgId,yv($.taskId,"in_progress",{virtualMcpId:E?.virtual_mcp_id??void 0,createdBy:E?.created_by,triggerId:E?.trigger_id,title:E?.title,branch:E?.branch??null,createdAt:E?.created_at,updatedAt:E?.updated_at}));return}case"RUN_RESUMED":{await f.update($.taskId,$.orgId,{run_owner_pod:$.podId,run_started_at:new Date().toISOString()});let w=await f.get($.taskId,$.orgId);J.emit($.orgId,yv($.taskId,"in_progress",{virtualMcpId:w?.virtual_mcp_id??void 0,createdBy:w?.created_by,triggerId:w?.trigger_id,title:w?.title,branch:w?.branch??null,createdAt:w?.created_at,updatedAt:w?.updated_at}));return}case"STEP_COMPLETED":J.emit($.orgId,MP0($.taskId,$.stepCount));return;case"RUN_COMPLETED":await Ux$($.taskId,$.orgId,"completed",u);return;case"RUN_REQUIRES_ACTION":await Ux$($.taskId,$.orgId,"requires_action",u);return;case"RUN_FAILED":{if($.reason==="ghost"){if(!await f.forceFailIfInProgress($.taskId,$.orgId))return;await f.update($.taskId,$.orgId,{run_owner_pod:null,run_config:null,run_started_at:null})}else await f.update($.taskId,$.orgId,{status:"failed",run_owner_pod:null,run_config:null,run_started_at:null});X.purge($.taskId);let w=await f.get($.taskId,$.orgId);J.emit($.orgId,yv($.taskId,"failed",{virtualMcpId:w?.virtual_mcp_id??void 0,createdBy:w?.created_by,triggerId:w?.trigger_id,title:w?.title,branch:w?.branch??null,createdAt:w?.created_at,updatedAt:w?.updated_at})),J.emit($.orgId,d50($.taskId,"failed"));return}case"PREVIOUS_RUN_ABORTED":return}}async function Ox$($,u){for(let{event:f}of $)await vz3(f,u)}var Nx$;var zx$=U(()=>{iu();Nx$=class Nx$ extends Error{constructor($){super(`Failed to claim run for thread ${$} \u2014 already running on another pod`);this.name="RunClaimError"}}});class LV1{deps;podId;clock;states=new Map;reaperTimer=null;constructor($,u,f=()=>new Date){this.deps=$;this.podId=u;this.clock=f;this.reaperTimer=setInterval(()=>this.reapStaleRuns(),Uz3)}async execute($){let u=this.dispatch($);return await this.react(u),u}dispatch($){let u=this.states.get($.taskId),f=Bx$($,u),X=[];for(let J of f){let w=this.states.get(J.taskId);if(J.type==="PREVIOUS_RUN_ABORTED"||J.type==="RUN_FAILED"){if(w?.status.tag==="running")w.status.abortController.abort()}let E=vx$(w,J,this.clock());if(E===void 0)this.states.delete(J.taskId);else this.states.set(J.taskId,E);if(X.push({event:J,state:E}),Oz3.has(J.type))Kx$.add(1,{"org.id":J.orgId});else if(zz3.has(J.type)&&w?.status.tag==="running")Kx$.add(-1,{"org.id":J.orgId})}return X}react($){return Ox$($,this.deps)}getAbortSignal($){let u=this.states.get($);if(u?.status.tag==="running")return u.status.abortController.signal;return null}isRunning($){return this.states.get($)?.status.tag==="running"}async stopAll(){try{await this.deps.storage.orphanRunsByPod(this.podId)}catch($){console.error("[RunRegistry] Failed to orphan runs in DB:",$)}for(let[,$]of this.states)if($.status.tag==="running")$.status.abortController.abort();this.states.clear()}async recoverOrphanedRuns($){let u=await this.deps.storage.listOrphanedRuns(this.podId);if(u.length===0)return;let f=5;for(let X=0;X<u.length;X+=f){let J=u.slice(X,X+f);await Promise.allSettled(J.map(async(w)=>{if(!await this.deps.storage.claimOrphanedRun(w.id,w.organization_id,this.podId))return;try{await $(w)}catch(Q){console.error(`[RunRegistry] Failed to resume ${w.id}:`,Q),await this.deps.storage.forceFailIfInProgress(w.id,w.organization_id).catch(()=>{})}}))}}async handlePodDeath($,u,f){let X=await this.deps.storage.listOrphanedRunsByPod($);if(X.length===0)return;for(let w of X)f?.broadcast(w.id);let J=5;for(let w=0;w<X.length;w+=J){let E=X.slice(w,w+J);await Promise.allSettled(E.map(async(Q)=>{if(this.isRunning(Q.id))return;if(!await this.deps.storage.claimOrphanedRun(Q.id,Q.organization_id,this.podId))return;try{await u(Q)}catch(Z){console.error(`[RunRegistry] Failed to resume ${Q.id}:`,Z),await this.deps.storage.forceFailIfInProgress(Q.id,Q.organization_id).catch(()=>{})}}))}}dispose(){if(this.reaperTimer)clearInterval(this.reaperTimer),this.reaperTimer=null}reapStaleRuns(){let $=this.clock().getTime();for(let[u,f]of this.states)if(f.status.tag==="running"&&$-f.status.startedAt.getTime()>Nz3)console.warn(`[RunRegistry] Reaping stale run for thread ${u} ...`),this.execute({type:"FORCE_FAIL",taskId:u,reason:"reaped"}).catch((X)=>{console.error("[RunRegistry] Reaper execute failed",X)})}}var Uz3=300000,Nz3=1800000,Oz3,zz3,Kx$;var Hx$=U(()=>{zx$();ew();Oz3=new Set(["RUN_STARTED","RUN_RESUMED"]),zz3=new Set(["RUN_COMPLETED","RUN_FAILED","RUN_REQUIRES_ACTION","PREVIOUS_RUN_ABORTED"]),Kx$=IQ.createUpDownCounter("decopilot.stream.inflight",{description:"Number of in-flight decopilot stream requests",unit:"{requests}"})});class TV1{storage;options;timer=null;constructor($,u={}){this.storage=$;this.options=u}start(){if(this.timer)return;let $=this.options.intervalMs??300000;this.timer=setInterval(()=>{this.runOnce()},$)}async runOnce(){let $=this.options.staleAfterMs??3600000;try{let u=await this.storage.sweepAbandoned($);if(u>0)console.log(`[async-research-sweeper] marked ${u} stale jobs as abandoned`);return u}catch(u){return console.error("[async-research-sweeper] sweep failed",u),0}}dispose(){if(this.timer)clearInterval(this.timer),this.timer=null}}import{readdir as Kz3,rm as cn0}from"fs/promises";import{join as dn0}from"path";async function mn0($){let u=new Date;u.setUTCDate(u.getUTCDate()-Hz3),u.setUTCHours(0,0,0,0);let f=0;try{let X=await ul($);for(let J of X)if(/^\d{4}$/.test(J))f+=await _x$($,J,u);else if(!J.startsWith(".")){let w=dn0($,J),E=await ul(w);for(let Y of E){if(!/^\d{4}$/.test(Y))continue;f+=await _x$(w,Y,u)}if((await ul(w)).length===0)await cn0(w,{recursive:!0,force:!0})}}catch(X){console.warn("monitoring retention cleanup failed:",X)}return f}async function _x$($,u,f){let X=0,J=dn0($,u),w=await ul(J);for(let Q of w){if(!/^\d{2}$/.test(Q))continue;let Y=dn0(J,Q),Z=await ul(Y);for(let G of Z){if(!/^\d{2}$/.test(G))continue;let F=new Date(`${u}-${Q}-${G}T00:00:00Z`);if(isNaN(F.getTime()))continue;if(F<f){let B=dn0(Y,G);await cn0(B,{recursive:!0,force:!0}),X++}}if((await ul(Y)).length===0)await cn0(Y,{recursive:!0,force:!0})}if((await ul(J)).length===0)await cn0(J,{recursive:!0,force:!0});return X}async function ul($){try{return(await Kz3($)).filter((f)=>!f.startsWith("."))}catch{return[]}}var Hz3=30;var AV1=()=>{};import{DBOS as IV1,SchedulerMode as _z3}from"@dbos-inc/dbos-sdk";async function jz3(){let $=[V2(),Vd(),SB()],u=0;for(let f of $)try{u+=await mn0(f)}catch(X){console.error("[monitoring-retention] cleanup failed:",X)}return console.log(`[monitoring-retention] deleted ${u} day-dir(s) across ${$.length} signal dir(s)`),{deleted:u,dirs:$.length}}async function Lz3($,u){await IV1.runStep(()=>jz3(),{name:"monitoringRetention"})}function jx$(){if(Px$)return;Px$=!0;let $=IV1.registerWorkflow(Lz3,{name:"monitoringRetentionWorkflow"});IV1.registerScheduled($,{name:"monitoringRetentionWorkflow",crontab:Pz3,mode:_z3.ExactlyOncePerIntervalWhenActive})}var Pz3="23 4 * * *",Px$=!1;var Lx$=U(()=>{LQ();AV1()});function bw0($){return{...$,title:$.title??$.id}}function Ix$($){let u=$.credentialId;return{credentialId:u,thinking:bw0($.thinking),...$.coding&&{coding:bw0($.coding)},...$.fast&&{fast:bw0($.fast)},...$.image&&{image:{...bw0($.image),credentialId:$.image.credentialId??u}},...$.deepResearch&&{deepResearch:{...bw0($.deepResearch),credentialId:$.deepResearch.credentialId??u}}}}var nn0,Tx$,Tz3,Ax$;var Sx$=U(()=>{c0();nn0=D.object({id:D.string(),title:D.string().optional(),capabilities:D.object({vision:D.boolean().optional(),text:D.boolean().optional(),tools:D.boolean().optional(),reasoning:D.boolean().optional(),file:D.boolean().optional()}).passthrough().optional(),limits:D.object({contextWindow:D.number().optional(),maxOutputTokens:D.number().optional()}).passthrough().optional(),provider:D.string().nullish()}),Tx$=nn0.extend({credentialId:D.string().optional()}),Tz3=D.object({models:D.object({credentialId:D.string(),thinking:nn0,coding:nn0.optional(),fast:nn0.optional(),image:Tx$.optional(),deepResearch:Tx$.optional()}),agent:D.object({id:D.string()}),temperature:D.number(),toolApprovalLevel:D.enum(["auto","readonly","plan"]).optional(),mode:D.enum(["default","plan","web-search","gen-image"]).optional(),windowSize:D.number().optional(),triggerId:D.string().optional()}),Ax$=Tz3.transform(($)=>{let u=$.mode??"default",f="auto";if($.toolApprovalLevel==="plan")u="plan",f="readonly";else if($.toolApprovalLevel==="readonly")f="readonly";else if($.toolApprovalLevel==="auto")f="auto";return{models:$.models,agent:$.agent,temperature:$.temperature,toolApprovalLevel:f,mode:u,windowSize:$.windowSize,triggerId:$.triggerId}})});class SV1{deps;kv=null;podId=null;refreshTimer=null;watchAbortController=null;initPromise=null;pendingDeathCallback=null;constructor($){this.deps=$}async init(){if(this.watchAbortController)this.watchAbortController.abort(),this.watchAbortController=null;if(this.refreshTimer)clearInterval(this.refreshTimer),this.refreshTimer=null;this.kv=null,this.initPromise=null;let $=this.deps.getJetStream();if(!$)return;return this.initPromise=$.views.kv(Az3,{ttl:Iz3,storage:kx$.StorageType.Memory}).then((u)=>{this.kv=u}).catch((u)=>{throw this.initPromise=null,u}),this.initPromise}start($){if(!this.kv)return;if(this.refreshTimer)return;if(this.podId=$,this.kv.put($,new TextEncoder().encode(new Date().toISOString())),this.refreshTimer=setInterval(()=>{this.kv?.put($,new TextEncoder().encode(new Date().toISOString())).catch((u)=>{console.error("[PodHeartbeat] Refresh failed:",u)})},Sz3),this.pendingDeathCallback)this.startDeathWatcher(this.pendingDeathCallback),this.pendingDeathCallback=null}onPodDeath($){if(!this.kv){this.pendingDeathCallback=$;return}this.startDeathWatcher($)}startDeathWatcher($){if(!this.kv)return;this.watchAbortController=new AbortController;let u=this.kv,f=this.podId,X=this.watchAbortController.signal;(async()=>{while(!X.aborted)try{let w=await u.watch({initializedFn:()=>{}});for await(let E of w){if(X.aborted)break;if(E.operation==="DEL"||E.operation==="PURGE"){let Q=E.key;if(Q!==f)$(Q)}}}catch(w){if(X.aborted)break;console.error("[PodHeartbeat] Watcher error, reconnecting in 1s:",w),await new Promise((E)=>setTimeout(E,1000))}})().catch((w)=>{if(!X.aborted)console.error("[PodHeartbeat] Watcher loop failed:",w)})}async stop(){if(this.refreshTimer)clearInterval(this.refreshTimer),this.refreshTimer=null;if(this.kv&&this.podId)try{await this.kv.delete(this.podId)}catch{}if(this.watchAbortController)this.watchAbortController.abort(),this.watchAbortController=null;this.kv=null,this.podId=null,this.initPromise=null,this.pendingDeathCallback=null}}var kx$,Az3="POD_HEARTBEATS",Iz3=45000,Sz3=1e4;var Rx$=U(()=>{kx$=Q0(ga(),1)});function Cx$($){return async(u,f)=>{let X=await $.db.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["member.role","organization.id as orgId","organization.slug as orgSlug","organization.name as orgName"]).where("member.userId","=",f).where("member.organizationId","=",u).executeTakeFirst();if(!X)return console.warn(`[automationContextFactory] User ${f} not found in org ${u} \u2014 returning null`),null;let J=await aZ.create();J.auth.user={id:f,role:X.role},J.organization={id:X.orgId,slug:X.orgSlug,name:X.orgName};let w=await bI1($.db,u,X.role);J.boundAuth=VI1({auth:J.authInstance,headers:new Headers,role:X.role,permissions:w,userId:f}),J.access=new jA(J.authInstance,f,void 0,J.boundAuth,X.role,"self"),J.storage.threads=new L70($.threadStorage,X.orgId),J.storage.asyncResearchJobs=new A70($.asyncResearchJobStorage,X.orgId);let E=eY();return J.objectStorage=E?xW(E,X.orgId):new RU(X.orgId,J.baseUrl),Km(J.storage,{objectStorage:J.objectStorage,baseUrl:J.baseUrl,orgSlug:X.orgSlug}),J}}var qx$=U(()=>{P70();M90();SI0();RI0();Ej();q90();a40()});import{EventEmitter as kz3}from"events";var kV1;var Mx$=U(()=>{BT();kV1=new kz3;kV1.on("request",($)=>{fU($)})});function hx$(){return async($,u)=>{let f=Date.now(),X=$.req.method,J=$.req.path;if(J==="/api/auth/get-session"||J.includes("favicon")){await u();return}let w="",E=!1;if(J.startsWith("/mcp")&&X==="POST"){E=!0;try{if($.req.header("Content-Type")?.includes("application/json")){let F=await $.req.raw.clone().json();if(F.method==="tools/call"&&F.params?.name){let B=EN(F.params.name),v=F.params.arguments||{};if(B==="EVENT_PUBLISH"&&v.type){let N=EN(String(v.type));w=`${G6.tool}EVENT_PUBLISH${G6.reset} ${G6.bold}\u2192 ${N}${G6.reset}`}else if(B==="EVENT_SUBSCRIBE"&&v.eventType){let N=EN(String(v.eventType));w=`${G6.tool}EVENT_SUBSCRIBE${G6.reset} ${G6.bold}\u2190 ${N}${G6.reset}`}else if(B==="EVENT_UNSUBSCRIBE"&&v.eventType){let N=EN(String(v.eventType));w=`${G6.tool}EVENT_UNSUBSCRIBE${G6.reset} ${G6.dim}\u2715 ${N}${G6.reset}`}else{let N=Object.keys(v).map((z)=>EN(z)),O=N.length>0?N.slice(0,3).join(",")+(N.length>3?"\u2026":""):"";w=`${G6.tool}${B}${G6.dim}(${O})${G6.reset}`}}else if(F.method)w=`${G6.dim}${EN(F.method)}${G6.reset}`}}catch{}}let Q=EN(J);if(J.startsWith("/mcp/conn_")){let W=J.split("/")[2]??"";Q=`/mcp/${G6.mcp}${EN(W.slice(0,12))}\u2026${G6.reset}`}else if(J==="/mcp")Q=`${G6.mcp}/mcp${G6.reset}`;else if(J==="/mcp/registry")Q=`${G6.mcp}/mcp/registry${G6.reset}`;let Y=Cz3(X),Z=E?"\u25C0":"\u2190";if(!ij0())console.log(`${G6.dim}${Z}${G6.reset} ${Y}${X}${G6.reset} ${Q}${w?` ${w}`:""}`);try{await u()}finally{let W=Date.now()-f,G=$.res.status,F=Rz3(G),B=W<1000?`${W}ms`:`${(W/1000).toFixed(1)}s`,v=E?"\u25B6":"\u2192";if(!ij0())console.log(`${G6.dim}${v}${G6.reset} ${Y}${X}${G6.reset} ${Q}${w?` ${w}`:""} ${F}${G}${G6.reset} ${G6.duration}${B}${G6.reset}`);kV1.emit("request",{method:X,path:EN(J),status:G,duration:W,timestamp:new Date})}}}var G6,Rz3=($)=>{if($>=500)return G6.serverError;if($>=400)return G6.clientError;if($>=300)return G6.redirect;return G6.ok},Cz3=($)=>{return G6[$]||G6.reset},EN=($)=>{return $.replace(/\r/g,"").replace(/\n/g,"").replace(/\x1b\[[0-9;]*m/g,"").replace(/[\x00-\x1f\x7f-\x9f]/g,"")};var yx$=U(()=>{BT();Mx$();G6={reset:"\x1B[0m",dim:"\x1B[2m",bold:"\x1B[1m",GET:"\x1B[36m",POST:"\x1B[33m",PUT:"\x1B[35m",DELETE:"\x1B[31m",ok:"\x1B[32m",redirect:"\x1B[36m",clientError:"\x1B[33m",serverError:"\x1B[31m",mcp:"\x1B[35m",tool:"\x1B[96m",duration:"\x1B[90m"}});import{createHmac as ix$}from"crypto";import{mkdir as qz3,readdir as Mz3,rm as gx$,stat as xx$}from"fs/promises";import{join as CV1,relative as hz3}from"path";function cx$($){let u=$.replace(/[^a-zA-Z0-9_-]/g,"_");return CV1(yz3,u)}function dx$($){return $.replace(/^\/+/,"").replace(/\.\./g,"")}function RV1($,u){let f=cx$($),X=dx$(u);return CV1(f,X)}function gz3($,u,f,X){let J=g4().encryptionKey||"dev-secret",w=`${$}:${u}:${f}:${X}`;return ix$("sha256",J).update(w).digest("hex")}function bx$($,u,f,X,J){let w=Math.floor(Date.now()/1000)+X,E=gz3(u,f,w,J),Q=new URL(`/api/dev-assets/${u}/${dx$(f)}`,$);return Q.searchParams.set("expires",w.toString()),Q.searchParams.set("signature",E),Q.searchParams.set("method",J),Q.toString()}function mx$($,u,f){let X=`${$}:${u.getTime()}:${f}`;return`"${ix$("md5","etag").update(X).digest("hex")}"`}async function nx$($,u,f,X,J){try{let w=await Mz3($,{withFileTypes:!0});for(let E of w){let Q=CV1($,E.name),Z=hz3(u,Q).replace(/\\/g,"/");if(f&&!Z.startsWith(f))continue;if(E.isDirectory())if(X){let W=Z+"/";if(!f||W.startsWith(f)){if(!