npm - decocms - Versions diffs - 3.35.1 → 3.35.3 - Mend

decocms 3.35.1 → 3.35.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (237) hide show

package/dist/server/cli.js CHANGED Viewed

@@ -104771,7 +104771,7 @@ ${c.stack}`;f.reject(d)}else f.resolve(_)}});return $.requestSubject=i,this.prot
 `);if(g===-1)return;let h=$.subarray(0,g).toString("utf8"),E=$.subarray(g+4),v=h.split(`\r
 `,1)[0]??"";if(!/^HTTP\/1\.[01] 101(?:\s|$)/.test(v)){o8(i,1011,t.upstreamErrorReason);try{c.end()}catch{}return}d=!0,i.data.upstream=c;let w=hNl((r,O)=>{try{if(r===1)i.send(O.toString("utf8"));else if(r===2)i.send(O);else if(r===8){let{code:y,reason:X}=gNl(O);o8(i,y,X);try{c.end()}catch{}}}catch{}});if(c.removeAllListeners("data"),E.length>0)w(E);c.on("data",(r)=>w(r));for(let r of i.data.pending)try{c.write(Tji(r,!0))}catch{}i.data.pending.length=0})}function _Nl(i,t){let u=[`GET ${i} HTTP/1.1`];for(let[l,n]of Object.entries(t))u.push(`${l}: ${n}`);return u.push("",""),u.join(`\r
 `)}function o8(i,t,u){try{if(t!==void 0)i.close(t,u??"");else i.close()}catch{}}function Tji(i,t,u){let l,n;if(typeof i==="string")l=Buffer.from(i,"utf8"),n=1;else if(i instanceof ArrayBuffer)l=Buffer.from(i),n=2;else if(Buffer.isBuffer(i))l=i,n=2;else l=Buffer.from(i),n=2;let f=u??n,c=l.length,$=[];$.push(128|f&15);let d=t?128:0;if(c<126)$.push(d|c);else if(c<65536)$.push(d|126,c>>8&255,c&255);else $.push(d|127,0,0,0,0),$.push(c>>>24&255,c>>>16&255,c>>>8&255,c&255);let _=t?4:0,g=Buffer.allocUnsafe($.length+_+c),h=0;for(let E=0;E<$.length;E++)g[h++]=$[E];if(t){let E=bSt(4);g[h++]=E[0],g[h++]=E[1],g[h++]=E[2],g[h++]=E[3];for(let v=0;v<c;v++)g[h++]=l[v]^E[v&3]}else l.copy(g,h);return g}function gNl(i){if(i.length<2)return{code:1000,reason:""};return{code:i.readUInt16BE(0),reason:i.subarray(2).toString("utf8")}}function hNl(i){let t=Buffer.alloc(0);return(u)=>{t=t.length===0?u:Buffer.concat([t,u]);while(!0){if(t.length<2)return;let l=t[0],n=t[1],f=l&15,c=(n&128)!==0,$=n&127,d=2;if($===126){if(t.length<d+2)return;$=t[d]<<8|t[d+1],d+=2}else if($===127){if(t.length<d+8)return;$=t[d+4]*16777216+(t[d+5]<<16|t[d+6]<<8|t[d+7]),d+=8}let _=null;if(c){if(t.length<d+4)return;_=t.subarray(d,d+4),d+=4}if(t.length<d+$)return;let g=t.subarray(d,d+$);if(_){let h=Buffer.alloc($);for(let E=0;E<$;E++)h[E]=g[E]^_[E&3];g=h}t=t.subarray(d+$),i(f,g)}}}var $Nl=256;var CSt=x(()=>{KSt()});function eSt(i){if(typeof i!=="string"||i.length===0)return null;let t=i.lastIndexOf(":");if(i.startsWith("["))return null;let l=(t>=0?i.slice(0,t):i).replace(/\.$/,"").toLowerCase(),n=".localhost";if(!l.endsWith(n))return null;let f=l.slice(0,-n.length);if(f.length===0)return null;if(f.includes("."))return null;return f}async function MSt(i){let t=RSt({maxPendingFrames:i.maxPendingWsFrames??ENl,backlogOverflowReason:"ingress backlog overflow"}),u=Bun.serve({port:i.port,hostname:"127.0.0.1",idleTimeout:0,async fetch(l,n){let f=l.headers.get("host"),c=eSt(f);if(!c)return new Response("not found",{status:404});let $=i.lookupSandboxPort(c);if(!$){if(l.headers.get("upgrade")==="websocket")return new Response("unknown handle",{status:404});return new Response(vNl,{status:503,headers:{"Content-Type":"text/html; charset=utf-8","Cache-Control":"no-store","Retry-After":"1"}})}if(l.headers.get("upgrade")==="websocket"){let h=new URL(l.url);if(!n.upgrade(l,{data:LSt({port:$,pathQuery:`${h.pathname}${h.search}`,protocols:HSt(l.headers)})}))return new Response("ws upgrade failed",{status:400});return}let d=new URL(l.url),_=`http://127.0.0.1:${$}${d.pathname}${d.search}`,g=new Headers(l.headers);return g.set("host",`127.0.0.1:${$}`),fetch(_,{method:l.method,headers:g,body:l.body,redirect:"manual"})},websocket:{open:t.open,message:t.message,close:t.close}});return{port:u.port??0,async stop(){u.stop(!0)}}}var ENl=256,vNl='<!DOCTYPE html><html><head><meta charset="utf-8"><title>Connecting\u2026</title><style>body{font-family:system-ui,sans-serif;display:flex;align-items:center;justify-content:center;min-height:100vh;margin:0;background:#fafafa;color:#555}div{text-align:center;max-width:420px;padding:24px}h3{margin:0 0 8px}p{margin:0;font-size:14px;color:#999;line-height:1.5}</style></head><body><div><h3>Connecting to sandbox\u2026</h3><p>Waiting for the local sandbox to come online. This page refreshes automatically.</p></div><script>setTimeout(function(){window.location.reload()},1500)</script></body></html>';var qSt=x(()=>{CSt()});async function Qji(i=yNl){let t=["decopilot-sandbox","body-offload"],[u,l]=await Promise.all([i.detectClaudeCode().catch(()=>!1),i.detectCodex().catch(()=>!1)]);if(u)t.push("claude-code");if(l)t.push("codex");return t}function xNl(i){return wNl.filter((t)=>!i.includes(t))}function rNl(i,t){let u=t.filter((l)=>!i.includes(l));return i.push(...u),u}function VSt(i,t={}){let u=t.detect??(()=>Qji()),l=setInterval(()=>{if(xNl(i).length===0)return;u().then((n)=>{let f=rNl(i,n);if(f.length>0)t.onChange?.(f)}).catch(()=>{})},t.intervalMs??60000);return l.unref?.(),()=>clearInterval(l)}async function DNl(){try{let{query:i}=await import("@anthropic-ai/claude-agent-sdk"),t=i({prompt:"",options:{maxTurns:1}}),u=await t.accountInfo();return t.return(void 0),Boolean(u.email)}catch{return!1}}async function ONl(){try{let i=Bun.spawn(["codex","--version"],{stdout:"ignore",stderr:"ignore"}),t=setTimeout(()=>i.kill(),1e4),u=await i.exited;return clearTimeout(t),u===0}catch{return!1}}var wNl,yNl;var mSt=x(()=>{wNl=["claude-code","codex"];yNl={detectClaudeCode:DNl,detectCodex:ONl}});import{randomBytes as XNl}from"crypto";import{mkdir as NNl,readFile as JNl,writeFile as UNl}from"fs/promises";import{dirname as ZNl,join as FNl}from"path";function TNl(i){return FNl(i,"machine-id")}async function aSt(i){let t=TNl(i);try{let n=(await JNl(t,"utf8")).trim();if(n)return n}catch{}let u=XNl(16).toString("hex");return await NNl(ZNl(t),{recursive:!0}),await UNl(t,u),u}var oSt=()=>{};import{randomBytes as QNl}from"crypto";import{mkdir as BNl}from"fs/promises";import{createServer as INl}from"net";import{join as YNl}from"path";function sSt(i,t){return Error(`sandbox failed to start: ${i}`,{cause:t})}function PNl(i){if(!(i instanceof Error))return!1;return i.name==="TimeoutError"||/timed out|timeout|operation was aborted|aborted/i.test(i.message)}function GNl(i){if(i instanceof Error){let t=i.cause;if(t instanceof Error&&t.message)return t.message;return i.message}return String(i)}function pSt(i){let t=i.maxSandboxes??20,u=new Map,l=i.pickPort??WNl,n=i.fetchImpl??fetch,f=i.resolvePreviewUrl??((E,v)=>`http://127.0.0.1:${v}`),c=(E)=>{try{i.onEvent?.(E)}catch{}},$=async(E)=>{let v=new AbortController,w=setTimeout(()=>v.abort(),1500);try{let r=await n(`${E}/health`,{signal:v.signal});if(!r.ok)console.warn(`[user-desktop] probe ${E}/health \u2192 ${r.status} (treating as dead)`);return r.ok}catch(r){return console.warn(`[user-desktop] probe ${E}/health failed: ${r instanceof Error?r.message:String(r)} (treating as dead)`),!1}finally{clearTimeout(w)}},d=(E)=>{console.warn(`[user-desktop] evicting dead daemon handle=${E.handle} port=${E.port}`);try{E.process.kill("SIGTERM")}catch{}if(u.get(E.handle)===E)u.delete(E.handle),c({handle:E.handle,phase:"evicted"})},_=new Map;function g(){if(u.size<t)return;let E=[...u.values()].filter((w)=>w.activeDispatchCount===0).sort((w,r)=>w.lastUsedAt-r.lastUsedAt);if(E.length===0){console.warn(`[user-desktop] at cap ${u.size}/${t} but every sandbox is pinned (active dispatch) \u2014 exceeding cap temporarily`);return}let v=E[0];console.log(`[user-desktop] evicting LRU victim handle=${v.handle} port=${v.port} (cap ${t} reached, size=${u.size})`);try{v.process.kill("SIGTERM")}catch{}u.delete(v.handle),c({handle:v.handle,phase:"evicted"})}let h=async(E)=>{c({handle:E.handle,phase:"spawning"}),g();let v=YNl(i.dataDir,"sandboxes",E.handle);await BNl(v,{recursive:!0}),console.log(`[user-desktop] ensure handle=${E.handle} repo=${E.repo?.cloneUrl??"(none)"} branch=${E.repo?.branch??"(none)"} runtime=${E.workload?.runtime??"(autodetect)"} pm=${E.workload?.packageManager??"(autodetect)"}`);let w=QNl(24).toString("hex"),[r,O]=await Promise.all([l(),l()]);console.log(`[user-desktop] spawn handle=${E.handle} port=${r} devPort=${O} workdir=${v}`);let y=await Promise.resolve(i.spawnDaemon({workdir:v,handle:E.handle,port:r,daemonToken:w,offloadAllowedHosts:E.offloadAllowedHosts??[],offloadAllowSameHostDev:E.offloadAllowSameHostDev??!1,orgFsConfigJson:E.orgFsConfigJson}));try{try{await i.waitForHealth(r)}catch(J){throw sSt("the sandbox didn't come online in time",J)}console.log(`[user-desktop] healthy handle=${E.handle} port=${r} \u2014 posting config`);try{await i.postConfig(r,O,{repo:E.repo,workload:E.workload,operator:E.operator},w)}catch(J){throw sSt(PNl(J)?"configuration timed out":"the sandbox rejected its configuration",J)}}catch(J){console.error(`[user-desktop] sandbox bring-up failed handle=${E.handle} port=${r} (killing daemon):`,J);try{y.kill("SIGKILL")}catch{}throw c({handle:E.handle,phase:"failed",error:GNl(J)}),J}let X=`http://127.0.0.1:${r}`,N=f(E.handle,r);console.log(`[user-desktop] ready handle=${E.handle} port=${r} sandboxApiUrl=${X} previewUrl=${N}`);let U={handle:E.handle,port:r,process:y,sandboxApiUrl:X,previewUrl:N,lastUsedAt:Date.now(),activeDispatchCount:0,daemonToken:w};if(u.set(E.handle,U),c({handle:E.handle,phase:"ready",port:r,previewUrl:N}),y.exited)y.exited.then(()=>{if(u.get(E.handle)===U)console.warn(`[user-desktop] daemon process exited unexpectedly handle=${E.handle} port=${r} \u2014 removing from cache`),u.delete(E.handle),c({handle:E.handle,phase:"evicted"});else console.log(`[user-desktop] daemon process exited handle=${E.handle} port=${r} (already replaced/removed)`)});return{sandboxApiUrl:X,previewUrl:N,port:r}};return{async ensureSandbox(E){let v=u.get(E.handle);if(v){if(await $(v.sandboxApiUrl))return console.log(`[user-desktop] cache hit handle=${E.handle} port=${v.port} (alive)`),v.lastUsedAt=Date.now(),{sandboxApiUrl:v.sandboxApiUrl,previewUrl:v.previewUrl,port:v.port};console.warn(`[user-desktop] cache stale handle=${E.handle} port=${v.port} \u2014 respawning`),d(v)}let w=_.get(E.handle);if(w)return console.log(`[user-desktop] joining in-flight ensure handle=${E.handle}`),w;let r=h(E).finally(()=>{_.delete(E.handle)});return _.set(E.handle,r),r},proxyPort(E){let v=u.get(E);if(v)v.lastUsedAt=Date.now();return v?.port??null},getDaemonToken(E){return u.get(E)?.daemonToken??null},hasHandle(E){return u.has(E)||_.has(E)},recordHit(E){let v=u.get(E);if(v)v.lastUsedAt=Date.now()},acquireDispatch(E){let v=u.get(E);if(!v)return()=>{};v.activeDispatchCount+=1;let w=!1;return()=>{if(w)return;w=!0;let r=u.get(E);if(r)r.activeDispatchCount=Math.max(0,r.activeDispatchCount-1)}},listSandboxes(){return[...u.values()]},async deleteSandbox(E){let v=u.get(E);if(!v){console.log(`[user-desktop] delete handle=${E} (not found, no-op)`);return}console.log(`[user-desktop] delete handle=${E} port=${v.port}`);try{v.process.kill("SIGTERM")}catch{}u.delete(E),c({handle:E,phase:"deleted"})},async shutdown(){console.log(`[user-desktop] shutdown \u2014 killing ${u.size} sandbox(es)`);for(let E of u.values())try{E.process.kill("SIGTERM")}catch{}u.clear()}}}function WNl(){return new Promise((i,t)=>{let u=INl();u.unref(),u.on("error",t),u.listen(0,"127.0.0.1",()=>{let l=u.address();if(l&&typeof l==="object"){let n=l.port;u.close(()=>i(n))}else u.close(()=>t(Error("could not allocate port")))})})}var izt=()=>{};import{randomUUID as ANl}from"crypto";import{hostname as jNl}from"os";async function tzt(i){let t=jNl()||void 0;i.monitor?.onMachine?.(t??"this machine");let u=rGt(i.dataDir,{outFd:i.logFd,perSandboxLog:i.perSandboxLogs,hotReload:i.hotReload}),l=0,n=pSt({dataDir:i.dataDir,resolvePreviewUrl:(N,U)=>l>0?`http://${N}.localhost:${l}`:`http://127.0.0.1:${U}`,spawnDaemon:async(N)=>{let U={DAEMON_BOOT_ID:ANl(),APP_ROOT:N.workdir,PROXY_PORT:String(N.port),DAEMON_TOKEN:N.daemonToken,OFFLOAD_ALLOWED_HOSTS:N.offloadAllowedHosts.join(","),...N.offloadAllowSameHostDev?{OFFLOAD_ALLOW_SAME_HOST_DEV:"1"}:{}};if(N.orgFsConfigJson){let F=await XGt(i.dataDir);if(F)U.ORGFS_CONFIG=N.orgFsConfigJson,U.ORGFS_RCLONE_PATH=F}let J=await u({workdir:N.workdir,env:U,daemonPort:N.port});return{port:N.port,kill:(F)=>J.kill(F),exited:J.exited.then(()=>{return})}},postConfig:async(N,U,J,F)=>{let I={port:U};if(J.workload)I.runtime=J.workload.runtime,I.packageManager={name:J.workload.packageManager,...J.workload.packageManagerPath?{path:J.workload.packageManagerPath}:{}};let B={application:I},P=th(J.operator??null);if(P)B.operator=P;if(J.repo)B.git={repository:{cloneUrl:J.repo.cloneUrl,branch:J.repo.branch},...J.repo.userName&&J.repo.userEmail?{identity:{userName:J.repo.userName,userEmail:J.repo.userEmail}}:{}};await W8(`http://127.0.0.1:${N}`,F,B)},waitForHealth:async(N)=>{await hli(`http://127.0.0.1:${N}`)},maxSandboxes:20,onEvent:i.monitor?.onEvent}),f=await MSt({port:i.port,lookupSandboxPort:(N)=>n.proxyPort(N)});l=f.port,console.log(`Local ingress listening on http://127.0.0.1:${f.port} (use http://<handle>.localhost:${f.port}/)`),i.monitor?.onIngress?.(f.port);let c=JGt({provider:n}),$=async()=>{let N=await Sx({dataDir:i.dataDir,target:i.clusterBaseUrl});if(!N)throw Object.assign(Error(`Session for ${i.clusterBaseUrl} is no longer valid \u2014 run \`deco auth login --target ${i.clusterBaseUrl}\` and restart \`deco link\`.`),{fatal:!0});return N.accessToken};console.log(`[link-daemon] transport=pull cluster=${i.clusterBaseUrl}`);let d=await aSt(i.dataDir),_=process.env.npm_package_version??"0.0.0",g=await Qji(),h=VSt(g,{onChange:(N)=>{console.log(`[link-daemon] capabilities detected: +${N.join(",")} (now: ${g.join(",")})`)}}),E=Uji({path:`${i.dataDir}/link/outbox.sqlite`}),v=()=>{},w=await ASt({clusterBaseUrl:i.clusterBaseUrl,getAccessToken:$,provider:n,outbox:E,controlHandler:c,capabilities:g,machineId:d,cliVersion:_,previewPort:f.port,onConnected:()=>{i.monitor?.onCluster?.("linked"),console.log(`Linked to ${i.clusterBaseUrl} (pull transport)`)},onShutdown:()=>v()}),r,O=new Promise((N)=>{r=N}),y=!1,X=async()=>{if(y)return;y=!0,console.log(`
-Shutting down\u2026`),h();try{await w.close()}catch{}try{await f.stop()}catch{}try{await n.shutdown()}catch{}try{E.close()}catch{}r(0)};return process.on("SIGINT",()=>void X()),process.on("SIGTERM",()=>void X()),v=()=>{console.log("Disconnect requested from the Studio web UI \u2014 shutting down. Run `bunx decocms link` to reconnect."),X()},w.closed.then(()=>{if(i.monitor?.onCluster?.("closed"),!y)console.error("Cluster connection closed permanently; exiting."),X()}),{stopped:O,stop:X}}var uzt=x(()=>{NWi();MH();DGt();NGt();UGt();jSt();Zji();qSt();mSt();oSt();eH();izt()});function Bji(i){return i.map((t)=>typeof t==="string"?t:String(t)).join(" ")}var U0i;var Iji=x(()=>{U0i={name:"decocms",version:"3.35.1",description:"Deco CMS \u2014 Self-hostable MCP Gateway for managing AI connections and tools",author:"Deco team",repository:{type:"git",url:"git+https://github.com/decocms/studio.git",directory:"apps/mesh"},bugs:{url:"https://github.com/decocms/studio/issues"},type:"module",bin:{deco:"./dist/server/cli.js"},files:["dist/**/*"],scripts:{dev:'bun run migrate && concurrently "bun run dev:client" "bun run dev:server"',"dev:servers":'concurrently "bun run dev:client" "bun run dev:server"',"dev:client":"vite dev","dev:server":"bun run --cwd=../../packages/sandbox build && NODE_ENV=development bun --env-file=.env --hot run src/index.ts","build:client":"bun --bun vite build","build:server":"bun run scripts/bundle-server-script.ts --dist ./dist/server","db:migrate":"bun run ./dist/server/migrate.js",check:"tsc --noEmit",start:"bun run ./dist/server/server.js",migrate:"bun run src/database/migrate.ts",test:"bun test","test:e2e":"playwright test","test:e2e:ui":"playwright test --ui","test:ct":"playwright test -c playwright-ct.config.ts","test:ct:ui":"playwright test -c playwright-ct.config.ts --ui","better-auth:migrate":"bunx --bun @better-auth/cli migrate -y --config src/auth/index.ts","smoke:link":"bun run scripts/smoke-link.ts",prepublishOnly:"bun run build:client && bun run build:server"},optionalDependencies:{"@anthropic-ai/claude-agent-sdk":"^0.2.141","@duckdb/node-api":"^1.5.0-r.1"},dependencies:{"@ai-sdk/anthropic":"^3.0.80","@ai-sdk/google":"^3.0.80","@ai-sdk/openai":"^3.0.65","@anthropic-ai/sdk":"^0.96.0","@aws-sdk/client-s3":"^3.1013.0","@aws-sdk/lib-storage":"^3.1013.0","@aws-sdk/s3-request-presigner":"^3.1013.0","@clickhouse/client":"^1.8.1","@dbos-inc/dbos-sdk":"^4.17.6","@dnd-kit/core":"^6.3.1","@dnd-kit/sortable":"^10.0.0","@dnd-kit/utilities":"^3.2.2","@inkjs/ui":"^2.0.0","@modelcontextprotocol/ext-apps":"^1.7.1","@openrouter/ai-sdk-provider":"^2.9.0","@opentelemetry/core":"^2.6.0","@tanstack/react-virtual":"3.13.24","@xterm/addon-fit":"^0.11.0","@xterm/xterm":"^6.0.0","embedded-postgres":"^18.3.0-beta.16",ink:"^6.8.0",kysely:"^0.28.12",nats:"^2.29.3","node-pty":"^1.0.0","posthog-js":"^1.371.1","posthog-node":"^5.0.0",react:"^19.2.6","react-dom":"^19.2.6"},devDependencies:{"@ai-sdk/provider":"^3.0.10","@ai-sdk/react":"^3.0.193","@better-auth/sso":"1.4.1","@daveyplate/better-auth-ui":"^3.2.7","@deco/ui":"workspace:*","@decocms/better-auth":"1.5.17","@decocms/bindings":"workspace:*","@decocms/harness":"workspace:*","@decocms/mcp-utils":"workspace:*","@decocms/mesh-sdk":"workspace:*","@decocms/runtime":"workspace:*","@decocms/sandbox":"workspace:*","@decocms/std":"workspace:*","@floating-ui/react":"^0.27.16","@happy-dom/global-registrator":"^20.9.0","@hookform/resolvers":"^5.2.2","@jitl/quickjs-wasmfile-release-sync":"0.31.0","@modelcontextprotocol/sdk":"1.29.0","@monaco-editor/react":"^4.7.0","@opentelemetry/api":"^1.9.0","@opentelemetry/api-logs":"^0.211.0","@opentelemetry/exporter-logs-otlp-proto":"^0.211.0","@opentelemetry/exporter-prometheus":"^0.208.0","@opentelemetry/exporter-trace-otlp-proto":"^0.207.0","@opentelemetry/instrumentation-runtime-node":"^0.24.0","@opentelemetry/resources":"^2.6.0","@opentelemetry/sdk-logs":"^0.211.0","@opentelemetry/sdk-metrics":"^2.2.0","@opentelemetry/sdk-node":"^0.207.0","@opentelemetry/sdk-trace-base":"^2.5.0","@playwright/experimental-ct-react":"1.59.1","@playwright/test":"^1.58.2","@radix-ui/react-avatar":"^1.1.10","@radix-ui/react-checkbox":"^1.3.3","@radix-ui/react-dialog":"^1.1.15","@radix-ui/react-dropdown-menu":"^2.1.16","@radix-ui/react-label":"^2.1.7","@radix-ui/react-select":"^2.2.6","@radix-ui/react-separator":"^1.1.7","@radix-ui/react-slot":"^1.2.3","@radix-ui/react-tabs":"^1.1.13","@rjsf/core":"^6.1.2","@rjsf/shadcn":"^6.1.2","@rjsf/utils":"^6.1.2","@rjsf/validator-ajv8":"^6.1.2","@tailwindcss/vite":"^4.1.17","@tanstack/react-query":"5.100.10","@tanstack/react-router":"1.169.2","@testing-library/jest-dom":"^6.9.1","@testing-library/react":"^16.3.2","@tiptap/core":"3.20.2","@tiptap/extension-mention":"3.20.2","@tiptap/extension-placeholder":"3.20.2","@tiptap/pm":"3.20.2","@tiptap/react":"3.20.2","@tiptap/starter-kit":"3.20.2","@tiptap/suggestion":"3.20.2","@types/bun":"^1.3.1","@types/pg":"^8.15.6","@types/react-syntax-highlighter":"^15.5.13","@untitledui/icons":"^0.0.19","@vercel/nft":"^1.1.1","@vitejs/plugin-react":"^5.1.0",ai:"^6.0.191","babel-plugin-react-compiler":"^1.0.0","better-auth":"1.4.22","class-variance-authority":"^0.7.1",clsx:"^2.1.1",concurrently:"^9.2.1",croner:"^9.1.0","date-fns":"^4.1.0",degit:"^2.8.4",hono:"^4.10.7","input-otp":"^1.4.2",jose:"^6.0.11","lucide-react":"^0.468.0",marked:"^15.0.6","mesh-plugin-workflows":"workspace:*",nanoid:"^5.1.6",pg:"^8.16.3",prettier:"^3.4.2","react-hook-form":"^7.66.0","react-markdown":"^10.1.0","react-resizable-panels":"^2.1.7","react-syntax-highlighter":"^15.6.1",recharts:"^3.6.0","rehype-raw":"^7.0.0","remark-gfm":"^4.0.0","sass-embedded":"^1.97.2",sonner:"^2.0.7","tailwind-merge":"^3.3.1",tailwindcss:"^4.1.17",typescript:"^5.9.3",vite:"^7.2.1","vite-tsconfig-paths":"^5.1.4",zod:"^4.0.0",zustand:"^5.0.9"},homepage:"https://github.com/decocms/studio",keywords:["mcp","model-context-protocol","ai","gateway","self-hosted","mesh","tools"],license:"MIT",publishConfig:{access:"public"}}});var DL={};Pi(DL,{printBanner:()=>zNl,bannerLines:()=>lzt,BANNER_LINES:()=>Z0i,BANNER_GRADIENT:()=>F0i});function SNl(i){let t=Number.parseInt(i.slice(1),16);return[t>>16&255,t>>8&255,t&255]}function lzt(i){let t=Z0i.map((u,l)=>{let[n,f,c]=SNl(F0i[l]);return`\x1B[38;2;${n};${f};${c}m${u}\x1B[39m`});if(i!==void 0)t.push(`\x1B[2m  v${i}\x1B[22m`);return t}function zNl(i){console.log("");for(let t of lzt(i))console.log(t);console.log("")}var Z0i,F0i;var jA=x(()=>{Z0i=[" \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588     \u2588\u2588\u2588\u2588\u2588\u2588\u2588   ","\u2591\u2591\u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2588\u2588\u2588 \u2591\u2591\u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2591\u2588  \u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2591\u2588\u2588\u2588  \u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2591\u2588\u2588\u2588 "," \u2591\u2588\u2588\u2588   \u2591\u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588  \u2588 \u2591  \u2588\u2588\u2588     \u2591\u2591\u2591  \u2588\u2588\u2588     \u2591\u2591\u2588\u2588\u2588"," \u2591\u2588\u2588\u2588    \u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588\u2588\u2588\u2588   \u2591\u2588\u2588\u2588         \u2591\u2588\u2588\u2588      \u2591\u2588\u2588\u2588"," \u2591\u2588\u2588\u2588    \u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588\u2591\u2591\u2588   \u2591\u2588\u2588\u2588         \u2591\u2588\u2588\u2588      \u2591\u2588\u2588\u2588"," \u2591\u2588\u2588\u2588    \u2588\u2588\u2588  \u2591\u2588\u2588\u2588 \u2591   \u2588\u2591\u2591\u2588\u2588\u2588     \u2588\u2588\u2588\u2591\u2591\u2588\u2588\u2588     \u2588\u2588\u2588 "," \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588 \u2591\u2591\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588  \u2591\u2591\u2591\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2591  ","\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591   \u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591   \u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591     \u2591\u2591\u2591\u2591\u2591\u2591\u2591   "],F0i=["#00ff64","#00ee5e","#00dc56","#00c84e","#00b444","#00a03c","#008832","#006e28"]});import{Box as KNl,Text as nzt}from"ink";import{jsx as bNl,jsxs as fzt}from"react/jsx-runtime";function T0i({version:i}){return fzt(KNl,{flexDirection:"column",marginTop:1,children:[Z0i.map((t,u)=>bNl(nzt,{color:F0i[u],children:t},u)),fzt(nzt,{dimColor:!0,children:[" v",i]})]})}var Yji=x(()=>{jA()});var $zt={};Pi($zt,{subscribeLinkState:()=>Wji,setMachine:()=>CNl,setLogPath:()=>MNl,setIngress:()=>RNl,setDaemonError:()=>eNl,setClusterUrl:()=>LNl,setCluster:()=>HNl,pushSandboxEvent:()=>qNl,getLinkState:()=>Gji,applySandboxEvent:()=>czt});function czt(i,t){let u=new Map(i);if(t.phase==="evicted"||t.phase==="deleted")return u.delete(t.handle),u;let l=u.get(t.handle);return u.set(t.handle,{handle:t.handle,port:t.port??l?.port??null,previewUrl:t.previewUrl??l?.previewUrl??null,status:t.phase,error:t.phase==="failed"?t.error??"failed":null}),u}function s8(){for(let i of Pji)i()}function Gji(){return t$}function Wji(i){return Pji.add(i),()=>Pji.delete(i)}function HNl(i){t$={...t$,cluster:i},s8()}function LNl(i){t$={...t$,clusterUrl:i},s8()}function RNl(i,t){t$={...t$,ingressPort:i,ingressUrl:t},s8()}function CNl(i){t$={...t$,machine:i},s8()}function eNl(i){t$={...t$,daemonError:i},s8()}function MNl(i){t$={...t$,logPath:i},s8()}function qNl(i){t$={...t$,sandboxes:czt(t$.sandboxes,i)},s8()}var t$,Pji;var Aji=x(()=>{t$={cluster:"connecting",clusterUrl:null,ingressUrl:null,ingressPort:null,machine:null,cap:20,sandboxes:new Map,daemonError:null,logPath:null},Pji=new Set});var dzt={};Pi(dzt,{LinkApp:()=>aNl});import{Box as u$,Text as l$}from"ink";import{useSyncExternalStore as VNl}from"react";import{jsx as $f,jsxs as eE}from"react/jsx-runtime";function mNl(i){if(i.status==="ready")return{color:"green",text:"\u25CF Live"};if(i.status==="spawning")return{color:"yellow",text:"\u25CC Starting\u2026"};return{color:"red",text:`\u2717 Error: ${i.error??""}`}}function aNl(){let i=VNl(Wji,Gji),t=[...i.sandboxes.values()].sort((u,l)=>u.handle.localeCompare(l.handle));return eE(u$,{flexDirection:"column",children:[$f(T0i,{version:U0i.version}),$f(u$,{marginBottom:1,children:$f(l$,{dimColor:!0,children:"\u2500".repeat(80)})}),$f(u$,{children:i.cluster==="linked"?eE(l$,{color:"green",children:["\u2713 Connected to ",i.clusterUrl??"deco"]}):i.cluster==="connecting"?eE(l$,{color:"yellow",children:["\u25CC Connecting to ",i.clusterUrl??"deco","\u2026"]}):eE(l$,{color:"red",children:["\u2717 Disconnected from ",i.clusterUrl??"deco"]})}),$f(u$,{children:i.ingressUrl?eE(l$,{color:"green",children:["\u2713 Serving at ",i.ingressUrl]}):$f(l$,{dimColor:!0,children:"\u25CC Starting local server\u2026"})}),$f(u$,{marginBottom:1,children:$f(l$,{dimColor:!0,children:`${"Computer".padEnd(16)}${i.machine??"this computer"} \xB7 ${t.length} of ${i.cap} previews`})}),t.length===0?$f(l$,{dimColor:!0,children:"No previews running yet."}):eE(u$,{flexDirection:"column",children:[eE(u$,{children:[$f(u$,{width:Q0i.project,flexShrink:0,marginRight:1,children:$f(l$,{dimColor:!0,wrap:"truncate-end",children:"PROJECT"})}),$f(u$,{width:Q0i.status,flexShrink:0,marginRight:1,children:$f(l$,{dimColor:!0,wrap:"truncate-end",children:"STATUS"})}),$f(u$,{flexGrow:1,children:$f(l$,{dimColor:!0,wrap:"truncate-end",children:"PREVIEW URL"})})]}),t.map((u)=>{let l=mNl(u);return eE(u$,{children:[$f(u$,{width:Q0i.project,flexShrink:0,marginRight:1,children:$f(l$,{wrap:"truncate-end",children:u.handle})}),$f(u$,{width:Q0i.status,flexShrink:0,marginRight:1,children:$f(l$,{color:l.color,wrap:"truncate-end",children:l.text})}),$f(u$,{flexGrow:1,children:$f(l$,{dimColor:!0,wrap:"truncate-end",children:u.previewUrl??"\u2014"})})]},u.handle)})]}),i.daemonError?$f(u$,{marginTop:1,children:eE(l$,{color:"red",children:["\u26A0 ",i.daemonError]})}):null,i.logPath?$f(u$,{marginTop:1,children:eE(l$,{dimColor:!0,children:["Logs: ",i.logPath]})}):null]})}var Q0i;var _zt=x(()=>{Iji();Yji();Aji();Q0i={project:18,status:14}});var hzt={};Pi(hzt,{runLinkCommand:()=>nJl});import{closeSync as oNl,mkdirSync as sNl,openSync as pNl,writeSync as iJl}from"fs";import{homedir as tJl}from"os";import{join as gzt}from"path";function uJl(i,t){let u={log:console.log,warn:console.warn,error:console.error},l=(n)=>{if(t===void 0)return;try{iJl(t,`${Bji(n)}
