decocms 4.126.1 → 4.126.2

package/dist/server/cli.js

@@ -174,7 +174,7 @@ Reference: https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-sso.ht
   Then retry.`);console.error(`[ensurePostgres] pg.initialise() failed. dataDir=${f}`,v);let D=Mw(i,"postgres");if(D&&mc(D.pid,"postgres"))return u.state="running",u.pid=D.pid,u.port=D.port,u.owner="managed",u;throw v}await w.start();try{await w.createDatabase(Fbu)}catch(v){if(!(v instanceof Error?v.message:String(v)).includes("already exists"))throw v}await gM(E);let h=null;if(L3(l)){let v=BM(l,"utf8").split(`
 `)[0]?.trim();if(v)h=Number.parseInt(v,10)}if(h)j1i(i,"postgres",{pid:h,port:E,startedAt:new Date().toISOString()}),u.pid=h;return u.state="running",u.owner="managed",u}async function lSt(i){let u=Mw(i,"postgres");if(u===null){console.log("PostgreSQL: not running");return}let{pid:t,port:f}=u;if(!R6(t)){console.log("PostgreSQL: process already dead, cleaning up state"),await Gl(i,"postgres");return}if(!mc(t,"postgres")){console.log(`PostgreSQL: PID ${t} no longer belongs to postgres (possible PID reuse), cleaning up state`),await Gl(i,"postgres");return}console.log(`PostgreSQL: stopping (PID ${t}, port ${f})...`);let l=L4(Q3(i),"postgres","data");try{await new(await import("embedded-postgres")).default({databaseDir:l,port:f,user:Azi,password:yzi,persistent:!0}).stop()}catch{console.log("PostgreSQL: embedded-postgres stop failed, sending SIGTERM...");try{if(!mc(t,"postgres"))console.log(`PostgreSQL: PID ${t} is no longer postgres, skipping signal`);else{process.kill(t,"SIGTERM");let E=Date.now();while(Date.now()-E<5000&&R6(t))await y0(200);if(R6(t)&&mc(t,"postgres"))process.kill(t,"SIGKILL")}}catch{}}await Gl(i,"postgres"),console.log("PostgreSQL stopped")}function ESt(){let i=k1i(),u=Uzi(),t={darwin:"darwin",linux:"linux",win32:"windows"},f={arm64:"arm64",x64:"amd64"},l=t[i],E=f[u];if(!l||!E)throw Error(`Unsupported platform: ${i}/${u}`);return`nats-server-${gbu}-${l}-${E}.${l==="windows"?"zip":"tar.gz"}`}function cSt(i){return L4(Q3(i),"nats","bin",`nats-server${Izi}`)}async function wSt(i){let u=cSt(i);if(L3(u))return u;let t=L4(Q3(i),"nats","bin");jD(t);let f=ESt(),l=`https://github.com/nats-io/nats-server/releases/download/${gbu}/${f}`,E=await fetch(l);if(!E.ok)throw Error(`Failed to download NATS: ${E.status} ${E.statusText}`);let c=L4(t,f),w=await E.arrayBuffer();mS(c,Buffer.from(w));let $=L4(t,f.replace(/\.(zip|tar\.gz)$/,""));if(F5)await Bun.spawn(["powershell","-Command",`Expand-Archive -Path '${c}' -DestinationPath '${t}' -Force`]).exited;else await Bun.spawn(["tar","-xzf",c,"-C",t]).exited;if(!L3(u)){let h=L4($,`nats-server${Izi}`);if(L3(h))Obu(h,u)}if(rWt($,{recursive:!0,force:!0}),await Bbu(c).catch(()=>{}),!F5)await Zbu(u,493);if(!L3(u))throw Error(`NATS binary not found at ${u} after extraction`);return u}function TM(i){return L4(Q3(i),"nats","jwt")}function $St(i){return L4(TM(i),"keys.json")}function dbu(i){return L4(TM(i),"nats-server.conf")}function hSt(i){return L4(TM(i),"cluster.creds")}function vSt(i){let u=$St(i);if(L3(u))try{let f=JSON.parse(BM(u,"utf8"));if(B_u(f))return f}catch{}let t=Z_u();return jD(TM(i)),mS(u,JSON.stringify(t,null,2),{mode:384}),t}function Dbu(i,u,t){return{publicUrl:`nats://127.0.0.1:${u}`,accountJwt:i.tunnelAccountJwt,accountSigningKey:i.tunnelSigningSeed,operatorJwt:i.operatorJwt,credsPath:t}}async function dSt(i){let u={name:"NATS",state:"stopped",pid:null,port:0,owner:"none"},t=vSt(i),f=await F_u(t),l=hSt(i),E=gui()?"0.0.0.0":"127.0.0.1",c=Mw(i,"nats");if(c!==null)if(mc(c.pid,"nats-server")){if(E==="127.0.0.1")return u.state="running",u.pid=c.pid,u.port=c.port,u.owner="managed",{info:u,tunnel:Dbu(f,c.port,l)};await Ubu(i)}else await Gl(i,"nats");let w=await FM(),$=await FM();u.port=w;let h=await wSt(i),v=L4(Q3(i),"nats","data"),d=L4(Q3(i),"nats");jD(v),jD(TM(i)),mS(l,f.clusterCreds,{mode:384});let D=g_u({tcpPort:w,wsPort:$,storeDir:v,bindHost:E,artifacts:f});mS(dbu(i),D);let _=Bun.file(L4(d,"nats.log")),N=Bun.spawn([h,"-c",dbu(i)],{stdout:_,stderr:_});return j1i(i,"nats",{pid:N.pid,port:w,wsPort:$,startedAt:new Date().toISOString()}),await gM(w),await gM($),u.state="running",u.pid=N.pid,u.owner="managed",{info:u,tunnel:Dbu(f,w,l)}}async function Ubu(i){let u=Mw(i,"nats");if(u===null){console.log("NATS: not running");return}let{pid:t}=u;if(!R6(t)){console.log("NATS: process already dead, cleaning up state"),await Gl(i,"nats");return}if(!mc(t,"nats-server")){console.log(`NATS: PID ${t} no longer belongs to nats-server (possible PID reuse), cleaning up state`),await Gl(i,"nats");return}if(console.log(`NATS: stopping (PID ${t})...`),F5)Bun.spawn(["taskkill","/PID",String(t)]);else process.kill(t,"SIGTERM");let f=Date.now();while(Date.now()-f<5000&&R6(t))await y0(200);if(R6(t)&&mc(t,"nats-server"))if(console.log("NATS: force killing..."),F5)Bun.spawn(["taskkill","/PID",String(t),"/F"]);else process.kill(t,"SIGKILL");await Gl(i,"nats"),console.log("NATS stopped")}function Abu(i,u){return i==="win32"?"minio.exe":"minio"}function ybu(i,u){let t={darwin:"darwin",linux:"linux",win32:"windows"},f={arm64:"arm64",x64:"amd64"},l=t[i],E=f[u];if(!l||!E)throw Error(`Unsupported platform for MinIO: ${i}/${u}`);let c=Abu(i,u);return`https://dl.min.io/server/minio/release/${l}-${E}/${c}`}function DSt(i){return L4(Q3(i),"minio","bin",`minio${Izi}`)}async function _St(i){let u=DSt(i);if(L3(u))return u;let t=L4(Q3(i),"minio","bin");jD(t);let f=ybu(k1i(),Uzi()),l=await fetch(f);if(!l.ok)throw Error(`Failed to download MinIO: ${l.status} ${l.statusText}`);let E=await l.arrayBuffer(),c=`${u}.download-${process.pid}`;if(mS(c,Buffer.from(E)),!F5)await Zbu(c,493);if(Obu(c,u),!L3(u))throw Error(`MinIO binary not found at ${u} after download`);return u}async function NSt(i,u=30000){let t=`http://127.0.0.1:${i}/minio/health/ready`,f=Date.now();while(Date.now()-f<u){try{if((await fetch(t)).status===200)return}catch{}await y0(200).catch(()=>{})}throw Error(`Timed out waiting for MinIO readiness at ${t}`)}async function _bu(i){let{S3Client:u,CreateBucketCommand:t}=await Promise.resolve().then(() => (ZM(),vbu)),f=new u({endpoint:i,region:"auto",credentials:{accessKeyId:Pzi,secretAccessKey:Gzi},forcePathStyle:!0});try{await B1(()=>f.send(new t({Bucket:Tbu})),{maxAttempts:5,minTimeout:200,maxTimeout:3000,isRetriable:(l)=>l instanceof Error&&/ECONNREFUSED|ECONNRESET|EPIPE|socket|fetch failed|timed out|network/i.test(`${l.name??""} ${l.message}`)})}catch(l){let E=l&&typeof l==="object"&&"name"in l?String(l.name):"";if(E!=="BucketAlreadyOwnedByUs"&&E!=="BucketAlreadyExists"&&!(l instanceof Error&&l.message.includes("already")))throw f.destroy(),l}f.destroy()}async function OSt(i){let u={name:"MinIO",state:"stopped",pid:null,port:0,owner:"none"},t=Mw(i,"minio");if(t!==null){if(mc(t.pid,"minio"))return u.state="running",u.pid=t.pid,u.port=t.port,u.owner="managed",await _bu(`http://127.0.0.1:${t.port}`),u;await Gl(i,"minio")}let f=await FM();u.port=f;let l=await _St(i),E=L4(Q3(i),"minio","data"),c=L4(Q3(i),"minio");jD(E);let w=Bun.file(L4(c,"minio.log")),$=Bun.spawn([l,"server",E,"--address",`:${f}`],{env:{...process.env,MINIO_ROOT_USER:Pzi,MINIO_ROOT_PASSWORD:Gzi},stdout:w,stderr:w});return j1i(i,"minio",{pid:$.pid,port:f,startedAt:new Date().toISOString()}),await NSt(f),await _bu(`http://127.0.0.1:${f}`),u.state="running",u.pid=$.pid,u.owner="managed",u}async function ZSt(i){let u=Mw(i,"minio");if(u===null){console.log("MinIO: not running");return}let{pid:t}=u;if(!R6(t)){console.log("MinIO: process already dead, cleaning up state"),await Gl(i,"minio");return}if(!mc(t,"minio")){console.log(`MinIO: PID ${t} no longer belongs to minio (possible PID reuse), cleaning up state`),await Gl(i,"minio");return}if(console.log(`MinIO: stopping (PID ${t})...`),F5)Bun.spawn(["taskkill","/PID",String(t)]);else process.kill(t,"SIGTERM");let f=Date.now();while(Date.now()-f<5000&&R6(t))await y0(200);if(R6(t)&&mc(t,"minio"))if(console.log("MinIO: force killing..."),F5)Bun.spawn(["taskkill","/PID",String(t),"/F"]);else process.kill(t,"SIGKILL");await Gl(i,"minio"),console.log("MinIO stopped")}function Pbu(i){let u=i.hotReload===!0?["--hot"]:[],t=i.hotReload===!0?["--hot"]:[];return["bun",...u,"run","--cwd=apps/api","src/cli.ts","link",i.clusterUrl,"--port",String(i.port),"--no-tui",...t]}async function BSt(i){let u={name:"Link",state:"stopped",pid:null,port:0,owner:"none"},t=Mw(i.home,"link");if(t!==null){if(mc(t.pid,Tzi,"args"))return u.state="running",u.pid=t.pid,u.port=t.port,u.owner="managed",{info:u,proc:null};await Gl(i.home,"link")}if(i.beforeSpawn)await i.beforeSpawn();let f=await FM();u.port=f;let l=Bun.spawn(Pbu({clusterUrl:i.clusterUrl,port:f,hotReload:i.hotReload}),{cwd:i.repoRoot,env:{...process.env,STUDIO_CLUSTER_URL:i.clusterUrl,DATA_DIR:i.linkDataDir,DECOCMS_HOME:i.linkDataDir,DECOCMS_LINK_MANAGED:"1"},stdio:i.stdio??["inherit","inherit","inherit"]});j1i(i.home,"link",{pid:l.pid,port:f,startedAt:new Date().toISOString()}),i.onSpawn?.(l);try{await gM(f)}catch(E){try{l.kill()}catch{}throw await Gl(i.home,"link"),E}return u.state="running",u.pid=l.pid,u.owner="managed",{info:u,proc:l}}async function Gbu(i){let u=Mw(i,"link");if(u===null){console.log("Link: not running");return}let{pid:t}=u;if(!R6(t)){console.log("Link: process already dead, cleaning up state"),await Gl(i,"link");return}if(!mc(t,Tzi,"args")){console.log(`Link: PID ${t} no longer belongs to the link daemon (possible PID reuse), cleaning up state`),await Gl(i,"link");return}if(console.log(`Link: stopping (PID ${t})...`),F5)Bun.spawn(["taskkill","/PID",String(t)]);else process.kill(t,"SIGTERM");let f=Date.now();while(Date.now()-f<5000&&R6(t))await y0(200);if(R6(t)&&mc(t,Tzi,"args"))if(console.log("Link: force killing..."),F5)Bun.spawn(["taskkill","/PID",String(t),"/F"]);else process.kill(t,"SIGKILL");await Gl(i,"link"),console.log("Link stopped")}function Nbu(i){return hE(gSt,FSt,i,2,0.5)}function USt(i,u){if(u.aborted)return Promise.resolve();return new Promise((t)=>{let f=()=>{u.removeEventListener("abort",f),t()};u.addEventListener("abort",f,{once:!0}),i.exited.then(()=>{u.removeEventListener("abort",f),t()})})}async function ASt(i,u){while(!u.aborted&&R6(i))await y0(2000,{signal:u}).catch(()=>{})}async function ySt(i){let u=0;while(!i.signal.aborted){let t=Date.now(),f;try{f=await BSt(i)}catch(w){if(i.onDown?.(),i.onLog?.(`[link] daemon failed to start: ${w instanceof Error?w.message:String(w)} \u2014 retrying`),i.signal.aborted)return;await y0(Nbu(u++),{signal:i.signal}).catch(()=>{});continue}let l=new AbortController,E=()=>l.abort();if(i.signal.addEventListener("abort",E,{once:!0}),gM(f.info.port,30000,l.signal).then(()=>{if(!l.signal.aborted)i.onReady?.(f.info.port)}).catch(()=>{}),f.proc)await USt(f.proc,i.signal);else if(f.info.pid!==null)await ASt(f.info.pid,i.signal);if(l.abort(),i.signal.removeEventListener("abort",E),i.signal.aborted)return;i.onDown?.();let c=Date.now()-t;if(c>=TSt)u=0;i.onLog?.(`[link] daemon exited after ${Math.round(c/1000)}s \u2014 respawning`),await y0(Nbu(u++),{signal:i.signal}).catch(()=>{})}}function gzi(i,u){try{let t=new URL(i);return t.port?Number.parseInt(t.port,10):u}catch{return u}}async function PSt(i){jD(Q3(i.home));let u=i.externalDatabaseUrl!==null,t=i.externalNatsUrl!==null,f=Boolean(process.env.S3_ENDPOINT&&process.env.S3_BUCKET&&process.env.S3_ACCESS_KEY_ID&&process.env.S3_SECRET_ACCESS_KEY),l=i.skipMinio===!0||f,E=u?{name:"PostgreSQL",state:"external",pid:null,port:gzi(i.externalDatabaseUrl,5432),owner:"external"}:await fSt(i.home),c=null,w;if(t)w={name:"NATS",state:"external",pid:null,port:gzi(i.externalNatsUrl,4222),owner:"external"};else{let D=await dSt(i.home);if(w=D.info,c=D.tunnel,gui()&&c){let _=await G_u({natsPort:w.port});c={...c,publicUrl:_.config.publicUrl},console.log(`[dev-nats-toxiproxy] daemon NATS routed through ${_.config.publicUrl} -> ${_.config.upstream} (admin ${_.config.apiUrl})`)}}let $=[E,w],h=null;if(f)$.push({name:"MinIO",state:"external",pid:null,port:gzi(process.env.S3_ENDPOINT,pWt),owner:"external"}),h={endpoint:process.env.S3_ENDPOINT,bucket:process.env.S3_BUCKET,accessKeyId:process.env.S3_ACCESS_KEY_ID,secretAccessKey:process.env.S3_SECRET_ACCESS_KEY,forcePathStyle:Iki(process.env.S3_FORCE_PATH_STYLE)};else if(!l){let D=await OSt(i.home);$.push(D),h={endpoint:`http://127.0.0.1:${D.port}`,bucket:Tbu,accessKeyId:Pzi,secretAccessKey:Gzi,forcePathStyle:!0}}if(h){if(process.env.S3_ENDPOINT=h.endpoint,process.env.S3_BUCKET=h.bucket,process.env.S3_ACCESS_KEY_ID=h.accessKeyId,process.env.S3_SECRET_ACCESS_KEY=h.secretAccessKey,h.forcePathStyle)process.env.S3_FORCE_PATH_STYLE="true"}if(c)process.env.NATS_PUBLIC_URL=c.publicUrl,process.env.NATS_ACCOUNT_JWT=c.accountJwt,process.env.NATS_ACCOUNT_SIGNING_KEY=c.accountSigningKey,process.env.NATS_OPERATOR_JWT=c.operatorJwt,process.env.NATS_TUNNEL_PUBLIC_ENABLED="true",process.env.NATS_CREDS=c.credsPath;let v=u?i.externalDatabaseUrl:tSt(E.port),d=t?i.externalNatsUrl:`nats://localhost:${w.port}`;return{services:$,outputs:{databaseUrl:v,natsUrls:[d],s3:h,natsTunnel:c}}}async function GSt(i){if(await Gbu(i),await lSt(i),await Ubu(i),await ZSt(i),gui())await I_u().catch(()=>{});console.log(`
 All managed services stopped.`)}async function ISt(i){let u=[],t=Mw(i,"postgres");if(t!==null&&R6(t.pid))u.push({name:"PostgreSQL",state:"running",pid:t.pid,port:t.port,owner:"managed"});else{if(t!==null)await Gl(i,"postgres");u.push({name:"PostgreSQL",state:"stopped",pid:null,port:0,owner:"none"})}let f=Mw(i,"nats");if(f!==null&&R6(f.pid))u.push({name:"NATS",state:"running",pid:f.pid,port:f.port,owner:"managed"});else{if(f!==null)await Gl(i,"nats");u.push({name:"NATS",state:"stopped",pid:null,port:0,owner:"none"})}let l=Mw(i,"minio");if(l!==null&&R6(l.pid))u.push({name:"MinIO",state:"running",pid:l.pid,port:l.port,owner:"managed"});else{if(l!==null)await Gl(i,"minio");u.push({name:"MinIO",state:"stopped",pid:null,port:0,owner:"none"})}let E=Mw(i,"link");if(E!==null&&R6(E.pid))u.push({name:"Link",state:"running",pid:E.pid,port:E.port,owner:"managed"});else{if(E!==null)await Gl(i,"link");u.push({name:"Link",state:"stopped",pid:null,port:0,owner:"none"})}return u}function xSt(i){console.log("Service     State       PID    Port   Owner"),console.log("----------  ----------  -----  -----  ----------");for(let f of i){let l=f.name.padEnd(10),E=f.state.padEnd(10),c=(f.pid?.toString()??"-").padEnd(5),w=(f.port?String(f.port):"-").padEnd(5),$=f.owner;console.log(`${l}  ${E}  ${c}  ${w}  ${$}`)}}var Azi="postgres",yzi="postgres",Fbu="postgres",gbu="v2.14.2",Pzi="minioadmin",Gzi="minioadmin",Tbu="studio-dev",pWt=9000,F5,Izi,Tzi="cli.ts link",FSt=500,gSt=30000,TSt=30000;var CZ=O(()=>{O4();LW();T_u();x_u();F5=k1i()==="win32",Izi=F5?".exe":""});var Ibu={};ji(Ibu,{servicesCommand:()=>kSt});async function kSt(i){let{subcommand:u,home:t}=i,{ensureServices:f,stopServices:l,getStatus:E,printTable:c}=await Promise.resolve().then(() => (CZ(),bZ));switch(u){case"up":{await f({home:t,externalDatabaseUrl:nb(process.env.DATABASE_URL),externalNatsUrl:nb(process.env.NATS_URL)});break}case"down":{await l(t);break}case"status":{let w=await E(t);c(w);break}default:console.error(`Unknown services subcommand: ${u}
-Usage: deco services <up|down|status>`),process.exit(1)}}var xbu=O(()=>{LW()});function kbu(i){UM=Object.freeze(i)}function hu(){if(!UM)jSt();return UM}function jSt(){if(UM)return;let i={...process.env},u=dui({port:i.PORT||"3000",home:i.DATA_DIR||i.DECOCMS_HOME||"",localMode:i.DECOCMS_LOCAL_MODE==="true",skipMigrations:!0,noTui:i.DECO_NO_TUI==="true",vitePort:i.VITE_PORT,baseUrl:i.BASE_URL},i);UM=Object.freeze({...u.settings,databaseUrl:i.DATABASE_URL??"postgresql://postgres:postgres@localhost:5432/postgres",natsUrls:(i.NATS_URL||"nats://localhost:4222").split(",").map((t)=>t.trim()).filter(Boolean)})}var UM=null;var z0=O(()=>{LW()});import{context as XSt,propagation as JSt,SpanKind as KSt,SpanStatusCode as kzi}from"@opentelemetry/api";function WSt(i,u){let t=i instanceof Error?i.name:void 0;if(t==="TimeoutError")return"timeout";if(t==="AbortError")return"cancelled";if(u?.aborted)return"cancelled";return null}function SSt(i,u){if(u.startsWith("/_sandbox/")){if(i===404)return"daemon_gone";if(i===409)return"daemon_not_ready"}if(i===404&&u.includes("/sandboxclaims/"))return"claim_gone";return null}function LSt(i,u){if(i===404&&(u==="/.decofile"||u==="/live/_meta"||u==="/sprites.svg"))return"not_a_deco_site";return null}function QSt(i){if(!(i instanceof Error))return!1;if(i.message.includes("socket connection was closed"))return!0;let u=i.code;return u==="ECONNRESET"||u==="EPIPE"}async function HSt(i,u){let t,f;if(i instanceof Request)t=new URL(i.url),f=u?.method??i.method;else if(i instanceof URL)t=i,f=u?.method??"GET";else t=new URL(i),f=u?.method??"GET";let l=`${f} ${t.host}`;return v_.startActiveSpan(l,{kind:KSt.CLIENT,attributes:{"http.request.method":f,"url.full":t.href,"url.scheme":t.protocol.replace(":",""),"url.path":t.pathname,"url.query":t.search||void 0,"server.address":t.hostname,"server.port":t.port?Number(t.port):void 0}},async(E)=>{try{let c=new Headers(u?.headers??(i instanceof Request?i.headers:{}));JSt.inject(XSt.active(),c,{set:(D,_,N)=>D.set(_,N)});let w={...u,headers:c},$=await YSt(i,w);E.setAttribute("http.response.status_code",$.status);let h=$.status===405&&f==="GET"&&(c.get("accept")??"").includes("text/event-stream"),v=$.status>=400?SSt($.status,t.pathname):null,d=$.status>=400?LSt($.status,t.pathname):null;if($.status>=400&&!h&&!v&&!d)E.setStatus({code:kzi.ERROR,message:`HTTP ${$.status}`});else{if(v)E.setAttribute("sandbox.lifecycle",v);if(d)E.setAttribute("preview.probe",d);E.setStatus({code:kzi.OK})}return $}catch(c){let w=u?.signal??(i instanceof Request?i.signal:void 0),$=WSt(c,w??void 0);if($)E.setAttribute("abort.reason",$);else if(QSt(c)&&t.pathname.startsWith("/_sandbox/"))E.setAttribute("sandbox.lifecycle","connection_closed");else E.recordException(c),E.setStatus({code:kzi.ERROR,message:c instanceof Error?c.message:"Fetch failed"});throw c}finally{E.end()}})}function jbu(){globalThis.fetch=HSt}var YSt;var Xbu=O(()=>{X1();YSt=globalThis.fetch});import{join as Xzi}from"path";function g5(){return Xzi(hu().dataDir,"logs")}function eS(){return Xzi(hu().dataDir,"traces")}function XD(){return Xzi(hu().dataDir,"metrics")}function d_(i,u){let t=i[u];return t!=null?String(t):""}function AM(i,u){let t=i[u];return t!=null&&t!==""?String(t):null}function Jbu(i){let{attributes:u}=i,t=u[If.IS_ERROR],f=u[If.DURATION_MS];return{v:1,id:i.id,type:d_(u,If.TYPE)||yM,organization_id:d_(u,If.ORGANIZATION_ID),connection_id:d_(u,If.CONNECTION_ID),connection_title:d_(u,If.CONNECTION_TITLE),tool_name:d_(u,If.TOOL_NAME),input:d_(u,If.INPUT),output:d_(u,If.OUTPUT),is_error:t===!0||t===1||t==="true"?1:0,error_message:AM(u,If.ERROR_MESSAGE),duration_ms:typeof f==="number"?f:Number(f)||0,timestamp:new Date(Number(i.timestampNano/1000000n)).toISOString(),user_id:AM(u,If.USER_ID),request_id:d_(u,If.REQUEST_ID),user_agent:AM(u,If.USER_AGENT),virtual_mcp_id:AM(u,If.VIRTUAL_MCP_ID),properties:AM(u,If.PROPERTIES)}}function J1i(i){return i[0]*1000+i[1]/1e6}function oS(i){return new Date(J1i(i)).toISOString()}var jzi="mcp.proxy.callTool",If,yM="tool_call",aS="llm_call",X1i="decopilot";var qw=O(()=>{z0();If={TYPE:"studio.monitoring.type",ORGANIZATION_ID:"studio.monitoring.organization_id",CONNECTION_ID:"studio.monitoring.connection_id",CONNECTION_TITLE:"studio.monitoring.connection_title",TOOL_NAME:"studio.monitoring.tool_name",INPUT:"studio.monitoring.input",OUTPUT:"studio.monitoring.output",IS_ERROR:"studio.monitoring.is_error",ERROR_MESSAGE:"studio.monitoring.error_message",DURATION_MS:"studio.monitoring.duration_ms",USER_ID:"studio.monitoring.user_id",REQUEST_ID:"studio.monitoring.request_id",USER_AGENT:"studio.monitoring.user_agent",VIRTUAL_MCP_ID:"studio.monitoring.virtual_mcp_id",PROPERTIES:"studio.monitoring.properties"}});import{ExportResultCode as K1i}from"@opentelemetry/core";import{mkdir as zSt,rename as nSt,writeFile as RSt}from"fs/promises";import{join as Y1i}from"path";class MZ{bufferItems=[];bufferBytes=0;flushTimer=null;flushQueue=Promise.resolve();basePath;flushThreshold;maxBufferBytes;isShutdown=!1;knownDirs=new Set;partitionKey;constructor(i){this.basePath=i.basePath,this.flushThreshold=i.flushThreshold??1000,this.maxBufferBytes=i.maxBufferBytes??10485760,this.partitionKey=i.partitionKey;let u=i.flushIntervalMs??60000;if(u>0&&u<3600000){if(this.flushTimer=setInterval(()=>{this.flush().catch((t)=>{console.error("[NDJSONExporter] Timer flush failed:",t)})},u),this.flushTimer&&typeof this.flushTimer==="object"&&"unref"in this.flushTimer)this.flushTimer.unref()}}exportRows(i){if(this.isShutdown)return Promise.resolve({code:K1i.FAILED});for(let u of i){let t=JSON.stringify(u),f=this.partitionKey?this.partitionKey(u):"";this.bufferItems.push({partition:f,json:t}),this.bufferBytes+=Buffer.byteLength(t,"utf8")+1}if(this.bufferItems.length>=this.flushThreshold||this.bufferBytes>=this.maxBufferBytes)return this.flush().then(()=>({code:K1i.SUCCESS})).catch((u)=>{return console.error("[NDJSONExporter] Flush failed:",u),{code:K1i.FAILED}});return Promise.resolve({code:K1i.SUCCESS})}async shutdown(){if(this.isShutdown=!0,this.flushTimer)clearInterval(this.flushTimer),this.flushTimer=null;try{await this.flushQueue}catch{}if(this.bufferItems.length>0)await this.flush()}async forceFlush(){try{await this.flushQueue}catch{}if(this.bufferItems.length>0)await this.flush()}flush(){let u=this.flushQueue.catch(()=>{}).then(()=>this.doFlush());return this.flushQueue=u,u}async doFlush(){if(this.bufferItems.length===0)return;let i=this.bufferItems;this.bufferItems=[],this.bufferBytes=0;let u=new Map;for(let l of i){let E=u.get(l.partition);if(!E)E=[],u.set(l.partition,E);E.push(l.json)}let t=await Promise.allSettled(Array.from(u.entries()).map(([l,E])=>this.writeNDJSON(E,l).then(()=>l))),f=t.find((l)=>l.status==="rejected");if(f){let l=new Set;for(let c of t)if(c.status==="fulfilled")l.add(c.value);let E=i.filter((c)=>!l.has(c.partition));this.bufferItems=E.concat(this.bufferItems),this.bufferBytes=0;for(let c of this.bufferItems)this.bufferBytes+=Buffer.byteLength(c.json,"utf8")+1;throw f.reason}}async writeNDJSON(i,u){let t=new Date,f=[String(t.getUTCFullYear()),String(t.getUTCMonth()+1).padStart(2,"0"),String(t.getUTCDate()).padStart(2,"0"),String(t.getUTCHours()).padStart(2,"0")],l=u?Y1i(this.basePath,u,...f):Y1i(this.basePath,...f);if(!this.knownDirs.has(l))await zSt(l,{recursive:!0,mode:448}),this.knownDirs.add(l);let E=`${crypto.randomUUID()}.ndjson`,c=Y1i(l,`.${E}.tmp`),w=Y1i(l,E),$=i.join(`
+Usage: deco services <up|down|status>`),process.exit(1)}}var xbu=O(()=>{LW()});function kbu(i){UM=Object.freeze(i)}function hu(){if(!UM)jSt();return UM}function jSt(){if(UM)return;let i={...process.env},u=dui({port:i.PORT||"3000",home:i.DATA_DIR||i.DECOCMS_HOME||"",localMode:i.DECOCMS_LOCAL_MODE==="true",skipMigrations:!0,noTui:i.DECO_NO_TUI==="true",vitePort:i.VITE_PORT,baseUrl:i.BASE_URL},i);UM=Object.freeze({...u.settings,databaseUrl:i.DATABASE_URL||"postgresql://postgres:postgres@localhost:5432/postgres",natsUrls:(i.NATS_URL||"nats://localhost:4222").split(",").map((t)=>t.trim()).filter(Boolean)})}var UM=null;var z0=O(()=>{LW()});import{context as XSt,propagation as JSt,SpanKind as KSt,SpanStatusCode as kzi}from"@opentelemetry/api";function WSt(i,u){let t=i instanceof Error?i.name:void 0;if(t==="TimeoutError")return"timeout";if(t==="AbortError")return"cancelled";if(u?.aborted)return"cancelled";return null}function SSt(i,u){if(u.startsWith("/_sandbox/")){if(i===404)return"daemon_gone";if(i===409)return"daemon_not_ready"}if(i===404&&u.includes("/sandboxclaims/"))return"claim_gone";return null}function LSt(i,u){if(i===404&&(u==="/.decofile"||u==="/live/_meta"||u==="/sprites.svg"))return"not_a_deco_site";return null}function QSt(i){if(!(i instanceof Error))return!1;if(i.message.includes("socket connection was closed"))return!0;let u=i.code;return u==="ECONNRESET"||u==="EPIPE"}async function HSt(i,u){let t,f;if(i instanceof Request)t=new URL(i.url),f=u?.method??i.method;else if(i instanceof URL)t=i,f=u?.method??"GET";else t=new URL(i),f=u?.method??"GET";let l=`${f} ${t.host}`;return v_.startActiveSpan(l,{kind:KSt.CLIENT,attributes:{"http.request.method":f,"url.full":t.href,"url.scheme":t.protocol.replace(":",""),"url.path":t.pathname,"url.query":t.search||void 0,"server.address":t.hostname,"server.port":t.port?Number(t.port):void 0}},async(E)=>{try{let c=new Headers(u?.headers??(i instanceof Request?i.headers:{}));JSt.inject(XSt.active(),c,{set:(D,_,N)=>D.set(_,N)});let w={...u,headers:c},$=await YSt(i,w);E.setAttribute("http.response.status_code",$.status);let h=$.status===405&&f==="GET"&&(c.get("accept")??"").includes("text/event-stream"),v=$.status>=400?SSt($.status,t.pathname):null,d=$.status>=400?LSt($.status,t.pathname):null;if($.status>=400&&!h&&!v&&!d)E.setStatus({code:kzi.ERROR,message:`HTTP ${$.status}`});else{if(v)E.setAttribute("sandbox.lifecycle",v);if(d)E.setAttribute("preview.probe",d);E.setStatus({code:kzi.OK})}return $}catch(c){let w=u?.signal??(i instanceof Request?i.signal:void 0),$=WSt(c,w??void 0);if($)E.setAttribute("abort.reason",$);else if(QSt(c)&&t.pathname.startsWith("/_sandbox/"))E.setAttribute("sandbox.lifecycle","connection_closed");else E.recordException(c),E.setStatus({code:kzi.ERROR,message:c instanceof Error?c.message:"Fetch failed"});throw c}finally{E.end()}})}function jbu(){globalThis.fetch=HSt}var YSt;var Xbu=O(()=>{X1();YSt=globalThis.fetch});import{join as Xzi}from"path";function g5(){return Xzi(hu().dataDir,"logs")}function eS(){return Xzi(hu().dataDir,"traces")}function XD(){return Xzi(hu().dataDir,"metrics")}function d_(i,u){let t=i[u];return t!=null?String(t):""}function AM(i,u){let t=i[u];return t!=null&&t!==""?String(t):null}function Jbu(i){let{attributes:u}=i,t=u[If.IS_ERROR],f=u[If.DURATION_MS];return{v:1,id:i.id,type:d_(u,If.TYPE)||yM,organization_id:d_(u,If.ORGANIZATION_ID),connection_id:d_(u,If.CONNECTION_ID),connection_title:d_(u,If.CONNECTION_TITLE),tool_name:d_(u,If.TOOL_NAME),input:d_(u,If.INPUT),output:d_(u,If.OUTPUT),is_error:t===!0||t===1||t==="true"?1:0,error_message:AM(u,If.ERROR_MESSAGE),duration_ms:typeof f==="number"?f:Number(f)||0,timestamp:new Date(Number(i.timestampNano/1000000n)).toISOString(),user_id:AM(u,If.USER_ID),request_id:d_(u,If.REQUEST_ID),user_agent:AM(u,If.USER_AGENT),virtual_mcp_id:AM(u,If.VIRTUAL_MCP_ID),properties:AM(u,If.PROPERTIES)}}function J1i(i){return i[0]*1000+i[1]/1e6}function oS(i){return new Date(J1i(i)).toISOString()}var jzi="mcp.proxy.callTool",If,yM="tool_call",aS="llm_call",X1i="decopilot";var qw=O(()=>{z0();If={TYPE:"studio.monitoring.type",ORGANIZATION_ID:"studio.monitoring.organization_id",CONNECTION_ID:"studio.monitoring.connection_id",CONNECTION_TITLE:"studio.monitoring.connection_title",TOOL_NAME:"studio.monitoring.tool_name",INPUT:"studio.monitoring.input",OUTPUT:"studio.monitoring.output",IS_ERROR:"studio.monitoring.is_error",ERROR_MESSAGE:"studio.monitoring.error_message",DURATION_MS:"studio.monitoring.duration_ms",USER_ID:"studio.monitoring.user_id",REQUEST_ID:"studio.monitoring.request_id",USER_AGENT:"studio.monitoring.user_agent",VIRTUAL_MCP_ID:"studio.monitoring.virtual_mcp_id",PROPERTIES:"studio.monitoring.properties"}});import{ExportResultCode as K1i}from"@opentelemetry/core";import{mkdir as zSt,rename as nSt,writeFile as RSt}from"fs/promises";import{join as Y1i}from"path";class MZ{bufferItems=[];bufferBytes=0;flushTimer=null;flushQueue=Promise.resolve();basePath;flushThreshold;maxBufferBytes;isShutdown=!1;knownDirs=new Set;partitionKey;constructor(i){this.basePath=i.basePath,this.flushThreshold=i.flushThreshold??1000,this.maxBufferBytes=i.maxBufferBytes??10485760,this.partitionKey=i.partitionKey;let u=i.flushIntervalMs??60000;if(u>0&&u<3600000){if(this.flushTimer=setInterval(()=>{this.flush().catch((t)=>{console.error("[NDJSONExporter] Timer flush failed:",t)})},u),this.flushTimer&&typeof this.flushTimer==="object"&&"unref"in this.flushTimer)this.flushTimer.unref()}}exportRows(i){if(this.isShutdown)return Promise.resolve({code:K1i.FAILED});for(let u of i){let t=JSON.stringify(u),f=this.partitionKey?this.partitionKey(u):"";this.bufferItems.push({partition:f,json:t}),this.bufferBytes+=Buffer.byteLength(t,"utf8")+1}if(this.bufferItems.length>=this.flushThreshold||this.bufferBytes>=this.maxBufferBytes)return this.flush().then(()=>({code:K1i.SUCCESS})).catch((u)=>{return console.error("[NDJSONExporter] Flush failed:",u),{code:K1i.FAILED}});return Promise.resolve({code:K1i.SUCCESS})}async shutdown(){if(this.isShutdown=!0,this.flushTimer)clearInterval(this.flushTimer),this.flushTimer=null;try{await this.flushQueue}catch{}if(this.bufferItems.length>0)await this.flush()}async forceFlush(){try{await this.flushQueue}catch{}if(this.bufferItems.length>0)await this.flush()}flush(){let u=this.flushQueue.catch(()=>{}).then(()=>this.doFlush());return this.flushQueue=u,u}async doFlush(){if(this.bufferItems.length===0)return;let i=this.bufferItems;this.bufferItems=[],this.bufferBytes=0;let u=new Map;for(let l of i){let E=u.get(l.partition);if(!E)E=[],u.set(l.partition,E);E.push(l.json)}let t=await Promise.allSettled(Array.from(u.entries()).map(([l,E])=>this.writeNDJSON(E,l).then(()=>l))),f=t.find((l)=>l.status==="rejected");if(f){let l=new Set;for(let c of t)if(c.status==="fulfilled")l.add(c.value);let E=i.filter((c)=>!l.has(c.partition));this.bufferItems=E.concat(this.bufferItems),this.bufferBytes=0;for(let c of this.bufferItems)this.bufferBytes+=Buffer.byteLength(c.json,"utf8")+1;throw f.reason}}async writeNDJSON(i,u){let t=new Date,f=[String(t.getUTCFullYear()),String(t.getUTCMonth()+1).padStart(2,"0"),String(t.getUTCDate()).padStart(2,"0"),String(t.getUTCHours()).padStart(2,"0")],l=u?Y1i(this.basePath,u,...f):Y1i(this.basePath,...f);if(!this.knownDirs.has(l))await zSt(l,{recursive:!0,mode:448}),this.knownDirs.add(l);let E=`${crypto.randomUUID()}.ndjson`,c=Y1i(l,`.${E}.tmp`),w=Y1i(l,E),$=i.join(`
 `)+`
 `;await RSt(c,$,{mode:384}),await nSt(c,w)}}var W1i=()=>{};import{ExportResultCode as bSt}from"@opentelemetry/core";class Jzi{inner;constructor(i){this.inner=new MZ({...i,partitionKey:(u)=>u.organization_id})}export(i,u){let t=[];for(let f of i){if(!CSt.has(f.attributes[If.TYPE]))continue;let l={};for(let[$,h]of Object.entries(f.attributes))if(typeof h==="string"||typeof h==="number"||typeof h==="boolean")l[$]=h;let E=f.spanContext?.spanId??crypto.randomUUID(),c=f.hrTime,w=BigInt(c[0])*1000000000n+BigInt(c[1]);t.push(Jbu({id:E,timestampNano:w,attributes:l}))}this.inner.exportRows(t).then((f)=>u(f)).catch(()=>u({code:bSt.FAILED}))}async shutdown(){await this.inner.shutdown()}async forceFlush(){await this.inner.forceFlush()}}var CSt;var Kbu=O(()=>{qw();W1i();CSt=new Set([yM,aS])});import{ExportResultCode as MSt}from"@opentelemetry/core";import{AggregationTemporality as qSt,DataPointType as Ybu}from"@opentelemetry/sdk-metrics";class Kzi{inner;constructor(i){this.inner=new MZ({...i,partitionKey:(u)=>u.organization_id})}selectAggregationTemporality(i){return qSt.DELTA}export(i,u){let t=[];for(let f of i.scopeMetrics)for(let l of f.metrics){let{descriptor:E,dataPointType:c}=l;if(c===Ybu.SUM)for(let w of l.dataPoints){let $=w.attributes;t.push({v:1,name:E.name,type:"sum",unit:E.unit,timestamp:oS(w.endTime),organization_id:String($["organization.id"]??""),connection_id:String($["connection.id"]??""),tool_name:String($["tool.name"]??""),status:String($.status??""),error_type:String($["error.type"]??""),value:w.value,hist_count:0,hist_sum:0,hist_min:0,hist_max:0,hist_boundaries:"[]",hist_bucket_counts:"[]"})}else if(c===Ybu.HISTOGRAM)for(let w of l.dataPoints){let{attributes:$,value:h}=w;t.push({v:1,name:E.name,type:"histogram",unit:E.unit,timestamp:oS(w.endTime),organization_id:String($["organization.id"]??""),connection_id:String($["connection.id"]??""),tool_name:String($["tool.name"]??""),status:String($.status??""),error_type:String($["error.type"]??""),value:h.count,hist_count:h.count,hist_sum:h.sum??0,hist_min:h.min??0,hist_max:h.max??0,hist_boundaries:JSON.stringify(h.buckets.boundaries),hist_bucket_counts:JSON.stringify(h.buckets.counts)})}}this.inner.exportRows(t).then((f)=>u(f)).catch(()=>u({code:MSt.FAILED}))}async shutdown(){await this.inner.shutdown()}async forceFlush(){await this.inner.forceFlush()}}var Wbu=O(()=>{qw();W1i()});import{ExportResultCode as VSt}from"@opentelemetry/core";function rSt(i){let u=i.resource,t=u.attributes["service.name"]??"unknown";return{v:1,trace_id:i.spanContext().traceId,span_id:i.spanContext().spanId,parent_span_id:i.parentSpanContext?.spanId||null,name:i.name,kind:i.kind,status:i.status.code,status_message:i.status.message||null,start_time:oS(i.startTime),end_time:oS(i.endTime),duration_ms:J1i(i.endTime)-J1i(i.startTime),service_name:t,attributes:JSON.stringify(i.attributes),events:JSON.stringify(i.events),links:JSON.stringify(i.links),resource:JSON.stringify(u.attributes)}}class Yzi{inner;constructor(i){this.inner=new MZ(i)}export(i,u){let t=i.map(rSt);this.inner.exportRows(t).then((f)=>u(f)).catch(()=>u({code:VSt.FAILED}))}async shutdown(){await this.inner.shutdown()}async forceFlush(){await this.inner.forceFlush()}}var Sbu=O(()=>{qw();W1i()});function sS(i,u=65536){if(i.length<=u&&Buffer.byteLength(i,"utf8")<=u)return i;let t=u-mSt;if(t<=0)return"... [TRUNCATED]".slice(0,u);let f=0,l=0;for(let E of i){let c=E.charCodeAt(0)<=127?1:Buffer.byteLength(E,"utf8");if(f+c>t)break;f+=c,l+=E.length}return i.slice(0,l)+"... [TRUNCATED]"}var mSt;var Wzi=O(()=>{mSt=Buffer.byteLength("... [TRUNCATED]","utf8")});import{NOOP_LOGGER as eSt}from"@opentelemetry/api-logs";function Qbu(i){Lbu=i.getLogger(aSt,oSt)}function Hbu(){return Lbu}var aSt="studio.monitoring",oSt="1.0.0",Lbu;var Szi=O(()=>{Lbu=eSt});var Rbu={};ji(Rbu,{shouldSkipStudioContext:()=>Lzi,isServerPath:()=>pSt,isHealthPath:()=>PM,SYSTEM_PATHS:()=>BE});function PM(i){return i===BE.HEALTH||i===BE.HEALTH_LIVE||i===BE.HEALTH_READY}function zbu(i){return i===BE.HEALTH||i===BE.HEALTH_LIVE||i===BE.HEALTH_READY||i===BE.METRICS||i.startsWith(qZ.WELL_KNOWN)||i.startsWith(BE.DBOS_QUEUE_DEPTH_PREFIX)||i===BE.HOSTED_RUN_PENDING}function nbu(i){return i.startsWith(qZ.API)}function pSt(i){return nbu(i)||i==="/mcp"||i.startsWith(qZ.MCP)||i.startsWith(qZ.OAUTH_PROXY)||i.startsWith(qZ.ORG)||i.startsWith(qZ.REPORT)||zbu(i)}function Lzi(i){return i==="/"||i.startsWith(qZ.API_AUTH)||i==="/api/trigger-callback"||zbu(i)||!nbu(i)&&sSt.test(i)}var BE,qZ,sSt;var S1i=O(()=>{BE={HEALTH:"/health",HEALTH_LIVE:"/health/live",HEALTH_READY:"/health/ready",METRICS:"/metrics",DBOS_QUEUE_DEPTH_PREFIX:"/dbos-queue-depth/",HOSTED_RUN_PENDING:"/hosted-run-pending"},qZ={API:"/api/",API_AUTH:"/api/auth/",MCP:"/mcp/",OAUTH_PROXY:"/oauth-proxy/",WELL_KNOWN:"/.well-known",ORG:"/org/",REPORT:"/report/"},sSt=/\.(html|css|js|ico|svg|png|jpg|jpeg|gif|webp|woff|woff2)$/});import{SpanStatusCode as Qzi}from"@opentelemetry/api";var iLt,uLt=()=>iLt??=At.createHistogram("http.server.request.duration",{description:"Duration of inbound HTTP requests handled by the API.",unit:"s",advice:{explicitBucketBoundaries:[0.005,0.01,0.025,0.05,0.075,0.1,0.25,0.5,0.75,1,2.5,5,7.5,10]}}),Hzi=async(i,u)=>{if(PM(i.req.path))return u();let t=i.req.raw,f=new URL(t.url),l=performance.now(),E=Mbu(t),c=zzi(t),w={"http.request.url":t.url,"http.request.method":t.method,"http.request.body.size":t.headers.get("content-length")??void 0,"url.scheme":f.protocol.replace(":",""),"server.address":f.host,"url.query":f.search||void 0,"url.path":f.pathname,"user_agent.original":t.headers.get("user-agent")??void 0,"request.internal":t.headers.has("traceparent"),...c?{"trace.debug.id":c}:{}};await v_.startActiveSpan(`${t.method} ${f.pathname}`,{attributes:w},E,async($)=>{i.set("rootSpan",$);try{await u()}catch(h){$.recordException(h),$.setStatus({code:Qzi.ERROR});let v=typeof h==="object"&&h&&"message"in h?String(h.message):JSON.stringify(h);throw console.error("error: ",v,w),h}finally{let h=i.res?.status??500,v=h>=500;$.setStatus({code:v?Qzi.ERROR:Qzi.OK}),$.setAttribute("http.response.status_code",h);let d=i.get("studioContext");if(d){if(d.auth.user?.id)$.setAttribute("studio.user.id",d.auth.user.id);if(d.auth.apiKey?.id)$.setAttribute("studio.api_key.id",d.auth.apiKey.id);if(d.organization?.id)$.setAttribute("studio.organization.id",d.organization.id)}if(c)Cbu(i.res.headers,c);uLt().record((performance.now()-l)/1000,{"http.request.method":t.method,"http.route":i.req.routePath,"http.response.status_code":h}),$.end()}})};var bbu=O(()=>{X1();S1i()});import{createContextKey as tLt,metrics as obu,propagation as fLt,ROOT_CONTEXT as lLt,SpanStatusCode as qbu,trace as Rzi}from"@opentelemetry/api";import{logs as sbu,SeverityNumber as XM}from"@opentelemetry/api-logs";import{OTLPLogExporter as Vbu}from"@opentelemetry/exporter-logs-otlp-proto";import{PrometheusExporter as ELt}from"@opentelemetry/exporter-prometheus";import{OTLPTraceExporter as cLt}from"@opentelemetry/exporter-trace-otlp-proto";import{RuntimeNodeInstrumentation as wLt}from"@opentelemetry/instrumentation-runtime-node";import{BatchLogRecordProcessor as nzi,LoggerProvider as rbu}from"@opentelemetry/sdk-logs";import{detectResources as $Lt,envDetector as hLt,hostDetector as vLt,osDetector as dLt,processDetector as DLt,resourceFromAttributes as mbu}from"@opentelemetry/resources";import{PeriodicExportingMetricReader as _Lt}from"@opentelemetry/sdk-metrics";import{NodeSDK as NLt}from"@opentelemetry/sdk-node";import{BatchSpanProcessor as ebu,SamplingDecision as pS}from"@opentelemetry/sdk-trace-base";class iCu{inner;ratio;constructor(i,u){this.inner=i;this.ratio=u}onEmit(i,u){if(i.severityNumber!