(f?Z.slice(f.length):Z).includes("/"))J.commonPrefixes.add(W)}}else await nx$(Q,u,f,X,J);else if(E.isFile()){if(X&&f){let W=Z.slice(f.length);if(W.includes(X)){let G=W.indexOf(X),F=f+W.slice(0,G+1);J.commonPrefixes.add(F);continue}}try{let W=await xx$(Q);J.objects.push({key:Z,size:W.size,lastModified:W.mtime.toISOString(),etag:mx$(Q,W.mtime,W.size)})}catch{}}}}catch{}}function tx$($,u){let X=r0($).id;return[{name:"LIST_OBJECTS",description:"List objects in the local assets directory with pagination support",inputSchema:D.object({prefix:D.string().optional(),maxKeys:D.number().optional().default(1000),continuationToken:D.string().optional(),delimiter:D.string().optional()}),outputSchema:D.object({objects:D.array(D.object({key:D.string(),size:D.number(),lastModified:D.string(),etag:D.string()})),nextContinuationToken:D.string().optional(),isTruncated:D.boolean(),commonPrefixes:D.array(D.string()).optional()}),handler:async(J)=>{let w=J,E=w.prefix||"",Q=w.maxKeys??1000,Y=w.delimiter,Z=w.continuationToken,W=cx$(X);await qz3(W,{recursive:!0});let G={objects:[],commonPrefixes:new Set};await nx$(W,W,E,Y,G),G.objects.sort((O,z)=>O.key.localeCompare(z.key));let F=0;if(Z){if(F=G.objects.findIndex((O)=>O.key>Z),F===-1)F=G.objects.length}let B=G.objects.slice(F,F+Q),v=F+Q<G.objects.length,N=v?B[B.length-1]?.key:void 0;return{objects:B,isTruncated:v,nextContinuationToken:N,commonPrefixes:Array.from(G.commonPrefixes).sort()}}},{name:"GET_OBJECT_METADATA",description:"Get metadata for a file in the local assets directory",inputSchema:D.object({key:D.string()}),outputSchema:D.object({contentType:D.string().optional(),contentLength:D.number(),lastModified:D.string(),etag:D.string(),metadata:D.record(D.string(),D.string()).optional()}),handler:async(J)=>{let w=J,E=RV1(X,w.key),Q=await xx$(E);return{contentType:xy1(w.key),contentLength:Q.size,lastModified:Q.mtime.toISOString(),etag:mx$(E,Q.mtime,Q.size)}}},{name:"GET_PRESIGNED_URL",description:"Generate a presigned URL for downloading a file from local storage",inputSchema:D.object({key:D.string(),expiresIn:D.number().optional()}),outputSchema:D.object({url:D.string(),expiresIn:D.number()}),handler:async(J)=>{let w=J,E=w.expiresIn??Vx$;return{url:bx$(u,X,w.key,E,"GET"),expiresIn:E}}},{name:"PUT_PRESIGNED_URL",description:"Generate a presigned URL for uploading a file to local storage",inputSchema:D.object({key:D.string(),expiresIn:D.number().optional(),contentType:D.string().optional()}),outputSchema:D.object({url:D.string(),expiresIn:D.number()}),handler:async(J)=>{let w=J,E=w.expiresIn??Vx$;return{url:bx$(u,X,w.key,E,"PUT"),expiresIn:E}}},{name:"DELETE_OBJECT",description:"Delete a single file from local storage",inputSchema:D.object({key:D.string()}),outputSchema:D.object({success:D.boolean(),key:D.string()}),handler:async(J)=>{let w=J,E=RV1(X,w.key);try{return await gx$(E),{success:!0,key:w.key}}catch{return{success:!1,key:w.key}}}},{name:"DELETE_OBJECTS",description:"Delete multiple files from local storage",inputSchema:D.object({keys:D.array(D.string()).max(1000)}),outputSchema:D.object({deleted:D.array(D.string()),errors:D.array(D.object({key:D.string(),message:D.string()}))}),handler:async(J)=>{let w=J,E=[],Q=[];return await Promise.all(w.keys.map(async(Y)=>{let Z=RV1(X,Y);try{await gx$(Z),E.push(Y)}catch(W){Q.push({key:Y,message:W instanceof Error?W.message:"Unknown error"})}})),{deleted:E,errors:Q}}}]}async function qV1($,u,f){let X=tx$(u,f),J=new gv({name:"dev-assets-mcp",version:"1.0.0"},{capabilities:{tools:{}}});for(let E of X){let Q="shape"in E.inputSchema?E.inputSchema.shape:D.object({}).shape,Y=E.outputSchema&&"shape"in E.outputSchema?E.outputSchema.shape:D.object({}).shape;J.registerTool(E.name,{description:E.description??"",inputSchema:Q,outputSchema:Y,annotations:E.annotations,_meta:E._meta},async(Z)=>{try{let W=await E.handler(Z);return{content:[{type:"text",text:JSON.stringify(W)}],structuredContent:W}}catch(W){return{content:[{type:"text",text:`Error: ${W.message}`}],isError:!0}}})}let w=new pD({enableJsonResponse:$.headers.get("Accept")?.includes("application/json")??!1});return await J.connect(w),w.handleRequest($)}async function rx$($,u,f,X){let w=tx$(f,X).find((E)=>E.name===$);if(!w)return{content:[{type:"text",text:`Tool not found: ${$}`}],isError:!0};try{let E=await w.handler(u);return{content:[{type:"text",text:JSON.stringify(E)}]}}catch(E){return{content:[{type:"text",text:E instanceof Error?E.message:String(E)}],isError:!0}}}var yz3="./data/assets",Vx$=3600,lx$,ax$;var px$=U(()=>{$5();uf();c0();n50();To();Jn0();lx$=new d4;lx$.all("/",async($)=>{let u=$.get("meshContext"),f=new URL($.req.url),X=`${f.protocol}//${f.host}`;return qV1($.req.raw,u,X)});ax$=lx$});var ox$={};Y1(ox$,{mountDevRoutes:()=>Vz3});function Vz3($,u){$.all("/mcp/:connectionId{.*_dev-assets$}",u,async(X)=>{let J=X.get("meshContext"),w=new URL(X.req.url),E=`${w.protocol}//${w.host}`;return qV1(X.req.raw,J,E)}),$.all("/mcp/:connectionId{.*_dev-assets$}/call-tool/:toolName",u,async(X)=>{let J=X.get("meshContext"),w=new URL(X.req.url),E=`${w.protocol}//${w.host}`,Q=X.req.param("toolName");if(!Q)return X.json({error:"Missing tool name"},400);let Y=await X.req.json(),Z=await rx$(Q,Y,J,E);if(Z.isError)return X.json(Z.content,500);return X.json(Z.content)}),$.use("/mcp/dev-assets",u),$.route("/mcp/dev-assets",ax$);let f=new d4;f.use("*",jY({mountPath:"/api/dev-assets"})),f.route("/",Xn0({orgFromPath:!1})),$.route("/api/dev-assets",f)}var sx$=U(()=>{uf();My1();Jn0();px$()});var ex$=U(()=>{zO1();KO1();xv()});var tn0=U(()=>{ex$()});var ul$={};Y1(ul$,{streamAgent:()=>$l$,createDecopilotClient:()=>iz3});async function bz3($){let{parseJsonEventStream:u,uiMessageChunkSchema:f}=await Promise.resolve().then(() => (a3(),YC1));return u({stream:$,schema:f}).pipeThrough(new TransformStream({transform(X,J){if(!X.success)throw X.error;J.enqueue(X.value)}}))}async function $l$($,u,f,X,J){let{readUIMessageStream:w}=await Promise.resolve().then(() => (a3(),YC1)),E=f.value??f.id;if(!E)throw Error("Agent binding has no id or value \u2014 cannot resolve agent");let Q=X.credentialId??f.credentialId,Y=X.thinking??f.thinking,Z=Y?.id,W={messages:X.messages,...Z?{models:{credentialId:Q,thinking:Y,...X.coding??f.coding?{coding:X.coding??f.coding}:{},...X.fast??f.fast?{fast:X.fast??f.fast}:{}}}:{},agent:{id:E},temperature:X.temperature??f.temperature,toolApprovalLevel:X.toolApprovalLevel??f.toolApprovalLevel,mode:X.mode??f.mode??"default",...X.memory?{memory:X.memory}:{},...X.thread_id?{thread_id:X.thread_id}:{}},G=await fetch($,{method:"POST",headers:{"Content-Type":"application/json","x-mesh-token":u,Authorization:`Bearer ${u}`},body:JSON.stringify(W),signal:J?.signal});if(!G.ok){let B=await G.text().catch(()=>""),v=`HTTP ${G.status}`;try{let N=JSON.parse(B);if(N?.error)v=N.error}catch{if(B)v=B}throw Error(v)}if(!G.body)throw Error("Empty response body from decopilot stream");let F=await bz3(G.body);return w({stream:F})}function iz3($){let{baseUrl:u,orgSlug:f,token:X}=$,J=`${u}/${f}/decopilot/runtime/stream`;return{stream(w,E){let Q={__type:"@deco/agent",id:w.agent.id,credentialId:w.credentialId??"",thinking:w.thinking??{id:"",title:""},coding:w.coding,fast:w.fast,toolApprovalLevel:w.toolApprovalLevel,mode:w.mode,temperature:w.temperature};return $l$(J,X,Q,w,E)}}}function fl$($){let u=$.properties;if(!u)return $;for(let f of Object.values(u)){let X=f.properties;if(!X?.__type?.const)continue;let J=X.__type.const,w=xz3.get(J);if(!w)continue;let E=w.map((Q)=>({name:String(Q.name),...Q.inputSchema&&{inputSchema:D.toJSONSchema(Q.inputSchema)},...Q.outputSchema&&{outputSchema:D.toJSONSchema(Q.outputSchema)}}));X.__binding={const:E}}return $}var xz3,LkX,lz3=($)=>{return typeof $==="object"&&$!==null&&$.__type==="@deco/agent"},hV1=($)=>{return typeof $==="object"&&$!==null&&typeof $.__type==="string"&&$.__type!=="@deco/agent"&&typeof $.value==="string"},rn0=($,u,f)=>{let X=f?{"x-caller-app":f}:void 0;if(u.cookie)X??={},X.cookie=u.cookie;if(u.token)X??={},X["x-mesh-token"]=u.token;return{type:"HTTP",url:new URL(`/mcp/${$}`,u.meshUrl).href,token:u.token,headers:X}},cz3=($,u,f)=>{let X=rn0($,u,f);return new Proxy(Mr.forConnection(X),{get(J,w){if(w==="value")return $;if(w==="__type")return f;return J[w]}})},dz3=($,u)=>{let f=u.organizationSlug;if(!f)throw Error("organizationSlug is required for agent bindings");let X=`${u.meshUrl}/api/${f}/decopilot/runtime/stream`;return{STREAM:async(J,w)=>{let{streamAgent:E}=await Promise.resolve().then(() => ul$);return E(X,u.token,$,J,w)}}},MV1=($,u)=>{if($===null||$===void 0)return $;if(Array.isArray($))return $.map((f)=>MV1(f,u));if(typeof $==="object"){if(lz3($))return dz3($,u);if(hV1($))return cz3($.value,u,$.__type);let f={};for(let[X,J]of Object.entries($))f[X]=MV1(J,u);return f}return $},Xl$=($)=>{return MV1($.state,$)};var hs=U(()=>{tn0();c0();xz3=new Map;LkX=D.object({id:D.string(),title:D.string(),capabilities:D.object({vision:D.boolean().optional(),text:D.boolean().optional(),tools:D.boolean().optional(),reasoning:D.boolean().optional()}).passthrough().optional(),provider:D.string().optional().nullable(),limits:D.object({contextWindow:D.number().optional(),maxOutputTokens:D.number().optional()}).passthrough().optional()})});var mz3,Jl$=($,u,f)=>{if(!u)return null;if($===void 0||$==="*")return"*";if(typeof $==="string")return $===u?$:null;if(Array.isArray($))return $.includes(u)?u:null;if(typeof $==="function")return $(u,f)??null;return null},nz3=($,u,f)=>{let X=u.headers.get("Origin"),J=Jl$(f.origin,X,u);if(J)$.set("Access-Control-Allow-Origin",J);if(f.credentials)$.set("Access-Control-Allow-Credentials","true");if(f.exposeHeaders?.length)$.set("Access-Control-Expose-Headers",f.exposeHeaders.join(", "))},wl$=($,u)=>{let f=new Headers,X=$.headers.get("Origin"),J=Jl$(u.origin,X,$);if(J)f.set("Access-Control-Allow-Origin",J);if(u.credentials)f.set("Access-Control-Allow-Credentials","true");let w=u.allowMethods??mz3;f.set("Access-Control-Allow-Methods",w.join(", "));let E=$.headers.get("Access-Control-Request-Headers");if(u.allowHeaders?.length)f.set("Access-Control-Allow-Headers",u.allowHeaders.join(", "));else if(E)f.set("Access-Control-Allow-Headers",E);if(u.maxAge!==void 0)f.set("Access-Control-Max-Age",u.maxAge.toString());return new Response(null,{status:204,headers:f})},El$=($,u,f)=>{let X=new Headers($.headers);return nz3(X,u,f),new Response($.body,{status:$.status,statusText:$.statusText,headers:X})};var Ql$=U(()=>{mz3=["GET","HEAD","PUT","POST","DELETE","PATCH"]});function Yl$($=32){let f=new Uint8Array($);return crypto.getRandomValues(f),Array.from(f,(X)=>"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789"[X%62]).join("")}function tz3($){try{let u=new URL($);return u.protocol==="https:"||u.hostname==="localhost"||u.hostname.endsWith(".localhost")||u.hostname==="127.0.0.1"||!u.protocol.startsWith("http")}catch{return!1}}function Dl$($){return btoa(JSON.stringify($)).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}function Zl$($){try{let u=$.replace(/-/g,"+").replace(/_/g,"/");return JSON.parse(atob(u))}catch{return null}}function Wl$($){return{handleProtectedResourceMetadata:(Z)=>{let W=MF(new URL(Z.url)),G=`${W.origin}/mcp`;return Response.json({resource:G,authorization_servers:[W.origin],scopes_supported:["*"],bearer_methods_supported:["header"],resource_signing_alg_values_supported:["RS256","none"]})},handleAuthorizationServerMetadata:(Z)=>{let G=MF(new URL(Z.url)).origin;return Response.json({issuer:G,authorization_endpoint:`${G}/authorize`,token_endpoint:`${G}/token`,registration_endpoint:`${G}/register`,scopes_supported:["*"],response_types_supported:["code"],response_modes_supported:["query"],grant_types_supported:["authorization_code","refresh_token"],token_endpoint_auth_methods_supported:["none","client_secret_post"],code_challenge_methods_supported:["S256","plain"]})},handleAuthorize:(Z)=>{let W=MF(new URL(Z.url)),G=W.searchParams.get("redirect_uri"),F=W.searchParams.get("response_type"),B=W.searchParams.get("state"),v=W.searchParams.get("code_challenge"),N=W.searchParams.get("code_challenge_method");if(!G)return Response.json({error:"invalid_request",error_description:"redirect_uri required"},{status:400});if(F!=="code")return Response.json({error:"unsupported_response_type",error_description:"Only 'code' is supported"},{status:400});let O=MF(new URL(`${W.origin}/oauth/callback`)),z=O.toString(),_=Dl$({redirectUri:G,clientState:B??void 0,codeChallenge:v??void 0,codeChallengeMethod:N??void 0,oauthCallbackUri:z});O.searchParams.set("state",_);let T=$.authorizationUrl(O.toString());return Response.redirect(T,302)},handleOAuthCallback:async(Z)=>{let W=MF(new URL(Z.url)),G=W.searchParams.get("code"),F=W.searchParams.get("state"),B=W.searchParams.get("error"),v=F?Zl$(F):null;if(B){let N=W.searchParams.get("error_description")??"Authorization failed";if(v?.redirectUri){let O=MF(new URL(v.redirectUri));if(O.searchParams.set("error",B),O.searchParams.set("error_description",N),v.clientState)O.searchParams.set("state",v.clientState);return Response.redirect(O.toString(),302)}return Response.json({error:B,error_description:N},{status:400})}if(!G||!v)return Response.json({error:"invalid_request",error_description:"Missing code or state"},{status:400});try{let N=v.oauthCallbackUri??MF(new URL(`${W.origin}/oauth/callback`)).toString(),O={code:G,redirect_uri:N},z=await $.exchangeCode(O),H={accessToken:z.access_token,tokenType:z.token_type,refreshToken:z.refresh_token,expiresIn:z.expires_in,scope:z.scope,codeChallenge:v.codeChallenge,codeChallengeMethod:v.codeChallengeMethod},_=Dl$(H),T=MF(new URL(v.redirectUri));if(T.searchParams.set("code",_),v.clientState)T.searchParams.set("state",v.clientState);return Response.redirect(T.toString(),302)}catch(N){console.error("OAuth callback error:",N);let O=MF(new URL(v.redirectUri));if(O.searchParams.set("error","server_error"),O.searchParams.set("error_description","Failed to exchange authorization code"),v.clientState)O.searchParams.set("state",v.clientState);return Response.redirect(O.toString(),302)}},handleToken:async(Z)=>{try{let W=Z.headers.get("content-type")??"",G;if(W.includes("application/x-www-form-urlencoded")){let H=await Z.formData();G=Object.fromEntries(H.entries())}else{let H=await Z.json();if(typeof H!=="object"||H===null||Array.isArray(H))return Response.json({error:"invalid_request",error_description:"Request body must be a JSON object"},{status:400});G=H}let{code:F,code_verifier:B,grant_type:v,refresh_token:N}=G;if(v==="refresh_token"){if(typeof N!=="string"||!N)return Response.json({error:"invalid_request",error_description:"refresh_token is required and must be a string"},{status:400});if(!$.refreshToken)return Response.json({error:"unsupported_grant_type",error_description:"refresh_token grant not supported"},{status:400});let H;try{H=await $.refreshToken(N)}catch(T){if(T instanceof yV1)return Response.json({error:T.error,...T.errorDescription?{error_description:T.errorDescription}:{}},{status:400});throw T}let _={access_token:H.access_token,token_type:H.token_type};if(H.refresh_token)_.refresh_token=H.refresh_token;if(H.expires_in!==void 0)_.expires_in=H.expires_in;if(H.scope)_.scope=H.scope;return Response.json(_,{headers:{"Cache-Control":"no-store",Pragma:"no-cache"}})}if(v!=="authorization_code")return Response.json({error:"unsupported_grant_type",error_description:"Only authorization_code and refresh_token supported"},{status:400});if(typeof F!=="string"||!F)return Response.json({error:"invalid_request",error_description:"code is required and must be a string"},{status:400});let O=Zl$(F);if(!O||!O.accessToken)return Response.json({error:"invalid_grant",error_description:"Invalid or expired code"},{status:400});if(O.codeChallenge){if(typeof B!=="string"||!B)return Response.json({error:"invalid_grant",error_description:"code_verifier required and must be a string"},{status:400});let H;if(O.codeChallengeMethod==="S256"){let T=new TextEncoder().encode(B),j=await crypto.subtle.digest("SHA-256",T);H=btoa(String.fromCharCode(...new Uint8Array(j))).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}else H=B;if(H!==O.codeChallenge)return Response.json({error:"invalid_grant",error_description:"Invalid code_verifier"},{status:400})}let z={access_token:O.accessToken,token_type:O.tokenType};if(O.refreshToken)z.refresh_token=O.refreshToken;if(O.expiresIn!==void 0)z.expires_in=O.expiresIn;if(O.scope)z.scope=O.scope;return Response.json(z,{headers:{"Cache-Control":"no-store",Pragma:"no-cache"}})}catch(W){return console.error("Token exchange error:",W),Response.json({error:"server_error",error_description:"Failed to process token request"},{status:500})}},handleClientRegistration:async(Z)=>{try{let W=await Z.json();if(!W.redirect_uris||W.redirect_uris.length===0)return Response.json({error:"invalid_redirect_uri",error_description:"At least one redirect_uri is required"},{status:400});for(let N of W.redirect_uris)if(!tz3(N))return Response.json({error:"invalid_redirect_uri",error_description:`Invalid redirect URI: ${N}`},{status:400});let G=Yl$(32),F=W.token_endpoint_auth_method!=="none"?Yl$(32):void 0,B=Math.floor(Date.now()/1000),v={client_id:G,client_secret:F,client_name:W.client_name,redirect_uris:W.redirect_uris,grant_types:W.grant_types??["authorization_code"],response_types:W.response_types??