decocms 4.125.0 → 4.125.1

package/dist/server/cli.js

@@ -174,7 +174,7 @@ Reference: https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-sso.ht
   Then retry.`);console.error(`[ensurePostgres] pg.initialise() failed. dataDir=${f}`,v);let D=Mw(i,"postgres");if(D&&mc(D.pid,"postgres"))return u.state="running",u.pid=D.pid,u.port=D.port,u.owner="managed",u;throw v}await w.start();try{await w.createDatabase(_bu)}catch(v){if(!(v instanceof Error?v.message:String(v)).includes("already exists"))throw v}await ZM(E);let h=null;if(L3(l)){let v=NM(l,"utf8").split(`
 `)[0]?.trim();if(v)h=Number.parseInt(v,10)}if(h)G1i(i,"postgres",{pid:h,port:E,startedAt:new Date().toISOString()}),u.pid=h;return u.state="running",u.owner="managed",u}async function rWt(i){let u=Mw(i,"postgres");if(u===null){console.log("PostgreSQL: not running");return}let{pid:t,port:f}=u;if(!R6(t)){console.log("PostgreSQL: process already dead, cleaning up state"),await Il(i,"postgres");return}if(!mc(t,"postgres")){console.log(`PostgreSQL: PID ${t} no longer belongs to postgres (possible PID reuse), cleaning up state`),await Il(i,"postgres");return}console.log(`PostgreSQL: stopping (PID ${t}, port ${f})...`);let l=L4(Q3(i),"postgres","data");try{await new(await import("embedded-postgres")).default({databaseDir:l,port:f,user:Tzi,password:Uzi,persistent:!0}).stop()}catch{console.log("PostgreSQL: embedded-postgres stop failed, sending SIGTERM...");try{if(!mc(t,"postgres"))console.log(`PostgreSQL: PID ${t} is no longer postgres, skipping signal`);else{process.kill(t,"SIGTERM");let E=Date.now();while(Date.now()-E<5000&&R6(t))await y0(200);if(R6(t)&&mc(t,"postgres"))process.kill(t,"SIGKILL")}}catch{}}await Il(i,"postgres"),console.log("PostgreSQL stopped")}function mWt(){let i=I1i(),u=gzi(),t={darwin:"darwin",linux:"linux",win32:"windows"},f={arm64:"arm64",x64:"amd64"},l=t[i],E=f[u];if(!l||!E)throw Error(`Unsupported platform: ${i}/${u}`);return`nats-server-${Nbu}-${l}-${E}.${l==="windows"?"zip":"tar.gz"}`}function eWt(i){return L4(Q3(i),"nats","bin",`nats-server${Pzi}`)}async function aWt(i){let u=eWt(i);if(L3(u))return u;let t=L4(Q3(i),"nats","bin");jD(t);let f=mWt(),l=`https://github.com/nats-io/nats-server/releases/download/${Nbu}/${f}`,E=await fetch(l);if(!E.ok)throw Error(`Failed to download NATS: ${E.status} ${E.statusText}`);let c=L4(t,f),w=await E.arrayBuffer();rS(c,Buffer.from(w));let $=L4(t,f.replace(/\.(zip|tar\.gz)$/,""));if(F5)await Bun.spawn(["powershell","-Command",`Expand-Archive -Path '${c}' -DestinationPath '${t}' -Force`]).exited;else await Bun.spawn(["tar","-xzf",c,"-C",t]).exited;if(!L3(u)){let h=L4($,`nats-server${Pzi}`);if(L3(h))vbu(h,u)}if(LWt($,{recursive:!0,force:!0}),await Dbu(c).catch(()=>{}),!F5)await dbu(u,493);if(!L3(u))throw Error(`NATS binary not found at ${u} after extraction`);return u}function BM(i){return L4(Q3(i),"nats","jwt")}function oWt(i){return L4(BM(i),"keys.json")}function cbu(i){return L4(BM(i),"nats-server.conf")}function sWt(i){return L4(BM(i),"cluster.creds")}function pWt(i){let u=oWt(i);if(L3(u))try{let f=JSON.parse(NM(u,"utf8"));if(D_u(f))return f}catch{}let t=d_u();return jD(BM(i)),rS(u,JSON.stringify(t,null,2),{mode:384}),t}function wbu(i,u,t){return{publicUrl:`nats://127.0.0.1:${u}`,accountJwt:i.tunnelAccountJwt,accountSigningKey:i.tunnelSigningSeed,operatorJwt:i.operatorJwt,credsPath:t}}async function iSt(i){let u={name:"NATS",state:"stopped",pid:null,port:0,owner:"none"},t=pWt(i),f=await __u(t),l=sWt(i),E=Zui()?"0.0.0.0":"127.0.0.1",c=Mw(i,"nats");if(c!==null)if(mc(c.pid,"nats-server")){if(E==="127.0.0.1")return u.state="running",u.pid=c.pid,u.port=c.port,u.owner="managed",{info:u,tunnel:wbu(f,c.port,l)};await Zbu(i)}else await Il(i,"nats");let w=await OM(),$=await OM();u.port=w;let h=await aWt(i),v=L4(Q3(i),"nats","data"),d=L4(Q3(i),"nats");jD(v),jD(BM(i)),rS(l,f.clusterCreds,{mode:384});let D=N_u({tcpPort:w,wsPort:$,storeDir:v,bindHost:E,artifacts:f});rS(cbu(i),D);let _=Bun.file(L4(d,"nats.log")),N=Bun.spawn([h,"-c",cbu(i)],{stdout:_,stderr:_});return G1i(i,"nats",{pid:N.pid,port:w,wsPort:$,startedAt:new Date().toISOString()}),await ZM(w),await ZM($),u.state="running",u.pid=N.pid,u.owner="managed",{info:u,tunnel:wbu(f,w,l)}}async function Zbu(i){let u=Mw(i,"nats");if(u===null){console.log("NATS: not running");return}let{pid:t}=u;if(!R6(t)){console.log("NATS: process already dead, cleaning up state"),await Il(i,"nats");return}if(!mc(t,"nats-server")){console.log(`NATS: PID ${t} no longer belongs to nats-server (possible PID reuse), cleaning up state`),await Il(i,"nats");return}if(console.log(`NATS: stopping (PID ${t})...`),F5)Bun.spawn(["taskkill","/PID",String(t)]);else process.kill(t,"SIGTERM");let f=Date.now();while(Date.now()-f<5000&&R6(t))await y0(200);if(R6(t)&&mc(t,"nats-server"))if(console.log("NATS: force killing..."),F5)Bun.spawn(["taskkill","/PID",String(t),"/F"]);else process.kill(t,"SIGKILL");await Il(i,"nats"),console.log("NATS stopped")}function Bbu(i,u){return i==="win32"?"minio.exe":"minio"}function Fbu(i,u){let t={darwin:"darwin",linux:"linux",win32:"windows"},f={arm64:"arm64",x64:"amd64"},l=t[i],E=f[u];if(!l||!E)throw Error(`Unsupported platform for MinIO: ${i}/${u}`);let c=Bbu(i,u);return`https://dl.min.io/server/minio/release/${l}-${E}/${c}`}function uSt(i){return i===void 0||i===""||i==="true"||i==="1"}function tSt(i){return L4(Q3(i),"minio","bin",`minio${Pzi}`)}async function fSt(i){let u=tSt(i);if(L3(u))return u;let t=L4(Q3(i),"minio","bin");jD(t);let f=Fbu(I1i(),gzi()),l=await fetch(f);if(!l.ok)throw Error(`Failed to download MinIO: ${l.status} ${l.statusText}`);let E=await l.arrayBuffer(),c=`${u}.download-${process.pid}`;if(rS(c,Buffer.from(E)),!F5)await dbu(c,493);if(vbu(c,u),!L3(u))throw Error(`MinIO binary not found at ${u} after download`);return u}async function lSt(i,u=30000){let t=`http://127.0.0.1:${i}/minio/health/ready`,f=Date.now();while(Date.now()-f<u){try{if((await fetch(t)).status===200)return}catch{}await y0(200).catch(()=>{})}throw Error(`Timed out waiting for MinIO readiness at ${t}`)}async function $bu(i){let{S3Client:u,CreateBucketCommand:t}=await Promise.resolve().then(() => (_M(),Ebu)),f=new u({endpoint:i,region:"auto",credentials:{accessKeyId:Azi,secretAccessKey:yzi},forcePathStyle:!0});try{await B1(()=>f.send(new t({Bucket:Obu})),{maxAttempts:5,minTimeout:200,maxTimeout:3000,isRetriable:(l)=>l instanceof Error&&/ECONNREFUSED|ECONNRESET|EPIPE|socket|fetch failed|timed out|network/i.test(`${l.name??""} ${l.message}`)})}catch(l){let E=l&&typeof l==="object"&&"name"in l?String(l.name):"";if(E!=="BucketAlreadyOwnedByUs"&&E!=="BucketAlreadyExists"&&!(l instanceof Error&&l.message.includes("already")))throw f.destroy(),l}f.destroy()}async function ESt(i){let u={name:"MinIO",state:"stopped",pid:null,port:0,owner:"none"},t=Mw(i,"minio");if(t!==null){if(mc(t.pid,"minio"))return u.state="running",u.pid=t.pid,u.port=t.port,u.owner="managed",await $bu(`http://127.0.0.1:${t.port}`),u;await Il(i,"minio")}let f=await OM();u.port=f;let l=await fSt(i),E=L4(Q3(i),"minio","data"),c=L4(Q3(i),"minio");jD(E);let w=Bun.file(L4(c,"minio.log")),$=Bun.spawn([l,"server",E,"--address",`:${f}`],{env:{...process.env,MINIO_ROOT_USER:Azi,MINIO_ROOT_PASSWORD:yzi},stdout:w,stderr:w});return G1i(i,"minio",{pid:$.pid,port:f,startedAt:new Date().toISOString()}),await lSt(f),await $bu(`http://127.0.0.1:${f}`),u.state="running",u.pid=$.pid,u.owner="managed",u}async function cSt(i){let u=Mw(i,"minio");if(u===null){console.log("MinIO: not running");return}let{pid:t}=u;if(!R6(t)){console.log("MinIO: process already dead, cleaning up state"),await Il(i,"minio");return}if(!mc(t,"minio")){console.log(`MinIO: PID ${t} no longer belongs to minio (possible PID reuse), cleaning up state`),await Il(i,"minio");return}if(console.log(`MinIO: stopping (PID ${t})...`),F5)Bun.spawn(["taskkill","/PID",String(t)]);else process.kill(t,"SIGTERM");let f=Date.now();while(Date.now()-f<5000&&R6(t))await y0(200);if(R6(t)&&mc(t,"minio"))if(console.log("MinIO: force killing..."),F5)Bun.spawn(["taskkill","/PID",String(t),"/F"]);else process.kill(t,"SIGKILL");await Il(i,"minio"),console.log("MinIO stopped")}function gbu(i){let u=i.hotReload===!0?["--hot"]:[],t=i.hotReload===!0?["--hot"]:[];return["bun",...u,"run","--cwd=apps/api","src/cli.ts","link",i.clusterUrl,"--port",String(i.port),"--no-tui",...t]}async function wSt(i){let u={name:"Link",state:"stopped",pid:null,port:0,owner:"none"},t=Mw(i.home,"link");if(t!==null){if(mc(t.pid,Fzi,"args"))return u.state="running",u.pid=t.pid,u.port=t.port,u.owner="managed",{info:u,proc:null};await Il(i.home,"link")}if(i.beforeSpawn)await i.beforeSpawn();let f=await OM();u.port=f;let l=Bun.spawn(gbu({clusterUrl:i.clusterUrl,port:f,hotReload:i.hotReload}),{cwd:i.repoRoot,env:{...process.env,STUDIO_CLUSTER_URL:i.clusterUrl,DATA_DIR:i.linkDataDir,DECOCMS_HOME:i.linkDataDir,DECOCMS_LINK_MANAGED:"1"},stdio:i.stdio??["inherit","inherit","inherit"]});G1i(i.home,"link",{pid:l.pid,port:f,startedAt:new Date().toISOString()}),i.onSpawn?.(l);try{await ZM(f)}catch(E){try{l.kill()}catch{}throw await Il(i.home,"link"),E}return u.state="running",u.pid=l.pid,u.owner="managed",{info:u,proc:l}}async function Tbu(i){let u=Mw(i,"link");if(u===null){console.log("Link: not running");return}let{pid:t}=u;if(!R6(t)){console.log("Link: process already dead, cleaning up state"),await Il(i,"link");return}if(!mc(t,Fzi,"args")){console.log(`Link: PID ${t} no longer belongs to the link daemon (possible PID reuse), cleaning up state`),await Il(i,"link");return}if(console.log(`Link: stopping (PID ${t})...`),F5)Bun.spawn(["taskkill","/PID",String(t)]);else process.kill(t,"SIGTERM");let f=Date.now();while(Date.now()-f<5000&&R6(t))await y0(200);if(R6(t)&&mc(t,Fzi,"args"))if(console.log("Link: force killing..."),F5)Bun.spawn(["taskkill","/PID",String(t),"/F"]);else process.kill(t,"SIGKILL");await Il(i,"link"),console.log("Link stopped")}function hbu(i){return hE(hSt,$St,i,2,0.5)}function dSt(i,u){if(u.aborted)return Promise.resolve();return new Promise((t)=>{let f=()=>{u.removeEventListener("abort",f),t()};u.addEventListener("abort",f,{once:!0}),i.exited.then(()=>{u.removeEventListener("abort",f),t()})})}async function DSt(i,u){while(!u.aborted&&R6(i))await y0(2000,{signal:u}).catch(()=>{})}async function _St(i){let u=0;while(!i.signal.aborted){let t=Date.now(),f;try{f=await wSt(i)}catch(w){if(i.onDown?.(),i.onLog?.(`[link] daemon failed to start: ${w instanceof Error?w.message:String(w)} \u2014 retrying`),i.signal.aborted)return;await y0(hbu(u++),{signal:i.signal}).catch(()=>{});continue}let l=new AbortController,E=()=>l.abort();if(i.signal.addEventListener("abort",E,{once:!0}),ZM(f.info.port,30000,l.signal).then(()=>{if(!l.signal.aborted)i.onReady?.(f.info.port)}).catch(()=>{}),f.proc)await dSt(f.proc,i.signal);else if(f.info.pid!==null)await DSt(f.info.pid,i.signal);if(l.abort(),i.signal.removeEventListener("abort",E),i.signal.aborted)return;i.onDown?.();let c=Date.now()-t;if(c>=vSt)u=0;i.onLog?.(`[link] daemon exited after ${Math.round(c/1000)}s \u2014 respawning`),await y0(hbu(u++),{signal:i.signal}).catch(()=>{})}}function Bzi(i,u){try{let t=new URL(i);return t.port?Number.parseInt(t.port,10):u}catch{return u}}async function NSt(i){jD(Q3(i.home));let u=i.externalDatabaseUrl!==null,t=i.externalNatsUrl!==null,f=Boolean(process.env.S3_ENDPOINT&&process.env.S3_BUCKET&&process.env.S3_ACCESS_KEY_ID&&process.env.S3_SECRET_ACCESS_KEY),l=i.skipMinio===!0||f,E=u?{name:"PostgreSQL",state:"external",pid:null,port:Bzi(i.externalDatabaseUrl,5432),owner:"external"}:await VWt(i.home),c=null,w;if(t)w={name:"NATS",state:"external",pid:null,port:Bzi(i.externalNatsUrl,4222),owner:"external"};else{let D=await iSt(i.home);if(w=D.info,c=D.tunnel,Zui()&&c){let _=await T_u({natsPort:w.port});c={...c,publicUrl:_.config.publicUrl},console.log(`[dev-nats-toxiproxy] daemon NATS routed through ${_.config.publicUrl} -> ${_.config.upstream} (admin ${_.config.apiUrl})`)}}let $=[E,w],h=null;if(f){$.push({name:"MinIO",state:"external",pid:null,port:Bzi(process.env.S3_ENDPOINT,bWt),owner:"external"});let D=uSt(process.env.S3_FORCE_PATH_STYLE);h={endpoint:process.env.S3_ENDPOINT,bucket:process.env.S3_BUCKET,accessKeyId:process.env.S3_ACCESS_KEY_ID,secretAccessKey:process.env.S3_SECRET_ACCESS_KEY,forcePathStyle:D}}else if(!l){let D=await ESt(i.home);$.push(D),h={endpoint:`http://127.0.0.1:${D.port}`,bucket:Obu,accessKeyId:Azi,secretAccessKey:yzi,forcePathStyle:!0}}if(h){if(process.env.S3_ENDPOINT=h.endpoint,process.env.S3_BUCKET=h.bucket,process.env.S3_ACCESS_KEY_ID=h.accessKeyId,process.env.S3_SECRET_ACCESS_KEY=h.secretAccessKey,h.forcePathStyle)process.env.S3_FORCE_PATH_STYLE="true"}if(c)process.env.NATS_PUBLIC_URL=c.publicUrl,process.env.NATS_ACCOUNT_JWT=c.accountJwt,process.env.NATS_ACCOUNT_SIGNING_KEY=c.accountSigningKey,process.env.NATS_OPERATOR_JWT=c.operatorJwt,process.env.NATS_TUNNEL_PUBLIC_ENABLED="true",process.env.NATS_CREDS=c.credsPath;let v=u?i.externalDatabaseUrl:qWt(E.port),d=t?i.externalNatsUrl:`nats://localhost:${w.port}`;return{services:$,outputs:{databaseUrl:v,natsUrls:[d],s3:h,natsTunnel:c}}}async function OSt(i){if(await Tbu(i),await rWt(i),await Zbu(i),await cSt(i),Zui())await U_u().catch(()=>{});console.log(`
 All managed services stopped.`)}async function ZSt(i){let u=[],t=Mw(i,"postgres");if(t!==null&&R6(t.pid))u.push({name:"PostgreSQL",state:"running",pid:t.pid,port:t.port,owner:"managed"});else{if(t!==null)await Il(i,"postgres");u.push({name:"PostgreSQL",state:"stopped",pid:null,port:0,owner:"none"})}let f=Mw(i,"nats");if(f!==null&&R6(f.pid))u.push({name:"NATS",state:"running",pid:f.pid,port:f.port,owner:"managed"});else{if(f!==null)await Il(i,"nats");u.push({name:"NATS",state:"stopped",pid:null,port:0,owner:"none"})}let l=Mw(i,"minio");if(l!==null&&R6(l.pid))u.push({name:"MinIO",state:"running",pid:l.pid,port:l.port,owner:"managed"});else{if(l!==null)await Il(i,"minio");u.push({name:"MinIO",state:"stopped",pid:null,port:0,owner:"none"})}let E=Mw(i,"link");if(E!==null&&R6(E.pid))u.push({name:"Link",state:"running",pid:E.pid,port:E.port,owner:"managed"});else{if(E!==null)await Il(i,"link");u.push({name:"Link",state:"stopped",pid:null,port:0,owner:"none"})}return u}function BSt(i){console.log("Service     State       PID    Port   Owner"),console.log("----------  ----------  -----  -----  ----------");for(let f of i){let l=f.name.padEnd(10),E=f.state.padEnd(10),c=(f.pid?.toString()??"-").padEnd(5),w=(f.port?String(f.port):"-").padEnd(5),$=f.owner;console.log(`${l}  ${E}  ${c}  ${w}  ${$}`)}}var Tzi="postgres",Uzi="postgres",_bu="postgres",Nbu="v2.14.2",Azi="minioadmin",yzi="minioadmin",Obu="studio-dev",bWt=9000,F5,Pzi,Fzi="cli.ts link",$St=500,hSt=30000,vSt=30000;var bZ=O(()=>{O4();O_u();A_u();F5=I1i()==="win32",Pzi=F5?".exe":""});var Abu={};ji(Abu,{servicesCommand:()=>FSt});function Ubu(i){if(!i)return null;try{let t=new URL(i).hostname;if(t==="localhost"||t==="127.0.0.1"||t==="::1")return null;return i}catch{return null}}async function FSt(i){let{subcommand:u,home:t}=i,{ensureServices:f,stopServices:l,getStatus:E,printTable:c}=await Promise.resolve().then(() => (bZ(),RZ));switch(u){case"up":{await f({home:t,externalDatabaseUrl:Ubu(process.env.DATABASE_URL),externalNatsUrl:Ubu(process.env.NATS_URL)});break}case"down":{await l(t);break}case"status":{let w=await E(t);c(w);break}default:console.error(`Unknown services subcommand: ${u}
-Usage: deco services <up|down|status>`),process.exit(1)}}import{homedir as gSt}from"os";function USt(i){let u=(i??"").trim();return TSt.has(u)?u:"all"}function ySt(i){let u=(i??"").trim();return ASt.has(u)?u:"development"}function Pbu(i,u,t){let f=i==="worker"?0:Math.floor(u*0.6);if(t===void 0||t==="")return f;let l=Number(t);return Number.isFinite(l)&&l>=0?l:f}function Ibu(i){if(!i)return"[settings] ENCRYPTION_KEY is not set (using deterministic fallback, 32 chars) \u2014 set ENCRYPTION_KEY for production";return`[settings] ENCRYPTION_KEY is set (${i.length<=8?"***":`${i.slice(0,4)}..${i.slice(-4)}`}, ${i.length} chars)`}function CZ(i){return i==="true"||i==="1"}function PSt(i){if(i===void 0||i==="")return;return CZ(i)}function FM(i,u,t){if(u===void 0||u==="")return t;let f=Number(u);if(!Number.isSafeInteger(f)||f<=0)throw Error(`${i} must be a positive integer`);return f}function ISt(i,u){if(u===void 0||u==="")return;let t=Number(u);if(!Number.isSafeInteger(t)||t<=0)throw Error(`${i} must be a positive integer`);return t}function GSt(i,u){if(i===void 0||i==="")return u;return i==="true"||i==="1"}function ybu(i){if(!i)return null;try{let t=new URL(i).hostname;if(t==="localhost"||t==="127.0.0.1"||t==="::1")return null;return i}catch{return null}}function kSt(i){let u=(i??"").trim(),t=u.length>0?u:"user-desktop";if(t==="cluster")return"agent-sandbox";if(!xSt.has(t))throw Error(`Unknown STUDIO_SANDBOX_PROVIDER="${i}" \u2014 expected "agent-sandbox", legacy "cluster", or "user-desktop".`);return t}function x1i(i,u){let t=i.home||u.DATA_DIR||u.DECOCMS_HOME||`${gSt()}/deco`,f=i.localMode,l=i.nodeEnv||ySt(u.NODE_ENV),E=u.NATS_URL||"nats://localhost:4222",c=PSt(u.NATS_TUNNEL_PUBLIC_ENABLED)??!!u.NATS_PUBLIC_URL;return{settings:{nodeEnv:l,port:FM("PORT",i.port||u.PORT,3000),baseUrl:i.baseUrl||u.BASE_URL,dataDir:t,databasePgSsl:CZ(u.DATABASE_PG_SSL),databasePoolMax:FM("DATABASE_POOL_MAX",u.DATABASE_POOL_MAX,5),betterAuthSecret:u.BETTER_AUTH_SECRET||"",encryptionKey:u.ENCRYPTION_KEY||"",studioJwtSecret:u.STUDIO_JWT_SECRET??u.MESH_JWT_SECRET,localMode:f,disableRateLimit:CZ(u.DISABLE_RATE_LIMIT),studioProvisionSecretKey:u.STUDIO_PROVISION_SECRET_KEY,deploymentAdminEmails:(u.DEPLOYMENT_ADMIN_EMAILS??"").split(",").map(($)=>$.trim().toLowerCase()).filter(Boolean),clickhouseUrl:u.CLICKHOUSE_URL,clickhouseMaxMemoryUsage:ISt("CLICKHOUSE_MAX_MEMORY_USAGE",u.CLICKHOUSE_MAX_MEMORY_USAGE),monitoringOtlpEndpoint:u.MONITORING_OTLP_ENDPOINT,otelServiceName:u.OTEL_SERVICE_NAME||"studio",natsPublicUrl:u.NATS_PUBLIC_URL,natsTunnelPublicEnabled:c,natsTunnelSessionTtlSeconds:FM("NATS_TUNNEL_SESSION_TTL_SECONDS",u.NATS_TUNNEL_SESSION_TTL_SECONDS,900),natsOperatorJwt:u.NATS_OPERATOR_JWT,natsAccountJwt:u.NATS_ACCOUNT_JWT,natsAccountSigningKey:u.NATS_ACCOUNT_SIGNING_KEY,natsCredsPath:u.NATS_CREDS,configPath:u.CONFIG_PATH||"./config.json",aiGatewayEnabled:CZ(u.DECO_AI_GATEWAY_ENABLED),aiGatewayUrl:u.DECO_AI_GATEWAY_URL||"https://ai-site.deco.site",aiGatewayAdminToken:u.DECO_AI_GATEWAY_ADMIN_TOKEN,seatAllowanceCents:FM("STUDIO_SEAT_ALLOWANCE_CENTS",u.STUDIO_SEAT_ALLOWANCE_CENTS,500),stripeWebhookSecret:u.STRIPE_WEBHOOK_SECRET,stripeSecretKey:u.STRIPE_SECRET_KEY,stripeSeatPriceId:u.STRIPE_SEAT_PRICE_ID,topupFeePercent:FM("STUDIO_TOPUP_FEE_PERCENT",u.STUDIO_TOPUP_FEE_PERCENT,15),enableDecoImport:CZ(u.ENABLE_DECO_IMPORT),billingEnforced:CZ(u.STUDIO_BILLING_ENFORCED),mcpCacheEnabled:GSt(u.MCP_CACHE_ENABLED,l!=="development"),orgFsPublicSetsJson:u.ORGFS_PUBLIC_SETS,orgFsMountsDisabled:CZ(u.DISABLE_ORGFS_MOUNTS),s3Endpoint:u.S3_ENDPOINT,s3Bucket:u.S3_BUCKET,s3Region:u.S3_REGION||"auto",s3AccessKeyId:u.S3_ACCESS_KEY_ID,s3SecretAccessKey:u.S3_SECRET_ACCESS_KEY,s3ForcePathStyle:u.S3_FORCE_PATH_STYLE===void 0||u.S3_FORCE_PATH_STYLE===""||u.S3_FORCE_PATH_STYLE==="true"||u.S3_FORCE_PATH_STYLE==="1",monitoringS3Bucket:u.MONITORING_S3_BUCKET,monitoringS3Endpoint:u.MONITORING_S3_ENDPOINT,monitoringS3Region:u.MONITORING_S3_REGION,monitoringS3AccessKeyId:u.MONITORING_S3_ACCESS_KEY_ID,monitoringS3SecretAccessKey:u.MONITORING_S3_SECRET_ACCESS_KEY,monitoringS3Prefix:u.MONITORING_S3_PREFIX,duckdbExtensionDirectory:u.DUCKDB_EXTENSION_DIRECTORY||"/opt/duckdb/extensions",duckdbMemoryLimit:u.DUCKDB_MEMORY_LIMIT||void 0,duckdbThreads:u.DUCKDB_THREADS?Number(u.DUCKDB_THREADS):void 0,isCli:!0,noTui:i.noTui===!0,podName:u.POD_NAME??crypto.randomUUID(),dispatchRole:USt(u.STUDIO_DISPATCH_ROLE??u.MESH_DISPATCH_ROLE),sandboxProviderKind:kSt(u.STUDIO_SANDBOX_PROVIDER),decoSupabaseUrl:u.DECO_SUPABASE_URL,decoSupabaseServiceKey:u.DECO_SUPABASE_SERVICE_KEY,firecrawlApiKey:u.FIRECRAWL_API_KEY,reportsInternalApiUrl:u.REPORTS_INTERNAL_API_URL??u.COMMERCE_DISCOVERY_INTERNAL_API_URL,reportsInternalApiKey:u.REPORTS_INTERNAL_API_KEY??u.COMMERCE_DISCOVERY_INTERNAL_API_KEY,s3TenantBucket:u.S3_TENANT_BUCKET||"new-deco-sites-assets",s3TenantRegion:u.S3_TENANT_REGION||"us-west-2",s3TenantEndpoint:u.S3_TENANT_ENDPOINT,s3TenantPublicUrlBase:u.S3_TENANT_PUBLIC_URL_BASE||"https://decoims.com",awsS3TenantRoleArn:u.AWS_S3_TENANT_ROLE_ARN,awsS3TenantProvisionerAccessKeyId:u.AWS_S3_TENANT_PROVISIONER_ACCESS_KEY_ID,awsS3TenantProvisionerSecretAccessKey:u.AWS_S3_TENANT_PROVISIONER_SECRET_ACCESS_KEY},externalDatabaseUrl:ybu(u.DATABASE_URL),externalNatsUrl:ybu(E),skipMigrations:i.skipMigrations}}var TSt,ASt,xSt;var k1i=O(()=>{TSt=new Set(["all","worker","api"]);ASt=new Set(["production","development","test"]);xSt=new Set(["agent-sandbox","user-desktop"])});function Gbu(i){gM=Object.freeze(i)}function hu(){if(!gM)jSt();return gM}function jSt(){if(gM)return;let i={...process.env},u=x1i({port:i.PORT||"3000",home:i.DATA_DIR||i.DECOCMS_HOME||"",localMode:i.DECOCMS_LOCAL_MODE==="true",skipMigrations:!0,noTui:i.DECO_NO_TUI==="true",vitePort:i.VITE_PORT,baseUrl:i.BASE_URL},i);gM=Object.freeze({...u.settings,databaseUrl:i.DATABASE_URL??"postgresql://postgres:postgres@localhost:5432/postgres",natsUrls:(i.NATS_URL||"nats://localhost:4222").split(",").map((t)=>t.trim()).filter(Boolean)})}var gM=null;var z0=O(()=>{k1i()});import{context as XSt,propagation as JSt,SpanKind as KSt,SpanStatusCode as Gzi}from"@opentelemetry/api";function WSt(i,u){let t=i instanceof Error?i.name:void 0;if(t==="TimeoutError")return"timeout";if(t==="AbortError")return"cancelled";if(u?.aborted)return"cancelled";return null}function SSt(i,u){if(u.startsWith("/_sandbox/")){if(i===404)return"daemon_gone";if(i===409)return"daemon_not_ready"}if(i===404&&u.includes("/sandboxclaims/"))return"claim_gone";return null}function LSt(i,u){if(i===404&&(u==="/.decofile"||u==="/live/_meta"||u==="/sprites.svg"))return"not_a_deco_site";return null}function QSt(i){if(!(i instanceof Error))return!1;if(i.message.includes("socket connection was closed"))return!0;let u=i.code;return u==="ECONNRESET"||u==="EPIPE"}async function HSt(i,u){let t,f;if(i instanceof Request)t=new URL(i.url),f=u?.method??i.method;else if(i instanceof URL)t=i,f=u?.method??"GET";else t=new URL(i),f=u?.method??"GET";let l=`${f} ${t.host}`;return h_.startActiveSpan(l,{kind:KSt.CLIENT,attributes:{"http.request.method":f,"url.full":t.href,"url.scheme":t.protocol.replace(":",""),"url.path":t.pathname,"url.query":t.search||void 0,"server.address":t.hostname,"server.port":t.port?Number(t.port):void 0}},async(E)=>{try{let c=new Headers(u?.headers??(i instanceof Request?i.headers:{}));JSt.inject(XSt.active(),c,{set:(D,_,N)=>D.set(_,N)});let w={...u,headers:c},$=await YSt(i,w);E.setAttribute("http.response.status_code",$.status);let h=$.status===405&&f==="GET"&&(c.get("accept")??"").includes("text/event-stream"),v=$.status>=400?SSt($.status,t.pathname):null,d=$.status>=400?LSt($.status,t.pathname):null;if($.status>=400&&!h&&!v&&!d)E.setStatus({code:Gzi.ERROR,message:`HTTP ${$.status}`});else{if(v)E.setAttribute("sandbox.lifecycle",v);if(d)E.setAttribute("preview.probe",d);E.setStatus({code:Gzi.OK})}return $}catch(c){let w=u?.signal??(i instanceof Request?i.signal:void 0),$=WSt(c,w??void 0);if($)E.setAttribute("abort.reason",$);else if(QSt(c)&&t.pathname.startsWith("/_sandbox/"))E.setAttribute("sandbox.lifecycle","connection_closed");else E.recordException(c),E.setStatus({code:Gzi.ERROR,message:c instanceof Error?c.message:"Fetch failed"});throw c}finally{E.end()}})}function xbu(){globalThis.fetch=HSt}var YSt;var kbu=O(()=>{X1();YSt=globalThis.fetch});import{join as kzi}from"path";function g5(){return kzi(hu().dataDir,"logs")}function mS(){return kzi(hu().dataDir,"traces")}function XD(){return kzi(hu().dataDir,"metrics")}function v_(i,u){let t=i[u];return t!=null?String(t):""}function TM(i,u){let t=i[u];return t!=null&&t!==""?String(t):null}function jbu(i){let{attributes:u}=i,t=u[Gf.IS_ERROR],f=u[Gf.DURATION_MS];return{v:1,id:i.id,type:v_(u,Gf.TYPE)||UM,organization_id:v_(u,Gf.ORGANIZATION_ID),connection_id:v_(u,Gf.CONNECTION_ID),connection_title:v_(u,Gf.CONNECTION_TITLE),tool_name:v_(u,Gf.TOOL_NAME),input:v_(u,Gf.INPUT),output:v_(u,Gf.OUTPUT),is_error:t===!0||t===1||t==="true"?1:0,error_message:TM(u,Gf.ERROR_MESSAGE),duration_ms:typeof f==="number"?f:Number(f)||0,timestamp:new Date(Number(i.timestampNano/1000000n)).toISOString(),user_id:TM(u,Gf.USER_ID),request_id:v_(u,Gf.REQUEST_ID),user_agent:TM(u,Gf.USER_AGENT),virtual_mcp_id:TM(u,Gf.VIRTUAL_MCP_ID),properties:TM(u,Gf.PROPERTIES)}}function X1i(i){return i[0]*1000+i[1]/1e6}function aS(i){return new Date(X1i(i)).toISOString()}var xzi="mcp.proxy.callTool",Gf,UM="tool_call",eS="llm_call",j1i="decopilot";var qw=O(()=>{z0();Gf={TYPE:"studio.monitoring.type",ORGANIZATION_ID:"studio.monitoring.organization_id",CONNECTION_ID:"studio.monitoring.connection_id",CONNECTION_TITLE:"studio.monitoring.connection_title",TOOL_NAME:"studio.monitoring.tool_name",INPUT:"studio.monitoring.input",OUTPUT:"studio.monitoring.output",IS_ERROR:"studio.monitoring.is_error",ERROR_MESSAGE:"studio.monitoring.error_message",DURATION_MS:"studio.monitoring.duration_ms",USER_ID:"studio.monitoring.user_id",REQUEST_ID:"studio.monitoring.request_id",USER_AGENT:"studio.monitoring.user_agent",VIRTUAL_MCP_ID:"studio.monitoring.virtual_mcp_id",PROPERTIES:"studio.monitoring.properties"}});import{ExportResultCode as J1i}from"@opentelemetry/core";import{mkdir as zSt,rename as nSt,writeFile as RSt}from"fs/promises";import{join as K1i}from"path";class MZ{bufferItems=[];bufferBytes=0;flushTimer=null;flushQueue=Promise.resolve();basePath;flushThreshold;maxBufferBytes;isShutdown=!1;knownDirs=new Set;partitionKey;constructor(i){this.basePath=i.basePath,this.flushThreshold=i.flushThreshold??1000,this.maxBufferBytes=i.maxBufferBytes??10485760,this.partitionKey=i.partitionKey;let u=i.flushIntervalMs??60000;if(u>0&&u<3600000){if(this.flushTimer=setInterval(()=>{this.flush().catch((t)=>{console.error("[NDJSONExporter] Timer flush failed:",t)})},u),this.flushTimer&&typeof this.flushTimer==="object"&&"unref"in this.flushTimer)this.flushTimer.unref()}}exportRows(i){if(this.isShutdown)return Promise.resolve({code:J1i.FAILED});for(let u of i){let t=JSON.stringify(u),f=this.partitionKey?this.partitionKey(u):"";this.bufferItems.push({partition:f,json:t}),this.bufferBytes+=Buffer.byteLength(t,"utf8")+1}if(this.bufferItems.length>=this.flushThreshold||this.bufferBytes>=this.maxBufferBytes)return this.flush().then(()=>({code:J1i.SUCCESS})).catch((u)=>{return console.error("[NDJSONExporter] Flush failed:",u),{code:J1i.FAILED}});return Promise.resolve({code:J1i.SUCCESS})}async shutdown(){if(this.isShutdown=!0,this.flushTimer)clearInterval(this.flushTimer),this.flushTimer=null;try{await this.flushQueue}catch{}if(this.bufferItems.length>0)await this.flush()}async forceFlush(){try{await this.flushQueue}catch{}if(this.bufferItems.length>0)await this.flush()}flush(){let u=this.flushQueue.catch(()=>{}).then(()=>this.doFlush());return this.flushQueue=u,u}async doFlush(){if(this.bufferItems.length===0)return;let i=this.bufferItems;this.bufferItems=[],this.bufferBytes=0;let u=new Map;for(let l of i){let E=u.get(l.partition);if(!E)E=[],u.set(l.partition,E);E.push(l.json)}let t=await Promise.allSettled(Array.from(u.entries()).map(([l,E])=>this.writeNDJSON(E,l).then(()=>l))),f=t.find((l)=>l.status==="rejected");if(f){let l=new Set;for(let c of t)if(c.status==="fulfilled")l.add(c.value);let E=i.filter((c)=>!l.has(c.partition));this.bufferItems=E.concat(this.bufferItems),this.bufferBytes=0;for(let c of this.bufferItems)this.bufferBytes+=Buffer.byteLength(c.json,"utf8")+1;throw f.reason}}async writeNDJSON(i,u){let t=new Date,f=[String(t.getUTCFullYear()),String(t.getUTCMonth()+1).padStart(2,"0"),String(t.getUTCDate()).padStart(2,"0"),String(t.getUTCHours()).padStart(2,"0")],l=u?K1i(this.basePath,u,...f):K1i(this.basePath,...f);if(!this.knownDirs.has(l))await zSt(l,{recursive:!0,mode:448}),this.knownDirs.add(l);let E=`${crypto.randomUUID()}.ndjson`,c=K1i(l,`.${E}.tmp`),w=K1i(l,E),$=i.join(`
+Usage: deco services <up|down|status>`),process.exit(1)}}import{homedir as gSt}from"os";function USt(i){let u=(i??"").trim();return TSt.has(u)?u:"all"}function ySt(i){let u=(i??"").trim();return ASt.has(u)?u:"development"}function Pbu(i,u,t){let f=i==="worker"?0:Math.floor(u*0.6);if(t===void 0||t==="")return f;let l=Number(t);return Number.isFinite(l)&&l>=0?l:f}function Ibu(i){if(!i)return"[settings] ENCRYPTION_KEY is not set (using deterministic fallback, 32 chars) \u2014 set ENCRYPTION_KEY for production";return`[settings] ENCRYPTION_KEY is set (${i.length<=8?"***":`${i.slice(0,4)}..${i.slice(-4)}`}, ${i.length} chars)`}function CZ(i){return i==="true"||i==="1"}function PSt(i){if(i===void 0||i==="")return;return CZ(i)}function FM(i,u,t){if(u===void 0||u==="")return t;let f=Number(u);if(!Number.isSafeInteger(f)||f<=0)throw Error(`${i} must be a positive integer`);return f}function ISt(i,u){if(u===void 0||u==="")return;let t=Number(u);if(!Number.isSafeInteger(t)||t<=0)throw Error(`${i} must be a positive integer`);return t}function GSt(i,u){if(i===void 0||i==="")return u;return i==="true"||i==="1"}function ybu(i){if(!i)return null;try{let t=new URL(i).hostname.replace(/^\[|\]$/g,"");if(t==="localhost"||t==="127.0.0.1"||t==="::1")return null;return i}catch{return null}}function kSt(i){let u=(i??"").trim(),t=u.length>0?u:"user-desktop";if(t==="cluster")return"agent-sandbox";if(!xSt.has(t))throw Error(`Unknown STUDIO_SANDBOX_PROVIDER="${i}" \u2014 expected "agent-sandbox", legacy "cluster", or "user-desktop".`);return t}function x1i(i,u){let t=i.home||u.DATA_DIR||u.DECOCMS_HOME||`${gSt()}/deco`,f=i.localMode,l=i.nodeEnv||ySt(u.NODE_ENV),E=u.NATS_URL||"nats://localhost:4222",c=PSt(u.NATS_TUNNEL_PUBLIC_ENABLED)??!!u.NATS_PUBLIC_URL;return{settings:{nodeEnv:l,port:FM("PORT",i.port||u.PORT,3000),baseUrl:i.baseUrl||u.BASE_URL,dataDir:t,databasePgSsl:CZ(u.DATABASE_PG_SSL),databasePoolMax:FM("DATABASE_POOL_MAX",u.DATABASE_POOL_MAX,5),betterAuthSecret:u.BETTER_AUTH_SECRET||"",encryptionKey:u.ENCRYPTION_KEY||"",studioJwtSecret:u.STUDIO_JWT_SECRET??u.MESH_JWT_SECRET,localMode:f,disableRateLimit:CZ(u.DISABLE_RATE_LIMIT),studioProvisionSecretKey:u.STUDIO_PROVISION_SECRET_KEY,deploymentAdminEmails:(u.DEPLOYMENT_ADMIN_EMAILS??"").split(",").map(($)=>$.trim().toLowerCase()).filter(Boolean),clickhouseUrl:u.CLICKHOUSE_URL,clickhouseMaxMemoryUsage:ISt("CLICKHOUSE_MAX_MEMORY_USAGE",u.CLICKHOUSE_MAX_MEMORY_USAGE),monitoringOtlpEndpoint:u.MONITORING_OTLP_ENDPOINT,otelServiceName:u.OTEL_SERVICE_NAME||"studio",natsPublicUrl:u.NATS_PUBLIC_URL,natsTunnelPublicEnabled:c,natsTunnelSessionTtlSeconds:FM("NATS_TUNNEL_SESSION_TTL_SECONDS",u.NATS_TUNNEL_SESSION_TTL_SECONDS,900),natsOperatorJwt:u.NATS_OPERATOR_JWT,natsAccountJwt:u.NATS_ACCOUNT_JWT,natsAccountSigningKey:u.NATS_ACCOUNT_SIGNING_KEY,natsCredsPath:u.NATS_CREDS,configPath:u.CONFIG_PATH||"./config.json",aiGatewayEnabled:CZ(u.DECO_AI_GATEWAY_ENABLED),aiGatewayUrl:u.DECO_AI_GATEWAY_URL||"https://ai-site.deco.site",aiGatewayAdminToken:u.DECO_AI_GATEWAY_ADMIN_TOKEN,seatAllowanceCents:FM("STUDIO_SEAT_ALLOWANCE_CENTS",u.STUDIO_SEAT_ALLOWANCE_CENTS,500),stripeWebhookSecret:u.STRIPE_WEBHOOK_SECRET,stripeSecretKey:u.STRIPE_SECRET_KEY,stripeSeatPriceId:u.STRIPE_SEAT_PRICE_ID,topupFeePercent:FM("STUDIO_TOPUP_FEE_PERCENT",u.STUDIO_TOPUP_FEE_PERCENT,15),enableDecoImport:CZ(u.ENABLE_DECO_IMPORT),billingEnforced:CZ(u.STUDIO_BILLING_ENFORCED),mcpCacheEnabled:GSt(u.MCP_CACHE_ENABLED,l!=="development"),orgFsPublicSetsJson:u.ORGFS_PUBLIC_SETS,orgFsMountsDisabled:CZ(u.DISABLE_ORGFS_MOUNTS),s3Endpoint:u.S3_ENDPOINT,s3Bucket:u.S3_BUCKET,s3Region:u.S3_REGION||"auto",s3AccessKeyId:u.S3_ACCESS_KEY_ID,s3SecretAccessKey:u.S3_SECRET_ACCESS_KEY,s3ForcePathStyle:u.S3_FORCE_PATH_STYLE===void 0||u.S3_FORCE_PATH_STYLE===""||u.S3_FORCE_PATH_STYLE==="true"||u.S3_FORCE_PATH_STYLE==="1",monitoringS3Bucket:u.MONITORING_S3_BUCKET,monitoringS3Endpoint:u.MONITORING_S3_ENDPOINT,monitoringS3Region:u.MONITORING_S3_REGION,monitoringS3AccessKeyId:u.MONITORING_S3_ACCESS_KEY_ID,monitoringS3SecretAccessKey:u.MONITORING_S3_SECRET_ACCESS_KEY,monitoringS3Prefix:u.MONITORING_S3_PREFIX,duckdbExtensionDirectory:u.DUCKDB_EXTENSION_DIRECTORY||"/opt/duckdb/extensions",duckdbMemoryLimit:u.DUCKDB_MEMORY_LIMIT||void 0,duckdbThreads:u.DUCKDB_THREADS?Number(u.DUCKDB_THREADS):void 0,isCli:!0,noTui:i.noTui===!0,podName:u.POD_NAME??crypto.randomUUID(),dispatchRole:USt(u.STUDIO_DISPATCH_ROLE??u.MESH_DISPATCH_ROLE),sandboxProviderKind:kSt(u.STUDIO_SANDBOX_PROVIDER),decoSupabaseUrl:u.DECO_SUPABASE_URL,decoSupabaseServiceKey:u.DECO_SUPABASE_SERVICE_KEY,firecrawlApiKey:u.FIRECRAWL_API_KEY,reportsInternalApiUrl:u.REPORTS_INTERNAL_API_URL??u.COMMERCE_DISCOVERY_INTERNAL_API_URL,reportsInternalApiKey:u.REPORTS_INTERNAL_API_KEY??u.COMMERCE_DISCOVERY_INTERNAL_API_KEY,s3TenantBucket:u.S3_TENANT_BUCKET||"new-deco-sites-assets",s3TenantRegion:u.S3_TENANT_REGION||"us-west-2",s3TenantEndpoint:u.S3_TENANT_ENDPOINT,s3TenantPublicUrlBase:u.S3_TENANT_PUBLIC_URL_BASE||"https://decoims.com",awsS3TenantRoleArn:u.AWS_S3_TENANT_ROLE_ARN,awsS3TenantProvisionerAccessKeyId:u.AWS_S3_TENANT_PROVISIONER_ACCESS_KEY_ID,awsS3TenantProvisionerSecretAccessKey:u.AWS_S3_TENANT_PROVISIONER_SECRET_ACCESS_KEY},externalDatabaseUrl:ybu(u.DATABASE_URL),externalNatsUrl:ybu(E),skipMigrations:i.skipMigrations}}var TSt,ASt,xSt;var k1i=O(()=>{TSt=new Set(["all","worker","api"]);ASt=new Set(["production","development","test"]);xSt=new Set(["agent-sandbox","user-desktop"])});function Gbu(i){gM=Object.freeze(i)}function hu(){if(!gM)jSt();return gM}function jSt(){if(gM)return;let i={...process.env},u=x1i({port:i.PORT||"3000",home:i.DATA_DIR||i.DECOCMS_HOME||"",localMode:i.DECOCMS_LOCAL_MODE==="true",skipMigrations:!0,noTui:i.DECO_NO_TUI==="true",vitePort:i.VITE_PORT,baseUrl:i.BASE_URL},i);gM=Object.freeze({...u.settings,databaseUrl:i.DATABASE_URL??"postgresql://postgres:postgres@localhost:5432/postgres",natsUrls:(i.NATS_URL||"nats://localhost:4222").split(",").map((t)=>t.trim()).filter(Boolean)})}var gM=null;var z0=O(()=>{k1i()});import{context as XSt,propagation as JSt,SpanKind as KSt,SpanStatusCode as Gzi}from"@opentelemetry/api";function WSt(i,u){let t=i instanceof Error?i.name:void 0;if(t==="TimeoutError")return"timeout";if(t==="AbortError")return"cancelled";if(u?.aborted)return"cancelled";return null}function SSt(i,u){if(u.startsWith("/_sandbox/")){if(i===404)return"daemon_gone";if(i===409)return"daemon_not_ready"}if(i===404&&u.includes("/sandboxclaims/"))return"claim_gone";return null}function LSt(i,u){if(i===404&&(u==="/.decofile"||u==="/live/_meta"||u==="/sprites.svg"))return"not_a_deco_site";return null}function QSt(i){if(!(i instanceof Error))return!1;if(i.message.includes("socket connection was closed"))return!0;let u=i.code;return u==="ECONNRESET"||u==="EPIPE"}async function HSt(i,u){let t,f;if(i instanceof Request)t=new URL(i.url),f=u?.method??i.method;else if(i instanceof URL)t=i,f=u?.method??"GET";else t=new URL(i),f=u?.method??"GET";let l=`${f} ${t.host}`;return h_.startActiveSpan(l,{kind:KSt.CLIENT,attributes:{"http.request.method":f,"url.full":t.href,"url.scheme":t.protocol.replace(":",""),"url.path":t.pathname,"url.query":t.search||void 0,"server.address":t.hostname,"server.port":t.port?Number(t.port):void 0}},async(E)=>{try{let c=new Headers(u?.headers??(i instanceof Request?i.headers:{}));JSt.inject(XSt.active(),c,{set:(D,_,N)=>D.set(_,N)});let w={...u,headers:c},$=await YSt(i,w);E.setAttribute("http.response.status_code",$.status);let h=$.status===405&&f==="GET"&&(c.get("accept")??"").includes("text/event-stream"),v=$.status>=400?SSt($.status,t.pathname):null,d=$.status>=400?LSt($.status,t.pathname):null;if($.status>=400&&!h&&!v&&!d)E.setStatus({code:Gzi.ERROR,message:`HTTP ${$.status}`});else{if(v)E.setAttribute("sandbox.lifecycle",v);if(d)E.setAttribute("preview.probe",d);E.setStatus({code:Gzi.OK})}return $}catch(c){let w=u?.signal??(i instanceof Request?i.signal:void 0),$=WSt(c,w??void 0);if($)E.setAttribute("abort.reason",$);else if(QSt(c)&&t.pathname.startsWith("/_sandbox/"))E.setAttribute("sandbox.lifecycle","connection_closed");else E.recordException(c),E.setStatus({code:Gzi.ERROR,message:c instanceof Error?c.message:"Fetch failed"});throw c}finally{E.end()}})}function xbu(){globalThis.fetch=HSt}var YSt;var kbu=O(()=>{X1();YSt=globalThis.fetch});import{join as kzi}from"path";function g5(){return kzi(hu().dataDir,"logs")}function mS(){return kzi(hu().dataDir,"traces")}function XD(){return kzi(hu().dataDir,"metrics")}function v_(i,u){let t=i[u];return t!=null?String(t):""}function TM(i,u){let t=i[u];return t!=null&&t!==""?String(t):null}function jbu(i){let{attributes:u}=i,t=u[Gf.IS_ERROR],f=u[Gf.DURATION_MS];return{v:1,id:i.id,type:v_(u,Gf.TYPE)||UM,organization_id:v_(u,Gf.ORGANIZATION_ID),connection_id:v_(u,Gf.CONNECTION_ID),connection_title:v_(u,Gf.CONNECTION_TITLE),tool_name:v_(u,Gf.TOOL_NAME),input:v_(u,Gf.INPUT),output:v_(u,Gf.OUTPUT),is_error:t===!0||t===1||t==="true"?1:0,error_message:TM(u,Gf.ERROR_MESSAGE),duration_ms:typeof f==="number"?f:Number(f)||0,timestamp:new Date(Number(i.timestampNano/1000000n)).toISOString(),user_id:TM(u,Gf.USER_ID),request_id:v_(u,Gf.REQUEST_ID),user_agent:TM(u,Gf.USER_AGENT),virtual_mcp_id:TM(u,Gf.VIRTUAL_MCP_ID),properties:TM(u,Gf.PROPERTIES)}}function X1i(i){return i[0]*1000+i[1]/1e6}function aS(i){return new Date(X1i(i)).toISOString()}var xzi="mcp.proxy.callTool",Gf,UM="tool_call",eS="llm_call",j1i="decopilot";var qw=O(()=>{z0();Gf={TYPE:"studio.monitoring.type",ORGANIZATION_ID:"studio.monitoring.organization_id",CONNECTION_ID:"studio.monitoring.connection_id",CONNECTION_TITLE:"studio.monitoring.connection_title",TOOL_NAME:"studio.monitoring.tool_name",INPUT:"studio.monitoring.input",OUTPUT:"studio.monitoring.output",IS_ERROR:"studio.monitoring.is_error",ERROR_MESSAGE:"studio.monitoring.error_message",DURATION_MS:"studio.monitoring.duration_ms",USER_ID:"studio.monitoring.user_id",REQUEST_ID:"studio.monitoring.request_id",USER_AGENT:"studio.monitoring.user_agent",VIRTUAL_MCP_ID:"studio.monitoring.virtual_mcp_id",PROPERTIES:"studio.monitoring.properties"}});import{ExportResultCode as J1i}from"@opentelemetry/core";import{mkdir as zSt,rename as nSt,writeFile as RSt}from"fs/promises";import{join as K1i}from"path";class MZ{bufferItems=[];bufferBytes=0;flushTimer=null;flushQueue=Promise.resolve();basePath;flushThreshold;maxBufferBytes;isShutdown=!1;knownDirs=new Set;partitionKey;constructor(i){this.basePath=i.basePath,this.flushThreshold=i.flushThreshold??1000,this.maxBufferBytes=i.maxBufferBytes??10485760,this.partitionKey=i.partitionKey;let u=i.flushIntervalMs??60000;if(u>0&&u<3600000){if(this.flushTimer=setInterval(()=>{this.flush().catch((t)=>{console.error("[NDJSONExporter] Timer flush failed:",t)})},u),this.flushTimer&&typeof this.flushTimer==="object"&&"unref"in this.flushTimer)this.flushTimer.unref()}}exportRows(i){if(this.isShutdown)return Promise.resolve({code:J1i.FAILED});for(let u of i){let t=JSON.stringify(u),f=this.partitionKey?this.partitionKey(u):"";this.bufferItems.push({partition:f,json:t}),this.bufferBytes+=Buffer.byteLength(t,"utf8")+1}if(this.bufferItems.length>=this.flushThreshold||this.bufferBytes>=this.maxBufferBytes)return this.flush().then(()=>({code:J1i.SUCCESS})).catch((u)=>{return console.error("[NDJSONExporter] Flush failed:",u),{code:J1i.FAILED}});return Promise.resolve({code:J1i.SUCCESS})}async shutdown(){if(this.isShutdown=!0,this.flushTimer)clearInterval(this.flushTimer),this.flushTimer=null;try{await this.flushQueue}catch{}if(this.bufferItems.length>0)await this.flush()}async forceFlush(){try{await this.flushQueue}catch{}if(this.bufferItems.length>0)await this.flush()}flush(){let u=this.flushQueue.catch(()=>{}).then(()=>this.doFlush());return this.flushQueue=u,u}async doFlush(){if(this.bufferItems.length===0)return;let i=this.bufferItems;this.bufferItems=[],this.bufferBytes=0;let u=new Map;for(let l of i){let E=u.get(l.partition);if(!E)E=[],u.set(l.partition,E);E.push(l.json)}let t=await Promise.allSettled(Array.from(u.entries()).map(([l,E])=>this.writeNDJSON(E,l).then(()=>l))),f=t.find((l)=>l.status==="rejected");if(f){let l=new Set;for(let c of t)if(c.status==="fulfilled")l.add(c.value);let E=i.filter((c)=>!l.has(c.partition));this.bufferItems=E.concat(this.bufferItems),this.bufferBytes=0;for(let c of this.bufferItems)this.bufferBytes+=Buffer.byteLength(c.json,"utf8")+1;throw f.reason}}async writeNDJSON(i,u){let t=new Date,f=[String(t.getUTCFullYear()),String(t.getUTCMonth()+1).padStart(2,"0"),String(t.getUTCDate()).padStart(2,"0"),String(t.getUTCHours()).padStart(2,"0")],l=u?K1i(this.basePath,u,...f):K1i(this.basePath,...f);if(!this.knownDirs.has(l))await zSt(l,{recursive:!0,mode:448}),this.knownDirs.add(l);let E=`${crypto.randomUUID()}.ndjson`,c=K1i(l,`.${E}.tmp`),w=K1i(l,E),$=i.join(`
 `)+`
 `;await RSt(c,$,{mode:384}),await nSt(c,w)}}var Y1i=()=>{};import{ExportResultCode as bSt}from"@opentelemetry/core";class jzi{inner;constructor(i){this.inner=new MZ({...i,partitionKey:(u)=>u.organization_id})}export(i,u){let t=[];for(let f of i){if(!CSt.has(f.attributes[Gf.TYPE]))continue;let l={};for(let[$,h]of Object.entries(f.attributes))if(typeof h==="string"||typeof h==="number"||typeof h==="boolean")l[$]=h;let E=f.spanContext?.spanId??crypto.randomUUID(),c=f.hrTime,w=BigInt(c[0])*1000000000n+BigInt(c[1]);t.push(jbu({id:E,timestampNano:w,attributes:l}))}this.inner.exportRows(t).then((f)=>u(f)).catch(()=>u({code:bSt.FAILED}))}async shutdown(){await this.inner.shutdown()}async forceFlush(){await this.inner.forceFlush()}}var CSt;var Xbu=O(()=>{qw();Y1i();CSt=new Set([UM,eS])});import{ExportResultCode as MSt}from"@opentelemetry/core";import{AggregationTemporality as qSt,DataPointType as Jbu}from"@opentelemetry/sdk-metrics";class Xzi{inner;constructor(i){this.inner=new MZ({...i,partitionKey:(u)=>u.organization_id})}selectAggregationTemporality(i){return qSt.DELTA}export(i,u){let t=[];for(let f of i.scopeMetrics)for(let l of f.metrics){let{descriptor:E,dataPointType:c}=l;if(c===Jbu.SUM)for(let w of l.dataPoints){let $=w.attributes;t.push({v:1,name:E.name,type:"sum",unit:E.unit,timestamp:aS(w.endTime),organization_id:String($["organization.id"]??""),connection_id:String($["connection.id"]??""),tool_name:String($["tool.name"]??""),status:String($.status??""),error_type:String($["error.type"]??""),value:w.value,hist_count:0,hist_sum:0,hist_min:0,hist_max:0,hist_boundaries:"[]",hist_bucket_counts:"[]"})}else if(c===Jbu.HISTOGRAM)for(let w of l.dataPoints){let{attributes:$,value:h}=w;t.push({v:1,name:E.name,type:"histogram",unit:E.unit,timestamp:aS(w.endTime),organization_id:String($["organization.id"]??""),connection_id:String($["connection.id"]??""),tool_name:String($["tool.name"]??""),status:String($.status??""),error_type:String($["error.type"]??""),value:h.count,hist_count:h.count,hist_sum:h.sum??0,hist_min:h.min??0,hist_max:h.max??0,hist_boundaries:JSON.stringify(h.buckets.boundaries),hist_bucket_counts:JSON.stringify(h.buckets.counts)})}}this.inner.exportRows(t).then((f)=>u(f)).catch(()=>u({code:MSt.FAILED}))}async shutdown(){await this.inner.shutdown()}async forceFlush(){await this.inner.forceFlush()}}var Kbu=O(()=>{qw();Y1i()});import{ExportResultCode as VSt}from"@opentelemetry/core";function rSt(i){let u=i.resource,t=u.attributes["service.name"]??"unknown";return{v:1,trace_id:i.spanContext().traceId,span_id:i.spanContext().spanId,parent_span_id:i.parentSpanContext?.spanId||null,name:i.name,kind:i.kind,status:i.status.code,status_message:i.status.message||null,start_time:aS(i.startTime),end_time:aS(i.endTime),duration_ms:X1i(i.endTime)-X1i(i.startTime),service_name:t,attributes:JSON.stringify(i.attributes),events:JSON.stringify(i.events),links:JSON.stringify(i.links),resource:JSON.stringify(u.attributes)}}class Jzi{inner;constructor(i){this.inner=new MZ(i)}export(i,u){let t=i.map(rSt);this.inner.exportRows(t).then((f)=>u(f)).catch(()=>u({code:VSt.FAILED}))}async shutdown(){await this.inner.shutdown()}async forceFlush(){await this.inner.forceFlush()}}var Ybu=O(()=>{qw();Y1i()});function oS(i,u=65536){if(i.length<=u&&Buffer.byteLength(i,"utf8")<=u)return i;let t=u-mSt;if(t<=0)return"... [TRUNCATED]".slice(0,u);let f=0,l=0;for(let E of i){let c=E.charCodeAt(0)<=127?1:Buffer.byteLength(E,"utf8");if(f+c>t)break;f+=c,l+=E.length}return i.slice(0,l)+"... [TRUNCATED]"}var mSt;var Kzi=O(()=>{mSt=Buffer.byteLength("... [TRUNCATED]","utf8")});import{NOOP_LOGGER as eSt}from"@opentelemetry/api-logs";function Sbu(i){Wbu=i.getLogger(aSt,oSt)}function Lbu(){return Wbu}var aSt="studio.monitoring",oSt="1.0.0",Wbu;var Yzi=O(()=>{Wbu=eSt});var zbu={};ji(zbu,{shouldSkipStudioContext:()=>Wzi,isServerPath:()=>pSt,isHealthPath:()=>AM,SYSTEM_PATHS:()=>BE});function AM(i){return i===BE.HEALTH||i===BE.HEALTH_LIVE||i===BE.HEALTH_READY}function Qbu(i){return i===BE.HEALTH||i===BE.HEALTH_LIVE||i===BE.HEALTH_READY||i===BE.METRICS||i.startsWith(qZ.WELL_KNOWN)||i.startsWith(BE.DBOS_QUEUE_DEPTH_PREFIX)||i===BE.HOSTED_RUN_PENDING}function Hbu(i){return i.startsWith(qZ.API)}function pSt(i){return Hbu(i)||i==="/mcp"||i.startsWith(qZ.MCP)||i.startsWith(qZ.OAUTH_PROXY)||i.startsWith(qZ.ORG)||i.startsWith(qZ.REPORT)||Qbu(i)}function Wzi(i){return i==="/"||i.startsWith(qZ.API_AUTH)||i==="/api/trigger-callback"||Qbu(i)||!Hbu(i)&&sSt.test(i)}var BE,qZ,sSt;var W1i=O(()=>{BE={HEALTH:"/health",HEALTH_LIVE:"/health/live",HEALTH_READY:"/health/ready",METRICS:"/metrics",DBOS_QUEUE_DEPTH_PREFIX:"/dbos-queue-depth/",HOSTED_RUN_PENDING:"/hosted-run-pending"},qZ={API:"/api/",API_AUTH:"/api/auth/",MCP:"/mcp/",OAUTH_PROXY:"/oauth-proxy/",WELL_KNOWN:"/.well-known",ORG:"/org/",REPORT:"/report/"},sSt=/\.(html|css|js|ico|svg|png|jpg|jpeg|gif|webp|woff|woff2)$/});import{SpanStatusCode as Szi}from"@opentelemetry/api";var iLt,uLt=()=>iLt??=At.createHistogram("http.server.request.duration",{description:"Duration of inbound HTTP requests handled by the API.",unit:"s",advice:{explicitBucketBoundaries:[0.005,0.01,0.025,0.05,0.075,0.1,0.25,0.5,0.75,1,2.5,5,7.5,10]}}),Lzi=async(i,u)=>{if(AM(i.req.path))return u();let t=i.req.raw,f=new URL(t.url),l=performance.now(),E=bbu(t),c=Qzi(t),w={"http.request.url":t.url,"http.request.method":t.method,"http.request.body.size":t.headers.get("content-length")??void 0,"url.scheme":f.protocol.replace(":",""),"server.address":f.host,"url.query":f.search||void 0,"url.path":f.pathname,"user_agent.original":t.headers.get("user-agent")??void 0,"request.internal":t.headers.has("traceparent"),...c?{"trace.debug.id":c}:{}};await h_.startActiveSpan(`${t.method} ${f.pathname}`,{attributes:w},E,async($)=>{i.set("rootSpan",$);try{await u()}catch(h){$.recordException(h),$.setStatus({code:Szi.ERROR});let v=typeof h==="object"&&h&&"message"in h?String(h.message):JSON.stringify(h);throw console.error("error: ",v,w),h}finally{let h=i.res?.status??500,v=h>=500;$.setStatus({code:v?Szi.ERROR:Szi.OK}),$.setAttribute("http.response.status_code",h);let d=i.get("studioContext");if(d){if(d.auth.user?.id)$.setAttribute("studio.user.id",d.auth.user.id);if(d.auth.apiKey?.id)$.setAttribute("studio.api_key.id",d.auth.apiKey.id);if(d.organization?.id)$.setAttribute("studio.organization.id",d.organization.id)}if(c)Rbu(i.res.headers,c);uLt().record((performance.now()-l)/1000,{"http.request.method":t.method,"http.route":i.req.routePath,"http.response.status_code":h}),$.end()}})};var nbu=O(()=>{X1();W1i()});import{createContextKey as tLt,metrics as ebu,propagation as fLt,ROOT_CONTEXT as lLt,SpanStatusCode as Cbu,trace as zzi}from"@opentelemetry/api";import{logs as abu,SeverityNumber as kM}from"@opentelemetry/api-logs";import{OTLPLogExporter as Mbu}from"@opentelemetry/exporter-logs-otlp-proto";import{PrometheusExporter as ELt}from"@opentelemetry/exporter-prometheus";import{OTLPTraceExporter as cLt}from"@opentelemetry/exporter-trace-otlp-proto";import{RuntimeNodeInstrumentation as wLt}from"@opentelemetry/instrumentation-runtime-node";import{BatchLogRecordProcessor as Hzi,LoggerProvider as qbu}from"@opentelemetry/sdk-logs";import{detectResources as $Lt,envDetector as hLt,hostDetector as vLt,osDetector as dLt,processDetector as DLt,resourceFromAttributes as Vbu}from"@opentelemetry/resources";import{PeriodicExportingMetricReader as _Lt}from"@opentelemetry/sdk-metrics";import{NodeSDK as NLt}from"@opentelemetry/sdk-node";import{BatchSpanProcessor as rbu,SamplingDecision as sS}from"@opentelemetry/sdk-trace-base";class sbu{inner;ratio;constructor(i,u){this.inner=i;this.ratio=u}onEmit(i,u){if(i.severityNumber!==void 0&&i.severityNumber>=kM.ERROR||Math.random()<this.ratio)this.inner.onEmit(i,u)}forceFlush(){return this.inner.forceFlush()}shutdown(){return this.inner.shutdown()}}class pbu{inner;maxBytes;constructor(i,u){this.inner=i;this.maxBytes=u}onEmit(i,u){let t=Gf.OUTPUT,f=i.attributes?.[t];if(typeof f==="string"&&f.length>this.maxBytes){let l=oS(f,this.maxBytes);this.inner.onEmit({...i,attributes:{...i.attributes,[t]:l}},u)}else this.inner.onEmit(i,u)}forceFlush(){return this.inner.forceFlush()}shutdown(){return this.inner.shutdown()}}class iCu{inner;constructor(i){this.inner=i}shouldSample(i,u,t,f,l,E){let c=i.getValue(obu);if(!c){if(this.inner)return this.inner.shouldSample(i,u,t,f,l,E);return{decision:sS.RECORD_AND_SAMPLED}}let w=Qzi(c);if(w)return{decision:sS.RECORD_AND_SAMPLED,attributes:{"trace.debug.id":w}};if(this.inner){let $=this.inner.shouldSample(i,u,t,f,l,E);if($.decision===sS.RECORD_AND_SAMPLED){let h=crypto.randomUUID();$.attributes={...$.attributes??{},"trace.debug.id":h}}return $}return{decision:sS.NOT_RECORD}}toString(){return"DebugSampler"}}class uCu{ratio;constructor(i){this.ratio=i}shouldSample(){if(Math.random()<this.ratio)return{decision:sS.RECORD_AND_SAMPLED};return{decision:sS.NOT_RECORD}}toString(){return`RatioSampler(${this.ratio})`}}function tCu(){if(mbu)return;let i=hu(),u=!!process.env.OTEL_EXPORTER_OTLP_ENDPOINT,t=u?new cLt:void 0;yM=i.nodeEnv==="test"?null:new jzi({basePath:g5()}),PM=i.nodeEnv==="test"?null:new Jzi({basePath:mS()}),IM=i.nodeEnv==="test"?null:new Xzi({basePath:XD()}),GM=IM?new _Lt({exporter:IM,exportIntervalMillis:60000}):null;let f=process.env.STUDIO_ENV??"production"??"unknown",l={};if(!process.env.OTEL_RESOURCE_ATTRIBUTES?.includes("deployment.environment"))l["deployment.environment"]=f;new NLt({serviceName:i.otelServiceName,resource:Vbu(l),metricReaders:[nzi,...GM?[GM]:[]],sampler:BLt,spanProcessors:[...t?[new rbu(t,{scheduledDelayMillis:60000,maxExportBatchSize:1000})]:[],...PM?[new rbu(PM,{scheduledDelayMillis:60000,maxExportBatchSize:250})]:[]],instrumentations:[new wLt]}).start(),At=ebu.getMeter("studio","1.0.0"),h_=zzi.getTracer("studio","1.0.0");let c=$Lt({detectors:[hLt,vLt,dLt,DLt]}).merge(Vbu({"service.name":i.otelServiceName,...l})),w=[];if(u){let d=f==="prod"||f==="production"?1:0.1,D=process.env.INFRA_LOG_SAMPLE_RATIO,_=d;if(D!==void 0){let N=Number(D);if(Number.isFinite(N)&&N>=0&&N<=1)_=N;else console.warn(`[observability] Ignoring invalid INFRA_LOG_SAMPLE_RATIO="${D}" (expected 0..1); using ${d}`)}w.push(new sbu(new Hzi(new Mbu),_))}xM=new qbu({resource:c,processors:w}),abu.setGlobalLoggerProvider(xM),fCu=xM.getLogger("studio","1.0.0");let $=i.monitoringOtlpEndpoint??process.env.OTEL_EXPORTER_OTLP_ENDPOINT,h=[];if($){let v=$.replace(/\/$/,""),d=v.endsWith("/v1/logs")?v:`${v}/v1/logs`;h.push(new pbu(new Hzi(new Mbu({url:d})),8000))}if(yM)h.push(new Hzi(yM,{scheduledDelayMillis:60000,maxExportBatchSize:250}));S1i=new qbu({resource:c,processors:h}),Sbu(S1i),xbu(),mbu=!0}async function fh(){let u=(await Promise.allSettled([xM?xM.forceFlush():Promise.resolve(),(async()=>{if(S1i)await S1i.forceFlush();if(yM)await yM.forceFlush()})(),(async()=>{let t=zzi.getTracerProvider();if("forceFlush"in t)await t.forceFlush();if(PM)await PM.forceFlush()})(),(async()=>{if(GM)await GM.forceFlush();if(IM)await IM.forceFlush()})()])).find((t)=>t.status==="rejected");if(u)throw u.reason}function Czi(i,u,t){return h_.startActiveSpan(i,{attributes:t},async(f)=>{try{let l=await u(f);return f.setStatus({code:Cbu.OK}),l}catch(l){let E=l instanceof Error?l:Error(String(l??"unknown"));throw f.setStatus({code:Cbu.ERROR,message:E.message}),f.recordException(E),l}finally{f.end()}})}var OLt="__d",obu,ZLt=1,Qzi=(i)=>{let t=new URL(i.url).searchParams.get(OLt);if(t==="")return crypto.randomUUID();if(!t)t=i.headers.get("x-trace-debug-id");return t},Rbu=(i,u)=>{try{i.set("x-trace-debug-id",u)}catch{}},nzi,BLt,yM=null,PM=null,IM=null,GM=null,xM=null,S1i=null,mbu=!1,h_,At,fCu,Rzi=(i,u,t)=>{let f={},l=t,E=t[t.length-1];if(E!==null&&typeof E==="object"&&!Array.isArray(E)&&!