==void 0&&i.severityNumber>=XM.ERROR||Math.random()<this.ratio)this.inner.onEmit(i,u)}forceFlush(){return this.inner.forceFlush()}shutdown(){return this.inner.shutdown()}}class uCu{inner;maxBytes;constructor(i,u){this.inner=i;this.maxBytes=u}onEmit(i,u){let t=If.OUTPUT,f=i.attributes?.[t];if(typeof f==="string"&&f.length>this.maxBytes){let l=sS(f,this.maxBytes);this.inner.onEmit({...i,attributes:{...i.attributes,[t]:l}},u)}else this.inner.onEmit(i,u)}forceFlush(){return this.inner.forceFlush()}shutdown(){return this.inner.shutdown()}}class tCu{inner;constructor(i){this.inner=i}shouldSample(i,u,t,f,l,E){let c=i.getValue(pbu);if(!c){if(this.inner)return this.inner.shouldSample(i,u,t,f,l,E);return{decision:pS.RECORD_AND_SAMPLED}}let w=zzi(c);if(w)return{decision:pS.RECORD_AND_SAMPLED,attributes:{"trace.debug.id":w}};if(this.inner){let $=this.inner.shouldSample(i,u,t,f,l,E);if($.decision===pS.RECORD_AND_SAMPLED){let h=crypto.randomUUID();$.attributes={...$.attributes??{},"trace.debug.id":h}}return $}return{decision:pS.NOT_RECORD}}toString(){return"DebugSampler"}}class fCu{ratio;constructor(i){this.ratio=i}shouldSample(){if(Math.random()<this.ratio)return{decision:pS.RECORD_AND_SAMPLED};return{decision:pS.NOT_RECORD}}toString(){return`RatioSampler(${this.ratio})`}}function lCu(){if(abu)return;let i=hu(),u=!!process.env.OTEL_EXPORTER_OTLP_ENDPOINT,t=u?new cLt:void 0;GM=i.nodeEnv==="test"?null:new Jzi({basePath:g5()}),IM=i.nodeEnv==="test"?null:new Yzi({basePath:eS()}),xM=i.nodeEnv==="test"?null:new Kzi({basePath:XD()}),kM=xM?new _Lt({exporter:xM,exportIntervalMillis:60000}):null;let f=process.env.STUDIO_ENV??"production"??"unknown",l={};if(!process.env.OTEL_RESOURCE_ATTRIBUTES?.includes("deployment.environment"))l["deployment.environment"]=f;new NLt({serviceName:i.otelServiceName,resource:mbu(l),metricReaders:[bzi,...kM?[kM]:[]],sampler:BLt,spanProcessors:[...t?[new ebu(t,{scheduledDelayMillis:60000,maxExportBatchSize:1000})]:[],...IM?[new ebu(IM,{scheduledDelayMillis:60000,maxExportBatchSize:250})]:[]],instrumentations:[new wLt]}).start(),At=obu.getMeter("studio","1.0.0"),v_=Rzi.getTracer("studio","1.0.0");let c=$Lt({detectors:[hLt,vLt,dLt,DLt]}).merge(mbu({"service.name":i.otelServiceName,...l})),w=[];if(u){let d=f==="prod"||f==="production"?1:0.1,D=process.env.INFRA_LOG_SAMPLE_RATIO,_=d;if(D!==void 0){let N=Number(D);if(Number.isFinite(N)&&N>=0&&N<=1)_=N;else console.warn(`[observability] Ignoring invalid INFRA_LOG_SAMPLE_RATIO="${D}" (expected 0..1); using ${d}`)}w.push(new iCu(new nzi(new Vbu),_))}jM=new rbu({resource:c,processors:w}),sbu.setGlobalLoggerProvider(jM),ECu=jM.getLogger("studio","1.0.0");let $=i.monitoringOtlpEndpoint??process.env.OTEL_EXPORTER_OTLP_ENDPOINT,h=[];if($){let v=$.replace(/\/$/,""),d=v.endsWith("/v1/logs")?v:`${v}/v1/logs`;h.push(new uCu(new nzi(new Vbu({url:d})),8000))}if(GM)h.push(new nzi(GM,{scheduledDelayMillis:60000,maxExportBatchSize:250}));L1i=new rbu({resource:c,processors:h}),Qbu(L1i),jbu(),abu=!0}async function fh(){let u=(await Promise.allSettled([jM?jM.forceFlush():Promise.resolve(),(async()=>{if(L1i)await L1i.forceFlush();if(GM)await GM.forceFlush()})(),(async()=>{let t=Rzi.getTracerProvider();if("forceFlush"in t)await t.forceFlush();if(IM)await IM.forceFlush()})(),(async()=>{if(kM)await kM.forceFlush();if(xM)await xM.forceFlush()})()])).find((t)=>t.status==="rejected");if(u)throw u.reason}function qzi(i,u,t){return v_.startActiveSpan(i,{attributes:t},async(f)=>{try{let l=await u(f);return f.setStatus({code:qbu.OK}),l}catch(l){let E=l instanceof Error?l:Error(String(l??"unknown"));throw f.setStatus({code:qbu.ERROR,message:E.message}),f.recordException(E),l}finally{f.end()}})}var OLt="__d",pbu,ZLt=1,zzi=(i)=>{let t=new URL(i.url).searchParams.get(OLt);if(t==="")return crypto.randomUUID();if(!t)t=i.headers.get("x-trace-debug-id");return t},Cbu=(i,u)=>{try{i.set("x-trace-debug-id",u)}catch{}},bzi,BLt,GM=null,IM=null,xM=null,kM=null,jM=null,L1i=null,abu=!1,v_,At,ECu,Czi=(i,u,t)=>{let f={},l=t,E=t[t.length-1];if(E!==null&&typeof E==="object"&&!Array.isArray(E)&&!(E instanceof Error)&&Object.getPrototypeOf(E)===Object.prototype)f=E,l=t.slice(0,-1);let c=l.map((w)=>{if(w instanceof Error)return`${w.name}: ${w.message}`;if(typeof w==="object")try{return JSON.stringify(w)}catch{return"[Object]"}return String(w)}).join(" ");ECu.emit({severityNumber:i,severityText:u,body:c,attributes:{"log.source":"console",...f}})},Mzi,Mbu=(i)=>{return fLt.extract(lLt,i.headers,{get:(t,f)=>t.get(f)??void 0,keys:(t)=>[...t.keys()]}).setValue(pbu,i)};var X1=O(()=>{Xbu();Kbu();Wbu();Sbu();qw();Wzi();z0();Szi();bbu();pbu=tLt("Current request");bzi=new ELt({preventServerStart:!0}),BLt=new tCu(new fCu(ZLt));v_=Rzi.getTracer("studio","1.0.0"),At=obu.getMeter("studio","1.0.0"),ECu=sbu.getLogger("studio","1.0.0"),Mzi={error:console.error.bind(console),warn:console.warn.bind(console),debug:console.debug.bind(console)};console.error=(...i)=>{Czi(XM.ERROR,"ERROR",i),Mzi.error(...i)};console.warn=(...i)=>{Czi(XM.WARN,"WARN",i),Mzi.warn(...i)};console.debug=(...i)=>{Czi(XM.DEBUG,"DEBUG",i),Mzi.debug(...i)}});function VZ(){try{return process.memoryUsage()}catch{return null}}import{Session as FLt}from"inspector";function rZ(i,u){return new Promise((t,f)=>iL.post(i,u,(l,E)=>l?f(l):t(E??{})))}async function cCu(i){try{return iL=new FLt,iL.connect(),await rZ("Profiler.enable"),await rZ("Profiler.setSamplingInterval",{interval:i}),await rZ("Profiler.start"),tL=!0,!0}catch{return tL=!1,iL=null,!1}}function gLt(i,u){let{nodes:t,samples:f,timeDeltas:l}=i;if(!f?.length)return null;let E=new Map,c=new Map;for(let Z of t){E.set(Z.id,Z);for(let B of Z.children??[])c.set(B,Z.id)}let w=Math.max(1,u)*1000,$=0,h=new Map;for(let Z=f.length-1;Z>=0;Z--){$+=l[Z]??0;let B=f[Z];if(B!==void 0)h.set(B,(h.get(B)??0)+1);if($>=w)break}let v=-1,d=0;for(let[Z,B]of h)if(B>d)d=B,v=Z;if(v<0)return null;let D=[],_=new Set,N=v;while(N!=null&&!_.has(N)){_.add(N);let Z=E.get(N);if(!Z)break;let B=Z.callFrame,F=B.url?` ${B.url}:${B.lineNumber+1}`:"";D.push(`${B.functionName||"(anonymous)"}${F}`),N=c.get(N)}return D}async function wCu(i){if(!tL||!iL||uL)return null;uL=!0;try{let{profile:u}=await rZ("Profiler.stop"),t=u?gLt(u,i):null;return await rZ("Profiler.start"),t}catch{return tL=!1,null}finally{uL=!1}}async function $Cu(){if(!tL||!iL||uL)return;uL=!0;try{await rZ("Profiler.stop"),await rZ("Profiler.start")}catch{tL=!1}finally{uL=!1}}var iL=null,tL=!1,uL=!1;var hCu=()=>{};function dCu(){if(Vzi)return;let i=performance.now()+rzi;Vzi=setInterval(()=>{let u=performance.now();vCu=Math.max(0,u-i),i=u+rzi},rzi),Vzi.unref?.()}function DCu(){return dCu(),vCu}function _Cu(){if(dCu(),process.env.EVENT_LOOP_MONITOR!=="1")return()=>{};let i=Number(process.env.EVENT_LOOP_INTERVAL_MS??250),u=Number(process.env.EVENT_LOOP_SPIKE_MS??100),t=process.env.EVENT_LOOP_PROFILE==="1",f=Number(process.env.EVENT_LOOP_PROFILE_MS??1000),l=Number(process.env.EVENT_LOOP_PROFILE_INTERVAL_US??1e4),E=30000,c=performance.now();if(t)cCu(l).then((h)=>{console.warn(JSON.stringify({msg:"event-loop-profiler",status:h?"started":"unavailable",intervalUs:l}))});let w=At.createHistogram("eventloop.delay",{description:"Event-loop lag measured as timer scheduling drift",unit:"ms"}),$=performance.now()+i;return Q1i=setInterval(()=>{let h=performance.now(),v=Math.max(0,h-$);if($=h+i,w.record(v),v>u){let d=VZ();console.warn(JSON.stringify({msg:"event-loop-stall",ts:new Date().toISOString(),lagMs:Math.round(v),rss:d?.rss,heapUsed:d?.heapUsed,heapTotal:d?.heapTotal,external:d?.external}))}if(t){if(v>f)wCu(Math.round(v)).then((d)=>{if(d?.length)console.warn(JSON.stringify({msg:"event-loop-stall-profile",ts:new Date().toISOString(),lagMs:Math.round(v),stack:d}))}),c=h;else if(h-c>E)$Cu(),c=h}},i),Q1i.unref?.(),()=>{if(Q1i)clearInterval(Q1i)}}var Q1i,Vzi,vCu=0,rzi=500;var mzi=O(()=>{X1();hCu()});var UCu={};ji(UCu,{withSslmode:()=>ezi,getDbDialect:()=>KM,getDb:()=>m0,getDatabaseUrl:()=>D_,createDatabase:()=>TCu,closeDatabase:()=>__});import{Kysely as TLt,PostgresDialect as ZCu}from"kysely";import{Pool as BCu}from"pg";function PLt(i){let u=i.connect.bind(i);return i.connect=(t)=>{if(typeof t==="function")return u(t);let f=performance.now(),l=H1i(),E=i.idleCount===0&&i.totalCount>=l,c=i.idleCount;return u().then((w)=>{let $=performance.now()-f;if(NCu().record($,{"db.pool.outcome":E?"contended":"available"}),$>ALt)if(E)console.error("Slow db pool acquire \u2014 pool saturated:",{waitMs:$,total:i.totalCount,idle:i.idleCount,waiting:i.waitingCount,max:l});else console.warn("Slow db pool acquire \u2014 event-loop lag (not pool):",{waitMs:$,idleAtStart:c,total:i.totalCount,max:l});return w},(w)=>{throw NCu().record(performance.now()-f,{"db.pool.outcome":"error"}),w})},i}function gCu(){try{return hu().databasePgSsl}catch{return!1}}function H1i(){try{return hu().databasePoolMax}catch{return 10}}function GLt(i){let u=PLt(new BCu({connectionString:i,max:H1i(),ssl:gCu(),...FCu})),t=new ZCu({pool:u});return{type:"postgres",db:new TLt({dialect:t,log:yLt(u)}),pool:u}}function D_(){return hu().databaseUrl}function ezi(i,u){if(!u)return i;let t=new URL(i);if(!t.searchParams.has("sslmode"))t.searchParams.set("sslmode","verify-full");return t.toString()}function KM(i){let u=i||D_();return new ZCu({pool:new BCu({connectionString:u,max:H1i(),ssl:gCu(),...FCu})})}function TCu(i){let u=i||D_();return GLt(u)}async function __(i){if(await i.db.destroy(),!i.pool.ended)await i.pool.end();if(i===JM)JM=null}function m0(){if(!JM)JM=TCu(D_());return JM}var ULt=()=>At.createHistogram("db.query.duration",{description:"Database query execution duration in milliseconds",unit:"ms"}),NCu=()=>At.createHistogram("db.pool.acquire.duration",{description:"Time spent waiting to acquire a connection from the pool",unit:"ms"}),OCu=400,ALt=100,yLt=(i)=>(u)=>{let t={"db.statement":u.query.sql,"db.status":u.level==="error"?"error":"success"};if(u.queryDurationMillis>OCu){let f=DCu(),l=f>OCu/2;console.error(l?"Slow query measurement \u2014 likely event-loop lag, not slow SQL:":"Slow query detected:",{durationMs:u.queryDurationMillis,eventLoopLagMs:Math.round(f),sql:u.query.sql,pool:{total:i.totalCount,idle:i.idleCount,waiting:i.waitingCount,max:H1i()}})}if(ULt().record(u.queryDurationMillis,t),u.level==="error")console.error("Query failed:",{durationMs:u.queryDurationMillis,error:u.error,sql:u.query.sql})},FCu,JM=null;var b6=O(()=>{z0();X1();mzi();FCu={keepAlive:!0,keepAliveInitialDelayMillis:1e4,idleTimeoutMillis:300000,connectionTimeoutMillis:30000,allowExitOnIdle:!0}});function yCu(i){let{port:u,query:t}=i,{protocol:f,path:l,hostname:E}=i;if(f&&f.slice(-1)!==":")f+=":";if(u)E+=`:${u}`;if(l&&l.charAt(0)!=="/")l=`/${l}`;let c=t?ACu.buildQueryString(t):"";if(c&&c[0]!=="?")c=`?${c}`;let w="";if(i.username!=null||i.password!=null){let h=i.username??"",v=i.password??"";w=`${h}:${v}@`}let $="";if(i.fragment)$=`#${i.fragment}`;return`${f}//${w}${E}${l}${c}${$}`}var ACu;var PCu=O(()=>{ACu=j(Xui(),1)});var GCu="UNSIGNED-PAYLOAD",ICu="X-Amz-Content-Sha256";class z1i{signer;constructor(i){let u={service:i.signingName||i.service||"s3",uriEscapePath:i.uriEscapePath||!1,applyChecksum:i.applyChecksum||!1,...i};this.signer=new xCu.SignatureV4MultiRegion(u)}presign(i,{unsignableHeaders:u=new Set,hoistableHeaders:t=new Set,unhoistableHeaders:f=new Set,...l}={}){return this.prepareRequest(i,{unsignableHeaders:u,unhoistableHeaders:f,hoistableHeaders:t}),this.signer.presign(i,{expiresIn:900,unsignableHeaders:u,unhoistableHeaders:f,...l})}presignWithCredentials(i,u,{unsignableHeaders:t=new Set,hoistableHeaders:f=new Set,unhoistableHeaders:l=new Set,...E}={}){return this.prepareRequest(i,{unsignableHeaders:t,unhoistableHeaders:l,hoistableHeaders:f}),this.signer.presignWithCredentials(i,u,{expiresIn:900,unsignableHeaders:t,unhoistableHeaders:l,...E})}prepareRequest(i,{unsignableHeaders:u=new Set,unhoistableHeaders:t=new Set,hoistableHeaders:f=new Set}={}){u.add("content-type"),Object.keys(i.headers).map((w)=>w.toLowerCase()).filter((w)=>w.startsWith("x-amz-server-side-encryption")).forEach((w)=>{if(!f.has(w))t.add(w)}),i.headers[ICu]=GCu;let l=i.headers.host,E=i.port,c=`${i.hostname}${i.port!=null?":"+E:""}`;if(!l||l===i.hostname&&i.port!=null)i.headers.host=c}}var xCu;var azi=O(()=>{xCu=j(OS(),1)});var kCu,jCu,n1i=async(i,u,t={})=>{let f,l;if(typeof i.config.endpointProvider==="function"){let D=(await kCu.getEndpointFromInstructions(u.input,u.constructor,i.config)).properties?.authSchemes?.[0];if(D?.name==="sigv4a")l=D?.signingRegionSet?.join(",");else l=D?.signingRegion;f=new z1i({...i.config,signingName:D?.signingName,region:async()=>l})}else f=new z1i(i.config);let E=(d,D)=>async(_)=>{let{request:N}=_;if(!jCu.HttpRequest.isInstance(N))throw Error("Request to be presigned is not an valid HTTP request.");delete N.headers["amz-sdk-invocation-id"],delete N.headers["amz-sdk-request"],delete N.headers["x-amz-user-agent"];let Z,B={...t,signingRegion:t.signingRegion??D.signing_region??l,signingService:t.signingService??D.signing_service};if(D.s3ExpressIdentity)Z=await f.presignWithCredentials(N,D.s3ExpressIdentity,B);else Z=await f.presign(N,B);return{response:{},output:{$metadata:{httpStatusCode:200},presigned:Z}}},c="presignInterceptMiddleware",w=i.middlewareStack.clone();w.addRelativeTo(E,{name:c,relation:"before",toMiddleware:"awsAuthMiddleware",override:!0});let $=u.resolveMiddleware(w,i.config,{}),{output:h}=await $({input:u.input}),{presigned:v}=h;return yCu(v)};var XCu=O(()=>{PCu();azi();kCu=j(Nu(),1),jCu=j(r4(),1)});var JCu=O(()=>{XCu();azi()});import{extname as ILt}from"path";function cd(i){let u;try{u=decodeURIComponent(i)}catch{u=i}let f=u.replace(/\0/g,"").replace(/[\x00-\x1f\x7f]/g,"").replace(/\\/g,"/").split("/"),l=[];for(let E of f)if(E==="..")l.pop();else if(E!=="."&&E!=="")l.push(E);return l.join("/")}function N_(i,u){let t=cd(u);if(!t)throw Error("Key is empty after sanitization");return`${i}/${t}`}function KCu(i,u){if(!u)return`${i}/`;let t=cd(u);return`${i}/${t}${t.endsWith("/")?"":"/"}`}function fL(i,u,t){let f=t.split("/").map(encodeURIComponent).join("/");return`${i}/api/${encodeURIComponent(u)}/files/${f}`}function ozi(i,u){let t=`${i}/`;if(u.startsWith(t))return u.slice(t.length);return u}function C6(i){let u=ILt(i).toLowerCase();return xLt[u]??"application/octet-stream"}function R1i(i){let u=i.split(";")[0].trim();if(kLt.has(u))return!0;if(u.startsWith("text/"))return!0;return!1}var xLt,kLt;var wd=O(()=>{xLt={".json":"application/json",".html":"text/html",".htm":"text/html",".css":"text/css",".js":"application/javascript",".mjs":"application/javascript",".ts":"text/typescript",".txt":"text/plain",".md":"text/markdown",".csv":"text/csv",".xml":"application/xml",".svg":"image/svg+xml",".png":"image/png",".jpg":"image/jpeg",".jpeg":"image/jpeg",".gif":"image/gif",".webp":"image/webp",".pdf":"application/pdf",".zip":"application/zip",".gz":"application/gzip",".tar":"application/x-tar",".wasm":"application/wasm",".yaml":"application/yaml",".yml":"application/yaml",".toml":"application/toml"};kLt=new Set(["application/json","text/html","text/css","application/javascript","text/typescript","text/plain","text/markdown","text/csv","application/xml","image/svg+xml","application/yaml","application/toml"])});class szi{client;bucket;constructor(i){this.bucket=i.bucket,this.client=new Ec({endpoint:i.endpoint,region:i.region,credentials:{accessKeyId:i.accessKeyId,secretAccessKey:i.secretAccessKey},forcePathStyle:i.forcePathStyle})}async getBytesOrPresign(i,u,t){let f=N_(i,u),l=await this.client.send(new B5({Bucket:this.bucket,Key:f})),E=l.ContentLength??0,c=l.ContentType??C6(u);if(E>t.presignWhenLargerThan){let v=await n1i(this.client,new kD({Bucket:this.bucket,Key:f}),{expiresIn:t.presignExpiresIn??3600});return{error:"FILE_TOO_LARGE",size:E,maxInlineSize:t.presignWhenLargerThan,presignedUrl:v,contentType:c}}let $=await(await this.client.send(new kD({Bucket:this.bucket,Key:f}))).Body.transformToByteArray(),h=R1i(c);return{content:h?new TextDecoder().decode($):Buffer.from($).toString("base64"),contentType:c,encoding:h?"utf-8":"base64",size:E,lastModified:l.LastModified,etag:l.ETag}}async getBytes(i,u){let t=N_(i,u);return(await this.client.send(new kD({Bucket:this.bucket,Key:t}))).Body.transformToByteArray()}async put(i,u,t,f){let l=N_(i,u),E=f?.contentType??C6(u);return{etag:(await this.client.send(new Ed({Bucket:this.bucket,Key:l,Body:typeof t==="string"?Buffer.from(t,"utf-8"):t,ContentType:E}))).ETag,key:u}}async list(i,u){let t=KCu(i,u?.prefix),f=await this.client.send(new Cw({Bucket:this.bucket,Prefix:t,MaxKeys:u?.maxKeys??1000,ContinuationToken:u?.continuationToken,Delimiter:u?.delimiter})),l=f.CommonPrefixes?.map((E)=>ozi(i,E.Prefix??"")).filter(Boolean);return{objects:(f.Contents??[]).map((E)=>({key:ozi(i,E.Key??""),size:E.Size??0,lastModified:E.LastModified,etag:E.ETag})),isTruncated:f.IsTruncated??!1,nextContinuationToken:f.NextContinuationToken,commonPrefixes:l&&l.length>0?l:void 0}}async delete(i,u){let t=N_(i,u);await this.client.send(new RS({Bucket:this.bucket,Key:t}))}async head(i,u){let t=N_(i,u),f=await this.client.send(new B5({Bucket:this.bucket,Key:t}));return{contentType:f.ContentType??C6(u),size:f.ContentLength??0,lastModified:f.LastModified,etag:f.ETag}}async presignedGetUrl(i,u,t=3600,f){let l=N_(i,u);return n1i(this.client,new kD({Bucket:this.bucket,Key:l}),{expiresIn:t})}async presignedPutUrl(i,u,t=3600,f){let l=N_(i,u);return n1i(this.client,new Ed({Bucket:this.bucket,Key:l,ContentType:f}),{expiresIn:t})}}var YCu=O(()=>{ZM();JCu();wd()});function jLt(){let i=hu();return!!(i.s3Endpoint&&i.s3Bucket&&i.s3AccessKeyId&&i.s3SecretAccessKey)}function ec(){if(YM!==void 0)return YM;if(!jLt())return YM=null,null;let i=hu();return YM=new szi({endpoint:i.s3Endpoint,bucket:i.s3Bucket,region:i.s3Region,accessKeyId:i.s3AccessKeyId,secretAccessKey:i.s3SecretAccessKey,forcePathStyle:i.s3ForcePathStyle}),YM}var YM;var O_=O(()=>{z0();YCu()});function Vw(i,u){return{getBytesOrPresign:(t,f)=>i.getBytesOrPresign(u,t,f),getBytes:(t)=>i.getBytes(u,t),put:(t,f,l)=>i.put(u,t,f,l),list:(t)=>i.list(u,t),delete:(t)=>i.delete(u,t),head:(t)=>i.head(u,t),presignedGetUrl:(t,f,l)=>i.presignedGetUrl(u,t,f,l),presignedPutUrl:(t,f,l)=>i.presignedPutUrl(u,t,f,l)}}import{createHash as XLt}from"crypto";function WCu(i){let u=i;while(u?.[b1i])u=u[b1i];return u}function SM(i){let{objectStorage:u,baseUrl:t,orgSlug:f,prefix:l="connection-icons",maxBytes:E=KLt,dryRun:c=!1}=i;return async(w)=>{if(typeof w!=="string")return w;let $=w.match(JLt);if(!$)return w;if(!u||!f)return w;let[,h,v]=$,d=h.toLowerCase(),D=WLt[d];if(!D)return w;if(Math.floor(v.length*3/4)>E)return console.warn(`[asset-hoister] asset exceeds ${E} bytes, keeping inline`),w;let _=Buffer.from(v,"base64"),N=XLt("sha256").update(_).digest("hex"),Z=`${l}/${N}.${D}`;if(c)return fL(t,f,Z);try{return await u.put(Z,_,{contentType:d}),fL(t,f,Z)}catch(B){return console.error("[asset-hoister] upload failed, keeping inline asset:",B),w}}}async function C1i(i,u,t=0){if(t>YLt)return i;if(typeof i==="string")return await u(i)??i;if(Array.isArray(i)){let f=await Promise.all(i.map((l)=>C1i(l,u,t+1)));return f.some((l,E)=>l!==i[E])?f:i}if(i!==null&&typeof i==="object"){let f=Object.entries(i),l=await Promise.all(f.map(([,w])=>C1i(w,u,t+1))),E=!1,c={};return f.forEach(([w,$],h)=>{if(c[w]=l[h],l[h]!==$)E=!0}),E?c:i}return i}function M1i(i,u){return C1i(i,u)}async function WM(i,u){let t={...i};if(typeof t.icon==="string")t.icon=await u(t.icon);if(t.metadata!==null&&typeof t.metadata==="object")t.metadata=await C1i(t.metadata,u);return t}function SLt(i,u){return new Proxy(i,{get(t,f,l){if(f===b1i)return t;if(f==="create")return async(c)=>t.create(await WM(c,u));if(f==="createNew")return async(c)=>t.createNew(await WM(c,u));if(f==="update")return async(c,w)=>t.update(c,await WM(w,u));let E=Reflect.get(t,f,l);return typeof E==="function"?E.bind(t):E}})}function LLt(i,u){return new Proxy(i,{get(t,f,l){if(f===b1i)return t;if(f==="create")return async(c,w,$,h)=>t.create(c,w,await WM($,u),h);if(f==="update")return async(c,w,$)=>t.update(c,w,await WM($,u));let E=Reflect.get(t,f,l);return typeof E==="function"?E.bind(t):E}})}function pzi(i,u){let t=SM(u);if(SCu(i.connections))i.connections=SLt(WCu(i.connections),t);if(SCu(i.virtualMcps))i.virtualMcps=LLt(WCu(i.virtualMcps),t)}function SCu(i){return i!==null&&typeof i==="object"}var JLt,KLt=5242880,YLt=64,b1i,WLt;var q1i=O(()=>{wd();JLt=/^data:((?:image|audio|video)\/[^;,]+)(?:;[^,]+)?;base64,(.+)$/is,b1i=Symbol("assetHoistingTarget"),WLt={"image/png":"png","image/jpeg":"jpg","image/gif":"gif","image/webp":"webp","image/x-icon":"ico","image/vnd.microsoft.icon":"ico","audio/mpeg":"mp3","audio/mp4":"m4a","audio/wav":"wav","audio/x-wav":"wav","audio/ogg":"ogg","audio/webm":"weba","audio/aac":"aac","video/mp4":"mp4","video/webm":"webm","video/ogg":"ogv","video/quicktime":"mov"}});function cl(){let i=hu();if(i.baseUrl)return i.baseUrl;return`http://localhost:${i.port??3000}`}function V1i(){return`http://localhost:${hu().port??3000}`}function FE(){return process.env.STUDIO_PUBLIC_URL??process.env.MESH_PUBLIC_URL??cl()}var Ml=O(()=>{z0()});var LCu={};ji(LCu,{backfillThreadAssetsCommand:()=>QLt});import{sql as ini}from"kysely";async function QLt(i){let{dryRun:u,batch:t}=i,f=i.baseUrl??cl(),l=ec();if(!l)return console.error("[backfill-assets] Object storage (S3) is not configured \u2014 cannot hoist "+"inline media. Set S3_ENDPOINT/S3_BUCKET/S3_ACCESS_KEY_ID/S3_SECRET_ACCESS_KEY and retry."),1;if(/^https?:\/\/localhost(:|\/|$)/.test(f))console.warn(`[backfill-assets] base URL resolves to "${f}" \u2014 set BASE_URL `+"(or pass --base-url) to the public origin, or stored media URLs will be wrong.");let E=m0(),{db:c}=E,w;if(i.org){let Z=await c.selectFrom("organization").select(["id","slug"]).where((B)=>B.or([B("id","=",i.org),B("slug","=",i.org)])).executeTakeFirst();if(!Z)return console.error(`[backfill-assets] org "${i.org}" not found (slug or id).`),await __(E).catch(()=>{}),1;w=Z.id,console.log(`[backfill-assets] scoped to org ${Z.slug??Z.id} (${Z.id})`)}console.log(`[backfill-assets] starting${u?" (dry-run)":""} \u2014 target=${i.target} baseUrl=${f} batch=${t}${i.limit?` limit=${i.limit}`:""}`);let $=new Map,h=(Z,B,F)=>{let g=`${F}\x00${Z}`,T=$.get(g);if(T)return T;let U=SM({objectStorage:Vw(l,Z),baseUrl:f,orgSlug:B??void 0,prefix:F,dryRun:u});return $.set(g,U),U},v=async(Z,B,F,g)=>{let T="";for(;;){let U=i.limit?i.limit-F.scanned:1/0;if(U<=0)break;let A=await Z(T,Math.min(t,U));if(A.length===0)break;for(let G of A)T=G.id,F.scanned++,await B(G);console.log(`[backfill-assets] ${g}: scanned=${F.scanned} ${u?"would-change":"changed"}=${F.changed} errors=${F.errors} cursor=${T}`)}},d={scanned:0,changed:0,errors:0},D={scanned:0,changed:0,errors:0},_={scanned:0,changed:0,errors:0};try{if(i.target==="all"||i.target==="threads")await v((Z,B)=>c.selectFrom("thread_messages as tm").innerJoin("threads as t","t.id","tm.thread_id").innerJoin("organization as o","o.id","t.organization_id").select(["tm.id as id",ini`tm.parts`.as("parts"),ini`tm.metadata`.as("metadata"),"t.organization_id as orgId","o.slug as orgSlug"]).where("tm.id",">",Z).$if(!!w,(F)=>F.where("t.organization_id","=",w)).orderBy("tm.id","asc").limit(B).execute(),async(Z)=>{try{if(!LM(Z.parts)&&!LM(Z.metadata))return;let B=h(Z.orgId,Z.orgSlug,"thread-assets"),F=JSON.parse(Z.parts),g=await M1i(F,B),T=g!==F,U=Z.metadata!==null?JSON.parse(Z.metadata):null,A=await M1i(U,B),G=A!==U;if(!T&&!G)return;if(d.changed++,u)return;await c.updateTable("thread_messages").set({parts:T?JSON.stringify(g):Z.parts,metadata:G?JSON.stringify(A):Z.metadata}).where("id","=",Z.id).execute()}catch(B){d.errors++,console.error(`[backfill-assets] thread_message ${Z.id} failed, skipping:`,B)}},d,"threads");if(i.target==="all"||i.target==="connections")await v((Z,B)=>c.selectFrom("connections as c").innerJoin("organization as o","o.id","c.organization_id").select(["c.id as id","c.icon as icon",ini`c.metadata`.as("metadata"),"c.organization_id as orgId","o.slug as orgSlug"]).where("c.id",">",Z).$if(!!w,(F)=>F.where("c.organization_id","=",w)).orderBy("c.id","asc").limit(B).execute(),async(Z)=>{try{if(!LM(Z.icon)&&!LM(Z.metadata))return;let B=h(Z.orgId,Z.orgSlug,"connection-icons"),F=Z.icon!==null?await B(Z.icon):Z.icon,g=F!==Z.icon,T=Z.metadata!==null?JSON.parse(Z.metadata):null,U=await M1i(T,B),A=U!==T;if(!g&&!A)return;if(D.changed++,u)return;await c.updateTable("connections").set({icon:g?F??null:Z.icon,metadata:A?JSON.stringify(U):Z.metadata}).where("id","=",Z.id).execute()}catch(B){D.errors++,console.error(`[backfill-assets] connection ${Z.id} failed, skipping:`,B)}},D,"connections");if(i.target==="all"||i.target==="organizations")await v((Z,B)=>c.selectFrom("organization as o").select(["o.id as id","o.logo as logo","o.slug as orgSlug"]).where("o.id",">",Z).$if(!!w,(F)=>F.where("o.id","=",w)).orderBy("o.id","asc").limit(B).execute(),async(Z)=>{try{if(!LM(Z.logo))return;let F=await h(Z.id,Z.orgSlug,"org-logos")(Z.logo);if(F===Z.logo)return;if(_.changed++,u)return;await c.updateTable("organization").set({logo:F??null}).where("id","=",Z.id).execute()}catch(B){_.errors++,console.error(`[backfill-assets] organization ${Z.id} failed, skipping:`,B)}},_,"organizations")}finally{await __(E).catch(()=>{})}let N=u?"would-change":"changed";return console.log("[backfill-assets] done \u2014 "+`threads(scanned=${d.scanned} ${N}=${d.changed} errors=${d.errors}) connections(scanned=${D.scanned} ${N}=${D.changed} errors=${D.errors}) organizations(scanned=${_.scanned} ${N}=${_.changed} errors=${_.errors})`),d.errors+D.errors+_.errors>0?1:0}var LM=(i)=>i!==null&&(i.includes("data:image/")||i.includes("data:audio/")||i.includes("data:video/"));var QCu=O(()=>{b6();O_();q1i();Ml()});async function HCu(i){let u,t,f=new Promise((c,w)=>{u=c,t=w});f.catch(()=>{});let l=!1,E=Bun.serve({port:i.port??0,hostname:"127.0.0.1",fetch(c){if(l)return new Response("",{status:204});let w=new URL(c.url),$=w.searchParams.get("code");if(w.searchParams.get("state")!==i.expectedState)return l=!0,t(Error("OAuth state mismatch")),new Response("State mismatch \u2014 close this tab.",{status:400});if(!$)return l=!0,t(Error("OAuth callback missing code")),new Response("Missing code \u2014 close this tab.",{status:400});return l=!0,u({code:$}),new Response(null,{status:302,headers:{location:i.successRedirectUrl}})}});return{url:`http://127.0.0.1:${E.port}`,waitForCallback:()=>f,close:()=>E.stop(!0)}}import{createHash as HLt,randomBytes as zLt}from"crypto";function nCu(){let i=zCu(zLt(32)),u=zCu(HLt("sha256").update(i).digest());return{verifier:i,challenge:u}}function zCu(i){return i.toString("base64").replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}var RCu=()=>{};import{chmod as nLt,mkdir as RLt,readdir as bLt,readFile as CLt,rename as MLt,rm as bCu,writeFile as qLt}from"fs/promises";import{dirname as VLt,join as tni}from"path";function r1i(i,u){if(!u)return tni(i,"session.json");return tni(i,`session.${rLt(u)}.json`)}function rLt(i){let u=i;try{u=new URL(i).host}catch{}return u.replace(/[^a-zA-Z0-9.-]/g,"_")||"default"}async function uni(i){try{let u=await CLt(i,"utf8"),t=JSON.parse(u);if(!mLt(t))return null;return t}catch{return null}}async function CCu(i){try{return(await bLt(i)).filter((t)=>/^session(\..+)?\.json$/.test(t)).map((t)=>tni(i,t))}catch{return[]}}async function m1i(i,u){let t=await uni(r1i(i,u));if(t)return t;if(u)return uni(r1i(i));for(let f of await CCu(i)){let l=await uni(f);if(l)return l}return null}async function lL(i,u){let t=r1i(i,u.target);await RLt(VLt(t),{recursive:!0});let f=`${t}.tmp`;await qLt(f,JSON.stringify(u,null,2),{mode:384}),await nLt(f,384),await MLt(f,t)}async function MCu(i,u){if(u){await bCu(r1i(i,u),{force:!0});return}for(let t of await CCu(i))await bCu(t,{force:!0})}function mLt(i){if(!i||typeof i!=="object")return!1;let u=i;if(typeof u.target!=="string"||typeof u.clientId!=="string"||typeof u.accessToken!=="string"||typeof u.createdAt!=="string")return!1;if(!u.user||typeof u.user!=="object")return!1;if(typeof u.user.sub!=="string")return!1;return!0}var QM=()=>{};var qCu={};ji(qCu,{performInteractiveLogin:()=>e1i,loginCommand:()=>pLt});import{spawn as eLt}from"child_process";import{randomUUID as aLt}from"crypto";async function e1i(i={}){let u=(i.target??oLt).replace(/\/$/,""),t=i.fetch??fetch,f=i.openBrowser??fQt,l=aLt(),E=nCu(),c=await HCu({expectedState:l,successRedirectUrl:`${u}/cli/auth-success`});try{let w=`${c.url}/`,$=await iQt(t,u,w),h=new URLSearchParams({client_id:$,redirect_uri:w,response_type:"code",state:l,scope:sLt,code_challenge:E.challenge,code_challenge_method:"S256"}),v=`${u}/login?${h.toString()}`;console.log(`Opening ${v} in your browser...`),await f(v);let{code:d}=await c.waitForCallback(),D=await uQt(t,u,$,d,w,E.verifier);if(!D.id_token)throw Error("Token endpoint returned no id_token");let _=tQt(D.id_token);return{target:u,clientId:$,user:{sub:_.sub,email:_.email,name:_.name},accessToken:D.access_token,refreshToken:D.refresh_token,expiresAt:D.expires_in?Math.floor(Date.now()/1000)+D.expires_in:void 0,createdAt:new Date().toISOString()}}finally{c.close()}}async function pLt(i){try{let u=await e1i({target:i.target,openBrowser:i.openBrowser,fetch:i.fetch});return await lL(i.dataDir,u),console.log(`Logged in as ${u.user.email??u.user.sub}.`),0}catch(u){return console.error(`Login failed: ${u instanceof Error?u.message:String(u)}`),1}}async function iQt(i,u,t){let f=await i(`${u}/api/auth/mcp/register`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({client_name:"decocms-cli",redirect_uris:[t],grant_types:["authorization_code","refresh_token"],response_types:["code"],token_endpoint_auth_method:"none",application_type:"native"})});if(!f.ok)throw Error(`Client registration failed: HTTP ${f.status} ${await f.text().catch(()=>"")}`);let l=await f.json();if(typeof l?.client_id!=="string")throw Error("Client registration returned no client_id");return l.client_id}async function uQt(i,u,t,f,l,E){let c=new URLSearchParams({grant_type:"authorization_code",code:f,redirect_uri:l,client_id:t,code_verifier:E}),w=await i(`${u}/api/auth/mcp/token`,{method:"POST",headers:{"content-type":"application/x-www-form-urlencoded"},body:c.toString()});if(!w.ok)throw Error(`Token exchange failed: HTTP ${w.status} ${await w.text().catch(()=>"")}`);let $=await w.json();if(typeof $?.access_token!=="string")throw Error("Token endpoint returned no access_token");return $}function tQt(i){let u=i.split(".");if(u.length!==3||!u[1])throw Error("id_token is not a valid JWT");let t=JSON.parse(Buffer.from(u[1],"base64url").toString("utf8"));if(typeof t.sub!=="string")throw Error("id_token has no sub claim");return{sub:t.sub,email:typeof t.email==="string"?t.email:void 0,name:typeof t.name==="string"?t.name:void 0}}async function fQt(i){let u,t;switch(process.platform){case"darwin":u="open",t=[i];break;case"win32":u="cmd",t=["/c","start","",i];break;default:u="xdg-open",t=[i];break}await new Promise((f)=>{let l=eLt(u,t,{stdio:"ignore",detached:!0});l.on("error",()=>{console.log(`Could not open browser automatically. Please open this URL manually:
   ${i}`),f()}),l.on("spawn",()=>{l.unref(),f()})})}var oLt="https://studio.decocms.com",sLt="openid profile email offline_access";var fni=O(()=>{RCu();QM()});async function VCu(i,u=fetch,t=Date.now){if(!i.refreshToken)throw new lh("invalid_grant","Session has no refresh token");let f=new URLSearchParams({grant_type:"refresh_token",refresh_token:i.refreshToken,client_id:i.clientId}),l;try{l=await u(`${i.target}/api/auth/mcp/token`,{method:"POST",headers:{"content-type":"application/x-www-form-urlencoded"},body:f.toString()})}catch(c){throw new lh("transient",c instanceof Error?c.message:String(c))}if(!l.ok){let c=await l.text().catch(()=>"");if(l.status>=400&&l.status<500)throw new lh("invalid_grant",`HTTP ${l.status} ${c}`);throw new lh("transient",`HTTP ${l.status} ${c}`)}let E=await l.json();if(typeof E.access_token!=="string")throw new lh("transient","Token endpoint returned no access_token");return{...i,accessToken:E.access_token,refreshToken:E.refresh_token??i.refreshToken,expiresAt:E.expires_in?Math.floor(t()/1000)+E.expires_in:i.expiresAt}}var lh;var a1i=O(()=>{lh=class lh extends Error{kind;constructor(i,u){super(u);this.name="RefreshFailedError",this.kind=i}}});async function Z_(i){let u=await m1i(i.dataDir,i.target);if(!u)return null;let t=i.now??Date.now;if(!EQt(u,t()))return u;try{let f=await VCu(u,i.fetch,t);return await lL(i.dataDir,f),f}catch(f){if(f instanceof lh&&f.kind==="invalid_grant")return null;throw f}}function EQt(i,u){if(i.expiresAt===void 0)return!1;let t=Math.floor(u/1000);return i.expiresAt-lQt<t}var lQt=60;var HM=O(()=>{a1i();QM()});var rCu={};ji(rCu,{whoamiCommand:()=>cQt});async function cQt(i){let u;try{u=await Z_({dataDir:i.dataDir,fetch:i.fetch,now:i.now})}catch(t){if(t instanceof lh&&t.kind==="transient")return console.error(`Could not refresh session: ${t.message}. Run \`decocms auth login\` to authenticate.`),1;throw t}if(!u)return console.error("Not logged in. Run `decocms auth login` to authenticate."),1;return console.log(`Target: ${u.target}`),console.log(`User:   ${u.user.email??u.user.sub}`),0}var mCu=O(()=>{HM();a1i()});var eCu={};ji(eCu,{logoutCommand:()=>wQt});async function wQt(i){if(!await m1i(i.dataDir))return console.log("Already logged out."),0;return await MCu(i.dataDir),console.log("Logged out."),0}var aCu=O(()=>{QM()});async function o1i(i){let u=i.isInteractive??Boolean(process.stdout.isTTY),t;try{t=await Z_({dataDir:i.dataDir,target:i.target,fetch:i.fetch,now:i.now})}catch(l){if(l instanceof lh&&l.kind==="transient")throw Error(`Could not refresh session: ${l.message}. Run \`decocms auth login\` to sign in again.`);throw l}if(t&&i.target&&u&&!$Qt(t.target,i.target))t=null;if(t)return t;if(!u)throw Error("No session found. Run `decocms auth login` first, then re-run the command.");console.log(`Not logged in \u2014 opening browser to sign in to ${i.intent}.`);let f=await e1i({target:i.target,openBrowser:i.openBrowser,fetch:i.fetch});return await lL(i.dataDir,f),console.log(`Logged in as ${f.user.email??f.user.sub}.`),f}function $Qt(i,u){try{return new URL(i).host===new URL(u).host}catch{return i===u}}var lni=O(()=>{fni();HM();a1i();QM()});function T5(i){let u=i?.userName?.trim();if(!u||oCu.test(u))return null;let t=i?.userEmail?.trim();if(!t||oCu.test(t))return{userName:u};if(!hQt.test(t))return{userName:u};return{userName:u,userEmail:t}}var oCu,hQt;var s1i=O(()=>{oCu=/[\r\n<>]/,hQt=/^[^\s@<>]+@[^\s@<>]+\.[^\s@<>]+$/});var zM=O(()=>{O4();s1i()});async function ili(i){try{let u=await fetch(`${i}/health`,{signal:AbortSignal.timeout(vQt)});if(!u.ok)return null;let t=await u.json();if(typeof t==="object"&&t!==null&&typeof t.bootId==="string"&&typeof t.ready==="boolean"&&t.setup&&typeof t.setup.running==="boolean"&&typeof t.setup.done==="boolean")return t;return null}catch{return null}}async function uli(i){for(let u=0;u<sCu;u++){if(await ili(i)!==null)return;let t=(Math.random()*2-1)*dQt;await y0(pCu+t)}throw Error(`sandbox daemon at ${i} did not respond on /health within ${sCu*pCu/1000}s`)}async function B_(i,u,t,f,l){return DQt(i,u,"POST",t,f,l)}async function DQt(i,u,t,f,l,E){let c={...f};if(l&&l.rotateToken!==void 0)c.auth=l;let w=await fetch(`${i}/_sandbox/config`,{method:t,headers:{"Content-Type":"application/json",Authorization:`Bearer ${u}`},body:JSON.stringify(c),signal:AbortSignal.timeout(E?.timeoutMs??iMu)}),$=await w.text();if(!w.ok)throw new p1i(w.status,$);return JSON.parse($)}async function uMu(i,u,t){let f=await fetch(`${i}/_sandbox/orgfs-config`,{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${u}`},body:t,signal:AbortSignal.timeout(iMu)}),l=await f.text();if(!f.ok)throw Error(`sandbox daemon /_sandbox/orgfs-config returned ${f.status}: ${l}`);return JSON.parse(l)}async function nM(i,u,t,f){let l=new Headers(f.headers);for(let w of _Qt)l.delete(w);l.set("authorization",`Bearer ${u}`);let E=f.method!=="GET"&&f.method!=="HEAD",c=`${i}${t.startsWith("/")?t:`/${t}`}`;return fetch(c,{method:f.method,headers:l,body:E?f.body:void 0,redirect:"manual",signal:f.signal,duplex:E?"half":void 0})}var p1i,vQt=500,iMu=30000,sCu=25,pCu=200,dQt=50,_Qt;var Eni=O(()=>{zM();p1i=class p1i extends Error{status;constructor(i,u){super(`sandbox daemon /_sandbox/config returned ${i}: ${u}`);this.status=i;this.name="ConfigRequestError"}};_Qt=["cookie","host","connection","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","accept-encoding","content-length"]});var fMu=`var __create = Object.create;