["code"],token_endpoint_auth_method:W.token_endpoint_auth_method??"client_secret_post",scope:W.scope,client_id_issued_at:B,client_secret_expires_at:0};if($.persistence)await $.persistence.saveClient(v);return new Response(JSON.stringify(v),{status:201,headers:{"Content-Type":"application/json","Cache-Control":"no-store",Pragma:"no-cache"}})}catch(W){return console.error("Client registration error:",W),Response.json({error:"invalid_client_metadata",error_description:"Invalid client registration request"},{status:400})}},createUnauthorizedResponse:(Z)=>{let F=`Bearer resource_metadata="${`${MF(new URL(Z.url)).origin}/.well-known/oauth-protected-resource`}", scope="*"`;return Response.json({jsonrpc:"2.0",error:{code:-32000,message:"Unauthorized: Authentication required"},id:null},{status:401,headers:{"WWW-Authenticate":F,"Access-Control-Expose-Headers":"WWW-Authenticate"}})},hasAuth:(Z)=>Z.headers.has("Authorization")}}var yV1,MF=($)=>{if(!($.hostname==="localhost"||$.hostname.endsWith(".localhost")||$.hostname==="127.0.0.1"))$.protocol="https:";return $};var gV1=U(()=>{yV1=class yV1 extends Error{error;errorDescription;constructor($="invalid_grant",u){super(u??$);this.name="OAuthInvalidGrantError",this.error=$,this.errorDescription=u}}});import{AsyncLocalStorage as rz3}from"async_hooks";var Gl$,iw0;var VV1=U(()=>{Gl$=new rz3,iw0={getStore:()=>{return Gl$.getStore()},run:($,u,...f)=>Gl$.run($,u,...f)}});var Bl$="SELF",pn0=($)=>{return typeof $==="object"&&$!==null&&"handler"in $&&"events"in $&&typeof $.handler==="function"&&Array.isArray($.events)},vl$=($)=>{return typeof $==="object"&&$!==null&&"handler"in $&&"events"in $&&typeof $.handler==="function"&&Array.isArray($.events)},Fl$="::",Ul$=($)=>{let u=$.indexOf(Fl$);if(u===-1)return null;let f=$.substring(0,u),X=$.substring(u+Fl$.length);return[f,X]},az3=($)=>{if(!$.startsWith("cron/"))return null;let u=$.substring(5),f=u.indexOf("/");if(f===-1)return null;let X=u.substring(0,f),J=u.substring(f+1);return[X,J]},Nl$=($)=>{if(pn0($))return[];return Object.keys($)},pz3=($,u)=>{if(pn0($))return $.events;let f=$[u];if(!f)return[];if(vl$(f))return f.events;return Object.keys(f)},an0=($,u,f)=>{if($===Bl$){if(!f)return console.warn("[Event] SELF binding used but no connectionId available"),null;return f}let X=u[$];if(!hV1(X))return console.warn(`[Event] Binding "${$}" not found in state`),null;return X.value},oz3=($,u,f)=>{let X=u;if(pn0($)){let w=[];for(let E of $.events){let Q=Ul$(E);if(!Q){console.warn(`[Event] Global handler event "${E}" must be prefixed with BINDING:: (e.g., "SELF::${E}" or "DATABASE::${E}")`);continue}let[Y,Z]=Q,W=an0(Y,X,f);if(!W)continue;w.push({eventType:Z,publisher:W})}return w}let J=[];for(let w of Nl$($)){let E=an0(w,X,f);if(!E)continue;let Q=pz3($,w);for(let Y of Q)J.push({eventType:Y,publisher:E})}return J},sz3=($)=>{let u=new Map;for(let f of $){let X=f.source,J=u.get(X)||[];J.push(f),u.set(X,J)}return u},ez3=($)=>{let u=new Map;for(let f of $){let X=f.type,J=u.get(X)||[];J.push(f),u.set(X,J)}return u},$K3=($)=>{let u={},f={},X=!1,J=0,w=[];for(let E of $){if(E.results)Object.assign(f,E.results);if(E.success===!1){if(X=!0,E.error)w.push(E.error)}if(E.processedCount!==void 0)J+=E.processedCount}if(Object.keys(f).length>0)u.results=f;if(u.success=!X,w.length>0)u.error=w.join("; ");if(J>0)u.processedCount=J;return u},uK3=async($,u,f,X,J)=>{let w=X;if(pn0($)){let W=new Set;for(let F of $.events){let B=Ul$(F);if(!B)continue;let[v,N]=B,O=an0(v,w,J);if(!O)continue;W.add(`${O}:${N}`)}let G=u.filter((F)=>{let B=`${F.source}:${F.type}`;return W.has(B)});if(G.length===0)return{success:!0};try{return await $.handler({events:G},f)}catch(F){return{success:!1,error:F instanceof Error?F.message:String(F)}}}let E=new Map;for(let W of Nl$($)){let G=an0(W,w,J);if(G)E.set(G,W)}let Q=sz3(u),Y=[];for(let[W,G]of Q){let F=E.get(W);if(!F)continue;let B=$[F];if(!B)continue;if(vl$(B)){Y.push((async()=>{try{return await B.handler({events:G},f)}catch(O){let z={};for(let H of G)z[H.id]={success:!1,error:O instanceof Error?O.message:String(O)};return{results:z}}})());continue}let v=B,N=ez3(G);for(let[O,z]of N){let H=v[O];if(!H)continue;Y.push((async()=>{try{let _=await H({events:z},f),T={};for(let j of z)T[j.id]=_;return{results:T}}catch(_){let T={};for(let j of z)T[j.id]={success:!1,error:_ instanceof Error?_.message:String(_)};return{results:T}}})())}}let Z=await Promise.all(Y);if(Z.length===0)return{success:!0};return $K3(Z)},on0;var bV1=U(()=>{hs();on0={subscriptions:oz3,execute:uK3,parseCron:az3}});function ys($){return $.toLowerCase().trim().replace(/[^a-z0-9]+/g,"-").replace(/^-|-$/g,"")}function zl$($,u){return`${$}::${ys(u)}`}function iV1($){return`START_WORKFLOW_${ys($).toUpperCase().replace(/-/g,"_")}`}function Kl$($,u){let f=rn0("self",{meshUrl:$,token:u});return Mr.forConnection(f)}function fK3($,u){if(!fl.has($)&&fl.size>=Hl$){let f=fl.keys().next().value;if(f!==void 0)fl.delete(f)}fl.set($,u)}function XK3($){return`Workflows Agent (${$})`}function Ol$($,u){if(!Xl.has($)&&Xl.size>=Hl$){let f=Xl.keys().next().value;if(f!==void 0)Xl.delete(f)}Xl.set($,u)}async function JK3($,u,f){let X=Xl.get($);if(X)return console.log(`${f} Using cached default Virtual MCP: ${X}`),X;let J=XK3($);try{let w=await u.COLLECTION_VIRTUAL_MCP_LIST({where:{operator:"and",conditions:[{field:["connection_id"],operator:"eq",value:$},{field:["title"],operator:"eq",value:J}]},limit:1});if(w.items.length>0){let E=w.items[0].id;return Ol$($,E),console.log(`${f} Found existing default Virtual MCP: ${E}`),E}}catch(w){console.warn(`${f} Could not list Virtual MCPs \u2014 proceeding without default. Error: ${w instanceof Error?w.message:String(w)}`);return}try{let E=(await u.COLLECTION_VIRTUAL_MCP_CREATE({data:{title:J,connections:[{connection_id:$,selected_tools:null}]}})).item.id;return Ol$($,E),console.log(`${f} Created default Virtual MCP: ${E}`),E}catch(w){console.warn(`${f} Could not create default Virtual MCP \u2014 proceeding without default. Error: ${w instanceof Error?w.message:String(w)}`);return}}function wK3($){return JSON.stringify($.map((u)=>({title:u.title,description:u.description??void 0,virtual_mcp_id:u.virtual_mcp_id??void 0,steps:u.steps,toolId:u.toolId??void 0,inputSchema:u.inputSchema??void 0})))}async function EK3($,u,f,X,J){let w=`[Workflows][${f}]`,E=$.find((_)=>ys(_.title)==="");if(E!==void 0){console.warn(`${w} Workflow title "${E.title}" produces an empty ID. Skipping sync.`);return}if($.length>0){let _=$.map((j)=>ys(j.title));if(new Set(_).size!==_.length){let j=new Set(_.filter((k,S)=>_.indexOf(k)!==S)),I=$.filter((k)=>j.has(ys(k.title))).map((k)=>k.title);console.warn(`${w} Workflow titles that produce duplicate IDs: ${[...new Set(I)].join(", ")}. Skipping sync.`);return}}let Q=wK3($),Y=fl.get(f);if(Y===Q){console.log(`${w} Fingerprint unchanged \u2014 skipping sync. Declared: ${$.length} workflow(s): [${$.map((_)=>_.title).join(", ")}]`);return}console.log(`${w} Fingerprint changed (or first sync) \u2014 starting sync. Declared: ${$.length} workflow(s): [${$.map((_)=>_.title).join(", ")}]`,Y?"(previous fingerprint existed)":"(no previous fingerprint)");let Z=J??Kl$(u,X),G=$.some((_)=>_.virtual_mcp_id===void 0)?await JK3(f,Z,w):void 0,F;try{let _=[],T=0,j=200;while(!0){let I=await Z.COLLECTION_WORKFLOW_LIST({limit:j,offset:T});if(_.push(...I.items),!I.hasMore||I.items.length===0)break;T+=I.items.length}F=_,console.log(`${w} LIST returned ${F.length} total workflow(s). IDs owned by this connection: [${F.filter((I)=>I.id.startsWith(`${f}::`)).map((I)=>I.id).join(", ")||"none"}]`)}catch(_){let T=_ instanceof Error?_.message:String(_);console.warn(`${w} Could not list workflows (workflows plugin may not be enabled). Skipping sync. Error: ${T}`);return}let B=`${f}::`,v=new Map(F.filter((_)=>_.id.startsWith(B)).map((_)=>[_.id,_])),N=$.map((_)=>[zl$(f,_.title),_]),O=new Set(N.map(([_])=>_)),z=!1;await Promise.all(N.map(async([_,T])=>{let j=v.has(_)?"UPDATE":"CREATE";console.log(`${w} ${j} "${T.title}" (id=${_})`);try{let I=T.virtual_mcp_id??G;if(j==="UPDATE"){let k=await Z.COLLECTION_WORKFLOW_UPDATE({id:_,data:{title:T.title,description:T.description,...I!==void 0&&{virtual_mcp_id:I},steps:T.steps,input_schema:T.inputSchema===void 0?void 0:T.inputSchema??null}});if(!k.success)z=!0,console.warn(`${w} UPDATE "${T.title}" returned success=false:`,String(k.error??"(no error message)"));else console.log(`${w} UPDATE "${T.title}" OK`)}else await Z.COLLECTION_WORKFLOW_CREATE({data:{id:_,title:T.title,description:T.description,virtual_mcp_id:I,steps:T.steps,input_schema:T.inputSchema??null}}),console.log(`${w} CREATE "${T.title}" OK`)}catch(I){z=!0,console.warn(`${w} Failed to ${j} workflow "${T.title}":`,I instanceof Error?I.message:String(I))}}));let H=[...v.keys()].filter((_)=>!O.has(_));if(H.length>0)console.log(`${w} Deleting ${H.length} orphaned workflow(s): [${H.join(", ")}]`);if(await Promise.all(H.map(async(_)=>{try{await Z.COLLECTION_WORKFLOW_DELETE({id:_}),console.log(`${w} DELETE "${_}" OK`)}catch(T){z=!0,console.warn(`${w} Failed to delete orphaned workflow "${_}":`,T instanceof Error?T.message:String(T))}})),!z)fK3(f,Q),console.log(`${w} Sync complete \u2014 fingerprint stored.`);else console.warn(`${w} Sync finished with errors \u2014 fingerprint NOT stored so the next call will retry.`)}async function QK3($,u,f,X,J){let E=(sn0.get(f)??Promise.resolve()).catch(()=>{}).then(()=>EK3($,u,f,X,J)).finally(()=>{if(sn0.get(f)===E)sn0.delete(f)});return sn0.set(f,E),E}var sn0,Hl$=500,fl,Xl,_l$,en0;var xV1=U(()=>{hs();tn0();sn0=new Map,fl=new Map;Xl=new Map;_l$=["SELF::COLLECTION_WORKFLOW_LIST","SELF::COLLECTION_WORKFLOW_CREATE","SELF::COLLECTION_WORKFLOW_UPDATE","SELF::COLLECTION_WORKFLOW_DELETE","SELF::COLLECTION_WORKFLOW_EXECUTION_CREATE","SELF::COLLECTION_VIRTUAL_MCP_LIST","SELF::COLLECTION_VIRTUAL_MCP_CREATE"],en0={sync:QK3,slugify:ys,workflowId:zl$,toolId:iV1,createExecution:async($,u,f)=>{return(await Kl$($,u).COLLECTION_WORKFLOW_EXECUTION_CREATE(f)).item.id},clearFingerprint:($)=>{fl.delete($),Xl.delete($)}}});function hF($){return{...$,execute:(u)=>{let f=xw0(u.runtimeContext);return $.execute({...u,runtimeContext:f},f)}}}var xw0=($)=>{let u=iw0.getStore();if(!u){if($)return $;throw Error("Missing context, did you forget to call State.bind?")}return u},YK3=($,u)=>{let f=u;return typeof f[$]<"u"?f[$]:u?.MESH_REQUEST_CONTEXT?.state?.[$]},$t0=($)=>{let u=$.runtimeContext.env.MESH_REQUEST_CONTEXT;return{connectionId:u?.connectionId,meshUrl:u?.meshUrl,token:u?.token}},DK3=({events:$,workflows:u,configuration:{state:f,scopes:X,onChange:J}={}}={})=>{let w=f?fl$(D.toJSONSchema(f)):{type:"object",properties:{}},E=String($?.bus??"EVENT_BUS");return[...J||$||u?.length?[hF({id:"ON_MCP_CONFIGURATION",description:"MCP Configuration On Change",inputSchema:D.object({state:f??D.unknown(),scopes:D.array(D.string()).describe("Array of scopes in format 'KEY::SCOPE' (e.g., 'GMAIL::GetCurrentUser')")}),outputSchema:D.object({}),execute:async(Q)=>{let Y=Q.context.state;await J?.(Q.runtimeContext.env,{state:Y,scopes:Q.context.scopes});let Z=YK3(E,Q.runtimeContext.env);if($&&Y&&Z){let{connectionId:W}=$t0(Q),G=on0.subscriptions($?.handlers??{},Y,W);if(await Z.EVENT_SYNC_SUBSCRIPTIONS({subscriptions:G}),W){let F=G.filter((B)=>B.eventType.startsWith("cron/")&&B.publisher===W);await Promise.all(F.map(async(B)=>{let v=on0.parseCron(B.eventType);if(v){let[,N]=v;await Z.EVENT_PUBLISH({type:B.eventType,cron:N})}}))}}if(u?.length){let{connectionId:W,meshUrl:G,token:F}=$t0(Q);if(W&&G)await en0.sync(u,G,W,F)}return Promise.resolve({})}})]:[],...$?.handlers?[hF({id:"ON_EVENTS",description:"Receive and process CloudEvents from the event bus. Returns per-event or batch results.",inputSchema:sT0,outputSchema:eT0,execute:async(Q)=>{let Y=Q.runtimeContext.env,Z=Y.MESH_REQUEST_CONTEXT?.state,{connectionId:W}=$t0(Q);return on0.execute($.handlers,Q.context.events,Y,Z,W)}})]:[],hF({id:"MCP_CONFIGURATION",description:"MCP Configuration",inputSchema:D.object({}),outputSchema:D.object({stateSchema:D.unknown(),scopes:D.array(D.string()).optional()}),execute:()=>{return Promise.resolve({stateSchema:w,scopes:[...X??[],...$?[`${E}::EVENT_SYNC_SUBSCRIPTIONS`]:[],...u?.length?[..._l$]:[]]})}}),...u?.length?u.map((Q)=>{let Y=Q.toolId??iV1(Q.title),Z=[Q.description?`Run workflow: ${Q.description}`:`Start the "${Q.title}" workflow.`,"Returns an execution_id immediately. Use COLLECTION_WORKFLOW_EXECUTION_GET to track progress."].join(" ");return hF({id:Y,description:(()=>{if(!Q.inputSchema)return Z;let W=JSON.stringify(Q.inputSchema,null,2);return W.length<=2048?`${Z}
+Use sentence case for the title. No markdown fences.`;var Pi$=U(()=>{a3();r90()});function BO3($){if(!$||$.length>255||$.includes("..")||$.startsWith("/")||$.endsWith("/")||$.endsWith(".lock")||!FO3.test($))throw Error(`Invalid branch name: ${$}`)}function GV1($){let{runner:u}=$.get("vmClaim");if(!u)return $.json({error:"No sandbox runner configured"},503);return u}async function hw($,u,f){let X=GV1($);if(X instanceof Response)return X;let{claimName:J}=$.get("vmClaim"),w=f?.method??"POST",E=null,Q=new Headers;if(f?.forwardJsonBody)E=await $.req.text(),Q.set("content-type","application/json");let Y;try{Y=await X.proxyDaemonRequest(J,u,{method:w,headers:Q,body:E,...f?.signal?{signal:f.signal}:{}})}catch(G){let F=G instanceof Error?G.message:String(G);return $.json({error:`Daemon unreachable: ${F}`},502)}if(f?.map404to410&&Y.status===404){try{await Y.body?.cancel()}catch{}return $.json({error:"Sandbox handle is gone. The sandbox needs to be re-provisioned."},410,Rs)}let Z=await Y.text(),W=Y.headers.get("content-type")??"application/json";return new Response(Z,{status:Y.status,headers:{"content-type":W,...Rs}})}async function ji$($,u,f,X="GET"){let J=await $.proxyDaemonRequest(u,f,{method:X,headers:new Headers,body:null});if(J.status===404){try{await J.body?.cancel()}catch{}throw Error("SANDBOX_GONE")}let w=await J.text();if(!J.ok)try{let E=JSON.parse(w);throw Error(E.error??`Daemon error (${J.status})`)}catch(E){if(E instanceof Error&&E.message!==w)throw E;throw Error(`Daemon error (${J.status})`)}return JSON.parse(w)}function OO3($){return Li$.includes($)}var FO3,vO3=524288,UO3,Rs,NO3,Li$,Ti$=()=>{let $=new d4;return $.use("/:virtualMcpId/:branch/*",UO3),$.post("/:virtualMcpId/:branch/write",(u)=>hw(u,"/_sandbox/write",{forwardJsonBody:!0})),$.post("/:virtualMcpId/:branch/unlink",(u)=>hw(u,"/_sandbox/unlink",{forwardJsonBody:!0})),$.post("/:virtualMcpId/:branch/read",(u)=>hw(u,"/_sandbox/read",{forwardJsonBody:!0})),$.post("/:virtualMcpId/:branch/glob",(u)=>hw(u,"/_sandbox/glob",{forwardJsonBody:!0})),$.post("/:virtualMcpId/:branch/exec/:script",(u)=>{let f=u.req.param("script");if(!f)return u.json({error:"missing script name"},400);return hw(u,`/_sandbox/exec/${encodeURIComponent(f)}`)}),$.post("/:virtualMcpId/:branch/exec/:script/kill",(u)=>{let f=u.req.param("script");if(!f)return u.json({error:"missing script name"},400);return hw(u,`/_sandbox/exec/${encodeURIComponent(f)}/kill`)}),$.get("/:virtualMcpId/:branch/config",(u)=>hw(u,"/_sandbox/config",{method:"GET",map404to410:!0})),$.put("/:virtualMcpId/:branch/config",(u)=>hw(u,"/_sandbox/config",{method:"PUT",forwardJsonBody:!0,map404to410:!0})),$.post("/:virtualMcpId/:branch/setup/:step",async(u)=>{let f=u.req.param("step");if(!f||!OO3(f))return u.json({error:`step must be one of: ${Li$.join(", ")}`},400);if(f==="start"){let X=u.get("vmClaim");if(X.runner){let J=r0(u.var.meshContext),w=eP$(X.virtualMcpMetadata);try{await tk0({ctx:u.var.meshContext,runner:X.runner,handle:X.claimName,orgId:J.id,userId:X.userId,entries:w})}catch(E){let Q=E instanceof Error?E.message:String(E);return u.json({error:`Failed to push env to daemon: ${Q}`},502)}}}return hw(u,`/_sandbox/setup/${f}`,{signal:u.req.raw.signal,map404to410:!0})}),$.get("/:virtualMcpId/:branch/events",(u)=>{let f=u.get("vmClaim");if(!f.runner)return J2(u,async(X)=>{await X.writeSSE({event:"phase",data:JSON.stringify({kind:"failed",reason:"unknown",message:"No sandbox runner configured on this mesh."