(E instanceof Error)&&Object.getPrototypeOf(E)===Object.prototype)f=E,l=t.slice(0,-1);let c=l.map((w)=>{if(w instanceof Error)return`${w.name}: ${w.message}`;if(typeof w==="object")try{return JSON.stringify(w)}catch{return"[Object]"}return String(w)}).join(" ");fCu.emit({severityNumber:i,severityText:u,body:c,attributes:{"log.source":"console",...f}})},bzi,bbu=(i)=>{return fLt.extract(lLt,i.headers,{get:(t,f)=>t.get(f)??void 0,keys:(t)=>[...t.keys()]}).setValue(obu,i)};var X1=O(()=>{kbu();Xbu();Kbu();Ybu();qw();Kzi();z0();Yzi();nbu();obu=tLt("Current request");nzi=new ELt({preventServerStart:!0}),BLt=new iCu(new uCu(ZLt));h_=zzi.getTracer("studio","1.0.0"),At=ebu.getMeter("studio","1.0.0"),fCu=abu.getLogger("studio","1.0.0"),bzi={error:console.error.bind(console),warn:console.warn.bind(console),debug:console.debug.bind(console)};console.error=(...i)=>{Rzi(kM.ERROR,"ERROR",i),bzi.error(...i)};console.warn=(...i)=>{Rzi(kM.WARN,"WARN",i),bzi.warn(...i)};console.debug=(...i)=>{Rzi(kM.DEBUG,"DEBUG",i),bzi.debug(...i)}});function VZ(){try{return process.memoryUsage()}catch{return null}}import{Session as FLt}from"inspector";function rZ(i,u){return new Promise((t,f)=>pS.post(i,u,(l,E)=>l?f(l):t(E??{})))}async function lCu(i){try{return pS=new FLt,pS.connect(),await rZ("Profiler.enable"),await rZ("Profiler.setSamplingInterval",{interval:i}),await rZ("Profiler.start"),uL=!0,!0}catch{return uL=!1,pS=null,!1}}function gLt(i,u){let{nodes:t,samples:f,timeDeltas:l}=i;if(!f?.length)return null;let E=new Map,c=new Map;for(let Z of t){E.set(Z.id,Z);for(let B of Z.children??[])c.set(B,Z.id)}let w=Math.max(1,u)*1000,$=0,h=new Map;for(let Z=f.length-1;Z>=0;Z--){$+=l[Z]??0;let B=f[Z];if(B!==void 0)h.set(B,(h.get(B)??0)+1);if($>=w)break}let v=-1,d=0;for(let[Z,B]of h)if(B>d)d=B,v=Z;if(v<0)return null;let D=[],_=new Set,N=v;while(N!=null&&!_.has(N)){_.add(N);let Z=E.get(N);if(!Z)break;let B=Z.callFrame,F=B.url?` ${B.url}:${B.lineNumber+1}`:"";D.push(`${B.functionName||"(anonymous)"}${F}`),N=c.get(N)}return D}async function ECu(i){if(!uL||!pS||iL)return null;iL=!0;try{let{profile:u}=await rZ("Profiler.stop"),t=u?gLt(u,i):null;return await rZ("Profiler.start"),t}catch{return uL=!1,null}finally{iL=!1}}async function cCu(){if(!uL||!pS||iL)return;iL=!0;try{await rZ("Profiler.stop"),await rZ("Profiler.start")}catch{uL=!1}finally{iL=!1}}var pS=null,uL=!1,iL=!1;var wCu=()=>{};function hCu(){if(Mzi)return;let i=performance.now()+qzi;Mzi=setInterval(()=>{let u=performance.now();$Cu=Math.max(0,u-i),i=u+qzi},qzi),Mzi.unref?.()}function vCu(){return hCu(),$Cu}function dCu(){if(hCu(),process.env.EVENT_LOOP_MONITOR!=="1")return()=>{};let i=Number(process.env.EVENT_LOOP_INTERVAL_MS??250),u=Number(process.env.EVENT_LOOP_SPIKE_MS??100),t=process.env.EVENT_LOOP_PROFILE==="1",f=Number(process.env.EVENT_LOOP_PROFILE_MS??1000),l=Number(process.env.EVENT_LOOP_PROFILE_INTERVAL_US??1e4),E=30000,c=performance.now();if(t)lCu(l).then((h)=>{console.warn(JSON.stringify({msg:"event-loop-profiler",status:h?"started":"unavailable",intervalUs:l}))});let w=At.createHistogram("eventloop.delay",{description:"Event-loop lag measured as timer scheduling drift",unit:"ms"}),$=performance.now()+i;return L1i=setInterval(()=>{let h=performance.now(),v=Math.max(0,h-$);if($=h+i,w.record(v),v>u){let d=VZ();console.warn(JSON.stringify({msg:"event-loop-stall",ts:new Date().toISOString(),lagMs:Math.round(v),rss:d?.rss,heapUsed:d?.heapUsed,heapTotal:d?.heapTotal,external:d?.external}))}if(t){if(v>f)ECu(Math.round(v)).then((d)=>{if(d?.length)console.warn(JSON.stringify({msg:"event-loop-stall-profile",ts:new Date().toISOString(),lagMs:Math.round(v),stack:d}))}),c=h;else if(h-c>E)cCu(),c=h}},i),L1i.unref?.(),()=>{if(L1i)clearInterval(L1i)}}var L1i,Mzi,$Cu=0,qzi=500;var Vzi=O(()=>{X1();wCu()});var gCu={};ji(gCu,{withSslmode:()=>rzi,getDbDialect:()=>XM,getDb:()=>m0,getDatabaseUrl:()=>d_,createDatabase:()=>FCu,closeDatabase:()=>D_});import{Kysely as TLt,PostgresDialect as NCu}from"kysely";import{Pool as OCu}from"pg";function PLt(i){let u=i.connect.bind(i);return i.connect=(t)=>{if(typeof t==="function")return u(t);let f=performance.now(),l=Q1i(),E=i.idleCount===0&&i.totalCount>=l,c=i.idleCount;return u().then((w)=>{let $=performance.now()-f;if(DCu().record($,{"db.pool.outcome":E?"contended":"available"}),$>ALt)if(E)console.error("Slow db pool acquire \u2014 pool saturated:",{waitMs:$,total:i.totalCount,idle:i.idleCount,waiting:i.waitingCount,max:l});else console.warn("Slow db pool acquire \u2014 event-loop lag (not pool):",{waitMs:$,idleAtStart:c,total:i.totalCount,max:l});return w},(w)=>{throw DCu().record(performance.now()-f,{"db.pool.outcome":"error"}),w})},i}function BCu(){try{return hu().databasePgSsl}catch{return!1}}function Q1i(){try{return hu().databasePoolMax}catch{return 10}}function ILt(i){let u=PLt(new OCu({connectionString:i,max:Q1i(),ssl:BCu(),...ZCu})),t=new NCu({pool:u});return{type:"postgres",db:new TLt({dialect:t,log:yLt(u)}),pool:u}}function d_(){return hu().databaseUrl}function rzi(i,u){if(!u)return i;let t=new URL(i);if(!t.searchParams.has("sslmode"))t.searchParams.set("sslmode","verify-full");return t.toString()}function XM(i){let u=i||d_();return new NCu({pool:new OCu({connectionString:u,max:Q1i(),ssl:BCu(),...ZCu})})}function FCu(i){let u=i||d_();return ILt(u)}async function D_(i){if(await i.db.destroy(),!i.pool.ended)await i.pool.end();if(i===jM)jM=null}function m0(){if(!jM)jM=FCu(d_());return jM}var ULt=()=>At.createHistogram("db.query.duration",{description:"Database query execution duration in milliseconds",unit:"ms"}),DCu=()=>At.createHistogram("db.pool.acquire.duration",{description:"Time spent waiting to acquire a connection from the pool",unit:"ms"}),_Cu=400,ALt=100,yLt=(i)=>(u)=>{let t={"db.statement":u.query.sql,"db.status":u.level==="error"?"error":"success"};if(u.queryDurationMillis>_Cu){let f=vCu(),l=f>_Cu/2;console.error(l?"Slow query measurement \u2014 likely event-loop lag, not slow SQL:":"Slow query detected:",{durationMs:u.queryDurationMillis,eventLoopLagMs:Math.round(f),sql:u.query.sql,pool:{total:i.totalCount,idle:i.idleCount,waiting:i.waitingCount,max:Q1i()}})}if(ULt().record(u.queryDurationMillis,t),u.level==="error")console.error("Query failed:",{durationMs:u.queryDurationMillis,error:u.error,sql:u.query.sql})},ZCu,jM=null;var b6=O(()=>{z0();X1();Vzi();ZCu={keepAlive:!0,keepAliveInitialDelayMillis:1e4,idleTimeoutMillis:300000,connectionTimeoutMillis:30000,allowExitOnIdle:!0}});function UCu(i){let{port:u,query:t}=i,{protocol:f,path:l,hostname:E}=i;if(f&&f.slice(-1)!==":")f+=":";if(u)E+=`:${u}`;if(l&&l.charAt(0)!=="/")l=`/${l}`;let c=t?TCu.buildQueryString(t):"";if(c&&c[0]!=="?")c=`?${c}`;let w="";if(i.username!=null||i.password!=null){let h=i.username??"",v=i.password??"";w=`${h}:${v}@`}let $="";if(i.fragment)$=`#${i.fragment}`;return`${f}//${w}${E}${l}${c}${$}`}var TCu;var ACu=O(()=>{TCu=j(xui(),1)});var yCu="UNSIGNED-PAYLOAD",PCu="X-Amz-Content-Sha256";class H1i{signer;constructor(i){let u={service:i.signingName||i.service||"s3",uriEscapePath:i.uriEscapePath||!1,applyChecksum:i.applyChecksum||!1,...i};this.signer=new ICu.SignatureV4MultiRegion(u)}presign(i,{unsignableHeaders:u=new Set,hoistableHeaders:t=new Set,unhoistableHeaders:f=new Set,...l}={}){return this.prepareRequest(i,{unsignableHeaders:u,unhoistableHeaders:f,hoistableHeaders:t}),this.signer.presign(i,{expiresIn:900,unsignableHeaders:u,unhoistableHeaders:f,...l})}presignWithCredentials(i,u,{unsignableHeaders:t=new Set,hoistableHeaders:f=new Set,unhoistableHeaders:l=new Set,...E}={}){return this.prepareRequest(i,{unsignableHeaders:t,unhoistableHeaders:l,hoistableHeaders:f}),this.signer.presignWithCredentials(i,u,{expiresIn:900,unsignableHeaders:t,unhoistableHeaders:l,...E})}prepareRequest(i,{unsignableHeaders:u=new Set,unhoistableHeaders:t=new Set,hoistableHeaders:f=new Set}={}){u.add("content-type"),Object.keys(i.headers).map((w)=>w.toLowerCase()).filter((w)=>w.startsWith("x-amz-server-side-encryption")).forEach((w)=>{if(!f.has(w))t.add(w)}),i.headers[PCu]=yCu;let l=i.headers.host,E=i.port,c=`${i.hostname}${i.port!=null?":"+E:""}`;if(!l||l===i.hostname&&i.port!=null)i.headers.host=c}}var ICu;var mzi=O(()=>{ICu=j(NS(),1)});var GCu,xCu,z1i=async(i,u,t={})=>{let f,l;if(typeof i.config.endpointProvider==="function"){let D=(await GCu.getEndpointFromInstructions(u.input,u.constructor,i.config)).properties?.authSchemes?.[0];if(D?.name==="sigv4a")l=D?.signingRegionSet?.join(",");else l=D?.signingRegion;f=new H1i({...i.config,signingName:D?.signingName,region:async()=>l})}else f=new H1i(i.config);let E=(d,D)=>async(_)=>{let{request:N}=_;if(!xCu.HttpRequest.isInstance(N))throw Error("Request to be presigned is not an valid HTTP request.");delete N.headers["amz-sdk-invocation-id"],delete N.headers["amz-sdk-request"],delete N.headers["x-amz-user-agent"];let Z,B={...t,signingRegion:t.signingRegion??D.signing_region??l,signingService:t.signingService??D.signing_service};if(D.s3ExpressIdentity)Z=await f.presignWithCredentials(N,D.s3ExpressIdentity,B);else Z=await f.presign(N,B);return{response:{},output:{$metadata:{httpStatusCode:200},presigned:Z}}},c="presignInterceptMiddleware",w=i.middlewareStack.clone();w.addRelativeTo(E,{name:c,relation:"before",toMiddleware:"awsAuthMiddleware",override:!0});let $=u.resolveMiddleware(w,i.config,{}),{output:h}=await $({input:u.input}),{presigned:v}=h;return UCu(v)};var kCu=O(()=>{ACu();mzi();GCu=j(Nu(),1),xCu=j(r4(),1)});var jCu=O(()=>{kCu();mzi()});import{extname as GLt}from"path";function cd(i){let u;try{u=decodeURIComponent(i)}catch{u=i}let f=u.replace(/\0/g,"").replace(/[\x00-\x1f\x7f]/g,"").replace(/\\/g,"/").split("/"),l=[];for(let E of f)if(E==="..")l.pop();else if(E!=="."&&E!=="")l.push(E);return l.join("/")}function __(i,u){let t=cd(u);if(!t)throw Error("Key is empty after sanitization");return`${i}/${t}`}function XCu(i,u){if(!u)return`${i}/`;let t=cd(u);return`${i}/${t}${t.endsWith("/")?"":"/"}`}function tL(i,u,t){let f=t.split("/").map(encodeURIComponent).join("/");return`${i}/api/${encodeURIComponent(u)}/files/${f}`}function ezi(i,u){let t=`${i}/`;if(u.startsWith(t))return u.slice(t.length);return u}function C6(i){let u=GLt(i).toLowerCase();return xLt[u]??"application/octet-stream"}function n1i(i){let u=i.split(";")[0].trim();if(kLt.has(u))return!0;if(u.startsWith("text/"))return!0;return!1}var xLt,kLt;var wd=O(()=>{xLt={".json":"application/json",".html":"text/html",".htm":"text/html",".css":"text/css",".js":"application/javascript",".mjs":"application/javascript",".ts":"text/typescript",".txt":"text/plain",".md":"text/markdown",".csv":"text/csv",".xml":"application/xml",".svg":"image/svg+xml",".png":"image/png",".jpg":"image/jpeg",".jpeg":"image/jpeg",".gif":"image/gif",".webp":"image/webp",".pdf":"application/pdf",".zip":"application/zip",".gz":"application/gzip",".tar":"application/x-tar",".wasm":"application/wasm",".yaml":"application/yaml",".yml":"application/yaml",".toml":"application/toml"};kLt=new Set(["application/json","text/html","text/css","application/javascript","text/typescript","text/plain","text/markdown","text/csv","application/xml","image/svg+xml","application/yaml","application/toml"])});class azi{client;bucket;constructor(i){this.bucket=i.bucket,this.client=new Ec({endpoint:i.endpoint,region:i.region,credentials:{accessKeyId:i.accessKeyId,secretAccessKey:i.secretAccessKey},forcePathStyle:i.forcePathStyle})}async getBytesOrPresign(i,u,t){let f=__(i,u),l=await this.client.send(new B5({Bucket:this.bucket,Key:f})),E=l.ContentLength??0,c=l.ContentType??C6(u);if(E>t.presignWhenLargerThan){let v=await z1i(this.client,new kD({Bucket:this.bucket,Key:f}),{expiresIn:t.presignExpiresIn??3600});return{error:"FILE_TOO_LARGE",size:E,maxInlineSize:t.presignWhenLargerThan,presignedUrl:v,contentType:c}}let $=await(await this.client.send(new kD({Bucket:this.bucket,Key:f}))).Body.transformToByteArray(),h=n1i(c);return{content:h?new TextDecoder().decode($):Buffer.from($).toString("base64"),contentType:c,encoding:h?"utf-8":"base64",size:E,lastModified:l.LastModified,etag:l.ETag}}async getBytes(i,u){let t=__(i,u);return(await this.client.send(new kD({Bucket:this.bucket,Key:t}))).Body.transformToByteArray()}async put(i,u,t,f){let l=__(i,u),E=f?.contentType??C6(u);return{etag:(await this.client.send(new Ed({Bucket:this.bucket,Key:l,Body:typeof t==="string"?Buffer.from(t,"utf-8"):t,ContentType:E}))).ETag,key:u}}async list(i,u){let t=XCu(i,u?.prefix),f=await this.client.send(new Cw({Bucket:this.bucket,Prefix:t,MaxKeys:u?.maxKeys??1000,ContinuationToken:u?.continuationToken,Delimiter:u?.delimiter})),l=f.CommonPrefixes?.map((E)=>ezi(i,E.Prefix??"")).filter(Boolean);return{objects:(f.Contents??[]).map((E)=>({key:ezi(i,E.Key??""),size:E.Size??0,lastModified:E.LastModified,etag:E.ETag})),isTruncated:f.IsTruncated??!1,nextContinuationToken:f.NextContinuationToken,commonPrefixes:l&&l.length>0?l:void 0}}async delete(i,u){let t=__(i,u);await this.client.send(new nS({Bucket:this.bucket,Key:t}))}async head(i,u){let t=__(i,u),f=await this.client.send(new B5({Bucket:this.bucket,Key:t}));return{contentType:f.ContentType??C6(u),size:f.ContentLength??0,lastModified:f.LastModified,etag:f.ETag}}async presignedGetUrl(i,u,t=3600,f){let l=__(i,u);return z1i(this.client,new kD({Bucket:this.bucket,Key:l}),{expiresIn:t})}async presignedPutUrl(i,u,t=3600,f){let l=__(i,u);return z1i(this.client,new Ed({Bucket:this.bucket,Key:l,ContentType:f}),{expiresIn:t})}}var JCu=O(()=>{_M();jCu();wd()});function jLt(){let i=hu();return!!(i.s3Endpoint&&i.s3Bucket&&i.s3AccessKeyId&&i.s3SecretAccessKey)}function ec(){if(JM!==void 0)return JM;if(!jLt())return JM=null,null;let i=hu();return JM=new azi({endpoint:i.s3Endpoint,bucket:i.s3Bucket,region:i.s3Region,accessKeyId:i.s3AccessKeyId,secretAccessKey:i.s3SecretAccessKey,forcePathStyle:i.s3ForcePathStyle}),JM}var JM;var N_=O(()=>{z0();JCu()});function Vw(i,u){return{getBytesOrPresign:(t,f)=>i.getBytesOrPresign(u,t,f),getBytes:(t)=>i.getBytes(u,t),put:(t,f,l)=>i.put(u,t,f,l),list:(t)=>i.list(u,t),delete:(t)=>i.delete(u,t),head:(t)=>i.head(u,t),presignedGetUrl:(t,f,l)=>i.presignedGetUrl(u,t,f,l),presignedPutUrl:(t,f,l)=>i.presignedPutUrl(u,t,f,l)}}import{createHash as XLt}from"crypto";function KCu(i){let u=i;while(u?.[R1i])u=u[R1i];return u}function YM(i){let{objectStorage:u,baseUrl:t,orgSlug:f,prefix:l="connection-icons",maxBytes:E=KLt,dryRun:c=!1}=i;return async(w)=>{if(typeof w!=="string")return w;let $=w.match(JLt);if(!$)return w;if(!u||!f)return w;let[,h,v]=$,d=h.toLowerCase(),D=WLt[d];if(!D)return w;if(Math.floor(v.length*3/4)>E)return console.warn(`[asset-hoister] asset exceeds ${E} bytes, keeping inline`),w;let _=Buffer.from(v,"base64"),N=XLt("sha256").update(_).digest("hex"),Z=`${l}/${N}.${D}`;if(c)return tL(t,f,Z);try{return await u.put(Z,_,{contentType:d}),tL(t,f,Z)}catch(B){return console.error("[asset-hoister] upload failed, keeping inline asset:",B),w}}}async function b1i(i,u,t=0){if(t>YLt)return i;if(typeof i==="string")return await u(i)??i;if(Array.isArray(i)){let f=await Promise.all(i.map((l)=>b1i(l,u,t+1)));return f.some((l,E)=>l!==i[E])?f:i}if(i!==null&&typeof i==="object"){let f=Object.entries(i),l=await Promise.all(f.map(([,w])=>b1i(w,u,t+1))),E=!1,c={};return f.forEach(([w,$],h)=>{if(c[w]=l[h],l[h]!==$)E=!0}),E?c:i}return i}function C1i(i,u){return b1i(i,u)}async function KM(i,u){let t={...i};if(typeof t.icon==="string")t.icon=await u(t.icon);if(t.metadata!==null&&typeof t.metadata==="object")t.metadata=await b1i(t.metadata,u);return t}function SLt(i,u){return new Proxy(i,{get(t,f,l){if(f===R1i)return t;if(f==="create")return async(c)=>t.create(await KM(c,u));if(f==="createNew")return async(c)=>t.createNew(await KM(c,u));if(f==="update")return async(c,w)=>t.update(c,await KM(w,u));let E=Reflect.get(t,f,l);return typeof E==="function"?E.bind(t):E}})}function LLt(i,u){return new Proxy(i,{get(t,f,l){if(f===R1i)return t;if(f==="create")return async(c,w,$,h)=>t.create(c,w,await KM($,u),h);if(f==="update")return async(c,w,$)=>t.update(c,w,await KM($,u));let E=Reflect.get(t,f,l);return typeof E==="function"?E.bind(t):E}})}function ozi(i,u){let t=YM(u);if(YCu(i.connections))i.connections=SLt(KCu(i.connections),t);if(YCu(i.virtualMcps))i.virtualMcps=LLt(KCu(i.virtualMcps),t)}function YCu(i){return i!==null&&typeof i==="object"}var JLt,KLt=5242880,YLt=64,R1i,WLt;var M1i=O(()=>{wd();JLt=/^data:((?:image|audio|video)\/[^;,]+)(?:;[^,]+)?;base64,(.+)$/is,R1i=Symbol("assetHoistingTarget"),WLt={"image/png":"png","image/jpeg":"jpg","image/gif":"gif","image/webp":"webp","image/x-icon":"ico","image/vnd.microsoft.icon":"ico","audio/mpeg":"mp3","audio/mp4":"m4a","audio/wav":"wav","audio/x-wav":"wav","audio/ogg":"ogg","audio/webm":"weba","audio/aac":"aac","video/mp4":"mp4","video/webm":"webm","video/ogg":"ogv","video/quicktime":"mov"}});function cl(){let i=hu();if(i.baseUrl)return i.baseUrl;return`http://localhost:${i.port??3000}`}function q1i(){return`http://localhost:${hu().port??3000}`}function FE(){return process.env.STUDIO_PUBLIC_URL??process.env.MESH_PUBLIC_URL??cl()}var Ml=O(()=>{z0()});var WCu={};ji(WCu,{backfillThreadAssetsCommand:()=>QLt});import{sql as szi}from"kysely";async function QLt(i){let{dryRun:u,batch:t}=i,f=i.baseUrl??cl(),l=ec();if(!l)return console.error("[backfill-assets] Object storage (S3) is not configured \u2014 cannot hoist "+"inline media. Set S3_ENDPOINT/S3_BUCKET/S3_ACCESS_KEY_ID/S3_SECRET_ACCESS_KEY and retry."),1;if(/^https?:\/\/localhost(:|\/|$)/.test(f))console.warn(`[backfill-assets] base URL resolves to "${f}" \u2014 set BASE_URL `+"(or pass --base-url) to the public origin, or stored media URLs will be wrong.");let E=m0(),{db:c}=E,w;if(i.org){let Z=await c.selectFrom("organization").select(["id","slug"]).where((B)=>B.or([B("id","=",i.org),B("slug","=",i.org)])).executeTakeFirst();if(!Z)return console.error(`[backfill-assets] org "${i.org}" not found (slug or id).`),await D_(E).catch(()=>{}),1;w=Z.id,console.log(`[backfill-assets] scoped to org ${Z.slug??Z.id} (${Z.id})`)}console.log(`[backfill-assets] starting${u?" (dry-run)":""} \u2014 target=${i.target} baseUrl=${f} batch=${t}${i.limit?` limit=${i.limit}`:""}`);let $=new Map,h=(Z,B,F)=>{let g=`${F}\x00${Z}`,T=$.get(g);if(T)return T;let U=YM({objectStorage:Vw(l,Z),baseUrl:f,orgSlug:B??void 0,prefix:F,dryRun:u});return $.set(g,U),U},v=async(Z,B,F,g)=>{let T="";for(;;){let U=i.limit?i.limit-F.scanned:1/0;if(U<=0)break;let A=await Z(T,Math.min(t,U));if(A.length===0)break;for(let I of A)T=I.id,F.scanned++,await B(I);console.log(`[backfill-assets] ${g}: scanned=${F.scanned} ${u?"would-change":"changed"}=${F.changed} errors=${F.errors} cursor=${T}`)}},d={scanned:0,changed:0,errors:0},D={scanned:0,changed:0,errors:0},_={scanned:0,changed:0,errors:0};try{if(i.target==="all"||i.target==="threads")await v((Z,B)=>c.selectFrom("thread_messages as tm").innerJoin("threads as t","t.id","tm.thread_id").innerJoin("organization as o","o.id","t.organization_id").select(["tm.id as id",szi`tm.parts`.as("parts"),szi`tm.metadata`.as("metadata"),"t.organization_id as orgId","o.slug as orgSlug"]).where("tm.id",">",Z).$if(!!w,(F)=>F.where("t.organization_id","=",w)).orderBy("tm.id","asc").limit(B).execute(),async(Z)=>{try{if(!WM(Z.parts)&&!WM(Z.metadata))return;let B=h(Z.orgId,Z.orgSlug,"thread-assets"),F=JSON.parse(Z.parts),g=await C1i(F,B),T=g!==F,U=Z.metadata!==null?JSON.parse(Z.metadata):null,A=await C1i(U,B),I=A!==U;if(!T&&!I)return;if(d.changed++,u)return;await c.updateTable("thread_messages").set({parts:T?JSON.stringify(g):Z.parts,metadata:I?JSON.stringify(A):Z.metadata}).where("id","=",Z.id).execute()}catch(B){d.errors++,console.error(`[backfill-assets] thread_message ${Z.id} failed, skipping:`,B)}},d,"threads");if(i.target==="all"||i.target==="connections")await v((Z,B)=>c.selectFrom("connections as c").innerJoin("organization as o","o.id","c.organization_id").select(["c.id as id","c.icon as icon",szi`c.metadata`.as("metadata"),"c.organization_id as orgId","o.slug as orgSlug"]).where("c.id",">",Z).$if(!!w,(F)=>F.where("c.organization_id","=",w)).orderBy("c.id","asc").limit(B).execute(),async(Z)=>{try{if(!WM(Z.icon)&&!WM(Z.metadata))return;let B=h(Z.orgId,Z.orgSlug,"connection-icons"),F=Z.icon!==null?await B(Z.icon):Z.icon,g=F!==Z.icon,T=Z.metadata!==null?JSON.parse(Z.metadata):null,U=await C1i(T,B),A=U!==T;if(!g&&!A)return;if(D.changed++,u)return;await c.updateTable("connections").set({icon:g?F??null:Z.icon,metadata:A?JSON.stringify(U):Z.metadata}).where("id","=",Z.id).execute()}catch(B){D.errors++,console.error(`[backfill-assets] connection ${Z.id} failed, skipping:`,B)}},D,"connections");if(i.target==="all"||i.target==="organizations")await v((Z,B)=>c.selectFrom("organization as o").select(["o.id as id","o.logo as logo","o.slug as orgSlug"]).where("o.id",">",Z).$if(!!w,(F)=>F.where("o.id","=",w)).orderBy("o.id","asc").limit(B).execute(),async(Z)=>{try{if(!WM(Z.logo))return;let F=await h(Z.id,Z.orgSlug,"org-logos")(Z.logo);if(F===Z.logo)return;if(_.changed++,u)return;await c.updateTable("organization").set({logo:F??null}).where("id","=",Z.id).execute()}catch(B){_.errors++,console.error(`[backfill-assets] organization ${Z.id} failed, skipping:`,B)}},_,"organizations")}finally{await D_(E).catch(()=>{})}let N=u?"would-change":"changed";return console.log("[backfill-assets] done \u2014 "+`threads(scanned=${d.scanned} ${N}=${d.changed} errors=${d.errors}) connections(scanned=${D.scanned} ${N}=${D.changed} errors=${D.errors}) organizations(scanned=${_.scanned} ${N}=${_.changed} errors=${_.errors})`),d.errors+D.errors+_.errors>0?1:0}var WM=(i)=>i!==null&&(i.includes("data:image/")||i.includes("data:audio/")||i.includes("data:video/"));var SCu=O(()=>{b6();N_();M1i();Ml()});async function LCu(i){let u,t,f=new Promise((c,w)=>{u=c,t=w});f.catch(()=>{});let l=!1,E=Bun.serve({port:i.port??0,hostname:"127.0.0.1",fetch(c){if(l)return new Response("",{status:204});let w=new URL(c.url),$=w.searchParams.get("code");if(w.searchParams.get("state")!==i.expectedState)return l=!0,t(Error("OAuth state mismatch")),new Response("State mismatch \u2014 close this tab.",{status:400});if(!$)return l=!0,t(Error("OAuth callback missing code")),new Response("Missing code \u2014 close this tab.",{status:400});return l=!0,u({code:$}),new Response(null,{status:302,headers:{location:i.successRedirectUrl}})}});return{url:`http://127.0.0.1:${E.port}`,waitForCallback:()=>f,close:()=>E.stop(!0)}}import{createHash as HLt,randomBytes as zLt}from"crypto";function HCu(){let i=QCu(zLt(32)),u=QCu(HLt("sha256").update(i).digest());return{verifier:i,challenge:u}}function QCu(i){return i.toString("base64").replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}var zCu=()=>{};import{chmod as nLt,mkdir as RLt,readdir as bLt,readFile as CLt,rename as MLt,rm as nCu,writeFile as qLt}from"fs/promises";import{dirname as VLt,join as ini}from"path";function V1i(i,u){if(!u)return ini(i,"session.json");return ini(i,`session.${rLt(u)}.json`)}function rLt(i){let u=i;try{u=new URL(i).host}catch{}return u.replace(/[^a-zA-Z0-9.-]/g,"_")||"default"}async function pzi(i){try{let u=await CLt(i,"utf8"),t=JSON.parse(u);if(!mLt(t))return null;return t}catch{return null}}async function RCu(i){try{return(await bLt(i)).filter((t)=>/^session(\..+)?\.json$/.test(t)).map((t)=>ini(i,t))}catch{return[]}}async function r1i(i,u){let t=await pzi(V1i(i,u));if(t)return t;if(u)return pzi(V1i(i));for(let f of await RCu(i)){let l=await pzi(f);if(l)return l}return null}async function fL(i,u){let t=V1i(i,u.target);await RLt(VLt(t),{recursive:!0});let f=`${t}.tmp`;await qLt(f,JSON.stringify(u,null,2),{mode:384}),await nLt(f,384),await MLt(f,t)}async function bCu(i,u){if(u){await nCu(V1i(i,u),{force:!0});return}for(let t of await RCu(i))await nCu(t,{force:!0})}function mLt(i){if(!i||typeof i!=="object")return!1;let u=i;if(typeof u.target!=="string"||typeof u.clientId!=="string"||typeof u.accessToken!=="string"||typeof u.createdAt!=="string")return!1;if(!u.user||typeof u.user!=="object")return!1;if(typeof u.user.sub!=="string")return!1;return!0}var SM=()=>{};var CCu={};ji(CCu,{performInteractiveLogin:()=>m1i,loginCommand:()=>pLt});import{spawn as eLt}from"child_process";import{randomUUID as aLt}from"crypto";async function m1i(i={}){let u=(i.target??oLt).replace(/\/$/,""),t=i.fetch??fetch,f=i.openBrowser??fQt,l=aLt(),E=HCu(),c=await LCu({expectedState:l,successRedirectUrl:`${u}/cli/auth-success`});try{let w=`${c.url}/`,$=await iQt(t,u,w),h=new URLSearchParams({client_id:$,redirect_uri:w,response_type:"code",state:l,scope:sLt,code_challenge:E.challenge,code_challenge_method:"S256"}),v=`${u}/login?${h.toString()}`;console.log(`Opening ${v} in your browser...`),await f(v);let{code:d}=await c.waitForCallback(),D=await uQt(t,u,$,d,w,E.verifier);if(!D.id_token)throw Error("Token endpoint returned no id_token");let _=tQt(D.id_token);return{target:u,clientId:$,user:{sub:_.sub,email:_.email,name:_.name},accessToken:D.access_token,refreshToken:D.refresh_token,expiresAt:D.expires_in?Math.floor(Date.now()/1000)+D.expires_in:void 0,createdAt:new Date().toISOString()}}finally{c.close()}}async function pLt(i){try{let u=await m1i({target:i.target,openBrowser:i.openBrowser,fetch:i.fetch});return await fL(i.dataDir,u),console.log(`Logged in as ${u.user.email??u.user.sub}.`),0}catch(u){return console.error(`Login failed: ${u instanceof Error?u.message:String(u)}`),1}}async function iQt(i,u,t){let f=await i(`${u}/api/auth/mcp/register`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({client_name:"decocms-cli",redirect_uris:[t],grant_types:["authorization_code","refresh_token"],response_types:["code"],token_endpoint_auth_method:"none",application_type:"native"})});if(!f.ok)throw Error(`Client registration failed: HTTP ${f.status} ${await f.text().catch(()=>"")}`);let l=await f.json();if(typeof l?.client_id!=="string")throw Error("Client registration returned no client_id");return l.client_id}async function uQt(i,u,t,f,l,E){let c=new URLSearchParams({grant_type:"authorization_code",code:f,redirect_uri:l,client_id:t,code_verifier:E}),w=await i(`${u}/api/auth/mcp/token`,{method:"POST",headers:{"content-type":"application/x-www-form-urlencoded"},body:c.toString()});if(!w.ok)throw Error(`Token exchange failed: HTTP ${w.status} ${await w.text().catch(()=>"")}`);let $=await w.json();if(typeof $?.access_token!=="string")throw Error("Token endpoint returned no access_token");return $}function tQt(i){let u=i.split(".");if(u.length!==3||!u[1])throw Error("id_token is not a valid JWT");let t=JSON.parse(Buffer.from(u[1],"base64url").toString("utf8"));if(typeof t.sub!=="string")throw Error("id_token has no sub claim");return{sub:t.sub,email:typeof t.email==="string"?t.email:void 0,name:typeof t.name==="string"?t.name:void 0}}async function fQt(i){let u,t;switch(process.platform){case"darwin":u="open",t=[i];break;case"win32":u="cmd",t=["/c","start","",i];break;default:u="xdg-open",t=[i];break}await new Promise((f)=>{let l=eLt(u,t,{stdio:"ignore",detached:!0});l.on("error",()=>{console.log(`Could not open browser automatically. Please open this URL manually:
   ${i}`),f()}),l.on("spawn",()=>{l.unref(),f()})})}var oLt="https://studio.decocms.com",sLt="openid profile email offline_access";var uni=O(()=>{zCu();SM()});async function MCu(i,u=fetch,t=Date.now){if(!i.refreshToken)throw new lh("invalid_grant","Session has no refresh token");let f=new URLSearchParams({grant_type:"refresh_token",refresh_token:i.refreshToken,client_id:i.clientId}),l;try{l=await u(`${i.target}/api/auth/mcp/token`,{method:"POST",headers:{"content-type":"application/x-www-form-urlencoded"},body:f.toString()})}catch(c){throw new lh("transient",c instanceof Error?c.message:String(c))}if(!l.ok){let c=await l.text().catch(()=>"");if(l.status>=400&&l.status<500)throw new lh("invalid_grant",`HTTP ${l.status} ${c}`);throw new lh("transient",`HTTP ${l.status} ${c}`)}let E=await l.json();if(typeof E.access_token!=="string")throw new lh("transient","Token endpoint returned no access_token");return{...i,accessToken:E.access_token,refreshToken:E.refresh_token??i.refreshToken,expiresAt:E.expires_in?Math.floor(t()/1000)+E.expires_in:i.expiresAt}}var lh;var e1i=O(()=>{lh=class lh extends Error{kind;constructor(i,u){super(u);this.name="RefreshFailedError",this.kind=i}}});async function O_(i){let u=await r1i(i.dataDir,i.target);if(!u)return null;let t=i.now??Date.now;if(!EQt(u,t()))return u;try{let f=await MCu(u,i.fetch,t);return await fL(i.dataDir,f),f}catch(f){if(f instanceof lh&&f.kind==="invalid_grant")return null;throw f}}function EQt(i,u){if(i.expiresAt===void 0)return!1;let t=Math.floor(u/1000);return i.expiresAt-lQt<t}var lQt=60;var LM=O(()=>{e1i();SM()});var qCu={};ji(qCu,{whoamiCommand:()=>cQt});async function cQt(i){let u;try{u=await O_({dataDir:i.dataDir,fetch:i.fetch,now:i.now})}catch(t){if(t instanceof lh&&t.kind==="transient")return console.error(`Could not refresh session: ${t.message}. Run \`decocms auth login\` to authenticate.`),1;throw t}if(!u)return console.error("Not logged in. Run `decocms auth login` to authenticate."),1;return console.log(`Target: ${u.target}`),console.log(`User:   ${u.user.email??u.user.sub}`),0}var VCu=O(()=>{LM();e1i()});var rCu={};ji(rCu,{logoutCommand:()=>wQt});async function wQt(i){if(!await r1i(i.dataDir))return console.log("Already logged out."),0;return await bCu(i.dataDir),console.log("Logged out."),0}var mCu=O(()=>{SM()});async function a1i(i){let u=i.isInteractive??Boolean(process.stdout.isTTY),t;try{t=await O_({dataDir:i.dataDir,target:i.target,fetch:i.fetch,now:i.now})}catch(l){if(l instanceof lh&&l.kind==="transient")throw Error(`Could not refresh session: ${l.message}. Run \`decocms auth login\` to sign in again.`);throw l}if(t&&i.target&&u&&!$Qt(t.target,i.target))t=null;if(t)return t;if(!u)throw Error("No session found. Run `decocms auth login` first, then re-run the command.");console.log(`Not logged in \u2014 opening browser to sign in to ${i.intent}.`);let f=await m1i({target:i.target,openBrowser:i.openBrowser,fetch:i.fetch});return await fL(i.dataDir,f),console.log(`Logged in as ${f.user.email??f.user.sub}.`),f}function $Qt(i,u){try{return new URL(i).host===new URL(u).host}catch{return i===u}}var tni=O(()=>{uni();LM();e1i();SM()});function T5(i){let u=i?.userName?.trim();if(!u||eCu.test(u))return null;let t=i?.userEmail?.trim();if(!t||eCu.test(t))return{userName:u};if(!hQt.test(t))return{userName:u};return{userName:u,userEmail:t}}var eCu,hQt;var o1i=O(()=>{eCu=/[\r\n<>]/,hQt=/^[^\s@<>]+@[^\s@<>]+\.[^\s@<>]+$/});var QM=O(()=>{O4();o1i()});async function p1i(i){try{let u=await fetch(`${i}/health`,{signal:AbortSignal.timeout(vQt)});if(!u.ok)return null;let t=await u.json();if(typeof t==="object"&&t!==null&&typeof t.bootId==="string"&&typeof t.ready==="boolean"&&t.setup&&typeof t.setup.running==="boolean"&&typeof t.setup.done==="boolean")return t;return null}catch{return null}}async function ili(i){for(let u=0;u<aCu;u++){if(await p1i(i)!==null)return;let t=(Math.random()*2-1)*dQt;await y0(oCu+t)}throw Error(`sandbox daemon at ${i} did not respond on /health within ${aCu*oCu/1000}s`)}async function Z_(i,u,t,f,l){return DQt(i,u,"POST",t,f,l)}async function DQt(i,u,t,f,l,E){let c={...f};if(l&&l.rotateToken!==void 0)c.auth=l;let w=await fetch(`${i}/_sandbox/config`,{method:t,headers:{"Content-Type":"application/json",Authorization:`Bearer ${u}`},body:JSON.stringify(c),signal:AbortSignal.timeout(E?.timeoutMs??sCu)}),$=await w.text();if(!w.ok)throw new s1i(w.status,$);return JSON.parse($)}async function pCu(i,u,t){let f=await fetch(`${i}/_sandbox/orgfs-config`,{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${u}`},body:t,signal:AbortSignal.timeout(sCu)}),l=await f.text();if(!f.ok)throw Error(`sandbox daemon /_sandbox/orgfs-config returned ${f.status}: ${l}`);return JSON.parse(l)}async function HM(i,u,t,f){let l=new Headers(f.headers);for(let w of _Qt)l.delete(w);l.set("authorization",`Bearer ${u}`);let E=f.method!=="GET"&&f.method!=="HEAD",c=`${i}${t.startsWith("/")?t:`/${t}`}`;return fetch(c,{method:f.method,headers:l,body:E?f.body:void 0,redirect:"manual",signal:f.signal,duplex:E?"half":void 0})}var s1i,vQt=500,sCu=30000,aCu=25,oCu=200,dQt=50,_Qt;var fni=O(()=>{QM();s1i=class s1i extends Error{status;constructor(i,u){super(`sandbox daemon /_sandbox/config returned ${i}: ${u}`);this.status=i;this.name="ConfigRequestError"}};_Qt=["cookie","host","connection","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","accept-encoding","content-length"]});var uMu=`var __create = Object.create;
@@ -83070,7 +83070,7 @@ ${w}`;v(B);return}if(c(null,F),t.strategy==="count"){if($--,$===0)v()}if(t.strat
   `);function v(d){if(t===void 0)return!0;let D=Nq(d),_=D&&Nq(t)?vau(t):t,N=D?vau(d):dau(d),Z=NVt(_,N);return Z===""||!Z.startsWith("..")&&!DVt(Z)}return{upsert(d){f.run({$handle:d.handle,$status:d.status,$sandboxPath:d.sandboxPath,$port:d.port??null,$previewUrl:d.previewUrl??null,$repoCloneUrl:d.repoCloneUrl??null,$branch:d.branch??null,$projectName:d.projectName??null,$error:d.error??null,$now:Date.now()})},list(){return l.all().map(pli)},reconcile(){let d=Date.now();for(let D of l.all().map(pli)){if(!v(D.sandboxPath)){E.run({$handle:D.handle,$now:d});continue}if(!Nq(D.sandboxPath)){c.run({$handle:D.handle,$now:d});continue}if(D.status==="spawning"||D.status==="ready"||D.status==="failed"||D.status==="missing")w.run({$handle:D.handle,$now:d})}return l.all().map(pli)},prune(d){let D=[],_=[],N=this.reconcile();for(let Z of N){if(!v(Z.sandboxPath)){_.push({handle:Z.handle,sandboxPath:Z.sandboxPath,reason:"outside_root",deletedFiles:!1});continue}if(d.missing&&Z.status==="missing"){$.run({$handle:Z.handle}),D.push({handle:Z.handle,sandboxPath:Z.sandboxPath,reason:"missing",deletedFiles:!1});continue}if(!d.merged||!Nq(Z.sandboxPath))continue;if(Z.branch===null||Z.branch.trim()===""){_.push({handle:Z.handle,sandboxPath:Z.sandboxPath,reason:"no_branch",deletedFiles:!1});continue}if(!x_(Z.sandboxPath,["rev-parse","--is-inside-work-tree"]).ok){_.push({handle:Z.handle,sandboxPath:Z.sandboxPath,reason:"git_unavailable",deletedFiles:!1});continue}let B=x_(Z.sandboxPath,["status","--porcelain"]);if(!B.ok){_.push({handle:Z.handle,sandboxPath:Z.sandboxPath,reason:"git_unavailable",deletedFiles:!1});continue}if(B.stdout.trim()!==""){_.push({handle:Z.handle,sandboxPath:Z.sandboxPath,reason:"dirty_worktree",deletedFiles:!1});continue}let F=_au(Z.sandboxPath,Z.branch);if(F===null){_.push({handle:Z.handle,sandboxPath:Z.sandboxPath,reason:"git_unavailable",deletedFiles:!1});continue}if(!F){_.push({handle:Z.handle,sandboxPath:Z.sandboxPath,reason:"branch_not_merged",deletedFiles:!1});continue}vVt(Z.sandboxPath,{recursive:!0,force:!0}),$.run({$handle:Z.handle}),D.push({handle:Z.handle,sandboxPath:Z.sandboxPath,reason:"merged",deletedFiles:!0})}return{removed:D,skipped:_}},delete(d){$.run({$handle:d})},inspect(d){let D=h.get({$handle:d});if(D===null)return null;let _=pli(D),N=0,Z=null;if(Nq(_.sandboxPath)&&x_(_.sandboxPath,["rev-parse","--is-inside-work-tree"]).ok){let B=x_(_.sandboxPath,["status","--porcelain"]);if(B.ok){let F=B.stdout.trim();N=F===""?0:F.split(`
 `).length}if(_.branch!==null&&_.branch.trim()!=="")Z=_au(_.sandboxPath,_.branch)}return{handle:_.handle,branch:_.branch,sandboxPath:_.sandboxPath,dirtyCount:N,merged:Z}},close(){u.close()}}}var ybi=()=>{};function FVt(i,u){return u?[["umount","-f",i]]:[["fusermount","-uz",i],["umount","-l",i]]}function Oau(i,u){if(process.platform==="win32")return;for(let t of FVt(i,u))if(Bun.spawnSync(t,{stdout:"ignore",stderr:"ignore",timeout:5000}).exitCode===0)break}var Zau=()=>{};import{existsSync as gVt,readdirSync as TVt}from"fs";import{rm as UVt}from"fs/promises";import{join as Bau}from"path";async function Fau(i,u={}){let t=u.detach??AVt,f=u.exists??gVt,l=u.readdir??((w)=>TVt(w)),E=u.rm??((w)=>UVt(w,{recursive:!0,force:!0})),c=Bau(i,"org");if(f(c))for(let w of l(c))t(Bau(c,w));await E(i)}var AVt=(i)=>Oau(i,process.platform==="darwin");var gau=O(()=>{Zau()});import{join as yVt}from"path";function Tau(i){let u=i.purge??Fau;return{stopSandbox(t){return i.provider.deleteSandbox(t)},inspectSandbox(t){return i.registry.inspect(t)},async removeSandbox(t){try{return await B1(async()=>{if(await i.provider.deleteSandbox(t),i.provider.hasHandle(t))throw Error("Can't delete \u2014 run in progress");let l=i.registry.inspect(t)?.sandboxPath??yVt(i.dataDir,"sandboxes",t);await u(l)},{maxAttempts:2,minTimeout:250,jitter:0}),i.registry.delete(t),{ok:!0}}catch(f){let l=f instanceof H6?f.cause:f;return{ok:!1,error:l instanceof Error?l.message:String(l)}}}}}var Uau=O(()=>{O4();gau()});import{randomBytes as PVt}from"crypto";import{mkdir as IVt}from"fs/promises";import{createServer as GVt}from"net";import{join as xVt}from"path";function Aau(i,u){return Error(`sandbox failed to start: ${i}`,{cause:u})}function yau(i){if(!(i instanceof Error))return!1;return i.name==="TimeoutError"||/timed out|timeout|operation was aborted|aborted/i.test(i.message)}function Pau(i){if(i instanceof Error){let u=i.cause;if(u instanceof Error&&u.message)return u.message;return i.message}return String(i)}function kVt(i){if(!i)return null;let u=i.trim().replace(/\/+$/,"");if(!u)return null;let t=u.split(/[/:]/).filter(Boolean).at(-1);if(!t)return null;return t.replace(/\.git$/i,"")||null}function jVt(i){return{repoCloneUrl:i.repo?.cloneUrl??null,branch:i.repo?.branch??null,projectName:kVt(i.repo?.cloneUrl)}}function Iau(i){let u=i.maxSandboxes??20,t=new Map,f=i.pickPort??XVt,l=i.fetchImpl??fetch,E=i.resolvePreviewUrl??((N,Z)=>`http://127.0.0.1:${Z}`),c=(N)=>xVt(i.dataDir,"sandboxes",N),w=(N)=>{try{i.registry?.upsert(N)}catch(Z){console.warn(`[user-desktop] failed to persist sandbox lifecycle handle=${N.handle} status=${N.status}:`,Z)}},$=(N)=>{try{i.onEvent?.(N)}catch{}},h=async(N)=>{let Z=new AbortController,B=setTimeout(()=>Z.abort(),1500);try{let F=await l(`${N}/health`,{signal:Z.signal});if(!F.ok)console.warn(`[user-desktop] probe ${N}/health \u2192 ${F.status} (treating as dead)`);return F.ok}catch(F){return console.warn(`[user-desktop] probe ${N}/health failed: ${F instanceof Error?F.message:String(F)} (treating as dead)`),!1}finally{clearTimeout(B)}},v=(N)=>{console.warn(`[user-desktop] evicting dead daemon handle=${N.handle} port=${N.port}`);try{N.process.kill("SIGTERM")}catch{}if(t.get(N.handle)===N)t.delete(N.handle),w({handle:N.handle,status:"stopped",sandboxPath:c(N.handle),port:null,previewUrl:null,...N.registryMetadata,error:null}),$({handle:N.handle,phase:"evicted"})},d=new Map;function D(){if(t.size<u)return;let N=[...t.values()].filter((B)=>B.activeDispatchCount===0).sort((B,F)=>B.lastUsedAt-F.lastUsedAt);if(N.length===0){console.warn(`[user-desktop] at cap ${t.size}/${u} but every sandbox is pinned (active dispatch) \u2014 exceeding cap temporarily`);return}let Z=N[0];console.log(`[user-desktop] evicting LRU victim handle=${Z.handle} port=${Z.port} (cap ${u} reached, size=${t.size})`);try{Z.process.kill("SIGTERM")}catch{}t.delete(Z.handle),w({handle:Z.handle,status:"stopped",sandboxPath:c(Z.handle),port:null,previewUrl:null,...Z.registryMetadata,error:null}),$({handle:Z.handle,phase:"evicted"})}let _=async(N)=>{let Z=jVt(N),B=c(N.handle);w({handle:N.handle,status:"spawning",sandboxPath:B,port:null,previewUrl:null,...Z,error:null}),$({handle:N.handle,phase:"spawning",sandboxPath:B,projectName:Z.projectName,branch:Z.branch}),D();let F,g=null,T;try{await IVt(B,{recursive:!0}),console.log(`[user-desktop] ensure handle=${N.handle} repo=${N.repo?.cloneUrl??"(none)"} branch=${N.repo?.branch??"(none)"} runtime=${N.workload?.runtime??"(autodetect)"} pm=${N.workload?.packageManager??"(autodetect)"}`),T=PVt(24).toString("hex");let[k,G]=await Promise.all([f(),f()]);F=k,console.log(`[user-desktop] spawn handle=${N.handle} port=${F} devPort=${G} workdir=${B}`),g=await Promise.resolve(i.spawnDaemon({workdir:B,handle:N.handle,port:F,daemonToken:T,offloadAllowedHosts:N.offloadAllowedHosts??[],offloadAllowSameHostDev:N.offloadAllowSameHostDev??!1,orgFsConfigJson:N.orgFsConfigJson}));try{await i.waitForHealth(F)}catch(X){throw Aau("the sandbox didn't come online in time",X)}console.log(`[user-desktop] healthy handle=${N.handle} port=${F} \u2014 posting config`);try{await i.postConfig(F,G,{repo:N.repo,workload:N.workload,operator:N.operator},T)}catch(X){throw Aau(yau(X)?"configuration timed out":"the sandbox rejected its configuration",X)}}catch(k){if((yau(k)?console.warn:console.error)(`[user-desktop] sandbox bring-up failed handle=${N.handle} port=${F??"(none)"}${g?" (killing daemon)":""}:`,k),g)try{g.kill("SIGKILL")}catch{}throw $({handle:N.handle,phase:"failed",error:Pau(k),sandboxPath:B,projectName:Z.projectName,branch:Z.branch}),w({handle:N.handle,status:"failed",sandboxPath:B,port:null,previewUrl:null,...Z,error:Pau(k)}),k}if(!g||F===void 0)throw Error("sandbox bring-up invariant violated");let U=`http://127.0.0.1:${F}`,A=E(N.handle,F);console.log(`[user-desktop] ready handle=${N.handle} port=${F} sandboxApiUrl=${U} previewUrl=${A}`);let I={handle:N.handle,port:F,process:g,sandboxApiUrl:U,previewUrl:A,lastUsedAt:Date.now(),activeDispatchCount:0,daemonToken:T,registryMetadata:Z};if(t.set(N.handle,I),w({handle:N.handle,status:"ready",sandboxPath:B,port:F,previewUrl:A,...Z,error:null}),$({handle:N.handle,phase:"ready",port:F,previewUrl:A,sandboxPath:B,projectName:Z.projectName,branch:Z.branch}),g.exited)g.exited.then(()=>{if(t.get(N.handle)===I)console.warn(`[user-desktop] daemon process exited unexpectedly handle=${N.handle} port=${F} \u2014 removing from cache`),t.delete(N.handle),w({handle:N.handle,status:"stopped",sandboxPath:B,port:null,previewUrl:null,...Z,error:null}),$({handle:N.handle,phase:"evicted"});else console.log(`[user-desktop] daemon process exited handle=${N.handle} port=${F} (already replaced/removed)`)});return{sandboxApiUrl:U,previewUrl:A,port:F}};return{async ensureSandbox(N){let Z=t.get(N.handle);if(Z){if(await h(Z.sandboxApiUrl))return console.log(`[user-desktop] cache hit handle=${N.handle} port=${Z.port} (alive)`),Z.lastUsedAt=Date.now(),{sandboxApiUrl:Z.sandboxApiUrl,previewUrl:Z.previewUrl,port:Z.port};console.warn(`[user-desktop] cache stale handle=${N.handle} port=${Z.port} \u2014 respawning`),v(Z)}let B=d.get(N.handle);if(B)return console.log(`[user-desktop] joining in-flight ensure handle=${N.handle}`),B;let F=_(N).finally(()=>{d.delete(N.handle)});return d.set(N.handle,F),F},proxyPort(N){let Z=t.get(N);if(Z)Z.lastUsedAt=Date.now();return Z?.port??null},getDaemonToken(N){return t.get(N)?.daemonToken??null},hasHandle(N){return t.has(N)||d.has(N)},recordHit(N){let Z=t.get(N);if(Z)Z.lastUsedAt=Date.now()},acquireDispatch(N){let Z=t.get(N);if(!Z)return()=>{};Z.activeDispatchCount+=1;let B=!1;return()=>{if(B)return;B=!0;let F=t.get(N);if(F)F.activeDispatchCount=Math.max(0,F.activeDispatchCount-1)}},listSandboxes(){return[...t.values()]},async deleteSandbox(N){let Z=t.get(N);if(!Z){console.log(`[user-desktop] delete handle=${N} (not found, no-op)`);return}if(Z.activeDispatchCount>0){console.warn(`[user-desktop] delete handle=${N} port=${Z.port} REFUSED \u2014 ${Z.activeDispatchCount} active dispatch(es) in flight`);return}console.log(`[user-desktop] delete handle=${N} port=${Z.port}`);try{Z.process.kill("SIGTERM")}catch{}t.delete(N),w({handle:N,status:"stopped",sandboxPath:c(N),port:null,previewUrl:null,repoCloneUrl:null,branch:null,projectName:null,error:null}),$({handle:N,phase:"deleted"})},async shutdown(){console.log(`[user-desktop] shutdown \u2014 killing ${t.size} sandbox(es)`);for(let N of t.values())try{N.process.kill("SIGTERM")}catch{}t.clear()}}}function XVt(){return new Promise((i,u)=>{let t=GVt();t.unref(),t.on("error",u),t.listen(0,"127.0.0.1",()=>{let f=t.address();if(f&&typeof f==="object"){let l=f.port;t.close(()=>i(l))}else t.close(()=>u(Error("could not allocate port")))})})}var Gau=()=>{};import{randomUUID as JVt}from"crypto";import{hostname as KVt}from"os";async function xau(i){let u=KVt()||void 0;i.monitor?.onMachine?.(u??"this machine");let t=cMu(i.dataDir,{outFd:i.logFd,perSandboxLog:i.perSandboxLogs,hotReload:i.hotReload}),f=u6i({path:i6i(i.dataDir),managedSandboxRoot:`${i.dataDir}/sandboxes`}),l=!1,E=()=>{if(l)return;l=!0;try{f.close()}catch{}};try{let c=0,w=Iau({dataDir:i.dataDir,registry:f,resolvePreviewUrl:(X,b)=>c>0?`http://${X}.localhost:${c}`:`http://127.0.0.1:${b}`,spawnDaemon:async(X)=>{let b={DAEMON_BOOT_ID:JVt(),APP_ROOT:X.workdir,PROXY_PORT:String(X.port),DAEMON_TOKEN:X.daemonToken,OFFLOAD_ALLOWED_HOSTS:X.offloadAllowedHosts.join(","),...X.offloadAllowSameHostDev?{OFFLOAD_ALLOW_SAME_HOST_DEV:"1"}:{}};if(X.orgFsConfigJson){let L=await vMu(i.dataDir);if(L)b.ORGFS_CONFIG=X.orgFsConfigJson,b.ORGFS_RCLONE_PATH=L}let K=await t({workdir:X.workdir,env:b,daemonPort:X.port});return{port:X.port,kill:(L)=>K.kill(L),exited:K.exited.then(()=>{return})}},postConfig:async(X,b,K,L)=>{let m={port:b};if(K.workload)m.runtime=K.workload.runtime,m.packageManager={name:K.workload.packageManager,...K.workload.packageManagerPath?{path:K.workload.packageManagerPath}:{}};let Q={application:m},ti=T5(K.operator??null);if(ti)Q.operator=ti;if(K.repo)Q.git={repository:{cloneUrl:K.repo.cloneUrl,branch:K.repo.branch,...K.repo.submoduleCredentials&&K.repo.submoduleCredentials.length>0?{submoduleCredentials:K.repo.submoduleCredentials}:{}},...K.repo.userName&&K.repo.userEmail?{identity:{userName:K.repo.userName,userEmail:K.repo.userEmail}}:{}};await Z_(`http://127.0.0.1:${X}`,L,Q)},waitForHealth:async(X)=>{await ili(`http://127.0.0.1:${X}`)},maxSandboxes:20,onEvent:i.monitor?.onEvent}),$=await seu({port:i.port,lookupSandboxPort:(X)=>w.proxyPort(X)});c=$.port,console.log(`Local ingress listening on http://127.0.0.1:${$.port} (use http://<handle>.localhost:${$.port}/)`),i.monitor?.onIngress?.($.port);let h=DMu({provider:w}),v=async()=>{let X=await O_({dataDir:i.dataDir,target:i.clusterBaseUrl});if(!X)throw Object.assign(Error(`Session for ${i.clusterBaseUrl} is no longer valid \u2014 run \`deco auth login --target ${i.clusterBaseUrl}\` and restart \`deco link\`.`),{fatal:!0});return X.accessToken},d=await $au(i.dataDir),D=process.env.npm_package_version??"0.0.0",_=await Abi(),N=cau(_,{onChange:(X)=>{console.log(`[link-daemon] capabilities detected: +${X.join(",")} (now: ${_.join(",")})`)}}),Z=vni({path:`${i.dataDir}/link/outbox.sqlite`});Z.clear();let B=()=>{},F=new AbortController,g={clusterBaseUrl:i.clusterBaseUrl,getAccessToken:v,provider:w,outbox:Z,controlHandler:h,capabilities:_,machineId:d,cliVersion:D,previewPort:$.port,onConnected:()=>{i.monitor?.onCluster?.("linked"),console.log(`Linked to ${i.clusterBaseUrl}`)},onShutdown:()=>B(),runLifetimeSignal:F.signal};console.log(`[link-daemon] transport=tunnel cluster=${i.clusterBaseUrl}`);let T=await neu(g);console.log("[link-daemon] active transport=tunnel");let U,A=new Promise((X)=>{U=X}),I=!1,k=async()=>{if(I)return;I=!0,F.abort(),console.log(`
 Shutting down\u2026`),N();try{await T.close()}catch{}try{await $.stop()}catch{}try{await w.shutdown()}catch{}try{Z.close()}catch{}E(),U(0)};process.on("SIGINT",()=>void k()),process.on("SIGTERM",()=>void k()),B=()=>{console.log("Disconnect requested from the Studio web UI \u2014 shutting down. Run `bunx decocms@latest link` to reconnect."),k()},T.closed.then(()=>{if(i.monitor?.onCluster?.("closed"),!I)console.error("Cluster connection closed permanently; exiting."),k()});let G=Tau({provider:w,registry:f,dataDir:i.dataDir});return{stopped:A,stop:k,stopSandbox:G.stopSandbox,removeSandbox:G.removeSandbox,inspectSandbox:G.inspectSandbox}}catch(c){throw E(),c}}var kau=O(()=>{fni();QM();wMu();dMu();_Mu();dni();Reu();peu();wau();hau();LM();ybi();Uau();Gau()});function Pbi(i){return i.map((u)=>typeof u==="string"?u:String(u)).join(" ")}import{createServer as YVt}from"net";async function SVt(i){for(let u of WVt)if(await Ibi(i,u))return u;return null}async function jau(i,{intervalMs:u=1000}={}){for(;;){let t=await SVt(i);if(t)return t;await y0(u)}}function Ibi(i,u){return new Promise((t)=>{let f=YVt();f.once("error",(l)=>{t(l.code==="EADDRINUSE")}),f.listen(i,u,()=>{f.close(()=>t(!1))})})}var WVt;var Gbi=O(()=>{O4();WVt=["localhost","127.0.0.1","0.0.0.0"]});function Xau(i){return typeof i==="object"&&i!==null&&"code"in i&&i.code==="EADDRINUSE"}function LVt(i,u=process.platform){if(u==="win32")return`for /f "tokens=5" %P in ('netstat -ano ^| findstr /R /C:":${i} .*LISTENING"') do taskkill /F /PID %P`;return`kill -9 $(lsof -ti tcp:${i})`}function Jau(i,u=process.platform){return[`Port ${i} is already in use.`,"Run this command to stop the process listening on it, then retry `decocms link`:","",`  ${LVt(i,u)}`].join(`