@@ -83069,7 +83069,7 @@ ${w}`;v(B);return}if(c(null,F),t.strategy==="count"){if($--,$===0)v()}if(t.strat
   `);function v(d){if(t===void 0)return!0;let D=Zq(d),_=D&&Zq(t)?Dau(t):t,N=D?Dau(d):_au(d),Z=NVt(_,N);return Z===""||!Z.startsWith("..")&&!DVt(Z)}return{upsert(d){f.run({$handle:d.handle,$status:d.status,$sandboxPath:d.sandboxPath,$port:d.port??null,$previewUrl:d.previewUrl??null,$repoCloneUrl:d.repoCloneUrl??null,$branch:d.branch??null,$projectName:d.projectName??null,$error:d.error??null,$now:Date.now()})},list(){return l.all().map(i6i)},reconcile(){let d=Date.now();for(let D of l.all().map(i6i)){if(!v(D.sandboxPath)){E.run({$handle:D.handle,$now:d});continue}if(!Zq(D.sandboxPath)){c.run({$handle:D.handle,$now:d});continue}if(D.status==="spawning"||D.status==="ready"||D.status==="failed"||D.status==="missing")w.run({$handle:D.handle,$now:d})}return l.all().map(i6i)},prune(d){let D=[],_=[],N=this.reconcile();for(let Z of N){if(!v(Z.sandboxPath)){_.push({handle:Z.handle,sandboxPath:Z.sandboxPath,reason:"outside_root",deletedFiles:!1});continue}if(d.missing&&Z.status==="missing"){$.run({$handle:Z.handle}),D.push({handle:Z.handle,sandboxPath:Z.sandboxPath,reason:"missing",deletedFiles:!1});continue}if(!d.merged||!Zq(Z.sandboxPath))continue;if(Z.branch===null||Z.branch.trim()===""){_.push({handle:Z.handle,sandboxPath:Z.sandboxPath,reason:"no_branch",deletedFiles:!1});continue}if(!k_(Z.sandboxPath,["rev-parse","--is-inside-work-tree"]).ok){_.push({handle:Z.handle,sandboxPath:Z.sandboxPath,reason:"git_unavailable",deletedFiles:!1});continue}let B=k_(Z.sandboxPath,["status","--porcelain"]);if(!B.ok){_.push({handle:Z.handle,sandboxPath:Z.sandboxPath,reason:"git_unavailable",deletedFiles:!1});continue}if(B.stdout.trim()!==""){_.push({handle:Z.handle,sandboxPath:Z.sandboxPath,reason:"dirty_worktree",deletedFiles:!1});continue}let F=Oau(Z.sandboxPath,Z.branch);if(F===null){_.push({handle:Z.handle,sandboxPath:Z.sandboxPath,reason:"git_unavailable",deletedFiles:!1});continue}if(!F){_.push({handle:Z.handle,sandboxPath:Z.sandboxPath,reason:"branch_not_merged",deletedFiles:!1});continue}vVt(Z.sandboxPath,{recursive:!0,force:!0}),$.run({$handle:Z.handle}),D.push({handle:Z.handle,sandboxPath:Z.sandboxPath,reason:"merged",deletedFiles:!0})}return{removed:D,skipped:_}},delete(d){$.run({$handle:d})},inspect(d){let D=h.get({$handle:d});if(D===null)return null;let _=i6i(D),N=0,Z=null;if(Zq(_.sandboxPath)&&k_(_.sandboxPath,["rev-parse","--is-inside-work-tree"]).ok){let B=k_(_.sandboxPath,["status","--porcelain"]);if(B.ok){let F=B.stdout.trim();N=F===""?0:F.split(`
 `).length}if(_.branch!==null&&_.branch.trim()!=="")Z=Oau(_.sandboxPath,_.branch)}return{handle:_.handle,branch:_.branch,sandboxPath:_.sandboxPath,dirtyCount:N,merged:Z}},close(){u.close()}}}var Gbi=()=>{};function FVt(i,u){return u?[["umount","-f",i]]:[["fusermount","-uz",i],["umount","-l",i]]}function Bau(i,u){if(process.platform==="win32")return;for(let t of FVt(i,u))if(Bun.spawnSync(t,{stdout:"ignore",stderr:"ignore",timeout:5000}).exitCode===0)break}var Fau=()=>{};import{existsSync as gVt,readdirSync as TVt}from"fs";import{rm as UVt}from"fs/promises";import{join as gau}from"path";async function Tau(i,u={}){let t=u.detach??AVt,f=u.exists??gVt,l=u.readdir??((w)=>TVt(w)),E=u.rm??((w)=>UVt(w,{recursive:!0,force:!0})),c=gau(i,"org");if(f(c))for(let w of l(c))t(gau(c,w));await E(i)}var AVt=(i)=>Bau(i,process.platform==="darwin");var Uau=O(()=>{Fau()});import{join as yVt}from"path";function Aau(i){let u=i.purge??Tau;return{stopSandbox(t){return i.provider.deleteSandbox(t)},inspectSandbox(t){return i.registry.inspect(t)},async removeSandbox(t){try{return await B1(async()=>{if(await i.provider.deleteSandbox(t),i.provider.hasHandle(t))throw Error("Can't delete \u2014 run in progress");let l=i.registry.inspect(t)?.sandboxPath??yVt(i.dataDir,"sandboxes",t);await u(l)},{maxAttempts:2,minTimeout:250,jitter:0}),i.registry.delete(t),{ok:!0}}catch(f){let l=f instanceof H6?f.cause:f;return{ok:!1,error:l instanceof Error?l.message:String(l)}}}}}var yau=O(()=>{O4();Uau()});import{randomBytes as PVt}from"crypto";import{mkdir as GVt}from"fs/promises";import{createServer as IVt}from"net";import{join as xVt}from"path";function Pau(i,u){return Error(`sandbox failed to start: ${i}`,{cause:u})}function Gau(i){if(!(i instanceof Error))return!1;return i.name==="TimeoutError"||/timed out|timeout|operation was aborted|aborted/i.test(i.message)}function Iau(i){if(i instanceof Error){let u=i.cause;if(u instanceof Error&&u.message)return u.message;return i.message}return String(i)}function kVt(i){if(!i)return null;let u=i.trim().replace(/\/+$/,"");if(!u)return null;let t=u.split(/[/:]/).filter(Boolean).at(-1);if(!t)return null;return t.replace(/\.git$/i,"")||null}function jVt(i){return{repoCloneUrl:i.repo?.cloneUrl??null,branch:i.repo?.branch??null,projectName:kVt(i.repo?.cloneUrl)}}function xau(i){let u=i.maxSandboxes??20,t=new Map,f=i.pickPort??XVt,l=i.fetchImpl??fetch,E=i.resolvePreviewUrl??((N,Z)=>`http://127.0.0.1:${Z}`),c=(N)=>xVt(i.dataDir,"sandboxes",N),w=(N)=>{try{i.registry?.upsert(N)}catch(Z){console.warn(`[user-desktop] failed to persist sandbox lifecycle handle=${N.handle} status=${N.status}:`,Z)}},$=(N)=>{try{i.onEvent?.(N)}catch{}},h=async(N)=>{let Z=new AbortController,B=setTimeout(()=>Z.abort(),1500);try{let F=await l(`${N}/health`,{signal:Z.signal});if(!F.ok)console.warn(`[user-desktop] probe ${N}/health \u2192 ${F.status} (treating as dead)`);return F.ok}catch(F){return console.warn(`[user-desktop] probe ${N}/health failed: ${F instanceof Error?F.message:String(F)} (treating as dead)`),!1}finally{clearTimeout(B)}},v=(N)=>{console.warn(`[user-desktop] evicting dead daemon handle=${N.handle} port=${N.port}`);try{N.process.kill("SIGTERM")}catch{}if(t.get(N.handle)===N)t.delete(N.handle),w({handle:N.handle,status:"stopped",sandboxPath:c(N.handle),port:null,previewUrl:null,...N.registryMetadata,error:null}),$({handle:N.handle,phase:"evicted"})},d=new Map;function D(){if(t.size<u)return;let N=[...t.values()].filter((B)=>B.activeDispatchCount===0).sort((B,F)=>B.lastUsedAt-F.lastUsedAt);if(N.length===0){console.warn(`[user-desktop] at cap ${t.size}/${u} but every sandbox is pinned (active dispatch) \u2014 exceeding cap temporarily`);return}let Z=N[0];console.log(`[user-desktop] evicting LRU victim handle=${Z.handle} port=${Z.port} (cap ${u} reached, size=${t.size})`);try{Z.process.kill("SIGTERM")}catch{}t.delete(Z.handle),w({handle:Z.handle,status:"stopped",sandboxPath:c(Z.handle),port:null,previewUrl:null,...Z.registryMetadata,error:null}),$({handle:Z.handle,phase:"evicted"})}let _=async(N)=>{let Z=jVt(N),B=c(N.handle);w({handle:N.handle,status:"spawning",sandboxPath:B,port:null,previewUrl:null,...Z,error:null}),$({handle:N.handle,phase:"spawning",sandboxPath:B,projectName:Z.projectName,branch:Z.branch}),D();let F,g=null,T;try{await GVt(B,{recursive:!0}),console.log(`[user-desktop] ensure handle=${N.handle} repo=${N.repo?.cloneUrl??"(none)"} branch=${N.repo?.branch??"(none)"} runtime=${N.workload?.runtime??"(autodetect)"} pm=${N.workload?.packageManager??"(autodetect)"}`),T=PVt(24).toString("hex");let[k,I]=await Promise.all([f(),f()]);F=k,console.log(`[user-desktop] spawn handle=${N.handle} port=${F} devPort=${I} workdir=${B}`),g=await Promise.resolve(i.spawnDaemon({workdir:B,handle:N.handle,port:F,daemonToken:T,offloadAllowedHosts:N.offloadAllowedHosts??[],offloadAllowSameHostDev:N.offloadAllowSameHostDev??!1,orgFsConfigJson:N.orgFsConfigJson}));try{await i.waitForHealth(F)}catch(X){throw Pau("the sandbox didn't come online in time",X)}console.log(`[user-desktop] healthy handle=${N.handle} port=${F} \u2014 posting config`);try{await i.postConfig(F,I,{repo:N.repo,workload:N.workload,operator:N.operator},T)}catch(X){throw Pau(Gau(X)?"configuration timed out":"the sandbox rejected its configuration",X)}}catch(k){if((Gau(k)?console.warn:console.error)(`[user-desktop] sandbox bring-up failed handle=${N.handle} port=${F??"(none)"}${g?" (killing daemon)":""}:`,k),g)try{g.kill("SIGKILL")}catch{}throw $({handle:N.handle,phase:"failed",error:Iau(k),sandboxPath:B,projectName:Z.projectName,branch:Z.branch}),w({handle:N.handle,status:"failed",sandboxPath:B,port:null,previewUrl:null,...Z,error:Iau(k)}),k}if(!g||F===void 0)throw Error("sandbox bring-up invariant violated");let U=`http://127.0.0.1:${F}`,A=E(N.handle,F);console.log(`[user-desktop] ready handle=${N.handle} port=${F} sandboxApiUrl=${U} previewUrl=${A}`);let G={handle:N.handle,port:F,process:g,sandboxApiUrl:U,previewUrl:A,lastUsedAt:Date.now(),activeDispatchCount:0,daemonToken:T,registryMetadata:Z};if(t.set(N.handle,G),w({handle:N.handle,status:"ready",sandboxPath:B,port:F,previewUrl:A,...Z,error:null}),$({handle:N.handle,phase:"ready",port:F,previewUrl:A,sandboxPath:B,projectName:Z.projectName,branch:Z.branch}),g.exited)g.exited.then(()=>{if(t.get(N.handle)===G)console.warn(`[user-desktop] daemon process exited unexpectedly handle=${N.handle} port=${F} \u2014 removing from cache`),t.delete(N.handle),w({handle:N.handle,status:"stopped",sandboxPath:B,port:null,previewUrl:null,...Z,error:null}),$({handle:N.handle,phase:"evicted"});else console.log(`[user-desktop] daemon process exited handle=${N.handle} port=${F} (already replaced/removed)`)});return{sandboxApiUrl:U,previewUrl:A,port:F}};return{async ensureSandbox(N){let Z=t.get(N.handle);if(Z){if(await h(Z.sandboxApiUrl))return console.log(`[user-desktop] cache hit handle=${N.handle} port=${Z.port} (alive)`),Z.lastUsedAt=Date.now(),{sandboxApiUrl:Z.sandboxApiUrl,previewUrl:Z.previewUrl,port:Z.port};console.warn(`[user-desktop] cache stale handle=${N.handle} port=${Z.port} \u2014 respawning`),v(Z)}let B=d.get(N.handle);if(B)return console.log(`[user-desktop] joining in-flight ensure handle=${N.handle}`),B;let F=_(N).finally(()=>{d.delete(N.handle)});return d.set(N.handle,F),F},proxyPort(N){let Z=t.get(N);if(Z)Z.lastUsedAt=Date.now();return Z?.port??null},getDaemonToken(N){return t.get(N)?.daemonToken??null},hasHandle(N){return t.has(N)||d.has(N)},recordHit(N){let Z=t.get(N);if(Z)Z.lastUsedAt=Date.now()},acquireDispatch(N){let Z=t.get(N);if(!Z)return()=>{};Z.activeDispatchCount+=1;let B=!1;return()=>{if(B)return;B=!0;let F=t.get(N);if(F)F.activeDispatchCount=Math.max(0,F.activeDispatchCount-1)}},listSandboxes(){return[...t.values()]},async deleteSandbox(N){let Z=t.get(N);if(!Z){console.log(`[user-desktop] delete handle=${N} (not found, no-op)`);return}if(Z.activeDispatchCount>0){console.warn(`[user-desktop] delete handle=${N} port=${Z.port} REFUSED \u2014 ${Z.activeDispatchCount} active dispatch(es) in flight`);return}console.log(`[user-desktop] delete handle=${N} port=${Z.port}`);try{Z.process.kill("SIGTERM")}catch{}t.delete(N),w({handle:N,status:"stopped",sandboxPath:c(N),port:null,previewUrl:null,repoCloneUrl:null,branch:null,projectName:null,error:null}),$({handle:N,phase:"deleted"})},async shutdown(){console.log(`[user-desktop] shutdown \u2014 killing ${t.size} sandbox(es)`);for(let N of t.values())try{N.process.kill("SIGTERM")}catch{}t.clear()}}}function XVt(){return new Promise((i,u)=>{let t=IVt();t.unref(),t.on("error",u),t.listen(0,"127.0.0.1",()=>{let f=t.address();if(f&&typeof f==="object"){let l=f.port;t.close(()=>i(l))}else t.close(()=>u(Error("could not allocate port")))})})}var kau=()=>{};import{randomUUID as JVt}from"crypto";import{hostname as KVt}from"os";async function jau(i){let u=KVt()||void 0;i.monitor?.onMachine?.(u??"this machine");let t=$Mu(i.dataDir,{outFd:i.logFd,perSandboxLog:i.perSandboxLogs,hotReload:i.hotReload}),f=t6i({path:u6i(i.dataDir),managedSandboxRoot:`${i.dataDir}/sandboxes`}),l=!1,E=()=>{if(l)return;l=!0;try{f.close()}catch{}};try{let c=0,w=xau({dataDir:i.dataDir,registry:f,resolvePreviewUrl:(X,b)=>c>0?`http://${X}.localhost:${c}`:`http://127.0.0.1:${b}`,spawnDaemon:async(X)=>{let b={DAEMON_BOOT_ID:JVt(),APP_ROOT:X.workdir,PROXY_PORT:String(X.port),DAEMON_TOKEN:X.daemonToken,OFFLOAD_ALLOWED_HOSTS:X.offloadAllowedHosts.join(","),...X.offloadAllowSameHostDev?{OFFLOAD_ALLOW_SAME_HOST_DEV:"1"}:{}};if(X.orgFsConfigJson){let L=await DMu(i.dataDir);if(L)b.ORGFS_CONFIG=X.orgFsConfigJson,b.ORGFS_RCLONE_PATH=L}let K=await t({workdir:X.workdir,env:b,daemonPort:X.port});return{port:X.port,kill:(L)=>K.kill(L),exited:K.exited.then(()=>{return})}},postConfig:async(X,b,K,L)=>{let m={port:b};if(K.workload)m.runtime=K.workload.runtime,m.packageManager={name:K.workload.packageManager,...K.workload.packageManagerPath?{path:K.workload.packageManagerPath}:{}};let Q={application:m},ti=T5(K.operator??null);if(ti)Q.operator=ti;if(K.repo)Q.git={repository:{cloneUrl:K.repo.cloneUrl,branch:K.repo.branch,...K.repo.submoduleCredentials&&K.repo.submoduleCredentials.length>0?{submoduleCredentials:K.repo.submoduleCredentials}:{}},...K.repo.userName&&K.repo.userEmail?{identity:{userName:K.repo.userName,userEmail:K.repo.userEmail}}:{}};await B_(`http://127.0.0.1:${X}`,L,Q)},waitForHealth:async(X)=>{await uli(`http://127.0.0.1:${X}`)},maxSandboxes:20,onEvent:i.monitor?.onEvent}),$=await iau({port:i.port,lookupSandboxPort:(X)=>w.proxyPort(X)});c=$.port,console.log(`Local ingress listening on http://127.0.0.1:${$.port} (use http://<handle>.localhost:${$.port}/)`),i.monitor?.onIngress?.($.port);let h=NMu({provider:w}),v=async()=>{let X=await Z_({dataDir:i.dataDir,target:i.clusterBaseUrl});if(!X)throw Object.assign(Error(`Session for ${i.clusterBaseUrl} is no longer valid \u2014 run \`deco auth login --target ${i.clusterBaseUrl}\` and restart \`deco link\`.`),{fatal:!0});return X.accessToken},d=await vau(i.dataDir),D=process.env.npm_package_version??"0.0.0",_=await Pbi(),N=$au(_,{onChange:(X)=>{console.log(`[link-daemon] capabilities detected: +${X.join(",")} (now: ${_.join(",")})`)}}),Z=Dni({path:`${i.dataDir}/link/outbox.sqlite`});Z.clear();let B=()=>{},F=new AbortController,g={clusterBaseUrl:i.clusterBaseUrl,getAccessToken:v,provider:w,outbox:Z,controlHandler:h,capabilities:_,machineId:d,cliVersion:D,previewPort:$.port,onConnected:()=>{i.monitor?.onCluster?.("linked"),console.log(`Linked to ${i.clusterBaseUrl}`)},onShutdown:()=>B(),runLifetimeSignal:F.signal};console.log(`[link-daemon] transport=tunnel cluster=${i.clusterBaseUrl}`);let T=await beu(g);console.log("[link-daemon] active transport=tunnel");let U,A=new Promise((X)=>{U=X}),G=!1,k=async()=>{if(G)return;G=!0,F.abort(),console.log(`
 Shutting down\u2026`),N();try{await T.close()}catch{}try{await $.stop()}catch{}try{await w.shutdown()}catch{}try{Z.close()}catch{}E(),U(0)};process.on("SIGINT",()=>void k()),process.on("SIGTERM",()=>void k()),B=()=>{console.log("Disconnect requested from the Studio web UI \u2014 shutting down. Run `bunx decocms@latest link` to reconnect."),k()},T.closed.then(()=>{if(i.monitor?.onCluster?.("closed"),!G)console.error("Cluster connection closed permanently; exiting."),k()});let I=Aau({provider:w,registry:f,dataDir:i.dataDir});return{stopped:A,stop:k,stopSandbox:I.stopSandbox,removeSandbox:I.removeSandbox,inspectSandbox:I.inspectSandbox}}catch(c){throw E(),c}}var Xau=O(()=>{Eni();zM();hMu();_Mu();OMu();_ni();Ceu();uau();hau();dau();HM();Gbi();yau();kau()});function Ibi(i){return i.map((u)=>typeof u==="string"?u:String(u)).join(" ")}import{createServer as YVt}from"net";async function SVt(i){for(let u of WVt)if(await xbi(i,u))return u;return null}async function Jau(i,{intervalMs:u=1000}={}){for(;;){let t=await SVt(i);if(t)return t;await y0(u)}}function xbi(i,u){return new Promise((t)=>{let f=YVt();f.once("error",(l)=>{t(l.code==="EADDRINUSE")}),f.listen(i,u,()=>{f.close(()=>t(!1))})})}var WVt;var kbi=O(()=>{O4();WVt=["localhost","127.0.0.1","0.0.0.0"]});function Kau(i){return typeof i==="object"&&i!==null&&"code"in i&&i.code==="EADDRINUSE"}function LVt(i,u=process.platform){if(u==="win32")return`for /f "tokens=5" %P in ('netstat -ano ^| findstr /R /C:":${i} .*LISTENING"') do taskkill /F /PID %P`;return`kill -9 $(lsof -ti tcp:${i})`}function Yau(i,u=process.platform){return[`Port ${i} is already in use.`,"Run this command to stop the process listening on it, then retry `decocms link`:","",`  ${LVt(i,u)}`].join(`
-`)}var jbi;var Wau=O(()=>{jbi=class jbi extends Error{port;code="EADDRINUSE";constructor(i){super(`Port ${i} is already in use.`);this.port=i;this.name="PortInUseError"}}});var gL;var f6i=O(()=>{gL={name:"decocms",version:"4.126.1",description:"Deco CMS \u2014 Self-hostable MCP Gateway for managing AI connections and tools",author:"Deco team",repository:{type:"git",url:"git+https://github.com/decocms/studio.git",directory:"apps/api"},bugs:{url:"https://github.com/decocms/studio/issues"},type:"module",bin:{deco:"./dist/server/cli.js"},files:["dist/**/*"],scripts:{dev:"bun run migrate && bun run dev:server","dev:server":"bun run --cwd=../../packages/sandbox build && NODE_ENV=development bun --env-file=.env --hot run src/index.ts",build:"bun run build:server","build:server":"bun run scripts/bundle-server-script.ts --dist ./dist/server","generate:tool-contracts":"bun run scripts/generate-tool-contracts.ts","db:migrate":"bun run ./dist/server/migrate.js",check:"tsc --noEmit",start:"bun run ./dist/server/server.js",migrate:"bun run src/database/migrate.ts",test:"bun test src","better-auth:migrate":"bunx --bun @better-auth/cli migrate -y --config src/auth/index.ts","smoke:link":"bun run scripts/smoke-link.ts",prepublishOnly:"bun run --cwd=../.. build:studio"},optionalDependencies:{"@anthropic-ai/claude-agent-sdk":"^0.3.181","@duckdb/node-api":"^1.5.0-r.1","@openai/codex":"0.144.3","@openai/codex-darwin-arm64":"npm:@openai/codex@0.144.3-darwin-arm64","@openai/codex-darwin-x64":"npm:@openai/codex@0.144.3-darwin-x64","@openai/codex-linux-arm64":"npm:@openai/codex@0.144.3-linux-arm64","@openai/codex-linux-x64":"npm:@openai/codex@0.144.3-linux-x64","@openai/codex-win32-arm64":"npm:@openai/codex@0.144.3-win32-arm64","@openai/codex-win32-x64":"npm:@openai/codex@0.144.3-win32-x64"},dependencies:{"@ai-sdk/anthropic":"^3.0.85","@ai-sdk/google":"^3.0.83","@ai-sdk/openai":"^3.0.73","@anthropic-ai/sdk":"^0.105.0","@aws-sdk/client-s3":"^3.1013.0","@aws-sdk/client-sts":"^3.1013.0","@aws-sdk/lib-storage":"^3.1013.0","@aws-sdk/s3-request-presigner":"^3.1013.0","@clickhouse/client":"^1.8.1","@dbos-inc/dbos-sdk":"^4.21.6","@inkjs/ui":"^2.0.0","@nats-io/jetstream":"3.4.0","@nats-io/kv":"3.4.0","@nats-io/nats-core":"3.4.0","@nats-io/transport-node":"3.4.0","@openrouter/ai-sdk-provider":"^2.9.1","@opentelemetry/core":"^2.6.0","@resvg/resvg-js":"^2.6.2","embedded-postgres":"^18.3.0-beta.16",ink:"^6.8.0",kysely:"^0.28.12","node-pty":"^1.0.0","posthog-node":"^5.0.0",react:"^19.2.6","react-dom":"^19.2.6",satori:"^0.28.2"},devDependencies:{"@ai-sdk/provider":"^3.0.10","@better-auth/sso":"1.4.1","@decocms/better-auth":"1.5.17","@decocms/bindings":"workspace:*","@decocms/harness":"workspace:*","@decocms/mcp-utils":"workspace:*","@decocms/runtime":"workspace:*","@decocms/sandbox":"workspace:*","@decocms/shared":"workspace:*","@decocms/tunnel":"workspace:*","@jitl/quickjs-wasmfile-release-sync":"0.31.0","@modelcontextprotocol/sdk":"1.29.0","@nats-io/jwt":"0.0.10-5","@opentelemetry/api":"^1.9.0","@opentelemetry/api-logs":"^0.211.0","@opentelemetry/exporter-logs-otlp-proto":"^0.211.0","@opentelemetry/exporter-prometheus":"^0.208.0","@opentelemetry/exporter-trace-otlp-proto":"^0.207.0","@opentelemetry/instrumentation-runtime-node":"^0.24.0","@opentelemetry/resources":"^2.6.0","@opentelemetry/sdk-logs":"^0.211.0","@opentelemetry/sdk-metrics":"^2.2.0","@opentelemetry/sdk-node":"^0.207.0","@opentelemetry/sdk-trace-base":"^2.5.0","@types/bun":"^1.3.1","@types/google.maps":"^3.65.2","@types/pg":"^8.15.6","@types/react-syntax-highlighter":"^15.5.13","@vercel/nft":"^1.1.1",ai:"^6.0.208","better-auth":"1.4.22",croner:"^9.1.0",degit:"^2.8.4",hono:"^4.10.7",jose:"^6.0.11",nanoid:"^5.1.6",pg:"^8.16.3",typescript:"^5.9.3",vite:"^7.2.1",zod:"^4.0.0"},homepage:"https://github.com/decocms/studio",keywords:["mcp","model-context-protocol","ai","gateway","self-hosted","tools"],license:"MIT",publishConfig:{access:"public"}}});var Bq={};ji(Bq,{printBanner:()=>zVt,bannerLines:()=>Sau,BANNER_LINES:()=>l6i,BANNER_GRADIENT:()=>E6i});function HVt(i){let u=Number.parseInt(i.slice(1),16);return[u>>16&255,u>>8&255,u&255]}function Sau(i){let u=l6i.map((t,f)=>{let[l,E,c]=HVt(E6i[f]);return`\x1B[38;2;${l};${E};${c}m${t}\x1B[39m`});if(i!==void 0)u.push(`\x1B[2m  v${i}\x1B[22m`);return u}function zVt(i){console.log("");for(let u of Sau(i))console.log(u);console.log("")}var l6i,E6i;var TL=O(()=>{l6i=[" \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588     \u2588\u2588\u2588\u2588\u2588\u2588\u2588   ","\u2591\u2591\u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2588\u2588\u2588 \u2591\u2591\u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2591\u2588  \u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2591\u2588\u2588\u2588  \u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2591\u2588\u2588\u2588 "," \u2591\u2588\u2588\u2588   \u2591\u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588  \u2588 \u2591  \u2588\u2588\u2588     \u2591\u2591\u2591  \u2588\u2588\u2588     \u2591\u2591\u2588\u2588\u2588"," \u2591\u2588\u2588\u2588    \u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588\u2588\u2588\u2588   \u2591\u2588\u2588\u2588         \u2591\u2588\u2588\u2588      \u2591\u2588\u2588\u2588"," \u2591\u2588\u2588\u2588    \u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588\u2591\u2591\u2588   \u2591\u2588\u2588\u2588         \u2591\u2588\u2588\u2588      \u2591\u2588\u2588\u2588"," \u2591\u2588\u2588\u2588    \u2588\u2588\u2588  \u2591\u2588\u2588\u2588 \u2591   \u2588\u2591\u2591\u2588\u2588\u2588     \u2588\u2588\u2588\u2591\u2591\u2588\u2588\u2588     \u2588\u2588\u2588 "," \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588 \u2591\u2591\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588  \u2591\u2591\u2591\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2591  ","\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591   \u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591   \u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591     \u2591\u2591\u2591\u2591\u2591\u2591\u2591   "],E6i=["#00ff64","#00ee5e","#00dc56","#00c84e","#00b444","#00a03c","#008832","#006e28"]});import{Box as nVt,Text as Lau}from"ink";import{jsx as RVt,jsxs as Qau}from"react/jsx-runtime";function c6i({version:i}){return Qau(nVt,{flexDirection:"column",marginTop:1,children:[l6i.map((u,t)=>RVt(Lau,{color:E6i[t],children:u},t)),Qau(Lau,{dimColor:!0,children:[" v",i]})]})}var Xbi=O(()=>{TL()});function Hau(i){let u=i.branch??i.handle,t=[];if(i.dirtyCount>0)t.push(`${i.dirtyCount} uncommitted file${i.dirtyCount===1?"":"s"}`);if(i.merged===!1)t.push("branch not merged");return t.length>0?`\u26A0 ${t.join(", ")} \u2014 delete ${u}? (y/n)`:`Delete ${u}? (y/n)`}function UL(i){return[...i.values()].map((u)=>u.handle).sort((u,t)=>u.localeCompare(t))}function zau(i,u,t){if(i.length===0)return null;let f=u===null?-1:i.indexOf(u);if(f===-1)return t>0?i[0]:i[i.length-1];let l=Math.max(0,Math.min(i.length-1,f+t));return i[l]}function nau(i,u,t){if(t!==u)return t;let f=i.indexOf(u);if(f===-1)return t;return i[f+1]??i[f-1]??null}var Wbi={};ji(Wbi,{subscribeLinkState:()=>Jbi,setSelectedHandle:()=>Kbi,setRemoving:()=>h6i,setPersistedSandboxes:()=>oVt,setPendingConfirm:()=>gq,setMachine:()=>rVt,setLogPath:()=>eVt,setLinkActions:()=>aVt,setIngress:()=>VVt,setDaemonError:()=>mVt,setClusterUrl:()=>qVt,setCluster:()=>MVt,setActionError:()=>$6i,resetLinkStateForTests:()=>pVt,removeSandboxRow:()=>Ybi,pushSandboxEvent:()=>sVt,getLinkState:()=>Fq,applySandboxEvent:()=>Rau});function CVt(i){return i==="spawning"||i==="ready"||i==="failed"}function Rau(i,u){let t=new Map(i),f=t.get(u.handle);if(u.phase==="evicted"||u.phase==="deleted"){if(f)t.set(u.handle,{...f,port:null,previewUrl:null,status:"stopped",error:null});return t}return t.set(u.handle,{handle:u.handle,port:u.port??f?.port??null,previewUrl:u.previewUrl??f?.previewUrl??null,status:u.phase,error:u.phase==="failed"?u.error??"failed":null,projectName:u.projectName??f?.projectName??null,branch:u.branch??f?.branch??null,sandboxPath:u.sandboxPath??f?.sandboxPath??null}),t}function bau(){return{cluster:"connecting",clusterUrl:null,ingressUrl:null,ingressPort:null,machine:null,cap:bVt,sandboxes:new Map,daemonError:null,logPath:null,selectedHandle:null,pendingConfirm:null,removingHandles:new Set,actionError:null,actions:null}}function b3(){for(let i of w6i)i()}function Fq(){return lf}function Jbi(i){return w6i.add(i),()=>w6i.delete(i)}function MVt(i){lf={...lf,cluster:i},b3()}function qVt(i){lf={...lf,clusterUrl:i},b3()}function VVt(i,u){lf={...lf,ingressPort:i,ingressUrl:u},b3()}function rVt(i){lf={...lf,machine:i},b3()}function mVt(i){lf={...lf,daemonError:i},b3()}function eVt(i){lf={...lf,logPath:i},b3()}function Kbi(i){lf={...lf,selectedHandle:i},b3()}function gq(i){lf={...lf,pendingConfirm:i},b3()}function $6i(i){lf={...lf,actionError:i},b3()}function h6i(i,u){if(lf.removingHandles.has(i)===u)return;let t=new Set(lf.removingHandles);if(u)t.add(i);else t.delete(i);lf={...lf,removingHandles:t},b3()}function aVt(i){lf={...lf,actions:i},b3()}function Ybi(i){let u=UL(lf.sandboxes),t=nau(u,i,lf.selectedHandle),f=new Map(lf.sandboxes);f.delete(i);let l=new Set(lf.removingHandles);l.delete(i),lf={...lf,sandboxes:f,selectedHandle:t,pendingConfirm:null,removingHandles:l},b3()}function oVt(i){let u=new Map;for(let t of i)u.set(t.handle,{handle:t.handle,port:t.port,previewUrl:t.previewUrl,status:t.status,error:t.error,projectName:t.projectName,branch:t.branch,sandboxPath:t.sandboxPath});for(let[t,f]of lf.sandboxes)if(CVt(f.status))u.set(t,f);lf={...lf,sandboxes:u},b3()}function sVt(i){lf={...lf,sandboxes:Rau(lf.sandboxes,i)},b3()}function pVt(){lf=bau(),w6i.clear()}var bVt=20,lf,w6i;var Tq=O(()=>{lf=bau(),w6i=new Set});import{spawn as irt}from"child_process";function urt(i){if(i==="darwin")return"open";if(i==="win32")return"start";return"xdg-open"}function Cau(i,u=process.platform){let t=urt(u);try{irt(t,[i],{stdio:"ignore",detached:!0}).unref()}catch{}}var Mau=()=>{};function qau(i,u={}){let t=u.openUrl??Cau,f=Fq(),l=UL(f.sandboxes),E=f.selectedHandle!==null&&l.includes(f.selectedHandle)?f.selectedHandle:l[0]??null,c=f.actions;switch(i.type){case"move":Kbi(zau(l,f.selectedHandle,i.delta));return;case"open":{if(E===null)return;let w=f.sandboxes.get(E);if(w?.status==="ready"&&w.previewUrl)t(w.previewUrl);return}case"stop":if(E!==null&&c)c.stopSandbox(E);return;case"delete":{if(E===null||!c)return;let w=c.inspectSandbox(E),$=f.sandboxes.get(E);$6i(null),gq({handle:E,branch:w?.branch??$?.branch??null,dirtyCount:w?.dirtyCount??0,merged:w?.merged??null});return}case"confirmYes":{let w=f.pendingConfirm;if(gq(null),w===null||!c)return;h6i(w.handle,!0),c.removeSandbox(w.handle).then(($)=>{if($.ok)Ybi(w.handle);else h6i(w.handle,!1),$6i($.error)});return}case"confirmNo":gq(null);return;case"quit":if(c)c.quit();return}}var Vau=O(()=>{Tq();Mau()});function rau(i,u,t){if(t)return i==="y"||i==="Y"?{type:"confirmYes"}:{type:"confirmNo"};if(u.upArrow||i==="k")return{type:"move",delta:-1};if(u.downArrow||i==="j")return{type:"move",delta:1};if(i==="s")return{type:"stop"};if(i==="d")return{type:"delete"};if(i==="o")return{type:"open"};if(i==="q"||u.ctrl===!0&&i==="c")return{type:"quit"};return null}var mau={};ji(mau,{LinkApp:()=>Ert});import{Box as b1,Text as hl,useInput as trt}from"ink";import{useSyncExternalStore as frt}from"react";import{jsx as kf,jsxs as J5}from"react/jsx-runtime";function lrt(i,u){if(u)return{color:"yellow",text:"\u25CC Removing\u2026"};if(i.status==="ready")return{color:"green",text:"\u25CF Live"};if(i.status==="spawning")return{color:"yellow",text:"\u25CC Starting\u2026"};if(i.status==="stopped")return{color:"gray",text:"\u25A0 Stopped"};if(i.status==="missing")return{color:"yellow",text:"\u25A1 Missing"};if(i.status==="merged")return{color:"cyan",text:"\u2713 Merged"};if(i.status==="invalid")return{color:"red",text:"\u2717 Invalid"};if(i.status==="failed")return{color:"red",text:`\u2717 Failed: ${i.error??"failed"}`};return{color:"red",text:`\u2717 Error: ${i.error??""}`}}function Ert(){let i=frt(Jbi,Fq),u=[...i.sandboxes.values()].sort((l,E)=>l.handle.localeCompare(E.handle)),t=UL(i.sandboxes),f=i.selectedHandle!==null&&t.includes(i.selectedHandle)?i.selectedHandle:t[0]??null;return trt((l,E)=>{let c=rau(l,E,i.pendingConfirm!==null);if(c!==null)qau(c)}),J5(b1,{flexDirection:"column",children:[kf(c6i,{version:gL.version}),kf(b1,{marginBottom:1,children:kf(hl,{dimColor:!0,children:"\u2500".repeat(80)})}),kf(b1,{children:i.cluster==="linked"?J5(hl,{color:"green",children:["\u2713 Connected to ",i.clusterUrl??"deco"]}):i.cluster==="connecting"?J5(hl,{color:"yellow",children:["\u25CC Connecting to ",i.clusterUrl??"deco","\u2026"]}):J5(hl,{color:"red",children:["\u2717 Disconnected from ",i.clusterUrl??"deco"]})}),kf(b1,{children:i.ingressUrl?J5(hl,{color:"green",children:["\u2713 Serving at ",i.ingressUrl]}):kf(hl,{dimColor:!0,children:"\u25CC Starting local server\u2026"})}),kf(b1,{marginBottom:1,children:kf(hl,{dimColor:!0,children:`${"Computer".padEnd(16)}${i.machine??"this computer"} \xB7 ${u.length} of ${i.cap} previews`})}),u.length===0?kf(hl,{dimColor:!0,children:"No previews running yet."}):J5(b1,{flexDirection:"column",children:[J5(b1,{children:[kf(b1,{width:2,flexShrink:0}),kf(b1,{width:AL.project,flexShrink:0,marginRight:1,children:kf(hl,{dimColor:!0,wrap:"truncate-end",children:"PROJECT"})}),kf(b1,{width:AL.branch,flexShrink:0,marginRight:1,children:kf(hl,{dimColor:!0,wrap:"truncate-end",children:"BRANCH"})}),kf(b1,{width:AL.status,flexShrink:0,marginRight:1,children:kf(hl,{dimColor:!0,wrap:"truncate-end",children:"STATUS"})}),kf(b1,{flexGrow:1,children:kf(hl,{dimColor:!0,wrap:"truncate-end",children:"PREVIEW URL"})})]}),u.map((l)=>{let E=lrt(l,i.removingHandles.has(l.handle)),c=l.handle===f;return J5(b1,{children:[kf(b1,{width:2,flexShrink:0,children:kf(hl,{color:"cyan",children:c?"\u203A":" "})}),kf(b1,{width:AL.project,flexShrink:0,marginRight:1,children:kf(hl,{bold:c,wrap:"truncate-end",children:l.projectName??l.handle})}),kf(b1,{width:AL.branch,flexShrink:0,marginRight:1,children:kf(hl,{bold:c,wrap:"truncate-end",children:l.branch??"\u2014"})}),kf(b1,{width:AL.status,flexShrink:0,marginRight:1,children:kf(hl,{color:E.color,bold:c,wrap:"truncate-end",children:E.text})}),kf(b1,{flexGrow:1,children:kf(hl,{dimColor:!0,wrap:"truncate-end",children:l.previewUrl??"\u2014"})})]},l.handle)})]}),i.daemonError?kf(b1,{marginTop:1,children:J5(hl,{color:"red",children:["\u26A0 ",i.daemonError]})}):null,i.logPath?kf(b1,{marginTop:1,children:J5(hl,{dimColor:!0,children:["Logs: ",i.logPath]})}):null,i.pendingConfirm?kf(b1,{marginTop:1,children:kf(hl,{color:"yellow",children:Hau(i.pendingConfirm)})}):null,i.actionError?kf(b1,{marginTop:1,children:J5(hl,{color:"red",children:["\u2717 ",i.actionError]})}):null,kf(b1,{marginTop:1,children:kf(hl,{dimColor:!0,children:"\u2191\u2193 move \xB7 s stop \xB7 d delete \xB7 o open \xB7 q quit"})})]})}var AL;var eau=O(()=>{f6i();Xbi();Vau();Tq();AL={project:18,branch:22,status:14}});var aau={};ji(aau,{runLinkCommand:()=>_rt});import{closeSync as crt,mkdirSync as wrt,openSync as $rt,writeSync as hrt}from"fs";import{homedir as vrt}from"os";import{join as Sbi}from"path";function drt(i,u){let t={log:console.log,warn:console.warn,error:console.error},f=(l)=>{if(u===void 0)return;try{hrt(u,`${Ibi(l)}
+`)}var jbi;var Wau=O(()=>{jbi=class jbi extends Error{port;code="EADDRINUSE";constructor(i){super(`Port ${i} is already in use.`);this.port=i;this.name="PortInUseError"}}});var gL;var f6i=O(()=>{gL={name:"decocms",version:"4.126.2",description:"Deco CMS \u2014 Self-hostable MCP Gateway for managing AI connections and tools",author:"Deco team",repository:{type:"git",url:"git+https://github.com/decocms/studio.git",directory:"apps/api"},bugs:{url:"https://github.com/decocms/studio/issues"},type:"module",bin:{deco:"./dist/server/cli.js"},files:["dist/**/*"],scripts:{dev:"bun run migrate && bun run dev:server","dev:server":"bun run --cwd=../../packages/sandbox build && NODE_ENV=development bun --env-file=.env --hot run src/index.ts",build:"bun run build:server","build:server":"bun run scripts/bundle-server-script.ts --dist ./dist/server","generate:tool-contracts":"bun run scripts/generate-tool-contracts.ts","db:migrate":"bun run ./dist/server/migrate.js",check:"tsc --noEmit",start:"bun run ./dist/server/server.js",migrate:"bun run src/database/migrate.ts",test:"bun test src","better-auth:migrate":"bunx --bun @better-auth/cli migrate -y --config src/auth/index.ts","smoke:link":"bun run scripts/smoke-link.ts",prepublishOnly:"bun run --cwd=../.. build:studio"},optionalDependencies:{"@anthropic-ai/claude-agent-sdk":"^0.3.181","@duckdb/node-api":"^1.5.0-r.1","@openai/codex":"0.144.3","@openai/codex-darwin-arm64":"npm:@openai/codex@0.144.3-darwin-arm64","@openai/codex-darwin-x64":"npm:@openai/codex@0.144.3-darwin-x64","@openai/codex-linux-arm64":"npm:@openai/codex@0.144.3-linux-arm64","@openai/codex-linux-x64":"npm:@openai/codex@0.144.3-linux-x64","@openai/codex-win32-arm64":"npm:@openai/codex@0.144.3-win32-arm64","@openai/codex-win32-x64":"npm:@openai/codex@0.144.3-win32-x64"},dependencies:{"@ai-sdk/anthropic":"^3.0.85","@ai-sdk/google":"^3.0.83","@ai-sdk/openai":"^3.0.73","@anthropic-ai/sdk":"^0.105.0","@aws-sdk/client-s3":"^3.1013.0","@aws-sdk/client-sts":"^3.1013.0","@aws-sdk/lib-storage":"^3.1013.0","@aws-sdk/s3-request-presigner":"^3.1013.0","@clickhouse/client":"^1.8.1","@dbos-inc/dbos-sdk":"^4.21.6","@inkjs/ui":"^2.0.0","@nats-io/jetstream":"3.4.0","@nats-io/kv":"3.4.0","@nats-io/nats-core":"3.4.0","@nats-io/transport-node":"3.4.0","@openrouter/ai-sdk-provider":"^2.9.1","@opentelemetry/core":"^2.6.0","@resvg/resvg-js":"^2.6.2","embedded-postgres":"^18.3.0-beta.16",ink:"^6.8.0",kysely:"^0.28.12","node-pty":"^1.0.0","posthog-node":"^5.0.0",react:"^19.2.6","react-dom":"^19.2.6",satori:"^0.28.2"},devDependencies:{"@ai-sdk/provider":"^3.0.10","@better-auth/sso":"1.4.1","@decocms/better-auth":"1.5.17","@decocms/bindings":"workspace:*","@decocms/harness":"workspace:*","@decocms/mcp-utils":"workspace:*","@decocms/runtime":"workspace:*","@decocms/sandbox":"workspace:*","@decocms/shared":"workspace:*","@decocms/tunnel":"workspace:*","@jitl/quickjs-wasmfile-release-sync":"0.31.0","@modelcontextprotocol/sdk":"1.29.0","@nats-io/jwt":"0.0.10-5","@opentelemetry/api":"^1.9.0","@opentelemetry/api-logs":"^0.211.0","@opentelemetry/exporter-logs-otlp-proto":"^0.211.0","@opentelemetry/exporter-prometheus":"^0.208.0","@opentelemetry/exporter-trace-otlp-proto":"^0.207.0","@opentelemetry/instrumentation-runtime-node":"^0.24.0","@opentelemetry/resources":"^2.6.0","@opentelemetry/sdk-logs":"^0.211.0","@opentelemetry/sdk-metrics":"^2.2.0","@opentelemetry/sdk-node":"^0.207.0","@opentelemetry/sdk-trace-base":"^2.5.0","@types/bun":"^1.3.1","@types/google.maps":"^3.65.2","@types/pg":"^8.15.6","@types/react-syntax-highlighter":"^15.5.13","@vercel/nft":"^1.1.1",ai:"^6.0.208","better-auth":"1.4.22",croner:"^9.1.0",degit:"^2.8.4",hono:"^4.10.7",jose:"^6.0.11",nanoid:"^5.1.6",pg:"^8.16.3",typescript:"^5.9.3",vite:"^7.2.1",zod:"^4.0.0"},homepage:"https://github.com/decocms/studio",keywords:["mcp","model-context-protocol","ai","gateway","self-hosted","tools"],license:"MIT",publishConfig:{access:"public"}}});var Bq={};ji(Bq,{printBanner:()=>zVt,bannerLines:()=>Sau,BANNER_LINES:()=>l6i,BANNER_GRADIENT:()=>E6i});function HVt(i){let u=Number.parseInt(i.slice(1),16);return[u>>16&255,u>>8&255,u&255]}function Sau(i){let u=l6i.map((t,f)=>{let[l,E,c]=HVt(E6i[f]);return`\x1B[38;2;${l};${E};${c}m${t}\x1B[39m`});if(i!==void 0)u.push(`\x1B[2m  v${i}\x1B[22m`);return u}function zVt(i){console.log("");for(let u of Sau(i))console.log(u);console.log("")}var l6i,E6i;var TL=O(()=>{l6i=[" \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588     \u2588\u2588\u2588\u2588\u2588\u2588\u2588   ","\u2591\u2591\u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2588\u2588\u2588 \u2591\u2591\u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2591\u2588  \u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2591\u2588\u2588\u2588  \u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2591\u2588\u2588\u2588 "," \u2591\u2588\u2588\u2588   \u2591\u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588  \u2588 \u2591  \u2588\u2588\u2588     \u2591\u2591\u2591  \u2588\u2588\u2588     \u2591\u2591\u2588\u2588\u2588"," \u2591\u2588\u2588\u2588    \u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588\u2588\u2588\u2588   \u2591\u2588\u2588\u2588         \u2591\u2588\u2588\u2588      \u2591\u2588\u2588\u2588"," \u2591\u2588\u2588\u2588    \u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588\u2591\u2591\u2588   \u2591\u2588\u2588\u2588         \u2591\u2588\u2588\u2588      \u2591\u2588\u2588\u2588"," \u2591\u2588\u2588\u2588    \u2588\u2588\u2588  \u2591\u2588\u2588\u2588 \u2591   \u2588\u2591\u2591\u2588\u2588\u2588     \u2588\u2588\u2588\u2591\u2591\u2588\u2588\u2588     \u2588\u2588\u2588 "," \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588 \u2591\u2591\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588  \u2591\u2591\u2591\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2591  ","\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591   \u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591   \u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591     \u2591\u2591\u2591\u2591\u2591\u2591\u2591   "],E6i=["#00ff64","#00ee5e","#00dc56","#00c84e","#00b444","#00a03c","#008832","#006e28"]});import{Box as nVt,Text as Lau}from"ink";import{jsx as RVt,jsxs as Qau}from"react/jsx-runtime";function c6i({version:i}){return Qau(nVt,{flexDirection:"column",marginTop:1,children:[l6i.map((u,t)=>RVt(Lau,{color:E6i[t],children:u},t)),Qau(Lau,{dimColor:!0,children:[" v",i]})]})}var Xbi=O(()=>{TL()});function Hau(i){let u=i.branch??i.handle,t=[];if(i.dirtyCount>0)t.push(`${i.dirtyCount} uncommitted file${i.dirtyCount===1?"":"s"}`);if(i.merged===!1)t.push("branch not merged");return t.length>0?