npm - decocms - Versions diffs - 3.10.0 → 3.10.1 - Mend

decocms 3.10.0 → 3.10.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (229) hide show

package/dist/server/cli.js CHANGED Viewed

@@ -104791,7 +104791,7 @@ ${c.stack}`;f.reject(d)}else f.resolve(_)}});return $.requestSubject=i,this.prot
 `);if(g===-1)return;let h=$.subarray(0,g).toString("utf8"),E=$.subarray(g+4),v=h.split(`\r
 `,1)[0]??"";if(!/^HTTP\/1\.[01] 101(?:\s|$)/.test(v)){C8(i,1011,t.upstreamErrorReason);try{c.end()}catch{}return}d=!0,i.data.upstream=c;let r=$9l((x,O)=>{try{if(x===1)i.send(O.toString("utf8"));else if(x===2)i.send(O);else if(x===8){let{code:y,reason:X}=c9l(O);C8(i,y,X);try{c.end()}catch{}}}catch{}});if(c.removeAllListeners("data"),E.length>0)r(E);c.on("data",(x)=>r(x));for(let x of i.data.pending)try{c.write($ki(x,!0))}catch{}i.data.pending.length=0})}function f9l(i,t){let u=[`GET ${i} HTTP/1.1`];for(let[l,n]of Object.entries(t))u.push(`${l}: ${n}`);return u.push("",""),u.join(`\r
 `)}function C8(i,t,u){try{if(t!==void 0)i.close(t,u??"");else i.close()}catch{}}function $ki(i,t,u){let l,n;if(typeof i==="string")l=Buffer.from(i,"utf8"),n=1;else if(i instanceof ArrayBuffer)l=Buffer.from(i),n=2;else if(Buffer.isBuffer(i))l=i,n=2;else l=Buffer.from(i),n=2;let f=u??n,c=l.length,$=[];$.push(128|f&15);let d=t?128:0;if(c<126)$.push(d|c);else if(c<65536)$.push(d|126,c>>8&255,c&255);else $.push(d|127,0,0,0,0),$.push(c>>>24&255,c>>>16&255,c>>>8&255,c&255);if(t){let _=gSt(4),g=Buffer.alloc(c);for(let h=0;h<c;h++)g[h]=l[h]^_[h&3];return Buffer.concat([Buffer.from($),_,g])}return Buffer.concat([Buffer.from($),l])}function c9l(i){if(i.length<2)return{code:1000,reason:""};return{code:i.readUInt16BE(0),reason:i.subarray(2).toString("utf8")}}function $9l(i){let t=Buffer.alloc(0);return(u)=>{t=t.length===0?u:Buffer.concat([t,u]);while(!0){if(t.length<2)return;let l=t[0],n=t[1],f=l&15,c=(n&128)!==0,$=n&127,d=2;if($===126){if(t.length<d+2)return;$=t[d]<<8|t[d+1],d+=2}else if($===127){if(t.length<d+8)return;$=t[d+4]*16777216+(t[d+5]<<16|t[d+6]<<8|t[d+7]),d+=8}let _=null;if(c){if(t.length<d+4)return;_=t.subarray(d,d+4),d+=4}if(t.length<d+$)return;let g=t.subarray(d,d+$);if(_){let h=Buffer.alloc($);for(let E=0;E<$;E++)h[E]=g[E]^_[E&3];g=h}t=t.subarray(d+$),i(f,g)}}}var l9l=256;var rSt=w(()=>{_St()});function wSt(i){if(typeof i!=="string"||i.length===0)return null;let t=i.lastIndexOf(":");if(i.startsWith("["))return null;let l=(t>=0?i.slice(0,t):i).replace(/\.$/,"").toLowerCase(),n=".localhost";if(!l.endsWith(n))return null;let f=l.slice(0,-n.length);if(f.length===0)return null;if(f.includes("."))return null;return f}async function xSt(i){let t=vSt({maxPendingFrames:i.maxPendingWsFrames??d9l,backlogOverflowReason:"ingress backlog overflow"}),u=Bun.serve({port:i.port,hostname:"127.0.0.1",idleTimeout:0,async fetch(l,n){let f=l.headers.get("host"),c=wSt(f);if(!c)return new Response("not found",{status:404});let $=i.lookupSandboxPort(c);if(!$){if(l.headers.get("upgrade")==="websocket")return new Response("unknown handle",{status:404});return new Response(_9l,{status:503,headers:{"Content-Type":"text/html; charset=utf-8","Cache-Control":"no-store","Retry-After":"1"}})}if(l.headers.get("upgrade")==="websocket"){let h=new URL(l.url);if(!n.upgrade(l,{data:ESt({port:$,pathQuery:`${h.pathname}${h.search}`,protocols:hSt(l.headers)})}))return new Response("ws upgrade failed",{status:400});return}let d=new URL(l.url),_=`http://127.0.0.1:${$}${d.pathname}${d.search}`,g=new Headers(l.headers);return g.set("host",`127.0.0.1:${$}`),fetch(_,{method:l.method,headers:g,body:l.body,redirect:"manual"})},websocket:{open:t.open,message:t.message,close:t.close}});return{port:u.port??0,async stop(){u.stop(!0)}}}var d9l=256,_9l='<!DOCTYPE html><html><head><meta charset="utf-8"><title>Connecting\u2026</title><style>body{font-family:system-ui,sans-serif;display:flex;align-items:center;justify-content:center;min-height:100vh;margin:0;background:#fafafa;color:#555}div{text-align:center;max-width:420px;padding:24px}h3{margin:0 0 8px}p{margin:0;font-size:14px;color:#999;line-height:1.5}</style></head><body><div><h3>Connecting to sandbox\u2026</h3><p>Waiting for the local sandbox to come online. This page refreshes automatically.</p></div><script>setTimeout(function(){window.location.reload()},1500)</script></body></html>';var DSt=w(()=>{rSt()});async function dki(i=w9l){let t=["decopilot-sandbox","body-offload"],[u,l]=await Promise.all([i.detectClaudeCode().catch(()=>!1),i.detectCodex().catch(()=>!1)]);if(u)t.push("claude-code");if(l)t.push("codex");return t}function h9l(i){return g9l.filter((t)=>!i.includes(t))}function E9l(i,t){let u=t.filter((l)=>!i.includes(l));return i.push(...u),u}function OSt(i,t={}){let u=t.detect??(()=>dki()),l=setInterval(()=>{if(h9l(i).length===0)return;u().then((n)=>{let f=E9l(i,n);if(f.length>0)t.onChange?.(f)}).catch(()=>{})},t.intervalMs??60000);return l.unref?.(),()=>clearInterval(l)}async function v9l(){try{let{query:i}=await import("@anthropic-ai/claude-agent-sdk"),t=i({prompt:"",options:{maxTurns:1}}),u=await t.accountInfo();return t.return(void 0),Boolean(u.email)}catch{return!1}}async function r9l(){try{let i=Bun.spawn(["codex","--version"],{stdout:"ignore",stderr:"ignore"}),t=setTimeout(()=>i.kill(),1e4),u=await i.exited;return clearTimeout(t),u===0}catch{return!1}}var g9l,w9l;var ySt=w(()=>{g9l=["claude-code","codex"];w9l={detectClaudeCode:v9l,detectCodex:r9l}});import{randomBytes as x9l}from"crypto";import{mkdir as D9l,readFile as O9l,writeFile as y9l}from"fs/promises";import{dirname as X9l,join as N9l}from"path";function J9l(i){return N9l(i,"machine-id")}async function XSt(i){let t=J9l(i);try{let n=(await O9l(t,"utf8")).trim();if(n)return n}catch{}let u=x9l(16).toString("hex");return await D9l(X9l(t),{recursive:!0}),await y9l(t,u),u}var NSt=()=>{};import{randomBytes as U9l}from"crypto";import{mkdir as T9l}from"fs/promises";import{createServer as F9l}from"net";import{join as I9l}from"path";function JSt(i,t){return Error(`sandbox failed to start: ${i}`,{cause:t})}function Z9l(i){if(!(i instanceof Error))return!1;return i.name==="TimeoutError"||/timed out|timeout|operation was aborted|aborted/i.test(i.message)}function B9l(i){if(i instanceof Error){let t=i.cause;if(t instanceof Error&&t.message)return t.message;return i.message}return String(i)}function USt(i){let t=i.maxSandboxes??20,u=new Map,l=i.pickPort??Q9l,n=i.fetchImpl??fetch,f=i.resolvePreviewUrl??((E,v)=>`http://127.0.0.1:${v}`),c=(E)=>{try{i.onEvent?.(E)}catch{}},$=async(E)=>{let v=new AbortController,r=setTimeout(()=>v.abort(),1500);try{let x=await n(`${E}/health`,{signal:v.signal});if(!x.ok)console.warn(`[user-desktop] probe ${E}/health \u2192 ${x.status} (treating as dead)`);return x.ok}catch(x){return console.warn(`[user-desktop] probe ${E}/health failed: ${x instanceof Error?x.message:String(x)} (treating as dead)`),!1}finally{clearTimeout(r)}},d=(E)=>{console.warn(`[user-desktop] evicting dead daemon handle=${E.handle} port=${E.port}`);try{E.process.kill("SIGTERM")}catch{}if(u.get(E.handle)===E)u.delete(E.handle),c({handle:E.handle,phase:"evicted"})},_=new Map;function g(){if(u.size<t)return;let E=[...u.values()].filter((r)=>r.activeDispatchCount===0).sort((r,x)=>r.lastUsedAt-x.lastUsedAt);if(E.length===0){console.warn(`[user-desktop] at cap ${u.size}/${t} but every sandbox is pinned (active dispatch) \u2014 exceeding cap temporarily`);return}let v=E[0];console.log(`[user-desktop] evicting LRU victim handle=${v.handle} port=${v.port} (cap ${t} reached, size=${u.size})`);try{v.process.kill("SIGTERM")}catch{}u.delete(v.handle),c({handle:v.handle,phase:"evicted"})}let h=async(E)=>{c({handle:E.handle,phase:"spawning"}),g();let v=I9l(i.dataDir,"sandboxes",E.handle);await T9l(v,{recursive:!0}),console.log(`[user-desktop] ensure handle=${E.handle} repo=${E.repo?.cloneUrl??"(none)"} branch=${E.repo?.branch??"(none)"} runtime=${E.workload?.runtime??"(autodetect)"} pm=${E.workload?.packageManager??"(autodetect)"}`);let r=U9l(24).toString("hex"),[x,O]=await Promise.all([l(),l()]);console.log(`[user-desktop] spawn handle=${E.handle} port=${x} devPort=${O} workdir=${v}`);let y=await Promise.resolve(i.spawnDaemon({workdir:v,handle:E.handle,port:x,daemonToken:r,offloadAllowedHosts:E.offloadAllowedHosts??[],offloadAllowSameHostDev:E.offloadAllowSameHostDev??!1,orgFsConfigJson:E.orgFsConfigJson}));try{try{await i.waitForHealth(x)}catch(J){throw JSt("the sandbox didn't come online in time",J)}console.log(`[user-desktop] healthy handle=${E.handle} port=${x} \u2014 posting config`);try{await i.postConfig(x,O,{repo:E.repo,workload:E.workload,operator:E.operator},r)}catch(J){throw JSt(Z9l(J)?"configuration timed out":"the sandbox rejected its configuration",J)}}catch(J){console.error(`[user-desktop] sandbox bring-up failed handle=${E.handle} port=${x} (killing daemon):`,J);try{y.kill("SIGKILL")}catch{}throw c({handle:E.handle,phase:"failed",error:B9l(J)}),J}let X=`http://127.0.0.1:${x}`,N=f(E.handle,x);console.log(`[user-desktop] ready handle=${E.handle} port=${x} sandboxApiUrl=${X} previewUrl=${N}`);let U={handle:E.handle,port:x,process:y,sandboxApiUrl:X,previewUrl:N,lastUsedAt:Date.now(),activeDispatchCount:0,daemonToken:r};if(u.set(E.handle,U),c({handle:E.handle,phase:"ready",port:x,previewUrl:N}),y.exited)y.exited.then(()=>{if(u.get(E.handle)===U)console.warn(`[user-desktop] daemon process exited unexpectedly handle=${E.handle} port=${x} \u2014 removing from cache`),u.delete(E.handle),c({handle:E.handle,phase:"evicted"});else console.log(`[user-desktop] daemon process exited handle=${E.handle} port=${x} (already replaced/removed)`)});return{sandboxApiUrl:X,previewUrl:N,port:x}};return{async ensureSandbox(E){let v=u.get(E.handle);if(v){if(await $(v.sandboxApiUrl))return console.log(`[user-desktop] cache hit handle=${E.handle} port=${v.port} (alive)`),v.lastUsedAt=Date.now(),{sandboxApiUrl:v.sandboxApiUrl,previewUrl:v.previewUrl,port:v.port};console.warn(`[user-desktop] cache stale handle=${E.handle} port=${v.port} \u2014 respawning`),d(v)}let r=_.get(E.handle);if(r)return console.log(`[user-desktop] joining in-flight ensure handle=${E.handle}`),r;let x=h(E).finally(()=>{_.delete(E.handle)});return _.set(E.handle,x),x},proxyPort(E){let v=u.get(E);if(v)v.lastUsedAt=Date.now();return v?.port??null},getDaemonToken(E){return u.get(E)?.daemonToken??null},hasHandle(E){return u.has(E)||_.has(E)},recordHit(E){let v=u.get(E);if(v)v.lastUsedAt=Date.now()},acquireDispatch(E){let v=u.get(E);if(!v)return()=>{};v.activeDispatchCount+=1;let r=!1;return()=>{if(r)return;r=!0;let x=u.get(E);if(x)x.activeDispatchCount=Math.max(0,x.activeDispatchCount-1)}},listSandboxes(){return[...u.values()]},async deleteSandbox(E){let v=u.get(E);if(!v){console.log(`[user-desktop] delete handle=${E} (not found, no-op)`);return}console.log(`[user-desktop] delete handle=${E} port=${v.port}`);try{v.process.kill("SIGTERM")}catch{}u.delete(E),c({handle:E,phase:"deleted"})},async shutdown(){console.log(`[user-desktop] shutdown \u2014 killing ${u.size} sandbox(es)`);for(let E of u.values())try{E.process.kill("SIGTERM")}catch{}u.clear()}}}function Q9l(){return new Promise((i,t)=>{let u=F9l();u.unref(),u.on("error",t),u.listen(0,"127.0.0.1",()=>{let l=u.address();if(l&&typeof l==="object"){let n=l.port;u.close(()=>i(n))}else u.close(()=>t(Error("could not allocate port")))})})}var TSt=()=>{};import{randomUUID as Y9l}from"crypto";import{hostname as P9l}from"os";async function FSt(i){let t=P9l()||void 0;i.monitor?.onMachine?.(t??"this machine");let u=KPt(i.dataDir,{outFd:i.logFd,hotReload:i.hotReload}),l=0,n=USt({dataDir:i.dataDir,resolvePreviewUrl:(N,U)=>l>0?`http://${N}.localhost:${l}`:`http://127.0.0.1:${U}`,spawnDaemon:async(N)=>{let U={DAEMON_BOOT_ID:Y9l(),APP_ROOT:N.workdir,PROXY_PORT:String(N.port),DAEMON_TOKEN:N.daemonToken,OFFLOAD_ALLOWED_HOSTS:N.offloadAllowedHosts.join(","),...N.offloadAllowSameHostDev?{OFFLOAD_ALLOW_SAME_HOST_DEV:"1"}:{}};if(N.orgFsConfigJson){let F=await ePt(i.dataDir);if(F)U.ORGFS_CONFIG=N.orgFsConfigJson,U.ORGFS_RCLONE_PATH=F}let J=await u({workdir:N.workdir,env:U,daemonPort:N.port});return{port:N.port,kill:(F)=>J.kill(F),exited:J.exited.then(()=>{return})}},postConfig:async(N,U,J,F)=>{let Q={port:U};if(J.workload)Q.runtime=J.workload.runtime,Q.packageManager={name:J.workload.packageManager,...J.workload.packageManagerPath?{path:J.workload.packageManagerPath}:{}};let B={application:Q},P=ih(J.operator??null);if(P)B.operator=P;if(J.repo)B.git={repository:{cloneUrl:J.repo.cloneUrl,branch:J.repo.branch},...J.repo.userName&&J.repo.userEmail?{identity:{userName:J.repo.userName,userEmail:J.repo.userEmail}}:{}};await Z8(`http://127.0.0.1:${N}`,F,B)},waitForHealth:async(N)=>{await mui(`http://127.0.0.1:${N}`)},maxSandboxes:20,onEvent:i.monitor?.onEvent}),f=await xSt({port:i.port,lookupSandboxPort:(N)=>n.proxyPort(N)});l=f.port,console.log(`Local ingress listening on http://127.0.0.1:${f.port} (use http://<handle>.localhost:${f.port}/)`),i.monitor?.onIngress?.(f.port);let c=MPt({provider:n}),$=async()=>{let N=await Sw({dataDir:i.dataDir,target:i.clusterBaseUrl});if(!N)throw Object.assign(Error(`Session for ${i.clusterBaseUrl} is no longer valid \u2014 run \`deco auth login --target ${i.clusterBaseUrl}\` and restart \`deco link\`.`),{fatal:!0});return N.accessToken};console.log(`[link-daemon] transport=pull cluster=${i.clusterBaseUrl}`);let d=await XSt(i.dataDir),_=process.env.npm_package_version??"0.0.0",g=await dki(),h=OSt(g,{onChange:(N)=>{console.log(`[link-daemon] capabilities detected: +${N.join(",")} (now: ${g.join(",")})`)}}),E=nki({path:`${i.dataDir}/link/outbox.sqlite`}),v=()=>{},r=await nSt({clusterBaseUrl:i.clusterBaseUrl,getAccessToken:$,provider:n,outbox:E,controlHandler:c,capabilities:g,machineId:d,cliVersion:_,previewPort:f.port,onConnected:()=>{i.monitor?.onCluster?.("linked"),console.log(`Linked to ${i.clusterBaseUrl} (pull transport)`)},onShutdown:()=>v()}),x,O=new Promise((N)=>{x=N}),y=!1,X=async()=>{if(y)return;y=!0,console.log(`
-Shutting down\u2026`),h();try{await r.close()}catch{}try{await f.stop()}catch{}try{await n.shutdown()}catch{}try{E.close()}catch{}x(0)};return process.on("SIGINT",()=>void X()),process.on("SIGTERM",()=>void X()),v=()=>{console.log("Disconnect requested from the Studio web UI \u2014 shutting down. Run `bunx decocms link` to reconnect."),X()},r.closed.then(()=>{if(i.monitor?.onCluster?.("closed"),!y)console.error("Cluster connection closed permanently; exiting."),X()}),{stopped:O,stop:X}}var ISt=w(()=>{lGi();jH();HPt();CPt();qPt();fSt();fki();DSt();ySt();NSt();kH();TSt()});function _ki(i){return i.map((t)=>typeof t==="string"?t:String(t)).join(" ")}var d0i;var gki=w(()=>{d0i={name:"decocms",version:"3.10.0",description:"Deco CMS \u2014 Self-hostable MCP Gateway for managing AI connections and tools",author:"Deco team",repository:{type:"git",url:"git+https://github.com/decocms/studio.git",directory:"apps/mesh"},bugs:{url:"https://github.com/decocms/studio/issues"},type:"module",bin:{deco:"./dist/server/cli.js"},files:["dist/**/*"],scripts:{dev:'bun run migrate && concurrently "bun run dev:client" "bun run dev:server"',"dev:servers":'concurrently "bun run dev:client" "bun run dev:server"',"dev:client":"vite dev","dev:server":"bun run --cwd=../../packages/sandbox build && NODE_ENV=development bun --env-file=.env --hot run src/index.ts","build:client":"bun --bun vite build","build:server":"bun run scripts/bundle-server-script.ts --dist ./dist/server","db:migrate":"bun run ./dist/server/migrate.js",check:"tsc --noEmit",start:"bun run ./dist/server/server.js",migrate:"bun run src/database/migrate.ts",test:"bun test","test:e2e":"playwright test","test:e2e:ui":"playwright test --ui","better-auth:migrate":"bunx --bun @better-auth/cli migrate -y --config src/auth/index.ts","smoke:link":"bun run scripts/smoke-link.ts",prepublishOnly:"bun run build:client && bun run build:server"},optionalDependencies:{"@anthropic-ai/claude-agent-sdk":"^0.2.141","@duckdb/node-api":"^1.5.0-r.1"},dependencies:{"@ai-sdk/anthropic":"^3.0.80","@ai-sdk/google":"^3.0.80","@ai-sdk/openai":"^3.0.65","@anthropic-ai/sdk":"^0.96.0","@aws-sdk/client-s3":"^3.1013.0","@aws-sdk/lib-storage":"^3.1013.0","@aws-sdk/s3-request-presigner":"^3.1013.0","@clickhouse/client":"^1.8.1","@dbos-inc/dbos-sdk":"^4.17.6","@dnd-kit/core":"^6.3.1","@dnd-kit/sortable":"^10.0.0","@dnd-kit/utilities":"^3.2.2","@inkjs/ui":"^2.0.0","@modelcontextprotocol/ext-apps":"^1.7.1","@openrouter/ai-sdk-provider":"^2.9.0","@opentelemetry/core":"^2.6.0","@tanstack/react-virtual":"3.13.24","@xterm/addon-fit":"^0.11.0","@xterm/xterm":"^6.0.0","embedded-postgres":"^18.3.0-beta.16",ink:"^6.8.0",kysely:"^0.28.12",nats:"^2.29.3","node-pty":"^1.0.0","posthog-js":"^1.371.1","posthog-node":"^5.0.0",react:"^19.2.6","react-dom":"^19.2.6"},devDependencies:{"@ai-sdk/provider":"^3.0.10","@ai-sdk/react":"^3.0.193","@better-auth/sso":"1.4.1","@daveyplate/better-auth-ui":"^3.2.7","@deco/ui":"workspace:*","@decocms/better-auth":"1.5.17","@decocms/bindings":"workspace:*","@decocms/harness":"workspace:*","@decocms/mcp-utils":"workspace:*","@decocms/mesh-sdk":"workspace:*","@decocms/runtime":"workspace:*","@decocms/sandbox":"workspace:*","@decocms/std":"workspace:*","@floating-ui/react":"^0.27.16","@happy-dom/global-registrator":"^20.9.0","@hookform/resolvers":"^5.2.2","@jitl/quickjs-wasmfile-release-sync":"0.31.0","@modelcontextprotocol/sdk":"1.29.0","@monaco-editor/react":"^4.7.0","@opentelemetry/api":"^1.9.0","@opentelemetry/api-logs":"^0.211.0","@opentelemetry/exporter-logs-otlp-proto":"^0.211.0","@opentelemetry/exporter-prometheus":"^0.208.0","@opentelemetry/exporter-trace-otlp-proto":"^0.207.0","@opentelemetry/instrumentation-runtime-node":"^0.24.0","@opentelemetry/resources":"^2.6.0","@opentelemetry/sdk-logs":"^0.211.0","@opentelemetry/sdk-metrics":"^2.2.0","@opentelemetry/sdk-node":"^0.207.0","@opentelemetry/sdk-trace-base":"^2.5.0","@playwright/test":"^1.58.2","@radix-ui/react-avatar":"^1.1.10","@radix-ui/react-checkbox":"^1.3.3","@radix-ui/react-dialog":"^1.1.15","@radix-ui/react-dropdown-menu":"^2.1.16","@radix-ui/react-label":"^2.1.7","@radix-ui/react-select":"^2.2.6","@radix-ui/react-separator":"^1.1.7","@radix-ui/react-slot":"^1.2.3","@radix-ui/react-tabs":"^1.1.13","@rjsf/core":"^6.1.2","@rjsf/shadcn":"^6.1.2","@rjsf/utils":"^6.1.2","@rjsf/validator-ajv8":"^6.1.2","@tailwindcss/vite":"^4.1.17","@tanstack/react-query":"5.100.10","@tanstack/react-router":"1.169.2","@testing-library/jest-dom":"^6.9.1","@testing-library/react":"^16.3.2","@tiptap/core":"3.20.2","@tiptap/extension-mention":"3.20.2","@tiptap/extension-placeholder":"3.20.2","@tiptap/pm":"3.20.2","@tiptap/react":"3.20.2","@tiptap/starter-kit":"3.20.2","@tiptap/suggestion":"3.20.2","@types/bun":"^1.3.1","@types/pg":"^8.15.6","@types/react-syntax-highlighter":"^15.5.13","@untitledui/icons":"^0.0.19","@vercel/nft":"^1.1.1","@vitejs/plugin-react":"^5.1.0",ai:"^6.0.191","babel-plugin-react-compiler":"^1.0.0","better-auth":"1.4.22","class-variance-authority":"^0.7.1",clsx:"^2.1.1",concurrently:"^9.2.1",croner:"^9.1.0","date-fns":"^4.1.0",degit:"^2.8.4",hono:"^4.10.7","input-otp":"^1.4.2",jose:"^6.0.11","lucide-react":"^0.468.0",marked:"^15.0.6","mesh-plugin-workflows":"workspace:*",nanoid:"^5.1.6",pg:"^8.16.3",prettier:"^3.4.2","react-hook-form":"^7.66.0","react-markdown":"^10.1.0","react-resizable-panels":"^2.1.7","react-syntax-highlighter":"^15.6.1",recharts:"^3.6.0","rehype-raw":"^7.0.0","remark-gfm":"^4.0.0","sass-embedded":"^1.97.2",sonner:"^2.0.7","tailwind-merge":"^3.3.1",tailwindcss:"^4.1.17",typescript:"^5.9.3",vite:"^7.2.1","vite-tsconfig-paths":"^5.1.4",zod:"^4.0.0",zustand:"^5.0.9"},homepage:"https://github.com/decocms/studio",keywords:["mcp","model-context-protocol","ai","gateway","self-hosted","mesh","tools"],license:"MIT",publishConfig:{access:"public"}}});var $R={};Gi($R,{printBanner:()=>W9l,bannerLines:()=>ZSt,BANNER_LINES:()=>_0i,BANNER_GRADIENT:()=>g0i});function G9l(i){let t=Number.parseInt(i.slice(1),16);return[t>>16&255,t>>8&255,t&255]}function ZSt(i){let t=_0i.map((u,l)=>{let[n,f,c]=G9l(g0i[l]);return`\x1B[38;2;${n};${f};${c}m${u}\x1B[39m`});if(i!==void 0)t.push(`\x1B[2m  v${i}\x1B[22m`);return t}function W9l(i){console.log("");for(let t of ZSt(i))console.log(t);console.log("")}var _0i,g0i;var JW=w(()=>{_0i=[" \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588     \u2588\u2588\u2588\u2588\u2588\u2588\u2588   ","\u2591\u2591\u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2588\u2588\u2588 \u2591\u2591\u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2591\u2588  \u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2591\u2588\u2588\u2588  \u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2591\u2588\u2588\u2588 "," \u2591\u2588\u2588\u2588   \u2591\u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588  \u2588 \u2591  \u2588\u2588\u2588     \u2591\u2591\u2591  \u2588\u2588\u2588     \u2591\u2591\u2588\u2588\u2588"," \u2591\u2588\u2588\u2588    \u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588\u2588\u2588\u2588   \u2591\u2588\u2588\u2588         \u2591\u2588\u2588\u2588      \u2591\u2588\u2588\u2588"," \u2591\u2588\u2588\u2588    \u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588\u2591\u2591\u2588   \u2591\u2588\u2588\u2588         \u2591\u2588\u2588\u2588      \u2591\u2588\u2588\u2588"," \u2591\u2588\u2588\u2588    \u2588\u2588\u2588  \u2591\u2588\u2588\u2588 \u2591   \u2588\u2591\u2591\u2588\u2588\u2588     \u2588\u2588\u2588\u2591\u2591\u2588\u2588\u2588     \u2588\u2588\u2588 "," \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588 \u2591\u2591\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588  \u2591\u2591\u2591\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2591  ","\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591   \u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591   \u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591     \u2591\u2591\u2591\u2591\u2591\u2591\u2591   "],g0i=["#00ff64","#00ee5e","#00dc56","#00c84e","#00b444","#00a03c","#008832","#006e28"]});import{Box as k9l,Text as BSt}from"ink";import{jsx as j9l,jsxs as QSt}from"react/jsx-runtime";function h0i({version:i}){return QSt(k9l,{flexDirection:"column",marginTop:1,children:[_0i.map((t,u)=>j9l(BSt,{color:g0i[u],children:t},u)),QSt(BSt,{dimColor:!0,children:[" v",i]})]})}var hki=w(()=>{JW()});var PSt={};Gi(PSt,{subscribeLinkState:()=>rki,setMachine:()=>K9l,setLogPath:()=>R9l,setIngress:()=>b9l,setDaemonError:()=>H9l,setClusterUrl:()=>z9l,setCluster:()=>S9l,pushSandboxEvent:()=>L9l,getLinkState:()=>vki,applySandboxEvent:()=>YSt});function YSt(i,t){let u=new Map(i);if(t.phase==="evicted"||t.phase==="deleted")return u.delete(t.handle),u;let l=u.get(t.handle);return u.set(t.handle,{handle:t.handle,port:t.port??l?.port??null,previewUrl:t.previewUrl??l?.previewUrl??null,status:t.phase,error:t.phase==="failed"?t.error??"failed":null}),u}function M8(){for(let i of Eki)i()}function vki(){return t$}function rki(i){return Eki.add(i),()=>Eki.delete(i)}function S9l(i){t$={...t$,cluster:i},M8()}function z9l(i){t$={...t$,clusterUrl:i},M8()}function b9l(i,t){t$={...t$,ingressPort:i,ingressUrl:t},M8()}function K9l(i){t$={...t$,machine:i},M8()}function H9l(i){t$={...t$,daemonError:i},M8()}function R9l(i){t$={...t$,logPath:i},M8()}function L9l(i){t$={...t$,sandboxes:YSt(t$.sandboxes,i)},M8()}var t$,Eki;var wki=w(()=>{t$={cluster:"connecting",clusterUrl:null,ingressUrl:null,ingressPort:null,machine:null,cap:20,sandboxes:new Map,daemonError:null,logPath:null},Eki=new Set});var ASt={};Gi(ASt,{LinkApp:()=>M9l});import{Box as u$,Text as l$}from"ink";import{useSyncExternalStore as e9l}from"react";import{jsx as $1,jsxs as LE}from"react/jsx-runtime";function C9l(i){if(i.status==="ready")return{color:"green",text:"\u25CF Live"};if(i.status==="spawning")return{color:"yellow",text:"\u25CC Starting\u2026"};return{color:"red",text:`\u2717 Error: ${i.error??""}`}}function M9l(){let i=e9l(rki,vki),t=[...i.sandboxes.values()].sort((u,l)=>u.handle.localeCompare(l.handle));return LE(u$,{flexDirection:"column",children:[$1(h0i,{version:d0i.version}),$1(u$,{marginBottom:1,children:$1(l$,{dimColor:!0,children:"\u2500".repeat(80)})}),$1(u$,{children:i.cluster==="linked"?LE(l$,{color:"green",children:["\u2713 Connected to ",i.clusterUrl??"deco"]}):i.cluster==="connecting"?LE(l$,{color:"yellow",children:["\u25CC Connecting to ",i.clusterUrl??"deco","\u2026"]}):LE(l$,{color:"red",children:["\u2717 Disconnected from ",i.clusterUrl??"deco"]})}),$1(u$,{children:i.ingressUrl?LE(l$,{color:"green",children:["\u2713 Serving at ",i.ingressUrl]}):$1(l$,{dimColor:!0,children:"\u25CC Starting local server\u2026"})}),$1(u$,{marginBottom:1,children:$1(l$,{dimColor:!0,children:`${"Computer".padEnd(16)}${i.machine??"this computer"} \xB7 ${t.length} of ${i.cap} previews`})}),t.length===0?$1(l$,{dimColor:!0,children:"No previews running yet."}):LE(u$,{flexDirection:"column",children:[LE(u$,{children:[$1(u$,{width:E0i.project,flexShrink:0,marginRight:1,children:$1(l$,{dimColor:!0,wrap:"truncate-end",children:"PROJECT"})}),$1(u$,{width:E0i.status,flexShrink:0,marginRight:1,children:$1(l$,{dimColor:!0,wrap:"truncate-end",children:"STATUS"})}),$1(u$,{flexGrow:1,children:$1(l$,{dimColor:!0,wrap:"truncate-end",children:"PREVIEW URL"})})]}),t.map((u)=>{let l=C9l(u);return LE(u$,{children:[$1(u$,{width:E0i.project,flexShrink:0,marginRight:1,children:$1(l$,{wrap:"truncate-end",children:u.handle})}),$1(u$,{width:E0i.status,flexShrink:0,marginRight:1,children:$1(l$,{color:l.color,wrap:"truncate-end",children:l.text})}),$1(u$,{flexGrow:1,children:$1(l$,{dimColor:!0,wrap:"truncate-end",children:u.previewUrl??"\u2014"})})]},u.handle)})]}),i.daemonError?$1(u$,{marginTop:1,children:LE(l$,{color:"red",children:["\u26A0 ",i.daemonError]})}):null,i.logPath?$1(u$,{marginTop:1,children:LE(l$,{dimColor:!0,children:["Logs: ",i.logPath]})}):null]})}var E0i;var GSt=w(()=>{gki();hki();wki();E0i={project:18,status:14}});var kSt={};Gi(kSt,{runLinkCommand:()=>iNl});import{closeSync as q9l,mkdirSync as V9l,openSync as a9l,writeSync as m9l}from"fs";import{homedir as o9l}from"os";import{join as WSt}from"path";function s9l(i,t){let u={log:console.log,warn:console.warn,error:console.error},l=(n)=>{if(t===void 0)return;try{m9l(t,`${_ki(n)}