+Shutting down\u2026`),h();try{await w.close()}catch{}try{await f.stop()}catch{}try{await n.shutdown()}catch{}try{E.close()}catch{}r(0)};return process.on("SIGINT",()=>void X()),process.on("SIGTERM",()=>void X()),v=()=>{console.log("Disconnect requested from the Studio web UI \u2014 shutting down. Run `bunx decocms@latest link` to reconnect."),X()},w.closed.then(()=>{if(i.monitor?.onCluster?.("closed"),!y)console.error("Cluster connection closed permanently; exiting."),X()}),{stopped:O,stop:X}}var uzt=x(()=>{NWi();MH();DGt();NGt();UGt();jSt();Zji();qSt();mSt();oSt();eH();izt()});function Bji(i){return i.map((t)=>typeof t==="string"?t:String(t)).join(" ")}var U0i;var Iji=x(()=>{U0i={name:"decocms",version:"3.35.3",description:"Deco CMS \u2014 Self-hostable MCP Gateway for managing AI connections and tools",author:"Deco team",repository:{type:"git",url:"git+https://github.com/decocms/studio.git",directory:"apps/mesh"},bugs:{url:"https://github.com/decocms/studio/issues"},type:"module",bin:{deco:"./dist/server/cli.js"},files:["dist/**/*"],scripts:{dev:'bun run migrate && concurrently "bun run dev:client" "bun run dev:server"',"dev:servers":'concurrently "bun run dev:client" "bun run dev:server"',"dev:client":"vite dev","dev:server":"bun run --cwd=../../packages/sandbox build && NODE_ENV=development bun --env-file=.env --hot run src/index.ts","build:client":"bun --bun vite build","build:server":"bun run scripts/bundle-server-script.ts --dist ./dist/server","db:migrate":"bun run ./dist/server/migrate.js",check:"tsc --noEmit",start:"bun run ./dist/server/server.js",migrate:"bun run src/database/migrate.ts",test:"bun test","test:e2e":"playwright test","test:e2e:ui":"playwright test --ui","test:ct":"playwright test -c playwright-ct.config.ts","test:ct:ui":"playwright test -c playwright-ct.config.ts --ui","better-auth:migrate":"bunx --bun @better-auth/cli migrate -y --config src/auth/index.ts","smoke:link":"bun run scripts/smoke-link.ts",prepublishOnly:"bun run build:client && bun run build:server"},optionalDependencies:{"@anthropic-ai/claude-agent-sdk":"^0.2.141","@duckdb/node-api":"^1.5.0-r.1"},dependencies:{"@ai-sdk/anthropic":"^3.0.80","@ai-sdk/google":"^3.0.80","@ai-sdk/openai":"^3.0.65","@anthropic-ai/sdk":"^0.96.0","@aws-sdk/client-s3":"^3.1013.0","@aws-sdk/lib-storage":"^3.1013.0","@aws-sdk/s3-request-presigner":"^3.1013.0","@clickhouse/client":"^1.8.1","@dbos-inc/dbos-sdk":"^4.17.6","@dnd-kit/core":"^6.3.1","@dnd-kit/sortable":"^10.0.0","@dnd-kit/utilities":"^3.2.2","@inkjs/ui":"^2.0.0","@modelcontextprotocol/ext-apps":"^1.7.1","@openrouter/ai-sdk-provider":"^2.9.0","@opentelemetry/core":"^2.6.0","@tanstack/react-virtual":"3.13.24","@xterm/addon-fit":"^0.11.0","@xterm/xterm":"^6.0.0","embedded-postgres":"^18.3.0-beta.16",ink:"^6.8.0",kysely:"^0.28.12",nats:"^2.29.3","node-pty":"^1.0.0","posthog-js":"^1.371.1","posthog-node":"^5.0.0",react:"^19.2.6","react-dom":"^19.2.6"},devDependencies:{"@ai-sdk/provider":"^3.0.10","@ai-sdk/react":"^3.0.193","@better-auth/sso":"1.4.1","@daveyplate/better-auth-ui":"^3.2.7","@deco/ui":"workspace:*","@decocms/better-auth":"1.5.17","@decocms/bindings":"workspace:*","@decocms/harness":"workspace:*","@decocms/mcp-utils":"workspace:*","@decocms/mesh-sdk":"workspace:*","@decocms/runtime":"workspace:*","@decocms/sandbox":"workspace:*","@decocms/std":"workspace:*","@floating-ui/react":"^0.27.16","@happy-dom/global-registrator":"^20.9.0","@hookform/resolvers":"^5.2.2","@jitl/quickjs-wasmfile-release-sync":"0.31.0","@modelcontextprotocol/sdk":"1.29.0","@monaco-editor/react":"^4.7.0","@opentelemetry/api":"^1.9.0","@opentelemetry/api-logs":"^0.211.0","@opentelemetry/exporter-logs-otlp-proto":"^0.211.0","@opentelemetry/exporter-prometheus":"^0.208.0","@opentelemetry/exporter-trace-otlp-proto":"^0.207.0","@opentelemetry/instrumentation-runtime-node":"^0.24.0","@opentelemetry/resources":"^2.6.0","@opentelemetry/sdk-logs":"^0.211.0","@opentelemetry/sdk-metrics":"^2.2.0","@opentelemetry/sdk-node":"^0.207.0","@opentelemetry/sdk-trace-base":"^2.5.0","@playwright/experimental-ct-react":"1.59.1","@playwright/test":"^1.58.2","@radix-ui/react-avatar":"^1.1.10","@radix-ui/react-checkbox":"^1.3.3","@radix-ui/react-dialog":"^1.1.15","@radix-ui/react-dropdown-menu":"^2.1.16","@radix-ui/react-label":"^2.1.7","@radix-ui/react-select":"^2.2.6","@radix-ui/react-separator":"^1.1.7","@radix-ui/react-slot":"^1.2.3","@radix-ui/react-tabs":"^1.1.13","@rjsf/core":"^6.1.2","@rjsf/shadcn":"^6.1.2","@rjsf/utils":"^6.1.2","@rjsf/validator-ajv8":"^6.1.2","@tailwindcss/vite":"^4.1.17","@tanstack/react-query":"5.100.10","@tanstack/react-router":"1.169.2","@testing-library/jest-dom":"^6.9.1","@testing-library/react":"^16.3.2","@tiptap/core":"3.20.2","@tiptap/extension-mention":"3.20.2","@tiptap/extension-placeholder":"3.20.2","@tiptap/pm":"3.20.2","@tiptap/react":"3.20.2","@tiptap/starter-kit":"3.20.2","@tiptap/suggestion":"3.20.2","@types/bun":"^1.3.1","@types/pg":"^8.15.6","@types/react-syntax-highlighter":"^15.5.13","@untitledui/icons":"^0.0.19","@vercel/nft":"^1.1.1","@vitejs/plugin-react":"^5.1.0",ai:"^6.0.191","babel-plugin-react-compiler":"^1.0.0","better-auth":"1.4.22","class-variance-authority":"^0.7.1",clsx:"^2.1.1",concurrently:"^9.2.1",croner:"^9.1.0","date-fns":"^4.1.0",degit:"^2.8.4",hono:"^4.10.7","input-otp":"^1.4.2",jose:"^6.0.11","lucide-react":"^0.468.0",marked:"^15.0.6","mesh-plugin-workflows":"workspace:*",nanoid:"^5.1.6",pg:"^8.16.3",prettier:"^3.4.2","react-hook-form":"^7.66.0","react-markdown":"^10.1.0","react-resizable-panels":"^2.1.7","react-syntax-highlighter":"^15.6.1",recharts:"^3.6.0","rehype-raw":"^7.0.0","remark-gfm":"^4.0.0","sass-embedded":"^1.97.2",sonner:"^2.0.7","tailwind-merge":"^3.3.1",tailwindcss:"^4.1.17",typescript:"^5.9.3",vite:"^7.2.1","vite-tsconfig-paths":"^5.1.4",zod:"^4.0.0",zustand:"^5.0.9"},homepage:"https://github.com/decocms/studio",keywords:["mcp","model-context-protocol","ai","gateway","self-hosted","mesh","tools"],license:"MIT",publishConfig:{access:"public"}}});var DL={};Pi(DL,{printBanner:()=>zNl,bannerLines:()=>lzt,BANNER_LINES:()=>Z0i,BANNER_GRADIENT:()=>F0i});function SNl(i){let t=Number.parseInt(i.slice(1),16);return[t>>16&255,t>>8&255,t&255]}function lzt(i){let t=Z0i.map((u,l)=>{let[n,f,c]=SNl(F0i[l]);return`\x1B[38;2;${n};${f};${c}m${u}\x1B[39m`});if(i!==void 0)t.push(`\x1B[2m  v${i}\x1B[22m`);return t}function zNl(i){console.log("");for(let t of lzt(i))console.log(t);console.log("")}var Z0i,F0i;var jA=x(()=>{Z0i=[" \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588     \u2588\u2588\u2588\u2588\u2588\u2588\u2588   ","\u2591\u2591\u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2588\u2588\u2588 \u2591\u2591\u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2591\u2588  \u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2591\u2588\u2588\u2588  \u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2591\u2588\u2588\u2588 "," \u2591\u2588\u2588\u2588   \u2591\u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588  \u2588 \u2591  \u2588\u2588\u2588     \u2591\u2591\u2591  \u2588\u2588\u2588     \u2591\u2591\u2588\u2588\u2588"," \u2591\u2588\u2588\u2588    \u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588\u2588\u2588\u2588   \u2591\u2588\u2588\u2588         \u2591\u2588\u2588\u2588      \u2591\u2588\u2588\u2588"," \u2591\u2588\u2588\u2588    \u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588\u2591\u2591\u2588   \u2591\u2588\u2588\u2588         \u2591\u2588\u2588\u2588      \u2591\u2588\u2588\u2588"," \u2591\u2588\u2588\u2588    \u2588\u2588\u2588  \u2591\u2588\u2588\u2588 \u2591   \u2588\u2591\u2591\u2588\u2588\u2588     \u2588\u2588\u2588\u2591\u2591\u2588\u2588\u2588     \u2588\u2588\u2588 "," \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588 \u2591\u2591\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588  \u2591\u2591\u2591\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2591  ","\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591   \u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591   \u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591     \u2591\u2591\u2591\u2591\u2591\u2591\u2591   "],F0i=["#00ff64","#00ee5e","#00dc56","#00c84e","#00b444","#00a03c","#008832","#006e28"]});import{Box as KNl,Text as nzt}from"ink";import{jsx as bNl,jsxs as fzt}from"react/jsx-runtime";function T0i({version:i}){return fzt(KNl,{flexDirection:"column",marginTop:1,children:[Z0i.map((t,u)=>bNl(nzt,{color:F0i[u],children:t},u)),fzt(nzt,{dimColor:!0,children:[" v",i]})]})}var Yji=x(()=>{jA()});var $zt={};Pi($zt,{subscribeLinkState:()=>Wji,setMachine:()=>CNl,setLogPath:()=>MNl,setIngress:()=>RNl,setDaemonError:()=>eNl,setClusterUrl:()=>LNl,setCluster:()=>HNl,pushSandboxEvent:()=>qNl,getLinkState:()=>Gji,applySandboxEvent:()=>czt});function czt(i,t){let u=new Map(i);if(t.phase==="evicted"||t.phase==="deleted")return u.delete(t.handle),u;let l=u.get(t.handle);return u.set(t.handle,{handle:t.handle,port:t.port??l?.port??null,previewUrl:t.previewUrl??l?.previewUrl??null,status:t.phase,error:t.phase==="failed"?t.error??"failed":null}),u}function s8(){for(let i of Pji)i()}function Gji(){return t$}function Wji(i){return Pji.add(i),()=>Pji.delete(i)}function HNl(i){t$={...t$,cluster:i},s8()}function LNl(i){t$={...t$,clusterUrl:i},s8()}function RNl(i,t){t$={...t$,ingressPort:i,ingressUrl:t},s8()}function CNl(i){t$={...t$,machine:i},s8()}function eNl(i){t$={...t$,daemonError:i},s8()}function MNl(i){t$={...t$,logPath:i},s8()}function qNl(i){t$={...t$,sandboxes:czt(t$.sandboxes,i)},s8()}var t$,Pji;var Aji=x(()=>{t$={cluster:"connecting",clusterUrl:null,ingressUrl:null,ingressPort:null,machine:null,cap:20,sandboxes:new Map,daemonError:null,logPath:null},Pji=new Set});var dzt={};Pi(dzt,{LinkApp:()=>aNl});import{Box as u$,Text as l$}from"ink";import{useSyncExternalStore as VNl}from"react";import{jsx as $f,jsxs as eE}from"react/jsx-runtime";function mNl(i){if(i.status==="ready")return{color:"green",text:"\u25CF Live"};if(i.status==="spawning")return{color:"yellow",text:"\u25CC Starting\u2026"};return{color:"red",text:`\u2717 Error: ${i.error??""}`}}function aNl(){let i=VNl(Wji,Gji),t=[...i.sandboxes.values()].sort((u,l)=>u.handle.localeCompare(l.handle));return eE(u$,{flexDirection:"column",children:[$f(T0i,{version:U0i.version}),$f(u$,{marginBottom:1,children:$f(l$,{dimColor:!0,children:"\u2500".repeat(80)})}),$f(u$,{children:i.cluster==="linked"?eE(l$,{color:"green",children:["\u2713 Connected to ",i.clusterUrl??"deco"]}):i.cluster==="connecting"?eE(l$,{color:"yellow",children:["\u25CC Connecting to ",i.clusterUrl??"deco","\u2026"]}):eE(l$,{color:"red",children:["\u2717 Disconnected from ",i.clusterUrl??"deco"]})}),$f(u$,{children:i.ingressUrl?eE(l$,{color:"green",children:["\u2713 Serving at ",i.ingressUrl]}):$f(l$,{dimColor:!0,children:"\u25CC Starting local server\u2026"})}),$f(u$,{marginBottom:1,children:$f(l$,{dimColor:!0,children:`${"Computer".padEnd(16)}${i.machine??"this computer"} \xB7 ${t.length} of ${i.cap} previews`})}),t.length===0?$f(l$,{dimColor:!0,children:"No previews running yet."}):eE(u$,{flexDirection:"column",children:[eE(u$,{children:[$f(u$,{width:Q0i.project,flexShrink:0,marginRight:1,children:$f(l$,{dimColor:!0,wrap:"truncate-end",children:"PROJECT"})}),$f(u$,{width:Q0i.status,flexShrink:0,marginRight:1,children:$f(l$,{dimColor:!0,wrap:"truncate-end",children:"STATUS"})}),$f(u$,{flexGrow:1,children:$f(l$,{dimColor:!0,wrap:"truncate-end",children:"PREVIEW URL"})})]}),t.map((u)=>{let l=mNl(u);return eE(u$,{children:[$f(u$,{width:Q0i.project,flexShrink:0,marginRight:1,children:$f(l$,{wrap:"truncate-end",children:u.handle})}),$f(u$,{width:Q0i.status,flexShrink:0,marginRight:1,children:$f(l$,{color:l.color,wrap:"truncate-end",children:l.text})}),$f(u$,{flexGrow:1,children:$f(l$,{dimColor:!0,wrap:"truncate-end",children:u.previewUrl??"\u2014"})})]},u.handle)})]}),i.daemonError?$f(u$,{marginTop:1,children:eE(l$,{color:"red",children:["\u26A0 ",i.daemonError]})}):null,i.logPath?$f(u$,{marginTop:1,children:eE(l$,{dimColor:!0,children:["Logs: ",i.logPath]})}):null]})}var Q0i;var _zt=x(()=>{Iji();Yji();Aji();Q0i={project:18,status:14}});var hzt={};Pi(hzt,{runLinkCommand:()=>nJl});import{closeSync as oNl,mkdirSync as sNl,openSync as pNl,writeSync as iJl}from"fs";import{homedir as tJl}from"os";import{join as gzt}from"path";function uJl(i,t){let u={log:console.log,warn:console.warn,error:console.error},l=(n)=>{if(t===void 0)return;try{iJl(t,`${Bji(n)}
 `)}catch{}};return console.log=(...n)=>l(n),console.warn=(...n)=>l(n),console.error=(...n)=>{l(n),i(Bji(n))},()=>{console.log=u.log,console.warn=u.warn,console.error=u.error}}async function lJl(i,t){let u;try{u=await fetch(`${i}/api/links/me`,{headers:{authorization:`Bearer ${t}`},signal:AbortSignal.timeout(1e4)})}catch{return}if(u.status===401||u.status===403)throw Error(`Authentication rejected by ${i} \u2014 the session token was not accepted. `+`Run \`deco auth login --target ${i}\` and try again.`)}async function nJl(i={}){let t=i.port??5174,u=i.dataDir??process.env.DATA_DIR??process.env.DECOCMS_HOME??gzt(tJl(),"deco"),l=i.clusterBaseUrl??process.env.MESH_CLUSTER_URL??"https://studio.decocms.com",n,f;try{let c=await $li({dataDir:u,intent:"Link",target:l});if(process.env.DECOCMS_LINK_MANAGED!=="1")await lJl(l,c.accessToken);let $;if(i.tui){let{render:g}=await import("ink"),{createElement:h}=await import("react"),{LinkApp:E}=await Promise.resolve().then(() => (_zt(),dzt)),{pushSandboxEvent:v,setCluster:w,setClusterUrl:r,setDaemonError:O,setIngress:y,setLogPath:X,setMachine:N}=await Promise.resolve().then(() => (Aji(),$zt));sNl(u,{recursive:!0});let U=gzt(u,"link.log");f=pNl(U,"w"),X(U),r(l),w("connecting"),$={onEvent:(J)=>v(J),onIngress:(J)=>y(J,`http://127.0.0.1:${J}`),onCluster:(J)=>w(J),onMachine:(J)=>N(J)},n=uJl(O,f),g(h(E),{patchConsole:!1})}else if(i.banner!==!1){let{printBanner:g}=await Promise.resolve().then(() => (jA(),DL));g(i.version??"0.0.0")}let d=process.env.DECOCMS_LINK_MANAGED!=="1";return await(await tzt({port:t,clusterBaseUrl:l,dataDir:u,session:c,monitor:$,logFd:f,perSandboxLogs:d,hotReload:i.hotReload})).stopped}catch(c){return n?.(),console.error(c instanceof Error?c.message:String(c)),1}finally{if(n?.(),f!==void 0)try{oNl(f)}catch{}}}var Ezt=x(()=>{XWi();uzt()});var bji={};Pi(bji,{resolveDevLinkClusterUrl:()=>dJl,populateDevLinkToxiProxy:()=>Ozt,isDevLinkToxiProxyEnabled:()=>$Jl,ensureDevLinkToxiProxy:()=>vJl,buildDevLinkToxiProxyConfig:()=>rzt,DEV_LINK_TOXIPROXY_SERVICE_NAME:()=>wzt,DEV_LINK_TOXIPROXY_PROXY_NAME:()=>xzt});function $Jl(i=process.env){return i.DECO_DEV_LINK_TOXIPROXY==="1"}function jji(i,t){if(!Number.isInteger(i)||i<1||i>65535)throw Error(`${t} must be an integer port in 1..65535`);return i}function rzt(i){let t=new URL(i.serverUrl);if(t.protocol!=="http:")throw Error("DECO_DEV_LINK_TOXIPROXY only supports http local Studio URLs");let u=jji(i.apiPort,"apiPort"),l=jji(i.listenPort,"listenPort");if(t.port.length===0)throw Error("serverUrl must include an explicit valid port");let n=jji(Number.parseInt(t.port,10),"upstreamPort"),f=`http://127.0.0.1:${n}`,c=`http://127.0.0.1:${l}`;return{serviceName:wzt,proxyName:xzt,apiUrl:`http://127.0.0.1:${u}`,listen:`0.0.0.0:${l}`,upstream:`host.docker.internal:${n}`,publicTargetUrl:f,clusterUrl:c,logLine:`[dev-link-toxiproxy] ready: ${c} -> ${f}`}}function dJl(i){return i.toxiproxy?.clusterUrl??i.serverUrl}async function kji(i,t,u){if(i.ok)return;let l=await i.text();throw Error(`ToxiProxy ${t} failed for ${u}: status=${i.status} statusText=${i.statusText} body=${l}`)}function Kji(i){if(i instanceof Error)return i.name==="Error"?i.message:`${i.name}: ${i.message}`;return String(i)}function Dzt(i){if(!(i instanceof Error))return!1;if(i.name==="TimeoutError")return!0;return Dzt(i.cause)}async function Sji(i,t,u,l){try{return await i(u,l)}catch(n){throw Error(`ToxiProxy ${t} failed for ${u}: ${Kji(n)}`,{cause:n})}}async function Ozt(i,t=fetch){let u=`${i.apiUrl}/reset`,l=await Sji(t,"reset",u,{method:"POST"});await kji(l,"reset",u);let n=`${i.apiUrl}/populate`,f=await Sji(t,"populate",n,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify([{name:i.proxyName,listen:i.listen,upstream:i.upstream,enabled:!0}])});await kji(f,"populate",n)}async function _Jl(i,t){let u=`${i.apiUrl}/version`;try{await Z3(async()=>{let l=await Sji(t,"readiness check",u,{method:"GET",signal:AbortSignal.timeout(cJl)});await kji(l,"readiness check",u)},{maxAttempts:fJl,minTimeout:vzt,maxTimeout:vzt,multiplier:1,jitter:0,isRetriable:(l)=>!Dzt(l)})}catch(l){let n=l instanceof T6?l.cause:l;throw Error(`ToxiProxy API did not become ready at ${u}: ${Kji(n)}`,{cause:n})}}async function gJl(i){if(i===null)return"";return await new Response(i).text()}async function zji(i,t={}){let u=["docker",...i].join(" "),l=(()=>{try{return Bun.spawn(["docker",...i],{stdout:"ignore",stderr:"pipe"})}catch($){throw Error(`Docker command failed to start (${u}): ${Kji($)}`,{cause:$})}})(),[n,f]=await Promise.all([l.exited,gJl(l.stderr)]);if(n===0||t.ignoreFailure===!0)return;let c=f.trim().length>0?`: ${f.trim()}`:"";throw Error(`Docker command failed (${u}) with exit ${n}${c}`)}async function hJl(i,t){let u=`deco-dev-link-toxiproxy-${i}`;await zji(["rm","-f",u],{ignoreFailure:!0}),await zji(["run","--rm","-d","--name",u,"-p",`127.0.0.1:${i}:8474`,"-p",`127.0.0.1:${t}:${t}`,"ghcr.io/shopify/toxiproxy:2.12.0","-host=0.0.0.0"])}async function EJl(i,t){let u=`deco-dev-link-toxiproxy-${i}`;await zji(["rm","-f",u],{ignoreFailure:!0})}async function vJl(i){let t=rzt(i),u=i.startDaemon??hJl,l=i.stopDaemon??(i.startDaemon===void 0?EJl:void 0);await u(i.apiPort,i.listenPort);let n=i.fetchImpl??fetch;try{await _Jl(t,n),await Ozt(t,n)}catch(f){if(l!==void 0)try{await l(i.apiPort,i.listenPort)}catch{}throw f}return{config:t,stop:async()=>{if(l!==void 0)await l(i.apiPort,i.listenPort)}}}var wzt="ToxiProxy",xzt="dev_link_studio",fJl=20,vzt=100,cJl=100;var Hji=x(()=>{H1()});var yzt={};Pi(yzt,{migrateBetterAuth:()=>Lji});import{getMigrations as wJl}from"better-auth/db";import{sso as xJl}from"@better-auth/sso";import{organization as rJl}from"@decocms/better-auth/plugins";import{admin as DJl,apiKey as OJl,jwt as yJl,magicLink as XJl,mcp as NJl,openAPI as JJl}from"better-auth/plugins";import{emailOTP as UJl}from"better-auth/plugins/email-otp";async function Lji(i){let u={database:bH(i||Ax()),plugins:[rJl({dynamicAccessControl:{enabled:!0,enableCustomResources:!0}}),DJl(),OJl(),yJl(),JJl(),NJl({loginPage:"/login"}),xJl(),XJl({sendMagicLink:async()=>{}}),UJl({sendVerificationOTP:async()=>{}})]},{toBeAdded:l,toBeCreated:n,runMigrations:f}=await wJl(u);if(!l.length&&!n.length)return"up to date";return await f(),`${n.length+l.length} table(s) migrated`}var Rji=x(()=>{z$()});var Cji={};Pi(Cji,{up:()=>ZJl,down:()=>FJl});import{sql as ME}from"kysely";async function ZJl(i){await i.schema.createTable("connections").addColumn("id","text",(t)=>t.primaryKey()).addColumn("organizationId","text",(t)=>t.notNull().references("organization.id").onDelete("cascade")).addColumn("createdById","text",(t)=>t.notNull().references("user.id").onDelete("cascade")).addColumn("name","text",(t)=>t.notNull()).addColumn("description","text").addColumn("icon","text").addColumn("appName","text").addColumn("appId","text").addColumn("connectionType","text",(t)=>t.notNull()).addColumn("connectionUrl","text",(t)=>t.notNull()).addColumn("connectionToken","text").addColumn("connectionHeaders","text").addColumn("oauthConfig","text").addColumn("metadata","text").addColumn("tools","text").addColumn("bindings","text").addColumn("status","text",(t)=>t.notNull().defaultTo("active")).addColumn("createdAt","text",(t)=>t.notNull().defaultTo(ME`CURRENT_TIMESTAMP`)).addColumn("updatedAt","text",(t)=>t.notNull().defaultTo(ME`CURRENT_TIMESTAMP`)).execute(),await i.schema.createTable("api_keys").addColumn("id","text",(t)=>t.primaryKey()).addColumn("userId","text",(t)=>t.notNull().references("user.id").onDelete("cascade")).addColumn("name","text",(t)=>t.notNull()).addColumn("hashedKey","text",(t)=>t.notNull().unique()).addColumn("permissions","text",(t)=>t.notNull()).addColumn("expiresAt","text").addColumn("remaining","integer").addColumn("metadata","text").addColumn("createdAt","text",(t)=>t.notNull().defaultTo(ME`CURRENT_TIMESTAMP`)).addColumn("updatedAt","text",(t)=>t.notNull().defaultTo(ME`CURRENT_TIMESTAMP`)).execute(),await i.schema.createTable("audit_logs").addColumn("id","text",(t)=>t.primaryKey()).addColumn("organizationId","text").addColumn("userId","text",(t)=>t.references("user.id").onDelete("set null")).addColumn("connectionId","text",(t)=>t.references("connections.id").onDelete("set null")).addColumn("toolName","text",(t)=>t.notNull()).addColumn("allowed","integer",(t)=>t.notNull()).addColumn("duration","integer").addColumn("timestamp","text",(t)=>t.notNull().defaultTo(ME`CURRENT_TIMESTAMP`)).addColumn("requestMetadata","text").execute(),await i.schema.createTable("oauth_clients").addColumn("id","text",(t)=>t.primaryKey()).addColumn("clientId","text",(t)=>t.notNull().unique()).addColumn("clientSecret","text").addColumn("clientName","text",(t)=>t.notNull()).addColumn("redirectUris","text",(t)=>t.notNull()).addColumn("grantTypes","text",(t)=>t.notNull()).addColumn("scope","text").addColumn("clientUri","text").addColumn("logoUri","text").addColumn("createdAt","text",(t)=>t.notNull().defaultTo(ME`CURRENT_TIMESTAMP`)).execute(),await i.schema.createTable("oauth_authorization_codes").addColumn("code","text",(t)=>t.primaryKey()).addColumn("clientId","text",(t)=>t.notNull().references("oauth_clients.clientId").onDelete("cascade")).addColumn("userId","text",(t)=>t.notNull().references("user.id").onDelete("cascade")).addColumn("redirectUri","text",(t)=>t.notNull()).addColumn("scope","text").addColumn("codeChallenge","text").addColumn("codeChallengeMethod","text").addColumn("expiresAt","text",(t)=>t.notNull()).addColumn("createdAt","text",(t)=>t.notNull().defaultTo(ME`CURRENT_TIMESTAMP`)).execute(),await i.schema.createTable("oauth_refresh_tokens").addColumn("token","text",(t)=>t.primaryKey()).addColumn("clientId","text",(t)=>t.notNull().references("oauth_clients.clientId").onDelete("cascade")).addColumn("userId","text",(t)=>t.notNull().references("user.id").onDelete("cascade")).addColumn("scope","text").addColumn("expiresAt","text").addColumn("createdAt","text",(t)=>t.notNull().defaultTo(ME`CURRENT_TIMESTAMP`)).execute(),await i.schema.createTable("downstream_tokens").addColumn("id","text",(t)=>t.primaryKey()).addColumn("connectionId","text",(t)=>t.notNull().references("connections.id").onDelete("cascade")).addColumn("userId","text",(t)=>t.references("user.id").onDelete("cascade")).addColumn("accessToken","text",(t)=>t.notNull()).addColumn("refreshToken","text").addColumn("scope","text").addColumn("expiresAt","text").addColumn("createdAt","text",(t)=>t.notNull().defaultTo(ME`CURRENT_TIMESTAMP`)).addColumn("updatedAt","text",(t)=>t.notNull().defaultTo(ME`CURRENT_TIMESTAMP`)).execute(),await i.schema.createIndex("idx_connections_organizationId").on("connections").column("organizationId").execute(),await i.schema.createIndex("idx_audit_logs_organizationId").on("audit_logs").column("organizationId").execute(),await i.schema.createIndex("idx_audit_logs_userId").on("audit_logs").column("userId").execute(),await i.schema.createIndex("idx_audit_logs_timestamp").on("audit_logs").column("timestamp").execute()}async function FJl(i){await i.schema.dropTable("downstream_tokens").execute(),await i.schema.dropTable("oauth_refresh_tokens").execute(),await i.schema.dropTable("oauth_authorization_codes").execute(),await i.schema.dropTable("oauth_clients").execute(),await i.schema.dropTable("audit_logs").execute(),await i.schema.dropTable("api_keys").execute(),await i.schema.dropTable("connections").execute()}var Xzt=()=>{};var eji={};Pi(eji,{up:()=>TJl,down:()=>QJl});import{sql as Nzt}from"kysely";async function TJl(i){await i.schema.createTable("organization_settings").addColumn("organizationId","text",(t)=>t.primaryKey().references("organization.id").onDelete("cascade")).addColumn("modelsBindingConnectionId","text",(t)=>t.references("connections.id").onDelete("set null")).addColumn("createdAt","text",(t)=>t.notNull().defaultTo(Nzt`CURRENT_TIMESTAMP`)).addColumn("updatedAt","text",(t)=>t.notNull().defaultTo(Nzt`CURRENT_TIMESTAMP`)).execute()}async function QJl(i){await i.schema.dropTable("organization_settings").execute()}var Jzt=()=>{};var Mji={};Pi(Mji,{up:()=>BJl,down:()=>IJl});async function BJl(i){await i.schema.alterTable("connections").renameColumn("name","title").execute(),await i.schema.alterTable("connections").renameColumn("createdById","created_by").execute(),await i.schema.alterTable("connections").renameColumn("createdAt","created_at").execute(),await i.schema.alterTable("connections").renameColumn("updatedAt","updated_at").execute(),await i.schema.alterTable("connections").renameColumn("organizationId","organization_id").execute(),await i.schema.alterTable("connections").renameColumn("connectionType","connection_type").execute(),await i.schema.alterTable("connections").renameColumn("connectionUrl","connection_url").execute(),await i.schema.alterTable("connections").renameColumn("connectionToken","connection_token").execute(),await i.schema.alterTable("connections").renameColumn("connectionHeaders","connection_headers").execute(),await i.schema.alterTable("connections").renameColumn("oauthConfig","oauth_config").execute(),await i.schema.alterTable("connections").renameColumn("appName","app_name").execute(),await i.schema.alterTable("connections").renameColumn("appId","app_id").execute()}async function IJl(i){await i.schema.alterTable("connections").renameColumn("title","name").execute(),await i.schema.alterTable("connections").renameColumn("created_by","createdById").execute(),await i.schema.alterTable("connections").renameColumn("created_at","createdAt").execute(),await