`\u26A0 ${t.join(", ")} \u2014 delete ${u}? (y/n)`:`Delete ${u}? (y/n)`}function UL(i){return[...i.values()].map((u)=>u.handle).sort((u,t)=>u.localeCompare(t))}function zau(i,u,t){if(i.length===0)return null;let f=u===null?-1:i.indexOf(u);if(f===-1)return t>0?i[0]:i[i.length-1];let l=Math.max(0,Math.min(i.length-1,f+t));return i[l]}function nau(i,u,t){if(t!==u)return t;let f=i.indexOf(u);if(f===-1)return t;return i[f+1]??i[f-1]??null}var Wbi={};ji(Wbi,{subscribeLinkState:()=>Jbi,setSelectedHandle:()=>Kbi,setRemoving:()=>h6i,setPersistedSandboxes:()=>oVt,setPendingConfirm:()=>gq,setMachine:()=>rVt,setLogPath:()=>eVt,setLinkActions:()=>aVt,setIngress:()=>VVt,setDaemonError:()=>mVt,setClusterUrl:()=>qVt,setCluster:()=>MVt,setActionError:()=>$6i,resetLinkStateForTests:()=>pVt,removeSandboxRow:()=>Ybi,pushSandboxEvent:()=>sVt,getLinkState:()=>Fq,applySandboxEvent:()=>Rau});function CVt(i){return i==="spawning"||i==="ready"||i==="failed"}function Rau(i,u){let t=new Map(i),f=t.get(u.handle);if(u.phase==="evicted"||u.phase==="deleted"){if(f)t.set(u.handle,{...f,port:null,previewUrl:null,status:"stopped",error:null});return t}return t.set(u.handle,{handle:u.handle,port:u.port??f?.port??null,previewUrl:u.previewUrl??f?.previewUrl??null,status:u.phase,error:u.phase==="failed"?u.error??"failed":null,projectName:u.projectName??f?.projectName??null,branch:u.branch??f?.branch??null,sandboxPath:u.sandboxPath??f?.sandboxPath??null}),t}function bau(){return{cluster:"connecting",clusterUrl:null,ingressUrl:null,ingressPort:null,machine:null,cap:bVt,sandboxes:new Map,daemonError:null,logPath:null,selectedHandle:null,pendingConfirm:null,removingHandles:new Set,actionError:null,actions:null}}function b3(){for(let i of w6i)i()}function Fq(){return lf}function Jbi(i){return w6i.add(i),()=>w6i.delete(i)}function MVt(i){lf={...lf,cluster:i},b3()}function qVt(i){lf={...lf,clusterUrl:i},b3()}function VVt(i,u){lf={...lf,ingressPort:i,ingressUrl:u},b3()}function rVt(i){lf={...lf,machine:i},b3()}function mVt(i){lf={...lf,daemonError:i},b3()}function eVt(i){lf={...lf,logPath:i},b3()}function Kbi(i){lf={...lf,selectedHandle:i},b3()}function gq(i){lf={...lf,pendingConfirm:i},b3()}function $6i(i){lf={...lf,actionError:i},b3()}function h6i(i,u){if(lf.removingHandles.has(i)===u)return;let t=new Set(lf.removingHandles);if(u)t.add(i);else t.delete(i);lf={...lf,removingHandles:t},b3()}function aVt(i){lf={...lf,actions:i},b3()}function Ybi(i){let u=UL(lf.sandboxes),t=nau(u,i,lf.selectedHandle),f=new Map(lf.sandboxes);f.delete(i);let l=new Set(lf.removingHandles);l.delete(i),lf={...lf,sandboxes:f,selectedHandle:t,pendingConfirm:null,removingHandles:l},b3()}function oVt(i){let u=new Map;for(let t of i)u.set(t.handle,{handle:t.handle,port:t.port,previewUrl:t.previewUrl,status:t.status,error:t.error,projectName:t.projectName,branch:t.branch,sandboxPath:t.sandboxPath});for(let[t,f]of lf.sandboxes)if(CVt(f.status))u.set(t,f);lf={...lf,sandboxes:u},b3()}function sVt(i){lf={...lf,sandboxes:Rau(lf.sandboxes,i)},b3()}function pVt(){lf=bau(),w6i.clear()}var bVt=20,lf,w6i;var Tq=O(()=>{lf=bau(),w6i=new Set});import{spawn as irt}from"child_process";function urt(i){if(i==="darwin")return"open";if(i==="win32")return"start";return"xdg-open"}function Cau(i,u=process.platform){let t=urt(u);try{irt(t,[i],{stdio:"ignore",detached:!0}).unref()}catch{}}var Mau=()=>{};function qau(i,u={}){let t=u.openUrl??Cau,f=Fq(),l=UL(f.sandboxes),E=f.selectedHandle!==null&&l.includes(f.selectedHandle)?f.selectedHandle:l[0]??null,c=f.actions;switch(i.type){case"move":Kbi(zau(l,f.selectedHandle,i.delta));return;case"open":{if(E===null)return;let w=f.sandboxes.get(E);if(w?.status==="ready"&&w.previewUrl)t(w.previewUrl);return}case"stop":if(E!==null&&c)c.stopSandbox(E);return;case"delete":{if(E===null||!c)return;let w=c.inspectSandbox(E),$=f.sandboxes.get(E);$6i(null),gq({handle:E,branch:w?.branch??$?.branch??null,dirtyCount:w?.dirtyCount??0,merged:w?.merged??null});return}case"confirmYes":{let w=f.pendingConfirm;if(gq(null),w===null||!c)return;h6i(w.handle,!0),c.removeSandbox(w.handle).then(($)=>{if($.ok)Ybi(w.handle);else h6i(w.handle,!1),$6i($.error)});return}case"confirmNo":gq(null);return;case"quit":if(c)c.quit();return}}var Vau=O(()=>{Tq();Mau()});function rau(i,u,t){if(t)return i==="y"||i==="Y"?{type:"confirmYes"}:{type:"confirmNo"};if(u.upArrow||i==="k")return{type:"move",delta:-1};if(u.downArrow||i==="j")return{type:"move",delta:1};if(i==="s")return{type:"stop"};if(i==="d")return{type:"delete"};if(i==="o")return{type:"open"};if(i==="q"||u.ctrl===!0&&i==="c")return{type:"quit"};return null}var mau={};ji(mau,{LinkApp:()=>Ert});import{Box as b1,Text as hl,useInput as trt}from"ink";import{useSyncExternalStore as frt}from"react";import{jsx as kf,jsxs as J5}from"react/jsx-runtime";function lrt(i,u){if(u)return{color:"yellow",text:"\u25CC Removing\u2026"};if(i.status==="ready")return{color:"green",text:"\u25CF Live"};if(i.status==="spawning")return{color:"yellow",text:"\u25CC Starting\u2026"};if(i.status==="stopped")return{color:"gray",text:"\u25A0 Stopped"};if(i.status==="missing")return{color:"yellow",text:"\u25A1 Missing"};if(i.status==="merged")return{color:"cyan",text:"\u2713 Merged"};if(i.status==="invalid")return{color:"red",text:"\u2717 Invalid"};if(i.status==="failed")return{color:"red",text:`\u2717 Failed: ${i.error??"failed"}`};return{color:"red",text:`\u2717 Error: ${i.error??""}`}}function Ert(){let i=frt(Jbi,Fq),u=[...i.sandboxes.values()].sort((l,E)=>l.handle.localeCompare(E.handle)),t=UL(i.sandboxes),f=i.selectedHandle!==null&&t.includes(i.selectedHandle)?i.selectedHandle:t[0]??null;return trt((l,E)=>{let c=rau(l,E,i.pendingConfirm!==null);if(c!==null)qau(c)}),J5(b1,{flexDirection:"column",children:[kf(c6i,{version:gL.version}),kf(b1,{marginBottom:1,children:kf(hl,{dimColor:!0,children:"\u2500".repeat(80)})}),kf(b1,{children:i.cluster==="linked"?J5(hl,{color:"green",children:["\u2713 Connected to ",i.clusterUrl??"deco"]}):i.cluster==="connecting"?J5(hl,{color:"yellow",children:["\u25CC Connecting to ",i.clusterUrl??"deco","\u2026"]}):J5(hl,{color:"red",children:["\u2717 Disconnected from ",i.clusterUrl??"deco"]})}),kf(b1,{children:i.ingressUrl?J5(hl,{color:"green",children:["\u2713 Serving at ",i.ingressUrl]}):kf(hl,{dimColor:!0,children:"\u25CC Starting local server\u2026"})}),kf(b1,{marginBottom:1,children:kf(hl,{dimColor:!0,children:`${"Computer".padEnd(16)}${i.machine??"this computer"} \xB7 ${u.length} of ${i.cap} previews`})}),u.length===0?kf(hl,{dimColor:!0,children:"No previews running yet."}):J5(b1,{flexDirection:"column",children:[J5(b1,{children:[kf(b1,{width:2,flexShrink:0}),kf(b1,{width:AL.project,flexShrink:0,marginRight:1,children:kf(hl,{dimColor:!0,wrap:"truncate-end",children:"PROJECT"})}),kf(b1,{width:AL.branch,flexShrink:0,marginRight:1,children:kf(hl,{dimColor:!0,wrap:"truncate-end",children:"BRANCH"})}),kf(b1,{width:AL.status,flexShrink:0,marginRight:1,children:kf(hl,{dimColor:!0,wrap:"truncate-end",children:"STATUS"})}),kf(b1,{flexGrow:1,children:kf(hl,{dimColor:!0,wrap:"truncate-end",children:"PREVIEW URL"})})]}),u.map((l)=>{let E=lrt(l,i.removingHandles.has(l.handle)),c=l.handle===f;return J5(b1,{children:[kf(b1,{width:2,flexShrink:0,children:kf(hl,{color:"cyan",children:c?"\u203A":" "})}),kf(b1,{width:AL.project,flexShrink:0,marginRight:1,children:kf(hl,{bold:c,wrap:"truncate-end",children:l.projectName??l.handle})}),kf(b1,{width:AL.branch,flexShrink:0,marginRight:1,children:kf(hl,{bold:c,wrap:"truncate-end",children:l.branch??"\u2014"})}),kf(b1,{width:AL.status,flexShrink:0,marginRight:1,children:kf(hl,{color:E.color,bold:c,wrap:"truncate-end",children:E.text})}),kf(b1,{flexGrow:1,children:kf(hl,{dimColor:!0,wrap:"truncate-end",children:l.previewUrl??"\u2014"})})]},l.handle)})]}),i.daemonError?kf(b1,{marginTop:1,children:J5(hl,{color:"red",children:["\u26A0 ",i.daemonError]})}):null,i.logPath?kf(b1,{marginTop:1,children:J5(hl,{dimColor:!0,children:["Logs: ",i.logPath]})}):null,i.pendingConfirm?kf(b1,{marginTop:1,children:kf(hl,{color:"yellow",children:Hau(i.pendingConfirm)})}):null,i.actionError?kf(b1,{marginTop:1,children:J5(hl,{color:"red",children:["\u2717 ",i.actionError]})}):null,kf(b1,{marginTop:1,children:kf(hl,{dimColor:!0,children:"\u2191\u2193 move \xB7 s stop \xB7 d delete \xB7 o open \xB7 q quit"})})]})}var AL;var eau=O(()=>{f6i();Xbi();Vau();Tq();AL={project:18,branch:22,status:14}});var aau={};ji(aau,{runLinkCommand:()=>_rt});import{closeSync as crt,mkdirSync as wrt,openSync as $rt,writeSync as hrt}from"fs";import{homedir as vrt}from"os";import{join as Sbi}from"path";function drt(i,u){let t={log:console.log,warn:console.warn,error:console.error},f=(l)=>{if(u===void 0)return;try{hrt(u,`${Ibi(l)}
 `)}catch{}};return console.log=(...l)=>f(l),console.warn=(...l)=>f(l),console.error=(...l)=>{f(l),i(Ibi(l))},()=>{console.log=t.log,console.warn=t.warn,console.error=t.error}}async function Drt(i,u){let t;try{t=await fetch(`${i}/api/links/me`,{headers:{authorization:`Bearer ${u}`},signal:AbortSignal.timeout(1e4)})}catch{return}if(t.status===401||t.status===403)throw Error(`Authentication rejected by ${i} \u2014 the session token was not accepted. `+`Run \`deco auth login --target ${i}\` and try again.`)}async function _rt(i={}){let u=i.port??5174,t=i.dataDir??process.env.DATA_DIR??process.env.DECOCMS_HOME??Sbi(vrt(),"deco"),f=i.clusterBaseUrl??process.env.STUDIO_CLUSTER_URL??process.env.MESH_CLUSTER_URL??"https://studio.decocms.com",l,E,c,w=()=>{if(c===void 0)return;try{c.close()}catch{}finally{c=void 0}};try{if(await xbi(u,"127.0.0.1"))throw new jbi(u);let $=Sbi(t,"sandboxes");c=t6i({path:u6i(t),managedSandboxRoot:$});let h=await o1i({dataDir:t,intent:"Link",target:f});if(process.env.DECOCMS_LINK_MANAGED!=="1")await Drt(f,h.accessToken);let v=c.reconcile();if(i.prune){let N=c.prune({missing:!0,merged:!0});if(!i.tui)console.log(`Pruned local sandboxes: removed ${N.removed.length}, skipped ${N.skipped.length}.`);v=c.reconcile()}let d;if(i.tui){let{render:N}=await import("ink"),{createElement:Z}=await import("react"),{LinkApp:B}=await Promise.resolve().then(() => (eau(),mau)),{pushSandboxEvent:F,setCluster:g,setClusterUrl:T,setDaemonError:U,setIngress:A,setLogPath:G,setMachine:k,setPersistedSandboxes:I}=await Promise.resolve().then(() => (Tq(),Wbi));wrt(t,{recursive:!0});let X=Sbi(t,"link.log");E=$rt(X,"w"),G(X),I(v),T(f),g("connecting"),d={onEvent:(b)=>F(b),onIngress:(b)=>A(b,`http://127.0.0.1:${b}`),onCluster:(b)=>g(b),onMachine:(b)=>k(b)},l=drt(U,E),N(Z(B),{patchConsole:!1})}else if(i.banner!==!1){let{printBanner:N}=await Promise.resolve().then(() => (TL(),Bq));N(i.version??"0.0.0")}w();let D=process.env.DECOCMS_LINK_MANAGED!=="1",_=await jau({port:u,clusterBaseUrl:f,dataDir:t,session:h,monitor:d,logFd:E,perSandboxLogs:D,hotReload:i.hotReload});if(i.tui){let{setLinkActions:N}=await Promise.resolve().then(() => (Tq(),Wbi));N({stopSandbox:_.stopSandbox,removeSandbox:_.removeSandbox,inspectSandbox:_.inspectSandbox,quit:_.stop})}return await _.stopped}catch($){return l?.(),console.error(Kau($)?Yau(u):$ instanceof Error?$.message:String($)),1}finally{if(l?.(),E!==void 0)try{crt(E)}catch{}w()}}var oau=O(()=>{lni();Xau();kbi();Wau();Gbi()});var Rbi={};ji(Rbi,{resolveDevLinkClusterUrl:()=>Brt,populateDevLinkToxiProxy:()=>fou,isDevLinkToxiProxyEnabled:()=>Zrt,ensureDevLinkToxiProxy:()=>Art,buildDevLinkToxiProxyConfig:()=>uou,DEV_LINK_TOXIPROXY_SERVICE_NAME:()=>pau,DEV_LINK_TOXIPROXY_PROXY_NAME:()=>iou});function Zrt(i=process.env){return i.DECO_DEV_LINK_TOXIPROXY==="1"}function Lbi(i,u){if(!Number.isInteger(i)||i<1||i>65535)throw Error(`${u} must be an integer port in 1..65535`);return i}function uou(i){let u=new URL(i.serverUrl);if(u.protocol!=="http:")throw Error("DECO_DEV_LINK_TOXIPROXY only supports http local Studio URLs");let t=Lbi(i.apiPort,"apiPort"),f=Lbi(i.listenPort,"listenPort");if(u.port.length===0)throw Error("serverUrl must include an explicit valid port");let l=Lbi(Number.parseInt(u.port,10),"upstreamPort"),E=`http://127.0.0.1:${l}`,c=`http://127.0.0.1:${f}`;return{serviceName:pau,proxyName:iou,apiUrl:`http://127.0.0.1:${t}`,listen:`0.0.0.0:${f}`,upstream:`host.docker.internal:${l}`,publicTargetUrl:E,clusterUrl:c,logLine:`[dev-link-toxiproxy] ready: ${c} -> ${E}`}}function Brt(i){return i.toxiproxy?.clusterUrl??i.serverUrl}async function Qbi(i,u,t){if(i.ok)return;let f=await i.text();throw Error(`ToxiProxy ${u} failed for ${t}: status=${i.status} statusText=${i.statusText} body=${f}`)}function nbi(i){if(i instanceof Error)return i.name==="Error"?i.message:`${i.name}: ${i.message}`;return String(i)}function tou(i){if(!(i instanceof Error))return!1;if(i.name==="TimeoutError")return!0;return tou(i.cause)}async function Hbi(i,u,t,f){try{return await i(t,f)}catch(l){throw Error(`ToxiProxy ${u} failed for ${t}: ${nbi(l)}`,{cause:l})}}async function fou(i,u=fetch){let t=`${i.apiUrl}/reset`,f=await Hbi(u,"reset",t,{method:"POST"});await Qbi(f,"reset",t);let l=`${i.apiUrl}/populate`,E=await Hbi(u,"populate",l,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify([{name:i.proxyName,listen:i.listen,upstream:i.upstream,enabled:!0}])});await Qbi(E,"populate",l)}async function Frt(i,u){let t=`${i.apiUrl}/version`;try{await B1(async()=>{let f=await Hbi(u,"readiness check",t,{method:"GET",signal:AbortSignal.timeout(Ort)});await Qbi(f,"readiness check",t)},{maxAttempts:Nrt,minTimeout:sau,maxTimeout:sau,multiplier:1,jitter:0,isRetriable:(f)=>!tou(f)})}catch(f){let l=f instanceof H6?f.cause:f;throw Error(`ToxiProxy API did not become ready at ${t}: ${nbi(l)}`,{cause:l})}}async function grt(i){if(i===null)return"";return await new Response(i).text()}async function zbi(i,u={}){let t=["docker",...i].join(" "),f=(()=>{try{return Bun.spawn(["docker",...i],{stdout:"ignore",stderr:"pipe"})}catch(w){throw Error(`Docker command failed to start (${t}): ${nbi(w)}`,{cause:w})}})(),[l,E]=await Promise.all([f.exited,grt(f.stderr)]);if(l===0||u.ignoreFailure===!0)return;let c=E.trim().length>0?`: ${E.trim()}`:"";throw Error(`Docker command failed (${t}) with exit ${l}${c}`)}async function Trt(i,u){let t=`deco-dev-link-toxiproxy-${i}`;await zbi(["rm","-f",t],{ignoreFailure:!0}),await zbi(["run","--rm","-d","--name",t,"-p",`127.0.0.1:${i}:8474`,"-p",`127.0.0.1:${u}:${u}`,"ghcr.io/shopify/toxiproxy:2.12.0","-host=0.0.0.0"])}async function Urt(i,u){let t=`deco-dev-link-toxiproxy-${i}`;await zbi(["rm","-f",t],{ignoreFailure:!0})}async function Art(i){let u=uou(i),t=i.startDaemon??Trt,f=i.stopDaemon??(i.startDaemon===void 0?Urt:void 0);await t(i.apiPort,i.listenPort);let l=i.fetchImpl??fetch;try{await Frt(u,l),await fou(u,l)}catch(E){if(f!==void 0)try{await f(i.apiPort,i.listenPort)}catch{}throw E}return{config:u,stop:async()=>{if(f!==void 0)await f(i.apiPort,i.listenPort)}}}var pau="ToxiProxy",iou="dev_link_studio",Nrt=20,sau=100,Ort=100;var bbi=O(()=>{O4()});var lou={};ji(lou,{migrateBetterAuth:()=>Cbi});import{getMigrations as yrt}from"better-auth/db";import{sso as Prt}from"@better-auth/sso";import{organization as Grt}from"@decocms/better-auth/plugins";import{admin as Irt,apiKey as xrt,jwt as krt,magicLink as jrt,mcp as Xrt,openAPI as Jrt}from"better-auth/plugins";import{emailOTP as Krt}from"better-auth/plugins/email-otp";async function Cbi(i){let t={database:KM(i||D_()),plugins:[Grt({dynamicAccessControl:{enabled:!0,enableCustomResources:!0}}),Irt(),xrt(),krt(),Jrt(),Xrt({loginPage:"/login"}),Prt(),jrt({sendMagicLink:async()=>{}}),Krt({sendVerificationOTP:async()=>{}})]},{toBeAdded:f,toBeCreated:l,runMigrations:E}=await yrt(t);if(!f.length&&!l.length)return"up to date";return await E(),`${l.length+f.length} table(s) migrated`}var Mbi=O(()=>{b6()});var qbi={};ji(qbi,{up:()=>Yrt,down:()=>Wrt});import{sql as _d}from"kysely";async function Yrt(i){await i.schema.createTable("connections").addColumn("id","text",(u)=>u.primaryKey()).addColumn("organizationId","text",(u)=>u.notNull().references("organization.id").onDelete("cascade")).addColumn("createdById","text",(u)=>u.notNull().references("user.id").onDelete("cascade")).addColumn("name","text",(u)=>u.notNull()).addColumn("description","text").addColumn("icon","text").addColumn("appName","text").addColumn("appId","text").addColumn("connectionType","text",(u)=>u.notNull()).addColumn("connectionUrl","text",(u)=>u.notNull()).addColumn("connectionToken","text").addColumn("connectionHeaders","text").addColumn("oauthConfig","text").addColumn("metadata","text").addColumn("tools","text").addColumn("bindings","text").addColumn("status","text",(u)=>u.notNull().defaultTo("active")).addColumn("createdAt","text",(u)=>u.notNull().defaultTo(_d`CURRENT_TIMESTAMP`)).addColumn("updatedAt","text",(u)=>u.notNull().defaultTo(_d`CURRENT_TIMESTAMP`)).execute(),await i.schema.createTable("api_keys").addColumn("id","text",(u)=>u.primaryKey()).addColumn("userId","text",(u)=>u.notNull().references("user.id").onDelete("cascade")).addColumn("name","text",(u)=>u.notNull()).addColumn("hashedKey","text",(u)=>u.notNull().unique()).addColumn("permissions","text",(u)=>u.notNull()).addColumn("expiresAt","text").addColumn("remaining","integer").addColumn("metadata","text").addColumn("createdAt","text",(u)=>u.notNull().defaultTo(_d`CURRENT_TIMESTAMP`)).addColumn("updatedAt","text",(u)=>u.notNull().defaultTo(_d`CURRENT_TIMESTAMP`)).execute(),await i.schema.createTable("audit_logs").addColumn("id","text",(u)=>u.primaryKey()).addColumn("organizationId","text").addColumn("userId","text",(u)=>u.references("user.id").onDelete("set null")).addColumn("connectionId","text",(u)=>u.references("connections.id").onDelete("set null")).addColumn("toolName","text",(u)=>u.notNull()).addColumn("allowed","integer",(u)=>u.notNull()).addColumn("duration","integer").addColumn("timestamp","text",(u)=>u.notNull().defaultTo(_d`CURRENT_TIMESTAMP`)).addColumn("requestMetadata","text").execute(),await i.schema.createTable("oauth_clients").addColumn("id","text",(u)=>u.primaryKey()).addColumn("clientId","text",(u)=>u.notNull().unique()).addColumn("clientSecret","text").addColumn("clientName","text",(u)=>u.notNull()).addColumn("redirectUris","text",(u)=>u.notNull()).addColumn("grantTypes","text",(u)=>u.notNull()).addColumn("scope","text").addColumn("clientUri","text").addColumn("logoUri","text").addColumn("createdAt","text",(u)=>u.notNull().defaultTo(_d`CURRENT_TIMESTAMP`)).execute(),await i.schema.createTable("oauth_authorization_codes").addColumn("code","text",(u)=>u.primaryKey()).addColumn("clientId","text",(u)=>u.notNull().references("oauth_clients.clientId").onDelete("cascade")).addColumn("userId","text",(u)=>u.notNull().references("user.id").onDelete("cascade")).addColumn("redirectUri","text",(u)=>u.notNull()).addColumn("scope","text").addColumn("codeChallenge","text").addColumn("codeChallengeMethod","text").addColumn("expiresAt","text",(u)=>u.notNull()).addColumn("createdAt","text",(u)=>u.notNull().defaultTo(_d`CURRENT_TIMESTAMP`)).execute(),await i.schema.createTable("oauth_refresh_tokens").addColumn("token","text",(u)=>u.primaryKey()).addColumn("clientId","text",(u)=>u.notNull().references("oauth_clients.clientId").onDelete("cascade")).addColumn("userId","text",(u)=>u.notNull().references("user.id").onDelete("cascade")).addColumn("scope","text").addColumn("expiresAt","text").addColumn("createdAt","text",(u)=>u.notNull().defaultTo(_d`CURRENT_TIMESTAMP`)).execute(),await i.schema.createTable("downstream_tokens").addColumn("id","text",(u)=>u.primaryKey()).addColumn("connectionId","text",(u)=>u.notNull().references("connections.id").onDelete("cascade")).addColumn("userId","text",(u)=>u.references("user.id").onDelete("cascade")).addColumn("accessToken","text",(u)=>u.notNull()).addColumn("refreshToken","text").addColumn("scope","text").addColumn("expiresAt","text").addColumn("createdAt","text",(u)=>u.notNull().defaultTo(_d`CURRENT_TIMESTAMP`)).addColumn("updatedAt","text",(u)=>u.notNull().defaultTo(_d`CURRENT_TIMESTAMP`)).execute(),await i.schema.createIndex("idx_connections_organizationId").on("connections").column("organizationId").execute(),await i.schema.createIndex("idx_audit_logs_organizationId").on("audit_logs").column("organizationId").execute(),await i.schema.createIndex("idx_audit_logs_userId").on("audit_logs").column("userId").execute(),await i.schema.createIndex("idx_audit_logs_timestamp").on("audit_logs").column("timestamp").execute()}async function Wrt(i){await i.schema.dropTable("downstream_tokens").execute(),await i.schema.dropTable("oauth_refresh_tokens").execute(),await i.schema.dropTable("oauth_authorization_codes").execute(),await i.schema.dropTable("oauth_clients").execute(),await i.schema.dropTable("audit_logs").execute(),await i.schema.dropTable("api_keys").execute(),await i.schema.dropTable("connections").execute()}var Eou=()=>{};var Vbi={};ji(Vbi,{up:()=>Srt,down:()=>Lrt});import{sql as cou}from"kysely";async function Srt(i){await i.schema.createTable("organization_settings").addColumn("organizationId","text",(u)=>u.primaryKey().references("organization.id").onDelete("cascade")).addColumn("modelsBindingConnectionId","text",(u)=>u.references("connections.id").onDelete("set null")).addColumn("createdAt","text",(u)=>u.notNull().defaultTo(cou`CURRENT_TIMESTAMP`)).addColumn("updatedAt","text",(u)=>u.notNull().defaultTo(cou`CURRENT_TIMESTAMP`)).execute()}async function Lrt(i){await i.schema.dropTable("organization_settings").execute()}var wou=()=>{};var rbi={};ji(rbi,{up:()=>Qrt,down:()=>Hrt});async function Qrt(i){await i.schema.alterTable("connections").renameColumn("name","title").execute(),await i.schema.alterTable("connections").renameColumn("createdById","created_by").execute(),await i.schema.alterTable("connections").renameColumn("createdAt","created_at").execute(),await i.schema.alterTable("connections").renameColumn("updatedAt","updated_at").execute(),await i.schema.alterTable("connections").renameColumn("organizationId","organization_id").execute(),await i.schema.alterTable("connections").renameColumn("connectionType","connection_type").execute(),await i.schema.alterTable("connections").renameColumn("connectionUrl","connection_url").execute(),await i.schema.alterTable("connections").renameColumn("connectionToken","connection_token").execute(),await i.schema.alterTable("connections").renameColumn("connectionHeaders","connection_headers").execute(),await i.schema.alterTable("connections").renameColumn("oauthConfig","oauth_config").execute(),await i.schema.alterTable("connections").renameColumn("appName","app_name").execute(),await i.schema.alterTable("connections").renameColumn("appId","app_id").execute()}async function Hrt(i){await i.schema.alterTable("connections").renameColumn("title","name").execute(),await i.schema.alterTable("connections").renameColumn("created_by","createdById").execute(),await i.schema.alterTable("connections").renameColumn("created_at","createdAt").execute(),await i.schema.alterTable("connections").renameColumn("updated_at","updatedAt").execute(),await i.schema.alterTable("connections").renameColumn("organization_id","organizationId").execute(),await i.schema.alterTable("connections").renameColumn("connection_type","connectionType").execute(),await i.schema.alterTable("connections").renameColumn("connection_url","connectionUrl").execute(),await i.schema.alterTable("connections").renameColumn("connection_token","connectionToken").execute(),await i.schema.alterTable("connections").renameColumn("connection_headers","connectionHeaders").execute(),await i.schema.alterTable("connections").renameColumn("oauth_config","oauthConfig").execute(),await i.schema.alterTable("connections").renameColumn("app_name","appName").execute(),await i.schema.alterTable("connections").renameColumn("app_id","appId").execute()}var mbi={};ji(mbi,{up:()=>zrt,down:()=>nrt});async function zrt(i){await i.schema.createTable("organization_settings_new").addColumn("organizationId","text",(u)=>u.primaryKey().references("organization.id").onDelete("cascade")).addColumn("createdAt","text",(u)=>u.notNull()).addColumn("updatedAt","text",(u)=>u.notNull()).execute(),await i.insertInto("organization_settings_new").columns(["organizationId","createdAt","updatedAt"]).expression((u)=>u.selectFrom("organization_settings").select(["organizationId","createdAt","updatedAt"])).execute(),await i.schema.dropTable("organization_settings").execute(),await i.schema.alterTable("organization_settings_new").renameTo("organization_settings").execute()}async function nrt(i){await i.schema.createTable("organization_settings_new").addColumn("organizationId","text",(u)=>u.primaryKey().references("organization.id").onDelete("cascade")).addColumn("modelsBindingConnectionId","text",(u)=>u.references("connections.id").onDelete("set null")).addColumn("createdAt","text",(u)=>u.notNull()).addColumn("updatedAt","text",(u)=>u.notNull()).execute(),await i.insertInto("organization_settings_new").columns(["organizationId","modelsBindingConnectionId","createdAt","updatedAt"]).expression((u)=>u.selectFrom("organization_settings").select(["organizationId",u.val(null).as("modelsBindingConnectionId"),"createdAt","updatedAt"])).execute(),await i.schema.dropTable("organization_settings").execute(),await i.schema.alterTable("organization_settings_new").renameTo("organization_settings").execute()}var ebi={};ji(ebi,{up:()=>Rrt,down:()=>brt});async function Rrt(i){await i.schema.alterTable("connections").addColumn("configuration_state","text").execute(),await i.schema.alterTable("connections").addColumn("configuration_scopes","text").execute()}async function brt(i){await i.schema.alterTable("connections").dropColumn("configuration_state").execute(),await i.schema.alterTable("connections").dropColumn("configuration_scopes").execute()}var abi={};ji(abi,{up:()=>Mrt,down:()=>qrt});import{sql as Crt}from"kysely";async function Mrt(i){await i.schema.alterTable("organization_settings").addColumn("sidebar_items",Crt`text`).execute()}async function qrt(i){await i.schema.alterTable("organization_settings").dropColumn("sidebar_items").execute()}var $ou=()=>{};var obi={};ji(obi,{up:()=>Vrt,down:()=>rrt});async function Vrt(i){await i.schema.createTable("monitoring_logs").addColumn("id","text",(u)=>u.primaryKey()).addColumn("organization_id","text",(u)=>u.notNull().references("organization.id").onDelete("cascade")).addColumn("connection_id","text",(u)=>u.notNull().references("connections.id").onDelete("cascade")).addColumn("connection_title","text",(u)=>u.notNull()).addColumn("tool_name","text",(u)=>u.notNull()).addColumn("input","text",(u)=>u.notNull()).addColumn("output","text",(u)=>u.notNull()).addColumn("is_error","integer",(u)=>u.notNull()).addColumn("error_message","text").addColumn("duration_ms","integer",(u)=>u.notNull()).addColumn("timestamp","text",(u)=>u.notNull()).addColumn("user_id","text").addColumn("request_id","text",(u)=>u.notNull()).execute(),await i.schema.createIndex("monitoring_logs_org_timestamp").on("monitoring_logs").columns(["organization_id","timestamp"]).execute(),await i.schema.createIndex("monitoring_logs_connection_timestamp").on("monitoring_logs").columns(["connection_id","timestamp"]).execute(),await i.schema.createIndex("monitoring_logs_is_error").on("monitoring_logs").columns(["organization_id","is_error","timestamp"]).execute()}async function rrt(i){await i.schema.dropIndex("monitoring_logs_is_error").execute(),await i.schema.dropIndex("monitoring_logs_connection_timestamp").execute(),await i.schema.dropIndex("monitoring_logs_org_timestamp").execute(),await i.schema.dropTable("monitoring_logs").execute()}var sbi={};ji(sbi,{up:()=>mrt,down:()=>ert});import{sql as Uq}from"kysely";async function mrt(i){await i.schema.createTable("events").addColumn("id","text",(u)=>u.primaryKey()).addColumn("organization_id","text",(u)=>u.notNull().references("organization.id").onDelete("cascade")).addColumn("type","text",(u)=>u.notNull()).addColumn("source","text",(u)=>u.notNull()).addColumn("specversion","text",(u)=>u.notNull().defaultTo("1.0")).addColumn("subject","text").addColumn("time","text",(u)=>u.notNull()).addColumn("datacontenttype","text",(u)=>u.notNull().defaultTo("application/json")).addColumn("dataschema","text").addColumn("data","text").addColumn("cron","varchar(255)").addColumn("status","text",(u)=>u.notNull().defaultTo("pending")).addColumn("attempts","integer",(u)=>u.notNull().defaultTo(0)).addColumn("last_error","text").addColumn("next_retry_at","text").addColumn("created_at","text",(u)=>u.notNull().defaultTo(Uq`CURRENT_TIMESTAMP`)).addColumn("updated_at","text",(u)=>u.notNull().defaultTo(Uq`CURRENT_TIMESTAMP`)).execute(),await i.schema.createTable("event_subscriptions").addColumn("id","text",(u)=>u.primaryKey()).addColumn("organization_id","text",(u)=>u.notNull().references("organization.id").onDelete("cascade")).addColumn("connection_id","text",(u)=>u.notNull().references("connections.id").onDelete("cascade")).addColumn("publisher","text").addColumn("event_type","text",(u)=>u.notNull()).addColumn("filter","text").addColumn("enabled","integer",(u)=>u.notNull().defaultTo(1)).addColumn("created_at","text",(u)=>u.notNull().defaultTo(Uq`CURRENT_TIMESTAMP`)).addColumn("updated_at","text",(u)=>u.notNull().defaultTo(Uq`CURRENT_TIMESTAMP`)).execute(),await i.schema.createTable("event_deliveries").addColumn("id","text",(u)=>u.primaryKey()).addColumn("event_id","text",(u)=>u.notNull()).addColumn("subscription_id","text",(u)=>u.notNull().references("event_subscriptions.id").onDelete("cascade")).addColumn("status","text",(u)=>u.notNull().defaultTo("pending")).addColumn("attempts","integer",(u)=>u.notNull().defaultTo(0)).addColumn("last_error","text").addColumn("delivered_at","text").addColumn("next_retry_at","text").addColumn("created_at","text",(u)=>u.notNull().defaultTo(Uq`CURRENT_TIMESTAMP`)).execute(),await i.schema.createIndex("idx_events_org_status").on("events").columns(["organization_id","status"]).execute(),await i.schema.createIndex("idx_events_source").on("events").columns(["source"]).execute(),await i.schema.createIndex("idx_events_type").on("events").columns(["type"]).execute(),await i.schema.createIndex("idx_events_retry").on("events").columns(["status","next_retry_at"]).execute(),await i.schema.createIndex("idx_subscriptions_connection").on("event_subscriptions").columns(["connection_id"]).execute(),await i.schema.createIndex("idx_subscriptions_type").on("event_subscriptions").columns(["event_type"]).execute(),await i.schema.createIndex("idx_subscriptions_org_enabled").on("event_subscriptions").columns(["organization_id","enabled"]).execute(),await i.schema.createIndex("idx_subscriptions_unique").on("event_subscriptions").columns(["connection_id","event_type","publisher","filter"]).unique().execute(),await i.schema.createIndex("idx_deliveries_event").on("event_deliveries").columns(["event_id"]).execute(),await i.schema.createIndex("idx_deliveries_subscription_status").on("event_deliveries").columns(["subscription_id","status"]).execute(),await i.schema.createIndex("idx_deliveries_retry").on("event_deliveries").columns(["status","next_retry_at"]).execute()}async function ert(i){await i.schema.dropIndex("idx_deliveries_retry").execute(),await i.schema.dropIndex("idx_deliveries_subscription_status").execute(),await i.schema.dropIndex("idx_deliveries_event").execute(),await i.schema.dropIndex("idx_subscriptions_unique").execute(),await i.schema.dropIndex("idx_subscriptions_org_enabled").execute(),await i.schema.dropIndex("idx_subscriptions_type").execute(),await i.schema.dropIndex("idx_subscriptions_connection").execute(),await i.schema.dropIndex("idx_events_retry").execute(),await i.schema.dropIndex("idx_events_type").execute(),await i.schema.dropIndex("idx_events_source").execute(),await i.schema.dropIndex("idx_events_org_status").execute(),await i.schema.dropTable("event_deliveries").execute(),await i.schema.dropTable("event_subscriptions").execute(),await i.schema.dropTable("events").execute()}var hou=()=>{};var pbi={};ji(pbi,{up:()=>ort,down:()=>srt});import{sql as art}from"kysely";async function ort(i){await i.schema.dropTable("audit_logs").ifExists().execute()}async function srt(i){await i.schema.createTable("audit_logs").ifNotExists().addColumn("id","text",(u)=>u.primaryKey()).addColumn("organizationId","text").addColumn("userId","text",(u)=>u.references("user.id").onDelete("set null")).addColumn("connectionId","text",(u)=>u.references("connections.id").onDelete("set null")).addColumn("toolName","text",(u)=>u.notNull()).addColumn("allowed","integer",(u)=>u.notNull()).addColumn("duration","integer").addColumn("timestamp","text",(u)=>u.notNull().defaultTo(art`CURRENT_TIMESTAMP`)).addColumn("requestMetadata","text").execute(),await i.schema.createIndex("idx_audit_logs_organizationId").on("audit_logs").column("organizationId").execute(),await i.schema.createIndex("idx_audit_logs_userId").on("audit_logs").column("userId").execute(),await i.schema.createIndex("idx_audit_logs_timestamp").on("audit_logs").column("timestamp").execute()}var vou=()=>{};var iCi={};ji(iCi,{up:()=>prt,down:()=>imt});import{sql as v6i}from"kysely";async function prt(i){await i.schema.createTable("gateways").addColumn("id","text",(u)=>u.primaryKey()).addColumn("organization_id","text",(u)=>u.notNull().references("organization.id").onDelete("cascade")).addColumn("title","text",(u)=>u.notNull()).addColumn("description","text").addColumn("tool_selection_strategy","text").addColumn("status","text",(u)=>u.notNull().defaultTo("active")).addColumn("is_default","integer",(u)=>u.notNull().defaultTo(0)).addColumn("created_at","text",(u)=>u.notNull().defaultTo(v6i`CURRENT_TIMESTAMP`)).addColumn("updated_at","text",(u)=>u.notNull().defaultTo(v6i`CURRENT_TIMESTAMP`)).addColumn("created_by","text",(u)=>u.notNull().references("user.id").onDelete("cascade")).addColumn("updated_by","text").execute(),await i.schema.createTable("gateway_connections").addColumn("id","text",(u)=>u.primaryKey()).addColumn("gateway_id","text",(u)=>u.notNull().references("gateways.id").onDelete("cascade")).addColumn("connection_id","text",(u)=>u.notNull().references("connections.id").onDelete("cascade")).addColumn("selected_tools","text").addColumn("created_at","text",(u)=>u.notNull().defaultTo(v6i`CURRENT_TIMESTAMP`)).execute(),await i.schema.createIndex("idx_gateways_org").on("gateways").columns(["organization_id"]).execute(),await i.schema.createIndex("idx_gateways_org_status").on("gateways").columns(["organization_id","status"]).execute(),await v6i`CREATE UNIQUE INDEX idx_gateways_default_per_org ON gateways (organization_id) WHERE is_default = 1`.execute(i),await i.schema.createIndex("idx_gateway_connections_gateway").on("gateway_connections").columns(["gateway_id"]).execute(),await i.schema.createIndex("idx_gateway_connections_connection").on("gateway_connections").columns(["connection_id"]).execute(),await i.schema.createIndex("idx_gateway_connections_unique").on("gateway_connections").columns(["gateway_id","connection_id"]).unique().execute()}async function imt(i){await i.schema.dropIndex("idx_gateway_connections_unique").execute(),await i.schema.dropIndex("idx_gateway_connections_connection").execute(),await i.schema.dropIndex("idx_gateway_connections_gateway").execute(),await i.schema.dropIndex("idx_gateways_default_per_org").execute(),await i.schema.dropIndex("idx_gateways_org_status").execute(),await i.schema.dropIndex("idx_gateways_org").execute(),await i.schema.dropTable("gateway_connections").execute(),await i.schema.dropTable("gateways").execute()}var dou=()=>{};var uCi={};ji(uCi,{up:()=>umt,down:()=>tmt});async function umt(i){await i.schema.alterTable("gateways").addColumn("icon","text").execute()}async function tmt(i){await i.schema.alterTable("gateways").dropColumn("icon").execute()}var tCi={};ji(tCi,{up:()=>fmt,down:()=>lmt});import{sql as d6i}from"kysely";async function fmt(i){await i.schema.alterTable("gateways").addColumn("tool_selection_mode","text",(u)=>u.notNull().defaultTo("inclusion")).execute(),await d6i`
     UPDATE gateways
     SET tool_selection_mode = CASE
@@ -85269,7 +85269,7 @@ conversation.