+Shutting down\u2026`),h();try{await r.close()}catch{}try{await f.stop()}catch{}try{await n.shutdown()}catch{}try{E.close()}catch{}x(0)};return process.on("SIGINT",()=>void X()),process.on("SIGTERM",()=>void X()),v=()=>{console.log("Disconnect requested from the Studio web UI \u2014 shutting down. Run `bunx decocms link` to reconnect."),X()},r.closed.then(()=>{if(i.monitor?.onCluster?.("closed"),!y)console.error("Cluster connection closed permanently; exiting."),X()}),{stopped:O,stop:X}}var ISt=w(()=>{lGi();jH();HPt();CPt();qPt();fSt();fki();DSt();ySt();NSt();kH();TSt()});function _ki(i){return i.map((t)=>typeof t==="string"?t:String(t)).join(" ")}var d0i;var gki=w(()=>{d0i={name:"decocms",version:"3.10.1",description:"Deco CMS \u2014 Self-hostable MCP Gateway for managing AI connections and tools",author:"Deco team",repository:{type:"git",url:"git+https://github.com/decocms/studio.git",directory:"apps/mesh"},bugs:{url:"https://github.com/decocms/studio/issues"},type:"module",bin:{deco:"./dist/server/cli.js"},files:["dist/**/*"],scripts:{dev:'bun run migrate && concurrently "bun run dev:client" "bun run dev:server"',"dev:servers":'concurrently "bun run dev:client" "bun run dev:server"',"dev:client":"vite dev","dev:server":"bun run --cwd=../../packages/sandbox build && NODE_ENV=development bun --env-file=.env --hot run src/index.ts","build:client":"bun --bun vite build","build:server":"bun run scripts/bundle-server-script.ts --dist ./dist/server","db:migrate":"bun run ./dist/server/migrate.js",check:"tsc --noEmit",start:"bun run ./dist/server/server.js",migrate:"bun run src/database/migrate.ts",test:"bun test","test:e2e":"playwright test","test:e2e:ui":"playwright test --ui","better-auth:migrate":"bunx --bun @better-auth/cli migrate -y --config src/auth/index.ts","smoke:link":"bun run scripts/smoke-link.ts",prepublishOnly:"bun run build:client && bun run build:server"},optionalDependencies:{"@anthropic-ai/claude-agent-sdk":"^0.2.141","@duckdb/node-api":"^1.5.0-r.1"},dependencies:{"@ai-sdk/anthropic":"^3.0.80","@ai-sdk/google":"^3.0.80","@ai-sdk/openai":"^3.0.65","@anthropic-ai/sdk":"^0.96.0","@aws-sdk/client-s3":"^3.1013.0","@aws-sdk/lib-storage":"^3.1013.0","@aws-sdk/s3-request-presigner":"^3.1013.0","@clickhouse/client":"^1.8.1","@dbos-inc/dbos-sdk":"^4.17.6","@dnd-kit/core":"^6.3.1","@dnd-kit/sortable":"^10.0.0","@dnd-kit/utilities":"^3.2.2","@inkjs/ui":"^2.0.0","@modelcontextprotocol/ext-apps":"^1.7.1","@openrouter/ai-sdk-provider":"^2.9.0","@opentelemetry/core":"^2.6.0","@tanstack/react-virtual":"3.13.24","@xterm/addon-fit":"^0.11.0","@xterm/xterm":"^6.0.0","embedded-postgres":"^18.3.0-beta.16",ink:"^6.8.0",kysely:"^0.28.12",nats:"^2.29.3","node-pty":"^1.0.0","posthog-js":"^1.371.1","posthog-node":"^5.0.0",react:"^19.2.6","react-dom":"^19.2.6"},devDependencies:{"@ai-sdk/provider":"^3.0.10","@ai-sdk/react":"^3.0.193","@better-auth/sso":"1.4.1","@daveyplate/better-auth-ui":"^3.2.7","@deco/ui":"workspace:*","@decocms/better-auth":"1.5.17","@decocms/bindings":"workspace:*","@decocms/harness":"workspace:*","@decocms/mcp-utils":"workspace:*","@decocms/mesh-sdk":"workspace:*","@decocms/runtime":"workspace:*","@decocms/sandbox":"workspace:*","@decocms/std":"workspace:*","@floating-ui/react":"^0.27.16","@happy-dom/global-registrator":"^20.9.0","@hookform/resolvers":"^5.2.2","@jitl/quickjs-wasmfile-release-sync":"0.31.0","@modelcontextprotocol/sdk":"1.29.0","@monaco-editor/react":"^4.7.0","@opentelemetry/api":"^1.9.0","@opentelemetry/api-logs":"^0.211.0","@opentelemetry/exporter-logs-otlp-proto":"^0.211.0","@opentelemetry/exporter-prometheus":"^0.208.0","@opentelemetry/exporter-trace-otlp-proto":"^0.207.0","@opentelemetry/instrumentation-runtime-node":"^0.24.0","@opentelemetry/resources":"^2.6.0","@opentelemetry/sdk-logs":"^0.211.0","@opentelemetry/sdk-metrics":"^2.2.0","@opentelemetry/sdk-node":"^0.207.0","@opentelemetry/sdk-trace-base":"^2.5.0","@playwright/test":"^1.58.2","@radix-ui/react-avatar":"^1.1.10","@radix-ui/react-checkbox":"^1.3.3","@radix-ui/react-dialog":"^1.1.15","@radix-ui/react-dropdown-menu":"^2.1.16","@radix-ui/react-label":"^2.1.7","@radix-ui/react-select":"^2.2.6","@radix-ui/react-separator":"^1.1.7","@radix-ui/react-slot":"^1.2.3","@radix-ui/react-tabs":"^1.1.13","@rjsf/core":"^6.1.2","@rjsf/shadcn":"^6.1.2","@rjsf/utils":"^6.1.2","@rjsf/validator-ajv8":"^6.1.2","@tailwindcss/vite":"^4.1.17","@tanstack/react-query":"5.100.10","@tanstack/react-router":"1.169.2","@testing-library/jest-dom":"^6.9.1","@testing-library/react":"^16.3.2","@tiptap/core":"3.20.2","@tiptap/extension-mention":"3.20.2","@tiptap/extension-placeholder":"3.20.2","@tiptap/pm":"3.20.2","@tiptap/react":"3.20.2","@tiptap/starter-kit":"3.20.2","@tiptap/suggestion":"3.20.2","@types/bun":"^1.3.1","@types/pg":"^8.15.6","@types/react-syntax-highlighter":"^15.5.13","@untitledui/icons":"^0.0.19","@vercel/nft":"^1.1.1","@vitejs/plugin-react":"^5.1.0",ai:"^6.0.191","babel-plugin-react-compiler":"^1.0.0","better-auth":"1.4.22","class-variance-authority":"^0.7.1",clsx:"^2.1.1",concurrently:"^9.2.1",croner:"^9.1.0","date-fns":"^4.1.0",degit:"^2.8.4",hono:"^4.10.7","input-otp":"^1.4.2",jose:"^6.0.11","lucide-react":"^0.468.0",marked:"^15.0.6","mesh-plugin-workflows":"workspace:*",nanoid:"^5.1.6",pg:"^8.16.3",prettier:"^3.4.2","react-hook-form":"^7.66.0","react-markdown":"^10.1.0","react-resizable-panels":"^2.1.7","react-syntax-highlighter":"^15.6.1",recharts:"^3.6.0","rehype-raw":"^7.0.0","remark-gfm":"^4.0.0","sass-embedded":"^1.97.2",sonner:"^2.0.7","tailwind-merge":"^3.3.1",tailwindcss:"^4.1.17",typescript:"^5.9.3",vite:"^7.2.1","vite-tsconfig-paths":"^5.1.4",zod:"^4.0.0",zustand:"^5.0.9"},homepage:"https://github.com/decocms/studio",keywords:["mcp","model-context-protocol","ai","gateway","self-hosted","mesh","tools"],license:"MIT",publishConfig:{access:"public"}}});var $R={};Gi($R,{printBanner:()=>W9l,bannerLines:()=>ZSt,BANNER_LINES:()=>_0i,BANNER_GRADIENT:()=>g0i});function G9l(i){let t=Number.parseInt(i.slice(1),16);return[t>>16&255,t>>8&255,t&255]}function ZSt(i){let t=_0i.map((u,l)=>{let[n,f,c]=G9l(g0i[l]);return`\x1B[38;2;${n};${f};${c}m${u}\x1B[39m`});if(i!==void 0)t.push(`\x1B[2m  v${i}\x1B[22m`);return t}function W9l(i){console.log("");for(let t of ZSt(i))console.log(t);console.log("")}var _0i,g0i;var JW=w(()=>{_0i=[" \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588     \u2588\u2588\u2588\u2588\u2588\u2588\u2588   ","\u2591\u2591\u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2588\u2588\u2588 \u2591\u2591\u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2591\u2588  \u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2591\u2588\u2588\u2588  \u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2591\u2588\u2588\u2588 "," \u2591\u2588\u2588\u2588   \u2591\u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588  \u2588 \u2591  \u2588\u2588\u2588     \u2591\u2591\u2591  \u2588\u2588\u2588     \u2591\u2591\u2588\u2588\u2588"," \u2591\u2588\u2588\u2588    \u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588\u2588\u2588\u2588   \u2591\u2588\u2588\u2588         \u2591\u2588\u2588\u2588      \u2591\u2588\u2588\u2588"," \u2591\u2588\u2588\u2588    \u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588\u2591\u2591\u2588   \u2591\u2588\u2588\u2588         \u2591\u2588\u2588\u2588      \u2591\u2588\u2588\u2588"," \u2591\u2588\u2588\u2588    \u2588\u2588\u2588  \u2591\u2588\u2588\u2588 \u2591   \u2588\u2591\u2591\u2588\u2588\u2588     \u2588\u2588\u2588\u2591\u2591\u2588\u2588\u2588     \u2588\u2588\u2588 "," \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588 \u2591\u2591\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588  \u2591\u2591\u2591\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2591  ","\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591   \u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591   \u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591     \u2591\u2591\u2591\u2591\u2591\u2591\u2591   "],g0i=["#00ff64","#00ee5e","#00dc56","#00c84e","#00b444","#00a03c","#008832","#006e28"]});import{Box as k9l,Text as BSt}from"ink";import{jsx as j9l,jsxs as QSt}from"react/jsx-runtime";function h0i({version:i}){return QSt(k9l,{flexDirection:"column",marginTop:1,children:[_0i.map((t,u)=>j9l(BSt,{color:g0i[u],children:t},u)),QSt(BSt,{dimColor:!0,children:[" v",i]})]})}var hki=w(()=>{JW()});var PSt={};Gi(PSt,{subscribeLinkState:()=>rki,setMachine:()=>K9l,setLogPath:()=>R9l,setIngress:()=>b9l,setDaemonError:()=>H9l,setClusterUrl:()=>z9l,setCluster:()=>S9l,pushSandboxEvent:()=>L9l,getLinkState:()=>vki,applySandboxEvent:()=>YSt});function YSt(i,t){let u=new Map(i);if(t.phase==="evicted"||t.phase==="deleted")return u.delete(t.handle),u;let l=u.get(t.handle);return u.set(t.handle,{handle:t.handle,port:t.port??l?.port??null,previewUrl:t.previewUrl??l?.previewUrl??null,status:t.phase,error:t.phase==="failed"?t.error??"failed":null}),u}function M8(){for(let i of Eki)i()}function vki(){return t$}function rki(i){return Eki.add(i),()=>Eki.delete(i)}function S9l(i){t$={...t$,cluster:i},M8()}function z9l(i){t$={...t$,clusterUrl:i},M8()}function b9l(i,t){t$={...t$,ingressPort:i,ingressUrl:t},M8()}function K9l(i){t$={...t$,machine:i},M8()}function H9l(i){t$={...t$,daemonError:i},M8()}function R9l(i){t$={...t$,logPath:i},M8()}function L9l(i){t$={...t$,sandboxes:YSt(t$.sandboxes,i)},M8()}var t$,Eki;var wki=w(()=>{t$={cluster:"connecting",clusterUrl:null,ingressUrl:null,ingressPort:null,machine:null,cap:20,sandboxes:new Map,daemonError:null,logPath:null},Eki=new Set});var ASt={};Gi(ASt,{LinkApp:()=>M9l});import{Box as u$,Text as l$}from"ink";import{useSyncExternalStore as e9l}from"react";import{jsx as $1,jsxs as LE}from"react/jsx-runtime";function C9l(i){if(i.status==="ready")return{color:"green",text:"\u25CF Live"};if(i.status==="spawning")return{color:"yellow",text:"\u25CC Starting\u2026"};return{color:"red",text:`\u2717 Error: ${i.error??""}`}}function M9l(){let i=e9l(rki,vki),t=[...i.sandboxes.values()].sort((u,l)=>u.handle.localeCompare(l.handle));return LE(u$,{flexDirection:"column",children:[$1(h0i,{version:d0i.version}),$1(u$,{marginBottom:1,children:$1(l$,{dimColor:!0,children:"\u2500".repeat(80)})}),$1(u$,{children:i.cluster==="linked"?LE(l$,{color:"green",children:["\u2713 Connected to ",i.clusterUrl??"deco"]}):i.cluster==="connecting"?LE(l$,{color:"yellow",children:["\u25CC Connecting to ",i.clusterUrl??"deco","\u2026"]}):LE(l$,{color:"red",children:["\u2717 Disconnected from ",i.clusterUrl??"deco"]})}),$1(u$,{children:i.ingressUrl?LE(l$,{color:"green",children:["\u2713 Serving at ",i.ingressUrl]}):$1(l$,{dimColor:!0,children:"\u25CC Starting local server\u2026"})}),$1(u$,{marginBottom:1,children:$1(l$,{dimColor:!0,children:`${"Computer".padEnd(16)}${i.machine??"this computer"} \xB7 ${t.length} of ${i.cap} previews`})}),t.length===0?$1(l$,{dimColor:!0,children:"No previews running yet."}):LE(u$,{flexDirection:"column",children:[LE(u$,{children:[$1(u$,{width:E0i.project,flexShrink:0,marginRight:1,children:$1(l$,{dimColor:!0,wrap:"truncate-end",children:"PROJECT"})}),$1(u$,{width:E0i.status,flexShrink:0,marginRight:1,children:$1(l$,{dimColor:!0,wrap:"truncate-end",children:"STATUS"})}),$1(u$,{flexGrow:1,children:$1(l$,{dimColor:!0,wrap:"truncate-end",children:"PREVIEW URL"})})]}),t.map((u)=>{let l=C9l(u);return LE(u$,{children:[$1(u$,{width:E0i.project,flexShrink:0,marginRight:1,children:$1(l$,{wrap:"truncate-end",children:u.handle})}),$1(u$,{width:E0i.status,flexShrink:0,marginRight:1,children:$1(l$,{color:l.color,wrap:"truncate-end",children:l.text})}),$1(u$,{flexGrow:1,children:$1(l$,{dimColor:!0,wrap:"truncate-end",children:u.previewUrl??"\u2014"})})]},u.handle)})]}),i.daemonError?$1(u$,{marginTop:1,children:LE(l$,{color:"red",children:["\u26A0 ",i.daemonError]})}):null,i.logPath?$1(u$,{marginTop:1,children:LE(l$,{dimColor:!0,children:["Logs: ",i.logPath]})}):null]})}var E0i;var GSt=w(()=>{gki();hki();wki();E0i={project:18,status:14}});var kSt={};Gi(kSt,{runLinkCommand:()=>iNl});import{closeSync as q9l,mkdirSync as V9l,openSync as a9l,writeSync as m9l}from"fs";import{homedir as o9l}from"os";import{join as WSt}from"path";function s9l(i,t){let u={log:console.log,warn:console.warn,error:console.error},l=(n)=>{if(t===void 0)return;try{m9l(t,`${_ki(n)}
 `)}catch{}};return console.log=(...n)=>l(n),console.warn=(...n)=>l(n),console.error=(...n)=>{l(n),i(_ki(n))},()=>{console.log=u.log,console.warn=u.warn,console.error=u.error}}async function p9l(i,t){let u;try{u=await fetch(`${i}/api/links/me`,{headers:{authorization:`Bearer ${t}`},signal:AbortSignal.timeout(1e4)})}catch{return}if(u.status===401||u.status===403)throw Error(`Authentication rejected by ${i} \u2014 the session token was not accepted. `+`Run \`deco auth login --target ${i}\` and try again.`)}async function iNl(i={}){let t=i.port??5174,u=i.dataDir??process.env.DATA_DIR??process.env.DECOCMS_HOME??WSt(o9l(),"deco"),l=i.clusterBaseUrl??process.env.MESH_CLUSTER_URL??"https://studio.decocms.com",n,f;try{let c=await Mui({dataDir:u,intent:"Link",target:l});if(process.env.DECOCMS_LINK_MANAGED!=="1")await p9l(l,c.accessToken);let $;if(i.tui){let{render:_}=await import("ink"),{createElement:g}=await import("react"),{LinkApp:h}=await Promise.resolve().then(() => (GSt(),ASt)),{pushSandboxEvent:E,setCluster:v,setClusterUrl:r,setDaemonError:x,setIngress:O,setLogPath:y,setMachine:X}=await Promise.resolve().then(() => (wki(),PSt));V9l(u,{recursive:!0});let N=WSt(u,"link.log");f=a9l(N,"a"),y(N),r(l),v("connecting"),$={onEvent:(U)=>E(U),onIngress:(U)=>O(U,`http://127.0.0.1:${U}`),onCluster:(U)=>v(U),onMachine:(U)=>X(U)},n=s9l(x,f),_(g(h),{patchConsole:!1})}else if(i.banner!==!1){let{printBanner:_}=await Promise.resolve().then(() => (JW(),$R));_(i.version??"0.0.0")}return await(await FSt({port:t,clusterBaseUrl:l,dataDir:u,session:c,monitor:$,logFd:f,hotReload:i.hotReload})).stopped}catch(c){return n?.(),console.error(c instanceof Error?c.message:String(c)),1}finally{if(n?.(),f!==void 0)try{q9l(f)}catch{}}}var jSt=w(()=>{uGi();ISt()});var Nki={};Gi(Nki,{resolveDevLinkClusterUrl:()=>nNl,populateDevLinkToxiProxy:()=>RSt,isDevLinkToxiProxyEnabled:()=>lNl,ensureDevLinkToxiProxy:()=>_Nl,buildDevLinkToxiProxyConfig:()=>KSt,DEV_LINK_TOXIPROXY_SERVICE_NAME:()=>zSt,DEV_LINK_TOXIPROXY_PROXY_NAME:()=>bSt});function lNl(i=process.env){return i.DECO_DEV_LINK_TOXIPROXY==="1"}function xki(i,t){if(!Number.isInteger(i)||i<1||i>65535)throw Error(`${t} must be an integer port in 1..65535`);return i}function KSt(i){let t=new URL(i.serverUrl);if(t.protocol!=="http:")throw Error("DECO_DEV_LINK_TOXIPROXY only supports http local Studio URLs");let u=xki(i.apiPort,"apiPort"),l=xki(i.listenPort,"listenPort");if(t.port.length===0)throw Error("serverUrl must include an explicit valid port");let n=xki(Number.parseInt(t.port,10),"upstreamPort"),f=`http://127.0.0.1:${n}`,c=`http://127.0.0.1:${l}`;return{serviceName:zSt,proxyName:bSt,apiUrl:`http://127.0.0.1:${u}`,listen:`0.0.0.0:${l}`,upstream:`host.docker.internal:${n}`,publicTargetUrl:f,clusterUrl:c,logLine:`[dev-link-toxiproxy] ready: ${c} -> ${f}`}}function nNl(i){return i.toxiproxy?.clusterUrl??i.serverUrl}async function Dki(i,t,u){if(i.ok)return;let l=await i.text();throw Error(`ToxiProxy ${t} failed for ${u}: status=${i.status} statusText=${i.statusText} body=${l}`)}function Xki(i){if(i instanceof Error)return i.name==="Error"?i.message:`${i.name}: ${i.message}`;return String(i)}function HSt(i){if(!(i instanceof Error))return!1;if(i.name==="TimeoutError")return!0;return HSt(i.cause)}async function Oki(i,t,u,l){try{return await i(u,l)}catch(n){throw Error(`ToxiProxy ${t} failed for ${u}: ${Xki(n)}`,{cause:n})}}async function RSt(i,t=fetch){let u=`${i.apiUrl}/reset`,l=await Oki(t,"reset",u,{method:"POST"});await Dki(l,"reset",u);let n=`${i.apiUrl}/populate`,f=await Oki(t,"populate",n,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify([{name:i.proxyName,listen:i.listen,upstream:i.upstream,enabled:!0}])});await Dki(f,"populate",n)}async function fNl(i,t){let u=`${i.apiUrl}/version`;try{await Tr(async()=>{let l=await Oki(t,"readiness check",u,{method:"GET",signal:AbortSignal.timeout(uNl)});await Dki(l,"readiness check",u)},{maxAttempts:tNl,minTimeout:SSt,maxTimeout:SSt,multiplier:1,jitter:0,isRetriable:(l)=>!HSt(l)})}catch(l){let n=l instanceof K6?l.cause:l;throw Error(`ToxiProxy API did not become ready at ${u}: ${Xki(n)}`,{cause:n})}}async function cNl(i){if(i===null)return"";return await new Response(i).text()}async function yki(i,t={}){let u=["docker",...i].join(" "),l=(()=>{try{return Bun.spawn(["docker",...i],{stdout:"ignore",stderr:"pipe"})}catch($){throw Error(`Docker command failed to start (${u}): ${Xki($)}`,{cause:$})}})(),[n,f]=await Promise.all([l.exited,cNl(l.stderr)]);if(n===0||t.ignoreFailure===!0)return;let c=f.trim().length>0?`: ${f.trim()}`:"";throw Error(`Docker command failed (${u}) with exit ${n}${c}`)}async function $Nl(i,t){let u=`deco-dev-link-toxiproxy-${i}`;await yki(["rm","-f",u],{ignoreFailure:!0}),await yki(["run","--rm","-d","--name",u,"-p",`127.0.0.1:${i}:8474`,"-p",`127.0.0.1:${t}:${t}`,"ghcr.io/shopify/toxiproxy:2.12.0","-host=0.0.0.0"])}async function dNl(i,t){let u=`deco-dev-link-toxiproxy-${i}`;await yki(["rm","-f",u],{ignoreFailure:!0})}async function _Nl(i){let t=KSt(i),u=i.startDaemon??$Nl,l=i.stopDaemon??(i.startDaemon===void 0?dNl:void 0);await u(i.apiPort,i.listenPort);let n=i.fetchImpl??fetch;try{await fNl(t,n),await RSt(t,n)}catch(f){if(l!==void 0)try{await l(i.apiPort,i.listenPort)}catch{}throw f}return{config:t,stop:async()=>{if(l!==void 0)await l(i.apiPort,i.listenPort)}}}var zSt="ToxiProxy",bSt="dev_link_studio",tNl=20,SSt=100,uNl=100;var Jki=w(()=>{n1()});var LSt={};Gi(LSt,{migrateBetterAuth:()=>Uki});import{getMigrations as gNl}from"better-auth/db";import{sso as hNl}from"@better-auth/sso";import{organization as ENl}from"@decocms/better-auth/plugins";import{admin as vNl,apiKey as rNl,jwt as wNl,magicLink as xNl,mcp as DNl,openAPI as ONl}from"better-auth/plugins";import{emailOTP as yNl}from"better-auth/plugins/email-otp";async function Uki(i){let u={database:PH(i||Ww()),plugins:[ENl({dynamicAccessControl:{enabled:!0,enableCustomResources:!0}}),vNl(),rNl(),wNl(),ONl(),DNl({loginPage:"/login"}),hNl(),xNl({sendMagicLink:async()=>{}}),yNl({sendVerificationOTP:async()=>{}})]},{toBeAdded:l,toBeCreated:n,runMigrations:f}=await gNl(u);if(!l.length&&!n.length)return"up to date";return await f(),`${n.length+l.length} table(s) migrated`}var Tki=w(()=>{Nd()});var Fki={};Gi(Fki,{up:()=>XNl,down:()=>NNl});import{sql as eE}from"kysely";async function XNl(i){await i.schema.createTable("connections").addColumn("id","text",(t)=>t.primaryKey()).addColumn("organizationId","text",(t)=>t.notNull().references("organization.id").onDelete("cascade")).addColumn("createdById","text",(t)=>t.notNull().references("user.id").onDelete("cascade")).addColumn("name","text",(t)=>t.notNull()).addColumn("description","text").addColumn("icon","text").addColumn("appName","text").addColumn("appId","text").addColumn("connectionType","text",(t)=>t.notNull()).addColumn("connectionUrl","text",(t)=>t.notNull()).addColumn("connectionToken","text").addColumn("connectionHeaders","text").addColumn("oauthConfig","text").addColumn("metadata","text").addColumn("tools","text").addColumn("bindings","text").addColumn("status","text",(t)=>t.notNull().defaultTo("active")).addColumn("createdAt","text",(t)=>t.notNull().defaultTo(eE`CURRENT_TIMESTAMP`)).addColumn("updatedAt","text",(t)=>t.notNull().defaultTo(eE`CURRENT_TIMESTAMP`)).execute(),await i.schema.createTable("api_keys").addColumn("id","text",(t)=>t.primaryKey()).addColumn("userId","text",(t)=>t.notNull().references("user.id").onDelete("cascade")).addColumn("name","text",(t)=>t.notNull()).addColumn("hashedKey","text",(t)=>t.notNull().unique()).addColumn("permissions","text",(t)=>t.notNull()).addColumn("expiresAt","text").addColumn("remaining","integer").addColumn("metadata","text").addColumn("createdAt","text",(t)=>t.notNull().defaultTo(eE`CURRENT_TIMESTAMP`)).addColumn("updatedAt","text",(t)=>t.notNull().defaultTo(eE`CURRENT_TIMESTAMP`)).execute(),await i.schema.createTable("audit_logs").addColumn("id","text",(t)=>t.primaryKey()).addColumn("organizationId","text").addColumn("userId","text",(t)=>t.references("user.id").onDelete("set null")).addColumn("connectionId","text",(t)=>t.references("connections.id").onDelete("set null")).addColumn("toolName","text",(t)=>t.notNull()).addColumn("allowed","integer",(t)=>t.notNull()).addColumn("duration","integer").addColumn("timestamp","text",(t)=>t.notNull().defaultTo(eE`CURRENT_TIMESTAMP`)).addColumn("requestMetadata","text").execute(),await i.schema.createTable("oauth_clients").addColumn("id","text",(t)=>t.primaryKey()).addColumn("clientId","text",(t)=>t.notNull().unique()).addColumn("clientSecret","text").addColumn("clientName","text",(t)=>t.notNull()).addColumn("redirectUris","text",(t)=>t.notNull()).addColumn("grantTypes","text",(t)=>t.notNull()).addColumn("scope","text").addColumn("clientUri","text").addColumn("logoUri","text").addColumn("createdAt","text",(t)=>t.notNull().defaultTo(eE`CURRENT_TIMESTAMP`)).execute(),await i.schema.createTable("oauth_authorization_codes").addColumn("code","text",(t)=>t.primaryKey()).addColumn("clientId","text",(t)=>t.notNull().references("oauth_clients.clientId").onDelete("cascade")).addColumn("userId","text",(t)=>t.notNull().references("user.id").onDelete("cascade")).addColumn("redirectUri","text",(t)=>t.notNull()).addColumn("scope","text").addColumn("codeChallenge","text").addColumn("codeChallengeMethod","text").addColumn("expiresAt","text",(t)=>t.notNull()).addColumn("createdAt","text",(t)=>t.notNull().defaultTo(eE`CURRENT_TIMESTAMP`)).execute(),await i.schema.createTable("oauth_refresh_tokens").addColumn("token","text",(t)=>t.primaryKey()).addColumn("clientId","text",(t)=>t.notNull().references("oauth_clients.clientId").onDelete("cascade")).addColumn("userId","text",(t)=>t.notNull().references("user.id").onDelete("cascade")).addColumn("scope","text").addColumn("expiresAt","text").addColumn("createdAt","text",(t)=>t.notNull().defaultTo(eE`CURRENT_TIMESTAMP`)).execute(),await i.schema.createTable("downstream_tokens").addColumn("id","text",(t)=>t.primaryKey()).addColumn("connectionId","text",(t)=>t.notNull().references("connections.id").onDelete("cascade")).addColumn("userId","text",(t)=>t.references("user.id").onDelete("cascade")).addColumn("accessToken","text",(t)=>t.notNull()).addColumn("refreshToken","text").addColumn("scope","text").addColumn("expiresAt","text").addColumn("createdAt","text",(t)=>t.notNull().defaultTo(eE`CURRENT_TIMESTAMP`)).addColumn("updatedAt","text",(t)=>t.notNull().defaultTo(eE`CURRENT_TIMESTAMP`)).execute(),await i.schema.createIndex("idx_connections_organizationId").on("connections").column("organizationId").execute(),await i.schema.createIndex("idx_audit_logs_organizationId").on("audit_logs").column("organizationId").execute(),await i.schema.createIndex("idx_audit_logs_userId").on("audit_logs").column("userId").execute(),await i.schema.createIndex("idx_audit_logs_timestamp").on("audit_logs").column("timestamp").execute()}async function NNl(i){await i.schema.dropTable("downstream_tokens").execute(),await i.schema.dropTable("oauth_refresh_tokens").execute(),await i.schema.dropTable("oauth_authorization_codes").execute(),await i.schema.dropTable("oauth_clients").execute(),await i.schema.dropTable("audit_logs").execute(),await i.schema.dropTable("api_keys").execute(),await i.schema.dropTable("connections").execute()}var eSt=()=>{};var Iki={};Gi(Iki,{up:()=>JNl,down:()=>UNl});import{sql as CSt}from"kysely";async function JNl(i){await i.schema.createTable("organization_settings").addColumn("organizationId","text",(t)=>t.primaryKey().references("organization.id").onDelete("cascade")).addColumn("modelsBindingConnectionId","text",(t)=>t.references("connections.id").onDelete("set null")).addColumn("createdAt","text",(t)=>t.notNull().defaultTo(CSt`CURRENT_TIMESTAMP`)).addColumn("updatedAt","text",(t)=>t.notNull().defaultTo(CSt`CURRENT_TIMESTAMP`)).execute()}async function UNl(i){await i.schema.dropTable("organization_settings").execute()}var MSt=()=>{};var Zki={};Gi(Zki,{up:()=>TNl,down:()=>FNl});async function TNl(i){await i.schema.alterTable("connections").renameColumn("name","title").execute(),await i.schema.alterTable("connections").renameColumn("createdById","created_by").execute(),await i.schema.alterTable("connections").renameColumn("createdAt","created_at").execute(),await i.schema.alterTable("connections").renameColumn("updatedAt","updated_at").execute(),await i.schema.alterTable("connections").renameColumn("organizationId","organization_id").execute(),await i.schema.alterTable("connections").renameColumn("connectionType","connection_type").execute(),await i.schema.alterTable("connections").renameColumn("connectionUrl","connection_url").execute(),await i.schema.alterTable("connections").renameColumn("connectionToken","connection_token").execute(),await i.schema.alterTable("connections").renameColumn("connectionHeaders","connection_headers").execute(),await i.schema.alterTable("connections").renameColumn("oauthConfig","oauth_config").execute(),await i.schema.alterTable("connections").renameColumn("appName","app_name").execute(),await i.schema.alterTable("connections").renameColumn("appId","app_id").execute()}async function FNl(i){await i.schema.alterTable("connections").renameColumn("title","name").execute(),await i.schema.alterTable("connections").renameColumn("created_by","createdById").execute(),await i.schema.alterTable("connections").renameColumn("created_at","createdAt").execute(),await i.schema.alterTable("connections").renameColumn("updated_at","updatedAt").execute(),await i.schema.alterTable("connections").renameColumn("organization_id","organizationId").execute(),await i.schema.alterTable("connections").renameColumn("connection_type","connectionType").execute(),await i.schema.alterTable("connections").renameColumn("connection_url","connectionUrl").execute(),await i.schema.alterTable("connections").renameColumn("connection_token","connectionToken").execute(),await i.schema.alterTable("connections").renameColumn("connection_headers","connectionHeaders").execute(),await i.schema.alterTable("connections").renameColumn("oauth_config","oauthConfig").execute(),await