})})});return Ni$(u,{ctx:u.var.meshContext,claimName:f.claimName,runner:f.runner,branch:f.branch,userId:f.userId,projectRef:f.projectRef,virtualMcpMetadata:f.virtualMcpMetadata})}),$.get("/:virtualMcpId/:branch/git/status",(u)=>hw(u,"/_sandbox/git/status",{method:"GET",map404to410:!0})),$.post("/:virtualMcpId/:branch/git/status",(u)=>hw(u,"/_sandbox/git/status",{map404to410:!0})),$.post("/:virtualMcpId/:branch/git/diff",(u)=>hw(u,"/_sandbox/git/diff",{forwardJsonBody:!0,map404to410:!0})),$.post("/:virtualMcpId/:branch/git/publish",(u)=>hw(u,"/_sandbox/git/publish",{forwardJsonBody:!0,map404to410:!0})),$.post("/:virtualMcpId/:branch/git/discard",(u)=>hw(u,"/_sandbox/git/discard",{forwardJsonBody:!0,map404to410:!0})),$.post("/:virtualMcpId/:branch/git/rebase",(u)=>hw(u,"/_sandbox/git/rebase",{forwardJsonBody:!0,map404to410:!0})),$.post("/:virtualMcpId/:branch/git/suggest-commit",D_({maxSize:vO3,onError:(u)=>u.json({error:"Payload too large"},413,Rs)}),async(u)=>{let f=GV1(u);if(f instanceof Response)return f;let{claimName:X}=u.get("vmClaim"),J=u.var.meshContext;try{let[w,E]=await Promise.all([ji$(f,X,"/_sandbox/git/status","GET"),ji$(f,X,"/_sandbox/git/diff","GET")]),Q=await _i$(J,w,E);return u.json(Q,200,Rs)}catch(w){let E=w instanceof Error?w.message:String(w);if(E==="SANDBOX_GONE")return u.json({error:"Sandbox handle is gone. The sandbox needs to be re-provisioned."},410,Rs);return u.json({error:E},502,Rs)}}),$.get("/:virtualMcpId/:branch/preview-fetch",async(u)=>{let f=GV1(u);if(f instanceof Response)return f;let{claimName:X}=u.get("vmClaim"),J=u.req.query("path");if(!J)return u.json({error:"path query parameter is required"},400);if(!NO3.has(J))return u.json({error:"Path not allowed"},403);let w=await f.getPreviewUrl(X);if(!w)return u.json({error:"Preview not available"},502);let E=w.replace(/\/+$/,""),Q;try{Q=await fetch(`${E}${J}`)}catch{return u.json({error:"Preview unreachable"},502)}let Y=await Q.text();return new Response(Y,{status:Q.status,headers:{"content-type":Q.headers.get("content-type")??"application/json"}})}),$};var Ai$=U(()=>{uf();vw0();$l();Bi$();bU();ZV1();sJ0();Oi$();yC1();nk0();Pi$();FO3=/^[a-zA-Z0-9][a-zA-Z0-9/._-]*$/;UO3=Fi$(async($,u)=>{let f=$.var.meshContext;try{X1(f)}catch{return $.json({error:"Unauthorized"},401)}let X=G$(f);if(!X)return $.json({error:"Unauthorized"},401);let J;try{J=r0(f)}catch{return $.json({error:"Organization scope required"},403)}let w=$.req.param("virtualMcpId"),E=$.req.param("branch");if(!w||!E)return $.json({error:"virtualMcpId and branch are required"},400);try{BO3(E)}catch(F){let B=F instanceof Error?F.message:String(F);return $.json({error:B},400)}let Q=await f.storage.virtualMcps.findById(w);if(!Q||Q.organization_id!==J.id)return $.json({error:"Virtual MCP not found"},404);let Y=EI({orgId:J.id,virtualMcpId:w,branch:E}),Z=Vn0({userId:X,projectRef:Y},E),W=Q.metadata??null,G;try{G=(await tU(f,{userId:X,branch:E,virtualMcpMetadata:W})).provider}catch{G=null}if(!G)return $.json({error:"No sandbox runner found"},404);return $.set("vmClaim",{claimName:Z,runner:G,virtualMcpId:w,branch:E,userId:X,projectRef:Y,virtualMcpMetadata:W}),u()});Rs={"Cache-Control":"no-store, no-cache, must-revalidate",Pragma:"no-cache"};NO3=new Set(["/.decofile","/live/_meta"]),Li$=["clone","install","start"]});var Ii$=($)=>{let u=new d4;if(u.use("*",dx),u.route("/",un0()),u.route("/",hn0()),u.route("/",qn0({kvStorage:$.kvStorage})),u.route("/",wi$()),u.route("/sandbox",Ti$()),u.route("/",Qi$()),u.route("/deco-sites",fn0()),u.route("/sso",Im0()),u.route("/",yn0({tokenStorage:$.tokenStorage,automationEventDispatcher:$.automationEventDispatcher})),u.route("/webhooks",Kg$()),$.mountDevAssets)u.route("/dev-assets",Xn0({orgFromPath:!0}));return u.use("/mcp/:connectionId?",$.mcpAuth),u.use("/mcp/gateway/:virtualMcpId?",$.mcpAuth),u.use("/mcp/virtual-mcp/:virtualMcpId?",$.mcpAuth),u.use("/mcp/self",$.mcpAuth),u.route("/",XB$()),u.get("/mcp/:gateway?/:connectionId/.well-known/oauth-protected-resource/*",$.betterAuthProtectedResourceHandler),u.route("/mcp",oS0()),u.route("/mcp/self",Mn0()),u.route("/mcp",$k0()),u.all("/oauth-proxy/:connectionId/*",$.oauthProxyHandler),u.post("/events/:type",$.eventsHandler),u.get("/watch",$.watchHandler),u};var Si$=U(()=>{uf();hy1();Hg$();iy1();Jn0();qy1();Ei$();XV1();g90();Ph1();uk0();JV1();Yi$();wV1();EV1();sS0();Ai$()});async function HO3($,u){try{return!await $.alive(u)}catch(f){return console.warn(`[vm-events] alive probe failed for ${u}; assuming alive: ${f instanceof Error?f.message:String(f)}`),!1}}async function _O3($){let{ctx:u,runner:f,claimName:X,userId:J,projectRef:w,sandboxProviderKind:E}=$;try{await f.delete(X)}catch(Q){console.warn(`[vm-events] runner.delete failed for ${X}: ${Q instanceof Error?Q.message:String(Q)}`)}try{await new nH(u.db).delete({userId:J,projectRef:w},E)}catch(Q){console.warn(`[vm-events] sandbox_runner_state delete failed for ${J}/${w}/${E}: ${Q instanceof Error?Q.message:String(Q)}`)}}async function PO3($){let{stream:u,claimName:f,runner:X,signal:J}=$;return new Promise((w)=>{let E=!1,Q=!1,Y=null,Z=(F)=>{if(E)return;E=!0,clearTimeout(W),J.removeEventListener("abort",G),Y?.unsubscribe(),w(F)},W=setTimeout(()=>{if(Q||E)return;u.writeSSE({event:"phase",data:JSON.stringify({kind:"failed",reason:"claim-never-created",message:"Sandbox claim was never created. The SANDBOX_START call may have failed earlier \u2014 check the start error."})}).catch(()=>{}),Z(!1)},zO3),G=()=>Z(!1);J.addEventListener("abort",G,{once:!0}),Y=oJ0(X,f,(F)=>{if(E)return;if(F.kind!=="claiming")Q=!0;if(u.writeSSE({event:"phase",data:JSON.stringify(F)}).catch(()=>{}),F.kind==="ready")Z(!0);else if(F.kind==="failed")Z(!1)})})}async function jO3($){let{stream:u,runner:f,claimName:X,signal:J}=$,w=Date.now(),E=null;while(!J.aborted){let Y=null;try{Y=await f.proxyDaemonRequest(X,"/_sandbox/events",{method:"GET",headers:new Headers({accept:"text/event-stream"}),body:null,signal:J})}catch(Z){if(J.aborted)return;if(Date.now()-w<ki$){await k3(Ri$,{signal:J}).catch(()=>{});continue}let W=Z instanceof Error?Z.message:String(Z);await u.writeSSE({event:"phase",data:JSON.stringify({kind:"failed",reason:"unknown",message:`Upstream daemon SSE error: ${W}`})}).catch(()=>{});return}if(Y.status===404){try{await Y.body?.cancel()}catch{}if(Date.now()-w<ki$){await k3(Ri$,{signal:J}).catch(()=>{});continue}await u.writeSSE({event:"gone",data:""}).catch(()=>{});return}if(!Y.ok||!Y.body){try{await Y.body?.cancel()}catch{}await u.writeSSE({event:"phase",data:JSON.stringify({kind:"failed",reason:"unknown",message:`Upstream daemon SSE failed (${Y.status}).`})}).catch(()=>{});return}E=Y;break}if(!E||!E.body)return;let Q=E.body.getReader();try{while(!J.aborted){let{value:Y,done:Z}=await Q.read();if(Z)break;if(Y)await u.write(Y)}}catch{}finally{try{Q.releaseLock()}catch{}}}var zO3=90000,KO3=15000,Ci$=()=>{let $=new d4;return $.get("/",async(u)=>{let f=u.var.meshContext;try{X1(f)}catch{return u.json({error:"Unauthorized"},401)}let X=G$(f);if(!X)return u.json({error:"Unauthorized"},401);let J;try{J=r0(f)}catch{return u.json({error:"Organization scope required"},403)}let w=u.req.query("virtualMcpId"),E=u.req.query("branch");if(!w||!E)return u.json({error:"virtualMcpId and branch are required"},400);let Q=await f.storage.virtualMcps.findById(w);if(!Q||Q.organization_id!==J.id)return u.json({error:"Virtual MCP not found"},404);let Y=EI({orgId:J.id,virtualMcpId:w,branch:E}),Z=Vn0({userId:X,projectRef:Y},E),W=Q.metadata??null,G,F=null,B=null;try{let O=await tU(f,{userId:X,branch:E,virtualMcpMetadata:W});G=O.provider,F=O.kind}catch(O){B=O instanceof Error?O:Error(String(O)),G=null}let v=F&&mH(u2(W),X,E,F),N=!!v&&v.sandboxHandle===Z;if(!G)return J2(u,async(O)=>{await O.writeSSE({event:"phase",data:JSON.stringify({kind:"failed",reason:"unknown",message:B?.message??"No sandbox runner configured on this mesh."})})});return u.header("X-Accel-Buffering","no"),u.header("Content-Encoding","identity"),J2(u,async(O)=>{let z=new AbortController,H=setInterval(()=>{O.writeSSE({event:"keepalive",data:""}).catch(()=>{clearInterval(H)})},KO3);O.onAbort(()=>{z.abort(),clearInterval(H)});try{if(N&&F){if(await HO3(G,Z)){await _O3({ctx:f,runner:G,claimName:Z,userId:X,projectRef:Y,sandboxProviderKind:F}),await O.writeSSE({event:"gone",data:""}).catch(()=>{});return}}if(!await PO3({stream:O,claimName:Z,runner:G,signal:z.signal})||z.signal.aborted)return;await jO3({stream:O,runner:G,claimName:Z,signal:z.signal})}finally{clearInterval(H)}})}),$},ki$=60000,Ri$=500;var qi$=U(()=>{uf();$l();bU();bw();ZV1();gx();sJ0();rk0();iU()});function qF($,u="invalid_request_error",f=null,X=null){return{error:{message:$,type:u,param:f,code:X}}}function qO3($){if(!$)return null;let u=$.indexOf(":");if(u===-1)return{credentialId:null,modelId:$};let f=$.substring(0,u),X=$.substring(u+1);if(!f||!X)return null;return{credentialId:f,modelId:X}}function MO3($,u,f){try{return JSON.parse($)}catch{throw new yi$(`Invalid JSON in tool call arguments for function '${f}' (tool_call_id: ${u}): ${$}`)}}function hO3($){let u={};for(let f of $)if(f.role==="assistant"&&f.tool_calls)for(let X of f.tool_calls)u[X.id]=X.function.name;return $.map((f)=>{switch(f.role){case"system":return{role:"system",content:f.content};case"user":if(typeof f.content==="string")return{role:"user",content:f.content};return{role:"user",content:f.content.map((J)=>{if(J.type==="text")return{type:"text",text:J.text};return{type:"image",image:J.image_url.url}})};case"assistant":if(f.tool_calls&&f.tool_calls.length>0)return{role:"assistant",content:f.tool_calls.map((J)=>({type:"tool-call",toolCallId:J.id,toolName:J.function.name,input:MO3(J.function.arguments,J.id,J.function.name)}))};return{role:"assistant",content:f.content??""};case"tool":let X=u[f.tool_call_id]??"unknown";return{role:"tool",content:[{type:"tool-result",toolCallId:f.tool_call_id,toolName:X,output:{type:"text",value:f.content}}]}}})}function yO3($){let u=$.map((f)=>{let X=f.function.parameters?WY(f.function.parameters):WY({type:"object",properties:{}});return[f.function.name,uu({description:f.function.description,inputSchema:X})]});return Object.fromEntries(u)}function gO3($){if(!$)return;return{openai:{response_format:$}}}function VO3(){return`chatcmpl-${crypto.randomUUID().replace(/-/g,"").substring(0,29)}`}function Mi$($,u,f,X,J,w){let E={model:$,messages:u,tools:f,temperature:X.temperature,maxTokens:X.max_tokens,topP:X.top_p,frequencyPenalty:X.frequency_penalty,presencePenalty:X.presence_penalty,stopSequences:X.stop?Array.isArray(X.stop)?X.stop:[X.stop]:void 0,abortSignal:w};return J?{...E,providerOptions:J}:E}function hi$($){if($==="tool-calls")return"tool_calls";if($==="length")return"length";return"stop"}var LO3,TO3,AO3,IO3,SO3,kO3,RO3,CO3,yi$,gi$,Vi$;var bi$=U(()=>{a3();uf();$l();c0();LO3=D.object({type:D.literal("function"),function:D.object({name:D.string(),description:D.string().optional(),parameters:D.record(D.string(),D.unknown()).optional()})}),TO3=D.object({id:D.string(),type:D.literal("function"),function:D.object({name:D.string(),arguments:D.string()})}),AO3=D.discriminatedUnion("role",[D.object({role:D.literal("system"),content:D.string(),name:D.string().optional()}),D.object({role:D.literal("user"),content:D.union([D.string(),D.array(D.union([D.object({type:D.literal("text"),text:D.string()}),D.object({type:D.literal("image_url"),image_url:D.object({url:D.string(),detail:D.string().optional()})})]))]),name:D.string().optional()}),D.object({role:D.literal("assistant"),content:D.string().nullable().optional(),name:D.string().optional(),tool_calls:D.array(TO3).optional()}),D.object({role:D.literal("tool"),content:D.string(),tool_call_id:D.string()})]),IO3=D.object({type:D.literal("text")}),SO3=D.object({type:D.literal("json_object")}),kO3=D.object({type:D.literal("json_schema"),json_schema:D.object({name:D.string(),description:D.string().optional(),schema:D.record(D.string(),D.unknown()),strict:D.boolean().optional()})}),RO3=D.union([IO3,SO3,kO3]),CO3=D.object({model:D.string().describe("Format: 'model_id' or 'credential_id:model_id'"),messages:D.array(AO3),stream:D.boolean().optional().default(!1),temperature:D.number().min(0).max(2).optional(),max_tokens:D.number().positive().optional(),top_p:D.number().min(0).max(1).optional(),frequency_penalty:D.number().min(-2).max(2).optional(),presence_penalty:D.number().min(-2).max(2).optional(),stop:D.union([D.string(),D.array(D.string())]).optional(),tools:D.array(LO3).optional(),tool_choice:D.union([D.literal("auto"),D.literal("none"),D.literal("required"),D.object({type:D.literal("function"),function:D.object({name:D.string()})})]).optional(),response_format:RO3.optional(),user:D.string().optional()});yi$=class yi$ extends Error{constructor($){super($);this.name="MessageConversionError"}};gi$=new d4;gi$.post("/:org/v1/chat/completions",async($)=>{let u=$.get("meshContext"),f=$.req.param("org");try{if(!u.auth.apiKey?.id)return $.json(qF("API key authentication required. Provide a valid API key via Authorization header.","authentication_error"),401);if(!u.organization)return $.json(qF("Organization context is required. Ensure your API key has organization metadata.","invalid_request_error","organization"),400);if((u.organization.slug??u.organization.id)!==f)return $.json(qF("Organization mismatch. The API key's organization does not match the requested organization.","invalid_request_error","organization"),403);let X=await $.req.json(),J=CO3.safeParse(X);if(!J.success){let O=J.error.issues[0]??{message:"Invalid request",path:[]};return $.json(qF(`Invalid request: ${O.message}`,"invalid_request_error",O.path.length>0?O.path.join("."):null),400)}let w=J.data,E=qO3(w.model);if(!E)return $.json(qF("Invalid model format. Expected 'model_id' or 'credential_id:model_id' (e.g., 'claude-sonnet-4-6' or 'key_abc123:claude-sonnet-4-6')","invalid_request_error","model"),400);let{credentialId:Q}=E,{modelId:Y}=E;if(!Q){let O=await u.storage.aiProviderKeys.list({organizationId:u.organization.id});if(O.length===0)return $.json(qF("No AI provider credentials configured for this organization. Add a credential in settings or specify one explicitly via 'credential_id:model_id'.","invalid_request_error","model"),400);Q=O[0].id}let Z;try{Z=await u.aiProviders.activate(Q,u.organization.id)}catch{return $.json(qF(`AI provider credential not found or inaccessible: ${Q}`,"invalid_request_error","model"),404)}let W=Z.aiSdk.languageModel(Y),G=hO3(w.messages),F=w.tools?yO3(w.tools):void 0,B=gO3(w.response_format),v=VO3(),N=Math.floor(Date.now()/1000);if(w.stream)return J2($,async(O)=>{let z=Mi$(W,G,F,w,B,$.req.raw.signal);try{let H=eD(z),_=!1,T=0;for await(let j of H.fullStream){if(!_&&(j.type==="text-delta"||j.type==="tool-call"))await O.writeSSE({data:JSON.stringify({id:v,object:"chat.completion.chunk",created:N,model:w.model,choices:[{index:0,delta:{role:"assistant",content:""},finish_reason:null}]})}),_=!0;if(j.type==="text-delta")await O.writeSSE({data:JSON.stringify({id:v,object:"chat.completion.chunk",created:N,model:w.model,choices:[{index:0,delta:{content:j.text},finish_reason:null}]})});else if(j.type==="tool-call"){let I=T++;await O.writeSSE({data:JSON.stringify({id:v,object:"chat.completion.chunk",created:N,model:w.model,choices:[{index:0,delta:{tool_calls:[{index:I,id:j.toolCallId,type:"function",function:{name:j.toolName,arguments:JSON.stringify(j.input)}}]},finish_reason:null}]})})}else if(j.type==="finish")await O.writeSSE({data:JSON.stringify({id:v,object:"chat.completion.chunk",created:N,model:w.model,choices:[{index:0,delta:{},finish_reason:hi$(j.finishReason)}],usage:j.totalUsage?{prompt_tokens:j.totalUsage.inputTokens??0,completion_tokens:j.totalUsage.outputTokens??0,total_tokens:j.totalUsage.totalTokens??0}:void 0})})}await O.writeSSE({data:"[DONE]"})}catch(H){let _=H;console.error("[openai-compat:stream] Error:",_.message),await O.writeSSE({data:JSON.stringify({error:{message:_.message,type:"server_error"}})})}});else{let O=Mi$(W,G,F,w,B,$.req.raw.signal),z=await lH(O),H={role:"assistant",content:z.text||null};if(z.toolCalls&&z.toolCalls.length>0)H.tool_calls=z.toolCalls.map((_)=>({id:_.toolCallId,type:"function",function:{name:_.toolName,arguments:JSON.stringify("input"in _?_.input:{})}})),H.content=null;return $.json({id:v,object:"chat.completion",created:N,model:w.model,choices:[{index:0,message:H,finish_reason:hi$(z.finishReason)}],usage:{prompt_tokens:z.usage?.inputTokens??0,completion_tokens:z.usage?.outputTokens??0,total_tokens:z.usage?.totalTokens??0}})}}catch(X){let J=X;if(J.name==="AbortError")return $.json(qF("Request aborted","invalid_request_error"),400);if(J.name==="MessageConversionError")return $.json(qF(J.message,"invalid_request_error","messages"),400);return console.error("[openai-compat] Error:",J.message,J.stack),$.json(qF(J.message,"server_error"),500)}});Vi$=gi$});function iO3(){let $=process.env.POSTHOG_KEY;if(!