-`)}var xbi;var Kau=O(()=>{xbi=class xbi extends Error{port;code="EADDRINUSE";constructor(i){super(`Port ${i} is already in use.`);this.port=i;this.name="PortInUseError"}}});var FL;var t6i=O(()=>{FL={name:"decocms",version:"4.125.0",description:"Deco CMS \u2014 Self-hostable MCP Gateway for managing AI connections and tools",author:"Deco team",repository:{type:"git",url:"git+https://github.com/decocms/studio.git",directory:"apps/api"},bugs:{url:"https://github.com/decocms/studio/issues"},type:"module",bin:{deco:"./dist/server/cli.js"},files:["dist/**/*"],scripts:{dev:"bun run migrate && bun run dev:server","dev:server":"bun run --cwd=../../packages/sandbox build && NODE_ENV=development bun --env-file=.env --hot run src/index.ts",build:"bun run build:server","build:server":"bun run scripts/bundle-server-script.ts --dist ./dist/server","generate:tool-contracts":"bun run scripts/generate-tool-contracts.ts","db:migrate":"bun run ./dist/server/migrate.js",check:"tsc --noEmit",start:"bun run ./dist/server/server.js",migrate:"bun run src/database/migrate.ts",test:"bun test src","better-auth:migrate":"bunx --bun @better-auth/cli migrate -y --config src/auth/index.ts","smoke:link":"bun run scripts/smoke-link.ts",prepublishOnly:"bun run --cwd=../.. build:studio"},optionalDependencies:{"@anthropic-ai/claude-agent-sdk":"^0.3.181","@duckdb/node-api":"^1.5.0-r.1","@openai/codex":"0.144.3","@openai/codex-darwin-arm64":"npm:@openai/codex@0.144.3-darwin-arm64","@openai/codex-darwin-x64":"npm:@openai/codex@0.144.3-darwin-x64","@openai/codex-linux-arm64":"npm:@openai/codex@0.144.3-linux-arm64","@openai/codex-linux-x64":"npm:@openai/codex@0.144.3-linux-x64","@openai/codex-win32-arm64":"npm:@openai/codex@0.144.3-win32-arm64","@openai/codex-win32-x64":"npm:@openai/codex@0.144.3-win32-x64"},dependencies:{"@ai-sdk/anthropic":"^3.0.85","@ai-sdk/google":"^3.0.83","@ai-sdk/openai":"^3.0.73","@anthropic-ai/sdk":"^0.105.0","@aws-sdk/client-s3":"^3.1013.0","@aws-sdk/client-sts":"^3.1013.0","@aws-sdk/lib-storage":"^3.1013.0","@aws-sdk/s3-request-presigner":"^3.1013.0","@clickhouse/client":"^1.8.1","@dbos-inc/dbos-sdk":"^4.21.6","@inkjs/ui":"^2.0.0","@nats-io/jetstream":"3.4.0","@nats-io/kv":"3.4.0","@nats-io/nats-core":"3.4.0","@nats-io/transport-node":"3.4.0","@openrouter/ai-sdk-provider":"^2.9.1","@opentelemetry/core":"^2.6.0","@resvg/resvg-js":"^2.6.2","embedded-postgres":"^18.3.0-beta.16",ink:"^6.8.0",kysely:"^0.28.12","node-pty":"^1.0.0","posthog-node":"^5.0.0",react:"^19.2.6","react-dom":"^19.2.6",satori:"^0.28.2"},devDependencies:{"@ai-sdk/provider":"^3.0.10","@better-auth/sso":"1.4.1","@decocms/better-auth":"1.5.17","@decocms/bindings":"workspace:*","@decocms/harness":"workspace:*","@decocms/mcp-utils":"workspace:*","@decocms/runtime":"workspace:*","@decocms/sandbox":"workspace:*","@decocms/shared":"workspace:*","@decocms/tunnel":"workspace:*","@jitl/quickjs-wasmfile-release-sync":"0.31.0","@modelcontextprotocol/sdk":"1.29.0","@nats-io/jwt":"0.0.10-5","@opentelemetry/api":"^1.9.0","@opentelemetry/api-logs":"^0.211.0","@opentelemetry/exporter-logs-otlp-proto":"^0.211.0","@opentelemetry/exporter-prometheus":"^0.208.0","@opentelemetry/exporter-trace-otlp-proto":"^0.207.0","@opentelemetry/instrumentation-runtime-node":"^0.24.0","@opentelemetry/resources":"^2.6.0","@opentelemetry/sdk-logs":"^0.211.0","@opentelemetry/sdk-metrics":"^2.2.0","@opentelemetry/sdk-node":"^0.207.0","@opentelemetry/sdk-trace-base":"^2.5.0","@types/bun":"^1.3.1","@types/google.maps":"^3.65.2","@types/pg":"^8.15.6","@types/react-syntax-highlighter":"^15.5.13","@vercel/nft":"^1.1.1",ai:"^6.0.208","better-auth":"1.4.22",croner:"^9.1.0",degit:"^2.8.4",hono:"^4.10.7",jose:"^6.0.11",nanoid:"^5.1.6",pg:"^8.16.3",typescript:"^5.9.3",vite:"^7.2.1",zod:"^4.0.0"},homepage:"https://github.com/decocms/studio",keywords:["mcp","model-context-protocol","ai","gateway","self-hosted","tools"],license:"MIT",publishConfig:{access:"public"}}});var Oq={};ji(Oq,{printBanner:()=>zVt,bannerLines:()=>Yau,BANNER_LINES:()=>f6i,BANNER_GRADIENT:()=>l6i});function HVt(i){let u=Number.parseInt(i.slice(1),16);return[u>>16&255,u>>8&255,u&255]}function Yau(i){let u=f6i.map((t,f)=>{let[l,E,c]=HVt(l6i[f]);return`\x1B[38;2;${l};${E};${c}m${t}\x1B[39m`});if(i!==void 0)u.push(`\x1B[2m  v${i}\x1B[22m`);return u}function zVt(i){console.log("");for(let u of Yau(i))console.log(u);console.log("")}var f6i,l6i;var gL=O(()=>{f6i=[" \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588     \u2588\u2588\u2588\u2588\u2588\u2588\u2588   ","\u2591\u2591\u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2588\u2588\u2588 \u2591\u2591\u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2591\u2588  \u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2591\u2588\u2588\u2588  \u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2591\u2588\u2588\u2588 "," \u2591\u2588\u2588\u2588   \u2591\u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588  \u2588 \u2591  \u2588\u2588\u2588     \u2591\u2591\u2591  \u2588\u2588\u2588     \u2591\u2591\u2588\u2588\u2588"," \u2591\u2588\u2588\u2588    \u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588\u2588\u2588\u2588   \u2591\u2588\u2588\u2588         \u2591\u2588\u2588\u2588      \u2591\u2588\u2588\u2588"," \u2591\u2588\u2588\u2588    \u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588\u2591\u2591\u2588   \u2591\u2588\u2588\u2588         \u2591\u2588\u2588\u2588      \u2591\u2588\u2588\u2588"," \u2591\u2588\u2588\u2588    \u2588\u2588\u2588  \u2591\u2588\u2588\u2588 \u2591   \u2588\u2591\u2591\u2588\u2588\u2588     \u2588\u2588\u2588\u2591\u2591\u2588\u2588\u2588     \u2588\u2588\u2588 "," \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588 \u2591\u2591\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588  \u2591\u2591\u2591\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2591  ","\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591   \u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591   \u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591     \u2591\u2591\u2591\u2591\u2591\u2591\u2591   "],l6i=["#00ff64","#00ee5e","#00dc56","#00c84e","#00b444","#00a03c","#008832","#006e28"]});import{Box as nVt,Text as Wau}from"ink";import{jsx as RVt,jsxs as Sau}from"react/jsx-runtime";function E6i({version:i}){return Sau(nVt,{flexDirection:"column",marginTop:1,children:[f6i.map((u,t)=>RVt(Wau,{color:l6i[t],children:u},t)),Sau(Wau,{dimColor:!0,children:[" v",i]})]})}var kbi=O(()=>{gL()});function Lau(i){let u=i.branch??i.handle,t=[];if(i.dirtyCount>0)t.push(`${i.dirtyCount} uncommitted file${i.dirtyCount===1?"":"s"}`);if(i.merged===!1)t.push("branch not merged");return t.length>0?`\u26A0 ${t.join(", ")} \u2014 delete ${u}? (y/n)`:`Delete ${u}? (y/n)`}function TL(i){return[...i.values()].map((u)=>u.handle).sort((u,t)=>u.localeCompare(t))}function Qau(i,u,t){if(i.length===0)return null;let f=u===null?-1:i.indexOf(u);if(f===-1)return t>0?i[0]:i[i.length-1];let l=Math.max(0,Math.min(i.length-1,f+t));return i[l]}function Hau(i,u,t){if(t!==u)return t;let f=i.indexOf(u);if(f===-1)return t;return i[f+1]??i[f-1]??null}var Kbi={};ji(Kbi,{subscribeLinkState:()=>jbi,setSelectedHandle:()=>Xbi,setRemoving:()=>$6i,setPersistedSandboxes:()=>oVt,setPendingConfirm:()=>Bq,setMachine:()=>rVt,setLogPath:()=>eVt,setLinkActions:()=>aVt,setIngress:()=>VVt,setDaemonError:()=>mVt,setClusterUrl:()=>qVt,setCluster:()=>MVt,setActionError:()=>w6i,resetLinkStateForTests:()=>pVt,removeSandboxRow:()=>Jbi,pushSandboxEvent:()=>sVt,getLinkState:()=>Zq,applySandboxEvent:()=>zau});function CVt(i){return i==="spawning"||i==="ready"||i==="failed"}function zau(i,u){let t=new Map(i),f=t.get(u.handle);if(u.phase==="evicted"||u.phase==="deleted"){if(f)t.set(u.handle,{...f,port:null,previewUrl:null,status:"stopped",error:null});return t}return t.set(u.handle,{handle:u.handle,port:u.port??f?.port??null,previewUrl:u.previewUrl??f?.previewUrl??null,status:u.phase,error:u.phase==="failed"?u.error??"failed":null,projectName:u.projectName??f?.projectName??null,branch:u.branch??f?.branch??null,sandboxPath:u.sandboxPath??f?.sandboxPath??null}),t}function nau(){return{cluster:"connecting",clusterUrl:null,ingressUrl:null,ingressPort:null,machine:null,cap:bVt,sandboxes:new Map,daemonError:null,logPath:null,selectedHandle:null,pendingConfirm:null,removingHandles:new Set,actionError:null,actions:null}}function b3(){for(let i of c6i)i()}function Zq(){return lf}function jbi(i){return c6i.add(i),()=>c6i.delete(i)}function MVt(i){lf={...lf,cluster:i},b3()}function qVt(i){lf={...lf,clusterUrl:i},b3()}function VVt(i,u){lf={...lf,ingressPort:i,ingressUrl:u},b3()}function rVt(i){lf={...lf,machine:i},b3()}function mVt(i){lf={...lf,daemonError:i},b3()}function eVt(i){lf={...lf,logPath:i},b3()}function Xbi(i){lf={...lf,selectedHandle:i},b3()}function Bq(i){lf={...lf,pendingConfirm:i},b3()}function w6i(i){lf={...lf,actionError:i},b3()}function $6i(i,u){if(lf.removingHandles.has(i)===u)return;let t=new Set(lf.removingHandles);if(u)t.add(i);else t.delete(i);lf={...lf,removingHandles:t},b3()}function aVt(i){lf={...lf,actions:i},b3()}function Jbi(i){let u=TL(lf.sandboxes),t=Hau(u,i,lf.selectedHandle),f=new Map(lf.sandboxes);f.delete(i);let l=new Set(lf.removingHandles);l.delete(i),lf={...lf,sandboxes:f,selectedHandle:t,pendingConfirm:null,removingHandles:l},b3()}function oVt(i){let u=new Map;for(let t of i)u.set(t.handle,{handle:t.handle,port:t.port,previewUrl:t.previewUrl,status:t.status,error:t.error,projectName:t.projectName,branch:t.branch,sandboxPath:t.sandboxPath});for(let[t,f]of lf.sandboxes)if(CVt(f.status))u.set(t,f);lf={...lf,sandboxes:u},b3()}function sVt(i){lf={...lf,sandboxes:zau(lf.sandboxes,i)},b3()}function pVt(){lf=nau(),c6i.clear()}var bVt=20,lf,c6i;var Fq=O(()=>{lf=nau(),c6i=new Set});import{spawn as irt}from"child_process";function urt(i){if(i==="darwin")return"open";if(i==="win32")return"start";return"xdg-open"}function Rau(i,u=process.platform){let t=urt(u);try{irt(t,[i],{stdio:"ignore",detached:!0}).unref()}catch{}}var bau=()=>{};function Cau(i,u={}){let t=u.openUrl??Rau,f=Zq(),l=TL(f.sandboxes),E=f.selectedHandle!==null&&l.includes(f.selectedHandle)?f.selectedHandle:l[0]??null,c=f.actions;switch(i.type){case"move":Xbi(Qau(l,f.selectedHandle,i.delta));return;case"open":{if(E===null)return;let w=f.sandboxes.get(E);if(w?.status==="ready"&&w.previewUrl)t(w.previewUrl);return}case"stop":if(E!==null&&c)c.stopSandbox(E);return;case"delete":{if(E===null||!c)return;let w=c.inspectSandbox(E),$=f.sandboxes.get(E);w6i(null),Bq({handle:E,branch:w?.branch??$?.branch??null,dirtyCount:w?.dirtyCount??0,merged:w?.merged??null});return}case"confirmYes":{let w=f.pendingConfirm;if(Bq(null),w===null||!c)return;$6i(w.handle,!0),c.removeSandbox(w.handle).then(($)=>{if($.ok)Jbi(w.handle);else $6i(w.handle,!1),w6i($.error)});return}case"confirmNo":Bq(null);return;case"quit":if(c)c.quit();return}}var Mau=O(()=>{Fq();bau()});function qau(i,u,t){if(t)return i==="y"||i==="Y"?{type:"confirmYes"}:{type:"confirmNo"};if(u.upArrow||i==="k")return{type:"move",delta:-1};if(u.downArrow||i==="j")return{type:"move",delta:1};if(i==="s")return{type:"stop"};if(i==="d")return{type:"delete"};if(i==="o")return{type:"open"};if(i==="q"||u.ctrl===!0&&i==="c")return{type:"quit"};return null}var Vau={};ji(Vau,{LinkApp:()=>Ert});import{Box as b1,Text as hl,useInput as trt}from"ink";import{useSyncExternalStore as frt}from"react";import{jsx as kf,jsxs as J5}from"react/jsx-runtime";function lrt(i,u){if(u)return{color:"yellow",text:"\u25CC Removing\u2026"};if(i.status==="ready")return{color:"green",text:"\u25CF Live"};if(i.status==="spawning")return{color:"yellow",text:"\u25CC Starting\u2026"};if(i.status==="stopped")return{color:"gray",text:"\u25A0 Stopped"};if(i.status==="missing")return{color:"yellow",text:"\u25A1 Missing"};if(i.status==="merged")return{color:"cyan",text:"\u2713 Merged"};if(i.status==="invalid")return{color:"red",text:"\u2717 Invalid"};if(i.status==="failed")return{color:"red",text:`\u2717 Failed: ${i.error??"failed"}`};return{color:"red",text:`\u2717 Error: ${i.error??""}`}}function Ert(){let i=frt(jbi,Zq),u=[...i.sandboxes.values()].sort((l,E)=>l.handle.localeCompare(E.handle)),t=TL(i.sandboxes),f=i.selectedHandle!==null&&t.includes(i.selectedHandle)?i.selectedHandle:t[0]??null;return trt((l,E)=>{let c=qau(l,E,i.pendingConfirm!==null);if(c!==null)Cau(c)}),J5(b1,{flexDirection:"column",children:[kf(E6i,{version:FL.version}),kf(b1,{marginBottom:1,children:kf(hl,{dimColor:!0,children:"\u2500".repeat(80)})}),kf(b1,{children:i.cluster==="linked"?J5(hl,{color:"green",children:["\u2713 Connected to ",i.clusterUrl??"deco"]}):i.cluster==="connecting"?J5(hl,{color:"yellow",children:["\u25CC Connecting to ",i.clusterUrl??"deco","\u2026"]}):J5(hl,{color:"red",children:["\u2717 Disconnected from ",i.clusterUrl??"deco"]})}),kf(b1,{children:i.ingressUrl?J5(hl,{color:"green",children:["\u2713 Serving at ",i.ingressUrl]}):kf(hl,{dimColor:!0,children:"\u25CC Starting local server\u2026"})}),kf(b1,{marginBottom:1,children:kf(hl,{dimColor:!0,children:`${"Computer".padEnd(16)}${i.machine??"this computer"} \xB7 ${u.length} of ${i.cap} previews`})}),u.length===0?kf(hl,{dimColor:!0,children:"No previews running yet."}):J5(b1,{flexDirection:"column",children:[J5(b1,{children:[kf(b1,{width:2,flexShrink:0}),kf(b1,{width:UL.project,flexShrink:0,marginRight:1,children:kf(hl,{dimColor:!0,wrap:"truncate-end",children:"PROJECT"})}),kf(b1,{width:UL.branch,flexShrink:0,marginRight:1,children:kf(hl,{dimColor:!0,wrap:"truncate-end",children:"BRANCH"})}),kf(b1,{width:UL.status,flexShrink:0,marginRight:1,children:kf(hl,{dimColor:!0,wrap:"truncate-end",children:"STATUS"})}),kf(b1,{flexGrow:1,children:kf(hl,{dimColor:!0,wrap:"truncate-end",children:"PREVIEW URL"})})]}),u.map((l)=>{let E=lrt(l,i.removingHandles.has(l.handle)),c=l.handle===f;return J5(b1,{children:[kf(b1,{width:2,flexShrink:0,children:kf(hl,{color:"cyan",children:c?"\u203A":" "})}),kf(b1,{width:UL.project,flexShrink:0,marginRight:1,children:kf(hl,{bold:c,wrap:"truncate-end",children:l.projectName??l.handle})}),kf(b1,{width:UL.branch,flexShrink:0,marginRight:1,children:kf(hl,{bold:c,wrap:"truncate-end",children:l.branch??"\u2014"})}),kf(b1,{width:UL.status,flexShrink:0,marginRight:1,children:kf(hl,{color:E.color,bold:c,wrap:"truncate-end",children:E.text})}),kf(b1,{flexGrow:1,children:kf(hl,{dimColor:!0,wrap:"truncate-end",children:l.previewUrl??"\u2014"})})]},l.handle)})]}),i.daemonError?kf(b1,{marginTop:1,children:J5(hl,{color:"red",children:["\u26A0 ",i.daemonError]})}):null,i.logPath?kf(b1,{marginTop:1,children:J5(hl,{dimColor:!0,children:["Logs: ",i.logPath]})}):null,i.pendingConfirm?kf(b1,{marginTop:1,children:kf(hl,{color:"yellow",children:Lau(i.pendingConfirm)})}):null,i.actionError?kf(b1,{marginTop:1,children:J5(hl,{color:"red",children:["\u2717 ",i.actionError]})}):null,kf(b1,{marginTop:1,children:kf(hl,{dimColor:!0,children:"\u2191\u2193 move \xB7 s stop \xB7 d delete \xB7 o open \xB7 q quit"})})]})}var UL;var rau=O(()=>{t6i();kbi();Mau();Fq();UL={project:18,branch:22,status:14}});var mau={};ji(mau,{runLinkCommand:()=>_rt});import{closeSync as crt,mkdirSync as wrt,openSync as $rt,writeSync as hrt}from"fs";import{homedir as vrt}from"os";import{join as Ybi}from"path";function drt(i,u){let t={log:console.log,warn:console.warn,error:console.error},f=(l)=>{if(u===void 0)return;try{hrt(u,`${Pbi(l)}
+`)}var xbi;var Kau=O(()=>{xbi=class xbi extends Error{port;code="EADDRINUSE";constructor(i){super(`Port ${i} is already in use.`);this.port=i;this.name="PortInUseError"}}});var FL;var t6i=O(()=>{FL={name:"decocms",version:"4.125.1",description:"Deco CMS \u2014 Self-hostable MCP Gateway for managing AI connections and tools",author:"Deco team",repository:{type:"git",url:"git+https://github.com/decocms/studio.git",directory:"apps/api"},bugs:{url:"https://github.com/decocms/studio/issues"},type:"module",bin:{deco:"./dist/server/cli.js"},files:["dist/**/*"],scripts:{dev:"bun run migrate && bun run dev:server","dev:server":"bun run --cwd=../../packages/sandbox build && NODE_ENV=development bun --env-file=.env --hot run src/index.ts",build:"bun run build:server","build:server":"bun run scripts/bundle-server-script.ts --dist ./dist/server","generate:tool-contracts":"bun run scripts/generate-tool-contracts.ts","db:migrate":"bun run ./dist/server/migrate.js",check:"tsc --noEmit",start:"bun run ./dist/server/server.js",migrate:"bun run src/database/migrate.ts",test:"bun test src","better-auth:migrate":"bunx --bun @better-auth/cli migrate -y --config src/auth/index.ts","smoke:link":"bun run scripts/smoke-link.ts",prepublishOnly:"bun run --cwd=../.. build:studio"},optionalDependencies:{"@anthropic-ai/claude-agent-sdk":"^0.3.181","@duckdb/node-api":"^1.5.0-r.1","@openai/codex":"0.144.3","@openai/codex-darwin-arm64":"npm:@openai/codex@0.144.3-darwin-arm64","@openai/codex-darwin-x64":"npm:@openai/codex@0.144.3-darwin-x64","@openai/codex-linux-arm64":"npm:@openai/codex@0.144.3-linux-arm64","@openai/codex-linux-x64":"npm:@openai/codex@0.144.3-linux-x64","@openai/codex-win32-arm64":"npm:@openai/codex@0.144.3-win32-arm64","@openai/codex-win32-x64":"npm:@openai/codex@0.144.3-win32-x64"},dependencies:{"@ai-sdk/anthropic":"^3.0.85","@ai-sdk/google":"^3.0.83","@ai-sdk/openai":"^3.0.73","@anthropic-ai/sdk":"^0.105.0","@aws-sdk/client-s3":"^3.1013.0","@aws-sdk/client-sts":"^3.1013.0","@aws-sdk/lib-storage":"^3.1013.0","@aws-sdk/s3-request-presigner":"^3.1013.0","@clickhouse/client":"^1.8.1","@dbos-inc/dbos-sdk":"^4.21.6","@inkjs/ui":"^2.0.0","@nats-io/jetstream":"3.4.0","@nats-io/kv":"3.4.0","@nats-io/nats-core":"3.4.0","@nats-io/transport-node":"3.4.0","@openrouter/ai-sdk-provider":"^2.9.1","@opentelemetry/core":"^2.6.0","@resvg/resvg-js":"^2.6.2","embedded-postgres":"^18.3.0-beta.16",ink:"^6.8.0",kysely:"^0.28.12","node-pty":"^1.0.0","posthog-node":"^5.0.0",react:"^19.2.6","react-dom":"^19.2.6",satori:"^0.28.2"},devDependencies:{"@ai-sdk/provider":"^3.0.10","@better-auth/sso":"1.4.1","@decocms/better-auth":"1.5.17","@decocms/bindings":"workspace:*","@decocms/harness":"workspace:*","@decocms/mcp-utils":"workspace:*","@decocms/runtime":"workspace:*","@decocms/sandbox":"workspace:*","@decocms/shared":"workspace:*","@decocms/tunnel":"workspace:*","@jitl/quickjs-wasmfile-release-sync":"0.31.0","@modelcontextprotocol/sdk":"1.29.0","@nats-io/jwt":"0.0.10-5","@opentelemetry/api":"^1.9.0","@opentelemetry/api-logs":"^0.211.0","@opentelemetry/exporter-logs-otlp-proto":"^0.211.0","@opentelemetry/exporter-prometheus":"^0.208.0","@opentelemetry/exporter-trace-otlp-proto":"^0.207.0","@opentelemetry/instrumentation-runtime-node":"^0.24.0","@opentelemetry/resources":"^2.6.0","@opentelemetry/sdk-logs":"^0.211.0","@opentelemetry/sdk-metrics":"^2.2.0","@opentelemetry/sdk-node":"^0.207.0","@opentelemetry/sdk-trace-base":"^2.5.0","@types/bun":"^1.3.1","@types/google.maps":"^3.65.2","@types/pg":"^8.15.6","@types/react-syntax-highlighter":"^15.5.13","@vercel/nft":"^1.1.1",ai:"^6.0.208","better-auth":"1.4.22",croner:"^9.1.0",degit:"^2.8.4",hono:"^4.10.7",jose:"^6.0.11",nanoid:"^5.1.6",pg:"^8.16.3",typescript:"^5.9.3",vite:"^7.2.1",zod:"^4.0.0"},homepage:"https://github.com/decocms/studio",keywords:["mcp","model-context-protocol","ai","gateway","self-hosted","tools"],license:"MIT",publishConfig:{access:"public"}}});var Oq={};ji(Oq,{printBanner:()=>zVt,bannerLines:()=>Yau,BANNER_LINES:()=>f6i,BANNER_GRADIENT:()=>l6i});function HVt(i){let u=Number.parseInt(i.slice(1),16);return[u>>16&255,u>>8&255,u&255]}function Yau(i){let u=f6i.map((t,f)=>{let[l,E,c]=HVt(l6i[f]);return`\x1B[38;2;${l};${E};${c}m${t}\x1B[39m`});if(i!==void 0)u.push(`\x1B[2m  v${i}\x1B[22m`);return u}function zVt(i){console.log("");for(let u of Yau(i))console.log(u);console.log("")}var f6i,l6i;var gL=O(()=>{f6i=[" \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588     \u2588\u2588\u2588\u2588\u2588\u2588\u2588   ","\u2591\u2591\u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2588\u2588\u2588 \u2591\u2591\u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2591\u2588  \u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2591\u2588\u2588\u2588  \u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2591\u2588\u2588\u2588 "," \u2591\u2588\u2588\u2588   \u2591\u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588  \u2588 \u2591  \u2588\u2588\u2588     \u2591\u2591\u2591  \u2588\u2588\u2588     \u2591\u2591\u2588\u2588\u2588"," \u2591\u2588\u2588\u2588    \u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588\u2588\u2588\u2588   \u2591\u2588\u2588\u2588         \u2591\u2588\u2588\u2588      \u2591\u2588\u2588\u2588"," \u2591\u2588\u2588\u2588    \u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588\u2591\u2591\u2588   \u2591\u2588\u2588\u2588         \u2591\u2588\u2588\u2588      \u2591\u2588\u2588\u2588"," \u2591\u2588\u2588\u2588    \u2588\u2588\u2588  \u2591\u2588\u2588\u2588 \u2591   \u2588\u2591\u2591\u2588\u2588\u2588     \u2588\u2588\u2588\u2591\u2591\u2588\u2588\u2588     \u2588\u2588\u2588 "," \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588 \u2591\u2591\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588  \u2591\u2591\u2591\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2591  ","\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591   \u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591   \u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591     \u2591\u2591\u2591\u2591\u2591\u2591\u2591   "],l6i=["#00ff64","#00ee5e","#00dc56","#00c84e","#00b444","#00a03c","#008832","#006e28"]});import{Box as nVt,Text as Wau}from"ink";import{jsx as RVt,jsxs as Sau}from"react/jsx-runtime";function E6i({version:i}){return Sau(nVt,{flexDirection:"column",marginTop:1,children:[f6i.map((u,t)=>RVt(Wau,{color:l6i[t],children:u},t)),Sau(Wau,{dimColor:!0,children:[" v",i]})]})}var kbi=O(()=>{gL()});function Lau(i){let u=i.branch??i.handle,t=[];if(i.dirtyCount>0)t.push(`${i.dirtyCount} uncommitted file${i.dirtyCount===1?"":"s"}`);if(i.merged===!1)t.push("branch not merged");return t.length>0?`\u26A0 ${t.join(", ")} \u2014 delete ${u}? (y/n)`:`Delete ${u}? (y/n)`}function TL(i){return[...i.values()].map((u)=>u.handle).sort((u,t)=>u.localeCompare(t))}function Qau(i,u,t){if(i.length===0)return null;let f=u===null?-1:i.indexOf(u);if(f===-1)return t>0?i[0]:i[i.length-1];let l=Math.max(0,Math.min(i.length-1,f+t));return i[l]}function Hau(i,u,t){if(t!==u)return t;let f=i.indexOf(u);if(f===-1)return t;return i[f+1]??i[f-1]??null}var Kbi={};ji(Kbi,{subscribeLinkState:()=>jbi,setSelectedHandle:()=>Xbi,setRemoving:()=>$6i,setPersistedSandboxes:()=>oVt,setPendingConfirm:()=>Bq,setMachine:()=>rVt,setLogPath:()=>eVt,setLinkActions:()=>aVt,setIngress:()=>VVt,setDaemonError:()=>mVt,setClusterUrl:()=>qVt,setCluster:()=>MVt,setActionError:()=>w6i,resetLinkStateForTests:()=>pVt,removeSandboxRow:()=>Jbi,pushSandboxEvent:()=>sVt,getLinkState:()=>Zq,applySandboxEvent:()=>zau});function CVt(i){return i==="spawning"||i==="ready"||i==="failed"}function zau(i,u){let t=new Map(i),f=t.get(u.handle);if(u.phase==="evicted"||u.phase==="deleted"){if(f)t.set(u.handle,{...f,port:null,previewUrl:null,status:"stopped",error:null});return t}return t.set(u.handle,{handle:u.handle,port:u.port??f?.port??null,previewUrl:u.previewUrl??f?.previewUrl??null,status:u.phase,error:u.phase==="failed"?u.error??"failed":null,projectName:u.projectName??f?.projectName??null,branch:u.branch??f?.branch??null,sandboxPath:u.sandboxPath??f?.sandboxPath??null}),t}function nau(){return{cluster:"connecting",clusterUrl:null,ingressUrl:null,ingressPort:null,machine:null,cap:bVt,sandboxes:new Map,daemonError:null,logPath:null,selectedHandle:null,pendingConfirm:null,removingHandles:new Set,actionError:null,actions:null}}function b3(){for(let i of c6i)i()}function Zq(){return lf}function jbi(i){return c6i.add(i),()=>c6i.delete(i)}function MVt(i){lf={...lf,cluster:i},b3()}function qVt(i){lf={...lf,clusterUrl:i},b3()}function VVt(i,u){lf={...lf,ingressPort:i,ingressUrl:u},b3()}function rVt(i){lf={...lf,machine:i},b3()}function mVt(i){lf={...lf,daemonError:i},b3()}function eVt(i){lf={...lf,logPath:i},b3()}function Xbi(i){lf={...lf,selectedHandle:i},b3()}function Bq(i){lf={...lf,pendingConfirm:i},b3()}function w6i(i){lf={...lf,actionError:i},b3()}function $6i(i,u){if(lf.removingHandles.has(i)===u)return;let t=new Set(lf.removingHandles);if(u)t.add(i);else t.delete(i);lf={...lf,removingHandles:t},b3()}function aVt(i){lf={...lf,actions:i},b3()}function Jbi(i){let u=TL(lf.sandboxes),t=Hau(u,i,lf.selectedHandle),f=new Map(lf.sandboxes);f.delete(i);let l=new Set(lf.removingHandles);l.delete(i),lf={...lf,sandboxes:f,selectedHandle:t,pendingConfirm:null,removingHandles:l},b3()}function oVt(i){let u=new Map;for(let t of i)u.set(t.handle,{handle:t.handle,port:t.port,previewUrl:t.previewUrl,status:t.status,error:t.error,projectName:t.projectName,branch:t.branch,sandboxPath:t.sandboxPath});for(let[t,f]of lf.sandboxes)if(CVt(f.status))u.set(t,f);lf={...lf,sandboxes:u},b3()}function sVt(i){lf={...lf,sandboxes:zau(lf.sandboxes,i)},b3()}function pVt(){lf=nau(),c6i.clear()}var bVt=20,lf,c6i;var Fq=O(()=>{lf=nau(),c6i=new Set});import{spawn as irt}from"child_process";function urt(i){if(i==="darwin")return"open";if(i==="win32")return"start";return"xdg-open"}function Rau(i,u=process.platform){let t=urt(u);try{irt(t,[i],{stdio:"ignore",detached:!0}).unref()}catch{}}var bau=()=>{};function Cau(i,u={}){let t=u.openUrl??Rau,f=Zq(),l=TL(f.sandboxes),E=f.selectedHandle!==null&&l.includes(f.selectedHandle)?f.selectedHandle:l[0]??null,c=f.actions;switch(i.type){case"move":Xbi(Qau(l,f.selectedHandle,i.delta));return;case"open":{if(E===null)return;let w=f.sandboxes.get(E);if(w?.status==="ready"&&w.previewUrl)t(w.previewUrl);return}case"stop":if(E!==null&&c)c.stopSandbox(E);return;case"delete":{if(E===null||!c)return;let w=c.inspectSandbox(E),$=f.sandboxes.get(E);w6i(null),Bq({handle:E,branch:w?.branch??$?.branch??null,dirtyCount:w?.dirtyCount??0,merged:w?.merged??null});return}case"confirmYes":{let w=f.pendingConfirm;if(Bq(null),w===null||!c)return;$6i(w.handle,!0),c.removeSandbox(w.handle).then(($)=>{if($.ok)Jbi(w.handle);else $6i(w.handle,!1),w6i($.error)});return}case"confirmNo":Bq(null);return;case"quit":if(c)c.quit();return}}var Mau=O(()=>{Fq();bau()});function qau(i,u,t){if(t)return i==="y"||i==="Y"?{type:"confirmYes"}:{type:"confirmNo"};if(u.upArrow||i==="k")return{type:"move",delta:-1};if(u.downArrow||i==="j")return{type:"move",delta:1};if(i==="s")return{type:"stop"};if(i==="d")return{type:"delete"};if(i==="o")return{type:"open"};if(i==="q"||u.ctrl===!0&&i==="c")return{type:"quit"};return null}var Vau={};ji(Vau,{LinkApp:()=>Ert});import{Box as b1,Text as hl,useInput as trt}from"ink";import{useSyncExternalStore as frt}from"react";import{jsx as kf,jsxs as J5}from"react/jsx-runtime";function lrt(i,u){if(u)return{color:"yellow",text:"\u25CC Removing\u2026"};if(i.status==="ready")return{color:"green",text:"\u25CF Live"};if(i.status==="spawning")return{color:"yellow",text:"\u25CC Starting\u2026"};if(i.status==="stopped")return{color:"gray",text:"\u25A0 Stopped"};if(i.status==="missing")return{color:"yellow",text:"\u25A1 Missing"};if(i.status==="merged")return{color:"cyan",text:"\u2713 Merged"};if(i.status==="invalid")return{color:"red",text:"\u2717 Invalid"};if(i.status==="failed")return{color:"red",text:`\u2717 Failed: ${i.error??"failed"}`};return{color:"red",text:`\u2717 Error: ${i.error??""}`}}function Ert(){let i=frt(jbi,Zq),u=[...i.sandboxes.values()].sort((l,E)=>l.handle.localeCompare(E.handle)),t=TL(i.sandboxes),f=i.selectedHandle!==null&&t.includes(i.selectedHandle)?i.selectedHandle:t[0]??null;return trt((l,E)=>{let c=qau(l,E,i.pendingConfirm!==null);if(c!==null)Cau(c)}),J5(b1,{flexDirection:"column",children:[kf(E6i,{version:FL.version}),kf(b1,{marginBottom:1,children:kf(hl,{dimColor:!0,children:"\u2500".repeat(80)})}),kf(b1,{children:i.cluster==="linked"?J5(hl,{color:"green",children:["\u2713 Connected to ",i.clusterUrl??"deco"]}):i.cluster==="connecting"?J5(hl,{color:"yellow",children:["\u25CC Connecting to ",i.clusterUrl??"deco","\u2026"]}):J5(hl,{color:"red",children:["\u2717 Disconnected from ",i.clusterUrl??"deco"]})}),kf(b1,{children:i.ingressUrl?J5(hl,{color:"green",children:["\u2713 Serving at ",i.ingressUrl]}):kf(hl,{dimColor:!0,children:"\u25CC Starting local server\u2026"})}),kf(b1,{marginBottom:1,children:kf(hl,{dimColor:!0,children:`${"Computer".padEnd(16)}${i.machine??"this computer"} \xB7 ${u.length} of ${i.cap} previews`})}),u.length===0?kf(hl,{dimColor:!0,children:"No previews running yet."}):J5(b1,{flexDirection:"column",children:[J5(b1,{children:[kf(b1,{width:2,flexShrink:0}),kf(b1,{width:UL.project,flexShrink:0,marginRight:1,children:kf(hl,{dimColor:!0,wrap:"truncate-end",children:"PROJECT"})}),kf(b1,{width:UL.branch,flexShrink:0,marginRight:1,children:kf(hl,{dimColor:!0,wrap:"truncate-end",children:"BRANCH"})}),kf(b1,{width:UL.status,flexShrink:0,marginRight:1,children:kf(hl,{dimColor:!0,wrap:"truncate-end",children:"STATUS"})}),kf(b1,{flexGrow:1,children:kf(hl,{dimColor:!0,wrap:"truncate-end",children:"PREVIEW URL"})})]}),u.map((l)=>{let E=lrt(l,i.removingHandles.has(l.handle)),c=l.handle===f;return J5(b1,{children:[kf(b1,{width:2,flexShrink:0,children:kf(hl,{color:"cyan",children:c?"\u203A":" "})}),kf(b1,{width:UL.project,flexShrink:0,marginRight:1,children:kf(hl,{bold:c,wrap:"truncate-end",children:l.projectName??l.handle})}),kf(b1,{width:UL.branch,flexShrink:0,marginRight:1,children:kf(hl,{bold:c,wrap:"truncate-end",children:l.branch??"\u2014"})}),kf(b1,{width:UL.status,flexShrink:0,marginRight:1,children:kf(hl,{color:E.color,bold:c,wrap:"truncate-end",children:E.text})}),kf(b1,{flexGrow:1,children:kf(hl,{dimColor:!0,wrap:"truncate-end",children:l.previewUrl??"\u2014"})})]},l.handle)})]}),i.daemonError?kf(b1,{marginTop:1,children:J5(hl,{color:"red",children:["\u26A0 ",i.daemonError]})}):null,i.logPath?kf(b1,{marginTop:1,children:J5(hl,{dimColor:!0,children:["Logs: ",i.logPath]})}):null,i.pendingConfirm?kf(b1,{marginTop:1,children:kf(hl,{color:"yellow",children:Lau(i.pendingConfirm)})}):null,i.actionError?kf(b1,{marginTop:1,children:J5(hl,{color:"red",children:["\u2717 ",i.actionError]})}):null,kf(b1,{marginTop:1,children:kf(hl,{dimColor:!0,children:"\u2191\u2193 move \xB7 s stop \xB7 d delete \xB7 o open \xB7 q quit"})})]})}var UL;var rau=O(()=>{t6i();kbi();Mau();Fq();UL={project:18,branch:22,status:14}});var mau={};ji(mau,{runLinkCommand:()=>_rt});import{closeSync as crt,mkdirSync as wrt,openSync as $rt,writeSync as hrt}from"fs";import{homedir as vrt}from"os";import{join as Ybi}from"path";function drt(i,u){let t={log:console.log,warn:console.warn,error:console.error},f=(l)=>{if(u===void 0)return;try{hrt(u,`${Pbi(l)}
 `)}catch{}};return console.log=(...l)=>f(l),console.warn=(...l)=>f(l),console.error=(...l)=>{f(l),i(Pbi(l))},()=>{console.log=t.log,console.warn=t.warn,console.error=t.error}}async function Drt(i,u){let t;try{t=await fetch(`${i}/api/links/me`,{headers:{authorization:`Bearer ${u}`},signal:AbortSignal.timeout(1e4)})}catch{return}if(t.status===401||t.status===403)throw Error(`Authentication rejected by ${i} \u2014 the session token was not accepted. `+`Run \`deco auth login --target ${i}\` and try again.`)}async function _rt(i={}){let u=i.port??5174,t=i.dataDir??process.env.DATA_DIR??process.env.DECOCMS_HOME??Ybi(vrt(),"deco"),f=i.clusterBaseUrl??process.env.STUDIO_CLUSTER_URL??process.env.MESH_CLUSTER_URL??"https://studio.decocms.com",l,E,c,w=()=>{if(c===void 0)return;try{c.close()}catch{}finally{c=void 0}};try{if(await Ibi(u,"127.0.0.1"))throw new xbi(u);let $=Ybi(t,"sandboxes");c=u6i({path:i6i(t),managedSandboxRoot:$});let h=await a1i({dataDir:t,intent:"Link",target:f});if(process.env.DECOCMS_LINK_MANAGED!=="1")await Drt(f,h.accessToken);let v=c.reconcile();if(i.prune){let N=c.prune({missing:!0,merged:!0});if(!i.tui)console.log(`Pruned local sandboxes: removed ${N.removed.length}, skipped ${N.skipped.length}.`);v=c.reconcile()}let d;if(i.tui){let{render:N}=await import("ink"),{createElement:Z}=await import("react"),{LinkApp:B}=await Promise.resolve().then(() => (rau(),Vau)),{pushSandboxEvent:F,setCluster:g,setClusterUrl:T,setDaemonError:U,setIngress:A,setLogPath:I,setMachine:k,setPersistedSandboxes:G}=await Promise.resolve().then(() => (Fq(),Kbi));wrt(t,{recursive:!0});let X=Ybi(t,"link.log");E=$rt(X,"w"),I(X),G(v),T(f),g("connecting"),d={onEvent:(b)=>F(b),onIngress:(b)=>A(b,`http://127.0.0.1:${b}`),onCluster:(b)=>g(b),onMachine:(b)=>k(b)},l=drt(U,E),N(Z(B),{patchConsole:!1})}else if(i.banner!==!1){let{printBanner:N}=await Promise.resolve().then(() => (gL(),Oq));N(i.version??"0.0.0")}w();let D=process.env.DECOCMS_LINK_MANAGED!=="1",_=await xau({port:u,clusterBaseUrl:f,dataDir:t,session:h,monitor:d,logFd:E,perSandboxLogs:D,hotReload:i.hotReload});if(i.tui){let{setLinkActions:N}=await Promise.resolve().then(() => (Fq(),Kbi));N({stopSandbox:_.stopSandbox,removeSandbox:_.removeSandbox,inspectSandbox:_.inspectSandbox,quit:_.stop})}return await _.stopped}catch($){return l?.(),console.error(Xau($)?Jau(u):$ instanceof Error?$.message:String($)),1}finally{if(l?.(),E!==void 0)try{crt(E)}catch{}w()}}var eau=O(()=>{tni();kau();Gbi();Kau();ybi()});var zbi={};ji(zbi,{resolveDevLinkClusterUrl:()=>Brt,populateDevLinkToxiProxy:()=>uou,isDevLinkToxiProxyEnabled:()=>Zrt,ensureDevLinkToxiProxy:()=>Art,buildDevLinkToxiProxyConfig:()=>pau,DEV_LINK_TOXIPROXY_SERVICE_NAME:()=>oau,DEV_LINK_TOXIPROXY_PROXY_NAME:()=>sau});function Zrt(i=process.env){return i.DECO_DEV_LINK_TOXIPROXY==="1"}function Wbi(i,u){if(!Number.isInteger(i)||i<1||i>65535)throw Error(`${u} must be an integer port in 1..65535`);return i}function pau(i){let u=new URL(i.serverUrl);if(u.protocol!=="http:")throw Error("DECO_DEV_LINK_TOXIPROXY only supports http local Studio URLs");let t=Wbi(i.apiPort,"apiPort"),f=Wbi(i.listenPort,"listenPort");if(u.port.length===0)throw Error("serverUrl must include an explicit valid port");let l=Wbi(Number.parseInt(u.port,10),"upstreamPort"),E=`http://127.0.0.1:${l}`,c=`http://127.0.0.1:${f}`;return{serviceName:oau,proxyName:sau,apiUrl:`http://127.0.0.1:${t}`,listen:`0.0.0.0:${f}`,upstream:`host.docker.internal:${l}`,publicTargetUrl:E,clusterUrl:c,logLine:`[dev-link-toxiproxy] ready: ${c} -> ${E}`}}function Brt(i){return i.toxiproxy?.clusterUrl??i.serverUrl}async function Sbi(i,u,t){if(i.ok)return;let f=await i.text();throw Error(`ToxiProxy ${u} failed for ${t}: status=${i.status} statusText=${i.statusText} body=${f}`)}function Hbi(i){if(i instanceof Error)return i.name==="Error"?i.message:`${i.name}: ${i.message}`;return String(i)}function iou(i){if(!(i instanceof Error))return!1;if(i.name==="TimeoutError")return!0;return iou(i.cause)}async function Lbi(i,u,t,f){try{return await i(t,f)}catch(l){throw Error(`ToxiProxy ${u} failed for ${t}: ${Hbi(l)}`,{cause:l})}}async function uou(i,u=fetch){let t=`${i.apiUrl}/reset`,f=await Lbi(u,"reset",t,{method:"POST"});await Sbi(f,"reset",t);let l=`${i.apiUrl}/populate`,E=await Lbi(u,"populate",l,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify([{name:i.proxyName,listen:i.listen,upstream:i.upstream,enabled:!0}])});await Sbi(E,"populate",l)}async function Frt(i,u){let t=`${i.apiUrl}/version`;try{await B1(async()=>{let f=await Lbi(u,"readiness check",t,{method:"GET",signal:AbortSignal.timeout(Ort)});await Sbi(f,"readiness check",t)},{maxAttempts:Nrt,minTimeout:aau,maxTimeout:aau,multiplier:1,jitter:0,isRetriable:(f)=>!iou(f)})}catch(f){let l=f instanceof H6?f.cause:f;throw Error(`ToxiProxy API did not become ready at ${t}: ${Hbi(l)}`,{cause:l})}}async function grt(i){if(i===null)return"";return await new Response(i).text()}async function Qbi(i,u={}){let t=["docker",...i].join(" "),f=(()=>{try{return Bun.spawn(["docker",...i],{stdout:"ignore",stderr:"pipe"})}catch(w){throw Error(`Docker command failed to start (${t}): ${Hbi(w)}`,{cause:w})}})(),[l,E]=await Promise.all([f.exited,grt(f.stderr)]);if(l===0||u.ignoreFailure===!0)return;let c=E.trim().length>0?`: ${E.trim()}`:"";throw Error(`Docker command failed (${t}) with exit ${l}${c}`)}async function Trt(i,u){let t=`deco-dev-link-toxiproxy-${i}`;await Qbi(["rm","-f",t],{ignoreFailure:!0}),await Qbi(["run","--rm","-d","--name",t,"-p",`127.0.0.1:${i}:8474`,"-p",`127.0.0.1:${u}:${u}`,"ghcr.io/shopify/toxiproxy:2.12.0","-host=0.0.0.0"])}async function Urt(i,u){let t=`deco-dev-link-toxiproxy-${i}`;await Qbi(["rm","-f",t],{ignoreFailure:!0})}async function Art(i){let u=pau(i),t=i.startDaemon??Trt,f=i.stopDaemon??(i.startDaemon===void 0?Urt:void 0);await t(i.apiPort,i.listenPort);let l=i.fetchImpl??fetch;try{await Frt(u,l),await uou(u,l)}catch(E){if(f!==void 0)try{await f(i.apiPort,i.listenPort)}catch{}throw E}return{config:u,stop:async()=>{if(f!==void 0)await f(i.apiPort,i.listenPort)}}}var oau="ToxiProxy",sau="dev_link_studio",Nrt=20,aau=100,Ort=100;var nbi=O(()=>{O4()});var tou={};ji(tou,{migrateBetterAuth:()=>Rbi});import{getMigrations as yrt}from"better-auth/db";import{sso as Prt}from"@better-auth/sso";import{organization as Irt}from"@decocms/better-auth/plugins";import{admin as Grt,apiKey as xrt,jwt as krt,magicLink as jrt,mcp as Xrt,openAPI as Jrt}from"better-auth/plugins";import{emailOTP as Krt}from"better-auth/plugins/email-otp";async function Rbi(i){let t={database:XM(i||d_()),plugins:[Irt({dynamicAccessControl:{enabled:!0,enableCustomResources:!0}}),Grt(),xrt(),krt(),Jrt(),Xrt({loginPage:"/login"}),Prt(),jrt({sendMagicLink:async()=>{}}),Krt({sendVerificationOTP:async()=>{}})]},{toBeAdded:f,toBeCreated:l,runMigrations:E}=await yrt(t);if(!f.length&&!l.length)return"up to date";return await E(),`${l.length+f.length} table(s) migrated`}var bbi=O(()=>{b6()});var Cbi={};ji(Cbi,{up:()=>Yrt,down:()=>Wrt});import{sql as _d}from"kysely";async function Yrt(i){await i.schema.createTable("connections").addColumn("id","text",(u)=>u.primaryKey()).addColumn("organizationId","text",(u)=>u.notNull().references("organization.id").onDelete("cascade")).addColumn("createdById","text",(u)=>u.notNull().references("user.id").onDelete("cascade")).addColumn("name","text",(u)=>u.notNull()).addColumn("description","text").addColumn("icon","text").addColumn("appName","text").addColumn("appId","text").addColumn("connectionType","text",(u)=>u.notNull()).addColumn("connectionUrl","text",(u)=>u.notNull()).addColumn("connectionToken","text").addColumn("connectionHeaders","text").addColumn("oauthConfig","text").addColumn("metadata","text").addColumn("tools","text").addColumn("bindings","text").addColumn("status","text",(u)=>u.notNull().defaultTo("active")).addColumn("createdAt","text",(u)=>u.notNull().defaultTo(_d`CURRENT_TIMESTAMP`)).addColumn("updatedAt","text",(u)=>u.notNull().defaultTo(_d`CURRENT_TIMESTAMP`)).execute(),await i.schema.createTable("api_keys").addColumn("id","text",(u)=>u.primaryKey()).addColumn("userId","text",(u)=>u.notNull().references("user.id").onDelete("cascade")).addColumn("name","text",(u)=>u.notNull()).addColumn("hashedKey","text",(u)=>u.notNull().unique()).addColumn("permissions","text",(u)=>u.notNull()).addColumn("expiresAt","text").addColumn("remaining","integer").addColumn("metadata","text").addColumn("createdAt","text",(u)=>u.notNull().defaultTo(_d`CURRENT_TIMESTAMP`)).addColumn("updatedAt","text",(u)=>u.notNull().defaultTo(_d`CURRENT_TIMESTAMP`)).execute(),await i.schema.createTable("audit_logs").addColumn("id","text",(u)=>u.primaryKey()).addColumn("organizationId","text").addColumn("userId","text",(u)=>u.references("user.id").onDelete("set null")).addColumn("connectionId","text",(u)=>u.references("connections.id").onDelete("set null")).addColumn("toolName","text",(u)=>u.notNull()).addColumn("allowed","integer",(u)=>u.notNull()).addColumn("duration","integer").addColumn("timestamp","text",(u)=>u.notNull().defaultTo(_d`CURRENT_TIMESTAMP`)).addColumn("requestMetadata","text").execute(),await i.schema.createTable("oauth_clients").addColumn("id","text",(u)=>u.primaryKey()).addColumn("clientId","text",(u)=>u.notNull().unique()).addColumn("clientSecret","text").addColumn("clientName","text",(u)=>u.notNull()).addColumn("redirectUris","text",(u)=>u.notNull()).addColumn("grantTypes","text",(u)=>u.notNull()).addColumn("scope","text").addColumn("clientUri","text").addColumn("logoUri","text").addColumn("createdAt","text",(u)=>u.notNull().defaultTo(_d`CURRENT_TIMESTAMP`)).execute(),await i.schema.createTable("oauth_authorization_codes").addColumn("code","text",(u)=>u.primaryKey()).addColumn("clientId","text",(u)=>u.notNull().references("oauth_clients.clientId").onDelete("cascade")).addColumn("userId","text",(u)=>u.notNull().references("user.id").onDelete("cascade")).addColumn("redirectUri","text",(u)=>u.notNull()).addColumn("scope","text").addColumn("codeChallenge","text").addColumn("codeChallengeMethod","text").addColumn("expiresAt","text",(u)=>u.notNull()).addColumn("createdAt","text",(u)=>u.notNull().defaultTo(_d`CURRENT_TIMESTAMP`)).execute(),await i.schema.createTable("oauth_refresh_tokens").addColumn("token","text",(u)=>u.primaryKey()).addColumn("clientId","text",(u)=>u.notNull().references("oauth_clients.clientId").onDelete("cascade")).addColumn("userId","text",(u)=>u.notNull().references("user.id").onDelete("cascade")).addColumn("scope","text").addColumn("expiresAt","text").addColumn("createdAt","text",(u)=>u.notNull().defaultTo(_d`CURRENT_TIMESTAMP`)).execute(),await i.schema.createTable("downstream_tokens").addColumn("id","text",(u)=>u.primaryKey()).addColumn("connectionId","text",(u)=>u.notNull().references("connections.id").onDelete("cascade")).addColumn("userId","text",(u)=>u.references("user.id").onDelete("cascade")).addColumn("accessToken","text",(u)=>u.notNull()).addColumn("refreshToken","text").addColumn("scope","text").addColumn("expiresAt","text").addColumn("createdAt","text",(u)=>u.notNull().defaultTo(_d`CURRENT_TIMESTAMP`)).addColumn("updatedAt","text",(u)=>u.notNull().defaultTo(_d`CURRENT_TIMESTAMP`)).execute(),await i.schema.createIndex("idx_connections_organizationId").on("connections").column("organizationId").execute(),await i.schema.createIndex("idx_audit_logs_organizationId").on("audit_logs").column("organizationId").execute(),await i.schema.createIndex("idx_audit_logs_userId").on("audit_logs").column("userId").execute(),await i.schema.createIndex("idx_audit_logs_timestamp").on("audit_logs").column("timestamp").execute()}async function Wrt(i){await i.schema.dropTable("downstream_tokens").execute(),await i.schema.dropTable("oauth_refresh_tokens").execute(),await i.schema.dropTable("oauth_authorization_codes").execute(),await i.schema.dropTable("oauth_clients").execute(),await i.schema.dropTable("audit_logs").execute(),await i.schema.dropTable("api_keys").execute(),await i.schema.dropTable("connections").execute()}var fou=()=>{};var Mbi={};ji(Mbi,{up:()=>Srt,down:()=>Lrt});import{sql as lou}from"kysely";async function Srt(i){await i.schema.createTable("organization_settings").addColumn("organizationId","text",(u)=>u.primaryKey().references("organization.id").onDelete("cascade")).addColumn("modelsBindingConnectionId","text",(u)=>u.references("connections.id").onDelete("set null")).addColumn("createdAt","text",(u)=>u.notNull().defaultTo(lou`CURRENT_TIMESTAMP`)).addColumn("updatedAt","text",(u)=>u.notNull().defaultTo(lou`CURRENT_TIMESTAMP`)).execute()}async function Lrt(i){await i.schema.dropTable("organization_settings").execute()}var Eou=()=>{};var qbi={};ji(qbi,{up:()=>Qrt,down:()=>Hrt});async function Qrt(i){await i.schema.alterTable("connections").renameColumn("name","title").execute(),await i.schema.alterTable("connections").renameColumn("createdById","created_by").execute(),await i.schema.alterTable("connections").renameColumn("createdAt","created_at").execute(),await i.schema.alterTable("connections").renameColumn("updatedAt","updated_at").execute(),await i.schema.alterTable("connections").renameColumn("organizationId","organization_id").execute(),await i.schema.alterTable("connections").renameColumn("connectionType","connection_type").execute(),await i.schema.alterTable("connections").renameColumn("connectionUrl","connection_url").execute(),await i.schema.alterTable("connections").renameColumn("connectionToken","connection_token").execute(),await i.schema.alterTable("connections").renameColumn("connectionHeaders","connection_headers").execute(),await i.schema.alterTable("connections").renameColumn("oauthConfig","oauth_config").execute(),await i.schema.alterTable("connections").renameColumn("appName","app_name").execute(),await i.schema.alterTable("connections").renameColumn("appId","app_id").execute()}async function Hrt(i){await i.schema.alterTable("connections").renameColumn("title","name").execute(),await i.schema.alterTable("connections").renameColumn("created_by","createdById").execute(),await i.schema.alterTable("connections").renameColumn("created_at","createdAt").execute(),await i.schema.alterTable("connections").renameColumn("updated_at","updatedAt").execute(),await i.schema.alterTable("connections").renameColumn("organization_id","organizationId").execute(),await i.schema.alterTable("connections").renameColumn("connection_type","connectionType").execute(),await i.schema.alterTable("connections").renameColumn("connection_url","connectionUrl").execute(),await i.schema.alterTable("connections").renameColumn("connection_token","connectionToken").execute(),await i.schema.alterTable("connections").renameColumn("connection_headers","connectionHeaders").execute(),await i.schema.alterTable("connections").renameColumn("oauth_config","oauthConfig").execute(),await i.schema.alterTable("connections").renameColumn("app_name","appName").execute(),await i.schema.alterTable("connections").renameColumn("app_id","appId").execute()}var Vbi={};ji(Vbi,{up:()=>zrt,down:()=>nrt});async function zrt(i){await i.schema.createTable("organization_settings_new").addColumn("organizationId","text",(u)=>u.primaryKey().references("organization.id").onDelete("cascade")).addColumn("createdAt","text",(u)=>u.notNull()).addColumn("updatedAt","text",(u)=>u.notNull()).execute(),await i.insertInto("organization_settings_new").columns(["organizationId","createdAt","updatedAt"]).expression((u)=>u.selectFrom("organization_settings").select(["organizationId","createdAt","updatedAt"])).execute(),await i.schema.dropTable("organization_settings").execute(),await i.schema.alterTable("organization_settings_new").renameTo("organization_settings").execute()}async function nrt(i){await i.schema.createTable("organization_settings_new").addColumn("organizationId","text",(u)=>u.primaryKey().references("organization.id").onDelete("cascade")).addColumn("modelsBindingConnectionId","text",(u)=>u.references("connections.id").onDelete("set null")).addColumn("createdAt","text",(u)=>u.notNull()).addColumn("updatedAt","text",(u)=>u.notNull()).execute(),await i.insertInto("organization_settings_new").columns(["organizationId","modelsBindingConnectionId","createdAt","updatedAt"]).expression((u)=>u.selectFrom("organization_settings").select(["organizationId",u.val(null).as("modelsBindingConnectionId"),"createdAt","updatedAt"])).execute(),await i.schema.dropTable("organization_settings").execute(),await i.schema.alterTable("organization_settings_new").renameTo("organization_settings").execute()}var rbi={};ji(rbi,{up:()=>Rrt,down:()=>brt});async function Rrt(i){await i.schema.alterTable("connections").addColumn("configuration_state","text").execute(),await i.schema.alterTable("connections").addColumn("configuration_scopes","text").execute()}async function brt(i){await i.schema.alterTable("connections").dropColumn("configuration_state").execute(),await i.schema.alterTable("connections").dropColumn("configuration_scopes").execute()}var mbi={};ji(mbi,{up:()=>Mrt,down:()=>qrt});import{sql as Crt}from"kysely";async function Mrt(i){await i.schema.alterTable("organization_settings").addColumn("sidebar_items",Crt`text`).execute()}async function qrt(i){await i.schema.alterTable("organization_settings").dropColumn("sidebar_items").execute()}var cou=()=>{};var ebi={};ji(ebi,{up:()=>Vrt,down:()=>rrt});async function Vrt(i){await i.schema.createTable("monitoring_logs").addColumn("id","text",(u)=>u.primaryKey()).addColumn("organization_id","text",(u)=>u.notNull().references("organization.id").onDelete("cascade")).addColumn("connection_id","text",(u)=>u.notNull().references("connections.id").onDelete("cascade")).addColumn("connection_title","text",(u)=>u.notNull()).addColumn("tool_name","text",(u)=>u.notNull()).addColumn("input","text",(u)=>u.notNull()).addColumn("output","text",(u)=>u.notNull()).addColumn("is_error","integer",(u)=>u.notNull()).addColumn("error_message","text").addColumn("duration_ms","integer",(u)=>u.notNull()).addColumn("timestamp","text",(u)=>u.notNull()).addColumn("user_id","text").addColumn("request_id","text",(u)=>u.notNull()).execute(),await i.schema.createIndex("monitoring_logs_org_timestamp").on("monitoring_logs").columns(["organization_id","timestamp"]).execute(),await i.schema.createIndex("monitoring_logs_connection_timestamp").on("monitoring_logs").columns(["connection_id","timestamp"]).execute(),await i.schema.createIndex("monitoring_logs_is_error").on("monitoring_logs").columns(["organization_id","is_error","timestamp"]).execute()}async function rrt(i){await i.schema.dropIndex("monitoring_logs_is_error").execute(),await i.schema.dropIndex("monitoring_logs_connection_timestamp").execute(),await i.schema.dropIndex("monitoring_logs_org_timestamp").execute(),await i.schema.dropTable("monitoring_logs").execute()}var abi={};ji(abi,{up:()=>mrt,down:()=>ert});import{sql as gq}from"kysely";async function mrt(i){await i.schema.createTable("events").addColumn("id","text",(u)=>u.primaryKey()).addColumn("organization_id","text",(u)=>u.notNull().references("organization.id").onDelete("cascade")).addColumn("type","text",(u)=>u.notNull()).addColumn("source","text",(u)=>u.notNull()).addColumn("specversion","text",(u)=>u.notNull().defaultTo("1.0")).addColumn("subject","text").addColumn("time","text",(u)=>u.notNull()).addColumn("datacontenttype","text",(u)=>u.notNull().defaultTo("application/json")).addColumn("dataschema","text").addColumn("data","text").addColumn("cron","varchar(255)").addColumn("status","text",(u)=>u.notNull().defaultTo("pending")).addColumn("attempts","integer",(u)=>u.notNull().defaultTo(0)).addColumn("last_error","text").addColumn("next_retry_at","text").addColumn("created_at","text",(u)=>u.notNull().defaultTo(gq`CURRENT_TIMESTAMP`)).addColumn("updated_at","text",(u)=>u.notNull().defaultTo(gq`CURRENT_TIMESTAMP`)).execute(),await i.schema.createTable("event_subscriptions").addColumn("id","text",(u)=>u.primaryKey()).addColumn("organization_id","text",(u)=>u.notNull().references("organization.id").onDelete("cascade")).addColumn("connection_id","text",(u)=>u.notNull().references("connections.id").onDelete("cascade")).addColumn("publisher","text").addColumn("event_type","text",(u)=>u.notNull()).addColumn("filter","text").addColumn("enabled","integer",(u)=>u.notNull().defaultTo(1)).addColumn("created_at","text",(u)=>u.notNull().defaultTo(gq`CURRENT_TIMESTAMP`)).addColumn("updated_at","text",(u)=>u.notNull().defaultTo(gq`CURRENT_TIMESTAMP`)).execute(),await i.schema.createTable("event_deliveries").addColumn("id","text",(u)=>u.primaryKey()).addColumn("event_id","text",(u)=>u.notNull()).addColumn("subscription_id","text",(u)=>u.notNull().references("event_subscriptions.id").onDelete("cascade")).addColumn("status","text",(u)=>u.notNull().defaultTo("pending")).addColumn("attempts","integer",(u)=>u.notNull().defaultTo(0)).addColumn("last_error","text").addColumn("delivered_at","text").addColumn("next_retry_at","text").addColumn("created_at","text",(u)=>u.notNull().defaultTo(gq`CURRENT_TIMESTAMP`)).execute(),await i.schema.createIndex("idx_events_org_status").on("events").columns(["organization_id","status"]).execute(),await i.schema.createIndex("idx_events_source").on("events").columns(["source"]).execute(),await i.schema.createIndex("idx_events_type").on("events").columns(["type"]).execute(),await i.schema.createIndex("idx_events_retry").on("events").columns(["status","next_retry_at"]).execute(),await i.schema.createIndex("idx_subscriptions_connection").on("event_subscriptions").columns(["connection_id"]).execute(),await i.schema.createIndex("idx_subscriptions_type").on("event_subscriptions").columns(["event_type"]).execute(),await i.schema.createIndex("idx_subscriptions_org_enabled").on("event_subscriptions").columns(["organization_id","enabled"]).execute(),await i.schema.createIndex("idx_subscriptions_unique").on("event_subscriptions").columns(["connection_id","event_type","publisher","filter"]).unique().execute(),await i.schema.createIndex("idx_deliveries_event").on("event_deliveries").columns(["event_id"]).execute(),await i.schema.createIndex("idx_deliveries_subscription_status").on("event_deliveries").columns(["subscription_id","status"]).execute(),await i.schema.createIndex("idx_deliveries_retry").on("event_deliveries").columns(["status","next_retry_at"]).execute()}async function ert(i){await i.schema.dropIndex("idx_deliveries_retry").execute(),await i.schema.dropIndex("idx_deliveries_subscription_status").execute(),await i.schema.dropIndex("idx_deliveries_event").execute(),await i.schema.dropIndex("idx_subscriptions_unique").execute(),await i.schema.dropIndex("idx_subscriptions_org_enabled").execute(),await i.schema.dropIndex("idx_subscriptions_type").execute(),await i.schema.dropIndex("idx_subscriptions_connection").execute(),await i.schema.dropIndex("idx_events_retry").execute(),await i.schema.dropIndex("idx_events_type").execute(),await i.schema.dropIndex("idx_events_source").execute(),await i.schema.dropIndex("idx_events_org_status").execute(),await i.schema.dropTable("event_deliveries").execute(),await i.schema.dropTable("event_subscriptions").execute(),await i.schema.dropTable("events").execute()}var wou=()=>{};var obi={};ji(obi,{up:()=>ort,down:()=>srt});import{sql as art}from"kysely";async function ort(i){await i.schema.dropTable("audit_logs").ifExists().execute()}async function srt(i){await i.schema.createTable("audit_logs").ifNotExists().addColumn("id","text",(u)=>u.primaryKey()).addColumn("organizationId","text").addColumn("userId","text",(u)=>u.references("user.id").onDelete("set null")).addColumn("connectionId","text",(u)=>u.references("connections.id").onDelete("set null")).addColumn("toolName","text",(u)=>u.notNull()).addColumn("allowed","integer",(u)=>u.notNull()).addColumn("duration","integer").addColumn("timestamp","text",(u)=>u.notNull().defaultTo(art`CURRENT_TIMESTAMP`)).addColumn("requestMetadata","text").execute(),await i.schema.createIndex("idx_audit_logs_organizationId").on("audit_logs").column("organizationId").execute(),await i.schema.createIndex("idx_audit_logs_userId").on("audit_logs").column("userId").execute(),await i.schema.createIndex("idx_audit_logs_timestamp").on("audit_logs").column("timestamp").execute()}var $ou=()=>{};var sbi={};ji(sbi,{up:()=>prt,down:()=>imt});import{sql as h6i}from"kysely";async function prt(i){await i.schema.createTable("gateways").addColumn("id","text",(u)=>u.primaryKey()).addColumn("organization_id","text",(u)=>u.notNull().references("organization.id").onDelete("cascade")).addColumn("title","text",(u)=>u.notNull()).addColumn("description","text").addColumn("tool_selection_strategy","text").addColumn("status","text",(u)=>u.notNull().defaultTo("active")).addColumn("is_default","integer",(u)=>u.notNull().defaultTo(0)).addColumn("created_at","text",(u)=>u.notNull().defaultTo(h6i`CURRENT_TIMESTAMP`)).addColumn("updated_at","text",(u)=>u.notNull().defaultTo(h6i`CURRENT_TIMESTAMP`)).addColumn("created_by","text",(u)=>u.notNull().references("user.id").onDelete("cascade")).addColumn("updated_by","text").execute(),await i.schema.createTable("gateway_connections").addColumn("id","text",(u)=>u.primaryKey()).addColumn("gateway_id","text",(u)=>u.notNull().references("gateways.id").onDelete("cascade")).addColumn("connection_id","text",(u)=>u.notNull().references("connections.id").onDelete("cascade")).addColumn("selected_tools","text").addColumn("created_at","text",(u)=>u.notNull().defaultTo(h6i`CURRENT_TIMESTAMP`)).execute(),await i.schema.createIndex("idx_gateways_org").on("gateways").columns(["organization_id"]).execute(),await i.schema.createIndex("idx_gateways_org_status").on("gateways").columns(["organization_id","status"]).execute(),await h6i`CREATE UNIQUE INDEX idx_gateways_default_per_org ON gateways (organization_id) WHERE is_default = 1`.execute(i),await i.schema.createIndex("idx_gateway_connections_gateway").on("gateway_connections").columns(["gateway_id"]).execute(),await i.schema.createIndex("idx_gateway_connections_connection").on("gateway_connections").columns(["connection_id"]).execute(),await i.schema.createIndex("idx_gateway_connections_unique").on("gateway_connections").columns(["gateway_id","connection_id"]).unique().execute()}async function imt(i){await i.schema.dropIndex("idx_gateway_connections_unique").execute(),await i.schema.dropIndex("idx_gateway_connections_connection").execute(),await i.schema.dropIndex("idx_gateway_connections_gateway").execute(),await i.schema.dropIndex("idx_gateways_default_per_org").execute(),await i.schema.dropIndex("idx_gateways_org_status").execute(),await i.schema.dropIndex("idx_gateways_org").execute(),await i.schema.dropTable("gateway_connections").execute(),await i.schema.dropTable("gateways").execute()}var hou=()=>{};var pbi={};ji(pbi,{up:()=>umt,down:()=>tmt});async function umt(i){await i.schema.alterTable("gateways").addColumn("icon","text").execute()}async function tmt(i){await i.schema.alterTable("gateways").dropColumn("icon").execute()}var iCi={};ji(iCi,{up:()=>fmt,down:()=>lmt});import{sql as v6i}from"kysely";async function fmt(i){await i.schema.alterTable("gateways").addColumn("tool_selection_mode","text",(u)=>u.notNull().defaultTo("inclusion")).execute(),await v6i`
     UPDATE gateways
     SET tool_selection_mode = CASE
@@ -85270,7 +85270,7 @@ conversation.