i.schema.alterTable("connections").renameColumn("app_name","appName").execute(),await i.schema.alterTable("connections").renameColumn("app_id","appId").execute()}var Bki={};Gi(Bki,{up:()=>INl,down:()=>ZNl});async function INl(i){await i.schema.createTable("organization_settings_new").addColumn("organizationId","text",(t)=>t.primaryKey().references("organization.id").onDelete("cascade")).addColumn("createdAt","text",(t)=>t.notNull()).addColumn("updatedAt","text",(t)=>t.notNull()).execute(),await i.insertInto("organization_settings_new").columns(["organizationId","createdAt","updatedAt"]).expression((t)=>t.selectFrom("organization_settings").select(["organizationId","createdAt","updatedAt"])).execute(),await i.schema.dropTable("organization_settings").execute(),await i.schema.alterTable("organization_settings_new").renameTo("organization_settings").execute()}async function ZNl(i){await i.schema.createTable("organization_settings_new").addColumn("organizationId","text",(t)=>t.primaryKey().references("organization.id").onDelete("cascade")).addColumn("modelsBindingConnectionId","text",(t)=>t.references("connections.id").onDelete("set null")).addColumn("createdAt","text",(t)=>t.notNull()).addColumn("updatedAt","text",(t)=>t.notNull()).execute(),await i.insertInto("organization_settings_new").columns(["organizationId","modelsBindingConnectionId","createdAt","updatedAt"]).expression((t)=>t.selectFrom("organization_settings").select(["organizationId",t.val(null).as("modelsBindingConnectionId"),"createdAt","updatedAt"])).execute(),await i.schema.dropTable("organization_settings").execute(),await i.schema.alterTable("organization_settings_new").renameTo("organization_settings").execute()}var Qki={};Gi(Qki,{up:()=>BNl,down:()=>QNl});async function BNl(i){await i.schema.alterTable("connections").addColumn("configuration_state","text").execute(),await i.schema.alterTable("connections").addColumn("configuration_scopes","text").execute()}async function QNl(i){await i.schema.alterTable("connections").dropColumn("configuration_state").execute(),await i.schema.alterTable("connections").dropColumn("configuration_scopes").execute()}var Yki={};Gi(Yki,{up:()=>PNl,down:()=>ANl});import{sql as YNl}from"kysely";async function PNl(i){await i.schema.alterTable("organization_settings").addColumn("sidebar_items",YNl`text`).execute()}async function ANl(i){await i.schema.alterTable("organization_settings").dropColumn("sidebar_items").execute()}var qSt=()=>{};var Pki={};Gi(Pki,{up:()=>GNl,down:()=>WNl});async function GNl(i){await i.schema.createTable("monitoring_logs").addColumn("id","text",(t)=>t.primaryKey()).addColumn("organization_id","text",(t)=>t.notNull().references("organization.id").onDelete("cascade")).addColumn("connection_id","text",(t)=>t.notNull().references("connections.id").onDelete("cascade")).addColumn("connection_title","text",(t)=>t.notNull()).addColumn("tool_name","text",(t)=>t.notNull()).addColumn("input","text",(t)=>t.notNull()).addColumn("output","text",(t)=>t.notNull()).addColumn("is_error","integer",(t)=>t.notNull()).addColumn("error_message","text").addColumn("duration_ms","integer",(t)=>t.notNull()).addColumn("timestamp","text",(t)=>t.notNull()).addColumn("user_id","text").addColumn("request_id","text",(t)=>t.notNull()).execute(),await i.schema.createIndex("monitoring_logs_org_timestamp").on("monitoring_logs").columns(["organization_id","timestamp"]).execute(),await i.schema.createIndex("monitoring_logs_connection_timestamp").on("monitoring_logs").columns(["connection_id","timestamp"]).execute(),await i.schema.createIndex("monitoring_logs_is_error").on("monitoring_logs").columns(["organization_id","is_error","timestamp"]).execute()}async function WNl(i){await i.schema.dropIndex("monitoring_logs_is_error").execute(),await i.schema.dropIndex("monitoring_logs_connection_timestamp").execute(),await i.schema.dropIndex("monitoring_logs_org_timestamp").execute(),await i.schema.dropTable("monitoring_logs").execute()}var Aki={};Gi(Aki,{up:()=>kNl,down:()=>jNl});import{sql as dR}from"kysely";async function kNl(i){await i.schema.createTable("events").addColumn("id","text",(t)=>t.primaryKey()).addColumn("organization_id","text",(t)=>t.notNull().references("organization.id").onDelete("cascade")).addColumn("type","text",(t)=>t.notNull()).addColumn("source","text",(t)=>t.notNull()).addColumn("specversion","text",(t)=>t.notNull().defaultTo("1.0")).addColumn("subject","text").addColumn("time","text",(t)=>t.notNull()).addColumn("datacontenttype","text",(t)=>t.notNull().defaultTo("application/json")).addColumn("dataschema","text").addColumn("data","text").addColumn("cron","varchar(255)").addColumn("status","text",(t)=>t.notNull().defaultTo("pending")).addColumn("attempts","integer",(t)=>t.notNull().defaultTo(0)).addColumn("last_error","text").addColumn("next_retry_at","text").addColumn("created_at","text",(t)=>t.notNull().defaultTo(dR`CURRENT_TIMESTAMP`)).addColumn("updated_at","text",(t)=>t.notNull().defaultTo(dR`CURRENT_TIMESTAMP`)).execute(),await i.schema.createTable("event_subscriptions").addColumn("id","text",(t)=>t.primaryKey()).addColumn("organization_id","text",(t)=>t.notNull().references("organization.id").onDelete("cascade")).addColumn("connection_id","text",(t)=>t.notNull().references("connections.id").onDelete("cascade")).addColumn("publisher","text").addColumn("event_type","text",(t)=>t.notNull()).addColumn("filter","text").addColumn("enabled","integer",(t)=>t.notNull().defaultTo(1)).addColumn("created_at","text",(t)=>t.notNull().defaultTo(dR`CURRENT_TIMESTAMP`)).addColumn("updated_at","text",(t)=>t.notNull().defaultTo(dR`CURRENT_TIMESTAMP`)).execute(),await i.schema.createTable("event_deliveries").addColumn("id","text",(t)=>t.primaryKey()).addColumn("event_id","text",(t)=>t.notNull()).addColumn("subscription_id","text",(t)=>t.notNull().references("event_subscriptions.id").onDelete("cascade")).addColumn("status","text",(t)=>t.notNull().defaultTo("pending")).addColumn("attempts","integer",(t)=>t.notNull().defaultTo(0)).addColumn("last_error","text").addColumn("delivered_at","text").addColumn("next_retry_at","text").addColumn("created_at","text",(t)=>t.notNull().defaultTo(dR`CURRENT_TIMESTAMP`)).execute(),await i.schema.createIndex("idx_events_org_status").on("events").columns(["organization_id","status"]).execute(),await i.schema.createIndex("idx_events_source").on("events").columns(["source"]).execute(),await i.schema.createIndex("idx_events_type").on("events").columns(["type"]).execute(),await i.schema.createIndex("idx_events_retry").on("events").columns(["status","next_retry_at"]).execute(),await i.schema.createIndex("idx_subscriptions_connection").on("event_subscriptions").columns(["connection_id"]).execute(),await i.schema.createIndex("idx_subscriptions_type").on("event_subscriptions").columns(["event_type"]).execute(),await i.schema.createIndex("idx_subscriptions_org_enabled").on("event_subscriptions").columns(["organization_id","enabled"]).execute(),await i.schema.createIndex("idx_subscriptions_unique").on("event_subscriptions").columns(["connection_id","event_type","publisher","filter"]).unique().execute(),await i.schema.createIndex("idx_deliveries_event").on("event_deliveries").columns(["event_id"]).execute(),await i.schema.createIndex("idx_deliveries_subscription_status").on("event_deliveries").columns(["subscription_id","status"]).execute(),await i.schema.createIndex("idx_deliveries_retry").on("event_deliveries").columns(["status","next_retry_at"]).execute()}async function jNl(i){await i.schema.dropIndex("idx_deliveries_retry").execute(),await i.schema.dropIndex("idx_deliveries_subscription_status").execute(),await i.schema.dropIndex("idx_deliveries_event").execute(),await i.schema.dropIndex("idx_subscriptions_unique").execute(),await i.schema.dropIndex("idx_subscriptions_org_enabled").execute(),await i.schema.dropIndex("idx_subscriptions_type").execute(),await i.schema.dropIndex("idx_subscriptions_connection").execute(),await i.schema.dropIndex("idx_events_retry").execute(),await i.schema.dropIndex("idx_events_type").execute(),await i.schema.dropIndex("idx_events_source").execute(),await i.schema.dropIndex("idx_events_org_status").execute(),await i.schema.dropTable("event_deliveries").execute(),await i.schema.dropTable("event_subscriptions").execute(),await i.schema.dropTable("events").execute()}var VSt=()=>{};var Gki={};Gi(Gki,{up:()=>zNl,down:()=>bNl});import{sql as SNl}from"kysely";async function zNl(i){await i.schema.dropTable("audit_logs").ifExists().execute()}async function bNl(i){await i.schema.createTable("audit_logs").ifNotExists().addColumn("id","text",(t)=>t.primaryKey()).addColumn("organizationId","text").addColumn("userId","text",(t)=>t.references("user.id").onDelete("set null")).addColumn("connectionId","text",(t)=>t.references("connections.id").onDelete("set null")).addColumn("toolName","text",(t)=>t.notNull()).addColumn("allowed","integer",(t)=>t.notNull()).addColumn("duration","integer").addColumn("timestamp","text",(t)=>t.notNull().defaultTo(SNl`CURRENT_TIMESTAMP`)).addColumn("requestMetadata","text").execute(),await i.schema.createIndex("idx_audit_logs_organizationId").on("audit_logs").column("organizationId").execute(),await i.schema.createIndex("idx_audit_logs_userId").on("audit_logs").column("userId").execute(),await i.schema.createIndex("idx_audit_logs_timestamp").on("audit_logs").column("timestamp").execute()}var aSt=()=>{};var Wki={};Gi(Wki,{up:()=>KNl,down:()=>HNl});import{sql as v0i}from"kysely";async function KNl(i){await i.schema.createTable("gateways").addColumn("id","text",(t)=>t.primaryKey()).addColumn("organization_id","text",(t)=>t.notNull().references("organization.id").onDelete("cascade")).addColumn("title","text",(t)=>t.notNull()).addColumn("description","text").addColumn("tool_selection_strategy","text").addColumn("status","text",(t)=>t.notNull().defaultTo("active")).addColumn("is_default","integer",(t)=>t.notNull().defaultTo(0)).addColumn("created_at","text",(t)=>t.notNull().defaultTo(v0i`CURRENT_TIMESTAMP`)).addColumn("updated_at","text",(t)=>t.notNull().defaultTo(v0i`CURRENT_TIMESTAMP`)).addColumn("created_by","text",(t)=>t.notNull().references("user.id").onDelete("cascade")).addColumn("updated_by","text").execute(),await i.schema.createTable("gateway_connections").addColumn("id","text",(t)=>t.primaryKey()).addColumn("gateway_id","text",(t)=>t.notNull().references("gateways.id").onDelete("cascade")).addColumn("connection_id","text",(t)=>t.notNull().references("connections.id").onDelete("cascade")).addColumn("selected_tools","text").addColumn("created_at","text",(t)=>t.notNull().defaultTo(v0i`CURRENT_TIMESTAMP`)).execute(),await i.schema.createIndex("idx_gateways_org").on("gateways").columns(["organization_id"]).execute(),await i.schema.createIndex("idx_gateways_org_status").on("gateways").columns(["organization_id","status"]).execute(),await v0i`CREATE UNIQUE INDEX idx_gateways_default_per_org ON gateways (organization_id) WHERE is_default = 1`.execute(i),await i.schema.createIndex("idx_gateway_connections_gateway").on("gateway_connections").columns(["gateway_id"]).execute(),await i.schema.createIndex("idx_gateway_connections_connection").on("gateway_connections").columns(["connection_id"]).execute(),await i.schema.createIndex("idx_gateway_connections_unique").on("gateway_connections").columns(["gateway_id","connection_id"]).unique().execute()}async function HNl(i){await i.schema.dropIndex("idx_gateway_connections_unique").execute(),await i.schema.dropIndex("idx_gateway_connections_connection").execute(),await i.schema.dropIndex("idx_gateway_connections_gateway").execute(),await i.schema.dropIndex("idx_gateways_default_per_org").execute(),await i.schema.dropIndex("idx_gateways_org_status").execute(),await i.schema.dropIndex("idx_gateways_org").execute(),await i.schema.dropTable("gateway_connections").execute(),await i.schema.dropTable("gateways").execute()}var mSt=()=>{};var kki={};Gi(kki,{up:()=>RNl,down:()=>LNl});async function RNl(i){await i.schema.alterTable("gateways").addColumn("icon","text").execute()}async function LNl(i){await i.schema.alterTable("gateways").dropColumn("icon").execute()}var jki={};Gi(jki,{up:()=>eNl,down:()=>CNl});import{sql as r0i}from"kysely";async function eNl(i){await i.schema.alterTable("gateways").addColumn("tool_selection_mode","text",(t)=>t.notNull().defaultTo("inclusion")).execute(),await r0i`
     UPDATE gateways
     SET tool_selection_mode = CASE
@@ -107859,7 +107859,7 @@ Hint: Configure a valid Google account email in Monitor Configuration > Contexto
 `);let l=t.pax;if(l)for(let n in l)u+=gut(" "+n+"="+l[n]+`
 `);return o0.from(u)};wN0.decodePax=function(t){let u={};while(t.length){let l=0;while(l<t.length&&t[l]!==32)l++;let n=parseInt(o0.toString(t.subarray(0,l)),10);if(!n)return u;let f=o0.toString(t.subarray(l+1,n-1)),c=f.indexOf("=");if(c===-1)return u;u[f.slice(0,c)]=f.slice(c+1),t=t.subarray(n)}return u};wN0.encode=function(t){let u=o0.alloc(512),l=t.name,n="";if(t.typeflag===5&&l[l.length-1]!=="/")l+="/";if(o0.byteLength(l)!==l.length)return null;while(o0.byteLength(l)>100){let f=l.indexOf("/");if(f===-1)return null;n+=n?"/"+l.slice(0,f):l.slice(0,f),l=l.slice(f+1)}if(o0.byteLength(l)>100||o0.byteLength(n)>155)return null;if(t.linkname&&o0.byteLength(t.linkname)>100)return null;if(o0.write(u,l),o0.write(u,fD(t.mode&4095,6),100),o0.write(u,fD(t.uid,6),108),o0.write(u,fD(t.gid,6),116),vN0(t.size,u,124),o0.write(u,fD(t.mtime.getTime()/1000|0,11),136),u[156]=48+hN0(t.type),t.linkname)o0.write(u,t.linkname,157);if(o0.copy(IJu,u,257),o0.copy(nN0,u,263),t.uname)o0.write(u,t.uname,265);if(t.gname)o0.write(u,t.gname,297);if(o0.write(u,fD(t.devmajor||0,6),329),o0.write(u,fD(t.devminor||0,6),337),n)o0.write(u,n,345);return o0.write(u,fD(BJu(u),6),148),u};wN0.decode=function(t,u,l){let n=t[156]===0?0:t[156]-48,f=Wz(t,0,100,u),c=nD(t,100,8),$=nD(t,108,8),d=nD(t,116,8),_=nD(t,124,12),g=nD(t,136,12),h=gN0(n),E=t[157]===0?null:Wz(t,157,100,u),v=Wz(t,265,32),r=Wz(t,297,32),x=nD(t,329,8),O=nD(t,337,8),y=BJu(t);if(y===256)return null;if(y!==nD(t,148,8))throw Error("Invalid tar header. Maybe the tar is corrupted or it needs to be gunzipped?");if($N0(t)){if(t[345])f=Wz(t,345,155,u)+"/"+f}else if(dN0(t));else if(!l)throw Error("Invalid tar header: unknown format.");if(n===0&&f&&f[f.length-1]==="/")n=5;return{name:f,mode:c,uid:$,gid:d,size:_,mtime:new Date(1000*g),type:h,linkname:E,uname:v,gname:r,devmajor:x,devminor:O,pax:null}};function $N0(i){return o0.equals(IJu,i.subarray(257,263))}function dN0(i){return o0.equals(fN0,i.subarray(257,263))&&o0.equals(cN0,i.subarray(263,265))}function _N0(i,t,u){if(typeof i!=="number")return u;if(i=~~i,i>=t)return t;if(i>=0)return i;if(i+=t,i>=0)return i;return 0}function gN0(i){switch(i){case 0:return"file";case 1:return"link";case 2:return"symlink";case 3:return"character-device";case 4:return"block-device";case 5:return"directory";case 6:return"fifo";case 7:return"contiguous-file";case 72:return"pax-header";case 55:return"pax-global-header";case 27:return"gnu-long-link-path";case 28:case 30:return"gnu-long-path"}return null}function hN0(i){switch(i){case"file":return 0;case"link":return 1;case"symlink":return 2;case"character-device":return 3;case"block-device":return 4;case"directory":return 5;case"fifo":return 6;case"contiguous-file":return 7;case"pax-header":return 72}return 0}function ZJu(i,t,u,l){for(;u<l;u++)if(i[u]===t)return u;return l}function BJu(i){let t=256;for(let u=0;u<148;u++)t+=i[u];for(let u=156;u<512;u++)t+=i[u];return t}function fD(i,t){if(i=i.toString(8),i.length>t)return"7777777777777777777".slice(0,t)+" ";return"0000000000000000000".slice(0,t-i.length)+i+" "}function EN0(i,t,u){t[u]=128;for(let l=11;l>0;l--)t[u+l]=i&255,i=Math.floor(i/256)}function vN0(i,t,u){if(i.toString(8).length>11)EN0(i,t,u);else o0.write(t,fD(i,11),u)}function rN0(i){let t;if(i[0]===128)t=!0;else if(i[0]===255)t=!1;else return null;let u=[],l;for(l=i.length-1;l>0;l--){let c=i[l];if(t)u.push(c);else u.push(255-c)}let n=0,f=u.length;for(l=0;l<f;l++)n+=u[l]*Math.pow(256,l);return t?n:-1*n}function nD(i,t,u){if(i=i.subarray(t,t+u),t=0,i[t]&128)return rN0(i);else{while(t<i.length&&i[t]===32)t++;let l=_N0(ZJu(i,32,t,i.length),i.length,i.length);while(t<l&&i[t]===0)t++;if(l===t)return 0;return parseInt(o0.toString(i.subarray(t,l)),8)}}function Wz(i,t,u,l){return o0.toString(i.subarray(t,ZJu(i,0,t,t+u)),l)}function gut(i){let t=o0.byteLength(i),u=Math.floor(Math.log(t)/Math.log(10))+1;if(t+u>=Math.pow(10,u))u++;return t+u+i}});var jJu=W((yJ1,kJu)=>{var{Writable:NN0,Readable:JN0,getStreamError:QJu}=_ut(),UN0=lut(),YJu=Gz(),kz=hut(),TN0=YJu.alloc(0);class PJu{constructor(){this.buffered=0,this.shifted=0,this.queue=new UN0,this._offset=0}push(i){this.buffered+=i.byteLength,this.queue.push(i)}shiftFirst(i){return this._buffered===0?null:this._next(i)}shift(i){if(i>this.buffered)return null;if(i===0)return TN0;let t=this._next(i);if(i===t.byteLength)return t;let u=[t];while((i-=t.byteLength)>0)t=this._next(i),u.push(t);return YJu.concat(u)}_next(i){let t=this.queue.peek(),u=t.byteLength-this._offset;if(i>=u){let l=this._offset?t.subarray(this._offset,t.byteLength):t;return this.queue.shift(),this._offset=0,this.buffered-=u,this.shifted+=u,l}return this.buffered-=i,this.shifted+=i,t.subarray(this._offset,this._offset+=i)}}class AJu extends JN0{constructor(i,t,u){super();this.header=t,this.offset=u,this._parent=i}_read(i){if(this.header.size===0)this.push(null);if(this._parent._stream===this)this._parent._update();i(null)}_predestroy(){this._parent.destroy(QJu(this))}_detach(){if(this._parent._stream===this)this._parent._stream=null,this._parent._missing=WJu(this.header.size),this._parent._update()}_destroy(i){this._detach(),i(null)}}class GJu extends NN0{constructor(i){super(i);if(!i)i={};this._buffer=new PJu,this._offset=0,this._header=null,this._stream=null,this._missing=0,this._longHeader=!1,this._callback=Eut,this._locked=!1,this._finished=!1,this._pax=null,this._paxGlobal=null,this._gnuLongPath=null,this._gnuLongLinkPath=null,this._filenameEncoding=i.filenameEncoding||"utf-8",this._allowUnknownFormat=!!i.allowUnknownFormat,this._unlockBound=this._unlock.bind(this)}_unlock(i){if(this._locked=!1,i){this.destroy(i),this._continueWrite(i);return}this._update()}_consumeHeader(){if(this._locked)return!1;this._offset=this._buffer.shifted;try{this._header=kz.decode(this._buffer.shift(512),this._filenameEncoding,this._allowUnknownFormat)}catch(i){return this._continueWrite(i),!1}if(!this._header)return!0;switch(this._header.type){case"gnu-long-path":case"gnu-long-link-path":case"pax-global-header":case"pax-header":return this._longHeader=!0,this._missing=this._header.size,!0}if(this._locked=!0,this._applyLongHeaders(),this._header.size===0||this._header.type==="directory")return this.emit("entry",this._header,this._createStream(),this._unlockBound),!0;return this._stream=this._createStream(),this._missing=this._header.size,this.emit("entry",this._header,this._stream,this._unlockBound),!0}_applyLongHeaders(){if(this._gnuLongPath)this._header.name=this._gnuLongPath,this._gnuLongPath=null;if(this._gnuLongLinkPath)this._header.linkname=this._gnuLongLinkPath,this._gnuLongLinkPath=null;if(this._pax){if(this._pax.path)this._header.name=this._pax.path;if(this._pax.linkpath)this._header.linkname=this._pax.linkpath;if(this._pax.size)this._header.size=parseInt(this._pax.size,10);this._header.pax=this._pax,this._pax=null}}_decodeLongHeader(i){switch(this._header.type){case"gnu-long-path":this._gnuLongPath=kz.decodeLongPath(i,this._filenameEncoding);break;case"gnu-long-link-path":this._gnuLongLinkPath=kz.decodeLongPath(i,this._filenameEncoding);break;case"pax-global-header":this._paxGlobal=kz.decodePax(i);break;case"pax-header":this._pax=this._paxGlobal===null?kz.decodePax(i):Object.assign({},this._paxGlobal,kz.decodePax(i));break}}_consumeLongHeader(){this._longHeader=!1,this._missing=WJu(this._header.size);let i=this._buffer.shift(this._header.size);try{this._decodeLongHeader(i)}catch(t){return this._continueWrite(t),!1}return!0}_consumeStream(){let i=this._buffer.shiftFirst(this._missing);if(i===null)return!1;this._missing-=i.byteLength;let t=this._stream.push(i);if(this._missing===0){if(this._stream.push(null),t)this._stream._detach();return t&&this._locked===!1}return t}_createStream(){return new AJu(this,this._header,this._offset)}_update(){while(this._buffer.buffered>0&&!this.destroying){if(this._missing>0){if(this._stream!==null){if(this._consumeStream()===!1)return;continue}if(this._longHeader===!0){if(this._missing>this._buffer.buffered)break;if(this._consumeLongHeader()===!1)return!1;continue}let i=this._buffer.shiftFirst(this._missing);if(i!==null)this._missing-=i.byteLength;continue}if(this._buffer.buffered<512)break;if(this._stream!==null||this._consumeHeader()===!1)return}this._continueWrite(null)}_continueWrite(i){let t=this._callback;this._callback=Eut,t(i)}_write(i,t){this._callback=t,this._buffer.push(i),this._update()}_final(i){this._finished=this._missing===0&&this._buffer.buffered===0,i(this._finished?null:Error("Unexpected end of data"))}_predestroy(){this._continueWrite(null)}_destroy(i){if(this._stream)this._stream.destroy(QJu(this));i(null)}[Symbol.asyncIterator](){let i=null,t=null,u=null,l=null,n=null,f=this;return this.on("entry",d),this.on("error",(h)=>{i=h}),this.on("close",_),{[Symbol.asyncIterator](){return this},next(){return new Promise($)},return(){return g(null)},throw(h){return g(h)}};function c(h){if(!n)return;let E=n;n=null,E(h)}function $(h,E){if(i)return E(i);if(l){h({value:l,done:!1}),l=null;return}if(t=h,u=E,c(null),f._finished&&t)t({value:void 0,done:!0}),t=u=null}function d(h,E,v){if(n=v,E.on("error",Eut),t)t({value:E,done:!1}),t=u=null;else l=E}function _(){if(c(i),!t)return;if(i)u(i);else t({value:void 0,done:!0});t=u=null}function g(h){return f.destroy(h),c(h),new Promise((E,v)=>{if(f.destroyed)return E({value:void 0,done:!0});f.once("close",function(){if(h)v(h);else E({value:void 0,done:!0})})})}}}kJu.exports=function(t){return new GJu(t)};function Eut(){}function WJu(i){return i&=511,i&&512-i}});var zJu=W((XJ1,vut)=>{var SJu={S_IFMT:61440,S_IFDIR:16384,S_IFCHR:8192,S_IFBLK:24576,S_IFIFO:4096,S_IFLNK:40960};try{vut.exports=vi("fs").constants||SJu}catch{vut.exports=SJu}});var CJu=W((NJ1,eJu)=>{var{Readable:FN0,Writable:IN0,getStreamError:bJu}=_ut(),SP=Gz(),jz=zJu(),$yi=hut(),KJu=SP.alloc(1024);class HJu extends IN0{constructor(i,t,u){super({mapWritable:BN0,eagerOpen:!0});if(this.written=0,this.header=t,this._callback=u,this._linkname=null,this._isLinkname=t.type==="symlink"&&!t.linkname,this._isVoid=t.type!=="file"&&t.type!=="contiguous-file",this._finished=!1,this._pack=i,this._openCallback=null,this._pack._stream===null)this._pack._stream=this;else this._pack._pending.push(this)}_open(i){if(this._openCallback=i,this._pack._stream===this)this._continueOpen()}_continuePack(i){if(this._callback===null)return;let t=this._callback;this._callback=null,t(i)}_continueOpen(){if(this._pack._stream===null)this._pack._stream=this;let i=this._openCallback;if(this._openCallback=null,i===null)return;if(this._pack.destroying)return i(Error("pack stream destroyed"));if(this._pack._finalized)return i(Error("pack stream is already finalized"));if(this._pack._stream=this,!this._isLinkname)this._pack._encode(this.header);if(this._isVoid)this._finish(),this._continuePack(null);i(null)}_write(i,t){if(this._isLinkname)return this._linkname=this._linkname?SP.concat([this._linkname,i]):i,t(null);if(this._isVoid){if(i.byteLength>0)return t(Error("No body allowed for this entry"));return t()}if(this.written+=i.byteLength,this._pack.push(i))return t();this._pack._drain=t}_finish(){if(this._finished)return;if(this._finished=!0,this._isLinkname)this.header.linkname=this._linkname?SP.toString(this._linkname,"utf-8"):"",this._pack._encode(this.header);LJu(this._pack,this.header.size),this._pack._done(this)}_final(i){if(this.written!==this.header.size)return i(Error("Size mismatch"));this._finish(),i(null)}_getError(){return bJu(this)||Error("tar entry destroyed")}_predestroy(){this._pack.destroy(this._getError())}_destroy(i){this._pack._done(this),this._continuePack(this._finished?null:this._getError()),i()}}class RJu extends FN0{constructor(i){super(i);this._drain=rut,this._finalized=!1,this._finalizing=!1,this._pending=[],this._stream=null}entry(i,t,u){if(this._finalized||this.destroying)throw Error("already finalized or destroyed");if(typeof t==="function")u=t,t=null;if(!u)u=rut;if(!i.size||i.type==="symlink")i.size=0;if(!i.type)i.type=ZN0(i.mode);if(!i.mode)i.mode=i.type==="directory"?493:420;if(!i.uid)i.uid=0;if(!i.gid)i.gid=0;if(!i.mtime)i.mtime=new Date;if(typeof t==="string")t=SP.from(t);let l=new HJu(this,i,u);if(SP.isBuffer(t))return i.size=t.byteLength,l.write(t),l.end(),l;if(l._isVoid)return l;return l}finalize(){if(this._stream||this._pending.length>0){this._finalizing=!0;return}if(this._finalized)return;this._finalized=!0,this.push(KJu),this.push(null)}_done(i){if(i!==this._stream)return;if(this._stream=null,this._finalizing)this.finalize();if(this._pending.length)this._pending.shift()._continueOpen()}_encode(i){if(!i.pax){let t=$yi.encode(i);if(t){this.push(t);return}}this._encodePax(i)}_encodePax(i){let t=$yi.encodePax({name:i.name,linkname:i.linkname,pax:i.pax}),u={name:"PaxHeader",mode:i.mode,uid:i.uid,gid:i.gid,size:t.byteLength,mtime:i.mtime,type:"pax-header",linkname:i.linkname&&"PaxHeader",uname:i.uname,gname:i.gname,devmajor:i.devmajor,devminor:i.devminor};this.push($yi.encode(u)),this.push(t),LJu(this,t.byteLength),u.size=i.size,u.type=i.type,this.push($yi.encode(u))}_doDrain(){let i=this._drain;this._drain=rut,i()}_predestroy(){let i=bJu(this);if(this._stream)this._stream.destroy(i);while(this._pending.length){let t=this._pending.shift();t.destroy(i),t._continueOpen()}this._doDrain()}_read(i){this._doDrain(),i()}}eJu.exports=function(t){return new RJu(t)};function ZN0(i){switch(i&jz.S_IFMT){case jz.S_IFBLK:return"block-device";case jz.S_IFCHR:return"character-device";case jz.S_IFDIR:return"directory";case jz.S_IFIFO:return"fifo";case jz.S_IFLNK:return"symlink"}return"file"}function rut(){}function LJu(i,t){if(t&=511,t)i.push(KJu.subarray(0,512-t))}function BN0(i){return SP.isBuffer(i)?i:SP.from(i)}});var MJu=W((QN0)=>{QN0.extract=jJu();QN0.pack=CJu()});var aJu=W((UJ1,VJu)=>{VJu.exports=qJu;function qJu(i,t){if(i&&t)return qJu(i)(t);if(typeof i!