i.schema.alterTable("connections").renameColumn("updated_at","updatedAt").execute(),await i.schema.alterTable("connections").renameColumn("organization_id","organizationId").execute(),await i.schema.alterTable("connections").renameColumn("connection_type","connectionType").execute(),await i.schema.alterTable("connections").renameColumn("connection_url","connectionUrl").execute(),await i.schema.alterTable("connections").renameColumn("connection_token","connectionToken").execute(),await i.schema.alterTable("connections").renameColumn("connection_headers","connectionHeaders").execute(),await i.schema.alterTable("connections").renameColumn("oauth_config","oauthConfig").execute(),await i.schema.alterTable("connections").renameColumn("app_name","appName").execute(),await i.schema.alterTable("connections").renameColumn("app_id","appId").execute()}var qji={};Pi(qji,{up:()=>YJl,down:()=>PJl});async function YJl(i){await i.schema.createTable("organization_settings_new").addColumn("organizationId","text",(t)=>t.primaryKey().references("organization.id").onDelete("cascade")).addColumn("createdAt","text",(t)=>t.notNull()).addColumn("updatedAt","text",(t)=>t.notNull()).execute(),await i.insertInto("organization_settings_new").columns(["organizationId","createdAt","updatedAt"]).expression((t)=>t.selectFrom("organization_settings").select(["organizationId","createdAt","updatedAt"])).execute(),await i.schema.dropTable("organization_settings").execute(),await i.schema.alterTable("organization_settings_new").renameTo("organization_settings").execute()}async function PJl(i){await i.schema.createTable("organization_settings_new").addColumn("organizationId","text",(t)=>t.primaryKey().references("organization.id").onDelete("cascade")).addColumn("modelsBindingConnectionId","text",(t)=>t.references("connections.id").onDelete("set null")).addColumn("createdAt","text",(t)=>t.notNull()).addColumn("updatedAt","text",(t)=>t.notNull()).execute(),await i.insertInto("organization_settings_new").columns(["organizationId","modelsBindingConnectionId","createdAt","updatedAt"]).expression((t)=>t.selectFrom("organization_settings").select(["organizationId",t.val(null).as("modelsBindingConnectionId"),"createdAt","updatedAt"])).execute(),await i.schema.dropTable("organization_settings").execute(),await i.schema.alterTable("organization_settings_new").renameTo("organization_settings").execute()}var Vji={};Pi(Vji,{up:()=>GJl,down:()=>WJl});async function GJl(i){await i.schema.alterTable("connections").addColumn("configuration_state","text").execute(),await i.schema.alterTable("connections").addColumn("configuration_scopes","text").execute()}async function WJl(i){await i.schema.alterTable("connections").dropColumn("configuration_state").execute(),await i.schema.alterTable("connections").dropColumn("configuration_scopes").execute()}var mji={};Pi(mji,{up:()=>jJl,down:()=>kJl});import{sql as AJl}from"kysely";async function jJl(i){await i.schema.alterTable("organization_settings").addColumn("sidebar_items",AJl`text`).execute()}async function kJl(i){await i.schema.alterTable("organization_settings").dropColumn("sidebar_items").execute()}var Uzt=()=>{};var aji={};Pi(aji,{up:()=>SJl,down:()=>zJl});async function SJl(i){await i.schema.createTable("monitoring_logs").addColumn("id","text",(t)=>t.primaryKey()).addColumn("organization_id","text",(t)=>t.notNull().references("organization.id").onDelete("cascade")).addColumn("connection_id","text",(t)=>t.notNull().references("connections.id").onDelete("cascade")).addColumn("connection_title","text",(t)=>t.notNull()).addColumn("tool_name","text",(t)=>t.notNull()).addColumn("input","text",(t)=>t.notNull()).addColumn("output","text",(t)=>t.notNull()).addColumn("is_error","integer",(t)=>t.notNull()).addColumn("error_message","text").addColumn("duration_ms","integer",(t)=>t.notNull()).addColumn("timestamp","text",(t)=>t.notNull()).addColumn("user_id","text").addColumn("request_id","text",(t)=>t.notNull()).execute(),await i.schema.createIndex("monitoring_logs_org_timestamp").on("monitoring_logs").columns(["organization_id","timestamp"]).execute(),await i.schema.createIndex("monitoring_logs_connection_timestamp").on("monitoring_logs").columns(["connection_id","timestamp"]).execute(),await i.schema.createIndex("monitoring_logs_is_error").on("monitoring_logs").columns(["organization_id","is_error","timestamp"]).execute()}async function zJl(i){await i.schema.dropIndex("monitoring_logs_is_error").execute(),await i.schema.dropIndex("monitoring_logs_connection_timestamp").execute(),await i.schema.dropIndex("monitoring_logs_org_timestamp").execute(),await i.schema.dropTable("monitoring_logs").execute()}var oji={};Pi(oji,{up:()=>KJl,down:()=>bJl});import{sql as OL}from"kysely";async function KJl(i){await i.schema.createTable("events").addColumn("id","text",(t)=>t.primaryKey()).addColumn("organization_id","text",(t)=>t.notNull().references("organization.id").onDelete("cascade")).addColumn("type","text",(t)=>t.notNull()).addColumn("source","text",(t)=>t.notNull()).addColumn("specversion","text",(t)=>t.notNull().defaultTo("1.0")).addColumn("subject","text").addColumn("time","text",(t)=>t.notNull()).addColumn("datacontenttype","text",(t)=>t.notNull().defaultTo("application/json")).addColumn("dataschema","text").addColumn("data","text").addColumn("cron","varchar(255)").addColumn("status","text",(t)=>t.notNull().defaultTo("pending")).addColumn("attempts","integer",(t)=>t.notNull().defaultTo(0)).addColumn("last_error","text").addColumn("next_retry_at","text").addColumn("created_at","text",(t)=>t.notNull().defaultTo(OL`CURRENT_TIMESTAMP`)).addColumn("updated_at","text",(t)=>t.notNull().defaultTo(OL`CURRENT_TIMESTAMP`)).execute(),await i.schema.createTable("event_subscriptions").addColumn("id","text",(t)=>t.primaryKey()).addColumn("organization_id","text",(t)=>t.notNull().references("organization.id").onDelete("cascade")).addColumn("connection_id","text",(t)=>t.notNull().references("connections.id").onDelete("cascade")).addColumn("publisher","text").addColumn("event_type","text",(t)=>t.notNull()).addColumn("filter","text").addColumn("enabled","integer",(t)=>t.notNull().defaultTo(1)).addColumn("created_at","text",(t)=>t.notNull().defaultTo(OL`CURRENT_TIMESTAMP`)).addColumn("updated_at","text",(t)=>t.notNull().defaultTo(OL`CURRENT_TIMESTAMP`)).execute(),await i.schema.createTable("event_deliveries").addColumn("id","text",(t)=>t.primaryKey()).addColumn("event_id","text",(t)=>t.notNull()).addColumn("subscription_id","text",(t)=>t.notNull().references("event_subscriptions.id").onDelete("cascade")).addColumn("status","text",(t)=>t.notNull().defaultTo("pending")).addColumn("attempts","integer",(t)=>t.notNull().defaultTo(0)).addColumn("last_error","text").addColumn("delivered_at","text").addColumn("next_retry_at","text").addColumn("created_at","text",(t)=>t.notNull().defaultTo(OL`CURRENT_TIMESTAMP`)).execute(),await i.schema.createIndex("idx_events_org_status").on("events").columns(["organization_id","status"]).execute(),await i.schema.createIndex("idx_events_source").on("events").columns(["source"]).execute(),await i.schema.createIndex("idx_events_type").on("events").columns(["type"]).execute(),await i.schema.createIndex("idx_events_retry").on("events").columns(["status","next_retry_at"]).execute(),await i.schema.createIndex("idx_subscriptions_connection").on("event_subscriptions").columns(["connection_id"]).execute(),await i.schema.createIndex("idx_subscriptions_type").on("event_subscriptions").columns(["event_type"]).execute(),await i.schema.createIndex("idx_subscriptions_org_enabled").on("event_subscriptions").columns(["organization_id","enabled"]).execute(),await i.schema.createIndex("idx_subscriptions_unique").on("event_subscriptions").columns(["connection_id","event_type","publisher","filter"]).unique().execute(),await i.schema.createIndex("idx_deliveries_event").on("event_deliveries").columns(["event_id"]).execute(),await i.schema.createIndex("idx_deliveries_subscription_status").on("event_deliveries").columns(["subscription_id","status"]).execute(),await i.schema.createIndex("idx_deliveries_retry").on("event_deliveries").columns(["status","next_retry_at"]).execute()}async function bJl(i){await i.schema.dropIndex("idx_deliveries_retry").execute(),await i.schema.dropIndex("idx_deliveries_subscription_status").execute(),await i.schema.dropIndex("idx_deliveries_event").execute(),await i.schema.dropIndex("idx_subscriptions_unique").execute(),await i.schema.dropIndex("idx_subscriptions_org_enabled").execute(),await i.schema.dropIndex("idx_subscriptions_type").execute(),await i.schema.dropIndex("idx_subscriptions_connection").execute(),await i.schema.dropIndex("idx_events_retry").execute(),await i.schema.dropIndex("idx_events_type").execute(),await i.schema.dropIndex("idx_events_source").execute(),await i.schema.dropIndex("idx_events_org_status").execute(),await i.schema.dropTable("event_deliveries").execute(),await i.schema.dropTable("event_subscriptions").execute(),await i.schema.dropTable("events").execute()}var Zzt=()=>{};var sji={};Pi(sji,{up:()=>LJl,down:()=>RJl});import{sql as HJl}from"kysely";async function LJl(i){await i.schema.dropTable("audit_logs").ifExists().execute()}async function RJl(i){await i.schema.createTable("audit_logs").ifNotExists().addColumn("id","text",(t)=>t.primaryKey()).addColumn("organizationId","text").addColumn("userId","text",(t)=>t.references("user.id").onDelete("set null")).addColumn("connectionId","text",(t)=>t.references("connections.id").onDelete("set null")).addColumn("toolName","text",(t)=>t.notNull()).addColumn("allowed","integer",(t)=>t.notNull()).addColumn("duration","integer").addColumn("timestamp","text",(t)=>t.notNull().defaultTo(HJl`CURRENT_TIMESTAMP`)).addColumn("requestMetadata","text").execute(),await i.schema.createIndex("idx_audit_logs_organizationId").on("audit_logs").column("organizationId").execute(),await i.schema.createIndex("idx_audit_logs_userId").on("audit_logs").column("userId").execute(),await i.schema.createIndex("idx_audit_logs_timestamp").on("audit_logs").column("timestamp").execute()}var Fzt=()=>{};var pji={};Pi(pji,{up:()=>CJl,down:()=>eJl});import{sql as B0i}from"kysely";async function CJl(i){await i.schema.createTable("gateways").addColumn("id","text",(t)=>t.primaryKey()).addColumn("organization_id","text",(t)=>t.notNull().references("organization.id").onDelete("cascade")).addColumn("title","text",(t)=>t.notNull()).addColumn("description","text").addColumn("tool_selection_strategy","text").addColumn("status","text",(t)=>t.notNull().defaultTo("active")).addColumn("is_default","integer",(t)=>t.notNull().defaultTo(0)).addColumn("created_at","text",(t)=>t.notNull().defaultTo(B0i`CURRENT_TIMESTAMP`)).addColumn("updated_at","text",(t)=>t.notNull().defaultTo(B0i`CURRENT_TIMESTAMP`)).addColumn("created_by","text",(t)=>t.notNull().references("user.id").onDelete("cascade")).addColumn("updated_by","text").execute(),await i.schema.createTable("gateway_connections").addColumn("id","text",(t)=>t.primaryKey()).addColumn("gateway_id","text",(t)=>t.notNull().references("gateways.id").onDelete("cascade")).addColumn("connection_id","text",(t)=>t.notNull().references("connections.id").onDelete("cascade")).addColumn("selected_tools","text").addColumn("created_at","text",(t)=>t.notNull().defaultTo(B0i`CURRENT_TIMESTAMP`)).execute(),await i.schema.createIndex("idx_gateways_org").on("gateways").columns(["organization_id"]).execute(),await i.schema.createIndex("idx_gateways_org_status").on("gateways").columns(["organization_id","status"]).execute(),await B0i`CREATE UNIQUE INDEX idx_gateways_default_per_org ON gateways (organization_id) WHERE is_default = 1`.execute(i),await i.schema.createIndex("idx_gateway_connections_gateway").on("gateway_connections").columns(["gateway_id"]).execute(),await i.schema.createIndex("idx_gateway_connections_connection").on("gateway_connections").columns(["connection_id"]).execute(),await i.schema.createIndex("idx_gateway_connections_unique").on("gateway_connections").columns(["gateway_id","connection_id"]).unique().execute()}async function eJl(i){await i.schema.dropIndex("idx_gateway_connections_unique").execute(),await i.schema.dropIndex("idx_gateway_connections_connection").execute(),await i.schema.dropIndex("idx_gateway_connections_gateway").execute(),await i.schema.dropIndex("idx_gateways_default_per_org").execute(),await i.schema.dropIndex("idx_gateways_org_status").execute(),await i.schema.dropIndex("idx_gateways_org").execute(),await i.schema.dropTable("gateway_connections").execute(),await i.schema.dropTable("gateways").execute()}var Tzt=()=>{};var iki={};Pi(iki,{up:()=>MJl,down:()=>qJl});async function MJl(i){await i.schema.alterTable("gateways").addColumn("icon","text").execute()}async function qJl(i){await i.schema.alterTable("gateways").dropColumn("icon").execute()}var tki={};Pi(tki,{up:()=>VJl,down:()=>mJl});import{sql as I0i}from"kysely";async function VJl(i){await i.schema.alterTable("gateways").addColumn("tool_selection_mode","text",(t)=>t.notNull().defaultTo("inclusion")).execute(),await I0i`
     UPDATE gateways
     SET tool_selection_mode = CASE
@@ -107865,7 +107865,7 @@ Hint: Configure a valid Google account email in Monitor Configuration > Contexto
 `);let l=t.pax;if(l)for(let n in l)u+=eut(" "+n+"="+l[n]+`
 `);return a0.from(u)};hU0.decodePax=function(t){let u={};while(t.length){let l=0;while(l<t.length&&t[l]!==32)l++;let n=parseInt(a0.toString(t.subarray(0,l)),10);if(!n)return u;let f=a0.toString(t.subarray(l+1,n-1)),c=f.indexOf("=");if(c===-1)return u;u[f.slice(0,c)]=f.slice(c+1),t=t.subarray(n)}return u};hU0.encode=function(t){let u=a0.alloc(512),l=t.name,n="";if(t.typeflag===5&&l[l.length-1]!=="/")l+="/";if(a0.byteLength(l)!==l.length)return null;while(a0.byteLength(l)>100){let f=l.indexOf("/");if(f===-1)return null;n+=n?"/"+l.slice(0,f):l.slice(0,f),l=l.slice(f+1)}if(a0.byteLength(l)>100||a0.byteLength(n)>155)return null;if(t.linkname&&a0.byteLength(t.linkname)>100)return null;if(a0.write(u,l),a0.write(u,hD(t.mode&4095,6),100),a0.write(u,hD(t.uid,6),108),a0.write(u,hD(t.gid,6),116),_U0(t.size,u,124),a0.write(u,hD(t.mtime.getTime()/1000|0,11),136),u[156]=48+$U0(t.type),t.linkname)a0.write(u,t.linkname,157);if(a0.copy(QUu,u,257),a0.copy(iU0,u,263),t.uname)a0.write(u,t.uname,265);if(t.gname)a0.write(u,t.gname,297);if(a0.write(u,hD(t.devmajor||0,6),329),a0.write(u,hD(t.devminor||0,6),337),n)a0.write(u,n,345);return a0.write(u,hD(IUu(u),6),148),u};hU0.decode=function(t,u,l){let n=t[156]===0?0:t[156]-48,f=Cz(t,0,100,u),c=gD(t,100,8),$=gD(t,108,8),d=gD(t,116,8),_=gD(t,124,12),g=gD(t,136,12),h=cU0(n),E=t[157]===0?null:Cz(t,157,100,u),v=Cz(t,265,32),w=Cz(t,297,32),r=gD(t,329,8),O=gD(t,337,8),y=IUu(t);if(y===256)return null;if(y!==gD(t,148,8))throw Error("Invalid tar header. Maybe the tar is corrupted or it needs to be gunzipped?");if(lU0(t)){if(t[345])f=Cz(t,345,155,u)+"/"+f}else if(nU0(t));else if(!l)throw Error("Invalid tar header: unknown format.");if(n===0&&f&&f[f.length-1]==="/")n=5;return{name:f,mode:c,uid:$,gid:d,size:_,mtime:new Date(1000*g),type:h,linkname:E,uname:v,gname:w,devmajor:r,devminor:O,pax:null}};function lU0(i){return a0.equals(QUu,i.subarray(257,263))}function nU0(i){return a0.equals(tU0,i.subarray(257,263))&&a0.equals(uU0,i.subarray(263,265))}function fU0(i,t,u){if(typeof i!=="number")return u;if(i=~~i,i>=t)return t;if(i>=0)return i;if(i+=t,i>=0)return i;return 0}function cU0(i){switch(i){case 0:return"file";case 1:return"link";case 2:return"symlink";case 3:return"character-device";case 4:return"block-device";case 5:return"directory";case 6:return"fifo";case 7:return"contiguous-file";case 72:return"pax-header";case 55:return"pax-global-header";case 27:return"gnu-long-link-path";case 28:case 30:return"gnu-long-path"}return null}function $U0(i){switch(i){case"file":return 0;case"link":return 1;case"symlink":return 2;case"character-device":return 3;case"block-device":return 4;case"directory":return 5;case"fifo":return 6;case"contiguous-file":return 7;case"pax-header":return 72}return 0}function BUu(i,t,u,l){for(;u<l;u++)if(i[u]===t)return u;return l}function IUu(i){let t=256;for(let u=0;u<148;u++)t+=i[u];for(let u=156;u<512;u++)t+=i[u];return t}function hD(i,t){if(i=i.toString(8),i.length>t)return"7777777777777777777".slice(0,t)+" ";return"0000000000000000000".slice(0,t-i.length)+i+" "}function dU0(i,t,u){t[u]=128;for(let l=11;l>0;l--)t[u+l]=i&255,i=Math.floor(i/256)}function _U0(i,t,u){if(i.toString(8).length>11)dU0(i,t,u);else a0.write(t,hD(i,11),u)}function gU0(i){let t;if(i[0]===128)t=!0;else if(i[0]===255)t=!1;else return null;let u=[],l;for(l=i.length-1;l>0;l--){let c=i[l];if(t)u.push(c);else u.push(255-c)}let n=0,f=u.length;for(l=0;l<f;l++)n+=u[l]*Math.pow(256,l);return t?n:-1*n}function gD(i,t,u){if(i=i.subarray(t,t+u),t=0,i[t]&128)return gU0(i);else{while(t<i.length&&i[t]===32)t++;let l=fU0(BUu(i,32,t,i.length),i.length,i.length);while(t<l&&i[t]===0)t++;if(l===t)return 0;return parseInt(a0.toString(i.subarray(t,l)),8)}}function Cz(i,t,u,l){return a0.toString(i.subarray(t,BUu(i,0,t,t+u)),l)}function eut(i){let t=a0.byteLength(i),u=Math.floor(Math.log(t)/Math.log(10))+1;if(t+u>=Math.pow(10,u))u++;return t+u+i}});var SUu=A((RZf,kUu)=>{var{Writable:DU0,Readable:OU0,getStreamError:YUu}=Cut(),yU0=zut(),PUu=Rz(),ez=Mut(),XU0=PUu.alloc(0);class GUu{constructor(){this.buffered=0,this.shifted=0,this.queue=new yU0,this._offset=0}push(i){this.buffered+=i.byteLength,this.queue.push(i)}shiftFirst(i){return this._buffered===0?null:this._next(i)}shift(i){if(i>this.buffered)return null;if(i===0)return XU0;let t=this._next(i);if(i===t.byteLength)return t;let u=[t];while((i-=t.byteLength)>0)t=this._next(i),u.push(t);return PUu.concat(u)}_next(i){let t=this.queue.peek(),u=t.byteLength-this._offset;if(i>=u){let l=this._offset?t.subarray(this._offset,t.byteLength):t;return this.queue.shift(),this._offset=0,this.buffered-=u,this.shifted+=u,l}return this.buffered-=i,this.shifted+=i,t.subarray(this._offset,this._offset+=i)}}class WUu extends OU0{constructor(i,t,u){super();this.header=t,this.offset=u,this._parent=i}_read(i){if(this.header.size===0)this.push(null);if(this._parent._stream===this)this._parent._update();i(null)}_predestroy(){this._parent.destroy(YUu(this))}_detach(){if(this._parent._stream===this)this._parent._stream=null,this._parent._missing=jUu(this.header.size),this._parent._update()}_destroy(i){this._detach(),i(null)}}class AUu extends DU0{constructor(i){super(i);if(!i)i={};this._buffer=new GUu,this._offset=0,this._header=null,this._stream=null,this._missing=0,this._longHeader=!1,this._callback=qut,this._locked=!1,this._finished=!1,this._pax=null,this._paxGlobal=null,this._gnuLongPath=null,this._gnuLongLinkPath=null,this._filenameEncoding=i.filenameEncoding||"utf-8",this._allowUnknownFormat=!!i.allowUnknownFormat,this._unlockBound=this._unlock.bind(this)}_unlock(i){if(this._locked=!1,i){this.destroy(i),this._continueWrite(i);return}this._update()}_consumeHeader(){if(this._locked)return!1;this._offset=this._buffer.shifted;try{this._header=ez.decode(this._buffer.shift(512),this._filenameEncoding,this._allowUnknownFormat)}catch(i){return this._continueWrite(i),!1}if(!this._header)return!0;switch(this._header.type){case"gnu-long-path":case"gnu-long-link-path":case"pax-global-header":case"pax-header":return this._longHeader=!0,this._missing=this._header.size,!0}if(this._locked=!0,this._applyLongHeaders(),this._header.size===0||this._header.type==="directory")return this.emit("entry",this._header,this._createStream(),this._unlockBound),!0;return this._stream=this._createStream(),this._missing=this._header.size,this.emit("entry",this._header,this._stream,this._unlockBound),!0}_applyLongHeaders(){if(this._gnuLongPath)this._header.name=this._gnuLongPath,this._gnuLongPath=null;if(this._gnuLongLinkPath)this._header.linkname=this._gnuLongLinkPath,this._gnuLongLinkPath=null;if(this._pax){if(this._pax.path)this._header.name=this._pax.path;if(this._pax.linkpath)this._header.linkname=this._pax.linkpath;if(this._pax.size)this._header.size=parseInt(this._pax.size,10);this._header.pax=this._pax,this._pax=null}}_decodeLongHeader(i){switch(this._header.type){case"gnu-long-path":this._gnuLongPath=ez.decodeLongPath(i,this._filenameEncoding);break;case"gnu-long-link-path":this._gnuLongLinkPath=ez.decodeLongPath(i,this._filenameEncoding);break;case"pax-global-header":this._paxGlobal=ez.decodePax(i);break;case"pax-header":this._pax=this._paxGlobal===null?ez.decodePax(i):Object.assign({},this._paxGlobal,ez.decodePax(i));break}}_consumeLongHeader(){this._longHeader=!1,this._missing=jUu(this._header.size);let i=this._buffer.shift(this._header.size);try{this._decodeLongHeader(i)}catch(t){return this._continueWrite(t),!1}return!0}_consumeStream(){let i=this._buffer.shiftFirst(this._missing);if(i===null)return!1;this._missing-=i.byteLength;let t=this._stream.push(i);if(this._missing===0){if(this._stream.push(null),t)this._stream._detach();return t&&this._locked===!1}return t}_createStream(){return new WUu(this,this._header,this._offset)}_update(){while(this._buffer.buffered>0&&!this.destroying){if(this._missing>0){if(this._stream!==null){if(this._consumeStream()===!1)return;continue}if(this._longHeader===!0){if(this._missing>this._buffer.buffered)break;if(this._consumeLongHeader()===!1)return!1;continue}let i=this._buffer.shiftFirst(this._missing);if(i!==null)this._missing-=i.byteLength;continue}if(this._buffer.buffered<512)break;if(this._stream!==null||this._consumeHeader()===!1)return}this._continueWrite(null)}_continueWrite(i){let t=this._callback;this._callback=qut,t(i)}_write(i,t){this._callback=t,this._buffer.push(i),this._update()}_final(i){this._finished=this._missing===0&&this._buffer.buffered===0,i(this._finished?null:Error("Unexpected end of data"))}_predestroy(){this._continueWrite(null)}_destroy(i){if(this._stream)this._stream.destroy(YUu(this));i(null)}[Symbol.asyncIterator](){let i=null,t=null,u=null,l=null,n=null,f=this;return this.on("entry",d),this.on("error",(h)=>{i=h}),this.on("close",_),{[Symbol.asyncIterator](){return this},next(){return new Promise($)},return(){return g(null)},throw(h){return g(h)}};function c(h){if(!n)return;let E=n;n=null,E(h)}function $(h,E){if(i)return E(i);if(l){h({value:l,done:!1}),l=null;return}if(t=h,u=E,c(null),f._finished&&t)t({value:void 0,done:!0}),t=u=null}function d(h,E,v){if(n=v,E.on("error",qut),t)t({value:E,done:!1}),t=u=null;else l=E}function _(){if(c(i),!t)return;if(i)u(i);else t({value:void 0,done:!0});t=u=null}function g(h){return f.destroy(h),c(h),new Promise((E,v)=>{if(f.destroyed)return E({value:void 0,done:!0});f.once("close",function(){if(h)v(h);else E({value:void 0,done:!0})})})}}}kUu.exports=function(t){return new AUu(t)};function qut(){}function jUu(i){return i&=511,i&&512-i}});var KUu=A((CZf,Vut)=>{var zUu={S_IFMT:61440,S_IFDIR:16384,S_IFCHR:8192,S_IFBLK:24576,S_IFIFO:4096,S_IFLNK:40960};try{Vut.exports=xi("fs").constants||zUu}catch{Vut.exports=zUu}});var MUu=A((eZf,eUu)=>{var{Readable:NU0,Writable:JU0,getStreamError:bUu}=Cut(),VP=Rz(),Mz=KUu(),Y7i=Mut(),HUu=VP.alloc(1024);class LUu extends JU0{constructor(i,t,u){super({mapWritable:ZU0,eagerOpen:!0});if(this.written=0,this.header=t,this._callback=u,this._linkname=null,this._isLinkname=t.type==="symlink"&&!t.linkname,this._isVoid=t.type!=="file"&&t.type!=="contiguous-file",this._finished=!1,this._pack=i,this._openCallback=null,this._pack._stream===null)this._pack._stream=this;else this._pack._pending.push(this)}_open(i){if(this._openCallback=i,this._pack._stream===this)this._continueOpen()}_continuePack(i){if(this._callback===null)return;let t=this._callback;this._callback=null,t(i)}_continueOpen(){if(this._pack._stream===null)this._pack._stream=this;let i=this._openCallback;if(this._openCallback=null,i===null)return;if(this._pack.destroying)return i(Error("pack stream destroyed"));if(this._pack._finalized)return i(Error("pack stream is already finalized"));if(this._pack._stream=this,!this._isLinkname)this._pack._encode(this.header);if(this._isVoid)this._finish(),this._continuePack(null);i(null)}_write(i,t){if(this._isLinkname)return this._linkname=this._linkname?VP.concat([this._linkname,i]):i,t(null);if(this._isVoid){if(i.byteLength>0)return t(Error("No body allowed for this entry"));return t()}if(this.written+=i.byteLength,this._pack.push(i))return t();this._pack._drain=t}_finish(){if(this._finished)return;if(this._finished=!0,this._isLinkname)this.header.linkname=this._linkname?VP.toString(this._linkname,"utf-8"):"",this._pack._encode(this.header);CUu(this._pack,this.header.size),this._pack._done(this)}_final(i){if(this.written!==this.header.size)return i(Error("Size mismatch"));this._finish(),i(null)}_getError(){return bUu(this)||Error("tar entry destroyed")}_predestroy(){this._pack.destroy(this._getError())}_destroy(i){this._pack._done(this),this._continuePack(this._finished?null:this._getError()),i()}}class RUu extends NU0{constructor(i){super(i);this._drain=mut,this._finalized=!1,this._finalizing=!1,this._pending=[],this._stream=null}entry(i,t,u){if(this._finalized||this.destroying)throw Error("already finalized or destroyed");if(typeof t==="function")u=t,t=null;if(!u)u=mut;if(!i.size||i.type==="symlink")i.size=0;if(!i.type)i.type=UU0(i.mode);if(!i.mode)i.mode=i.type==="directory"?493:420;if(!i.uid)i.uid=0;if(!i.gid)i.gid=0;if(!i.mtime)i.mtime=new Date;if(typeof t==="string")t=VP.from(t);let l=new LUu(this,i,u);if(VP.isBuffer(t))return i.size=t.byteLength,l.write(t),l.end(),l;if(l._isVoid)return l;return l}finalize(){if(this._stream||this._pending.length>0){this._finalizing=!0;return}if(this._finalized)return;this._finalized=!0,this.push(HUu),this.push(null)}_done(i){if(i!