 `);let f=u.pax;if(f)for(let l in f)t+=j4u(" "+l+"="+f[l]+`
 `);return mf.from(t)};QHf.decodePax=function(u){let t={};while(u.length){let f=0;while(f<u.length&&u[f]!==32)f++;let l=parseInt(mf.toString(u.subarray(0,f)),10);if(!l)return t;let E=mf.toString(u.subarray(f+1,l-1)),c=E.indexOf("=");if(c===-1)return t;t[E.slice(0,c)]=E.slice(c+1),u=u.subarray(l)}return t};QHf.encode=function(u){let t=mf.alloc(512),f=u.name,l="";if(u.typeflag===5&&f[f.length-1]!=="/")f+="/";if(mf.byteLength(f)!==f.length)return null;while(mf.byteLength(f)>100){let E=f.indexOf("/");if(E===-1)return null;l+=l?"/"+f.slice(0,E):f.slice(0,E),f=f.slice(E+1)}if(mf.byteLength(f)>100||mf.byteLength(l)>155)return null;if(u.linkname&&mf.byteLength(u.linkname)>100)return null;if(mf.write(t,f),mf.write(t,JN(u.mode&4095,6),100),mf.write(t,JN(u.uid,6),108),mf.write(t,JN(u.gid,6),116),SHf(u.size,t,124),mf.write(t,JN(u.mtime.getTime()/1000|0,11),136),t[156]=48+YHf(u.type),u.linkname)mf.write(t,u.linkname,157);if(mf.copy(xP0,t,257),mf.copy(IHf,t,263),u.uname)mf.write(t,u.uname,265);if(u.gname)mf.write(t,u.gname,297);if(mf.write(t,JN(u.devmajor||0,6),329),mf.write(t,JN(u.devminor||0,6),337),l)mf.write(t,l,345);return mf.write(t,JN(jP0(t),6),148),t};QHf.decode=function(u,t,f){let l=u[156]===0?0:u[156]-48,E=sz(u,0,100,t),c=XN(u,100,8),w=XN(u,108,8),$=XN(u,116,8),h=XN(u,124,12),v=XN(u,136,12),d=KHf(l),D=u[157]===0?null:sz(u,157,100,t),_=sz(u,265,32),N=sz(u,297,32),Z=XN(u,329,8),B=XN(u,337,8),F=jP0(u);if(F===256)return null;if(F!==XN(u,148,8))throw Error("Invalid tar header. Maybe the tar is corrupted or it needs to be gunzipped?");if(jHf(u)){if(u[345])E=sz(u,345,155,t)+"/"+E}else if(XHf(u));else if(!f)throw Error("Invalid tar header: unknown format.");if(l===0&&E&&E[E.length-1]==="/")l=5;return{name:E,mode:c,uid:w,gid:$,size:h,mtime:new Date(1000*v),type:d,linkname:D,uname:_,gname:N,devmajor:Z,devminor:B,pax:null}};function jHf(i){return mf.equals(xP0,i.subarray(257,263))}function XHf(i){return mf.equals(xHf,i.subarray(257,263))&&mf.equals(kHf,i.subarray(263,265))}function JHf(i,u,t){if(typeof i!=="number")return t;if(i=~~i,i>=u)return u;if(i>=0)return i;if(i+=u,i>=0)return i;return 0}function KHf(i){switch(i){case 0:return"file";case 1:return"link";case 2:return"symlink";case 3:return"character-device";case 4:return"block-device";case 5:return"directory";case 6:return"fifo";case 7:return"contiguous-file";case 72:return"pax-header";case 55:return"pax-global-header";case 27:return"gnu-long-link-path";case 28:case 30:return"gnu-long-path"}return null}function YHf(i){switch(i){case"file":return 0;case"link":return 1;case"symlink":return 2;case"character-device":return 3;case"block-device":return 4;case"directory":return 5;case"fifo":return 6;case"contiguous-file":return 7;case"pax-header":return 72}return 0}function kP0(i,u,t,f){for(;t<f;t++)if(i[t]===u)return t;return f}function jP0(i){let u=256;for(let t=0;t<148;t++)u+=i[t];for(let t=156;t<512;t++)u+=i[t];return u}function JN(i,u){if(i=i.toString(8),i.length>u)return"7777777777777777777".slice(0,u)+" ";return"0000000000000000000".slice(0,u-i.length)+i+" "}function WHf(i,u,t){u[t]=128;for(let f=11;f>0;f--)u[t+f]=i&255,i=Math.floor(i/256)}function SHf(i,u,t){if(i.toString(8).length>11)WHf(i,u,t);else mf.write(u,JN(i,11),t)}function LHf(i){let u;if(i[0]===128)u=!0;else if(i[0]===255)u=!1;else return null;let t=[],f;for(f=i.length-1;f>0;f--){let c=i[f];if(u)t.push(c);else t.push(255-c)}let l=0,E=t.length;for(f=0;f<E;f++)l+=t[f]*Math.pow(256,f);return u?l:-1*l}function XN(i,u,t){if(i=i.subarray(u,u+t),u=0,i[u]&128)return LHf(i);else{while(u<i.length&&i[u]===32)u++;let f=JHf(kP0(i,32,u,i.length),i.length,i.length);while(u<f&&i[u]===0)u++;if(f===u)return 0;return parseInt(mf.toString(i.subarray(u,f)),8)}}function sz(i,u,t,f){return mf.toString(i.subarray(u,kP0(i,0,u,u+t)),f)}function j4u(i){let u=mf.byteLength(i),t=Math.floor(Math.log(u)/Math.log(10))+1;if(u+t>=Math.pow(10,t))t++;return u+t+i}});var QP0=Y((a46,LP0)=>{var{Writable:CHf,Readable:MHf,getStreamError:XP0}=k4u(),qHf=A4u(),JP0=oz(),pz=X4u(),VHf=JP0.alloc(0);class KP0{constructor(){this.buffered=0,this.shifted=0,this.queue=new qHf,this._offset=0}push(i){this.buffered+=i.byteLength,this.queue.push(i)}shiftFirst(i){return this._buffered===0?null:this._next(i)}shift(i){if(i>this.buffered)return null;if(i===0)return VHf;let u=this._next(i);if(i===u.byteLength)return u;let t=[u];while((i-=u.byteLength)>0)u=this._next(i),t.push(u);return JP0.concat(t)}_next(i){let u=this.queue.peek(),t=u.byteLength-this._offset;if(i>=t){let f=this._offset?u.subarray(this._offset,u.byteLength):u;return this.queue.shift(),this._offset=0,this.buffered-=t,this.shifted+=t,f}return this.buffered-=i,this.shifted+=i,u.subarray(this._offset,this._offset+=i)}}class YP0 extends MHf{constructor(i,u,t){super();this.header=u,this.offset=t,this._parent=i}_read(i){if(this.header.size===0)this.push(null);if(this._parent._stream===this)this._parent._update();i(null)}_predestroy(){this._parent.destroy(XP0(this))}_detach(){if(this._parent._stream===this)this._parent._stream=null,this._parent._missing=SP0(this.header.size),this._parent._update()}_destroy(i){this._detach(),i(null)}}class WP0 extends CHf{constructor(i){super(i);if(!i)i={};this._buffer=new KP0,this._offset=0,this._header=null,this._stream=null,this._missing=0,this._longHeader=!1,this._callback=J4u,this._locked=!1,this._finished=!1,this._pax=null,this._paxGlobal=null,this._gnuLongPath=null,this._gnuLongLinkPath=null,this._filenameEncoding=i.filenameEncoding||"utf-8",this._allowUnknownFormat=!!i.allowUnknownFormat,this._unlockBound=this._unlock.bind(this)}_unlock(i){if(this._locked=!1,i){this.destroy(i),this._continueWrite(i);return}this._update()}_consumeHeader(){if(this._locked)return!1;this._offset=this._buffer.shifted;try{this._header=pz.decode(this._buffer.shift(512),this._filenameEncoding,this._allowUnknownFormat)}catch(i){return this._continueWrite(i),!1}if(!this._header)return!0;switch(this._header.type){case"gnu-long-path":case"gnu-long-link-path":case"pax-global-header":case"pax-header":return this._longHeader=!0,this._missing=this._header.size,!0}if(this._locked=!0,this._applyLongHeaders(),this._header.size===0||this._header.type==="directory")return this.emit("entry",this._header,this._createStream(),this._unlockBound),!0;return this._stream=this._createStream(),this._missing=this._header.size,this.emit("entry",this._header,this._stream,this._unlockBound),!0}_applyLongHeaders(){if(this._gnuLongPath)this._header.name=this._gnuLongPath,this._gnuLongPath=null;if(this._gnuLongLinkPath)this._header.linkname=this._gnuLongLinkPath,this._gnuLongLinkPath=null;if(this._pax){if(this._pax.path)this._header.name=this._pax.path;if(this._pax.linkpath)this._header.linkname=this._pax.linkpath;if(this._pax.size)this._header.size=parseInt(this._pax.size,10);this._header.pax=this._pax,this._pax=null}}_decodeLongHeader(i){switch(this._header.type){case"gnu-long-path":this._gnuLongPath=pz.decodeLongPath(i,this._filenameEncoding);break;case"gnu-long-link-path":this._gnuLongLinkPath=pz.decodeLongPath(i,this._filenameEncoding);break;case"pax-global-header":this._paxGlobal=pz.decodePax(i);break;case"pax-header":this._pax=this._paxGlobal===null?pz.decodePax(i):Object.assign({},this._paxGlobal,pz.decodePax(i));break}}_consumeLongHeader(){this._longHeader=!1,this._missing=SP0(this._header.size);let i=this._buffer.shift(this._header.size);try{this._decodeLongHeader(i)}catch(u){return this._continueWrite(u),!1}return!0}_consumeStream(){let i=this._buffer.shiftFirst(this._missing);if(i===null)return!1;this._missing-=i.byteLength;let u=this._stream.push(i);if(this._missing===0){if(this._stream.push(null),u)this._stream._detach();return u&&this._locked===!1}return u}_createStream(){return new YP0(this,this._header,this._offset)}_update(){while(this._buffer.buffered>0&&!this.destroying){if(this._missing>0){if(this._stream!==null){if(this._consumeStream()===!1)return;continue}if(this._longHeader===!0){if(this._missing>this._buffer.buffered)break;if(this._consumeLongHeader()===!1)return!1;continue}let i=this._buffer.shiftFirst(this._missing);if(i!==null)this._missing-=i.byteLength;continue}if(this._buffer.buffered<512)break;if(this._stream!==null||this._consumeHeader()===!1)return}this._continueWrite(null)}_continueWrite(i){let u=this._callback;this._callback=J4u,u(i)}_write(i,u){this._callback=u,this._buffer.push(i),this._update()}_final(i){this._finished=this._missing===0&&this._buffer.buffered===0,i(this._finished?null:Error("Unexpected end of data"))}_predestroy(){this._continueWrite(null)}_destroy(i){if(this._stream)this._stream.destroy(XP0(this));i(null)}[Symbol.asyncIterator](){let i=null,u=null,t=null,f=null,l=null,E=this;return this.on("entry",$),this.on("error",(d)=>{i=d}),this.on("close",h),{[Symbol.asyncIterator](){return this},next(){return new Promise(w)},return(){return v(null)},throw(d){return v(d)}};function c(d){if(!l)return;let D=l;l=null,D(d)}function w(d,D){if(i)return D(i);if(f){d({value:f,done:!1}),f=null;return}if(u=d,t=D,c(null),E._finished&&u)u({value:void 0,done:!0}),u=t=null}function $(d,D,_){if(l=_,D.on("error",J4u),u)u({value:D,done:!1}),u=t=null;else f=D}function h(){if(c(i),!u)return;if(i)t(i);else u({value:void 0,done:!0});u=t=null}function v(d){return E.destroy(d),c(d),new Promise((D,_)=>{if(E.destroyed)return D({value:void 0,done:!0});E.once("close",function(){if(d)_(d);else D({value:void 0,done:!0})})})}}}LP0.exports=function(u){return new WP0(u)};function J4u(){}function SP0(i){return i&=511,i&&512-i}});var zP0=Y((o46,K4u)=>{var HP0={S_IFMT:61440,S_IFDIR:16384,S_IFCHR:8192,S_IFBLK:24576,S_IFIFO:4096,S_IFLNK:40960};try{K4u.exports=Fi("fs").constants||HP0}catch{K4u.exports=HP0}});var VP0=Y((s46,qP0)=>{var{Readable:rHf,Writable:mHf,getStreamError:nP0}=k4u(),KK=oz(),un=zP0(),Lgi=X4u(),RP0=KK.alloc(1024);class bP0 extends mHf{constructor(i,u,t){super({mapWritable:aHf,eagerOpen:!0});if(this.written=0,this.header=u,this._callback=t,this._linkname=null,this._isLinkname=u.type==="symlink"&&!u.linkname,this._isVoid=u.type!=="file"&&u.type!=="contiguous-file",this._finished=!1,this._pack=i,this._openCallback=null,this._pack._stream===null)this._pack._stream=this;else this._pack._pending.push(this)}_open(i){if(this._openCallback=i,this._pack._stream===this)this._continueOpen()}_continuePack(i){if(this._callback===null)return;let u=this._callback;this._callback=null,u(i)}_continueOpen(){if(this._pack._stream===null)this._pack._stream=this;let i=this._openCallback;if(this._openCallback=null,i===null)return;if(this._pack.destroying)return i(Error("pack stream destroyed"));if(this._pack._finalized)return i(Error("pack stream is already finalized"));if(this._pack._stream=this,!this._isLinkname)this._pack._encode(this.header);if(this._isVoid)this._finish(),this._continuePack(null);i(null)}_write(i,u){if(this._isLinkname)return this._linkname=this._linkname?KK.concat([this._linkname,i]):i,u(null);if(this._isVoid){if(i.byteLength>0)return u(Error("No body allowed for this entry"));return u()}if(this.written+=i.byteLength,this._pack.push(i))return u();this._pack._drain=u}_finish(){if(this._finished)return;if(this._finished=!0,this._isLinkname)this.header.linkname=this._linkname?KK.toString(this._linkname,"utf-8"):"",this._pack._encode(this.header);MP0(this._pack,this.header.size),this._pack._done(this)}_final(i){if(this.written!==this.header.size)return i(Error("Size mismatch"));this._finish(),i(null)}_getError(){return nP0(this)||Error("tar entry destroyed")}_predestroy(){this._pack.destroy(this._getError())}_destroy(i){this._pack._done(this),this._continuePack(this._finished?null:this._getError()),i()}}class CP0 extends rHf{constructor(i){super(i);this._drain=Y4u,this._finalized=!1,this._finalizing=!1,this._pending=[],this._stream=null}entry(i,u,t){if(this._finalized||this.destroying)throw Error("already finalized or destroyed");if(typeof u==="function")t=u,u=null;if(!t)t=Y4u;if(!i.size||i.type==="symlink")i.size=0;if(!i.type)i.type=eHf(i.mode);if(!i.mode)i.mode=i.type==="directory"?493:420;if(!i.uid)i.uid=0;if(!i.gid)i.gid=0;if(!i.mtime)i.mtime=new Date;if(typeof u==="string")u=KK.from(u);let f=new bP0(this,i,t);if(KK.isBuffer(u))return i.size=u.byteLength,f.write(u),f.end(),f;if(f._isVoid)return f;return f}finalize(){if(this._stream||this._pending.length>0){this._finalizing=!0;return}if(this._finalized)return;this._finalized=!0,this.push(RP0),this.push(null)}_done(i){if(i!==this._stream)return;if(this._stream=null,this._finalizing)this.finalize();if(this._pending.length)this._pending.shift()._continueOpen()}_encode(i){if(!i.pax){let u=Lgi.encode(i);if(u){this.push(u);return}}this._encodePax(i)}_encodePax(i){let u=Lgi.encodePax({name:i.name,linkname:i.linkname,pax:i.pax}),t={name:"PaxHeader",mode:i.mode,uid:i.uid,gid:i.gid,size:u.byteLength,mtime:i.mtime,type:"pax-header",linkname:i.linkname&&"PaxHeader",uname:i.uname,gname:i.gname,devmajor:i.devmajor,devminor:i.devminor};this.push(Lgi.encode(t)),this.push(u),MP0(this,u.byteLength),t.size=i.size,t.type=i.type,this.push(Lgi.encode(t))}_doDrain(){let i=this._drain;this._drain=Y4u,i()}_predestroy(){let i=nP0(this);if(this._stream)this._stream.destroy(i);while(this._pending.length){let u=this._pending.shift();u.destroy(i),u._continueOpen()}this._doDrain()}_read(i){this._doDrain(),i()}}qP0.exports=function(u){return new CP0(u)};function eHf(i){switch(i&un.S_IFMT){case un.S_IFBLK:return"block-device";case un.S_IFCHR:return"character-device";case un.S_IFDIR:return"directory";case un.S_IFIFO:return"fifo";case un.S_IFLNK:return"symlink"}return"file"}function Y4u(){}function MP0(i,u){if(u&=511,u)i.push(RP0.subarray(0,512-u))}function aHf(i){return KK.isBuffer(i)?i:KK.from(i)}});var rP0=Y((oHf)=>{oHf.extract=QP0();oHf.pack=VP0()});var aP0=Y((i16,eP0)=>{eP0.exports=mP0;function mP0(i,u){if(i&&u)return mP0(i)(u);if(typeof i!=="function")throw TypeError("need wrapper function");return Object.keys(i).forEach(function(f){t[f]=i[f]}),t;function t(){var f=Array(arguments.length);for(var l=0;l<f.length;l++)f[l]=arguments[l];var E=i.apply(this,f),c=f[f.length-1];if(typeof E==="function"&&E!==c)Object.keys(c).forEach(function(w){E[w]=c[w]});return E}}});var S4u=Y((u16,W4u)=>{var oP0=aP0();W4u.exports=oP0(Qgi);W4u.exports.strict=oP0(sP0);Qgi.proto=Qgi(function(){Object.defineProperty(Function.prototype,"once",{value:function(){return Qgi(this)},configurable:!0}),Object.defineProperty(Function.prototype,"onceStrict",{value:function(){return sP0(this)},configurable:!0})});function Qgi(i){var u=function(){if(u.called)return u.value;return u.called=!0,u.value=i.apply(this,arguments)};return u.called=!1,u}function sP0(i){var u=function(){if(u.called)throw Error(u.onceError);return u.called=!0,u.value=i.apply(this,arguments)},t=i.name||"Function wrapped with `once`";return u.onceError=t+" shouldn't be called more than once",u.called=!1,u}});var uG0=Y((t16,iG0)=>{var izf=S4u(),uzf=function(){},tzf=global.Bare?queueMicrotask:process.nextTick.bind(process),fzf=function(i){return i.setHeader&&typeof i.abort==="function"},lzf=function(i){return i.stdio&&Array.isArray(i.stdio)&&i.stdio.length===3},pP0=function(i,u,t){if(typeof u==="function")return pP0(i,null,u);if(!u)u={};t=izf(t||uzf);var{_writableState:f,_readableState:l}=i,E=u.readable||u.readable!==!1&&i.readable,c=u.writable||u.writable!==!1&&i.writable,w=!1,$=function(){if(!i.writable)h()},h=function(){if(c=!1,!E)t.call(i)},v=function(){if(E=!1,!c)t.call(i)},d=function(B){t.call(i,B?Error("exited with error code: "+B):null)},D=function(B){t.call(i,B)},_=function(){tzf(N)},N=function(){if(w)return;if(E&&!(l&&(l.ended&&!l.destroyed)))return t.call(i,Error("premature close"));if(c&&!(f&&(f.ended&&!f.destroyed)))return t.call(i,Error("premature close"))},Z=function(){i.req.on("finish",h)};if(fzf(i))if(i.on("complete",h),i.on("abort",_),i.req)Z();else i.on("request",Z);else if(c&&!f)i.on("end",$),i.on("close",$);if(lzf(i))i.on("exit",d);if(i.on("end",v),i.on("finish",h),u.error!==!1)i.on("error",D);return i.on("close",_),function(){if(w=!0,i.removeListener("complete",h),i.removeListener("abort",_),i.removeListener("request",Z),i.req)i.req.removeListener("finish",h);i.removeListener("end",$),i.removeListener("close",$),i.removeListener("finish",h),i.removeListener("exit",d),i.removeListener("end",v),i.removeListener("error",D),i.removeListener("close",_)}};iG0.exports=pP0});var lG0=Y((f16,fG0)=>{var Ezf=S4u(),czf=uG0(),Hgi;try{Hgi=Fi("fs")}catch(i){}var co=function(){},wzf=typeof process>"u"?!1:/^v?\.0/.test(process.version),zgi=function(i){return typeof i==="function"},$zf=function(i){if(!wzf)return!1;if(!Hgi)return!1;return(i instanceof(Hgi.ReadStream||co)||i instanceof(Hgi.WriteStream||co))&&zgi(i.close)},hzf=function(i){return i.setHeader&&zgi(i.abort)},vzf=function(i,u,t,f){f=Ezf(f);var l=!1;i.on("close",function(){l=!0}),czf(i,{readable:u,writable:t},function(c){if(c)return f(c);l=!0,f()});var E=!1;return function(c){if(l)return;if(E)return;if(E=!0,$zf(i))return i.close(co);if(hzf(i))return i.abort();if(zgi(i.destroy))return i.destroy();f(c||Error("stream was destroyed"))}},tG0=function(i){i()},dzf=function(i,u){return i.pipe(u)},Dzf=function(){var i=Array.prototype.slice.call(arguments),u=zgi(i[i.length-1]||co)&&i.pop()||co;if(Array.isArray(i[0]))i=i[0];if(i.length<2)throw Error("pump requires two streams per minimum");var t,f=i.map(function(l,E){var c=E<i.length-1,w=E>0;return vzf(l,c,w,function($){if(!t)t=$;if($)f.forEach(tG0);if(c)return;f.forEach(tG0),u(t)})});return i.reduce(dzf)};fG0.exports=Dzf});var _G0=Y((Zzf)=>{var EG0=rP0(),cG0=lG0(),wG0=Fi("fs"),Fl=Fi("path"),wo=(global.Bare?global.Bare.platform:process.platform)==="win32";Zzf.pack=function(u,t){if(!u)u=".";if(!t)t={};let f=t.fs||wG0,l=t.ignore||t.filter||$o,E=t.mapStream||dG0,c=Ozf(f,t.dereference?f.stat:f.lstat,u,l,t.entries,t.sort),w=t.strict!==!1,$=typeof t.umask==="number"?~t.umask:~$G0(),h=t.pack||EG0.pack(),v=t.finish||$o,d=t.map||$o,D=typeof t.dmode==="number"?t.dmode:0,_=typeof t.fmode==="number"?t.fmode:0;if(t.strip)d=DG0(d,t.strip);if(t.readable)D|=parseInt(555,8),_|=parseInt(444,8);if(t.writable)D|=parseInt(333,8),_|=parseInt(222,8);B();function N(F,g){f.readlink(Fl.join(u,F),function(T,U){if(T)return h.destroy(T);g.linkname=L4u(U),h.entry(g,B)})}function Z(F,g,T){if(h.destroyed)return;if(F)return h.destroy(F);if(!g){if(t.finalize!==!1)h.finalize();return v(h)}if(T.isSocket())return B();let U={name:L4u(g),mode:(T.mode|(T.isDirectory()?D:_))&$,mtime:T.mtime,size:T.size,type:"file",uid:T.uid,gid:T.gid};if(T.isDirectory())return U.size=0,U.type="directory",U=d(U)||U,h.entry(U,B);if(T.isSymbolicLink())return U.size=0,U.type="symlink",U=d(U)||U,N(g,U);if(U=d(U)||U,!T.isFile()){if(w)return h.destroy(Error("unsupported type for "+g));return B()}let A=h.entry(U,B),G=E(f.createReadStream(Fl.join(u,g),{start:0,end:U.size>0?U.size-1:U.size}),U);G.on("error",function(k){A.destroy(k)}),cG0(G,A)}function B(F){if(F)return h.destroy(F);c(Z)}return h};function _zf(i){return i.length?i[i.length-1]:null}function Nzf(){return!global.Bare&&process.getuid?process.getuid():-1}function $G0(){return!global.Bare&&process.umask?process.umask():0}Zzf.extract=function(u,t){if(!u)u=".";if(!t)t={};u=Fl.resolve(u);let f=t.fs||wG0,l=t.ignore||t.filter||$o,E=t.mapStream||dG0,c=t.chown!==!1&&!wo&&Nzf()===0,w=t.extract||EG0.extract(),$=[],h=new Date,v=typeof t.umask==="number"?~t.umask:~$G0(),d=t.strict!==!1,D=t.validateSymlinks!==!1,_=t.map||$o,N=typeof t.dmode==="number"?t.dmode:0,Z=typeof t.fmode==="number"?t.fmode:0;if(t.strip)_=DG0(_,t.strip);if(t.readable)N|=parseInt(555,8),Z|=parseInt(444,8);if(t.writable)N|=parseInt(333,8),Z|=parseInt(222,8);if(w.on("entry",B),t.finish)w.on("finish",t.finish);return w;function B(A,G,k){A=_(A)||A,A.name=L4u(A.name);let I=Fl.join(u,Fl.join("/",A.name));if(l(I,A))return G.resume(),k();let X=Fl.join(I,".")===Fl.join(u,".")?u:Fl.dirname(I);vG0(f,X,Fl.join(u,"."),function(ti,vi){if(ti)return k(ti);if(!vi)return k(Error(X+" is not a valid path"));if(A.type==="directory")return $.push([I,A.mtime]),U(I,{fs:f,own:c,uid:A.uid,gid:A.gid,mode:A.mode},b);U(X,{fs:f,own:c,uid:A.uid,gid:A.gid,mode:493},function(Ei){if(Ei)return k(Ei);switch(A.type){case"file":return Q();case"link":return L();case"symlink":return K()}if(d)return k(Error("unsupported type for "+I+" ("+A.type+")"));G.resume(),k()})});function b(ti){if(ti)return k(ti);g(I,A,function(vi){if(vi)return k(vi);if(wo)return k();T(I,A,k)})}function K(){if(wo)return k();f.unlink(I,function(){let ti=Fl.resolve(Fl.dirname(I),A.linkname);if(!m(ti)&&D)return k(Error(I+" is not a valid symlink"));hG0(f,ti,Fl.join(u,"."),function(vi,Ei){if(vi)return k(vi);if(!Ei&&D)return k(Error(I+" is not a valid symlink"));f.symlink(A.linkname,I,b)})})}function L(){if(wo)return k();f.unlink(I,function(){let ti=Fl.join(u,Fl.join("/",A.linkname));f.realpath(ti,function(vi,Ei){if(vi||!m(Ei))return k(Error(I+" is not a valid hardlink"));f.link(Ei,I,function(ii){if(ii&&ii.code==="EPERM"&&t.hardlinkAsFilesFallback)return G=f.createReadStream(Ei),Q();b(ii)})})})}function m(ti){return ti===u||ti.startsWith(u+Fl.sep)}function Q(){let ti=f.createWriteStream(I),vi=E(G,A);ti.on("error",function(Ei){vi.destroy(Ei)}),cG0(vi,ti,function(Ei){if(Ei)return k(Ei);ti.on("close",b)})}}function F(A,G){let k;while((k=_zf($))&&A.slice(0,k[0].length)!==k[0])$.pop();if(!k)return G();f.utimes(k[0],h,k[1],G)}function g(A,G,k){if(t.utimes===!1)return k();if(G.type==="directory")return f.utimes(A,h,G.mtime,k);if(G.type==="symlink")return F(A,k);f.utimes(A,h,G.mtime,function(I){if(I)return k(I);F(A,k)})}function T(A,G,k){let I=G.type==="symlink",X=I?f.lchmod:f.chmod,b=I?f.lchown:f.chown;if(!X)return k();let K=(G.mode|(G.type==="directory"?N:Z))&v;if(b&&c)b.call(f,A,G.uid,G.gid,L);else L(null);function L(m){if(m)return k(m);if(!X)return k();X.call(f,A,K,k)}}function U(A,G,k){f.stat(A,function(I){if(!I)return k(null);if(I.code!=="ENOENT")return k(I);f.mkdir(A,{mode:G.mode,recursive:!0},function(X,b){if(X)return k(X);T(A,G,k)})})}};function hG0(i,u,t,f){if(u===t)return f(null,!0);if(!u.startsWith(t+Fl.sep))return f(null,!1);i.lstat(u,function(l,E){if(l&&l.code!=="ENOENT"&&l.code!=="EPERM")return f(l);if(l||!E.isSymbolicLink())return hG0(i,Fl.join(u,".."),t,f);f(null,!1)})}function vG0(i,u,t,f){if(u===t)return f(null,!0);i.lstat(u,function(l,E){if(l&&l.code!=="ENOENT"&&l.code!=="EPERM")return f(l);if(l||E.isDirectory())return vG0(i,Fl.join(u,".."),t,f);f(null,!1)})}function $o(){}function dG0(i){return i}function L4u(i){return wo?i.replace(/\\/g,"/").replace(/[:?<>|]/g,"_"):i}function Ozf(i,u,t,f,l,E){if(!l)l=["."];let c=l.slice(0);return function($){if(!c.length)return $(null);let h=c.shift(),v=Fl.join(t,h);u.call(i,v,function(d,D){if(d)return $(l.indexOf(h)===-1&&d.code==="ENOENT"?null:d);if(!D.isDirectory())return $(null,h,D);i.readdir(v,function(_,N){if(_)return $(_);if(E)N.sort();for(let Z=0;Z<N.length;Z++)if(!f(Fl.join(t,h,N[Z])))c.push(Fl.join(h,N[Z]));$(null,h,D)})})}}function DG0(i,u){return function(t){t.name=t.name.split("/").slice(u).join("/");let f=t.linkname;if(f&&(t.type==="link"||Fl.isAbsolute(f)))t.linkname=f.split("/").slice(u).join("/");return i(t)}}});var gzf,Tzf;var NG0=O(()=>{T4u();gzf=j(uP0(),1),Tzf=j(_G0(),1)});var ngi=()=>{};var OG0=O(()=>{igi()});var ZG0=O(()=>{xgi();Igi();ngi()});var BG0=()=>{};var FG0=()=>{};var Q4u=O(()=>{Ly0();F4u();xgi();Ry0();Z4u();T4u();by0();Cy0();My0();qy0();B4u();Vy0();NG0();ngi();OG0();ZG0();BG0();FG0();ngi()});var Wl,pl,YK,ho;var vo=O(()=>{Wl={CLAIM_API_GROUP:"extensions.agents.x-k8s.io",CLAIM_API_VERSION:"v1alpha1",CLAIM_PLURAL:"sandboxclaims",SANDBOX_API_GROUP:"agents.x-k8s.io",SANDBOX_API_VERSION:"v1alpha1",SANDBOX_PLURAL:"sandboxes",POD_NAME_ANNOTATION:"agents.x-k8s.io/pod-name"};pl=class pl extends Error{cause;constructor(i,u){super(i);if(this.name="SandboxError",this.cause=u,u instanceof Error&&u.stack)this.stack=`${this.stack}
 Caused by: ${u.stack}`}};YK=class YK extends pl{constructor(i,u){super(i,u);this.name="SandboxTimeoutError"}};ho=class ho extends pl{constructor(i,u){super(i,u);this.name="SandboxAlreadyExistsError"}}});async function Uzf(i){let u=i.getCurrentCluster();if(!u)throw new pl("No active cluster in kubeconfig");let t={};await i.applyToHTTPSOptions(t);let f={},l=t.headers??{};for(let[E,c]of Object.entries(l))if(Array.isArray(c))f[E]=c.join(", ");else if(c!==void 0)f[E]=String(c);if(typeof t.auth==="string"&&!f.Authorization)f.Authorization=`Basic ${Buffer.from(t.auth).toString("base64")}`;return{server:u.server.replace(/\/+$/,""),headers:f,tls:{cert:H4u(t.cert),key:H4u(t.key),ca:H4u(t.ca),rejectUnauthorized:u.skipTLSVerify?!1:void 0}}}function H4u(i){if(i==null)return;if(typeof i==="string")return i;if(Buffer.isBuffer(i))return i.toString("utf8");return String(i)}async function WK(i,u){let t=await Uzf(i),f={...t.headers,...u.headers};if(u.method==="PATCH")f["content-type"]=u.patchType==="apply"?"application/apply-patch+yaml":u.patchType==="strategic-merge"?"application/strategic-merge-patch+json":"application/merge-patch+json";else if(u.body!==void 0&&!("content-type"in f))f["content-type"]="application/json";let l={method:u.method,headers:f,body:u.body===void 0?void 0:JSON.stringify(u.body),signal:u.signal,tls:t.tls,...u.stream?{timeout:!1}:{}};return fetch(`${t.server}${u.path}`,l)}async function z4u(i){try{return await i.json()}catch{return null}}async function n4u(i,u){if(i.ok)return;let t=await z4u(i),f=t?.message??`${u} failed: ${i.status} ${i.statusText}`;throw new gG0(i.status,t,f)}async function Do(i,u,t,f,l="none"){try{let E=await WK(i,u);if(E.status===404)return null;if(await n4u(E,t),l==="json")return await E.json();return null}catch(E){throw new pl(f,E)}}async function _o(i,u,t){let f=`${TG0}/${encodeURIComponent(u)}/${Wl.CLAIM_PLURAL}`,l;try{l=await WK(i,{method:"POST",path:f,body:t})}catch(h){let v=h instanceof Error?h.message:String(h);throw console.warn(`[agent-sandbox/client] createSandboxClaim ${t.metadata.name} transport error: ${v}`),new pl(`Failed to create SandboxClaim: ${t.metadata.name} (transport error: ${v})`,h)}if(l.ok)return;let E=await z4u(l),c=E?.reason?` ${E.reason}`:"",w=E?.message??l.statusText,$=`Failed to create SandboxClaim: ${t.metadata.name} (${l.status}${c}: ${w})`;if(console.warn(`[agent-sandbox/client] createSandboxClaim ${t.metadata.name} rejected: status=${l.status} reason=${E?.reason??"<none>"} message=${w}`),l.status===409)throw new ho($);throw new pl($)}async function Rgi(i,u,t,f=60000){let l=Date.now()+f,E=500,c;while(!0){let w=await n2(i,u,t).catch(()=>{return});if(!w)return;if(c=w,Date.now()>=l){let $=c.metadata?.finalizers??[],h=c.metadata?.deletionTimestamp??"<unknown>";throw new YK(`SandboxClaim ${t} still terminating after ${f}ms (deletionTimestamp=${h}, finalizers=[${$.join(", ")}])`)}await y0(500)}}function R4u(i,u){return`${TG0}/${encodeURIComponent(i)}/${Wl.CLAIM_PLURAL}/${encodeURIComponent(u)}`}async function UG0(i,u,t,f){await Do(i,{method:"PATCH",path:R4u(u,t),patchType:"merge",body:{spec:{lifecycle:{shutdownPolicy:"Delete",shutdownTime:f}}}},"patchSandboxClaimShutdown",`Failed to patch SandboxClaim shutdownTime: ${t}`)}async function KN(i,u,t){await Do(i,{method:"DELETE",path:R4u(u,t)},"deleteSandboxClaim",`Failed to delete SandboxClaim: ${t}`)}async function n2(i,u,t){return await Do(i,{method:"GET",path:R4u(u,t)},"getSandboxClaim",`Failed to get SandboxClaim: ${t}`,"json")??void 0}async function AG0(i,u,t,f=60){let l=Date.now()+f*1000,E=200;while(Date.now()<l){let w=(await n2(i,u,t).catch(()=>{return}))?.status?.sandbox?.name;if(w)return w;await y0(200)}throw new YK(`SandboxClaim ${t} did not record an adopted Sandbox (status.sandbox.name) within ${f}s`)}function b4u(i,u){return`${Azf}/${encodeURIComponent(i)}/${GG0}/${encodeURIComponent(u)}`}async function bgi(i,u,t){let f=new URLSearchParams({fieldManager:xG0,force:"true"}),l=`${b4u(u,t.metadata.name)}?${f}`;try{let E=await WK(i,{method:"PATCH",path:l,patchType:"apply",body:t});await n4u(E,"applyHttpRoute")}catch(E){throw new pl(`Failed to apply HTTPRoute: ${t.metadata.name}`,E)}}async function Cgi(i,u,t){await Do(i,{method:"DELETE",path:b4u(u,t)},"deleteHttpRoute",`Failed to delete HTTPRoute: ${t}`)}async function IG0(i,u,t){return await Do(i,{method:"GET",path:b4u(u,t)},"getHttpRoute",`Failed to get HTTPRoute: ${t}`,"json")??void 0}async function kG0(i,u,t,f){let l={apiVersion:"v1",kind:"Service",metadata:{name:t},spec:{ports:[{name:f.name,port:f.port,targetPort:f.targetPort,protocol:f.protocol??"TCP"}]}},E=new URLSearchParams({fieldManager:xG0,force:"true"}),c=`/api/v1/namespaces/${encodeURIComponent(u)}/services/${encodeURIComponent(t)}?${E}`;try{let w=await WK(i,{method:"PATCH",path:c,patchType:"apply",body:l});await n4u(w,"ensureServicePort")}catch(w){throw new pl(`Failed to apply Service ports: ${t}`,w)}}function Mgi(i,u,t,f=180){let l=`/apis/${Wl.SANDBOX_API_GROUP}/${Wl.SANDBOX_API_VERSION}/namespaces/${encodeURIComponent(u)}/${Wl.SANDBOX_PLURAL}?watch=true&fieldSelector=${encodeURIComponent(`metadata.name=${t}`)}`,{resolve:E,reject:c,promise:w}=Promise.withResolvers(),$=new AbortController,h=!1,v=setTimeout(()=>{if(h)return;h=!0,$.abort(),c(new YK(`Sandbox did not become ready within ${f} seconds`))},f*1000),d=(D)=>{if(h)return;h=!0,clearTimeout(v),$.abort(),D()};return(async()=>{let D;try{D=await WK(i,{method:"GET",path:l,signal:$.signal,headers:{accept:"application/json"},stream:!0})}catch(_){d(()=>c(new pl("Failed to start watch for sandbox readiness",_)));return}if(!D.ok||!D.body){let _=await z4u(D).catch(()=>null);d(()=>c(new pl(`Watch handshake failed (${D.status}): ${_?.message??D.statusText}`)));return}try{for await(let _ of C4u(D.body)){if(h)return;if(_.type==="ERROR"){let g=_.object;d(()=>c(new pl(`Watch stream error while waiting for sandbox: ${g.message??"unknown"}`)));return}if(_.type!=="ADDED"&&_.type!=="MODIFIED")continue;let N=_.object;if(!N.status?.conditions?.find((g)=>g.type==="Ready"&&g.status==="True"))continue;let B=N.metadata?.name;if(!B){d(()=>c(new pl("Sandbox metadata or name is missing")));return}let F=N.metadata?.annotations?.[Wl.POD_NAME_ANNOTATION]??B;d(()=>E({sandboxName:B,podName:F}));return}d(()=>c(new pl("Watch stream closed before sandbox became ready")))}catch(_){if(h)return;if(_ instanceof Error&&(_.name==="AbortError"||$.signal.aborted))return;d(()=>c(new pl("Watch stream error while waiting for sandbox",_)))}})(),w}async function*C4u(i){let u=i.getReader(),t=new TextDecoder,f="";try{while(!0){let{value:E,done:c}=await u.read();if(c)break;f+=t.decode(E,{stream:!0});let w;while((w=f.indexOf(`