=="function")throw TypeError("need wrapper function");return Object.keys(i).forEach(function(l){u[l]=i[l]}),u;function u(){var l=Array(arguments.length);for(var n=0;n<l.length;n++)l[n]=arguments[n];var f=i.apply(this,l),c=l[l.length-1];if(typeof f==="function"&&f!==c)Object.keys(c).forEach(function($){f[$]=c[$]});return f}}});var xut=W((TJ1,wut)=>{var mJu=aJu();wut.exports=mJu(dyi);wut.exports.strict=mJu(oJu);dyi.proto=dyi(function(){Object.defineProperty(Function.prototype,"once",{value:function(){return dyi(this)},configurable:!0}),Object.defineProperty(Function.prototype,"onceStrict",{value:function(){return oJu(this)},configurable:!0})});function dyi(i){var t=function(){if(t.called)return t.value;return t.called=!0,t.value=i.apply(this,arguments)};return t.called=!1,t}function oJu(i){var t=function(){if(t.called)throw Error(t.onceError);return t.called=!0,t.value=i.apply(this,arguments)},u=i.name||"Function wrapped with `once`";return t.onceError=u+" shouldn't be called more than once",t.called=!1,t}});var iUu=W((FJ1,pJu)=>{var AN0=xut(),GN0=function(){},WN0=global.Bare?queueMicrotask:process.nextTick.bind(process),kN0=function(i){return i.setHeader&&typeof i.abort==="function"},jN0=function(i){return i.stdio&&Array.isArray(i.stdio)&&i.stdio.length===3},sJu=function(i,t,u){if(typeof t==="function")return sJu(i,null,t);if(!t)t={};u=AN0(u||GN0);var{_writableState:l,_readableState:n}=i,f=t.readable||t.readable!==!1&&i.readable,c=t.writable||t.writable!==!1&&i.writable,$=!1,d=function(){if(!i.writable)_()},_=function(){if(c=!1,!f)u.call(i)},g=function(){if(f=!1,!c)u.call(i)},h=function(O){u.call(i,O?Error("exited with error code: "+O):null)},E=function(O){u.call(i,O)},v=function(){WN0(r)},r=function(){if($)return;if(f&&!(n&&(n.ended&&!n.destroyed)))return u.call(i,Error("premature close"));if(c&&!(l&&(l.ended&&!l.destroyed)))return u.call(i,Error("premature close"))},x=function(){i.req.on("finish",_)};if(kN0(i))if(i.on("complete",_),i.on("abort",v),i.req)x();else i.on("request",x);else if(c&&!l)i.on("end",d),i.on("close",d);if(jN0(i))i.on("exit",h);if(i.on("end",g),i.on("finish",_),t.error!==!1)i.on("error",E);return i.on("close",v),function(){if($=!0,i.removeListener("complete",_),i.removeListener("abort",v),i.removeListener("request",x),i.req)i.req.removeListener("finish",_);i.removeListener("end",d),i.removeListener("close",d),i.removeListener("finish",_),i.removeListener("exit",h),i.removeListener("end",g),i.removeListener("error",E),i.removeListener("close",v)}};pJu.exports=sJu});var lUu=W((IJ1,uUu)=>{var SN0=xut(),zN0=iUu(),_yi;try{_yi=vi("fs")}catch(i){}var ta=function(){},bN0=typeof process>"u"?!1:/^v?\.0/.test(process.version),gyi=function(i){return typeof i==="function"},KN0=function(i){if(!bN0)return!1;if(!_yi)return!1;return(i instanceof(_yi.ReadStream||ta)||i instanceof(_yi.WriteStream||ta))&&gyi(i.close)},HN0=function(i){return i.setHeader&&gyi(i.abort)},RN0=function(i,t,u,l){l=SN0(l);var n=!1;i.on("close",function(){n=!0}),zN0(i,{readable:t,writable:u},function(c){if(c)return l(c);n=!0,l()});var f=!1;return function(c){if(n)return;if(f)return;if(f=!0,KN0(i))return i.close(ta);if(HN0(i))return i.abort();if(gyi(i.destroy))return i.destroy();l(c||Error("stream was destroyed"))}},tUu=function(i){i()},LN0=function(i,t){return i.pipe(t)},eN0=function(){var i=Array.prototype.slice.call(arguments),t=gyi(i[i.length-1]||ta)&&i.pop()||ta;if(Array.isArray(i[0]))i=i[0];if(i.length<2)throw Error("pump requires two streams per minimum");var u,l=i.map(function(n,f){var c=f<i.length-1,$=f>0;return RN0(n,c,$,function(d){if(!u)u=d;if(d)l.forEach(tUu);if(c)return;l.forEach(tUu),t(u)})});return i.reduce(LN0)};uUu.exports=eN0});var EUu=W((VN0)=>{var nUu=MJu(),fUu=lUu(),cUu=vi("fs"),Y1=vi("path"),ua=(global.Bare?global.Bare.platform:process.platform)==="win32";VN0.pack=function(t,u){if(!t)t=".";if(!u)u={};let l=u.fs||cUu,n=u.ignore||u.filter||la,f=u.mapStream||gUu,c=qN0(l,u.dereference?l.stat:l.lstat,t,n,u.entries,u.sort),$=u.strict!==!1,d=typeof u.umask==="number"?~u.umask:~$Uu(),_=u.pack||nUu.pack(),g=u.finish||la,h=u.map||la,E=typeof u.dmode==="number"?u.dmode:0,v=typeof u.fmode==="number"?u.fmode:0;if(u.strip)h=hUu(h,u.strip);if(u.readable)E|=parseInt(555,8),v|=parseInt(444,8);if(u.writable)E|=parseInt(333,8),v|=parseInt(222,8);O();function r(y,X){l.readlink(Y1.join(t,y),function(N,U){if(N)return _.destroy(N);X.linkname=Dut(U),_.entry(X,O)})}function x(y,X,N){if(_.destroyed)return;if(y)return _.destroy(y);if(!X){if(u.finalize!==!1)_.finalize();return g(_)}if(N.isSocket())return O();let U={name:Dut(X),mode:(N.mode|(N.isDirectory()?E:v))&d,mtime:N.mtime,size:N.size,type:"file",uid:N.uid,gid:N.gid};if(N.isDirectory())return U.size=0,U.type="directory",U=h(U)||U,_.entry(U,O);if(N.isSymbolicLink())return U.size=0,U.type="symlink",U=h(U)||U,r(X,U);if(U=h(U)||U,!N.isFile()){if($)return _.destroy(Error("unsupported type for "+X));return O()}let J=_.entry(U,O),F=f(l.createReadStream(Y1.join(t,X),{start:0,end:U.size>0?U.size-1:U.size}),U);F.on("error",function(Q){J.destroy(Q)}),fUu(F,J)}function O(y){if(y)return _.destroy(y);c(x)}return _};function CN0(i){return i.length?i[i.length-1]:null}function MN0(){return!global.Bare&&process.getuid?process.getuid():-1}function $Uu(){return!global.Bare&&process.umask?process.umask():0}VN0.extract=function(t,u){if(!t)t=".";if(!u)u={};t=Y1.resolve(t);let l=u.fs||cUu,n=u.ignore||u.filter||la,f=u.mapStream||gUu,c=u.chown!==!1&&!ua&&MN0()===0,$=u.extract||nUu.extract(),d=[],_=new Date,g=typeof u.umask==="number"?~u.umask:~$Uu(),h=u.strict!==!1,E=u.validateSymlinks!==!1,v=u.map||la,r=typeof u.dmode==="number"?u.dmode:0,x=typeof u.fmode==="number"?u.fmode:0;if(u.strip)v=hUu(v,u.strip);if(u.readable)r|=parseInt(555,8),x|=parseInt(444,8);if(u.writable)r|=parseInt(333,8),x|=parseInt(222,8);if($.on("entry",O),u.finish)$.on("finish",u.finish);return $;function O(J,F,Q){J=v(J)||J,J.name=Dut(J.name);let B=Y1.join(t,Y1.join("/",J.name));if(n(B,J))return F.resume(),Q();let P=Y1.join(B,".")===Y1.join(t,".")?t:Y1.dirname(B);_Uu(l,P,Y1.join(t,"."),function(M,p){if(M)return Q(M);if(!p)return Q(Error(P+" is not a valid path"));if(J.type==="directory")return d.push([B,J.mtime]),U(B,{fs:l,own:c,uid:J.uid,gid:J.gid,mode:J.mode},H);U(P,{fs:l,own:c,uid:J.uid,gid:J.gid,mode:493},function(s){if(s)return Q(s);switch(J.type){case"file":return S();case"link":return k();case"symlink":return j()}if(h)return Q(Error("unsupported type for "+B+" ("+J.type+")"));F.resume(),Q()})});function H(M){if(M)return Q(M);X(B,J,function(p){if(p)return Q(p);if(ua)return Q();N(B,J,Q)})}function j(){if(ua)return Q();l.unlink(B,function(){let M=Y1.resolve(Y1.dirname(B),J.linkname);if(!m(M)&&E)return Q(Error(B+" is not a valid symlink"));dUu(l,M,Y1.join(t,"."),function(p,s){if(p)return Q(p);if(!s&&E)return Q(Error(B+" is not a valid symlink"));l.symlink(J.linkname,B,H)})})}function k(){if(ua)return Q();l.unlink(B,function(){let M=Y1.join(t,Y1.join("/",J.linkname));l.realpath(M,function(p,s){if(p||!m(s))return Q(Error(B+" is not a valid hardlink"));l.link(s,B,function($i){if($i&&$i.code==="EPERM"&&u.hardlinkAsFilesFallback)return F=l.createReadStream(s),S();H($i)})})})}function m(M){return M===t||M.startsWith(t+Y1.sep)}function S(){let M=l.createWriteStream(B),p=f(F,J);M.on("error",function(s){p.destroy(s)}),fUu(p,M,function(s){if(s)return Q(s);M.on("close",H)})}}function y(J,F){let Q;while((Q=CN0(d))&&J.slice(0,Q[0].length)!==Q[0])d.pop();if(!Q)return F();l.utimes(Q[0],_,Q[1],F)}function X(J,F,Q){if(u.utimes===!1)return Q();if(F.type==="directory")return l.utimes(J,_,F.mtime,Q);if(F.type==="symlink")return y(J,Q);l.utimes(J,_,F.mtime,function(B){if(B)return Q(B);y(J,Q)})}function N(J,F,Q){let B=F.type==="symlink",P=B?l.lchmod:l.chmod,H=B?l.lchown:l.chown;if(!P)return Q();let j=(F.mode|(F.type==="directory"?r:x))&g;if(H&&c)H.call(l,J,F.uid,F.gid,k);else k(null);function k(m){if(m)return Q(m);if(!P)return Q();P.call(l,J,j,Q)}}function U(J,F,Q){l.stat(J,function(B){if(!B)return Q(null);if(B.code!=="ENOENT")return Q(B);l.mkdir(J,{mode:F.mode,recursive:!0},function(P,H){if(P)return Q(P);N(J,F,Q)})})}};function dUu(i,t,u,l){if(t===u)return l(null,!0);if(!t.startsWith(u+Y1.sep))return l(null,!1);i.lstat(t,function(n,f){if(n&&n.code!=="ENOENT"&&n.code!=="EPERM")return l(n);if(n||!f.isSymbolicLink())return dUu(i,Y1.join(t,".."),u,l);l(null,!1)})}function _Uu(i,t,u,l){if(t===u)return l(null,!0);i.lstat(t,function(n,f){if(n&&n.code!=="ENOENT"&&n.code!=="EPERM")return l(n);if(n||f.isDirectory())return _Uu(i,Y1.join(t,".."),u,l);l(null,!1)})}function la(){}function gUu(i){return i}function Dut(i){return ua?i.replace(/\\/g,"/").replace(/[:?<>|]/g,"_"):i}function qN0(i,t,u,l,n,f){if(!n)n=["."];let c=n.slice(0);return function(d){if(!c.length)return d(null);let _=c.shift(),g=Y1.join(u,_);t.call(i,g,function(h,E){if(h)return d(n.indexOf(_)===-1&&h.code==="ENOENT"?null:h);if(!E.isDirectory())return d(null,_,E);i.readdir(g,function(v,r){if(v)return d(v);if(f)r.sort();for(let x=0;x<r.length;x++)if(!l(Y1.join(u,_,r[x])))c.push(Y1.join(_,r[x]));d(null,_,E)})})}}function hUu(i,t){return function(u){u.name=u.name.split("/").slice(t).join("/");let l=u.linkname;if(l&&(u.type==="link"||Y1.isAbsolute(l)))u.linkname=l.split("/").slice(t).join("/");return i(u)}}});var oN0,sN0;var vUu=w(()=>{tut();oN0=z(iJu(),1),sN0=z(EUu(),1)});var hyi=()=>{};var rUu=w(()=>{FOi()});var wUu=w(()=>{sOi();oOi();hyi()});var xUu=()=>{};var DUu=()=>{};var Out=w(()=>{kNu();ptt();sOi();KNu();ott();tut();HNu();RNu();LNu();eNu();stt();CNu();vUu();hyi();rUu();wUu();xUu();DUu();hyi()});var q1,Ec,zP,na;var fa=w(()=>{q1={CLAIM_API_GROUP:"extensions.agents.x-k8s.io",CLAIM_API_VERSION:"v1alpha1",CLAIM_PLURAL:"sandboxclaims",SANDBOX_API_GROUP:"agents.x-k8s.io",SANDBOX_API_VERSION:"v1alpha1",SANDBOX_PLURAL:"sandboxes",POD_NAME_ANNOTATION:"agents.x-k8s.io/pod-name"};Ec=class Ec extends Error{cause;constructor(i,t){super(i);if(this.name="SandboxError",this.cause=t,t instanceof Error&&t.stack)this.stack=`${this.stack}
 Caused by: ${t.stack}`}};zP=class zP extends Ec{constructor(i,t){super(i,t);this.name="SandboxTimeoutError"}};na=class na extends Ec{constructor(i,t){super(i,t);this.name="SandboxAlreadyExistsError"}}});async function pN0(i){let t=i.getCurrentCluster();if(!t)throw new Ec("No active cluster in kubeconfig");let u={};await i.applyToHTTPSOptions(u);let l={},n=u.headers??{};for(let[f,c]of Object.entries(n))if(Array.isArray(c))l[f]=c.join(", ");else if(c!==void 0)l[f]=String(c);if(typeof u.auth==="string"&&!l.Authorization)l.Authorization=`Basic ${Buffer.from(u.auth).toString("base64")}`;return{server:t.server.replace(/\/+$/,""),headers:l,tls:{cert:yut(u.cert),key:yut(u.key),ca:yut(u.ca),rejectUnauthorized:t.skipTLSVerify?!1:void 0}}}function yut(i){if(i==null)return;if(typeof i==="string")return i;if(Buffer.isBuffer(i))return i.toString("utf8");return String(i)}async function bP(i,t){let u=await pN0(i),l={...u.headers,...t.headers};if(t.method==="PATCH")l["content-type"]=t.patchType==="apply"?"application/apply-patch+yaml":t.patchType==="strategic-merge"?"application/strategic-merge-patch+json":"application/merge-patch+json";else if(t.body!==void 0&&!("content-type"in l))l["content-type"]="application/json";let n={method:t.method,headers:l,body:t.body===void 0?void 0:JSON.stringify(t.body),signal:t.signal,tls:u.tls};return fetch(`${u.server}${t.path}`,n)}async function Xut(i){try{return await i.json()}catch{return null}}async function Nut(i,t){if(i.ok)return;let u=await Xut(i),l=u?.message??`${t} failed: ${i.status} ${i.statusText}`;throw new OUu(i.status,u,l)}async function ca(i,t,u,l,n="none"){try{let f=await bP(i,t);if(f.status===404)return null;if(await Nut(f,u),n==="json")return await f.json();return null}catch(f){throw new Ec(l,f)}}async function $a(i,t,u){let l=`${yUu}/${encodeURIComponent(t)}/${q1.CLAIM_PLURAL}`,n;try{n=await bP(i,{method:"POST",path:l,body:u})}catch(_){let g=_ instanceof Error?_.message:String(_);throw console.warn(`[agent-sandbox/client] createSandboxClaim ${u.metadata.name} transport error: ${g}`),new Ec(`Failed to create SandboxClaim: ${u.metadata.name} (transport error: ${g})`,_)}if(n.ok)return;let f=await Xut(n),c=f?.reason?` ${f.reason}`:"",$=f?.message??n.statusText,d=`Failed to create SandboxClaim: ${u.metadata.name} (${n.status}${c}: ${$})`;if(console.warn(`[agent-sandbox/client] createSandboxClaim ${u.metadata.name} rejected: status=${n.status} reason=${f?.reason??"<none>"} message=${$}`),n.status===409)throw new na(d);throw new Ec(d)}async function Eyi(i,t,u,l=60000){let n=Date.now()+l,f=500,c;while(!0){let $=await P2(i,t,u).catch(()=>{return});if(!$)return;if(c=$,Date.now()>=n){let d=c.metadata?.finalizers??[],_=c.metadata?.deletionTimestamp??"<unknown>";throw new zP(`SandboxClaim ${u} still terminating after ${l}ms (deletionTimestamp=${_}, finalizers=[${d.join(", ")}])`)}await new Promise((d)=>setTimeout(d,500))}}function Jut(i,t){return`${yUu}/${encodeURIComponent(i)}/${q1.CLAIM_PLURAL}/${encodeURIComponent(t)}`}async function XUu(i,t,u,l){await ca(i,{method:"PATCH",path:Jut(t,u),patchType:"merge",body:{spec:{lifecycle:{shutdownPolicy:"Delete",shutdownTime:l}}}},"patchSandboxClaimShutdown",`Failed to patch SandboxClaim shutdownTime: ${u}`)}async function cD(i,t,u){await ca(i,{method:"DELETE",path:Jut(t,u)},"deleteSandboxClaim",`Failed to delete SandboxClaim: ${u}`)}async function P2(i,t,u){return await ca(i,{method:"GET",path:Jut(t,u)},"getSandboxClaim",`Failed to get SandboxClaim: ${u}`,"json")??void 0}async function NUu(i,t,u,l=60){let n=Date.now()+l*1000,f=200;while(Date.now()<n){let $=(await P2(i,t,u).catch(()=>{return}))?.status?.sandbox?.name;if($)return $;await new Promise((d)=>setTimeout(d,200))}throw new zP(`SandboxClaim ${u} did not record an adopted Sandbox (status.sandbox.name) within ${l}s`)}function Uut(i,t){return`${iJ0}/${encodeURIComponent(i)}/${TUu}/${encodeURIComponent(t)}`}async function vyi(i,t,u){let l=new URLSearchParams({fieldManager:IUu,force:"true"}),n=`${Uut(t,u.metadata.name)}?${l}`;try{let f=await bP(i,{method:"PATCH",path:n,patchType:"apply",body:u});await Nut(f,"applyHttpRoute")}catch(f){throw new Ec(`Failed to apply HTTPRoute: ${u.metadata.name}`,f)}}async function ryi(i,t,u){await ca(i,{method:"DELETE",path:Uut(t,u)},"deleteHttpRoute",`Failed to delete HTTPRoute: ${u}`)}async function FUu(i,t,u){return await ca(i,{method:"GET",path:Uut(t,u)},"getHttpRoute",`Failed to get HTTPRoute: ${u}`,"json")??void 0}async function ZUu(i,t,u,l){let n={apiVersion:"v1",kind:"Service",metadata:{name:u},spec:{ports:[{name:l.name,port:l.port,targetPort:l.targetPort,protocol:l.protocol??"TCP"}]}},f=new URLSearchParams({fieldManager:IUu,force:"true"}),c=`/api/v1/namespaces/${encodeURIComponent(t)}/services/${encodeURIComponent(u)}?${f}`;try{let $=await bP(i,{method:"PATCH",path:c,patchType:"apply",body:n});await Nut($,"ensureServicePort")}catch($){throw new Ec(`Failed to apply Service ports: ${u}`,$)}}function wyi(i,t,u,l=180){let n=`/apis/${q1.SANDBOX_API_GROUP}/${q1.SANDBOX_API_VERSION}/namespaces/${encodeURIComponent(t)}/${q1.SANDBOX_PLURAL}?watch=true&fieldSelector=${encodeURIComponent(`metadata.name=${u}`)}`,{resolve:f,reject:c,promise:$}=Promise.withResolvers(),d=new AbortController,_=!1,g=setTimeout(()=>{if(_)return;_=!0,d.abort(),c(new zP(`Sandbox did not become ready within ${l} seconds`))},l*1000),h=(E)=>{if(_)return;_=!0,clearTimeout(g),d.abort(),E()};return(async()=>{let E;try{E=await bP(i,{method:"GET",path:n,signal:d.signal,headers:{accept:"application/json"}})}catch(v){h(()=>c(new Ec("Failed to start watch for sandbox readiness",v)));return}if(!E.ok||!E.body){let v=await Xut(E).catch(()=>null);h(()=>c(new Ec(`Watch handshake failed (${E.status}): ${v?.message??E.statusText}`)));return}try{for await(let v of Tut(E.body)){if(_)return;if(v.type==="ERROR"){let X=v.object;h(()=>c(new Ec(`Watch stream error while waiting for sandbox: ${X.message??"unknown"}`)));return}if(v.type!=="ADDED"&&v.type!=="MODIFIED")continue;let r=v.object;if(!r.status?.conditions?.find((X)=>X.type==="Ready"&&X.status==="True"))continue;let O=r.metadata?.name;if(!O){h(()=>c(new Ec("Sandbox metadata or name is missing")));return}let y=r.metadata?.annotations?.[q1.POD_NAME_ANNOTATION]??O;h(()=>f({sandboxName:O,podName:y}));return}h(()=>c(new Ec("Watch stream closed before sandbox became ready")))}catch(v){if(_)return;if(v instanceof Error&&(v.name==="AbortError"||d.signal.aborted))return;h(()=>c(new Ec("Watch stream error while waiting for sandbox",v)))}})(),$}async function*Tut(i){let t=i.getReader(),u=new TextDecoder,l="";try{while(!0){let{value:f,done:c}=await t.read();if(c)break;l+=u.decode(f,{stream:!0});let $;while(($=l.indexOf(`
-`))>=0){let d=l.slice(0,$).trim();if(l=l.slice($+1),!d)continue;yield JSON.parse(d)}}let n=l.trim();if(n)yield JSON.parse(n)}finally{t.releaseLock()}}var OUu,yUu,JUu="gateway.networking.k8s.io",UUu="v1",TUu="httproutes",iJ0,da,IUu="mesh-sandbox-runner";var xyi=w(()=>{fa();OUu=class OUu extends Error{status;body;constructor(i,t,u){super(u);this.status=i;this.body=t;this.name="KubeHttpError"}};yUu=`/apis/${q1.CLAIM_API_GROUP}/${q1.CLAIM_API_VERSION}/namespaces`;iJ0=`/apis/${JUu}/${UUu}/namespaces`;da={API_GROUP:JUu,API_VERSION:UUu,PLURAL:TUu}});async function*YUu(i){let t=i.now??(()=>Date.now()),u=t(),l=i.schedulingTimeoutMs??lJ0,n={pod:{},sandbox:{},events:{hasPulling:!1,hasPulled:!1},startedAt:u},f=[],c=null,$=!1,d=(X)=>{if($)return;if(c){let N=c;c=null,N(X)}else f.push(X)},_=()=>{if(f.length>0)return Promise.resolve(f.shift());if($)return Promise.resolve(null);return new Promise((X)=>{c=X})},g=()=>{if($)return;if($=!0,c){let X=c;c=null,X(null)}},h=new AbortController,E=()=>{h.abort(),g()};if(i.signal)if(i.signal.aborted)h.abort(),g();else i.signal.addEventListener("abort",E,{once:!0});let v=Math.max(0,l-(t()-u)),r=setTimeout(()=>d("tick"),v+100),x,O=new Promise((X)=>{x=X}),y=Promise.allSettled([nJ0(i.kc,i.namespace,i.claimName,h.signal,n,d,t,x),cJ0(i.kc,i.namespace,i.claimName,h.signal,n,d),$J0(i.kc,i.namespace,i.claimName,O,h.signal,n,d,t)]);try{let X=null,N=-1,U=BUu(n,l,t);if(X=Iut(U),!Fut(U))N=QUu(U);if(yield U,Fut(U))return;while(!$){if(await _()===null)break;let F=BUu(n,l,t);if(Fut(F)){let P=Iut(F);if(P!==X)X=P,yield F;return}let Q=QUu(F);if(Q<N)continue;let B=Iut(F);if(B!==X)X=B,N=Q,yield F}}finally{if(clearTimeout(r),h.abort(),i.signal)i.signal.removeEventListener("abort",E);g(),await y.catch(()=>{})}}function BUu(i,t,u){let{pod:l,sandbox:n,events:f,startedAt:c}=i;if(n.ready)return{kind:"ready"};let $=l.containerWaitingReason;if($==="ImagePullBackOff"||$==="ErrImagePull")return{kind:"failed",reason:"image-pull-backoff",message:"Sandbox image failed to download. The cluster may be missing pull credentials or the image tag may not exist."};if($==="CrashLoopBackOff")return{kind:"failed",reason:"crash-loop-backoff",message:"Sandbox crashed during startup and is now in CrashLoopBackOff. Check pod logs."};if(!l.scheduled&&f.lastFailedSchedulingAt!==void 0&&u()-c>t)return{kind:"failed",reason:"scheduling-timeout",message:f.failedSchedulingMessage??`Pod could not be scheduled within ${Math.round(t/1000)}s.`};if(l.containerRunning&&!l.containerReady)return{kind:"warming-daemon",since:c};if(f.hasPulling&&!f.hasPulled)return{kind:"pulling-image",since:c};if($==="ContainerCreating"||$==="PodInitializing"||l.scheduled&&!l.containerRunning)return{kind:"starting-container",since:c};if(l.scheduledFalseReason==="Unschedulable"||f.lastFailedSchedulingAt!==void 0&&!l.scheduled)return{kind:"waiting-for-capacity",since:c,message:f.failedSchedulingMessage??l.scheduledFalseMessage,nodeClaim:f.nominatedNodeClaim};return{kind:"claiming",since:c}}function Fut(i){return i.kind==="ready"||i.kind==="failed"}function QUu(i){switch(i.kind){case"claiming":return 0;case"waiting-for-capacity":return 1;case"pulling-image":return 2;case"starting-container":return 3;case"warming-daemon":return 4;case"ready":case"failed":return 99}}function Iut(i){switch(i.kind){case"claiming":case"pulling-image":case"starting-container":case"warming-daemon":return i.kind;case"waiting-for-capacity":return`waiting-for-capacity:${i.message??""}:${i.nodeClaim??""}`;case"ready":return"ready";case"failed":return`failed:${i.reason}:${i.message}`}}async function nJ0(i,t,u,l,n,f,c,$){let d=`/api/v1/namespaces/${encodeURIComponent(t)}/pods?watch=true&labelSelector=${encodeURIComponent(`${tJ0}=${u}`)}`;return Dyi({kc:i,path:d,signal:l,label:`pod/${u}`,onEvent:(_)=>{if(_.type!=="ADDED"&&_.type!=="MODIFIED")return;let g=_.object;if(g.metadata?.name)$(g.metadata.name);fJ0(g,n,c),f("pod")}})}function fJ0(i,t,u){let n=(i.status?.conditions??[]).find((c)=>c.type==="PodScheduled");if(n?.status==="True")t.pod.scheduled=!0,t.pod.scheduledFalseReason=void 0,t.pod.scheduledFalseMessage=void 0;else if(n?.status==="False")t.pod.scheduled=!1,t.pod.scheduledFalseReason=n.reason,t.pod.scheduledFalseMessage=n.message;let f=(i.status?.containerStatuses??[]).find((c)=>c.name===uJ0);if(f)t.pod.containerWaitingReason=f.state?.waiting?.reason,t.pod.containerRunning=!!f.state?.running,t.pod.containerReady=f.ready===!0}async function cJ0(i,t,u,l,n,f){let c=`/apis/${q1.CLAIM_API_GROUP}/${q1.CLAIM_API_VERSION}/namespaces/${encodeURIComponent(t)}/${q1.CLAIM_PLURAL}?watch=true&fieldSelector=${encodeURIComponent(`metadata.name=${u}`)}`;return Dyi({kc:i,path:c,signal:l,label:`sandboxclaim/${u}`,onEvent:($)=>{if($.type!=="ADDED"&&$.type!=="MODIFIED")return;let _=$.object.status?.conditions?.find((g)=>g.type==="Ready");if(!_)return;if(_.status==="True")n.sandbox.ready=!0,n.sandbox.notReadyReason=void 0,n.sandbox.notReadyMessage=void 0;else n.sandbox.ready=!1,n.sandbox.notReadyReason=_.reason,n.sandbox.notReadyMessage=_.message;f("sandbox")}})}async function $J0(i,t,u,l,n,f,c,$){let d=await Promise.race([l,new Promise((g)=>{if(n.aborted){g(u);return}n.addEventListener("abort",()=>g(u),{once:!0})})]);if(n.aborted)return;let _=`/api/v1/namespaces/${encodeURIComponent(t)}/events?watch=true&fieldSelector=${encodeURIComponent(`involvedObject.name=${d},involvedObject.kind=Pod`)}`;return Dyi({kc:i,path:_,signal:n,label:`events/${u}`,onEvent:(g)=>{if(g.type!=="ADDED"&&g.type!=="MODIFIED")return;let h=g.object,E=h.reason;if(!E)return;switch(E){case"Pulling":f.events.hasPulling=!0;break;case"Pulled":f.events.hasPulling=!0,f.events.hasPulled=!0;break;case"FailedScheduling":f.events.lastFailedSchedulingAt=$(),f.events.failedSchedulingMessage=h.message;break;case"Nominated":{let v=h.message?.match(/nodeclaim\/([\w-]+)/);if(v)f.events.nominatedNodeClaim=v[1];break}default:return}c("event")}})}async function PUu(i){let{kc:t,namespace:u,labelSelector:l,signal:n,onDelete:f}=i,c=`/apis/${q1.CLAIM_API_GROUP}/${q1.CLAIM_API_VERSION}/namespaces/${encodeURIComponent(u)}/${q1.CLAIM_PLURAL}?watch=true&labelSelector=${encodeURIComponent(l)}`;return Dyi({kc:t,path:c,signal:n,label:"sandboxclaim-reaper",onEvent:($)=>{if($.type!=="DELETED")return;let d=$.object.metadata?.name;if(d)f(d)}})}async function Dyi(i){let{kc:t,path:u,signal:l,label:n,onEvent:f}=i,c=0;while(!l.aborted){try{let d=await bP(t,{method:"GET",path:u,signal:l,headers:{accept:"application/json"}});if(!d.ok||!d.body){try{await d.body?.cancel()}catch{}throw Error(`watch handshake failed: ${d.status} ${d.statusText}`)}c=0;for await(let _ of Tut(d.body)){if(l.aborted)return;try{f(_)}catch(g){console.warn(`[lifecycle-watcher] ${n} onEvent threw: ${g instanceof Error?g.message:String(g)}`)}}}catch(d){if(l.aborted)return;let _=d instanceof Error?d.message:String(d);console.warn(`[lifecycle-watcher] ${n} watch ended: ${_}`)}if(l.aborted)return;let $=Wn(5000,250,c,2,0);c+=1,await mu($,{signal:l}).catch(()=>{})}}var tJ0="studio.decocms.com/sandbox-handle",uJ0="sandbox",lJ0=300000;var AUu=w(()=>{n1();fa();xyi()});import{createHash as dJ0,randomBytes as _J0,randomUUID as gJ0}from"crypto";import*as jUu from"net";import{PassThrough as hJ0}from"stream";function EJ0(i){if(i instanceof Error)return i.message;if(i&&typeof i==="object"){let t=i;if(t.error instanceof Error)return t.error.message;if(typeof t.message==="string"&&t.message)return t.message}return String(i)}class Aut{kind=c_;records=new Map;inflight=new H_i;stateStore;previewUrlPattern;kubeConfig;portForward;namespace;sandboxTemplateName;envName;tokenGenerator;idleTtlMs;metrics;previewGateway;sentinelToken;closed=!1;claimWatchAbort=new AbortController;constructor(i={}){this.stateStore=i.stateStore??null,this.previewUrlPattern=i.previewUrlPattern??null,this.kubeConfig=i.kubeConfig??JJ0(),this.portForward=new uut(this.kubeConfig),this.namespace=i.namespace??vJ0,this.sandboxTemplateName=i.sandboxTemplateName??rJ0,this.envName=BJ0(i.envName),this.tokenGenerator=i.tokenGenerator??(()=>_J0(xJ0).toString("hex")),this.idleTtlMs=i.idleTtlMs??OJ0,this.metrics=i.meter?NJ0(i.meter):null,this.previewGateway=i.previewGateway&&i.previewUrlPattern?{...i.previewGateway}:null;let t=i.sentinelToken?.trim()??"";this.sentinelToken=t.length>0?t:null,this.startClaimReaper()}startClaimReaper(){let i=["app.kubernetes.io/managed-by=studio","app.kubernetes.io/name=studio-sandbox",...this.envName?[`${W6.env}=${this.envName}`]:[]].join(",");PUu({kc:this.kubeConfig,namespace:this.namespace,labelSelector:i,signal:this.claimWatchAbort.signal,onDelete:(t)=>this.invalidateRecord(t)})}async ensure(i,t={}){let u=q5(i,t.branch??t.repo?.branch??null);return this.inflight.run(u,()=>R_i(this.stateStore,i,c_,(l)=>this.ensureLocked(i,u,t,l)))}async delete(i){let t=await this.getRecord(i);if(this.records.delete(i),t)this.closeForwarder(t.daemonForward),this.metrics?.active.add(-1,Yut(t.tenant));if(await this.deleteHttpRouteIfManaged(i).catch((u)=>{console.warn(`[${S4}] HTTPRoute delete failed for ${i}: ${u instanceof Error?u.message:String(u)}`)}),await cD(this.kubeConfig,this.namespace,i),this.stateStore)if(t)await this.stateStore.delete(t.id,c_);else await this.stateStore.deleteByHandle(c_,i)}async alive(i){return await P2(this.kubeConfig,this.namespace,i)!==void 0}watchClaimLifecycle(i,t){return YUu({kc:this.kubeConfig,namespace:this.namespace,claimName:i,signal:t})}async getPreviewUrl(i){let t=await this.getRecord(i);if(!t)return null;return this.composePreviewUrl(t)}async proxyDaemonRequest(i,t,u){let l=await this.getRecord(i);if(!l&&this.previewUrlPattern&&this.stateStore){let d=await this.stateStore.getByHandle(c_,i),_=d?.state,g=_?.token;if(d&&g){let E=`http://${_?.adoptedSandboxName??i}.