$)return null;return{key:$,host:process.env.POSTHOG_HOST??bO3}}var ii$,bO3="https://us.i.posthog.com",xi$;var li$=U(()=>{uf();sK1();Vx();lW();$5();zh1();ii$=new d4;ii$.get("/",($)=>{let u={theme:g4$(),...KT().logo&&{logo:KT().logo},...rU()&&{internalUrl:UB0()},...g4().enableDecoImport&&{enableDecoImport:!0},brandExtractEnabled:!!g4().firecrawlApiKey,auth:IC$(),posthog:iO3()};return $.json({success:!0,config:u})});xi$=ii$});var ci$,di$;var mi$=U(()=>{uf();VG();Xw0();fa();ci$=new d4;ci$.get("/:org/files/*",async($)=>{let u=$.get("meshContext"),f=u.organization?.id;if(!u.auth?.user?.id){if(vs($))return $.redirect(`/login?next=${encodeURIComponent($.req.path)}`,302);throw new Pu(401,{message:"Authentication required"})}if(!f)throw new Pu(401,{message:"Organization context required"});let X=$.req.path.replace(/^.*\/files\//,"");if(!X)throw new Pu(400,{message:"Missing file key"});let J=await xx(X,u);if(!J)throw new Pu(503,{message:"Object storage not configured"});if(J.startsWith("data:")&&AZ()){let w=J.match(/^data:([^;]+);base64,(.+)$/s);if(!w)throw new Pu(500,{message:"Invalid data URL from storage"});let[,E,Q]=w,Y=Buffer.from(Q,"base64");return $.body(Y,200,{"Content-Type":E,"Cache-Control":"private, max-age=86400"})}return $.redirect(J,302)});di$=ci$});var ri$={};Y1(ri$,{shouldSkipStudioContext:()=>FV1,isServerPath:()=>nO3,SYSTEM_PATHS:()=>B_});function ni$($){return $===B_.HEALTH_LIVE||$===B_.HEALTH_READY||$===B_.METRICS||$.startsWith(Cs.WELL_KNOWN)}function ti$($){return $.startsWith(Cs.API)}function lO3($){return $==="/mcp"||$.startsWith(Cs.MCP)}function cO3($){return $.startsWith(Cs.OAUTH_PROXY)}function dO3($){return xO3.test($)}function mO3($){return $.startsWith(Cs.ORG)}function nO3($){return ti$($)||lO3($)||cO3($)||mO3($)||ni$($)}function FV1($){return $==="/"||$.startsWith(Cs.API_AUTH)||$==="/api/trigger-callback"||ni$($)||!ti$($)&&dO3($)}var B_,Cs,xO3;var BV1=U(()=>{B_={HEALTH_LIVE:"/health/live",HEALTH_READY:"/health/ready",METRICS:"/metrics"},Cs={API:"/api/",API_AUTH:"/api/auth/",MCP:"/mcp/",OAUTH_PROXY:"/oauth-proxy/",WELL_KNOWN:"/.well-known",ORG:"/org/"},xO3=/\.(html|css|js|ico|svg|png|jpg|jpeg|gif|webp|woff|woff2)$/});function ai$($){let u=$?.connectFn??pO3,f=null,X=null,J=!1,w=!1,E=!1,Q=[];function Y(){return f!==null&&!f.isClosed()&&!f.isDraining()&&!E}function Z(){console.log(`[NatsProvider] fireReady: ${Q.length} callbacks`);for(let F of Q)try{F()}catch{}}function W(F){(async()=>{for await(let B of F.status())if(B.type===Vw0.Events.Disconnect)console.log("[NatsProvider] Disconnected"),E=!0;else if(B.type===Vw0.Events.Reconnect)console.log("[NatsProvider] Reconnected, re-firing ready callbacks"),E=!1,X=null,Z()})().catch(()=>{})}async function G(F){let B=0;while(!w)try{f=await u({servers:F,timeout:aO3,reconnect:!0,maxReconnectAttempts:-1}),console.log(`[NatsProvider] Connected to ${f.getServer()} after ${B} attempt(s)`),X=null,E=!1,W(f),Z();return}catch{B++;let v=PJ(rO3,tO3,B-1,2,0.5);await k3(v)}}return{init(F){if(J)return;J=!0,w=!1,G(F).catch(()=>{})},isConnected(){return Y()},getConnection(){return Y()?f:null},getJetStream(){if(!Y())return null;if(!X)X=f.jetstream();return X},onReady(F){if(Q.push(F),Y())try{F()}catch{}},async drain(){if(w=!0,J=!1,X=null,E=!1,f){let F=f;f=null,await F.drain().catch(()=>{})}}}}function pO3($){return Vw0.connect($)}var Vw0,tO3=100,rO3=3000,aO3=3000;var pi$=U(()=>{bw();Vw0=Q0(ga(),1)});function qs($){let u=$?.ttlMs??60000,f=$?.maxSize??1e4,X=$?.updateRecencyOnGet??!1,J=new Map;function w(){if(J.size<=f)return;let E=Date.now();for(let[Q,Y]of J)if(Y.expiresAt<=E)J.delete(Q);while(J.size>f){let Q=J.keys().next().value;if(Q===void 0)break;J.delete(Q)}}return{get(E){let Q=J.get(E);if(!Q)return;if(Q.expiresAt<=Date.now()){J.delete(E);return}if(X)J.delete(E),J.set(E,Q);return Q.value},set(E,Q){J.delete(E),J.set(E,{value:Q,expiresAt:Date.now()+u}),w()},delete(E){J.delete(E)},clear(){J.clear()},size(){return J.size}}}function vV1($,u){return`${$}.${u}`}class UV1{cache;constructor($){this.cache=qs({ttlMs:$?.ttlMs??oO3,maxSize:$?.maxSize??sO3})}async get($,u){return this.cache.get(vV1($,u))??null}async set($,u,f){this.cache.set(vV1($,u),f)}async invalidate($,u){this.cache.delete(vV1($,u))}teardown(){this.cache.clear()}}var oO3=600000,sO3=5000;var oi$=()=>{};function bn0($,u){return`${$}:${u}`}function NV1($){let u=qs({ttlMs:$?.ttlMs??eO3,maxSize:$?.maxSize??$z3}),f=$?.getConnection,X=crypto.randomUUID(),J=new TextEncoder,w=new TextDecoder,E=null;function Q(Y,Z){let W=f?.();if(!W)return;try{W.publish(si$,J.encode(JSON.stringify({organizationId:Y,keyId:Z,originId:X})))}catch(G){console.warn("[ProviderKeyCache] Publish failed (non-critical):",G)}}return{get(Y,Z){return u.get(bn0(Y,Z))},set(Y,Z,W){u.set(bn0(Y,Z),W)},invalidate(Y,Z){u.delete(bn0(Y,Z)),Q(Y,Z)},start(){if(E)return;let Y=f?.();if(!Y)return;E=Y.subscribe(si$),(async()=>{for await(let Z of E)try{let W=JSON.parse(w.decode(Z.data));if(W.originId===X)continue;u.delete(bn0(W.organizationId,W.keyId))}catch{}})().catch(console.error)},teardown(){E?.unsubscribe(),E=null,u.clear()}}}var si$="studio.ai-provider-keys.invalidate",eO3=30000,$z3=5000;var ei$=()=>{};class OV1{options;sub=null;onCancel=null;encoder=new TextEncoder;originId=crypto.randomUUID();constructor($){this.options=$}async start($){if($)this.onCancel=$;if(this.sub)return;if(!this.onCancel)return;let u=this.options.getConnection();if(!u)return;this.sub=u.subscribe("mesh.decopilot.cancel");let f=new TextDecoder;(async()=>{for await(let X of this.sub)try{let J=JSON.parse(f.decode(X.data));if(J.originId===this.originId)continue;this.onCancel?.(J.taskId)}catch{}})().catch(console.error)}broadcast($){if(/[.*>\s]/.test($)){console.warn("[NatsCancelBroadcast] Invalid threadId, skipping broadcast");return}this.onCancel?.($);try{let u=this.options.getConnection();if(!u)return;u.publish("mesh.decopilot.cancel",this.encoder.encode(JSON.stringify({taskId:$,originId:this.originId})))}catch(u){console.warn("[NatsCancelBroadcast] Publish failed (non-critical):",u)}}async stop(){this.sub?.unsubscribe(),this.sub=null,this.onCancel=null}}function Jz3($){if(/[.*>\s]/.test($))throw Error("Invalid NATS subject token")}function KV1($){return Jz3($),`${fx$}.${$}`}function wz3($){let u=0;return{publish(f,X,J,w){f.publish(X,J,w?{headers:w}:void 0).catch((E)=>{if(u++,u===1||u%100===0)console.warn(`[Decopilot] JetStream publish failed for thread ${$} (${u} total):`,E)})},get errorCount(){return u}}}class HV1{options;js=null;jsm=null;encoder=new TextEncoder;constructor($){this.options=$}async init(){let $=this.options.getConnection();if(!$)return;let u=await $.jetstreamManager(),f={name:in0,subjects:[`${fx$}.>`],storage:TY.StorageType.Memory,max_age:uz3,max_bytes:fz3,max_msgs_per_subject:Xz3,discard:TY.DiscardPolicy.Old,retention:TY.RetentionPolicy.Limits,num_replicas:1};try{await u.streams.info(in0),await u.streams.update(in0,f)}catch(X){if(X instanceof Error&&X.message.includes("stream not found"))await u.streams.add(f);else throw X}this.js=this.options.getJetStream(),this.jsm=u}pump($,u,f){let X=this.js;if(!X)return;let J=KV1(u),w=wz3(u),E=this.encoder,Q=!1,Y=()=>{if(Q)return;Q=!0,X.publish(J,E.encode(JSON.stringify({done:!0}))).catch(()=>{})};f.addEventListener("abort",Y,{once:!0});let Z=(W)=>{let G=E.encode(JSON.stringify({p:W}));if(G.length<=IF){w.publish(X,J,G);return}if(G.length>$x$){console.warn(`[Decopilot] dropping oversized stream chunk for thread ${u}: ${(G.length/1048576).toFixed(1)} MiB exceeds ${$x$/1048576} MiB cap`);return}let F=Math.ceil(G.length/IF);for(let B=0;B<F;B++){let v=G.slice(B*IF,(B+1)*IF),N=TY.headers();N.set(ux$,String(B)),N.set(zV1,String(F)),w.publish(X,J,v,N)}};(async()=>{let W=$.getReader();try{while(!0){let{done:G,value:F}=await W.read();if(G)break;Z(F)}}catch(G){console.warn(`[Decopilot] stream pump error for thread ${u}:`,G?.message??G)}finally{W.releaseLock(),Y()}})()}async createTailStream($,u,f){let X=this.js;if(!X)return null;let J=f?.deliverPolicy==="new"?TY.DeliverPolicy.New:TY.DeliverPolicy.All,w=f?.closeOnDone??!1,E=KV1($),Q;try{Q=await X.subscribe(E,{ordered:!0,config:{filter_subject:E,ack_policy:TY.AckPolicy.None,deliver_policy:J}})}catch(v){return console.warn("[Decopilot] JetStream tail unavailable (non-critical):",v?.message??v),null}let Y=new TextDecoder,Z=null,W=(v)=>{let N=v.headers?.get(zV1);if(!N)return null;let O=Number(N),z=Number(v.headers?.get(ux$)??"0");if(z===0)Z={total:O,received:0,parts:Array(O)};else if(!Z||Z.total!==O)return null;if(!Z.parts[z])Z.received++;if(Z.parts[z]=v.data,Z.received<Z.total)return null;let H=Z.parts.reduce((j,I)=>j+(I?.length??0),0),_=new Uint8Array(H),T=0;for(let j of Z.parts)_.set(j,T),T+=j.length;return Z=null,_},G=async function*(){for await(let v of Q)yield v}(),F=!1,B=()=>{if(F)return;F=!0,Q.unsubscribe(),G.return(void 0).catch(()=>{})};return u?.addEventListener("abort",B,{once:!0}),new ReadableStream({async pull(v){while(!0){let N=await G.next();if(N.done){B(),v.close();return}let O=N.value,z=W(O);if(O.headers?.get(zV1)&&!z)continue;let H=z??O.data;try{let _=JSON.parse(Y.decode(H));if(_.done){if(w){B(),v.close();return}continue}if(_.p){v.enqueue(_.p);return}}catch{}}},cancel(){B()}})}purge($){if(!this.jsm)return;this.jsm.streams.purge(in0,{filter:KV1($)}).catch(()=>{})}teardown(){this.js=null,this.jsm=null}}var TY,in0="DECOPILOT_STREAMS",fx$="decopilot.stream",uz3=300000000000,fz3=524288000,Xz3=20000,$x$=33554432,ux$="Dp-Frag-Idx",zV1="Dp-Frag-Total";var Xx$=U(()=>{TY=Q0(ga(),1)});function wx$(){let $=new Map,u=new Map;function f(X){let J=u.get(X);if(!J)return;let w=$.get(X)??null;for(let E of J)try{E(w)}catch{}}return{async get(X){return $.get(X)??null},async put(X,J){$.set(X,J),f(X)},async delete(X){$.delete(X),f(X)},watch(X,J){let w=u.get(X);if(!w)w=new Set,u.set(X,w);w.add(J);try{J($.get(X)??null)}catch{}return()=>{let E=u.get(X);if(!E)return;if(E.delete(J),E.size===0)u.delete(X)}}}}class _V1{options;kv=null;codec=xn0.JSONCodec();constructor($){this.options=$}async init(){let $=this.options.getJetStream();if(!$)return;this.kv=await $.views.kv(Ez3,{history:1,ttl:Jx$,storage:xn0.StorageType.Memory})}async get($){if(!this.kv)return null;try{let u=await this.kv.get($);if(!u?.value)return null;if(u.operation==="DEL"||u.operation==="PURGE")return null;if(Date.now()-u.created.getTime()>Jx$)return null;return this.codec.decode(u.value)}catch{return null}}async put($,u){if(!this.kv)return;await this.kv.put($,this.codec.encode(u))}async delete($){if(!this.kv)return;try{await this.kv.delete($)}catch{}}watch($,u){if(!this.kv){try{u(null)}catch{}return()=>{}}let f=!1,X=null;return(async()=>{let J=250;while(!f){try{X=await this.kv.watch({key:$}),J=250;for await(let w of X){if(f)return;let Q=w.operation==="DEL"||w.operation==="PURGE"||!w.value?null:this.codec.decode(w.value);try{u(Q)}catch{}}if(f)return}catch{}if(f)return;await new Promise((w)=>setTimeout(w,J)),J=Math.min(J*2,5000)}})(),()=>{f=!0;try{X?.stop()}catch{}}}}var xn0,Ez3="studio_links",Jx$=60000;var Ex$=U(()=>{xn0=Q0(ga(),1)});function Yx$($,u){let f=u.helloTimeoutMs??5000,X=u.refreshIntervalMs??20000,J=new Map;$.get("/api/links/connect",async(w)=>{let E=w.req.header("authorization")??"",Q=/^Bearer\s+(.+)$/i.exec(E);if(!Q)return new Response("missing bearer",{status:401});let Y=(Q[1]??"").trim(),Z=await u.validateBearer(Y);if(!Z)return new Response("invalid bearer",{status:401});let W=w.env?.server;if(!W||typeof W.upgrade!=="function")return new Response("ws upgrade not available",{status:500});if(!W.upgrade(w.req.raw,{data:{kind:"gateway",userSub:Z,deps:u,helloTimeoutMs:f,refreshIntervalMs:X,localOwners:J}}))return new Response("ws upgrade failed",{status:400});return new Response(null,{status:101})}),$.get("/api/links/me",async(w)=>{let E=w.req.header("authorization")??"",Q=/^Bearer\s+(.+)$/i.exec(E),Y=null;if(Q)Y=await u.validateBearer((Q[1]??"").trim());else Y=w.get("meshContext")?.auth?.user?.id??null;if(!Y)return w.json({error:"unauthorized"},401);let Z=await u.registry.get(Y);if(!Z)return w.json(null);return w.json({machineId:Z.machineId,hostname:Z.hostname,cliVersion:Z.cliVersion,previewPort:Z.previewPort,connectedAt:Z.connectedAt})})}function jV1($){if(!$.data._inflight)$.data._inflight=new Map;return $.data._inflight}async function Yz3($,u){let{userSub:f,deps:X,refreshIntervalMs:J,localOwners:w}=$.data,E={podId:X.podId,machineId:u.machineId,...u.hostname?{hostname:u.hostname}:{},cliVersion:u.cliVersion,previewPort:u.previewPort,connectedAt:Date.now(),capabilities:u.capabilities},Q=w.get(f);if(Q&&Q!==$){if(Q.data.state)Q.data.state.lostOwnership=!0;try{Q.close(Qx$,"superseded")}catch{}}w.set(f,$);let Y={userSub:f,hello:u,refreshTimer:setInterval(()=>{X.registry.put(f,{...E,connectedAt:Date.now()}).catch(()=>{})},J),stopWatch:()=>{},unsubscribeDispatch:()=>{},unsubscribeCancel:()=>{},lostOwnership:!1};$.data.state=Y;try{Y.unsubscribeDispatch=X.nats.subscribe(`links.dispatch.${f}`,(W,G)=>Dz3($,W,G)),Y.unsubscribeCancel=X.nats.subscribe(`links.cancel.${f}`,(W)=>Zz3($,W));let Z=!0;Y.stopWatch=X.registry.watch(f,(W)=>{if(Z){Z=!1;return}if(!W||W.podId!==X.podId){Y.lostOwnership=!0;try{$.close(Qx$,"superseded")}catch{}}}),await X.registry.put(f,E)}catch(Z){clearInterval(Y.refreshTimer);try{Y.stopWatch()}catch{}try{Y.unsubscribeDispatch()}catch{}try{Y.unsubscribeCancel()}catch{}if(w.get(f)===$)w.delete(f);$.data.state=void 0,$.close(Qz3,`init failed: ${Z instanceof Error?Z.message:String(Z)}`)}}function Dz3($,u,f){if(!f)return;let X;try{X=rO(PV1.decode(u))}catch{return}if(X.type!=="request")return;jV1($).set(X.reqId,{reply:f}),$.send(K8(X))}function Zz3($,u){let f;try{f=rO(PV1.decode(u))}catch{return}if(f.type!=="cancel")return;if(!jV1($).has(f.reqId))return;$.send(K8(f))}function Wz3($,u,f){let X=$.data.deps.nats;if(f.type!=="chunk"){X.publish(u,Ms.encode(K8(f)));return}let J=Ms.encode(K8(f));if(J.length<=IF){X.publish(u,J);return}let w=Ms.encode(K8({type:"chunk",reqId:f.reqId,data:""})).length;for(let E of cy$(f.data,IF,w))X.publish(u,Ms.encode(K8({type:"chunk",reqId:f.reqId,data:E})))}function Gz3($,u,f,X,J="publish_failed"){try{return $.data.deps.nats.publish(u,Ms.encode(K8({type:"error",reqId:f,code:J,message:X}))),!0}catch{return!1}}async function Fz3($,u){if(u.type==="hello"){$.close(ln0,"duplicate hello");return}if(u.type==="request"||u.type==="cancel")return;let f=jV1($),X=f.get(u.reqId);if(!X)return;try{Wz3($,X.reply,u)}catch(J){if(Gz3($,X.reply,u.reqId,J instanceof Error?J.message:String(J)))f.delete(u.reqId);return}if(u.type==="end"||u.type==="error")f.delete(u.reqId)}var Qx$=4001,ln0=1008,Qz3=1011,Ms,PV1,Dx$;var Zx$=U(()=>{yN0();Ms=new TextEncoder,PV1=new TextDecoder;Dx$={open($){$.data.helloTimer=setTimeout(()=>{$.close(ln0,"hello timeout")},$.data.helloTimeoutMs)},async message($,u){let f=typeof u==="string"?u:PV1.decode(u),X;try{X=rO(f)}catch(J){$.close(ln0,`bad frame: ${J instanceof Error?J.message:String(J)}`);return}if(!$.data.state){if(X.type!=="hello"){$.close(ln0,"first frame must be hello");return}clearTimeout($.data.helloTimer),await Yz3($,X);return}await Fz3($,X)},close($,u,f){clearTimeout($.data.helloTimer);let X=$.data._inflight;if(X&&X.size>0){for(let[E,Q]of X)try{$.data.deps.nats.publish(Q.reply,Ms.encode(K8({type:"error",reqId:E,code:"ws_closed",message:"daemon WebSocket closed before response completed"})))}catch{}X.clear()}let J=$.data.state;if(!J)return;clearInterval(J.refreshTimer);try{J.stopWatch()}catch{}try{J.unsubscribeDispatch()}catch{}try{J.unsubscribeCancel()}catch{}let w=$.data.localOwners.get(J.userSub)===$;if(w)$.data.localOwners.delete(J.userSub);if(w&&!J.lostOwnership)$.data.deps.registry.delete(J.userSub).catch(()=>{})}}});function Gx$($){let u=$.requestTimeoutMs??30000;return function(X,J,w){return{async*[Symbol.asyncIterator](){if(w?.signal?.aborted)throw Error("dispatch aborted");let E=crypto.randomUUID(),Q=$.nats.createInbox(),Y=[],Z=null,W=!1,G=null,F=null,B=()=>{if(F)clearTimeout(F),F=null;let T=Z;Z=null,T?.()},v=$.nats.subscribe(Q,(T)=>{if(W)return;try{Y.push(rO(Bz3.decode(T)))}catch(j){G=j instanceof Error?j:Error(String(j)),W=!0}B()}),N=!1,O=()=>{if(N)return;N=!0,W=!0;try{v()}catch{}},z=()=>{$.nats.publish(`links.cancel.