 `);let f=u.pax;if(f)for(let l in f)t+=x4u(" "+l+"="+f[l]+`
 `);return mf.from(t)};QHf.decodePax=function(u){let t={};while(u.length){let f=0;while(f<u.length&&u[f]!==32)f++;let l=parseInt(mf.toString(u.subarray(0,f)),10);if(!l)return t;let E=mf.toString(u.subarray(f+1,l-1)),c=E.indexOf("=");if(c===-1)return t;t[E.slice(0,c)]=E.slice(c+1),u=u.subarray(l)}return t};QHf.encode=function(u){let t=mf.alloc(512),f=u.name,l="";if(u.typeflag===5&&f[f.length-1]!=="/")f+="/";if(mf.byteLength(f)!==f.length)return null;while(mf.byteLength(f)>100){let E=f.indexOf("/");if(E===-1)return null;l+=l?"/"+f.slice(0,E):f.slice(0,E),f=f.slice(E+1)}if(mf.byteLength(f)>100||mf.byteLength(l)>155)return null;if(u.linkname&&mf.byteLength(u.linkname)>100)return null;if(mf.write(t,f),mf.write(t,XN(u.mode&4095,6),100),mf.write(t,XN(u.uid,6),108),mf.write(t,XN(u.gid,6),116),SHf(u.size,t,124),mf.write(t,XN(u.mtime.getTime()/1000|0,11),136),t[156]=48+YHf(u.type),u.linkname)mf.write(t,u.linkname,157);if(mf.copy(IP0,t,257),mf.copy(GHf,t,263),u.uname)mf.write(t,u.uname,265);if(u.gname)mf.write(t,u.gname,297);if(mf.write(t,XN(u.devmajor||0,6),329),mf.write(t,XN(u.devminor||0,6),337),l)mf.write(t,l,345);return mf.write(t,XN(xP0(t),6),148),t};QHf.decode=function(u,t,f){let l=u[156]===0?0:u[156]-48,E=oz(u,0,100,t),c=jN(u,100,8),w=jN(u,108,8),$=jN(u,116,8),h=jN(u,124,12),v=jN(u,136,12),d=KHf(l),D=u[157]===0?null:oz(u,157,100,t),_=oz(u,265,32),N=oz(u,297,32),Z=jN(u,329,8),B=jN(u,337,8),F=xP0(u);if(F===256)return null;if(F!==jN(u,148,8))throw Error("Invalid tar header. Maybe the tar is corrupted or it needs to be gunzipped?");if(jHf(u)){if(u[345])E=oz(u,345,155,t)+"/"+E}else if(XHf(u));else if(!f)throw Error("Invalid tar header: unknown format.");if(l===0&&E&&E[E.length-1]==="/")l=5;return{name:E,mode:c,uid:w,gid:$,size:h,mtime:new Date(1000*v),type:d,linkname:D,uname:_,gname:N,devmajor:Z,devminor:B,pax:null}};function jHf(i){return mf.equals(IP0,i.subarray(257,263))}function XHf(i){return mf.equals(xHf,i.subarray(257,263))&&mf.equals(kHf,i.subarray(263,265))}function JHf(i,u,t){if(typeof i!=="number")return t;if(i=~~i,i>=u)return u;if(i>=0)return i;if(i+=u,i>=0)return i;return 0}function KHf(i){switch(i){case 0:return"file";case 1:return"link";case 2:return"symlink";case 3:return"character-device";case 4:return"block-device";case 5:return"directory";case 6:return"fifo";case 7:return"contiguous-file";case 72:return"pax-header";case 55:return"pax-global-header";case 27:return"gnu-long-link-path";case 28:case 30:return"gnu-long-path"}return null}function YHf(i){switch(i){case"file":return 0;case"link":return 1;case"symlink":return 2;case"character-device":return 3;case"block-device":return 4;case"directory":return 5;case"fifo":return 6;case"contiguous-file":return 7;case"pax-header":return 72}return 0}function GP0(i,u,t,f){for(;t<f;t++)if(i[t]===u)return t;return f}function xP0(i){let u=256;for(let t=0;t<148;t++)u+=i[t];for(let t=156;t<512;t++)u+=i[t];return u}function XN(i,u){if(i=i.toString(8),i.length>u)return"7777777777777777777".slice(0,u)+" ";return"0000000000000000000".slice(0,u-i.length)+i+" "}function WHf(i,u,t){u[t]=128;for(let f=11;f>0;f--)u[t+f]=i&255,i=Math.floor(i/256)}function SHf(i,u,t){if(i.toString(8).length>11)WHf(i,u,t);else mf.write(u,XN(i,11),t)}function LHf(i){let u;if(i[0]===128)u=!0;else if(i[0]===255)u=!1;else return null;let t=[],f;for(f=i.length-1;f>0;f--){let c=i[f];if(u)t.push(c);else t.push(255-c)}let l=0,E=t.length;for(f=0;f<E;f++)l+=t[f]*Math.pow(256,f);return u?l:-1*l}function jN(i,u,t){if(i=i.subarray(u,u+t),u=0,i[u]&128)return LHf(i);else{while(u<i.length&&i[u]===32)u++;let f=JHf(GP0(i,32,u,i.length),i.length,i.length);while(u<f&&i[u]===0)u++;if(f===u)return 0;return parseInt(mf.toString(i.subarray(u,f)),8)}}function oz(i,u,t,f){return mf.toString(i.subarray(u,GP0(i,0,u,u+t)),f)}function x4u(i){let u=mf.byteLength(i),t=Math.floor(Math.log(u)/Math.log(10))+1;if(u+t>=Math.pow(10,t))t++;return u+t+i}});var SP0=Y((r46,WP0)=>{var{Writable:CHf,Readable:MHf,getStreamError:kP0}=G4u(),qHf=T4u(),jP0=az(),sz=k4u(),VHf=jP0.alloc(0);class XP0{constructor(){this.buffered=0,this.shifted=0,this.queue=new qHf,this._offset=0}push(i){this.buffered+=i.byteLength,this.queue.push(i)}shiftFirst(i){return this._buffered===0?null:this._next(i)}shift(i){if(i>this.buffered)return null;if(i===0)return VHf;let u=this._next(i);if(i===u.byteLength)return u;let t=[u];while((i-=u.byteLength)>0)u=this._next(i),t.push(u);return jP0.concat(t)}_next(i){let u=this.queue.peek(),t=u.byteLength-this._offset;if(i>=t){let f=this._offset?u.subarray(this._offset,u.byteLength):u;return this.queue.shift(),this._offset=0,this.buffered-=t,this.shifted+=t,f}return this.buffered-=i,this.shifted+=i,u.subarray(this._offset,this._offset+=i)}}class JP0 extends MHf{constructor(i,u,t){super();this.header=u,this.offset=t,this._parent=i}_read(i){if(this.header.size===0)this.push(null);if(this._parent._stream===this)this._parent._update();i(null)}_predestroy(){this._parent.destroy(kP0(this))}_detach(){if(this._parent._stream===this)this._parent._stream=null,this._parent._missing=YP0(this.header.size),this._parent._update()}_destroy(i){this._detach(),i(null)}}class KP0 extends CHf{constructor(i){super(i);if(!i)i={};this._buffer=new XP0,this._offset=0,this._header=null,this._stream=null,this._missing=0,this._longHeader=!1,this._callback=j4u,this._locked=!1,this._finished=!1,this._pax=null,this._paxGlobal=null,this._gnuLongPath=null,this._gnuLongLinkPath=null,this._filenameEncoding=i.filenameEncoding||"utf-8",this._allowUnknownFormat=!!i.allowUnknownFormat,this._unlockBound=this._unlock.bind(this)}_unlock(i){if(this._locked=!1,i){this.destroy(i),this._continueWrite(i);return}this._update()}_consumeHeader(){if(this._locked)return!1;this._offset=this._buffer.shifted;try{this._header=sz.decode(this._buffer.shift(512),this._filenameEncoding,this._allowUnknownFormat)}catch(i){return this._continueWrite(i),!1}if(!this._header)return!0;switch(this._header.type){case"gnu-long-path":case"gnu-long-link-path":case"pax-global-header":case"pax-header":return this._longHeader=!0,this._missing=this._header.size,!0}if(this._locked=!0,this._applyLongHeaders(),this._header.size===0||this._header.type==="directory")return this.emit("entry",this._header,this._createStream(),this._unlockBound),!0;return this._stream=this._createStream(),this._missing=this._header.size,this.emit("entry",this._header,this._stream,this._unlockBound),!0}_applyLongHeaders(){if(this._gnuLongPath)this._header.name=this._gnuLongPath,this._gnuLongPath=null;if(this._gnuLongLinkPath)this._header.linkname=this._gnuLongLinkPath,this._gnuLongLinkPath=null;if(this._pax){if(this._pax.path)this._header.name=this._pax.path;if(this._pax.linkpath)this._header.linkname=this._pax.linkpath;if(this._pax.size)this._header.size=parseInt(this._pax.size,10);this._header.pax=this._pax,this._pax=null}}_decodeLongHeader(i){switch(this._header.type){case"gnu-long-path":this._gnuLongPath=sz.decodeLongPath(i,this._filenameEncoding);break;case"gnu-long-link-path":this._gnuLongLinkPath=sz.decodeLongPath(i,this._filenameEncoding);break;case"pax-global-header":this._paxGlobal=sz.decodePax(i);break;case"pax-header":this._pax=this._paxGlobal===null?sz.decodePax(i):Object.assign({},this._paxGlobal,sz.decodePax(i));break}}_consumeLongHeader(){this._longHeader=!1,this._missing=YP0(this._header.size);let i=this._buffer.shift(this._header.size);try{this._decodeLongHeader(i)}catch(u){return this._continueWrite(u),!1}return!0}_consumeStream(){let i=this._buffer.shiftFirst(this._missing);if(i===null)return!1;this._missing-=i.byteLength;let u=this._stream.push(i);if(this._missing===0){if(this._stream.push(null),u)this._stream._detach();return u&&this._locked===!1}return u}_createStream(){return new JP0(this,this._header,this._offset)}_update(){while(this._buffer.buffered>0&&!this.destroying){if(this._missing>0){if(this._stream!==null){if(this._consumeStream()===!1)return;continue}if(this._longHeader===!0){if(this._missing>this._buffer.buffered)break;if(this._consumeLongHeader()===!1)return!1;continue}let i=this._buffer.shiftFirst(this._missing);if(i!==null)this._missing-=i.byteLength;continue}if(this._buffer.buffered<512)break;if(this._stream!==null||this._consumeHeader()===!1)return}this._continueWrite(null)}_continueWrite(i){let u=this._callback;this._callback=j4u,u(i)}_write(i,u){this._callback=u,this._buffer.push(i),this._update()}_final(i){this._finished=this._missing===0&&this._buffer.buffered===0,i(this._finished?null:Error("Unexpected end of data"))}_predestroy(){this._continueWrite(null)}_destroy(i){if(this._stream)this._stream.destroy(kP0(this));i(null)}[Symbol.asyncIterator](){let i=null,u=null,t=null,f=null,l=null,E=this;return this.on("entry",$),this.on("error",(d)=>{i=d}),this.on("close",h),{[Symbol.asyncIterator](){return this},next(){return new Promise(w)},return(){return v(null)},throw(d){return v(d)}};function c(d){if(!l)return;let D=l;l=null,D(d)}function w(d,D){if(i)return D(i);if(f){d({value:f,done:!1}),f=null;return}if(u=d,t=D,c(null),E._finished&&u)u({value:void 0,done:!0}),u=t=null}function $(d,D,_){if(l=_,D.on("error",j4u),u)u({value:D,done:!1}),u=t=null;else f=D}function h(){if(c(i),!u)return;if(i)t(i);else u({value:void 0,done:!0});u=t=null}function v(d){return E.destroy(d),c(d),new Promise((D,_)=>{if(E.destroyed)return D({value:void 0,done:!0});E.once("close",function(){if(d)_(d);else D({value:void 0,done:!0})})})}}}WP0.exports=function(u){return new KP0(u)};function j4u(){}function YP0(i){return i&=511,i&&512-i}});var QP0=Y((m46,X4u)=>{var LP0={S_IFMT:61440,S_IFDIR:16384,S_IFCHR:8192,S_IFBLK:24576,S_IFIFO:4096,S_IFLNK:40960};try{X4u.exports=Fi("fs").constants||LP0}catch{X4u.exports=LP0}});var MP0=Y((e46,CP0)=>{var{Readable:rHf,Writable:mHf,getStreamError:HP0}=G4u(),KK=az(),pz=QP0(),Sgi=k4u(),zP0=KK.alloc(1024);class nP0 extends mHf{constructor(i,u,t){super({mapWritable:aHf,eagerOpen:!0});if(this.written=0,this.header=u,this._callback=t,this._linkname=null,this._isLinkname=u.type==="symlink"&&!u.linkname,this._isVoid=u.type!=="file"&&u.type!=="contiguous-file",this._finished=!1,this._pack=i,this._openCallback=null,this._pack._stream===null)this._pack._stream=this;else this._pack._pending.push(this)}_open(i){if(this._openCallback=i,this._pack._stream===this)this._continueOpen()}_continuePack(i){if(this._callback===null)return;let u=this._callback;this._callback=null,u(i)}_continueOpen(){if(this._pack._stream===null)this._pack._stream=this;let i=this._openCallback;if(this._openCallback=null,i===null)return;if(this._pack.destroying)return i(Error("pack stream destroyed"));if(this._pack._finalized)return i(Error("pack stream is already finalized"));if(this._pack._stream=this,!this._isLinkname)this._pack._encode(this.header);if(this._isVoid)this._finish(),this._continuePack(null);i(null)}_write(i,u){if(this._isLinkname)return this._linkname=this._linkname?KK.concat([this._linkname,i]):i,u(null);if(this._isVoid){if(i.byteLength>0)return u(Error("No body allowed for this entry"));return u()}if(this.written+=i.byteLength,this._pack.push(i))return u();this._pack._drain=u}_finish(){if(this._finished)return;if(this._finished=!0,this._isLinkname)this.header.linkname=this._linkname?KK.toString(this._linkname,"utf-8"):"",this._pack._encode(this.header);bP0(this._pack,this.header.size),this._pack._done(this)}_final(i){if(this.written!==this.header.size)return i(Error("Size mismatch"));this._finish(),i(null)}_getError(){return HP0(this)||Error("tar entry destroyed")}_predestroy(){this._pack.destroy(this._getError())}_destroy(i){this._pack._done(this),this._continuePack(this._finished?null:this._getError()),i()}}class RP0 extends rHf{constructor(i){super(i);this._drain=J4u,this._finalized=!1,this._finalizing=!1,this._pending=[],this._stream=null}entry(i,u,t){if(this._finalized||this.destroying)throw Error("already finalized or destroyed");if(typeof u==="function")t=u,u=null;if(!t)t=J4u;if(!i.size||i.type==="symlink")i.size=0;if(!i.type)i.type=eHf(i.mode);if(!i.mode)i.mode=i.type==="directory"?493:420;if(!i.uid)i.uid=0;if(!i.gid)i.gid=0;if(!i.mtime)i.mtime=new Date;if(typeof u==="string")u=KK.from(u);let f=new nP0(this,i,t);if(KK.isBuffer(u))return i.size=u.byteLength,f.write(u),f.end(),f;if(f._isVoid)return f;return f}finalize(){if(this._stream||this._pending.length>0){this._finalizing=!0;return}if(this._finalized)return;this._finalized=!0,this.push(zP0),this.push(null)}_done(i){if(i!==this._stream)return;if(this._stream=null,this._finalizing)this.finalize();if(this._pending.length)this._pending.shift()._continueOpen()}_encode(i){if(!i.pax){let u=Sgi.encode(i);if(u){this.push(u);return}}this._encodePax(i)}_encodePax(i){let u=Sgi.encodePax({name:i.name,linkname:i.linkname,pax:i.pax}),t={name:"PaxHeader",mode:i.mode,uid:i.uid,gid:i.gid,size:u.byteLength,mtime:i.mtime,type:"pax-header",linkname:i.linkname&&"PaxHeader",uname:i.uname,gname:i.gname,devmajor:i.devmajor,devminor:i.devminor};this.push(Sgi.encode(t)),this.push(u),bP0(this,u.byteLength),t.size=i.size,t.type=i.type,this.push(Sgi.encode(t))}_doDrain(){let i=this._drain;this._drain=J4u,i()}_predestroy(){let i=HP0(this);if(this._stream)this._stream.destroy(i);while(this._pending.length){let u=this._pending.shift();u.destroy(i),u._continueOpen()}this._doDrain()}_read(i){this._doDrain(),i()}}CP0.exports=function(u){return new RP0(u)};function eHf(i){switch(i&pz.S_IFMT){case pz.S_IFBLK:return"block-device";case pz.S_IFCHR:return"character-device";case pz.S_IFDIR:return"directory";case pz.S_IFIFO:return"fifo";case pz.S_IFLNK:return"symlink"}return"file"}function J4u(){}function bP0(i,u){if(u&=511,u)i.push(zP0.subarray(0,512-u))}function aHf(i){return KK.isBuffer(i)?i:KK.from(i)}});var qP0=Y((oHf)=>{oHf.extract=SP0();oHf.pack=MP0()});var mP0=Y((o46,rP0)=>{rP0.exports=VP0;function VP0(i,u){if(i&&u)return VP0(i)(u);if(typeof i!=="function")throw TypeError("need wrapper function");return Object.keys(i).forEach(function(f){t[f]=i[f]}),t;function t(){var f=Array(arguments.length);for(var l=0;l<f.length;l++)f[l]=arguments[l];var E=i.apply(this,f),c=f[f.length-1];if(typeof E==="function"&&E!==c)Object.keys(c).forEach(function(w){E[w]=c[w]});return E}}});var Y4u=Y((s46,K4u)=>{var eP0=mP0();K4u.exports=eP0(Lgi);K4u.exports.strict=eP0(aP0);Lgi.proto=Lgi(function(){Object.defineProperty(Function.prototype,"once",{value:function(){return Lgi(this)},configurable:!0}),Object.defineProperty(Function.prototype,"onceStrict",{value:function(){return aP0(this)},configurable:!0})});function Lgi(i){var u=function(){if(u.called)return u.value;return u.called=!0,u.value=i.apply(this,arguments)};return u.called=!1,u}function aP0(i){var u=function(){if(u.called)throw Error(u.onceError);return u.called=!0,u.value=i.apply(this,arguments)},t=i.name||"Function wrapped with `once`";return u.onceError=t+" shouldn't be called more than once",u.called=!1,u}});var pP0=Y((p46,sP0)=>{var izf=Y4u(),uzf=function(){},tzf=global.Bare?queueMicrotask:process.nextTick.bind(process),fzf=function(i){return i.setHeader&&typeof i.abort==="function"},lzf=function(i){return i.stdio&&Array.isArray(i.stdio)&&i.stdio.length===3},oP0=function(i,u,t){if(typeof u==="function")return oP0(i,null,u);if(!u)u={};t=izf(t||uzf);var{_writableState:f,_readableState:l}=i,E=u.readable||u.readable!==!1&&i.readable,c=u.writable||u.writable!==!1&&i.writable,w=!1,$=function(){if(!i.writable)h()},h=function(){if(c=!1,!E)t.call(i)},v=function(){if(E=!1,!c)t.call(i)},d=function(B){t.call(i,B?Error("exited with error code: "+B):null)},D=function(B){t.call(i,B)},_=function(){tzf(N)},N=function(){if(w)return;if(E&&!(l&&(l.ended&&!l.destroyed)))return t.call(i,Error("premature close"));if(c&&!(f&&(f.ended&&!f.destroyed)))return t.call(i,Error("premature close"))},Z=function(){i.req.on("finish",h)};if(fzf(i))if(i.on("complete",h),i.on("abort",_),i.req)Z();else i.on("request",Z);else if(c&&!f)i.on("end",$),i.on("close",$);if(lzf(i))i.on("exit",d);if(i.on("end",v),i.on("finish",h),u.error!==!1)i.on("error",D);return i.on("close",_),function(){if(w=!0,i.removeListener("complete",h),i.removeListener("abort",_),i.removeListener("request",Z),i.req)i.req.removeListener("finish",h);i.removeListener("end",$),i.removeListener("close",$),i.removeListener("finish",h),i.removeListener("exit",d),i.removeListener("end",v),i.removeListener("error",D),i.removeListener("close",_)}};sP0.exports=oP0});var tI0=Y((i16,uI0)=>{var Ezf=Y4u(),czf=pP0(),Qgi;try{Qgi=Fi("fs")}catch(i){}var lo=function(){},wzf=typeof process>"u"?!1:/^v?\.0/.test(process.version),Hgi=function(i){return typeof i==="function"},$zf=function(i){if(!wzf)return!1;if(!Qgi)return!1;return(i instanceof(Qgi.ReadStream||lo)||i instanceof(Qgi.WriteStream||lo))&&Hgi(i.close)},hzf=function(i){return i.setHeader&&Hgi(i.abort)},vzf=function(i,u,t,f){f=Ezf(f);var l=!1;i.on("close",function(){l=!0}),czf(i,{readable:u,writable:t},function(c){if(c)return f(c);l=!0,f()});var E=!1;return function(c){if(l)return;if(E)return;if(E=!0,$zf(i))return i.close(lo);if(hzf(i))return i.abort();if(Hgi(i.destroy))return i.destroy();f(c||Error("stream was destroyed"))}},iI0=function(i){i()},dzf=function(i,u){return i.pipe(u)},Dzf=function(){var i=Array.prototype.slice.call(arguments),u=Hgi(i[i.length-1]||lo)&&i.pop()||lo;if(Array.isArray(i[0]))i=i[0];if(i.length<2)throw Error("pump requires two streams per minimum");var t,f=i.map(function(l,E){var c=E<i.length-1,w=E>0;return vzf(l,c,w,function($){if(!t)t=$;if($)f.forEach(iI0);if(c)return;f.forEach(iI0),u(t)})});return i.reduce(dzf)};uI0.exports=Dzf});var dI0=Y((Zzf)=>{var fI0=qP0(),lI0=tI0(),EI0=Fi("fs"),Fl=Fi("path"),Eo=(global.Bare?global.Bare.platform:process.platform)==="win32";Zzf.pack=function(u,t){if(!u)u=".";if(!t)t={};let f=t.fs||EI0,l=t.ignore||t.filter||co,E=t.mapStream||hI0,c=Ozf(f,t.dereference?f.stat:f.lstat,u,l,t.entries,t.sort),w=t.strict!==!1,$=typeof t.umask==="number"?~t.umask:~cI0(),h=t.pack||fI0.pack(),v=t.finish||co,d=t.map||co,D=typeof t.dmode==="number"?t.dmode:0,_=typeof t.fmode==="number"?t.fmode:0;if(t.strip)d=vI0(d,t.strip);if(t.readable)D|=parseInt(555,8),_|=parseInt(444,8);if(t.writable)D|=parseInt(333,8),_|=parseInt(222,8);B();function N(F,g){f.readlink(Fl.join(u,F),function(T,U){if(T)return h.destroy(T);g.linkname=W4u(U),h.entry(g,B)})}function Z(F,g,T){if(h.destroyed)return;if(F)return h.destroy(F);if(!g){if(t.finalize!==!1)h.finalize();return v(h)}if(T.isSocket())return B();let U={name:W4u(g),mode:(T.mode|(T.isDirectory()?D:_))&$,mtime:T.mtime,size:T.size,type:"file",uid:T.uid,gid:T.gid};if(T.isDirectory())return U.size=0,U.type="directory",U=d(U)||U,h.entry(U,B);if(T.isSymbolicLink())return U.size=0,U.type="symlink",U=d(U)||U,N(g,U);if(U=d(U)||U,!T.isFile()){if(w)return h.destroy(Error("unsupported type for "+g));return B()}let A=h.entry(U,B),I=E(f.createReadStream(Fl.join(u,g),{start:0,end:U.size>0?U.size-1:U.size}),U);I.on("error",function(k){A.destroy(k)}),lI0(I,A)}function B(F){if(F)return h.destroy(F);c(Z)}return h};function _zf(i){return i.length?i[i.length-1]:null}function Nzf(){return!global.Bare&&process.getuid?process.getuid():-1}function cI0(){return!global.Bare&&process.umask?process.umask():0}Zzf.extract=function(u,t){if(!u)u=".";if(!t)t={};u=Fl.resolve(u);let f=t.fs||EI0,l=t.ignore||t.filter||co,E=t.mapStream||hI0,c=t.chown!==!1&&!Eo&&Nzf()===0,w=t.extract||fI0.extract(),$=[],h=new Date,v=typeof t.umask==="number"?~t.umask:~cI0(),d=t.strict!==!1,D=t.validateSymlinks!==!1,_=t.map||co,N=typeof t.dmode==="number"?t.dmode:0,Z=typeof t.fmode==="number"?t.fmode:0;if(t.strip)_=vI0(_,t.strip);if(t.readable)N|=parseInt(555,8),Z|=parseInt(444,8);if(t.writable)N|=parseInt(333,8),Z|=parseInt(222,8);if(w.on("entry",B),t.finish)w.on("finish",t.finish);return w;function B(A,I,k){A=_(A)||A,A.name=W4u(A.name);let G=Fl.join(u,Fl.join("/",A.name));if(l(G,A))return I.resume(),k();let X=Fl.join(G,".")===Fl.join(u,".")?u:Fl.dirname(G);$I0(f,X,Fl.join(u,"."),function(ti,vi){if(ti)return k(ti);if(!vi)return k(Error(X+" is not a valid path"));if(A.type==="directory")return $.push([G,A.mtime]),U(G,{fs:f,own:c,uid:A.uid,gid:A.gid,mode:A.mode},b);U(X,{fs:f,own:c,uid:A.uid,gid:A.gid,mode:493},function(Ei){if(Ei)return k(Ei);switch(A.type){case"file":return Q();case"link":return L();case"symlink":return K()}if(d)return k(Error("unsupported type for "+G+" ("+A.type+")"));I.resume(),k()})});function b(ti){if(ti)return k(ti);g(G,A,function(vi){if(vi)return k(vi);if(Eo)return k();T(G,A,k)})}function K(){if(Eo)return k();f.unlink(G,function(){let ti=Fl.resolve(Fl.dirname(G),A.linkname);if(!m(ti)&&D)return k(Error(G+" is not a valid symlink"));wI0(f,ti,Fl.join(u,"."),function(vi,Ei){if(vi)return k(vi);if(!Ei&&D)return k(Error(G+" is not a valid symlink"));f.symlink(A.linkname,G,b)})})}function L(){if(Eo)return k();f.unlink(G,function(){let ti=Fl.join(u,Fl.join("/",A.linkname));f.realpath(ti,function(vi,Ei){if(vi||!m(Ei))return k(Error(G+" is not a valid hardlink"));f.link(Ei,G,function(ii){if(ii&&ii.code==="EPERM"&&t.hardlinkAsFilesFallback)return I=f.createReadStream(Ei),Q();b(ii)})})})}function m(ti){return ti===u||ti.startsWith(u+Fl.sep)}function Q(){let ti=f.createWriteStream(G),vi=E(I,A);ti.on("error",function(Ei){vi.destroy(Ei)}),lI0(vi,ti,function(Ei){if(Ei)return k(Ei);ti.on("close",b)})}}function F(A,I){let k;while((k=_zf($))&&A.slice(0,k[0].length)!==k[0])$.pop();if(!k)return I();f.utimes(k[0],h,k[1],I)}function g(A,I,k){if(t.utimes===!1)return k();if(I.type==="directory")return f.utimes(A,h,I.mtime,k);if(I.type==="symlink")return F(A,k);f.utimes(A,h,I.mtime,function(G){if(G)return k(G);F(A,k)})}function T(A,I,k){let G=I.type==="symlink",X=G?f.lchmod:f.chmod,b=G?f.lchown:f.chown;if(!X)return k();let K=(I.mode|(I.type==="directory"?N:Z))&v;if(b&&c)b.call(f,A,I.uid,I.gid,L);else L(null);function L(m){if(m)return k(m);if(!X)return k();X.call(f,A,K,k)}}function U(A,I,k){f.stat(A,function(G){if(!G)return k(null);if(G.code!=="ENOENT")return k(G);f.mkdir(A,{mode:I.mode,recursive:!0},function(X,b){if(X)return k(X);T(A,I,k)})})}};function wI0(i,u,t,f){if(u===t)return f(null,!0);if(!u.startsWith(t+Fl.sep))return f(null,!1);i.lstat(u,function(l,E){if(l&&l.code!=="ENOENT"&&l.code!=="EPERM")return f(l);if(l||!E.isSymbolicLink())return wI0(i,Fl.join(u,".."),t,f);f(null,!1)})}function $I0(i,u,t,f){if(u===t)return f(null,!0);i.lstat(u,function(l,E){if(l&&l.code!=="ENOENT"&&l.code!=="EPERM")return f(l);if(l||E.isDirectory())return $I0(i,Fl.join(u,".."),t,f);f(null,!1)})}function co(){}function hI0(i){return i}function W4u(i){return Eo?i.replace(/\\/g,"/").replace(/[:?<>|]/g,"_"):i}function Ozf(i,u,t,f,l,E){if(!l)l=["."];let c=l.slice(0);return function($){if(!c.length)return $(null);let h=c.shift(),v=Fl.join(t,h);u.call(i,v,function(d,D){if(d)return $(l.indexOf(h)===-1&&d.code==="ENOENT"?null:d);if(!D.isDirectory())return $(null,h,D);i.readdir(v,function(_,N){if(_)return $(_);if(E)N.sort();for(let Z=0;Z<N.length;Z++)if(!f(Fl.join(t,h,N[Z])))c.push(Fl.join(h,N[Z]));$(null,h,D)})})}}function vI0(i,u){return function(t){t.name=t.name.split("/").slice(u).join("/");let f=t.linkname;if(f&&(t.type==="link"||Fl.isAbsolute(f)))t.linkname=f.split("/").slice(u).join("/");return i(t)}}});var gzf,Tzf;var DI0=O(()=>{F4u();gzf=j(py0(),1),Tzf=j(dI0(),1)});var zgi=()=>{};var _I0=O(()=>{pFi()});var NI0=O(()=>{Ggi();Igi();zgi()});var OI0=()=>{};var ZI0=()=>{};var S4u=O(()=>{Wy0();Z4u();Ggi();zy0();N4u();F4u();ny0();Ry0();by0();Cy0();O4u();My0();DI0();zgi();_I0();NI0();OI0();ZI0();zgi()});var Wl,pl,YK,wo;var $o=O(()=>{Wl={CLAIM_API_GROUP:"extensions.agents.x-k8s.io",CLAIM_API_VERSION:"v1alpha1",CLAIM_PLURAL:"sandboxclaims",SANDBOX_API_GROUP:"agents.x-k8s.io",SANDBOX_API_VERSION:"v1alpha1",SANDBOX_PLURAL:"sandboxes",POD_NAME_ANNOTATION:"agents.x-k8s.io/pod-name"};pl=class pl extends Error{cause;constructor(i,u){super(i);if(this.name="SandboxError",this.cause=u,u instanceof Error&&u.stack)this.stack=`${this.stack}
 Caused by: ${u.stack}`}};YK=class YK extends pl{constructor(i,u){super(i,u);this.name="SandboxTimeoutError"}};wo=class wo extends pl{constructor(i,u){super(i,u);this.name="SandboxAlreadyExistsError"}}});async function Uzf(i){let u=i.getCurrentCluster();if(!u)throw new pl("No active cluster in kubeconfig");let t={};await i.applyToHTTPSOptions(t);let f={},l=t.headers??{};for(let[E,c]of Object.entries(l))if(Array.isArray(c))f[E]=c.join(", ");else if(c!==void 0)f[E]=String(c);if(typeof t.auth==="string"&&!f.Authorization)f.Authorization=`Basic ${Buffer.from(t.auth).toString("base64")}`;return{server:u.server.replace(/\/+$/,""),headers:f,tls:{cert:L4u(t.cert),key:L4u(t.key),ca:L4u(t.ca),rejectUnauthorized:u.skipTLSVerify?!1:void 0}}}function L4u(i){if(i==null)return;if(typeof i==="string")return i;if(Buffer.isBuffer(i))return i.toString("utf8");return String(i)}async function WK(i,u){let t=await Uzf(i),f={...t.headers,...u.headers};if(u.method==="PATCH")f["content-type"]=u.patchType==="apply"?"application/apply-patch+yaml":u.patchType==="strategic-merge"?"application/strategic-merge-patch+json":"application/merge-patch+json";else if(u.body!==void 0&&!("content-type"in f))f["content-type"]="application/json";let l={method:u.method,headers:f,body:u.body===void 0?void 0:JSON.stringify(u.body),signal:u.signal,tls:t.tls,...u.stream?{timeout:!1}:{}};return fetch(`${t.server}${u.path}`,l)}async function Q4u(i){try{return await i.json()}catch{return null}}async function H4u(i,u){if(i.ok)return;let t=await Q4u(i),f=t?.message??`${u} failed: ${i.status} ${i.statusText}`;throw new BI0(i.status,t,f)}async function ho(i,u,t,f,l="none"){try{let E=await WK(i,u);if(E.status===404)return null;if(await H4u(E,t),l==="json")return await E.json();return null}catch(E){throw new pl(f,E)}}async function vo(i,u,t){let f=`${FI0}/${encodeURIComponent(u)}/${Wl.CLAIM_PLURAL}`,l;try{l=await WK(i,{method:"POST",path:f,body:t})}catch(h){let v=h instanceof Error?h.message:String(h);throw console.warn(`[agent-sandbox/client] createSandboxClaim ${t.metadata.name} transport error: ${v}`),new pl(`Failed to create SandboxClaim: ${t.metadata.name} (transport error: ${v})`,h)}if(l.ok)return;let E=await Q4u(l),c=E?.reason?` ${E.reason}`:"",w=E?.message??l.statusText,$=`Failed to create SandboxClaim: ${t.metadata.name} (${l.status}${c}: ${w})`;if(console.warn(`[agent-sandbox/client] createSandboxClaim ${t.metadata.name} rejected: status=${l.status} reason=${E?.reason??"<none>"} message=${w}`),l.status===409)throw new wo($);throw new pl($)}async function ngi(i,u,t,f=60000){let l=Date.now()+f,E=500,c;while(!0){let w=await n2(i,u,t).catch(()=>{return});if(!w)return;if(c=w,Date.now()>=l){let $=c.metadata?.finalizers??[],h=c.metadata?.deletionTimestamp??"<unknown>";throw new YK(`SandboxClaim ${t} still terminating after ${f}ms (deletionTimestamp=${h}, finalizers=[${$.join(", ")}])`)}await y0(500)}}function z4u(i,u){return`${FI0}/${encodeURIComponent(i)}/${Wl.CLAIM_PLURAL}/${encodeURIComponent(u)}`}async function gI0(i,u,t,f){await ho(i,{method:"PATCH",path:z4u(u,t),patchType:"merge",body:{spec:{lifecycle:{shutdownPolicy:"Delete",shutdownTime:f}}}},"patchSandboxClaimShutdown",`Failed to patch SandboxClaim shutdownTime: ${t}`)}async function JN(i,u,t){await ho(i,{method:"DELETE",path:z4u(u,t)},"deleteSandboxClaim",`Failed to delete SandboxClaim: ${t}`)}async function n2(i,u,t){return await ho(i,{method:"GET",path:z4u(u,t)},"getSandboxClaim",`Failed to get SandboxClaim: ${t}`,"json")??void 0}async function TI0(i,u,t,f=60){let l=Date.now()+f*1000,E=200;while(Date.now()<l){let w=(await n2(i,u,t).catch(()=>{return}))?.status?.sandbox?.name;if(w)return w;await y0(200)}throw new YK(`SandboxClaim ${t} did not record an adopted Sandbox (status.sandbox.name) within ${f}s`)}function n4u(i,u){return`${Azf}/${encodeURIComponent(i)}/${yI0}/${encodeURIComponent(u)}`}async function Rgi(i,u,t){let f=new URLSearchParams({fieldManager:II0,force:"true"}),l=`${n4u(u,t.metadata.name)}?${f}`;try{let E=await WK(i,{method:"PATCH",path:l,patchType:"apply",body:t});await H4u(E,"applyHttpRoute")}catch(E){throw new pl(`Failed to apply HTTPRoute: ${t.metadata.name}`,E)}}async function bgi(i,u,t){await ho(i,{method:"DELETE",path:n4u(u,t)},"deleteHttpRoute",`Failed to delete HTTPRoute: ${t}`)}async function PI0(i,u,t){return await ho(i,{method:"GET",path:n4u(u,t)},"getHttpRoute",`Failed to get HTTPRoute: ${t}`,"json")??void 0}async function GI0(i,u,t,f){let l={apiVersion:"v1",kind:"Service",metadata:{name:t},spec:{ports:[{name:f.name,port:f.port,targetPort:f.targetPort,protocol:f.protocol??"TCP"}]}},E=new URLSearchParams({fieldManager:II0,force:"true"}),c=`/api/v1/namespaces/${encodeURIComponent(u)}/services/${encodeURIComponent(t)}?${E}`;try{let w=await WK(i,{method:"PATCH",path:c,patchType:"apply",body:l});await H4u(w,"ensureServicePort")}catch(w){throw new pl(`Failed to apply Service ports: ${t}`,w)}}function Cgi(i,u,t,f=180){let l=`/apis/${Wl.SANDBOX_API_GROUP}/${Wl.SANDBOX_API_VERSION}/namespaces/${encodeURIComponent(u)}/${Wl.SANDBOX_PLURAL}?watch=true&fieldSelector=${encodeURIComponent(`metadata.name=${t}`)}`,{resolve:E,reject:c,promise:w}=Promise.withResolvers(),$=new AbortController,h=!1,v=setTimeout(()=>{if(h)return;h=!0,$.abort(),c(new YK(`Sandbox did not become ready within ${f} seconds`))},f*1000),d=(D)=>{if(h)return;h=!0,clearTimeout(v),$.abort(),D()};return(async()=>{let D;try{D=await WK(i,{method:"GET",path:l,signal:$.signal,headers:{accept:"application/json"},stream:!0})}catch(_){d(()=>c(new pl("Failed to start watch for sandbox readiness",_)));return}if(!D.ok||!D.body){let _=await Q4u(D).catch(()=>null);d(()=>c(new pl(`Watch handshake failed (${D.status}): ${_?.message??D.statusText}`)));return}try{for await(let _ of R4u(D.body)){if(h)return;if(_.type==="ERROR"){let g=_.object;d(()=>c(new pl(`Watch stream error while waiting for sandbox: ${g.message??"unknown"}`)));return}if(_.type!=="ADDED"&&_.type!=="MODIFIED")continue;let N=_.object;if(!N.status?.conditions?.find((g)=>g.type==="Ready"&&g.status==="True"))continue;let B=N.metadata?.name;if(!B){d(()=>c(new pl("Sandbox metadata or name is missing")));return}let F=N.metadata?.annotations?.[Wl.POD_NAME_ANNOTATION]??B;d(()=>E({sandboxName:B,podName:F}));return}d(()=>c(new pl("Watch stream closed before sandbox became ready")))}catch(_){if(h)return;if(_ instanceof Error&&(_.name==="AbortError"||$.signal.aborted))return;d(()=>c(new pl("Watch stream error while waiting for sandbox",_)))}})(),w}async function*R4u(i){let u=i.getReader(),t=new TextDecoder,f="";try{while(!0){let{value:E,done:c}=await u.read();if(c)break;f+=t.decode(E,{stream:!0});let w;while((w=f.indexOf(`
-`))>=0){let $=f.slice(0,w).trim();if(f=f.slice(w+1),!$)continue;yield JSON.parse($)}}let l=f.trim();if(l)yield JSON.parse(l)}finally{u.releaseLock()}}var BI0,FI0,UI0="gateway.networking.k8s.io",AI0="v1",yI0="httproutes",Azf,Do,II0="mesh-sandbox-runner";var Mgi=O(()=>{O4();$o();BI0=class BI0 extends Error{status;body;constructor(i,u,t){super(t);this.status=i;this.body=u;this.name="KubeHttpError"}};FI0=`/apis/${Wl.CLAIM_API_GROUP}/${Wl.CLAIM_API_VERSION}/namespaces`;Azf=`/apis/${UI0}/${AI0}/namespaces`;Do={API_GROUP:UI0,API_VERSION:AI0,PLURAL:yI0}});async function*jI0(i){let u=i.now??(()=>Date.now()),t=u(),f=i.schedulingTimeoutMs??Izf,l={pod:{},sandbox:{},events:{hasPulling:!1,hasPulled:!1},startedAt:t},E=[],c=null,w=!1,$=(g)=>{if(w)return;if(c){let T=c;c=null,T(g)}else E.push(g)},h=()=>{if(E.length>0)return Promise.resolve(E.shift());if(w)return Promise.resolve(null);return new Promise((g)=>{c=g})},v=()=>{if(w)return;if(w=!0,c){let g=c;c=null,g(null)}},d=new AbortController,D=()=>{d.abort(),v()};if(i.signal)if(i.signal.aborted)d.abort(),v();else i.signal.addEventListener("abort",D,{once:!0});let _=Math.max(0,f-(u()-t)),N=setTimeout(()=>$("tick"),_+100),Z,B=new Promise((g)=>{Z=g}),F=Promise.allSettled([Gzf(i.kc,i.namespace,i.claimName,d.signal,l,$,u,Z),kzf(i.kc,i.namespace,i.claimName,d.signal,l,$),jzf(i.kc,i.namespace,i.claimName,B,d.signal,l,$,u)]);try{let g=null,T=-1,U=xI0(l,f,u);if(g=C4u(U),!b4u(U))T=kI0(U);if(yield U,b4u(U))return;while(!w){if(await h()===null)break;let I=xI0(l,f,u);if(b4u(I)){let X=C4u(I);if(X!==g)g=X,yield I;return}let k=kI0(I);if(k<T)continue;let G=C4u(I);if(G!==g)g=G,T=k,yield I}}finally{if(clearTimeout(N),d.abort(),i.signal)i.signal.removeEventListener("abort",D);v(),await F.catch(()=>{})}}function xI0(i,u,t){let{pod:f,sandbox:l,events:E,startedAt:c}=i;if(l.ready)return{kind:"ready"};let w=f.containerWaitingReason;if(w==="ImagePullBackOff"||w==="ErrImagePull")return{kind:"failed",reason:"image-pull-backoff",message:"Sandbox image failed to download. The cluster may be missing pull credentials or the image tag may not exist."};if(w==="CrashLoopBackOff")return{kind:"failed",reason:"crash-loop-backoff",message:"Sandbox crashed during startup and is now in CrashLoopBackOff. Check pod logs."};if(!f.scheduled&&E.lastFailedSchedulingAt!==void 0&&t()-c>u)return{kind:"failed",reason:"scheduling-timeout",message:E.failedSchedulingMessage??`Pod could not be scheduled within ${Math.round(u/1000)}s.`};if(f.containerRunning&&!f.containerReady)return{kind:"warming-daemon",since:c};if(E.hasPulling&&!E.hasPulled)return{kind:"pulling-image",since:c};if(w==="ContainerCreating"||w==="PodInitializing"||f.scheduled&&!f.containerRunning)return{kind:"starting-container",since:c};if(f.scheduledFalseReason==="Unschedulable"||E.lastFailedSchedulingAt!==void 0&&!f.scheduled)return{kind:"waiting-for-capacity",since:c,message:E.failedSchedulingMessage??f.scheduledFalseMessage,nodeClaim:E.nominatedNodeClaim};return{kind:"claiming",since:c}}function b4u(i){return i.kind==="ready"||i.kind==="failed"}function kI0(i){switch(i.kind){case"claiming":return 0;case"waiting-for-capacity":return 1;case"pulling-image":return 2;case"starting-container":return 3;case"warming-daemon":return 4;case"ready":case"failed":return 99}}function C4u(i){switch(i.kind){case"claiming":case"pulling-image":case"starting-container":case"warming-daemon":return i.kind;case"waiting-for-capacity":return`waiting-for-capacity:${i.message??""}:${i.nodeClaim??""}`;case"ready":return"ready";case"failed":return`failed:${i.reason}:${i.message}`}}async function Gzf(i,u,t,f,l,E,c,w){let $=`/api/v1/namespaces/${encodeURIComponent(u)}/pods?watch=true&labelSelector=${encodeURIComponent(`${yzf}=${t}`)}`;return qgi({kc:i,path:$,signal:f,label:`pod/${t}`,onEvent:(h)=>{if(h.type!=="ADDED"&&h.type!=="MODIFIED")return;let v=h.object;if(v.metadata?.name)w(v.metadata.name);xzf(v,l,c),E("pod")}})}function xzf(i,u,t){let l=(i.status?.conditions??[]).find((c)=>c.type==="PodScheduled");if(l?.status==="True")u.pod.scheduled=!0,u.pod.scheduledFalseReason=void 0,u.pod.scheduledFalseMessage=void 0;else if(l?.status==="False")u.pod.scheduled=!1,u.pod.scheduledFalseReason=l.reason,u.pod.scheduledFalseMessage=l.message;let E=(i.status?.containerStatuses??[]).find((c)=>c.name===Pzf);if(E)u.pod.containerWaitingReason=E.state?.waiting?.reason,u.pod.containerRunning=!!E.state?.running,u.pod.containerReady=E.ready===!0}async function kzf(i,u,t,f,l,E){let c=`/apis/${Wl.CLAIM_API_GROUP}/${Wl.CLAIM_API_VERSION}/namespaces/${encodeURIComponent(u)}/${Wl.CLAIM_PLURAL}?watch=true&fieldSelector=${encodeURIComponent(`metadata.name=${t}`)}`;return qgi({kc:i,path:c,signal:f,label:`sandboxclaim/${t}`,onEvent:(w)=>{if(w.type!=="ADDED"&&w.type!=="MODIFIED")return;let h=w.object.status?.conditions?.find((v)=>v.type==="Ready");if(!h)return;if(h.status==="True")l.sandbox.ready=!0,l.sandbox.notReadyReason=void 0,l.sandbox.notReadyMessage=void 0;else l.sandbox.ready=!1,l.sandbox.notReadyReason=h.reason,l.sandbox.notReadyMessage=h.message;E("sandbox")}})}async function jzf(i,u,t,f,l,E,c,w){let $=await Promise.race([f,new Promise((v)=>{if(l.aborted){v(t);return}l.addEventListener("abort",()=>v(t),{once:!0})})]);if(l.aborted)return;let h=`/api/v1/namespaces/${encodeURIComponent(u)}/events?watch=true&fieldSelector=${encodeURIComponent(`involvedObject.name=${$},involvedObject.kind=Pod`)}`;return qgi({kc:i,path:h,signal:l,label:`events/${t}`,onEvent:(v)=>{if(v.type!=="ADDED"&&v.type!=="MODIFIED")return;let d=v.object,D=d.reason;if(!D)return;switch(D){case"Pulling":E.events.hasPulling=!0;break;case"Pulled":E.events.hasPulling=!0,E.events.hasPulled=!0;break;case"FailedScheduling":E.events.lastFailedSchedulingAt=w(),E.events.failedSchedulingMessage=d.message;break;case"Nominated":{let _=d.message?.match(/nodeclaim\/([\w-]+)/);if(_)E.events.nominatedNodeClaim=_[1];break}default:return}c("event")}})}async function XI0(i){let{kc:u,namespace:t,labelSelector:f,signal:l,onDelete:E}=i,c=`/apis/${Wl.CLAIM_API_GROUP}/${Wl.CLAIM_API_VERSION}/namespaces/${encodeURIComponent(t)}/${Wl.CLAIM_PLURAL}?watch=true&labelSelector=${encodeURIComponent(f)}`;return qgi({kc:u,path:c,signal:l,label:"sandboxclaim-reaper",onEvent:(w)=>{if(w.type!=="DELETED")return;let $=w.object.metadata?.name;if($)E($)}})}async function qgi(i){let{kc:u,path:t,signal:f,label:l,onEvent:E}=i,c=0;while(!f.aborted){try{let $=await WK(u,{method:"GET",path:t,signal:f,headers:{accept:"application/json"},stream:!0});if(!$.ok||!$.body){try{await $.body?.cancel()}catch{}if($.status===401||$.status===403){console.warn(`[lifecycle-watcher] ${l} stopped: watch denied (${$.status} ${$.statusText}). `+"The kubeconfig in use cannot watch SandboxClaims \u2014 if you are running locally, "+"this provider should not be active (check STUDIO_SANDBOX_PROVIDER / your sandbox preference).");return}throw Error(`watch handshake failed: ${$.status} ${$.statusText}`)}c=0;for await(let h of R4u($.body)){if(f.aborted)return;try{E(h)}catch(v){console.warn(`[lifecycle-watcher] ${l} onEvent threw: ${v instanceof Error?v.message:String(v)}`)}}}catch($){if(f.aborted)return;let h=$ instanceof Error?$.message:String($);console.warn(`[lifecycle-watcher] ${l} watch ended: ${h}`)}if(f.aborted)return;let w=hE(5000,250,c,2,0);c+=1,await y0(w,{signal:f}).catch(()=>{})}}var yzf="studio.decocms.com/sandbox-handle",Pzf="sandbox",Izf=300000;var JI0=O(()=>{O4();$o();Mgi()});async function KI0(i,u,t){let f=new Map;for(let l of i){let E=u(l);if(!E)continue;let c=f.get(E);if(c)c.push(l);else f.set(E,[l])}await Promise.allSettled([...f.values()].map(async(l)=>{for(let E of l)await t(E).catch(()=>{})}))}import{createHash as Xzf,randomBytes as Jzf,randomUUID as Kzf}from"crypto";import*as LI0 from"net";import{PassThrough as Yzf}from"stream";function Wzf(i){if(i instanceof Error)return i.message;if(i&&typeof i==="object"){let u=i;if(u.error instanceof Error)return u.error.message;if(typeof u.message==="string"&&u.message)return u.message}return String(i)}class e4u{kind=Xc;records=new Map;inflight=new g5i;stateStore;previewUrlPattern;kubeConfig;portForward;namespace;sandboxTemplateName;envName;tokenGenerator;idleTtlMs;metrics;previewGateway;sentinelToken;mintCloneUrl;closed=!1;claimWatchAbort=new AbortController;constructor(i={}){this.stateStore=i.stateStore??null,this.previewUrlPattern=i.previewUrlPattern??null,this.kubeConfig=i.kubeConfig??Vzf(),this.portForward=new g4u(this.kubeConfig),this.namespace=i.namespace??Szf,this.sandboxTemplateName=i.sandboxTemplateName??Lzf,this.envName=szf(i.envName),this.tokenGenerator=i.tokenGenerator??(()=>Jzf(Hzf).toString("hex")),this.idleTtlMs=i.idleTtlMs??nzf,this.metrics=i.meter?qzf(i.meter):null,this.previewGateway=i.previewGateway&&i.previewUrlPattern?{...i.previewGateway}:null;let u=i.sentinelToken?.trim()??"";this.sentinelToken=u.length>0?u:null,this.mintCloneUrl=i.mintCloneUrl,this.startClaimReaper(),this.startCredentialRefresher()}startClaimReaper(){let i=["app.kubernetes.io/managed-by=studio","app.kubernetes.io/name=studio-sandbox",...this.envName?[`${zh.env}=${this.envName}`]:[]].join(",");XI0({kc:this.kubeConfig,namespace:this.namespace,labelSelector:i,signal:this.claimWatchAbort.signal,onDelete:(u)=>this.invalidateRecord(u)})}async ensure(i,u={}){let t=gN(i,u.branch??u.repo?.branch??null);return this.inflight.run(t,()=>Ha(this.stateStore,i,Xc,(f)=>this.ensureLocked(i,t,u,f)))}async delete(i,u){if(u&&this.stateStore){await Ha(this.stateStore,u,Xc,(t)=>this.deleteLocked(i,u,t));return}await this.deleteLocked(i,u,this.stateStore)}async deleteLocked(i,u,t){let f=this.records.get(i)??null;if(this.records.delete(i),f)this.closeForwarder(f.daemonForward),this.metrics?.active.add(-1,r4u(f.tenant));if(await this.deleteHttpRouteIfManaged(i).catch((l)=>{console.warn(`[${i6}] HTTPRoute delete failed for ${i}: ${l instanceof Error?l.message:String(l)}`)}),await JN(this.kubeConfig,this.namespace,i),t)if(u)await t.delete(u,Xc);else if(f)await t.delete(f.id,Xc);else await t.deleteByHandle(Xc,i)}async alive(i){return await n2(this.kubeConfig,this.namespace,i)!==void 0}watchClaimLifecycle(i,u){return jI0({kc:this.kubeConfig,namespace:this.namespace,claimName:i,signal:u})}async getPreviewUrl(i){let u=await this.getRecord(i);if(!u)return null;return this.composePreviewUrl(u)}async proxyDaemonRequest(i,u,t){let f=await this.getRecord(i);if(!f&&this.previewUrlPattern&&this.stateStore){let $=await this.stateStore.getByHandle(Xc,i),h=$?.state,v=h?.token;if($&&v){let D=`http://${h?.adoptedSandboxName??i}.${this.namespace}.svc.cluster.local:${KN}`;try{let _=await HM(D,v,u,t);if(_.status!==404)return _;try{await _.body?.cancel()}catch{}}catch{}}}if(!f)f=await this.resurrectByHandle(i);if(!f)return new Response(JSON.stringify({error:"sandbox not found"}),{status:404,headers:{"content-type":"application/json"}});let l=f,E=performance.now(),c=0,w=!(t.body instanceof ReadableStream);try{let $=await HM(f.daemonUrl,f.token,u,t);if($.status===401&&w){this.invalidateRecord(i);let h=await this.getRecord(i).catch(()=>null)??await this.resurrectByHandle(i).catch(()=>null);if(h)l=h,$=await HM(h.daemonUrl,h.token,u,t)}return c=$.status,$}catch($){if(!w)throw $;this.invalidateRecord(i);let h=await this.resurrectByHandle(i)??await this.getRecord(i).catch(()=>null);if(!h)throw $;l=h;let v=await HM(h.daemonUrl,h.token,u,t);return c=v.status,v}finally{this.recordProxyDuration("daemon",c,l,performance.now()-E)}}async adoptLiveClaim(i,u){if(this.records.has(u))return!0;let t=await n2(this.kubeConfig,this.namespace,u).catch(()=>{return});if(!t||t.metadata?.deletionTimestamp)return!1;return await this.inflight.run(u,async()=>{let l=this.records.get(u);if(l)return this.toSandbox(l);let E=await this.adopt(i,u,t);if(!E)throw Error(`cannot adopt live claim ${u}`);return Ha(this.stateStore,i,Xc,(c)=>this.finish(E,c,!0,!0,"adopt"))}).catch(()=>null)!=null}async resolvePreviewUpstreamUrl(i){if(this.previewUrlPattern)return`http://${await this.resolveServiceNameForHandle(i)}.${this.namespace}.svc.cluster.local:${KN}`;let u=await this.getRecord(i);if(u)return u.daemonUrl;let t=await this.resurrectByHandle(i);return t?t.daemonUrl:null}async resolveServiceNameForHandle(i){let u=this.records.get(i);if(u)return u.adoptedSandboxName;if(this.stateStore){let f=(await this.stateStore.getByHandle(Xc,i).catch(()=>null))?.state?.adoptedSandboxName;if(f)return f}return i}async proxyPreviewRequest(i,u){let t=performance.now(),f=this.records.get(i)??null,l=0;try{let E=await this.resolvePreviewUpstreamUrl(i);if(!E){l=404;let N=q4u(404,{error:"sandbox not found"});return N.headers.set(LK,"1"),N}let c=new URL(u.url);if((c.pathname==="/_sandbox"||c.pathname.startsWith("/_sandbox/")||c.pathname==="/_decopilot_vm"||c.pathname.startsWith("/_decopilot_vm/"))&&u.method!=="GET")return l=404,q4u(404,{error:"not found"});let $=(N)=>`${N}${c.pathname}${c.search}`,h=new Headers(u.headers);for(let N of Czf)h.delete(N);let v=u.method!=="GET"&&u.method!=="HEAD",d={method:u.method,headers:h,body:v?u.body:void 0,redirect:"manual",signal:u.signal,duplex:v?"half":void 0},D;try{D=await fetch($(E),d)}catch(N){let Z=`${E}${c.pathname}`;if(console.warn(`[${i6}] preview fetch to ${Z} failed: ${N instanceof Error?N.message:String(N)}`),u.method==="GET"||u.method==="HEAD"){if(this.invalidateRecord(i),await this.resurrectByHandle(i).catch(()=>null)){let g=await this.resolvePreviewUpstreamUrl(i);if(g)try{D=await fetch($(g),d);let T=new Headers;for(let[U,A]of D.headers.entries())if(!YI0.includes(U.toLowerCase()))T.set(U,A);return l=D.status,new Response(D.body,{status:D.status,statusText:D.statusText,headers:T})}catch(T){console.warn(`[${i6}] preview fetch retry to ${Z} failed: ${T instanceof Error?T.message:String(T)}`)}}}else this.invalidateRecord(i);l=502;let B=q4u(502,{error:"sandbox daemon unreachable"});return B.headers.set(LK,"1"),B}let _=new Headers;for(let[N,Z]of D.headers.entries())if(!YI0.includes(N.toLowerCase()))_.set(N,Z);return l=D.status,new Response(D.body,{status:D.status,statusText:D.statusText,headers:_})}finally{this.recordProxyDuration("preview",l,f,performance.now()-t,i)}}async ensureLocked(i,u,t,f){if(t.image)console.warn(`[${i6}] opts.image ignored (template ${this.sandboxTemplateName} pins image): got ${t.image}`);if(f){let c=await f.get(i,Xc);if(c){let w=await this.rehydrate(i,u,c);if(w)return await this.refreshDaemonGitCredential(w,t),this.finish(w,f,!1,!0,"resume");await f.delete(i,Xc)}}let l=await n2(this.kubeConfig,this.namespace,u).catch(()=>{return});if(l)if(l.metadata?.deletionTimestamp)await ngi(this.kubeConfig,this.namespace,u).catch((c)=>{console.warn(`[${i6}] wait for terminating claim ${u} failed: ${c instanceof Error?c.message:String(c)}`)});else{let c=await this.adopt(i,u,l).catch((w)=>{return console.warn(`[${i6}] adopt ${u} failed, recreating: ${w instanceof Error?w.message:String(w)}`),null});if(c)return await this.refreshDaemonGitCredential(c,t),this.finish(c,f,!0,!0,"adopt");await JN(this.kubeConfig,this.namespace,u).catch(()=>{}),await ngi(this.kubeConfig,this.namespace,u).catch((w)=>{console.warn(`[${i6}] wait for deleted claim ${u} failed: ${w instanceof Error?w.message:String(w)}`)})}let E=await this.provision(i,u,t);return this.finish(E,f,!0,!1,"fresh")}async finish(i,u,t,f,l){let E=this.records.get(i.handle),c=E!==void 0;if(E&&E.daemonForward!==i.daemonForward)this.closeForwarder(E.daemonForward);if(this.records.set(i.handle,i),t)await this.persist(u,i);if(f)await gI0(this.kubeConfig,this.namespace,i.handle,this.computeShutdownTime()).catch((w)=>console.warn(`[${i6}] TTL refresh failed for ${i.handle}: ${w instanceof Error?w.message:String(w)}`));if(this.metrics){let w=r4u(i.tenant);if(this.metrics.ensureOutcome.add(1,{...w,outcome:l}),!c)this.metrics.active.add(1,w)}return this.toSandbox(i)}buildEnvMap(i,u){let t={},f=[];for(let[l,E]of Object.entries(i.env??{}))if(zzf.has(l))f.push(l);else t[l]=E;if(f.length>0)console.warn(`[${i6}] opts.env keys overlap reserved bootstrap names and were dropped: ${f.join(",")}`);return{...t,DAEMON_TOKEN:u.token,DAEMON_BOOT_ID:u.daemonBootId,APP_ROOT:u.workdir,PROXY_PORT:String(KN)}}buildClaim(i,u,t){let f=this.sentinelToken!==null,l=f?[]:Object.entries(this.buildEnvMap(u,t)).sort(([w],[$])=>w<$?-1:w>$?1:0).map(([w,$])=>({name:w,value:$})),E=unf(u),c=Object.keys(E).length>0;return{apiVersion:`${Wl.CLAIM_API_GROUP}/${Wl.CLAIM_API_VERSION}`,kind:"SandboxClaim",metadata:{name:i,namespace:this.namespace,labels:{"app.kubernetes.io/name":"studio-sandbox","app.kubernetes.io/managed-by":"studio",...this.envName?{[zh.env]:this.envName}:{},...V4u(u.tenant)},...c?{annotations:E}:{}},spec:{sandboxTemplateRef:{name:this.sandboxTemplateName},additionalPodMetadata:{labels:V4u(u.tenant,{[zh.role]:"claimed",[zh.sandboxHandle]:i,...this.envName?{[zh.env]:this.envName}:{}}),...c?{annotations:E}:{}},env:l,warmpool:f?"default":"none",lifecycle:{shutdownPolicy:"Delete",shutdownTime:this.computeShutdownTime()}}}}async provision(i,u,t){let f=this.tokenGenerator(),l=Kzf(),E=M4u,c=this.buildClaim(u,t,{token:f,daemonBootId:l,workdir:E});try{await vo(this.kubeConfig,this.namespace,c)}catch(D){if(D instanceof wo)await ngi(this.kubeConfig,this.namespace,u),await vo(this.kubeConfig,this.namespace,c);else throw D}let w;try{w=await TI0(this.kubeConfig,this.namespace,u),await Cgi(this.kubeConfig,this.namespace,w)}catch(D){throw await JN(this.kubeConfig,this.namespace,u).catch(()=>{}),D}try{await this.ensureServicePortForAdoptedSandbox(w),await this.ensureHttpRouteForHandle(u,w,t.tenant??null)}catch(D){throw await JN(this.kubeConfig,this.namespace,u).catch(()=>{}),D}let $=await this.openForwarder(w,KN,u),h=`http://127.0.0.1:${$.localPort}`,v=this.workloadConfigPayload(t),d=l;try{if(await ili(h),this.sentinelToken!==null){let D=await p1i(h);if(D)d=D.bootId;await Z_(h,this.sentinelToken,v??{},{rotateToken:f})}else if(v)await Z_(h,f,v);if(t.orgFsConfigJson)await pCu(h,f,t.orgFsConfigJson).catch((D)=>console.warn("[org-fs] sidecar config relay failed",D))}catch(D){throw this.closeForwarder($),await this.deleteHttpRouteIfManaged(u).catch(()=>{}),await JN(this.kubeConfig,this.namespace,u).catch(()=>{}),D}return{id:i,handle:u,adoptedSandboxName:w,token:f,workdir:E,daemonUrl:h,daemonForward:$,workload:t.workload??null,daemonBootId:d,tenant:t.tenant??null,ensureOpts:fnf(t)}}workloadConfigPayload(i){return Htu({runtime:i?.workload?.runtime??"node",packageManager:i?.workload?.packageManager?{name:i.workload.packageManager,...i.workload.packageManagerPath?{path:i.workload.packageManagerPath}:{}}:null,repo:i?.repo??null,port:i?.workload?.devPort??Qzf,tenant:i?.tenant??void 0})}async refreshDaemonGitCredential(i,u){let t=ztu(u);if(!t)return;try{await Z_(i.daemonUrl,i.token,t)}catch(f){console.warn(`[${i6}] git credential refresh failed for ${i.handle}: ${f instanceof Error?f.message:String(f)}`)}}async withFreshCloneUrl(i,u){if(!this.mintCloneUrl)return i;try{let t=await this.mintCloneUrl(i,u!==void 0?{bufferMs:u}:void 0);return t?{...i,cloneUrl:t}:i}catch(t){return console.warn(`[${i6}] clone credential re-mint failed: ${t instanceof Error?t.message:String(t)}`),i}}startCredentialRefresher(){if(!this.mintCloneUrl)return;let{signal:i}=this.claimWatchAbort;(async()=>{while(!i.aborted){if(await y0(Rzf,{signal:i}).catch(()=>{}),i.aborted)break;try{await this.refreshAllGitCredentials()}catch(u){console.warn(`[${i6}] periodic credential refresh failed: ${u instanceof Error?u.message:String(u)}`)}}})()}async refreshAllGitCredentials(){await KI0(this.records.values(),(i)=>i.ensureOpts?.repo?.connectionId,async(i)=>{if(this.claimWatchAbort.signal.aborted)return;let u=i.ensureOpts?.repo;if(!u)return;let t=await this.withFreshCloneUrl(u,bzf);await this.refreshDaemonGitCredential(i,{...i.ensureOpts,repo:t}),i.ensureOpts={...i.ensureOpts,repo:t}})}async rebootstrapDaemon(i,u,t){if(this.sentinelToken===null)return!1;let f=this.workloadConfigPayload(t)??{};try{return await Z_(i,this.sentinelToken,f,{rotateToken:u}),!0}catch(l){if(l instanceof s1i&&l.status===401)try{return await Z_(i,u,f,{rotateToken:u}),!0}catch(E){return console.warn(`[${i6}] re-bootstrap retry with claim token failed: ${E instanceof Error?E.message:String(E)}`),!1}return console.warn(`[${i6}] re-bootstrap failed: ${l instanceof Error?l.message:String(l)}`),!1}}async ensureServicePortForAdoptedSandbox(i){if(!this.previewGateway||!this.previewUrlPattern)return;await GI0(this.kubeConfig,this.namespace,i,{name:"daemon",port:KN,targetPort:KN})}async ensureHttpRouteForHandle(i,u,t){if(!this.previewGateway||!this.previewUrlPattern)return;let f=lnf(this.previewUrlPattern,i);if(!f)throw new pl(`Unable to derive preview hostname for ${i} from pattern: ${this.previewUrlPattern}`);let l={apiVersion:`${Do.API_GROUP}/${Do.API_VERSION}`,kind:"HTTPRoute",metadata:{name:i,namespace:this.namespace,labels:V4u(t??void 0,{[zh.role]:"claimed",[zh.sandboxHandle]:i,"app.kubernetes.io/name":"studio-sandbox","app.kubernetes.io/managed-by":"studio",...this.envName?{[zh.env]:this.envName}:{}})},spec:{parentRefs:[{kind:"Gateway",group:"gateway.networking.k8s.io",name:this.previewGateway.name,namespace:this.previewGateway.namespace}],hostnames:[f],rules:[{backendRefs:[{group:"",kind:"Service",name:u,port:KN}]}]}};await Rgi(this.kubeConfig,this.namespace,l)}async deleteHttpRouteIfManaged(i){if(!this.previewGateway)return;await bgi(this.kubeConfig,this.namespace,i)}async rehydrate(i,u,t){let f=t.state;if(!f.adoptedSandboxName&&!f.podName||!f.token)return null;let l=await n2(this.kubeConfig,this.namespace,u).catch(()=>{return});if(!l||!WI0(l))return null;let E=l.status?.sandbox?.name??f.adoptedSandboxName??f.podName??u,c=await this.openAndProbeDaemon(E,u);if(!c)return null;if(f.daemonBootId&&f.daemonBootId!==c.bootId){if(this.sentinelToken!==null){let w=f.ensureOpts?.repo?{...f.ensureOpts,repo:await this.withFreshCloneUrl(f.ensureOpts.repo)}:f.ensureOpts??null;if(!await this.rebootstrapDaemon(c.daemonUrl,f.token,w))return this.closeForwarder(c.daemonForward),null}else console.warn(`[${i6}] daemon restart detected (handle=${u}): stored bootId=${f.daemonBootId} live bootId=${c.bootId}`);await this.stateStore?.put(i,Xc,{handle:u,state:{...f,daemonBootId:c.bootId}}).catch((w)=>console.warn(`[${i6}] bootId persist failed for ${u}: ${w instanceof Error?w.message:String(w)}`))}return{id:i,handle:u,adoptedSandboxName:E,token:f.token,workdir:f.workdir??M4u,daemonUrl:c.daemonUrl,daemonForward:c.daemonForward,workload:f.workload??null,daemonBootId:c.bootId,tenant:f.tenant??null,ensureOpts:f.ensureOpts??null}}async adopt(i,u,t){if(!WI0(t))return null;let f=t.status?.sandbox?.name??u;if(this.sentinelToken!==null)return null;let l=rzf(t);if(!l)return null;let E=await this.openAndProbeDaemon(f,u);if(!E)return null;let c=tnf(t);if(this.previewGateway)await this.ensureServicePortForAdoptedSandbox(f).catch((w)=>{console.warn(`[${i6}] Service port backfill failed for ${u}: ${w instanceof Error?w.message:String(w)}`)}),await this.ensureHttpRouteForHandle(u,f,c).catch((w)=>{console.warn(`[${i6}] HTTPRoute backfill failed for ${u}: ${w instanceof Error?w.message:String(w)}`)});return{id:i,handle:u,adoptedSandboxName:f,token:l,workdir:M4u,daemonUrl:E.daemonUrl,daemonForward:E.daemonForward,workload:null,daemonBootId:E.bootId,tenant:c,ensureOpts:null}}async openAndProbeDaemon(i,u){let t=await this.openForwarder(i,KN,u).catch(()=>null);if(!t)return null;let f=`http://127.0.0.1:${t.localPort}`,l=await p1i(f);if(!l)return this.closeForwarder(t),null;return{daemonForward:t,daemonUrl:f,bootId:l.bootId}}async getRecord(i){let u=this.records.get(i);if(u)return u;if(!this.stateStore)return null;let t=await this.stateStore.getByHandle(Xc,i);if(!t)return null;let f=await this.rehydrate(t.id,i,t);if(f)this.records.set(i,f);return f}async resurrectByHandle(i){if(!this.stateStore)return null;let u=await this.stateStore.getByHandle(Xc,i);if(!u)return null;let t=u.state.ensureOpts;if(!t)return null;let f=t.repo?{...t,repo:await this.withFreshCloneUrl(t.repo)}:t;return await this.ensure(u.id,f),this.records.get(i)??null}invalidateRecord(i){let u=this.records.get(i);if(!u)return;this.records.delete(i),this.closeForwarder(u.daemonForward)}recordProxyDuration(i,u,t,f,l){if(!this.metrics)return;this.metrics.proxyDurationMs.record(f,{...r4u(t?.tenant??null),source:i,sandbox_handle:t?.handle??l??"",status_code:u||0})}composePreviewUrl(i){if(this.previewUrlPattern)return T5i(this.previewUrlPattern,i.handle);return`http://127.0.0.1:${i.daemonForward.localPort}/`}toSandbox(i){return{handle:i.handle,workdir:i.workdir,previewUrl:this.composePreviewUrl(i)}}async persist(i,u){if(!i)return;let t={adoptedSandboxName:u.adoptedSandboxName,token:u.token,workdir:u.workdir,workload:u.workload,daemonBootId:u.daemonBootId,tenant:u.tenant,...u.ensureOpts?{ensureOpts:u.ensureOpts}:{}};await i.put(u.id,Xc,{handle:u.handle,state:t})}computeShutdownTime(){return new Date(Date.now()+this.idleTtlMs).toISOString()}openForwarder(i,u,t=i){let f=mzf(t,u);return new Promise((l,E)=>{let c=(w,$)=>{let h=LI0.createServer((v)=>this.handleForwardedConnection(v,i,u,t));h.once("error",(v)=>{if(v.code==="EADDRINUSE"&&$<Mzf){try{h.close()}catch{}let d=m4u+(w-m4u+1)%QI0;c(d,$+1);return}E(v)}),h.listen(w,"127.0.0.1",()=>{let v=h.address();if(!v||typeof v==="string"){h.close(),E(Error("port-forward listener failed to bind"));return}l({server:h,localPort:v.port})})};c(f,0)})}handleForwardedConnection(i,u,t,f){let l=new Yzf,E=null,c=!1,w=()=>{if(c)return;if(c=!0,l.destroy(),E)try{E.close()}catch{}if(!i.destroyed)i.destroy()};i.pipe(l),i.on("error",w),i.on("close",w),this.portForward.portForward(this.namespace,u,[t],i,null,l).then(($)=>{let h=typeof $==="function"?$():$;if(!h){w();return}if(E=h,E.on("close",w),E.on("error",()=>{this.invalidateRecord(f),w()}),c)try{E.close()}catch{}}).catch(($)=>{console.warn(`[${i6}] port-forward to ${u}:${t} failed: ${Wzf($)}`),this.invalidateRecord(f),w()})}closeForwarder(i){i.server.close((u)=>{if(u)console.warn(`[${i6}] port-forward close on :${i.localPort} errored: ${u instanceof Error?u.message:String(u)}`)})}close(){if(this.closed)return;this.closed=!0,this.claimWatchAbort.abort();for(let i of this.records.values())this.closeForwarder(i.daemonForward);this.records.clear()}}function qzf(i){return{active:i.createUpDownCounter("studio.sandbox.active",{description:"Active sandbox count, by runner kind and owning org. Cross-checks the cAdvisor-derived count from the cluster \u2014 divergence between the two indicates orphaned claims (studio deleted but K8s didn't reap) or unattributed pods.",unit:"{sandbox}"}),ensureOutcome:i.createCounter("studio.sandbox.ensure.outcome",{description:"Outcome of each ensure() call: fresh provision, resume from state-store after restart, or adopt of a cluster-side claim studio didn't know about. Cold-start ratio is the primary input for warm-pool sizing.",unit:"{call}"}),proxyDurationMs:i.createHistogram("studio.sandbox.proxy.duration_ms",{description:"Wall-clock latency of studio-mediated requests to the sandbox daemon: tool exec proxies (source=daemon) and preview iframe traffic (source=preview).",unit:"ms"})}}function Vzf(){let i=new ez;return i.loadFromDefault(),i}function WI0(i){return Boolean(i.status?.conditions?.some((u)=>u.type==="Ready"&&u.status==="True"))}function rzf(i){let u=i.spec?.env;if(!u)return null;for(let t of u)if(t.name==="DAEMON_TOKEN"&&t.value)return t.value;return null}function mzf(i,u){let t=Xzf("sha256").update(`${i}:${u}`).digest();return m4u+t.readUInt32BE(0)%QI0}function q4u(i,u){return new Response(JSON.stringify(u),{status:i,headers:{"content-type":"application/json","access-control-allow-origin":"*"}})}function SI0(i){let u=i.slice(0,azf);return ezf.test(u)?u:""}function szf(i){if(i===void 0)return null;let u=i.trim();if(u==="")return null;if(!ozf.test(u))throw Error(`AgentSandboxProvider: envName=${JSON.stringify(u)} is not a valid DNS-label-safe environment name (lowercase alphanumeric or '-', starts with a letter, ends alphanumeric, \u226432 chars). Studio sets this from STUDIO_ENV; check the studio chart's configMap.