${this.namespace}.svc.cluster.local:${$D}`;try{let v=await SH(E,g,t,u);if(v.status!==404)return v;try{await v.body?.cancel()}catch{}}catch{}}}if(!l)l=await this.resurrectByHandle(i);if(!l)return new Response(JSON.stringify({error:"sandbox not found"}),{status:404,headers:{"content-type":"application/json"}});let n=l,f=performance.now(),c=0,$=!(u.body instanceof ReadableStream);try{let d=await SH(l.daemonUrl,l.token,t,u);if(d.status===401&&$){this.invalidateRecord(i);let _=await this.getRecord(i).catch(()=>null)??await this.resurrectByHandle(i).catch(()=>null);if(_)n=_,d=await SH(_.daemonUrl,_.token,t,u)}return c=d.status,d}catch(d){if(!$)throw d;this.invalidateRecord(i);let _=await this.resurrectByHandle(i)??await this.getRecord(i).catch(()=>null);if(!_)throw d;n=_;let g=await SH(_.daemonUrl,_.token,t,u);return c=g.status,g}finally{this.recordProxyDuration("daemon",c,n,performance.now()-f)}}async adoptLiveClaim(i,t){if(this.records.has(t))return!0;let u=await P2(this.kubeConfig,this.namespace,t).catch(()=>{return});if(!u||u.metadata?.deletionTimestamp)return!1;return await this.inflight.run(t,async()=>{let n=this.records.get(t);if(n)return this.toSandbox(n);let f=await this.adopt(i,t,u);if(!f)throw Error(`cannot adopt live claim ${t}`);return R_i(this.stateStore,i,c_,(c)=>this.finish(f,c,!0,!0,"adopt"))}).catch(()=>null)!=null}async resolvePreviewUpstreamUrl(i){if(this.previewUrlPattern)return`http://${await this.resolveServiceNameForHandle(i)}.${this.namespace}.svc.cluster.local:${$D}`;let t=await this.getRecord(i);if(t)return t.daemonUrl;let u=await this.resurrectByHandle(i);return u?u.daemonUrl:null}async resolveServiceNameForHandle(i){let t=this.records.get(i);if(t)return t.adoptedSandboxName;if(this.stateStore){let l=(await this.stateStore.getByHandle(c_,i).catch(()=>null))?.state?.adoptedSandboxName;if(l)return l}return i}async proxyPreviewRequest(i,t){let u=performance.now(),l=this.records.get(i)??null,n=0;try{let f=await this.resolvePreviewUpstreamUrl(i);if(!f){n=404;let r=But(404,{error:"sandbox not found"});return r.headers.set(HP,"1"),r}let c=new URL(t.url);if((c.pathname==="/_sandbox"||c.pathname.startsWith("/_sandbox/")||c.pathname==="/_decopilot_vm"||c.pathname.startsWith("/_decopilot_vm/"))&&t.method!=="GET")return n=404,But(404,{error:"not found"});let d=(r)=>`${r}${c.pathname}${c.search}`,_=new Headers(t.headers);for(let r of yJ0)_.delete(r);let g=t.method!=="GET"&&t.method!=="HEAD",h={method:t.method,headers:_,body:g?t.body:void 0,redirect:"manual",signal:t.signal,duplex:g?"half":void 0},E;try{E=await fetch(d(f),h)}catch(r){let x=`${f}${c.pathname}`;if(console.warn(`[${S4}] preview fetch to ${x} failed: ${r instanceof Error?r.message:String(r)}`),t.method==="GET"||t.method==="HEAD"){if(this.invalidateRecord(i),await this.resurrectByHandle(i).catch(()=>null)){let X=await this.resolvePreviewUpstreamUrl(i);if(X)try{E=await fetch(d(X),h);let N=new Headers;for(let[U,J]of E.headers.entries())if(!GUu.includes(U.toLowerCase()))N.set(U,J);return n=E.status,new Response(E.body,{status:E.status,statusText:E.statusText,headers:N})}catch(N){console.warn(`[${S4}] preview fetch retry to ${x} failed: ${N instanceof Error?N.message:String(N)}`)}}}else this.invalidateRecord(i);n=502;let O=But(502,{error:"sandbox daemon unreachable"});return O.headers.set(HP,"1"),O}let v=new Headers;for(let[r,x]of E.headers.entries())if(!GUu.includes(r.toLowerCase()))v.set(r,x);return n=E.status,new Response(E.body,{status:E.status,statusText:E.statusText,headers:v})}finally{this.recordProxyDuration("preview",n,l,performance.now()-u,i)}}async ensureLocked(i,t,u,l){if(u.image)console.warn(`[${S4}] opts.image ignored (template ${this.sandboxTemplateName} pins image): got ${u.image}`);if(l){let c=await l.get(i,c_);if(c){let $=await this.rehydrate(i,t,c);if($)return this.finish($,l,!1,!0,"resume");await l.delete(i,c_)}}let n=await P2(this.kubeConfig,this.namespace,t).catch(()=>{return});if(n)if(n.metadata?.deletionTimestamp)await Eyi(this.kubeConfig,this.namespace,t).catch((c)=>{console.warn(`[${S4}] wait for terminating claim ${t} failed: ${c instanceof Error?c.message:String(c)}`)});else{let c=await this.adopt(i,t,n).catch(($)=>{return console.warn(`[${S4}] adopt ${t} failed, recreating: ${$ instanceof Error?$.message:String($)}`),null});if(c)return this.finish(c,l,!0,!0,"adopt");await cD(this.kubeConfig,this.namespace,t).catch(()=>{}),await Eyi(this.kubeConfig,this.namespace,t).catch(($)=>{console.warn(`[${S4}] wait for deleted claim ${t} failed: ${$ instanceof Error?$.message:String($)}`)})}let f=await this.provision(i,t,u);return this.finish(f,l,!0,!1,"fresh")}async finish(i,t,u,l,n){let f=this.records.get(i.handle),c=f!==void 0;if(f&&f.daemonForward!==i.daemonForward)this.closeForwarder(f.daemonForward);if(this.records.set(i.handle,i),u)await this.persist(t,i);if(l)await XUu(this.kubeConfig,this.namespace,i.handle,this.computeShutdownTime()).catch(($)=>console.warn(`[${S4}] TTL refresh failed for ${i.handle}: ${$ instanceof Error?$.message:String($)}`));if(this.metrics){let $=Yut(i.tenant);if(this.metrics.ensureOutcome.add(1,{...$,outcome:n}),!c)this.metrics.active.add(1,$)}return this.toSandbox(i)}buildEnvMap(i,t){let u={},l=[];for(let[n,f]of Object.entries(i.env??{}))if(DJ0.has(n))l.push(n);else u[n]=f;if(l.length>0)console.warn(`[${S4}] opts.env keys overlap reserved bootstrap names and were dropped: ${l.join(",")}`);return{...u,DAEMON_TOKEN:t.token,DAEMON_BOOT_ID:t.daemonBootId,APP_ROOT:t.workdir,PROXY_PORT:String($D)}}buildClaim(i,t,u){let l=this.sentinelToken!==null,n=l?[]:Object.entries(this.buildEnvMap(t,u)).sort(([$],[d])=>$<d?-1:$>d?1:0).map(([$,d])=>({name:$,value:d})),f=PJ0(t),c=Object.keys(f).length>0;return{apiVersion:`${q1.CLAIM_API_GROUP}/${q1.CLAIM_API_VERSION}`,kind:"SandboxClaim",metadata:{name:i,namespace:this.namespace,labels:{"app.kubernetes.io/name":"studio-sandbox","app.kubernetes.io/managed-by":"studio",...this.envName?{[W6.env]:this.envName}:{},...Qut(t.tenant)},...c?{annotations:f}:{}},spec:{sandboxTemplateRef:{name:this.sandboxTemplateName},additionalPodMetadata:{labels:Qut(t.tenant,{[W6.role]:"claimed",[W6.sandboxHandle]:i,...this.envName?{[W6.env]:this.envName}:{}}),...c?{annotations:f}:{}},env:n,warmpool:l?"default":"none",lifecycle:{shutdownPolicy:"Delete",shutdownTime:this.computeShutdownTime()}}}}async provision(i,t,u){let l=this.tokenGenerator(),n=gJ0(),f=Zut,c=this.buildClaim(t,u,{token:l,daemonBootId:n,workdir:f});try{await $a(this.kubeConfig,this.namespace,c)}catch(E){if(E instanceof na)await Eyi(this.kubeConfig,this.namespace,t),await $a(this.kubeConfig,this.namespace,c);else throw E}let $;try{$=await NUu(this.kubeConfig,this.namespace,t),await wyi(this.kubeConfig,this.namespace,$)}catch(E){throw await cD(this.kubeConfig,this.namespace,t).catch(()=>{}),E}try{await this.ensureServicePortForAdoptedSandbox($),await this.ensureHttpRouteForHandle(t,$,u.tenant??null)}catch(E){throw await cD(this.kubeConfig,this.namespace,t).catch(()=>{}),E}let d=await this.openForwarder($,$D,t),_=`http://127.0.0.1:${d.localPort}`,g=this.workloadConfigPayload(u),h=n;try{if(await mui(_),this.sentinelToken!==null){let E=await aui(_);if(E)h=E.bootId;await Z8(_,this.sentinelToken,g??{},{rotateToken:l})}else if(g)await Z8(_,l,g);if(u.orgFsConfigJson)await APt(_,l,u.orgFsConfigJson).catch((E)=>console.warn("[org-fs] sidecar config relay failed",E))}catch(E){throw this.closeForwarder(d),await this.deleteHttpRouteIfManaged(t).catch(()=>{}),await cD(this.kubeConfig,this.namespace,t).catch(()=>{}),E}return{id:i,handle:t,adoptedSandboxName:$,token:l,workdir:f,daemonUrl:_,daemonForward:d,workload:u.workload??null,daemonBootId:h,tenant:u.tenant??null,ensureOpts:GJ0(u)}}workloadConfigPayload(i){return Jit({runtime:i?.workload?.runtime??"node",packageManager:i?.workload?.packageManager?{name:i.workload.packageManager,...i.workload.packageManagerPath?{path:i.workload.packageManagerPath}:{}}:null,repo:i?.repo??null,port:i?.workload?.devPort??wJ0,tenant:i?.tenant??void 0})}async rebootstrapDaemon(i,t,u){if(this.sentinelToken===null)return!1;let l=this.workloadConfigPayload(u)??{};try{return await Z8(i,this.sentinelToken,l,{rotateToken:t}),!0}catch(n){if(n instanceof Vui&&n.status===401)try{return await Z8(i,t,l,{rotateToken:t}),!0}catch(f){return console.warn(`[${S4}] re-bootstrap retry with claim token failed: ${f instanceof Error?f.message:String(f)}`),!1}return console.warn(`[${S4}] re-bootstrap failed: ${n instanceof Error?n.message:String(n)}`),!1}}async ensureServicePortForAdoptedSandbox(i){if(!this.previewGateway||!this.previewUrlPattern)return;await ZUu(this.kubeConfig,this.namespace,i,{name:"daemon",port:$D,targetPort:$D})}async ensureHttpRouteForHandle(i,t,u){if(!this.previewGateway||!this.previewUrlPattern)return;let l=WJ0(this.previewUrlPattern,i);if(!l)throw new Ec(`Unable to derive preview hostname for ${i} from pattern: ${this.previewUrlPattern}`);let n={apiVersion:`${da.API_GROUP}/${da.API_VERSION}`,kind:"HTTPRoute",metadata:{name:i,namespace:this.namespace,labels:Qut(u??void 0,{[W6.role]:"claimed",[W6.sandboxHandle]:i,"app.kubernetes.io/name":"studio-sandbox","app.kubernetes.io/managed-by":"studio",...this.envName?{[W6.env]:this.envName}:{}})},spec:{parentRefs:[{kind:"Gateway",group:"gateway.networking.k8s.io",name:this.previewGateway.name,namespace:this.previewGateway.namespace}],hostnames:[l],rules:[{backendRefs:[{group:"",kind:"Service",name:t,port:$D}]}]}};await vyi(this.kubeConfig,this.namespace,n)}async deleteHttpRouteIfManaged(i){if(!this.previewGateway)return;await ryi(this.kubeConfig,this.namespace,i)}async rehydrate(i,t,u){let l=u.state;if(!l.adoptedSandboxName&&!l.podName||!l.token)return null;let n=await P2(this.kubeConfig,this.namespace,t).catch(()=>{return});if(!n||!WUu(n))return null;let f=n.status?.sandbox?.name??l.adoptedSandboxName??l.podName??t,c=await this.openAndProbeDaemon(f,t);if(!c)return null;if(l.daemonBootId&&l.daemonBootId!==c.bootId){if(this.sentinelToken!==null){if(!await this.rebootstrapDaemon(c.daemonUrl,l.token,l.ensureOpts??null))return this.closeForwarder(c.daemonForward),null}else console.warn(`[${S4}] daemon restart detected (handle=${t}): stored bootId=${l.daemonBootId} live bootId=${c.bootId}`);await this.stateStore?.put(i,c_,{handle:t,state:{...l,daemonBootId:c.bootId}}).catch(($)=>console.warn(`[${S4}] bootId persist failed for ${t}: ${$ instanceof Error?$.message:String($)}`))}return{id:i,handle:t,adoptedSandboxName:f,token:l.token,workdir:l.workdir??Zut,daemonUrl:c.daemonUrl,daemonForward:c.daemonForward,workload:l.workload??null,daemonBootId:c.bootId,tenant:l.tenant??null,ensureOpts:l.ensureOpts??null}}async adopt(i,t,u){if(!WUu(u))return null;let l=u.status?.sandbox?.name??t;if(this.sentinelToken!==null)return null;let n=UJ0(u);if(!n)return null;let f=await this.openAndProbeDaemon(l,t);if(!f)return null;let c=AJ0(u);if(this.previewGateway)await this.ensureServicePortForAdoptedSandbox(l).catch(($)=>{console.warn(`[${S4}] Service port backfill failed for ${t}: ${$ instanceof Error?$.message:String($)}`)}),await this.ensureHttpRouteForHandle(t,l,c).catch(($)=>{console.warn(`[${S4}] HTTPRoute backfill failed for ${t}: ${$ instanceof Error?$.message:String($)}`)});return{id:i,handle:t,adoptedSandboxName:l,token:n,workdir:Zut,daemonUrl:f.daemonUrl,daemonForward:f.daemonForward,workload:null,daemonBootId:f.bootId,tenant:c,ensureOpts:null}}async openAndProbeDaemon(i,t){let u=await this.openForwarder(i,$D,t).catch(()=>null);if(!u)return null;let l=`http://127.0.0.1:${u.localPort}`,n=await aui(l);if(!n)return this.closeForwarder(u),null;return{daemonForward:u,daemonUrl:l,bootId:n.bootId}}async getRecord(i){let t=this.records.get(i);if(t)return t;if(!this.stateStore)return null;let u=await this.stateStore.getByHandle(c_,i);if(!u)return null;let l=await this.rehydrate(u.id,i,u);if(l)this.records.set(i,l);return l}async resurrectByHandle(i){if(!this.stateStore)return null;let t=await this.stateStore.getByHandle(c_,i);if(!t)return null;let u=t.state.ensureOpts;if(!u)return null;return await this.ensure(t.id,u),this.records.get(i)??null}invalidateRecord(i){let t=this.records.get(i);if(!t)return;this.records.delete(i),this.closeForwarder(t.daemonForward)}recordProxyDuration(i,t,u,l,n){if(!this.metrics)return;this.metrics.proxyDurationMs.record(l,{...Yut(u?.tenant??null),source:i,sandbox_handle:u?.handle??n??"",status_code:t||0})}composePreviewUrl(i){if(this.previewUrlPattern)return L_i(this.previewUrlPattern,i.handle);return`http://127.0.0.1:${i.daemonForward.localPort}/`}toSandbox(i){return{handle:i.handle,workdir:i.workdir,previewUrl:this.composePreviewUrl(i)}}async persist(i,t){if(!i)return;let u={adoptedSandboxName:t.adoptedSandboxName,token:t.token,workdir:t.workdir,workload:t.workload,daemonBootId:t.daemonBootId,tenant:t.tenant,...t.ensureOpts?{ensureOpts:t.ensureOpts}:{}};await i.put(t.id,c_,{handle:t.handle,state:u})}computeShutdownTime(){return new Date(Date.now()+this.idleTtlMs).toISOString()}openForwarder(i,t,u=i){let l=TJ0(u,t);return new Promise((n,f)=>{let c=($,d)=>{let _=jUu.createServer((g)=>this.handleForwardedConnection(g,i,t,u));_.once("error",(g)=>{if(g.code==="EADDRINUSE"&&d<XJ0){try{_.close()}catch{}let h=Put+($-Put+1)%SUu;c(h,d+1);return}f(g)}),_.listen($,"127.0.0.1",()=>{let g=_.address();if(!g||typeof g==="string"){_.close(),f(Error("port-forward listener failed to bind"));return}n({server:_,localPort:g.port})})};c(l,0)})}handleForwardedConnection(i,t,u,l){let n=new hJ0,f=null,c=!1,$=()=>{if(c)return;if(c=!0,n.destroy(),f)try{f.close()}catch{}if(!i.destroyed)i.destroy()};i.pipe(n),i.on("error",$),i.on("close",$),this.portForward.portForward(this.namespace,t,[u],i,null,n).then((d)=>{let _=typeof d==="function"?d():d;if(!_){$();return}if(f=_,f.on("close",$),f.on("error",()=>{this.invalidateRecord(l),$()}),c)try{f.close()}catch{}}).catch((d)=>{console.warn(`[${S4}] port-forward to ${t}:${u} failed: ${EJ0(d)}`),this.invalidateRecord(l),$()})}closeForwarder(i){i.server.close((t)=>{if(t)console.warn(`[${S4}] port-forward close on :${i.localPort} errored: ${t instanceof Error?t.message:String(t)}`)})}close(){if(this.closed)return;this.closed=!0,this.claimWatchAbort.abort();for(let i of this.records.values())this.closeForwarder(i.daemonForward);this.records.clear()}}function NJ0(i){return{active:i.createUpDownCounter("studio.sandbox.active",{description:"Active sandbox count, by runner kind and owning org. Cross-checks the cAdvisor-derived count from the cluster \u2014 divergence between the two indicates orphaned claims (mesh deleted but K8s didn't reap) or unattributed pods.",unit:"{sandbox}"}),ensureOutcome:i.createCounter("studio.sandbox.ensure.outcome",{description:"Outcome of each ensure() call: fresh provision, resume from state-store after restart, or adopt of a cluster-side claim mesh didn't know about. Cold-start ratio is the primary input for warm-pool sizing.",unit:"{call}"}),proxyDurationMs:i.createHistogram("studio.sandbox.proxy.duration_ms",{description:"Wall-clock latency of mesh-mediated requests to the sandbox daemon: tool exec proxies (source=daemon) and preview iframe traffic (source=preview).",unit:"ms"})}}function JJ0(){let i=new Az;return i.loadFromDefault(),i}function WUu(i){return Boolean(i.status?.conditions?.some((t)=>t.type==="Ready"&&t.status==="True"))}function UJ0(i){let t=i.spec?.env;if(!t)return null;for(let u of t)if(u.name==="DAEMON_TOKEN"&&u.value)return u.value;return null}function TJ0(i,t){let u=dJ0("sha256").update(`${i}:${t}`).digest();return Put+u.readUInt32BE(0)%SUu}function But(i,t){return new Response(JSON.stringify(t),{status:i,headers:{"content-type":"application/json","access-control-allow-origin":"*"}})}function kUu(i){let t=i.slice(0,IJ0);return FJ0.test(t)?t:""}function BJ0(i){if(i===void 0)return null;let t=i.trim();if(t==="")return null;if(!ZJ0.test(t))throw Error(`AgentSandboxProvider: envName=${JSON.stringify(t)} is not a valid DNS-label-safe environment name (lowercase alphanumeric or '-', starts with a letter, ends alphanumeric, \u226432 chars). Mesh sets this from STUDIO_ENV; check the studio chart's configMap.`);return t}function Qut(i,t={}){let u={...t};if(i){let l=kUu(i.orgId),n=kUu(i.userId);if(l)u[W6.orgId]=l;if(n)u[W6.userId]=n}return u}function KP(i){let t="";for(let u of i){let l=u.codePointAt(0)??0;t+=l<32||l===127?" ":u}return t.slice(0,QJ0)}function YJ0(i){try{let t=new URL(i);return t.username="",t.password="",t.toString()}catch{return""}}function PJ0(i){let t={},u=i.tenant;if(u?.orgSlug)t[dE.orgSlug]=KP(u.orgSlug);if(u?.orgName)t[dE.orgName]=KP(u.orgName);if(u?.userEmail)t[dE.userEmail]=KP(u.userEmail);if(u?.userName)t[dE.userName]=KP(u.userName);let l=i.repo;if(l){if(l.displayName)t[dE.gitRepo]=KP(l.displayName);let n=YJ0(l.cloneUrl);if(n)t[dE.gitRepoUrl]=KP(n);let f=i.branch??l.branch;if(f)t[dE.gitBranch]=KP(f)}return t}function AJ0(i){let t=i.metadata?.labels;if(!t)return null;let u=t[W6.orgId],l=t[W6.userId];if(!u||!l)return null;let n=i.metadata?.annotations??{};return{orgId:u,userId:l,orgSlug:n[dE.orgSlug],orgName:n[dE.orgName],userEmail:n[dE.userEmail],userName:n[dE.userName]}}function Yut(i){return{org_id:i?.orgId??"",user_id:i?.userId??"",runner_kind:c_}}function GJ0(i){let t={};if(i.repo)t.repo=i.repo;if(i.workload)t.workload=i.workload;if(i.env&&Object.keys(i.env).length>0)t.env=i.env;if(i.tenant)t.tenant=i.tenant;return Object.keys(t).length>0?t:null}function WJ0(i,t){try{return new URL(L_i(i,t)).hostname||null}catch{return null}}var c_="agent-sandbox",S4="AgentSandboxProvider",HP="x-sandbox-preview-not-ready",vJ0="agent-sandbox-system",rJ0="studio-sandbox",$D=9000,wJ0=3000,Zut="/app",xJ0=32,DJ0,OJ0=900000,yJ0,GUu,Put=40000,SUu=1e4,XJ0=256,W6,dE,FJ0,IJ0=63,ZJ0,QJ0=253;var zUu=w(()=>{Out();lGi();e_i();xyi();fa();AUu();DJ0=new Set(["DAEMON_TOKEN","DAEMON_BOOT_ID","APP_ROOT","PROXY_PORT"]),yJ0=["cookie","host","connection","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","accept-encoding","content-length","upgrade"],GUu=["connection","keep-alive","transfer-encoding","content-encoding","content-length"];W6={role:"studio.decocms.com/role",sandboxHandle:"studio.decocms.com/sandbox-handle",orgId:"studio.decocms.com/org-id",userId:"studio.decocms.com/user-id",env:"studio.decocms.com/env"},dE={orgSlug:"studio.decocms.com/org-slug",orgName:"studio.decocms.com/org-name",userEmail:"studio.decocms.com/user-email",userName:"studio.decocms.com/user-name",gitRepo:"studio.decocms.com/git-repo",gitRepoUrl:"studio.decocms.com/git-repo-url",gitBranch:"studio.decocms.com/git-branch"},FJ0=/^([A-Za-z0-9]([-A-Za-z0-9_.]*[A-Za-z0-9])?)?$/;ZJ0=/^[a-z]([a-z0-9-]{0,30}[a-z0-9])?$/});var bUu={};Gi(bUu,{waitForSandboxReady:()=>wyi,getSandboxClaim:()=>P2,getHttpRoute:()=>FUu,deleteSandboxClaim:()=>cD,deleteHttpRoute:()=>ryi,createSandboxClaim:()=>$a,applyHttpRoute:()=>vyi,SandboxTimeoutError:()=>zP,SandboxError:()=>Ec,PREVIEW_NOT_READY_HEADER:()=>HP,KubeConfig:()=>Az,K8S_CONSTANTS:()=>q1,HTTPROUTE_CONSTANTS:()=>da,AgentSandboxProvider:()=>Aut});var Gut=w(()=>{Out();fa();xyi();zUu()});class Oyi{kind=dD;userSub;dispatch;stateStore;records=new Map;constructor(i){if(!i.userSub)throw Error("DesktopSandboxProvider requires userSub");if(!i.dispatch)throw Error("DesktopSandboxProvider requires dispatch");this.userSub=i.userSub,this.dispatch=i.dispatch,this.stateStore=i.stateStore??null}async ensure(i,t={}){let u=t.branch??t.repo?.branch,l=q5(i,u),n=this.records.get(l);if(n){if(await this.probeHealth(l))return this.toSandbox(n);if(this.records.delete(l),this.stateStore)await this.stateStore.deleteByHandle(dD,l).catch(()=>{})}else if(this.stateStore){let E=(await this.stateStore.getByHandle(dD,l))?.state,v=E?.sandboxApiUrl;if(v){if(await this.probeHealth(l)){let r={handle:l,sandboxApiUrl:v,previewUrl:E?.previewUrl??v};return this.records.set(l,r),this.toSandbox(r)}await this.stateStore.deleteByHandle(dD,l).catch(()=>{})}}let f=ih({userName:t.tenant?.userName,userEmail:t.tenant?.userEmail}),c=JSON.stringify({handle:l,repo:t.repo,branch:u,...t.workload?{workload:t.workload}:{},...f?{operator:f}:{},...t.offloadAllowedHosts?{offloadAllowedHosts:t.offloadAllowedHosts}:{},...t.offloadAllowSameHostDev!==void 0?{offloadAllowSameHostDev:t.offloadAllowSameHostDev}:{},...t.orgFsConfigJson?{orgFsConfigJson:t.orgFsConfigJson}:{}}),$=await this.dispatchJson("POST","/api/sandboxes",c),d=JSON.parse($);if(typeof d.sandboxApiUrl!=="string")throw Error("desktop ensure: daemon did not return a sandboxApiUrl string");let _=typeof d.previewUrl==="string"?d.previewUrl:d.sandboxApiUrl,g={handle:l,sandboxApiUrl:d.sandboxApiUrl,previewUrl:_};if(this.records.set(l,g),this.stateStore)await this.stateStore.put(i,dD,{handle:l,state:{handle:l,sandboxApiUrl:d.sandboxApiUrl,previewUrl:_}});return this.toSandbox(g)}async proxyDaemonRequest(i,t,u){let l=t.startsWith("/")?t:`/${t}`,n=l.startsWith("/_sandbox/")?l.slice(9):l,f=`/_sandbox/${encodeURIComponent(i)}${n}`,c=new Headers(u.headers);for(let y of["host","cookie","connection","keep-alive","transfer-encoding","upgrade","authorization"])c.delete(y);let $={};c.forEach((y,X)=>{$[X]=y});let d;if(u.body!=null)d=await jJ0(u.body);let g=this.dispatch(this.userSub,{method:u.method,path:f,headers:$,body:d},{signal:u.signal})[Symbol.asyncIterator](),h=kJ0(),E=200,v={"content-type":"application/octet-stream"},r=[];try{while(!0){let y=await g.next();if(y.done)break;let X=y.value;if(X.headers){E=X.headers.status,v=X.headers.headers;break}if(X.data!=null){let N=h.push(X.data);if(N.length)r.push(N)}}}catch(y){let X=y instanceof Error?y.message:"dispatch error";return new Response(JSON.stringify({error:X}),{status:502,headers:{"content-type":"application/json"}})}let x=!1,O=new ReadableStream({async start(y){for(let X of r)y.enqueue(X)},async pull(y){try{while(!0){let X=await g.next();if(x)return;if(X.done){let U=h.flush();if(U.length)y.enqueue(U);y.close();return}let N=X.value;if(N.data!=null){let U=h.push(N.data);if(U.length){y.enqueue(U);return}}}}catch(X){if(!x)y.error(X)}},cancel(){x=!0,g.return?.()}});return new Response(O,{status:E,headers:v})}async alive(i){return this.probeHealth(i)}async probeHealth(i){let t=new AbortController,u=setTimeout(()=>t.abort(),3000);try{return await this.dispatchJson("GET",`/api/sandboxes/${encodeURIComponent(i)}`,void 0,t.signal),!0}catch{return!1}finally{clearTimeout(u)}}async forgetHandle(i){if(this.records.delete(i),this.stateStore)await this.stateStore.deleteByHandle(dD,i).catch(()=>{})}async delete(i){if(this.records.delete(i),this.stateStore)await this.stateStore.deleteByHandle(dD,i).catch(()=>{});try{await this.dispatchJson("DELETE",`/api/sandboxes/${encodeURIComponent(i)}`)}catch(t){if(!(t instanceof Error?t.message:String(t)).includes("404"))throw t}}async getPreviewUrl(i){return(await this.resolveRecord(i))?.previewUrl??null}async localWorkdir(i){return null}async*watchClaimLifecycle(i,t){yield{kind:"ready"}}toSandbox(i){return{handle:i.handle,workdir:i.sandboxApiUrl,previewUrl:i.previewUrl}}async resolveRecord(i){let t=this.records.get(i);if(t)return t;if(!this.stateStore)return null;let l=(await this.stateStore.getByHandle(dD,i))?.state,n=l?.sandboxApiUrl;if(!n)return null;let f={handle:i,sandboxApiUrl:n,previewUrl:l?.previewUrl??n};return this.records.set(i,f),f}async dispatchJson(i,t,u,l){let n={accept:"application/json"};if(u!==void 0)n["content-type"]="application/json";let f=this.dispatch(this.userSub,{method:i,path:t,headers:n,body:u},{signal:l}),c=null,$="";for await(let _ of f)if(_.headers)c=_.headers.status;else if(_.data!=null)$+=_.data;let d=Buffer.from($,"base64").toString("utf8");if(c!=null&&(c<200||c>=300))throw Error(`daemon returned ${c}: ${d}`);return d}}function KUu(i){return new Oyi(i)}function kJ0(){let i="";return{push(t){if(t.length===0)return Wut;i+=t;let u=i.length-i.length%4;if(u===0)return Wut;let l=i.slice(0,u);return i=i.slice(u),new Uint8Array(Buffer.from(l,"base64"))},flush(){if(i.length===0)return Wut;let t=i;return i="",new Uint8Array(Buffer.from(t,"base64"))}}}async function jJ0(i){if(typeof i==="string")return i;if(i instanceof ArrayBuffer)return Buffer.from(i).toString("utf8");if(ArrayBuffer.isView(i))return Buffer.from(i.buffer,i.byteOffset,i.byteLength).toString("utf8");if(i instanceof URLSearchParams)return i.toString();return await new Response(i).text()}var dD="user-desktop",Wut;var HUu=w(()=>{e_i();qui();Wut=new Uint8Array(0)});var RUu={};Gi(RUu,{createDesktopProvider:()=>KUu,DesktopSandboxProvider:()=>Oyi});var LUu=w(()=>{HUu()});var aUu={};Gi(aUu,{subscribeLifecycle:()=>_a,getSandboxProviderByKind:()=>jut,getOrInitSharedRunner:()=>eJ0,buildDesktopProvider:()=>yyi,__resetSharedLifecyclesForTesting:()=>aJ0});function qUu(i,t){let u=eUu[i];if(u)return Promise.resolve(u);let l=kut[i];if(l)return l;let n=t().then((f)=>{return eUu[i]=f,f}).finally(()=>{delete kut[i]});return kut[i]=n,n}function bJ0(){let i=process.env.STUDIO_SANDBOX_PREVIEW_URL_PATTERN;return i&&i.trim()!==""?i:void 0}function KJ0(){let i=process.env.STUDIO_SANDBOX_TEMPLATE_NAME;return i&&i.trim()!==""?i:void 0}function HJ0(){let i=process.env.STUDIO_ENV;return i&&i.trim()!==""?i:void 0}function RJ0(){let i=process.env.STUDIO_SANDBOX_SENTINEL_TOKEN;return i&&i.trim()!==""?i:void 0}function LJ0(){let i=process.env.STUDIO_SANDBOX_PREVIEW_GATEWAY_NAME?.trim(),t=process.env.STUDIO_SANDBOX_PREVIEW_GATEWAY_NAMESPACE?.trim();if(!i&&!t)return;if(!i||!t)throw Error("STUDIO_SANDBOX_PREVIEW_GATEWAY_NAME and STUDIO_SANDBOX_PREVIEW_GATEWAY_NAMESPACE must both be set, or both unset. Half-configured per-claim HTTPRoute routing would silently fail to attach.");return{name:i,namespace:t}}async function VUu(i,t){let u=new a5(t),l=bJ0();switch(i){case"agent-sandbox":{let{AgentSandboxProvider:n}=await Promise.resolve().then(() => (Gut(),bUu));return new n({stateStore:u,previewUrlPattern:l,sandboxTemplateName:KJ0(),envName:HJ0(),previewGateway:LJ0(),sentinelToken:RJ0(),meter:lf})}case"user-desktop":throw Error("user-desktop provider cannot be instantiated without a per-run link claim \u2014 call resolveSandboxProvider, which binds the link before constructing the provider.");default:throw Error(`Unknown sandbox provider kind: ${String(i)}`)}}async function yyi(i,t){let{DesktopSandboxProvider:u}=await Promise.resolve().then(() => (LUu(),RUu)),{getProxyDispatch:l}=await Promise.resolve().then(() => (zut(),Sut)),n=new a5(i.db);if(!t)throw Error("buildDesktopProvider: userSub must be a non-empty string");let f=l();return new u({userSub:t,dispatch:f,stateStore:n})}function jut(i,t){return qUu(t,()=>VUu(t,i.db))}async function eJ0(){let i;try{i=av()}catch(u){return console.warn("[lifecycle] cannot resolve sandbox runner:",u instanceof Error?u.message:String(u)),null}return await qUu(i,()=>VUu(i,R0().db))}function _a(i,t,u){let l=_D.get(t);if(l){if(l.terminated){if(l.lastPhase)try{u(l.lastPhase)}catch{}return{unsubscribe:qJ0}}if(l.listeners.add(u),l.lastPhase)try{u(l.lastPhase)}catch{}return CUu(t,l,u)}let n=new AbortController,f={lastPhase:null,terminated:!1,listeners:new Set([u]),abort:n};return _D.set(t,f),VJ0(i,t,f),CUu(t,f,u)}function qJ0(){}function CUu(i,t,u){return{unsubscribe(){if(_D.get(i)!