==this._stream)return;if(this._stream=null,this._finalizing)this.finalize();if(this._pending.length)this._pending.shift()._continueOpen()}_encode(i){if(!i.pax){let t=Y7i.encode(i);if(t){this.push(t);return}}this._encodePax(i)}_encodePax(i){let t=Y7i.encodePax({name:i.name,linkname:i.linkname,pax:i.pax}),u={name:"PaxHeader",mode:i.mode,uid:i.uid,gid:i.gid,size:t.byteLength,mtime:i.mtime,type:"pax-header",linkname:i.linkname&&"PaxHeader",uname:i.uname,gname:i.gname,devmajor:i.devmajor,devminor:i.devminor};this.push(Y7i.encode(u)),this.push(t),CUu(this,t.byteLength),u.size=i.size,u.type=i.type,this.push(Y7i.encode(u))}_doDrain(){let i=this._drain;this._drain=mut,i()}_predestroy(){let i=bUu(this);if(this._stream)this._stream.destroy(i);while(this._pending.length){let t=this._pending.shift();t.destroy(i),t._continueOpen()}this._doDrain()}_read(i){this._doDrain(),i()}}eUu.exports=function(t){return new RUu(t)};function UU0(i){switch(i&Mz.S_IFMT){case Mz.S_IFBLK:return"block-device";case Mz.S_IFCHR:return"character-device";case Mz.S_IFDIR:return"directory";case Mz.S_IFIFO:return"fifo";case Mz.S_IFLNK:return"symlink"}return"file"}function mut(){}function CUu(i,t){if(t&=511,t)i.push(HUu.subarray(0,512-t))}function ZU0(i){return VP.isBuffer(i)?i:VP.from(i)}});var qUu=A((FU0)=>{FU0.extract=SUu();FU0.pack=MUu()});var aUu=A((qZf,mUu)=>{mUu.exports=VUu;function VUu(i,t){if(i&&t)return VUu(i)(t);if(typeof i!=="function")throw TypeError("need wrapper function");return Object.keys(i).forEach(function(l){u[l]=i[l]}),u;function u(){var l=Array(arguments.length);for(var n=0;n<l.length;n++)l[n]=arguments[n];var f=i.apply(this,l),c=l[l.length-1];if(typeof f==="function"&&f!==c)Object.keys(c).forEach(function($){f[$]=c[$]});return f}}});var out=A((VZf,aut)=>{var oUu=aUu();aut.exports=oUu(P7i);aut.exports.strict=oUu(sUu);P7i.proto=P7i(function(){Object.defineProperty(Function.prototype,"once",{value:function(){return P7i(this)},configurable:!0}),Object.defineProperty(Function.prototype,"onceStrict",{value:function(){return sUu(this)},configurable:!0})});function P7i(i){var t=function(){if(t.called)return t.value;return t.called=!0,t.value=i.apply(this,arguments)};return t.called=!1,t}function sUu(i){var t=function(){if(t.called)throw Error(t.onceError);return t.called=!0,t.value=i.apply(this,arguments)},u=i.name||"Function wrapped with `once`";return t.onceError=u+" shouldn't be called more than once",t.called=!1,t}});var tZu=A((mZf,iZu)=>{var BU0=out(),IU0=function(){},YU0=global.Bare?queueMicrotask:process.nextTick.bind(process),PU0=function(i){return i.setHeader&&typeof i.abort==="function"},GU0=function(i){return i.stdio&&Array.isArray(i.stdio)&&i.stdio.length===3},pUu=function(i,t,u){if(typeof t==="function")return pUu(i,null,t);if(!t)t={};u=BU0(u||IU0);var{_writableState:l,_readableState:n}=i,f=t.readable||t.readable!==!1&&i.readable,c=t.writable||t.writable!==!1&&i.writable,$=!1,d=function(){if(!i.writable)_()},_=function(){if(c=!1,!f)u.call(i)},g=function(){if(f=!1,!c)u.call(i)},h=function(O){u.call(i,O?Error("exited with error code: "+O):null)},E=function(O){u.call(i,O)},v=function(){YU0(w)},w=function(){if($)return;if(f&&!(n&&(n.ended&&!n.destroyed)))return u.call(i,Error("premature close"));if(c&&!(l&&(l.ended&&!l.destroyed)))return u.call(i,Error("premature close"))},r=function(){i.req.on("finish",_)};if(PU0(i))if(i.on("complete",_),i.on("abort",v),i.req)r();else i.on("request",r);else if(c&&!l)i.on("end",d),i.on("close",d);if(GU0(i))i.on("exit",h);if(i.on("end",g),i.on("finish",_),t.error!==!1)i.on("error",E);return i.on("close",v),function(){if($=!0,i.removeListener("complete",_),i.removeListener("abort",v),i.removeListener("request",r),i.req)i.req.removeListener("finish",_);i.removeListener("end",d),i.removeListener("close",d),i.removeListener("finish",_),i.removeListener("exit",h),i.removeListener("end",g),i.removeListener("error",E),i.removeListener("close",v)}};iZu.exports=pUu});var nZu=A((aZf,lZu)=>{var WU0=out(),AU0=tZu(),G7i;try{G7i=xi("fs")}catch(i){}var rm=function(){},jU0=typeof process>"u"?!1:/^v?\.0/.test(process.version),W7i=function(i){return typeof i==="function"},kU0=function(i){if(!jU0)return!1;if(!G7i)return!1;return(i instanceof(G7i.ReadStream||rm)||i instanceof(G7i.WriteStream||rm))&&W7i(i.close)},SU0=function(i){return i.setHeader&&W7i(i.abort)},zU0=function(i,t,u,l){l=WU0(l);var n=!1;i.on("close",function(){n=!0}),AU0(i,{readable:t,writable:u},function(c){if(c)return l(c);n=!0,l()});var f=!1;return function(c){if(n)return;if(f)return;if(f=!0,kU0(i))return i.close(rm);if(SU0(i))return i.abort();if(W7i(i.destroy))return i.destroy();l(c||Error("stream was destroyed"))}},uZu=function(i){i()},KU0=function(i,t){return i.pipe(t)},bU0=function(){var i=Array.prototype.slice.call(arguments),t=W7i(i[i.length-1]||rm)&&i.pop()||rm;if(Array.isArray(i[0]))i=i[0];if(i.length<2)throw Error("pump requires two streams per minimum");var u,l=i.map(function(n,f){var c=f<i.length-1,$=f>0;return zU0(n,c,$,function(d){if(!u)u=d;if(d)l.forEach(uZu);if(c)return;l.forEach(uZu),t(u)})});return i.reduce(KU0)};lZu.exports=bU0});var vZu=A((CU0)=>{var fZu=qUu(),cZu=nZu(),$Zu=xi("fs"),Yf=xi("path"),Dm=(global.Bare?global.Bare.platform:process.platform)==="win32";CU0.pack=function(t,u){if(!t)t=".";if(!u)u={};let l=u.fs||$Zu,n=u.ignore||u.filter||Om,f=u.mapStream||hZu,c=RU0(l,u.dereference?l.stat:l.lstat,t,n,u.entries,u.sort),$=u.strict!==!1,d=typeof u.umask==="number"?~u.umask:~dZu(),_=u.pack||fZu.pack(),g=u.finish||Om,h=u.map||Om,E=typeof u.dmode==="number"?u.dmode:0,v=typeof u.fmode==="number"?u.fmode:0;if(u.strip)h=EZu(h,u.strip);if(u.readable)E|=parseInt(555,8),v|=parseInt(444,8);if(u.writable)E|=parseInt(333,8),v|=parseInt(222,8);O();function w(y,X){l.readlink(Yf.join(t,y),function(N,U){if(N)return _.destroy(N);X.linkname=sut(U),_.entry(X,O)})}function r(y,X,N){if(_.destroyed)return;if(y)return _.destroy(y);if(!X){if(u.finalize!==!1)_.finalize();return g(_)}if(N.isSocket())return O();let U={name:sut(X),mode:(N.mode|(N.isDirectory()?E:v))&d,mtime:N.mtime,size:N.size,type:"file",uid:N.uid,gid:N.gid};if(N.isDirectory())return U.size=0,U.type="directory",U=h(U)||U,_.entry(U,O);if(N.isSymbolicLink())return U.size=0,U.type="symlink",U=h(U)||U,w(X,U);if(U=h(U)||U,!N.isFile()){if($)return _.destroy(Error("unsupported type for "+X));return O()}let J=_.entry(U,O),F=f(l.createReadStream(Yf.join(t,X),{start:0,end:U.size>0?U.size-1:U.size}),U);F.on("error",function(I){J.destroy(I)}),cZu(F,J)}function O(y){if(y)return _.destroy(y);c(r)}return _};function HU0(i){return i.length?i[i.length-1]:null}function LU0(){return!global.Bare&&process.getuid?process.getuid():-1}function dZu(){return!global.Bare&&process.umask?process.umask():0}CU0.extract=function(t,u){if(!t)t=".";if(!u)u={};t=Yf.resolve(t);let l=u.fs||$Zu,n=u.ignore||u.filter||Om,f=u.mapStream||hZu,c=u.chown!==!1&&!Dm&&LU0()===0,$=u.extract||fZu.extract(),d=[],_=new Date,g=typeof u.umask==="number"?~u.umask:~dZu(),h=u.strict!==!1,E=u.validateSymlinks!==!1,v=u.map||Om,w=typeof u.dmode==="number"?u.dmode:0,r=typeof u.fmode==="number"?u.fmode:0;if(u.strip)v=EZu(v,u.strip);if(u.readable)w|=parseInt(555,8),r|=parseInt(444,8);if(u.writable)w|=parseInt(333,8),r|=parseInt(222,8);if($.on("entry",O),u.finish)$.on("finish",u.finish);return $;function O(J,F,I){J=v(J)||J,J.name=sut(J.name);let B=Yf.join(t,Yf.join("/",J.name));if(n(B,J))return F.resume(),I();let P=Yf.join(B,".")===Yf.join(t,".")?t:Yf.dirname(B);gZu(l,P,Yf.join(t,"."),function(M,p){if(M)return I(M);if(!p)return I(Error(P+" is not a valid path"));if(J.type==="directory")return d.push([B,J.mtime]),U(B,{fs:l,own:c,uid:J.uid,gid:J.gid,mode:J.mode},L);U(P,{fs:l,own:c,uid:J.uid,gid:J.gid,mode:493},function(s){if(s)return I(s);switch(J.type){case"file":return S();case"link":return j();case"symlink":return k()}if(h)return I(Error("unsupported type for "+B+" ("+J.type+")"));F.resume(),I()})});function L(M){if(M)return I(M);X(B,J,function(p){if(p)return I(p);if(Dm)return I();N(B,J,I)})}function k(){if(Dm)return I();l.unlink(B,function(){let M=Yf.resolve(Yf.dirname(B),J.linkname);if(!a(M)&&E)return I(Error(B+" is not a valid symlink"));_Zu(l,M,Yf.join(t,"."),function(p,s){if(p)return I(p);if(!s&&E)return I(Error(B+" is not a valid symlink"));l.symlink(J.linkname,B,L)})})}function j(){if(Dm)return I();l.unlink(B,function(){let M=Yf.join(t,Yf.join("/",J.linkname));l.realpath(M,function(p,s){if(p||!a(s))return I(Error(B+" is not a valid hardlink"));l.link(s,B,function($i){if($i&&$i.code==="EPERM"&&u.hardlinkAsFilesFallback)return F=l.createReadStream(s),S();L($i)})})})}function a(M){return M===t||M.startsWith(t+Yf.sep)}function S(){let M=l.createWriteStream(B),p=f(F,J);M.on("error",function(s){p.destroy(s)}),cZu(p,M,function(s){if(s)return I(s);M.on("close",L)})}}function y(J,F){let I;while((I=HU0(d))&&J.slice(0,I[0].length)!==I[0])d.pop();if(!I)return F();l.utimes(I[0],_,I[1],F)}function X(J,F,I){if(u.utimes===!1)return I();if(F.type==="directory")return l.utimes(J,_,F.mtime,I);if(F.type==="symlink")return y(J,I);l.utimes(J,_,F.mtime,function(B){if(B)return I(B);y(J,I)})}function N(J,F,I){let B=F.type==="symlink",P=B?l.lchmod:l.chmod,L=B?l.lchown:l.chown;if(!P)return I();let k=(F.mode|(F.type==="directory"?w:r))&g;if(L&&c)L.call(l,J,F.uid,F.gid,j);else j(null);function j(a){if(a)return I(a);if(!P)return I();P.call(l,J,k,I)}}function U(J,F,I){l.stat(J,function(B){if(!B)return I(null);if(B.code!=="ENOENT")return I(B);l.mkdir(J,{mode:F.mode,recursive:!0},function(P,L){if(P)return I(P);N(J,F,I)})})}};function _Zu(i,t,u,l){if(t===u)return l(null,!0);if(!t.startsWith(u+Yf.sep))return l(null,!1);i.lstat(t,function(n,f){if(n&&n.code!=="ENOENT"&&n.code!=="EPERM")return l(n);if(n||!f.isSymbolicLink())return _Zu(i,Yf.join(t,".."),u,l);l(null,!1)})}function gZu(i,t,u,l){if(t===u)return l(null,!0);i.lstat(t,function(n,f){if(n&&n.code!=="ENOENT"&&n.code!=="EPERM")return l(n);if(n||f.isDirectory())return gZu(i,Yf.join(t,".."),u,l);l(null,!1)})}function Om(){}function hZu(i){return i}function sut(i){return Dm?i.replace(/\\/g,"/").replace(/[:?<>|]/g,"_"):i}function RU0(i,t,u,l,n,f){if(!n)n=["."];let c=n.slice(0);return function(d){if(!c.length)return d(null);let _=c.shift(),g=Yf.join(u,_);t.call(i,g,function(h,E){if(h)return d(n.indexOf(_)===-1&&h.code==="ENOENT"?null:h);if(!E.isDirectory())return d(null,_,E);i.readdir(g,function(v,w){if(v)return d(v);if(f)w.sort();for(let r=0;r<w.length;r++)if(!l(Yf.join(u,_,w[r])))c.push(Yf.join(_,w[r]));d(null,_,E)})})}}function EZu(i,t){return function(u){u.name=u.name.split("/").slice(t).join("/");let l=u.linkname;if(l&&(u.type==="link"||Yf.isAbsolute(l)))u.linkname=l.split("/").slice(t).join("/");return i(u)}}});var qU0,VU0;var wZu=x(()=>{kut();qU0=z(tUu(),1),VU0=z(vZu(),1)});var A7i=()=>{};var xZu=x(()=>{VOi()});var rZu=x(()=>{N7i();X7i();A7i()});var DZu=()=>{};var OZu=()=>{};var put=x(()=>{kJu();Aut();N7i();HJu();Gut();kut();LJu();RJu();CJu();eJu();Wut();MJu();wZu();A7i();xZu();rZu();DZu();OZu();A7i()});var mf,hc,mP,ym;var Xm=x(()=>{mf={CLAIM_API_GROUP:"extensions.agents.x-k8s.io",CLAIM_API_VERSION:"v1alpha1",CLAIM_PLURAL:"sandboxclaims",SANDBOX_API_GROUP:"agents.x-k8s.io",SANDBOX_API_VERSION:"v1alpha1",SANDBOX_PLURAL:"sandboxes",POD_NAME_ANNOTATION:"agents.x-k8s.io/pod-name"};hc=class hc extends Error{cause;constructor(i,t){super(i);if(this.name="SandboxError",this.cause=t,t instanceof Error&&t.stack)this.stack=`${this.stack}
 Caused by: ${t.stack}`}};mP=class mP extends hc{constructor(i,t){super(i,t);this.name="SandboxTimeoutError"}};ym=class ym extends hc{constructor(i,t){super(i,t);this.name="SandboxAlreadyExistsError"}}});async function mU0(i){let t=i.getCurrentCluster();if(!t)throw new hc("No active cluster in kubeconfig");let u={};await i.applyToHTTPSOptions(u);let l={},n=u.headers??{};for(let[f,c]of Object.entries(n))if(Array.isArray(c))l[f]=c.join(", ");else if(c!==void 0)l[f]=String(c);if(typeof u.auth==="string"&&!l.Authorization)l.Authorization=`Basic ${Buffer.from(u.auth).toString("base64")}`;return{server:t.server.replace(/\/+$/,""),headers:l,tls:{cert:ilt(u.cert),key:ilt(u.key),ca:ilt(u.ca),rejectUnauthorized:t.skipTLSVerify?!1:void 0}}}function ilt(i){if(i==null)return;if(typeof i==="string")return i;if(Buffer.isBuffer(i))return i.toString("utf8");return String(i)}async function aP(i,t){let u=await mU0(i),l={...u.headers,...t.headers};if(t.method==="PATCH")l["content-type"]=t.patchType==="apply"?"application/apply-patch+yaml":t.patchType==="strategic-merge"?"application/strategic-merge-patch+json":"application/merge-patch+json";else if(t.body!==void 0&&!("content-type"in l))l["content-type"]="application/json";let n={method:t.method,headers:l,body:t.body===void 0?void 0:JSON.stringify(t.body),signal:t.signal,tls:u.tls,...t.stream?{timeout:!1}:{}};return fetch(`${u.server}${t.path}`,n)}async function tlt(i){try{return await i.json()}catch{return null}}async function ult(i,t){if(i.ok)return;let u=await tlt(i),l=u?.message??`${t} failed: ${i.status} ${i.statusText}`;throw new yZu(i.status,u,l)}async function Nm(i,t,u,l,n="none"){try{let f=await aP(i,t);if(f.status===404)return null;if(await ult(f,u),n==="json")return await f.json();return null}catch(f){throw new hc(l,f)}}async function Jm(i,t,u){let l=`${XZu}/${encodeURIComponent(t)}/${mf.CLAIM_PLURAL}`,n;try{n=await aP(i,{method:"POST",path:l,body:u})}catch(_){let g=_ instanceof Error?_.message:String(_);throw console.warn(`[agent-sandbox/client] createSandboxClaim ${u.metadata.name} transport error: ${g}`),new hc(`Failed to create SandboxClaim: ${u.metadata.name} (transport error: ${g})`,_)}if(n.ok)return;let f=await tlt(n),c=f?.reason?` ${f.reason}`:"",$=f?.message??n.statusText,d=`Failed to create SandboxClaim: ${u.metadata.name} (${n.status}${c}: ${$})`;if(console.warn(`[agent-sandbox/client] createSandboxClaim ${u.metadata.name} rejected: status=${n.status} reason=${f?.reason??"<none>"} message=${$}`),n.status===409)throw new ym(d);throw new hc(d)}async function j7i(i,t,u,l=60000){let n=Date.now()+l,f=500,c;while(!0){let $=await Ww(i,t,u).catch(()=>{return});if(!$)return;if(c=$,Date.now()>=n){let d=c.metadata?.finalizers??[],_=c.metadata?.deletionTimestamp??"<unknown>";throw new mP(`SandboxClaim ${u} still terminating after ${l}ms (deletionTimestamp=${_}, finalizers=[${d.join(", ")}])`)}await new Promise((d)=>setTimeout(d,500))}}function llt(i,t){return`${XZu}/${encodeURIComponent(i)}/${mf.CLAIM_PLURAL}/${encodeURIComponent(t)}`}async function NZu(i,t,u,l){await Nm(i,{method:"PATCH",path:llt(t,u),patchType:"merge",body:{spec:{lifecycle:{shutdownPolicy:"Delete",shutdownTime:l}}}},"patchSandboxClaimShutdown",`Failed to patch SandboxClaim shutdownTime: ${u}`)}async function ED(i,t,u){await Nm(i,{method:"DELETE",path:llt(t,u)},"deleteSandboxClaim",`Failed to delete SandboxClaim: ${u}`)}async function Ww(i,t,u){return await Nm(i,{method:"GET",path:llt(t,u)},"getSandboxClaim",`Failed to get SandboxClaim: ${u}`,"json")??void 0}async function JZu(i,t,u,l=60){let n=Date.now()+l*1000,f=200;while(Date.now()<n){let $=(await Ww(i,t,u).catch(()=>{return}))?.status?.sandbox?.name;if($)return $;await new Promise((d)=>setTimeout(d,200))}throw new mP(`SandboxClaim ${u} did not record an adopted Sandbox (status.sandbox.name) within ${l}s`)}function nlt(i,t){return`${aU0}/${encodeURIComponent(i)}/${FZu}/${encodeURIComponent(t)}`}async function k7i(i,t,u){let l=new URLSearchParams({fieldManager:QZu,force:"true"}),n=`${nlt(t,u.metadata.name)}?${l}`;try{let f=await aP(i,{method:"PATCH",path:n,patchType:"apply",body:u});await ult(f,"applyHttpRoute")}catch(f){throw new hc(`Failed to apply HTTPRoute: ${u.metadata.name}`,f)}}async function S7i(i,t,u){await Nm(i,{method:"DELETE",path:nlt(t,u)},"deleteHttpRoute",`Failed to delete HTTPRoute: ${u}`)}async function TZu(i,t,u){return await Nm(i,{method:"GET",path:nlt(t,u)},"getHttpRoute",`Failed to get HTTPRoute: ${u}`,"json")??void 0}async function BZu(i,t,u,l){let n={apiVersion:"v1",kind:"Service",metadata:{name:u},spec:{ports:[{name:l.name,port:l.port,targetPort:l.targetPort,protocol:l.protocol??"TCP"}]}},f=new URLSearchParams({fieldManager:QZu,force:"true"}),c=`/api/v1/namespaces/${encodeURIComponent(t)}/services/${encodeURIComponent(u)}?${f}`;try{let $=await aP(i,{method:"PATCH",path:c,patchType:"apply",body:n});await ult($,"ensureServicePort")}catch($){throw new hc(`Failed to apply Service ports: ${u}`,$)}}function z7i(i,t,u,l=180){let n=`/apis/${mf.SANDBOX_API_GROUP}/${mf.SANDBOX_API_VERSION}/namespaces/${encodeURIComponent(t)}/${mf.SANDBOX_PLURAL}?watch=true&fieldSelector=${encodeURIComponent(`metadata.name=${u}`)}`,{resolve:f,reject:c,promise:$}=Promise.withResolvers(),d=new AbortController,_=!1,g=setTimeout(()=>{if(_)return;_=!0,d.abort(),c(new mP(`Sandbox did not become ready within ${l} seconds`))},l*1000),h=(E)=>{if(_)return;_=!0,clearTimeout(g),d.abort(),E()};return(async()=>{let E;try{E=await aP(i,{method:"GET",path:n,signal:d.signal,headers:{accept:"application/json"},stream:!0})}catch(v){h(()=>c(new hc("Failed to start watch for sandbox readiness",v)));return}if(!E.ok||!E.body){let v=await tlt(E).catch(()=>null);h(()=>c(new hc(`Watch handshake failed (${E.status}): ${v?.message??E.statusText}`)));return}try{for await(let v of flt(E.body)){if(_)return;if(v.type==="ERROR"){let X=v.object;h(()=>c(new hc(`Watch stream error while waiting for sandbox: ${X.message??"unknown"}`)));return}if(v.type!=="ADDED"&&v.type!=="MODIFIED")continue;let w=v.object;if(!w.status?.conditions?.find((X)=>X.type==="Ready"&&X.status==="True"))continue;let O=w.metadata?.name;if(!O){h(()=>c(new hc("Sandbox metadata or name is missing")));return}let y=w.metadata?.annotations?.[mf.POD_NAME_ANNOTATION]??O;h(()=>f({sandboxName:O,podName:y}));return}h(()=>c(new hc("Watch stream closed before sandbox became ready")))}catch(v){if(_)return;if(v instanceof Error&&(v.name==="AbortError"||d.signal.aborted))return;h(()=>c(new hc("Watch stream error while waiting for sandbox",v)))}})(),$}async function*flt(i){let t=i.getReader(),u=new TextDecoder,l="";try{while(!0){let{value:f,done:c}=await t.read();if(c)break;l+=u.decode(f,{stream:!0});let $;while(($=l.indexOf(`
-`))>=0){let d=l.slice(0,$).trim();if(l=l.slice($+1),!d)continue;yield JSON.parse(d)}}let n=l.trim();if(n)yield JSON.parse(n)}finally{t.releaseLock()}}var yZu,XZu,UZu="gateway.networking.k8s.io",ZZu="v1",FZu="httproutes",aU0,Um,QZu="mesh-sandbox-runner";var K7i=x(()=>{Xm();yZu=class yZu extends Error{status;body;constructor(i,t,u){super(u);this.status=i;this.body=t;this.name="KubeHttpError"}};XZu=`/apis/${mf.CLAIM_API_GROUP}/${mf.CLAIM_API_VERSION}/namespaces`;aU0=`/apis/${UZu}/${ZZu}/namespaces`;Um={API_GROUP:UZu,API_VERSION:ZZu,PLURAL:FZu}});async function*PZu(i){let t=i.now??(()=>Date.now()),u=t(),l=i.schedulingTimeoutMs??pU0,n={pod:{},sandbox:{},events:{hasPulling:!1,hasPulled:!1},startedAt:u},f=[],c=null,$=!1,d=(X)=>{if($)return;if(c){let N=c;c=null,N(X)}else f.push(X)},_=()=>{if(f.length>0)return Promise.resolve(f.shift());if($)return Promise.resolve(null);return new Promise((X)=>{c=X})},g=()=>{if($)return;if($=!0,c){let X=c;c=null,X(null)}},h=new AbortController,E=()=>{h.abort(),g()};if(i.signal)if(i.signal.aborted)h.abort(),g();else i.signal.addEventListener("abort",E,{once:!0});let v=Math.max(0,l-(t()-u)),w=setTimeout(()=>d("tick"),v+100),r,O=new Promise((X)=>{r=X}),y=Promise.allSettled([iZ0(i.kc,i.namespace,i.claimName,h.signal,n,d,t,r),uZ0(i.kc,i.namespace,i.claimName,h.signal,n,d),lZ0(i.kc,i.namespace,i.claimName,O,h.signal,n,d,t)]);try{let X=null,N=-1,U=IZu(n,l,t);if(X=$lt(U),!clt(U))N=YZu(U);if(yield U,clt(U))return;while(!$){if(await _()===null)break;let F=IZu(n,l,t);if(clt(F)){let P=$lt(F);if(P!==X)X=P,yield F;return}let I=YZu(F);if(I<N)continue;let B=$lt(F);if(B!==X)X=B,N=I,yield F}}finally{if(clearTimeout(w),h.abort(),i.signal)i.signal.removeEventListener("abort",E);g(),await y.catch(()=>{})}}function IZu(i,t,u){let{pod:l,sandbox:n,events:f,startedAt:c}=i;if(n.ready)return{kind:"ready"};let $=l.containerWaitingReason;if($==="ImagePullBackOff"||$==="ErrImagePull")return{kind:"failed",reason:"image-pull-backoff",message:"Sandbox image failed to download. The cluster may be missing pull credentials or the image tag may not exist."};if($==="CrashLoopBackOff")return{kind:"failed",reason:"crash-loop-backoff",message:"Sandbox crashed during startup and is now in CrashLoopBackOff. Check pod logs."};if(!l.scheduled&&f.lastFailedSchedulingAt!==void 0&&u()-c>t)return{kind:"failed",reason:"scheduling-timeout",message:f.failedSchedulingMessage??`Pod could not be scheduled within ${Math.round(t/1000)}s.`};if(l.containerRunning&&!l.containerReady)return{kind:"warming-daemon",since:c};if(f.hasPulling&&!f.hasPulled)return{kind:"pulling-image",since:c};if($==="ContainerCreating"||$==="PodInitializing"||l.scheduled&&!l.containerRunning)return{kind:"starting-container",since:c};if(l.scheduledFalseReason==="Unschedulable"||f.lastFailedSchedulingAt!==void 0&&!l.scheduled)return{kind:"waiting-for-capacity",since:c,message:f.failedSchedulingMessage??l.scheduledFalseMessage,nodeClaim:f.nominatedNodeClaim};return{kind:"claiming",since:c}}function clt(i){return i.kind==="ready"||i.kind==="failed"}function YZu(i){switch(i.kind){case"claiming":return 0;case"waiting-for-capacity":return 1;case"pulling-image":return 2;case"starting-container":return 3;case"warming-daemon":return 4;case"ready":case"failed":return 99}}function $lt(i){switch(i.kind){case"claiming":case"pulling-image":case"starting-container":case"warming-daemon":return i.kind;case"waiting-for-capacity":return`waiting-for-capacity:${i.message??""}:${i.nodeClaim??""}`;case"ready":return"ready";case"failed":return`failed:${i.reason}:${i.message}`}}async function iZ0(i,t,u,l,n,f,c,$){let d=`/api/v1/namespaces/${encodeURIComponent(t)}/pods?watch=true&labelSelector=${encodeURIComponent(`${oU0}=${u}`)}`;return b7i({kc:i,path:d,signal:l,label:`pod/${u}`,onEvent:(_)=>{if(_.type!=="ADDED"&&_.type!=="MODIFIED")return;let g=_.object;if(g.metadata?.name)$(g.metadata.name);tZ0(g,n,c),f("pod")}})}function tZ0(i,t,u){let n=(i.status?.conditions??[]).find((c)=>c.type==="PodScheduled");if(n?.status==="True")t.pod.scheduled=!0,t.pod.scheduledFalseReason=void 0,t.pod.scheduledFalseMessage=void 0;else if(n?.status==="False")t.pod.scheduled=!1,t.pod.scheduledFalseReason=n.reason,t.pod.scheduledFalseMessage=n.message;let f=(i.status?.containerStatuses??[]).find((c)=>c.name===sU0);if(f)t.pod.containerWaitingReason=f.state?.waiting?.reason,t.pod.containerRunning=!!f.state?.running,t.pod.containerReady=f.ready===!0}async function uZ0(i,t,u,l,n,f){let c=`/apis/${mf.CLAIM_API_GROUP}/${mf.CLAIM_API_VERSION}/namespaces/${encodeURIComponent(t)}/${mf.CLAIM_PLURAL}?watch=true&fieldSelector=${encodeURIComponent(`metadata.name=${u}`)}`;return b7i({kc:i,path:c,signal:l,label:`sandboxclaim/${u}`,onEvent:($)=>{if($.type!=="ADDED"&&$.type!=="MODIFIED")return;let _=$.object.status?.conditions?.find((g)=>g.type==="Ready");if(!_)return;if(_.status==="True")n.sandbox.ready=!0,n.sandbox.notReadyReason=void 0,n.sandbox.notReadyMessage=void 0;else n.sandbox.ready=!1,n.sandbox.notReadyReason=_.reason,n.sandbox.notReadyMessage=_.message;f("sandbox")}})}async function lZ0(i,t,u,l,n,f,c,$){let d=await Promise.race([l,new Promise((g)=>{if(n.aborted){g(u);return}n.addEventListener("abort",()=>g(u),{once:!0})})]);if(n.aborted)return;let _=`/api/v1/namespaces/${encodeURIComponent(t)}/events?watch=true&fieldSelector=${encodeURIComponent(`involvedObject.name=${d},involvedObject.kind=Pod`)}`;return b7i({kc:i,path:_,signal:n,label:`events/${u}`,onEvent:(g)=>{if(g.type!=="ADDED"&&g.type!=="MODIFIED")return;let h=g.object,E=h.reason;if(!E)return;switch(E){case"Pulling":f.events.hasPulling=!0;break;case"Pulled":f.events.hasPulling=!0,f.events.hasPulled=!0;break;case"FailedScheduling":f.events.lastFailedSchedulingAt=$(),f.events.failedSchedulingMessage=h.message;break;case"Nominated":{let v=h.message?.match(/nodeclaim\/([\w-]+)/);if(v)f.events.nominatedNodeClaim=v[1];break}default:return}c("event")}})}async function GZu(i){let{kc:t,namespace:u,labelSelector:l,signal:n,onDelete:f}=i,c=`/apis/${mf.CLAIM_API_GROUP}/${mf.CLAIM_API_VERSION}/namespaces/${encodeURIComponent(u)}/${mf.CLAIM_PLURAL}?watch=true&labelSelector=${encodeURIComponent(l)}`;return b7i({kc:t,path:c,signal:n,label:"sandboxclaim-reaper",onEvent:($)=>{if($.type!=="DELETED")return;let d=$.object.metadata?.name;if(d)f(d)}})}async function b7i(i){let{kc:t,path:u,signal:l,label:n,onEvent:f}=i,c=0;while(!l.aborted){try{let d=await aP(t,{method:"GET",path:u,signal:l,headers:{accept:"application/json"},stream:!0});if(!d.ok||!d.body){try{await d.body?.cancel()}catch{}if(d.status===401||d.status===403){console.warn(`[lifecycle-watcher] ${n} stopped: watch denied (${d.status} ${d.statusText}). `+"The kubeconfig in use cannot watch SandboxClaims \u2014 if you are running locally, "+"this provider should not be active (check STUDIO_SANDBOX_PROVIDER / your sandbox preference).");return}throw Error(`watch handshake failed: ${d.status} ${d.statusText}`)}c=0;for await(let _ of flt(d.body)){if(l.aborted)return;try{f(_)}catch(g){console.warn(`[lifecycle-watcher] ${n} onEvent threw: ${g instanceof Error?g.message:String(g)}`)}}}catch(d){if(l.aborted)return;let _=d instanceof Error?d.message:String(d);console.warn(`[lifecycle-watcher] ${n} watch ended: ${_}`)}if(l.aborted)return;let $=On(5000,250,c,2,0);c+=1,await qu($,{signal:l}).catch(()=>{})}}var oU0="studio.decocms.com/sandbox-handle",sU0="sandbox",pU0=300000;var WZu=x(()=>{H1();Xm();K7i()});import{createHash as nZ0,randomBytes as fZ0,randomUUID as cZ0}from"crypto";import*as SZu from"net";import{PassThrough as $Z0}from"stream";function dZ0(i){if(i instanceof Error)return i.message;if(i&&typeof i==="object"){let t=i;if(t.error instanceof Error)return t.error.message;if(typeof t.message==="string"&&t.message)return t.message}return String(i)}class vlt{kind=__;records=new Map;inflight=new g6i;stateStore;previewUrlPattern;kubeConfig;portForward;namespace;sandboxTemplateName;envName;tokenGenerator;idleTtlMs;metrics;previewGateway;sentinelToken;closed=!1;claimWatchAbort=new AbortController;constructor(i={}){this.stateStore=i.stateStore??null,this.previewUrlPattern=i.previewUrlPattern??null,this.kubeConfig=i.kubeConfig??OZ0(),this.portForward=new Sut(this.kubeConfig),this.namespace=i.namespace??_Z0,this.sandboxTemplateName=i.sandboxTemplateName??gZ0,this.envName=ZZ0(i.envName),this.tokenGenerator=i.tokenGenerator??(()=>fZ0(EZ0).toString("hex")),this.idleTtlMs=i.idleTtlMs??wZ0,this.metrics=i.meter?DZ0(i.meter):null,this.previewGateway=i.previewGateway&&i.previewUrlPattern?{...i.previewGateway}:null;let t=i.sentinelToken?.trim()??"";this.sentinelToken=t.length>0?t:null,this.startClaimReaper()}startClaimReaper(){let i=["app.kubernetes.io/managed-by=studio","app.kubernetes.io/name=studio-sandbox",...this.envName?