`);return u}function V4u(i,u={}){let t={...u};if(i){let f=SI0(i.orgId),l=i.userId?SI0(i.userId):"";if(f)t[zh.orgId]=f;if(l)t[zh.userId]=l}return t}function SK(i){let u="";for(let t of i){let f=t.codePointAt(0)??0;u+=f<32||f===127?" ":t}return u.slice(0,pzf)}function inf(i){try{let u=new URL(i);return u.username="",u.password="",u.toString()}catch{return""}}function unf(i){let u={},t=i.tenant;if(t?.orgSlug)u[Iv.orgSlug]=SK(t.orgSlug);if(t?.orgName)u[Iv.orgName]=SK(t.orgName);if(t?.userEmail)u[Iv.userEmail]=SK(t.userEmail);if(t?.userName)u[Iv.userName]=SK(t.userName);let f=i.repo;if(f){if(f.displayName)u[Iv.gitRepo]=SK(f.displayName);let l=inf(f.cloneUrl);if(l)u[Iv.gitRepoUrl]=SK(l);let E=i.branch??f.branch;if(E)u[Iv.gitBranch]=SK(E)}return u}function tnf(i){let u=i.metadata?.labels;if(!u)return null;let t=u[zh.orgId],f=u[zh.userId];if(!t)return null;let l=i.metadata?.annotations??{};return{orgId:t,...f?{userId:f}:{},orgSlug:l[Iv.orgSlug],orgName:l[Iv.orgName],userEmail:l[Iv.userEmail],userName:l[Iv.userName]}}function r4u(i){return{org_id:i?.orgId??"",user_id:i?.userId??"",runner_kind:Xc}}function fnf(i){let u={};if(i.repo)u.repo=i.repo;if(i.workload)u.workload=i.workload;if(i.env&&Object.keys(i.env).length>0)u.env=i.env;if(i.tenant)u.tenant=i.tenant;return Object.keys(u).length>0?u:null}function lnf(i,u){try{return new URL(T5i(i,u)).hostname||null}catch{return null}}var Xc="agent-sandbox",i6="AgentSandboxProvider",LK="x-sandbox-preview-not-ready",Szf="agent-sandbox-system",Lzf="studio-sandbox",KN=9000,Qzf=3000,M4u="/app",Hzf=32,zzf,nzf=900000,Rzf=900000,bzf=1800000,Czf,YI0,m4u=40000,QI0=1e4,Mzf=256,zh,Iv,ezf,azf=63,ozf,pzf=253;var HI0=O(()=>{O4();S4u();fni();U5i();Mgi();$o();JI0();zzf=new Set(["DAEMON_TOKEN","DAEMON_BOOT_ID","APP_ROOT","PROXY_PORT"]),Czf=["cookie","host","connection","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","accept-encoding","content-length","upgrade"],YI0=["connection","keep-alive","transfer-encoding","content-encoding","content-length"];zh={role:"studio.decocms.com/role",sandboxHandle:"studio.decocms.com/sandbox-handle",orgId:"studio.decocms.com/org-id",userId:"studio.decocms.com/user-id",env:"studio.decocms.com/env"},Iv={orgSlug:"studio.decocms.com/org-slug",orgName:"studio.decocms.com/org-name",userEmail:"studio.decocms.com/user-email",userName:"studio.decocms.com/user-name",gitRepo:"studio.decocms.com/git-repo",gitRepoUrl:"studio.decocms.com/git-repo-url",gitBranch:"studio.decocms.com/git-branch"},ezf=/^([A-Za-z0-9]([-A-Za-z0-9_.]*[A-Za-z0-9])?)?$/;ozf=/^[a-z]([a-z0-9-]{0,30}[a-z0-9])?$/});var zI0={};ji(zI0,{waitForSandboxReady:()=>Cgi,getSandboxClaim:()=>n2,getHttpRoute:()=>PI0,deleteSandboxClaim:()=>JN,deleteHttpRoute:()=>bgi,createSandboxClaim:()=>vo,applyHttpRoute:()=>Rgi,SandboxTimeoutError:()=>YK,SandboxError:()=>pl,PREVIEW_NOT_READY_HEADER:()=>LK,KubeConfig:()=>ez,K8S_CONSTANTS:()=>Wl,HTTPROUTE_CONSTANTS:()=>Do,AgentSandboxProvider:()=>e4u});var a4u=O(()=>{S4u();$o();Mgi();HI0()});class Vgi{kind=YN;userSub;dispatch;stateStore;records=new Map;constructor(i){if(!i.userSub)throw Error("DesktopSandboxProvider requires userSub");if(!i.dispatch)throw Error("DesktopSandboxProvider requires dispatch");this.userSub=i.userSub,this.dispatch=i.dispatch,this.stateStore=i.stateStore??null}async ensure(i,u={}){let t=u.branch??u.repo?.branch,f=gN(i,t),l=this.records.get(f);if(l){if(await this.probeHealth(f))return this.toSandbox(l);if(this.records.delete(f),this.stateStore)await this.stateStore.deleteByHandle(YN,f).catch(()=>{})}else if(this.stateStore){let D=(await this.stateStore.getByHandle(YN,f))?.state,_=D?.sandboxApiUrl;if(_){if(await this.probeHealth(f)){let N={handle:f,sandboxApiUrl:_,previewUrl:D?.previewUrl??_};return this.records.set(f,N),this.toSandbox(N)}await this.stateStore.deleteByHandle(YN,f).catch(()=>{})}}let E=T5({userName:u.tenant?.userName,userEmail:u.tenant?.userEmail}),c=JSON.stringify({handle:f,repo:u.repo,branch:t,...u.workload?{workload:u.workload}:{},...E?{operator:E}:{},...u.offloadAllowedHosts?{offloadAllowedHosts:u.offloadAllowedHosts}:{},...u.offloadAllowSameHostDev!==void 0?{offloadAllowSameHostDev:u.offloadAllowSameHostDev}:{},...u.orgFsConfigJson?{orgFsConfigJson:u.orgFsConfigJson}:{}}),w=await this.dispatchJson("POST","/api/sandboxes",c),$=JSON.parse(w);if(typeof $.sandboxApiUrl!=="string")throw Error("desktop ensure: daemon did not return a sandboxApiUrl string");let h=typeof $.previewUrl==="string"?$.previewUrl:$.sandboxApiUrl,v={handle:f,sandboxApiUrl:$.sandboxApiUrl,previewUrl:h};if(this.records.set(f,v),this.stateStore)await this.stateStore.put(i,YN,{handle:f,state:{handle:f,sandboxApiUrl:$.sandboxApiUrl,previewUrl:h}});return this.toSandbox(v)}async proxyDaemonRequest(i,u,t){let f=u.startsWith("/")?u:`/${u}`,l=f.startsWith("/_sandbox/")?f.slice(9):f,E=`/_sandbox/${encodeURIComponent(i)}${l}`,c=new Headers(t.headers);for(let F of["host","cookie","connection","keep-alive","transfer-encoding","upgrade","authorization"])c.delete(F);let w={};c.forEach((F,g)=>{w[g]=F});let $;if(t.body!=null)$=await cnf(t.body);let v=this.dispatch(this.userSub,{method:t.method,path:E,headers:w,body:$},{signal:t.signal})[Symbol.asyncIterator](),d=Enf(),D=200,_={"content-type":"application/octet-stream"},N=[];try{while(!0){let F=await v.next();if(F.done)break;let g=F.value;if(g.headers){D=g.headers.status,_=g.headers.headers;break}if(g.data!=null){let T=d.push(g.data);if(T.length)N.push(T)}}}catch(F){let g=F instanceof Error?F.message:"dispatch error";return new Response(JSON.stringify({error:g}),{status:502,headers:{"content-type":"application/json"}})}let Z=!1,B=new ReadableStream({async start(F){for(let g of N)F.enqueue(g)},async pull(F){try{while(!0){let g=await v.next();if(Z)return;if(g.done){let U=d.flush();if(U.length)F.enqueue(U);F.close();return}let T=g.value;if(T.data!=null){let U=d.push(T.data);if(U.length){F.enqueue(U);return}}}}catch(g){if(!Z)F.error(g)}},cancel(){Z=!0,v.return?.()}});return new Response(B,{status:D,headers:_})}async alive(i){return this.probeHealth(i)}async probeHealth(i){let u=new AbortController,t=setTimeout(()=>u.abort(),3000);try{return await this.dispatchJson("GET",`/api/sandboxes/${encodeURIComponent(i)}`,void 0,u.signal),!0}catch{return!1}finally{clearTimeout(t)}}async forgetHandle(i){if(this.records.delete(i),this.stateStore)await this.stateStore.deleteByHandle(YN,i).catch(()=>{})}async delete(i){if(this.records.delete(i),this.stateStore)await this.stateStore.deleteByHandle(YN,i).catch(()=>{});try{await this.dispatchJson("DELETE",`/api/sandboxes/${encodeURIComponent(i)}`)}catch(u){if(!(u instanceof Error?u.message:String(u)).includes("404"))throw u}}async getPreviewUrl(i){return(await this.resolveRecord(i))?.previewUrl??null}async localWorkdir(i){return null}async*watchClaimLifecycle(i,u){yield{kind:"ready"}}toSandbox(i){return{handle:i.handle,workdir:i.sandboxApiUrl,previewUrl:i.previewUrl}}async resolveRecord(i){let u=this.records.get(i);if(u)return u;if(!this.stateStore)return null;let f=(await this.stateStore.getByHandle(YN,i))?.state,l=f?.sandboxApiUrl;if(!l)return null;let E={handle:i,sandboxApiUrl:l,previewUrl:f?.previewUrl??l};return this.records.set(i,E),E}async dispatchJson(i,u,t,f){let l={accept:"application/json"};if(t!==void 0)l["content-type"]="application/json";let E=this.dispatch(this.userSub,{method:i,path:u,headers:l,body:t},{signal:f}),c=null,w="";for await(let h of E)if(h.headers)c=h.headers.status;else if(h.data!=null)w+=h.data;let $=Buffer.from(w,"base64").toString("utf8");if(c!=null&&(c<200||c>=300))throw Error(`daemon returned ${c}: ${$}`);return $}}function nI0(i){return new Vgi(i)}function Enf(){let i="";return{push(u){if(u.length===0)return o4u;i+=u;let t=i.length-i.length%4;if(t===0)return o4u;let f=i.slice(0,t);return i=i.slice(t),new Uint8Array(Buffer.from(f,"base64"))},flush(){if(i.length===0)return o4u;let u=i;return i="",new Uint8Array(Buffer.from(u,"base64"))}}}async function cnf(i){if(typeof i==="string")return i;if(i instanceof ArrayBuffer)return Buffer.from(i).toString("utf8");if(ArrayBuffer.isView(i))return Buffer.from(i.buffer,i.byteOffset,i.byteLength).toString("utf8");if(i instanceof URLSearchParams)return i.toString();return await new Response(i).text()}var YN="user-desktop",o4u;var RI0=O(()=>{U5i();o1i();o4u=new Uint8Array(0)});var bI0={};ji(bI0,{createDesktopProvider:()=>nI0,DesktopSandboxProvider:()=>Vgi});var CI0=O(()=>{RI0()});var eI0={};ji(eI0,{subscribeLifecycle:()=>p4u,getSandboxProviderByKind:()=>_o,getOrInitSharedRunner:()=>Nnf,buildDesktopProvider:()=>rgi,__resetSharedLifecyclesForTesting:()=>gnf});function rI0(i,u){let t=MI0[i];if(t)return Promise.resolve(t);let f=s4u[i];if(f)return f;let l=u().then((E)=>{return MI0[i]=E,E}).finally(()=>{delete s4u[i]});return s4u[i]=l,l}function hnf(){let i=process.env.STUDIO_SANDBOX_PREVIEW_URL_PATTERN;return i&&i.trim()!==""?i:void 0}function vnf(){let i=process.env.STUDIO_SANDBOX_TEMPLATE_NAME;return i&&i.trim()!==""?i:void 0}function dnf(){let i=process.env.STUDIO_ENV;return i&&i.trim()!==""?i:void 0}function Dnf(){let i=process.env.STUDIO_SANDBOX_SENTINEL_TOKEN;return i&&i.trim()!==""?i:void 0}function _nf(){let i=process.env.STUDIO_SANDBOX_PREVIEW_GATEWAY_NAME?.trim(),u=process.env.STUDIO_SANDBOX_PREVIEW_GATEWAY_NAMESPACE?.trim();if(!i&&!u)return;if(!i||!u)throw Error("STUDIO_SANDBOX_PREVIEW_GATEWAY_NAME and STUDIO_SANDBOX_PREVIEW_GATEWAY_NAMESPACE must both be set, or both unset. Half-configured per-claim HTTPRoute routing would silently fail to attach.");return{name:i,namespace:u}}async function mI0(i,u){let t=hnf();switch(i){case"agent-sandbox":{let f=new btu(u),{AgentSandboxProvider:l}=await Promise.resolve().then(() => (a4u(),zI0)),E=new u2(hu().encryptionKey);return new l({stateStore:f,previewUrlPattern:t,sandboxTemplateName:vnf(),envName:dnf(),previewGateway:_nf(),sentinelToken:Dnf(),meter:At,mintCloneUrl:async(c,w)=>{if(!c.connectionId)return null;let $=VF0(c.cloneUrl);if(!$)return null;let{cloneUrl:h}=await TN(c.connectionId,$.owner,$.name,u,E,{bufferMs:w?.bufferMs});return h}})}case"user-desktop":throw Error("user-desktop provider cannot be instantiated without a per-run link claim \u2014 call resolveSandboxProvider, which binds the link before constructing the provider.");default:throw Error(`Unknown sandbox provider kind: ${String(i)}`)}}async function rgi(i,u){let{DesktopSandboxProvider:t}=await Promise.resolve().then(() => (CI0(),bI0)),{getProxyDispatch:f}=await Promise.resolve().then(() => (u1u(),i1u)),l=new Rtu(i.db);if(!u)throw Error("buildDesktopProvider: userSub must be a non-empty string");let E=f();return new t({userSub:u,dispatch:E,stateStore:l})}function _o(i,u){return rI0(u,()=>mI0(u,i.db))}async function Nnf(){let i;try{i=cg()}catch(t){return console.warn("[lifecycle] cannot resolve sandbox runner:",t instanceof Error?t.message:String(t)),null}return await rI0(i,()=>mI0(i,m0().db))}function p4u(i,u,t){let f=WN.get(u);if(f){if(f.terminated){if(f.lastPhase)try{t(f.lastPhase)}catch{}return{unsubscribe:Bnf}}if(f.listeners.add(t),f.lastPhase)try{t(f.lastPhase)}catch{}return qI0(u,f,t)}let l=new AbortController,E={lastPhase:null,terminated:!1,listeners:new Set([t]),abort:l};return WN.set(u,E),Fnf(i,u,E),qI0(u,E,t)}function Bnf(){}function qI0(i,u,t){return{unsubscribe(){if(WN.get(i)!==u)return;if(u.listeners.delete(t),u.listeners.size===0)WN.delete(i),u.abort.abort()}}}async function Fnf(i,u,t){let f=null;try{for await(let l of i.watchClaimLifecycle(u,t.abort.signal)){if(t.abort.signal.aborted)break;t.lastPhase=l;let E=l.kind==="ready"||l.kind==="failed";if(E)t.terminated=!0;let c=Array.from(t.listeners);for(let w of c)try{w(l)}catch{}if(E)break}}catch(l){f=l}finally{if(!t.terminated&&!t.abort.signal.aborted&&t.listeners.size>0){let l={kind:"failed",reason:"unknown",message:f instanceof Error?f.message:"Lifecycle watcher ended unexpectedly"};t.lastPhase=l,t.terminated=!0;for(let E of Array.from(t.listeners))try{E(l)}catch{}}if(WN.get(u)===t)WN.delete(u)}}function gnf(){for(let i of WN.values())i.abort.abort();WN.clear()}var wnf,$nf,VI0,MI0,s4u,Onf,Znf,WN;var No=O(()=>{Qh();b6();X1();SF0();bF0();ba();kV();z0();wnf=Symbol.for("decocms.sandbox.lifecycle.runners"),$nf=Symbol.for("decocms.sandbox.lifecycle.inflight"),VI0=globalThis,MI0=VI0[wnf]??={},s4u=VI0[$nf]??={};Onf=Symbol.for("decocms.sandbox.lifecycle.shared-lifecycles"),Znf=globalThis,WN=Znf[Onf]??=new Map});function SN(i,u){return gN(i,u)}var Oo=O(()=>{Qh()});async function t1u(i,u){if(u.length===0)return;let t=await _o(i,"agent-sandbox");for(let f=0;f<u.length;f+=aI0){let l=u.slice(f,f+aI0);await Promise.all(l.map(async(E)=>{let c=Lh({orgId:E.organizationId,virtualMcpId:E.virtualMcpId,branch:E.branch}),w=v8(c),$={organizationId:E.organizationId,virtualMcpId:E.virtualMcpId,branch:E.branch},h=await i.storage.agentSandboxSessions.withLock($,(v)=>v.beginDelete($,E.lastStartedBy));if(!h)return;await t.delete(h.sandboxHandle??SN(w,E.branch),w),await i.storage.agentSandboxSessions.withLock($,(v)=>v.completeDelete($,h.generation))}))}}async function oI0(i,u,t){while(!0){let f=await i.storage.agentSandboxSessions.listByVirtualMcp(u,t,{limit:200});if(f.length===0)return;await t1u(i,f)}}var aI0=20;var f1u=O(()=>{Qh();No();Oo()});import{z as l1u}from"zod";var Tnf,Unf,E1u;var sI0=O(()=>{ON();Tv();fu();Ia();_9();f1u();Tnf=l1u.object({id:l1u.string().describe("ID of the virtual MCP to delete")}),Unf=l1u.object({item:$c.describe("The deleted virtual MCP entity")}),E1u=ui({name:"COLLECTION_VIRTUAL_MCP_DELETE",description:"Permanently delete a Virtual MCP and its virtual tools.",annotations:{title:"Delete Virtual MCP",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:Tnf,outputSchema:Unf,handler:async(i,u)=>{gi(u);let t=Oi(u);await u.access.check();let f=await u.storage.virtualMcps.findById(i.id);if(!f)throw Error(`Virtual MCP not found: ${i.id}`);if(f.organization_id!==t.id)throw Error(`Virtual MCP not found: ${i.id}`);if(await oI0(u,t.id,i.id),await u.storage.virtualMcps.delete(i.id),u.orgFs)await vtu(u.orgFs,i.id,Wu(u)??"system");let l=f.metadata?.githubRepo?.connectionId;if(l)try{let E=await u.storage.connections.findById(l,t.id);if(E&&Yh(E)){let w=await new r1(u.db,u.vault).get(l);if(w?.accessToken)try{await fetch("https://api.github.com/installation/token",{method:"DELETE",headers:{Authorization:`Bearer ${w.accessToken}`,Accept:"application/vnd.github+json","X-GitHub-Api-Version":"2022-11-28"},signal:AbortSignal.timeout(5000)})}catch{}await u.storage.connections.delete(l)}}catch(E){console.error("[VIRTUAL_MCP_DELETE] failed to tear down repo-scoped connection",{childConnectionId:l,error:E.message})}return{item:f}}})});import{z as Bw}from"zod";var Anf,c1u;var pI0=O(()=>{fu();Anf=Bw.object({id:Bw.string(),virtualMcpId:Bw.string(),pluginId:Bw.string(),connectionId:Bw.string().nullable(),settings:Bw.record(Bw.string(),Bw.unknown()).nullable(),createdAt:Bw.string(),updatedAt:Bw.string()}),c1u=ui({name:"VIRTUAL_MCP_PLUGIN_CONFIG_GET",description:"Get a plugin's current configuration for a specific virtual MCP.",annotations:{title:"Get Virtual MCP Plugin Config",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:Bw.object({virtualMcpId:Bw.string().describe("Virtual MCP ID"),pluginId:Bw.string().describe("Plugin ID")}),outputSchema:Bw.object({config:Anf.nullable()}),handler:async(i,u)=>{gi(u);let t=Oi(u);await u.access.check();let{virtualMcpId:f,pluginId:l}=i,E=await u.storage.connections.findById(f);if(!E||E.organization_id!==t.id)return{config:null};let c=await u.storage.virtualMcpPluginConfigs.get(f,l);if(!c)return{config:null};return{config:{id:c.id,virtualMcpId:c.virtualMcpId,pluginId:c.pluginId,connectionId:c.connectionId,settings:c.settings,createdAt:c.createdAt instanceof Date?c.createdAt.toISOString():c.createdAt,updatedAt:c.updatedAt instanceof Date?c.updatedAt.toISOString():c.updatedAt}}}})});import{z as fE}from"zod";var ynf,w1u;var iG0=O(()=>{fu();VL();Ml();ynf=fE.object({id:fE.string(),virtualMcpId:fE.string(),pluginId:fE.string(),connectionId:fE.string().nullable(),settings:fE.record(fE.string(),fE.unknown()).nullable(),createdAt:fE.string(),updatedAt:fE.string()}),w1u=ui({name:"VIRTUAL_MCP_PLUGIN_CONFIG_UPDATE",description:"Set or update a plugin's configuration for a specific virtual MCP.",annotations:{title:"Update Virtual MCP Plugin Config",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:fE.object({virtualMcpId:fE.string().describe("Virtual MCP ID"),pluginId:fE.string().describe("Plugin ID"),connectionId:fE.string().nullable().optional().describe("MCP connection to bind"),settings:fE.record(fE.string(),fE.unknown()).nullable().optional().describe("Plugin-specific settings")}),outputSchema:fE.object({config:ynf}),handler:async(i,u)=>{gi(u);let t=Oi(u);await u.access.check();let{virtualMcpId:f,pluginId:l,connectionId:E,settings:c}=i,w=Wu(u),$=await u.storage.connections.findById(f);if(!$)throw Error(`Connection not found: ${f}`);if($.organization_id!==t.id)throw Error(`Connection not found: ${f}`);let h=E?await u.storage.connections.findById(E):null;if(E&&h&&h.organization_id!==t.id)throw Error(`Connection not found: ${E}`);if(E&&$.organization_id&&!h&&b5()){if(DEi(E,$.organization_id)){if(!w)throw Error("User ID required to create dev-assets connection");let d=qL($.organization_id,cl());await u.storage.connections.create({...d,organization_id:$.organization_id,created_by:w})}}let v=await u.storage.virtualMcpPluginConfigs.upsert(f,l,{connectionId:E,settings:c});return{config:{id:v.id,virtualMcpId:v.virtualMcpId,pluginId:v.pluginId,connectionId:v.connectionId,settings:v.settings,createdAt:v.createdAt instanceof Date?v.createdAt.toISOString():v.createdAt,updatedAt:v.updatedAt instanceof Date?v.updatedAt.toISOString():v.updatedAt}}}})});import{z as F3}from"zod";var Pnf,$1u;var uG0=O(()=>{fu();_9();Pnf=F3.object({connectionId:F3.string(),toolName:F3.string(),label:F3.string(),icon:F3.string().nullable().optional()}),$1u=ui({name:"VIRTUAL_MCP_PINNED_VIEWS_UPDATE",description:"Update the pinned sidebar views for a virtual MCP. Replaces all current pins.",annotations:{title:"Update Pinned Views",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:F3.object({virtualMcpId:F3.string().describe("Virtual MCP ID"),pinnedViews:F3.array(Pnf).describe("Pinned views to set for the virtual MCP sidebar"),layout:F3.object({defaultMainView:F3.object({type:F3.string(),id:F3.string().optional(),toolName:F3.string().optional()}).nullable().optional(),chatDefaultOpen:F3.boolean().nullable().optional()}).optional()}),outputSchema:F3.object({item:$c.nullable()}),handler:async(i,u)=>{gi(u);let t=Oi(u);await u.access.check();let{virtualMcpId:f,pinnedViews:l,layout:E}=i,c=Wu(u),w=await u.storage.virtualMcps.findById(f);if(!w)throw Error(`Virtual MCP not found: ${f}`);if(w.organization_id!==t.id)throw Error(`Virtual MCP not found: ${f}`);let $=w.metadata?.ui??{},h={...$,pinnedViews:l.length>0?l:null,layout:E??$.layout??null};return{item:await u.storage.virtualMcps.update(f,c??"system",{metadata:{...w.metadata,ui:h}})}}})});import{z as R2}from"zod";var Inf,Gnf,h1u;var tG0=O(()=>{fu();Inf=R2.object({ids:R2.array(R2.string()).describe("Virtual MCP ids to look up")}),Gnf=R2.object({items:R2.array(R2.object({id:R2.string(),last_used_at:R2.string().optional(),last_used_by:R2.string().optional()}))}),h1u=ui({name:"VIRTUAL_MCP_LAST_USED_LIST",description:"Get last-used info (timestamp + user) for one or more virtual MCPs, derived from the most recent thread per agent.",annotations:{title:"List Virtual MCP Last Used",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:Inf,outputSchema:Gnf,handler:async(i,u)=>{gi(u),Oi(u),await u.access.check();let t=await u.storage.threads.findLastUsedByVirtualMcpIds(i.ids);return{items:i.ids.map((f)=>({id:f,last_used_at:t.get(f)?.last_used_at,last_used_by:t.get(f)?.last_used_by}))}}})});var fG0=O(()=>{AF0();yF0();PF0();IF0();sI0();pI0();iG0();uG0();tG0()});import{z as G1}from"zod";var v1u;var lG0=O(()=>{X1();fu();v1u=ui({name:"MONITORING_LOG_GET",description:"Get a single monitoring log by ID with full input and output data.",annotations:{title:"Get Monitoring Log",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:G1.object({id:G1.string().describe("Log ID to fetch")}),outputSchema:G1.object({log:G1.object({id:G1.string().optional(),organizationId:G1.string(),connectionId:G1.string(),toolName:G1.string(),input:G1.record(G1.string(),G1.unknown()),output:G1.record(G1.string(),G1.unknown()),isError:G1.boolean(),errorMessage:G1.string().nullish(),durationMs:G1.number(),timestamp:G1.string(),userId:G1.string().nullish(),requestId:G1.string(),userAgent:G1.string().nullish(),virtualMcpId:G1.string().nullish(),properties:G1.record(G1.string(),G1.string()).nullish()}).nullable().describe("The monitoring log, or null if not found")}),handler:async(i,u)=>{await u.access.check(),await fh();let t=Oi(u),f=await u.storage.monitoring.getById(t.id,i.id);if(!f)return{log:null};return{log:{...f,timestamp:f.timestamp instanceof Date?f.timestamp.toISOString():f.timestamp}}}})});import{z as Ut}from"zod";var knf,d1u;var EG0=O(()=>{X1();fu();knf=Ut.object({id:Ut.string().optional().describe("Unique log identifier"),organizationId:Ut.string().describe("Organization ID"),connectionId:Ut.string().describe("Connection ID"),toolName:Ut.string().describe("Name of the tool that was called"),isError:Ut.boolean().describe("Whether the call resulted in an error"),errorMessage:Ut.string().nullish().describe("Error message if applicable"),durationMs:Ut.number().describe("Call duration in milliseconds"),timestamp:Ut.string().describe("ISO 8601 timestamp of the call"),userId:Ut.string().nullish().describe("User who triggered the call"),requestId:Ut.string().describe("Unique request identifier"),userAgent:Ut.string().nullish().describe("Client identifier (x-studio-client header)"),virtualMcpId:Ut.string().nullish().describe("Virtual MCP (Agent) ID if routed through an agent"),properties:Ut.record(Ut.string(),Ut.string()).nullish().describe("Custom key-value metadata attached to the log")}),d1u=ui({name:"MONITORING_LOGS_LIST",description:"List monitoring logs for tool calls with filtering and pagination.",annotations:{title:"List Monitoring Logs",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:Ut.object({connectionId:Ut.string().optional().describe("Filter by connection ID"),excludeConnectionIds:Ut.array(Ut.string()).optional().describe("Exclude logs from these connection IDs (e.g. system connections)"),virtualMcpId:Ut.string().optional().describe("Filter by Virtual MCP (Agent) ID"),toolName:Ut.string().optional().describe("Filter by tool name"),isError:Ut.boolean().optional().describe("Filter by error status"),startDate:Ut.string().datetime().optional().describe("Filter by start date (ISO 8601 datetime string)"),endDate:Ut.string().datetime().optional().describe("Filter by end date (ISO 8601 datetime string)"),limit:Ut.number().default(20).describe("Maximum number of results"),offset:Ut.number().default(0).describe("Offset for pagination"),properties:Ut.record(Ut.string(),Ut.string()).optional().describe("Filter by exact property key=value matches"),propertyKeys:Ut.array(Ut.string()).optional().describe("Filter by logs that have these property keys"),propertyPatterns:Ut.record(Ut.string(),Ut.string()).optional().describe("Filter by property value patterns (SQL LIKE, use % as wildcard)"),propertyInValues:Ut.record(Ut.string(),Ut.string()).optional().describe("Filter by exact match within comma-separated values (e.g., user_tags in 'Engineering')")}),outputSchema:Ut.object({logs:Ut.array(knf).describe("Array of monitoring logs"),total:Ut.number().describe("Total number of logs matching filters"),offset:Ut.number().describe("Current offset for pagination"),limit:Ut.number().describe("Current limit for pagination")}),handler:async(i,u)=>{await fh();let t=Oi(u),l=i.properties||i.propertyKeys||i.propertyPatterns||i.propertyInValues?{properties:i.properties,propertyKeys:i.propertyKeys,propertyPatterns:i.propertyPatterns,propertyInValues:i.propertyInValues}:void 0,E={organizationId:t.id,connectionId:i.connectionId,excludeConnectionIds:i.excludeConnectionIds,virtualMcpId:i.virtualMcpId,toolName:i.toolName,isError:i.isError,startDate:i.startDate?new Date(i.startDate):void 0,endDate:i.endDate?new Date(i.endDate):void 0,limit:i.limit,offset:i.offset,propertyFilters:l},c=await u.storage.monitoring.query(E);return{logs:c.logs.map(({input:w,output:$,...h})=>({...h,timestamp:h.timestamp instanceof Date?h.timestamp.toISOString():h.timestamp})),total:c.total,offset:i.offset,limit:i.limit}}})});import{z as D0}from"zod";var D1u;var cG0=O(()=>{X1();fu();D1u=ui({name:"MONITORING_STATS",description:"Get aggregated statistics (counts, latency, error rates) for tool call monitoring.",annotations:{title:"Get Monitoring Stats",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:D0.object({startDate:D0.string().datetime().optional().describe("Filter by start date (ISO 8601 datetime string)"),endDate:D0.string().datetime().optional().describe("Filter by end date (ISO 8601 datetime string)"),interval:D0.string().regex(/^\d+[mhd]$/).optional().describe("Bucket interval for timeseries data (e.g. 1m, 5m, 2h, 1d). When provided, returns timeseries array."),connectionIds:D0.array(D0.string()).max(100).optional().describe("Filter by specific connection IDs (max 100)"),excludeConnectionIds:D0.array(D0.string()).max(100).optional().describe("Exclude specific connection IDs (max 100)"),toolNames:D0.array(D0.string()).max(100).optional().describe("Filter by specific tool names (max 100)"),status:D0.enum(["success","error"]).optional().describe("Filter metrics by execution status"),topN:D0.number().int().min(1).max(20).optional().describe("When provided with interval, also return top tools and their timeseries"),userIds:D0.array(D0.string()).max(100).optional().describe("Filter LLM usage by user IDs (only applied when llmUsage is true)"),llmUsage:D0.boolean().optional().describe("Aggregate LLM-call usage (tokens + USD cost) from raw log rows for the given connection. Returns token/cost totals and timeseries. Requires interval.")}),outputSchema:D0.object({totalCalls:D0.number().describe("Total number of tool calls"),errorRate:D0.number().optional().describe("Error rate as a decimal (0 to 1)"),avgDurationMs:D0.number().describe("Average call duration in milliseconds"),errorRatePercent:D0.string().optional().describe("Error rate as a percentage string"),totalErrors:D0.number().optional().describe("Total number of errors"),p50DurationMs:D0.number().optional().describe("50th percentile duration in milliseconds"),p95DurationMs:D0.number().optional().describe("95th percentile duration in milliseconds"),connectionBreakdown:D0.array(D0.object({connectionId:D0.string(),calls:D0.number(),errors:D0.number(),errorRate:D0.number(),avgDurationMs:D0.number()})).optional().describe("Per-connection metric breakdown"),totalInputTokens:D0.number().optional().describe("Total input tokens (LLM usage mode)"),totalOutputTokens:D0.number().optional().describe("Total output tokens (LLM usage mode)"),totalTokens:D0.number().optional().describe("Total tokens (LLM usage mode)"),totalCostUsd:D0.number().optional().describe("Total USD cost (LLM usage mode; only non-zero for providers that report cost)"),topTools:D0.array(D0.object({toolName:D0.string(),connectionId:D0.string().nullable(),calls:D0.number(),inputTokens:D0.number().optional(),outputTokens:D0.number().optional(),costUsd:D0.number().optional()})).optional().describe("Top tools ranked by calls"),topToolsTimeseries:D0.array(D0.object({timestamp:D0.string(),toolName:D0.string(),calls:D0.number(),errors:D0.number(),avg:D0.number(),p95:D0.number()})).optional().describe("Per-tool metric timeseries for the top tools"),timeseries:D0.array(D0.object({timestamp:D0.string(),calls:D0.number(),errors:D0.number(),errorRate:D0.number(),avg:D0.number(),p50:D0.number(),p95:D0.number(),inputTokens:D0.number().optional(),outputTokens:D0.number().optional(),totalTokens:D0.number().optional(),costUsd:D0.number().optional()})).optional().describe("Timeseries data points bucketed by interval")}),handler:async(i,u)=>{let t=Oi(u);if(await u.access.check(),await fh(),i.interval&&i.llmUsage)return u.storage.monitoring.queryLlmUsageStats({organizationId:t.id,interval:i.interval,connectionId:i.connectionIds?.[0]??"decopilot",startDate:i.startDate?new Date(i.startDate):void 0,endDate:i.endDate?new Date(i.endDate):void 0,userIds:i.userIds,topN:i.topN});if(i.interval){let l=await u.storage.monitoring.queryMetricTimeseries({organizationId:t.id,interval:i.interval,startDate:i.startDate?new Date(i.startDate):void 0,endDate:i.endDate?new Date(i.endDate):void 0,filters:{connectionIds:i.connectionIds,excludeConnectionIds:i.excludeConnectionIds,toolNames:i.toolNames,status:i.status}});if(!i.topN)return l;let E=await u.storage.monitoring.queryMetricTopToolsTimeseries({organizationId:t.id,interval:i.interval,startDate:i.startDate?new Date(i.startDate):void 0,endDate:i.endDate?new Date(i.endDate):void 0,topN:i.topN,filters:{connectionIds:i.connectionIds,excludeConnectionIds:i.excludeConnectionIds,toolNames:i.toolNames,status:i.status}});return{...l,topTools:E.topTools,topToolsTimeseries:E.timeseries}}let f=await u.storage.monitoring.getStats({organizationId:t.id,startDate:i.startDate?new Date(i.startDate):void 0,endDate:i.endDate?new Date(i.endDate):void 0});return{...f,errorRatePercent:(f.errorRate*100).toFixed(2)}}})});import{z as g3}from"zod";var _1u;var wG0=O(()=>{X1();fu();_1u=ui({name:"MONITORING_THREAD_USAGE",description:"Aggregate LLM token usage and USD cost per thread for the given thread IDs.",annotations:{title:"Get Thread Usage",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:g3.object({threadIds:g3.array(g3.string()).min(1).max(500).describe("Thread IDs to aggregate usage for (max 500)"),connectionId:g3.string().optional().describe("LLM connection ID (defaults to 'decopilot')"),startDate:g3.string().datetime().optional().describe("Filter by start date (ISO 8601 datetime string)"),endDate:g3.string().datetime().optional().describe("Filter by end date (ISO 8601 datetime string)")}),outputSchema:g3.object({items:g3.array(g3.object({threadId:g3.string(),calls:g3.number(),inputTokens:g3.number(),outputTokens:g3.number(),totalTokens:g3.number(),costUsd:g3.number()}))}),handler:async(i,u)=>{let t=Oi(u);return await u.access.check(),await fh(),{items:await u.storage.monitoring.queryThreadUsage({organizationId:t.id,connectionId:i.connectionId??"decopilot",threadIds:i.threadIds,startDate:i.startDate?new Date(i.startDate):void 0,endDate:i.endDate?new Date(i.endDate):void 0})}}})});var $G0=O(()=>{lG0();EG0();cG0();wG0()});function mgi(i){return typeof i==="string"&&Xnf.has(i.trim().toLowerCase())}var Xnf;var N1u=O(()=>{Xnf=new Set([".well-known","_admin","api","auth","cli","commerce-onboarding","dbos-queue-depth","health","hosted-run-pending","login","mcp","metrics","oauth","oauth-proxy","onboarding","org","report","reset-password"])});import{z as A$}from"zod";var O1u;var hG0=O(()=>{fu();N1u();O1u=ui({name:"ORGANIZATION_CREATE",description:"Create a new organization. The caller becomes the owner automatically.",annotations:{title:"Create Organization",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!1,openWorldHint:!1},inputSchema:A$.object({slug:A$.string().min(1).max(50).regex(/^[a-z0-9-]+$/,"Slug must be lowercase alphanumeric with hyphens").refine((i)=>!mgi(i),"Slug is reserved by Studio"),name:A$.string().min(1).max(255),description:A$.string().optional()}),outputSchema:A$.object({id:A$.string(),name:A$.string(),slug:A$.string(),logo:A$.string().nullable().optional(),metadata:A$.any().optional(),createdAt:A$.string().datetime().describe("ISO 8601 timestamp"),members:A$.array(A$.any()).optional()}),handler:async(i,u)=>{gi(u),await u.access.check();let t=Wu(u);if(!t)throw Error("User ID required to create organization");let f=await u.boundAuth.organization.create({name:i.name,slug:i.slug,metadata:i.description?{description:i.description}:void 0,userId:t});if(!f)throw Error("Failed to create organization");return{...f,createdAt:f.createdAt instanceof Date?f.createdAt.toISOString():f.createdAt}}})});import{z as Gv}from"zod";var Z1u;var vG0=O(()=>{fu();Z1u=ui({name:"ORGANIZATION_LIST",description:"List organizations the current user belongs to.",annotations:{title:"List Organizations",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},_meta:{ui:{visibility:"app"}},inputSchema:Gv.object({userId:Gv.string().optional()}),outputSchema:Gv.object({organizations:Gv.array(Gv.object({id:Gv.string(),name:Gv.string(),slug:Gv.string(),logo:Gv.string().nullable().optional(),metadata:Gv.any().optional(),createdAt:Gv.string().datetime().describe("ISO 8601 timestamp")}))}),handler:async(i,u)=>{gi(u),await u.access.check();let t=Wu(u),f=i.userId||t;if(!f)throw Error("User ID required to list organizations");return{organizations:(await u.boundAuth.organization.list(f)).map((E)=>({...E,createdAt:E.createdAt instanceof Date?E.createdAt.toISOString():E.createdAt}))}}})});import{z as nh}from"zod";var B1u;var dG0=O(()=>{fu();B1u=ui({name:"ORGANIZATION_GET",description:"Get an organization's details, members, and settings by slug or ID.",annotations:{title:"Get Organization",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:nh.object({}),outputSchema:nh.object({id:nh.string(),name:nh.string(),slug:nh.string(),logo:nh.string().nullable().optional(),metadata:nh.any().optional(),createdAt:nh.string().datetime().describe("ISO 8601 timestamp"),members:nh.array(nh.any()).optional(),invitations:nh.array(nh.any()).optional()}),handler:async(i,u)=>{gi(u),await u.access.check();let t=u.organization?.id;if(!t)throw Error("Organization ID required (no active organization in context)");let f=await u.boundAuth.organization.get(t);if(!f)throw Error("No active organization found");let l=new Date,E=f.invitations?.filter((c)=>new Date(c.expiresAt)>l);return{...f,invitations:E,createdAt:f.createdAt instanceof Date?f.createdAt.toISOString():f.createdAt}}})});import{z as xv}from"zod";var F1u;var DG0=O(()=>{fu();F1u=ui({name:"ORGANIZATION_UPDATE",description:"Update an organization's name or description.",annotations:{title:"Update Organization",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:xv.object({id:xv.string(),name:xv.string().min(1).max(255).optional(),description:xv.string().optional()}),outputSchema:xv.object({id:xv.string(),name:xv.string(),slug:xv.string(),logo:xv.string().nullable().optional(),metadata:xv.any().optional(),createdAt:xv.string().datetime().describe("ISO 8601 timestamp")}),handler:async(i,u)=>{gi(u),await u.access.check();let t={};if(i.name)t.name=i.name;if(i.description)t.metadata={description:i.description};let f=await u.boundAuth.organization.update({organizationId:i.id,data:t});if(!f)throw Error("Failed to update organization");return{...f,createdAt:f.createdAt instanceof Date?f.createdAt.toISOString():f.createdAt}}})});import{z as Zo}from"zod";var g1u;var _G0=O(()=>{fu();g1u=ui({name:"ORGANIZATION_DELETE",description:"Archive an organization (soft delete).",annotations:{title:"Delete Organization",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:Zo.object({id:Zo.string()}),outputSchema:Zo.object({success:Zo.boolean(),id:Zo.string()}),handler:async(i,u)=>{return gi(u),await u.access.check(),await u.boundAuth.organization.update({organizationId:i.id,data:{metadata:{archived:!0,archivedAt:new Date().toISOString()}}}),{success:!0,id:i.id}}})});import{z as M0}from"zod";var Bo,Fo,un,NG0,egi,go,To,LN;var b2=O(()=>{Bo=M0.object({title:M0.string(),url:M0.string(),icon:M0.string()}),Fo=M0.object({registries:M0.record(M0.string(),M0.object({enabled:M0.boolean()})).describe("Per-registry enabled/disabled state. Key is connection ID. Absent registries are treated as enabled."),blockedMcps:M0.array(M0.string()).describe("List of MCP app_name or app_id values to hide from the store.")}),un=M0.object({keyId:M0.string(),modelId:M0.string(),title:M0.string().optional()}).nullable(),NG0=M0.enum(["fast","smart","thinking","image","web_search","deep_research"]),egi=M0.enum(["fast","smart","thinking"]),go=M0.object({tiers:M0.object({fast:un,smart:un,thinking:un,image:un,web_search:un,deep_research:un})}),To=M0.object({ids:M0.array(M0.string()).describe("Ordered list of custom virtual MCP agent ids to show on the home view.")}),LN=M0.object({id:M0.string().describe("Brand context ID"),name:M0.string().describe("Company name"),domain:M0.string().describe("Company domain (e.g. example.com)"),overview:M0.string().describe("Company overview / description"),logo:M0.string().nullable().optional().describe("Logo URL"),favicon:M0.string().nullable().optional().describe("Favicon URL"),ogImage:M0.string().nullable().optional().describe("OG image URL"),fonts:M0.object({heading:M0.string().optional().describe("Font family for headings"),body:M0.string().optional().describe("Font family for body text"),code:M0.string().optional().describe("Font family for code / monospace")}).nullable().optional().describe("Font families by semantic role"),colors:M0.object({primary:M0.string().optional().describe("Primary brand color (hex)"),secondary:M0.string().optional().describe("Secondary brand color (hex)"),accent:M0.string().optional().describe("Accent / highlight color (hex)"),background:M0.string().optional().describe("Background color (hex)"),foreground:M0.string().optional().describe("Foreground / text color (hex)")}).nullable().optional().describe("Semantic color palette"),images:M0.array(M0.record(M0.string(),M0.unknown())).nullable().optional().describe("Brand images"),metadata:M0.record(M0.string(),M0.unknown()).nullable().optional().describe("Extra design tokens (typography, components, spacing, layout, tone, etc.)"),archivedAt:M0.string().nullable().optional().describe("Archive timestamp (null to unarchive)"),isDefault:M0.boolean().optional().describe("Whether this is the default brand for the organization")})});import{z as C2}from"zod";var T1u;var OG0=O(()=>{fu();b2();T1u=ui({name:"ORGANIZATION_SETTINGS_GET",description:"Get organization-level settings including sidebar configuration, store registry settings, simple model mode, and default home agents.",annotations:{title:"Get Organization Settings",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:C2.object({}),outputSchema:C2.object({organizationId:C2.string(),sidebar_items:C2.array(Bo).nullable().optional(),enabled_plugins:C2.array(C2.string()).nullable().optional(),registry_config:Fo.nullable().optional(),simple_mode:go.nullable().optional(),default_home_agents:To.nullable().optional(),reports_only:C2.boolean().nullable().optional(),createdAt:C2.string().datetime().optional().describe("ISO 8601 timestamp"),updatedAt:C2.string().datetime().optional().describe("ISO 8601 timestamp")}),handler:async(i,u)=>{gi(u),await u.access.check();let t=u.organization?.id;if(!t)throw Error("Organization ID required (no active organization in context)");let f=await u.storage.organizationSettings.get(t);if(!f)return{organizationId:t};return{...f,createdAt:f.createdAt instanceof Date?f.createdAt.toISOString():f.createdAt,updatedAt:f.updatedAt instanceof Date?f.updatedAt.toISOString():f.updatedAt}}})});import{z as Fw}from"zod";var U1u;var ZG0=O(()=>{fu();b2();U1u=ui({name:"ORGANIZATION_SETTINGS_UPDATE",description:"Update organization-level settings such as sidebar configuration, store registry settings, simple model mode, and default home agents.",annotations:{title:"Update Organization Settings",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:Fw.object({organizationId:Fw.string(),sidebar_items:Fw.array(Bo).optional(),enabled_plugins:Fw.array(Fw.string()).optional(),registry_config:Fo.optional(),simple_mode:go.optional(),default_home_agents:To.optional(),reports_only:Fw.boolean().optional()}),outputSchema:Fw.object({organizationId:Fw.string(),sidebar_items:Fw.array(Bo).nullable().optional(),enabled_plugins:Fw.array(Fw.string()).nullable().optional(),registry_config:Fo.nullable().optional(),simple_mode:go.nullable().optional(),default_home_agents:To.nullable().optional(),reports_only:Fw.boolean().nullable().optional(),createdAt:Fw.string().datetime().describe("ISO 8601 timestamp"),updatedAt:Fw.string().datetime().describe("ISO 8601 timestamp")}),handler:async(i,u)=>{if(gi(u),await u.access.check(),Oi(u).id!==i.organizationId)throw Error("Cannot update settings for a different organization");let f=await u.storage.organizationSettings.upsert(i.organizationId,{sidebar_items:i.sidebar_items,enabled_plugins:i.enabled_plugins,registry_config:i.registry_config,simple_mode:i.simple_mode,default_home_agents:i.default_home_agents,reports_only:i.reports_only});return{...f,createdAt:f.createdAt instanceof Date?f.createdAt.toISOString():f.createdAt,updatedAt:f.updatedAt instanceof Date?f.updatedAt.toISOString():f.updatedAt}}})});import{z as kv}from"zod";var BG0,A1u,y1u;var FG0=O(()=>{fu();b2();BG0=LN.extend({organizationId:kv.string(),archivedAt:kv.string().nullable().optional().describe("ISO 8601 timestamp"),createdAt:kv.string().describe("ISO 8601 timestamp"),updatedAt:kv.string().describe("ISO 8601 timestamp")}),A1u=ui({name:"BRAND_CONTEXT_LIST",description:"List all brand contexts (company profiles) for the current organization.",annotations:{title:"List Brand Contexts",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:kv.object({includeArchived:kv.boolean().optional().describe("Include archived brands in the list")}),outputSchema:kv.object({items:kv.array(BG0)}),handler:async(i,u)=>{gi(u),await u.access.check();let t=u.organization?.id;if(!t)throw Error("Organization ID required (no active organization in context)");return{items:(await u.storage.brandContext.list(t,{includeArchived:i.includeArchived})).map((l)=>({...l,archivedAt:l.archivedAt instanceof Date?l.archivedAt.toISOString():l.archivedAt,createdAt:l.createdAt instanceof Date?l.createdAt.toISOString():l.createdAt,updatedAt:l.updatedAt instanceof Date?l.updatedAt.toISOString():l.updatedAt}))}}}),y1u=ui({name:"BRAND_CONTEXT_GET",description:"Get a specific brand context by ID.",annotations:{title:"Get Brand Context",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:kv.object({id:kv.string().describe("Brand context ID")}),outputSchema:BG0.extend({organizationId:kv.string()}),handler:async(i,u)=>{gi(u),await u.access.check();let t=u.organization?.id;if(!t)throw Error("Organization ID required (no active organization in context)");let f=await u.storage.brandContext.get(i.id,t);if(!f)throw Error("Brand context not found");return{...f,archivedAt:f.archivedAt instanceof Date?f.archivedAt.toISOString():f.archivedAt,createdAt:f.createdAt instanceof Date?f.createdAt.toISOString():f.createdAt,updatedAt:f.updatedAt instanceof Date?f.updatedAt.toISOString():f.updatedAt}}})});import{z as QK}from"zod";var gG0,P1u,I1u,G1u;var TG0=O(()=>{fu();b2();gG0=LN.extend({organizationId:QK.string(),createdAt:QK.string().describe("ISO 8601 timestamp"),updatedAt:QK.string().describe("ISO 8601 timestamp")}),P1u=ui({name:"BRAND_CONTEXT_CREATE",description:"Create a new brand context (company profile) for the current organization.",annotations:{title:"Create Brand Context",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!1,openWorldHint:!1},inputSchema:LN.omit({id:!0}),outputSchema:gG0,handler:async(i,u)=>{gi(u),await u.access.check();let t=u.organization?.id;if(!t)throw Error("Organization ID required (no active organization in context)");let f=await u.storage.brandContext.create(t,{name:i.name,domain:i.domain,overview:i.overview,logo:i.logo??null,favicon:i.favicon??null,ogImage:i.ogImage??null,fonts:i.fonts??null,colors:i.colors??null,images:i.images??null,metadata:i.metadata??null});return{...f,archivedAt:f.archivedAt instanceof Date?f.archivedAt.toISOString():f.archivedAt,createdAt:f.createdAt instanceof Date?f.createdAt.toISOString():f.createdAt,updatedAt:f.updatedAt instanceof Date?f.updatedAt.toISOString():f.updatedAt}}}),I1u=ui({name:"BRAND_CONTEXT_UPDATE",description:"Update an existing brand context by ID.",annotations:{title:"Update Brand Context",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:LN.partial().required({id:!0}),outputSchema:gG0,handler:async(i,u)=>{gi(u),await u.access.check();let t=u.organization?.id;if(!t)throw Error("Organization ID required (no active organization in context)");if(!await u.storage.brandContext.get(i.id,t))throw Error("Brand context not found");let{id:l,...E}=i;if(E.isDefault===!0)await u.storage.brandContext.setDefault(l,t);let c=await u.storage.brandContext.update(l,t,{name:E.name,domain:E.domain,overview:E.overview,logo:E.logo!==void 0?E.logo??null:void 0,favicon:E.favicon!==void 0?E.favicon??null:void 0,ogImage:E.ogImage!==void 0?E.ogImage??null:void 0,fonts:E.fonts!==void 0?E.fonts??null:void 0,colors:E.colors!==void 0?E.colors??null:void 0,images:E.images!==void 0?E.images??null:void 0,metadata:E.metadata!==void 0?E.metadata??null:void 0,archivedAt:E.archivedAt!==void 0?E.archivedAt??null:void 0,isDefault:E.isDefault===!1?!1:void 0});return{...c,archivedAt:c.archivedAt instanceof Date?c.archivedAt.toISOString():c.archivedAt,createdAt:c.createdAt instanceof Date?c.createdAt.toISOString():c.createdAt,updatedAt:c.updatedAt instanceof Date?c.updatedAt.toISOString():c.updatedAt}}}),G1u=ui({name:"BRAND_CONTEXT_DELETE",description:"Archive a brand context by ID (soft delete).",annotations:{title:"Archive Brand Context",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:QK.object({id:QK.string().describe("Brand context ID")}),outputSchema:QK.object({success:QK.boolean()}),handler:async(i,u)=>{gi(u),await u.access.check();let t=u.organization?.id;if(!t)throw Error("Organization ID required (no active organization in context)");if(!await u.storage.brandContext.get(i.id,t))throw Error("Brand context not found");return await u.storage.brandContext.update(i.id,t,{archivedAt:new Date().toISOString(),isDefault:!1}),{success:!0}}})});async function agi(i,u,t){let f=i.trim();if(!f.startsWith("http"))f=`https://${f}`;let l=await fetch("https://api.firecrawl.dev/v1/scrape",{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${u}`},body:JSON.stringify({url:f,formats:["branding"]})});if(!l.ok){let D=await l.text().catch(()=>"");throw Error(`Firecrawl API error: ${l.status} ${D.slice(0,200)}`)}let E=await l.json();if(!E.success||!E.data?.branding)return null;let c=E.data.branding,w=E.data.metadata??{},$=Ynf(c,w);return{name:w.title?.split(/[|\u2013\u2014]|\s+-\s+/).map((D)=>D.trim()).filter(Boolean)?.slice().sort((D,_)=>D.length-_.length)[0]??w.ogSiteName??t??i,domain:i,overview:w.description??"",logo:$.logo,favicon:$.favicon,ogImage:$.ogImage,fonts:$.fonts,colors:$.colors,images:null,metadata:Object.keys($.metadata).length>0?$.metadata:null}}function Ynf(i,u){let t=i.images??{},f=i.colors??{},l={};for(let[v,d]of Object.entries(f))if(typeof d==="string"&&d&&Jnf.has(v))l[v]=d;let E={},w=(i.typography??{}).fontFamilies??{};for(let[v,d]of Object.entries(w))if(typeof d==="string"&&d){let D=Knf[v.toLowerCase()];if(D&&!E[D])E[D]=d}let $=i.fonts;if(Array.isArray($))for(let v of $){let d=v.family;if(typeof d==="string"&&d&&!E.body)E.body=d}let h={};for(let v of["typography","components","spacing","layout","animations","icons","tone","personality","colorScheme"])if(i[v]!==void 0)h[v]=i[v];return{logo:t.logo??null,favicon:t.favicon??null,ogImage:t.ogImage??u.ogImage??null,fonts:Object.keys(E).length>0?E:null,colors:Object.keys(l).length>0?l:null,metadata:h}}var Jnf,Knf;var x1u=O(()=>{Jnf=new Set(["primary","secondary","accent","background","foreground"]),Knf={heading:"heading",headings:"heading",head:"heading",title:"heading",body:"body",primary:"body",text:"body",code:"code",monospace:"code",mono:"code"}});import{z as ogi}from"zod";var Wnf,k1u;var UG0=O(()=>{fu();x1u();b2();Wnf=LN.pick({id:!0,name:!0,domain:!0,overview:!0,logo:!0,favicon:!0,ogImage:!0,fonts:!0,colors:!0}).extend({success:ogi.boolean()}),k1u=ui({name:"BRAND_CONTEXT_EXTRACT",description:"Extract brand context (colors, fonts, logos) from a website URL using Firecrawl.",annotations:{title:"Extract Brand Context",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!0},inputSchema:ogi.object({domain:ogi.string().describe("Website domain to extract brand from"),brandId:ogi.string().optional().describe("Existing brand context ID to update (creates new if omitted)")}),outputSchema:Wnf,modelSummary:(i)=>i.success?`Brand saved (id=${i.id}, name=${i.name}, domain=${i.domain}). The UI rendered the logo, colors, fonts, and overview.`:"Brand extraction failed.",handler:async(i,u)=>{gi(u),await u.access.check();let t=u.organization?.id;if(!t)throw Error("Organization ID required (no active organization in context)");let f=u.firecrawlApiKey;if(!f)throw Error("FIRECRAWL_API_KEY is not configured. Set the environment variable to enable brand extraction.");let l=await agi(i.domain,f,i.domain);if(!l)throw Error("Firecrawl did not return branding data for this URL");let E={name:l.name,domain:l.domain,overview:l.overview,logo:l.logo,favicon:l.favicon,ogImage:l.ogImage,fonts:l.fonts,colors:l.colors,images:l.images,metadata:l.metadata},c=i.brandId?await(async()=>{if(!await u.storage.brandContext.get(i.brandId,t))throw Error("Brand context not found");return u.storage.brandContext.update(i.brandId,t,E)})():await u.storage.brandContext.create(t,E);return{id:c.id,name:c.name,domain:c.domain,overview:c.overview,logo:c.logo,favicon:c.favicon,ogImage:c.ogImage,fonts:c.fonts,colors:c.colors,success:!0}}})});function AG0(i){let u=i.metadata??{};return{id:i.id,name:i.name,domain:i.domain||void 0,colors:i.colors??void 0,fonts:i.fonts??void 0,assets:i.logo||i.favicon||i.ogImage?{logo:i.logo??void 0,favicon:i.favicon??void 0,ogImage:i.ogImage??void 0}:void 0,overview:i.overview||void 0,tagline:typeof u.tagline==="string"?u.tagline:void 0,tone:typeof u.tone==="string"?u.tone:void 0,metadata:(()=>{let t=Object.fromEntries(Object.entries(u).filter(([f])=>f!=="tagline"&&f!=="tone"));return Object.keys(t).length>0?t:void 0})()}}var j1u,X1u;var yG0=O(()=>{Utu();fu();j1u=ui({name:"BRAND_GET",description:"Get a brand context by ID. Omit the ID to get the default brand for the organization.",annotations:{title:"Get Brand",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:$5i,outputSchema:Xa,handler:async(i,u)=>{gi(u),await u.access.check();let t=u.organization?.id;if(!t)throw Error("Organization ID required (no active organization in context)");let f=i.id?await u.storage.brandContext.get(i.id,t):await u.storage.brandContext.getDefault(t);if(!f)throw Error(i.id?"Brand not found":"No default brand configured");return AG0(f)}}),X1u=ui({name:"BRAND_LIST",description:"List all active brands for the current organization.",annotations:{title:"List Brands",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:h5i,outputSchema:v5i,handler:async(i,u)=>{gi(u),await u.access.check();let t=u.organization?.id;if(!t)throw Error("Organization ID required (no active organization in context)");return{items:(await u.storage.brandContext.list(t)).map(AG0)}}})});import{resolveTxt as Snf}from"dns/promises";function J1u(i){return`${Lnf}.${i.toLowerCase()}`}function PG0(){return`deco-verify-${crypto.randomUUID().replace(/-/g,"")}`}async function IG0(i,u,t=Snf){if(!u)return!1;try{return(await t(J1u(i))).some((l)=>l.join("").trim()===u)}catch{return!1}}var Lnf="_deco-verify";var GG0=()=>{};import{z as L1}from"zod";function QN(i){let u=i.verificationStatus==="pending"&&Boolean(i.verificationToken);return{id:i.id,domain:i.domain,joinMode:i.joinMode,verificationStatus:i.verificationStatus,verificationMethod:i.verificationMethod,verifiedAt:i.verifiedAt?new Date(i.verifiedAt).toISOString():null,recordName:u?J1u(i.domain):null,recordValue:u?i.verificationToken:null}}function Hnf(i){let u=i.toLowerCase().trim();if(!Qnf.test(u))throw Error(`Invalid domain format: "${u}". Must be a valid domain like "acme.com"`);if(jv.has(u))throw Error(`Cannot claim generic email domain "${u}". Only corporate domains are allowed.`);return u}var Qnf,K1u,sgi,Y1u,W1u,S1u,L1u,Q1u;var xG0=O(()=>{F$();GG0();fu();Qnf=/^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+$/,K1u=L1.enum(["off","auto","request"]),sgi=L1.object({id:L1.string(),domain:L1.string(),joinMode:K1u,verificationStatus:L1.enum(["pending","verified"]),verificationMethod:L1.enum(["email","dns"]).nullable(),verifiedAt:L1.string().nullable(),recordName:L1.string().nullable(),recordValue:L1.string().nullable()});Y1u=ui({name:"ORGANIZATION_DOMAIN_LIST",description:"List the email domains claimed by an organization.",annotations:{title:"List Organization Domains",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:L1.object({}),outputSchema:L1.object({domains:L1.array(sgi)}),handler:async(i,u)=>{gi(u),await u.access.check();let t=Oi(u);return{domains:(await u.storage.organizationDomains.listByOrganizationId(t.id)).map(QN)}}}),W1u=ui({name:"ORGANIZATION_DOMAIN_ADD",description:"Claim an email domain for an organization. If the caller's verified email matches the domain it is trusted immediately; otherwise it requires DNS verification.",annotations:{title:"Add Organization Domain",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:L1.object({domain:L1.string().min(1).max(255).describe("Domain to claim, e.g. acme.com"),joinMode:K1u.optional().describe("Initial join mode (only applied when the domain is trusted immediately via email match).")}),outputSchema:sgi,handler:async(i,u)=>{gi(u),await u.access.check();let t=Oi(u),f=Hnf(i.domain),E=u.auth.user?.email?.split("@")[1]?.toLowerCase(),c=Boolean(u.auth.user?.emailVerified)&&E===f,w=await u.storage.organizationDomains.getByOrgAndDomain(t.id,f);if(w){if(w.verificationStatus!=="verified"&&c){let h=await u.storage.organizationDomains.markVerified(w.id,"email");return QN(h)}return QN(w)}let $=c?await u.storage.organizationDomains.add(t.id,f,{joinMode:i.joinMode??"off",verificationStatus:"verified",verificationMethod:"email"}):await u.storage.organizationDomains.add(t.id,f,{joinMode:"off",verificationStatus:"pending",verificationToken:PG0()});return QN($)}}),S1u=ui({name:"ORGANIZATION_DOMAIN_UPDATE",description:"Set the join mode for a claimed domain. Discoverable modes (auto/request) require the domain to be verified.",annotations:{title:"Update Organization Domain",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:L1.object({id:L1.string(),joinMode:K1u}),outputSchema:sgi,handler:async(i,u)=>{gi(u),await u.access.check();let t=Oi(u),f=await u.storage.organizationDomains.getById(i.id);if(!f||f.organizationId!==t.id)throw Error("Domain not found");if(i.joinMode!=="off"&&f.verificationStatus!=="verified")throw Error("Verify the domain before enabling auto-join or requests.");let l=await u.storage.organizationDomains.updateJoinMode(i.id,i.joinMode);return QN(l)}}),L1u=ui({name:"ORGANIZATION_DOMAIN_VERIFY",description:"Check the DNS TXT record for a pending domain and mark it verified if present.",annotations:{title:"Verify Organization Domain",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!0},inputSchema:L1.object({id:L1.string()}),outputSchema:L1.object({verified:L1.boolean(),domain:sgi}),handler:async(i,u)=>{gi(u),await u.access.check();let t=Oi(u),f=await u.storage.organizationDomains.getById(i.id);if(!f||f.organizationId!==t.id)throw Error("Domain not found");if(f.verificationStatus==="verified")return{verified:!0,domain:QN(f)};if(!f.verificationToken)throw Error("Domain has no pending DNS verification.");if(!await IG0(f.domain,f.verificationToken))return{verified:!1,domain:QN(f)};let E=await u.storage.organizationDomains.markVerified(i.id,"dns");return{verified:!0,domain:QN(E)}}}),Q1u=ui({name:"ORGANIZATION_DOMAIN_REMOVE",description:"Remove a claimed domain from an organization.",annotations:{title:"Remove Organization Domain",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:L1.object({id:L1.string()}),outputSchema:L1.object({success:L1.boolean()}),handler:async(i,u)=>{gi(u),await u.access.check();let t=Oi(u),f=await u.storage.organizationDomains.getById(i.id);if(!f||f.organizationId!==t.id)throw Error("Domain not found");return await u.storage.organizationDomains.removeById(i.id),{success:!0}}})});function HN(i){return(i instanceof Error?i.message.toLowerCase():"").includes("already a member")}import{z as Sl}from"zod";var znf,H1u,z1u,n1u;var kG0=O(()=>{fu();H4();znf=Sl.object({id:Sl.string(),userId:Sl.string(),status:Sl.enum(["pending","approved","denied"]),createdAt:Sl.string(),user:Sl.object({id:Sl.string(),name:Sl.string(),email:Sl.string(),image:Sl.string().nullable()}).nullable()}),H1u=ui({name:"ORGANIZATION_JOIN_REQUEST_LIST",description:"List pending requests to join the organization.",annotations:{title:"List Join Requests",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:Sl.object({}),outputSchema:Sl.object({requests:Sl.array(znf)}),handler:async(i,u)=>{gi(u),await u.access.check();let t=Oi(u);return{requests:(await u.storage.organizationJoinRequests.listPendingWithUser(t.id)).map((l)=>({id:l.id,userId:l.userId,status:l.status,createdAt:new Date(l.createdAt).toISOString(),user:l.user}))}}}),z1u=ui({name:"ORGANIZATION_JOIN_REQUEST_APPROVE",description:"Approve a pending join request, adding the user as a member.",annotations:{title:"Approve Join Request",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:Sl.object({requestId:Sl.string()}),outputSchema:Sl.object({success:Sl.boolean()}),handler:async(i,u)=>{gi(u),await u.access.check();let t=Oi(u),f=await u.storage.organizationJoinRequests.getById(i.requestId);if(!f||f.organizationId!==t.id)throw Error("Join request not found");if(f.status!=="pending")throw Error("Join request has already been decided");let l=Wu(u);if(!await u.storage.organizationJoinRequests.decide(f.id,"approved",l??f.userId))return{success:!0};try{await u.boundAuth.organization.addMember({organizationId:t.id,userId:f.userId,role:["user"]})}catch(c){if(!HN(c))throw c}if(l)mu.capture({distinctId:l,event:"organization_join_request_approved",groups:{organization:t.id},properties:{organization_id:t.id,user_id:f.userId}});return{success:!0}}}),n1u=ui({name:"ORGANIZATION_JOIN_REQUEST_DENY",description:"Deny a pending join request.",annotations:{title:"Deny Join Request",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:Sl.object({requestId:Sl.string()}),outputSchema:Sl.object({success:Sl.boolean()}),handler:async(i,u)=>{gi(u),await u.access.check();let t=Oi(u),f=await u.storage.organizationJoinRequests.getById(i.requestId);if(!f||f.organizationId!==t.id)throw Error("Join request not found");if(f.status!