${X}`,Wx$.encode(K8({type:"cancel",reqId:E}))),G=Error("dispatch aborted"),O(),B()};w?.signal?.addEventListener("abort",z,{once:!0});try{$.nats.publish(`links.dispatch.${X}`,Wx$.encode(K8({type:"request",reqId:E,method:J.method,path:J.path,headers:J.headers,...J.body!==void 0?{body:J.body}:{}})),{reply:Q})}catch(T){throw w?.signal?.removeEventListener("abort",z),O(),T instanceof Error?T:Error(String(T))}let H=Date.now()+u,_=!1;try{while(!W){if(G)throw G;if(Y.length===0){let j=H-Date.now();if(!_&&j<=0)throw Error("dispatch timeout: no reply from daemon");if(await new Promise((I)=>{if(Z=I,!_)F=setTimeout(B,Math.max(0,j))}),G)throw G;continue}let T=Y.shift();if(_=!0,T.type==="chunk")yield{data:T.data};else if(T.type==="headers")yield{headers:{status:T.status,headers:T.headers}};else if(T.type==="end")return;else if(T.type==="error")throw Error(`${T.code}: ${T.message}`)}if(G)throw G}finally{if(w?.signal?.removeEventListener("abort",z),F)clearTimeout(F),F=null;O()}}}}}var Wx$,Bz3;var Fx$=U(()=>{yN0();Wx$=new TextEncoder,Bz3=new TextDecoder});function Bx$($,u){switch($.type){case"START":{let f={type:"RUN_STARTED",taskId:$.taskId,orgId:$.orgId,userId:$.userId,abortController:$.abortController,runConfig:$.runConfig,podId:$.podId};if(u?.status.tag==="running")return[{type:"PREVIOUS_RUN_ABORTED",taskId:$.taskId,orgId:u.orgId},f];return[f]}case"STEP_DONE":{if(u?.status.tag!=="running")return[];return[{type:"STEP_COMPLETED",taskId:$.taskId,orgId:u.orgId,stepCount:u.status.stepCount+1}]}case"FINISH":{if(u==null||u.status.tag!=="running")return[];let{stepCount:f}=u.status;if($.threadStatus==="completed")return[{type:"RUN_COMPLETED",taskId:$.taskId,orgId:u.orgId,stepCount:f}];if($.threadStatus==="requires_action")return[{type:"RUN_REQUIRES_ACTION",taskId:$.taskId,orgId:u.orgId,stepCount:f}];return[{type:"RUN_FAILED",taskId:$.taskId,orgId:u.orgId,reason:"error"}]}case"CANCEL":{if(u?.status.tag!=="running")return[];return[{type:"RUN_FAILED",taskId:$.taskId,orgId:u.orgId,reason:"cancelled"}]}case"RESUME":{if(u?.status.tag==="running")return[];return[{type:"RUN_RESUMED",taskId:$.taskId,orgId:$.orgId,userId:$.userId,abortController:$.abortController,podId:$.podId}]}case"FORCE_FAIL":{if($.reason==="ghost")return[{type:"RUN_FAILED",taskId:$.taskId,orgId:u?.orgId??$.orgId,reason:$.reason}];if(u?.status.tag!=="running")return[];return[{type:"RUN_FAILED",taskId:$.taskId,orgId:u.orgId,reason:$.reason}]}}}function vx$($,u,f=new Date){switch(u.type){case"RUN_STARTED":return{taskId:u.taskId,orgId:u.orgId,userId:u.userId,status:{tag:"running",abortController:u.abortController,stepCount:0,startedAt:f}};case"RUN_RESUMED":return{taskId:u.taskId,orgId:u.orgId,userId:u.userId,status:{tag:"running",abortController:u.abortController,stepCount:0,startedAt:f}};case"STEP_COMPLETED":if($?.status.tag!=="running")return $;return{...$,status:{...$.status,stepCount:u.stepCount}};case"RUN_COMPLETED":return;case"RUN_REQUIRES_ACTION":return;case"RUN_FAILED":return;case"PREVIOUS_RUN_ABORTED":return}}async function Ux$($,u,f,X){let{storage:J,streamBuffer:w,sseHub:E}=X,Q=await J.get($,u);await J.update($,u,{status:f,run_owner_pod:null,run_config:null,run_started_at:null}),w.purge($),E.emit(u,yv($,f,{virtualMcpId:Q?.virtual_mcp_id??void 0,createdBy:Q?.created_by,triggerId:Q?.trigger_id,title:Q?.title,branch:Q?.branch??null,createdAt:Q?.created_at,updatedAt:Q?.updated_at})),E.emit(u,d50($,f))}async function vz3($,u){let{storage:f,streamBuffer:X,sseHub:J}=u;switch($.type){case"RUN_STARTED":{if(!await f.claimRunStart($.taskId,$.orgId,{status:"in_progress",run_owner_pod:$.podId??null,run_config:$.runConfig??null,run_started_at:$.podId?new Date().toISOString():null},$.podId??null))throw new Nx$($.taskId);let E=await f.get($.taskId,$.orgId);J.emit($.orgId,yv($.taskId,"in_progress",{virtualMcpId:E?.virtual_mcp_id??void 0,createdBy:E?.created_by,triggerId:E?.trigger_id,title:E?.title,branch:E?.branch??null,createdAt:E?.created_at,updatedAt:E?.updated_at}));return}case"RUN_RESUMED":{await f.update($.taskId,$.orgId,{run_owner_pod:$.podId,run_started_at:new Date().toISOString()});let w=await f.get($.taskId,$.orgId);J.emit($.orgId,yv($.taskId,"in_progress",{virtualMcpId:w?.virtual_mcp_id??void 0,createdBy:w?.created_by,triggerId:w?.trigger_id,title:w?.title,branch:w?.branch??null,createdAt:w?.created_at,updatedAt:w?.updated_at}));return}case"STEP_COMPLETED":J.emit($.orgId,MP0($.taskId,$.stepCount));return;case"RUN_COMPLETED":await Ux$($.taskId,$.orgId,"completed",u);return;case"RUN_REQUIRES_ACTION":await Ux$($.taskId,$.orgId,"requires_action",u);return;case"RUN_FAILED":{if($.reason==="ghost"){if(!await f.forceFailIfInProgress($.taskId,$.orgId))return;await f.update($.taskId,$.orgId,{run_owner_pod:null,run_config:null,run_started_at:null})}else await f.update($.taskId,$.orgId,{status:"failed",run_owner_pod:null,run_config:null,run_started_at:null});X.purge($.taskId);let w=await f.get($.taskId,$.orgId);J.emit($.orgId,yv($.taskId,"failed",{virtualMcpId:w?.virtual_mcp_id??void 0,createdBy:w?.created_by,triggerId:w?.trigger_id,title:w?.title,branch:w?.branch??null,createdAt:w?.created_at,updatedAt:w?.updated_at})),J.emit($.orgId,d50($.taskId,"failed"));return}case"PREVIOUS_RUN_ABORTED":return}}async function Ox$($,u){for(let{event:f}of $)await vz3(f,u)}var Nx$;var zx$=U(()=>{iu();Nx$=class Nx$ extends Error{constructor($){super(`Failed to claim run for thread ${$} \u2014 already running on another pod`);this.name="RunClaimError"}}});class LV1{deps;podId;clock;states=new Map;reaperTimer=null;constructor($,u,f=()=>new Date){this.deps=$;this.podId=u;this.clock=f;this.reaperTimer=setInterval(()=>this.reapStaleRuns(),Uz3)}async execute($){let u=this.dispatch($);return await this.react(u),u}dispatch($){let u=this.states.get($.taskId),f=Bx$($,u),X=[];for(let J of f){let w=this.states.get(J.taskId);if(J.type==="PREVIOUS_RUN_ABORTED"||J.type==="RUN_FAILED"){if(w?.status.tag==="running")w.status.abortController.abort()}let E=vx$(w,J,this.clock());if(E===void 0)this.states.delete(J.taskId);else this.states.set(J.taskId,E);if(X.push({event:J,state:E}),Oz3.has(J.type))Kx$.add(1,{"org.id":J.orgId});else if(zz3.has(J.type)&&w?.status.tag==="running")Kx$.add(-1,{"org.id":J.orgId})}return X}react($){return Ox$($,this.deps)}getAbortSignal($){let u=this.states.get($);if(u?.status.tag==="running")return u.status.abortController.signal;return null}isRunning($){return this.states.get($)?.status.tag==="running"}async stopAll(){try{await this.deps.storage.orphanRunsByPod(this.podId)}catch($){console.error("[RunRegistry] Failed to orphan runs in DB:",$)}for(let[,$]of this.states)if($.status.tag==="running")$.status.abortController.abort();this.states.clear()}async recoverOrphanedRuns($){let u=await this.deps.storage.listOrphanedRuns(this.podId);if(u.length===0)return;let f=5;for(let X=0;X<u.length;X+=f){let J=u.slice(X,X+f);await Promise.allSettled(J.map(async(w)=>{if(!await this.deps.storage.claimOrphanedRun(w.id,w.organization_id,this.podId))return;try{await $(w)}catch(Q){console.error(`[RunRegistry] Failed to resume ${w.id}:`,Q),await this.deps.storage.forceFailIfInProgress(w.id,w.organization_id).catch(()=>{})}}))}}async handlePodDeath($,u,f){let X=await this.deps.storage.listOrphanedRunsByPod($);if(X.length===0)return;for(let w of X)f?.broadcast(w.id);let J=5;for(let w=0;w<X.length;w+=J){let E=X.slice(w,w+J);await Promise.allSettled(E.map(async(Q)=>{if(this.isRunning(Q.id))return;if(!await this.deps.storage.claimOrphanedRun(Q.id,Q.organization_id,this.podId))return;try{await u(Q)}catch(Z){console.error(`[RunRegistry] Failed to resume ${Q.id}:`,Z),await this.deps.storage.forceFailIfInProgress(Q.id,Q.organization_id).catch(()=>{})}}))}}dispose(){if(this.reaperTimer)clearInterval(this.reaperTimer),this.reaperTimer=null}reapStaleRuns(){let $=this.clock().getTime();for(let[u,f]of this.states)if(f.status.tag==="running"&&$-f.status.startedAt.getTime()>Nz3)console.warn(`[RunRegistry] Reaping stale run for thread ${u} ...`),this.execute({type:"FORCE_FAIL",taskId:u,reason:"reaped"}).catch((X)=>{console.error("[RunRegistry] Reaper execute failed",X)})}}var Uz3=300000,Nz3=1800000,Oz3,zz3,Kx$;var Hx$=U(()=>{zx$();ew();Oz3=new Set(["RUN_STARTED","RUN_RESUMED"]),zz3=new Set(["RUN_COMPLETED","RUN_FAILED","RUN_REQUIRES_ACTION","PREVIOUS_RUN_ABORTED"]),Kx$=IQ.createUpDownCounter("decopilot.stream.inflight",{description:"Number of in-flight decopilot stream requests",unit:"{requests}"})});class TV1{storage;options;timer=null;constructor($,u={}){this.storage=$;this.options=u}start(){if(this.timer)return;let $=this.options.intervalMs??300000;this.timer=setInterval(()=>{this.runOnce()},$)}async runOnce(){let $=this.options.staleAfterMs??3600000;try{let u=await this.storage.sweepAbandoned($);if(u>0)console.log(`[async-research-sweeper] marked ${u} stale jobs as abandoned`);return u}catch(u){return console.error("[async-research-sweeper] sweep failed",u),0}}dispose(){if(this.timer)clearInterval(this.timer),this.timer=null}}import{readdir as Kz3,rm as cn0}from"fs/promises";import{join as dn0}from"path";async function mn0($){let u=new Date;u.setUTCDate(u.getUTCDate()-Hz3),u.setUTCHours(0,0,0,0);let f=0;try{let X=await ul($);for(let J of X)if(/^\d{4}$/.test(J))f+=await _x$($,J,u);else if(!J.startsWith(".")){let w=dn0($,J),E=await ul(w);for(let Y of E){if(!/^\d{4}$/.test(Y))continue;f+=await _x$(w,Y,u)}if((await ul(w)).length===0)await cn0(w,{recursive:!0,force:!0})}}catch(X){console.warn("monitoring retention cleanup failed:",X)}return f}async function _x$($,u,f){let X=0,J=dn0($,u),w=await ul(J);for(let Q of w){if(!/^\d{2}$/.test(Q))continue;let Y=dn0(J,Q),Z=await ul(Y);for(let G of Z){if(!/^\d{2}$/.test(G))continue;let F=new Date(`${u}-${Q}-${G}T00:00:00Z`);if(isNaN(F.getTime()))continue;if(F<f){let B=dn0(Y,G);await cn0(B,{recursive:!0,force:!0}),X++}}if((await ul(Y)).length===0)await cn0(Y,{recursive:!0,force:!0})}if((await ul(J)).length===0)await cn0(J,{recursive:!0,force:!0});return X}async function ul($){try{return(await Kz3($)).filter((f)=>!f.startsWith("."))}catch{return[]}}var Hz3=30;var AV1=()=>{};import{DBOS as IV1,SchedulerMode as _z3}from"@dbos-inc/dbos-sdk";async function jz3(){let $=[V2(),Vd(),SB()],u=0;for(let f of $)try{u+=await mn0(f)}catch(X){console.error("[monitoring-retention] cleanup failed:",X)}return console.log(`[monitoring-retention] deleted ${u} day-dir(s) across ${$.length} signal dir(s)`),{deleted:u,dirs:$.length}}async function Lz3($,u){await IV1.runStep(()=>jz3(),{name:"monitoringRetention"})}function jx$(){if(Px$)return;Px$=!0;let $=IV1.registerWorkflow(Lz3,{name:"monitoringRetentionWorkflow"});IV1.registerScheduled($,{name:"monitoringRetentionWorkflow",crontab:Pz3,mode:_z3.ExactlyOncePerIntervalWhenActive})}var Pz3="23 4 * * *",Px$=!1;var Lx$=U(()=>{LQ();AV1()});function bw0($){return{...$,title:$.title??$.id}}function Ix$($){let u=$.credentialId;return{credentialId:u,thinking:bw0($.thinking),...$.coding&&{coding:bw0($.coding)},...$.fast&&{fast:bw0($.fast)},...$.image&&{image:{...bw0($.image),credentialId:$.image.credentialId??u}},...$.deepResearch&&{deepResearch:{...bw0($.deepResearch),credentialId:$.deepResearch.credentialId??u}}}}var nn0,Tx$,Tz3,Ax$;var Sx$=U(()=>{c0();nn0=D.object({id:D.string(),title:D.string().optional(),capabilities:D.object({vision:D.boolean().optional(),text:D.boolean().optional(),tools:D.boolean().optional(),reasoning:D.boolean().optional(),file:D.boolean().optional()}).passthrough().optional(),limits:D.object({contextWindow:D.number().optional(),maxOutputTokens:D.number().optional()}).passthrough().optional(),provider:D.string().nullish()}),Tx$=nn0.extend({credentialId:D.string().optional()}),Tz3=D.object({models:D.object({credentialId:D.string(),thinking:nn0,coding:nn0.optional(),fast:nn0.optional(),image:Tx$.optional(),deepResearch:Tx$.optional()}),agent:D.object({id:D.string()}),temperature:D.number(),toolApprovalLevel:D.enum(["auto","readonly","plan"]).optional(),mode:D.enum(["default","plan","web-search","gen-image"]).optional(),windowSize:D.number().optional(),triggerId:D.string().optional()}),Ax$=Tz3.transform(($)=>{let u=$.mode??"default",f="auto";if($.toolApprovalLevel==="plan")u="plan",f="readonly";else if($.toolApprovalLevel==="readonly")f="readonly";else if($.toolApprovalLevel==="auto")f="auto";return{models:$.models,agent:$.agent,temperature:$.temperature,toolApprovalLevel:f,mode:u,windowSize:$.windowSize,triggerId:$.triggerId}})});class SV1{deps;kv=null;podId=null;refreshTimer=null;watchAbortController=null;initPromise=null;pendingDeathCallback=null;constructor($){this.deps=$}async init(){if(this.watchAbortController)this.watchAbortController.abort(),this.watchAbortController=null;if(this.refreshTimer)clearInterval(this.refreshTimer),this.refreshTimer=null;this.kv=null,this.initPromise=null;let $=this.deps.getJetStream();if(!$)return;return this.initPromise=$.views.kv(Az3,{ttl:Iz3,storage:kx$.StorageType.Memory}).then((u)=>{this.kv=u}).catch((u)=>{throw this.initPromise=null,u}),this.initPromise}start($){if(!this.kv)return;if(this.refreshTimer)return;if(this.podId=$,this.kv.put($,new TextEncoder().encode(new Date().toISOString())),this.refreshTimer=setInterval(()=>{this.kv?.put($,new TextEncoder().encode(new Date().toISOString())).catch((u)=>{console.error("[PodHeartbeat] Refresh failed:",u)})},Sz3),this.pendingDeathCallback)this.startDeathWatcher(this.pendingDeathCallback),this.pendingDeathCallback=null}onPodDeath($){if(!this.kv){this.pendingDeathCallback=$;return}this.startDeathWatcher($)}startDeathWatcher($){if(!this.kv)return;this.watchAbortController=new AbortController;let u=this.kv,f=this.podId,X=this.watchAbortController.signal;(async()=>{while(!X.aborted)try{let w=await u.watch({initializedFn:()=>{}});for await(let E of w){if(X.aborted)break;if(E.operation==="DEL"||E.operation==="PURGE"){let Q=E.key;if(Q!==f)$(Q)}}}catch(w){if(X.aborted)break;console.error("[PodHeartbeat] Watcher error, reconnecting in 1s:",w),await new Promise((E)=>setTimeout(E,1000))}})().catch((w)=>{if(!X.aborted)console.error("[PodHeartbeat] Watcher loop failed:",w)})}async stop(){if(this.refreshTimer)clearInterval(this.refreshTimer),this.refreshTimer=null;if(this.kv&&this.podId)try{await this.kv.delete(this.podId)}catch{}if(this.watchAbortController)this.watchAbortController.abort(),this.watchAbortController=null;this.kv=null,this.podId=null,this.initPromise=null,this.pendingDeathCallback=null}}var kx$,Az3="POD_HEARTBEATS",Iz3=45000,Sz3=1e4;var Rx$=U(()=>{kx$=Q0(ga(),1)});function Cx$($){return async(u,f)=>{let X=await $.db.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["member.role","organization.id as orgId","organization.slug as orgSlug","organization.name as orgName"]).where("member.userId","=",f).where("member.organizationId","=",u).executeTakeFirst();if(!X)return console.warn(`[automationContextFactory] User ${f} not found in org ${u} \u2014 returning null`),null;let J=await aZ.create();J.auth.user={id:f,role:X.role},J.organization={id:X.orgId,slug:X.orgSlug,name:X.orgName};let w=await bI1($.db,u,X.role);J.boundAuth=VI1({auth:J.authInstance,headers:new Headers,role:X.role,permissions:w,userId:f}),J.access=new jA(J.authInstance,f,void 0,J.boundAuth,X.role,"self"),J.storage.threads=new L70($.threadStorage,X.orgId),J.storage.asyncResearchJobs=new A70($.asyncResearchJobStorage,X.orgId);let E=eY();return J.objectStorage=E?xW(E,X.orgId):new RU(X.orgId,J.baseUrl),Km(J.storage,{objectStorage:J.objectStorage,baseUrl:J.baseUrl,orgSlug:X.orgSlug}),J}}var qx$=U(()=>{P70();M90();SI0();RI0();Ej();q90();a40()});import{EventEmitter as kz3}from"events";var kV1;var Mx$=U(()=>{BT();kV1=new kz3;kV1.on("request",($)=>{fU($)})});function hx$(){return async($,u)=>{let f=Date.now(),X=$.req.method,J=$.req.path;if(J==="/api/auth/get-session"||J.includes("favicon")){await u();return}let w="",E=!1;if(J.startsWith("/mcp")&&X==="POST"){E=!0;try{if($.req.header("Content-Type")?.includes("application/json")){let F=await $.req.raw.clone().json();if(F.method==="tools/call"&&F.params?.name){let B=EN(F.params.name),v=F.params.arguments||{};if(B==="EVENT_PUBLISH"&&v.type){let N=EN(String(v.type));w=`${G6.tool}EVENT_PUBLISH${G6.reset} ${G6.bold}\u2192 ${N}${G6.reset}`}else if(B==="EVENT_SUBSCRIBE"&&v.eventType){let N=EN(String(v.eventType));w=`${G6.tool}EVENT_SUBSCRIBE${G6.reset} ${G6.bold}\u2190 ${N}${G6.reset}`}else if(B==="EVENT_UNSUBSCRIBE"&&v.eventType){let N=EN(String(v.eventType));w=`${G6.tool}EVENT_UNSUBSCRIBE${G6.reset} ${G6.dim}\u2715 ${N}${G6.reset}`}else{let N=Object.keys(v).map((z)=>EN(z)),O=N.length>0?N.slice(0,3).join(",")+(N.length>3?"