-`))>=0){let $=f.slice(0,w).trim();if(f=f.slice(w+1),!$)continue;yield JSON.parse($)}}let l=f.trim();if(l)yield JSON.parse(l)}finally{u.releaseLock()}}var gG0,TG0,yG0="gateway.networking.k8s.io",PG0="v1",GG0="httproutes",Azf,No,xG0="mesh-sandbox-runner";var qgi=O(()=>{O4();vo();gG0=class gG0 extends Error{status;body;constructor(i,u,t){super(t);this.status=i;this.body=u;this.name="KubeHttpError"}};TG0=`/apis/${Wl.CLAIM_API_GROUP}/${Wl.CLAIM_API_VERSION}/namespaces`;Azf=`/apis/${yG0}/${PG0}/namespaces`;No={API_GROUP:yG0,API_VERSION:PG0,PLURAL:GG0}});async function*JG0(i){let u=i.now??(()=>Date.now()),t=u(),f=i.schedulingTimeoutMs??Gzf,l={pod:{},sandbox:{},events:{hasPulling:!1,hasPulled:!1},startedAt:t},E=[],c=null,w=!1,$=(g)=>{if(w)return;if(c){let T=c;c=null,T(g)}else E.push(g)},h=()=>{if(E.length>0)return Promise.resolve(E.shift());if(w)return Promise.resolve(null);return new Promise((g)=>{c=g})},v=()=>{if(w)return;if(w=!0,c){let g=c;c=null,g(null)}},d=new AbortController,D=()=>{d.abort(),v()};if(i.signal)if(i.signal.aborted)d.abort(),v();else i.signal.addEventListener("abort",D,{once:!0});let _=Math.max(0,f-(u()-t)),N=setTimeout(()=>$("tick"),_+100),Z,B=new Promise((g)=>{Z=g}),F=Promise.allSettled([Izf(i.kc,i.namespace,i.claimName,d.signal,l,$,u,Z),kzf(i.kc,i.namespace,i.claimName,d.signal,l,$),jzf(i.kc,i.namespace,i.claimName,B,d.signal,l,$,u)]);try{let g=null,T=-1,U=jG0(l,f,u);if(g=q4u(U),!M4u(U))T=XG0(U);if(yield U,M4u(U))return;while(!w){if(await h()===null)break;let G=jG0(l,f,u);if(M4u(G)){let X=q4u(G);if(X!==g)g=X,yield G;return}let k=XG0(G);if(k<T)continue;let I=q4u(G);if(I!==g)g=I,T=k,yield G}}finally{if(clearTimeout(N),d.abort(),i.signal)i.signal.removeEventListener("abort",D);v(),await F.catch(()=>{})}}function jG0(i,u,t){let{pod:f,sandbox:l,events:E,startedAt:c}=i;if(l.ready)return{kind:"ready"};let w=f.containerWaitingReason;if(w==="ImagePullBackOff"||w==="ErrImagePull")return{kind:"failed",reason:"image-pull-backoff",message:"Sandbox image failed to download. The cluster may be missing pull credentials or the image tag may not exist."};if(w==="CrashLoopBackOff")return{kind:"failed",reason:"crash-loop-backoff",message:"Sandbox crashed during startup and is now in CrashLoopBackOff. Check pod logs."};if(!f.scheduled&&E.lastFailedSchedulingAt!==void 0&&t()-c>u)return{kind:"failed",reason:"scheduling-timeout",message:E.failedSchedulingMessage??`Pod could not be scheduled within ${Math.round(u/1000)}s.`};if(f.containerRunning&&!f.containerReady)return{kind:"warming-daemon",since:c};if(E.hasPulling&&!E.hasPulled)return{kind:"pulling-image",since:c};if(w==="ContainerCreating"||w==="PodInitializing"||f.scheduled&&!f.containerRunning)return{kind:"starting-container",since:c};if(f.scheduledFalseReason==="Unschedulable"||E.lastFailedSchedulingAt!==void 0&&!f.scheduled)return{kind:"waiting-for-capacity",since:c,message:E.failedSchedulingMessage??f.scheduledFalseMessage,nodeClaim:E.nominatedNodeClaim};return{kind:"claiming",since:c}}function M4u(i){return i.kind==="ready"||i.kind==="failed"}function XG0(i){switch(i.kind){case"claiming":return 0;case"waiting-for-capacity":return 1;case"pulling-image":return 2;case"starting-container":return 3;case"warming-daemon":return 4;case"ready":case"failed":return 99}}function q4u(i){switch(i.kind){case"claiming":case"pulling-image":case"starting-container":case"warming-daemon":return i.kind;case"waiting-for-capacity":return`waiting-for-capacity:${i.message??""}:${i.nodeClaim??""}`;case"ready":return"ready";case"failed":return`failed:${i.reason}:${i.message}`}}async function Izf(i,u,t,f,l,E,c,w){let $=`/api/v1/namespaces/${encodeURIComponent(u)}/pods?watch=true&labelSelector=${encodeURIComponent(`${yzf}=${t}`)}`;return Vgi({kc:i,path:$,signal:f,label:`pod/${t}`,onEvent:(h)=>{if(h.type!=="ADDED"&&h.type!=="MODIFIED")return;let v=h.object;if(v.metadata?.name)w(v.metadata.name);xzf(v,l,c),E("pod")}})}function xzf(i,u,t){let l=(i.status?.conditions??[]).find((c)=>c.type==="PodScheduled");if(l?.status==="True")u.pod.scheduled=!0,u.pod.scheduledFalseReason=void 0,u.pod.scheduledFalseMessage=void 0;else if(l?.status==="False")u.pod.scheduled=!1,u.pod.scheduledFalseReason=l.reason,u.pod.scheduledFalseMessage=l.message;let E=(i.status?.containerStatuses??[]).find((c)=>c.name===Pzf);if(E)u.pod.containerWaitingReason=E.state?.waiting?.reason,u.pod.containerRunning=!!E.state?.running,u.pod.containerReady=E.ready===!0}async function kzf(i,u,t,f,l,E){let c=`/apis/${Wl.CLAIM_API_GROUP}/${Wl.CLAIM_API_VERSION}/namespaces/${encodeURIComponent(u)}/${Wl.CLAIM_PLURAL}?watch=true&fieldSelector=${encodeURIComponent(`metadata.name=${t}`)}`;return Vgi({kc:i,path:c,signal:f,label:`sandboxclaim/${t}`,onEvent:(w)=>{if(w.type!=="ADDED"&&w.type!=="MODIFIED")return;let h=w.object.status?.conditions?.find((v)=>v.type==="Ready");if(!h)return;if(h.status==="True")l.sandbox.ready=!0,l.sandbox.notReadyReason=void 0,l.sandbox.notReadyMessage=void 0;else l.sandbox.ready=!1,l.sandbox.notReadyReason=h.reason,l.sandbox.notReadyMessage=h.message;E("sandbox")}})}async function jzf(i,u,t,f,l,E,c,w){let $=await Promise.race([f,new Promise((v)=>{if(l.aborted){v(t);return}l.addEventListener("abort",()=>v(t),{once:!0})})]);if(l.aborted)return;let h=`/api/v1/namespaces/${encodeURIComponent(u)}/events?watch=true&fieldSelector=${encodeURIComponent(`involvedObject.name=${$},involvedObject.kind=Pod`)}`;return Vgi({kc:i,path:h,signal:l,label:`events/${t}`,onEvent:(v)=>{if(v.type!=="ADDED"&&v.type!=="MODIFIED")return;let d=v.object,D=d.reason;if(!D)return;switch(D){case"Pulling":E.events.hasPulling=!0;break;case"Pulled":E.events.hasPulling=!0,E.events.hasPulled=!0;break;case"FailedScheduling":E.events.lastFailedSchedulingAt=w(),E.events.failedSchedulingMessage=d.message;break;case"Nominated":{let _=d.message?.match(/nodeclaim\/([\w-]+)/);if(_)E.events.nominatedNodeClaim=_[1];break}default:return}c("event")}})}async function KG0(i){let{kc:u,namespace:t,labelSelector:f,signal:l,onDelete:E}=i,c=`/apis/${Wl.CLAIM_API_GROUP}/${Wl.CLAIM_API_VERSION}/namespaces/${encodeURIComponent(t)}/${Wl.CLAIM_PLURAL}?watch=true&labelSelector=${encodeURIComponent(f)}`;return Vgi({kc:u,path:c,signal:l,label:"sandboxclaim-reaper",onEvent:(w)=>{if(w.type!=="DELETED")return;let $=w.object.metadata?.name;if($)E($)}})}async function Vgi(i){let{kc:u,path:t,signal:f,label:l,onEvent:E}=i,c=0;while(!f.aborted){try{let $=await WK(u,{method:"GET",path:t,signal:f,headers:{accept:"application/json"},stream:!0});if(!$.ok||!$.body){try{await $.body?.cancel()}catch{}if($.status===401||$.status===403){console.warn(`[lifecycle-watcher] ${l} stopped: watch denied (${$.status} ${$.statusText}). `+"The kubeconfig in use cannot watch SandboxClaims \u2014 if you are running locally, "+"this provider should not be active (check STUDIO_SANDBOX_PROVIDER / your sandbox preference).");return}throw Error(`watch handshake failed: ${$.status} ${$.statusText}`)}c=0;for await(let h of C4u($.body)){if(f.aborted)return;try{E(h)}catch(v){console.warn(`[lifecycle-watcher] ${l} onEvent threw: ${v instanceof Error?v.message:String(v)}`)}}}catch($){if(f.aborted)return;let h=$ instanceof Error?$.message:String($);console.warn(`[lifecycle-watcher] ${l} watch ended: ${h}`)}if(f.aborted)return;let w=hE(5000,250,c,2,0);c+=1,await y0(w,{signal:f}).catch(()=>{})}}var yzf="studio.decocms.com/sandbox-handle",Pzf="sandbox",Gzf=300000;var YG0=O(()=>{O4();vo();qgi()});async function WG0(i,u,t){let f=new Map;for(let l of i){let E=u(l);if(!E)continue;let c=f.get(E);if(c)c.push(l);else f.set(E,[l])}await Promise.allSettled([...f.values()].map(async(l)=>{for(let E of l)await t(E).catch(()=>{})}))}import{createHash as Xzf,randomBytes as Jzf,randomUUID as Kzf}from"crypto";import*as HG0 from"net";import{PassThrough as Yzf}from"stream";function Wzf(i){if(i instanceof Error)return i.message;if(i&&typeof i==="object"){let u=i;if(u.error instanceof Error)return u.error.message;if(typeof u.message==="string"&&u.message)return u.message}return String(i)}class o4u{kind=Xc;records=new Map;inflight=new T5i;stateStore;previewUrlPattern;kubeConfig;portForward;namespace;sandboxTemplateName;envName;tokenGenerator;idleTtlMs;metrics;previewGateway;sentinelToken;mintCloneUrl;closed=!1;claimWatchAbort=new AbortController;constructor(i={}){this.stateStore=i.stateStore??null,this.previewUrlPattern=i.previewUrlPattern??null,this.kubeConfig=i.kubeConfig??Vzf(),this.portForward=new U4u(this.kubeConfig),this.namespace=i.namespace??Szf,this.sandboxTemplateName=i.sandboxTemplateName??Lzf,this.envName=szf(i.envName),this.tokenGenerator=i.tokenGenerator??(()=>Jzf(Hzf).toString("hex")),this.idleTtlMs=i.idleTtlMs??nzf,this.metrics=i.meter?qzf(i.meter):null,this.previewGateway=i.previewGateway&&i.previewUrlPattern?{...i.previewGateway}:null;let u=i.sentinelToken?.trim()??"";this.sentinelToken=u.length>0?u:null,this.mintCloneUrl=i.mintCloneUrl,this.startClaimReaper(),this.startCredentialRefresher()}startClaimReaper(){let i=["app.kubernetes.io/managed-by=studio","app.kubernetes.io/name=studio-sandbox",...this.envName?[`${zh.env}=${this.envName}`]:[]].join(",");KG0({kc:this.kubeConfig,namespace:this.namespace,labelSelector:i,signal:this.claimWatchAbort.signal,onDelete:(u)=>this.invalidateRecord(u)})}async ensure(i,u={}){let t=TN(i,u.branch??u.repo?.branch??null);return this.inflight.run(t,()=>na(this.stateStore,i,Xc,(f)=>this.ensureLocked(i,t,u,f)))}async delete(i,u){if(u&&this.stateStore){await na(this.stateStore,u,Xc,(t)=>this.deleteLocked(i,u,t));return}await this.deleteLocked(i,u,this.stateStore)}async deleteLocked(i,u,t){let f=this.records.get(i)??null;if(this.records.delete(i),f)this.closeForwarder(f.daemonForward),this.metrics?.active.add(-1,e4u(f.tenant));if(await this.deleteHttpRouteIfManaged(i).catch((l)=>{console.warn(`[${i6}] HTTPRoute delete failed for ${i}: ${l instanceof Error?l.message:String(l)}`)}),await KN(this.kubeConfig,this.namespace,i),t)if(u)await t.delete(u,Xc);else if(f)await t.delete(f.id,Xc);else await t.deleteByHandle(Xc,i)}async alive(i){return await n2(this.kubeConfig,this.namespace,i)!==void 0}watchClaimLifecycle(i,u){return JG0({kc:this.kubeConfig,namespace:this.namespace,claimName:i,signal:u})}async getPreviewUrl(i){let u=await this.getRecord(i);if(!u)return null;return this.composePreviewUrl(u)}async proxyDaemonRequest(i,u,t){let f=await this.getRecord(i);if(!f&&this.previewUrlPattern&&this.stateStore){let $=await this.stateStore.getByHandle(Xc,i),h=$?.state,v=h?.token;if($&&v){let D=`http://${h?.adoptedSandboxName??i}.${this.namespace}.svc.cluster.local:${YN}`;try{let _=await nM(D,v,u,t);if(_.status!==404)return _;try{await _.body?.cancel()}catch{}}catch{}}}if(!f)f=await this.resurrectByHandle(i);if(!f)return new Response(JSON.stringify({error:"sandbox not found"}),{status:404,headers:{"content-type":"application/json"}});let l=f,E=performance.now(),c=0,w=!(t.body instanceof ReadableStream);try{let $=await nM(f.daemonUrl,f.token,u,t);if($.status===401&&w){this.invalidateRecord(i);let h=await this.getRecord(i).catch(()=>null)??await this.resurrectByHandle(i).catch(()=>null);if(h)l=h,$=await nM(h.daemonUrl,h.token,u,t)}return c=$.status,$}catch($){if(!w)throw $;this.invalidateRecord(i);let h=await this.resurrectByHandle(i)??await this.getRecord(i).catch(()=>null);if(!h)throw $;l=h;let v=await nM(h.daemonUrl,h.token,u,t);return c=v.status,v}finally{this.recordProxyDuration("daemon",c,l,performance.now()-E)}}async adoptLiveClaim(i,u){if(this.records.has(u))return!0;let t=await n2(this.kubeConfig,this.namespace,u).catch(()=>{return});if(!t||t.metadata?.deletionTimestamp)return!1;return await this.inflight.run(u,async()=>{let l=this.records.get(u);if(l)return this.toSandbox(l);let E=await this.adopt(i,u,t);if(!E)throw Error(`cannot adopt live claim ${u}`);return na(this.stateStore,i,Xc,(c)=>this.finish(E,c,!0,!0,"adopt"))}).catch(()=>null)!=null}async resolvePreviewUpstreamUrl(i){if(this.previewUrlPattern)return`http://${await this.resolveServiceNameForHandle(i)}.${this.namespace}.svc.cluster.local:${YN}`;let u=await this.getRecord(i);if(u)return u.daemonUrl;let t=await this.resurrectByHandle(i);return t?t.daemonUrl:null}async resolveServiceNameForHandle(i){let u=this.records.get(i);if(u)return u.adoptedSandboxName;if(this.stateStore){let f=(await this.stateStore.getByHandle(Xc,i).catch(()=>null))?.state?.adoptedSandboxName;if(f)return f}return i}async proxyPreviewRequest(i,u){let t=performance.now(),f=this.records.get(i)??null,l=0;try{let E=await this.resolvePreviewUpstreamUrl(i);if(!E){l=404;let N=r4u(404,{error:"sandbox not found"});return N.headers.set(LK,"1"),N}let c=new URL(u.url);if((c.pathname==="/_sandbox"||c.pathname.startsWith("/_sandbox/")||c.pathname==="/_decopilot_vm"||c.pathname.startsWith("/_decopilot_vm/"))&&u.method!=="GET")return l=404,r4u(404,{error:"not found"});let $=(N)=>`${N}${c.pathname}${c.search}`,h=new Headers(u.headers);for(let N of Czf)h.delete(N);let v=u.method!=="GET"&&u.method!=="HEAD",d={method:u.method,headers:h,body:v?u.body:void 0,redirect:"manual",signal:u.signal,duplex:v?"half":void 0},D;try{D=await fetch($(E),d)}catch(N){let Z=`${E}${c.pathname}`;if(console.warn(`[${i6}] preview fetch to ${Z} failed: ${N instanceof Error?N.message:String(N)}`),u.method==="GET"||u.method==="HEAD"){if(this.invalidateRecord(i),await this.resurrectByHandle(i).catch(()=>null)){let g=await this.resolvePreviewUpstreamUrl(i);if(g)try{D=await fetch($(g),d);let T=new Headers;for(let[U,A]of D.headers.entries())if(!SG0.includes(U.toLowerCase()))T.set(U,A);return l=D.status,new Response(D.body,{status:D.status,statusText:D.statusText,headers:T})}catch(T){console.warn(`[${i6}] preview fetch retry to ${Z} failed: ${T instanceof Error?T.message:String(T)}`)}}}else this.invalidateRecord(i);l=502;let B=r4u(502,{error:"sandbox daemon unreachable"});return B.headers.set(LK,"1"),B}let _=new Headers;for(let[N,Z]of D.headers.entries())if(!SG0.includes(N.toLowerCase()))_.set(N,Z);return l=D.status,new Response(D.body,{status:D.status,statusText:D.statusText,headers:_})}finally{this.recordProxyDuration("preview",l,f,performance.now()-t,i)}}async ensureLocked(i,u,t,f){if(t.image)console.warn(`[${i6}] opts.image ignored (template ${this.sandboxTemplateName} pins image): got ${t.image}`);if(f){let c=await f.get(i,Xc);if(c){let w=await this.rehydrate(i,u,c);if(w)return await this.refreshDaemonGitCredential(w,t),this.finish(w,f,!1,!0,"resume");await f.delete(i,Xc)}}let l=await n2(this.kubeConfig,this.namespace,u).catch(()=>{return});if(l)if(l.metadata?.deletionTimestamp)await Rgi(this.kubeConfig,this.namespace,u).catch((c)=>{console.warn(`[${i6}] wait for terminating claim ${u} failed: ${c instanceof Error?c.message:String(c)}`)});else{let c=await this.adopt(i,u,l).catch((w)=>{return console.warn(`[${i6}] adopt ${u} failed, recreating: ${w instanceof Error?w.message:String(w)}`),null});if(c)return await this.refreshDaemonGitCredential(c,t),this.finish(c,f,!0,!0,"adopt");await KN(this.kubeConfig,this.namespace,u).catch(()=>{}),await Rgi(this.kubeConfig,this.namespace,u).catch((w)=>{console.warn(`[${i6}] wait for deleted claim ${u} failed: ${w instanceof Error?w.message:String(w)}`)})}let E=await this.provision(i,u,t);return this.finish(E,f,!0,!1,"fresh")}async finish(i,u,t,f,l){let E=this.records.get(i.handle),c=E!==void 0;if(E&&E.daemonForward!==i.daemonForward)this.closeForwarder(E.daemonForward);if(this.records.set(i.handle,i),t)await this.persist(u,i);if(f)await UG0(this.kubeConfig,this.namespace,i.handle,this.computeShutdownTime()).catch((w)=>console.warn(`[${i6}] TTL refresh failed for ${i.handle}: ${w instanceof Error?w.message:String(w)}`));if(this.metrics){let w=e4u(i.tenant);if(this.metrics.ensureOutcome.add(1,{...w,outcome:l}),!c)this.metrics.active.add(1,w)}return this.toSandbox(i)}buildEnvMap(i,u){let t={},f=[];for(let[l,E]of Object.entries(i.env??{}))if(zzf.has(l))f.push(l);else t[l]=E;if(f.length>0)console.warn(`[${i6}] opts.env keys overlap reserved bootstrap names and were dropped: ${f.join(",")}`);return{...t,DAEMON_TOKEN:u.token,DAEMON_BOOT_ID:u.daemonBootId,APP_ROOT:u.workdir,PROXY_PORT:String(YN)}}buildClaim(i,u,t){let f=this.sentinelToken!==null,l=f?[]:Object.entries(this.buildEnvMap(u,t)).sort(([w],[$])=>w<$?-1:w>$?1:0).map(([w,$])=>({name:w,value:$})),E=unf(u),c=Object.keys(E).length>0;return{apiVersion:`${Wl.CLAIM_API_GROUP}/${Wl.CLAIM_API_VERSION}`,kind:"SandboxClaim",metadata:{name:i,namespace:this.namespace,labels:{"app.kubernetes.io/name":"studio-sandbox","app.kubernetes.io/managed-by":"studio",...this.envName?{[zh.env]:this.envName}:{},...m4u(u.tenant)},...c?{annotations:E}:{}},spec:{sandboxTemplateRef:{name:this.sandboxTemplateName},additionalPodMetadata:{labels:m4u(u.tenant,{[zh.role]:"claimed",[zh.sandboxHandle]:i,...this.envName?{[zh.env]:this.envName}:{}}),...c?{annotations:E}:{}},env:l,warmpool:f?"default":"none",lifecycle:{shutdownPolicy:"Delete",shutdownTime:this.computeShutdownTime()}}}}async provision(i,u,t){let f=this.tokenGenerator(),l=Kzf(),E=V4u,c=this.buildClaim(u,t,{token:f,daemonBootId:l,workdir:E});try{await _o(this.kubeConfig,this.namespace,c)}catch(D){if(D instanceof ho)await Rgi(this.kubeConfig,this.namespace,u),await _o(this.kubeConfig,this.namespace,c);else throw D}let w;try{w=await AG0(this.kubeConfig,this.namespace,u),await Mgi(this.kubeConfig,this.namespace,w)}catch(D){throw await KN(this.kubeConfig,this.namespace,u).catch(()=>{}),D}try{await this.ensureServicePortForAdoptedSandbox(w),await this.ensureHttpRouteForHandle(u,w,t.tenant??null)}catch(D){throw await KN(this.kubeConfig,this.namespace,u).catch(()=>{}),D}let $=await this.openForwarder(w,YN,u),h=`http://127.0.0.1:${$.localPort}`,v=this.workloadConfigPayload(t),d=l;try{if(await uli(h),this.sentinelToken!==null){let D=await ili(h);if(D)d=D.bootId;await B_(h,this.sentinelToken,v??{},{rotateToken:f})}else if(v)await B_(h,f,v);if(t.orgFsConfigJson)await uMu(h,f,t.orgFsConfigJson).catch((D)=>console.warn("[org-fs] sidecar config relay failed",D))}catch(D){throw this.closeForwarder($),await this.deleteHttpRouteIfManaged(u).catch(()=>{}),await KN(this.kubeConfig,this.namespace,u).catch(()=>{}),D}return{id:i,handle:u,adoptedSandboxName:w,token:f,workdir:E,daemonUrl:h,daemonForward:$,workload:t.workload??null,daemonBootId:d,tenant:t.tenant??null,ensureOpts:fnf(t)}}workloadConfigPayload(i){return ntu({runtime:i?.workload?.runtime??"node",packageManager:i?.workload?.packageManager?{name:i.workload.packageManager,...i.workload.packageManagerPath?{path:i.workload.packageManagerPath}:{}}:null,repo:i?.repo??null,port:i?.workload?.devPort??Qzf,tenant:i?.tenant??void 0})}async refreshDaemonGitCredential(i,u){let t=Rtu(u);if(!t)return;try{await B_(i.daemonUrl,i.token,t)}catch(f){console.warn(`[${i6}] git credential refresh failed for ${i.handle}: ${f instanceof Error?f.message:String(f)}`)}}async withFreshCloneUrl(i,u){if(!this.mintCloneUrl)return i;try{let t=await this.mintCloneUrl(i,u!==void 0?{bufferMs:u}:void 0);return t?{...i,cloneUrl:t}:i}catch(t){return console.warn(`[${i6}] clone credential re-mint failed: ${t instanceof Error?t.message:String(t)}`),i}}startCredentialRefresher(){if(!this.mintCloneUrl)return;let{signal:i}=this.claimWatchAbort;(async()=>{while(!i.aborted){if(await y0(Rzf,{signal:i}).catch(()=>{}),i.aborted)break;try{await this.refreshAllGitCredentials()}catch(u){console.warn(`[${i6}] periodic credential refresh failed: ${u instanceof Error?u.message:String(u)}`)}}})()}async refreshAllGitCredentials(){await WG0(this.records.values(),(i)=>i.ensureOpts?.repo?.connectionId,async(i)=>{if(this.claimWatchAbort.signal.aborted)return;let u=i.ensureOpts?.repo;if(!u)return;let t=await this.withFreshCloneUrl(u,bzf);await this.refreshDaemonGitCredential(i,{...i.ensureOpts,repo:t}),i.ensureOpts={...i.ensureOpts,repo:t}})}async rebootstrapDaemon(i,u,t){if(this.sentinelToken===null)return!1;let f=this.workloadConfigPayload(t)??{};try{return await B_(i,this.sentinelToken,f,{rotateToken:u}),!0}catch(l){if(l instanceof p1i&&l.status===401)try{return await B_(i,u,f,{rotateToken:u}),!0}catch(E){return console.warn(`[${i6}] re-bootstrap retry with claim token failed: ${E instanceof Error?E.message:String(E)}`),!1}return console.warn(`[${i6}] re-bootstrap failed: ${l instanceof Error?l.message:String(l)}`),!1}}async ensureServicePortForAdoptedSandbox(i){if(!this.previewGateway||!this.previewUrlPattern)return;await kG0(this.kubeConfig,this.namespace,i,{name:"daemon",port:YN,targetPort:YN})}async ensureHttpRouteForHandle(i,u,t){if(!this.previewGateway||!this.previewUrlPattern)return;let f=lnf(this.previewUrlPattern,i);if(!f)throw new pl(`Unable to derive preview hostname for ${i} from pattern: ${this.previewUrlPattern}`);let l={apiVersion:`${No.API_GROUP}/${No.API_VERSION}`,kind:"HTTPRoute",metadata:{name:i,namespace:this.namespace,labels:m4u(t??void 0,{[zh.role]:"claimed",[zh.sandboxHandle]:i,"app.kubernetes.io/name":"studio-sandbox","app.kubernetes.io/managed-by":"studio",...this.envName?{[zh.env]:this.envName}:{}})},spec:{parentRefs:[{kind:"Gateway",group:"gateway.networking.k8s.io",name:this.previewGateway.name,namespace:this.previewGateway.namespace}],hostnames:[f],rules:[{backendRefs:[{group:"",kind:"Service",name:u,port:YN}]}]}};await bgi(this.kubeConfig,this.namespace,l)}async deleteHttpRouteIfManaged(i){if(!this.previewGateway)return;await Cgi(this.kubeConfig,this.namespace,i)}async rehydrate(i,u,t){let f=t.state;if(!f.adoptedSandboxName&&!f.podName||!f.token)return null;let l=await n2(this.kubeConfig,this.namespace,u).catch(()=>{return});if(!l||!LG0(l))return null;let E=l.status?.sandbox?.name??f.adoptedSandboxName??f.podName??u,c=await this.openAndProbeDaemon(E,u);if(!c)return null;if(f.daemonBootId&&f.daemonBootId!==c.bootId){if(this.sentinelToken!==null){let w=f.ensureOpts?.repo?{...f.ensureOpts,repo:await this.withFreshCloneUrl(f.ensureOpts.repo)}:f.ensureOpts??null;if(!await this.rebootstrapDaemon(c.daemonUrl,f.token,w))return this.closeForwarder(c.daemonForward),null}else console.warn(`[${i6}] daemon restart detected (handle=${u}): stored bootId=${f.daemonBootId} live bootId=${c.bootId}`);await this.stateStore?.put(i,Xc,{handle:u,state:{...f,daemonBootId:c.bootId}}).catch((w)=>console.warn(`[${i6}] bootId persist failed for ${u}: ${w instanceof Error?w.message:String(w)}`))}return{id:i,handle:u,adoptedSandboxName:E,token:f.token,workdir:f.workdir??V4u,daemonUrl:c.daemonUrl,daemonForward:c.daemonForward,workload:f.workload??null,daemonBootId:c.bootId,tenant:f.tenant??null,ensureOpts:f.ensureOpts??null}}async adopt(i,u,t){if(!LG0(t))return null;let f=t.status?.sandbox?.name??u;if(this.sentinelToken!==null)return null;let l=rzf(t);if(!l)return null;let E=await this.openAndProbeDaemon(f,u);if(!E)return null;let c=tnf(t);if(this.previewGateway)await this.ensureServicePortForAdoptedSandbox(f).catch((w)=>{console.warn(`[${i6}] Service port backfill failed for ${u}: ${w instanceof Error?w.message:String(w)}`)}),await this.ensureHttpRouteForHandle(u,f,c).catch((w)=>{console.warn(`[${i6}] HTTPRoute backfill failed for ${u}: ${w instanceof Error?w.message:String(w)}`)});return{id:i,handle:u,adoptedSandboxName:f,token:l,workdir:V4u,daemonUrl:E.daemonUrl,daemonForward:E.daemonForward,workload:null,daemonBootId:E.bootId,tenant:c,ensureOpts:null}}async openAndProbeDaemon(i,u){let t=await this.openForwarder(i,YN,u).catch(()=>null);if(!t)return null;let f=`http://127.0.0.1:${t.localPort}`,l=await ili(f);if(!l)return this.closeForwarder(t),null;return{daemonForward:t,daemonUrl:f,bootId:l.bootId}}async getRecord(i){let u=this.records.get(i);if(u)return u;if(!this.stateStore)return null;let t=await this.stateStore.getByHandle(Xc,i);if(!t)return null;let f=await this.rehydrate(t.id,i,t);if(f)this.records.set(i,f);return f}async resurrectByHandle(i){if(!this.stateStore)return null;let u=await this.stateStore.getByHandle(Xc,i);if(!u)return null;let t=u.state.ensureOpts;if(!t)return null;let f=t.repo?{...t,repo:await this.withFreshCloneUrl(t.repo)}:t;return await this.ensure(u.id,f),this.records.get(i)??null}invalidateRecord(i){let u=this.records.get(i);if(!u)return;this.records.delete(i),this.closeForwarder(u.daemonForward)}recordProxyDuration(i,u,t,f,l){if(!this.metrics)return;this.metrics.proxyDurationMs.record(f,{...e4u(t?.tenant??null),source:i,sandbox_handle:t?.handle??l??"",status_code:u||0})}composePreviewUrl(i){if(this.previewUrlPattern)return U5i(this.previewUrlPattern,i.handle);return`http://127.0.0.1:${i.daemonForward.localPort}/`}toSandbox(i){return{handle:i.handle,workdir:i.workdir,previewUrl:this.composePreviewUrl(i)}}async persist(i,u){if(!i)return;let t={adoptedSandboxName:u.adoptedSandboxName,token:u.token,workdir:u.workdir,workload:u.workload,daemonBootId:u.daemonBootId,tenant:u.tenant,...u.ensureOpts?{ensureOpts:u.ensureOpts}:{}};await i.put(u.id,Xc,{handle:u.handle,state:t})}computeShutdownTime(){return new Date(Date.now()+this.idleTtlMs).toISOString()}openForwarder(i,u,t=i){let f=mzf(t,u);return new Promise((l,E)=>{let c=(w,$)=>{let h=HG0.createServer((v)=>this.handleForwardedConnection(v,i,u,t));h.once("error",(v)=>{if(v.code==="EADDRINUSE"&&$<Mzf){try{h.close()}catch{}let d=a4u+(w-a4u+1)%zG0;c(d,$+1);return}E(v)}),h.listen(w,"127.0.0.1",()=>{let v=h.address();if(!v||typeof v==="string"){h.close(),E(Error("port-forward listener failed to bind"));return}l({server:h,localPort:v.port})})};c(f,0)})}handleForwardedConnection(i,u,t,f){let l=new Yzf,E=null,c=!1,w=()=>{if(c)return;if(c=!0,l.destroy(),E)try{E.close()}catch{}if(!i.destroyed)i.destroy()};i.pipe(l),i.on("error",w),i.on("close",w),this.portForward.portForward(this.namespace,u,[t],i,null,l).then(($)=>{let h=typeof $==="function"?$():$;if(!h){w();return}if(E=h,E.on("close",w),E.on("error",()=>{this.invalidateRecord(f),w()}),c)try{E.close()}catch{}}).catch(($)=>{console.warn(`[${i6}] port-forward to ${u}:${t} failed: ${Wzf($)}`),this.invalidateRecord(f),w()})}closeForwarder(i){i.server.close((u)=>{if(u)console.warn(`[${i6}] port-forward close on :${i.localPort} errored: ${u instanceof Error?u.message:String(u)}`)})}close(){if(this.closed)return;this.closed=!0,this.claimWatchAbort.abort();for(let i of this.records.values())this.closeForwarder(i.daemonForward);this.records.clear()}}function qzf(i){return{active:i.createUpDownCounter("studio.sandbox.active",{description:"Active sandbox count, by runner kind and owning org. Cross-checks the cAdvisor-derived count from the cluster \u2014 divergence between the two indicates orphaned claims (studio deleted but K8s didn't reap) or unattributed pods.",unit:"{sandbox}"}),ensureOutcome:i.createCounter("studio.sandbox.ensure.outcome",{description:"Outcome of each ensure() call: fresh provision, resume from state-store after restart, or adopt of a cluster-side claim studio didn't know about. Cold-start ratio is the primary input for warm-pool sizing.",unit:"{call}"}),proxyDurationMs:i.createHistogram("studio.sandbox.proxy.duration_ms",{description:"Wall-clock latency of studio-mediated requests to the sandbox daemon: tool exec proxies (source=daemon) and preview iframe traffic (source=preview).",unit:"ms"})}}function Vzf(){let i=new az;return i.loadFromDefault(),i}function LG0(i){return Boolean(i.status?.conditions?.some((u)=>u.type==="Ready"&&u.status==="True"))}function rzf(i){let u=i.spec?.env;if(!u)return null;for(let t of u)if(t.name==="DAEMON_TOKEN"&&t.value)return t.value;return null}function mzf(i,u){let t=Xzf("sha256").update(`${i}:${u}`).digest();return a4u+t.readUInt32BE(0)%zG0}function r4u(i,u){return new Response(JSON.stringify(u),{status:i,headers:{"content-type":"application/json","access-control-allow-origin":"*"}})}function QG0(i){let u=i.slice(0,azf);return ezf.test(u)?u:""}function szf(i){if(i===void 0)return null;let u=i.trim();if(u==="")return null;if(!ozf.test(u))throw Error(`AgentSandboxProvider: envName=${JSON.stringify(u)} is not a valid DNS-label-safe environment name (lowercase alphanumeric or '-', starts with a letter, ends alphanumeric, \u226432 chars). Studio sets this from STUDIO_ENV; check the studio chart's configMap.`);return u}function m4u(i,u={}){let t={...u};if(i){let f=QG0(i.orgId),l=i.userId?QG0(i.userId):"";if(f)t[zh.orgId]=f;if(l)t[zh.userId]=l}return t}function SK(i){let u="";for(let t of i){let f=t.codePointAt(0)??0;u+=f<32||f===127?" ":t}return u.slice(0,pzf)}function inf(i){try{let u=new URL(i);return u.username="",u.password="",u.toString()}catch{return""}}function unf(i){let u={},t=i.tenant;if(t?.orgSlug)u[Gv.orgSlug]=SK(t.orgSlug);if(t?.orgName)u[Gv.orgName]=SK(t.orgName);if(t?.userEmail)u[Gv.userEmail]=SK(t.userEmail);if(t?.userName)u[Gv.userName]=SK(t.userName);let f=i.repo;if(f){if(f.displayName)u[Gv.gitRepo]=SK(f.displayName);let l=inf(f.cloneUrl);if(l)u[Gv.gitRepoUrl]=SK(l);let E=i.branch??f.branch;if(E)u[Gv.gitBranch]=SK(E)}return u}function tnf(i){let u=i.metadata?.labels;if(!u)return null;let t=u[zh.orgId],f=u[zh.userId];if(!t)return null;let l=i.metadata?.annotations??{};return{orgId:t,...f?{userId:f}:{},orgSlug:l[Gv.orgSlug],orgName:l[Gv.orgName],userEmail:l[Gv.userEmail],userName:l[Gv.userName]}}function e4u(i){return{org_id:i?.orgId??"",user_id:i?.userId??"",runner_kind:Xc}}function fnf(i){let u={};if(i.repo)u.repo=i.repo;if(i.workload)u.workload=i.workload;if(i.env&&Object.keys(i.env).length>0)u.env=i.env;if(i.tenant)u.tenant=i.tenant;return Object.keys(u).length>0?u:null}function lnf(i,u){try{return new URL(U5i(i,u)).hostname||null}catch{return null}}var Xc="agent-sandbox",i6="AgentSandboxProvider",LK="x-sandbox-preview-not-ready",Szf="agent-sandbox-system",Lzf="studio-sandbox",YN=9000,Qzf=3000,V4u="/app",Hzf=32,zzf,nzf=900000,Rzf=900000,bzf=1800000,Czf,SG0,a4u=40000,zG0=1e4,Mzf=256,zh,Gv,ezf,azf=63,ozf,pzf=253;var nG0=O(()=>{O4();Q4u();Eni();A5i();qgi();vo();YG0();zzf=new Set(["DAEMON_TOKEN","DAEMON_BOOT_ID","APP_ROOT","PROXY_PORT"]),Czf=["cookie","host","connection","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","accept-encoding","content-length","upgrade"],SG0=["connection","keep-alive","transfer-encoding","content-encoding","content-length"];zh={role:"studio.decocms.com/role",sandboxHandle:"studio.decocms.com/sandbox-handle",orgId:"studio.decocms.com/org-id",userId:"studio.decocms.com/user-id",env:"studio.decocms.com/env"},Gv={orgSlug:"studio.decocms.com/org-slug",orgName:"studio.decocms.com/org-name",userEmail:"studio.decocms.com/user-email",userName:"studio.decocms.com/user-name",gitRepo:"studio.decocms.com/git-repo",gitRepoUrl:"studio.decocms.com/git-repo-url",gitBranch:"studio.decocms.com/git-branch"},ezf=/^([A-Za-z0-9]([-A-Za-z0-9_.]*[A-Za-z0-9])?)?$/;ozf=/^[a-z]([a-z0-9-]{0,30}[a-z0-9])?$/});var RG0={};ji(RG0,{waitForSandboxReady:()=>Mgi,getSandboxClaim:()=>n2,getHttpRoute:()=>IG0,deleteSandboxClaim:()=>KN,deleteHttpRoute:()=>Cgi,createSandboxClaim:()=>_o,applyHttpRoute:()=>bgi,SandboxTimeoutError:()=>YK,SandboxError:()=>pl,PREVIEW_NOT_READY_HEADER:()=>LK,KubeConfig:()=>az,K8S_CONSTANTS:()=>Wl,HTTPROUTE_CONSTANTS:()=>No,AgentSandboxProvider:()=>o4u});var s4u=O(()=>{Q4u();vo();qgi();nG0()});class rgi{kind=WN;userSub;dispatch;stateStore;records=new Map;constructor(i){if(!i.userSub)throw Error("DesktopSandboxProvider requires userSub");if(!i.dispatch)throw Error("DesktopSandboxProvider requires dispatch");this.userSub=i.userSub,this.dispatch=i.dispatch,this.stateStore=i.stateStore??null}async ensure(i,u={}){let t=u.branch??u.repo?.branch,f=TN(i,t),l=this.records.get(f);if(l){if(await this.probeHealth(f))return this.toSandbox(l);if(this.records.delete(f),this.stateStore)await this.stateStore.deleteByHandle(WN,f).catch(()=>{})}else if(this.stateStore){let D=(await this.stateStore.getByHandle(WN,f))?.state,_=D?.sandboxApiUrl;if(_){if(await this.probeHealth(f)){let N={handle:f,sandboxApiUrl:_,previewUrl:D?.previewUrl??_};return this.records.set(f,N),this.toSandbox(N)}await this.stateStore.deleteByHandle(WN,f).catch(()=>{})}}let E=T5({userName:u.tenant?.userName,userEmail:u.tenant?.userEmail}),c=JSON.stringify({handle:f,repo:u.repo,branch:t,...u.workload?{workload:u.workload}:{},...E?{operator:E}:{},...u.offloadAllowedHosts?{offloadAllowedHosts:u.offloadAllowedHosts}:{},...u.offloadAllowSameHostDev!==void 0?{offloadAllowSameHostDev:u.offloadAllowSameHostDev}:{},...u.orgFsConfigJson?{orgFsConfigJson:u.orgFsConfigJson}:{}}),w=await this.dispatchJson("POST","/api/sandboxes",c),$=JSON.parse(w);if(typeof $.sandboxApiUrl!=="string")throw Error("desktop ensure: daemon did not return a sandboxApiUrl string");let h=typeof $.previewUrl==="string"?$.previewUrl:$.sandboxApiUrl,v={handle:f,sandboxApiUrl:$.sandboxApiUrl,previewUrl:h};if(this.records.set(f,v),this.stateStore)await this.stateStore.put(i,WN,{handle:f,state:{handle:f,sandboxApiUrl:$.sandboxApiUrl,previewUrl:h}});return this.toSandbox(v)}async proxyDaemonRequest(i,u,t){let f=u.startsWith("/")?u:`/${u}`,l=f.startsWith("/_sandbox/")?f.slice(9):f,E=`/_sandbox/${encodeURIComponent(i)}${l}`,c=new Headers(t.headers);for(let F of["host","cookie","connection","keep-alive","transfer-encoding","upgrade","authorization"])c.delete(F);let w={};c.forEach((F,g)=>{w[g]=F});let $;if(t.body!=null)$=await cnf(t.body);let v=this.dispatch(this.userSub,{method:t.method,path:E,headers:w,body:$},{signal:t.signal})[Symbol.asyncIterator](),d=Enf(),D=200,_={"content-type":"application/octet-stream"},N=[];try{while(!0){let F=await v.next();if(F.done)break;let g=F.value;if(g.headers){D=g.headers.status,_=g.headers.headers;break}if(g.data!=null){let T=d.push(g.data);if(T.length)N.push(T)}}}catch(F){let g=F instanceof Error?F.message:"dispatch error";return new Response(JSON.stringify({error:g}),{status:502,headers:{"content-type":"application/json"}})}let Z=!1,B=new ReadableStream({async start(F){for(let g of N)F.enqueue(g)},async pull(F){try{while(!0){let g=await v.next();if(Z)return;if(g.done){let U=d.flush();if(U.length)F.enqueue(U);F.close();return}let T=g.value;if(T.data!=null){let U=d.push(T.data);if(U.length){F.enqueue(U);return}}}}catch(g){if(!Z)F.error(g)}},cancel(){Z=!0,v.return?.()}});return new Response(B,{status:D,headers:_})}async alive(i){return this.probeHealth(i)}async probeHealth(i){let u=new AbortController,t=setTimeout(()=>u.abort(),3000);try{return await this.dispatchJson("GET",`/api/sandboxes/${encodeURIComponent(i)}`,void 0,u.signal),!0}catch{return!1}finally{clearTimeout(t)}}async forgetHandle(i){if(this.records.delete(i),this.stateStore)await this.stateStore.deleteByHandle(WN,i).catch(()=>{})}async delete(i){if(this.records.delete(i),this.stateStore)await this.stateStore.deleteByHandle(WN,i).catch(()=>{});try{await this.dispatchJson("DELETE",`/api/sandboxes/${encodeURIComponent(i)}`)}catch(u){if(!(u instanceof Error?u.message:String(u)).includes("404"))throw u}}async getPreviewUrl(i){return(await this.resolveRecord(i))?.previewUrl??null}async localWorkdir(i){return null}async*watchClaimLifecycle(i,u){yield{kind:"ready"}}toSandbox(i){return{handle:i.handle,workdir:i.sandboxApiUrl,previewUrl:i.previewUrl}}async resolveRecord(i){let u=this.records.get(i);if(u)return u;if(!this.stateStore)return null;let f=(await this.stateStore.getByHandle(WN,i))?.state,l=f?.sandboxApiUrl;if(!l)return null;let E={handle:i,sandboxApiUrl:l,previewUrl:f?.previewUrl??l};return this.records.set(i,E),E}async dispatchJson(i,u,t,f){let l={accept:"application/json"};if(t!==void 0)l["content-type"]="application/json";let E=this.dispatch(this.userSub,{method:i,path:u,headers:l,body:t},{signal:f}),c=null,w="";for await(let h of E)if(h.headers)c=h.headers.status;else if(h.data!=null)w+=h.data;let $=Buffer.from(w,"base64").toString("utf8");if(c!=null&&(c<200||c>=300))throw Error(`daemon returned ${c}: ${$}`);return $}}function bG0(i){return new rgi(i)}function Enf(){let i="";return{push(u){if(u.length===0)return p4u;i+=u;let t=i.length-i.length%4;if(t===0)return p4u;let f=i.slice(0,t);return i=i.slice(t),new Uint8Array(Buffer.from(f,"base64"))},flush(){if(i.length===0)return p4u;let u=i;return i="",new Uint8Array(Buffer.from(u,"base64"))}}}async function cnf(i){if(typeof i==="string")return i;if(i instanceof ArrayBuffer)return Buffer.from(i).toString("utf8");if(ArrayBuffer.isView(i))return Buffer.from(i.buffer,i.byteOffset,i.byteLength).toString("utf8");if(i instanceof URLSearchParams)return i.toString();return await new Response(i).text()}var WN="user-desktop",p4u;var CG0=O(()=>{A5i();s1i();p4u=new Uint8Array(0)});var MG0={};ji(MG0,{createDesktopProvider:()=>bG0,DesktopSandboxProvider:()=>rgi});var qG0=O(()=>{CG0()});var oG0={};ji(oG0,{subscribeLifecycle:()=>u1u,getSandboxProviderByKind:()=>Oo,getOrInitSharedRunner:()=>Nnf,buildDesktopProvider:()=>mgi,__resetSharedLifecyclesForTesting:()=>gnf});function eG0(i,u){let t=VG0[i];if(t)return Promise.resolve(t);let f=i1u[i];if(f)return f;let l=u().then((E)=>{return VG0[i]=E,E}).finally(()=>{delete i1u[i]});return i1u[i]=l,l}function hnf(){let i=process.env.STUDIO_SANDBOX_PREVIEW_URL_PATTERN;return i&&i.trim()!==""?i:void 0}function vnf(){let i=process.env.STUDIO_SANDBOX_TEMPLATE_NAME;return i&&i.trim()!==""?i:void 0}function dnf(){let i=process.env.STUDIO_ENV;return i&&i.trim()!==""?i:void 0}function Dnf(){let i=process.env.STUDIO_SANDBOX_SENTINEL_TOKEN;return i&&i.trim()!==""?i:void 0}function _nf(){let i=process.env.STUDIO_SANDBOX_PREVIEW_GATEWAY_NAME?.trim(),u=process.env.STUDIO_SANDBOX_PREVIEW_GATEWAY_NAMESPACE?.trim();if(!i&&!u)return;if(!i||!u)throw Error("STUDIO_SANDBOX_PREVIEW_GATEWAY_NAME and STUDIO_SANDBOX_PREVIEW_GATEWAY_NAMESPACE must both be set, or both unset. Half-configured per-claim HTTPRoute routing would silently fail to attach.");return{name:i,namespace:u}}async function aG0(i,u){let t=hnf();switch(i){case"agent-sandbox":{let f=new Mtu(u),{AgentSandboxProvider:l}=await Promise.resolve().then(() => (s4u(),RG0)),E=new u2(hu().encryptionKey);return new l({stateStore:f,previewUrlPattern:t,sandboxTemplateName:vnf(),envName:dnf(),previewGateway:_nf(),sentinelToken:Dnf(),meter:At,mintCloneUrl:async(c,w)=>{if(!c.connectionId)return null;let $=mF0(c.cloneUrl);if(!$)return null;let{cloneUrl:h}=await UN(c.connectionId,$.owner,$.name,u,E,{bufferMs:w?.bufferMs});return h}})}case"user-desktop":throw Error("user-desktop provider cannot be instantiated without a per-run link claim \u2014 call resolveSandboxProvider, which binds the link before constructing the provider.");default:throw Error(`Unknown sandbox provider kind: ${String(i)}`)}}async function mgi(i,u){let{DesktopSandboxProvider:t}=await Promise.resolve().then(() => (qG0(),MG0)),{getProxyDispatch:f}=await Promise.resolve().then(() => (f1u(),t1u)),l=new Ctu(i.db);if(!u)throw Error("buildDesktopProvider: userSub must be a non-empty string");let E=f();return new t({userSub:u,dispatch:E,stateStore:l})}function Oo(i,u){return eG0(u,()=>aG0(u,i.db))}async function Nnf(){let i;try{i=cg()}catch(t){return console.warn("[lifecycle] cannot resolve sandbox runner:",t instanceof Error?t.message:String(t)),null}return await eG0(i,()=>aG0(i,m0().db))}function u1u(i,u,t){let f=SN.get(u);if(f){if(f.terminated){if(f.lastPhase)try{t(f.lastPhase)}catch{}return{unsubscribe:Bnf}}if(f.listeners.add(t),f.lastPhase)try{t(f.lastPhase)}catch{}return rG0(u,f,t)}let l=new AbortController,E={lastPhase:null,terminated:!1,listeners:new Set([t]),abort:l};return SN.set(u,E),Fnf(i,u,E),rG0(u,E,t)}function Bnf(){}function rG0(i,u,t){return{unsubscribe(){if(SN.get(i)!