==t)return;if(t.listeners.delete(u),t.listeners.size===0)_D.delete(i),t.abort.abort()}}}async function VJ0(i,t,u){let l=null;try{for await(let n of i.watchClaimLifecycle(t,u.abort.signal)){if(u.abort.signal.aborted)break;u.lastPhase=n;let f=n.kind==="ready"||n.kind==="failed";if(f)u.terminated=!0;let c=Array.from(u.listeners);for(let $ of c)try{$(n)}catch{}if(f)break}}catch(n){l=n}finally{if(!u.terminated&&!u.abort.signal.aborted&&u.listeners.size>0){let n={kind:"failed",reason:"unknown",message:l instanceof Error?l.message:"Lifecycle watcher ended unexpectedly"};u.lastPhase=n,u.terminated=!0;for(let f of Array.from(u.listeners))try{f(n)}catch{}}if(_D.get(t)===u)_D.delete(t)}}function aJ0(){for(let i of _D.values())i.abort.abort();_D.clear()}var SJ0,zJ0,MUu,eUu,kut,CJ0,MJ0,_D;var ga=w(()=>{_g();Nd();s1();m_i();SJ0=Symbol.for("decocms.sandbox.lifecycle.runners"),zJ0=Symbol.for("decocms.sandbox.lifecycle.inflight"),MUu=globalThis,eUu=MUu[SJ0]??={},kut=MUu[zJ0]??={};CJ0=Symbol.for("decocms.sandbox.lifecycle.shared-lifecycles"),MJ0=globalThis,_D=MJ0[CJ0]??=new Map});async function Xyi(i,t){if(await t.linkClaimRegistry.get(i))return"user-desktop";return t.resolveEnvKind()}async function _E(i,t){let{userId:u,branch:l,virtualMcpMetadata:n,explicitKind:f}=t;if(f)return{provider:await ha(i,u,f),kind:f};if(i.sandboxPreference==="agent-sandbox")return{provider:await ha(i,u,"agent-sandbox"),kind:"agent-sandbox"};if(i.sandboxPreference==="user-desktop"&&i.linkForCurrentRun)return{provider:await yyi(i,u),kind:"user-desktop"};if(i.sandboxPreference==="cluster-default"){let g=av();return{provider:await ha(i,u,g),kind:g}}let[c,...$]=mJ0(n,u,l);if(c){let g=$.length===0?c:await oJ0(i,u,c,$);return{provider:await ha(i,u,g),kind:g}}let d=await mUu(i,u);return{provider:await ha(i,u,d),kind:d}}function mJ0(i,t,u){let l=gg(i)[t]?.[u];if(!l)return[];let n=w3(l);return Object.keys(n)}async function oJ0(i,t,u,l){let n=await mUu(i,t);if(n===u||l.includes(n))return n;return u}async function mUu(i,t){if(!i.linkClaimRegistry)return av();return Xyi(t,{linkClaimRegistry:i.linkClaimRegistry,resolveEnvKind:av})}async function ha(i,t,u){if(u!=="user-desktop")return jut(i,u);if(!i.linkClaimRegistry)throw Error("user-desktop sandbox provider requires ctx.linkClaimRegistry to be wired (set on StudioContextConfig).");if(!await i.linkClaimRegistry.get(t))throw Error(`No link daemon registered for user "${t}". Start one with \`deco link\` (or run \`bun run dev --local-sandbox-provider\` for dev).`);return yyi(i,t)}var Sz=w(()=>{zl();_g();T2();ga()});async function Nyi(i,t){if(!i)return{hosts:[],allowSameHostDev:!1};let u;try{u=await i.presignedGetUrl("link-dispatch/_allowlist_probe",60,{requireFetchable:!0})}catch{return{hosts:[],allowSameHostDev:!1}}let l;try{l=new URL(u)}catch{return{hosts:[],allowSameHostDev:!1}}if(l.protocol!=="https:"&&l.protocol!=="http:")return{hosts:[],allowSameHostDev:!1};let n=l.hostname,f=sJ0.has(n);return{hosts:[n],allowSameHostDev:f&&!t.isProduction}}var sJ0;var but=w(()=>{sJ0=new Set(["127.0.0.1","localhost","::1","[::1]","0.0.0.0"])});function zz(i){if(pJ0.has(i)||!iU0.test(i))return"home";return i}var pJ0,iU0;var Jyi=w(()=>{pJ0=new Set(["output","upload","public","home"]),iU0=/^[A-Za-z0-9][A-Za-z0-9._-]*$/});function nU0(i){return{baseUrl:i.baseUrl.replace(/\/+$/,""),orgSlug:i.orgSlug,token:i.token,mounts:[{volume:"home",path:zz(i.orgSlug)},...lU0.map((t)=>({...t})),...(i.publicSets??[]).map((t)=>({volume:J1i(t),path:`public/${t}`,readonly:!0}))]}}async function Uyi(i,t){try{let u=await i.boundAuth.apiKey.create({name:`orgfs-${t.orgSlug}`,expiresIn:fU0,metadata:{organization:{id:t.orgId,slug:t.orgSlug}}});return JSON.stringify(nU0({baseUrl:t.baseUrl,orgSlug:t.orgSlug,token:u.key,publicSets:Ih().map((l)=>l.set)}))}catch(u){console.warn("[org-fs] token mint failed; mounts disabled for this sandbox",u);return}}var tU0=".outputs",uU0=".uploads",lU0,fU0=604800;var Kut=w(()=>{Jyi();jk();lU0=[{volume:"outputs",path:tU0},{volume:"uploads",path:uU0}]});import{z as tr}from"zod";async function oUu(i,t){Ui(t);let u=Ei(t),l=yu(t);if(!l)throw Error("User ID required");let n=await t.storage.virtualMcps.findById(i.virtualMcpId);if(!n||n.organization_id!==u.id)throw Error("Virtual MCP not found");let f=n.metadata??{},c=U2(gg(f),l,i.branch,i.sandboxProviderKind),$=i.sandboxProviderKind,{provider:d}=await _E(t,{userId:l,branch:i.branch,virtualMcpMetadata:f,explicitKind:$});if(c){if($!=="user-desktop")return c;if(await d.alive(c.sandboxHandle).catch(()=>!1))return c;await V5(t.storage.virtualMcps,i.virtualMcpId,l,l,i.branch,$).catch((E)=>{console.warn("[ensureSandbox] failed to reap stale user-desktop entry",E)})}let _=f.githubRepo??null,{entry:g}=await sUu({ctx:t,userId:l,orgId:u.id,virtualMcpId:i.virtualMcpId,branch:i.branch,metadata:f,githubRepo:_,existing:null,providerKind:$,runner:d});return g}async function sUu(i){let{ctx:t,userId:u,orgId:l,virtualMcpId:n,branch:f,metadata:c,githubRepo:$,existing:d,runner:_}=i,{runtime:g,packageManager:h,port:E,packageManagerPath:v}=C_i(c),r;if($){if($.connectionId)await Xz({ctx:t,connectionId:$.connectionId,organizationId:l,onLegacyMintError:(p)=>{console.error("[provisionSandbox] repo-scoped legacy token mint failed",{connectionId:$.connectionId,error:p.message})}});let{cloneUrl:m,gitUserName:S,gitUserEmail:M}=$.connectionId?await Nz($.connectionId,$.owner,$.name,t.db,t.vault):q_i($.owner,$.name);if(!h){let p=$.connectionId?await zOu($.connectionId,$.owner,$.name,t.db,t.vault):await bOu($.owner,$.name);if(p)h=p.packageManager,g=zV[p.packageManager].runtime,E=p.devPort??E,await $U0(t,n,u,p.packageManager,p.devPort)}r={cloneUrl:m,userName:S,userEmail:M,branch:f,displayName:`${$.owner}/${$.name}`}}let x=g&&h?{runtime:g,packageManager:h,...E!==null?{devPort:Number(E)}:{},...v?{packageManagerPath:v}:{}}:void 0,O=J2({orgId:l,virtualMcpId:n,branch:f}),y=_.kind==="user-desktop"?await Nyi(t.objectStorage,{isProduction:Qt().nodeEnv==="production"}):null,X=_.kind==="user-desktop"||_.kind==="agent-sandbox"&&Qt().orgFsClusterMounts,N;if(X){let m=t.organization?.slug??(await t.db.selectFrom("organization").select(["slug"]).where("id","=",l).executeTakeFirst())?.slug;if(m)N=await Uyi(t,{orgSlug:m,orgId:l,baseUrl:QE()})}let U=await _.ensure({userId:u,projectRef:O},{branch:f,repo:r,workload:x,tenant:{orgId:l,userId:u,...t.organization?.slug?{orgSlug:t.organization.slug}:{},...t.organization?.name?{orgName:t.organization.name}:{},...t.auth.user?.email?{userEmail:t.auth.user.email}:{},...t.auth.user?.name?{userName:t.auth.user.name}:{}},...y?{offloadAllowedHosts:y.hosts,offloadAllowSameHostDev:y.allowSameHostDev}:{},...N?{orgFsConfigJson:N}:{}}),J=c.runtime?.env??null;await M_i({ctx:t,runner:_,handle:U.handle,orgId:l,userId:u,entries:J});let Q=!!d&&d.sandboxHandle===U.handle&&d?.createdAt?d.createdAt:Date.now(),B=c.runtime?.selected??null,P=c.runtime?.port??null,H=c.runtime?.path??null,j={sandboxHandle:U.handle,previewUrl:U.previewUrl,sandboxApiUrl:U.previewUrl,sandboxProviderKind:_.kind,createdAt:Q,startedWith:{packageManager:B,port:P,path:H}};await GOu(t.storage.virtualMcps,n,u,u,f,i.providerKind,j);let k=!d||d.sandboxHandle!==U.handle;return{entry:j,isNewVm:k}}async function $U0(i,t,u,l,n){let f=await i.storage.virtualMcps.findById(t);if(!f)return;let c=f.metadata??{};await i.storage.virtualMcps.update(t,u,{metadata:{...c,runtime:{selected:l,port:n}}})}var cU0,Hut;var Rut=w(()=>{_g();Vi();bV();Fit();T2();V_i();HOu();Goi();Tit();Sz();but();U0();T_();Kut();T2();cU0=tr.enum(["agent-sandbox","user-desktop","cluster"]),Hut=li({name:"SANDBOX_START",description:"Start a sandbox with the connected GitHub repo and dev server.",annotations:{title:"Start VM Preview",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!1,openWorldHint:!0},_meta:{ui:{visibility:"app"}},inputSchema:tr.object({virtualMcpId:tr.string().describe("Virtual MCP ID"),branch:tr.string().min(1).optional().describe("Optional git branch to check out. When omitted the handler generates `deco/<adjective>-<noun>` and uses it. The resolved branch is returned in the response so callers can persist it."),sandboxProviderKind:cU0.optional().describe("Explicit runtime choice. Hosted provider is `agent-sandbox`; legacy `cluster` input is accepted only for compatibility and normalized to `agent-sandbox`. When omitted, defaults to `user-desktop` if the acting user's link daemon is online, else the env kind.")}),outputSchema:tr.object({previewUrl:tr.string().nullable(),sandboxHandle:tr.string(),branch:tr.string(),isNewVm:tr.boolean(),sandboxProviderKind:tr.enum(["agent-sandbox","user-desktop"])}),handler:async(i,t)=>{Ui(t);let u=Ei(t);await t.access.check();let l=i.branch??Qdi(),n=yu(t);if(!n)throw Error("User ID required");let f=await t.storage.virtualMcps.findById(i.virtualMcpId);if(!f||f.organization_id!==u.id)throw Error("Virtual MCP not found");let c=f.metadata??{},$=i.sandboxProviderKind?N2(i.sandboxProviderKind):void 0,{provider:d,kind:_}=await _E(t,{userId:n,branch:l,virtualMcpMetadata:c,explicitKind:$}),g=U2(gg(c),n,l,_),h=c.githubRepo??null,{entry:E,isNewVm:v}=await sUu({ctx:t,userId:n,orgId:u.id,virtualMcpId:i.virtualMcpId,branch:l,metadata:c,githubRepo:h,existing:g,providerKind:_,runner:d});return{...E,branch:l,isNewVm:v,sandboxProviderKind:_}}})});import{z as bz}from"zod";var dU0,Lut;var pUu=w(()=>{_g();Vi();bV();T2();Sz();dU0=bz.enum(["agent-sandbox","user-desktop","cluster"]),Lut=li({name:"SANDBOX_DELETE",description:"Delete a sandbox.",annotations:{title:"Delete VM Preview",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!0},_meta:{ui:{visibility:"app"}},inputSchema:bz.object({virtualMcpId:bz.string().describe("Virtual MCP ID that owns this VM"),branch:bz.string().min(1).describe("Branch whose vm should be deleted (sandboxMap[userId][branch])"),sandboxProviderKind:dU0.describe("Kind of sandbox provider the VM was started with. Hosted provider is `agent-sandbox`; legacy `cluster` input is accepted only for compatibility and normalized to `agent-sandbox`. Used to locate the correct 3-level sandboxMap entry.")}),outputSchema:bz.object({success:bz.boolean()}),handler:async(i,t)=>{let u=N2(i.sandboxProviderKind),l;try{l=await kOu({...i,sandboxProviderKind:u},t)}catch($){if($ instanceof Error&&$.message==="Virtual MCP not found")return{success:!0};throw $}let{entry:n,userId:f}=l;if(!n)return{success:!0};let{provider:c}=await _E(t,{userId:f,branch:i.branch,virtualMcpMetadata:l.metadata,explicitKind:u});return await V5(t.storage.virtualMcps,i.virtualMcpId,f,f,i.branch,u),await c.delete(n.sandboxHandle).catch(($)=>console.error(`[SANDBOX_DELETE] ${u} ${n.sandboxHandle}: ${$ instanceof Error?$.message:String($)}`)),{success:!0}}})});var iTu=w(()=>{Rut();pUu()});import{z as ur}from"zod";var gU0="https://api.github.com",eut;var tTu=w(()=>{Vi();Ly();zS();kv();eut=li({name:"GITHUB_LIST_USER_ORGS",description:"List GitHub App installations (orgs/accounts) accessible to the authenticated user.",annotations:{title:"List GitHub User Orgs",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!0},_meta:{ui:{visibility:"app"}},inputSchema:ur.object({connectionId:ur.string().describe("ID of the mcp-github connection to use")}),outputSchema:ur.object({installations:ur.array(ur.object({installationId:ur.number(),login:ur.string(),avatarUrl:ur.string(),type:ur.string()})),appSlug:ur.string().optional()}),handler:async(i,t)=>{await t.access.check();let u=t.organization?.id;if(!u)throw Error("Organization context required");let l=await t.storage.connections.findById(i.connectionId,u);if(!l)throw Error("Connection not found");if(jv(l))throw Error("Repo-scoped connections cannot list installations \u2014 use an org-level mcp-github connection");let n=new e1(t.db,t.vault),f=await n.get(i.connectionId);if(!f)throw Error("No GitHub token found. Ensure the mcp-github connection is authenticated.");let c=f.accessToken;if(wdi(f)&&n.isExpired(f,eq)){let E=await xdi(f,n);if(!E)throw Error(O$);c=E,f=await n.get(i.connectionId)??f}let $=[],d,_=1,g=100,h=async(E)=>fetch(`${gU0}/user/installations?per_page=${g}&page=${_}`,{headers:{Authorization:`Bearer ${E}`,Accept:"application/vnd.github+json","X-GitHub-Api-Version":"2022-11-28"}});while(!0){let E=await h(c);if(E.status===401){let r=await n.get(i.connectionId);if(!r||!wdi(r))throw Error(O$);let x=await xdi(r,n);if(!x)throw Error(O$);if(c=x,E=await h(c),E.status===401)throw Error(O$)}if(!E.ok)throw Error(`GitHub /user/installations failed: ${E.status}`);let v=await E.json();for(let r of v.installations){if(!d)d=r.app_slug??r.app?.slug;$.push({installationId:r.id,login:r.account.login,avatarUrl:r.account.avatar_url,type:r.account.type})}if(v.installations.length<g)break;_++}return{installations:$,...d?{appSlug:d}:{}}}})});var uTu=w(()=>{tTu()});import RP from"zod";var Cut;var lTu=w(()=>{n0i();Vi();Cut=li({name:"LINK_CURRENT_GET",description:"Return the calling user's currently registered desktop link, or `online: false` if no link is registered or the TTL has expired.",inputSchema:RP.object({}),outputSchema:RP.object({online:RP.boolean(),machineId:RP.string().optional(),hostname:RP.string().optional(),cliVersion:RP.string().optional(),capabilities:RP.array(CWi).default([])}),handler:async(i,t)=>{Ui(t),await t.access.check();let u=t.linkClaimRegistry;if(!u)return{online:!1,capabilities:[]};let l=await u.get(t.auth.user.id);if(!l)return{online:!1,capabilities:[]};return{online:!0,machineId:l.machineId,hostname:l.hostname,cliVersion:l.cliVersion,capabilities:l.capabilities}}})});import Mut from"zod";var qut;var nTu=w(()=>{Vi();qut=li({name:"LINK_DISCONNECT",description:"Disconnect the calling user's desktop link from the Studio side: tells the linked daemon to shut down (via a `shutdown` control frame) and removes the presence claim. The user re-links by running `bunx decocms link` on the desktop.",inputSchema:Mut.object({}),outputSchema:Mut.object({disconnected:Mut.boolean()}),handler:async(i,t)=>{Ui(t),await t.access.check();let u=t.auth.user.id,l=t.linkClaimRegistry;if(!(l?await l.get(u):null))return{disconnected:!1};return t.publishLinkControlFrame?.(u,{type:"shutdown"}),await l.delete(u),{disconnected:!0}}})});var fTu=w(()=>{lTu();nTu()});import{z as vc}from"zod";function cTu(i){if(!i)return"";return typeof i==="string"?i:i.toISOString()}var vU0,rU0,wU0,xU0,DU0,Vut;var $Tu=w(()=>{Vi();vU0=["thread"],rU0=vc.object({type:vc.literal("thread"),id:vc.string(),title:vc.string(),created_at:vc.string(),updated_at:vc.string(),virtual_mcp_id:vc.string().nullable(),run_config:vc.record(vc.string(),vc.unknown()).nullable(),status:vc.string().nullable()}),wU0=vc.discriminatedUnion("type",[rU0]),xU0=vc.object({query:vc.string().min(1).describe("Free-text search query."),limit:vc.number().int().min(1).max(50).optional().describe("Maximum results per resource type (default: 20)."),types:vc.array(vc.enum(vU0)).optional().describe("Restrict the search to specific resource types. Omit to search across all available types.")}),DU0=vc.object({items:vc.array(wU0),totalCount:vc.number()});Vut=li({name:"GLOBAL_SEARCH",description:"Search across organization resources by free-text query. Returns a typed union of matches (currently: threads). New resource types may be added over time without changes to the call shape.",annotations:{title:"Global Search",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:xU0,outputSchema:DU0,handler:async(i,t)=>{await t.access.check(),Ei(t);let u=i.limit??20,l=i.types?.length?new Set(i.types):null,n=!l||l.has("thread"),f=[],c=0;if(n){let{threads:$,total:d}=await t.storage.threads.list(void 0,{limit:u,offset:0,search:i.query,includeArchived:!1});c+=d;for(let _ of $)f.push({type:"thread",id:_.id,title:_.title??"",created_at:cTu(_.created_at),updated_at:cTu(_.updated_at),virtual_mcp_id:_.virtual_mcp_id??null,run_config:_.run_config??null,status:_.status??null})}return{items:f,totalCount:c}}})});var dTu=w(()=>{$Tu()});var Ndi={};Gi(Ndi,{managementMCP:()=>pS,listManagementTools:()=>NU0,ALL_TOOLS:()=>_Tu});import{z as aut}from"zod";async function NU0(i){let t=await pS(i),[u,l]=Ce.createLinkedPair();await t.connect(l);let n=new N1({name:"tools-hydration",version:"1.0.0"},{jsonSchemaValidator:nc});try{return await n.connect(u),(await n.listTools()).tools}finally{await n.close().catch(()=>{}),await t.close().catch(()=>{})}}var yU0,XU0,_Tu,pS=async(i)=>{let t=null;if(i.organization){let c=await i.storage.organizationSettings.get(i.organization.id),$=await i.storage.virtualMcps.listEnabledPlugins(i.organization.id),d=new Set(c?.enabled_plugins??[]);for(let _ of $)d.add(_);t=d.size>0?[...d]:null}let u=jot(_Tu,t),l=new x3({name:"mcp-cms-management",version:"1.0.0"},{capabilities:{tools:{},prompts:{},resources:{}},jsonSchemaValidator:nc});for(let c of u){let $=c.inputSchema&&typeof c.inputSchema==="object"&&"shape"in c.inputSchema?c.inputSchema:aut.object({}),d=c.outputSchema&&typeof c.outputSchema==="object"&&"shape"in c.outputSchema?c.outputSchema:void 0,_=$.shape,g=d?.shape;l.registerTool(c.name,{description:c.description??"",inputSchema:_,outputSchema:g,annotations:c.annotations,_meta:c._meta},async(h)=>{i.access.setToolName(c.name);try{let E=await c.execute(h,i);return{content:[{type:"text",text:c.modelSummary?c.modelSummary(E):JSON.stringify(E)}],structuredContent:E}}catch(E){return{content:[{type:"text",text:`Error: ${E.message}`}],isError:!0}}})}let n=c_i();for(let c of n){let $=c.arguments?.length?Object.fromEntries(c.arguments.map((d)=>{let _=d.required?aut.string():aut.string().optional();return[d.name,d.description?_.describe(d.description):_]})):void 0;l.registerPrompt(c.name,{title:c.title,description:c.description,...$?{argsSchema:$}:{}},(d)=>{return{messages:[{role:"user",content:{type:"text",text:typeof c.text==="function"?c.text(d??{}):c.text}}]}})}if(i.organization?.id){let c=await i.storage.brandContext.list(i.organization.id),$=new Set;for(let d of c){let _=d.name.toLowerCase().replace(/[^a-z0-9]+/g,"-").replace(/^-|-$/g,""),g=_?`brand-${_}`:`brand-${d.id}`;if($.has(g))g=`${g}-${d.id.slice(0,8)}`;$.add(g);let h=[`# Brand: ${d.name}`,"",`**Domain:** ${d.domain}`,"","## Overview",d.overview];if(d.colors){let v=Object.entries(d.colors).filter(([,r])=>r);if(v.length>0){h.push("","## Colors");for(let[r,x]of v)h.push(`- **${r}:** ${x}`)}}if(d.fonts){let v=Object.entries(d.fonts).filter(([,r])=>r);if(v.length>0){h.push("","## Fonts");for(let[r,x]of v)h.push(`- ${x} (${r})`)}}if(d.logo)h.push("",`**Logo:** ${d.logo}`);if(d.favicon)h.push(`**Favicon:** ${d.favicon}`);if(d.ogImage)h.push(`**OG Image:** ${d.ogImage}`);if(d.images&&d.images.length>0){h.push("","## Images");for(let v of d.images){let r=Object.entries(v).map(([x,O])=>`${x}: ${O}`).join(", ");h.push(`- ${r}`)}}let E=h.join(`
+`))>=0){let d=l.slice(0,$).trim();if(l=l.slice($+1),!d)continue;yield JSON.parse(d)}}let n=l.trim();if(n)yield JSON.parse(n)}finally{t.releaseLock()}}var OUu,yUu,JUu="gateway.networking.k8s.io",UUu="v1",TUu="httproutes",iJ0,da,IUu="mesh-sandbox-runner";var xyi=w(()=>{fa();OUu=class OUu extends Error{status;body;constructor(i,t,u){super(u);this.status=i;this.body=t;this.name="KubeHttpError"}};yUu=`/apis/${q1.CLAIM_API_GROUP}/${q1.CLAIM_API_VERSION}/namespaces`;iJ0=`/apis/${JUu}/${UUu}/namespaces`;da={API_GROUP:JUu,API_VERSION:UUu,PLURAL:TUu}});async function*YUu(i){let t=i.now??(()=>Date.now()),u=t(),l=i.schedulingTimeoutMs??lJ0,n={pod:{},sandbox:{},events:{hasPulling:!1,hasPulled:!1},startedAt:u},f=[],c=null,$=!1,d=(X)=>{if($)return;if(c){let N=c;c=null,N(X)}else f.push(X)},_=()=>{if(f.length>0)return Promise.resolve(f.shift());if($)return Promise.resolve(null);return new Promise((X)=>{c=X})},g=()=>{if($)return;if($=!0,c){let X=c;c=null,X(null)}},h=new AbortController,E=()=>{h.abort(),g()};if(i.signal)if(i.signal.aborted)h.abort(),g();else i.signal.addEventListener("abort",E,{once:!0});let v=Math.max(0,l-(t()-u)),r=setTimeout(()=>d("tick"),v+100),x,O=new Promise((X)=>{x=X}),y=Promise.allSettled([nJ0(i.kc,i.namespace,i.claimName,h.signal,n,d,t,x),cJ0(i.kc,i.namespace,i.claimName,h.signal,n,d),$J0(i.kc,i.namespace,i.claimName,O,h.signal,n,d,t)]);try{let X=null,N=-1,U=BUu(n,l,t);if(X=Iut(U),!Fut(U))N=QUu(U);if(yield U,Fut(U))return;while(!$){if(await _()===null)break;let F=BUu(n,l,t);if(Fut(F)){let P=Iut(F);if(P!==X)X=P,yield F;return}let Q=QUu(F);if(Q<N)continue;let B=Iut(F);if(B!==X)X=B,N=Q,yield F}}finally{if(clearTimeout(r),h.abort(),i.signal)i.signal.removeEventListener("abort",E);g(),await y.catch(()=>{})}}function BUu(i,t,u){let{pod:l,sandbox:n,events:f,startedAt:c}=i;if(n.ready)return{kind:"ready"};let $=l.containerWaitingReason;if($==="ImagePullBackOff"||$==="ErrImagePull")return{kind:"failed",reason:"image-pull-backoff",message:"Sandbox image failed to download. The cluster may be missing pull credentials or the image tag may not exist."};if($==="CrashLoopBackOff")return{kind:"failed",reason:"crash-loop-backoff",message:"Sandbox crashed during startup and is now in CrashLoopBackOff. Check pod logs."};if(!l.scheduled&&f.lastFailedSchedulingAt!==void 0&&u()-c>t)return{kind:"failed",reason:"scheduling-timeout",message:f.failedSchedulingMessage??`Pod could not be scheduled within ${Math.round(t/1000)}s.`};if(l.containerRunning&&!l.containerReady)return{kind:"warming-daemon",since:c};if(f.hasPulling&&!f.hasPulled)return{kind:"pulling-image",since:c};if($==="ContainerCreating"||$==="PodInitializing"||l.scheduled&&!l.containerRunning)return{kind:"starting-container",since:c};if(l.scheduledFalseReason==="Unschedulable"||f.lastFailedSchedulingAt!==void 0&&!l.scheduled)return{kind:"waiting-for-capacity",since:c,message:f.failedSchedulingMessage??l.scheduledFalseMessage,nodeClaim:f.nominatedNodeClaim};return{kind:"claiming",since:c}}function Fut(i){return i.kind==="ready"||i.kind==="failed"}function QUu(i){switch(i.kind){case"claiming":return 0;case"waiting-for-capacity":return 1;case"pulling-image":return 2;case"starting-container":return 3;case"warming-daemon":return 4;case"ready":case"failed":return 99}}function Iut(i){switch(i.kind){case"claiming":case"pulling-image":case"starting-container":case"warming-daemon":return i.kind;case"waiting-for-capacity":return`waiting-for-capacity:${i.message??""}:${i.nodeClaim??""}`;case"ready":return"ready";case"failed":return`failed:${i.reason}:${i.message}`}}async function nJ0(i,t,u,l,n,f,c,$){let d=`/api/v1/namespaces/${encodeURIComponent(t)}/pods?watch=true&labelSelector=${encodeURIComponent(`${tJ0}=${u}`)}`;return Dyi({kc:i,path:d,signal:l,label:`pod/${u}`,onEvent:(_)=>{if(_.type!=="ADDED"&&_.type!=="MODIFIED")return;let g=_.object;if(g.metadata?.name)$(g.metadata.name);fJ0(g,n,c),f("pod")}})}function fJ0(i,t,u){let n=(i.status?.conditions??[]).find((c)=>c.type==="PodScheduled");if(n?.status==="True")t.pod.scheduled=!0,t.pod.scheduledFalseReason=void 0,t.pod.scheduledFalseMessage=void 0;else if(n?.status==="False")t.pod.scheduled=!1,t.pod.scheduledFalseReason=n.reason,t.pod.scheduledFalseMessage=n.message;let f=(i.status?.containerStatuses??[]).find((c)=>c.name===uJ0);if(f)t.pod.containerWaitingReason=f.state?.waiting?.reason,t.pod.containerRunning=!!f.state?.running,t.pod.containerReady=f.ready===!0}async function cJ0(i,t,u,l,n,f){let c=`/apis/${q1.CLAIM_API_GROUP}/${q1.CLAIM_API_VERSION}/namespaces/${encodeURIComponent(t)}/${q1.CLAIM_PLURAL}?watch=true&fieldSelector=${encodeURIComponent(`metadata.name=${u}`)}`;return Dyi({kc:i,path:c,signal:l,label:`sandboxclaim/${u}`,onEvent:($)=>{if($.type!=="ADDED"&&$.type!=="MODIFIED")return;let _=$.object.status?.conditions?.find((g)=>g.type==="Ready");if(!_)return;if(_.status==="True")n.sandbox.ready=!0,n.sandbox.notReadyReason=void 0,n.sandbox.notReadyMessage=void 0;else n.sandbox.ready=!1,n.sandbox.notReadyReason=_.reason,n.sandbox.notReadyMessage=_.message;f("sandbox")}})}async function $J0(i,t,u,l,n,f,c,$){let d=await Promise.race([l,new Promise((g)=>{if(n.aborted){g(u);return}n.addEventListener("abort",()=>g(u),{once:!0})})]);if(n.aborted)return;let _=`/api/v1/namespaces/${encodeURIComponent(t)}/events?watch=true&fieldSelector=${encodeURIComponent(`involvedObject.name=${d},involvedObject.kind=Pod`)}`;return Dyi({kc:i,path:_,signal:n,label:`events/${u}`,onEvent:(g)=>{if(g.type!=="ADDED"&&g.type!=="MODIFIED")return;let h=g.object,E=h.reason;if(!E)return;switch(E){case"Pulling":f.events.hasPulling=!0;break;case"Pulled":f.events.hasPulling=!0,f.events.hasPulled=!0;break;case"FailedScheduling":f.events.lastFailedSchedulingAt=$(),f.events.failedSchedulingMessage=h.message;break;case"Nominated":{let v=h.message?.match(/nodeclaim\/([\w-]+)/);if(v)f.events.nominatedNodeClaim=v[1];break}default:return}c("event")}})}async function PUu(i){let{kc:t,namespace:u,labelSelector:l,signal:n,onDelete:f}=i,c=`/apis/${q1.CLAIM_API_GROUP}/${q1.CLAIM_API_VERSION}/namespaces/${encodeURIComponent(u)}/${q1.CLAIM_PLURAL}?watch=true&labelSelector=${encodeURIComponent(l)}`;return Dyi({kc:t,path:c,signal:n,label:"sandboxclaim-reaper",onEvent:($)=>{if($.type!