[`${kg.env}=${this.envName}`]:[]].join(",");GZu({kc:this.kubeConfig,namespace:this.namespace,labelSelector:i,signal:this.claimWatchAbort.signal,onDelete:(t)=>this.invalidateRecord(t)})}async ensure(i,t={}){let u=p5(i,t.branch??t.repo?.branch??null);return this.inflight.run(u,()=>h6i(this.stateStore,i,__,(l)=>this.ensureLocked(i,u,t,l)))}async delete(i){let t=await this.getRecord(i);if(this.records.delete(i),t)this.closeForwarder(t.daemonForward),this.metrics?.active.add(-1,hlt(t.tenant));if(await this.deleteHttpRouteIfManaged(i).catch((u)=>{console.warn(`[${S4}] HTTPRoute delete failed for ${i}: ${u instanceof Error?u.message:String(u)}`)}),await ED(this.kubeConfig,this.namespace,i),this.stateStore)if(t)await this.stateStore.delete(t.id,__);else await this.stateStore.deleteByHandle(__,i)}async alive(i){return await Ww(this.kubeConfig,this.namespace,i)!==void 0}watchClaimLifecycle(i,t){return PZu({kc:this.kubeConfig,namespace:this.namespace,claimName:i,signal:t})}async getPreviewUrl(i){let t=await this.getRecord(i);if(!t)return null;return this.composePreviewUrl(t)}async proxyDaemonRequest(i,t,u){let l=await this.getRecord(i);if(!l&&this.previewUrlPattern&&this.stateStore){let d=await this.stateStore.getByHandle(__,i),_=d?.state,g=_?.token;if(d&&g){let E=`http://${_?.adoptedSandboxName??i}.${this.namespace}.svc.cluster.local:${vD}`;try{let v=await qH(E,g,t,u);if(v.status!==404)return v;try{await v.body?.cancel()}catch{}}catch{}}}if(!l)l=await this.resurrectByHandle(i);if(!l)return new Response(JSON.stringify({error:"sandbox not found"}),{status:404,headers:{"content-type":"application/json"}});let n=l,f=performance.now(),c=0,$=!(u.body instanceof ReadableStream);try{let d=await qH(l.daemonUrl,l.token,t,u);if(d.status===401&&$){this.invalidateRecord(i);let _=await this.getRecord(i).catch(()=>null)??await this.resurrectByHandle(i).catch(()=>null);if(_)n=_,d=await qH(_.daemonUrl,_.token,t,u)}return c=d.status,d}catch(d){if(!$)throw d;this.invalidateRecord(i);let _=await this.resurrectByHandle(i)??await this.getRecord(i).catch(()=>null);if(!_)throw d;n=_;let g=await qH(_.daemonUrl,_.token,t,u);return c=g.status,g}finally{this.recordProxyDuration("daemon",c,n,performance.now()-f)}}async adoptLiveClaim(i,t){if(this.records.has(t))return!0;let u=await Ww(this.kubeConfig,this.namespace,t).catch(()=>{return});if(!u||u.metadata?.deletionTimestamp)return!1;return await this.inflight.run(t,async()=>{let n=this.records.get(t);if(n)return this.toSandbox(n);let f=await this.adopt(i,t,u);if(!f)throw Error(`cannot adopt live claim ${t}`);return h6i(this.stateStore,i,__,(c)=>this.finish(f,c,!0,!0,"adopt"))}).catch(()=>null)!=null}async resolvePreviewUpstreamUrl(i){if(this.previewUrlPattern)return`http://${await this.resolveServiceNameForHandle(i)}.${this.namespace}.svc.cluster.local:${vD}`;let t=await this.getRecord(i);if(t)return t.daemonUrl;let u=await this.resurrectByHandle(i);return u?u.daemonUrl:null}async resolveServiceNameForHandle(i){let t=this.records.get(i);if(t)return t.adoptedSandboxName;if(this.stateStore){let l=(await this.stateStore.getByHandle(__,i).catch(()=>null))?.state?.adoptedSandboxName;if(l)return l}return i}async proxyPreviewRequest(i,t){let u=performance.now(),l=this.records.get(i)??null,n=0;try{let f=await this.resolvePreviewUpstreamUrl(i);if(!f){n=404;let w=_lt(404,{error:"sandbox not found"});return w.headers.set(sP,"1"),w}let c=new URL(t.url);if((c.pathname==="/_sandbox"||c.pathname.startsWith("/_sandbox/")||c.pathname==="/_decopilot_vm"||c.pathname.startsWith("/_decopilot_vm/"))&&t.method!=="GET")return n=404,_lt(404,{error:"not found"});let d=(w)=>`${w}${c.pathname}${c.search}`,_=new Headers(t.headers);for(let w of xZ0)_.delete(w);let g=t.method!=="GET"&&t.method!=="HEAD",h={method:t.method,headers:_,body:g?t.body:void 0,redirect:"manual",signal:t.signal,duplex:g?"half":void 0},E;try{E=await fetch(d(f),h)}catch(w){let r=`${f}${c.pathname}`;if(console.warn(`[${S4}] preview fetch to ${r} failed: ${w instanceof Error?w.message:String(w)}`),t.method==="GET"||t.method==="HEAD"){if(this.invalidateRecord(i),await this.resurrectByHandle(i).catch(()=>null)){let X=await this.resolvePreviewUpstreamUrl(i);if(X)try{E=await fetch(d(X),h);let N=new Headers;for(let[U,J]of E.headers.entries())if(!AZu.includes(U.toLowerCase()))N.set(U,J);return n=E.status,new Response(E.body,{status:E.status,statusText:E.statusText,headers:N})}catch(N){console.warn(`[${S4}] preview fetch retry to ${r} failed: ${N instanceof Error?N.message:String(N)}`)}}}else this.invalidateRecord(i);n=502;let O=_lt(502,{error:"sandbox daemon unreachable"});return O.headers.set(sP,"1"),O}let v=new Headers;for(let[w,r]of E.headers.entries())if(!AZu.includes(w.toLowerCase()))v.set(w,r);return n=E.status,new Response(E.body,{status:E.status,statusText:E.statusText,headers:v})}finally{this.recordProxyDuration("preview",n,l,performance.now()-u,i)}}async ensureLocked(i,t,u,l){if(u.image)console.warn(`[${S4}] opts.image ignored (template ${this.sandboxTemplateName} pins image): got ${u.image}`);if(l){let c=await l.get(i,__);if(c){let $=await this.rehydrate(i,t,c);if($)return this.finish($,l,!1,!0,"resume");await l.delete(i,__)}}let n=await Ww(this.kubeConfig,this.namespace,t).catch(()=>{return});if(n)if(n.metadata?.deletionTimestamp)await j7i(this.kubeConfig,this.namespace,t).catch((c)=>{console.warn(`[${S4}] wait for terminating claim ${t} failed: ${c instanceof Error?c.message:String(c)}`)});else{let c=await this.adopt(i,t,n).catch(($)=>{return console.warn(`[${S4}] adopt ${t} failed, recreating: ${$ instanceof Error?$.message:String($)}`),null});if(c)return this.finish(c,l,!0,!0,"adopt");await ED(this.kubeConfig,this.namespace,t).catch(()=>{}),await j7i(this.kubeConfig,this.namespace,t).catch(($)=>{console.warn(`[${S4}] wait for deleted claim ${t} failed: ${$ instanceof Error?$.message:String($)}`)})}let f=await this.provision(i,t,u);return this.finish(f,l,!0,!1,"fresh")}async finish(i,t,u,l,n){let f=this.records.get(i.handle),c=f!==void 0;if(f&&f.daemonForward!==i.daemonForward)this.closeForwarder(f.daemonForward);if(this.records.set(i.handle,i),u)await this.persist(t,i);if(l)await NZu(this.kubeConfig,this.namespace,i.handle,this.computeShutdownTime()).catch(($)=>console.warn(`[${S4}] TTL refresh failed for ${i.handle}: ${$ instanceof Error?$.message:String($)}`));if(this.metrics){let $=hlt(i.tenant);if(this.metrics.ensureOutcome.add(1,{...$,outcome:n}),!c)this.metrics.active.add(1,$)}return this.toSandbox(i)}buildEnvMap(i,t){let u={},l=[];for(let[n,f]of Object.entries(i.env??{}))if(vZ0.has(n))l.push(n);else u[n]=f;if(l.length>0)console.warn(`[${S4}] opts.env keys overlap reserved bootstrap names and were dropped: ${l.join(",")}`);return{...u,DAEMON_TOKEN:t.token,DAEMON_BOOT_ID:t.daemonBootId,APP_ROOT:t.workdir,PROXY_PORT:String(vD)}}buildClaim(i,t,u){let l=this.sentinelToken!==null,n=l?[]:Object.entries(this.buildEnvMap(t,u)).sort(([$],[d])=>$<d?-1:$>d?1:0).map(([$,d])=>({name:$,value:d})),f=QZ0(t),c=Object.keys(f).length>0;return{apiVersion:`${mf.CLAIM_API_GROUP}/${mf.CLAIM_API_VERSION}`,kind:"SandboxClaim",metadata:{name:i,namespace:this.namespace,labels:{"app.kubernetes.io/name":"studio-sandbox","app.kubernetes.io/managed-by":"studio",...this.envName?{[kg.env]:this.envName}:{},...glt(t.tenant)},...c?{annotations:f}:{}},spec:{sandboxTemplateRef:{name:this.sandboxTemplateName},additionalPodMetadata:{labels:glt(t.tenant,{[kg.role]:"claimed",[kg.sandboxHandle]:i,...this.envName?{[kg.env]:this.envName}:{}}),...c?{annotations:f}:{}},env:n,warmpool:l?"default":"none",lifecycle:{shutdownPolicy:"Delete",shutdownTime:this.computeShutdownTime()}}}}async provision(i,t,u){let l=this.tokenGenerator(),n=cZ0(),f=dlt,c=this.buildClaim(t,u,{token:l,daemonBootId:n,workdir:f});try{await Jm(this.kubeConfig,this.namespace,c)}catch(E){if(E instanceof ym)await j7i(this.kubeConfig,this.namespace,t),await Jm(this.kubeConfig,this.namespace,c);else throw E}let $;try{$=await JZu(this.kubeConfig,this.namespace,t),await z7i(this.kubeConfig,this.namespace,$)}catch(E){throw await ED(this.kubeConfig,this.namespace,t).catch(()=>{}),E}try{await this.ensureServicePortForAdoptedSandbox($),await this.ensureHttpRouteForHandle(t,$,u.tenant??null)}catch(E){throw await ED(this.kubeConfig,this.namespace,t).catch(()=>{}),E}let d=await this.openForwarder($,vD,t),_=`http://127.0.0.1:${d.localPort}`,g=this.workloadConfigPayload(u),h=n;try{if(await hli(_),this.sentinelToken!==null){let E=await gli(_);if(E)h=E.bootId;await W8(_,this.sentinelToken,g??{},{rotateToken:l})}else if(g)await W8(_,l,g);if(u.orgFsConfigJson)await _Gt(_,l,u.orgFsConfigJson).catch((E)=>console.warn("[org-fs] sidecar config relay failed",E))}catch(E){throw this.closeForwarder(d),await this.deleteHttpRouteIfManaged(t).catch(()=>{}),await ED(this.kubeConfig,this.namespace,t).catch(()=>{}),E}return{id:i,handle:t,adoptedSandboxName:$,token:l,workdir:f,daemonUrl:_,daemonForward:d,workload:u.workload??null,daemonBootId:h,tenant:u.tenant??null,ensureOpts:IZ0(u)}}workloadConfigPayload(i){return ltt({runtime:i?.workload?.runtime??"node",packageManager:i?.workload?.packageManager?{name:i.workload.packageManager,...i.workload.packageManagerPath?{path:i.workload.packageManagerPath}:{}}:null,repo:i?.repo??null,port:i?.workload?.devPort??hZ0,tenant:i?.tenant??void 0})}async rebootstrapDaemon(i,t,u){if(this.sentinelToken===null)return!1;let l=this.workloadConfigPayload(u)??{};try{return await W8(i,this.sentinelToken,l,{rotateToken:t}),!0}catch(n){if(n instanceof _li&&n.status===401)try{return await W8(i,t,l,{rotateToken:t}),!0}catch(f){return console.warn(`[${S4}] re-bootstrap retry with claim token failed: ${f instanceof Error?f.message:String(f)}`),!1}return console.warn(`[${S4}] re-bootstrap failed: ${n instanceof Error?n.message:String(n)}`),!1}}async ensureServicePortForAdoptedSandbox(i){if(!this.previewGateway||!this.previewUrlPattern)return;await BZu(this.kubeConfig,this.namespace,i,{name:"daemon",port:vD,targetPort:vD})}async ensureHttpRouteForHandle(i,t,u){if(!this.previewGateway||!this.previewUrlPattern)return;let l=YZ0(this.previewUrlPattern,i);if(!l)throw new hc(`Unable to derive preview hostname for ${i} from pattern: ${this.previewUrlPattern}`);let n={apiVersion:`${Um.API_GROUP}/${Um.API_VERSION}`,kind:"HTTPRoute",metadata:{name:i,namespace:this.namespace,labels:glt(u??void 0,{[kg.role]:"claimed",[kg.sandboxHandle]:i,"app.kubernetes.io/name":"studio-sandbox","app.kubernetes.io/managed-by":"studio",...this.envName?{[kg.env]:this.envName}:{}})},spec:{parentRefs:[{kind:"Gateway",group:"gateway.networking.k8s.io",name:this.previewGateway.name,namespace:this.previewGateway.namespace}],hostnames:[l],rules:[{backendRefs:[{group:"",kind:"Service",name:t,port:vD}]}]}};await k7i(this.kubeConfig,this.namespace,n)}async deleteHttpRouteIfManaged(i){if(!this.previewGateway)return;await S7i(this.kubeConfig,this.namespace,i)}async rehydrate(i,t,u){let l=u.state;if(!l.adoptedSandboxName&&!l.podName||!l.token)return null;let n=await Ww(this.kubeConfig,this.namespace,t).catch(()=>{return});if(!n||!jZu(n))return null;let f=n.status?.sandbox?.name??l.adoptedSandboxName??l.podName??t,c=await this.openAndProbeDaemon(f,t);if(!c)return null;if(l.daemonBootId&&l.daemonBootId!==c.bootId){if(this.sentinelToken!==null){if(!await this.rebootstrapDaemon(c.daemonUrl,l.token,l.ensureOpts??null))return this.closeForwarder(c.daemonForward),null}else console.warn(`[${S4}] daemon restart detected (handle=${t}): stored bootId=${l.daemonBootId} live bootId=${c.bootId}`);await this.stateStore?.put(i,__,{handle:t,state:{...l,daemonBootId:c.bootId}}).catch(($)=>console.warn(`[${S4}] bootId persist failed for ${t}: ${$ instanceof Error?$.message:String($)}`))}return{id:i,handle:t,adoptedSandboxName:f,token:l.token,workdir:l.workdir??dlt,daemonUrl:c.daemonUrl,daemonForward:c.daemonForward,workload:l.workload??null,daemonBootId:c.bootId,tenant:l.tenant??null,ensureOpts:l.ensureOpts??null}}async adopt(i,t,u){if(!jZu(u))return null;let l=u.status?.sandbox?.name??t;if(this.sentinelToken!==null)return null;let n=yZ0(u);if(!n)return null;let f=await this.openAndProbeDaemon(l,t);if(!f)return null;let c=BZ0(u);if(this.previewGateway)await this.ensureServicePortForAdoptedSandbox(l).catch(($)=>{console.warn(`[${S4}] Service port backfill failed for ${t}: ${$ instanceof Error?$.message:String($)}`)}),await this.ensureHttpRouteForHandle(t,l,c).catch(($)=>{console.warn(`[${S4}] HTTPRoute backfill failed for ${t}: ${$ instanceof Error?$.message:String($)}`)});return{id:i,handle:t,adoptedSandboxName:l,token:n,workdir:dlt,daemonUrl:f.daemonUrl,daemonForward:f.daemonForward,workload:null,daemonBootId:f.bootId,tenant:c,ensureOpts:null}}async openAndProbeDaemon(i,t){let u=await this.openForwarder(i,vD,t).catch(()=>null);if(!u)return null;let l=`http://127.0.0.1:${u.localPort}`,n=await gli(l);if(!n)return this.closeForwarder(u),null;return{daemonForward:u,daemonUrl:l,bootId:n.bootId}}async getRecord(i){let t=this.records.get(i);if(t)return t;if(!this.stateStore)return null;let u=await this.stateStore.getByHandle(__,i);if(!u)return null;let l=await this.rehydrate(u.id,i,u);if(l)this.records.set(i,l);return l}async resurrectByHandle(i){if(!this.stateStore)return null;let t=await this.stateStore.getByHandle(__,i);if(!t)return null;let u=t.state.ensureOpts;if(!u)return null;return await this.ensure(t.id,u),this.records.get(i)??null}invalidateRecord(i){let t=this.records.get(i);if(!t)return;this.records.delete(i),this.closeForwarder(t.daemonForward)}recordProxyDuration(i,t,u,l,n){if(!this.metrics)return;this.metrics.proxyDurationMs.record(l,{...hlt(u?.tenant??null),source:i,sandbox_handle:u?.handle??n??"",status_code:t||0})}composePreviewUrl(i){if(this.previewUrlPattern)return E6i(this.previewUrlPattern,i.handle);return`http://127.0.0.1:${i.daemonForward.localPort}/`}toSandbox(i){return{handle:i.handle,workdir:i.workdir,previewUrl:this.composePreviewUrl(i)}}async persist(i,t){if(!i)return;let u={adoptedSandboxName:t.adoptedSandboxName,token:t.token,workdir:t.workdir,workload:t.workload,daemonBootId:t.daemonBootId,tenant:t.tenant,...t.ensureOpts?{ensureOpts:t.ensureOpts}:{}};await i.put(t.id,__,{handle:t.handle,state:u})}computeShutdownTime(){return new Date(Date.now()+this.idleTtlMs).toISOString()}openForwarder(i,t,u=i){let l=XZ0(u,t);return new Promise((n,f)=>{let c=($,d)=>{let _=SZu.createServer((g)=>this.handleForwardedConnection(g,i,t,u));_.once("error",(g)=>{if(g.code==="EADDRINUSE"&&d<rZ0){try{_.close()}catch{}let h=Elt+($-Elt+1)%zZu;c(h,d+1);return}f(g)}),_.listen($,"127.0.0.1",()=>{let g=_.address();if(!g||typeof g==="string"){_.close(),f(Error("port-forward listener failed to bind"));return}n({server:_,localPort:g.port})})};c(l,0)})}handleForwardedConnection(i,t,u,l){let n=new $Z0,f=null,c=!1,$=()=>{if(c)return;if(c=!0,n.destroy(),f)try{f.close()}catch{}if(!i.destroyed)i.destroy()};i.pipe(n),i.on("error",$),i.on("close",$),this.portForward.portForward(this.namespace,t,[u],i,null,n).then((d)=>{let _=typeof d==="function"?d():d;if(!_){$();return}if(f=_,f.on("close",$),f.on("error",()=>{this.invalidateRecord(l),$()}),c)try{f.close()}catch{}}).catch((d)=>{console.warn(`[${S4}] port-forward to ${t}:${u} failed: ${dZ0(d)}`),this.invalidateRecord(l),$()})}closeForwarder(i){i.server.close((t)=>{if(t)console.warn(`[${S4}] port-forward close on :${i.localPort} errored: ${t instanceof Error?t.message:String(t)}`)})}close(){if(this.closed)return;this.closed=!0,this.claimWatchAbort.abort();for(let i of this.records.values())this.closeForwarder(i.daemonForward);this.records.clear()}}function DZ0(i){return{active:i.createUpDownCounter("studio.sandbox.active",{description:"Active sandbox count, by runner kind and owning org. Cross-checks the cAdvisor-derived count from the cluster \u2014 divergence between the two indicates orphaned claims (mesh deleted but K8s didn't reap) or unattributed pods.",unit:"{sandbox}"}),ensureOutcome:i.createCounter("studio.sandbox.ensure.outcome",{description:"Outcome of each ensure() call: fresh provision, resume from state-store after restart, or adopt of a cluster-side claim mesh didn't know about. Cold-start ratio is the primary input for warm-pool sizing.",unit:"{call}"}),proxyDurationMs:i.createHistogram("studio.sandbox.proxy.duration_ms",{description:"Wall-clock latency of mesh-mediated requests to the sandbox daemon: tool exec proxies (source=daemon) and preview iframe traffic (source=preview).",unit:"ms"})}}function OZ0(){let i=new Lz;return i.loadFromDefault(),i}function jZu(i){return Boolean(i.status?.conditions?.some((t)=>t.type==="Ready"&&t.status==="True"))}function yZ0(i){let t=i.spec?.env;if(!t)return null;for(let u of t)if(u.name==="DAEMON_TOKEN"&&u.value)return u.value;return null}function XZ0(i,t){let u=nZ0("sha256").update(`${i}:${t}`).digest();return Elt+u.readUInt32BE(0)%zZu}function _lt(i,t){return new Response(JSON.stringify(t),{status:i,headers:{"content-type":"application/json","access-control-allow-origin":"*"}})}function kZu(i){let t=i.slice(0,JZ0);return NZ0.test(t)?t:""}function ZZ0(i){if(i===void 0)return null;let t=i.trim();if(t==="")return null;if(!UZ0.test(t))throw Error(`AgentSandboxProvider: envName=${JSON.stringify(t)} is not a valid DNS-label-safe environment name (lowercase alphanumeric or '-', starts with a letter, ends alphanumeric, \u226432 chars). Mesh sets this from STUDIO_ENV; check the studio chart's configMap.`);return t}function glt(i,t={}){let u={...t};if(i){let l=kZu(i.orgId),n=kZu(i.userId);if(l)u[kg.orgId]=l;if(n)u[kg.userId]=n}return u}function oP(i){let t="";for(let u of i){let l=u.codePointAt(0)??0;t+=l<32||l===127?" ":u}return t.slice(0,FZ0)}function TZ0(i){try{let t=new URL(i);return t.username="",t.password="",t.toString()}catch{return""}}function QZ0(i){let t={},u=i.tenant;if(u?.orgSlug)t[_E.orgSlug]=oP(u.orgSlug);if(u?.orgName)t[_E.orgName]=oP(u.orgName);if(u?.userEmail)t[_E.userEmail]=oP(u.userEmail);if(u?.userName)t[_E.userName]=oP(u.userName);let l=i.repo;if(l){if(l.displayName)t[_E.gitRepo]=oP(l.displayName);let n=TZ0(l.cloneUrl);if(n)t[_E.gitRepoUrl]=oP(n);let f=i.branch??l.branch;if(f)t[_E.gitBranch]=oP(f)}return t}function BZ0(i){let t=i.metadata?.labels;if(!t)return null;let u=t[kg.orgId],l=t[kg.userId];if(!u||!l)return null;let n=i.metadata?.annotations??{};return{orgId:u,userId:l,orgSlug:n[_E.orgSlug],orgName:n[_E.orgName],userEmail:n[_E.userEmail],userName:n[_E.userName]}}function hlt(i){return{org_id:i?.orgId??"",user_id:i?.userId??"",runner_kind:__}}function IZ0(i){let t={};if(i.repo)t.repo=i.repo;if(i.workload)t.workload=i.workload;if(i.env&&Object.keys(i.env).length>0)t.env=i.env;if(i.tenant)t.tenant=i.tenant;return Object.keys(t).length>0?t:null}function YZ0(i,t){try{return new URL(E6i(i,t)).hostname||null}catch{return null}}var __="agent-sandbox",S4="AgentSandboxProvider",sP="x-sandbox-preview-not-ready",_Z0="agent-sandbox-system",gZ0="studio-sandbox",vD=9000,hZ0=3000,dlt="/app",EZ0=32,vZ0,wZ0=900000,xZ0,AZu,Elt=40000,zZu=1e4,rZ0=256,kg,_E,NZ0,JZ0=63,UZ0,FZ0=253;var KZu=x(()=>{put();NWi();v6i();K7i();Xm();WZu();vZ0=new Set(["DAEMON_TOKEN","DAEMON_BOOT_ID","APP_ROOT","PROXY_PORT"]),xZ0=["cookie","host","connection","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","accept-encoding","content-length","upgrade"],AZu=["connection","keep-alive","transfer-encoding","content-encoding","content-length"];kg={role:"studio.decocms.com/role",sandboxHandle:"studio.decocms.com/sandbox-handle",orgId:"studio.decocms.com/org-id",userId:"studio.decocms.com/user-id",env:"studio.decocms.com/env"},_E={orgSlug:"studio.decocms.com/org-slug",orgName:"studio.decocms.com/org-name",userEmail:"studio.decocms.com/user-email",userName:"studio.decocms.com/user-name",gitRepo:"studio.decocms.com/git-repo",gitRepoUrl:"studio.decocms.com/git-repo-url",gitBranch:"studio.decocms.com/git-branch"},NZ0=/^([A-Za-z0-9]([-A-Za-z0-9_.]*[A-Za-z0-9])?)?$/;UZ0=/^[a-z]([a-z0-9-]{0,30}[a-z0-9])?$/});var bZu={};Pi(bZu,{waitForSandboxReady:()=>z7i,getSandboxClaim:()=>Ww,getHttpRoute:()=>TZu,deleteSandboxClaim:()=>ED,deleteHttpRoute:()=>S7i,createSandboxClaim:()=>Jm,applyHttpRoute:()=>k7i,SandboxTimeoutError:()=>mP,SandboxError:()=>hc,PREVIEW_NOT_READY_HEADER:()=>sP,KubeConfig:()=>Lz,K8S_CONSTANTS:()=>mf,HTTPROUTE_CONSTANTS:()=>Um,AgentSandboxProvider:()=>vlt});var wlt=x(()=>{put();Xm();K7i();KZu()});class H7i{kind=wD;userSub;dispatch;stateStore;records=new Map;constructor(i){if(!i.userSub)throw Error("DesktopSandboxProvider requires userSub");if(!i.dispatch)throw Error("DesktopSandboxProvider requires dispatch");this.userSub=i.userSub,this.dispatch=i.dispatch,this.stateStore=i.stateStore??null}async ensure(i,t={}){let u=t.branch??t.repo?.branch,l=p5(i,u),n=this.records.get(l);if(n){if(await this.probeHealth(l))return this.toSandbox(n);if(this.records.delete(l),this.stateStore)await this.stateStore.deleteByHandle(wD,l).catch(()=>{})}else if(this.stateStore){let E=(await this.stateStore.getByHandle(wD,l))?.state,v=E?.sandboxApiUrl;if(v){if(await this.probeHealth(l)){let w={handle:l,sandboxApiUrl:v,previewUrl:E?.previewUrl??v};return this.records.set(l,w),this.toSandbox(w)}await this.stateStore.deleteByHandle(wD,l).catch(()=>{})}}let f=th({userName:t.tenant?.userName,userEmail:t.tenant?.userEmail}),c=JSON.stringify({handle:l,repo:t.repo,branch:u,...t.workload?{workload:t.workload}:{},...f?{operator:f}:{},...t.offloadAllowedHosts?{offloadAllowedHosts:t.offloadAllowedHosts}:{},...t.offloadAllowSameHostDev!==void 0?{offloadAllowSameHostDev:t.offloadAllowSameHostDev}:{},...t.orgFsConfigJson?{orgFsConfigJson:t.orgFsConfigJson}:{}}),$=await this.dispatchJson("POST","/api/sandboxes",c),d=JSON.parse($);if(typeof d.sandboxApiUrl!=="string")throw Error("desktop ensure: daemon did not return a sandboxApiUrl string");let _=typeof d.previewUrl==="string"?d.previewUrl:d.sandboxApiUrl,g={handle:l,sandboxApiUrl:d.sandboxApiUrl,previewUrl:_};if(this.records.set(l,g),this.stateStore)await this.stateStore.put(i,wD,{handle:l,state:{handle:l,sandboxApiUrl:d.sandboxApiUrl,previewUrl:_}});return this.toSandbox(g)}async proxyDaemonRequest(i,t,u){let l=t.startsWith("/")?t:`/${t}`,n=l.startsWith("/_sandbox/")?l.slice(9):l,f=`/_sandbox/${encodeURIComponent(i)}${n}`,c=new Headers(u.headers);for(let y of["host","cookie","connection","keep-alive","transfer-encoding","upgrade","authorization"])c.delete(y);let $={};c.forEach((y,X)=>{$[X]=y});let d;if(u.body!=null)d=await GZ0(u.body);let g=this.dispatch(this.userSub,{method:u.method,path:f,headers:$,body:d},{signal:u.signal})[Symbol.asyncIterator](),h=PZ0(),E=200,v={"content-type":"application/octet-stream"},w=[];try{while(!0){let y=await g.next();if(y.done)break;let X=y.value;if(X.headers){E=X.headers.status,v=X.headers.headers;break}if(X.data!=null){let N=h.push(X.data);if(N.length)w.push(N)}}}catch(y){let X=y instanceof Error?y.message:"dispatch error";return new Response(JSON.stringify({error:X}),{status:502,headers:{"content-type":"application/json"}})}let r=!1,O=new ReadableStream({async start(y){for(let X of w)y.enqueue(X)},async pull(y){try{while(!0){let X=await g.next();if(r)return;if(X.done){let U=h.flush();if(U.length)y.enqueue(U);y.close();return}let N=X.value;if(N.data!=null){let U=h.push(N.data);if(U.length){y.enqueue(U);return}}}}catch(X){if(!r)y.error(X)}},cancel(){r=!0,g.return?.()}});return new Response(O,{status:E,headers:v})}async alive(i){return this.probeHealth(i)}async probeHealth(i){let t=new AbortController,u=setTimeout(()=>t.abort(),3000);try{return await this.dispatchJson("GET",`/api/sandboxes/${encodeURIComponent(i)}`,void 0,t.signal),!0}catch{return!1}finally{clearTimeout(u)}}async forgetHandle(i){if(this.records.delete(i),this.stateStore)await this.stateStore.deleteByHandle(wD,i).catch(()=>{})}async delete(i){if(this.records.delete(i),this.stateStore)await this.stateStore.deleteByHandle(wD,i).catch(()=>{});try{await this.dispatchJson("DELETE",`/api/sandboxes/${encodeURIComponent(i)}`)}catch(t){if(!(t instanceof Error?t.message:String(t)).includes("404"))throw t}}async getPreviewUrl(i){return(await this.resolveRecord(i))?.previewUrl??null}async localWorkdir(i){return null}async*watchClaimLifecycle(i,t){yield{kind:"ready"}}toSandbox(i){return{handle:i.handle,workdir:i.sandboxApiUrl,previewUrl:i.previewUrl}}async resolveRecord(i){let t=this.records.get(i);if(t)return t;if(!this.stateStore)return null;let l=(await this.stateStore.getByHandle(wD,i))?.state,n=l?.sandboxApiUrl;if(!n)return null;let f={handle:i,sandboxApiUrl:n,previewUrl:l?.previewUrl??n};return this.records.set(i,f),f}async dispatchJson(i,t,u,l){let n={accept:"application/json"};if(u!==void 0)n["content-type"]="application/json";let f=this.dispatch(this.userSub,{method:i,path:t,headers:n,body:u},{signal:l}),c=null,$="";for await(let _ of f)if(_.headers)c=_.headers.status;else if(_.data!=null)$+=_.data;let d=Buffer.from($,"base64").toString("utf8");if(c!=null&&(c<200||c>=300))throw Error(`daemon returned ${c}: ${d}`);return d}}function HZu(i){return new H7i(i)}function PZ0(){let i="";return{push(t){if(t.length===0)return xlt;i+=t;let u=i.length-i.length%4;if(u===0)return xlt;let l=i.slice(0,u);return i=i.slice(u),new Uint8Array(Buffer.from(l,"base64"))},flush(){if(i.length===0)return xlt;let t=i;return i="",new Uint8Array(Buffer.from(t,"base64"))}}}async function GZ0(i){if(typeof i==="string")return i;if(i instanceof ArrayBuffer)return Buffer.from(i).toString("utf8");if(ArrayBuffer.isView(i))return Buffer.from(i.buffer,i.byteOffset,i.byteLength).toString("utf8");if(i instanceof URLSearchParams)return i.toString();return await new Response(i).text()}var wD="user-desktop",xlt;var LZu=x(()=>{v6i();dli();xlt=new Uint8Array(0)});var RZu={};Pi(RZu,{createDesktopProvider:()=>HZu,DesktopSandboxProvider:()=>H7i});var CZu=x(()=>{LZu()});var aZu={};Pi(aZu,{subscribeLifecycle:()=>Zm,getSandboxProviderByKind:()=>Dlt,getOrInitSharedRunner:()=>bZ0,buildDesktopProvider:()=>L7i,__resetSharedLifecyclesForTesting:()=>eZ0});function VZu(i,t){let u=eZu[i];if(u)return Promise.resolve(u);let l=rlt[i];if(l)return l;let n=t().then((f)=>{return eZu[i]=f,f}).finally(()=>{delete rlt[i]});return rlt[i]=n,n}function jZ0(){let i=process.env.STUDIO_SANDBOX_PREVIEW_URL_PATTERN;return i&&i.trim()!