==u)return;if(u.listeners.delete(t),u.listeners.size===0)SN.delete(i),u.abort.abort()}}}async function Fnf(i,u,t){let f=null;try{for await(let l of i.watchClaimLifecycle(u,t.abort.signal)){if(t.abort.signal.aborted)break;t.lastPhase=l;let E=l.kind==="ready"||l.kind==="failed";if(E)t.terminated=!0;let c=Array.from(t.listeners);for(let w of c)try{w(l)}catch{}if(E)break}}catch(l){f=l}finally{if(!t.terminated&&!t.abort.signal.aborted&&t.listeners.size>0){let l={kind:"failed",reason:"unknown",message:f instanceof Error?f.message:"Lifecycle watcher ended unexpectedly"};t.lastPhase=l,t.terminated=!0;for(let E of Array.from(t.listeners))try{E(l)}catch{}}if(SN.get(u)===t)SN.delete(u)}}function gnf(){for(let i of SN.values())i.abort.abort();SN.clear()}var wnf,$nf,mG0,VG0,i1u,Onf,Znf,SN;var Zo=O(()=>{Qh();b6();X1();QF0();MF0();Ma();XV();z0();wnf=Symbol.for("decocms.sandbox.lifecycle.runners"),$nf=Symbol.for("decocms.sandbox.lifecycle.inflight"),mG0=globalThis,VG0=mG0[wnf]??={},i1u=mG0[$nf]??={};Onf=Symbol.for("decocms.sandbox.lifecycle.shared-lifecycles"),Znf=globalThis,SN=Znf[Onf]??=new Map});function LN(i,u){return TN(i,u)}var Bo=O(()=>{Qh()});async function l1u(i,u){if(u.length===0)return;let t=await Oo(i,"agent-sandbox");for(let f=0;f<u.length;f+=sG0){let l=u.slice(f,f+sG0);await Promise.all(l.map(async(E)=>{let c=Lh({orgId:E.organizationId,virtualMcpId:E.virtualMcpId,branch:E.branch}),w=v8(c),$={organizationId:E.organizationId,virtualMcpId:E.virtualMcpId,branch:E.branch},h=await i.storage.agentSandboxSessions.withLock($,(v)=>v.beginDelete($,E.lastStartedBy));if(!h)return;await t.delete(h.sandboxHandle??LN(w,E.branch),w),await i.storage.agentSandboxSessions.withLock($,(v)=>v.completeDelete($,h.generation))}))}}async function pG0(i,u,t){while(!0){let f=await i.storage.agentSandboxSessions.listByVirtualMcp(u,t,{limit:200});if(f.length===0)return;await l1u(i,f)}}var sG0=20;var E1u=O(()=>{Qh();Zo();Bo()});import{z as c1u}from"zod";var Tnf,Unf,w1u;var iI0=O(()=>{ZN();Tv();fu();xa();N9();E1u();Tnf=c1u.object({id:c1u.string().describe("ID of the virtual MCP to delete")}),Unf=c1u.object({item:$c.describe("The deleted virtual MCP entity")}),w1u=ui({name:"COLLECTION_VIRTUAL_MCP_DELETE",description:"Permanently delete a Virtual MCP and its virtual tools.",annotations:{title:"Delete Virtual MCP",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:Tnf,outputSchema:Unf,handler:async(i,u)=>{gi(u);let t=Oi(u);await u.access.check();let f=await u.storage.virtualMcps.findById(i.id);if(!f)throw Error(`Virtual MCP not found: ${i.id}`);if(f.organization_id!==t.id)throw Error(`Virtual MCP not found: ${i.id}`);if(await pG0(u,t.id,i.id),await u.storage.virtualMcps.delete(i.id),u.orgFs)await Dtu(u.orgFs,i.id,Wu(u)??"system");let l=f.metadata?.githubRepo?.connectionId;if(l)try{let E=await u.storage.connections.findById(l,t.id);if(E&&Yh(E)){let w=await new r1(u.db,u.vault).get(l);if(w?.accessToken)try{await fetch("https://api.github.com/installation/token",{method:"DELETE",headers:{Authorization:`Bearer ${w.accessToken}`,Accept:"application/vnd.github+json","X-GitHub-Api-Version":"2022-11-28"},signal:AbortSignal.timeout(5000)})}catch{}await u.storage.connections.delete(l)}}catch(E){console.error("[VIRTUAL_MCP_DELETE] failed to tear down repo-scoped connection",{childConnectionId:l,error:E.message})}return{item:f}}})});import{z as Bw}from"zod";var Anf,$1u;var uI0=O(()=>{fu();Anf=Bw.object({id:Bw.string(),virtualMcpId:Bw.string(),pluginId:Bw.string(),connectionId:Bw.string().nullable(),settings:Bw.record(Bw.string(),Bw.unknown()).nullable(),createdAt:Bw.string(),updatedAt:Bw.string()}),$1u=ui({name:"VIRTUAL_MCP_PLUGIN_CONFIG_GET",description:"Get a plugin's current configuration for a specific virtual MCP.",annotations:{title:"Get Virtual MCP Plugin Config",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:Bw.object({virtualMcpId:Bw.string().describe("Virtual MCP ID"),pluginId:Bw.string().describe("Plugin ID")}),outputSchema:Bw.object({config:Anf.nullable()}),handler:async(i,u)=>{gi(u);let t=Oi(u);await u.access.check();let{virtualMcpId:f,pluginId:l}=i,E=await u.storage.connections.findById(f);if(!E||E.organization_id!==t.id)return{config:null};let c=await u.storage.virtualMcpPluginConfigs.get(f,l);if(!c)return{config:null};return{config:{id:c.id,virtualMcpId:c.virtualMcpId,pluginId:c.pluginId,connectionId:c.connectionId,settings:c.settings,createdAt:c.createdAt instanceof Date?c.createdAt.toISOString():c.createdAt,updatedAt:c.updatedAt instanceof Date?c.updatedAt.toISOString():c.updatedAt}}}})});import{z as fE}from"zod";var ynf,h1u;var tI0=O(()=>{fu();rL();Ml();ynf=fE.object({id:fE.string(),virtualMcpId:fE.string(),pluginId:fE.string(),connectionId:fE.string().nullable(),settings:fE.record(fE.string(),fE.unknown()).nullable(),createdAt:fE.string(),updatedAt:fE.string()}),h1u=ui({name:"VIRTUAL_MCP_PLUGIN_CONFIG_UPDATE",description:"Set or update a plugin's configuration for a specific virtual MCP.",annotations:{title:"Update Virtual MCP Plugin Config",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:fE.object({virtualMcpId:fE.string().describe("Virtual MCP ID"),pluginId:fE.string().describe("Plugin ID"),connectionId:fE.string().nullable().optional().describe("MCP connection to bind"),settings:fE.record(fE.string(),fE.unknown()).nullable().optional().describe("Plugin-specific settings")}),outputSchema:fE.object({config:ynf}),handler:async(i,u)=>{gi(u);let t=Oi(u);await u.access.check();let{virtualMcpId:f,pluginId:l,connectionId:E,settings:c}=i,w=Wu(u),$=await u.storage.connections.findById(f);if(!$)throw Error(`Connection not found: ${f}`);if($.organization_id!==t.id)throw Error(`Connection not found: ${f}`);if($.connection_type!=="VIRTUAL")throw Error(`Connection not found: ${f}`);let h=E?await u.storage.connections.findById(E):null;if(E&&h&&h.organization_id!==t.id)throw Error(`Connection not found: ${E}`);if(E&&$.organization_id&&!h&&b5()&&_Ei(E,$.organization_id)){if(!w)throw Error("User ID required to create dev-assets connection");let d=VL($.organization_id,cl());await u.storage.connections.create({...d,organization_id:$.organization_id,created_by:w})}else if(E&&!h)throw Error(`Connection not found: ${E}`);let v=await u.storage.virtualMcpPluginConfigs.upsert(f,l,{connectionId:E,settings:c});return{config:{id:v.id,virtualMcpId:v.virtualMcpId,pluginId:v.pluginId,connectionId:v.connectionId,settings:v.settings,createdAt:v.createdAt instanceof Date?v.createdAt.toISOString():v.createdAt,updatedAt:v.updatedAt instanceof Date?v.updatedAt.toISOString():v.updatedAt}}}})});import{z as F3}from"zod";var Pnf,v1u;var fI0=O(()=>{fu();N9();Pnf=F3.object({connectionId:F3.string(),toolName:F3.string(),label:F3.string(),icon:F3.string().nullable().optional()}),v1u=ui({name:"VIRTUAL_MCP_PINNED_VIEWS_UPDATE",description:"Update the pinned sidebar views for a virtual MCP. Replaces all current pins.",annotations:{title:"Update Pinned Views",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:F3.object({virtualMcpId:F3.string().describe("Virtual MCP ID"),pinnedViews:F3.array(Pnf).describe("Pinned views to set for the virtual MCP sidebar"),layout:F3.object({defaultMainView:F3.object({type:F3.string(),id:F3.string().optional(),toolName:F3.string().optional()}).nullable().optional(),chatDefaultOpen:F3.boolean().nullable().optional()}).optional()}),outputSchema:F3.object({item:$c.nullable()}),handler:async(i,u)=>{gi(u);let t=Oi(u);await u.access.check();let{virtualMcpId:f,pinnedViews:l,layout:E}=i,c=Wu(u),w=await u.storage.virtualMcps.findById(f);if(!w)throw Error(`Virtual MCP not found: ${f}`);if(w.organization_id!==t.id)throw Error(`Virtual MCP not found: ${f}`);let $=w.metadata?.ui??{},h={...$,pinnedViews:l.length>0?l:null,layout:E??$.layout??null};return{item:await u.storage.virtualMcps.update(f,c??"system",{metadata:{...w.metadata,ui:h}})}}})});import{z as R2}from"zod";var Gnf,Inf,d1u;var lI0=O(()=>{fu();Gnf=R2.object({ids:R2.array(R2.string()).describe("Virtual MCP ids to look up")}),Inf=R2.object({items:R2.array(R2.object({id:R2.string(),last_used_at:R2.string().optional(),last_used_by:R2.string().optional()}))}),d1u=ui({name:"VIRTUAL_MCP_LAST_USED_LIST",description:"Get last-used info (timestamp + user) for one or more virtual MCPs, derived from the most recent thread per agent.",annotations:{title:"List Virtual MCP Last Used",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:Gnf,outputSchema:Inf,handler:async(i,u)=>{gi(u),Oi(u),await u.access.check();let t=await u.storage.threads.findLastUsedByVirtualMcpIds(i.ids);return{items:i.ids.map((f)=>({id:f,last_used_at:t.get(f)?.last_used_at,last_used_by:t.get(f)?.last_used_by}))}}})});var EI0=O(()=>{PF0();GF0();IF0();xF0();iI0();uI0();tI0();fI0();lI0()});import{z as I1}from"zod";var D1u;var cI0=O(()=>{X1();fu();D1u=ui({name:"MONITORING_LOG_GET",description:"Get a single monitoring log by ID with full input and output data.",annotations:{title:"Get Monitoring Log",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:I1.object({id:I1.string().describe("Log ID to fetch")}),outputSchema:I1.object({log:I1.object({id:I1.string().optional(),organizationId:I1.string(),connectionId:I1.string(),toolName:I1.string(),input:I1.record(I1.string(),I1.unknown()),output:I1.record(I1.string(),I1.unknown()),isError:I1.boolean(),errorMessage:I1.string().nullish(),durationMs:I1.number(),timestamp:I1.string(),userId:I1.string().nullish(),requestId:I1.string(),userAgent:I1.string().nullish(),virtualMcpId:I1.string().nullish(),properties:I1.record(I1.string(),I1.string()).nullish()}).nullable().describe("The monitoring log, or null if not found")}),handler:async(i,u)=>{await u.access.check(),await fh();let t=Oi(u),f=await u.storage.monitoring.getById(t.id,i.id);if(!f)return{log:null};return{log:{...f,timestamp:f.timestamp instanceof Date?f.timestamp.toISOString():f.timestamp}}}})});import{z as Ut}from"zod";var knf,_1u;var wI0=O(()=>{X1();fu();knf=Ut.object({id:Ut.string().optional().describe("Unique log identifier"),organizationId:Ut.string().describe("Organization ID"),connectionId:Ut.string().describe("Connection ID"),toolName:Ut.string().describe("Name of the tool that was called"),isError:Ut.boolean().describe("Whether the call resulted in an error"),errorMessage:Ut.string().nullish().describe("Error message if applicable"),durationMs:Ut.number().describe("Call duration in milliseconds"),timestamp:Ut.string().describe("ISO 8601 timestamp of the call"),userId:Ut.string().nullish().describe("User who triggered the call"),requestId:Ut.string().describe("Unique request identifier"),userAgent:Ut.string().nullish().describe("Client identifier (x-studio-client header)"),virtualMcpId:Ut.string().nullish().describe("Virtual MCP (Agent) ID if routed through an agent"),properties:Ut.record(Ut.string(),Ut.string()).nullish().describe("Custom key-value metadata attached to the log")}),_1u=ui({name:"MONITORING_LOGS_LIST",description:"List monitoring logs for tool calls with filtering and pagination.",annotations:{title:"List Monitoring Logs",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:Ut.object({connectionId:Ut.string().optional().describe("Filter by connection ID"),excludeConnectionIds:Ut.array(Ut.string()).optional().describe("Exclude logs from these connection IDs (e.g. system connections)"),virtualMcpId:Ut.string().optional().describe("Filter by Virtual MCP (Agent) ID"),toolName:Ut.string().optional().describe("Filter by tool name"),isError:Ut.boolean().optional().describe("Filter by error status"),startDate:Ut.string().datetime().optional().describe("Filter by start date (ISO 8601 datetime string)"),endDate:Ut.string().datetime().optional().describe("Filter by end date (ISO 8601 datetime string)"),limit:Ut.number().default(20).describe("Maximum number of results"),offset:Ut.number().default(0).describe("Offset for pagination"),properties:Ut.record(Ut.string(),Ut.string()).optional().describe("Filter by exact property key=value matches"),propertyKeys:Ut.array(Ut.string()).optional().describe("Filter by logs that have these property keys"),propertyPatterns:Ut.record(Ut.string(),Ut.string()).optional().describe("Filter by property value patterns (SQL LIKE, use % as wildcard)"),propertyInValues:Ut.record(Ut.string(),Ut.string()).optional().describe("Filter by exact match within comma-separated values (e.g., user_tags in 'Engineering')")}),outputSchema:Ut.object({logs:Ut.array(knf).describe("Array of monitoring logs"),total:Ut.number().describe("Total number of logs matching filters"),offset:Ut.number().describe("Current offset for pagination"),limit:Ut.number().describe("Current limit for pagination")}),handler:async(i,u)=>{await fh();let t=Oi(u),l=i.properties||i.propertyKeys||i.propertyPatterns||i.propertyInValues?{properties:i.properties,propertyKeys:i.propertyKeys,propertyPatterns:i.propertyPatterns,propertyInValues:i.propertyInValues}:void 0,E={organizationId:t.id,connectionId:i.connectionId,excludeConnectionIds:i.excludeConnectionIds,virtualMcpId:i.virtualMcpId,toolName:i.toolName,isError:i.isError,startDate:i.startDate?new Date(i.startDate):void 0,endDate:i.endDate?new Date(i.endDate):void 0,limit:i.limit,offset:i.offset,propertyFilters:l},c=await u.storage.monitoring.query(E);return{logs:c.logs.map(({input:w,output:$,...h})=>({...h,timestamp:h.timestamp instanceof Date?h.timestamp.toISOString():h.timestamp})),total:c.total,offset:i.offset,limit:i.limit}}})});import{z as D0}from"zod";var N1u;var $I0=O(()=>{X1();fu();N1u=ui({name:"MONITORING_STATS",description:"Get aggregated statistics (counts, latency, error rates) for tool call monitoring.",annotations:{title:"Get Monitoring Stats",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:D0.object({startDate:D0.string().datetime().optional().describe("Filter by start date (ISO 8601 datetime string)"),endDate:D0.string().datetime().optional().describe("Filter by end date (ISO 8601 datetime string)"),interval:D0.string().regex(/^\d+[mhd]$/).optional().describe("Bucket interval for timeseries data (e.g. 1m, 5m, 2h, 1d). When provided, returns timeseries array."),connectionIds:D0.array(D0.string()).max(100).optional().describe("Filter by specific connection IDs (max 100)"),excludeConnectionIds:D0.array(D0.string()).max(100).optional().describe("Exclude specific connection IDs (max 100)"),toolNames:D0.array(D0.string()).max(100).optional().describe("Filter by specific tool names (max 100)"),status:D0.enum(["success","error"]).optional().describe("Filter metrics by execution status"),topN:D0.number().int().min(1).max(20).optional().describe("When provided with interval, also return top tools and their timeseries"),userIds:D0.array(D0.string()).max(100).optional().describe("Filter LLM usage by user IDs (only applied when llmUsage is true)"),llmUsage:D0.boolean().optional().describe("Aggregate LLM-call usage (tokens + USD cost) from raw log rows for the given connection. Returns token/cost totals and timeseries. Requires interval.")}),outputSchema:D0.object({totalCalls:D0.number().describe("Total number of tool calls"),errorRate:D0.number().optional().describe("Error rate as a decimal (0 to 1)"),avgDurationMs:D0.number().describe("Average call duration in milliseconds"),errorRatePercent:D0.string().optional().describe("Error rate as a percentage string"),totalErrors:D0.number().optional().describe("Total number of errors"),p50DurationMs:D0.number().optional().describe("50th percentile duration in milliseconds"),p95DurationMs:D0.number().optional().describe("95th percentile duration in milliseconds"),connectionBreakdown:D0.array(D0.object({connectionId:D0.string(),calls:D0.number(),errors:D0.number(),errorRate:D0.number(),avgDurationMs:D0.number()})).optional().describe("Per-connection metric breakdown"),totalInputTokens:D0.number().optional().describe("Total input tokens (LLM usage mode)"),totalOutputTokens:D0.number().optional().describe("Total output tokens (LLM usage mode)"),totalTokens:D0.number().optional().describe("Total tokens (LLM usage mode)"),totalCostUsd:D0.number().optional().describe("Total USD cost (LLM usage mode; only non-zero for providers that report cost)"),topTools:D0.array(D0.object({toolName:D0.string(),connectionId:D0.string().nullable(),calls:D0.number(),inputTokens:D0.number().optional(),outputTokens:D0.number().optional(),costUsd:D0.number().optional()})).optional().describe("Top tools ranked by calls"),topToolsTimeseries:D0.array(D0.object({timestamp:D0.string(),toolName:D0.string(),calls:D0.number(),errors:D0.number(),avg:D0.number(),p95:D0.number()})).optional().describe("Per-tool metric timeseries for the top tools"),timeseries:D0.array(D0.object({timestamp:D0.string(),calls:D0.number(),errors:D0.number(),errorRate:D0.number(),avg:D0.number(),p50:D0.number(),p95:D0.number(),inputTokens:D0.number().optional(),outputTokens:D0.number().optional(),totalTokens:D0.number().optional(),costUsd:D0.number().optional()})).optional().describe("Timeseries data points bucketed by interval")}),handler:async(i,u)=>{let t=Oi(u);if(await u.access.check(),await fh(),i.interval&&i.llmUsage)return u.storage.monitoring.queryLlmUsageStats({organizationId:t.id,interval:i.interval,connectionId:i.connectionIds?.[0]??"decopilot",startDate:i.startDate?new Date(i.startDate):void 0,endDate:i.endDate?new Date(i.endDate):void 0,userIds:i.userIds,topN:i.topN});if(i.interval){let l=await u.storage.monitoring.queryMetricTimeseries({organizationId:t.id,interval:i.interval,startDate:i.startDate?new Date(i.startDate):void 0,endDate:i.endDate?new Date(i.endDate):void 0,filters:{connectionIds:i.connectionIds,excludeConnectionIds:i.excludeConnectionIds,toolNames:i.toolNames,status:i.status}});if(!i.topN)return l;let E=await u.storage.monitoring.queryMetricTopToolsTimeseries({organizationId:t.id,interval:i.interval,startDate:i.startDate?new Date(i.startDate):void 0,endDate:i.endDate?new Date(i.endDate):void 0,topN:i.topN,filters:{connectionIds:i.connectionIds,excludeConnectionIds:i.excludeConnectionIds,toolNames:i.toolNames,status:i.status}});return{...l,topTools:E.topTools,topToolsTimeseries:E.timeseries}}let f=await u.storage.monitoring.getStats({organizationId:t.id,startDate:i.startDate?new Date(i.startDate):void 0,endDate:i.endDate?new Date(i.endDate):void 0});return{...f,errorRatePercent:(f.errorRate*100).toFixed(2)}}})});import{z as g3}from"zod";var O1u;var hI0=O(()=>{X1();fu();O1u=ui({name:"MONITORING_THREAD_USAGE",description:"Aggregate LLM token usage and USD cost per thread for the given thread IDs.",annotations:{title:"Get Thread Usage",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:g3.object({threadIds:g3.array(g3.string()).min(1).max(500).describe("Thread IDs to aggregate usage for (max 500)"),connectionId:g3.string().optional().describe("LLM connection ID (defaults to 'decopilot')"),startDate:g3.string().datetime().optional().describe("Filter by start date (ISO 8601 datetime string)"),endDate:g3.string().datetime().optional().describe("Filter by end date (ISO 8601 datetime string)")}),outputSchema:g3.object({items:g3.array(g3.object({threadId:g3.string(),calls:g3.number(),inputTokens:g3.number(),outputTokens:g3.number(),totalTokens:g3.number(),costUsd:g3.number()}))}),handler:async(i,u)=>{let t=Oi(u);return await u.access.check(),await fh(),{items:await u.storage.monitoring.queryThreadUsage({organizationId:t.id,connectionId:i.connectionId??"decopilot",threadIds:i.threadIds,startDate:i.startDate?new Date(i.startDate):void 0,endDate:i.endDate?new Date(i.endDate):void 0})}}})});var vI0=O(()=>{cI0();wI0();$I0();hI0()});function egi(i){return typeof i==="string"&&Xnf.has(i.trim().toLowerCase())}var Xnf;var Z1u=O(()=>{Xnf=new Set([".well-known","_admin","api","auth","cli","commerce-onboarding","dbos-queue-depth","health","hosted-run-pending","login","mcp","metrics","oauth","oauth-proxy","onboarding","org","report","reset-password"])});import{z as A$}from"zod";var B1u;var dI0=O(()=>{fu();Z1u();B1u=ui({name:"ORGANIZATION_CREATE",description:"Create a new organization. The caller becomes the owner automatically.",annotations:{title:"Create Organization",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!1,openWorldHint:!1},inputSchema:A$.object({slug:A$.string().min(1).max(50).regex(/^[a-z0-9-]+$/,"Slug must be lowercase alphanumeric with hyphens").refine((i)=>!egi(i),"Slug is reserved by Studio"),name:A$.string().min(1).max(255),description:A$.string().optional()}),outputSchema:A$.object({id:A$.string(),name:A$.string(),slug:A$.string(),logo:A$.string().nullable().optional(),metadata:A$.any().optional(),createdAt:A$.string().datetime().describe("ISO 8601 timestamp"),members:A$.array(A$.any()).optional()}),handler:async(i,u)=>{gi(u),await u.access.check();let t=Wu(u);if(!t)throw Error("User ID required to create organization");let f=await u.boundAuth.organization.create({name:i.name,slug:i.slug,metadata:i.description?{description:i.description}:void 0,userId:t});if(!f)throw Error("Failed to create organization");return{...f,createdAt:f.createdAt instanceof Date?f.createdAt.toISOString():f.createdAt}}})});import{z as Iv}from"zod";var F1u;var DI0=O(()=>{fu();F1u=ui({name:"ORGANIZATION_LIST",description:"List organizations the current user belongs to.",annotations:{title:"List Organizations",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},_meta:{ui:{visibility:"app"}},inputSchema:Iv.object({userId:Iv.string().optional()}),outputSchema:Iv.object({organizations:Iv.array(Iv.object({id:Iv.string(),name:Iv.string(),slug:Iv.string(),logo:Iv.string().nullable().optional(),metadata:Iv.any().optional(),createdAt:Iv.string().datetime().describe("ISO 8601 timestamp")}))}),handler:async(i,u)=>{gi(u),await u.access.check();let t=Wu(u),f=i.userId||t;if(!f)throw Error("User ID required to list organizations");return{organizations:(await u.boundAuth.organization.list(f)).map((E)=>({...E,createdAt:E.createdAt instanceof Date?E.createdAt.toISOString():E.createdAt}))}}})});import{z as nh}from"zod";var g1u;var _I0=O(()=>{fu();g1u=ui({name:"ORGANIZATION_GET",description:"Get an organization's details, members, and settings by slug or ID.",annotations:{title:"Get Organization",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:nh.object({}),outputSchema:nh.object({id:nh.string(),name:nh.string(),slug:nh.string(),logo:nh.string().nullable().optional(),metadata:nh.any().optional(),createdAt:nh.string().datetime().describe("ISO 8601 timestamp"),members:nh.array(nh.any()).optional(),invitations:nh.array(nh.any()).optional()}),handler:async(i,u)=>{gi(u),await u.access.check();let t=u.organization?.id;if(!t)throw Error("Organization ID required (no active organization in context)");let f=await u.boundAuth.organization.get(t);if(!f)throw Error("No active organization found");let l=new Date,E=f.invitations?.filter((c)=>new Date(c.expiresAt)>l);return{...f,invitations:E,createdAt:f.createdAt instanceof Date?f.createdAt.toISOString():f.createdAt}}})});import{z as xv}from"zod";var T1u;var NI0=O(()=>{fu();T1u=ui({name:"ORGANIZATION_UPDATE",description:"Update an organization's name or description.",annotations:{title:"Update Organization",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:xv.object({id:xv.string(),name:xv.string().min(1).max(255).optional(),description:xv.string().optional()}),outputSchema:xv.object({id:xv.string(),name:xv.string(),slug:xv.string(),logo:xv.string().nullable().optional(),metadata:xv.any().optional(),createdAt:xv.string().datetime().describe("ISO 8601 timestamp")}),handler:async(i,u)=>{gi(u),await u.access.check();let t={};if(i.name)t.name=i.name;if(i.description)t.metadata={description:i.description};let f=await u.boundAuth.organization.update({organizationId:i.id,data:t});if(!f)throw Error("Failed to update organization");return{...f,createdAt:f.createdAt instanceof Date?f.createdAt.toISOString():f.createdAt}}})});import{z as Fo}from"zod";var U1u;var OI0=O(()=>{fu();U1u=ui({name:"ORGANIZATION_DELETE",description:"Archive an organization (soft delete).",annotations:{title:"Delete Organization",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:Fo.object({id:Fo.string()}),outputSchema:Fo.object({success:Fo.boolean(),id:Fo.string()}),handler:async(i,u)=>{return gi(u),await u.access.check(),await u.boundAuth.organization.update({organizationId:i.id,data:{metadata:{archived:!0,archivedAt:new Date().toISOString()}}}),{success:!0,id:i.id}}})});import{z as M0}from"zod";var go,To,tn,ZI0,agi,Uo,Ao,QN;var b2=O(()=>{go=M0.object({title:M0.string(),url:M0.string(),icon:M0.string()}),To=M0.object({registries:M0.record(M0.string(),M0.object({enabled:M0.boolean()})).describe("Per-registry enabled/disabled state. Key is connection ID. Absent registries are treated as enabled."),blockedMcps:M0.array(M0.string()).describe("List of MCP app_name or app_id values to hide from the store.")}),tn=M0.object({keyId:M0.string(),modelId:M0.string(),title:M0.string().optional()}).nullable(),ZI0=M0.enum(["fast","smart","thinking","image","web_search","deep_research"]),agi=M0.enum(["fast","smart","thinking"]),Uo=M0.object({tiers:M0.object({fast:tn,smart:tn,thinking:tn,image:tn,web_search:tn,deep_research:tn})}),Ao=M0.object({ids:M0.array(M0.string()).describe("Ordered list of custom virtual MCP agent ids to show on the home view.")}),QN=M0.object({id:M0.string().describe("Brand context ID"),name:M0.string().describe("Company name"),domain:M0.string().describe("Company domain (e.g. example.com)"),overview:M0.string().describe("Company overview / description"),logo:M0.string().nullable().optional().describe("Logo URL"),favicon:M0.string().nullable().optional().describe("Favicon URL"),ogImage:M0.string().nullable().optional().describe("OG image URL"),fonts:M0.object({heading:M0.string().optional().describe("Font family for headings"),body:M0.string().optional().describe("Font family for body text"),code:M0.string().optional().describe("Font family for code / monospace")}).nullable().optional().describe("Font families by semantic role"),colors:M0.object({primary:M0.string().optional().describe("Primary brand color (hex)"),secondary:M0.string().optional().describe("Secondary brand color (hex)"),accent:M0.string().optional().describe("Accent / highlight color (hex)"),background:M0.string().optional().describe("Background color (hex)"),foreground:M0.string().optional().describe("Foreground / text color (hex)")}).nullable().optional().describe("Semantic color palette"),images:M0.array(M0.record(M0.string(),M0.unknown())).nullable().optional().describe("Brand images"),metadata:M0.record(M0.string(),M0.unknown()).nullable().optional().describe("Extra design tokens (typography, components, spacing, layout, tone, etc.)"),archivedAt:M0.string().nullable().optional().describe("Archive timestamp (null to unarchive)"),isDefault:M0.boolean().optional().describe("Whether this is the default brand for the organization")})});import{z as C2}from"zod";var A1u;var BI0=O(()=>{fu();b2();A1u=ui({name:"ORGANIZATION_SETTINGS_GET",description:"Get organization-level settings including sidebar configuration, store registry settings, simple model mode, and default home agents.",annotations:{title:"Get Organization Settings",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:C2.object({}),outputSchema:C2.object({organizationId:C2.string(),sidebar_items:C2.array(go).nullable().optional(),enabled_plugins:C2.array(C2.string()).nullable().optional(),registry_config:To.nullable().optional(),simple_mode:Uo.nullable().optional(),default_home_agents:Ao.nullable().optional(),reports_only:C2.boolean().nullable().optional(),createdAt:C2.string().datetime().optional().describe("ISO 8601 timestamp"),updatedAt:C2.string().datetime().optional().describe("ISO 8601 timestamp")}),handler:async(i,u)=>{gi(u),await u.access.check();let t=u.organization?.id;if(!t)throw Error("Organization ID required (no active organization in context)");let f=await u.storage.organizationSettings.get(t);if(!f)return{organizationId:t};return{...f,createdAt:f.createdAt instanceof Date?f.createdAt.toISOString():f.createdAt,updatedAt:f.updatedAt instanceof Date?f.updatedAt.toISOString():f.updatedAt}}})});import{z as Fw}from"zod";var y1u;var FI0=O(()=>{fu();b2();y1u=ui({name:"ORGANIZATION_SETTINGS_UPDATE",description:"Update organization-level settings such as sidebar configuration, store registry settings, simple model mode, and default home agents.",annotations:{title:"Update Organization Settings",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:Fw.object({organizationId:Fw.string(),sidebar_items:Fw.array(go).optional(),enabled_plugins:Fw.array(Fw.string()).optional(),registry_config:To.optional(),simple_mode:Uo.optional(),default_home_agents:Ao.optional(),reports_only:Fw.boolean().optional()}),outputSchema:Fw.object({organizationId:Fw.string(),sidebar_items:Fw.array(go).nullable().optional(),enabled_plugins:Fw.array(Fw.string()).nullable().optional(),registry_config:To.nullable().optional(),simple_mode:Uo.nullable().optional(),default_home_agents:Ao.nullable().optional(),reports_only:Fw.boolean().nullable().optional(),createdAt:Fw.string().datetime().describe("ISO 8601 timestamp"),updatedAt:Fw.string().datetime().describe("ISO 8601 timestamp")}),handler:async(i,u)=>{if(gi(u),await u.access.check(),Oi(u).id!==i.organizationId)throw Error("Cannot update settings for a different organization");let f=await u.storage.organizationSettings.upsert(i.organizationId,{sidebar_items:i.sidebar_items,enabled_plugins:i.enabled_plugins,registry_config:i.registry_config,simple_mode:i.simple_mode,default_home_agents:i.default_home_agents,reports_only:i.reports_only});return{...f,createdAt:f.createdAt instanceof Date?f.createdAt.toISOString():f.createdAt,updatedAt:f.updatedAt instanceof Date?f.updatedAt.toISOString():f.updatedAt}}})});import{z as kv}from"zod";var gI0,P1u,G1u;var TI0=O(()=>{fu();b2();gI0=QN.extend({organizationId:kv.string(),archivedAt:kv.string().nullable().optional().describe("ISO 8601 timestamp"),createdAt:kv.string().describe("ISO 8601 timestamp"),updatedAt:kv.string().describe("ISO 8601 timestamp")}),P1u=ui({name:"BRAND_CONTEXT_LIST",description:"List all brand contexts (company profiles) for the current organization.",annotations:{title:"List Brand Contexts",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:kv.object({includeArchived:kv.boolean().optional().describe("Include archived brands in the list")}),outputSchema:kv.object({items:kv.array(gI0)}),handler:async(i,u)=>{gi(u),await u.access.check();let t=u.organization?.id;if(!t)throw Error("Organization ID required (no active organization in context)");return{items:(await u.storage.brandContext.list(t,{includeArchived:i.includeArchived})).map((l)=>({...l,archivedAt:l.archivedAt instanceof Date?l.archivedAt.toISOString():l.archivedAt,createdAt:l.createdAt instanceof Date?l.createdAt.toISOString():l.createdAt,updatedAt:l.updatedAt instanceof Date?l.updatedAt.toISOString():l.updatedAt}))}}}),G1u=ui({name:"BRAND_CONTEXT_GET",description:"Get a specific brand context by ID.",annotations:{title:"Get Brand Context",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:kv.object({id:kv.string().describe("Brand context ID")}),outputSchema:gI0.extend({organizationId:kv.string()}),handler:async(i,u)=>{gi(u),await u.access.check();let t=u.organization?.id;if(!t)throw Error("Organization ID required (no active organization in context)");let f=await u.storage.brandContext.get(i.id,t);if(!f)throw Error("Brand context not found");return{...f,archivedAt:f.archivedAt instanceof Date?f.archivedAt.toISOString():f.archivedAt,createdAt:f.createdAt instanceof Date?f.createdAt.toISOString():f.createdAt,updatedAt:f.updatedAt instanceof Date?f.updatedAt.toISOString():f.updatedAt}}})});import{z as QK}from"zod";var UI0,I1u,x1u,k1u;var AI0=O(()=>{fu();b2();UI0=QN.extend({organizationId:QK.string(),createdAt:QK.string().describe("ISO 8601 timestamp"),updatedAt:QK.string().describe("ISO 8601 timestamp")}),I1u=ui({name:"BRAND_CONTEXT_CREATE",description:"Create a new brand context (company profile) for the current organization.",annotations:{title:"Create Brand Context",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!1,openWorldHint:!1},inputSchema:QN.omit({id:!0}),outputSchema:UI0,handler:async(i,u)=>{gi(u),await u.access.check();let t=u.organization?.id;if(!t)throw Error("Organization ID required (no active organization in context)");let f=await u.storage.brandContext.create(t,{name:i.name,domain:i.domain,overview:i.overview,logo:i.logo??null,favicon:i.favicon??null,ogImage:i.ogImage??null,fonts:i.fonts??null,colors:i.colors??null,images:i.images??null,metadata:i.metadata??null});return{...f,archivedAt:f.archivedAt instanceof Date?f.archivedAt.toISOString():f.archivedAt,createdAt:f.createdAt instanceof Date?f.createdAt.toISOString():f.createdAt,updatedAt:f.updatedAt instanceof Date?f.updatedAt.toISOString():f.updatedAt}}}),x1u=ui({name:"BRAND_CONTEXT_UPDATE",description:"Update an existing brand context by ID.",annotations:{title:"Update Brand Context",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:QN.partial().required({id:!0}),outputSchema:UI0,handler:async(i,u)=>{gi(u),await u.access.check();let t=u.organization?.id;if(!t)throw Error("Organization ID required (no active organization in context)");if(!await u.storage.brandContext.get(i.id,t))throw Error("Brand context not found");let{id:l,...E}=i;if(E.isDefault===!0)await u.storage.brandContext.setDefault(l,t);let c=await u.storage.brandContext.update(l,t,{name:E.name,domain:E.domain,overview:E.overview,logo:E.logo!==void 0?E.logo??null:void 0,favicon:E.favicon!==void 0?E.favicon??null:void 0,ogImage:E.ogImage!==void 0?E.ogImage??null:void 0,fonts:E.fonts!==void 0?E.fonts??null:void 0,colors:E.colors!==void 0?E.colors??null:void 0,images:E.images!==void 0?E.images??null:void 0,metadata:E.metadata!==void 0?E.metadata??null:void 0,archivedAt:E.archivedAt!