=="DELETED")return;let d=$.object.metadata?.name;if(d)f(d)}})}async function Dyi(i){let{kc:t,path:u,signal:l,label:n,onEvent:f}=i,c=0;while(!l.aborted){try{let d=await bP(t,{method:"GET",path:u,signal:l,headers:{accept:"application/json"}});if(!d.ok||!d.body){try{await d.body?.cancel()}catch{}throw Error(`watch handshake failed: ${d.status} ${d.statusText}`)}c=0;for await(let _ of Tut(d.body)){if(l.aborted)return;try{f(_)}catch(g){console.warn(`[lifecycle-watcher] ${n} onEvent threw: ${g instanceof Error?g.message:String(g)}`)}}}catch(d){if(l.aborted)return;let _=d instanceof Error?d.message:String(d);console.warn(`[lifecycle-watcher] ${n} watch ended: ${_}`)}if(l.aborted)return;let $=Wn(5000,250,c,2,0);c+=1,await mu($,{signal:l}).catch(()=>{})}}var tJ0="studio.decocms.com/sandbox-handle",uJ0="sandbox",lJ0=300000;var AUu=w(()=>{n1();fa();xyi()});import{createHash as dJ0,randomBytes as _J0,randomUUID as gJ0}from"crypto";import*as jUu from"net";import{PassThrough as hJ0}from"stream";function EJ0(i){if(i instanceof Error)return i.message;if(i&&typeof i==="object"){let t=i;if(t.error instanceof Error)return t.error.message;if(typeof t.message==="string"&&t.message)return t.message}return String(i)}class Aut{kind=c_;records=new Map;inflight=new H_i;stateStore;previewUrlPattern;kubeConfig;portForward;namespace;sandboxTemplateName;envName;tokenGenerator;idleTtlMs;metrics;previewGateway;sentinelToken;closed=!1;claimWatchAbort=new AbortController;constructor(i={}){this.stateStore=i.stateStore??null,this.previewUrlPattern=i.previewUrlPattern??null,this.kubeConfig=i.kubeConfig??JJ0(),this.portForward=new uut(this.kubeConfig),this.namespace=i.namespace??vJ0,this.sandboxTemplateName=i.sandboxTemplateName??rJ0,this.envName=BJ0(i.envName),this.tokenGenerator=i.tokenGenerator??(()=>_J0(xJ0).toString("hex")),this.idleTtlMs=i.idleTtlMs??OJ0,this.metrics=i.meter?NJ0(i.meter):null,this.previewGateway=i.previewGateway&&i.previewUrlPattern?{...i.previewGateway}:null;let t=i.sentinelToken?.trim()??"";this.sentinelToken=t.length>0?t:null,this.startClaimReaper()}startClaimReaper(){let i=["app.kubernetes.io/managed-by=studio","app.kubernetes.io/name=studio-sandbox",...this.envName?[`${W6.env}=${this.envName}`]:[]].join(",");PUu({kc:this.kubeConfig,namespace:this.namespace,labelSelector:i,signal:this.claimWatchAbort.signal,onDelete:(t)=>this.invalidateRecord(t)})}async ensure(i,t={}){let u=q5(i,t.branch??t.repo?.branch??null);return this.inflight.run(u,()=>R_i(this.stateStore,i,c_,(l)=>this.ensureLocked(i,u,t,l)))}async delete(i){let t=await this.getRecord(i);if(this.records.delete(i),t)this.closeForwarder(t.daemonForward),this.metrics?.active.add(-1,Yut(t.tenant));if(await this.deleteHttpRouteIfManaged(i).catch((u)=>{console.warn(`[${S4}] HTTPRoute delete failed for ${i}: ${u instanceof Error?u.message:String(u)}`)}),await cD(this.kubeConfig,this.namespace,i),this.stateStore)if(t)await this.stateStore.delete(t.id,c_);else await this.stateStore.deleteByHandle(c_,i)}async alive(i){return await P2(this.kubeConfig,this.namespace,i)!==void 0}watchClaimLifecycle(i,t){return YUu({kc:this.kubeConfig,namespace:this.namespace,claimName:i,signal:t})}async getPreviewUrl(i){let t=await this.getRecord(i);if(!t)return null;return this.composePreviewUrl(t)}async proxyDaemonRequest(i,t,u){let l=await this.getRecord(i);if(!l&&this.previewUrlPattern&&this.stateStore){let d=await this.stateStore.getByHandle(c_,i),_=d?.state,g=_?.token;if(d&&g){let E=`http://${_?.adoptedSandboxName??i}.${this.namespace}.svc.cluster.local:${$D}`;try{let v=await SH(E,g,t,u);if(v.status!==404)return v;try{await v.body?.cancel()}catch{}}catch{}}}if(!l)l=await this.resurrectByHandle(i);if(!l)return new Response(JSON.stringify({error:"sandbox not found"}),{status:404,headers:{"content-type":"application/json"}});let n=l,f=performance.now(),c=0,$=!(u.body instanceof ReadableStream);try{let d=await SH(l.daemonUrl,l.token,t,u);if(d.status===401&&$){this.invalidateRecord(i);let _=await this.getRecord(i).catch(()=>null)??await this.resurrectByHandle(i).catch(()=>null);if(_)n=_,d=await SH(_.daemonUrl,_.token,t,u)}return c=d.status,d}catch(d){if(!$)throw d;this.invalidateRecord(i);let _=await this.resurrectByHandle(i)??await this.getRecord(i).catch(()=>null);if(!_)throw d;n=_;let g=await SH(_.daemonUrl,_.token,t,u);return c=g.status,g}finally{this.recordProxyDuration("daemon",c,n,performance.now()-f)}}async adoptLiveClaim(i,t){if(this.records.has(t))return!0;let u=await P2(this.kubeConfig,this.namespace,t).catch(()=>{return});if(!u||u.metadata?.deletionTimestamp)return!1;return await this.inflight.run(t,async()=>{let n=this.records.get(t);if(n)return this.toSandbox(n);let f=await this.adopt(i,t,u);if(!f)throw Error(`cannot adopt live claim ${t}`);return R_i(this.stateStore,i,c_,(c)=>this.finish(f,c,!0,!0,"adopt"))}).catch(()=>null)!=null}async resolvePreviewUpstreamUrl(i){if(this.previewUrlPattern)return`http://${await this.resolveServiceNameForHandle(i)}.${this.namespace}.svc.cluster.local:${$D}`;let t=await this.getRecord(i);if(t)return t.daemonUrl;let u=await this.resurrectByHandle(i);return u?u.daemonUrl:null}async resolveServiceNameForHandle(i){let t=this.records.get(i);if(t)return t.adoptedSandboxName;if(this.stateStore){let l=(await this.stateStore.getByHandle(c_,i).catch(()=>null))?.state?.adoptedSandboxName;if(l)return l}return i}async proxyPreviewRequest(i,t){let u=performance.now(),l=this.records.get(i)??null,n=0;try{let f=await this.resolvePreviewUpstreamUrl(i);if(!f){n=404;let r=But(404,{error:"sandbox not found"});return r.headers.set(HP,"1"),r}let c=new URL(t.url);if((c.pathname==="/_sandbox"||c.pathname.startsWith("/_sandbox/")||c.pathname==="/_decopilot_vm"||c.pathname.startsWith("/_decopilot_vm/"))&&t.method!=="GET")return n=404,But(404,{error:"not found"});let d=(r)=>`${r}${c.pathname}${c.search}`,_=new Headers(t.headers);for(let r of yJ0)_.delete(r);let g=t.method!=="GET"&&t.method!=="HEAD",h={method:t.method,headers:_,body:g?t.body:void 0,redirect:"manual",signal:t.signal,duplex:g?"half":void 0},E;try{E=await fetch(d(f),h)}catch(r){let x=`${f}${c.pathname}`;if(console.warn(`[${S4}] preview fetch to ${x} failed: ${r instanceof Error?r.message:String(r)}`),t.method==="GET"||t.method==="HEAD"){if(this.invalidateRecord(i),await this.resurrectByHandle(i).catch(()=>null)){let X=await this.resolvePreviewUpstreamUrl(i);if(X)try{E=await fetch(d(X),h);let N=new Headers;for(let[U,J]of E.headers.entries())if(!GUu.includes(U.toLowerCase()))N.set(U,J);return n=E.status,new Response(E.body,{status:E.status,statusText:E.statusText,headers:N})}catch(N){console.warn(`[${S4}] preview fetch retry to ${x} failed: ${N instanceof Error?N.message:String(N)}`)}}}else this.invalidateRecord(i);n=502;let O=But(502,{error:"sandbox daemon unreachable"});return O.headers.set(HP,"1"),O}let v=new Headers;for(let[r,x]of E.headers.entries())if(!GUu.includes(r.toLowerCase()))v.set(r,x);return n=E.status,new Response(E.body,{status:E.status,statusText:E.statusText,headers:v})}finally{this.recordProxyDuration("preview",n,l,performance.now()-u,i)}}async ensureLocked(i,t,u,l){if(u.image)console.warn(`[${S4}] opts.image ignored (template ${this.sandboxTemplateName} pins image): got ${u.image}`);if(l){let c=await l.get(i,c_);if(c){let $=await this.rehydrate(i,t,c);if($)return this.finish($,l,!1,!0,"resume");await l.delete(i,c_)}}let n=await P2(this.kubeConfig,this.namespace,t).catch(()=>{return});if(n)if(n.metadata?.deletionTimestamp)await Eyi(this.kubeConfig,this.namespace,t).catch((c)=>{console.warn(`[${S4}] wait for terminating claim ${t} failed: ${c instanceof Error?c.message:String(c)}`)});else{let c=await this.adopt(i,t,n).catch(($)=>{return console.warn(`[${S4}] adopt ${t} failed, recreating: ${$ instanceof Error?$.message:String($)}`),null});if(c)return this.finish(c,l,!0,!0,"adopt");await cD(this.kubeConfig,this.namespace,t).catch(()=>{}),await Eyi(this.kubeConfig,this.namespace,t).catch(($)=>{console.warn(`[${S4}] wait for deleted claim ${t} failed: ${$ instanceof Error?$.message:String($)}`)})}let f=await this.provision(i,t,u);return this.finish(f,l,!0,!1,"fresh")}async finish(i,t,u,l,n){let f=this.records.get(i.handle),c=f!==void 0;if(f&&f.daemonForward!==i.daemonForward)this.closeForwarder(f.daemonForward);if(this.records.set(i.handle,i),u)await this.persist(t,i);if(l)await XUu(this.kubeConfig,this.namespace,i.handle,this.computeShutdownTime()).catch(($)=>console.warn(`[${S4}] TTL refresh failed for ${i.handle}: ${$ instanceof Error?$.message:String($)}`));if(this.metrics){let $=Yut(i.tenant);if(this.metrics.ensureOutcome.add(1,{...$,outcome:n}),!c)this.metrics.active.add(1,$)}return this.toSandbox(i)}buildEnvMap(i,t){let u={},l=[];for(let[n,f]of Object.entries(i.env??{}))if(DJ0.has(n))l.push(n);else u[n]=f;if(l.length>0)console.warn(`[${S4}] opts.env keys overlap reserved bootstrap names and were dropped: ${l.join(",")}`);return{...u,DAEMON_TOKEN:t.token,DAEMON_BOOT_ID:t.daemonBootId,APP_ROOT:t.workdir,PROXY_PORT:String($D)}}buildClaim(i,t,u){let l=this.sentinelToken!==null,n=l?[]:Object.entries(this.buildEnvMap(t,u)).sort(([$],[d])=>$<d?-1:$>d?1:0).map(([$,d])=>({name:$,value:d})),f=PJ0(t),c=Object.keys(f).length>0;return{apiVersion:`${q1.CLAIM_API_GROUP}/${q1.CLAIM_API_VERSION}`,kind:"SandboxClaim",metadata:{name:i,namespace:this.namespace,labels:{"app.kubernetes.io/name":"studio-sandbox","app.kubernetes.io/managed-by":"studio",...this.envName?{[W6.env]:this.envName}:{},...Qut(t.tenant)},...c?{annotations:f}:{}},spec:{sandboxTemplateRef:{name:this.sandboxTemplateName},additionalPodMetadata:{labels:Qut(t.tenant,{[W6.role]:"claimed",[W6.sandboxHandle]:i,...this.envName?{[W6.env]:this.envName}:{}}),...c?{annotations:f}:{}},env:n,warmpool:l?"default":"none",lifecycle:{shutdownPolicy:"Delete",shutdownTime:this.computeShutdownTime()}}}}async provision(i,t,u){let l=this.tokenGenerator(),n=gJ0(),f=Zut,c=this.buildClaim(t,u,{token:l,daemonBootId:n,workdir:f});try{await $a(this.kubeConfig,this.namespace,c)}catch(E){if(E instanceof na)await Eyi(this.kubeConfig,this.namespace,t),await $a(this.kubeConfig,this.namespace,c);else throw E}let $;try{$=await NUu(this.kubeConfig,this.namespace,t),await wyi(this.kubeConfig,this.namespace,$)}catch(E){throw await cD(this.kubeConfig,this.namespace,t).catch(()=>{}),E}try{await this.ensureServicePortForAdoptedSandbox($),await this.ensureHttpRouteForHandle(t,$,u.tenant??null)}catch(E){throw await cD(this.kubeConfig,this.namespace,t).catch(()=>{}),E}let d=await this.openForwarder($,$D,t),_=`http://127.0.0.1:${d.localPort}`,g=this.workloadConfigPayload(u),h=n;try{if(await mui(_),this.sentinelToken!==null){let E=await aui(_);if(E)h=E.bootId;await Z8(_,this.sentinelToken,g??{},{rotateToken:l})}else if(g)await Z8(_,l,g);if(u.orgFsConfigJson)await APt(_,l,u.orgFsConfigJson).catch((E)=>console.warn("[org-fs] sidecar config relay failed",E))}catch(E){throw this.closeForwarder(d),await this.deleteHttpRouteIfManaged(t).catch(()=>{}),await cD(this.kubeConfig,this.namespace,t).catch(()=>{}),E}return{id:i,handle:t,adoptedSandboxName:$,token:l,workdir:f,daemonUrl:_,daemonForward:d,workload:u.workload??null,daemonBootId:h,tenant:u.tenant??null,ensureOpts:GJ0(u)}}workloadConfigPayload(i){return Jit({runtime:i?.workload?.runtime??"node",packageManager:i?.workload?.packageManager?{name:i.workload.packageManager,...i.workload.packageManagerPath?{path:i.workload.packageManagerPath}:{}}:null,repo:i?.repo??null,port:i?.workload?.devPort??wJ0,tenant:i?.tenant??void 0})}async rebootstrapDaemon(i,t,u){if(this.sentinelToken===null)return!1;let l=this.workloadConfigPayload(u)??{};try{return await Z8(i,this.sentinelToken,l,{rotateToken:t}),!0}catch(n){if(n instanceof Vui&&n.status===401)try{return await Z8(i,t,l,{rotateToken:t}),!0}catch(f){return console.warn(`[${S4}] re-bootstrap retry with claim token failed: ${f instanceof Error?f.message:String(f)}`),!1}return console.warn(`[${S4}] re-bootstrap failed: ${n instanceof Error?n.message:String(n)}`),!1}}async ensureServicePortForAdoptedSandbox(i){if(!this.previewGateway||!this.previewUrlPattern)return;await ZUu(this.kubeConfig,this.namespace,i,{name:"daemon",port:$D,targetPort:$D})}async ensureHttpRouteForHandle(i,t,u){if(!this.previewGateway||!this.previewUrlPattern)return;let l=WJ0(this.previewUrlPattern,i);if(!l)throw new Ec(`Unable to derive preview hostname for ${i} from pattern: ${this.previewUrlPattern}`);let n={apiVersion:`${da.API_GROUP}/${da.API_VERSION}`,kind:"HTTPRoute",metadata:{name:i,namespace:this.namespace,labels:Qut(u??void 0,{[W6.role]:"claimed",[W6.sandboxHandle]:i,"app.kubernetes.io/name":"studio-sandbox","app.kubernetes.io/managed-by":"studio",...this.envName?{[W6.env]:this.envName}:{}})},spec:{parentRefs:[{kind:"Gateway",group:"gateway.networking.k8s.io",name:this.previewGateway.name,namespace:this.previewGateway.namespace}],hostnames:[l],rules:[{backendRefs:[{group:"",kind:"Service",name:t,port:$D}]}]}};await vyi(this.kubeConfig,this.namespace,n)}async deleteHttpRouteIfManaged(i){if(!this.previewGateway)return;await ryi(this.kubeConfig,this.namespace,i)}async rehydrate(i,t,u){let l=u.state;if(!l.adoptedSandboxName&&!l.podName||!l.token)return null;let n=await P2(this.kubeConfig,this.namespace,t).catch(()=>{return});if(!n||!WUu(n))return null;let f=n.status?.sandbox?.name??l.adoptedSandboxName??l.podName??t,c=await this.openAndProbeDaemon(f,t);if(!c)return null;if(l.daemonBootId&&l.daemonBootId!==c.bootId){if(this.sentinelToken!==null){if(!await this.rebootstrapDaemon(c.daemonUrl,l.token,l.ensureOpts??null))return this.closeForwarder(c.daemonForward),null}else console.warn(`[${S4}] daemon restart detected (handle=${t}): stored bootId=${l.daemonBootId} live bootId=${c.bootId}`);await this.stateStore?.put(i,c_,{handle:t,state:{...l,daemonBootId:c.bootId}}).catch(($)=>console.warn(`[${S4}] bootId persist failed for ${t}: ${$ instanceof Error?$.message:String($)}`))}return{id:i,handle:t,adoptedSandboxName:f,token:l.token,workdir:l.workdir??Zut,daemonUrl:c.daemonUrl,daemonForward:c.daemonForward,workload:l.workload??null,daemonBootId:c.bootId,tenant:l.tenant??null,ensureOpts:l.ensureOpts??null}}async adopt(i,t,u){if(!WUu(u))return null;let l=u.status?.sandbox?.name??t;if(this.sentinelToken!==null)return null;let n=UJ0(u);if(!n)return null;let f=await this.openAndProbeDaemon(l,t);if(!f)return null;let c=AJ0(u);if(this.previewGateway)await this.ensureServicePortForAdoptedSandbox(l).catch(($)=>{console.warn(`[${S4}] Service port backfill failed for ${t}: ${$ instanceof Error?$.message:String($)}`)}),await this.ensureHttpRouteForHandle(t,l,c).catch(($)=>{console.warn(`[${S4}] HTTPRoute backfill failed for ${t}: ${$ instanceof Error?$.message:String($)}`)});return{id:i,handle:t,adoptedSandboxName:l,token:n,workdir:Zut,daemonUrl:f.daemonUrl,daemonForward:f.daemonForward,workload:null,daemonBootId:f.bootId,tenant:c,ensureOpts:null}}async openAndProbeDaemon(i,t){let u=await this.openForwarder(i,$D,t).catch(()=>null);if(!u)return null;let l=`http://127.0.0.1:${u.localPort}`,n=await aui(l);if(!n)return this.closeForwarder(u),null;return{daemonForward:u,daemonUrl:l,bootId:n.bootId}}async getRecord(i){let t=this.records.get(i);if(t)return t;if(!this.stateStore)return null;let u=await this.stateStore.getByHandle(c_,i);if(!u)return null;let l=await this.rehydrate(u.id,i,u);if(l)this.records.set(i,l);return l}async resurrectByHandle(i){if(!this.stateStore)return null;let t=await this.stateStore.getByHandle(c_,i);if(!t)return null;let u=t.state.ensureOpts;if(!u)return null;return await this.ensure(t.id,u),this.records.get(i)??null}invalidateRecord(i){let t=this.records.get(i);if(!t)return;this.records.delete(i),this.closeForwarder(t.daemonForward)}recordProxyDuration(i,t,u,l,n){if(!this.metrics)return;this.metrics.proxyDurationMs.record(l,{...Yut(u?.tenant??null),source:i,sandbox_handle:u?.handle??n??"",status_code:t||0})}composePreviewUrl(i){if(this.previewUrlPattern)return L_i(this.previewUrlPattern,i.handle);return`http://127.0.0.1:${i.daemonForward.localPort}/`}toSandbox(i){return{handle:i.handle,workdir:i.workdir,previewUrl:this.composePreviewUrl(i)}}async persist(i,t){if(!i)return;let u={adoptedSandboxName:t.adoptedSandboxName,token:t.token,workdir:t.workdir,workload:t.workload,daemonBootId:t.daemonBootId,tenant:t.tenant,...t.ensureOpts?{ensureOpts:t.ensureOpts}:{}};await i.put(t.id,c_,{handle:t.handle,state:u})}computeShutdownTime(){return new Date(Date.now()+this.idleTtlMs).toISOString()}openForwarder(i,t,u=i){let l=TJ0(u,t);return new Promise((n,f)=>{let c=($,d)=>{let _=jUu.createServer((g)=>this.handleForwardedConnection(g,i,t,u));_.once("error",(g)=>{if(g.code==="EADDRINUSE"&&d<XJ0){try{_.close()}catch{}let h=Put+($-Put+1)%SUu;c(h,d+1);return}f(g)}),_.listen($,"127.0.0.1",()=>{let g=_.address();if(!g||typeof g==="string"){_.close(),f(Error("port-forward listener failed to bind"));return}n({server:_,localPort:g.port})})};c(l,0)})}handleForwardedConnection(i,t,u,l){let n=new hJ0,f=null,c=!1,$=()=>{if(c)return;if(c=!0,n.destroy(),f)try{f.close()}catch{}if(!i.destroyed)i.destroy()};i.pipe(n),i.on("error",$),i.on("close",$),this.portForward.portForward(this.namespace,t,[u],i,null,n).then((d)=>{let _=typeof d==="function"?d():d;if(!_){$();return}if(f=_,f.on("close",$),f.on("error",()=>{this.invalidateRecord(l),$()}),c)try{f.close()}catch{}}).catch((d)=>{console.warn(`[${S4}] port-forward to ${t}:${u} failed: ${EJ0(d)}`),this.invalidateRecord(l),$()})}closeForwarder(i){i.server.close((t)=>{if(t)console.warn(`[${S4}] port-forward close on :${i.localPort} errored: ${t instanceof Error?t.message:String(t)}`)})}close(){if(this.closed)return;this.closed=!0,this.claimWatchAbort.abort();for(let i of this.records.values())this.closeForwarder(i.daemonForward);this.records.clear()}}function NJ0(i){return{active:i.createUpDownCounter("studio.sandbox.active",{description:"Active sandbox count, by runner kind and owning org. Cross-checks the cAdvisor-derived count from the cluster \u2014 divergence between the two indicates orphaned claims (mesh deleted but K8s didn't reap) or unattributed pods.",unit:"{sandbox}"}),ensureOutcome:i.createCounter("studio.sandbox.ensure.outcome",{description:"Outcome of each ensure() call: fresh provision, resume from state-store after restart, or adopt of a cluster-side claim mesh didn't know about. Cold-start ratio is the primary input for warm-pool sizing.",unit:"{call}"}),proxyDurationMs:i.createHistogram("studio.sandbox.proxy.duration_ms",{description:"Wall-clock latency of mesh-mediated requests to the sandbox daemon: tool exec proxies (source=daemon) and preview iframe traffic (source=preview).",unit:"ms"})}}function JJ0(){let i=new Az;return i.loadFromDefault(),i}function WUu(i){return Boolean(i.status?.conditions?.some((t)=>t.type==="Ready"&&t.status==="True"))}function UJ0(i){let t=i.spec?.env;if(!t)return null;for(let u of t)if(u.name==="DAEMON_TOKEN"&&u.value)return u.value;return null}function TJ0(i,t){let u=dJ0("sha256").update(`${i}:${t}`).digest();return Put+u.readUInt32BE(0)%SUu}function But(i,t){return new Response(JSON.stringify(t),{status:i,headers:{"content-type":"application/json","access-control-allow-origin":"*"}})}function kUu(i){let t=i.slice(0,IJ0);return FJ0.test(t)?t:""}function BJ0(i){if(i===void 0)return null;let t=i.trim();if(t==="")return null;if(!ZJ0.test(t))throw Error(`AgentSandboxProvider: envName=${JSON.stringify(t)} is not a valid DNS-label-safe environment name (lowercase alphanumeric or '-', starts with a letter, ends alphanumeric, \u226432 chars). Mesh sets this from STUDIO_ENV; check the studio chart's configMap.`);return t}function Qut(i,t={}){let u={...t};if(i){let l=kUu(i.orgId),n=kUu(i.userId);if(l)u[W6.orgId]=l;if(n)u[W6.userId]=n}return u}function KP(i){let t="";for(let u of i){let l=u.codePointAt(0)??0;t+=l<32||l===127?" ":u}return t.slice(0,QJ0)}function YJ0(i){try{let t=new URL(i);return t.username="",t.password="",t.toString()}catch{return""}}function PJ0(i){let t={},u=i.tenant;if(u?.orgSlug)t[dE.orgSlug]=KP(u.orgSlug);if(u?.orgName)t[dE.orgName]=KP(u.orgName);if(u?.userEmail)t[dE.userEmail]=KP(u.userEmail);if(u?.userName)t[dE.userName]=KP(u.userName);let l=i.repo;if(l){if(l.displayName)t[dE.gitRepo]=KP(l.displayName);let n=YJ0(l.cloneUrl);if(n)t[dE.gitRepoUrl]=KP(n);let f=i.branch??l.branch;if(f)t[dE.gitBranch]=KP(f)}return t}function AJ0(i){let t=i.metadata?.labels;if(!t)return null;let u=t[W6.orgId],l=t[W6.userId];if(!u||!l)return null;let n=i.metadata?.annotations??{};return{orgId:u,userId:l,orgSlug:n[dE.orgSlug],orgName:n[dE.orgName],userEmail:n[dE.userEmail],userName:n[dE.userName]}}function Yut(i){return{org_id:i?.orgId??"",user_id:i?.userId??"",runner_kind:c_}}function GJ0(i){let t={};if(i.repo)t.repo=i.repo;if(i.workload)t.workload=i.workload;if(i.env&&Object.keys(i.env).length>0)t.env=i.env;if(i.tenant)t.tenant=i.tenant;return Object.keys(t).length>0?t:null}function WJ0(i,t){try{return new URL(L_i(i,t)).hostname||null}catch{return null}}var c_="agent-sandbox",S4="AgentSandboxProvider",HP="x-sandbox-preview-not-ready",vJ0="agent-sandbox-system",rJ0="studio-sandbox",$D=9000,wJ0=3000,Zut="/app",xJ0=32,DJ0,OJ0=900000,yJ0,GUu,Put=40000,SUu=1e4,XJ0=256,W6,dE,FJ0,IJ0=63,ZJ0,QJ0=253;var zUu=w(()=>{Out();lGi();e_i();xyi();fa();AUu();DJ0=new Set(["DAEMON_TOKEN","DAEMON_BOOT_ID","APP_ROOT","PROXY_PORT"]),yJ0=["cookie","host","connection","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","accept-encoding","content-length","upgrade"],GUu=["connection","keep-alive","transfer-encoding","content-encoding","content-length"];W6={role:"studio.decocms.com/role",sandboxHandle:"studio.decocms.com/sandbox-handle",orgId:"studio.decocms.com/org-id",userId:"studio.decocms.com/user-id",env:"studio.decocms.com/env"},dE={orgSlug:"studio.decocms.com/org-slug",orgName:"studio.decocms.com/org-name",userEmail:"studio.decocms.com/user-email",userName:"studio.decocms.com/user-name",gitRepo:"studio.decocms.com/git-repo",gitRepoUrl:"studio.decocms.com/git-repo-url",gitBranch:"studio.decocms.com/git-branch"},FJ0=/^([A-Za-z0-9]([-A-Za-z0-9_.]*[A-Za-z0-9])?)?$/;ZJ0=/^[a-z]([a-z0-9-]{0,30}[a-z0-9])?$/});var bUu={};Gi(bUu,{waitForSandboxReady:()=>wyi,getSandboxClaim:()=>P2,getHttpRoute:()=>FUu,deleteSandboxClaim:()=>cD,deleteHttpRoute:()=>ryi,createSandboxClaim:()=>$a,applyHttpRoute:()=>vyi,SandboxTimeoutError:()=>zP,SandboxError:()=>Ec,PREVIEW_NOT_READY_HEADER:()=>HP,KubeConfig:()=>Az,K8S_CONSTANTS:()=>q1,HTTPROUTE_CONSTANTS:()=>da,AgentSandboxProvider:()=>Aut});var Gut=w(()=>{Out();fa();xyi();zUu()});class Oyi{kind=dD;userSub;dispatch;stateStore;records=new Map;constructor(i){if(!i.userSub)throw Error("DesktopSandboxProvider requires userSub");if(!i.dispatch)throw Error("DesktopSandboxProvider requires dispatch");this.userSub=i.userSub,this.dispatch=i.dispatch,this.stateStore=i.stateStore??null}async ensure(i,t={}){let u=t.branch??t.repo?.branch,l=q5(i,u),n=this.records.get(l);if(n){if(await this.probeHealth(l))return this.toSandbox(n);if(this.records.delete(l),this.stateStore)await this.stateStore.deleteByHandle(dD,l).catch(()=>{})}else if(this.stateStore){let E=(await this.stateStore.getByHandle(dD,l))?.state,v=E?.sandboxApiUrl;if(v){if(await this.probeHealth(l)){let r={handle:l,sandboxApiUrl:v,previewUrl:E?.previewUrl??v};return this.records.set(l,r),this.toSandbox(r)}await this.stateStore.deleteByHandle(dD,l).catch(()=>{})}}let f=ih({userName:t.tenant?.userName,userEmail:t.tenant?.userEmail}),c=JSON.stringify({handle:l,repo:t.repo,branch:u,...t.workload?{workload:t.workload}:{},...f?{operator:f}:{},...t.offloadAllowedHosts?{offloadAllowedHosts:t.offloadAllowedHosts}:{},...t.offloadAllowSameHostDev!==void 0?{offloadAllowSameHostDev:t.offloadAllowSameHostDev}:{},...t.orgFsConfigJson?{orgFsConfigJson:t.orgFsConfigJson}:{}}),$=await this.dispatchJson("POST","/api/sandboxes",c),d=JSON.parse($);if(typeof d.sandboxApiUrl!=="string")throw Error("desktop ensure: daemon did not return a sandboxApiUrl string");let _=typeof d.previewUrl==="string"?d.previewUrl:d.sandboxApiUrl,g={handle:l,sandboxApiUrl:d.sandboxApiUrl,previewUrl:_};if(this.records.set(l,g),this.stateStore)await this.stateStore.put(i,dD,{handle:l,state:{handle:l,sandboxApiUrl:d.sandboxApiUrl,previewUrl:_}});return this.toSandbox(g)}async proxyDaemonRequest(i,t,u){let l=t.startsWith("/")?t:`/${t}`,n=l.startsWith("/_sandbox/")?l.slice(9):l,f=`/_sandbox/${encodeURIComponent(i)}${n}`,c=new Headers(u.headers);for(let y of["host","cookie","connection","keep-alive","transfer-encoding","upgrade","authorization"])c.delete(y);let $={};c.forEach((y,X)=>{$[X]=y});let d;if(u.body!=null)d=await jJ0(u.body);let g=this.dispatch(this.userSub,{method:u.method,path:f,headers:$,body:d},{signal:u.signal})[Symbol.asyncIterator](),h=kJ0(),E=200,v={"content-type":"application/octet-stream"},r=[];try{while(!0){let y=await g.next();if(y.done)break;let X=y.value;if(X.headers){E=X.headers.status,v=X.headers.headers;break}if(X.data!=null){let N=h.push(X.data);if(N.length)r.push(N)}}}catch(y){let X=y instanceof Error?y.message:"dispatch error";return new Response(JSON.stringify({error:X}),{status:502,headers:{"content-type":"application/json"}})}let x=!1,O=new ReadableStream({async start(y){for(let X of r)y.enqueue(X)},async pull(y){try{while(!0){let X=await g.next();if(x)return;if(X.done){let U=h.flush();if(U.length)y.enqueue(U);y.close();return}let N=X.value;if(N.data!=null){let U=h.push(N.data);if(U.length){y.enqueue(U);return}}}}catch(X){if(!x)y.error(X)}},cancel(){x=!0,g.return?.()}});return new Response(O,{status:E,headers:v})}async alive(i){return this.probeHealth(i)}async probeHealth(i){let t=new AbortController,u=setTimeout(()=>t.abort(),3000);try{return await this.dispatchJson("GET",`/api/sandboxes/${encodeURIComponent(i)}`,void 0,t.signal),!0}catch{return!1}finally{clearTimeout(u)}}async forgetHandle(i){if(this.records.delete(i),this.stateStore)await this.stateStore.deleteByHandle(dD,i).catch(()=>{})}async delete(i){if(this.records.delete(i),this.stateStore)await this.stateStore.deleteByHandle(dD,i).catch(()=>{});try{await this.dispatchJson("DELETE",`/api/sandboxes/${encodeURIComponent(i)}`)}catch(t){if(!(t instanceof Error?t.message:String(t)).includes("404"))throw t}}async getPreviewUrl(i){return(await this.resolveRecord(i))?.previewUrl??null}async localWorkdir(i){return null}async*watchClaimLifecycle(i,t){yield{kind:"ready"}}toSandbox(i){return{handle:i.handle,workdir:i.sandboxApiUrl,previewUrl:i.previewUrl}}async resolveRecord(i){let t=this.records.get(i);if(t)return t;if(!this.stateStore)return null;let l=(await this.stateStore.getByHandle(dD,i))?.state,n=l?.sandboxApiUrl;if(!n)return null;let f={handle:i,sandboxApiUrl:n,previewUrl:l?.previewUrl??n};return this.records.set(i,f),f}async dispatchJson(i,t,u,l){let n={accept:"application/json"};if(u!==void 0)n["content-type"]="application/json";let f=this.dispatch(this.userSub,{method:i,path:t,headers:n,body:u},{signal:l}),c=null,$="";for await(let _ of f)if(_.headers)c=_.headers.status;else if(_.data!