==""?i:void 0}function kZ0(){let i=process.env.STUDIO_SANDBOX_TEMPLATE_NAME;return i&&i.trim()!==""?i:void 0}function SZ0(){let i=process.env.STUDIO_ENV;return i&&i.trim()!==""?i:void 0}function zZ0(){let i=process.env.STUDIO_SANDBOX_SENTINEL_TOKEN;return i&&i.trim()!==""?i:void 0}function KZ0(){let i=process.env.STUDIO_SANDBOX_PREVIEW_GATEWAY_NAME?.trim(),t=process.env.STUDIO_SANDBOX_PREVIEW_GATEWAY_NAMESPACE?.trim();if(!i&&!t)return;if(!i||!t)throw Error("STUDIO_SANDBOX_PREVIEW_GATEWAY_NAME and STUDIO_SANDBOX_PREVIEW_GATEWAY_NAMESPACE must both be set, or both unset. Half-configured per-claim HTTPRoute routing would silently fail to attach.");return{name:i,namespace:t}}async function mZu(i,t){let u=new tD(t),l=jZ0();switch(i){case"agent-sandbox":{let{AgentSandboxProvider:n}=await Promise.resolve().then(() => (wlt(),bZu));return new n({stateStore:u,previewUrlPattern:l,sandboxTemplateName:kZ0(),envName:SZ0(),previewGateway:KZ0(),sentinelToken:zZ0(),meter:Bn})}case"user-desktop":throw Error("user-desktop provider cannot be instantiated without a per-run link claim \u2014 call resolveSandboxProvider, which binds the link before constructing the provider.");default:throw Error(`Unknown sandbox provider kind: ${String(i)}`)}}async function L7i(i,t){let{DesktopSandboxProvider:u}=await Promise.resolve().then(() => (CZu(),RZu)),{getProxyDispatch:l}=await Promise.resolve().then(() => (ylt(),Olt)),n=new tD(i.db);if(!t)throw Error("buildDesktopProvider: userSub must be a non-empty string");let f=l();return new u({userSub:t,dispatch:f,stateStore:n})}function Dlt(i,t){return VZu(t,()=>mZu(t,i.db))}async function bZ0(){let i;try{i=mv()}catch(u){return console.warn("[lifecycle] cannot resolve sandbox runner:",u instanceof Error?u.message:String(u)),null}return await VZu(i,()=>mZu(i,N0().db))}function Zm(i,t,u){let l=xD.get(t);if(l){if(l.terminated){if(l.lastPhase)try{u(l.lastPhase)}catch{}return{unsubscribe:RZ0}}if(l.listeners.add(u),l.lastPhase)try{u(l.lastPhase)}catch{}return MZu(t,l,u)}let n=new AbortController,f={lastPhase:null,terminated:!1,listeners:new Set([u]),abort:n};return xD.set(t,f),CZ0(i,t,f),MZu(t,f,u)}function RZ0(){}function MZu(i,t,u){return{unsubscribe(){if(xD.get(i)!==t)return;if(t.listeners.delete(u),t.listeners.size===0)xD.delete(i),t.abort.abort()}}}async function CZ0(i,t,u){let l=null;try{for await(let n of i.watchClaimLifecycle(t,u.abort.signal)){if(u.abort.signal.aborted)break;u.lastPhase=n;let f=n.kind==="ready"||n.kind==="failed";if(f)u.terminated=!0;let c=Array.from(u.listeners);for(let $ of c)try{$(n)}catch{}if(f)break}}catch(n){l=n}finally{if(!u.terminated&&!u.abort.signal.aborted&&u.listeners.size>0){let n={kind:"failed",reason:"unknown",message:l instanceof Error?l.message:"Lifecycle watcher ended unexpectedly"};u.lastPhase=n,u.terminated=!0;for(let f of Array.from(u.listeners))try{f(n)}catch{}}if(xD.get(t)===u)xD.delete(t)}}function eZ0(){for(let i of xD.values())i.abort.abort();xD.clear()}var WZ0,AZ0,qZu,eZu,rlt,HZ0,LZ0,xD;var Fm=x(()=>{g6();z$();pf();y6i();WZ0=Symbol.for("decocms.sandbox.lifecycle.runners"),AZ0=Symbol.for("decocms.sandbox.lifecycle.inflight"),qZu=globalThis,eZu=qZu[WZ0]??={},rlt=qZu[AZ0]??={};HZ0=Symbol.for("decocms.sandbox.lifecycle.shared-lifecycles"),LZ0=globalThis,xD=LZ0[HZ0]??=new Map});async function R7i(i,t){if(await t.linkClaimRegistry.get(i))return"user-desktop";return t.resolveEnvKind()}async function gE(i,t){let{userId:u,branch:l,virtualMcpMetadata:n,explicitKind:f}=t;if(f)return{provider:await Tm(i,u,f),kind:f};if(i.sandboxPreference==="agent-sandbox")return{provider:await Tm(i,u,"agent-sandbox"),kind:"agent-sandbox"};if(i.sandboxPreference==="user-desktop"&&i.linkForCurrentRun)return{provider:await L7i(i,u),kind:"user-desktop"};if(i.sandboxPreference==="cluster-default"){let g=mv();return{provider:await Tm(i,u,g),kind:g}}let[c,...$]=MZ0(n,u,l);if(c){let g=$.length===0?c:await qZ0(i,u,c,$);return{provider:await Tm(i,u,g),kind:g}}let d=await oZu(i,u);return{provider:await Tm(i,u,d),kind:d}}function MZ0(i,t,u){let l=h6(i)[t]?.[u];if(!l)return[];let n=w2(l);return Object.keys(n)}async function qZ0(i,t,u,l){let n=await oZu(i,t);if(n===u||l.includes(n))return n;return u}async function oZu(i,t){if(!i.linkClaimRegistry)return mv();return R7i(t,{linkClaimRegistry:i.linkClaimRegistry,resolveEnvKind:mv})}async function Tm(i,t,u){if(u!=="user-desktop")return Dlt(i,u);if(!i.linkClaimRegistry)throw Error("user-desktop sandbox provider requires ctx.linkClaimRegistry to be wired (set on StudioContextConfig).");if(!await i.linkClaimRegistry.get(t))throw Error(`No link daemon registered for user "${t}". Start one with \`deco link\` (or run \`bun run dev --local-sandbox-provider\` for dev).`);return L7i(i,t)}var qz=x(()=>{kl();g6();Tw();Fm()});async function C7i(i,t){if(!i)return{hosts:[],allowSameHostDev:!1};let u;try{u=await i.presignedGetUrl("link-dispatch/_allowlist_probe",60,{requireFetchable:!0})}catch{return{hosts:[],allowSameHostDev:!1}}let l;try{l=new URL(u)}catch{return{hosts:[],allowSameHostDev:!1}}if(l.protocol!=="https:"&&l.protocol!=="http:")return{hosts:[],allowSameHostDev:!1};let n=l.hostname,f=VZ0.has(n);return{hosts:[n],allowSameHostDev:f&&!t.isProduction}}var VZ0;var Xlt=x(()=>{VZ0=new Set(["127.0.0.1","localhost","::1","[::1]","0.0.0.0"])});import{z as t3}from"zod";async function sZu(i,t){Ui(t);let u=Ei(t),l=Du(t);if(!l)throw Error("User ID required");let n=await t.storage.virtualMcps.findById(i.virtualMcpId);if(!n||n.organization_id!==u.id)throw Error("Virtual MCP not found");let f=n.metadata??{},c=Fw(h6(f),l,i.branch,i.sandboxProviderKind),$=i.sandboxProviderKind,{provider:d}=await gE(t,{userId:l,branch:i.branch,virtualMcpMetadata:f,explicitKind:$});if(c){if($!=="user-desktop")return c;if(await d.alive(c.sandboxHandle).catch(()=>!1))return c;await iD(t.storage.virtualMcps,i.virtualMcpId,l,l,i.branch,$).catch((E)=>{console.warn("[ensureSandbox] failed to reap stale user-desktop entry",E)})}let _=f.githubRepo??null,{entry:g}=await pZu({ctx:t,userId:l,orgId:u.id,virtualMcpId:i.virtualMcpId,branch:i.branch,metadata:f,githubRepo:_,existing:null,providerKind:$,runner:d});return g}async function pZu(i){let{ctx:t,userId:u,orgId:l,virtualMcpId:n,branch:f,metadata:c,githubRepo:$,existing:d,runner:_}=i,{runtime:g,packageManager:h,port:E,packageManagerPath:v}=w6i(c),w;if($){if($.connectionId)await Yz({ctx:t,connectionId:$.connectionId,organizationId:l,forceRefresh:!0,onLegacyMintError:(p)=>{console.error("[provisionSandbox] repo-scoped legacy token mint failed",{connectionId:$.connectionId,error:p.message})}});let{cloneUrl:a,gitUserName:S,gitUserEmail:M}=$.connectionId?await Pz($.connectionId,$.owner,$.name,t.db,t.vault):r6i($.owner,$.name);if(!h){let p=$.connectionId?await K7u($.connectionId,$.owner,$.name,t.db,t.vault):await b7u($.owner,$.name);if(p)h=p.packageManager,g=pV[p.packageManager].runtime,E=p.devPort??E,await aZ0(t,n,u,p.packageManager,p.devPort)}w={cloneUrl:a,userName:S,userEmail:M,branch:f,displayName:`${$.owner}/${$.name}`}}let r=g&&h?{runtime:g,packageManager:h,...E!==null?{devPort:Number(E)}:{},...v?{packageManagerPath:v}:{}}:void 0,O=Zw({orgId:l,virtualMcpId:n,branch:f}),y=_.kind==="user-desktop"?await C7i(t.objectStorage,{isProduction:kt().nodeEnv==="production"}):null,X=(_.kind==="user-desktop"||_.kind==="agent-sandbox")&&!kt().orgFsMountsDisabled,N;if(X){let a=t.organization?.slug??(await t.db.selectFrom("organization").select(["slug"]).where("id","=",l).executeTakeFirst())?.slug;if(a)N=await zdi(t,{orgSlug:a,orgId:l,baseUrl:PE()})}let U=await _.ensure({userId:u,projectRef:O},{branch:f,repo:w,workload:r,tenant:{orgId:l,userId:u,...t.organization?.slug?{orgSlug:t.organization.slug}:{},...t.organization?.name?{orgName:t.organization.name}:{},...t.auth.user?.email?{userEmail:t.auth.user.email}:{},...t.auth.user?.name?{userName:t.auth.user.name}:{}},...y?{offloadAllowedHosts:y.hosts,offloadAllowSameHostDev:y.allowSameHostDev}:{},...N?{orgFsConfigJson:N}:{}}),J=c.runtime?.env??null;await x6i({ctx:t,runner:_,handle:U.handle,orgId:l,userId:u,entries:J});let I=!!d&&d.sandboxHandle===U.handle&&d?.createdAt?d.createdAt:Date.now(),B=c.runtime?.selected??null,P=c.runtime?.port??null,L=c.runtime?.path??null,k={sandboxHandle:U.handle,previewUrl:U.previewUrl,sandboxApiUrl:U.previewUrl,sandboxProviderKind:_.kind,createdAt:I,startedWith:{packageManager:B,port:P,path:L}};await A7u(t.storage.virtualMcps,n,u,u,f,i.providerKind,k);let j=!d||d.sandboxHandle!==U.handle;return{entry:k,isNewVm:j}}async function aZ0(i,t,u,l,n){let f=await i.storage.virtualMcps.findById(t);if(!f)return;let c=f.metadata??{};await i.storage.virtualMcps.update(t,u,{metadata:{...c,runtime:{selected:l,port:n}}})}var mZ0,Nlt;var Jlt=x(()=>{g6();ai();im();ctt();Tw();D6i();L7u();Esi();ftt();qz();Xlt();tn();Zd();Kdi();Tw();mZ0=t3.enum(["agent-sandbox","user-desktop","cluster"]),Nlt=li({name:"SANDBOX_START",description:"Start a sandbox with the connected GitHub repo and dev server.",annotations:{title:"Start VM Preview",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!1,openWorldHint:!0},_meta:{ui:{visibility:"app"}},inputSchema:t3.object({virtualMcpId:t3.string().describe("Virtual MCP ID"),branch:t3.string().min(1).optional().describe("Optional git branch to check out. When omitted the handler generates a Bayer-style `<greek-letter>-<constellation>` name (e.g. `alpha-centauri`) and uses it. The resolved branch is returned in the response so callers can persist it."),sandboxProviderKind:mZ0.optional().describe("Explicit runtime choice. Hosted provider is `agent-sandbox`; legacy `cluster` input is accepted only for compatibility and normalized to `agent-sandbox`. When omitted, defaults to `user-desktop` if the acting user's link daemon is online, else the env kind.")}),outputSchema:t3.object({previewUrl:t3.string().nullable(),sandboxHandle:t3.string(),branch:t3.string(),isNewVm:t3.boolean(),sandboxProviderKind:t3.enum(["agent-sandbox","user-desktop"])}),handler:async(i,t)=>{Ui(t);let u=Ei(t);await t.access.check();let l=i.branch??mdi(),n=Du(t);if(!n)throw Error("User ID required");let f=await t.storage.virtualMcps.findById(i.virtualMcpId);if(!f||f.organization_id!==u.id)throw Error("Virtual MCP not found");let c=f.metadata??{},$=i.sandboxProviderKind?Uw(i.sandboxProviderKind):void 0,{provider:d,kind:_}=await gE(t,{userId:n,branch:l,virtualMcpMetadata:c,explicitKind:$}),g=Fw(h6(c),n,l,_),h=c.githubRepo??null,{entry:E,isNewVm:v}=await pZu({ctx:t,userId:n,orgId:u.id,virtualMcpId:i.virtualMcpId,branch:l,metadata:c,githubRepo:h,existing:g,providerKind:_,runner:d});return{...E,branch:l,isNewVm:v,sandboxProviderKind:_}}})});import{z as Vz}from"zod";var oZ0,Ult;var iFu=x(()=>{g6();ai();im();Tw();qz();oZ0=Vz.enum(["agent-sandbox","user-desktop","cluster"]),Ult=li({name:"SANDBOX_DELETE",description:"Delete a sandbox.",annotations:{title:"Delete VM Preview",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!0},_meta:{ui:{visibility:"app"}},inputSchema:Vz.object({virtualMcpId:Vz.string().describe("Virtual MCP ID that owns this VM"),branch:Vz.string().min(1).describe("Branch whose vm should be deleted (sandboxMap[userId][branch])"),sandboxProviderKind:oZ0.describe("Kind of sandbox provider the VM was started with. Hosted provider is `agent-sandbox`; legacy `cluster` input is accepted only for compatibility and normalized to `agent-sandbox`. Used to locate the correct 3-level sandboxMap entry.")}),outputSchema:Vz.object({success:Vz.boolean()}),handler:async(i,t)=>{let u=Uw(i.sandboxProviderKind),l;try{l=await k7u({...i,sandboxProviderKind:u},t)}catch($){if($ instanceof Error&&$.message==="Virtual MCP not found")return{success:!0};throw $}let{entry:n,userId:f}=l;if(!n)return{success:!0};let{provider:c}=await gE(t,{userId:f,branch:i.branch,virtualMcpMetadata:l.metadata,explicitKind:u});return await iD(t.storage.virtualMcps,i.virtualMcpId,f,f,i.branch,u),await c.delete(n.sandboxHandle).catch(($)=>console.error(`[SANDBOX_DELETE] ${u} ${n.sandboxHandle}: ${$ instanceof Error?$.message:String($)}`)),{success:!0}}})});var tFu=x(()=>{Jlt();iFu()});import{z as u3}from"zod";var pZ0="https://api.github.com",Zlt;var uFu=x(()=>{ai();o7();aS();kv();Zlt=li({name:"GITHUB_LIST_USER_ORGS",description:"List GitHub App installations (orgs/accounts) accessible to the authenticated user.",annotations:{title:"List GitHub User Orgs",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!0},_meta:{ui:{visibility:"app"}},inputSchema:u3.object({connectionId:u3.string().describe("ID of the mcp-github connection to use")}),outputSchema:u3.object({installations:u3.array(u3.object({installationId:u3.number(),login:u3.string(),avatarUrl:u3.string(),type:u3.string()})),appSlug:u3.string().optional()}),handler:async(i,t)=>{await t.access.check();let u=t.organization?.id;if(!u)throw Error("Organization context required");let l=await t.storage.connections.findById(i.connectionId,u);if(!l)throw Error("Connection not found");if(Sv(l))throw Error("Repo-scoped connections cannot list installations \u2014 use an org-level mcp-github connection");let n=new Mf(t.db,t.vault),f=await n.get(i.connectionId);if(!f)throw Error("No GitHub token found. Ensure the mcp-github connection is authenticated.");let c=f.accessToken;if(Gdi(f)&&n.isExpired(f,nV)){let E=await Wdi(f,n);if(!E)throw Error(O$);c=E,f=await n.get(i.connectionId)??f}let $=[],d,_=1,g=100,h=async(E)=>fetch(`${pZ0}/user/installations?per_page=${g}&page=${_}`,{headers:{Authorization:`Bearer ${E}`,Accept:"application/vnd.github+json","X-GitHub-Api-Version":"2022-11-28"}});while(!0){let E=await h(c);if(E.status===401){let w=await n.get(i.connectionId);if(!w||!Gdi(w))throw Error(O$);let r=await Wdi(w,n);if(!r)throw Error(O$);if(c=r,E=await h(c),E.status===401)throw Error(O$)}if(!E.ok)throw Error(`GitHub /user/installations failed: ${E.status}`);let v=await E.json();for(let w of v.installations){if(!d)d=w.app_slug??w.app?.slug;$.push({installationId:w.id,login:w.account.login,avatarUrl:w.account.avatar_url,type:w.account.type})}if(v.installations.length<g)break;_++}return{installations:$,...d?{appSlug:d}:{}}}})});var lFu=x(()=>{uFu()});import pP from"zod";var Flt;var nFu=x(()=>{y0i();ai();Flt=li({name:"LINK_CURRENT_GET",description:"Return the calling user's currently registered desktop link, or `online: false` if no link is registered or the TTL has expired.",inputSchema:pP.object({}),outputSchema:pP.object({online:pP.boolean(),machineId:pP.string().optional(),hostname:pP.string().optional(),cliVersion:pP.string().optional(),capabilities:pP.array(gji).default([])}),handler:async(i,t)=>{Ui(t),await t.access.check();let u=t.linkClaimRegistry;if(!u)return{online:!1,capabilities:[]};let l=await u.get(t.auth.user.id);if(!l)return{online:!1,capabilities:[]};return{online:!0,machineId:l.machineId,hostname:l.hostname,cliVersion:l.cliVersion,capabilities:l.capabilities}}})});import Tlt from"zod";var Qlt;var fFu=x(()=>{ai();Qlt=li({name:"LINK_DISCONNECT",description:"Disconnect the calling user's desktop link from the Studio side: tells the linked daemon to shut down (via a `shutdown` control frame) and removes the presence claim. The user re-links by running `bunx decocms link` on the desktop.",inputSchema:Tlt.object({}),outputSchema:Tlt.object({disconnected:Tlt.boolean()}),handler:async(i,t)=>{Ui(t),await t.access.check();let u=t.auth.user.id,l=t.linkClaimRegistry;if(!(l?await l.get(u):null))return{disconnected:!1};return t.publishLinkControlFrame?.(u,{type:"shutdown"}),await l.delete(u),{disconnected:!0}}})});var cFu=x(()=>{nFu();fFu()});import{z as Ec}from"zod";function $Fu(i){if(!i)return"";return typeof i==="string"?i:i.toISOString()}var uF0,lF0,nF0,fF0,cF0,Blt;var dFu=x(()=>{ai();uF0=["thread"],lF0=Ec.object({type:Ec.literal("thread"),id:Ec.string(),title:Ec.string(),created_at:Ec.string(),updated_at:Ec.string(),virtual_mcp_id:Ec.string().nullable(),run_config:Ec.record(Ec.string(),Ec.unknown()).nullable(),status:Ec.string().nullable()}),nF0=Ec.discriminatedUnion("type",[lF0]),fF0=Ec.object({query:Ec.string().min(1).describe("Free-text search query."),limit:Ec.number().int().min(1).max(50).optional().describe("Maximum results per resource type (default: 20)."),types:Ec.array(Ec.enum(uF0)).optional().describe("Restrict the search to specific resource types. Omit to search across all available types.")}),cF0=Ec.object({items:Ec.array(nF0),totalCount:Ec.number()});Blt=li({name:"GLOBAL_SEARCH",description:"Search across organization resources by free-text query. Returns a typed union of matches (currently: threads). New resource types may be added over time without changes to the call shape.",annotations:{title:"Global Search",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:fF0,outputSchema:cF0,handler:async(i,t)=>{await t.access.check(),Ei(t);let u=i.limit??20,l=i.types?.length?new Set(i.types):null,n=!l||l.has("thread"),f=[],c=0;if(n){let{threads:$,total:d}=await t.storage.threads.list(void 0,{limit:u,offset:0,search:i.query,includeArchived:!1});c+=d;for(let _ of $)f.push({type:"thread",id:_.id,title:_.title??"",created_at:$Fu(_.created_at),updated_at:$Fu(_.updated_at),virtual_mcp_id:_.virtual_mcp_id??null,run_config:_.run_config??null,status:_.status??null})}return{items:f,totalCount:c}}})});var _Fu=x(()=>{dFu()});var Hdi={};Pi(Hdi,{managementMCP:()=>_z,managementContextStore:()=>$y,listManagementTools:()=>_F0,getFilteredTools:()=>M7i,CORE_TOOLS:()=>hFu,ALL_TOOLS:()=>e7i});import{z as gFu}from"zod";async function EFu(i){if(Ilt.length===0||!i.organization)return null;let t=await i.storage.organizationSettings.get(i.organization.id),u=await i.storage.virtualMcps.listEnabledPlugins(i.organization.id),l=new Set(t?.enabled_plugins??[]);for(let n of u)l.add(n);return l.size>0?[...l]:null}async function M7i(i){if(Ilt.length===0)return dF0;let t=await EFu(i);return new Map(URi(e7i,t).map((u)=>[u.name,u]))}async function _F0(i){let t=await _z(i),[u,l]=te.createLinkedPair();await t.connect(l);let n=new Nf({name:"tools-hydration",version:"1.0.0"},{jsonSchemaValidator:V1});try{return await n.connect(u),(await n.listTools()).tools}finally{await n.close().catch(()=>{}),await t.close().catch(()=>{})}}var hFu,Ilt,e7i,dF0,_z=async(i)=>{let t=await EFu(i),u=URi(e7i,t),l=new x2({name:"mcp-cms-management",version:"1.0.0"},{capabilities:{tools:{},prompts:{},resources:{}},jsonSchemaValidator:V1});for(let c of u){let{config:$,handler:d}=B_i(c);l.registerTool(c.name,$,d)}let n=Q_i();for(let c of n){let $=c.arguments?.length?Object.fromEntries(c.arguments.map((d)=>{let _=d.required?gFu.string():gFu.string().optional();return[d.name,d.description?_.describe(d.description):_]})):void 0;l.registerPrompt(c.name,{title:c.title,description:c.description,...$?{argsSchema:$}:{}},(d)=>{return{messages:[{role:"user",content:{type:"text",text:typeof c.text==="function"?c.text(d??{}):c.text}}]}})}if(i.organization?.id){let c=await i.storage.brandContext.list(i.organization.id),$=new Set;for(let d of c){let _=d.name.toLowerCase().replace(/[^a-z0-9]+/g,"-").replace(/^-|-$/g,""),g=_?`brand-${_}`:`brand-${d.id}`;if($.has(g))g=`${g}-${d.id.slice(0,8)}`;$.add(g);let h=[`# Brand: ${d.name}`,"",`**Domain:** ${d.domain}`,"","## Overview",d.overview];if(d.colors){let v=Object.entries(d.colors).filter(([,w])=>w);if(v.length>0){h.push("","## Colors");for(let[w,r]of v)h.push(`- **${w}:** ${r}`)}}if(d.fonts){let v=Object.entries(d.fonts).filter(([,w])=>w);if(v.length>0){h.push("","## Fonts");for(let[w,r]of v)h.push(`- ${r} (${w})`)}}if(d.logo)h.push("",`**Logo:** ${d.logo}`);if(d.favicon)h.push(`**Favicon:** ${d.favicon}`);if(d.ogImage)h.push(`**OG Image:** ${d.ogImage}`);if(d.images&&d.images.length>0){h.push("","## Images");for(let v of d.images){let w=Object.entries(v).map(([r,O])=>`${r}: ${O}`).join(", ");h.push(`- ${w}`)}}let E=h.join(`
+`))>=0){let d=l.slice(0,$).trim();if(l=l.slice($+1),!d)continue;yield JSON.parse(d)}}let n=l.trim();if(n)yield JSON.parse(n)}finally{t.releaseLock()}}var yZu,XZu,UZu="gateway.networking.k8s.io",ZZu="v1",FZu="httproutes",aU0,Um,QZu="mesh-sandbox-runner";var K7i=x(()=>{Xm();yZu=class yZu extends Error{status;body;constructor(i,t,u){super(u);this.status=i;this.body=t;this.name="KubeHttpError"}};XZu=`/apis/${mf.CLAIM_API_GROUP}/${mf.CLAIM_API_VERSION}/namespaces`;aU0=`/apis/${UZu}/${ZZu}/namespaces`;Um={API_GROUP:UZu,API_VERSION:ZZu,PLURAL:FZu}});async function*PZu(i){let t=i.now??(()=>Date.now()),u=t(),l=i.schedulingTimeoutMs??pU0,n={pod:{},sandbox:{},events:{hasPulling:!1,hasPulled:!1},startedAt:u},f=[],c=null,$=!1,d=(X)=>{if($)return;if(c){let N=c;c=null,N(X)}else f.push(X)},_=()=>{if(f.length>0)return Promise.resolve(f.shift());if($)return Promise.resolve(null);return new Promise((X)=>{c=X})},g=()=>{if($)return;if($=!0,c){let X=c;c=null,X(null)}},h=new AbortController,E=()=>{h.abort(),g()};if(i.signal)if(i.signal.aborted)h.abort(),g();else i.signal.addEventListener("abort",E,{once:!0});let v=Math.max(0,l-(t()-u)),w=setTimeout(()=>d("tick"),v+100),r,O=new Promise((X)=>{r=X}),y=Promise.allSettled([iZ0(i.kc,i.namespace,i.claimName,h.signal,n,d,t,r),uZ0(i.kc,i.namespace,i.claimName,h.signal,n,d),lZ0(i.kc,i.namespace,i.claimName,O,h.signal,n,d,t)]);try{let X=null,N=-1,U=IZu(n,l,t);if(X=$lt(U),!clt(U))N=YZu(U);if(yield U,clt(U))return;while(!$){if(await _()===null)break;let F=IZu(n,l,t);if(clt(F)){let P=$lt(F);if(P!==X)X=P,yield F;return}let I=YZu(F);if(I<N)continue;let B=$lt(F);if(B!==X)X=B,N=I,yield F}}finally{if(clearTimeout(w),h.abort(),i.signal)i.signal.removeEventListener("abort",E);g(),await y.catch(()=>{})}}function IZu(i,t,u){let{pod:l,sandbox:n,events:f,startedAt:c}=i;if(n.ready)return{kind:"ready"};let $=l.containerWaitingReason;if($==="ImagePullBackOff"||$==="ErrImagePull")return{kind:"failed",reason:"image-pull-backoff",message:"Sandbox image failed to download. The cluster may be missing pull credentials or the image tag may not exist."};if($==="CrashLoopBackOff")return{kind:"failed",reason:"crash-loop-backoff",message:"Sandbox crashed during startup and is now in CrashLoopBackOff. Check pod logs."};if(!l.scheduled&&f.lastFailedSchedulingAt!==void 0&&u()-c>t)return{kind:"failed",reason:"scheduling-timeout",message:f.failedSchedulingMessage??`Pod could not be scheduled within ${Math.round(t/1000)}s.`};if(l.containerRunning&&!l.containerReady)return{kind:"warming-daemon",since:c};if(f.hasPulling&&!f.hasPulled)return{kind:"pulling-image",since:c};if($==="ContainerCreating"||$==="PodInitializing"||l.scheduled&&!l.containerRunning)return{kind:"starting-container",since:c};if(l.scheduledFalseReason==="Unschedulable"||f.lastFailedSchedulingAt!==void 0&&!l.scheduled)return{kind:"waiting-for-capacity",since:c,message:f.failedSchedulingMessage??l.scheduledFalseMessage,nodeClaim:f.nominatedNodeClaim};return{kind:"claiming",since:c}}function clt(i){return i.kind==="ready"||i.kind==="failed"}function YZu(i){switch(i.kind){case"claiming":return 0;case"waiting-for-capacity":return 1;case"pulling-image":return 2;case"starting-container":return 3;case"warming-daemon":return 4;case"ready":case"failed":return 99}}function $lt(i){switch(i.kind){case"claiming":case"pulling-image":case"starting-container":case"warming-daemon":return i.kind;case"waiting-for-capacity":return`waiting-for-capacity:${i.message??""}:${i.nodeClaim??""}`;case"ready":return"ready";case"failed":return`failed:${i.reason}:${i.message}`}}async function iZ0(i,t,u,l,n,f,c,$){let d=`/api/v1/namespaces/${encodeURIComponent(t)}/pods?watch=true&labelSelector=${encodeURIComponent(`${oU0}=${u}`)}`;return b7i({kc:i,path:d,signal:l,label:`pod/${u}`,onEvent:(_)=>{if(_.type!=="ADDED"&&_.type!=="MODIFIED")return;let g=_.object;if(g.metadata?.name)$(g.metadata.name);tZ0(g,n,c),f("pod")}})}function tZ0(i,t,u){let n=(i.status?.conditions??[]).find((c)=>c.type==="PodScheduled");if(n?.status==="True")t.pod.scheduled=!0,t.pod.scheduledFalseReason=void 0,t.pod.scheduledFalseMessage=void 0;else if(n?.status==="False")t.pod.scheduled=!1,t.pod.scheduledFalseReason=n.reason,t.pod.scheduledFalseMessage=n.message;let f=(i.status?.containerStatuses??[]).find((c)=>c.name===sU0);if(f)t.pod.containerWaitingReason=f.state?.waiting?.reason,t.pod.containerRunning=!!f.state?.running,t.pod.containerReady=f.ready===!0}async function uZ0(i,t,u,l,n,f){let c=`/apis/${mf.CLAIM_API_GROUP}/${mf.CLAIM_API_VERSION}/namespaces/${encodeURIComponent(t)}/${mf.CLAIM_PLURAL}?watch=true&fieldSelector=${encodeURIComponent(`metadata.name=${u}`)}`;return b7i({kc:i,path:c,signal:l,label:`sandboxclaim/${u}`,onEvent:($)=>{if($.type!=="ADDED"&&$.type!=="MODIFIED")return;let _=$.object.status?.conditions?.find((g)=>g.type==="Ready");if(!_)return;if(_.status==="True")n.sandbox.ready=!0,n.sandbox.notReadyReason=void 0,n.sandbox.notReadyMessage=void 0;else n.sandbox.ready=!1,n.sandbox.notReadyReason=_.reason,n.sandbox.notReadyMessage=_.message;f("sandbox")}})}async function lZ0(i,t,u,l,n,f,c,$){let d=await Promise.race([l,new Promise((g)=>{if(n.aborted){g(u);return}n.addEventListener("abort",()=>g(u),{once:!0})})]);if(n.aborted)return;let _=`/api/v1/namespaces/${encodeURIComponent(t)}/events?watch=true&fieldSelector=${encodeURIComponent(`involvedObject.name=${d},involvedObject.kind=Pod`)}`;return b7i({kc:i,path:_,signal:n,label:`events/${u}`,onEvent:(g)=>{if(g.type!=="ADDED"&&g.type!=="MODIFIED")return;let h=g.object,E=h.reason;if(!E)return;switch(E){case"Pulling":f.events.hasPulling=!0;break;case"Pulled":f.events.hasPulling=!0,f.events.hasPulled=!0;break;case"FailedScheduling":f.events.lastFailedSchedulingAt=$(),f.events.failedSchedulingMessage=h.message;break;case"Nominated":{let v=h.message?.match(/nodeclaim\/([\w-]+)/);if(v)f.events.nominatedNodeClaim=v[1];break}default:return}c("event")}})}async function GZu(i){let{kc:t,namespace:u,labelSelector:l,signal:n,onDelete:f}=i,c=`/apis/${mf.CLAIM_API_GROUP}/${mf.CLAIM_API_VERSION}/namespaces/${encodeURIComponent(u)}/${mf.CLAIM_PLURAL}?watch=true&labelSelector=${encodeURIComponent(l)}`;return b7i({kc:t,path:c,signal:n,label:"sandboxclaim-reaper",onEvent:($)=>{if($.type!