\u2026":""):"";w=`${G6.tool}${B}${G6.dim}(${O})${G6.reset}`}}else if(F.method)w=`${G6.dim}${EN(F.method)}${G6.reset}`}}catch{}}let Q=EN(J);if(J.startsWith("/mcp/conn_")){let W=J.split("/")[2]??"";Q=`/mcp/${G6.mcp}${EN(W.slice(0,12))}\u2026${G6.reset}`}else if(J==="/mcp")Q=`${G6.mcp}/mcp${G6.reset}`;else if(J==="/mcp/registry")Q=`${G6.mcp}/mcp/registry${G6.reset}`;let Y=Cz3(X),Z=E?"\u25C0":"\u2190";if(!ij0())console.log(`${G6.dim}${Z}${G6.reset} ${Y}${X}${G6.reset} ${Q}${w?` ${w}`:""}`);try{await u()}finally{let W=Date.now()-f,G=$.res.status,F=Rz3(G),B=W<1000?`${W}ms`:`${(W/1000).toFixed(1)}s`,v=E?"\u25B6":"\u2192";if(!ij0())console.log(`${G6.dim}${v}${G6.reset} ${Y}${X}${G6.reset} ${Q}${w?` ${w}`:""} ${F}${G}${G6.reset} ${G6.duration}${B}${G6.reset}`);kV1.emit("request",{method:X,path:EN(J),status:G,duration:W,timestamp:new Date})}}}var G6,Rz3=($)=>{if($>=500)return G6.serverError;if($>=400)return G6.clientError;if($>=300)return G6.redirect;return G6.ok},Cz3=($)=>{return G6[$]||G6.reset},EN=($)=>{return $.replace(/\r/g,"").replace(/\n/g,"").replace(/\x1b\[[0-9;]*m/g,"").replace(/[\x00-\x1f\x7f-\x9f]/g,"")};var yx$=U(()=>{BT();Mx$();G6={reset:"\x1B[0m",dim:"\x1B[2m",bold:"\x1B[1m",GET:"\x1B[36m",POST:"\x1B[33m",PUT:"\x1B[35m",DELETE:"\x1B[31m",ok:"\x1B[32m",redirect:"\x1B[36m",clientError:"\x1B[33m",serverError:"\x1B[31m",mcp:"\x1B[35m",tool:"\x1B[96m",duration:"\x1B[90m"}});import{createHmac as ix$}from"crypto";import{mkdir as qz3,readdir as Mz3,rm as gx$,stat as xx$}from"fs/promises";import{join as CV1,relative as hz3}from"path";function cx$($){let u=$.replace(/[^a-zA-Z0-9_-]/g,"_");return CV1(yz3,u)}function dx$($){return $.replace(/^\/+/,"").replace(/\.\./g,"")}function RV1($,u){let f=cx$($),X=dx$(u);return CV1(f,X)}function gz3($,u,f,X){let J=g4().encryptionKey||"dev-secret",w=`${$}:${u}:${f}:${X}`;return ix$("sha256",J).update(w).digest("hex")}function bx$($,u,f,X,J){let w=Math.floor(Date.now()/1000)+X,E=gz3(u,f,w,J),Q=new URL(`/api/dev-assets/${u}/${dx$(f)}`,$);return Q.searchParams.set("expires",w.toString()),Q.searchParams.set("signature",E),Q.searchParams.set("method",J),Q.toString()}function mx$($,u,f){let X=`${$}:${u.getTime()}:${f}`;return`"${ix$("md5","etag").update(X).digest("hex")}"`}async function nx$($,u,f,X,J){try{let w=await Mz3($,{withFileTypes:!0});for(let E of w){let Q=CV1($,E.name),Z=hz3(u,Q).replace(/\\/g,"/");if(f&&!Z.startsWith(f))continue;if(E.isDirectory())if(X){let W=Z+"/";if(!f||W.startsWith(f)){if(!(f?Z.slice(f.length):Z).includes("/"))J.commonPrefixes.add(W)}}else await nx$(Q,u,f,X,J);else if(E.isFile()){if(X&&f){let W=Z.slice(f.length);if(W.includes(X)){let G=W.indexOf(X),F=f+W.slice(0,G+1);J.commonPrefixes.add(F);continue}}try{let W=await xx$(Q);J.objects.push({key:Z,size:W.size,lastModified:W.mtime.toISOString(),etag:mx$(Q,W.mtime,W.size)})}catch{}}}}catch{}}function tx$($,u){let X=r0($).id;return[{name:"LIST_OBJECTS",description:"List objects in the local assets directory with pagination support",inputSchema:D.object({prefix:D.string().optional(),maxKeys:D.number().optional().default(1000),continuationToken:D.string().optional(),delimiter:D.string().optional()}),outputSchema:D.object({objects:D.array(D.object({key:D.string(),size:D.number(),lastModified:D.string(),etag:D.string()})),nextContinuationToken:D.string().optional(),isTruncated:D.boolean(),commonPrefixes:D.array(D.string()).optional()}),handler:async(J)=>{let w=J,E=w.prefix||"",Q=w.maxKeys??1000,Y=w.delimiter,Z=w.continuationToken,W=cx$(X);await qz3(W,{recursive:!0});let G={objects:[],commonPrefixes:new Set};await nx$(W,W,E,Y,G),G.objects.sort((O,z)=>O.key.localeCompare(z.key));let F=0;if(Z){if(F=G.objects.findIndex((O)=>O.key>Z),F===-1)F=G.objects.length}let B=G.objects.slice(F,F+Q),v=F+Q<G.objects.length,N=v?B[B.length-1]?.key:void 0;return{objects:B,isTruncated:v,nextContinuationToken:N,commonPrefixes:Array.from(G.commonPrefixes).sort()}}},{name:"GET_OBJECT_METADATA",description:"Get metadata for a file in the local assets directory",inputSchema:D.object({key:D.string()}),outputSchema:D.object({contentType:D.string().optional(),contentLength:D.number(),lastModified:D.string(),etag:D.string(),metadata:D.record(D.string(),D.string()).optional()}),handler:async(J)=>{let w=J,E=RV1(X,w.key),Q=await xx$(E);return{contentType:xy1(w.key),contentLength:Q.size,lastModified:Q.mtime.toISOString(),etag:mx$(E,Q.mtime,Q.size)}}},{name:"GET_PRESIGNED_URL",description:"Generate a presigned URL for downloading a file from local storage",inputSchema:D.object({key:D.string(),expiresIn:D.number().optional()}),outputSchema:D.object({url:D.string(),expiresIn:D.number()}),handler:async(J)=>{let w=J,E=w.expiresIn??Vx$;return{url:bx$(u,X,w.key,E,"GET"),expiresIn:E}}},{name:"PUT_PRESIGNED_URL",description:"Generate a presigned URL for uploading a file to local storage",inputSchema:D.object({key:D.string(),expiresIn:D.number().optional(),contentType:D.string().optional()}),outputSchema:D.object({url:D.string(),expiresIn:D.number()}),handler:async(J)=>{let w=J,E=w.expiresIn??Vx$;return{url:bx$(u,X,w.key,E,"PUT"),expiresIn:E}}},{name:"DELETE_OBJECT",description:"Delete a single file from local storage",inputSchema:D.object({key:D.string()}),outputSchema:D.object({success:D.boolean(),key:D.string()}),handler:async(J)=>{let w=J,E=RV1(X,w.key);try{return await gx$(E),{success:!0,key:w.key}}catch{return{success:!1,key:w.key}}}},{name:"DELETE_OBJECTS",description:"Delete multiple files from local storage",inputSchema:D.object({keys:D.array(D.string()).max(1000)}),outputSchema:D.object({deleted:D.array(D.string()),errors:D.array(D.object({key:D.string(),message:D.string()}))}),handler:async(J)=>{let w=J,E=[],Q=[];return await Promise.all(w.keys.map(async(Y)=>{let Z=RV1(X,Y);try{await gx$(Z),E.push(Y)}catch(W){Q.push({key:Y,message:W instanceof Error?W.message:"Unknown error"})}})),{deleted:E,errors:Q}}}]}async function qV1($,u,f){let X=tx$(u,f),J=new gv({name:"dev-assets-mcp",version:"1.0.0"},{capabilities:{tools:{}}});for(let E of X){let Q="shape"in E.inputSchema?E.inputSchema.shape:D.object({}).shape,Y=E.outputSchema&&"shape"in E.outputSchema?E.outputSchema.shape:D.object({}).shape;J.registerTool(E.name,{description:E.description??"",inputSchema:Q,outputSchema:Y,annotations:E.annotations,_meta:E._meta},async(Z)=>{try{let W=await E.handler(Z);return{content:[{type:"text",text:JSON.stringify(W)}],structuredContent:W}}catch(W){return{content:[{type:"text",text:`Error: ${W.message}`}],isError:!0}}})}let w=new pD({enableJsonResponse:$.headers.get("Accept")?.includes("application/json")??!1});return await J.connect(w),w.handleRequest($)}async function rx$($,u,f,X){let w=tx$(f,X).find((E)=>E.name===$);if(!w)return{content:[{type:"text",text:`Tool not found: ${$}`}],isError:!0};try{let E=await w.handler(u);return{content:[{type:"text",text:JSON.stringify(E)}]}}catch(E){return{content:[{type:"text",text:E instanceof Error?E.message:String(E)}],isError:!0}}}var yz3="./data/assets",Vx$=3600,lx$,ax$;var px$=U(()=>{$5();uf();c0();n50();To();Jn0();lx$=new d4;lx$.all("/",async($)=>{let u=$.get("meshContext"),f=new URL($.req.url),X=`${f.protocol}//${f.host}`;return qV1($.req.raw,u,X)});ax$=lx$});var ox$={};Y1(ox$,{mountDevRoutes:()=>Vz3});function Vz3($,u){$.all("/mcp/:connectionId{.*_dev-assets$}",u,async(X)=>{let J=X.get("meshContext"),w=new URL(X.req.url),E=`${w.protocol}//${w.host}`;return qV1(X.req.raw,J,E)}),$.all("/mcp/:connectionId{.*_dev-assets$}/call-tool/:toolName",u,async(X)=>{let J=X.get("meshContext"),w=new URL(X.req.url),E=`${w.protocol}//${w.host}`,Q=X.req.param("toolName");if(!Q)return X.json({error:"Missing tool name"},400);let Y=await X.req.json(),Z=await rx$(Q,Y,J,E);if(Z.isError)return X.json(Z.content,500);return X.json(Z.content)}),$.use("/mcp/dev-assets",u),$.route("/mcp/dev-assets",ax$);let f=new d4;f.use("*",jY({mountPath:"/api/dev-assets"})),f.route("/",Xn0({orgFromPath:!1})),$.route("/api/dev-assets",f)}var sx$=U(()=>{uf();My1();Jn0();px$()});var ex$=U(()=>{zO1();KO1();xv()});var tn0=U(()=>{ex$()});var ul$={};Y1(ul$,{streamAgent:()=>$l$,createDecopilotClient:()=>iz3});async function bz3($){let{parseJsonEventStream:u,uiMessageChunkSchema:f}=await Promise.resolve().then(() => (a3(),YC1));return u({stream:$,schema:f}).pipeThrough(new TransformStream({transform(X,J){if(!X.success)throw X.error;J.enqueue(X.value)}}))}async function $l$($,u,f,X,J){let{readUIMessageStream:w}=await Promise.resolve().then(() => (a3(),YC1)),E=f.value??f.id;if(!E)throw Error("Agent binding has no id or value \u2014 cannot resolve agent");let Q=X.credentialId??f.credentialId,Y=X.thinking??f.thinking,Z=Y?.id,W={messages:X.messages,...Z?{models:{credentialId:Q,thinking:Y,...X.coding??f.coding?{coding:X.coding??f.coding}:{},...X.fast??f.fast?{fast:X.fast??f.fast}:{}}}:{},agent:{id:E},temperature:X.temperature??f.temperature,toolApprovalLevel:X.toolApprovalLevel??f.toolApprovalLevel,mode:X.mode??f.mode??"default",...X.memory?{memory:X.memory}:{},...X.thread_id?{thread_id:X.thread_id}:{}},G=await fetch($,{method:"POST",headers:{"Content-Type":"application/json","x-mesh-token":u,Authorization:`Bearer ${u}`},body:JSON.stringify(W),signal:J?.signal});if(!G.ok){let B=await G.text().catch(()=>""),v=`HTTP ${G.status}`;try{let N=JSON.parse(B);if(N?.error)v=N.error}catch{if(B)v=B}throw Error(v)}if(!G.body)throw Error("Empty response body from decopilot stream");let F=await bz3(G.body);return w({stream:F})}function iz3($){let{baseUrl:u,orgSlug:f,token:X}=$,J=`${u}/${f}/decopilot/runtime/stream`;return{stream(w,E){let Q={__type:"@deco/agent",id:w.agent.id,credentialId:w.credentialId??"",thinking:w.thinking??{id:"",title:""},coding:w.coding,fast:w.fast,toolApprovalLevel:w.toolApprovalLevel,mode:w.mode,temperature:w.temperature};return $l$(J,X,Q,w,E)}}}function fl$($){let u=$.properties;if(!u)return $;for(let f of Object.values(u)){let X=f.properties;if(!X?.__type?.const)continue;let J=X.__type.const,w=xz3.get(J);if(!w)continue;let E=w.map((Q)=>({name:String(Q.name),...Q.inputSchema&&{inputSchema:D.toJSONSchema(Q.inputSchema)},...Q.outputSchema&&{outputSchema:D.toJSONSchema(Q.outputSchema)}}));X.__binding={const:E}}return $}var xz3,LkX,lz3=($)=>{return typeof $==="object"&&$!==null&&$.__type==="@deco/agent"},hV1=($)=>{return typeof $==="object"&&$!==null&&typeof $.__type==="string"&&$.__type!=="@deco/agent"&&typeof $.value==="string"},rn0=($,u,f)=>{let X=f?{"x-caller-app":f}:void 0;if(u.cookie)X??={},X.cookie=u.cookie;if(u.token)X??={},X["x-mesh-token"]=u.token;return{type:"HTTP",url:new URL(`/mcp/${$}`,u.meshUrl).href,token:u.token,headers:X}},cz3=($,u,f)=>{let X=rn0($,u,f);return new Proxy(Mr.forConnection(X),{get(J,w){if(w==="value")return $;if(w==="__type")return f;return J[w]}})},dz3=($,u)=>{let f=u.organizationSlug;if(!f)throw Error("organizationSlug is required for agent bindings");let X=`${u.meshUrl}/api/${f}/decopilot/runtime/stream`;return{STREAM:async(J,w)=>{let{streamAgent:E}=await Promise.resolve().then(() => ul$);return E(X,u.token,$,J,w)}}},MV1=($,u)=>{if($===null||$===void 0)return $;if(Array.isArray($))return $.map((f)=>MV1(f,u));if(typeof $==="object"){if(lz3($))return dz3($,u);if(hV1($))return cz3($.value,u,$.__type);let f={};for(let[X,J]of Object.entries($))f[X]=MV1(J,u);return f}return $},Xl$=($)=>{return MV1($.state,$)};var hs=U(()=>{tn0();c0();xz3=new Map;LkX=D.object({id:D.string(),title:D.string(),capabilities:D.object({vision:D.boolean().optional(),text:D.boolean().optional(),tools:D.boolean().optional(),reasoning:D.boolean().optional()}).passthrough().optional(),provider:D.string().optional().nullable(),limits:D.object({contextWindow:D.number().optional(),maxOutputTokens:D.number().optional()}).passthrough().optional()})});var mz3,Jl$=($,u,f)=>{if(!u)return null;if($===void 0||$==="*")return"*";if(typeof $==="string")return $===u?$:null;if(Array.isArray($))return $.includes(u)?u:null;if(typeof $==="function")return $(u,f)??null;return null},nz3=($,u,f)=>{let X=u.headers.get("Origin"),J=Jl$(f.origin,X,u);if(J)$.set("Access-Control-Allow-Origin",J);if(f.credentials)$.set("Access-Control-Allow-Credentials","true");if(f.exposeHeaders?.length)$.set("Access-Control-Expose-Headers",f.exposeHeaders.join(", "))},wl$=($,u)=>{let f=new Headers,X=$.headers.get("Origin"),J=Jl$(u.origin,X,$);if(J)f.set("Access-Control-Allow-Origin",J);if(u.credentials)f.set("Access-Control-Allow-Credentials","true");let w=u.allowMethods??mz3;f.set("Access-Control-Allow-Methods",w.join(", "));let E=$.headers.get("Access-Control-Request-Headers");if(u.allowHeaders?.length)f.set("Access-Control-Allow-Headers",u.allowHeaders.join(", "));else if(E)f.set("Access-Control-Allow-Headers",E);if(u.maxAge!==void 0)f.set("Access-Control-Max-Age",u.maxAge.toString());return new Response(null,{status:204,headers:f})},El$=($,u,f)=>{let X=new Headers($.headers);return nz3(X,u,f),new Response($.body,{status:$.status,statusText:$.statusText,headers:X})};var Ql$=U(()=>{mz3=["GET","HEAD","PUT","POST","DELETE","PATCH"]});function Yl$($=32){let f=new Uint8Array($);return crypto.getRandomValues(f),Array.from(f,(X)=>"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789"[X%62]).join("")}function tz3($){try{let u=new URL($);return u.protocol==="https:"||u.hostname==="localhost"||u.hostname.endsWith(".localhost")||u.hostname==="127.0.0.1"||!u.protocol.startsWith("http")}catch{return!1}}function Dl$($){return btoa(JSON.stringify($)).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}function Zl$($){try{let u=$.replace(/-/g,"+").replace(/_/g,"/");return JSON.parse(atob(u))}catch{return null}}function Wl$($){return{handleProtectedResourceMetadata:(Z)=>{let W=MF(new URL(Z.url)),G=`${W.origin}/mcp`;return Response.json({resource:G,authorization_servers:[W.origin],scopes_supported:["*"],bearer_methods_supported:["header"],resource_signing_alg_values_supported:["RS256","none"]})},handleAuthorizationServerMetadata:(Z)=>{let G=MF(new URL(Z.url)).origin;return Response.json({issuer:G,authorization_endpoint:`${G}/authorize`,token_endpoint:`${G}/token`,registration_endpoint:`${G}/register`,scopes_supported:["*"],response_types_supported:["code"],response_modes_supported:["query"],grant_types_supported:["authorization_code","refresh_token"],token_endpoint_auth_methods_supported:["none","client_secret_post"],code_challenge_methods_supported:["S256","plain"]})},handleAuthorize:(Z)=>{let W=MF(new URL(Z.url)),G=W.searchParams.get("redirect_uri"),F=W.searchParams.get("response_type"),B=W.searchParams.get("state"),v=W.searchParams.get("code_challenge"),N=W.searchParams.get("code_challenge_method");if(!G)return Response.json({error:"invalid_request",error_description:"redirect_uri required"},{status:400});if(F!=="code")return Response.json({error:"unsupported_response_type",error_description:"Only 'code' is supported"},{status:400});let O=MF(new URL(`${W.origin}/oauth/callback`)),z=O.toString(),_=Dl$({redirectUri:G,clientState:B??void 0,codeChallenge:v??void 0,codeChallengeMethod:N??void 0,oauthCallbackUri:z});O.searchParams.set("state",_);let T=$.authorizationUrl(O.toString());return Response.redirect(T,302)},handleOAuthCallback:async(Z)=>{let W=MF(new URL(Z.url)),G=W.searchParams.get("code"),F=W.searchParams.get("state"),B=W.searchParams.get("error"),v=F?Zl$(F):null;if(B){let N=W.searchParams.get("error_description")??"Authorization failed";if(v?.redirectUri){let O=MF(new URL(v.redirectUri));if(O.searchParams.set("error",B),O.searchParams.set("error_description",N),v.clientState)O.searchParams.set("state",v.clientState);return Response.redirect(O.toString(),302)}return Response.json({error:B,error_description:N},{status:400})}if(!G||!v)return Response.json({error:"invalid_request",error_description:"Missing code or state"},{status:400});try{let N=v.oauthCallbackUri??MF(new URL(`${W.origin}/oauth/callback`)).toString(),O={code:G,redirect_uri:N},z=await $.exchangeCode(O),H={accessToken:z.access_token,tokenType:z.token_type,refreshToken:z.refresh_token,expiresIn:z.expires_in,scope:z.scope,codeChallenge:v.codeChallenge,codeChallengeMethod:v.codeChallengeMethod},_=Dl$(H),T=MF(new URL(v.redirectUri));if(T.searchParams.set("code",_),v.clientState)T.searchParams.set("state",v.clientState);return Response.redirect(T.toString(),302)}catch(N){console.error("OAuth callback error:",N);let O=MF(new URL(v.redirectUri));if(O.searchParams.set("error","server_error"),O.searchParams.set("error_description","Failed to exchange authorization code"),v.clientState)O.searchParams.set("state",v.clientState);return Response.redirect(O.toString(),302)}},handleToken:async(Z)=>{try{let W=Z.headers.get("content-type")??"",G;if(W.includes("application/x-www-form-urlencoded")){let H=await Z.formData();G=Object.fromEntries(H.entries())}else{let H=await Z.json();if(typeof H!