=="pending")throw Error("Join request has already been decided");let l=Wu(u);if(await u.storage.organizationJoinRequests.decide(f.id,"denied",l??f.userId)&&l)mu.capture({distinctId:l,event:"organization_join_request_denied",groups:{organization:t.id},properties:{organization_id:t.id,user_id:f.userId}});return{success:!0}}})});import{z as gw}from"zod";var R1u;var jG0=O(()=>{H4();fu();Uh();R1u=ui({name:"ORGANIZATION_MEMBER_ADD",description:"Invite a member to the organization by email with an assigned role.",annotations:{title:"Add Organization Member",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:gw.object({organizationId:gw.string().optional(),userId:gw.string(),role:gw.array(gw.string())}),outputSchema:gw.object({id:gw.string(),organizationId:gw.string(),userId:gw.string(),role:gw.union([gw.string(),gw.array(gw.string())]),createdAt:gw.string().datetime().describe("ISO 8601 timestamp")}),handler:async(i,u)=>{gi(u),await u.access.check();let t=i.organizationId||u.organization?.id;if(!t)throw Error("Organization ID required (no active organization in context)");if(t!==u.organization?.id)throw Error("Organization ID does not match authenticated organization");let f=await u.db.selectFrom("member").select(["role"]).where("userId","=",Wu(u)??"").where("organizationId","=",t).executeTakeFirst();if(!f$i(f?.role,i.role))throw Error(`Insufficient privileges to assign role "${i.role.join(",")}"`);let l=await u.boundAuth.organization.addMember({organizationId:t,userId:i.userId,role:i.role});if(!l)throw Error("Failed to add member");let E=Wu(u);if(E)mu.capture({distinctId:E,event:"organization_member_added",groups:{organization:t},properties:{organization_id:t,added_user_id:i.userId,role:i.role}});return{...l,role:l.role,createdAt:l.createdAt instanceof Date?l.createdAt.toISOString():l.createdAt}}})});import{z as tn}from"zod";var b1u;var XG0=O(()=>{H4();fu();b1u=ui({name:"ORGANIZATION_MEMBER_REMOVE",description:"Remove a member from the organization. Revokes all their access immediately.",annotations:{title:"Remove Organization Member",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:tn.object({organizationId:tn.string().optional(),memberIdOrEmail:tn.string()}),outputSchema:tn.object({success:tn.boolean(),memberIdOrEmail:tn.string()}),handler:async(i,u)=>{gi(u),await u.access.check();let t=i.organizationId||u.organization?.id;if(!t)throw Error("Organization ID required (no active organization in context)");if(t!==u.organization?.id)throw Error("Organization ID does not match authenticated organization");await u.boundAuth.organization.removeMember({organizationId:t,memberIdOrEmail:i.memberIdOrEmail});let f=Wu(u);if(f)mu.capture({distinctId:f,event:"organization_member_removed",groups:{organization:t},properties:{organization_id:t,member_id_or_email:i.memberIdOrEmail}});return{success:!0,memberIdOrEmail:i.memberIdOrEmail}}})});import{z as Jc}from"zod";var C1u;var JG0=O(()=>{fu();C1u=ui({name:"ORGANIZATION_MEMBER_LIST",description:"List all members in the organization with their roles.",annotations:{title:"List Organization Members",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:Jc.object({limit:Jc.number().optional(),offset:Jc.number().optional()}),outputSchema:Jc.object({members:Jc.array(Jc.object({id:Jc.string(),organizationId:Jc.string(),userId:Jc.string(),role:Jc.string(),createdAt:Jc.string().datetime().describe("ISO 8601 timestamp"),user:Jc.object({id:Jc.string(),name:Jc.string(),email:Jc.string(),image:Jc.string().optional()}).optional()}))}),handler:async(i,u)=>{gi(u),await u.access.check();let t=u.organization?.id;if(!t)throw Error("Organization ID required (no active organization in context)");let f=await u.boundAuth.organization.listMembers({organizationId:t,limit:i.limit,offset:i.offset});return{members:(Array.isArray(f)?f:[]).map((E)=>({...E,createdAt:E.createdAt instanceof Date?E.createdAt.toISOString():E.createdAt}))}}})});import{z as lE}from"zod";var M1u;var KG0=O(()=>{H4();fu();Uh();M1u=ui({name:"ORGANIZATION_MEMBER_UPDATE_ROLE",description:"Change a member's role (e.g., admin, member) within the organization.",annotations:{title:"Update Member Role",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:lE.object({organizationId:lE.string().optional(),memberId:lE.string(),role:lE.array(lE.string())}),outputSchema:lE.object({id:lE.string(),organizationId:lE.string(),userId:lE.string(),role:lE.union([lE.string(),lE.array(lE.string())]),createdAt:lE.string().datetime().describe("ISO 8601 timestamp"),user:lE.object({email:lE.string(),name:lE.string(),image:lE.string().optional()})}),handler:async(i,u)=>{gi(u),await u.access.check();let t=i.organizationId||u.organization?.id;if(!t)throw Error("Organization ID required (no active organization in context)");let f=await u.db.selectFrom("member").select(["role"]).where("userId","=",Wu(u)??"").where("organizationId","=",t).executeTakeFirst();if(!f$i(f?.role,i.role))throw Error(`Insufficient privileges to assign role "${i.role.join(",")}"`);let l=await u.boundAuth.organization.updateMemberRole({organizationId:t,memberId:i.memberId,role:i.role});if(!l)throw Error("Failed to update member role");u.invalidateMemberRole?.(l.userId,t);let E=Wu(u);if(E)mu.capture({distinctId:E,event:"organization_member_role_updated",groups:{organization:t},properties:{organization_id:t,member_id:i.memberId,target_user_id:l.userId,new_role:Array.isArray(i.role)?i.role.join(","):i.role}});return{...l,createdAt:l.createdAt instanceof Date?l.createdAt.toISOString():l.createdAt}}})});async function YG0(){if(Uo&&Date.now()-Uo.fetchedAt<600000)return Uo.rate;try{let u=await(await fetch("https://economia.awesomeapi.com.br/json/last/USD-BRL",{signal:AbortSignal.timeout(5000)})).json(),t=parseFloat(u.USDBRL?.bid??"");if(Number.isNaN(t)||t<=0)throw Error("Invalid rate");return Uo={rate:t,fetchedAt:Date.now()},t}catch{return Uo?.rate??5.5}}function WG0(i,u,t){if(u==="brl")return Math.round(i/t);return i}var Uo=null;function q1u(i,u="",t=new URLSearchParams){for(let[f,l]of Object.entries(i)){if(l===void 0||l===null)continue;let E=u?`${u}[${f}]`:f;if(Array.isArray(l))l.forEach((c,w)=>{if(typeof c==="object"&&c!==null)q1u(c,`${E}[${w}]`,t);else t.append(`${E}[${w}]`,String(c))});else if(typeof l==="object")q1u(l,E,t);else t.append(E,String(l))}return t}async function zN(i,u){let t=hu().stripeSecretKey;if(!t)throw new Tw(503,"billing is not configured");let f=u?.params?q1u(u.params).toString():void 0,l=await fetch(`${nnf}${i}`,{method:u?.method??(f?"POST":"GET"),headers:{Authorization:`Bearer ${t}`,...f&&{"Content-Type":"application/x-www-form-urlencoded"}},body:f,signal:AbortSignal.timeout(Rnf)}),E=await l.json().catch(()=>({}));if(!l.ok){let c=E.error?.message??`HTTP ${l.status}`;throw new Tw(l.status,c)}return E}async function SG0(i){let u=hu().stripeSeatPriceId;if(!u)throw new Tw(503,"billing is not configured");let t=await zN("/checkout/sessions",{params:{mode:"subscription",line_items:[{price:u,quantity:i.quantity}],success_url:i.successUrl,cancel_url:i.cancelUrl,metadata:{orgId:i.organizationId},subscription_data:{metadata:{orgId:i.organizationId}}}});if(!t.url)throw new Tw(500,"checkout session lacks url");return{url:t.url}}async function V1u(i){let t=(await zN(`/subscriptions/${encodeURIComponent(i)}`)).items?.data??[],f=hu().stripeSeatPriceId,l=f?t.find((E)=>E.price?.id===f):t.length===1?t[0]:void 0;if(!l)throw new Tw(500,"subscription has no seat item");return{itemId:l.id,quantity:l.quantity??0}}async function LG0(i){let{itemId:u}=await V1u(i.subscriptionId),t=await zN("/invoices/create_preview",{params:{subscription:i.subscriptionId,subscription_details:{items:[{id:u,quantity:i.quantity}],proration_behavior:"always_invoice"}}});return{amountDueCents:t.amount_due??0,currency:t.currency??"usd"}}function bnf(i,u){return Math.round(i*(1+u/100))}async function QG0(i){let u=bnf(i.amountCents,i.feePercent),t=WG0(i.amountCents,i.currency,await YG0()),f=i.currency==="brl"?`Studio AI credits (R$ ${(i.amountCents/100).toFixed(2)})`:`Studio AI credits ($${(i.amountCents/100).toFixed(2)})`,l=await zN("/checkout/sessions",{params:{mode:"payment",...i.customerId&&{customer:i.customerId},line_items:[{quantity:1,price_data:{currency:i.currency,unit_amount:u,product_data:{name:f}}}],success_url:i.successUrl,cancel_url:i.cancelUrl,metadata:{kind:"topup",orgId:i.organizationId,creditCents:t}}});if(!l.url)throw new Tw(500,"checkout session lacks url");return{url:l.url}}async function HG0(i){let u=await zN("/billing_portal/sessions",{params:{customer:i.customerId,return_url:i.returnUrl}});if(!u.url)throw new Tw(500,"portal session lacks url");return{url:u.url}}async function zG0(i){let{itemId:u}=await V1u(i.subscriptionId);await zN(`/subscriptions/${encodeURIComponent(i.subscriptionId)}`,{params:{items:[{id:u,quantity:i.quantity}],proration_behavior:"always_invoice",payment_behavior:"pending_if_incomplete"}})}async function nG0(i){await zN(`/subscriptions/${encodeURIComponent(i)}`,{method:"DELETE"})}async function RG0(i){if(i.targetQuantity<1)return!1;let{itemId:u,quantity:t}=await V1u(i.subscriptionId);if(t===i.targetQuantity)return!1;return await zN(`/subscriptions/${encodeURIComponent(i.subscriptionId)}`,{params:{items:[{id:u,quantity:i.targetQuantity}],proration_behavior:"always_invoice",payment_behavior:"pending_if_incomplete"}}),!0}var nnf="https://api.stripe.com/v1",Tw,Rnf=15000;var fn=O(()=>{z0();Tw=class Tw extends Error{status;constructor(i,u){super(`Stripe API ${i}: ${u}`);this.status=i;this.name="StripeApiError"}}});import{z as Ll}from"zod";var Cnf,r1u,m1u;var bG0=O(()=>{fn();ML();fu();KL();Cnf=Ll.object({legacy:Ll.boolean(),billingMode:Ll.string(),status:Ll.string(),includedReportUrl:Ll.string().nullable()}),r1u=ui({name:"ORGANIZATION_SEATS_GET",description:"Get the organization's billing identity and which members hold paid seats.",annotations:{title:"Get Organization Seats",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:Ll.object({}),outputSchema:Ll.object({billing:Cnf.nullable(),paidSeatUserIds:Ll.array(Ll.string())}),handler:async(i,u)=>{gi(u),await u.access.check();let t=u.organization?.id;if(!t)throw Error("Organization context required");let[f,l]=await Promise.all([u.storage.organizationBilling.getBilling(t),u.storage.organizationBilling.listPaidSeatUserIds(t)]);return{billing:f?{legacy:f.legacy,billingMode:f.billingMode,status:f.status,includedReportUrl:f.includedReportUrl}:null,paidSeatUserIds:l}}}),m1u=ui({name:"ORGANIZATION_SEATS_SET",description:"Set members' seats (paid/free). Invoiced organizations apply directly; self-serve organizations with an active subscription also charge the prorated difference on the saved card (preview it with ORGANIZATION_SEATS_PREVIEW first).",annotations:{title:"Set Organization Seats",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:Ll.object({seats:Ll.array(Ll.object({userId:Ll.string().min(1),seat:Ll.enum(["paid","free"])})).min(1).max(200)}),outputSchema:Ll.object({applied:Ll.array(Ll.object({userId:Ll.string(),seat:Ll.enum(["paid","free"])})),paidSeatCount:Ll.number(),benefitsSyncQueued:Ll.boolean()}),handler:async(i,u)=>{gi(u),await u.access.check();let t=u.organization?.id;if(!t)throw Error("Organization context required");let f=Wu(u);if(!f)throw Error("User ID required");let l=await u.storage.organizationBilling.getBilling(t);if(!l||l.legacy)throw Error("This organization is on the legacy plan \u2014 seats do not apply.");let E=CL(l)?l.stripeSubscriptionId:null,c;try{c=await u.storage.organizationBilling.setSeats(t,i.seats,f,{markBenefitsPending:gB()})}catch($){if($ instanceof Y6i)throw Error($.message);throw $}if(E)try{await zG0({subscriptionId:E,quantity:c.paidSeatCount})}catch($){let h=$ instanceof Tw?$.message:"Stripe update failed";throw Error(`Seats saved, but updating the subscription failed: ${h}. Apply again to retry the charge.`)}let w=!1;if(c.benefitsReferenceId)try{await eD(t,c.benefitsReferenceId,"apply"),w=!0}catch($){console.error("Failed to enqueue benefit sync (sweep covers):",$)}return{applied:c.applied,paidSeatCount:c.paidSeatCount,benefitsSyncQueued:w}}})});import{z as M2}from"zod";var e1u,a1u;var CG0=O(()=>{fn();Ml();fu();e1u=ui({name:"ORGANIZATION_BILLING_CHECKOUT_START",description:"Start the organization's seat subscription: creates a Stripe Checkout session for the current paid-seat count and returns its URL.",annotations:{title:"Start Billing Checkout",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!1,openWorldHint:!0},inputSchema:M2.object({}),outputSchema:M2.object({url:M2.string(),quantity:M2.number()}),handler:async(i,u)=>{gi(u),await u.access.check();let t=u.organization?.id,f=u.organization?.slug;if(!t||!f)throw Error("Organization context required");let[l,E]=await Promise.all([u.storage.organizationBilling.getBilling(t),u.storage.organizationBilling.listPaidSeatUserIds(t)]);if(!l||l.legacy)throw Error("This organization is on the legacy plan \u2014 no subscription needed.");if(l.billingMode!=="self_serve")throw Error("Contract-billed organizations do not use checkout.");if(l.status==="active")throw Error("This organization already has an active subscription \u2014 seat changes apply directly.");if(l.stripeSubscriptionId)throw Error("This organization still has a subscription on file \u2014 settle or cancel it before starting a new checkout.");let c=E.length;if(c<1)throw Error("Mark at least one member as a paid seat before subscribing.");let w=`${FE()}/${encodeURIComponent(f)}/members`,{url:$}=await SG0({organizationId:t,quantity:c,successUrl:`${w}?checkout=success`,cancelUrl:`${w}?checkout=canceled`});return{url:$,quantity:c}}}),a1u=ui({name:"ORGANIZATION_SEATS_PREVIEW",description:"Preview what the organization pays now for changing its paid-seat count (Stripe prorated invoice preview). Read-only \u2014 nothing is charged.",annotations:{title:"Preview Seat Change",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!0},inputSchema:M2.object({quantity:M2.number().int().min(1).max(1000)}),outputSchema:M2.object({amountDueCents:M2.number(),currency:M2.string()}),handler:async(i,u)=>{gi(u),await u.access.check();let t=u.organization?.id;if(!t)throw Error("Organization context required");let f=await u.storage.organizationBilling.getBilling(t);if(!CL(f))throw Error("Seat previews need an active self-serve subscription.");return await LG0({subscriptionId:f.stripeSubscriptionId,quantity:i.quantity})}})});import{z as nN}from"zod";var o1u,s1u;var MG0=O(()=>{fn();ML();Ml();fu();mB();o1u=ui({name:"ORGANIZATION_BILLING_PORTAL",description:"Open the organization's Stripe billing portal (manage card, invoices, cancellation). Returns the portal URL.",annotations:{title:"Open Billing Portal",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!1,openWorldHint:!0},inputSchema:nN.object({}),outputSchema:nN.object({url:nN.string()}),handler:async(i,u)=>{gi(u),await u.access.check();let t=Oi(u);if(!t.slug)throw Error("Organization context required");let f=await u.storage.organizationBilling.getBilling(t.id);if(!f?.stripeCustomerId)throw Error("This organization has no billing account yet \u2014 subscribe first.");if(f.legacy||f.billingMode!=="self_serve")throw Error("This organization's billing is managed by deco \u2014 contact support.");try{return await HG0({customerId:f.stripeCustomerId,returnUrl:`${FE()}/${encodeURIComponent(t.slug)}/members`})}catch(l){if(l instanceof Tw)throw Error(l.message);throw l}}}),s1u=ui({name:"ORGANIZATION_INCLUDED_REPORT_SET",description:"Choose which site's weekly report re-run the organization's subscription includes (null clears it).",annotations:{title:"Set Included Report Site",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:nN.object({url:nN.string().trim().min(1).max(255).nullable()}),outputSchema:nN.object({includedReportUrl:nN.string().nullable(),benefitsSyncQueued:nN.boolean()}),handler:async(i,u)=>{gi(u),await u.access.check();let t=Oi(u),f=await u.storage.organizationBilling.getBilling(t.id);if(!f||f.legacy)throw Error("This organization is on the legacy plan \u2014 included reports do not apply.");let l=i.url===null?null:L3i(i.url);if(i.url!==null&&!l)throw Error(`"${i.url}" is not a valid site URL.`);let{updated:E,benefitsReferenceId:c}=await u.storage.organizationBilling.setIncludedReportUrl(t.id,l,{markBenefitsPending:gB()});if(!E)throw Error("Organization billing row missing.");let w=!1;if(c)try{await eD(t.id,c,"apply"),w=!0}catch($){console.error("Failed to enqueue benefit sync (sweep covers):",$)}return{includedReportUrl:l,benefitsSyncQueued:w}}})});import{z as Ao}from"zod";function Mnf(i){return`[CREDITS] Paid report runs need at least $${(qG0/100).toFixed(2)} of AI credit balance \u2014 current balance is $${(i/100).toFixed(2)}. Top up and try again.`}var qG0=500,p1u;var VG0=O(()=>{pVi();fu();E8();D9();mB();p1u=ui({name:"ORGANIZATION_REPORT_RUN_PAID",description:"Trigger a paid report run for one of the organization's sites, billed against its AI credits (requires at least $5 of balance; the run's real cost plus markup is debited at completion).",annotations:{title:"Run Paid Report",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!1,openWorldHint:!0},inputSchema:Ao.object({url:Ao.string().trim().min(1).max(255).optional()}),outputSchema:Ao.object({url:Ao.string(),started:Ao.boolean()}),handler:async(i,u)=>{gi(u),await u.access.check();let t=Oi(u),f=Wu(u);if(!f)throw Error("User ID required");if(!pq())throw Error("Reports are not available on this deployment.");let l;if(i.url)l=L3i(i.url);else l=(await u.storage.organizationBilling.getBilling(t.id))?.includedReportUrl??null;if(!l)throw Error(i.url?`"${i.url}" is not a valid site URL.`:"No site chosen \u2014 pass a url or set the included report site first.");let E=x6().deco;if(!E?.getCreditsBalance)throw Error("AI credit balance is not available on this deployment.");let c=await Sd(f,u.auth.user?.email),{balanceCents:w}=await E.getCreditsBalance(c,t.id);if(!(w>=qG0))throw Error(Mnf(w??0));return await vu0({host:l,organizationId:t.id}),{url:l,started:!0}}})});var rG0=O(()=>{hG0();vG0();dG0();DG0();_G0();OG0();ZG0();FG0();TG0();UG0();yG0();xG0();kG0();jG0();XG0();JG0();KG0();bG0();CG0();MG0();VG0()});var y$="super-agent",mG0="task-board.item.updated",eG0="task-board.item.deleted";import{z as ef}from"zod";var yo,HK,Vnf,aG0,ln;var zK=O(()=>{yo=ef.enum(["triage","todo","in_progress","in_review","done"]),HK=ef.enum(["none","low","medium","high","urgent"]),Vnf=ef.object({threadId:ef.string(),virtualMcpId:ef.string().nullable(),status:ef.enum(["in_progress","requires_action","failed","completed","expired"]).nullable(),title:ef.string().nullable(),lastMessage:ef.string().nullable(),hasPreview:ef.boolean(),createdAt:ef.string()}),aG0=ef.object({url:ef.string(),number:ef.number(),repoOwner:ef.string(),repoName:ef.string(),createdAt:ef.string(),title:ef.string().nullable(),body:ef.string().nullable(),state:ef.enum(["open","closed"]).nullable(),draft:ef.boolean().nullable(),merged:ef.boolean().nullable()}),ln=ef.object({id:ef.string(),organizationId:ef.string(),title:ef.string(),description:ef.string().nullable(),status:yo,priority:HK,assigneeId:ef.string().nullable(),assignedBy:ef.string().nullable(),dueDate:ef.string().datetime().nullable(),threads:ef.array(Vnf),createdBy:ef.string(),createdAt:ef.string().datetime(),updatedBy:ef.string(),updatedAt:ef.string().datetime()})});async function pgi(i,u,t){if(t===y$)return;let{members:f}=await i.boundAuth.organization.listMembers({organizationId:u,filterField:"userId",filterValue:t});if(!f.some((l)=>l.userId===t))throw Error("assigneeId is not a member of the organization")}var ilu=O(()=>{zK()});async function ulu(i,u,t){let f;try{return await Promise.race([i.aiProviders.listModels(u,t),new Promise((E,c)=>{f=setTimeout(()=>c(Error("listModels timeout")),rnf)})])}finally{if(f)clearTimeout(f)}}function mnf(i,u){switch(i){case"fast":return u.chat.fast;case"smart":return u.chat.smart;case"thinking":return u.chat.thinking;case"image":return u.image;case"web_search":return u.webSearch;case"deep_research":return u.deepResearch}}function tlu(i,u,t){let f=i.find((l)=>l.modelId===u);return{title:f?.title??t??u,providerId:f?.providerId,capabilities:f?.capabilities,limits:f?.limits??null}}async function P$(i,u){let t=i.organization?.id;if(!t)throw Error("resolveTier called without an organization");let l=(await i.storage.organizationSettings.get(t))?.simple_mode?.tiers?.[u]??null,E=await i.storage.aiProviderKeys.list({organizationId:t});if(l&&E.some((v)=>v.id===l.keyId)){let v=await ulu(i,l.keyId,t).catch(()=>[]);return{credentialId:l.keyId,modelId:l.modelId,modelMeta:tlu(v,l.modelId,l.title)}}if(E.length===0)throw new En(u);let c={};await Promise.all(E.map(async(v)=>{c[v.id]=await ulu(i,v.id,t).catch(()=>[])}));let w=E.map((v)=>({id:v.id,providerId:v.providerId,label:v.label,presetId:v.presetId,createdBy:v.createdBy,createdAt:v.createdAt})),$=si0(w,c),h=mnf(u,$);if(!h)throw new En(u);return{credentialId:h.keyId,modelId:h.modelId,modelMeta:tlu(c[h.keyId]??[],h.modelId,h.title)}}async function oG0(i,u,t){let f=i.organization?.id;if(!f)throw Error("resolveSpecificModel called without an organization");let l=await ulu(i,u,f).catch(()=>[]);return{credentialId:u,modelId:t,modelMeta:tlu(l,t)}}async function Rh(i,u){try{return await P$(i,u)}catch(t){if(t instanceof En)return null;return console.warn(`[resolveTier] tier "${u}" resolution failed:`,t),null}}var En,rnf=5000;var nK=O(()=>{Ef();En=class En extends Error{tier;constructor(i){super(`No model available for tier "${i}". Connect a provider or configure the tier in organization settings.`);this.tier=i;this.name="TierUnavailableError"}}});function iTi(i){return i.sandboxProviderKind==="agent-sandbox"&&i.harnessId==="decopilot"}function sG0(i){return i.harnessId==="decopilot"&&(i.sandboxProviderKind==null||i.sandboxProviderKind==="agent-sandbox")}function anf(i){return{type:"data-run-status",id:"run-status",data:{stage:i}}}function pG0(i){if(!i||typeof i!=="object")return!1;return i.type==="data-run-status"}async function q2(i,u,t){if(!i)return;try{await i.publishRawChunk(u,anf(t))}catch{}}var enf,Po,k36;var Io=O(()=>{enf=["waiting-runner","starting-run","gathering-context","preparing-tools","starting-assistant","analyzing-scope"],Po=["gathering-context","preparing-tools","starting-assistant","analyzing-scope"],k36=new Set(enf)});function uTi(){return crypto.randomUUID()}var llu=Y((J36,tx0)=>{var{defineProperty:flu,getOwnPropertyDescriptor:onf,getOwnPropertyNames:snf}=Object,pnf=Object.prototype.hasOwnProperty,iRf=(i,u)=>{for(var t in u)flu(i,t,{get:u[t],enumerable:!0})},uRf=(i,u,t,f)=>{if(u&&typeof u==="object"||typeof u==="function"){for(let l of snf(u))if(!pnf.call(i,l)&&l!==t)flu(i,l,{get:()=>u[l],enumerable:!(f=onf(u,l))||f.enumerable})}return i},tRf=(i)=>uRf(flu({},"__esModule",{value:!0}),i),ix0={};iRf(ix0,{SYMBOL_FOR_REQ_CONTEXT:()=>ux0,getContext:()=>fRf});tx0.exports=tRf(ix0);var ux0=Symbol.for("@vercel/request-context");function fRf(){return globalThis[ux0]?.get?.()??{}}});var Go=Y((K36,Ex0)=>{var{defineProperty:Elu,getOwnPropertyDescriptor:lRf,getOwnPropertyNames:ERf}=Object,cRf=Object.prototype.hasOwnProperty,wRf=(i,u)=>{for(var t in u)Elu(i,t,{get:u[t],enumerable:!0})},$Rf=(i,u,t,f)=>{if(u&&typeof u==="object"||typeof u==="function"){for(let l of ERf(u))if(!cRf.call(i,l)&&l!==t)Elu(i,l,{get:()=>u[l],enumerable:!(f=lRf(u,l))||f.enumerable})}return i},hRf=(i)=>$Rf(Elu({},"__esModule",{value:!0}),i),fx0={};wRf(fx0,{VercelOidcTokenError:()=>lx0});Ex0.exports=hRf(fx0);class lx0 extends Error{constructor(i,u){super(i);this.name="VercelOidcTokenError",this.cause=u}toString(){if(this.cause)return`${this.name}: ${this.message}: ${this.cause}`;return`${this.name}: ${this.message}`}}});var hx0=Y((Y36,$x0)=>{var{create:vRf,defineProperty:tTi,getOwnPropertyDescriptor:dRf,getOwnPropertyNames:DRf,getPrototypeOf:_Rf}=Object,NRf=Object.prototype.hasOwnProperty,ORf=(i,u)=>{for(var t in u)tTi(i,t,{get:u[t],enumerable:!0})},cx0=(i,u,t,f)=>{if(u&&typeof u==="object"||typeof u==="function"){for(let l of DRf(u))if(!NRf.call(i,l)&&l!==t)tTi(i,l,{get:()=>u[l],enumerable:!(f=dRf(u,l))||f.enumerable})}return i},wlu=(i,u,t)=>(t=i!=null?vRf(_Rf(i)):{},cx0(u||!i||!i.__esModule?tTi(t,"default",{value:i,enumerable:!0}):t,i)),ZRf=(i)=>cx0(tTi({},"__esModule",{value:!0}),i),wx0={};ORf(wx0,{findRootDir:()=>gRf,getUserDataDir:()=>TRf});$x0.exports=ZRf(wx0);var xo=wlu(Fi("path")),BRf=wlu(Fi("fs")),clu=wlu(Fi("os")),FRf=Go();function gRf(){try{let i=process.cwd();while(i!==xo.default.dirname(i)){let u=xo.default.join(i,".vercel");if(BRf.default.existsSync(u))return i;i=xo.default.dirname(i)}}catch(i){throw new FRf.VercelOidcTokenError("Token refresh only supported in node server environments")}return null}function TRf(){if(process.env.XDG_DATA_HOME)return process.env.XDG_DATA_HOME;switch(clu.default.platform()){case"darwin":return xo.default.join(clu.default.homedir(),"Library/Application Support");case"linux":return xo.default.join(clu.default.homedir(),".local/share");case"win32":if(process.env.LOCALAPPDATA)return process.env.LOCALAPPDATA;return null;default:return null}}});var Zx0=Y((W36,Ox0)=>{var{create:URf,defineProperty:fTi,getOwnPropertyDescriptor:ARf,getOwnPropertyNames:yRf,getPrototypeOf:PRf}=Object,IRf=Object.prototype.hasOwnProperty,GRf=(i,u)=>{for(var t in u)fTi(i,t,{get:u[t],enumerable:!0})},vx0=(i,u,t,f)=>{if(u&&typeof u==="object"||typeof u==="function"){for(let l of yRf(u))if(!IRf.call(i,l)&&l!==t)fTi(i,l,{get:()=>u[l],enumerable:!(f=ARf(u,l))||f.enumerable})}return i},dx0=(i,u,t)=>(t=i!=null?URf(PRf(i)):{},vx0(u||!i||!i.__esModule?fTi(t,"default",{value:i,enumerable:!0}):t,i)),xRf=(i)=>vx0(fTi({},"__esModule",{value:!0}),i),Dx0={};GRf(Dx0,{isValidAccessToken:()=>JRf,readAuthConfig:()=>jRf,writeAuthConfig:()=>XRf});Ox0.exports=xRf(Dx0);var ko=dx0(Fi("fs")),_x0=dx0(Fi("path")),kRf=jo();function Nx0(){let i=(0,kRf.getVercelDataDir)();if(!i)throw Error(`Unable to find Vercel CLI data directory. Your platform: ${process.platform}. Supported: darwin, linux, win32.`);return _x0.join(i,"auth.json")}function jRf(){try{let i=Nx0();if(!ko.existsSync(i))return null;let u=ko.readFileSync(i,"utf8");if(!u)return null;return JSON.parse(u)}catch(i){return null}}function XRf(i){let u=Nx0(),t=_x0.dirname(u);if(!ko.existsSync(t))ko.mkdirSync(t,{mode:504,recursive:!0});ko.writeFileSync(u,JSON.stringify(i,null,2),{mode:384})}function JRf(i,u=0){if(!i.token)return!1;if(typeof i.expiresAt!=="number")return!0;let t=Math.floor(Date.now()/1000),f=u/1000;return i.expiresAt>=t+f}});var Tx0=Y((S36,gx0)=>{var{defineProperty:vlu,getOwnPropertyDescriptor:KRf,getOwnPropertyNames:YRf}=Object,WRf=Object.prototype.hasOwnProperty,SRf=(i,u)=>{for(var t in u)vlu(i,t,{get:u[t],enumerable:!0})},LRf=(i,u,t,f)=>{if(u&&typeof u==="object"||typeof u==="function"){for(let l of YRf(u))if(!WRf.call(i,l)&&l!==t)vlu(i,l,{get:()=>u[l],enumerable:!(f=KRf(u,l))||f.enumerable})}return i},QRf=(i)=>LRf(vlu({},"__esModule",{value:!0}),i),Bx0={};SRf(Bx0,{processTokenResponse:()=>bRf,refreshTokenRequest:()=>RRf});gx0.exports=QRf(Bx0);var $lu=Fi("os"),HRf="https://vercel.com",zRf="cl_HYyOPBNtFMfHhaUn9L4QPfTZz6TP47bp",Fx0=`@vercel/oidc node-${process.version} ${(0,$lu.platform)()} (${(0,$lu.arch)()}) ${(0,$lu.hostname)()}`,hlu=null;async function nRf(){if(hlu)return hlu;let i=`${HRf}/.well-known/openid-configuration`,u=await fetch(i,{headers:{"user-agent":Fx0}});if(!u.ok)throw Error("Failed to discover OAuth endpoints");let t=await u.json();if(!t||typeof t.token_endpoint!=="string")throw Error("Invalid OAuth discovery response");let f=t.token_endpoint;return hlu=f,f}async function RRf(i){let u=await nRf();return await fetch(u,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded","user-agent":Fx0},body:new URLSearchParams({client_id:zRf,grant_type:"refresh_token",...i})})}async function bRf(i){let u=await i.json();if(!i.ok){let t=typeof u==="object"&&u&&"error"in u?String(u.error):"Token refresh failed";return[Error(t)]}if(typeof u!=="object"||u===null)return[Error("Invalid token response")];if(typeof u.access_token!=="string")return[Error("Missing access_token in response")];if(u.token_type!=="Bearer")return[Error("Invalid token_type in response")];if(typeof u.expires_in!=="number")return[Error("Missing expires_in in response")];return[null,u]}});var Dlu=Y((L36,Px0)=>{var{defineProperty:dlu,getOwnPropertyDescriptor:CRf,getOwnPropertyNames:MRf}=Object,qRf=Object.prototype.hasOwnProperty,VRf=(i,u)=>{for(var t in u)dlu(i,t,{get:u[t],enumerable:!0})},rRf=(i,u,t,f)=>{if(u&&typeof u==="object"||typeof u==="function"){for(let l of MRf(u))if(!qRf.call(i,l)&&l!==t)dlu(i,l,{get:()=>u[l],enumerable:!(f=CRf(u,l))||f.enumerable})}return i},mRf=(i)=>rRf(dlu({},"__esModule",{value:!0}),i),Ux0={};VRf(Ux0,{AccessTokenMissingError:()=>Ax0,RefreshAccessTokenFailedError:()=>yx0});Px0.exports=mRf(Ux0);class Ax0 extends Error{constructor(){super("No authentication found. Please log in with the Vercel CLI (vercel login).");this.name="AccessTokenMissingError"}}class yx0 extends Error{constructor(i){super("Failed to refresh authentication token.",{cause:i});this.name="RefreshAccessTokenFailedError"}}});var jo=Y((Q36,jx0)=>{var{create:eRf,defineProperty:lTi,getOwnPropertyDescriptor:aRf,getOwnPropertyNames:oRf,getPrototypeOf:sRf}=Object,pRf=Object.prototype.hasOwnProperty,ibf=(i,u)=>{for(var t in u)lTi(i,t,{get:u[t],enumerable:!0})},Gx0=(i,u,t,f)=>{if(u&&typeof u==="object"||typeof u==="function"){for(let l of oRf(u))if(!pRf.call(i,l)&&l!==t)lTi(i,l,{get:()=>u[l],enumerable:!(f=aRf(u,l))||f.enumerable})}return i},xx0=(i,u,t)=>(t=i!=null?eRf(sRf(i)):{},Gx0(u||!i||!i.__esModule?lTi(t,"default",{value:i,enumerable:!0}):t,i)),ubf=(i)=>Gx0(lTi({},"__esModule",{value:!0}),i),kx0={};ibf(kx0,{assertVercelOidcTokenResponse:()=>_lu,findProjectInfo:()=>Ebf,getTokenPayload:()=>$bf,getVercelDataDir:()=>tbf,getVercelOidcToken:()=>lbf,getVercelToken:()=>fbf,isExpired:()=>hbf,loadToken:()=>wbf,saveToken:()=>cbf});jx0.exports=ubf(kx0);var Xo=xx0(Fi("path")),RK=xx0(Fi("fs")),$n=Go(),ETi=hx0(),cn=Zx0(),Ix0=Tx0(),wn=Dlu();function tbf(){let u=(0,ETi.getUserDataDir)();if(!u)return null;return Xo.join(u,"com.vercel.cli")}async function fbf(i){let u=(0,cn.readAuthConfig)();if(!u?.token)throw new wn.AccessTokenMissingError;if((0,cn.isValidAccessToken)(u,i?.expirationBufferMs))return u.token;if(!u.refreshToken)throw(0,cn.writeAuthConfig)({}),new wn.RefreshAccessTokenFailedError("No refresh token available");try{let t=await(0,Ix0.refreshTokenRequest)({refresh_token:u.refreshToken}),[f,l]=await(0,Ix0.processTokenResponse)(t);if(f||!l)throw(0,cn.writeAuthConfig)({}),new wn.RefreshAccessTokenFailedError(f);let E={token:l.access_token,expiresAt:Math.floor(Date.now()/1000)+l.expires_in};if(l.refresh_token)E.refreshToken=l.refresh_token;return(0,cn.writeAuthConfig)(E),E.token}catch(t){if((0,cn.writeAuthConfig)({}),t instanceof wn.AccessTokenMissingError||t instanceof wn.RefreshAccessTokenFailedError)throw t;throw new wn.RefreshAccessTokenFailedError(t)}}async function lbf(i,u,t){let f=`https://api.vercel.com/v1/projects/${u}/token?source=vercel-oidc-refresh${t?`&teamId=${t}`:""}`,l=await fetch(f,{method:"POST",headers:{Authorization:`Bearer ${i}`}});if(!l.ok)throw new $n.VercelOidcTokenError(`Failed to refresh OIDC token: ${l.statusText}`);let E=await l.json();return _lu(E),E}function _lu(i){if(!i||typeof i!=="object")throw TypeError("Vercel OIDC token is malformed. Expected an object. Please run `vc env pull` and try again");if(!("token"in i)||typeof i.token!=="string")throw TypeError("Vercel OIDC token is malformed. Expected a string-valued token property. Please run `vc env pull` and try again")}function Ebf(){let i=(0,ETi.findRootDir)();if(!i)throw new $n.VercelOidcTokenError("Unable to find project root directory. Have you linked your project with `vc link?`");let u=Xo.join(i,".vercel","project.json");if(!RK.existsSync(u))throw new $n.VercelOidcTokenError("project.json not found, have you linked your project with `vc link?`");let t=JSON.parse(RK.readFileSync(u,"utf8"));if(typeof t.projectId!=="string"&&typeof t.orgId!=="string")throw TypeError("Expected a string-valued projectId property. Try running `vc link` to re-link your project.");return{projectId:t.projectId,teamId:t.orgId}}function cbf(i,u){let t=(0,ETi.getUserDataDir)();if(!t)throw new $n.VercelOidcTokenError("Unable to find user data directory. Please reach out to Vercel support.");let f=Xo.join(t,"com.vercel.token",`${u}.json`),l=JSON.stringify(i);RK.mkdirSync(Xo.dirname(f),{mode:504,recursive:!0}),RK.writeFileSync(f,l),RK.chmodSync(f,432);return}function wbf(i){let u=(0,ETi.getUserDataDir)();if(!u)throw new $n.VercelOidcTokenError("Unable to find user data directory. Please reach out to Vercel support.");let t=Xo.join(u,"com.vercel.token",`${i}.json`);if(!RK.existsSync(t))return null;let f=JSON.parse(RK.readFileSync(t,"utf8"));return _lu(f),f}function $bf(i){let u=i.split(".");if(u.length!==3)throw new $n.VercelOidcTokenError("Invalid token. Please run `vc env pull` and try again");let t=u[1].replace(/-/g,"+").replace(/_/g,"/"),f=t.padEnd(t.length+(4-t.length%4)%4,"=");return JSON.parse(Buffer.from(f,"base64").toString("utf8"))}function hbf(i,u=0){return i.exp*1000<Date.now()+u}});var Yx0=Y((H36,Kx0)=>{var{defineProperty:Nlu,getOwnPropertyDescriptor:vbf,getOwnPropertyNames:dbf}=Object,Dbf=Object.prototype.hasOwnProperty,_bf=(i,u)=>{for(var t in u)Nlu(i,t,{get:u[t],enumerable:!0})},Nbf=(i,u,t,f)=>{if(u&&typeof u==="object"||typeof u==="function"){for(let l of dbf(u))if(!Dbf.call(i,l)&&l!==t)Nlu(i,l,{get:()=>u[l],enumerable:!(f=vbf(u,l))||f.enumerable})}return i},Obf=(i)=>Nbf(Nlu({},"__esModule",{value:!0}),i),Jx0={};_bf(Jx0,{refreshToken:()=>Zbf});Kx0.exports=Obf(Jx0);var Xx0=Go(),RN=jo();async function Zbf(i){let u=i?.project,t=i?.team;if(!u&&!t){let l=(0,RN.findProjectInfo)();u=l.projectId,t=l.teamId}else if(!u||!t){let l=(0,RN.findProjectInfo)();u=u??l.projectId,t=t??l.teamId}if(!u)throw new Xx0.VercelOidcTokenError("Failed to refresh OIDC token: No project specified. Try re-linking your project with `vc link`");let f=(0,RN.loadToken)(u);if(!f||(0,RN.isExpired)((0,RN.getTokenPayload)(f.token),i?.expirationBufferMs)){let l=await(0,RN.getVercelToken)({expirationBufferMs:i?.expirationBufferMs});if(f=await(0,RN.getVercelOidcToken)(l,u,t),!f)throw new Xx0.VercelOidcTokenError("Failed to refresh OIDC token");(0,RN.saveToken)(f,u)}process.env.VERCEL_OIDC_TOKEN=f.token;return}});var Lx0=Y((z36,Sx0)=>{var{defineProperty:Zlu,getOwnPropertyDescriptor:Bbf,getOwnPropertyNames:Fbf}=Object,gbf=Object.prototype.hasOwnProperty,Tbf=(i,u)=>{for(var t in u)Zlu(i,t,{get:u[t],enumerable:!0})},Ubf=(i,u,t,f)=>{if(u&&typeof u==="object"||typeof u==="function"){for(let l of Fbf(u))if(!gbf.call(i,l)&&l!==t)Zlu(i,l,{get:()=>u[l],enumerable:!(f=Bbf(u,l))||f.enumerable})}return i},Abf=(i)=>Ubf(Zlu({},"__esModule",{value:!0}),i),Wx0={};Tbf(Wx0,{getVercelOidcToken:()=>Ibf,getVercelOidcTokenSync:()=>Olu});Sx0.exports=Abf(Wx0);var ybf=llu(),Pbf=Go();async function Ibf(i){let u="",t;try{u=Olu()}catch(f){t=f}try{let[{getTokenPayload:f,isExpired:l},{refreshToken:E}]=await Promise.all([await Promise.resolve().then(() => j(jo())),await Promise.resolve().then(() => j(Yx0()))]);if(!u||l(f(u),i?.expirationBufferMs))await E(i),u=Olu()}catch(f){let l=t instanceof Error?t.message:"";if(f instanceof Error)l=`${l}
+`))>=0){let $=f.slice(0,w).trim();if(f=f.slice(w+1),!$)continue;yield JSON.parse($)}}let l=f.trim();if(l)yield JSON.parse(l)}finally{u.releaseLock()}}var BI0,FI0,UI0="gateway.networking.k8s.io",AI0="v1",yI0="httproutes",Azf,Do,II0="mesh-sandbox-runner";var Mgi=O(()=>{O4();$o();BI0=class BI0 extends Error{status;body;constructor(i,u,t){super(t);this.status=i;this.body=u;this.name="KubeHttpError"}};FI0=`/apis/${Wl.CLAIM_API_GROUP}/${Wl.CLAIM_API_VERSION}/namespaces`;Azf=`/apis/${UI0}/${AI0}/namespaces`;Do={API_GROUP:UI0,API_VERSION:AI0,PLURAL:yI0}});async function*jI0(i){let u=i.now??(()=>Date.now()),t=u(),f=i.schedulingTimeoutMs??Izf,l={pod:{},sandbox:{},events:{hasPulling:!1,hasPulled:!1},startedAt:t},E=[],c=null,w=!1,$=(g)=>{if(w)return;if(c){let T=c;c=null,T(g)}else E.push(g)},h=()=>{if(E.length>0)return Promise.resolve(E.shift());if(w)return Promise.resolve(null);return new Promise((g)=>{c=g})},v=()=>{if(w)return;if(w=!0,c){let g=c;c=null,g(null)}},d=new AbortController,D=()=>{d.abort(),v()};if(i.signal)if(i.signal.aborted)d.abort(),v();else i.signal.addEventListener("abort",D,{once:!0});let _=Math.max(0,f-(u()-t)),N=setTimeout(()=>$("tick"),_+100),Z,B=new Promise((g)=>{Z=g}),F=Promise.allSettled([Gzf(i.kc,i.namespace,i.claimName,d.signal,l,$,u,Z),kzf(i.kc,i.namespace,i.claimName,d.signal,l,$),jzf(i.kc,i.namespace,i.claimName,B,d.signal,l,$,u)]);try{let g=null,T=-1,U=xI0(l,f,u);if(g=C4u(U),!b4u(U))T=kI0(U);if(yield U,b4u(U))return;while(!w){if(await h()===null)break;let I=xI0(l,f,u);if(b4u(I)){let X=C4u(I);if(X!==g)g=X,yield I;return}let k=kI0(I);if(k<T)continue;let G=C4u(I);if(G!==g)g=G,T=k,yield I}}finally{if(clearTimeout(N),d.abort(),i.signal)i.signal.removeEventListener("abort",D);v(),await F.catch(()=>{})}}function xI0(i,u,t){let{pod:f,sandbox:l,events:E,startedAt:c}=i;if(l.ready)return{kind:"ready"};let w=f.containerWaitingReason;if(w==="ImagePullBackOff"||w==="ErrImagePull")return{kind:"failed",reason:"image-pull-backoff",message:"Sandbox image failed to download. The cluster may be missing pull credentials or the image tag may not exist."};if(w==="CrashLoopBackOff")return{kind:"failed",reason:"crash-loop-backoff",message:"Sandbox crashed during startup and is now in CrashLoopBackOff. Check pod logs."};if(!f.scheduled&&E.lastFailedSchedulingAt!==void 0&&t()-c>u)return{kind:"failed",reason:"scheduling-timeout",message:E.failedSchedulingMessage??`Pod could not be scheduled within ${Math.round(u/1000)}s.`};if(f.containerRunning&&!f.containerReady)return{kind:"warming-daemon",since:c};if(E.hasPulling&&!E.hasPulled)return{kind:"pulling-image",since:c};if(w==="ContainerCreating"||w==="PodInitializing"||f.scheduled&&!f.containerRunning)return{kind:"starting-container",since:c};if(f.scheduledFalseReason==="Unschedulable"||E.lastFailedSchedulingAt!==void 0&&!f.scheduled)return{kind:"waiting-for-capacity",since:c,message:E.failedSchedulingMessage??f.scheduledFalseMessage,nodeClaim:E.nominatedNodeClaim};return{kind:"claiming",since:c}}function b4u(i){return i.kind==="ready"||i.kind==="failed"}function kI0(i){switch(i.kind){case"claiming":return 0;case"waiting-for-capacity":return 1;case"pulling-image":return 2;case"starting-container":return 3;case"warming-daemon":return 4;case"ready":case"failed":return 99}}function C4u(i){switch(i.kind){case"claiming":case"pulling-image":case"starting-container":case"warming-daemon":return i.kind;case"waiting-for-capacity":return`waiting-for-capacity:${i.message??""}:${i.nodeClaim??""}`;case"ready":return"ready";case"failed":return`failed:${i.reason}:${i.message}`}}async function Gzf(i,u,t,f,l,E,c,w){let $=`/api/v1/namespaces/${encodeURIComponent(u)}/pods?watch=true&labelSelector=${encodeURIComponent(`${yzf}=${t}`)}`;return qgi({kc:i,path:$,signal:f,label:`pod/${t}`,onEvent:(h)=>{if(h.type!=="ADDED"&&h.type!=="MODIFIED")return;let v=h.object;if(v.metadata?.name)w(v.metadata.name);xzf(v,l,c),E("pod")}})}function xzf(i,u,t){let l=(i.status?.conditions??[]).find((c)=>c.type==="PodScheduled");if(l?.status==="True")u.pod.scheduled=!0,u.pod.scheduledFalseReason=void 0,u.pod.scheduledFalseMessage=void 0;else if(l?.status==="False")u.pod.scheduled=!1,u.pod.scheduledFalseReason=l.reason,u.pod.scheduledFalseMessage=l.message;let E=(i.status?.containerStatuses??[]).find((c)=>c.name===Pzf);if(E)u.pod.containerWaitingReason=E.state?.waiting?.reason,u.pod.containerRunning=!!E.state?.running,u.pod.containerReady=E.ready===!0}async function kzf(i,u,t,f,l,E){let c=`/apis/${Wl.CLAIM_API_GROUP}/${Wl.CLAIM_API_VERSION}/namespaces/${encodeURIComponent(u)}/${Wl.CLAIM_PLURAL}?watch=true&fieldSelector=${encodeURIComponent(`metadata.name=${t}`)}`;return qgi({kc:i,path:c,signal:f,label:`sandboxclaim/${t}`,onEvent:(w)=>{if(w.type!=="ADDED"&&w.type!=="MODIFIED")return;let h=w.object.status?.conditions?.find((v)=>v.type==="Ready");if(!h)return;if(h.status==="True")l.sandbox.ready=!0,l.sandbox.notReadyReason=void 0,l.sandbox.notReadyMessage=void 0;else l.sandbox.ready=!1,l.sandbox.notReadyReason=h.reason,l.sandbox.notReadyMessage=h.message;E("sandbox")}})}async function jzf(i,u,t,f,l,E,c,w){let $=await Promise.race([f,new Promise((v)=>{if(l.aborted){v(t);return}l.addEventListener("abort",()=>v(t),{once:!0})})]);if(l.aborted)return;let h=`/api/v1/namespaces/${encodeURIComponent(u)}/events?watch=true&fieldSelector=${encodeURIComponent(`involvedObject.name=${$},involvedObject.kind=Pod`)}`;return qgi({kc:i,path:h,signal:l,label:`events/${t}`,onEvent:(v)=>{if(v.type!=="ADDED"&&v.type!=="MODIFIED")return;let d=v.object,D=d.reason;if(!D)return;switch(D){case"Pulling":E.events.hasPulling=!0;break;case"Pulled":E.events.hasPulling=!0,E.events.hasPulled=!0;break;case"FailedScheduling":E.events.lastFailedSchedulingAt=w(),E.events.failedSchedulingMessage=d.message;break;case"Nominated":{let _=d.message?.match(/nodeclaim\/([\w-]+)/);if(_)E.events.nominatedNodeClaim=_[1];break}default:return}c("event")}})}async function XI0(i){let{kc:u,namespace:t,labelSelector:f,signal:l,onDelete:E}=i,c=`/apis/${Wl.CLAIM_API_GROUP}/${Wl.CLAIM_API_VERSION}/namespaces/${encodeURIComponent(t)}/${Wl.CLAIM_PLURAL}?watch=true&labelSelector=${encodeURIComponent(f)}`;return qgi({kc:u,path:c,signal:l,label:"sandboxclaim-reaper",onEvent:(w)=>{if(w.type!=="DELETED")return;let $=w.object.metadata?.name;if($)E($)}})}async function qgi(i){let{kc:u,path:t,signal:f,label:l,onEvent:E}=i,c=0;while(!f.aborted){try{let $=await WK(u,{method:"GET",path:t,signal:f,headers:{accept:"application/json"},stream:!0});if(!$.ok||!$.body){try{await $.body?.cancel()}catch{}if($.status===401||$.status===403){console.warn(`[lifecycle-watcher] ${l} stopped: watch denied (${$.status} ${$.statusText}). `+"The kubeconfig in use cannot watch SandboxClaims \u2014 if you are running locally, "+"this provider should not be active (check STUDIO_SANDBOX_PROVIDER / your sandbox preference).");return}throw Error(`watch handshake failed: ${$.status} ${$.statusText}`)}c=0;for await(let h of R4u($.body)){if(f.aborted)return;try{E(h)}catch(v){console.warn(`[lifecycle-watcher] ${l} onEvent threw: ${v instanceof Error?v.message:String(v)}`)}}}catch($){if(f.aborted)return;let h=$ instanceof Error?$.message:String($);console.warn(`[lifecycle-watcher] ${l} watch ended: ${h}`)}if(f.aborted)return;let w=hE(5000,250,c,2,0);c+=1,await y0(w,{signal:f}).catch(()=>{})}}var yzf="studio.decocms.com/sandbox-handle",Pzf="sandbox",Izf=300000;var JI0=O(()=>{O4();$o();Mgi()});async function KI0(i,u,t){let f=new Map;for(let l of i){let E=u(l);if(!E)continue;let c=f.get(E);if(c)c.push(l);else f.set(E,[l])}await Promise.allSettled([...f.values()].map(async(l)=>{for(let E of l)await t(E).catch(()=>{})}))}import{createHash as Xzf,randomBytes as Jzf,randomUUID as Kzf}from"crypto";import*as LI0 from"net";import{PassThrough as Yzf}from"stream";function Wzf(i){if(i instanceof Error)return i.message;if(i&&typeof i==="object"){let u=i;if(u.error instanceof Error)return u.error.message;if(typeof u.message==="string"&&u.message)return u.message}return String(i)}class e4u{kind=Xc;records=new Map;inflight=new g5i;stateStore;previewUrlPattern;kubeConfig;portForward;namespace;sandboxTemplateName;envName;tokenGenerator;idleTtlMs;metrics;previewGateway;sentinelToken;mintCloneUrl;closed=!1;claimWatchAbort=new AbortController;constructor(i={}){this.stateStore=i.stateStore??null,this.previewUrlPattern=i.previewUrlPattern??null,this.kubeConfig=i.kubeConfig??Vzf(),this.portForward=new g4u(this.kubeConfig),this.namespace=i.namespace??Szf,this.sandboxTemplateName=i.sandboxTemplateName??Lzf,this.envName=szf(i.envName),this.tokenGenerator=i.tokenGenerator??(()=>Jzf(Hzf).toString("hex")),this.idleTtlMs=i.idleTtlMs??nzf,this.metrics=i.meter?qzf(i.meter):null,this.previewGateway=i.previewGateway&&i.previewUrlPattern?{...i.previewGateway}:null;let u=i.sentinelToken?.trim()??"";this.sentinelToken=u.length>0?u:null,this.mintCloneUrl=i.mintCloneUrl,this.startClaimReaper(),this.startCredentialRefresher()}startClaimReaper(){let i=["app.kubernetes.io/managed-by=studio","app.kubernetes.io/name=studio-sandbox",...this.envName?[`${zh.env}=${this.envName}`]:[]].join(",");XI0({kc:this.kubeConfig,namespace:this.namespace,labelSelector:i,signal:this.claimWatchAbort.signal,onDelete:(u)=>this.invalidateRecord(u)})}async ensure(i,u={}){let t=gN(i,u.branch??u.repo?.branch??null);return this.inflight.run(t,()=>Ha(this.stateStore,i,Xc,(f)=>this.ensureLocked(i,t,u,f)))}async delete(i,u){if(u&&this.stateStore){await Ha(this.stateStore,u,Xc,(t)=>this.deleteLocked(i,u,t));return}await this.deleteLocked(i,u,this.stateStore)}async deleteLocked(i,u,t){let f=this.records.get(i)??null;if(this.records.delete(i),f)this.closeForwarder(f.daemonForward),this.metrics?.active.add(-1,r4u(f.tenant));if(await this.deleteHttpRouteIfManaged(i).catch((l)=>{console.warn(`[${i6}] HTTPRoute delete failed for ${i}: ${l instanceof Error?l.message:String(l)}`)}),await JN(this.kubeConfig,this.namespace,i),t)if(u)await t.delete(u,Xc);else if(f)await t.delete(f.id,Xc);else await t.deleteByHandle(Xc,i)}async alive(i){return await n2(this.kubeConfig,this.namespace,i)!==void 0}watchClaimLifecycle(i,u){return jI0({kc:this.kubeConfig,namespace:this.namespace,claimName:i,signal:u})}async getPreviewUrl(i){let u=await this.getRecord(i);if(!u)return null;return this.composePreviewUrl(u)}async proxyDaemonRequest(i,u,t){let f=await this.getRecord(i);if(!f&&this.previewUrlPattern&&this.stateStore){let $=await this.stateStore.getByHandle(Xc,i),h=$?.state,v=h?.token;if($&&v){let D=`http://${h?.adoptedSandboxName??i}.${this.namespace}.svc.cluster.local:${KN}`;try{let _=await HM(D,v,u,t);if(_.status!==404)return _;try{await _.body?.cancel()}catch{}}catch{}}}if(!f)f=await this.resurrectByHandle(i);if(!f)return new Response(JSON.stringify({error:"sandbox not found"}),{status:404,headers:{"content-type":"application/json"}});let l=f,E=performance.now(),c=0,w=!(t.body instanceof ReadableStream);try{let $=await HM(f.daemonUrl,f.token,u,t);if($.status===401&&w){this.invalidateRecord(i);let h=await this.getRecord(i).catch(()=>null)??await this.resurrectByHandle(i).catch(()=>null);if(h)l=h,$=await HM(h.daemonUrl,h.token,u,t)}return c=$.status,$}catch($){if(!w)throw $;this.invalidateRecord(i);let h=await this.resurrectByHandle(i)??await this.getRecord(i).catch(()=>null);if(!h)throw $;l=h;let v=await HM(h.daemonUrl,h.token,u,t);return c=v.status,v}finally{this.recordProxyDuration("daemon",c,l,performance.now()-E)}}async adoptLiveClaim(i,u){if(this.records.has(u))return!0;let t=await n2(this.kubeConfig,this.namespace,u).catch(()=>{return});if(!t||t.metadata?.deletionTimestamp)return!1;return await this.inflight.run(u,async()=>{let l=this.records.get(u);if(l)return this.toSandbox(l);let E=await this.adopt(i,u,t);if(!E)throw Error(`cannot adopt live claim ${u}`);return Ha(this.stateStore,i,Xc,(c)=>this.finish(E,c,!0,!0,"adopt"))}).catch(()=>null)!=null}async resolvePreviewUpstreamUrl(i){if(this.previewUrlPattern)return`http://${await this.resolveServiceNameForHandle(i)}.${this.namespace}.svc.cluster.local:${KN}`;let u=await this.getRecord(i);if(u)return u.daemonUrl;let t=await this.resurrectByHandle(i);return t?t.daemonUrl:null}async resolveServiceNameForHandle(i){let u=this.records.get(i);if(u)return u.adoptedSandboxName;if(this.stateStore){let f=(await this.stateStore.getByHandle(Xc,i).catch(()=>null))?.state?.adoptedSandboxName;if(f)return f}return i}async proxyPreviewRequest(i,u){let t=performance.now(),f=this.records.get(i)??null,l=0;try{let E=await this.resolvePreviewUpstreamUrl(i);if(!E){l=404;let N=q4u(404,{error:"sandbox not found"});return N.headers.set(LK,"1"),N}let c=new URL(u.url);if((c.pathname==="/_sandbox"||c.pathname.startsWith("/_sandbox/")||c.pathname==="/_decopilot_vm"||c.pathname.startsWith("/_decopilot_vm/"))&&u.method!=="GET")return l=404,q4u(404,{error:"not found"});let $=(N)=>`${N}${c.pathname}${c.search}`,h=new Headers(u.headers);for(let N of Czf)h.delete(N);let v=u.method!=="GET"&&u.method!=="HEAD",d={method:u.method,headers:h,body:v?u.body:void 0,redirect:"manual",signal:u.signal,duplex:v?"half":void 0},D;try{D=await fetch($(E),d)}catch(N){let Z=`${E}${c.pathname}`;if(console.warn(`[${i6}] preview fetch to ${Z} failed: ${N instanceof Error?N.message:String(N)}`),u.method==="GET"||u.method==="HEAD"){if(this.invalidateRecord(i),await this.resurrectByHandle(i).catch(()=>null)){let g=await this.resolvePreviewUpstreamUrl(i);if(g)try{D=await fetch($(g),d);let T=new Headers;for(let[U,A]of D.headers.entries())if(!YI0.includes(U.toLowerCase()))T.set(U,A);return l=D.status,new Response(D.body,{status:D.status,statusText:D.statusText,headers:T})}catch(T){console.warn(`[${i6}] preview fetch retry to ${Z} failed: ${T instanceof Error?T.message:String(T)}`)}}}else this.invalidateRecord(i);l=502;let B=q4u(502,{error:"sandbox daemon unreachable"});return B.headers.set(LK,"1"),B}let _=new Headers;for(let[N,Z]of D.headers.entries())if(!YI0.includes(N.toLowerCase()))_.set(N,Z);return l=D.status,new Response(D.body,{status:D.status,statusText:D.statusText,headers:_})}finally{this.recordProxyDuration("preview",l,f,performance.now()-t,i)}}async ensureLocked(i,u,t,f){if(t.image)console.warn(`[${i6}] opts.image ignored (template ${this.sandboxTemplateName} pins image): got ${t.image}`);if(f){let c=await f.get(i,Xc);if(c){let w=await this.rehydrate(i,u,c);if(w)return await this.refreshDaemonGitCredential(w,t),this.finish(w,f,!1,!0,"resume");await f.delete(i,Xc)}}let l=await n2(this.kubeConfig,this.namespace,u).catch(()=>{return});if(l)if(l.metadata?.deletionTimestamp)await ngi(this.kubeConfig,this.namespace,u).catch((c)=>{console.warn(`[${i6}] wait for terminating claim ${u} failed: ${c instanceof Error?c.message:String(c)}`)});else{let c=await this.adopt(i,u,l).catch((w)=>{return console.warn(`[${i6}] adopt ${u} failed, recreating: ${w instanceof Error?w.message:String(w)}`),null});if(c)return await this.refreshDaemonGitCredential(c,t),this.finish(c,f,!0,!0,"adopt");await JN(this.kubeConfig,this.namespace,u).catch(()=>{}),await ngi(this.kubeConfig,this.namespace,u).catch((w)=>{console.warn(`[${i6}] wait for deleted claim ${u} failed: ${w instanceof Error?w.message:String(w)}`)})}let E=await this.provision(i,u,t);return this.finish(E,f,!0,!1,"fresh")}async finish(i,u,t,f,l){let E=this.records.get(i.handle),c=E!==void 0;if(E&&E.daemonForward!==i.daemonForward)this.closeForwarder(E.daemonForward);if(this.records.set(i.handle,i),t)await this.persist(u,i);if(f)await gI0(this.kubeConfig,this.namespace,i.handle,this.computeShutdownTime()).catch((w)=>console.warn(`[${i6}] TTL refresh failed for ${i.handle}: ${w instanceof Error?w.message:String(w)}`));if(this.metrics){let w=r4u(i.tenant);if(this.metrics.ensureOutcome.add(1,{...w,outcome:l}),!c)this.metrics.active.add(1,w)}return this.toSandbox(i)}buildEnvMap(i,u){let t={},f=[];for(let[l,E]of Object.entries(i.env??{}))if(zzf.has(l))f.push(l);else t[l]=E;if(f.length>0)console.warn(`[${i6}] opts.env keys overlap reserved bootstrap names and were dropped: ${f.join(",")}`);return{...t,DAEMON_TOKEN:u.token,DAEMON_BOOT_ID:u.daemonBootId,APP_ROOT:u.workdir,PROXY_PORT:String(KN)}}buildClaim(i,u,t){let f=this.sentinelToken!==null,l=f?[]:Object.entries(this.buildEnvMap(u,t)).sort(([w],[$])=>w<$?-1:w>$?1:0).map(([w,$])=>({name:w,value:$})),E=unf(u),c=Object.keys(E).length>0;return{apiVersion:`${Wl.CLAIM_API_GROUP}/${Wl.CLAIM_API_VERSION}`,kind:"SandboxClaim",metadata:{name:i,namespace:this.namespace,labels:{"app.kubernetes.io/name":"studio-sandbox","app.kubernetes.io/managed-by":"studio",...this.envName?{[zh.env]:this.envName}:{},...V4u(u.tenant)},...c?{annotations:E}:{}},spec:{sandboxTemplateRef:{name:this.sandboxTemplateName},additionalPodMetadata:{labels:V4u(u.tenant,{[zh.role]:"claimed",[zh.sandboxHandle]:i,...this.envName?{[zh.env]:this.envName}:{}}),...c?{annotations:E}:{}},env:l,warmpool:f?"default":"none",lifecycle:{shutdownPolicy:"Delete",shutdownTime:this.computeShutdownTime()}}}}async provision(i,u,t){let f=this.tokenGenerator(),l=Kzf(),E=M4u,c=this.buildClaim(u,t,{token:f,daemonBootId:l,workdir:E});try{await vo(this.kubeConfig,this.namespace,c)}catch(D){if(D instanceof wo)await ngi(this.kubeConfig,this.namespace,u),await vo(this.kubeConfig,this.namespace,c);else throw D}let w;try{w=await TI0(this.kubeConfig,this.namespace,u),await Cgi(this.kubeConfig,this.namespace,w)}catch(D){throw await JN(this.kubeConfig,this.namespace,u).catch(()=>{}),D}try{await this.ensureServicePortForAdoptedSandbox(w),await this.ensureHttpRouteForHandle(u,w,t.tenant??null)}catch(D){throw await JN(this.kubeConfig,this.namespace,u).catch(()=>{}),D}let $=await this.openForwarder(w,KN,u),h=`http://127.0.0.1:${$.localPort}`,v=this.workloadConfigPayload(t),d=l;try{if(await ili(h),this.sentinelToken!==null){let D=await p1i(h);if(D)d=D.bootId;await Z_(h,this.sentinelToken,v??{},{rotateToken:f})}else if(v)await Z_(h,f,v);if(t.orgFsConfigJson)await pCu(h,f,t.orgFsConfigJson).catch((D)=>console.warn("[org-fs] sidecar config relay failed",D))}catch(D){throw this.closeForwarder($),await this.deleteHttpRouteIfManaged(u).catch(()=>{}),await JN(this.kubeConfig,this.namespace,u).catch(()=>{}),D}return{id:i,handle:u,adoptedSandboxName:w,token:f,workdir:E,daemonUrl:h,daemonForward:$,workload:t.workload??null,daemonBootId:d,tenant:t.tenant??null,ensureOpts:fnf(t)}}workloadConfigPayload(i){return Htu({runtime:i?.workload?.runtime??"node",packageManager:i?.workload?.packageManager?{name:i.workload.packageManager,...i.workload.packageManagerPath?{path:i.workload.packageManagerPath}:{}}:null,repo:i?.repo??null,port:i?.workload?.devPort??Qzf,tenant:i?.tenant??void 0})}async refreshDaemonGitCredential(i,u){let t=ztu(u);if(!t)return;try{await Z_(i.daemonUrl,i.token,t)}catch(f){console.warn(`[${i6}] git credential refresh failed for ${i.handle}: ${f instanceof Error?f.message:String(f)}`)}}async withFreshCloneUrl(i,u){if(!this.mintCloneUrl)return i;try{let t=await this.mintCloneUrl(i,u!==void 0?{bufferMs:u}:void 0);return t?{...i,cloneUrl:t}:i}catch(t){return console.warn(`[${i6}] clone credential re-mint failed: ${t instanceof Error?t.message:String(t)}`),i}}startCredentialRefresher(){if(!this.mintCloneUrl)return;let{signal:i}=this.claimWatchAbort;(async()=>{while(!i.aborted){if(await y0(Rzf,{signal:i}).catch(()=>{}),i.aborted)break;try{await this.refreshAllGitCredentials()}catch(u){console.warn(`[${i6}] periodic credential refresh failed: ${u instanceof Error?u.message:String(u)}`)}}})()}async refreshAllGitCredentials(){await KI0(this.records.values(),(i)=>i.ensureOpts?.repo?.connectionId,async(i)=>{if(this.claimWatchAbort.signal.aborted)return;let u=i.ensureOpts?.repo;if(!u)return;let t=await this.withFreshCloneUrl(u,bzf);await this.refreshDaemonGitCredential(i,{...i.ensureOpts,repo:t}),i.ensureOpts={...i.ensureOpts,repo:t}})}async rebootstrapDaemon(i,u,t){if(this.sentinelToken===null)return!1;let f=this.workloadConfigPayload(t)??{};try{return await Z_(i,this.sentinelToken,f,{rotateToken:u}),!0}catch(l){if(l instanceof s1i&&l.status===401)try{return await Z_(i,u,f,{rotateToken:u}),!0}catch(E){return console.warn(`[${i6}] re-bootstrap retry with claim token failed: ${E instanceof Error?E.message:String(E)}`),!1}return console.warn(`[${i6}] re-bootstrap failed: ${l instanceof Error?l.message:String(l)}`),!1}}async ensureServicePortForAdoptedSandbox(i){if(!this.previewGateway||!this.previewUrlPattern)return;await GI0(this.kubeConfig,this.namespace,i,{name:"daemon",port:KN,targetPort:KN})}async ensureHttpRouteForHandle(i,u,t){if(!this.previewGateway||!this.previewUrlPattern)return;let f=lnf(this.previewUrlPattern,i);if(!f)throw new pl(`Unable to derive preview hostname for ${i} from pattern: ${this.previewUrlPattern}`);let l={apiVersion:`${Do.API_GROUP}/${Do.API_VERSION}`,kind:"HTTPRoute",metadata:{name:i,namespace:this.namespace,labels:V4u(t??void 0,{[zh.role]:"claimed",[zh.sandboxHandle]:i,"app.kubernetes.io/name":"studio-sandbox","app.kubernetes.io/managed-by":"studio",...this.envName?{[zh.env]:this.envName}:{}})},spec:{parentRefs:[{kind:"Gateway",group:"gateway.networking.k8s.io",name:this.previewGateway.name,namespace:this.previewGateway.namespace}],hostnames:[f],rules:[{backendRefs:[{group:"",kind:"Service",name:u,port:KN}]}]}};await Rgi(this.kubeConfig,this.namespace,l)}async deleteHttpRouteIfManaged(i){if(!this.previewGateway)return;await bgi(this.kubeConfig,this.namespace,i)}async rehydrate(i,u,t){let f=t.state;if(!f.adoptedSandboxName&&!f.podName||!f.token)return null;let l=await n2(this.kubeConfig,this.namespace,u).catch(()=>{return});if(!l||!WI0(l))return null;let E=l.status?.sandbox?.name??f.adoptedSandboxName??f.podName??u,c=await this.openAndProbeDaemon(E,u);if(!c)return null;if(f.daemonBootId&&f.daemonBootId!==c.bootId){if(this.sentinelToken!==null){let w=f.ensureOpts?.repo?{...f.ensureOpts,repo:await this.withFreshCloneUrl(f.ensureOpts.repo)}:f.ensureOpts??null;if(!await this.rebootstrapDaemon(c.daemonUrl,f.token,w))return this.closeForwarder(c.daemonForward),null}else console.warn(`[${i6}] daemon restart detected (handle=${u}): stored bootId=${f.daemonBootId} live bootId=${c.bootId}`);await this.stateStore?.put(i,Xc,{handle:u,state:{...f,daemonBootId:c.bootId}}).catch((w)=>console.warn(`[${i6}] bootId persist failed for ${u}: ${w instanceof Error?w.message:String(w)}`))}return{id:i,handle:u,adoptedSandboxName:E,token:f.token,workdir:f.workdir??M4u,daemonUrl:c.daemonUrl,daemonForward:c.daemonForward,workload:f.workload??null,daemonBootId:c.bootId,tenant:f.tenant??null,ensureOpts:f.ensureOpts??null}}async adopt(i,u,t){if(!WI0(t))return null;let f=t.status?.sandbox?.name??u;if(this.sentinelToken!==null)return null;let l=rzf(t);if(!l)return null;let E=await this.openAndProbeDaemon(f,u);if(!E)return null;let c=tnf(t);if(this.previewGateway)await this.ensureServicePortForAdoptedSandbox(f).catch((w)=>{console.warn(`[${i6}] Service port backfill failed for ${u}: ${w instanceof Error?w.message:String(w)}`)}),await this.ensureHttpRouteForHandle(u,f,c).catch((w)=>{console.warn(`[${i6}] HTTPRoute backfill failed for ${u}: ${w instanceof Error?w.message:String(w)}`)});return{id:i,handle:u,adoptedSandboxName:f,token:l,workdir:M4u,daemonUrl:E.daemonUrl,daemonForward:E.daemonForward,workload:null,daemonBootId:E.bootId,tenant:c,ensureOpts:null}}async openAndProbeDaemon(i,u){let t=await this.openForwarder(i,KN,u).catch(()=>null);if(!t)return null;let f=`http://127.0.0.1:${t.localPort}`,l=await p1i(f);if(!l)return this.closeForwarder(t),null;return{daemonForward:t,daemonUrl:f,bootId:l.bootId}}async getRecord(i){let u=this.records.get(i);if(u)return u;if(!this.stateStore)return null;let t=await this.stateStore.getByHandle(Xc,i);if(!t)return null;let f=await this.rehydrate(t.id,i,t);if(f)this.records.set(i,f);return f}async resurrectByHandle(i){if(!this.stateStore)return null;let u=await this.stateStore.getByHandle(Xc,i);if(!u)return null;let t=u.state.ensureOpts;if(!t)return null;let f=t.repo?