=="DELETED")return;let d=$.object.metadata?.name;if(d)f(d)}})}async function b7i(i){let{kc:t,path:u,signal:l,label:n,onEvent:f}=i,c=0;while(!l.aborted){try{let d=await aP(t,{method:"GET",path:u,signal:l,headers:{accept:"application/json"},stream:!0});if(!d.ok||!d.body){try{await d.body?.cancel()}catch{}if(d.status===401||d.status===403){console.warn(`[lifecycle-watcher] ${n} stopped: watch denied (${d.status} ${d.statusText}). `+"The kubeconfig in use cannot watch SandboxClaims \u2014 if you are running locally, "+"this provider should not be active (check STUDIO_SANDBOX_PROVIDER / your sandbox preference).");return}throw Error(`watch handshake failed: ${d.status} ${d.statusText}`)}c=0;for await(let _ of flt(d.body)){if(l.aborted)return;try{f(_)}catch(g){console.warn(`[lifecycle-watcher] ${n} onEvent threw: ${g instanceof Error?g.message:String(g)}`)}}}catch(d){if(l.aborted)return;let _=d instanceof Error?d.message:String(d);console.warn(`[lifecycle-watcher] ${n} watch ended: ${_}`)}if(l.aborted)return;let $=On(5000,250,c,2,0);c+=1,await qu($,{signal:l}).catch(()=>{})}}var oU0="studio.decocms.com/sandbox-handle",sU0="sandbox",pU0=300000;var WZu=x(()=>{H1();Xm();K7i()});import{createHash as nZ0,randomBytes as fZ0,randomUUID as cZ0}from"crypto";import*as SZu from"net";import{PassThrough as $Z0}from"stream";function dZ0(i){if(i instanceof Error)return i.message;if(i&&typeof i==="object"){let t=i;if(t.error instanceof Error)return t.error.message;if(typeof t.message==="string"&&t.message)return t.message}return String(i)}class vlt{kind=__;records=new Map;inflight=new g6i;stateStore;previewUrlPattern;kubeConfig;portForward;namespace;sandboxTemplateName;envName;tokenGenerator;idleTtlMs;metrics;previewGateway;sentinelToken;closed=!1;claimWatchAbort=new AbortController;constructor(i={}){this.stateStore=i.stateStore??null,this.previewUrlPattern=i.previewUrlPattern??null,this.kubeConfig=i.kubeConfig??OZ0(),this.portForward=new Sut(this.kubeConfig),this.namespace=i.namespace??_Z0,this.sandboxTemplateName=i.sandboxTemplateName??gZ0,this.envName=ZZ0(i.envName),this.tokenGenerator=i.tokenGenerator??(()=>fZ0(EZ0).toString("hex")),this.idleTtlMs=i.idleTtlMs??wZ0,this.metrics=i.meter?DZ0(i.meter):null,this.previewGateway=i.previewGateway&&i.previewUrlPattern?{...i.previewGateway}:null;let t=i.sentinelToken?.trim()??"";this.sentinelToken=t.length>0?t:null,this.startClaimReaper()}startClaimReaper(){let i=["app.kubernetes.io/managed-by=studio","app.kubernetes.io/name=studio-sandbox",...this.envName?[`${kg.env}=${this.envName}`]:[]].join(",");GZu({kc:this.kubeConfig,namespace:this.namespace,labelSelector:i,signal:this.claimWatchAbort.signal,onDelete:(t)=>this.invalidateRecord(t)})}async ensure(i,t={}){let u=p5(i,t.branch??t.repo?.branch??null);return this.inflight.run(u,()=>h6i(this.stateStore,i,__,(l)=>this.ensureLocked(i,u,t,l)))}async delete(i){let t=await this.getRecord(i);if(this.records.delete(i),t)this.closeForwarder(t.daemonForward),this.metrics?.active.add(-1,hlt(t.tenant));if(await this.deleteHttpRouteIfManaged(i).catch((u)=>{console.warn(`[${S4}] HTTPRoute delete failed for ${i}: ${u instanceof Error?u.message:String(u)}`)}),await ED(this.kubeConfig,this.namespace,i),this.stateStore)if(t)await this.stateStore.delete(t.id,__);else await this.stateStore.deleteByHandle(__,i)}async alive(i){return await Ww(this.kubeConfig,this.namespace,i)!==void 0}watchClaimLifecycle(i,t){return PZu({kc:this.kubeConfig,namespace:this.namespace,claimName:i,signal:t})}async getPreviewUrl(i){let t=await this.getRecord(i);if(!t)return null;return this.composePreviewUrl(t)}async proxyDaemonRequest(i,t,u){let l=await this.getRecord(i);if(!l&&this.previewUrlPattern&&this.stateStore){let d=await this.stateStore.getByHandle(__,i),_=d?.state,g=_?.token;if(d&&g){let E=`http://${_?.adoptedSandboxName??i}.${this.namespace}.svc.cluster.local:${vD}`;try{let v=await qH(E,g,t,u);if(v.status!==404)return v;try{await v.body?.cancel()}catch{}}catch{}}}if(!l)l=await this.resurrectByHandle(i);if(!l)return new Response(JSON.stringify({error:"sandbox not found"}),{status:404,headers:{"content-type":"application/json"}});let n=l,f=performance.now(),c=0,$=!(u.body instanceof ReadableStream);try{let d=await qH(l.daemonUrl,l.token,t,u);if(d.status===401&&$){this.invalidateRecord(i);let _=await this.getRecord(i).catch(()=>null)??await this.resurrectByHandle(i).catch(()=>null);if(_)n=_,d=await qH(_.daemonUrl,_.token,t,u)}return c=d.status,d}catch(d){if(!$)throw d;this.invalidateRecord(i);let _=await this.resurrectByHandle(i)??await this.getRecord(i).catch(()=>null);if(!_)throw d;n=_;let g=await qH(_.daemonUrl,_.token,t,u);return c=g.status,g}finally{this.recordProxyDuration("daemon",c,n,performance.now()-f)}}async adoptLiveClaim(i,t){if(this.records.has(t))return!0;let u=await Ww(this.kubeConfig,this.namespace,t).catch(()=>{return});if(!u||u.metadata?.deletionTimestamp)return!1;return await this.inflight.run(t,async()=>{let n=this.records.get(t);if(n)return this.toSandbox(n);let f=await this.adopt(i,t,u);if(!f)throw Error(`cannot adopt live claim ${t}`);return h6i(this.stateStore,i,__,(c)=>this.finish(f,c,!0,!0,"adopt"))}).catch(()=>null)!=null}async resolvePreviewUpstreamUrl(i){if(this.previewUrlPattern)return`http://${await this.resolveServiceNameForHandle(i)}.${this.namespace}.svc.cluster.local:${vD}`;let t=await this.getRecord(i);if(t)return t.daemonUrl;let u=await this.resurrectByHandle(i);return u?u.daemonUrl:null}async resolveServiceNameForHandle(i){let t=this.records.get(i);if(t)return t.adoptedSandboxName;if(this.stateStore){let l=(await this.stateStore.getByHandle(__,i).catch(()=>null))?.state?.adoptedSandboxName;if(l)return l}return i}async proxyPreviewRequest(i,t){let u=performance.now(),l=this.records.get(i)??null,n=0;try{let f=await this.resolvePreviewUpstreamUrl(i);if(!f){n=404;let w=_lt(404,{error:"sandbox not found"});return w.headers.set(sP,"1"),w}let c=new URL(t.url);if((c.pathname==="/_sandbox"||c.pathname.startsWith("/_sandbox/")||c.pathname==="/_decopilot_vm"||c.pathname.startsWith("/_decopilot_vm/"))&&t.method!=="GET")return n=404,_lt(404,{error:"not found"});let d=(w)=>`${w}${c.pathname}${c.search}`,_=new Headers(t.headers);for(let w of xZ0)_.delete(w);let g=t.method!=="GET"&&t.method!=="HEAD",h={method:t.method,headers:_,body:g?t.body:void 0,redirect:"manual",signal:t.signal,duplex:g?"half":void 0},E;try{E=await fetch(d(f),h)}catch(w){let r=`${f}${c.pathname}`;if(console.warn(`[${S4}] preview fetch to ${r} failed: ${w instanceof Error?w.message:String(w)}`),t.method==="GET"||t.method==="HEAD"){if(this.invalidateRecord(i),await this.resurrectByHandle(i).catch(()=>null)){let X=await this.resolvePreviewUpstreamUrl(i);if(X)try{E=await fetch(d(X),h);let N=new Headers;for(let[U,J]of E.headers.entries())if(!AZu.includes(U.toLowerCase()))N.set(U,J);return n=E.status,new Response(E.body,{status:E.status,statusText:E.statusText,headers:N})}catch(N){console.warn(`[${S4}] preview fetch retry to ${r} failed: ${N instanceof Error?N.message:String(N)}`)}}}else this.invalidateRecord(i);n=502;let O=_lt(502,{error:"sandbox daemon unreachable"});return O.headers.set(sP,"1"),O}let v=new Headers;for(let[w,r]of E.headers.entries())if(!AZu.includes(w.toLowerCase()))v.set(w,r);return n=E.status,new Response(E.body,{status:E.status,statusText:E.statusText,headers:v})}finally{this.recordProxyDuration("preview",n,l,performance.now()-u,i)}}async ensureLocked(i,t,u,l){if(u.image)console.warn(`[${S4}] opts.image ignored (template ${this.sandboxTemplateName} pins image): got ${u.image}`);if(l){let c=await l.get(i,__);if(c){let $=await this.rehydrate(i,t,c);if($)return this.finish($,l,!1,!0,"resume");await l.delete(i,__)}}let n=await Ww(this.kubeConfig,this.namespace,t).catch(()=>{return});if(n)if(n.metadata?.deletionTimestamp)await j7i(this.kubeConfig,this.namespace,t).catch((c)=>{console.warn(`[${S4}] wait for terminating claim ${t} failed: ${c instanceof Error?c.message:String(c)}`)});else{let c=await this.adopt(i,t,n).catch(($)=>{return console.warn(`[${S4}] adopt ${t} failed, recreating: ${$ instanceof Error?$.message:String($)}`),null});if(c)return this.finish(c,l,!0,!0,"adopt");await ED(this.kubeConfig,this.namespace,t).catch(()=>{}),await j7i(this.kubeConfig,this.namespace,t).catch(($)=>{console.warn(`[${S4}] wait for deleted claim ${t} failed: ${$ instanceof Error?$.message:String($)}`)})}let f=await this.provision(i,t,u);return this.finish(f,l,!0,!1,"fresh")}async finish(i,t,u,l,n){let f=this.records.get(i.handle),c=f!==void 0;if(f&&f.daemonForward!==i.daemonForward)this.closeForwarder(f.daemonForward);if(this.records.set(i.handle,i),u)await this.persist(t,i);if(l)await NZu(this.kubeConfig,this.namespace,i.handle,this.computeShutdownTime()).catch(($)=>console.warn(`[${S4}] TTL refresh failed for ${i.handle}: ${$ instanceof Error?$.message:String($)}`));if(this.metrics){let $=hlt(i.tenant);if(this.metrics.ensureOutcome.add(1,{...$,outcome:n}),!c)this.metrics.active.add(1,$)}return this.toSandbox(i)}buildEnvMap(i,t){let u={},l=[];for(let[n,f]of Object.entries(i.env??{}))if(vZ0.has(n))l.push(n);else u[n]=f;if(l.length>0)console.warn(`[${S4}] opts.env keys overlap reserved bootstrap names and were dropped: ${l.join(",")}`);return{...u,DAEMON_TOKEN:t.token,DAEMON_BOOT_ID:t.daemonBootId,APP_ROOT:t.workdir,PROXY_PORT:String(vD)}}buildClaim(i,t,u){let l=this.sentinelToken!==null,n=l?[]:Object.entries(this.buildEnvMap(t,u)).sort(([$],[d])=>$<d?-1:$>d?1:0).map(([$,d])=>({name:$,value:d})),f=QZ0(t),c=Object.keys(f).length>0;return{apiVersion:`${mf.CLAIM_API_GROUP}/${mf.CLAIM_API_VERSION}`,kind:"SandboxClaim",metadata:{name:i,namespace:this.namespace,labels:{"app.kubernetes.io/name":"studio-sandbox","app.kubernetes.io/managed-by":"studio",...this.envName?{[kg.env]:this.envName}:{},...glt(t.tenant)},...c?{annotations:f}:{}},spec:{sandboxTemplateRef:{name:this.sandboxTemplateName},additionalPodMetadata:{labels:glt(t.tenant,{[kg.role]:"claimed",[kg.sandboxHandle]:i,...this.envName?{[kg.env]:this.envName}:{}}),...c?{annotations:f}:{}},env:n,warmpool:l?"default":"none",lifecycle:{shutdownPolicy:"Delete",shutdownTime:this.computeShutdownTime()}}}}async provision(i,t,u){let l=this.tokenGenerator(),n=cZ0(),f=dlt,c=this.buildClaim(t,u,{token:l,daemonBootId:n,workdir:f});try{await Jm(this.kubeConfig,this.namespace,c)}catch(E){if(E instanceof ym)await j7i(this.kubeConfig,this.namespace,t),await Jm(this.kubeConfig,this.namespace,c);else throw E}let $;try{$=await JZu(this.kubeConfig,this.namespace,t),await z7i(this.kubeConfig,this.namespace,$)}catch(E){throw await ED(this.kubeConfig,this.namespace,t).catch(()=>{}),E}try{await this.ensureServicePortForAdoptedSandbox($),await this.ensureHttpRouteForHandle(t,$,u.tenant??null)}catch(E){throw await ED(this.kubeConfig,this.namespace,t).catch(()=>{}),E}let d=await this.openForwarder($,vD,t),_=`http://127.0.0.1:${d.localPort}`,g=this.workloadConfigPayload(u),h=n;try{if(await hli(_),this.sentinelToken!==null){let E=await gli(_);if(E)h=E.bootId;await W8(_,this.sentinelToken,g??{},{rotateToken:l})}else if(g)await W8(_,l,g);if(u.orgFsConfigJson)await _Gt(_,l,u.orgFsConfigJson).catch((E)=>console.warn("[org-fs] sidecar config relay failed",E))}catch(E){throw this.closeForwarder(d),await this.deleteHttpRouteIfManaged(t).catch(()=>{}),await ED(this.kubeConfig,this.namespace,t).catch(()=>{}),E}return{id:i,handle:t,adoptedSandboxName:$,token:l,workdir:f,daemonUrl:_,daemonForward:d,workload:u.workload??null,daemonBootId:h,tenant:u.tenant??null,ensureOpts:IZ0(u)}}workloadConfigPayload(i){return ltt({runtime:i?.workload?.runtime??"node",packageManager:i?.workload?.packageManager?{name:i.workload.packageManager,...i.workload.packageManagerPath?{path:i.workload.packageManagerPath}:{}}:null,repo:i?.repo??null,port:i?.workload?.devPort??hZ0,tenant:i?.tenant??void 0})}async rebootstrapDaemon(i,t,u){if(this.sentinelToken===null)return!1;let l=this.workloadConfigPayload(u)??{};try{return await W8(i,this.sentinelToken,l,{rotateToken:t}),!0}catch(n){if(n instanceof _li&&n.status===401)try{return await W8(i,t,l,{rotateToken:t}),!0}catch(f){return console.warn(`[${S4}] re-bootstrap retry with claim token failed: ${f instanceof Error?f.message:String(f)}`),!1}return console.warn(`[${S4}] re-bootstrap failed: ${n instanceof Error?n.message:String(n)}`),!1}}async ensureServicePortForAdoptedSandbox(i){if(!this.previewGateway||!this.previewUrlPattern)return;await BZu(this.kubeConfig,this.namespace,i,{name:"daemon",port:vD,targetPort:vD})}async ensureHttpRouteForHandle(i,t,u){if(!this.previewGateway||!this.previewUrlPattern)return;let l=YZ0(this.previewUrlPattern,i);if(!l)throw new hc(`Unable to derive preview hostname for ${i} from pattern: ${this.previewUrlPattern}`);let n={apiVersion:`${Um.API_GROUP}/${Um.API_VERSION}`,kind:"HTTPRoute",metadata:{name:i,namespace:this.namespace,labels:glt(u??void 0,{[kg.role]:"claimed",[kg.sandboxHandle]:i,"app.kubernetes.io/name":"studio-sandbox","app.kubernetes.io/managed-by":"studio",...this.envName?{[kg.env]:this.envName}:{}})},spec:{parentRefs:[{kind:"Gateway",group:"gateway.networking.k8s.io",name:this.previewGateway.name,namespace:this.previewGateway.namespace}],hostnames:[l],rules:[{backendRefs:[{group:"",kind:"Service",name:t,port:vD}]}]}};await k7i(this.kubeConfig,this.namespace,n)}async deleteHttpRouteIfManaged(i){if(!this.previewGateway)return;await S7i(this.kubeConfig,this.namespace,i)}async rehydrate(i,t,u){let l=u.state;if(!l.adoptedSandboxName&&!l.podName||!l.token)return null;let n=await Ww(this.kubeConfig,this.namespace,t).catch(()=>{return});if(!n||!jZu(n))return null;let f=n.status?.sandbox?.name??l.adoptedSandboxName??l.podName??t,c=await this.openAndProbeDaemon(f,t);if(!c)return null;if(l.daemonBootId&&l.daemonBootId!==c.bootId){if(this.sentinelToken!==null){if(!await this.rebootstrapDaemon(c.daemonUrl,l.token,l.ensureOpts??null))return this.closeForwarder(c.daemonForward),null}else console.warn(`[${S4}] daemon restart detected (handle=${t}): stored bootId=${l.daemonBootId} live bootId=${c.bootId}`);await this.stateStore?.put(i,__,{handle:t,state:{...l,daemonBootId:c.bootId}}).catch(($)=>console.warn(`[${S4}] bootId persist failed for ${t}: ${$ instanceof Error?$.message:String($)}`))}return{id:i,handle:t,adoptedSandboxName:f,token:l.token,workdir:l.workdir??dlt,daemonUrl:c.daemonUrl,daemonForward:c.daemonForward,workload:l.workload??null,daemonBootId:c.bootId,tenant:l.tenant??null,ensureOpts:l.ensureOpts??null}}async adopt(i,t,u){if(!jZu(u))return null;let l=u.status?.sandbox?.name??t;if(this.sentinelToken!==null)return null;let n=yZ0(u);if(!n)return null;let f=await this.openAndProbeDaemon(l,t);if(!f)return null;let c=BZ0(u);if(this.previewGateway)await this.ensureServicePortForAdoptedSandbox(l).catch(($)=>{console.warn(`[${S4}] Service port backfill failed for ${t}: ${$ instanceof Error?$.message:String($)}`)}),await this.ensureHttpRouteForHandle(t,l,c).catch(($)=>{console.warn(`[${S4}] HTTPRoute backfill failed for ${t}: ${$ instanceof Error?$.message:String($)}`)});return{id:i,handle:t,adoptedSandboxName:l,token:n,workdir:dlt,daemonUrl:f.daemonUrl,daemonForward:f.daemonForward,workload:null,daemonBootId:f.bootId,tenant:c,ensureOpts:null}}async openAndProbeDaemon(i,t){let u=await this.openForwarder(i,vD,t).catch(()=>null);if(!u)return null;let l=`http://127.0.0.1:${u.localPort}`,n=await gli(l);if(!n)return this.closeForwarder(u),null;return{daemonForward:u,daemonUrl:l,bootId:n.bootId}}async getRecord(i){let t=this.records.get(i);if(t)return t;if(!this.stateStore)return null;let u=await this.stateStore.getByHandle(__,i);if(!u)return null;let l=await this.rehydrate(u.id,i,u);if(l)this.records.set(i,l);return l}async resurrectByHandle(i){if(!this.stateStore)return null;let t=await this.stateStore.getByHandle(__,i);if(!t)return null;let u=t.state.ensureOpts;if(!u)return null;return await this.ensure(t.id,u),this.records.get(i)??null}invalidateRecord(i){let t=this.records.get(i);if(!t)return;this.records.delete(i),this.closeForwarder(t.daemonForward)}recordProxyDuration(i,t,u,l,n){if(!this.metrics)return;this.metrics.proxyDurationMs.record(l,{...hlt(u?.tenant??null),source:i,sandbox_handle:u?.handle??n??"",status_code:t||0})}composePreviewUrl(i){if(this.previewUrlPattern)return E6i(this.previewUrlPattern,i.handle);return`http://127.0.0.1:${i.daemonForward.localPort}/`}toSandbox(i){return{handle:i.handle,workdir:i.workdir,previewUrl:this.composePreviewUrl(i)}}async persist(i,t){if(!i)return;let u={adoptedSandboxName:t.adoptedSandboxName,token:t.token,workdir:t.workdir,workload:t.workload,daemonBootId:t.daemonBootId,tenant:t.tenant,...t.ensureOpts?{ensureOpts:t.ensureOpts}:{}};await i.put(t.id,__,{handle:t.handle,state:u})}computeShutdownTime(){return new Date(Date.now()+this.idleTtlMs).toISOString()}openForwarder(i,t,u=i){let l=XZ0(u,t);return new Promise((n,f)=>{let c=($,d)=>{let _=SZu.createServer((g)=>this.handleForwardedConnection(g,i,t,u));_.once("error",(g)=>{if(g.code==="EADDRINUSE"&&d<rZ0){try{_.close()}catch{}let h=Elt+($-Elt+1)%zZu;c(h,d+1);return}f(g)}),_.listen($,"127.0.0.1",()=>{let g=_.address();if(!g||typeof g==="string"){_.close(),f(Error("port-forward listener failed to bind"));return}n({server:_,localPort:g.port})})};c(l,0)})}handleForwardedConnection(i,t,u,l){let n=new $Z0,f=null,c=!1,$=()=>{if(c)return;if(c=!0,n.destroy(),f)try{f.close()}catch{}if(!i.destroyed)i.destroy()};i.pipe(n),i.on("error",$),i.on("close",$),this.portForward.portForward(this.namespace,t,[u],i,null,n).then((d)=>{let _=typeof d==="function"?d():d;if(!_){$();return}if(f=_,f.on("close",$),f.on("error",()=>{this.invalidateRecord(l),$()}),c)try{f.close()}catch{}}).catch((d)=>{console.warn(`[${S4}] port-forward to ${t}:${u} failed: ${dZ0(d)}`),this.invalidateRecord(l),$()})}closeForwarder(i){i.server.close((t)=>{if(t)console.warn(`[${S4}] port-forward close on :${i.localPort} errored: ${t instanceof Error?t.message:String(t)}`)})}close(){if(this.closed)return;this.closed=!0,this.claimWatchAbort.abort();for(let i of this.records.values())this.closeForwarder(i.daemonForward);this.records.clear()}}function DZ0(i){return{active:i.createUpDownCounter("studio.sandbox.active",{description:"Active sandbox count, by runner kind and owning org. Cross-checks the cAdvisor-derived count from the cluster \u2014 divergence between the two indicates orphaned claims (mesh deleted but K8s didn't reap) or unattributed pods.",unit:"{sandbox}"}),ensureOutcome:i.createCounter("studio.sandbox.ensure.outcome",{description:"Outcome of each ensure() call: fresh provision, resume from state-store after restart, or adopt of a cluster-side claim mesh didn't know about. Cold-start ratio is the primary input for warm-pool sizing.",unit:"{call}"}),proxyDurationMs:i.createHistogram("studio.sandbox.proxy.duration_ms",{description:"Wall-clock latency of mesh-mediated requests to the sandbox daemon: tool exec proxies (source=daemon) and preview iframe traffic (source=preview).",unit:"ms"})}}function OZ0(){let i=new Lz;return i.loadFromDefault(),i}function jZu(i){return Boolean(i.status?.conditions?.some((t)=>t.type==="Ready"&&t.status==="True"))}function yZ0(i){let t=i.spec?.env;if(!t)return null;for(let u of t)if(u.name==="DAEMON_TOKEN"&&u.value)return u.value;return null}function XZ0(i,t){let u=nZ0("sha256").update(`${i}:${t}`).digest();return Elt+u.readUInt32BE(0)%zZu}function _lt(i,t){return new Response(JSON.stringify(t),{status:i,headers:{"content-type":"application/json","access-control-allow-origin":"*"}})}function kZu(i){let t=i.slice(0,JZ0);return NZ0.test(t)?t:""}function ZZ0(i){if(i===void 0)return null;let t=i.trim();if(t==="")return null;if(!UZ0.test(t))throw Error(`AgentSandboxProvider: envName=${JSON.stringify(t)} is not a valid DNS-label-safe environment name (lowercase alphanumeric or '-', starts with a letter, ends alphanumeric, \u226432 chars). Mesh sets this from STUDIO_ENV; check the studio chart's configMap.`);return t}function glt(i,t={}){let u={...t};if(i){let l=kZu(i.orgId),n=kZu(i.userId);if(l)u[kg.orgId]=l;if(n)u[kg.userId]=n}return u}function oP(i){let t="";for(let u of i){let l=u.codePointAt(0)??0;t+=l<32||l===127?" ":u}return t.slice(0,FZ0)}function TZ0(i){try{let t=new URL(i);return t.username="",t.password="",t.toString()}catch{return""}}function QZ0(i){let t={},u=i.tenant;if(u?.orgSlug)t[_E.orgSlug]=oP(u.orgSlug);if(u?.orgName)t[_E.orgName]=oP(u.orgName);if(u?.userEmail)t[_E.userEmail]=oP(u.userEmail);if(u?.userName)t[_E.userName]=oP(u.userName);let l=i.repo;if(l){if(l.displayName)t[_E.gitRepo]=oP(l.displayName);let n=TZ0(l.cloneUrl);if(n)t[_E.gitRepoUrl]=oP(n);let f=i.branch??l.branch;if(f)t[_E.gitBranch]=oP(f)}return t}function BZ0(i){let t=i.metadata?.labels;if(!t)return null;let u=t[kg.orgId],l=t[kg.userId];if(!u||!l)return null;let n=i.metadata?.annotations??{};return{orgId:u,userId:l,orgSlug:n[_E.orgSlug],orgName:n[_E.orgName],userEmail:n[_E.userEmail],userName:n[_E.userName]}}function hlt(i){return{org_id:i?.orgId??"",user_id:i?.userId??"",runner_kind:__}}function IZ0(i){let t={};if(i.repo)t.repo=i.repo;if(i.workload)t.workload=i.workload;if(i.env&&Object.keys(i.env).length>0)t.env=i.env;if(i.tenant)t.tenant=i.tenant;return Object.keys(t).length>0?t:null}function YZ0(i,t){try{return new URL(E6i(i,t)).hostname||null}catch{return null}}var __="agent-sandbox",S4="AgentSandboxProvider",sP="x-sandbox-preview-not-ready",_Z0="agent-sandbox-system",gZ0="studio-sandbox",vD=9000,hZ0=3000,dlt="/app",EZ0=32,vZ0,wZ0=900000,xZ0,AZu,Elt=40000,zZu=1e4,rZ0=256,kg,_E,NZ0,JZ0=63,UZ0,FZ0=253;var KZu=x(()=>{put();NWi();v6i();K7i();Xm();WZu();vZ0=new Set(["DAEMON_TOKEN","DAEMON_BOOT_ID","APP_ROOT","PROXY_PORT"]),xZ0=["cookie","host","connection","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","accept-encoding","content-length","upgrade"],AZu=["connection","keep-alive","transfer-encoding","content-encoding","content-length"];kg={role:"studio.decocms.com/role",sandboxHandle:"studio.decocms.com/sandbox-handle",orgId:"studio.decocms.com/org-id",userId:"studio.decocms.com/user-id",env:"studio.decocms.com/env"},_E={orgSlug:"studio.decocms.com/org-slug",orgName:"studio.decocms.com/org-name",userEmail:"studio.decocms.com/user-email",userName:"studio.decocms.com/user-name",gitRepo:"studio.decocms.com/git-repo",gitRepoUrl:"studio.decocms.com/git-repo-url",gitBranch:"studio.decocms.com/git-branch"},NZ0=/^([A-Za-z0-9]([-A-Za-z0-9_.]*[A-Za-z0-9])?)?$/;UZ0=/^[a-z]([a-z0-9-]{0,30}[a-z0-9])?$/});var bZu={};Pi(bZu,{waitForSandboxReady:()=>z7i,getSandboxClaim:()=>Ww,getHttpRoute:()=>TZu,deleteSandboxClaim:()=>ED,deleteHttpRoute:()=>S7i,createSandboxClaim:()=>Jm,applyHttpRoute:()=>k7i,SandboxTimeoutError:()=>mP,SandboxError:()=>hc,PREVIEW_NOT_READY_HEADER:()=>sP,KubeConfig:()=>Lz,K8S_CONSTANTS:()=>mf,HTTPROUTE_CONSTANTS:()=>Um,AgentSandboxProvider:()=>vlt});var wlt=x(()=>{put();Xm();K7i();KZu()});class H7i{kind=wD;userSub;dispatch;stateStore;records=new Map;constructor(i){if(!i.userSub)throw Error("DesktopSandboxProvider requires userSub");if(!i.dispatch)throw Error("DesktopSandboxProvider requires dispatch");this.userSub=i.userSub,this.dispatch=i.dispatch,this.stateStore=i.stateStore??null}async ensure(i,t={}){let u=t.branch??t.repo?.branch,l=p5(i,u),n=this.records.get(l);if(n){if(await this.probeHealth(l))return this.toSandbox(n);if(this.records.delete(l),this.stateStore)await this.stateStore.deleteByHandle(wD,l).catch(()=>{})}else if(this.stateStore){let E=(await this.stateStore.getByHandle(wD,l))?.state,v=E?.sandboxApiUrl;if(v){if(await this.probeHealth(l)){let w={handle:l,sandboxApiUrl:v,previewUrl:E?.previewUrl??v};return this.records.set(l,w),this.toSandbox(w)}await this.stateStore.deleteByHandle(wD,l).catch(()=>{})}}let f=th({userName:t.tenant?.userName,userEmail:t.tenant?.userEmail}),c=JSON.stringify({handle:l,repo:t.repo,branch:u,...t.workload?{workload:t.workload}:{},...f?{operator:f}:{},...t.offloadAllowedHosts?{offloadAllowedHosts:t.offloadAllowedHosts}:{},...t.offloadAllowSameHostDev!==void 0?{offloadAllowSameHostDev:t.offloadAllowSameHostDev}:{},...t.orgFsConfigJson?{orgFsConfigJson:t.orgFsConfigJson}:{}}),$=await this.dispatchJson("POST","/api/sandboxes",c),d=JSON.parse($);if(typeof d.sandboxApiUrl!=="string")throw Error("desktop ensure: daemon did not return a sandboxApiUrl string");let _=typeof d.previewUrl==="string"?d.previewUrl:d.sandboxApiUrl,g={handle:l,sandboxApiUrl:d.sandboxApiUrl,previewUrl:_};if(this.records.set(l,g),this.stateStore)await this.stateStore.put(i,wD,{handle:l,state:{handle:l,sandboxApiUrl:d.sandboxApiUrl,previewUrl:_}});return this.toSandbox(g)}async proxyDaemonRequest(i,t,u){let l=t.startsWith("/")?t:`/${t}`,n=l.startsWith("/_sandbox/")?l.slice(9):l,f=`/_sandbox/${encodeURIComponent(i)}${n}`,c=new Headers(u.headers);for(let y of["host","cookie","connection","keep-alive","transfer-encoding","upgrade","authorization"])c.delete(y);let $={};c.forEach((y,X)=>{$[X]=y});let d;if(u.body!=null)d=await GZ0(u.body);let g=this.dispatch(this.userSub,{method:u.method,path:f,headers:$,body:d},{signal:u.signal})[Symbol.asyncIterator](),h=PZ0(),E=200,v={"content-type":"application/octet-stream"},w=[];try{while(!0){let y=await g.next();if(y.done)break;let X=y.value;if(X.headers){E=X.headers.status,v=X.headers.headers;break}if(X.data!=null){let N=h.push(X.data);if(N.length)w.push(N)}}}catch(y){let X=y instanceof Error?y.message:"dispatch error";return new Response(JSON.stringify({error:X}),{status:502,headers:{"content-type":"application/json"}})}let r=!1,O=new ReadableStream({async start(y){for(let X of w)y.enqueue(X)},async pull(y){try{while(!0){let X=await g.next();if(r)return;if(X.done){let U=h.flush();if(U.length)y.enqueue(U);y.close();return}let N=X.value;if(N.data!=null){let U=h.push(N.data);if(U.length){y.enqueue(U);return}}}}catch(X){if(!r)y.error(X)}},cancel(){r=!0,g.return?.()}});return new Response(O,{status:E,headers:v})}async alive(i){return this.probeHealth(i)}async probeHealth(i){let t=new AbortController,u=setTimeout(()=>t.abort(),3000);try{return await this.dispatchJson("GET",`/api/sandboxes/${encodeURIComponent(i)}`,void 0,t.signal),!0}catch{return!1}finally{clearTimeout(u)}}async forgetHandle(i){if(this.records.delete(i),this.stateStore)await this.stateStore.deleteByHandle(wD,i).catch(()=>{})}async delete(i){if(this.records.delete(i),this.stateStore)await this.stateStore.deleteByHandle(wD,i).catch(()=>{});try{await this.dispatchJson("DELETE",`/api/sandboxes/${encodeURIComponent(i)}`)}catch(t){if(!