=null)$+=_.data;let d=Buffer.from($,"base64").toString("utf8");if(c!=null&&(c<200||c>=300))throw Error(`daemon returned ${c}: ${d}`);return d}}function KUu(i){return new Oyi(i)}function kJ0(){let i="";return{push(t){if(t.length===0)return Wut;i+=t;let u=i.length-i.length%4;if(u===0)return Wut;let l=i.slice(0,u);return i=i.slice(u),new Uint8Array(Buffer.from(l,"base64"))},flush(){if(i.length===0)return Wut;let t=i;return i="",new Uint8Array(Buffer.from(t,"base64"))}}}async function jJ0(i){if(typeof i==="string")return i;if(i instanceof ArrayBuffer)return Buffer.from(i).toString("utf8");if(ArrayBuffer.isView(i))return Buffer.from(i.buffer,i.byteOffset,i.byteLength).toString("utf8");if(i instanceof URLSearchParams)return i.toString();return await new Response(i).text()}var dD="user-desktop",Wut;var HUu=w(()=>{e_i();qui();Wut=new Uint8Array(0)});var RUu={};Gi(RUu,{createDesktopProvider:()=>KUu,DesktopSandboxProvider:()=>Oyi});var LUu=w(()=>{HUu()});var aUu={};Gi(aUu,{subscribeLifecycle:()=>_a,getSandboxProviderByKind:()=>jut,getOrInitSharedRunner:()=>eJ0,buildDesktopProvider:()=>yyi,__resetSharedLifecyclesForTesting:()=>aJ0});function qUu(i,t){let u=eUu[i];if(u)return Promise.resolve(u);let l=kut[i];if(l)return l;let n=t().then((f)=>{return eUu[i]=f,f}).finally(()=>{delete kut[i]});return kut[i]=n,n}function bJ0(){let i=process.env.STUDIO_SANDBOX_PREVIEW_URL_PATTERN;return i&&i.trim()!==""?i:void 0}function KJ0(){let i=process.env.STUDIO_SANDBOX_TEMPLATE_NAME;return i&&i.trim()!==""?i:void 0}function HJ0(){let i=process.env.STUDIO_ENV;return i&&i.trim()!==""?i:void 0}function RJ0(){let i=process.env.STUDIO_SANDBOX_SENTINEL_TOKEN;return i&&i.trim()!==""?i:void 0}function LJ0(){let i=process.env.STUDIO_SANDBOX_PREVIEW_GATEWAY_NAME?.trim(),t=process.env.STUDIO_SANDBOX_PREVIEW_GATEWAY_NAMESPACE?.trim();if(!i&&!t)return;if(!i||!t)throw Error("STUDIO_SANDBOX_PREVIEW_GATEWAY_NAME and STUDIO_SANDBOX_PREVIEW_GATEWAY_NAMESPACE must both be set, or both unset. Half-configured per-claim HTTPRoute routing would silently fail to attach.");return{name:i,namespace:t}}async function VUu(i,t){let u=new a5(t),l=bJ0();switch(i){case"agent-sandbox":{let{AgentSandboxProvider:n}=await Promise.resolve().then(() => (Gut(),bUu));return new n({stateStore:u,previewUrlPattern:l,sandboxTemplateName:KJ0(),envName:HJ0(),previewGateway:LJ0(),sentinelToken:RJ0(),meter:lf})}case"user-desktop":throw Error("user-desktop provider cannot be instantiated without a per-run link claim \u2014 call resolveSandboxProvider, which binds the link before constructing the provider.");default:throw Error(`Unknown sandbox provider kind: ${String(i)}`)}}async function yyi(i,t){let{DesktopSandboxProvider:u}=await Promise.resolve().then(() => (LUu(),RUu)),{getProxyDispatch:l}=await Promise.resolve().then(() => (zut(),Sut)),n=new a5(i.db);if(!t)throw Error("buildDesktopProvider: userSub must be a non-empty string");let f=l();return new u({userSub:t,dispatch:f,stateStore:n})}function jut(i,t){return qUu(t,()=>VUu(t,i.db))}async function eJ0(){let i;try{i=av()}catch(u){return console.warn("[lifecycle] cannot resolve sandbox runner:",u instanceof Error?u.message:String(u)),null}return await qUu(i,()=>VUu(i,R0().db))}function _a(i,t,u){let l=_D.get(t);if(l){if(l.terminated){if(l.lastPhase)try{u(l.lastPhase)}catch{}return{unsubscribe:qJ0}}if(l.listeners.add(u),l.lastPhase)try{u(l.lastPhase)}catch{}return CUu(t,l,u)}let n=new AbortController,f={lastPhase:null,terminated:!1,listeners:new Set([u]),abort:n};return _D.set(t,f),VJ0(i,t,f),CUu(t,f,u)}function qJ0(){}function CUu(i,t,u){return{unsubscribe(){if(_D.get(i)!==t)return;if(t.listeners.delete(u),t.listeners.size===0)_D.delete(i),t.abort.abort()}}}async function VJ0(i,t,u){let l=null;try{for await(let n of i.watchClaimLifecycle(t,u.abort.signal)){if(u.abort.signal.aborted)break;u.lastPhase=n;let f=n.kind==="ready"||n.kind==="failed";if(f)u.terminated=!0;let c=Array.from(u.listeners);for(let $ of c)try{$(n)}catch{}if(f)break}}catch(n){l=n}finally{if(!u.terminated&&!u.abort.signal.aborted&&u.listeners.size>0){let n={kind:"failed",reason:"unknown",message:l instanceof Error?l.message:"Lifecycle watcher ended unexpectedly"};u.lastPhase=n,u.terminated=!0;for(let f of Array.from(u.listeners))try{f(n)}catch{}}if(_D.get(t)===u)_D.delete(t)}}function aJ0(){for(let i of _D.values())i.abort.abort();_D.clear()}var SJ0,zJ0,MUu,eUu,kut,CJ0,MJ0,_D;var ga=w(()=>{_g();Nd();s1();m_i();SJ0=Symbol.for("decocms.sandbox.lifecycle.runners"),zJ0=Symbol.for("decocms.sandbox.lifecycle.inflight"),MUu=globalThis,eUu=MUu[SJ0]??={},kut=MUu[zJ0]??={};CJ0=Symbol.for("decocms.sandbox.lifecycle.shared-lifecycles"),MJ0=globalThis,_D=MJ0[CJ0]??=new Map});async function Xyi(i,t){if(await t.linkClaimRegistry.get(i))return"user-desktop";return t.resolveEnvKind()}async function _E(i,t){let{userId:u,branch:l,virtualMcpMetadata:n,explicitKind:f}=t;if(f)return{provider:await ha(i,u,f),kind:f};if(i.sandboxPreference==="agent-sandbox")return{provider:await ha(i,u,"agent-sandbox"),kind:"agent-sandbox"};if(i.sandboxPreference==="user-desktop"&&i.linkForCurrentRun)return{provider:await yyi(i,u),kind:"user-desktop"};if(i.sandboxPreference==="cluster-default"){let g=av();return{provider:await ha(i,u,g),kind:g}}let[c,...$]=mJ0(n,u,l);if(c){let g=$.length===0?c:await oJ0(i,u,c,$);return{provider:await ha(i,u,g),kind:g}}let d=await mUu(i,u);return{provider:await ha(i,u,d),kind:d}}function mJ0(i,t,u){let l=gg(i)[t]?.[u];if(!l)return[];let n=w3(l);return Object.keys(n)}async function oJ0(i,t,u,l){let n=await mUu(i,t);if(n===u||l.includes(n))return n;return u}async function mUu(i,t){if(!i.linkClaimRegistry)return av();return Xyi(t,{linkClaimRegistry:i.linkClaimRegistry,resolveEnvKind:av})}async function ha(i,t,u){if(u!=="user-desktop")return jut(i,u);if(!i.linkClaimRegistry)throw Error("user-desktop sandbox provider requires ctx.linkClaimRegistry to be wired (set on StudioContextConfig).");if(!await i.linkClaimRegistry.get(t))throw Error(`No link daemon registered for user "${t}". Start one with \`deco link\` (or run \`bun run dev --local-sandbox-provider\` for dev).`);return yyi(i,t)}var Sz=w(()=>{zl();_g();T2();ga()});async function Nyi(i,t){if(!i)return{hosts:[],allowSameHostDev:!1};let u;try{u=await i.presignedGetUrl("link-dispatch/_allowlist_probe",60,{requireFetchable:!0})}catch{return{hosts:[],allowSameHostDev:!1}}let l;try{l=new URL(u)}catch{return{hosts:[],allowSameHostDev:!1}}if(l.protocol!=="https:"&&l.protocol!=="http:")return{hosts:[],allowSameHostDev:!1};let n=l.hostname,f=sJ0.has(n);return{hosts:[n],allowSameHostDev:f&&!t.isProduction}}var sJ0;var but=w(()=>{sJ0=new Set(["127.0.0.1","localhost","::1","[::1]","0.0.0.0"])});function zz(i){if(pJ0.has(i)||!iU0.test(i))return"home";return i}var pJ0,iU0;var Jyi=w(()=>{pJ0=new Set(["output","upload","public","home"]),iU0=/^[A-Za-z0-9][A-Za-z0-9._-]*$/});function nU0(i){return{baseUrl:i.baseUrl.replace(/\/+$/,""),orgSlug:i.orgSlug,token:i.token,mounts:[{volume:"home",path:zz(i.orgSlug)},...lU0.map((t)=>({...t})),...(i.publicSets??[]).map((t)=>({volume:J1i(t),path:`public/${t}`,readonly:!0}))]}}async function Uyi(i,t){try{let u=await i.boundAuth.apiKey.create({name:`orgfs-${t.orgSlug}`,expiresIn:fU0,metadata:{organization:{id:t.orgId,slug:t.orgSlug}}});return JSON.stringify(nU0({baseUrl:t.baseUrl,orgSlug:t.orgSlug,token:u.key,publicSets:Ih().map((l)=>l.set)}))}catch(u){console.warn("[org-fs] token mint failed; mounts disabled for this sandbox",u);return}}var tU0=".outputs",uU0=".uploads",lU0,fU0=604800;var Kut=w(()=>{Jyi();jk();lU0=[{volume:"outputs",path:tU0},{volume:"uploads",path:uU0}]});import{z as tr}from"zod";async function oUu(i,t){Ui(t);let u=Ei(t),l=yu(t);if(!l)throw Error("User ID required");let n=await t.storage.virtualMcps.findById(i.virtualMcpId);if(!n||n.organization_id!==u.id)throw Error("Virtual MCP not found");let f=n.metadata??{},c=U2(gg(f),l,i.branch,i.sandboxProviderKind),$=i.sandboxProviderKind,{provider:d}=await _E(t,{userId:l,branch:i.branch,virtualMcpMetadata:f,explicitKind:$});if(c){if($!=="user-desktop")return c;if(await d.alive(c.sandboxHandle).catch(()=>!1))return c;await V5(t.storage.virtualMcps,i.virtualMcpId,l,l,i.branch,$).catch((E)=>{console.warn("[ensureSandbox] failed to reap stale user-desktop entry",E)})}let _=f.githubRepo??null,{entry:g}=await sUu({ctx:t,userId:l,orgId:u.id,virtualMcpId:i.virtualMcpId,branch:i.branch,metadata:f,githubRepo:_,existing:null,providerKind:$,runner:d});return g}async function sUu(i){let{ctx:t,userId:u,orgId:l,virtualMcpId:n,branch:f,metadata:c,githubRepo:$,existing:d,runner:_}=i,{runtime:g,packageManager:h,port:E,packageManagerPath:v}=C_i(c),r;if($){if($.connectionId)await Xz({ctx:t,connectionId:$.connectionId,organizationId:l,onLegacyMintError:(p)=>{console.error("[provisionSandbox] repo-scoped legacy token mint failed",{connectionId:$.connectionId,error:p.message})}});let{cloneUrl:m,gitUserName:S,gitUserEmail:M}=$.connectionId?await Nz($.connectionId,$.owner,$.name,t.db,t.vault):q_i($.owner,$.name);if(!h){let p=$.connectionId?await zOu($.connectionId,$.owner,$.name,t.db,t.vault):await bOu($.owner,$.name);if(p)h=p.packageManager,g=zV[p.packageManager].runtime,E=p.devPort??E,await $U0(t,n,u,p.packageManager,p.devPort)}r={cloneUrl:m,userName:S,userEmail:M,branch:f,displayName:`${$.owner}/${$.name}`}}let x=g&&h?{runtime:g,packageManager:h,...E!==null?{devPort:Number(E)}:{},...v?{packageManagerPath:v}:{}}:void 0,O=J2({orgId:l,virtualMcpId:n,branch:f}),y=_.kind==="user-desktop"?await Nyi(t.objectStorage,{isProduction:Qt().nodeEnv==="production"}):null,X=_.kind==="user-desktop"||_.kind==="agent-sandbox"&&Qt().orgFsClusterMounts,N;if(X){let m=t.organization?.slug??(await t.db.selectFrom("organization").select(["slug"]).where("id","=",l).executeTakeFirst())?.slug;if(m)N=await Uyi(t,{orgSlug:m,orgId:l,baseUrl:QE()})}let U=await _.ensure({userId:u,projectRef:O},{branch:f,repo:r,workload:x,tenant:{orgId:l,userId:u,...t.organization?.slug?{orgSlug:t.organization.slug}:{},...t.organization?.name?{orgName:t.organization.name}:{},...t.auth.user?.email?{userEmail:t.auth.user.email}:{},...t.auth.user?.name?{userName:t.auth.user.name}:{}},...y?{offloadAllowedHosts:y.hosts,offloadAllowSameHostDev:y.allowSameHostDev}:{},...N?{orgFsConfigJson:N}:{}}),J=c.runtime?.env??null;await M_i({ctx:t,runner:_,handle:U.handle,orgId:l,userId:u,entries:J});let Q=!!d&&d.sandboxHandle===U.handle&&d?.createdAt?d.createdAt:Date.now(),B=c.runtime?.selected??null,P=c.runtime?.port??null,H=c.runtime?.path??null,j={sandboxHandle:U.handle,previewUrl:U.previewUrl,sandboxApiUrl:U.previewUrl,sandboxProviderKind:_.kind,createdAt:Q,startedWith:{packageManager:B,port:P,path:H}};await GOu(t.storage.virtualMcps,n,u,u,f,i.providerKind,j);let k=!d||d.sandboxHandle!==U.handle;return{entry:j,isNewVm:k}}async function $U0(i,t,u,l,n){let f=await i.storage.virtualMcps.findById(t);if(!f)return;let c=f.metadata??{};await i.storage.virtualMcps.update(t,u,{metadata:{...c,runtime:{selected:l,port:n}}})}var cU0,Hut;var Rut=w(()=>{_g();Vi();bV();Fit();T2();V_i();HOu();Goi();Tit();Sz();but();U0();T_();Kut();T2();cU0=tr.enum(["agent-sandbox","user-desktop","cluster"]),Hut=li({name:"SANDBOX_START",description:"Start a sandbox with the connected GitHub repo and dev server.",annotations:{title:"Start VM Preview",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!1,openWorldHint:!0},_meta:{ui:{visibility:"app"}},inputSchema:tr.object({virtualMcpId:tr.string().describe("Virtual MCP ID"),branch:tr.string().min(1).optional().describe("Optional git branch to check out. When omitted the handler generates `deco/<adjective>-<noun>` and uses it. The resolved branch is returned in the response so callers can persist it."),sandboxProviderKind:cU0.optional().describe("Explicit runtime choice. Hosted provider is `agent-sandbox`; legacy `cluster` input is accepted only for compatibility and normalized to `agent-sandbox`. When omitted, defaults to `user-desktop` if the acting user's link daemon is online, else the env kind.")}),outputSchema:tr.object({previewUrl:tr.string().nullable(),sandboxHandle:tr.string(),branch:tr.string(),isNewVm:tr.boolean(),sandboxProviderKind:tr.enum(["agent-sandbox","user-desktop"])}),handler:async(i,t)=>{Ui(t);let u=Ei(t);await t.access.check();let l=i.branch??Qdi(),n=yu(t);if(!n)throw Error("User ID required");let f=await t.storage.virtualMcps.findById(i.virtualMcpId);if(!f||f.organization_id!==u.id)throw Error("Virtual MCP not found");let c=f.metadata??{},$=i.sandboxProviderKind?N2(i.sandboxProviderKind):void 0,{provider:d,kind:_}=await _E(t,{userId:n,branch:l,virtualMcpMetadata:c,explicitKind:$}),g=U2(gg(c),n,l,_),h=c.githubRepo??null,{entry:E,isNewVm:v}=await sUu({ctx:t,userId:n,orgId:u.id,virtualMcpId:i.virtualMcpId,branch:l,metadata:c,githubRepo:h,existing:g,providerKind:_,runner:d});return{...E,branch:l,isNewVm:v,sandboxProviderKind:_}}})});import{z as bz}from"zod";var dU0,Lut;var pUu=w(()=>{_g();Vi();bV();T2();Sz();dU0=bz.enum(["agent-sandbox","user-desktop","cluster"]),Lut=li({name:"SANDBOX_DELETE",description:"Delete a sandbox.",annotations:{title:"Delete VM Preview",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!0},_meta:{ui:{visibility:"app"}},inputSchema:bz.object({virtualMcpId:bz.string().describe("Virtual MCP ID that owns this VM"),branch:bz.string().min(1).describe("Branch whose vm should be deleted (sandboxMap[userId][branch])"),sandboxProviderKind:dU0.describe("Kind of sandbox provider the VM was started with. Hosted provider is `agent-sandbox`; legacy `cluster` input is accepted only for compatibility and normalized to `agent-sandbox`. Used to locate the correct 3-level sandboxMap entry.")}),outputSchema:bz.object({success:bz.boolean()}),handler:async(i,t)=>{let u=N2(i.sandboxProviderKind),l;try{l=await kOu({...i,sandboxProviderKind:u},t)}catch($){if($ instanceof Error&&$.message==="Virtual MCP not found")return{success:!0};throw $}let{entry:n,userId:f}=l;if(!n)return{success:!0};let{provider:c}=await _E(t,{userId:f,branch:i.branch,virtualMcpMetadata:l.metadata,explicitKind:u});return await V5(t.storage.virtualMcps,i.virtualMcpId,f,f,i.branch,u),await c.delete(n.sandboxHandle).catch(($)=>console.error(`[SANDBOX_DELETE] ${u} ${n.sandboxHandle}: ${$ instanceof Error?$.message:String($)}`)),{success:!0}}})});var iTu=w(()=>{Rut();pUu()});import{z as ur}from"zod";var gU0="https://api.github.com",eut;var tTu=w(()=>{Vi();Ly();zS();kv();eut=li({name:"GITHUB_LIST_USER_ORGS",description:"List GitHub App installations (orgs/accounts) accessible to the authenticated user.",annotations:{title:"List GitHub User Orgs",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!0},_meta:{ui:{visibility:"app"}},inputSchema:ur.object({connectionId:ur.string().describe("ID of the mcp-github connection to use")}),outputSchema:ur.object({installations:ur.array(ur.object({installationId:ur.number(),login:ur.string(),avatarUrl:ur.string(),type:ur.string()})),appSlug:ur.string().optional()}),handler:async(i,t)=>{await t.access.check();let u=t.organization?.id;if(!u)throw Error("Organization context required");let l=await t.storage.connections.findById(i.connectionId,u);if(!l)throw Error("Connection not found");if(jv(l))throw Error("Repo-scoped connections cannot list installations \u2014 use an org-level mcp-github connection");let n=new e1(t.db,t.vault),f=await n.get(i.connectionId);if(!f)throw Error("No GitHub token found. Ensure the mcp-github connection is authenticated.");let c=f.accessToken;if(wdi(f)&&n.isExpired(f,eq)){let E=await xdi(f,n);if(!E)throw Error(O$);c=E,f=await n.get(i.connectionId)??f}let $=[],d,_=1,g=100,h=async(E)=>fetch(`${gU0}/user/installations?per_page=${g}&page=${_}`,{headers:{Authorization:`Bearer ${E}`,Accept:"application/vnd.github+json","X-GitHub-Api-Version":"2022-11-28"}});while(!0){let E=await h(c);if(E.status===401){let r=await n.get(i.connectionId);if(!r||!wdi(r))throw Error(O$);let x=await xdi(r,n);if(!x)throw Error(O$);if(c=x,E=await h(c),E.status===401)throw Error(O$)}if(!E.ok)throw Error(`GitHub /user/installations failed: ${E.status}`);let v=await E.json();for(let r of v.installations){if(!d)d=r.app_slug??r.app?.slug;$.push({installationId:r.id,login:r.account.login,avatarUrl:r.account.avatar_url,type:r.account.type})}if(v.installations.length<g)break;_++}return{installations:$,...d?{appSlug:d}:{}}}})});var uTu=w(()=>{tTu()});import RP from"zod";var Cut;var lTu=w(()=>{n0i();Vi();Cut=li({name:"LINK_CURRENT_GET",description:"Return the calling user's currently registered desktop link, or `online: false` if no link is registered or the TTL has expired.",inputSchema:RP.object({}),outputSchema:RP.object({online:RP.boolean(),machineId:RP.string().optional(),hostname:RP.string().optional(),cliVersion:RP.string().optional(),capabilities:RP.array(CWi).default([])}),handler:async(i,t)=>{Ui(t),await t.access.check();let u=t.linkClaimRegistry;if(!u)return{online:!1,capabilities:[]};let l=await u.get(t.auth.user.id);if(!l)return{online:!1,capabilities:[]};return{online:!0,machineId:l.machineId,hostname:l.hostname,cliVersion:l.cliVersion,capabilities:l.capabilities}}})});import Mut from"zod";var qut;var nTu=w(()=>{Vi();qut=li({name:"LINK_DISCONNECT",description:"Disconnect the calling user's desktop link from the Studio side: tells the linked daemon to shut down (via a `shutdown` control frame) and removes the presence claim. The user re-links by running `bunx decocms link` on the desktop.",inputSchema:Mut.object({}),outputSchema:Mut.object({disconnected:Mut.boolean()}),handler:async(i,t)=>{Ui(t),await t.access.check();let u=t.auth.user.id,l=t.linkClaimRegistry;if(!(l?await l.get(u):null))return{disconnected:!1};return t.publishLinkControlFrame?.(u,{type:"shutdown"}),await l.delete(u),{disconnected:!0}}})});var fTu=w(()=>{lTu();nTu()});import{z as vc}from"zod";function cTu(i){if(!i)return"";return typeof i==="string"?i:i.toISOString()}var vU0,rU0,wU0,xU0,DU0,Vut;var $Tu=w(()=>{Vi();vU0=["thread"],rU0=vc.object({type:vc.literal("thread"),id:vc.string(),title:vc.string(),created_at:vc.string(),updated_at:vc.string(),virtual_mcp_id:vc.string().nullable(),run_config:vc.record(vc.string(),vc.unknown()).nullable(),status:vc.string().nullable()}),wU0=vc.discriminatedUnion("type",[rU0]),xU0=vc.object({query:vc.string().min(1).describe("Free-text search query."),limit:vc.number().int().min(1).max(50).optional().describe("Maximum results per resource type (default: 20)."),types:vc.array(vc.enum(vU0)).optional().describe("Restrict the search to specific resource types. Omit to search across all available types.")}),DU0=vc.object({items:vc.array(wU0),totalCount:vc.number()});Vut=li({name:"GLOBAL_SEARCH",description:"Search across organization resources by free-text query. Returns a typed union of matches (currently: threads). New resource types may be added over time without changes to the call shape.",annotations:{title:"Global Search",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:xU0,outputSchema:DU0,handler:async(i,t)=>{await t.access.check(),Ei(t);let u=i.limit??20,l=i.types?.length?new Set(i.types):null,n=!l||l.has("thread"),f=[],c=0;if(n){let{threads:$,total:d}=await t.storage.threads.list(void 0,{limit:u,offset:0,search:i.query,includeArchived:!1});c+=d;for(let _ of $)f.push({type:"thread",id:_.id,title:_.title??"",created_at:cTu(_.created_at),updated_at:cTu(_.updated_at),virtual_mcp_id:_.virtual_mcp_id??null,run_config:_.run_config??null,status:_.status??null})}return{items:f,totalCount:c}}})});var dTu=w(()=>{$Tu()});var Ndi={};Gi(Ndi,{managementMCP:()=>pS,listManagementTools:()=>NU0,ALL_TOOLS:()=>_Tu});import{z as aut}from"zod";async function NU0(i){let t=await pS(i),[u,l]=Ce.createLinkedPair();await t.connect(l);let n=new N1({name:"tools-hydration",version:"1.0.0"},{jsonSchemaValidator:nc});try{return await n.connect(u),(await n.listTools()).tools}finally{await n.close().catch(()=>{}),await t.close().catch(()=>{})}}var yU0,XU0,_Tu,pS=async(i)=>{let t=null;if(i.organization){let c=await i.storage.organizationSettings.get(i.organization.id),$=await i.storage.virtualMcps.listEnabledPlugins(i.organization.id),d=new Set(c?.enabled_plugins??[]);for(let _ of $)d.add(_);t=d.size>0?[...d]:null}let u=jot(_Tu,t),l=new x3({name:"mcp-cms-management",version:"1.0.0"},{capabilities:{tools:{},prompts:{},resources:{}},jsonSchemaValidator:nc});for(let c of u){let $=c.inputSchema&&typeof c.inputSchema==="object"&&"shape"in c.inputSchema?c.inputSchema:aut.object({}),d=c.outputSchema&&typeof c.outputSchema==="object"&&"shape"in c.outputSchema?c.outputSchema:void 0;l.registerTool(c.name,{description:c.description??"",inputSchema:$,outputSchema:d,annotations:c.annotations,_meta:c._meta},async(_)=>{i.access.setToolName(c.name);try{let g=await c.execute(_,i);return{content:[{type:"text",text:c.modelSummary?c.modelSummary(g):JSON.stringify(g)}],structuredContent:g}}catch(g){return{content:[{type:"text",text:`Error: ${g.message}`}],isError:!0}}})}let n=c_i();for(let c of n){let $=c.arguments?.length?Object.fromEntries(c.arguments.map((d)=>{let _=d.required?aut.string():aut.string().optional();return[d.name,d.description?_.describe(d.description):_]})):void 0;l.registerPrompt(c.name,{title:c.title,description:c.description,...$?{argsSchema:$}:{}},(d)=>{return{messages:[{role:"user",content:{type:"text",text:typeof c.text==="function"?c.text(d??{}):c.text}}]}})}if(i.organization?.id){let c=await i.storage.brandContext.list(i.organization.id),$=new Set;for(let d of c){let _=d.name.toLowerCase().replace(/[^a-z0-9]+/g,"-").replace(/^-|-$/g,""),g=_?`brand-${_}`:`brand-${d.id}`;if($.has(g))g=`${g}-${d.id.slice(0,8)}`;$.add(g);let h=[`# Brand: ${d.name}`,"",`**Domain:** ${d.domain}`,"","## Overview",d.overview];if(d.colors){let v=Object.entries(d.colors).filter(([,r])=>r);if(v.length>0){h.push("","## Colors");for(let[r,x]of v)h.push(`- **${r}:** ${x}`)}}if(d.fonts){let v=Object.entries(d.fonts).filter(([,r])=>r);if(v.length>0){h.push("","## Fonts");for(let[r,x]of v)h.push(`- ${x} (${r})`)}}if(d.logo)h.push("",`**Logo:** ${d.logo}`);if(d.favicon)h.push(`**Favicon:** ${d.favicon}`);if(d.ogImage)h.push(`**OG Image:** ${d.ogImage}`);if(d.images&&d.images.length>0){h.push("","## Images");for(let v of d.images){let r=Object.entries(v).map(([x,O])=>`${x}: ${O}`).join(", ");h.push(`- ${r}`)}}let E=h.join(`
 `);l.prompt(g,`Brand context for ${d.name}`,()=>({messages:[{role:"user",content:{type:"text",text:E}}]}))}}let f=v2u();for(let c of f)l.resource(c.name,c.uri,{description:c.description,mimeType:c.mimeType??"text/markdown"},async($)=>{return{contents:[{uri:typeof $==="string"?$:$.href,mimeType:c.mimeType??"text/markdown",text:c.text}]}});return l};var eS=w(()=>{oL();Xh();$L();W_();unu();lvu();$vu();Dvu();Yvu();kvu();lru();_ru();Fru();f3u();$3u();Y3u();G3u();R3u();e3u();qsi();z2u();QOu();iTu();uTu();fTu();dTu();yU0=[noi,foi,coi,$oi,doi,_oi,goi,hoi,Eoi,voi,roi,woi,Doi,Ooi,yoi,Xoi,Noi,Joi,Uoi,Toi,Foi,Ioi,Zoi,XCi,Zmi,Bmi,Ymi,Pmi,Ami,Hmi,Lmi,Cmi,qmi,ami,cvu,ioi,toi,uoi,loi,ECi,rCi,wCi,vCi,Gmi,Wmi,kmi,jmi,Smi,zmi,bmi,ysi,Woi,koi,joi,zoi,boi,Koi,Boi,Qoi,Yoi,Poi,Aoi,Hoi,Roi,Loi,Esi,vsi,rsi,wsi,xsi,Dsi,Osi,mmi,omi,smi,pmi,Xsi,Usi,Tsi,Fsi,Isi,Zsi,Bsi,Qsi,Ysi,Psi,Asi,Gsi,Wsi,jsi,Ssi,zsi,Ksi,Hsi,Rsi,Msi,L3u,Vsi,asi,msi,osi,ssi,psi,...BOu,Hut,Lut,eut,Cut,qut,Vut],XU0=Sot(),_Tu=[...yU0,...XU0]});import{z as gTu}from"zod";function JU0(i){return[{permissions:{self:["*"]},getTools:async()=>{let{ALL_TOOLS:t}=await Promise.resolve().then(() => (eS(),Ndi));return t.map((u)=>{return{name:u.name,inputSchema:gTu.toJSONSchema(u.inputSchema,{unrepresentable:"any"}),outputSchema:u.outputSchema?gTu.toJSONSchema(u.outputSchema,{unrepresentable:"any"}):void 0,description:u.description}})},data:vKi(o4(),i)},{data:EKi()},{data:hKi(i)}]}async function hTu(i,t){try{let u=R0(),l=Qt(),n=new RO(l.encryptionKey),f=new Ke(u.db,n),c=JU0(i);await Promise.all(c.map(async($)=>{let d=null;if($.permissions)d=(await an.api.createApiKey({body:{name:`${$.data.app_name??crypto.randomUUID()}-mcp`,userId:t,permissions:$.permissions,rateLimitEnabled:!1,metadata:{organization:{id:i},purpose:"default-org-connections"}}}))?.key;let _=await zx({id:"pending",title:$.data.title,connection_type:$.data.connection_type,connection_url:$.data.connection_url,connection_token:$.data.connection_token??d,connection_headers:$.data.connection_headers}).catch(()=>null),g=await $.getTools?.()??_?.tools??null,h=_?.scopes?.length?_.scopes:null,E=$.data.id?$.data.id.startsWith(`${i}_`)?$.data.id:`${i}_${$.data.id}`:void 0;await f.create({...$.data,id:E,tools:g,configuration_scopes:h,organization_id:i,created_by:t,connection_token:$.data.connection_token??d})}));try{await hCi({orgId:i,createdBy:t})}catch($){console.error("Failed to enqueue studio pack install:",$)}if(l.aiGatewayEnabled&&l.studioProvisionSecretKey&&Se.provisionKey)try{let $=await bx(t),d=await Se.provisionKey($,i);await new be(u.db,n).upsert({providerId:"deco",label:"Auto-provisioned",apiKey:d,organizationId:i,createdBy:t})}catch($){console.error("Failed to auto-provision Deco AI Gateway key:",$)}}catch(u){console.error("Error creating default MCP connections:",u)}}var ETu=w(()=>{zl();qei();T_();Nd();Fci();aei();mei();Re();U0();E2();Aci();CO()});function UU0(i,t){let u=i.email.split("@")[1]?.toLowerCase()??null;return{distinctId:i.id,properties:{$set:{email:i.email,name:i.name,email_verified:i.emailVerified},$set_once:{first_seen_at:t.toISOString(),signup_email_domain:u}}}}function mut(i){Ju.identify(UU0(i,new Date))}var vTu=w(()=>{Ff()});import{decodeJwt as TU0}from"jose";import{sql as Ea}from"kysely";async function ZU0(i){let{user:t,token:u}=i;if(!u?.idToken)return;let l;try{l=TU0(u.idToken)}catch{return}let{preferred_username:n,upn:f}=l,c=[n,f].filter((_)=>typeof _==="string"&&_.length>0&&_.toLowerCase()!==t.email.toLowerCase()).map((_)=>_.toLowerCase());if(c.length===0)return;let{db:$}=R0(),d=await $.selectFrom("user").selectAll().where("email","in",c).where("id","!=",t.id).executeTakeFirst();if(!d)return;try{await $.transaction().execute(async(_)=>{await Ea`UPDATE "account" SET "userId" = ${d.id} WHERE "userId" = ${t.id}`.execute(_),await Ea`UPDATE "session" SET "userId" = ${d.id} WHERE "userId" = ${t.id}`.execute(_),await Ea`
         UPDATE "member" SET "userId" = ${d.id}
         WHERE "userId" = ${t.id}