{...t,repo:await this.withFreshCloneUrl(t.repo)}:t;return await this.ensure(u.id,f),this.records.get(i)??null}invalidateRecord(i){let u=this.records.get(i);if(!u)return;this.records.delete(i),this.closeForwarder(u.daemonForward)}recordProxyDuration(i,u,t,f,l){if(!this.metrics)return;this.metrics.proxyDurationMs.record(f,{...r4u(t?.tenant??null),source:i,sandbox_handle:t?.handle??l??"",status_code:u||0})}composePreviewUrl(i){if(this.previewUrlPattern)return T5i(this.previewUrlPattern,i.handle);return`http://127.0.0.1:${i.daemonForward.localPort}/`}toSandbox(i){return{handle:i.handle,workdir:i.workdir,previewUrl:this.composePreviewUrl(i)}}async persist(i,u){if(!i)return;let t={adoptedSandboxName:u.adoptedSandboxName,token:u.token,workdir:u.workdir,workload:u.workload,daemonBootId:u.daemonBootId,tenant:u.tenant,...u.ensureOpts?{ensureOpts:u.ensureOpts}:{}};await i.put(u.id,Xc,{handle:u.handle,state:t})}computeShutdownTime(){return new Date(Date.now()+this.idleTtlMs).toISOString()}openForwarder(i,u,t=i){let f=mzf(t,u);return new Promise((l,E)=>{let c=(w,$)=>{let h=LI0.createServer((v)=>this.handleForwardedConnection(v,i,u,t));h.once("error",(v)=>{if(v.code==="EADDRINUSE"&&$<Mzf){try{h.close()}catch{}let d=m4u+(w-m4u+1)%QI0;c(d,$+1);return}E(v)}),h.listen(w,"127.0.0.1",()=>{let v=h.address();if(!v||typeof v==="string"){h.close(),E(Error("port-forward listener failed to bind"));return}l({server:h,localPort:v.port})})};c(f,0)})}handleForwardedConnection(i,u,t,f){let l=new Yzf,E=null,c=!1,w=()=>{if(c)return;if(c=!0,l.destroy(),E)try{E.close()}catch{}if(!i.destroyed)i.destroy()};i.pipe(l),i.on("error",w),i.on("close",w),this.portForward.portForward(this.namespace,u,[t],i,null,l).then(($)=>{let h=typeof $==="function"?$():$;if(!h){w();return}if(E=h,E.on("close",w),E.on("error",()=>{this.invalidateRecord(f),w()}),c)try{E.close()}catch{}}).catch(($)=>{console.warn(`[${i6}] port-forward to ${u}:${t} failed: ${Wzf($)}`),this.invalidateRecord(f),w()})}closeForwarder(i){i.server.close((u)=>{if(u)console.warn(`[${i6}] port-forward close on :${i.localPort} errored: ${u instanceof Error?u.message:String(u)}`)})}close(){if(this.closed)return;this.closed=!0,this.claimWatchAbort.abort();for(let i of this.records.values())this.closeForwarder(i.daemonForward);this.records.clear()}}function qzf(i){return{active:i.createUpDownCounter("studio.sandbox.active",{description:"Active sandbox count, by runner kind and owning org. Cross-checks the cAdvisor-derived count from the cluster \u2014 divergence between the two indicates orphaned claims (studio deleted but K8s didn't reap) or unattributed pods.",unit:"{sandbox}"}),ensureOutcome:i.createCounter("studio.sandbox.ensure.outcome",{description:"Outcome of each ensure() call: fresh provision, resume from state-store after restart, or adopt of a cluster-side claim studio didn't know about. Cold-start ratio is the primary input for warm-pool sizing.",unit:"{call}"}),proxyDurationMs:i.createHistogram("studio.sandbox.proxy.duration_ms",{description:"Wall-clock latency of studio-mediated requests to the sandbox daemon: tool exec proxies (source=daemon) and preview iframe traffic (source=preview).",unit:"ms"})}}function Vzf(){let i=new ez;return i.loadFromDefault(),i}function WI0(i){return Boolean(i.status?.conditions?.some((u)=>u.type==="Ready"&&u.status==="True"))}function rzf(i){let u=i.spec?.env;if(!u)return null;for(let t of u)if(t.name==="DAEMON_TOKEN"&&t.value)return t.value;return null}function mzf(i,u){let t=Xzf("sha256").update(`${i}:${u}`).digest();return m4u+t.readUInt32BE(0)%QI0}function q4u(i,u){return new Response(JSON.stringify(u),{status:i,headers:{"content-type":"application/json","access-control-allow-origin":"*"}})}function SI0(i){let u=i.slice(0,azf);return ezf.test(u)?u:""}function szf(i){if(i===void 0)return null;let u=i.trim();if(u==="")return null;if(!ozf.test(u))throw Error(`AgentSandboxProvider: envName=${JSON.stringify(u)} is not a valid DNS-label-safe environment name (lowercase alphanumeric or '-', starts with a letter, ends alphanumeric, \u226432 chars). Studio sets this from STUDIO_ENV; check the studio chart's configMap.`);return u}function V4u(i,u={}){let t={...u};if(i){let f=SI0(i.orgId),l=i.userId?SI0(i.userId):"";if(f)t[zh.orgId]=f;if(l)t[zh.userId]=l}return t}function SK(i){let u="";for(let t of i){let f=t.codePointAt(0)??0;u+=f<32||f===127?" ":t}return u.slice(0,pzf)}function inf(i){try{let u=new URL(i);return u.username="",u.password="",u.toString()}catch{return""}}function unf(i){let u={},t=i.tenant;if(t?.orgSlug)u[Iv.orgSlug]=SK(t.orgSlug);if(t?.orgName)u[Iv.orgName]=SK(t.orgName);if(t?.userEmail)u[Iv.userEmail]=SK(t.userEmail);if(t?.userName)u[Iv.userName]=SK(t.userName);let f=i.repo;if(f){if(f.displayName)u[Iv.gitRepo]=SK(f.displayName);let l=inf(f.cloneUrl);if(l)u[Iv.gitRepoUrl]=SK(l);let E=i.branch??f.branch;if(E)u[Iv.gitBranch]=SK(E)}return u}function tnf(i){let u=i.metadata?.labels;if(!u)return null;let t=u[zh.orgId],f=u[zh.userId];if(!t)return null;let l=i.metadata?.annotations??{};return{orgId:t,...f?{userId:f}:{},orgSlug:l[Iv.orgSlug],orgName:l[Iv.orgName],userEmail:l[Iv.userEmail],userName:l[Iv.userName]}}function r4u(i){return{org_id:i?.orgId??"",user_id:i?.userId??"",runner_kind:Xc}}function fnf(i){let u={};if(i.repo)u.repo=i.repo;if(i.workload)u.workload=i.workload;if(i.env&&Object.keys(i.env).length>0)u.env=i.env;if(i.tenant)u.tenant=i.tenant;return Object.keys(u).length>0?u:null}function lnf(i,u){try{return new URL(T5i(i,u)).hostname||null}catch{return null}}var Xc="agent-sandbox",i6="AgentSandboxProvider",LK="x-sandbox-preview-not-ready",Szf="agent-sandbox-system",Lzf="studio-sandbox",KN=9000,Qzf=3000,M4u="/app",Hzf=32,zzf,nzf=900000,Rzf=900000,bzf=1800000,Czf,YI0,m4u=40000,QI0=1e4,Mzf=256,zh,Iv,ezf,azf=63,ozf,pzf=253;var HI0=O(()=>{O4();S4u();fni();U5i();Mgi();$o();JI0();zzf=new Set(["DAEMON_TOKEN","DAEMON_BOOT_ID","APP_ROOT","PROXY_PORT"]),Czf=["cookie","host","connection","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","accept-encoding","content-length","upgrade"],YI0=["connection","keep-alive","transfer-encoding","content-encoding","content-length"];zh={role:"studio.decocms.com/role",sandboxHandle:"studio.decocms.com/sandbox-handle",orgId:"studio.decocms.com/org-id",userId:"studio.decocms.com/user-id",env:"studio.decocms.com/env"},Iv={orgSlug:"studio.decocms.com/org-slug",orgName:"studio.decocms.com/org-name",userEmail:"studio.decocms.com/user-email",userName:"studio.decocms.com/user-name",gitRepo:"studio.decocms.com/git-repo",gitRepoUrl:"studio.decocms.com/git-repo-url",gitBranch:"studio.decocms.com/git-branch"},ezf=/^([A-Za-z0-9]([-A-Za-z0-9_.]*[A-Za-z0-9])?)?$/;ozf=/^[a-z]([a-z0-9-]{0,30}[a-z0-9])?$/});var zI0={};ji(zI0,{waitForSandboxReady:()=>Cgi,getSandboxClaim:()=>n2,getHttpRoute:()=>PI0,deleteSandboxClaim:()=>JN,deleteHttpRoute:()=>bgi,createSandboxClaim:()=>vo,applyHttpRoute:()=>Rgi,SandboxTimeoutError:()=>YK,SandboxError:()=>pl,PREVIEW_NOT_READY_HEADER:()=>LK,KubeConfig:()=>ez,K8S_CONSTANTS:()=>Wl,HTTPROUTE_CONSTANTS:()=>Do,AgentSandboxProvider:()=>e4u});var a4u=O(()=>{S4u();$o();Mgi();HI0()});class Vgi{kind=YN;userSub;dispatch;stateStore;records=new Map;constructor(i){if(!i.userSub)throw Error("DesktopSandboxProvider requires userSub");if(!i.dispatch)throw Error("DesktopSandboxProvider requires dispatch");this.userSub=i.userSub,this.dispatch=i.dispatch,this.stateStore=i.stateStore??null}async ensure(i,u={}){let t=u.branch??u.repo?.branch,f=gN(i,t),l=this.records.get(f);if(l){if(await this.probeHealth(f))return this.toSandbox(l);if(this.records.delete(f),this.stateStore)await this.stateStore.deleteByHandle(YN,f).catch(()=>{})}else if(this.stateStore){let D=(await this.stateStore.getByHandle(YN,f))?.state,_=D?.sandboxApiUrl;if(_){if(await this.probeHealth(f)){let N={handle:f,sandboxApiUrl:_,previewUrl:D?.previewUrl??_};return this.records.set(f,N),this.toSandbox(N)}await this.stateStore.deleteByHandle(YN,f).catch(()=>{})}}let E=T5({userName:u.tenant?.userName,userEmail:u.tenant?.userEmail}),c=JSON.stringify({handle:f,repo:u.repo,branch:t,...u.workload?{workload:u.workload}:{},...E?{operator:E}:{},...u.offloadAllowedHosts?{offloadAllowedHosts:u.offloadAllowedHosts}:{},...u.offloadAllowSameHostDev!==void 0?{offloadAllowSameHostDev:u.offloadAllowSameHostDev}:{},...u.orgFsConfigJson?{orgFsConfigJson:u.orgFsConfigJson}:{}}),w=await this.dispatchJson("POST","/api/sandboxes",c),$=JSON.parse(w);if(typeof $.sandboxApiUrl!=="string")throw Error("desktop ensure: daemon did not return a sandboxApiUrl string");let h=typeof $.previewUrl==="string"?$.previewUrl:$.sandboxApiUrl,v={handle:f,sandboxApiUrl:$.sandboxApiUrl,previewUrl:h};if(this.records.set(f,v),this.stateStore)await this.stateStore.put(i,YN,{handle:f,state:{handle:f,sandboxApiUrl:$.sandboxApiUrl,previewUrl:h}});return this.toSandbox(v)}async proxyDaemonRequest(i,u,t){let f=u.startsWith("/")?u:`/${u}`,l=f.startsWith("/_sandbox/")?f.slice(9):f,E=`/_sandbox/${encodeURIComponent(i)}${l}`,c=new Headers(t.headers);for(let F of["host","cookie","connection","keep-alive","transfer-encoding","upgrade","authorization"])c.delete(F);let w={};c.forEach((F,g)=>{w[g]=F});let $;if(t.body!=null)$=await cnf(t.body);let v=this.dispatch(this.userSub,{method:t.method,path:E,headers:w,body:$},{signal:t.signal})[Symbol.asyncIterator](),d=Enf(),D=200,_={"content-type":"application/octet-stream"},N=[];try{while(!0){let F=await v.next();if(F.done)break;let g=F.value;if(g.headers){D=g.headers.status,_=g.headers.headers;break}if(g.data!=null){let T=d.push(g.data);if(T.length)N.push(T)}}}catch(F){let g=F instanceof Error?F.message:"dispatch error";return new Response(JSON.stringify({error:g}),{status:502,headers:{"content-type":"application/json"}})}let Z=!1,B=new ReadableStream({async start(F){for(let g of N)F.enqueue(g)},async pull(F){try{while(!0){let g=await v.next();if(Z)return;if(g.done){let U=d.flush();if(U.length)F.enqueue(U);F.close();return}let T=g.value;if(T.data!=null){let U=d.push(T.data);if(U.length){F.enqueue(U);return}}}}catch(g){if(!Z)F.error(g)}},cancel(){Z=!0,v.return?.()}});return new Response(B,{status:D,headers:_})}async alive(i){return this.probeHealth(i)}async probeHealth(i){let u=new AbortController,t=setTimeout(()=>u.abort(),3000);try{return await this.dispatchJson("GET",`/api/sandboxes/${encodeURIComponent(i)}`,void 0,u.signal),!0}catch{return!1}finally{clearTimeout(t)}}async forgetHandle(i){if(this.records.delete(i),this.stateStore)await this.stateStore.deleteByHandle(YN,i).catch(()=>{})}async delete(i){if(this.records.delete(i),this.stateStore)await this.stateStore.deleteByHandle(YN,i).catch(()=>{});try{await this.dispatchJson("DELETE",`/api/sandboxes/${encodeURIComponent(i)}`)}catch(u){if(!(u instanceof Error?u.message:String(u)).includes("404"))throw u}}async getPreviewUrl(i){return(await this.resolveRecord(i))?.previewUrl??null}async localWorkdir(i){return null}async*watchClaimLifecycle(i,u){yield{kind:"ready"}}toSandbox(i){return{handle:i.handle,workdir:i.sandboxApiUrl,previewUrl:i.previewUrl}}async resolveRecord(i){let u=this.records.get(i);if(u)return u;if(!this.stateStore)return null;let f=(await this.stateStore.getByHandle(YN,i))?.state,l=f?.sandboxApiUrl;if(!l)return null;let E={handle:i,sandboxApiUrl:l,previewUrl:f?.previewUrl??l};return this.records.set(i,E),E}async dispatchJson(i,u,t,f){let l={accept:"application/json"};if(t!==void 0)l["content-type"]="application/json";let E=this.dispatch(this.userSub,{method:i,path:u,headers:l,body:t},{signal:f}),c=null,w="";for await(let h of E)if(h.headers)c=h.headers.status;else if(h.data!=null)w+=h.data;let $=Buffer.from(w,"base64").toString("utf8");if(c!=null&&(c<200||c>=300))throw Error(`daemon returned ${c}: ${$}`);return $}}function nI0(i){return new Vgi(i)}function Enf(){let i="";return{push(u){if(u.length===0)return o4u;i+=u;let t=i.length-i.length%4;if(t===0)return o4u;let f=i.slice(0,t);return i=i.slice(t),new Uint8Array(Buffer.from(f,"base64"))},flush(){if(i.length===0)return o4u;let u=i;return i="",new Uint8Array(Buffer.from(u,"base64"))}}}async function cnf(i){if(typeof i==="string")return i;if(i instanceof ArrayBuffer)return Buffer.from(i).toString("utf8");if(ArrayBuffer.isView(i))return Buffer.from(i.buffer,i.byteOffset,i.byteLength).toString("utf8");if(i instanceof URLSearchParams)return i.toString();return await new Response(i).text()}var YN="user-desktop",o4u;var RI0=O(()=>{U5i();o1i();o4u=new Uint8Array(0)});var bI0={};ji(bI0,{createDesktopProvider:()=>nI0,DesktopSandboxProvider:()=>Vgi});var CI0=O(()=>{RI0()});var eI0={};ji(eI0,{subscribeLifecycle:()=>p4u,getSandboxProviderByKind:()=>_o,getOrInitSharedRunner:()=>Nnf,buildDesktopProvider:()=>rgi,__resetSharedLifecyclesForTesting:()=>gnf});function rI0(i,u){let t=MI0[i];if(t)return Promise.resolve(t);let f=s4u[i];if(f)return f;let l=u().then((E)=>{return MI0[i]=E,E}).finally(()=>{delete s4u[i]});return s4u[i]=l,l}function hnf(){let i=process.env.STUDIO_SANDBOX_PREVIEW_URL_PATTERN;return i&&i.trim()!==""?i:void 0}function vnf(){let i=process.env.STUDIO_SANDBOX_TEMPLATE_NAME;return i&&i.trim()!==""?i:void 0}function dnf(){let i=process.env.STUDIO_ENV;return i&&i.trim()!==""?i:void 0}function Dnf(){let i=process.env.STUDIO_SANDBOX_SENTINEL_TOKEN;return i&&i.trim()!==""?i:void 0}function _nf(){let i=process.env.STUDIO_SANDBOX_PREVIEW_GATEWAY_NAME?.trim(),u=process.env.STUDIO_SANDBOX_PREVIEW_GATEWAY_NAMESPACE?.trim();if(!i&&!u)return;if(!i||!u)throw Error("STUDIO_SANDBOX_PREVIEW_GATEWAY_NAME and STUDIO_SANDBOX_PREVIEW_GATEWAY_NAMESPACE must both be set, or both unset. Half-configured per-claim HTTPRoute routing would silently fail to attach.");return{name:i,namespace:u}}async function mI0(i,u){let t=hnf();switch(i){case"agent-sandbox":{let f=new btu(u),{AgentSandboxProvider:l}=await Promise.resolve().then(() => (a4u(),zI0)),E=new u2(hu().encryptionKey);return new l({stateStore:f,previewUrlPattern:t,sandboxTemplateName:vnf(),envName:dnf(),previewGateway:_nf(),sentinelToken:Dnf(),meter:At,mintCloneUrl:async(c,w)=>{if(!c.connectionId)return null;let $=VF0(c.cloneUrl);if(!$)return null;let{cloneUrl:h}=await TN(c.connectionId,$.owner,$.name,u,E,{bufferMs:w?.bufferMs});return h}})}case"user-desktop":throw Error("user-desktop provider cannot be instantiated without a per-run link claim \u2014 call resolveSandboxProvider, which binds the link before constructing the provider.");default:throw Error(`Unknown sandbox provider kind: ${String(i)}`)}}async function rgi(i,u){let{DesktopSandboxProvider:t}=await Promise.resolve().then(() => (CI0(),bI0)),{getProxyDispatch:f}=await Promise.resolve().then(() => (u1u(),i1u)),l=new Rtu(i.db);if(!u)throw Error("buildDesktopProvider: userSub must be a non-empty string");let E=f();return new t({userSub:u,dispatch:E,stateStore:l})}function _o(i,u){return rI0(u,()=>mI0(u,i.db))}async function Nnf(){let i;try{i=cg()}catch(t){return console.warn("[lifecycle] cannot resolve sandbox runner:",t instanceof Error?t.message:String(t)),null}return await rI0(i,()=>mI0(i,m0().db))}function p4u(i,u,t){let f=WN.get(u);if(f){if(f.terminated){if(f.lastPhase)try{t(f.lastPhase)}catch{}return{unsubscribe:Bnf}}if(f.listeners.add(t),f.lastPhase)try{t(f.lastPhase)}catch{}return qI0(u,f,t)}let l=new AbortController,E={lastPhase:null,terminated:!1,listeners:new Set([t]),abort:l};return WN.set(u,E),Fnf(i,u,E),qI0(u,E,t)}function Bnf(){}function qI0(i,u,t){return{unsubscribe(){if(WN.get(i)!==u)return;if(u.listeners.delete(t),u.listeners.size===0)WN.delete(i),u.abort.abort()}}}async function Fnf(i,u,t){let f=null;try{for await(let l of i.watchClaimLifecycle(u,t.abort.signal)){if(t.abort.signal.aborted)break;t.lastPhase=l;let E=l.kind==="ready"||l.kind==="failed";if(E)t.terminated=!0;let c=Array.from(t.listeners);for(let w of c)try{w(l)}catch{}if(E)break}}catch(l){f=l}finally{if(!t.terminated&&!t.abort.signal.aborted&&t.listeners.size>0){let l={kind:"failed",reason:"unknown",message:f instanceof Error?f.message:"Lifecycle watcher ended unexpectedly"};t.lastPhase=l,t.terminated=!0;for(let E of Array.from(t.listeners))try{E(l)}catch{}}if(WN.get(u)===t)WN.delete(u)}}function gnf(){for(let i of WN.values())i.abort.abort();WN.clear()}var wnf,$nf,VI0,MI0,s4u,Onf,Znf,WN;var No=O(()=>{Qh();b6();X1();SF0();bF0();ba();kV();z0();wnf=Symbol.for("decocms.sandbox.lifecycle.runners"),$nf=Symbol.for("decocms.sandbox.lifecycle.inflight"),VI0=globalThis,MI0=VI0[wnf]??={},s4u=VI0[$nf]??={};Onf=Symbol.for("decocms.sandbox.lifecycle.shared-lifecycles"),Znf=globalThis,WN=Znf[Onf]??=new Map});function SN(i,u){return gN(i,u)}var Oo=O(()=>{Qh()});async function t1u(i,u){if(u.length===0)return;let t=await _o(i,"agent-sandbox");for(let f=0;f<u.length;f+=aI0){let l=u.slice(f,f+aI0);await Promise.all(l.map(async(E)=>{let c=Lh({orgId:E.organizationId,virtualMcpId:E.virtualMcpId,branch:E.branch}),w=v8(c),$={organizationId:E.organizationId,virtualMcpId:E.virtualMcpId,branch:E.branch},h=await i.storage.agentSandboxSessions.withLock($,(v)=>v.beginDelete($,E.lastStartedBy));if(!h)return;await t.delete(h.sandboxHandle??SN(w,E.branch),w),await i.storage.agentSandboxSessions.withLock($,(v)=>v.completeDelete($,h.generation))}))}}async function oI0(i,u,t){while(!0){let f=await i.storage.agentSandboxSessions.listByVirtualMcp(u,t,{limit:200});if(f.length===0)return;await t1u(i,f)}}var aI0=20;var f1u=O(()=>{Qh();No();Oo()});import{z as l1u}from"zod";var Tnf,Unf,E1u;var sI0=O(()=>{ON();Tv();fu();Ia();_9();f1u();Tnf=l1u.object({id:l1u.string().describe("ID of the virtual MCP to delete")}),Unf=l1u.object({item:$c.describe("The deleted virtual MCP entity")}),E1u=ui({name:"COLLECTION_VIRTUAL_MCP_DELETE",description:"Permanently delete a Virtual MCP and its virtual tools.",annotations:{title:"Delete Virtual MCP",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:Tnf,outputSchema:Unf,handler:async(i,u)=>{gi(u);let t=Oi(u);await u.access.check();let f=await u.storage.virtualMcps.findById(i.id);if(!f)throw Error(`Virtual MCP not found: ${i.id}`);if(f.organization_id!==t.id)throw Error(`Virtual MCP not found: ${i.id}`);if(await oI0(u,t.id,i.id),await u.storage.virtualMcps.delete(i.id),u.orgFs)await vtu(u.orgFs,i.id,Wu(u)??"system");let l=f.metadata?.githubRepo?.connectionId;if(l)try{let E=await u.storage.connections.findById(l,t.id);if(E&&Yh(E)){let w=await new r1(u.db,u.vault).get(l);if(w?.accessToken)try{await fetch("https://api.github.com/installation/token",{method:"DELETE",headers:{Authorization:`Bearer ${w.accessToken}`,Accept:"application/vnd.github+json","X-GitHub-Api-Version":"2022-11-28"},signal:AbortSignal.timeout(5000)})}catch{}await u.storage.connections.delete(l)}}catch(E){console.error("[VIRTUAL_MCP_DELETE] failed to tear down repo-scoped connection",{childConnectionId:l,error:E.message})}return{item:f}}})});import{z as Bw}from"zod";var Anf,c1u;var pI0=O(()=>{fu();Anf=Bw.object({id:Bw.string(),virtualMcpId:Bw.string(),pluginId:Bw.string(),connectionId:Bw.string().nullable(),settings:Bw.record(Bw.string(),Bw.unknown()).nullable(),createdAt:Bw.string(),updatedAt:Bw.string()}),c1u=ui({name:"VIRTUAL_MCP_PLUGIN_CONFIG_GET",description:"Get a plugin's current configuration for a specific virtual MCP.",annotations:{title:"Get Virtual MCP Plugin Config",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:Bw.object({virtualMcpId:Bw.string().describe("Virtual MCP ID"),pluginId:Bw.string().describe("Plugin ID")}),outputSchema:Bw.object({config:Anf.nullable()}),handler:async(i,u)=>{gi(u);let t=Oi(u);await u.access.check();let{virtualMcpId:f,pluginId:l}=i,E=await u.storage.connections.findById(f);if(!E||E.organization_id!==t.id)return{config:null};let c=await u.storage.virtualMcpPluginConfigs.get(f,l);if(!c)return{config:null};return{config:{id:c.id,virtualMcpId:c.virtualMcpId,pluginId:c.pluginId,connectionId:c.connectionId,settings:c.settings,createdAt:c.createdAt instanceof Date?c.createdAt.toISOString():c.createdAt,updatedAt:c.updatedAt instanceof Date?c.updatedAt.toISOString():c.updatedAt}}}})});import{z as fE}from"zod";var ynf,w1u;var iG0=O(()=>{fu();VL();Ml();ynf=fE.object({id:fE.string(),virtualMcpId:fE.string(),pluginId:fE.string(),connectionId:fE.string().nullable(),settings:fE.record(fE.string(),fE.unknown()).nullable(),createdAt:fE.string(),updatedAt:fE.string()}),w1u=ui({name:"VIRTUAL_MCP_PLUGIN_CONFIG_UPDATE",description:"Set or update a plugin's configuration for a specific virtual MCP.",annotations:{title:"Update Virtual MCP Plugin Config",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:fE.object({virtualMcpId:fE.string().describe("Virtual MCP ID"),pluginId:fE.string().describe("Plugin ID"),connectionId:fE.string().nullable().optional().describe("MCP connection to bind"),settings:fE.record(fE.string(),fE.unknown()).nullable().optional().describe("Plugin-specific settings")}),outputSchema:fE.object({config:ynf}),handler:async(i,u)=>{gi(u);let t=Oi(u);await u.access.check();let{virtualMcpId:f,pluginId:l,connectionId:E,settings:c}=i,w=Wu(u),$=await u.storage.connections.findById(f);if(!$)throw Error(`Connection not found: ${f}`);if($.organization_id!==t.id)throw Error(`Connection not found: ${f}`);let h=E?await u.storage.connections.findById(E):null;if(E&&h&&h.organization_id!==t.id)throw Error(`Connection not found: ${E}`);if(E&&$.organization_id&&!h&&b5()&&DEi(E,$.organization_id)){if(!w)throw Error("User ID required to create dev-assets connection");let d=qL($.organization_id,cl());await u.storage.connections.create({...d,organization_id:$.organization_id,created_by:w})}else if(E&&!h)throw Error(`Connection not found: ${E}`);let v=await u.storage.virtualMcpPluginConfigs.upsert(f,l,{connectionId:E,settings:c});return{config:{id:v.id,virtualMcpId:v.virtualMcpId,pluginId:v.pluginId,connectionId:v.connectionId,settings:v.settings,createdAt:v.createdAt instanceof Date?v.createdAt.toISOString():v.createdAt,updatedAt:v.updatedAt instanceof Date?v.updatedAt.toISOString():v.updatedAt}}}})});import{z as F3}from"zod";var Pnf,$1u;var uG0=O(()=>{fu();_9();Pnf=F3.object({connectionId:F3.string(),toolName:F3.string(),label:F3.string(),icon:F3.string().nullable().optional()}),$1u=ui({name:"VIRTUAL_MCP_PINNED_VIEWS_UPDATE",description:"Update the pinned sidebar views for a virtual MCP. Replaces all current pins.",annotations:{title:"Update Pinned Views",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:F3.object({virtualMcpId:F3.string().describe("Virtual MCP ID"),pinnedViews:F3.array(Pnf).describe("Pinned views to set for the virtual MCP sidebar"),layout:F3.object({defaultMainView:F3.object({type:F3.string(),id:F3.string().optional(),toolName:F3.string().optional()}).nullable().optional(),chatDefaultOpen:F3.boolean().nullable().optional()}).optional()}),outputSchema:F3.object({item:$c.nullable()}),handler:async(i,u)=>{gi(u);let t=Oi(u);await u.access.check();let{virtualMcpId:f,pinnedViews:l,layout:E}=i,c=Wu(u),w=await u.storage.virtualMcps.findById(f);if(!w)throw Error(`Virtual MCP not found: ${f}`);if(w.organization_id!==t.id)throw Error(`Virtual MCP not found: ${f}`);let $=w.metadata?.ui??{},h={...$,pinnedViews:l.length>0?l:null,layout:E??$.layout??null};return{item:await u.storage.virtualMcps.update(f,c??"system",{metadata:{...w.metadata,ui:h}})}}})});import{z as R2}from"zod";var Inf,Gnf,h1u;var tG0=O(()=>{fu();Inf=R2.object({ids:R2.array(R2.string()).describe("Virtual MCP ids to look up")}),Gnf=R2.object({items:R2.array(R2.object({id:R2.string(),last_used_at:R2.string().optional(),last_used_by:R2.string().optional()}))}),h1u=ui({name:"VIRTUAL_MCP_LAST_USED_LIST",description:"Get last-used info (timestamp + user) for one or more virtual MCPs, derived from the most recent thread per agent.",annotations:{title:"List Virtual MCP Last Used",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:Inf,outputSchema:Gnf,handler:async(i,u)=>{gi(u),Oi(u),await u.access.check();let t=await u.storage.threads.findLastUsedByVirtualMcpIds(i.ids);return{items:i.ids.map((f)=>({id:f,last_used_at:t.get(f)?.last_used_at,last_used_by:t.get(f)?.last_used_by}))}}})});var fG0=O(()=>{AF0();yF0();PF0();IF0();sI0();pI0();iG0();uG0();tG0()});import{z as G1}from"zod";var v1u;var lG0=O(()=>{X1();fu();v1u=ui({name:"MONITORING_LOG_GET",description:"Get a single monitoring log by ID with full input and output data.",annotations:{title:"Get Monitoring Log",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:G1.object({id:G1.string().describe("Log ID to fetch")}),outputSchema:G1.object({log:G1.object({id:G1.string().optional(),organizationId:G1.string(),connectionId:G1.string(),toolName:G1.string(),input:G1.record(G1.string(),G1.unknown()),output:G1.record(G1.string(),G1.unknown()),isError:G1.boolean(),errorMessage:G1.string().nullish(),durationMs:G1.number(),timestamp:G1.string(),userId:G1.string().nullish(),requestId:G1.string(),userAgent:G1.string().nullish(),virtualMcpId:G1.string().nullish(),properties:G1.record(G1.string(),G1.string()).nullish()}).nullable().describe("The monitoring log, or null if not found")}),handler:async(i,u)=>{await u.access.check(),await fh();let t=Oi(u),f=await u.storage.monitoring.getById(t.id,i.id);if(!f)return{log:null};return{log:{...f,timestamp:f.timestamp instanceof Date?f.timestamp.toISOString():f.timestamp}}}})});import{z as Ut}from"zod";var knf,d1u;var EG0=O(()=>{X1();fu();knf=Ut.object({id:Ut.string().optional().describe("Unique log identifier"),organizationId:Ut.string().describe("Organization ID"),connectionId:Ut.string().describe("Connection ID"),toolName:Ut.string().describe("Name of the tool that was called"),isError:Ut.boolean().describe("Whether the call resulted in an error"),errorMessage:Ut.string().nullish().describe("Error message if applicable"),durationMs:Ut.number().describe("Call duration in milliseconds"),timestamp:Ut.string().describe("ISO 8601 timestamp of the call"),userId:Ut.string().nullish().describe("User who triggered the call"),requestId:Ut.string().describe("Unique request identifier"),userAgent:Ut.string().nullish().describe("Client identifier (x-studio-client header)"),virtualMcpId:Ut.string().nullish().describe("Virtual MCP (Agent) ID if routed through an agent"),properties:Ut.record(Ut.string(),Ut.string()).nullish().describe("Custom key-value metadata attached to the log")}),d1u=ui({name:"MONITORING_LOGS_LIST",description:"List monitoring logs for tool calls with filtering and pagination.",annotations:{title:"List Monitoring Logs",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:Ut.object({connectionId:Ut.string().optional().describe("Filter by connection ID"),excludeConnectionIds:Ut.array(Ut.string()).optional().describe("Exclude logs from these connection IDs (e.g. system connections)"),virtualMcpId:Ut.string().optional().describe("Filter by Virtual MCP (Agent) ID"),toolName:Ut.string().optional().describe("Filter by tool name"),isError:Ut.boolean().optional().describe("Filter by error status"),startDate:Ut.string().datetime().optional().describe("Filter by start date (ISO 8601 datetime string)"),endDate:Ut.string().datetime().optional().describe("Filter by end date (ISO 8601 datetime string)"),limit:Ut.number().default(20).describe("Maximum number of results"),offset:Ut.number().default(0).describe("Offset for pagination"),properties:Ut.record(Ut.string(),Ut.string()).optional().describe("Filter by exact property key=value matches"),propertyKeys:Ut.array(Ut.string()).optional().describe("Filter by logs that have these property keys"),propertyPatterns:Ut.record(Ut.string(),Ut.string()).optional().describe("Filter by property value patterns (SQL LIKE, use % as wildcard)"),propertyInValues:Ut.record(Ut.string(),Ut.string()).optional().describe("Filter by exact match within comma-separated values (e.g., user_tags in 'Engineering')")}),outputSchema:Ut.object({logs:Ut.array(knf).describe("Array of monitoring logs"),total:Ut.number().describe("Total number of logs matching filters"),offset:Ut.number().describe("Current offset for pagination"),limit:Ut.number().describe("Current limit for pagination")}),handler:async(i,u)=>{await fh();let t=Oi(u),l=i.properties||i.propertyKeys||i.propertyPatterns||i.propertyInValues?{properties:i.properties,propertyKeys:i.propertyKeys,propertyPatterns:i.propertyPatterns,propertyInValues:i.propertyInValues}:void 0,E={organizationId:t.id,connectionId:i.connectionId,excludeConnectionIds:i.excludeConnectionIds,virtualMcpId:i.virtualMcpId,toolName:i.toolName,isError:i.isError,startDate:i.startDate?new Date(i.startDate):void 0,endDate:i.endDate?new Date(i.endDate):void 0,limit:i.limit,offset:i.offset,propertyFilters:l},c=await u.storage.monitoring.query(E);return{logs:c.logs.map(({input:w,output:$,...h})=>({...h,timestamp:h.timestamp instanceof Date?h.timestamp.toISOString():h.timestamp})),total:c.total,offset:i.offset,limit:i.limit}}})});import{z as D0}from"zod";var D1u;var cG0=O(()=>{X1();fu();D1u=ui({name:"MONITORING_STATS",description:"Get aggregated statistics (counts, latency, error rates) for tool call monitoring.",annotations:{title:"Get Monitoring Stats",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:D0.object({startDate:D0.string().datetime().optional().describe("Filter by start date (ISO 8601 datetime string)"),endDate:D0.string().datetime().optional().describe("Filter by end date (ISO 8601 datetime string)"),interval:D0.string().regex(/^\d+[mhd]$/).optional().describe("Bucket interval for timeseries data (e.g. 1m, 5m, 2h, 1d). When provided, returns timeseries array."),connectionIds:D0.array(D0.string()).max(100).optional().describe("Filter by specific connection IDs (max 100)"),excludeConnectionIds:D0.array(D0.string()).max(100).optional().describe("Exclude specific connection IDs (max 100)"),toolNames:D0.array(D0.string()).max(100).optional().describe("Filter by specific tool names (max 100)"),status:D0.enum(["success","error"]).optional().describe("Filter metrics by execution status"),topN:D0.number().int().min(1).max(20).optional().describe("When provided with interval, also return top tools and their timeseries"),userIds:D0.array(D0.string()).max(100).optional().describe("Filter LLM usage by user IDs (only applied when llmUsage is true)"),llmUsage:D0.boolean().optional().describe("Aggregate LLM-call usage (tokens + USD cost) from raw log rows for the given connection. Returns token/cost totals and timeseries. Requires interval.")}),outputSchema:D0.object({totalCalls:D0.number().describe("Total number of tool calls"),errorRate:D0.number().optional().describe("Error rate as a decimal (0 to 1)"),avgDurationMs:D0.number().describe("Average call duration in milliseconds"),errorRatePercent:D0.string().optional().describe("Error rate as a percentage string"),totalErrors:D0.number().optional().describe("Total number of errors"),p50DurationMs:D0.number().optional().describe("50th percentile duration in milliseconds"),p95DurationMs:D0.number().optional().describe("95th percentile duration in milliseconds"),connectionBreakdown:D0.array(D0.object({connectionId:D0.string(),calls:D0.number(),errors:D0.number(),errorRate:D0.number(),avgDurationMs:D0.number()})).optional().describe("Per-connection metric breakdown"),totalInputTokens:D0.number().optional().describe("Total input tokens (LLM usage mode)"),totalOutputTokens:D0.number().optional().describe("Total output tokens (LLM usage mode)"),totalTokens:D0.number().optional().describe("Total tokens (LLM usage mode)"),totalCostUsd:D0.number().optional().describe("Total USD cost (LLM usage mode; only non-zero for providers that report cost)"),topTools:D0.array(D0.object({toolName:D0.string(),connectionId:D0.string().nullable(),calls:D0.number(),inputTokens:D0.number().optional(),outputTokens:D0.number().optional(),costUsd:D0.number().optional()})).optional().describe("Top tools ranked by calls"),topToolsTimeseries:D0.array(D0.object({timestamp:D0.string(),toolName:D0.string(),calls:D0.number(),errors:D0.number(),avg:D0.number(),p95:D0.number()})).optional().describe("Per-tool metric timeseries for the top tools"),timeseries:D0.array(D0.object({timestamp:D0.string(),calls:D0.number(),errors:D0.number(),errorRate:D0.number(),avg:D0.number(),p50:D0.number(),p95:D0.number(),inputTokens:D0.number().optional(),outputTokens:D0.number().optional(),totalTokens:D0.number().optional(),costUsd:D0.number().optional()})).optional().describe("Timeseries data points bucketed by interval")}),handler:async(i,u)=>{let t=Oi(u);if(await u.access.check(),await fh(),i.interval&&i.llmUsage)return u.storage.monitoring.queryLlmUsageStats({organizationId:t.id,interval:i.interval,connectionId:i.connectionIds?.[0]??"decopilot",startDate:i.startDate?new Date(i.startDate):void 0,endDate:i.endDate?new Date(i.endDate):void 0,userIds:i.userIds,topN:i.topN});if(i.interval){let l=await u.storage.monitoring.queryMetricTimeseries({organizationId:t.id,interval:i.interval,startDate:i.startDate?new Date(i.startDate):void 0,endDate:i.endDate?new Date(i.endDate):void 0,filters:{connectionIds:i.connectionIds,excludeConnectionIds:i.excludeConnectionIds,toolNames:i.toolNames,status:i.status}});if(!i.topN)return l;let E=await u.storage.monitoring.queryMetricTopToolsTimeseries({organizationId:t.id,interval:i.interval,startDate:i.startDate?new Date(i.startDate):void 0,endDate:i.endDate?new Date(i.endDate):void 0,topN:i.topN,filters:{connectionIds:i.connectionIds,excludeConnectionIds:i.excludeConnectionIds,toolNames:i.toolNames,status:i.status}});return{...l,topTools:E.topTools,topToolsTimeseries:E.timeseries}}let f=await u.storage.monitoring.getStats({organizationId:t.id,startDate:i.startDate?new Date(i.startDate):void 0,endDate:i.endDate?new Date(i.endDate):void 0});return{...f,errorRatePercent:(f.errorRate*100).toFixed(2)}}})});import{z as g3}from"zod";var _1u;var wG0=O(()=>{X1();fu();_1u=ui({name:"MONITORING_THREAD_USAGE",description:"Aggregate LLM token usage and USD cost per thread for the given thread IDs.",annotations:{title:"Get Thread Usage",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:g3.object({threadIds:g3.array(g3.string()).min(1).max(500).describe("Thread IDs to aggregate usage for (max 500)"),connectionId:g3.string().optional().describe("LLM connection ID (defaults to 'decopilot')"),startDate:g3.string().datetime().optional().describe("Filter by start date (ISO 8601 datetime string)"),endDate:g3.string().datetime().optional().describe("Filter by end date (ISO 8601 datetime string)")}),outputSchema:g3.object({items:g3.array(g3.object({threadId:g3.string(),calls:g3.number(),inputTokens:g3.number(),outputTokens:g3.number(),totalTokens:g3.number(),costUsd:g3.number()}))}),handler:async(i,u)=>{let t=Oi(u);return await u.access.check(),await fh(),{items:await u.storage.monitoring.queryThreadUsage({organizationId:t.id,connectionId:i.connectionId??"decopilot",threadIds:i.threadIds,startDate:i.startDate?new Date(i.startDate):void 0,endDate:i.endDate?new Date(i.endDate):void 0})}}})});var $G0=O(()=>{lG0();EG0();cG0();wG0()});function mgi(i){return typeof i==="string"&&Xnf.has(i.trim().toLowerCase())}var Xnf;var N1u=O(()=>{Xnf=new Set([".well-known","_admin","api","auth","cli","commerce-onboarding","dbos-queue-depth","health","hosted-run-pending","login","mcp","metrics","oauth","oauth-proxy","onboarding","org","report","reset-password"])});import{z as A$}from"zod";var O1u;var hG0=O(()=>{fu();N1u();O1u=ui({name:"ORGANIZATION_CREATE",description:"Create a new organization. The caller becomes the owner automatically.",annotations:{title:"Create Organization",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!1,openWorldHint:!1},inputSchema:A$.object({slug:A$.string().min(1).max(50).regex(/^[a-z0-9-]+$/,"Slug must be lowercase alphanumeric with hyphens").refine((i)=>!mgi(i),"Slug is reserved by Studio"),name:A$.string().min(1).max(255),description:A$.string().optional()}),outputSchema:A$.object({id:A$.string(),name:A$.string(),slug:A$.string(),logo:A$.string().nullable().optional(),metadata:A$.any().optional(),createdAt:A$.string().datetime().describe("ISO 8601 timestamp"),members:A$.array(A$.any()).optional()}),handler:async(i,u)=>{gi(u),await u.access.check();let t=Wu(u);if(!t)throw Error("User ID required to create organization");let f=await u.boundAuth.organization.create({name:i.name,slug:i.slug,metadata:i.description?{description:i.description}:void 0,userId:t});if(!f)throw Error("Failed to create organization");return{...f,createdAt:f.createdAt instanceof Date?f.createdAt.toISOString():f.createdAt}}})});import{z as Gv}from"zod";var Z1u;var vG0=O(()=>{fu();Z1u=ui({name:"ORGANIZATION_LIST",description:"List organizations the current user belongs to.",annotations:{title:"List Organizations",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},_meta:{ui:{visibility:"app"}},inputSchema:Gv.object({userId:Gv.string().optional()}),outputSchema:Gv.object({organizations:Gv.array(Gv.object({id:Gv.string(),name:Gv.string(),slug:Gv.string(),logo:Gv.string().nullable().optional(),metadata:Gv.any().optional(),createdAt:Gv.string().datetime().describe("ISO 8601 timestamp")}))}),handler:async(i,u)=>{gi(u),await u.access.check();let t=Wu(u),f=i.userId||t;if(!f)throw Error("User ID required to list organizations");return{organizations:(await u.boundAuth.organization.list(f)).map((E)=>({...E,createdAt:E.createdAt instanceof Date?E.createdAt.toISOString():E.createdAt}))}}})});import{z as nh}from"zod";var B1u;var dG0=O(()=>{fu();B1u=ui({name:"ORGANIZATION_GET",description:"Get an organization's details, members, and settings by slug or ID.",annotations:{title:"Get Organization",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:nh.object({}),outputSchema:nh.object({id:nh.string(),name:nh.string(),slug:nh.string(),logo:nh.string().nullable().optional(),metadata:nh.any().optional(),createdAt:nh.string().datetime().describe("ISO 8601 timestamp"),members:nh.array(nh.any()).optional(),invitations:nh.array(nh.any()).optional()}),handler:async(i,u)=>{gi(u),await u.access.check();let t=u.organization?.id;if(!t)throw Error("Organization ID required (no active organization in context)");let f=await u.boundAuth.organization.get(t);if(!f)throw Error("No active organization found");let l=new Date,E=f.invitations?.filter((c)=>new Date(c.expiresAt)>l);return{...f,invitations:E,createdAt:f.createdAt instanceof Date?f.createdAt.toISOString():f.createdAt}}})});import{z as xv}from"zod";var F1u;var DG0=O(()=>{fu();F1u=ui({name:"ORGANIZATION_UPDATE",description:"Update an organization's name or description.",annotations:{title:"Update Organization",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:xv.object({id:xv.string(),name:xv.string().min(1).max(255).optional(),description:xv.string().optional()}),outputSchema:xv.object({id:xv.string(),name:xv.string(),slug:xv.string(),logo:xv.string().nullable().optional(),metadata:xv.any().optional(),createdAt:xv.string().datetime().describe("ISO 8601 timestamp")}),handler:async(i,u)=>{gi(u),await u.access.check();let t={};if(i.name)t.name=i.name;if(i.description)t.metadata={description:i.description};let f=await u.boundAuth.organization.update({organizationId:i.id,data:t});if(!f)throw Error("Failed to update organization");return{...f,createdAt:f.createdAt instanceof Date?f.createdAt.toISOString():f.createdAt}}})});import{z as Zo}from"zod";var g1u;var _G0=O(()=>{fu();g1u=ui({name:"ORGANIZATION_DELETE",description:"Archive an organization (soft delete).",annotations:{title:"Delete Organization",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:Zo.object({id:Zo.string()}),outputSchema:Zo.object({success:Zo.boolean(),id:Zo.string()}),handler:async(i,u)=>{return gi(u),await u.access.check(),await u.boundAuth.organization.update({organizationId:i.id,data:{metadata:{archived:!0,archivedAt:new Date().toISOString()}}}),{success:!0,id:i.id}}})});import{z as M0}from"zod";var Bo,Fo,un,NG0,egi,go,To,LN;var b2=O(()=>{Bo=M0.object({title:M0.string(),url:M0.string(),icon:M0.string()}),Fo=M0.object({registries:M0.record(M0.string(),M0.object({enabled:M0.boolean()})).describe("Per-registry enabled/disabled state. Key is connection ID. Absent registries are treated as enabled."),blockedMcps:M0.array(M0.string()).describe("List of MCP app_name or app_id values to hide from the store.")}),un=M0.object({keyId:M0.string(),modelId:M0.string(),title:M0.string().optional()}).nullable(),NG0=M0.enum(["fast","smart","thinking","image","web_search","deep_research"]),egi=M0.enum(["fast","smart","thinking"]),go=M0.object({tiers:M0.object({fast:un,smart:un,thinking:un,image:un,web_search:un,deep_research:un})}),To=M0.object({ids:M0.array(M0.string()).describe("Ordered list of custom virtual MCP agent ids to show on the home view.")}),LN=M0.object({id:M0.string().describe("Brand context ID"),name:M0.string().describe("Company name"),domain:M0.string().describe("Company domain (e.g. example.com)"),overview:M0.string().describe("Company overview / description"),logo:M0.string().nullable().optional().describe("Logo URL"),favicon:M0.string().nullable().optional().describe("Favicon URL"),ogImage:M0.string().nullable().optional().describe("OG image URL"),fonts:M0.object({heading:M0.string().optional().describe("Font family for headings"),body:M0.string().optional().describe("Font family for body text"),code:M0.string().optional().describe("Font family for code / monospace")}).nullable().optional().describe("Font families by semantic role"),colors:M0.object({primary:M0.string().optional().describe("Primary brand color (hex)"),secondary:M0.string().optional().describe("Secondary brand color (hex)"),accent:M0.string().optional().describe("Accent / highlight color (hex)"),background:M0.string().optional().describe("Background color (hex)"),foreground:M0.string().optional().describe("Foreground / text color (hex)")}).nullable().optional().describe("Semantic color palette"),images:M0.array(M0.record(M0.string(),M0.unknown())).nullable().optional().describe("Brand images"),metadata:M0.record(M0.string(),M0.unknown()).nullable().optional().describe("Extra design tokens (typography, components, spacing, layout, tone, etc.)"),archivedAt:M0.string().nullable().optional().describe("Archive timestamp (null to unarchive)"),isDefault:M0.boolean().optional().describe("Whether this is the default brand for the organization")})});import{z as C2}from"zod";var T1u;var OG0=O(()=>{fu();b2();T1u=ui({name:"ORGANIZATION_SETTINGS_GET",description:"Get organization-level settings including sidebar configuration, store registry settings, simple model mode, and default home agents.",annotations:{title:"Get Organization Settings",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:C2.object({}),outputSchema:C2.object({organizationId:C2.string(),sidebar_items:C2.array(Bo).nullable().optional(),enabled_plugins:C2.array(C2.string()).nullable().optional(),registry_config:Fo.nullable().optional(),simple_mode:go.nullable().optional(),default_home_agents:To.nullable().optional(),reports_only:C2.boolean().nullable().optional(),createdAt:C2.string().datetime().optional().describe("ISO 8601 timestamp"),updatedAt:C2.string().datetime().optional().describe("ISO 8601 timestamp")}),handler:async(i,u)=>{gi(u),await u.access.check();let t=u.organization?.id;if(!t)throw Error("Organization ID required (no active organization in context)");let f=await u.storage.organizationSettings.get(t);if(!f)return{organizationId:t};return{...f,createdAt:f.createdAt instanceof Date?f.createdAt.toISOString():f.createdAt,updatedAt:f.updatedAt instanceof Date?f.updatedAt.toISOString():f.updatedAt}}})});import{z as Fw}from"zod";var U1u;var ZG0=O(()=>{fu();b2();U1u=ui({name:"ORGANIZATION_SETTINGS_UPDATE",description:"Update organization-level settings such as sidebar configuration, store registry settings, simple model mode, and default home agents.",annotations:{title:"Update Organization Settings",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:Fw.object({organizationId:Fw.string(),sidebar_items:Fw.array(Bo).optional(),enabled_plugins:Fw.array(Fw.string()).optional(),registry_config:Fo.optional(),simple_mode:go.optional(),default_home_agents:To.optional(),reports_only:Fw.boolean().optional()}),outputSchema:Fw.object({organizationId:Fw.string(),sidebar_items:Fw.array(Bo).nullable().optional(),enabled_plugins:Fw.array(Fw.string()).nullable().optional(),registry_config:Fo.nullable().optional(),simple_mode:go.nullable().optional(),default_home_agents:To.nullable().optional(),reports_only:Fw.boolean().nullable().optional(),createdAt:Fw.string().datetime().describe("ISO 8601 timestamp"),updatedAt:Fw.string().datetime().describe("ISO 8601 timestamp")}),handler:async(i,u)=>{if(gi(u),await u.access.check(),Oi(u).id!==i.organizationId)throw Error("Cannot update settings for a different organization");let f=await u.storage.organizationSettings.upsert(i.organizationId,{sidebar_items:i.sidebar_items,enabled_plugins:i.enabled_plugins,registry_config:i.registry_config,simple_mode:i.simple_mode,default_home_agents:i.default_home_agents,reports_only:i.reports_only});return{...f,createdAt:f.createdAt instanceof Date?f.createdAt.toISOString():f.createdAt,updatedAt:f.updatedAt instanceof Date?f.updatedAt.toISOString():f.updatedAt}}})});import{z as kv}from"zod";var BG0,A1u,y1u;var FG0=O(()=>{fu();b2();BG0=LN.extend({organizationId:kv.string(),archivedAt:kv.string().nullable().optional().describe("ISO 8601 timestamp"),createdAt:kv.string().describe("ISO 8601 timestamp"),updatedAt:kv.string().describe("ISO 8601 timestamp")}),A1u=ui({name:"BRAND_CONTEXT_LIST",description:"List all brand contexts (company profiles) for the current organization.",annotations:{title:"List Brand Contexts",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:kv.object({includeArchived:kv.boolean().optional().describe("Include archived brands in the list")}),outputSchema:kv.object({items:kv.array(BG0)}),handler:async(i,u)=>{gi(u),await u.access.check();let t=u.organization?.id;if(!t)throw Error("Organization ID required (no active organization in context)");return{items:(await u.storage.brandContext.list(t,{includeArchived:i.includeArchived})).map((l)=>({...l,archivedAt:l.archivedAt instanceof Date?l.archivedAt.toISOString():l.archivedAt,createdAt:l.createdAt instanceof Date?l.createdAt.toISOString():l.createdAt,updatedAt:l.updatedAt instanceof Date?l.updatedAt.toISOString():l.updatedAt}))}}}),y1u=ui({name:"BRAND_CONTEXT_GET",description:"Get a specific brand context by ID.",annotations:{title:"Get Brand Context",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:kv.object({id:kv.string().describe("Brand context ID")}),outputSchema:BG0.extend({organizationId:kv.string()}),handler:async(i,u)=>{gi(u),await u.access.check();let t=u.organization?.id;if(!t)throw Error("Organization ID required (no active organization in context)");let f=await u.storage.brandContext.get(i.id,t);if(!f)throw Error("Brand context not found");return{...f,archivedAt:f.archivedAt instanceof Date?f.archivedAt.toISOString():f.archivedAt,createdAt:f.createdAt instanceof Date?f.createdAt.toISOString():f.createdAt,updatedAt:f.updatedAt instanceof Date?f.updatedAt.toISOString():f.updatedAt}}})});import{z as QK}from"zod";var gG0,P1u,I1u,G1u;var TG0=O(()=>{fu();b2();gG0=LN.extend({organizationId:QK.string(),createdAt:QK.string().describe("ISO 8601 timestamp"),updatedAt:QK.string().describe("ISO 8601 timestamp")}),P1u=ui({name:"BRAND_CONTEXT_CREATE",description:"Create a new brand context (company profile) for the current organization.",annotations:{title:"Create Brand Context",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!1,openWorldHint:!1},inputSchema:LN.omit({id:!0}),outputSchema:gG0,handler:async(i,u)=>{gi(u),await u.access.check();let t=u.organization?.id;if(!t)throw Error("Organization ID required (no active organization in context)");let f=await u.storage.brandContext.create(t,{name:i.name,domain:i.domain,overview:i.overview,logo:i.logo??null,favicon:i.favicon??null,ogImage:i.ogImage??null,fonts:i.fonts??null,colors:i.colors??null,images:i.images??null,metadata:i.metadata??null});return{...f,archivedAt:f.archivedAt instanceof Date?f.archivedAt.toISOString():f.archivedAt,createdAt:f.createdAt instanceof Date?f.createdAt.toISOString():f.createdAt,updatedAt:f.updatedAt instanceof Date?f.updatedAt.toISOString():f.updatedAt}}}),I1u=ui({name:"BRAND_CONTEXT_UPDATE",description:"Update an existing brand context by ID.",annotations:{title:"Update Brand Context",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:LN.partial().required({id:!0}),outputSchema:gG0,handler:async(i,u)=>{gi(u),await u.access.check();let t=u.organization?.id;if(!t)throw Error("Organization ID required (no active organization in context)");if(!await u.storage.brandContext.get(i.id,t))throw Error("Brand context not found");let{id:l,...E}=i;if(E.isDefault===!0)await u.storage.brandContext.setDefault(l,t);let c=await u.storage.brandContext.update(l,t,{name:E.name,domain:E.domain,overview:E.overview,logo:E.logo!==void 0?E.logo??null:void 0,favicon:E.favicon!==void 0?E.favicon??null:void 0,ogImage:E.ogImage!==void 0?E.ogImage??null:void 0,fonts:E.fonts!==void 0?E.fonts??null:void 0,colors:E.colors!==void 0?E.colors??null:void 0,images:E.images!==void 0?E.images??null:void 0,metadata:E.metadata!==void 0?E.metadata??null:void 0,archivedAt:E.archivedAt!==void 0?E.archivedAt??null:void 0,isDefault:E.isDefault===!1?!1:void 0});return{...c,archivedAt:c.archivedAt instanceof Date?c.archivedAt.toISOString():c.archivedAt,createdAt:c.createdAt instanceof Date?c.createdAt.toISOString():c.createdAt,updatedAt:c.updatedAt instanceof Date?c.updatedAt.toISOString():c.updatedAt}}}),G1u=ui({name:"BRAND_CONTEXT_DELETE",description:"Archive a brand context by ID (soft delete).",annotations:{title:"Archive Brand Context",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:QK.object({id:QK.string().describe("Brand context ID")}),outputSchema:QK.object({success:QK.boolean()}),handler:async(i,u)=>{gi(u),await u.access.check();let t=u.organization?.id;if(!t)throw Error("Organization ID required (no active organization in context)");if(!await u.storage.brandContext.get(i.id,t))throw Error("Brand context not found");return await u.storage.brandContext.update(i.id,t,{archivedAt:new Date().toISOString(),isDefault:!1}),{success:!0}}})});async function agi(i,u,t){let f=i.trim();if(!f.startsWith("http"))f=`https://${f}`;let l=await fetch("https://api.firecrawl.dev/v1/scrape",{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${u}`},body:JSON.stringify({url:f,formats:["branding"]})});if(!l.ok){let D=await l.text().catch(()=>"");throw Error(`Firecrawl API error: ${l.status} ${D.slice(0,200)}`)}let E=await l.json();if(!E.success||!E.data?.branding)return null;let c=E.data.branding,w=E.data.metadata??{},$=Ynf(c,w);return{name:w.title?.split(/[|\u2013\u2014]|\s+-\s+/).map((D)=>D.trim()).filter(Boolean)?.slice().sort((D,_)=>D.length-_.length)[0]??w.ogSiteName??t??i,domain:i,overview:w.description??"",logo:$.logo,favicon:$.favicon,ogImage:$.ogImage,fonts:$.fonts,colors:$.colors,images:null,metadata:Object.keys($.metadata).length>0?$.metadata:null}}function Ynf(i,u){let t=i.images??{},f=i.colors??{},l={};for(let[v,d]of Object.entries(f))if(typeof d==="string"&&d&&Jnf.has(v))l[v]=d;let E={},w=(i.typography??{}).fontFamilies??{};for(let[v,d]of Object.entries(w))if(typeof d==="string"&&d){let D=Knf[v.toLowerCase()];if(D&&!E[D])E[D]=d}let $=i.fonts;if(Array.isArray($))for(let v of $){let d=v.family;if(typeof d==="string"&&d&&!E.body)E.body=d}let h={};for(let v of["typography","components","spacing","layout","animations","icons","tone","personality","colorScheme"])if(i[v]!==void 0)h[v]=i[v];return{logo:t.logo??null,favicon:t.favicon??null,ogImage:t.ogImage??u.ogImage??null,fonts:Object.keys(E).length>0?E:null,colors:Object.keys(l).length>0?l:null,metadata:h}}var Jnf,Knf;var x1u=O(()=>{Jnf=new Set(["primary","secondary","accent","background","foreground"]),Knf={heading:"heading",headings:"heading",head:"heading",title:"heading",body:"body",primary:"body",text:"body",code:"code",monospace:"code",mono:"code"}});import{z as ogi}from"zod";var Wnf,k1u;var UG0=O(()=>{fu();x1u();b2();Wnf=LN.pick({id:!0,name:!0,domain:!0,overview:!0,logo:!0,favicon:!0,ogImage:!0,fonts:!0,colors:!0}).extend({success:ogi.boolean()}),k1u=ui({name:"BRAND_CONTEXT_EXTRACT",description:"Extract brand context (colors, fonts, logos) from a website URL using Firecrawl.",annotations:{title:"Extract Brand Context",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!0},inputSchema:ogi.object({domain:ogi.string().describe("Website domain to extract brand from"),brandId:ogi.string().optional().describe("Existing brand context ID to update (creates new if omitted)")}),outputSchema:Wnf,modelSummary:(i)=>i.success?`Brand saved (id=${i.id}, name=${i.name}, domain=${i.domain}). The UI rendered the logo, colors, fonts, and overview.`:"Brand extraction failed.",handler:async(i,u)=>{gi(u),await u.access.check();let t=u.organization?.id;if(!t)throw Error("Organization ID required (no active organization in context)");let f=u.firecrawlApiKey;if(!f)throw Error("FIRECRAWL_API_KEY is not configured. Set the environment variable to enable brand extraction.");let l=await agi(i.domain,f,i.domain);if(!l)throw Error("Firecrawl did not return branding data for this URL");let E={name:l.name,domain:l.domain,overview:l.overview,logo:l.logo,favicon:l.favicon,ogImage:l.ogImage,fonts:l.fonts,colors:l.colors,images:l.images,metadata:l.metadata},c=i.brandId?await(async()=>{if(!await u.storage.brandContext.get(i.brandId,t))throw Error("Brand context not found");return u.storage.brandContext.update(i.brandId,t,E)})():await u.storage.brandContext.create(t,E);return{id:c.id,name:c.name,domain:c.domain,overview:c.overview,logo:c.logo,favicon:c.favicon,ogImage:c.ogImage,fonts:c.fonts,colors:c.colors,success:!0}}})});function AG0(i){let u=i.metadata??{};return{id:i.id,name:i.name,domain:i.domain||void 0,colors:i.colors??void 0,fonts:i.fonts??void 0,assets:i.logo||i.favicon||i.ogImage?{logo:i.logo??void 0,favicon:i.favicon??void 0,ogImage:i.ogImage??void 0}:void 0,overview:i.overview||void 0,tagline:typeof u.tagline==="string"?u.tagline:void 0,tone:typeof u.tone==="string"?u.tone:void 0,metadata:(()=>{let t=Object.fromEntries(Object.entries(u).filter(([f])=>f!=="tagline"&&f!=="tone"));return Object.keys(t).length>0?t:void 0})()}}var j1u,X1u;var yG0=O(()=>{Utu();fu();j1u=ui({name:"BRAND_GET",description:"Get a brand context by ID. Omit the ID to get the default brand for the organization.",annotations:{title:"Get Brand",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:$5i,outputSchema:Xa,handler:async(i,u)=>{gi(u),await u.access.check();let t=u.organization?.id;if(!t)throw Error("Organization ID required (no active organization in context)");let f=i.id?await u.storage.brandContext.get(i.id,t):await u.storage.brandContext.getDefault(t);if(!f)throw Error(i.id?"Brand not found":"No default brand configured");return AG0(f)}}),X1u=ui({name:"BRAND_LIST",description:"List all active brands for the current organization.",annotations:{title:"List Brands",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:h5i,outputSchema:v5i,handler:async(i,u)=>{gi(u),await u.access.check();let t=u.organization?.id;if(!t)throw Error("Organization ID required (no active organization in context)");return{items:(await u.storage.brandContext.list(t)).map(AG0)}}})});import{resolveTxt as Snf}from"dns/promises";function J1u(i){return`${Lnf}.${i.toLowerCase()}`}function PG0(){return`deco-verify-${crypto.randomUUID().replace(/-/g,"")}`}async function IG0(i,u,t=Snf){if(!u)return!1;try{return(await t(J1u(i))).some((l)=>l.join("").trim()===u)}catch{return!1}}var Lnf="_deco-verify";var GG0=()=>{};import{z as L1}from"zod";function QN(i){let u=i.verificationStatus==="pending"&&Boolean(i.verificationToken);return{id:i.id,domain:i.domain,joinMode:i.joinMode,verificationStatus:i.verificationStatus,verificationMethod:i.verificationMethod,verifiedAt:i.verifiedAt?new Date(i.verifiedAt).toISOString():null,recordName:u?J1u(i.domain):null,recordValue:u?i.verificationToken:null}}function Hnf(i){let u=i.toLowerCase().trim();if(!Qnf.test(u))throw Error(`Invalid domain format: "${u}". Must be a valid domain like "acme.com"`);if(jv.has(u))throw Error(`Cannot claim generic email domain "${u}". Only corporate domains are allowed.`);return u}var Qnf,K1u,sgi,Y1u,W1u,S1u,L1u,Q1u;var xG0=O(()=>{F$();GG0();fu();Qnf=/^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+$/,K1u=L1.enum(["off","auto","request"]),sgi=L1.object({id:L1.string(),domain:L1.string(),joinMode:K1u,verificationStatus:L1.enum(["pending","verified"]),verificationMethod:L1.enum(["email","dns"]).nullable(),verifiedAt:L1.string().nullable(),recordName:L1.string().nullable(),recordValue:L1.string().nullable()});Y1u=ui({name:"ORGANIZATION_DOMAIN_LIST",description:"List the email domains claimed by an organization.",annotations:{title:"List Organization Domains",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:L1.object({}),outputSchema:L1.object({domains:L1.array(sgi)}),handler:async(i,u)=>{gi(u),await u.access.check();let t=Oi(u);return{domains:(await u.storage.organizationDomains.listByOrganizationId(t.id)).map(QN)}}}),W1u=ui({name:"ORGANIZATION_DOMAIN_ADD",description:"Claim an email domain for an organization. If the caller's verified email matches the domain it is trusted immediately; otherwise it requires DNS verification.",annotations:{title:"Add Organization Domain",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:L1.object({domain:L1.string().min(1).max(255).describe("Domain to claim, e.g. acme.com"),joinMode:K1u.optional().describe("Initial join mode (only applied when the domain is trusted immediately via email match).")}),outputSchema:sgi,handler:async(i,u)=>{gi(u),await u.access.check();let t=Oi(u),f=Hnf(i.domain),E=u.auth.user?.email?.split("@")[1]?.toLowerCase(),c=Boolean(u.auth.user?.emailVerified)&&E===f,w=await u.storage.organizationDomains.getByOrgAndDomain(t.id,f);if(w){if(w.verificationStatus!