(t instanceof Error?t.message:String(t)).includes("404"))throw t}}async getPreviewUrl(i){return(await this.resolveRecord(i))?.previewUrl??null}async localWorkdir(i){return null}async*watchClaimLifecycle(i,t){yield{kind:"ready"}}toSandbox(i){return{handle:i.handle,workdir:i.sandboxApiUrl,previewUrl:i.previewUrl}}async resolveRecord(i){let t=this.records.get(i);if(t)return t;if(!this.stateStore)return null;let l=(await this.stateStore.getByHandle(wD,i))?.state,n=l?.sandboxApiUrl;if(!n)return null;let f={handle:i,sandboxApiUrl:n,previewUrl:l?.previewUrl??n};return this.records.set(i,f),f}async dispatchJson(i,t,u,l){let n={accept:"application/json"};if(u!==void 0)n["content-type"]="application/json";let f=this.dispatch(this.userSub,{method:i,path:t,headers:n,body:u},{signal:l}),c=null,$="";for await(let _ of f)if(_.headers)c=_.headers.status;else if(_.data!=null)$+=_.data;let d=Buffer.from($,"base64").toString("utf8");if(c!=null&&(c<200||c>=300))throw Error(`daemon returned ${c}: ${d}`);return d}}function HZu(i){return new H7i(i)}function PZ0(){let i="";return{push(t){if(t.length===0)return xlt;i+=t;let u=i.length-i.length%4;if(u===0)return xlt;let l=i.slice(0,u);return i=i.slice(u),new Uint8Array(Buffer.from(l,"base64"))},flush(){if(i.length===0)return xlt;let t=i;return i="",new Uint8Array(Buffer.from(t,"base64"))}}}async function GZ0(i){if(typeof i==="string")return i;if(i instanceof ArrayBuffer)return Buffer.from(i).toString("utf8");if(ArrayBuffer.isView(i))return Buffer.from(i.buffer,i.byteOffset,i.byteLength).toString("utf8");if(i instanceof URLSearchParams)return i.toString();return await new Response(i).text()}var wD="user-desktop",xlt;var LZu=x(()=>{v6i();dli();xlt=new Uint8Array(0)});var RZu={};Pi(RZu,{createDesktopProvider:()=>HZu,DesktopSandboxProvider:()=>H7i});var CZu=x(()=>{LZu()});var aZu={};Pi(aZu,{subscribeLifecycle:()=>Zm,getSandboxProviderByKind:()=>Dlt,getOrInitSharedRunner:()=>bZ0,buildDesktopProvider:()=>L7i,__resetSharedLifecyclesForTesting:()=>eZ0});function VZu(i,t){let u=eZu[i];if(u)return Promise.resolve(u);let l=rlt[i];if(l)return l;let n=t().then((f)=>{return eZu[i]=f,f}).finally(()=>{delete rlt[i]});return rlt[i]=n,n}function jZ0(){let i=process.env.STUDIO_SANDBOX_PREVIEW_URL_PATTERN;return i&&i.trim()!==""?i:void 0}function kZ0(){let i=process.env.STUDIO_SANDBOX_TEMPLATE_NAME;return i&&i.trim()!==""?i:void 0}function SZ0(){let i=process.env.STUDIO_ENV;return i&&i.trim()!==""?i:void 0}function zZ0(){let i=process.env.STUDIO_SANDBOX_SENTINEL_TOKEN;return i&&i.trim()!==""?i:void 0}function KZ0(){let i=process.env.STUDIO_SANDBOX_PREVIEW_GATEWAY_NAME?.trim(),t=process.env.STUDIO_SANDBOX_PREVIEW_GATEWAY_NAMESPACE?.trim();if(!i&&!t)return;if(!i||!t)throw Error("STUDIO_SANDBOX_PREVIEW_GATEWAY_NAME and STUDIO_SANDBOX_PREVIEW_GATEWAY_NAMESPACE must both be set, or both unset. Half-configured per-claim HTTPRoute routing would silently fail to attach.");return{name:i,namespace:t}}async function mZu(i,t){let u=new tD(t),l=jZ0();switch(i){case"agent-sandbox":{let{AgentSandboxProvider:n}=await Promise.resolve().then(() => (wlt(),bZu));return new n({stateStore:u,previewUrlPattern:l,sandboxTemplateName:kZ0(),envName:SZ0(),previewGateway:KZ0(),sentinelToken:zZ0(),meter:Bn})}case"user-desktop":throw Error("user-desktop provider cannot be instantiated without a per-run link claim \u2014 call resolveSandboxProvider, which binds the link before constructing the provider.");default:throw Error(`Unknown sandbox provider kind: ${String(i)}`)}}async function L7i(i,t){let{DesktopSandboxProvider:u}=await Promise.resolve().then(() => (CZu(),RZu)),{getProxyDispatch:l}=await Promise.resolve().then(() => (ylt(),Olt)),n=new tD(i.db);if(!t)throw Error("buildDesktopProvider: userSub must be a non-empty string");let f=l();return new u({userSub:t,dispatch:f,stateStore:n})}function Dlt(i,t){return VZu(t,()=>mZu(t,i.db))}async function bZ0(){let i;try{i=mv()}catch(u){return console.warn("[lifecycle] cannot resolve sandbox runner:",u instanceof Error?u.message:String(u)),null}return await VZu(i,()=>mZu(i,N0().db))}function Zm(i,t,u){let l=xD.get(t);if(l){if(l.terminated){if(l.lastPhase)try{u(l.lastPhase)}catch{}return{unsubscribe:RZ0}}if(l.listeners.add(u),l.lastPhase)try{u(l.lastPhase)}catch{}return MZu(t,l,u)}let n=new AbortController,f={lastPhase:null,terminated:!1,listeners:new Set([u]),abort:n};return xD.set(t,f),CZ0(i,t,f),MZu(t,f,u)}function RZ0(){}function MZu(i,t,u){return{unsubscribe(){if(xD.get(i)!==t)return;if(t.listeners.delete(u),t.listeners.size===0)xD.delete(i),t.abort.abort()}}}async function CZ0(i,t,u){let l=null;try{for await(let n of i.watchClaimLifecycle(t,u.abort.signal)){if(u.abort.signal.aborted)break;u.lastPhase=n;let f=n.kind==="ready"||n.kind==="failed";if(f)u.terminated=!0;let c=Array.from(u.listeners);for(let $ of c)try{$(n)}catch{}if(f)break}}catch(n){l=n}finally{if(!u.terminated&&!u.abort.signal.aborted&&u.listeners.size>0){let n={kind:"failed",reason:"unknown",message:l instanceof Error?l.message:"Lifecycle watcher ended unexpectedly"};u.lastPhase=n,u.terminated=!0;for(let f of Array.from(u.listeners))try{f(n)}catch{}}if(xD.get(t)===u)xD.delete(t)}}function eZ0(){for(let i of xD.values())i.abort.abort();xD.clear()}var WZ0,AZ0,qZu,eZu,rlt,HZ0,LZ0,xD;var Fm=x(()=>{g6();z$();pf();y6i();WZ0=Symbol.for("decocms.sandbox.lifecycle.runners"),AZ0=Symbol.for("decocms.sandbox.lifecycle.inflight"),qZu=globalThis,eZu=qZu[WZ0]??={},rlt=qZu[AZ0]??={};HZ0=Symbol.for("decocms.sandbox.lifecycle.shared-lifecycles"),LZ0=globalThis,xD=LZ0[HZ0]??=new Map});async function R7i(i,t){if(await t.linkClaimRegistry.get(i))return"user-desktop";return t.resolveEnvKind()}async function gE(i,t){let{userId:u,branch:l,virtualMcpMetadata:n,explicitKind:f}=t;if(f)return{provider:await Tm(i,u,f),kind:f};if(i.sandboxPreference==="agent-sandbox")return{provider:await Tm(i,u,"agent-sandbox"),kind:"agent-sandbox"};if(i.sandboxPreference==="user-desktop"&&i.linkForCurrentRun)return{provider:await L7i(i,u),kind:"user-desktop"};if(i.sandboxPreference==="cluster-default"){let g=mv();return{provider:await Tm(i,u,g),kind:g}}let[c,...$]=MZ0(n,u,l);if(c){let g=$.length===0?c:await qZ0(i,u,c,$);return{provider:await Tm(i,u,g),kind:g}}let d=await oZu(i,u);return{provider:await Tm(i,u,d),kind:d}}function MZ0(i,t,u){let l=h6(i)[t]?.[u];if(!l)return[];let n=w2(l);return Object.keys(n)}async function qZ0(i,t,u,l){let n=await oZu(i,t);if(n===u||l.includes(n))return n;return u}async function oZu(i,t){if(!i.linkClaimRegistry)return mv();return R7i(t,{linkClaimRegistry:i.linkClaimRegistry,resolveEnvKind:mv})}async function Tm(i,t,u){if(u!=="user-desktop")return Dlt(i,u);if(!i.linkClaimRegistry)throw Error("user-desktop sandbox provider requires ctx.linkClaimRegistry to be wired (set on StudioContextConfig).");if(!await i.linkClaimRegistry.get(t))throw Error(`No link daemon registered for user "${t}". Start one with \`deco link\` (or run \`bun run dev --local-sandbox-provider\` for dev).`);return L7i(i,t)}var qz=x(()=>{kl();g6();Tw();Fm()});async function C7i(i,t){if(!i)return{hosts:[],allowSameHostDev:!1};let u;try{u=await i.presignedGetUrl("link-dispatch/_allowlist_probe",60,{requireFetchable:!0})}catch{return{hosts:[],allowSameHostDev:!1}}let l;try{l=new URL(u)}catch{return{hosts:[],allowSameHostDev:!1}}if(l.protocol!=="https:"&&l.protocol!=="http:")return{hosts:[],allowSameHostDev:!1};let n=l.hostname,f=VZ0.has(n);return{hosts:[n],allowSameHostDev:f&&!t.isProduction}}var VZ0;var Xlt=x(()=>{VZ0=new Set(["127.0.0.1","localhost","::1","[::1]","0.0.0.0"])});import{z as t3}from"zod";async function sZu(i,t){Ui(t);let u=Ei(t),l=Du(t);if(!l)throw Error("User ID required");let n=await t.storage.virtualMcps.findById(i.virtualMcpId);if(!n||n.organization_id!==u.id)throw Error("Virtual MCP not found");let f=n.metadata??{},c=Fw(h6(f),l,i.branch,i.sandboxProviderKind),$=i.sandboxProviderKind,{provider:d}=await gE(t,{userId:l,branch:i.branch,virtualMcpMetadata:f,explicitKind:$});if(c){if($!=="user-desktop")return c;if(await d.alive(c.sandboxHandle).catch(()=>!1))return c;await iD(t.storage.virtualMcps,i.virtualMcpId,l,l,i.branch,$).catch((E)=>{console.warn("[ensureSandbox] failed to reap stale user-desktop entry",E)})}let _=f.githubRepo??null,{entry:g}=await pZu({ctx:t,userId:l,orgId:u.id,virtualMcpId:i.virtualMcpId,branch:i.branch,metadata:f,githubRepo:_,existing:null,providerKind:$,runner:d});return g}async function pZu(i){let{ctx:t,userId:u,orgId:l,virtualMcpId:n,branch:f,metadata:c,githubRepo:$,existing:d,runner:_}=i,{runtime:g,packageManager:h,port:E,packageManagerPath:v}=w6i(c),w;if($){if($.connectionId)await Yz({ctx:t,connectionId:$.connectionId,organizationId:l,forceRefresh:!0,onLegacyMintError:(p)=>{console.error("[provisionSandbox] repo-scoped legacy token mint failed",{connectionId:$.connectionId,error:p.message})}});let{cloneUrl:a,gitUserName:S,gitUserEmail:M}=$.connectionId?await Pz($.connectionId,$.owner,$.name,t.db,t.vault):r6i($.owner,$.name);if(!h){let p=$.connectionId?await K7u($.connectionId,$.owner,$.name,t.db,t.vault):await b7u($.owner,$.name);if(p)h=p.packageManager,g=pV[p.packageManager].runtime,E=p.devPort??E,await aZ0(t,n,u,p.packageManager,p.devPort)}w={cloneUrl:a,userName:S,userEmail:M,branch:f,displayName:`${$.owner}/${$.name}`}}let r=g&&h?{runtime:g,packageManager:h,...E!==null?{devPort:Number(E)}:{},...v?{packageManagerPath:v}:{}}:void 0,O=Zw({orgId:l,virtualMcpId:n,branch:f}),y=_.kind==="user-desktop"?await C7i(t.objectStorage,{isProduction:kt().nodeEnv==="production"}):null,X=(_.kind==="user-desktop"||_.kind==="agent-sandbox")&&!kt().orgFsMountsDisabled,N;if(X){let a=t.organization?.slug??(await t.db.selectFrom("organization").select(["slug"]).where("id","=",l).executeTakeFirst())?.slug;if(a)N=await zdi(t,{orgSlug:a,orgId:l,baseUrl:PE()})}let U=await _.ensure({userId:u,projectRef:O},{branch:f,repo:w,workload:r,tenant:{orgId:l,userId:u,...t.organization?.slug?{orgSlug:t.organization.slug}:{},...t.organization?.name?{orgName:t.organization.name}:{},...t.auth.user?.email?{userEmail:t.auth.user.email}:{},...t.auth.user?.name?{userName:t.auth.user.name}:{}},...y?{offloadAllowedHosts:y.hosts,offloadAllowSameHostDev:y.allowSameHostDev}:{},...N?{orgFsConfigJson:N}:{}}),J=c.runtime?.env??null;await x6i({ctx:t,runner:_,handle:U.handle,orgId:l,userId:u,entries:J});let I=!!d&&d.sandboxHandle===U.handle&&d?.createdAt?d.createdAt:Date.now(),B=c.runtime?.selected??null,P=c.runtime?.port??null,L=c.runtime?.path??null,k={sandboxHandle:U.handle,previewUrl:U.previewUrl,sandboxApiUrl:U.previewUrl,sandboxProviderKind:_.kind,createdAt:I,startedWith:{packageManager:B,port:P,path:L}};await A7u(t.storage.virtualMcps,n,u,u,f,i.providerKind,k);let j=!d||d.sandboxHandle!==U.handle;return{entry:k,isNewVm:j}}async function aZ0(i,t,u,l,n){let f=await i.storage.virtualMcps.findById(t);if(!f)return;let c=f.metadata??{};await i.storage.virtualMcps.update(t,u,{metadata:{...c,runtime:{selected:l,port:n}}})}var mZ0,Nlt;var Jlt=x(()=>{g6();ai();im();ctt();Tw();D6i();L7u();Esi();ftt();qz();Xlt();tn();Zd();Kdi();Tw();mZ0=t3.enum(["agent-sandbox","user-desktop","cluster"]),Nlt=li({name:"SANDBOX_START",description:"Start a sandbox with the connected GitHub repo and dev server.",annotations:{title:"Start VM Preview",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!1,openWorldHint:!0},_meta:{ui:{visibility:"app"}},inputSchema:t3.object({virtualMcpId:t3.string().describe("Virtual MCP ID"),branch:t3.string().min(1).optional().describe("Optional git branch to check out. When omitted the handler generates a Bayer-style `<greek-letter>-<constellation>` name (e.g. `alpha-centauri`) and uses it. The resolved branch is returned in the response so callers can persist it."),sandboxProviderKind:mZ0.optional().describe("Explicit runtime choice. Hosted provider is `agent-sandbox`; legacy `cluster` input is accepted only for compatibility and normalized to `agent-sandbox`. When omitted, defaults to `user-desktop` if the acting user's link daemon is online, else the env kind.")}),outputSchema:t3.object({previewUrl:t3.string().nullable(),sandboxHandle:t3.string(),branch:t3.string(),isNewVm:t3.boolean(),sandboxProviderKind:t3.enum(["agent-sandbox","user-desktop"])}),handler:async(i,t)=>{Ui(t);let u=Ei(t);await t.access.check();let l=i.branch??mdi(),n=Du(t);if(!n)throw Error("User ID required");let f=await t.storage.virtualMcps.findById(i.virtualMcpId);if(!f||f.organization_id!==u.id)throw Error("Virtual MCP not found");let c=f.metadata??{},$=i.sandboxProviderKind?Uw(i.sandboxProviderKind):void 0,{provider:d,kind:_}=await gE(t,{userId:n,branch:l,virtualMcpMetadata:c,explicitKind:$}),g=Fw(h6(c),n,l,_),h=c.githubRepo??null,{entry:E,isNewVm:v}=await pZu({ctx:t,userId:n,orgId:u.id,virtualMcpId:i.virtualMcpId,branch:l,metadata:c,githubRepo:h,existing:g,providerKind:_,runner:d});return{...E,branch:l,isNewVm:v,sandboxProviderKind:_}}})});import{z as Vz}from"zod";var oZ0,Ult;var iFu=x(()=>{g6();ai();im();Tw();qz();oZ0=Vz.enum(["agent-sandbox","user-desktop","cluster"]),Ult=li({name:"SANDBOX_DELETE",description:"Delete a sandbox.",annotations:{title:"Delete VM Preview",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!0},_meta:{ui:{visibility:"app"}},inputSchema:Vz.object({virtualMcpId:Vz.string().describe("Virtual MCP ID that owns this VM"),branch:Vz.string().min(1).describe("Branch whose vm should be deleted (sandboxMap[userId][branch])"),sandboxProviderKind:oZ0.describe("Kind of sandbox provider the VM was started with. Hosted provider is `agent-sandbox`; legacy `cluster` input is accepted only for compatibility and normalized to `agent-sandbox`. Used to locate the correct 3-level sandboxMap entry.")}),outputSchema:Vz.object({success:Vz.boolean()}),handler:async(i,t)=>{let u=Uw(i.sandboxProviderKind),l;try{l=await k7u({...i,sandboxProviderKind:u},t)}catch($){if($ instanceof Error&&$.message==="Virtual MCP not found")return{success:!0};throw $}let{entry:n,userId:f}=l;if(!n)return{success:!0};let{provider:c}=await gE(t,{userId:f,branch:i.branch,virtualMcpMetadata:l.metadata,explicitKind:u});return await iD(t.storage.virtualMcps,i.virtualMcpId,f,f,i.branch,u),await c.delete(n.sandboxHandle).catch(($)=>console.error(`[SANDBOX_DELETE] ${u} ${n.sandboxHandle}: ${$ instanceof Error?$.message:String($)}`)),{success:!0}}})});var tFu=x(()=>{Jlt();iFu()});import{z as u3}from"zod";var pZ0="https://api.github.com",Zlt;var uFu=x(()=>{ai();o7();aS();kv();Zlt=li({name:"GITHUB_LIST_USER_ORGS",description:"List GitHub App installations (orgs/accounts) accessible to the authenticated user.",annotations:{title:"List GitHub User Orgs",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!0},_meta:{ui:{visibility:"app"}},inputSchema:u3.object({connectionId:u3.string().describe("ID of the mcp-github connection to use")}),outputSchema:u3.object({installations:u3.array(u3.object({installationId:u3.number(),login:u3.string(),avatarUrl:u3.string(),type:u3.string()})),appSlug:u3.string().optional()}),handler:async(i,t)=>{await t.access.check();let u=t.organization?.id;if(!u)throw Error("Organization context required");let l=await t.storage.connections.findById(i.connectionId,u);if(!l)throw Error("Connection not found");if(Sv(l))throw Error("Repo-scoped connections cannot list installations \u2014 use an org-level mcp-github connection");let n=new Mf(t.db,t.vault),f=await n.get(i.connectionId);if(!f)throw Error("No GitHub token found. Ensure the mcp-github connection is authenticated.");let c=f.accessToken;if(Gdi(f)&&n.isExpired(f,nV)){let E=await Wdi(f,n);if(!E)throw Error(O$);c=E,f=await n.get(i.connectionId)??f}let $=[],d,_=1,g=100,h=async(E)=>fetch(`${pZ0}/user/installations?per_page=${g}&page=${_}`,{headers:{Authorization:`Bearer ${E}`,Accept:"application/vnd.github+json","X-GitHub-Api-Version":"2022-11-28"}});while(!0){let E=await h(c);if(E.status===401){let w=await n.get(i.connectionId);if(!w||!Gdi(w))throw Error(O$);let r=await Wdi(w,n);if(!r)throw Error(O$);if(c=r,E=await h(c),E.status===401)throw Error(O$)}if(!E.ok)throw Error(`GitHub /user/installations failed: ${E.status}`);let v=await E.json();for(let w of v.installations){if(!d)d=w.app_slug??w.app?.slug;$.push({installationId:w.id,login:w.account.login,avatarUrl:w.account.avatar_url,type:w.account.type})}if(v.installations.length<g)break;_++}return{installations:$,...d?{appSlug:d}:{}}}})});var lFu=x(()=>{uFu()});import pP from"zod";var Flt;var nFu=x(()=>{y0i();ai();Flt=li({name:"LINK_CURRENT_GET",description:"Return the calling user's currently registered desktop link, or `online: false` if no link is registered or the TTL has expired.",inputSchema:pP.object({}),outputSchema:pP.object({online:pP.boolean(),machineId:pP.string().optional(),hostname:pP.string().optional(),cliVersion:pP.string().optional(),capabilities:pP.array(gji).default([])}),handler:async(i,t)=>{Ui(t),await t.access.check();let u=t.linkClaimRegistry;if(!u)return{online:!1,capabilities:[]};let l=await u.get(t.auth.user.id);if(!l)return{online:!1,capabilities:[]};return{online:!0,machineId:l.machineId,hostname:l.hostname,cliVersion:l.cliVersion,capabilities:l.capabilities}}})});import Tlt from"zod";var Qlt;var fFu=x(()=>{ai();Qlt=li({name:"LINK_DISCONNECT",description:"Disconnect the calling user's desktop link from the Studio side: tells the linked daemon to shut down (via a `shutdown` control frame) and removes the presence claim. The user re-links by running `bunx decocms@latest link` on the desktop.",inputSchema:Tlt.object({}),outputSchema:Tlt.object({disconnected:Tlt.boolean()}),handler:async(i,t)=>{Ui(t),await t.access.check();let u=t.auth.user.id,l=t.linkClaimRegistry;if(!(l?await l.get(u):null))return{disconnected:!1};return t.publishLinkControlFrame?.(u,{type:"shutdown"}),await l.delete(u),{disconnected:!0}}})});var cFu=x(()=>{nFu();fFu()});import{z as Ec}from"zod";function $Fu(i){if(!i)return"";return typeof i==="string"?i:i.toISOString()}var uF0,lF0,nF0,fF0,cF0,Blt;var dFu=x(()=>{ai();uF0=["thread"],lF0=Ec.object({type:Ec.literal("thread"),id:Ec.string(),title:Ec.string(),created_at:Ec.string(),updated_at:Ec.string(),virtual_mcp_id:Ec.string().nullable(),run_config:Ec.record(Ec.string(),Ec.unknown()).nullable(),status:Ec.string().nullable()}),nF0=Ec.discriminatedUnion("type",[lF0]),fF0=Ec.object({query:Ec.string().min(1).describe("Free-text search query."),limit:Ec.number().int().min(1).max(50).optional().describe("Maximum results per resource type (default: 20)."),types:Ec.array(Ec.enum(uF0)).optional().describe("Restrict the search to specific resource types. Omit to search across all available types.")}),cF0=Ec.object({items:Ec.array(nF0),totalCount:Ec.number()});Blt=li({name:"GLOBAL_SEARCH",description:"Search across organization resources by free-text query. Returns a typed union of matches (currently: threads). New resource types may be added over time without changes to the call shape.",annotations:{title:"Global Search",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:fF0,outputSchema:cF0,handler:async(i,t)=>{await t.access.check(),Ei(t);let u=i.limit??20,l=i.types?.length?new Set(i.types):null,n=!l||l.has("thread"),f=[],c=0;if(n){let{threads:$,total:d}=await t.storage.threads.list(void 0,{limit:u,offset:0,search:i.query,includeArchived:!1});c+=d;for(let _ of $)f.push({type:"thread",id:_.id,title:_.title??"",created_at:$Fu(_.created_at),updated_at:$Fu(_.updated_at),virtual_mcp_id:_.virtual_mcp_id??null,run_config:_.run_config??null,status:_.status??null})}return{items:f,totalCount:c}}})});var _Fu=x(()=>{dFu()});var Hdi={};Pi(Hdi,{managementMCP:()=>_z,managementContextStore:()=>$y,listManagementTools:()=>_F0,getFilteredTools:()=>M7i,CORE_TOOLS:()=>hFu,ALL_TOOLS:()=>e7i});import{z as gFu}from"zod";async function EFu(i){if(Ilt.length===0||!i.organization)return null;let t=await i.storage.organizationSettings.get(i.organization.id),u=await i.storage.virtualMcps.listEnabledPlugins(i.organization.id),l=new Set(t?.enabled_plugins??[]);for(let n of u)l.add(n);return l.size>0?[...l]:null}async function M7i(i){if(Ilt.length===0)return dF0;let t=await EFu(i);return new Map(URi(e7i,t).map((u)=>[u.name,u]))}async function _F0(i){let t=await _z(i),[u,l]=te.createLinkedPair();await t.connect(l);let n=new Nf({name:"tools-hydration",version:"1.0.0"},{jsonSchemaValidator:V1});try{return await n.connect(u),(await n.listTools()).tools}finally{await n.close().catch(()=>{}),await t.close().catch(()=>{})}}var hFu,Ilt,e7i,dF0,_z=async(i)=>{let t=await EFu(i),u=URi(e7i,t),l=new x2({name:"mcp-cms-management",version:"1.0.0"},{capabilities:{tools:{},prompts:{},resources:{}},jsonSchemaValidator:V1});for(let c of u){let{config:$,handler:d}=B_i(c);l.registerTool(c.name,$,d)}let n=Q_i();for(let c of n){let $=c.arguments?.length?Object.fromEntries(c.arguments.map((d)=>{let _=d.required?gFu.string():gFu.string().optional();return[d.name,d.description?_.describe(d.description):_]})):void 0;l.registerPrompt(c.name,{title:c.title,description:c.description,...$?{argsSchema:$}:{}},(d)=>{return{messages:[{role:"user",content:{type:"text",text:typeof c.text==="function"?c.text(d??{}):c.text}}]}})}if(i.organization?.id){let c=await i.storage.brandContext.list(i.organization.id),$=new Set;for(let d of c){let _=d.name.toLowerCase().replace(/[^a-z0-9]+/g,"-").replace(/^-|-$/g,""),g=_?`brand-${_}`:`brand-${d.id}`;if($.has(g))g=`${g}-${d.id.slice(0,8)}`;$.add(g);let h=[`# Brand: ${d.name}`,"",`**Domain:** ${d.domain}`,"","## Overview",d.overview];if(d.colors){let v=Object.entries(d.colors).filter(([,w])=>w);if(v.length>0){h.push("","## Colors");for(let[w,r]of v)h.push(`- **${w}:** ${r}`)}}if(d.fonts){let v=Object.entries(d.fonts).filter(([,w])=>w);if(v.length>0){h.push("","## Fonts");for(let[w,r]of v)h.push(`- ${r} (${w})`)}}if(d.logo)h.push("",`**Logo:** ${d.logo}`);if(d.favicon)h.push(`**Favicon:** ${d.favicon}`);if(d.ogImage)h.push(`**OG Image:** ${d.ogImage}`);if(d.images&&d.images.length>0){h.push("","## Images");for(let v of d.images){let w=Object.entries(v).map(([r,O])=>`${r}: ${O}`).join(", ");h.push(`- ${w}`)}}let E=h.join(`
 `);l.prompt(g,`Brand context for ${d.name}`,()=>({messages:[{role:"user",content:{type:"text",text:E}}]}))}}let f=vxu();for(let c of f)l.resource(c.name,c.uri,{description:c.description,mimeType:c.mimeType??"text/markdown"},async($)=>{return{contents:[{uri:typeof $==="string"?$:$.href,mimeType:c.mimeType??"text/markdown",text:c.text}]}});return l};var p7=x(()=>{dC();Nh();OR();m$();Hnu();t3u();f3u();x3u();B3u();W3u();t2u();$2u();U2u();fwu();$wu();Ywu();Wwu();Lwu();Cwu();Ipi();I_i();I_i();Kxu();Y7u();tFu();lFu();cFu();_Fu();hFu=[Soi,zoi,Koi,boi,Hoi,Loi,Roi,Coi,eoi,Moi,qoi,Voi,aoi,ooi,soi,poi,isi,tsi,usi,lsi,nsi,fsi,csi,Vei,coi,$oi,_oi,goi,hoi,Xoi,Joi,Zoi,Toi,Boi,n3u,Woi,Aoi,joi,koi,bei,Lei,Rei,Hei,Eoi,voi,woi,xoi,roi,Doi,Ooi,ipi,vsi,wsi,xsi,Dsi,Osi,ysi,$si,dsi,_si,gsi,hsi,Xsi,Nsi,Jsi,qsi,Vsi,msi,asi,osi,ssi,psi,Ioi,Yoi,Poi,Goi,tpi,npi,fpi,cpi,$pi,dpi,_pi,gpi,hpi,Epi,vpi,wpi,xpi,Dpi,Opi,ypi,Npi,Jpi,Upi,Bpi,Rwu,Ypi,Ppi,Gpi,Wpi,Api,jpi,...I7u,Nlt,Ult,Zlt,Flt,Qlt,Blt],Ilt=Est(),e7i=[...hFu,...Ilt],dF0=new Map(e7i.map((i)=>[i.name,i]))});import{z as vFu}from"zod";function gF0(i){return[{permissions:{self:["*"]},getTools:async()=>{let{ALL_TOOLS:t}=await Promise.resolve().then(() => (p7(),Hdi));return t.map((u)=>{return{name:u.name,inputSchema:vFu.toJSONSchema(u.inputSchema,{unrepresentable:"any"}),outputSchema:u.outputSchema?vFu.toJSONSchema(u.outputSchema,{unrepresentable:"any"}):void 0,description:u.description}})},data:ybi(bc(),i)},{data:Obi()},{data:Dbi(i)}]}async function wFu(i,t){try{let u=N0(),l=kt(),n=new mO(l.encryptionKey),f=new aC(u.db,n),c=gF0(i);await Promise.all(c.map(async($)=>{let d=null;if($.permissions)d=(await mn.api.createApiKey({body:{name:`${$.data.app_name??crypto.randomUUID()}-mcp`,userId:t,permissions:$.permissions,rateLimitEnabled:!1,metadata:{organization:{id:i},purpose:"default-org-connections"}}}))?.key;let _=await Lr({id:"pending",title:$.data.title,connection_type:$.data.connection_type,connection_url:$.data.connection_url,connection_token:$.data.connection_token??d,connection_headers:$.data.connection_headers}).catch(()=>null),g=await $.getTools?.()??_?.tools??null,h=_?.scopes?.length?_.scopes:null,E=$.data.id?$.data.id.startsWith(`${i}_`)?$.data.id:`${i}_${$.data.id}`:void 0;await f.create({...$.data,id:E,tools:g,configuration_scopes:h,organization_id:i,created_by:t,connection_token:$.data.connection_token??d})}));try{await Kei({orgId:i,createdBy:t})}catch($){console.error("Failed to enqueue studio pack install:",$)}if(l.aiGatewayEnabled&&l.studioProvisionSecretKey&&qC.provisionKey)try{let $=await Rr(t),d=await qC.provisionKey($,i);await new mC(u.db,n).upsert({providerId:"deco",label:"Auto-provisioned",apiKey:d,organizationId:i,createdBy:t})}catch($){console.error("Failed to auto-provision Deco AI Gateway key:",$)}}catch(u){console.error("Error creating default MCP connections:",u)}}var xFu=x(()=>{kl();Dei();Zd();z$();Kci();yei();Zei();sC();tn();ww();qci();sO()});async function rFu(i,t){let u=T_();if(!u)return t;let l=await N0().db.selectFrom("organization").select("slug").where("id","=",i).executeTakeFirst();if(!l?.slug)return t;return await EA({objectStorage:ih(u,i),baseUrl:bc(),orgSlug:l.slug,prefix:"org-logos"})(t)??t}var DFu=x(()=>{z$();G8();tli();Zd()});function hF0(i,t){let u=i.email.split("@")[1]?.toLowerCase()??null;return{distinctId:i.id,properties:{$set:{email:i.email,name:i.name,email_verified:i.emailVerified},$set_once:{first_seen_at:t.toISOString(),signup_email_domain:u}}}}function Ylt(i){Xu.identify(hF0(i,new Date))}var OFu=x(()=>{U1()});import{decodeJwt as EF0}from"jose";import{sql as Qm}from"kysely";async function xF0(i){let{user:t,token:u}=i;if(!u?.idToken)return;let l;try{l=EF0(u.idToken)}catch{return}let{preferred_username:n,upn:f}=l,c=[n,f].filter((_)=>typeof _==="string"&&_.length>0&&_.toLowerCase()!==t.email.toLowerCase()).map((_)=>_.toLowerCase());if(c.length===0)return;let{db:$}=N0(),d=await $.selectFrom("user").selectAll().where("email","in",c).where("id","!=",t.id).executeTakeFirst();if(!d)return;try{await $.transaction().execute(async(_)=>{await Qm`UPDATE "account" SET "userId" = ${d.id} WHERE "userId" = ${t.id}`.execute(_),await Qm`UPDATE "session" SET "userId" = ${d.id} WHERE "userId" = ${t.id}`.execute(_),await Qm`
         UPDATE "member" SET "userId" = ${d.id}
         WHERE "userId" = ${t.id}