=="object"||H===null||Array.isArray(H))return Response.json({error:"invalid_request",error_description:"Request body must be a JSON object"},{status:400});G=H}let{code:F,code_verifier:B,grant_type:v,refresh_token:N}=G;if(v==="refresh_token"){if(typeof N!=="string"||!N)return Response.json({error:"invalid_request",error_description:"refresh_token is required and must be a string"},{status:400});if(!$.refreshToken)return Response.json({error:"unsupported_grant_type",error_description:"refresh_token grant not supported"},{status:400});let H;try{H=await $.refreshToken(N)}catch(T){if(T instanceof yV1)return Response.json({error:T.error,...T.errorDescription?{error_description:T.errorDescription}:{}},{status:400});throw T}let _={access_token:H.access_token,token_type:H.token_type};if(H.refresh_token)_.refresh_token=H.refresh_token;if(H.expires_in!==void 0)_.expires_in=H.expires_in;if(H.scope)_.scope=H.scope;return Response.json(_,{headers:{"Cache-Control":"no-store",Pragma:"no-cache"}})}if(v!=="authorization_code")return Response.json({error:"unsupported_grant_type",error_description:"Only authorization_code and refresh_token supported"},{status:400});if(typeof F!=="string"||!F)return Response.json({error:"invalid_request",error_description:"code is required and must be a string"},{status:400});let O=Zl$(F);if(!O||!O.accessToken)return Response.json({error:"invalid_grant",error_description:"Invalid or expired code"},{status:400});if(O.codeChallenge){if(typeof B!=="string"||!B)return Response.json({error:"invalid_grant",error_description:"code_verifier required and must be a string"},{status:400});let H;if(O.codeChallengeMethod==="S256"){let T=new TextEncoder().encode(B),j=await crypto.subtle.digest("SHA-256",T);H=btoa(String.fromCharCode(...new Uint8Array(j))).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}else H=B;if(H!==O.codeChallenge)return Response.json({error:"invalid_grant",error_description:"Invalid code_verifier"},{status:400})}let z={access_token:O.accessToken,token_type:O.tokenType};if(O.refreshToken)z.refresh_token=O.refreshToken;if(O.expiresIn!==void 0)z.expires_in=O.expiresIn;if(O.scope)z.scope=O.scope;return Response.json(z,{headers:{"Cache-Control":"no-store",Pragma:"no-cache"}})}catch(W){return console.error("Token exchange error:",W),Response.json({error:"server_error",error_description:"Failed to process token request"},{status:500})}},handleClientRegistration:async(Z)=>{try{let W=await Z.json();if(!W.redirect_uris||W.redirect_uris.length===0)return Response.json({error:"invalid_redirect_uri",error_description:"At least one redirect_uri is required"},{status:400});for(let N of W.redirect_uris)if(!tz3(N))return Response.json({error:"invalid_redirect_uri",error_description:`Invalid redirect URI: ${N}`},{status:400});let G=Yl$(32),F=W.token_endpoint_auth_method!=="none"?Yl$(32):void 0,B=Math.floor(Date.now()/1000),v={client_id:G,client_secret:F,client_name:W.client_name,redirect_uris:W.redirect_uris,grant_types:W.grant_types??["authorization_code"],response_types:W.response_types??["code"],token_endpoint_auth_method:W.token_endpoint_auth_method??"client_secret_post",scope:W.scope,client_id_issued_at:B,client_secret_expires_at:0};if($.persistence)await $.persistence.saveClient(v);return new Response(JSON.stringify(v),{status:201,headers:{"Content-Type":"application/json","Cache-Control":"no-store",Pragma:"no-cache"}})}catch(W){return console.error("Client registration error:",W),Response.json({error:"invalid_client_metadata",error_description:"Invalid client registration request"},{status:400})}},createUnauthorizedResponse:(Z)=>{let F=`Bearer resource_metadata="${`${MF(new URL(Z.url)).origin}/.well-known/oauth-protected-resource`}", scope="*"`;return Response.json({jsonrpc:"2.0",error:{code:-32000,message:"Unauthorized: Authentication required"},id:null},{status:401,headers:{"WWW-Authenticate":F,"Access-Control-Expose-Headers":"WWW-Authenticate"}})},hasAuth:(Z)=>Z.headers.has("Authorization")}}var yV1,MF=($)=>{if(!($.hostname==="localhost"||$.hostname.endsWith(".localhost")||$.hostname==="127.0.0.1"))$.protocol="https:";return $};var gV1=U(()=>{yV1=class yV1 extends Error{error;errorDescription;constructor($="invalid_grant",u){super(u??$);this.name="OAuthInvalidGrantError",this.error=$,this.errorDescription=u}}});import{AsyncLocalStorage as rz3}from"async_hooks";var Gl$,iw0;var VV1=U(()=>{Gl$=new rz3,iw0={getStore:()=>{return Gl$.getStore()},run:($,u,...f)=>Gl$.run($,u,...f)}});var Bl$="SELF",pn0=($)=>{return typeof $==="object"&&$!==null&&"handler"in $&&"events"in $&&typeof $.handler==="function"&&Array.isArray($.events)},vl$=($)=>{return typeof $==="object"&&$!==null&&"handler"in $&&"events"in $&&typeof $.handler==="function"&&Array.isArray($.events)},Fl$="::",Ul$=($)=>{let u=$.indexOf(Fl$);if(u===-1)return null;let f=$.substring(0,u),X=$.substring(u+Fl$.length);return[f,X]},az3=($)=>{if(!$.startsWith("cron/"))return null;let u=$.substring(5),f=u.indexOf("/");if(f===-1)return null;let X=u.substring(0,f),J=u.substring(f+1);return[X,J]},Nl$=($)=>{if(pn0($))return[];return Object.keys($)},pz3=($,u)=>{if(pn0($))return $.events;let f=$[u];if(!f)return[];if(vl$(f))return f.events;return Object.keys(f)},an0=($,u,f)=>{if($===Bl$){if(!f)return console.warn("[Event] SELF binding used but no connectionId available"),null;return f}let X=u[$];if(!hV1(X))return console.warn(`[Event] Binding "${$}" not found in state`),null;return X.value},oz3=($,u,f)=>{let X=u;if(pn0($)){let w=[];for(let E of $.events){let Q=Ul$(E);if(!Q){console.warn(`[Event] Global handler event "${E}" must be prefixed with BINDING:: (e.g., "SELF::${E}" or "DATABASE::${E}")`);continue}let[Y,Z]=Q,W=an0(Y,X,f);if(!W)continue;w.push({eventType:Z,publisher:W})}return w}let J=[];for(let w of Nl$($)){let E=an0(w,X,f);if(!E)continue;let Q=pz3($,w);for(let Y of Q)J.push({eventType:Y,publisher:E})}return J},sz3=($)=>{let u=new Map;for(let f of $){let X=f.source,J=u.get(X)||[];J.push(f),u.set(X,J)}return u},ez3=($)=>{let u=new Map;for(let f of $){let X=f.type,J=u.get(X)||[];J.push(f),u.set(X,J)}return u},$K3=($)=>{let u={},f={},X=!1,J=0,w=[];for(let E of $){if(E.results)Object.assign(f,E.results);if(E.success===!1){if(X=!0,E.error)w.push(E.error)}if(E.processedCount!==void 0)J+=E.processedCount}if(Object.keys(f).length>0)u.results=f;if(u.success=!X,w.length>0)u.error=w.join("; ");if(J>0)u.processedCount=J;return u},uK3=async($,u,f,X,J)=>{let w=X;if(pn0($)){let W=new Set;for(let F of $.events){let B=Ul$(F);if(!B)continue;let[v,N]=B,O=an0(v,w,J);if(!O)continue;W.add(`${O}:${N}`)}let G=u.filter((F)=>{let B=`${F.source}:${F.type}`;return W.has(B)});if(G.length===0)return{success:!0};try{return await $.handler({events:G},f)}catch(F){return{success:!1,error:F instanceof Error?F.message:String(F)}}}let E=new Map;for(let W of Nl$($)){let G=an0(W,w,J);if(G)E.set(G,W)}let Q=sz3(u),Y=[];for(let[W,G]of Q){let F=E.get(W);if(!F)continue;let B=$[F];if(!B)continue;if(vl$(B)){Y.push((async()=>{try{return await B.handler({events:G},f)}catch(O){let z={};for(let H of G)z[H.id]={success:!1,error:O instanceof Error?O.message:String(O)};return{results:z}}})());continue}let v=B,N=ez3(G);for(let[O,z]of N){let H=v[O];if(!H)continue;Y.push((async()=>{try{let _=await H({events:z},f),T={};for(let j of z)T[j.id]=_;return{results:T}}catch(_){let T={};for(let j of z)T[j.id]={success:!1,error:_ instanceof Error?_.message:String(_)};return{results:T}}})())}}let Z=await Promise.all(Y);if(Z.length===0)return{success:!0};return $K3(Z)},on0;var bV1=U(()=>{hs();on0={subscriptions:oz3,execute:uK3,parseCron:az3}});function ys($){return $.toLowerCase().trim().replace(/[^a-z0-9]+/g,"-").replace(/^-|-$/g,"")}function zl$($,u){return`${$}::${ys(u)}`}function iV1($){return`START_WORKFLOW_${ys($).toUpperCase().replace(/-/g,"_")}`}function Kl$($,u){let f=rn0("self",{meshUrl:$,token:u});return Mr.forConnection(f)}function fK3($,u){if(!fl.has($)&&fl.size>=Hl$){let f=fl.keys().next().value;if(f!==void 0)fl.delete(f)}fl.set($,u)}function XK3($){return`Workflows Agent (${$})`}function Ol$($,u){if(!Xl.has($)&&Xl.size>=Hl$){let f=Xl.keys().next().value;if(f!==void 0)Xl.delete(f)}Xl.set($,u)}async function JK3($,u,f){let X=Xl.get($);if(X)return console.log(`${f} Using cached default Virtual MCP: ${X}`),X;let J=XK3($);try{let w=await u.COLLECTION_VIRTUAL_MCP_LIST({where:{operator:"and",conditions:[{field:["connection_id"],operator:"eq",value:$},{field:["title"],operator:"eq",value:J}]},limit:1});if(w.items.length>0){let E=w.items[0].id;return Ol$($,E),console.log(`${f} Found existing default Virtual MCP: ${E}`),E}}catch(w){console.warn(`${f} Could not list Virtual MCPs \u2014 proceeding without default. Error: ${w instanceof Error?w.message:String(w)}`);return}try{let E=(await u.COLLECTION_VIRTUAL_MCP_CREATE({data:{title:J,connections:[{connection_id:$,selected_tools:null}]}})).item.id;return Ol$($,E),console.log(`${f} Created default Virtual MCP: ${E}`),E}catch(w){console.warn(`${f} Could not create default Virtual MCP \u2014 proceeding without default. Error: ${w instanceof Error?w.message:String(w)}`);return}}function wK3($){return JSON.stringify($.map((u)=>({title:u.title,description:u.description??void 0,virtual_mcp_id:u.virtual_mcp_id??void 0,steps:u.steps,toolId:u.toolId??void 0,inputSchema:u.inputSchema??void 0})))}async function EK3($,u,f,X,J){let w=`[Workflows][${f}]`,E=$.find((_)=>ys(_.title)==="");if(E!==void 0){console.warn(`${w} Workflow title "${E.title}" produces an empty ID. Skipping sync.`);return}if($.length>0){let _=$.map((j)=>ys(j.title));if(new Set(_).size!==_.length){let j=new Set(_.filter((k,S)=>_.indexOf(k)!==S)),I=$.filter((k)=>j.has(ys(k.title))).map((k)=>k.title);console.warn(`${w} Workflow titles that produce duplicate IDs: ${[...new Set(I)].join(", ")}. Skipping sync.`);return}}let Q=wK3($),Y=fl.get(f);if(Y===Q){console.log(`${w} Fingerprint unchanged \u2014 skipping sync. Declared: ${$.length} workflow(s): [${$.map((_)=>_.title).join(", ")}]`);return}console.log(`${w} Fingerprint changed (or first sync) \u2014 starting sync. Declared: ${$.length} workflow(s): [${$.map((_)=>_.title).join(", ")}]`,Y?"(previous fingerprint existed)":"(no previous fingerprint)");let Z=J??Kl$(u,X),G=$.some((_)=>_.virtual_mcp_id===void 0)?await JK3(f,Z,w):void 0,F;try{let _=[],T=0,j=200;while(!0){let I=await Z.COLLECTION_WORKFLOW_LIST({limit:j,offset:T});if(_.push(...I.items),!I.hasMore||I.items.length===0)break;T+=I.items.length}F=_,console.log(`${w} LIST returned ${F.length} total workflow(s). IDs owned by this connection: [${F.filter((I)=>I.id.startsWith(`${f}::`)).map((I)=>I.id).join(", ")||"none"}]`)}catch(_){let T=_ instanceof Error?_.message:String(_);console.warn(`${w} Could not list workflows (workflows plugin may not be enabled). Skipping sync. Error: ${T}`);return}let B=`${f}::`,v=new Map(F.filter((_)=>_.id.startsWith(B)).map((_)=>[_.id,_])),N=$.map((_)=>[zl$(f,_.title),_]),O=new Set(N.map(([_])=>_)),z=!1;await Promise.all(N.map(async([_,T])=>{let j=v.has(_)?"UPDATE":"CREATE";console.log(`${w} ${j} "${T.title}" (id=${_})`);try{let I=T.virtual_mcp_id??G;if(j==="UPDATE"){let k=await Z.COLLECTION_WORKFLOW_UPDATE({id:_,data:{title:T.title,description:T.description,...I!==void 0&&{virtual_mcp_id:I},steps:T.steps,input_schema:T.inputSchema===void 0?void 0:T.inputSchema??null}});if(!k.success)z=!0,console.warn(`${w} UPDATE "${T.title}" returned success=false:`,String(k.error??"(no error message)"));else console.log(`${w} UPDATE "${T.title}" OK`)}else await Z.COLLECTION_WORKFLOW_CREATE({data:{id:_,title:T.title,description:T.description,virtual_mcp_id:I,steps:T.steps,input_schema:T.inputSchema??null}}),console.log(`${w} CREATE "${T.title}" OK`)}catch(I){z=!0,console.warn(`${w} Failed to ${j} workflow "${T.title}":`,I instanceof Error?I.message:String(I))}}));let H=[...v.keys()].filter((_)=>!O.has(_));if(H.length>0)console.log(`${w} Deleting ${H.length} orphaned workflow(s): [${H.join(", ")}]`);if(await Promise.all(H.map(async(_)=>{try{await Z.COLLECTION_WORKFLOW_DELETE({id:_}),console.log(`${w} DELETE "${_}" OK`)}catch(T){z=!0,console.warn(`${w} Failed to delete orphaned workflow "${_}":`,T instanceof Error?T.message:String(T))}})),!z)fK3(f,Q),console.log(`${w} Sync complete \u2014 fingerprint stored.`);else console.warn(`${w} Sync finished with errors \u2014 fingerprint NOT stored so the next call will retry.`)}async function QK3($,u,f,X,J){let E=(sn0.get(f)??Promise.resolve()).catch(()=>{}).then(()=>EK3($,u,f,X,J)).finally(()=>{if(sn0.get(f)===E)sn0.delete(f)});return sn0.set(f,E),E}var sn0,Hl$=500,fl,Xl,_l$,en0;var xV1=U(()=>{hs();tn0();sn0=new Map,fl=new Map;Xl=new Map;_l$=["SELF::COLLECTION_WORKFLOW_LIST","SELF::COLLECTION_WORKFLOW_CREATE","SELF::COLLECTION_WORKFLOW_UPDATE","SELF::COLLECTION_WORKFLOW_DELETE","SELF::COLLECTION_WORKFLOW_EXECUTION_CREATE","SELF::COLLECTION_VIRTUAL_MCP_LIST","SELF::COLLECTION_VIRTUAL_MCP_CREATE"],en0={sync:QK3,slugify:ys,workflowId:zl$,toolId:iV1,createExecution:async($,u,f)=>{return(await Kl$($,u).COLLECTION_WORKFLOW_EXECUTION_CREATE(f)).item.id},clearFingerprint:($)=>{fl.delete($),Xl.delete($)}}});function hF($){return{...$,execute:(u)=>{let f=xw0(u.runtimeContext);return $.execute({...u,runtimeContext:f},f)}}}var xw0=($)=>{let u=iw0.getStore();if(!u){if($)return $;throw Error("Missing context, did you forget to call State.bind?")}return u},YK3=($,u)=>{let f=u;return typeof f[$]<"u"?f[$]:u?.MESH_REQUEST_CONTEXT?.state?.[$]},$t0=($)=>{let u=$.runtimeContext.env.MESH_REQUEST_CONTEXT;return{connectionId:u?.connectionId,meshUrl:u?.meshUrl,token:u?.token}},DK3=({events:$,workflows:u,configuration:{state:f,scopes:X,onChange:J}={}}={})=>{let w=f?fl$(D.toJSONSchema(f)):{type:"object",properties:{}},E=String($?.bus??"EVENT_BUS");return[...J||$||u?.length?[hF({id:"ON_MCP_CONFIGURATION",description:"MCP Configuration On Change",inputSchema:D.object({state:f??D.unknown(),scopes:D.array(D.string()).describe("Array of scopes in format 'KEY::SCOPE' (e.g., 'GMAIL::GetCurrentUser')")}),outputSchema:D.object({}),execute:async(Q)=>{let Y=Q.context.state;await J?.(Q.runtimeContext.env,{state:Y,scopes:Q.context.scopes});let Z=YK3(E,Q.runtimeContext.env);if($&&Y&&Z){let{connectionId:W}=$t0(Q),G=on0.subscriptions($?.handlers??{},Y,W);if(await Z.EVENT_SYNC_SUBSCRIPTIONS({subscriptions:G}),W){let F=G.filter((B)=>B.eventType.startsWith("cron/")&&B.publisher===W);await Promise.all(F.map(async(B)=>{let v=on0.parseCron(B.eventType);if(v){let[,N]=v;await Z.EVENT_PUBLISH({type:B.eventType,cron:N})}}))}}if(u?.length){let{connectionId:W,meshUrl:G,token:F}=$t0(Q);if(W&&G)await en0.sync(u,G,W,F)}return Promise.resolve({})}})]:[],...$?.handlers?[hF({id:"ON_EVENTS",description:"Receive and process CloudEvents from the event bus. Returns per-event or batch results.",inputSchema:sT0,outputSchema:eT0,execute:async(Q)=>{let Y=Q.runtimeContext.env,Z=Y.MESH_REQUEST_CONTEXT?.state,{connectionId:W}=$t0(Q);return on0.execute($.handlers,Q.context.events,Y,Z,W)}})]:[],hF({id:"MCP_CONFIGURATION",description:"MCP Configuration",inputSchema:D.object({}),outputSchema:D.object({stateSchema:D.unknown(),scopes:D.array(D.string()).optional()}),execute:()=>{return Promise.resolve({stateSchema:w,scopes:[...X??[],...$?[`${E}::EVENT_SYNC_SUBSCRIPTIONS`]:[],...u?.length?[..._l$]:[]]})}}),...u?.length?u.map((Q)=>{let Y=Q.toolId??iV1(Q.title),Z=[Q.description?`Run workflow: ${Q.description}`:`Start the "${Q.title}" workflow.`,"Returns an execution_id immediately. Use COLLECTION_WORKFLOW_EXECUTION_GET to track progress."].join(" ");return hF({id:Y,description:(()=>{if(!Q.inputSchema)return Z;let W=JSON.stringify(Q.inputSchema,null,2);return W.length<=2048?`${Z}
 Input schema:
 ${W}`:`${Z}