=="verified"&&c){let h=await u.storage.organizationDomains.markVerified(w.id,"email");return QN(h)}return QN(w)}let $=c?await u.storage.organizationDomains.add(t.id,f,{joinMode:i.joinMode??"off",verificationStatus:"verified",verificationMethod:"email"}):await u.storage.organizationDomains.add(t.id,f,{joinMode:"off",verificationStatus:"pending",verificationToken:PG0()});return QN($)}}),S1u=ui({name:"ORGANIZATION_DOMAIN_UPDATE",description:"Set the join mode for a claimed domain. Discoverable modes (auto/request) require the domain to be verified.",annotations:{title:"Update Organization Domain",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:L1.object({id:L1.string(),joinMode:K1u}),outputSchema:sgi,handler:async(i,u)=>{gi(u),await u.access.check();let t=Oi(u),f=await u.storage.organizationDomains.getById(i.id);if(!f||f.organizationId!==t.id)throw Error("Domain not found");if(i.joinMode!=="off"&&f.verificationStatus!=="verified")throw Error("Verify the domain before enabling auto-join or requests.");let l=await u.storage.organizationDomains.updateJoinMode(i.id,i.joinMode);return QN(l)}}),L1u=ui({name:"ORGANIZATION_DOMAIN_VERIFY",description:"Check the DNS TXT record for a pending domain and mark it verified if present.",annotations:{title:"Verify Organization Domain",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!0},inputSchema:L1.object({id:L1.string()}),outputSchema:L1.object({verified:L1.boolean(),domain:sgi}),handler:async(i,u)=>{gi(u),await u.access.check();let t=Oi(u),f=await u.storage.organizationDomains.getById(i.id);if(!f||f.organizationId!==t.id)throw Error("Domain not found");if(f.verificationStatus==="verified")return{verified:!0,domain:QN(f)};if(!f.verificationToken)throw Error("Domain has no pending DNS verification.");if(!await IG0(f.domain,f.verificationToken))return{verified:!1,domain:QN(f)};let E=await u.storage.organizationDomains.markVerified(i.id,"dns");return{verified:!0,domain:QN(E)}}}),Q1u=ui({name:"ORGANIZATION_DOMAIN_REMOVE",description:"Remove a claimed domain from an organization.",annotations:{title:"Remove Organization Domain",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:L1.object({id:L1.string()}),outputSchema:L1.object({success:L1.boolean()}),handler:async(i,u)=>{gi(u),await u.access.check();let t=Oi(u),f=await u.storage.organizationDomains.getById(i.id);if(!f||f.organizationId!==t.id)throw Error("Domain not found");return await u.storage.organizationDomains.removeById(i.id),{success:!0}}})});function HN(i){return(i instanceof Error?i.message.toLowerCase():"").includes("already a member")}import{z as Sl}from"zod";var znf,H1u,z1u,n1u;var kG0=O(()=>{fu();H4();znf=Sl.object({id:Sl.string(),userId:Sl.string(),status:Sl.enum(["pending","approved","denied"]),createdAt:Sl.string(),user:Sl.object({id:Sl.string(),name:Sl.string(),email:Sl.string(),image:Sl.string().nullable()}).nullable()}),H1u=ui({name:"ORGANIZATION_JOIN_REQUEST_LIST",description:"List pending requests to join the organization.",annotations:{title:"List Join Requests",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:Sl.object({}),outputSchema:Sl.object({requests:Sl.array(znf)}),handler:async(i,u)=>{gi(u),await u.access.check();let t=Oi(u);return{requests:(await u.storage.organizationJoinRequests.listPendingWithUser(t.id)).map((l)=>({id:l.id,userId:l.userId,status:l.status,createdAt:new Date(l.createdAt).toISOString(),user:l.user}))}}}),z1u=ui({name:"ORGANIZATION_JOIN_REQUEST_APPROVE",description:"Approve a pending join request, adding the user as a member.",annotations:{title:"Approve Join Request",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:Sl.object({requestId:Sl.string()}),outputSchema:Sl.object({success:Sl.boolean()}),handler:async(i,u)=>{gi(u),await u.access.check();let t=Oi(u),f=await u.storage.organizationJoinRequests.getById(i.requestId);if(!f||f.organizationId!==t.id)throw Error("Join request not found");if(f.status!=="pending")throw Error("Join request has already been decided");let l=Wu(u);if(!await u.storage.organizationJoinRequests.decide(f.id,"approved",l??f.userId))return{success:!0};try{await u.boundAuth.organization.addMember({organizationId:t.id,userId:f.userId,role:["user"]})}catch(c){if(!HN(c))throw c}if(l)mu.capture({distinctId:l,event:"organization_join_request_approved",groups:{organization:t.id},properties:{organization_id:t.id,user_id:f.userId}});return{success:!0}}}),n1u=ui({name:"ORGANIZATION_JOIN_REQUEST_DENY",description:"Deny a pending join request.",annotations:{title:"Deny Join Request",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:Sl.object({requestId:Sl.string()}),outputSchema:Sl.object({success:Sl.boolean()}),handler:async(i,u)=>{gi(u),await u.access.check();let t=Oi(u),f=await u.storage.organizationJoinRequests.getById(i.requestId);if(!f||f.organizationId!==t.id)throw Error("Join request not found");if(f.status!=="pending")throw Error("Join request has already been decided");let l=Wu(u);if(await u.storage.organizationJoinRequests.decide(f.id,"denied",l??f.userId)&&l)mu.capture({distinctId:l,event:"organization_join_request_denied",groups:{organization:t.id},properties:{organization_id:t.id,user_id:f.userId}});return{success:!0}}})});import{z as gw}from"zod";var R1u;var jG0=O(()=>{H4();fu();Uh();R1u=ui({name:"ORGANIZATION_MEMBER_ADD",description:"Invite a member to the organization by email with an assigned role.",annotations:{title:"Add Organization Member",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:gw.object({organizationId:gw.string().optional(),userId:gw.string(),role:gw.array(gw.string())}),outputSchema:gw.object({id:gw.string(),organizationId:gw.string(),userId:gw.string(),role:gw.union([gw.string(),gw.array(gw.string())]),createdAt:gw.string().datetime().describe("ISO 8601 timestamp")}),handler:async(i,u)=>{gi(u),await u.access.check();let t=i.organizationId||u.organization?.id;if(!t)throw Error("Organization ID required (no active organization in context)");if(t!==u.organization?.id)throw Error("Organization ID does not match authenticated organization");let f=await u.db.selectFrom("member").select(["role"]).where("userId","=",Wu(u)??"").where("organizationId","=",t).executeTakeFirst();if(!f$i(f?.role,i.role))throw Error(`Insufficient privileges to assign role "${i.role.join(",")}"`);let l=await u.boundAuth.organization.addMember({organizationId:t,userId:i.userId,role:i.role});if(!l)throw Error("Failed to add member");let E=Wu(u);if(E)mu.capture({distinctId:E,event:"organization_member_added",groups:{organization:t},properties:{organization_id:t,added_user_id:i.userId,role:i.role}});return{...l,role:l.role,createdAt:l.createdAt instanceof Date?l.createdAt.toISOString():l.createdAt}}})});import{z as tn}from"zod";var b1u;var XG0=O(()=>{H4();fu();b1u=ui({name:"ORGANIZATION_MEMBER_REMOVE",description:"Remove a member from the organization. Revokes all their access immediately.",annotations:{title:"Remove Organization Member",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:tn.object({organizationId:tn.string().optional(),memberIdOrEmail:tn.string()}),outputSchema:tn.object({success:tn.boolean(),memberIdOrEmail:tn.string()}),handler:async(i,u)=>{gi(u),await u.access.check();let t=i.organizationId||u.organization?.id;if(!t)throw Error("Organization ID required (no active organization in context)");if(t!==u.organization?.id)throw Error("Organization ID does not match authenticated organization");await u.boundAuth.organization.removeMember({organizationId:t,memberIdOrEmail:i.memberIdOrEmail});let f=Wu(u);if(f)mu.capture({distinctId:f,event:"organization_member_removed",groups:{organization:t},properties:{organization_id:t,member_id_or_email:i.memberIdOrEmail}});return{success:!0,memberIdOrEmail:i.memberIdOrEmail}}})});import{z as Jc}from"zod";var C1u;var JG0=O(()=>{fu();C1u=ui({name:"ORGANIZATION_MEMBER_LIST",description:"List all members in the organization with their roles.",annotations:{title:"List Organization Members",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:Jc.object({limit:Jc.number().optional(),offset:Jc.number().optional()}),outputSchema:Jc.object({members:Jc.array(Jc.object({id:Jc.string(),organizationId:Jc.string(),userId:Jc.string(),role:Jc.string(),createdAt:Jc.string().datetime().describe("ISO 8601 timestamp"),user:Jc.object({id:Jc.string(),name:Jc.string(),email:Jc.string(),image:Jc.string().optional()}).optional()}))}),handler:async(i,u)=>{gi(u),await u.access.check();let t=u.organization?.id;if(!t)throw Error("Organization ID required (no active organization in context)");let f=await u.boundAuth.organization.listMembers({organizationId:t,limit:i.limit,offset:i.offset});return{members:(Array.isArray(f)?f:[]).map((E)=>({...E,createdAt:E.createdAt instanceof Date?E.createdAt.toISOString():E.createdAt}))}}})});import{z as lE}from"zod";var M1u;var KG0=O(()=>{H4();fu();Uh();M1u=ui({name:"ORGANIZATION_MEMBER_UPDATE_ROLE",description:"Change a member's role (e.g., admin, member) within the organization.",annotations:{title:"Update Member Role",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:lE.object({organizationId:lE.string().optional(),memberId:lE.string(),role:lE.array(lE.string())}),outputSchema:lE.object({id:lE.string(),organizationId:lE.string(),userId:lE.string(),role:lE.union([lE.string(),lE.array(lE.string())]),createdAt:lE.string().datetime().describe("ISO 8601 timestamp"),user:lE.object({email:lE.string(),name:lE.string(),image:lE.string().optional()})}),handler:async(i,u)=>{gi(u),await u.access.check();let t=i.organizationId||u.organization?.id;if(!t)throw Error("Organization ID required (no active organization in context)");let f=await u.db.selectFrom("member").select(["role"]).where("userId","=",Wu(u)??"").where("organizationId","=",t).executeTakeFirst();if(!f$i(f?.role,i.role))throw Error(`Insufficient privileges to assign role "${i.role.join(",")}"`);let l=await u.boundAuth.organization.updateMemberRole({organizationId:t,memberId:i.memberId,role:i.role});if(!l)throw Error("Failed to update member role");u.invalidateMemberRole?.(l.userId,t);let E=Wu(u);if(E)mu.capture({distinctId:E,event:"organization_member_role_updated",groups:{organization:t},properties:{organization_id:t,member_id:i.memberId,target_user_id:l.userId,new_role:Array.isArray(i.role)?i.role.join(","):i.role}});return{...l,createdAt:l.createdAt instanceof Date?l.createdAt.toISOString():l.createdAt}}})});async function YG0(){if(Uo&&Date.now()-Uo.fetchedAt<600000)return Uo.rate;try{let u=await(await fetch("https://economia.awesomeapi.com.br/json/last/USD-BRL",{signal:AbortSignal.timeout(5000)})).json(),t=parseFloat(u.USDBRL?.bid??"");if(Number.isNaN(t)||t<=0)throw Error("Invalid rate");return Uo={rate:t,fetchedAt:Date.now()},t}catch{return Uo?.rate??5.5}}function WG0(i,u,t){if(u==="brl")return Math.round(i/t);return i}var Uo=null;function q1u(i,u="",t=new URLSearchParams){for(let[f,l]of Object.entries(i)){if(l===void 0||l===null)continue;let E=u?`${u}[${f}]`:f;if(Array.isArray(l))l.forEach((c,w)=>{if(typeof c==="object"&&c!==null)q1u(c,`${E}[${w}]`,t);else t.append(`${E}[${w}]`,String(c))});else if(typeof l==="object")q1u(l,E,t);else t.append(E,String(l))}return t}async function zN(i,u){let t=hu().stripeSecretKey;if(!t)throw new Tw(503,"billing is not configured");let f=u?.params?q1u(u.params).toString():void 0,l=await fetch(`${nnf}${i}`,{method:u?.method??(f?"POST":"GET"),headers:{Authorization:`Bearer ${t}`,...f&&{"Content-Type":"application/x-www-form-urlencoded"}},body:f,signal:AbortSignal.timeout(Rnf)}),E=await l.json().catch(()=>({}));if(!l.ok){let c=E.error?.message??`HTTP ${l.status}`;throw new Tw(l.status,c)}return E}async function SG0(i){let u=hu().stripeSeatPriceId;if(!u)throw new Tw(503,"billing is not configured");let t=await zN("/checkout/sessions",{params:{mode:"subscription",line_items:[{price:u,quantity:i.quantity}],success_url:i.successUrl,cancel_url:i.cancelUrl,metadata:{orgId:i.organizationId},subscription_data:{metadata:{orgId:i.organizationId}}}});if(!t.url)throw new Tw(500,"checkout session lacks url");return{url:t.url}}async function V1u(i){let t=(await zN(`/subscriptions/${encodeURIComponent(i)}`)).items?.data??[],f=hu().stripeSeatPriceId,l=f?t.find((E)=>E.price?.id===f):t.length===1?t[0]:void 0;if(!l)throw new Tw(500,"subscription has no seat item");return{itemId:l.id,quantity:l.quantity??0}}async function LG0(i){let{itemId:u}=await V1u(i.subscriptionId),t=await zN("/invoices/create_preview",{params:{subscription:i.subscriptionId,subscription_details:{items:[{id:u,quantity:i.quantity}],proration_behavior:"always_invoice"}}});return{amountDueCents:t.amount_due??0,currency:t.currency??"usd"}}function bnf(i,u){return Math.round(i*(1+u/100))}async function QG0(i){let u=bnf(i.amountCents,i.feePercent),t=WG0(i.amountCents,i.currency,await YG0()),f=i.currency==="brl"?`Studio AI credits (R$ ${(i.amountCents/100).toFixed(2)})`:`Studio AI credits ($${(i.amountCents/100).toFixed(2)})`,l=await zN("/checkout/sessions",{params:{mode:"payment",...i.customerId&&{customer:i.customerId},line_items:[{quantity:1,price_data:{currency:i.currency,unit_amount:u,product_data:{name:f}}}],success_url:i.successUrl,cancel_url:i.cancelUrl,metadata:{kind:"topup",orgId:i.organizationId,creditCents:t}}});if(!l.url)throw new Tw(500,"checkout session lacks url");return{url:l.url}}async function HG0(i){let u=await zN("/billing_portal/sessions",{params:{customer:i.customerId,return_url:i.returnUrl}});if(!u.url)throw new Tw(500,"portal session lacks url");return{url:u.url}}async function zG0(i){let{itemId:u}=await V1u(i.subscriptionId);await zN(`/subscriptions/${encodeURIComponent(i.subscriptionId)}`,{params:{items:[{id:u,quantity:i.quantity}],proration_behavior:"always_invoice",payment_behavior:"pending_if_incomplete"}})}async function nG0(i){await zN(`/subscriptions/${encodeURIComponent(i)}`,{method:"DELETE"})}async function RG0(i){if(i.targetQuantity<1)return!1;let{itemId:u,quantity:t}=await V1u(i.subscriptionId);if(t===i.targetQuantity)return!1;return await zN(`/subscriptions/${encodeURIComponent(i.subscriptionId)}`,{params:{items:[{id:u,quantity:i.targetQuantity}],proration_behavior:"always_invoice",payment_behavior:"pending_if_incomplete"}}),!0}var nnf="https://api.stripe.com/v1",Tw,Rnf=15000;var fn=O(()=>{z0();Tw=class Tw extends Error{status;constructor(i,u){super(`Stripe API ${i}: ${u}`);this.status=i;this.name="StripeApiError"}}});import{z as Ll}from"zod";var Cnf,r1u,m1u;var bG0=O(()=>{fn();ML();fu();KL();Cnf=Ll.object({legacy:Ll.boolean(),billingMode:Ll.string(),status:Ll.string(),includedReportUrl:Ll.string().nullable()}),r1u=ui({name:"ORGANIZATION_SEATS_GET",description:"Get the organization's billing identity and which members hold paid seats.",annotations:{title:"Get Organization Seats",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:Ll.object({}),outputSchema:Ll.object({billing:Cnf.nullable(),paidSeatUserIds:Ll.array(Ll.string())}),handler:async(i,u)=>{gi(u),await u.access.check();let t=u.organization?.id;if(!t)throw Error("Organization context required");let[f,l]=await Promise.all([u.storage.organizationBilling.getBilling(t),u.storage.organizationBilling.listPaidSeatUserIds(t)]);return{billing:f?{legacy:f.legacy,billingMode:f.billingMode,status:f.status,includedReportUrl:f.includedReportUrl}:null,paidSeatUserIds:l}}}),m1u=ui({name:"ORGANIZATION_SEATS_SET",description:"Set members' seats (paid/free). Invoiced organizations apply directly; self-serve organizations with an active subscription also charge the prorated difference on the saved card (preview it with ORGANIZATION_SEATS_PREVIEW first).",annotations:{title:"Set Organization Seats",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:Ll.object({seats:Ll.array(Ll.object({userId:Ll.string().min(1),seat:Ll.enum(["paid","free"])})).min(1).max(200)}),outputSchema:Ll.object({applied:Ll.array(Ll.object({userId:Ll.string(),seat:Ll.enum(["paid","free"])})),paidSeatCount:Ll.number(),benefitsSyncQueued:Ll.boolean()}),handler:async(i,u)=>{gi(u),await u.access.check();let t=u.organization?.id;if(!t)throw Error("Organization context required");let f=Wu(u);if(!f)throw Error("User ID required");let l=await u.storage.organizationBilling.getBilling(t);if(!l||l.legacy)throw Error("This organization is on the legacy plan \u2014 seats do not apply.");let E=CL(l)?l.stripeSubscriptionId:null,c;try{c=await u.storage.organizationBilling.setSeats(t,i.seats,f,{markBenefitsPending:gB()})}catch($){if($ instanceof Y6i)throw Error($.message);throw $}if(E)try{await zG0({subscriptionId:E,quantity:c.paidSeatCount})}catch($){let h=$ instanceof Tw?$.message:"Stripe update failed";throw Error(`Seats saved, but updating the subscription failed: ${h}. Apply again to retry the charge.`)}let w=!1;if(c.benefitsReferenceId)try{await eD(t,c.benefitsReferenceId,"apply"),w=!0}catch($){console.error("Failed to enqueue benefit sync (sweep covers):",$)}return{applied:c.applied,paidSeatCount:c.paidSeatCount,benefitsSyncQueued:w}}})});import{z as M2}from"zod";var e1u,a1u;var CG0=O(()=>{fn();Ml();fu();e1u=ui({name:"ORGANIZATION_BILLING_CHECKOUT_START",description:"Start the organization's seat subscription: creates a Stripe Checkout session for the current paid-seat count and returns its URL.",annotations:{title:"Start Billing Checkout",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!1,openWorldHint:!0},inputSchema:M2.object({}),outputSchema:M2.object({url:M2.string(),quantity:M2.number()}),handler:async(i,u)=>{gi(u),await u.access.check();let t=u.organization?.id,f=u.organization?.slug;if(!t||!f)throw Error("Organization context required");let[l,E]=await Promise.all([u.storage.organizationBilling.getBilling(t),u.storage.organizationBilling.listPaidSeatUserIds(t)]);if(!l||l.legacy)throw Error("This organization is on the legacy plan \u2014 no subscription needed.");if(l.billingMode!=="self_serve")throw Error("Contract-billed organizations do not use checkout.");if(l.status==="active")throw Error("This organization already has an active subscription \u2014 seat changes apply directly.");if(l.stripeSubscriptionId)throw Error("This organization still has a subscription on file \u2014 settle or cancel it before starting a new checkout.");let c=E.length;if(c<1)throw Error("Mark at least one member as a paid seat before subscribing.");let w=`${FE()}/${encodeURIComponent(f)}/members`,{url:$}=await SG0({organizationId:t,quantity:c,successUrl:`${w}?checkout=success`,cancelUrl:`${w}?checkout=canceled`});return{url:$,quantity:c}}}),a1u=ui({name:"ORGANIZATION_SEATS_PREVIEW",description:"Preview what the organization pays now for changing its paid-seat count (Stripe prorated invoice preview). Read-only \u2014 nothing is charged.",annotations:{title:"Preview Seat Change",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!0},inputSchema:M2.object({quantity:M2.number().int().min(1).max(1000)}),outputSchema:M2.object({amountDueCents:M2.number(),currency:M2.string()}),handler:async(i,u)=>{gi(u),await u.access.check();let t=u.organization?.id;if(!t)throw Error("Organization context required");let f=await u.storage.organizationBilling.getBilling(t);if(!CL(f))throw Error("Seat previews need an active self-serve subscription.");return await LG0({subscriptionId:f.stripeSubscriptionId,quantity:i.quantity})}})});import{z as nN}from"zod";var o1u,s1u;var MG0=O(()=>{fn();ML();Ml();fu();mB();o1u=ui({name:"ORGANIZATION_BILLING_PORTAL",description:"Open the organization's Stripe billing portal (manage card, invoices, cancellation). Returns the portal URL.",annotations:{title:"Open Billing Portal",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!1,openWorldHint:!0},inputSchema:nN.object({}),outputSchema:nN.object({url:nN.string()}),handler:async(i,u)=>{gi(u),await u.access.check();let t=Oi(u);if(!t.slug)throw Error("Organization context required");let f=await u.storage.organizationBilling.getBilling(t.id);if(!f?.stripeCustomerId)throw Error("This organization has no billing account yet \u2014 subscribe first.");if(f.legacy||f.billingMode!=="self_serve")throw Error("This organization's billing is managed by deco \u2014 contact support.");try{return await HG0({customerId:f.stripeCustomerId,returnUrl:`${FE()}/${encodeURIComponent(t.slug)}/members`})}catch(l){if(l instanceof Tw)throw Error(l.message);throw l}}}),s1u=ui({name:"ORGANIZATION_INCLUDED_REPORT_SET",description:"Choose which site's weekly report re-run the organization's subscription includes (null clears it).",annotations:{title:"Set Included Report Site",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:nN.object({url:nN.string().trim().min(1).max(255).nullable()}),outputSchema:nN.object({includedReportUrl:nN.string().nullable(),benefitsSyncQueued:nN.boolean()}),handler:async(i,u)=>{gi(u),await u.access.check();let t=Oi(u),f=await u.storage.organizationBilling.getBilling(t.id);if(!f||f.legacy)throw Error("This organization is on the legacy plan \u2014 included reports do not apply.");let l=i.url===null?null:L3i(i.url);if(i.url!==null&&!l)throw Error(`"${i.url}" is not a valid site URL.`);let{updated:E,benefitsReferenceId:c}=await u.storage.organizationBilling.setIncludedReportUrl(t.id,l,{markBenefitsPending:gB()});if(!E)throw Error("Organization billing row missing.");let w=!1;if(c)try{await eD(t.id,c,"apply"),w=!0}catch($){console.error("Failed to enqueue benefit sync (sweep covers):",$)}return{includedReportUrl:l,benefitsSyncQueued:w}}})});import{z as Ao}from"zod";function Mnf(i){return`[CREDITS] Paid report runs need at least $${(qG0/100).toFixed(2)} of AI credit balance \u2014 current balance is $${(i/100).toFixed(2)}. Top up and try again.`}var qG0=500,p1u;var VG0=O(()=>{pVi();fu();E8();D9();mB();p1u=ui({name:"ORGANIZATION_REPORT_RUN_PAID",description:"Trigger a paid report run for one of the organization's sites, billed against its AI credits (requires at least $5 of balance; the run's real cost plus markup is debited at completion).",annotations:{title:"Run Paid Report",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!1,openWorldHint:!0},inputSchema:Ao.object({url:Ao.string().trim().min(1).max(255).optional()}),outputSchema:Ao.object({url:Ao.string(),started:Ao.boolean()}),handler:async(i,u)=>{gi(u),await u.access.check();let t=Oi(u),f=Wu(u);if(!f)throw Error("User ID required");if(!pq())throw Error("Reports are not available on this deployment.");let l;if(i.url)l=L3i(i.url);else l=(await u.storage.organizationBilling.getBilling(t.id))?.includedReportUrl??null;if(!l)throw Error(i.url?`"${i.url}" is not a valid site URL.`:"No site chosen \u2014 pass a url or set the included report site first.");let E=x6().deco;if(!E?.getCreditsBalance)throw Error("AI credit balance is not available on this deployment.");let c=await Sd(f,u.auth.user?.email),{balanceCents:w}=await E.getCreditsBalance(c,t.id);if(!(w>=qG0))throw Error(Mnf(w??0));return await vu0({host:l,organizationId:t.id}),{url:l,started:!0}}})});var rG0=O(()=>{hG0();vG0();dG0();DG0();_G0();OG0();ZG0();FG0();TG0();UG0();yG0();xG0();kG0();jG0();XG0();JG0();KG0();bG0();CG0();MG0();VG0()});var y$="super-agent",mG0="task-board.item.updated",eG0="task-board.item.deleted";import{z as ef}from"zod";var yo,HK,Vnf,aG0,ln;var zK=O(()=>{yo=ef.enum(["triage","todo","in_progress","in_review","done"]),HK=ef.enum(["none","low","medium","high","urgent"]),Vnf=ef.object({threadId:ef.string(),virtualMcpId:ef.string().nullable(),status:ef.enum(["in_progress","requires_action","failed","completed","expired"]).nullable(),title:ef.string().nullable(),lastMessage:ef.string().nullable(),hasPreview:ef.boolean(),createdAt:ef.string()}),aG0=ef.object({url:ef.string(),number:ef.number(),repoOwner:ef.string(),repoName:ef.string(),createdAt:ef.string(),title:ef.string().nullable(),body:ef.string().nullable(),state:ef.enum(["open","closed"]).nullable(),draft:ef.boolean().nullable(),merged:ef.boolean().nullable()}),ln=ef.object({id:ef.string(),organizationId:ef.string(),title:ef.string(),description:ef.string().nullable(),status:yo,priority:HK,assigneeId:ef.string().nullable(),assignedBy:ef.string().nullable(),dueDate:ef.string().datetime().nullable(),threads:ef.array(Vnf),createdBy:ef.string(),createdAt:ef.string().datetime(),updatedBy:ef.string(),updatedAt:ef.string().datetime()})});async function pgi(i,u,t){if(t===y$)return;let{members:f}=await i.boundAuth.organization.listMembers({organizationId:u,filterField:"userId",filterValue:t});if(!f.some((l)=>l.userId===t))throw Error("assigneeId is not a member of the organization")}var ilu=O(()=>{zK()});async function ulu(i,u,t){let f;try{return await Promise.race([i.aiProviders.listModels(u,t),new Promise((E,c)=>{f=setTimeout(()=>c(Error("listModels timeout")),rnf)})])}finally{if(f)clearTimeout(f)}}function mnf(i,u){switch(i){case"fast":return u.chat.fast;case"smart":return u.chat.smart;case"thinking":return u.chat.thinking;case"image":return u.image;case"web_search":return u.webSearch;case"deep_research":return u.deepResearch}}function tlu(i,u,t){let f=i.find((l)=>l.modelId===u);return{title:f?.title??t??u,providerId:f?.providerId,capabilities:f?.capabilities,limits:f?.limits??null}}async function P$(i,u){let t=i.organization?.id;if(!t)throw Error("resolveTier called without an organization");let l=(await i.storage.organizationSettings.get(t))?.simple_mode?.tiers?.[u]??null,E=await i.storage.aiProviderKeys.list({organizationId:t});if(l&&E.some((v)=>v.id===l.keyId)){let v=await ulu(i,l.keyId,t).catch(()=>[]);return{credentialId:l.keyId,modelId:l.modelId,modelMeta:tlu(v,l.modelId,l.title)}}if(E.length===0)throw new En(u);let c={};await Promise.all(E.map(async(v)=>{c[v.id]=await ulu(i,v.id,t).catch(()=>[])}));let w=E.map((v)=>({id:v.id,providerId:v.providerId,label:v.label,presetId:v.presetId,createdBy:v.createdBy,createdAt:v.createdAt})),$=si0(w,c),h=mnf(u,$);if(!h)throw new En(u);return{credentialId:h.keyId,modelId:h.modelId,modelMeta:tlu(c[h.keyId]??[],h.modelId,h.title)}}async function oG0(i,u,t){let f=i.organization?.id;if(!f)throw Error("resolveSpecificModel called without an organization");let l=await ulu(i,u,f).catch(()=>[]);return{credentialId:u,modelId:t,modelMeta:tlu(l,t)}}async function Rh(i,u){try{return await P$(i,u)}catch(t){if(t instanceof En)return null;return console.warn(`[resolveTier] tier "${u}" resolution failed:`,t),null}}var En,rnf=5000;var nK=O(()=>{Ef();En=class En extends Error{tier;constructor(i){super(`No model available for tier "${i}". Connect a provider or configure the tier in organization settings.`);this.tier=i;this.name="TierUnavailableError"}}});function iTi(i){return i.sandboxProviderKind==="agent-sandbox"&&i.harnessId==="decopilot"}function sG0(i){return i.harnessId==="decopilot"&&(i.sandboxProviderKind==null||i.sandboxProviderKind==="agent-sandbox")}function anf(i){return{type:"data-run-status",id:"run-status",data:{stage:i}}}function pG0(i){if(!i||typeof i!=="object")return!1;return i.type==="data-run-status"}async function q2(i,u,t){if(!i)return;try{await i.publishRawChunk(u,anf(t))}catch{}}var enf,Po,k36;var Io=O(()=>{enf=["waiting-runner","starting-run","gathering-context","preparing-tools","starting-assistant","analyzing-scope"],Po=["gathering-context","preparing-tools","starting-assistant","analyzing-scope"],k36=new Set(enf)});function uTi(){return crypto.randomUUID()}var llu=Y((J36,tx0)=>{var{defineProperty:flu,getOwnPropertyDescriptor:onf,getOwnPropertyNames:snf}=Object,pnf=Object.prototype.hasOwnProperty,iRf=(i,u)=>{for(var t in u)flu(i,t,{get:u[t],enumerable:!0})},uRf=(i,u,t,f)=>{if(u&&typeof u==="object"||typeof u==="function"){for(let l of snf(u))if(!pnf.call(i,l)&&l!==t)flu(i,l,{get:()=>u[l],enumerable:!(f=onf(u,l))||f.enumerable})}return i},tRf=(i)=>uRf(flu({},"__esModule",{value:!0}),i),ix0={};iRf(ix0,{SYMBOL_FOR_REQ_CONTEXT:()=>ux0,getContext:()=>fRf});tx0.exports=tRf(ix0);var ux0=Symbol.for("@vercel/request-context");function fRf(){return globalThis[ux0]?.get?.()??{}}});var Go=Y((K36,Ex0)=>{var{defineProperty:Elu,getOwnPropertyDescriptor:lRf,getOwnPropertyNames:ERf}=Object,cRf=Object.prototype.hasOwnProperty,wRf=(i,u)=>{for(var t in u)Elu(i,t,{get:u[t],enumerable:!0})},$Rf=(i,u,t,f)=>{if(u&&typeof u==="object"||typeof u==="function"){for(let l of ERf(u))if(!cRf.call(i,l)&&l!==t)Elu(i,l,{get:()=>u[l],enumerable:!(f=lRf(u,l))||f.enumerable})}return i},hRf=(i)=>$Rf(Elu({},"__esModule",{value:!0}),i),fx0={};wRf(fx0,{VercelOidcTokenError:()=>lx0});Ex0.exports=hRf(fx0);class lx0 extends Error{constructor(i,u){super(i);this.name="VercelOidcTokenError",this.cause=u}toString(){if(this.cause)return`${this.name}: ${this.message}: ${this.cause}`;return`${this.name}: ${this.message}`}}});var hx0=Y((Y36,$x0)=>{var{create:vRf,defineProperty:tTi,getOwnPropertyDescriptor:dRf,getOwnPropertyNames:DRf,getPrototypeOf:_Rf}=Object,NRf=Object.prototype.hasOwnProperty,ORf=(i,u)=>{for(var t in u)tTi(i,t,{get:u[t],enumerable:!0})},cx0=(i,u,t,f)=>{if(u&&typeof u==="object"||typeof u==="function"){for(let l of DRf(u))if(!NRf.call(i,l)&&l!==t)tTi(i,l,{get:()=>u[l],enumerable:!(f=dRf(u,l))||f.enumerable})}return i},wlu=(i,u,t)=>(t=i!=null?vRf(_Rf(i)):{},cx0(u||!i||!i.__esModule?tTi(t,"default",{value:i,enumerable:!0}):t,i)),ZRf=(i)=>cx0(tTi({},"__esModule",{value:!0}),i),wx0={};ORf(wx0,{findRootDir:()=>gRf,getUserDataDir:()=>TRf});$x0.exports=ZRf(wx0);var xo=wlu(Fi("path")),BRf=wlu(Fi("fs")),clu=wlu(Fi("os")),FRf=Go();function gRf(){try{let i=process.cwd();while(i!==xo.default.dirname(i)){let u=xo.default.join(i,".vercel");if(BRf.default.existsSync(u))return i;i=xo.default.dirname(i)}}catch(i){throw new FRf.VercelOidcTokenError("Token refresh only supported in node server environments")}return null}function TRf(){if(process.env.XDG_DATA_HOME)return process.env.XDG_DATA_HOME;switch(clu.default.platform()){case"darwin":return xo.default.join(clu.default.homedir(),"Library/Application Support");case"linux":return xo.default.join(clu.default.homedir(),".local/share");case"win32":if(process.env.LOCALAPPDATA)return process.env.LOCALAPPDATA;return null;default:return null}}});var Zx0=Y((W36,Ox0)=>{var{create:URf,defineProperty:fTi,getOwnPropertyDescriptor:ARf,getOwnPropertyNames:yRf,getPrototypeOf:PRf}=Object,IRf=Object.prototype.hasOwnProperty,GRf=(i,u)=>{for(var t in u)fTi(i,t,{get:u[t],enumerable:!0})},vx0=(i,u,t,f)=>{if(u&&typeof u==="object"||typeof u==="function"){for(let l of yRf(u))if(!IRf.call(i,l)&&l!==t)fTi(i,l,{get:()=>u[l],enumerable:!(f=ARf(u,l))||f.enumerable})}return i},dx0=(i,u,t)=>(t=i!=null?URf(PRf(i)):{},vx0(u||!i||!i.__esModule?fTi(t,"default",{value:i,enumerable:!0}):t,i)),xRf=(i)=>vx0(fTi({},"__esModule",{value:!0}),i),Dx0={};GRf(Dx0,{isValidAccessToken:()=>JRf,readAuthConfig:()=>jRf,writeAuthConfig:()=>XRf});Ox0.exports=xRf(Dx0);var ko=dx0(Fi("fs")),_x0=dx0(Fi("path")),kRf=jo();function Nx0(){let i=(0,kRf.getVercelDataDir)();if(!i)throw Error(`Unable to find Vercel CLI data directory. Your platform: ${process.platform}. Supported: darwin, linux, win32.`);return _x0.join(i,"auth.json")}function jRf(){try{let i=Nx0();if(!ko.existsSync(i))return null;let u=ko.readFileSync(i,"utf8");if(!u)return null;return JSON.parse(u)}catch(i){return null}}function XRf(i){let u=Nx0(),t=_x0.dirname(u);if(!ko.existsSync(t))ko.mkdirSync(t,{mode:504,recursive:!0});ko.writeFileSync(u,JSON.stringify(i,null,2),{mode:384})}function JRf(i,u=0){if(!i.token)return!1;if(typeof i.expiresAt!=="number")return!0;let t=Math.floor(Date.now()/1000),f=u/1000;return i.expiresAt>=t+f}});var Tx0=Y((S36,gx0)=>{var{defineProperty:vlu,getOwnPropertyDescriptor:KRf,getOwnPropertyNames:YRf}=Object,WRf=Object.prototype.hasOwnProperty,SRf=(i,u)=>{for(var t in u)vlu(i,t,{get:u[t],enumerable:!0})},LRf=(i,u,t,f)=>{if(u&&typeof u==="object"||typeof u==="function"){for(let l of YRf(u))if(!WRf.call(i,l)&&l!==t)vlu(i,l,{get:()=>u[l],enumerable:!(f=KRf(u,l))||f.enumerable})}return i},QRf=(i)=>LRf(vlu({},"__esModule",{value:!0}),i),Bx0={};SRf(Bx0,{processTokenResponse:()=>bRf,refreshTokenRequest:()=>RRf});gx0.exports=QRf(Bx0);var $lu=Fi("os"),HRf="https://vercel.com",zRf="cl_HYyOPBNtFMfHhaUn9L4QPfTZz6TP47bp",Fx0=`@vercel/oidc node-${process.version} ${(0,$lu.platform)()} (${(0,$lu.arch)()}) ${(0,$lu.hostname)()}`,hlu=null;async function nRf(){if(hlu)return hlu;let i=`${HRf}/.well-known/openid-configuration`,u=await fetch(i,{headers:{"user-agent":Fx0}});if(!u.ok)throw Error("Failed to discover OAuth endpoints");let t=await u.json();if(!t||typeof t.token_endpoint!=="string")throw Error("Invalid OAuth discovery response");let f=t.token_endpoint;return hlu=f,f}async function RRf(i){let u=await nRf();return await fetch(u,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded","user-agent":Fx0},body:new URLSearchParams({client_id:zRf,grant_type:"refresh_token",...i})})}async function bRf(i){let u=await i.json();if(!i.ok){let t=typeof u==="object"&&u&&"error"in u?String(u.error):"Token refresh failed";return[Error(t)]}if(typeof u!=="object"||u===null)return[Error("Invalid token response")];if(typeof u.access_token!=="string")return[Error("Missing access_token in response")];if(u.token_type!=="Bearer")return[Error("Invalid token_type in response")];if(typeof u.expires_in!=="number")return[Error("Missing expires_in in response")];return[null,u]}});var Dlu=Y((L36,Px0)=>{var{defineProperty:dlu,getOwnPropertyDescriptor:CRf,getOwnPropertyNames:MRf}=Object,qRf=Object.prototype.hasOwnProperty,VRf=(i,u)=>{for(var t in u)dlu(i,t,{get:u[t],enumerable:!0})},rRf=(i,u,t,f)=>{if(u&&typeof u==="object"||typeof u==="function"){for(let l of MRf(u))if(!qRf.call(i,l)&&l!==t)dlu(i,l,{get:()=>u[l],enumerable:!(f=CRf(u,l))||f.enumerable})}return i},mRf=(i)=>rRf(dlu({},"__esModule",{value:!0}),i),Ux0={};VRf(Ux0,{AccessTokenMissingError:()=>Ax0,RefreshAccessTokenFailedError:()=>yx0});Px0.exports=mRf(Ux0);class Ax0 extends Error{constructor(){super("No authentication found. Please log in with the Vercel CLI (vercel login).");this.name="AccessTokenMissingError"}}class yx0 extends Error{constructor(i){super("Failed to refresh authentication token.",{cause:i});this.name="RefreshAccessTokenFailedError"}}});var jo=Y((Q36,jx0)=>{var{create:eRf,defineProperty:lTi,getOwnPropertyDescriptor:aRf,getOwnPropertyNames:oRf,getPrototypeOf:sRf}=Object,pRf=Object.prototype.hasOwnProperty,ibf=(i,u)=>{for(var t in u)lTi(i,t,{get:u[t],enumerable:!0})},Gx0=(i,u,t,f)=>{if(u&&typeof u==="object"||typeof u==="function"){for(let l of oRf(u))if(!pRf.call(i,l)&&l!==t)lTi(i,l,{get:()=>u[l],enumerable:!(f=aRf(u,l))||f.enumerable})}return i},xx0=(i,u,t)=>(t=i!=null?eRf(sRf(i)):{},Gx0(u||!i||!i.__esModule?lTi(t,"default",{value:i,enumerable:!0}):t,i)),ubf=(i)=>Gx0(lTi({},"__esModule",{value:!0}),i),kx0={};ibf(kx0,{assertVercelOidcTokenResponse:()=>_lu,findProjectInfo:()=>Ebf,getTokenPayload:()=>$bf,getVercelDataDir:()=>tbf,getVercelOidcToken:()=>lbf,getVercelToken:()=>fbf,isExpired:()=>hbf,loadToken:()=>wbf,saveToken:()=>cbf});jx0.exports=ubf(kx0);var Xo=xx0(Fi("path")),RK=xx0(Fi("fs")),$n=Go(),ETi=hx0(),cn=Zx0(),Ix0=Tx0(),wn=Dlu();function tbf(){let u=(0,ETi.getUserDataDir)();if(!u)return null;return Xo.join(u,"com.vercel.cli")}async function fbf(i){let u=(0,cn.readAuthConfig)();if(!u?.token)throw new wn.AccessTokenMissingError;if((0,cn.isValidAccessToken)(u,i?.expirationBufferMs))return u.token;if(!u.refreshToken)throw(0,cn.writeAuthConfig)({}),new wn.RefreshAccessTokenFailedError("No refresh token available");try{let t=await(0,Ix0.refreshTokenRequest)({refresh_token:u.refreshToken}),[f,l]=await(0,Ix0.processTokenResponse)(t);if(f||!l)throw(0,cn.writeAuthConfig)({}),new wn.RefreshAccessTokenFailedError(f);let E={token:l.access_token,expiresAt:Math.floor(Date.now()/1000)+l.expires_in};if(l.refresh_token)E.refreshToken=l.refresh_token;return(0,cn.writeAuthConfig)(E),E.token}catch(t){if((0,cn.writeAuthConfig)({}),t instanceof wn.AccessTokenMissingError||t instanceof wn.RefreshAccessTokenFailedError)throw t;throw new wn.RefreshAccessTokenFailedError(t)}}async function lbf(i,u,t){let f=`https://api.vercel.com/v1/projects/${u}/token?source=vercel-oidc-refresh${t?`&teamId=${t}`:""}`,l=await fetch(f,{method:"POST",headers:{Authorization:`Bearer ${i}`}});if(!l.ok)throw new $n.VercelOidcTokenError(`Failed to refresh OIDC token: ${l.statusText}`);let E=await l.json();return _lu(E),E}function _lu(i){if(!i||typeof i!=="object")throw TypeError("Vercel OIDC token is malformed. Expected an object. Please run `vc env pull` and try again");if(!("token"in i)||typeof i.token!=="string")throw TypeError("Vercel OIDC token is malformed. Expected a string-valued token property. Please run `vc env pull` and try again")}function Ebf(){let i=(0,ETi.findRootDir)();if(!i)throw new $n.VercelOidcTokenError("Unable to find project root directory. Have you linked your project with `vc link?`");let u=Xo.join(i,".vercel","project.json");if(!RK.existsSync(u))throw new $n.VercelOidcTokenError("project.json not found, have you linked your project with `vc link?`");let t=JSON.parse(RK.readFileSync(u,"utf8"));if(typeof t.projectId!=="string"&&typeof t.orgId!=="string")throw TypeError("Expected a string-valued projectId property. Try running `vc link` to re-link your project.");return{projectId:t.projectId,teamId:t.orgId}}function cbf(i,u){let t=(0,ETi.getUserDataDir)();if(!t)throw new $n.VercelOidcTokenError("Unable to find user data directory. Please reach out to Vercel support.");let f=Xo.join(t,"com.vercel.token",`${u}.json`),l=JSON.stringify(i);RK.mkdirSync(Xo.dirname(f),{mode:504,recursive:!0}),RK.writeFileSync(f,l),RK.chmodSync(f,432);return}function wbf(i){let u=(0,ETi.getUserDataDir)();if(!u)throw new $n.VercelOidcTokenError("Unable to find user data directory. Please reach out to Vercel support.");let t=Xo.join(u,"com.vercel.token",`${i}.json`);if(!RK.existsSync(t))return null;let f=JSON.parse(RK.readFileSync(t,"utf8"));return _lu(f),f}function $bf(i){let u=i.split(".");if(u.length!==3)throw new $n.VercelOidcTokenError("Invalid token. Please run `vc env pull` and try again");let t=u[1].replace(/-/g,"+").replace(/_/g,"/"),f=t.padEnd(t.length+(4-t.length%4)%4,"=");return JSON.parse(Buffer.from(f,"base64").toString("utf8"))}function hbf(i,u=0){return i.exp*1000<Date.now()+u}});var Yx0=Y((H36,Kx0)=>{var{defineProperty:Nlu,getOwnPropertyDescriptor:vbf,getOwnPropertyNames:dbf}=Object,Dbf=Object.prototype.hasOwnProperty,_bf=(i,u)=>{for(var t in u)Nlu(i,t,{get:u[t],enumerable:!0})},Nbf=(i,u,t,f)=>{if(u&&typeof u==="object"||typeof u==="function"){for(let l of dbf(u))if(!Dbf.call(i,l)&&l!==t)Nlu(i,l,{get:()=>u[l],enumerable:!(f=vbf(u,l))||f.enumerable})}return i},Obf=(i)=>Nbf(Nlu({},"__esModule",{value:!0}),i),Jx0={};_bf(Jx0,{refreshToken:()=>Zbf});Kx0.exports=Obf(Jx0);var Xx0=Go(),RN=jo();async function Zbf(i){let u=i?.project,t=i?.team;if(!u&&!t){let l=(0,RN.findProjectInfo)();u=l.projectId,t=l.teamId}else if(!u||!t){let l=(0,RN.findProjectInfo)();u=u??l.projectId,t=t??l.teamId}if(!u)throw new Xx0.VercelOidcTokenError("Failed to refresh OIDC token: No project specified. Try re-linking your project with `vc link`");let f=(0,RN.loadToken)(u);if(!f||(0,RN.isExpired)((0,RN.getTokenPayload)(f.token),i?.expirationBufferMs)){let l=await(0,RN.getVercelToken)({expirationBufferMs:i?.expirationBufferMs});if(f=await(0,RN.getVercelOidcToken)(l,u,t),!f)throw new Xx0.VercelOidcTokenError("Failed to refresh OIDC token");(0,RN.saveToken)(f,u)}process.env.VERCEL_OIDC_TOKEN=f.token;return}});var Lx0=Y((z36,Sx0)=>{var{defineProperty:Zlu,getOwnPropertyDescriptor:Bbf,getOwnPropertyNames:Fbf}=Object,gbf=Object.prototype.hasOwnProperty,Tbf=(i,u)=>{for(var t in u)Zlu(i,t,{get:u[t],enumerable:!0})},Ubf=(i,u,t,f)=>{if(u&&typeof u==="object"||typeof u==="function"){for(let l of Fbf(u))if(!gbf.call(i,l)&&l!==t)Zlu(i,l,{get:()=>u[l],enumerable:!(f=Bbf(u,l))||f.enumerable})}return i},Abf=(i)=>Ubf(Zlu({},"__esModule",{value:!0}),i),Wx0={};Tbf(Wx0,{getVercelOidcToken:()=>Ibf,getVercelOidcTokenSync:()=>Olu});Sx0.exports=Abf(Wx0);var ybf=llu(),Pbf=Go();async function Ibf(i){let u="",t;try{u=Olu()}catch(f){t=f}try{let[{getTokenPayload:f,isExpired:l},{refreshToken:E}]=await Promise.all([await Promise.resolve().then(() => j(jo())),await Promise.resolve().then(() => j(Yx0()))]);if(!u||l(f(u),i?.expirationBufferMs))await E(i),u=Olu()}catch(f){let l=t instanceof Error?t.message:"";if(f instanceof Error)l=`${l}
 ${f.message}`;if(l)throw new Pbf.VercelOidcTokenError(l);throw f}return u}function Olu(){let i=(0,ybf.getContext)().headers?.["x-vercel-oidc-token"]??process.env.VERCEL_OIDC_TOKEN;if(!i)throw Error("The 'x-vercel-oidc-token' header is missing from the request. Do you have the OIDC option enabled in the Vercel project settings?");return i}});var Flu=Y((n36,nx0)=>{var{defineProperty:Blu,getOwnPropertyDescriptor:Gbf,getOwnPropertyNames:xbf}=Object,kbf=Object.prototype.hasOwnProperty,jbf=(i,u)=>{for(var t in u)Blu(i,t,{get:u[t],enumerable:!0})},Xbf=(i,u,t,f)=>{if(u&&typeof u==="object"||typeof u==="function"){for(let l of xbf(u))if(!kbf.call(i,l)&&l!==t)Blu(i,l,{get:()=>u[l],enumerable:!(f=Gbf(u,l))||f.enumerable})}return i},Jbf=(i)=>Xbf(Blu({},"__esModule",{value:!0}),i),zx0={};jbf(zx0,{AccessTokenMissingError:()=>Hx0.AccessTokenMissingError,RefreshAccessTokenFailedError:()=>Hx0.RefreshAccessTokenFailedError,getContext:()=>Kbf.getContext,getVercelOidcToken:()=>Qx0.getVercelOidcToken,getVercelOidcTokenSync:()=>Qx0.getVercelOidcTokenSync,getVercelToken:()=>Ybf.getVercelToken});nx0.exports=Jbf(zx0);var Qx0=Lx0(),Kbf=llu(),Hx0=Dlu(),Ybf=jo()});import{z as V2}from"zod/v4";import{z as sx0}from"zod/v4";import{z as Tlu}from"zod/v4";import{z as Hl}from"zod/v4";import{z as j6}from"zod/v4";import{z as Ql}from"zod/v4";import{z as cTi}from"zod/v4";import{z as x1}from"zod/v4";import{z as i1}from"zod/v4";import{z as pt}from"zod/v4";import{z as Q1}from"zod/v4";import{z as d4}from"zod";import{z as w4}from"zod";async function Ok0({response:i,statusCode:u,defaultMessage:t="Gateway request failed",cause:f,authMethod:l}){var E;let c=await _l({value:i,schema:abf});if(!c.success){let d=typeof i==="object"&&i!==null&&"generationId"in i?i.generationId:void 0;return new ebf({message:`Invalid error response format: ${t}`,statusCode:u,response:i,validationError:c.error,cause:f,generationId:d})}let w=c.value,$=w.error.type,h=w.error.message,v=(E=w.generationId)!=null?E:void 0;switch($){case"authentication_error":return wTi.createContextualError({apiKeyProvided:l==="api-key",oidcTokenProvided:l==="oidc",statusCode:u,cause:f,generationId:v});case"invalid_request_error":return new Qbf({message:h,statusCode:u,cause:f,generationId:v});case"rate_limit_exceeded":return new zbf({message:h,statusCode:u,cause:f,generationId:v});case"model_not_found":{let d=await _l({value:w.error.param,schema:Rbf});return new bbf({message:h,statusCode:u,modelId:d.success?d.value.modelId:void 0,cause:f,generationId:v})}case"internal_server_error":return new Ek0({message:h,statusCode:u,cause:f,generationId:v});case"failed_dependency":return new qbf({message:h,statusCode:u,cause:f,generationId:v});case"forbidden":return new rbf({message:h,statusCode:u,cause:f,generationId:v});default:return new Ek0({message:h,statusCode:u,cause:f,generationId:v})}}function obf(i){if(i.data!==void 0)return i.data;if(i.responseBody!=null)try{return JSON.parse(i.responseBody)}catch(u){return i.responseBody}return{}}function Tk0(i){if(!(i instanceof Error))return!1;let u=i.code;if(typeof u==="string")return["UND_ERR_HEADERS_TIMEOUT","UND_ERR_BODY_TIMEOUT","UND_ERR_CONNECT_TIMEOUT"].includes(u);return!1}async function Uw(i,u){var t;if(zl.isInstance(i))return i;if(Tk0(i))return gk0.createTimeoutError({originalMessage:i instanceof Error?i.message:"Unknown error",cause:i});if(Nt.isInstance(i)){if(i.cause&&Tk0(i.cause))return gk0.createTimeoutError({originalMessage:i.message,cause:i});return await Ok0({response:obf(i),statusCode:(t=i.statusCode)!=null?t:500,defaultMessage:"Gateway request failed",cause:i,authMethod:u})}return await Ok0({response:{},statusCode:500,defaultMessage:i instanceof Error?`Gateway request failed: ${i.message}`:"Unknown Gateway error",cause:i,authMethod:u})}async function Z8(i){let u=await _l({value:i[Kk0],schema:pbf});return u.success?u.value:void 0}function Ak0(i){if(i.type==="file"&&i.data instanceof Uint8Array)return{...i,data:lw(i.data)};return i}function BCf(i){if(i.type==="file"&&i.data instanceof Uint8Array)return{...i,data:lw(i.data)};return i}async function WCf(){var i;return(i=Yk0.getContext().headers)==null?void 0:i["x-vercel-id"]}function Ulu(i={}){var u,t;let f=null,l=null,E=(u=i.metadataCacheRefreshMillis)!=null?u:300000,c=0,w=(t=o9(i.baseURL))!=null?t:"https://ai-gateway.vercel.sh/v3/ai",$=async()=>{try{let g=await QCf(i);return c4({Authorization:`Bearer ${g.token}`,"ai-gateway-protocol-version":LCf,[Kk0]:g.authMethod,...i.headers},`ai-sdk/gateway/${SCf}`)}catch(g){throw wTi.createContextualError({apiKeyProvided:!1,oidcTokenProvided:!1,statusCode:401,cause:g})}},h=()=>{let g=rd({settingValue:void 0,environmentVariableName:"VERCEL_DEPLOYMENT_ID"}),T=rd({settingValue:void 0,environmentVariableName:"VERCEL_ENV"}),U=rd({settingValue:void 0,environmentVariableName:"VERCEL_REGION"}),A=rd({settingValue:void 0,environmentVariableName:"VERCEL_PROJECT_ID"});return async()=>{let I=await WCf();return{...g&&{"ai-o11y-deployment-id":g},...T&&{"ai-o11y-environment":T},...U&&{"ai-o11y-region":U},...I&&{"ai-o11y-request-id":I},...A&&{"ai-o11y-project-id":A}}}},v=(g)=>{return new wCf(g,{provider:"gateway",baseURL:w,headers:$,fetch:i.fetch,o11yHeaders:h()})},d=async()=>{var g,T,U;let A=(U=(T=(g=i._internal)==null?void 0:g.currentDate)==null?void 0:T.call(g).getTime())!=null?U:Date.now();if(!f||A-c>E)c=A,f=new Uk0({baseURL:w,headers:$,fetch:i.fetch}).getAvailableModels().then((I)=>{return l=I,I}).catch(async(I)=>{throw await Uw(I,await Z8(await $()))});return l?Promise.resolve(l):f},D=async()=>{return new Uk0({baseURL:w,headers:$,fetch:i.fetch}).getCredits().catch(async(g)=>{throw await Uw(g,await Z8(await $()))})},_=async(g)=>{return new fCf({baseURL:w,headers:$,fetch:i.fetch}).getSpendReport(g).catch(async(T)=>{throw await Uw(T,await Z8(await $()))})},N=async(g)=>{return new ECf({baseURL:w,headers:$,fetch:i.fetch}).getGenerationInfo(g).catch(async(T)=>{throw await Uw(T,await Z8(await $()))})},Z=function(g){if(new.target)throw Error("The Gateway Provider model function cannot be called with the new keyword.");return v(g)};Z.specificationVersion="v3",Z.getAvailableModels=d,Z.getCredits=D,Z.getSpendReport=_,Z.getGenerationInfo=N,Z.imageModel=(g)=>{return new dCf(g,{provider:"gateway",baseURL:w,headers:$,fetch:i.fetch,o11yHeaders:h()})},Z.languageModel=v;let B=(g)=>{return new $Cf(g,{provider:"gateway",baseURL:w,headers:$,fetch:i.fetch,o11yHeaders:h()})};Z.embeddingModel=B,Z.textEmbeddingModel=B,Z.videoModel=(g)=>{return new ZCf(g,{provider:"gateway",baseURL:w,headers:$,fetch:i.fetch,o11yHeaders:h()})};let F=(g)=>{return new ACf(g,{provider:"gateway",baseURL:w,headers:$,fetch:i.fetch,o11yHeaders:h()})};return Z.rerankingModel=F,Z.reranking=F,Z.chat=Z.languageModel,Z.embedding=Z.embeddingModel,Z.image=Z.imageModel,Z.video=Z.videoModel,Z.tools=YCf,Z}async function QCf(i){let u=rd({settingValue:i.apiKey,environmentVariableName:"AI_GATEWAY_API_KEY"});if(u)return{token:u,authMethod:"api-key"};return{token:await Wk0.getVercelOidcToken(),authMethod:"oidc"}}var Yk0,Wk0,Wbf="vercel.ai.gateway.error",glu,Rx0,bx0,zl,yk0="GatewayAuthenticationError",Sbf,Cx0,Mx0,qx0,wTi,Pk0="GatewayInvalidRequestError",Lbf,Vx0,rx0,mx0,Qbf,Ik0="GatewayRateLimitError",Hbf,ex0,ax0,ox0,zbf,Gk0="GatewayModelNotFoundError",nbf,px0,Rbf,ik0,uk0,bbf,xk0="GatewayInternalServerError",Cbf,tk0,fk0,lk0,Ek0,kk0="GatewayFailedDependencyError",Mbf,ck0,wk0,$k0,qbf,jk0="GatewayForbiddenError",Vbf,hk0,vk0,dk0,rbf,Xk0="GatewayResponseError",mbf,Dk0,_k0,Nk0,ebf,abf,Jk0="GatewayTimeoutError",sbf,Zk0,Bk0,Fk0,gk0,Kk0="ai-gateway-auth-method",pbf,iCf,Uk0=class{constructor(i){this.config=i}async getAvailableModels(){try{let{value:i}=await v$({url:`${this.config.baseURL}/config`,headers:await R0(this.config.headers()),successfulResponseHandler:ht(uCf),failedResponseHandler:S1({errorSchema:Hl.any(),errorToMessage:(u)=>u}),fetch:this.config.fetch});return i}catch(i){throw await Uw(i)}}async getCredits(){try{let i=new URL(this.config.baseURL),{value:u}=await v$({url:`${i.origin}/v1/credits`,headers:await R0(this.config.headers()),successfulResponseHandler:ht(tCf),failedResponseHandler:S1({errorSchema:Hl.any(),errorToMessage:(t)=>t}),fetch:this.config.fetch});return u}catch(i){throw await Uw(i)}}},uCf,tCf,fCf=class{constructor(i){this.config=i}async getSpendReport(i){try{let u=new URL(this.config.baseURL),t=new URLSearchParams;if(t.set("start_date",i.startDate),t.set("end_date",i.endDate),i.groupBy)t.set("group_by",i.groupBy);if(i.datePart)t.set("date_part",i.datePart);if(i.userId)t.set("user_id",i.userId);if(i.model)t.set("model",i.model);if(i.provider)t.set("provider",i.provider);if(i.credentialType)t.set("credential_type",i.credentialType);if(i.tags&&i.tags.length>0)t.set("tags",i.tags.join(","));let{value:f}=await v$({url:`${u.origin}/v1/report?${t.toString()}`,headers:await R0(this.config.headers()),successfulResponseHandler:ht(lCf),failedResponseHandler:S1({errorSchema:j6.any(),errorToMessage:(l)=>l}),fetch:this.config.fetch});return f}catch(u){throw await Uw(u)}}},lCf,ECf=class{constructor(i){this.config=i}async getGenerationInfo(i){try{let u=new URL(this.config.baseURL),{value:t}=await v$({url:`${u.origin}/v1/generation?id=${encodeURIComponent(i.id)}`,headers:await R0(this.config.headers()),successfulResponseHandler:ht(cCf),failedResponseHandler:S1({errorSchema:Ql.any(),errorToMessage:(f)=>f}),fetch:this.config.fetch});return t}catch(u){throw await Uw(u)}}},cCf,wCf=class{constructor(i,u){this.modelId=i,this.config=u,this.specificationVersion="v3",this.supportedUrls={"*/*":[/.*/]}}get provider(){return this.config.provider}async getArgs(i){let{abortSignal:u,...t}=i;return{args:this.maybeEncodeFileParts(t),warnings:[]}}async doGenerate(i){let{args:u,warnings:t}=await this.getArgs(i),{abortSignal:f}=i,l=await R0(this.config.headers());try{let{responseHeaders:E,value:c,rawValue:w}=await Tt({url:this.getUrl(),headers:ut(l,i.headers,this.getModelConfigHeaders(this.modelId,!1),await R0(this.config.o11yHeaders)),body:u,successfulResponseHandler:ht(cTi.any()),failedResponseHandler:S1({errorSchema:cTi.any(),errorToMessage:($)=>$}),...f&&{abortSignal:f},fetch:this.config.fetch});return{...c,request:{body:u},response:{headers:E,body:w},warnings:t}}catch(E){throw await Uw(E,await Z8(l))}}async doStream(i){let{args:u,warnings:t}=await this.getArgs(i),{abortSignal:f}=i,l=await R0(this.config.headers());try{let{value:E,responseHeaders:c}=await Tt({url:this.getUrl(),headers:ut(l,i.headers,this.getModelConfigHeaders(this.modelId,!0),await R0(this.config.o11yHeaders)),body:u,successfulResponseHandler:Fc(cTi.any()),failedResponseHandler:S1({errorSchema:cTi.any(),errorToMessage:(w)=>w}),...f&&{abortSignal:f},fetch:this.config.fetch});return{stream:E.pipeThrough(new TransformStream({start(w){if(t.length>0)w.enqueue({type:"stream-start",warnings:t})},transform(w,$){if(w.success){let h=w.value;if(h.type==="raw"&&!i.includeRawChunks)return;if(h.type==="response-metadata"&&h.timestamp&&typeof h.timestamp==="string")h.timestamp=new Date(h.timestamp);$.enqueue(h)}else $.error(w.error)}})),request:{body:u},response:{headers:c}}}catch(E){throw await Uw(E,await Z8(l))}}isFilePart(i){return i&&typeof i==="object"&&"type"in i&&i.type==="file"}maybeEncodeFileParts(i){for(let u of i.prompt)for(let t of u.content)if(this.isFilePart(t)){let f=t;if(f.data instanceof Uint8Array){let l=Uint8Array.from(f.data),E=Buffer.from(l).toString("base64");f.data=new URL(`data:${f.mediaType||"application/octet-stream"};base64,${E}`)}}return i}getUrl(){return`${this.config.baseURL}/language-model`}getModelConfigHeaders(i,u){return{"ai-language-model-specification-version":"3","ai-language-model-id":i,"ai-language-model-streaming":String(u)}}},$Cf=class{constructor(i,u){this.modelId=i,this.config=u,this.specificationVersion="v3",this.maxEmbeddingsPerCall=2048,this.supportsParallelCalls=!0}get provider(){return this.config.provider}async doEmbed({values:i,headers:u,abortSignal:t,providerOptions:f}){var l,E;let c=await R0(this.config.headers());try{let{responseHeaders:w,value:$,rawValue:h}=await Tt({url:this.getUrl(),headers:ut(c,u!=null?u:{},this.getModelConfigHeaders(),await R0(this.config.o11yHeaders)),body:{values:i,...f?{providerOptions:f}:{}},successfulResponseHandler:ht(vCf),failedResponseHandler:S1({errorSchema:x1.any(),errorToMessage:(v)=>v}),...t&&{abortSignal:t},fetch:this.config.fetch});return{embeddings:$.embeddings,usage:(l=$.usage)!=null?l:void 0,providerMetadata:$.providerMetadata,response:{headers:w,body:h},warnings:(E=$.warnings)!=null?E:[]}}catch(w){throw await Uw(w,await Z8(c))}}getUrl(){return`${this.config.baseURL}/embedding-model`}getModelConfigHeaders(){return{"ai-embedding-model-specification-version":"3","ai-model-id":this.modelId}}},hCf,vCf,dCf=class{constructor(i,u){this.modelId=i,this.config=u,this.specificationVersion="v3",this.maxImagesPerCall=Number.MAX_SAFE_INTEGER}get provider(){return this.config.provider}async doGenerate({prompt:i,n:u,size:t,aspectRatio:f,seed:l,files:E,mask:c,providerOptions:w,headers:$,abortSignal:h}){var v,d,D,_;let N=await R0(this.config.headers());try{let{responseHeaders:Z,value:B,rawValue:F}=await Tt({url:this.getUrl(),headers:ut(N,$!=null?$:{},this.getModelConfigHeaders(),await R0(this.config.o11yHeaders)),body:{prompt:i,n:u,...t&&{size:t},...f&&{aspectRatio:f},...l&&{seed:l},...w&&{providerOptions:w},...E&&{files:E.map((g)=>Ak0(g))},...c&&{mask:Ak0(c)}},successfulResponseHandler:ht(OCf),failedResponseHandler:S1({errorSchema:i1.any(),errorToMessage:(g)=>g}),...h&&{abortSignal:h},fetch:this.config.fetch});return{images:B.images,warnings:(v=B.warnings)!=null?v:[],providerMetadata:B.providerMetadata,response:{timestamp:new Date,modelId:this.modelId,headers:Z},...B.usage!=null&&{usage:{inputTokens:(d=B.usage.inputTokens)!=null?d:void 0,outputTokens:(D=B.usage.outputTokens)!=null?D:void 0,totalTokens:(_=B.usage.totalTokens)!=null?_:void 0}}}}catch(Z){throw await Uw(Z,await Z8(N))}}getUrl(){return`${this.config.baseURL}/image-model`}getModelConfigHeaders(){return{"ai-image-model-specification-version":"3","ai-model-id":this.modelId}}},DCf,_Cf,NCf,OCf,ZCf=class{constructor(i,u){this.modelId=i,this.config=u,this.specificationVersion="v3",this.maxVideosPerCall=Number.MAX_SAFE_INTEGER}get provider(){return this.config.provider}async doGenerate({prompt:i,n:u,aspectRatio:t,resolution:f,duration:l,fps:E,seed:c,image:w,providerOptions:$,headers:h,abortSignal:v}){var d;let D=await R0(this.config.headers());try{let{responseHeaders:_,value:N}=await Tt({url:this.getUrl(),headers:ut(D,h!=null?h:{},this.getModelConfigHeaders(),await R0(this.config.o11yHeaders),{accept:"text/event-stream"}),body:{prompt:i,n:u,...t&&{aspectRatio:t},...f&&{resolution:f},...l&&{duration:l},...E&&{fps:E},...c&&{seed:c},...$&&{providerOptions:$},...w&&{image:BCf(w)}},successfulResponseHandler:async({response:Z,url:B,requestBodyValues:F})=>{if(Z.body==null)throw new Nt({message:"SSE response body is empty",url:B,requestBodyValues:F,statusCode:Z.status});let T=U2({stream:Z.body,schema:UCf}).getReader(),{done:U,value:A}=await T.read();if(T.releaseLock(),U||!A)throw new Nt({message:"SSE stream ended without a data event",url:B,requestBodyValues:F,statusCode:Z.status});if(!A.success)throw new Nt({message:"Failed to parse video SSE event",cause:A.error,url:B,requestBodyValues:F,statusCode:Z.status});let I=A.value;if(I.type==="error")throw new Nt({message:I.message,statusCode:I.statusCode,url:B,requestBodyValues:F,responseHeaders:Object.fromEntries([...Z.headers]),responseBody:JSON.stringify(I),data:{error:{message:I.message,type:I.errorType,param:I.param}}});return{value:{videos:I.videos,warnings:I.warnings,providerMetadata:I.providerMetadata},responseHeaders:Object.fromEntries([...Z.headers])}},failedResponseHandler:S1({errorSchema:pt.any(),errorToMessage:(Z)=>Z}),...v&&{abortSignal:v},fetch:this.config.fetch});return{videos:N.videos,warnings:(d=N.warnings)!=null?d:[],providerMetadata:N.providerMetadata,response:{timestamp:new Date,modelId:this.modelId,headers:_}}}catch(_){throw await Uw(_,await Z8(D))}}getUrl(){return`${this.config.baseURL}/video-model`}getModelConfigHeaders(){return{"ai-video-model-specification-version":"3","ai-model-id":this.modelId}}},FCf,gCf,TCf,UCf,ACf=class{constructor(i,u){this.modelId=i,this.config=u,this.specificationVersion="v3"}get provider(){return this.config.provider}async doRerank({documents:i,query:u,topN:t,headers:f,abortSignal:l,providerOptions:E}){var c;let w=await R0(this.config.headers());try{let{responseHeaders:$,value:h,rawValue:v}=await Tt({url:this.getUrl(),headers:ut(w,f!=null?f:{},this.getModelConfigHeaders(),await R0(this.config.o11yHeaders)),body:{documents:i,query:u,...t!=null?{topN:t}:{},...E?{providerOptions:E}:{}},successfulResponseHandler:ht(PCf),failedResponseHandler:S1({errorSchema:Q1.any(),errorToMessage:(d)=>d}),...l&&{abortSignal:l},fetch:this.config.fetch});return{ranking:h.ranking,providerMetadata:h.providerMetadata,response:{headers:$,body:v},warnings:(c=h.warnings)!=null?c:[]}}catch($){throw await Uw($,await Z8(w))}}getUrl(){return`${this.config.baseURL}/reranking-model`}getModelConfigHeaders(){return{"ai-reranking-model-specification-version":"3","ai-model-id":this.modelId}}},yCf,PCf,ICf,GCf,xCf,kCf=(i={})=>xCf(i),jCf,XCf,JCf,KCf=(i={})=>JCf(i),YCf,SCf="3.0.133",LCf="0.0.1",$Ti;var Jo=O(()=>{uu();eu();uu();uu();uu();uu();uu();uu();uu();uu();uu();eu();uu();uu();uu();uu();Yk0=j(Flu(),1),Wk0=j(Flu(),1),glu=Symbol.for(Wbf),zl=class i extends(bx0=Error,Rx0=glu,bx0){constructor({message:u,statusCode:t=500,cause:f,generationId:l,isRetryable:E=t!=null&&(t===408||t===409||t===429||t>=500)}){super(l?`${u} [${l}]`:u);this[Rx0]=!0,this.statusCode=t,this.cause=f,this.generationId=l,this.isRetryable=E}static isInstance(u){return i.hasMarker(u)}static hasMarker(u){return typeof u==="object"&&u!==null&&glu in u&&u[glu]===!0}},Sbf=`vercel.ai.gateway.error.${yk0}`,Cx0=Symbol.for(Sbf),wTi=class i extends(qx0=zl,Mx0=Cx0,qx0){constructor({message:u="Authentication failed",statusCode:t=401,cause:f,generationId:l}={}){super({message:u,statusCode:t,cause:f,generationId:l});this[Mx0]=!0,this.name=yk0,this.type="authentication_error"}static isInstance(u){return zl.hasMarker(u)&&Cx0 in u}static createContextualError({apiKeyProvided:u,oidcTokenProvided:t,message:f="Authentication failed",statusCode:l=401,cause:E,generationId:c}){let w;if(u)w=`AI Gateway authentication failed: Invalid API key.
 
 Create a new API key: https://vercel.com/d?to=%2F%5Bteam%5D%2F%7E%2Fai%2Fapi-keys