==void 0?E.archivedAt??null:void 0,isDefault:E.isDefault===!1?!1:void 0});return{...c,archivedAt:c.archivedAt instanceof Date?c.archivedAt.toISOString():c.archivedAt,createdAt:c.createdAt instanceof Date?c.createdAt.toISOString():c.createdAt,updatedAt:c.updatedAt instanceof Date?c.updatedAt.toISOString():c.updatedAt}}}),k1u=ui({name:"BRAND_CONTEXT_DELETE",description:"Archive a brand context by ID (soft delete).",annotations:{title:"Archive Brand Context",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:QK.object({id:QK.string().describe("Brand context ID")}),outputSchema:QK.object({success:QK.boolean()}),handler:async(i,u)=>{gi(u),await u.access.check();let t=u.organization?.id;if(!t)throw Error("Organization ID required (no active organization in context)");if(!await u.storage.brandContext.get(i.id,t))throw Error("Brand context not found");return await u.storage.brandContext.update(i.id,t,{archivedAt:new Date().toISOString(),isDefault:!1}),{success:!0}}})});async function ogi(i,u,t){let f=i.trim();if(!f.startsWith("http"))f=`https://${f}`;let l=await fetch("https://api.firecrawl.dev/v1/scrape",{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${u}`},body:JSON.stringify({url:f,formats:["branding"]})});if(!l.ok){let D=await l.text().catch(()=>"");throw Error(`Firecrawl API error: ${l.status} ${D.slice(0,200)}`)}let E=await l.json();if(!E.success||!E.data?.branding)return null;let c=E.data.branding,w=E.data.metadata??{},$=Ynf(c,w);return{name:w.title?.split(/[|\u2013\u2014]|\s+-\s+/).map((D)=>D.trim()).filter(Boolean)?.slice().sort((D,_)=>D.length-_.length)[0]??w.ogSiteName??t??i,domain:i,overview:w.description??"",logo:$.logo,favicon:$.favicon,ogImage:$.ogImage,fonts:$.fonts,colors:$.colors,images:null,metadata:Object.keys($.metadata).length>0?$.metadata:null}}function Ynf(i,u){let t=i.images??{},f=i.colors??{},l={};for(let[v,d]of Object.entries(f))if(typeof d==="string"&&d&&Jnf.has(v))l[v]=d;let E={},w=(i.typography??{}).fontFamilies??{};for(let[v,d]of Object.entries(w))if(typeof d==="string"&&d){let D=Knf[v.toLowerCase()];if(D&&!E[D])E[D]=d}let $=i.fonts;if(Array.isArray($))for(let v of $){let d=v.family;if(typeof d==="string"&&d&&!E.body)E.body=d}let h={};for(let v of["typography","components","spacing","layout","animations","icons","tone","personality","colorScheme"])if(i[v]!==void 0)h[v]=i[v];return{logo:t.logo??null,favicon:t.favicon??null,ogImage:t.ogImage??u.ogImage??null,fonts:Object.keys(E).length>0?E:null,colors:Object.keys(l).length>0?l:null,metadata:h}}var Jnf,Knf;var j1u=O(()=>{Jnf=new Set(["primary","secondary","accent","background","foreground"]),Knf={heading:"heading",headings:"heading",head:"heading",title:"heading",body:"body",primary:"body",text:"body",code:"code",monospace:"code",mono:"code"}});import{z as sgi}from"zod";var Wnf,X1u;var yI0=O(()=>{fu();j1u();b2();Wnf=QN.pick({id:!0,name:!0,domain:!0,overview:!0,logo:!0,favicon:!0,ogImage:!0,fonts:!0,colors:!0}).extend({success:sgi.boolean()}),X1u=ui({name:"BRAND_CONTEXT_EXTRACT",description:"Extract brand context (colors, fonts, logos) from a website URL using Firecrawl.",annotations:{title:"Extract Brand Context",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!0},inputSchema:sgi.object({domain:sgi.string().describe("Website domain to extract brand from"),brandId:sgi.string().optional().describe("Existing brand context ID to update (creates new if omitted)")}),outputSchema:Wnf,modelSummary:(i)=>i.success?`Brand saved (id=${i.id}, name=${i.name}, domain=${i.domain}). The UI rendered the logo, colors, fonts, and overview.`:"Brand extraction failed.",handler:async(i,u)=>{gi(u),await u.access.check();let t=u.organization?.id;if(!t)throw Error("Organization ID required (no active organization in context)");let f=u.firecrawlApiKey;if(!f)throw Error("FIRECRAWL_API_KEY is not configured. Set the environment variable to enable brand extraction.");let l=await ogi(i.domain,f,i.domain);if(!l)throw Error("Firecrawl did not return branding data for this URL");let E={name:l.name,domain:l.domain,overview:l.overview,logo:l.logo,favicon:l.favicon,ogImage:l.ogImage,fonts:l.fonts,colors:l.colors,images:l.images,metadata:l.metadata},c=i.brandId?await(async()=>{if(!await u.storage.brandContext.get(i.brandId,t))throw Error("Brand context not found");return u.storage.brandContext.update(i.brandId,t,E)})():await u.storage.brandContext.create(t,E);return{id:c.id,name:c.name,domain:c.domain,overview:c.overview,logo:c.logo,favicon:c.favicon,ogImage:c.ogImage,fonts:c.fonts,colors:c.colors,success:!0}}})});function PI0(i){let u=i.metadata??{};return{id:i.id,name:i.name,domain:i.domain||void 0,colors:i.colors??void 0,fonts:i.fonts??void 0,assets:i.logo||i.favicon||i.ogImage?{logo:i.logo??void 0,favicon:i.favicon??void 0,ogImage:i.ogImage??void 0}:void 0,overview:i.overview||void 0,tagline:typeof u.tagline==="string"?u.tagline:void 0,tone:typeof u.tone==="string"?u.tone:void 0,metadata:(()=>{let t=Object.fromEntries(Object.entries(u).filter(([f])=>f!=="tagline"&&f!=="tone"));return Object.keys(t).length>0?t:void 0})()}}var J1u,K1u;var GI0=O(()=>{ytu();fu();J1u=ui({name:"BRAND_GET",description:"Get a brand context by ID. Omit the ID to get the default brand for the organization.",annotations:{title:"Get Brand",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:h5i,outputSchema:Ka,handler:async(i,u)=>{gi(u),await u.access.check();let t=u.organization?.id;if(!t)throw Error("Organization ID required (no active organization in context)");let f=i.id?await u.storage.brandContext.get(i.id,t):await u.storage.brandContext.getDefault(t);if(!f)throw Error(i.id?"Brand not found":"No default brand configured");return PI0(f)}}),K1u=ui({name:"BRAND_LIST",description:"List all active brands for the current organization.",annotations:{title:"List Brands",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:v5i,outputSchema:d5i,handler:async(i,u)=>{gi(u),await u.access.check();let t=u.organization?.id;if(!t)throw Error("Organization ID required (no active organization in context)");return{items:(await u.storage.brandContext.list(t)).map(PI0)}}})});import{resolveTxt as Snf}from"dns/promises";function Y1u(i){return`${Lnf}.${i.toLowerCase()}`}function II0(){return`deco-verify-${crypto.randomUUID().replace(/-/g,"")}`}async function xI0(i,u,t=Snf){if(!u)return!1;try{return(await t(Y1u(i))).some((l)=>l.join("").trim()===u)}catch{return!1}}var Lnf="_deco-verify";var kI0=()=>{};import{z as L1}from"zod";function HN(i){let u=i.verificationStatus==="pending"&&Boolean(i.verificationToken);return{id:i.id,domain:i.domain,joinMode:i.joinMode,verificationStatus:i.verificationStatus,verificationMethod:i.verificationMethod,verifiedAt:i.verifiedAt?new Date(i.verifiedAt).toISOString():null,recordName:u?Y1u(i.domain):null,recordValue:u?i.verificationToken:null}}function Hnf(i){let u=i.toLowerCase().trim();if(!Qnf.test(u))throw Error(`Invalid domain format: "${u}". Must be a valid domain like "acme.com"`);if(jv.has(u))throw Error(`Cannot claim generic email domain "${u}". Only corporate domains are allowed.`);return u}var Qnf,W1u,pgi,S1u,L1u,Q1u,H1u,z1u;var jI0=O(()=>{F$();kI0();fu();Qnf=/^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+$/,W1u=L1.enum(["off","auto","request"]),pgi=L1.object({id:L1.string(),domain:L1.string(),joinMode:W1u,verificationStatus:L1.enum(["pending","verified"]),verificationMethod:L1.enum(["email","dns"]).nullable(),verifiedAt:L1.string().nullable(),recordName:L1.string().nullable(),recordValue:L1.string().nullable()});S1u=ui({name:"ORGANIZATION_DOMAIN_LIST",description:"List the email domains claimed by an organization.",annotations:{title:"List Organization Domains",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:L1.object({}),outputSchema:L1.object({domains:L1.array(pgi)}),handler:async(i,u)=>{gi(u),await u.access.check();let t=Oi(u);return{domains:(await u.storage.organizationDomains.listByOrganizationId(t.id)).map(HN)}}}),L1u=ui({name:"ORGANIZATION_DOMAIN_ADD",description:"Claim an email domain for an organization. If the caller's verified email matches the domain it is trusted immediately; otherwise it requires DNS verification.",annotations:{title:"Add Organization Domain",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:L1.object({domain:L1.string().min(1).max(255).describe("Domain to claim, e.g. acme.com"),joinMode:W1u.optional().describe("Initial join mode (only applied when the domain is trusted immediately via email match).")}),outputSchema:pgi,handler:async(i,u)=>{gi(u),await u.access.check();let t=Oi(u),f=Hnf(i.domain),E=u.auth.user?.email?.split("@")[1]?.toLowerCase(),c=Boolean(u.auth.user?.emailVerified)&&E===f,w=await u.storage.organizationDomains.getByOrgAndDomain(t.id,f);if(w){if(w.verificationStatus!=="verified"&&c){let h=await u.storage.organizationDomains.markVerified(w.id,"email");return HN(h)}return HN(w)}let $=c?await u.storage.organizationDomains.add(t.id,f,{joinMode:i.joinMode??"off",verificationStatus:"verified",verificationMethod:"email"}):await u.storage.organizationDomains.add(t.id,f,{joinMode:"off",verificationStatus:"pending",verificationToken:II0()});return HN($)}}),Q1u=ui({name:"ORGANIZATION_DOMAIN_UPDATE",description:"Set the join mode for a claimed domain. Discoverable modes (auto/request) require the domain to be verified.",annotations:{title:"Update Organization Domain",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:L1.object({id:L1.string(),joinMode:W1u}),outputSchema:pgi,handler:async(i,u)=>{gi(u),await u.access.check();let t=Oi(u),f=await u.storage.organizationDomains.getById(i.id);if(!f||f.organizationId!==t.id)throw Error("Domain not found");if(i.joinMode!=="off"&&f.verificationStatus!=="verified")throw Error("Verify the domain before enabling auto-join or requests.");let l=await u.storage.organizationDomains.updateJoinMode(i.id,i.joinMode);return HN(l)}}),H1u=ui({name:"ORGANIZATION_DOMAIN_VERIFY",description:"Check the DNS TXT record for a pending domain and mark it verified if present.",annotations:{title:"Verify Organization Domain",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!0},inputSchema:L1.object({id:L1.string()}),outputSchema:L1.object({verified:L1.boolean(),domain:pgi}),handler:async(i,u)=>{gi(u),await u.access.check();let t=Oi(u),f=await u.storage.organizationDomains.getById(i.id);if(!f||f.organizationId!==t.id)throw Error("Domain not found");if(f.verificationStatus==="verified")return{verified:!0,domain:HN(f)};if(!f.verificationToken)throw Error("Domain has no pending DNS verification.");if(!await xI0(f.domain,f.verificationToken))return{verified:!1,domain:HN(f)};let E=await u.storage.organizationDomains.markVerified(i.id,"dns");return{verified:!0,domain:HN(E)}}}),z1u=ui({name:"ORGANIZATION_DOMAIN_REMOVE",description:"Remove a claimed domain from an organization.",annotations:{title:"Remove Organization Domain",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:L1.object({id:L1.string()}),outputSchema:L1.object({success:L1.boolean()}),handler:async(i,u)=>{gi(u),await u.access.check();let t=Oi(u),f=await u.storage.organizationDomains.getById(i.id);if(!f||f.organizationId!==t.id)throw Error("Domain not found");return await u.storage.organizationDomains.removeById(i.id),{success:!0}}})});function zN(i){return(i instanceof Error?i.message.toLowerCase():"").includes("already a member")}import{z as Sl}from"zod";var znf,n1u,R1u,b1u;var XI0=O(()=>{fu();H4();znf=Sl.object({id:Sl.string(),userId:Sl.string(),status:Sl.enum(["pending","approved","denied"]),createdAt:Sl.string(),user:Sl.object({id:Sl.string(),name:Sl.string(),email:Sl.string(),image:Sl.string().nullable()}).nullable()}),n1u=ui({name:"ORGANIZATION_JOIN_REQUEST_LIST",description:"List pending requests to join the organization.",annotations:{title:"List Join Requests",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:Sl.object({}),outputSchema:Sl.object({requests:Sl.array(znf)}),handler:async(i,u)=>{gi(u),await u.access.check();let t=Oi(u);return{requests:(await u.storage.organizationJoinRequests.listPendingWithUser(t.id)).map((l)=>({id:l.id,userId:l.userId,status:l.status,createdAt:new Date(l.createdAt).toISOString(),user:l.user}))}}}),R1u=ui({name:"ORGANIZATION_JOIN_REQUEST_APPROVE",description:"Approve a pending join request, adding the user as a member.",annotations:{title:"Approve Join Request",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:Sl.object({requestId:Sl.string()}),outputSchema:Sl.object({success:Sl.boolean()}),handler:async(i,u)=>{gi(u),await u.access.check();let t=Oi(u),f=await u.storage.organizationJoinRequests.getById(i.requestId);if(!f||f.organizationId!==t.id)throw Error("Join request not found");if(f.status!=="pending")throw Error("Join request has already been decided");let l=Wu(u);if(!await u.storage.organizationJoinRequests.decide(f.id,"approved",l??f.userId))return{success:!0};try{await u.boundAuth.organization.addMember({organizationId:t.id,userId:f.userId,role:["user"]})}catch(c){if(!zN(c))throw c}if(l)mu.capture({distinctId:l,event:"organization_join_request_approved",groups:{organization:t.id},properties:{organization_id:t.id,user_id:f.userId}});return{success:!0}}}),b1u=ui({name:"ORGANIZATION_JOIN_REQUEST_DENY",description:"Deny a pending join request.",annotations:{title:"Deny Join Request",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:Sl.object({requestId:Sl.string()}),outputSchema:Sl.object({success:Sl.boolean()}),handler:async(i,u)=>{gi(u),await u.access.check();let t=Oi(u),f=await u.storage.organizationJoinRequests.getById(i.requestId);if(!f||f.organizationId!==t.id)throw Error("Join request not found");if(f.status!=="pending")throw Error("Join request has already been decided");let l=Wu(u);if(await u.storage.organizationJoinRequests.decide(f.id,"denied",l??f.userId)&&l)mu.capture({distinctId:l,event:"organization_join_request_denied",groups:{organization:t.id},properties:{organization_id:t.id,user_id:f.userId}});return{success:!0}}})});import{z as gw}from"zod";var C1u;var JI0=O(()=>{H4();fu();Uh();C1u=ui({name:"ORGANIZATION_MEMBER_ADD",description:"Invite a member to the organization by email with an assigned role.",annotations:{title:"Add Organization Member",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:gw.object({organizationId:gw.string().optional(),userId:gw.string(),role:gw.array(gw.string())}),outputSchema:gw.object({id:gw.string(),organizationId:gw.string(),userId:gw.string(),role:gw.union([gw.string(),gw.array(gw.string())]),createdAt:gw.string().datetime().describe("ISO 8601 timestamp")}),handler:async(i,u)=>{gi(u),await u.access.check();let t=i.organizationId||u.organization?.id;if(!t)throw Error("Organization ID required (no active organization in context)");if(t!==u.organization?.id)throw Error("Organization ID does not match authenticated organization");let f=await u.db.selectFrom("member").select(["role"]).where("userId","=",Wu(u)??"").where("organizationId","=",t).executeTakeFirst();if(!l$i(f?.role,i.role))throw Error(`Insufficient privileges to assign role "${i.role.join(",")}"`);let l=await u.boundAuth.organization.addMember({organizationId:t,userId:i.userId,role:i.role});if(!l)throw Error("Failed to add member");let E=Wu(u);if(E)mu.capture({distinctId:E,event:"organization_member_added",groups:{organization:t},properties:{organization_id:t,added_user_id:i.userId,role:i.role}});return{...l,role:l.role,createdAt:l.createdAt instanceof Date?l.createdAt.toISOString():l.createdAt}}})});import{z as fn}from"zod";var M1u;var KI0=O(()=>{H4();fu();M1u=ui({name:"ORGANIZATION_MEMBER_REMOVE",description:"Remove a member from the organization. Revokes all their access immediately.",annotations:{title:"Remove Organization Member",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:fn.object({organizationId:fn.string().optional(),memberIdOrEmail:fn.string()}),outputSchema:fn.object({success:fn.boolean(),memberIdOrEmail:fn.string()}),handler:async(i,u)=>{gi(u),await u.access.check();let t=i.organizationId||u.organization?.id;if(!t)throw Error("Organization ID required (no active organization in context)");if(t!==u.organization?.id)throw Error("Organization ID does not match authenticated organization");await u.boundAuth.organization.removeMember({organizationId:t,memberIdOrEmail:i.memberIdOrEmail});let f=Wu(u);if(f)mu.capture({distinctId:f,event:"organization_member_removed",groups:{organization:t},properties:{organization_id:t,member_id_or_email:i.memberIdOrEmail}});return{success:!0,memberIdOrEmail:i.memberIdOrEmail}}})});import{z as Jc}from"zod";var q1u;var YI0=O(()=>{fu();q1u=ui({name:"ORGANIZATION_MEMBER_LIST",description:"List all members in the organization with their roles.",annotations:{title:"List Organization Members",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:Jc.object({limit:Jc.number().optional(),offset:Jc.number().optional()}),outputSchema:Jc.object({members:Jc.array(Jc.object({id:Jc.string(),organizationId:Jc.string(),userId:Jc.string(),role:Jc.string(),createdAt:Jc.string().datetime().describe("ISO 8601 timestamp"),user:Jc.object({id:Jc.string(),name:Jc.string(),email:Jc.string(),image:Jc.string().optional()}).optional()}))}),handler:async(i,u)=>{gi(u),await u.access.check();let t=u.organization?.id;if(!t)throw Error("Organization ID required (no active organization in context)");let f=await u.boundAuth.organization.listMembers({organizationId:t,limit:i.limit,offset:i.offset});return{members:(Array.isArray(f)?f:[]).map((E)=>({...E,createdAt:E.createdAt instanceof Date?E.createdAt.toISOString():E.createdAt}))}}})});import{z as lE}from"zod";var V1u;var WI0=O(()=>{H4();fu();Uh();V1u=ui({name:"ORGANIZATION_MEMBER_UPDATE_ROLE",description:"Change a member's role (e.g., admin, member) within the organization.",annotations:{title:"Update Member Role",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:lE.object({organizationId:lE.string().optional(),memberId:lE.string(),role:lE.array(lE.string())}),outputSchema:lE.object({id:lE.string(),organizationId:lE.string(),userId:lE.string(),role:lE.union([lE.string(),lE.array(lE.string())]),createdAt:lE.string().datetime().describe("ISO 8601 timestamp"),user:lE.object({email:lE.string(),name:lE.string(),image:lE.string().optional()})}),handler:async(i,u)=>{gi(u),await u.access.check();let t=i.organizationId||u.organization?.id;if(!t)throw Error("Organization ID required (no active organization in context)");let f=await u.db.selectFrom("member").select(["role"]).where("userId","=",Wu(u)??"").where("organizationId","=",t).executeTakeFirst();if(!l$i(f?.role,i.role))throw Error(`Insufficient privileges to assign role "${i.role.join(",")}"`);let l=await u.boundAuth.organization.updateMemberRole({organizationId:t,memberId:i.memberId,role:i.role});if(!l)throw Error("Failed to update member role");u.invalidateMemberRole?.(l.userId,t);let E=Wu(u);if(E)mu.capture({distinctId:E,event:"organization_member_role_updated",groups:{organization:t},properties:{organization_id:t,member_id:i.memberId,target_user_id:l.userId,new_role:Array.isArray(i.role)?i.role.join(","):i.role}});return{...l,createdAt:l.createdAt instanceof Date?l.createdAt.toISOString():l.createdAt}}})});async function SI0(){if(yo&&Date.now()-yo.fetchedAt<600000)return yo.rate;try{let u=await(await fetch("https://economia.awesomeapi.com.br/json/last/USD-BRL",{signal:AbortSignal.timeout(5000)})).json(),t=parseFloat(u.USDBRL?.bid??"");if(Number.isNaN(t)||t<=0)throw Error("Invalid rate");return yo={rate:t,fetchedAt:Date.now()},t}catch{return yo?.rate??5.5}}function LI0(i,u,t){if(u==="brl")return Math.round(i/t);return i}var yo=null;function r1u(i,u="",t=new URLSearchParams){for(let[f,l]of Object.entries(i)){if(l===void 0||l===null)continue;let E=u?`${u}[${f}]`:f;if(Array.isArray(l))l.forEach((c,w)=>{if(typeof c==="object"&&c!==null)r1u(c,`${E}[${w}]`,t);else t.append(`${E}[${w}]`,String(c))});else if(typeof l==="object")r1u(l,E,t);else t.append(E,String(l))}return t}async function nN(i,u){let t=hu().stripeSecretKey;if(!t)throw new Tw(503,"billing is not configured");let f=u?.params?r1u(u.params).toString():void 0,l=await fetch(`${nnf}${i}`,{method:u?.method??(f?"POST":"GET"),headers:{Authorization:`Bearer ${t}`,...f&&{"Content-Type":"application/x-www-form-urlencoded"}},body:f,signal:AbortSignal.timeout(Rnf)}),E=await l.json().catch(()=>({}));if(!l.ok){let c=E.error?.message??`HTTP ${l.status}`;throw new Tw(l.status,c)}return E}async function QI0(i){let u=hu().stripeSeatPriceId;if(!u)throw new Tw(503,"billing is not configured");let t=await nN("/checkout/sessions",{params:{mode:"subscription",line_items:[{price:u,quantity:i.quantity}],success_url:i.successUrl,cancel_url:i.cancelUrl,metadata:{orgId:i.organizationId},subscription_data:{metadata:{orgId:i.organizationId}}}});if(!t.url)throw new Tw(500,"checkout session lacks url");return{url:t.url}}async function m1u(i){let t=(await nN(`/subscriptions/${encodeURIComponent(i)}`)).items?.data??[],f=hu().stripeSeatPriceId,l=f?t.find((E)=>E.price?.id===f):t.length===1?t[0]:void 0;if(!l)throw new Tw(500,"subscription has no seat item");return{itemId:l.id,quantity:l.quantity??0}}async function HI0(i){let{itemId:u}=await m1u(i.subscriptionId),t=await nN("/invoices/create_preview",{params:{subscription:i.subscriptionId,subscription_details:{items:[{id:u,quantity:i.quantity}],proration_behavior:"always_invoice"}}});return{amountDueCents:t.amount_due??0,currency:t.currency??"usd"}}function bnf(i,u){return Math.round(i*(1+u/100))}async function zI0(i){let u=bnf(i.amountCents,i.feePercent),t=LI0(i.amountCents,i.currency,await SI0()),f=i.currency==="brl"?`Studio AI credits (R$ ${(i.amountCents/100).toFixed(2)})`:`Studio AI credits ($${(i.amountCents/100).toFixed(2)})`,l=await nN("/checkout/sessions",{params:{mode:"payment",...i.customerId&&{customer:i.customerId},line_items:[{quantity:1,price_data:{currency:i.currency,unit_amount:u,product_data:{name:f}}}],success_url:i.successUrl,cancel_url:i.cancelUrl,metadata:{kind:"topup",orgId:i.organizationId,creditCents:t}}});if(!l.url)throw new Tw(500,"checkout session lacks url");return{url:l.url}}async function nI0(i){let u=await nN("/billing_portal/sessions",{params:{customer:i.customerId,return_url:i.returnUrl}});if(!u.url)throw new Tw(500,"portal session lacks url");return{url:u.url}}async function RI0(i){let{itemId:u}=await m1u(i.subscriptionId);await nN(`/subscriptions/${encodeURIComponent(i.subscriptionId)}`,{params:{items:[{id:u,quantity:i.quantity}],proration_behavior:"always_invoice",payment_behavior:"pending_if_incomplete"}})}async function bI0(i){await nN(`/subscriptions/${encodeURIComponent(i)}`,{method:"DELETE"})}async function CI0(i){if(i.targetQuantity<1)return!1;let{itemId:u,quantity:t}=await m1u(i.subscriptionId);if(t===i.targetQuantity)return!1;return await nN(`/subscriptions/${encodeURIComponent(i.subscriptionId)}`,{params:{items:[{id:u,quantity:i.targetQuantity}],proration_behavior:"always_invoice",payment_behavior:"pending_if_incomplete"}}),!0}var nnf="https://api.stripe.com/v1",Tw,Rnf=15000;var ln=O(()=>{z0();Tw=class Tw extends Error{status;constructor(i,u){super(`Stripe API ${i}: ${u}`);this.status=i;this.name="StripeApiError"}}});import{z as Ll}from"zod";var Cnf,e1u,a1u;var MI0=O(()=>{ln();qL();fu();YL();Cnf=Ll.object({legacy:Ll.boolean(),billingMode:Ll.string(),status:Ll.string(),includedReportUrl:Ll.string().nullable()}),e1u=ui({name:"ORGANIZATION_SEATS_GET",description:"Get the organization's billing identity and which members hold paid seats.",annotations:{title:"Get Organization Seats",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:Ll.object({}),outputSchema:Ll.object({billing:Cnf.nullable(),paidSeatUserIds:Ll.array(Ll.string())}),handler:async(i,u)=>{gi(u),await u.access.check();let t=u.organization?.id;if(!t)throw Error("Organization context required");let[f,l]=await Promise.all([u.storage.organizationBilling.getBilling(t),u.storage.organizationBilling.listPaidSeatUserIds(t)]);return{billing:f?{legacy:f.legacy,billingMode:f.billingMode,status:f.status,includedReportUrl:f.includedReportUrl}:null,paidSeatUserIds:l}}}),a1u=ui({name:"ORGANIZATION_SEATS_SET",description:"Set members' seats (paid/free). Invoiced organizations apply directly; self-serve organizations with an active subscription also charge the prorated difference on the saved card (preview it with ORGANIZATION_SEATS_PREVIEW first).",annotations:{title:"Set Organization Seats",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:Ll.object({seats:Ll.array(Ll.object({userId:Ll.string().min(1),seat:Ll.enum(["paid","free"])})).min(1).max(200)}),outputSchema:Ll.object({applied:Ll.array(Ll.object({userId:Ll.string(),seat:Ll.enum(["paid","free"])})),paidSeatCount:Ll.number(),benefitsSyncQueued:Ll.boolean()}),handler:async(i,u)=>{gi(u),await u.access.check();let t=u.organization?.id;if(!t)throw Error("Organization context required");let f=Wu(u);if(!f)throw Error("User ID required");let l=await u.storage.organizationBilling.getBilling(t);if(!l||l.legacy)throw Error("This organization is on the legacy plan \u2014 seats do not apply.");let E=ML(l)?l.stripeSubscriptionId:null,c;try{c=await u.storage.organizationBilling.setSeats(t,i.seats,f,{markBenefitsPending:gB()})}catch($){if($ instanceof W6i)throw Error($.message);throw $}if(E)try{await RI0({subscriptionId:E,quantity:c.paidSeatCount})}catch($){let h=$ instanceof Tw?$.message:"Stripe update failed";throw Error(`Seats saved, but updating the subscription failed: ${h}. Apply again to retry the charge.`)}let w=!1;if(c.benefitsReferenceId)try{await eD(t,c.benefitsReferenceId,"apply"),w=!0}catch($){console.error("Failed to enqueue benefit sync (sweep covers):",$)}return{applied:c.applied,paidSeatCount:c.paidSeatCount,benefitsSyncQueued:w}}})});import{z as M2}from"zod";var o1u,s1u;var qI0=O(()=>{ln();Ml();fu();o1u=ui({name:"ORGANIZATION_BILLING_CHECKOUT_START",description:"Start the organization's seat subscription: creates a Stripe Checkout session for the current paid-seat count and returns its URL.",annotations:{title:"Start Billing Checkout",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!1,openWorldHint:!0},inputSchema:M2.object({}),outputSchema:M2.object({url:M2.string(),quantity:M2.number()}),handler:async(i,u)=>{gi(u),await u.access.check();let t=u.organization?.id,f=u.organization?.slug;if(!t||!f)throw Error("Organization context required");let[l,E]=await Promise.all([u.storage.organizationBilling.getBilling(t),u.storage.organizationBilling.listPaidSeatUserIds(t)]);if(!l||l.legacy)throw Error("This organization is on the legacy plan \u2014 no subscription needed.");if(l.billingMode!=="self_serve")throw Error("Contract-billed organizations do not use checkout.");if(l.status==="active")throw Error("This organization already has an active subscription \u2014 seat changes apply directly.");if(l.stripeSubscriptionId)throw Error("This organization still has a subscription on file \u2014 settle or cancel it before starting a new checkout.");let c=E.length;if(c<1)throw Error("Mark at least one member as a paid seat before subscribing.");let w=`${FE()}/${encodeURIComponent(f)}/members`,{url:$}=await QI0({organizationId:t,quantity:c,successUrl:`${w}?checkout=success`,cancelUrl:`${w}?checkout=canceled`});return{url:$,quantity:c}}}),s1u=ui({name:"ORGANIZATION_SEATS_PREVIEW",description:"Preview what the organization pays now for changing its paid-seat count (Stripe prorated invoice preview). Read-only \u2014 nothing is charged.",annotations:{title:"Preview Seat Change",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!0},inputSchema:M2.object({quantity:M2.number().int().min(1).max(1000)}),outputSchema:M2.object({amountDueCents:M2.number(),currency:M2.string()}),handler:async(i,u)=>{gi(u),await u.access.check();let t=u.organization?.id;if(!t)throw Error("Organization context required");let f=await u.storage.organizationBilling.getBilling(t);if(!ML(f))throw Error("Seat previews need an active self-serve subscription.");return await HI0({subscriptionId:f.stripeSubscriptionId,quantity:i.quantity})}})});import{z as RN}from"zod";var p1u,ilu;var VI0=O(()=>{ln();qL();Ml();fu();mB();p1u=ui({name:"ORGANIZATION_BILLING_PORTAL",description:"Open the organization's Stripe billing portal (manage card, invoices, cancellation). Returns the portal URL.",annotations:{title:"Open Billing Portal",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!1,openWorldHint:!0},inputSchema:RN.object({}),outputSchema:RN.object({url:RN.string()}),handler:async(i,u)=>{gi(u),await u.access.check();let t=Oi(u);if(!t.slug)throw Error("Organization context required");let f=await u.storage.organizationBilling.getBilling(t.id);if(!f?.stripeCustomerId)throw Error("This organization has no billing account yet \u2014 subscribe first.");if(f.legacy||f.billingMode!=="self_serve")throw Error("This organization's billing is managed by deco \u2014 contact support.");try{return await nI0({customerId:f.stripeCustomerId,returnUrl:`${FE()}/${encodeURIComponent(t.slug)}/members`})}catch(l){if(l instanceof Tw)throw Error(l.message);throw l}}}),ilu=ui({name:"ORGANIZATION_INCLUDED_REPORT_SET",description:"Choose which site's weekly report re-run the organization's subscription includes (null clears it).",annotations:{title:"Set Included Report Site",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:RN.object({url:RN.string().trim().min(1).max(255).nullable()}),outputSchema:RN.object({includedReportUrl:RN.string().nullable(),benefitsSyncQueued:RN.boolean()}),handler:async(i,u)=>{gi(u),await u.access.check();let t=Oi(u),f=await u.storage.organizationBilling.getBilling(t.id);if(!f||f.legacy)throw Error("This organization is on the legacy plan \u2014 included reports do not apply.");let l=i.url===null?null:Q3i(i.url);if(i.url!==null&&!l)throw Error(`"${i.url}" is not a valid site URL.`);let{updated:E,benefitsReferenceId:c}=await u.storage.organizationBilling.setIncludedReportUrl(t.id,l,{markBenefitsPending:gB()});if(!E)throw Error("Organization billing row missing.");let w=!1;if(c)try{await eD(t.id,c,"apply"),w=!0}catch($){console.error("Failed to enqueue benefit sync (sweep covers):",$)}return{includedReportUrl:l,benefitsSyncQueued:w}}})});import{z as Po}from"zod";function Mnf(i){return`[CREDITS] Paid report runs need at least $${(rI0/100).toFixed(2)} of AI credit balance \u2014 current balance is $${(i/100).toFixed(2)}. Top up and try again.`}var rI0=500,ulu;var mI0=O(()=>{uri();fu();E8();_9();mB();ulu=ui({name:"ORGANIZATION_REPORT_RUN_PAID",description:"Trigger a paid report run for one of the organization's sites, billed against its AI credits (requires at least $5 of balance; the run's real cost plus markup is debited at completion).",annotations:{title:"Run Paid Report",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!1,openWorldHint:!0},inputSchema:Po.object({url:Po.string().trim().min(1).max(255).optional()}),outputSchema:Po.object({url:Po.string(),started:Po.boolean()}),handler:async(i,u)=>{gi(u),await u.access.check();let t=Oi(u),f=Wu(u);if(!f)throw Error("User ID required");if(!uV())throw Error("Reports are not available on this deployment.");let l;if(i.url)l=Q3i(i.url);else l=(await u.storage.organizationBilling.getBilling(t.id))?.includedReportUrl??null;if(!l)throw Error(i.url?`"${i.url}" is not a valid site URL.`:"No site chosen \u2014 pass a url or set the included report site first.");let E=x6().deco;if(!E?.getCreditsBalance)throw Error("AI credit balance is not available on this deployment.");let c=await Sd(f,u.auth.user?.email),{balanceCents:w}=await E.getCreditsBalance(c,t.id);if(!(w>=rI0))throw Error(Mnf(w??0));return await Du0({host:l,organizationId:t.id}),{url:l,started:!0}}})});var eI0=O(()=>{dI0();DI0();_I0();NI0();OI0();BI0();FI0();TI0();AI0();yI0();GI0();jI0();XI0();JI0();KI0();YI0();WI0();MI0();qI0();VI0();mI0()});var y$="super-agent",aI0="task-board.item.updated",oI0="task-board.item.deleted";import{z as ef}from"zod";var Go,HK,Vnf,sI0,En;var zK=O(()=>{Go=ef.enum(["triage","todo","in_progress","in_review","done"]),HK=ef.enum(["none","low","medium","high","urgent"]),Vnf=ef.object({threadId:ef.string(),virtualMcpId:ef.string().nullable(),status:ef.enum(["in_progress","requires_action","failed","completed","expired"]).nullable(),title:ef.string().nullable(),lastMessage:ef.string().nullable(),hasPreview:ef.boolean(),createdAt:ef.string()}),sI0=ef.object({url:ef.string(),number:ef.number(),repoOwner:ef.string(),repoName:ef.string(),createdAt:ef.string(),title:ef.string().nullable(),body:ef.string().nullable(),state:ef.enum(["open","closed"]).nullable(),draft:ef.boolean().nullable(),merged:ef.boolean().nullable()}),En=ef.object({id:ef.string(),organizationId:ef.string(),title:ef.string(),description:ef.string().nullable(),status:Go,priority:HK,assigneeId:ef.string().nullable(),assignedBy:ef.string().nullable(),dueDate:ef.string().datetime().nullable(),threads:ef.array(Vnf),createdBy:ef.string(),createdAt:ef.string().datetime(),updatedBy:ef.string(),updatedAt:ef.string().datetime()})});async function iTi(i,u,t){if(t===y$)return;let{members:f}=await i.boundAuth.organization.listMembers({organizationId:u,filterField:"userId",filterValue:t});if(!f.some((l)=>l.userId===t))throw Error("assigneeId is not a member of the organization")}var tlu=O(()=>{zK()});async function flu(i,u,t){let f;try{return await Promise.race([i.aiProviders.listModels(u,t),new Promise((E,c)=>{f=setTimeout(()=>c(Error("listModels timeout")),rnf)})])}finally{if(f)clearTimeout(f)}}function mnf(i,u){switch(i){case"fast":return u.chat.fast;case"smart":return u.chat.smart;case"thinking":return u.chat.thinking;case"image":return u.image;case"web_search":return u.webSearch;case"deep_research":return u.deepResearch}}function llu(i,u,t){let f=i.find((l)=>l.modelId===u);return{title:f?.title??t??u,providerId:f?.providerId,capabilities:f?.capabilities,limits:f?.limits??null}}async function P$(i,u){let t=i.organization?.id;if(!t)throw Error("resolveTier called without an organization");let l=(await i.storage.organizationSettings.get(t))?.simple_mode?.tiers?.[u]??null,E=await i.storage.aiProviderKeys.list({organizationId:t});if(l&&E.some((v)=>v.id===l.keyId)){let v=await flu(i,l.keyId,t).catch(()=>[]);return{credentialId:l.keyId,modelId:l.modelId,modelMeta:llu(v,l.modelId,l.title)}}if(E.length===0)throw new cn(u);let c={};await Promise.all(E.map(async(v)=>{c[v.id]=await flu(i,v.id,t).catch(()=>[])}));let w=E.map((v)=>({id:v.id,providerId:v.providerId,label:v.label,presetId:v.presetId,createdBy:v.createdBy,createdAt:v.createdAt})),$=iu0(w,c),h=mnf(u,$);if(!h)throw new cn(u);return{credentialId:h.keyId,modelId:h.modelId,modelMeta:llu(c[h.keyId]??[],h.modelId,h.title)}}async function pI0(i,u,t){let f=i.organization?.id;if(!f)throw Error("resolveSpecificModel called without an organization");let l=await flu(i,u,f).catch(()=>[]);return{credentialId:u,modelId:t,modelMeta:llu(l,t)}}async function Rh(i,u){try{return await P$(i,u)}catch(t){if(t instanceof cn)return null;return console.warn(`[resolveTier] tier "${u}" resolution failed:`,t),null}}var cn,rnf=5000;var nK=O(()=>{Ef();cn=class cn extends Error{tier;constructor(i){super(`No model available for tier "${i}". Connect a provider or configure the tier in organization settings.`);this.tier=i;this.name="TierUnavailableError"}}});function uTi(i){return i.sandboxProviderKind==="agent-sandbox"&&i.harnessId==="decopilot"}function ix0(i){return i.harnessId==="decopilot"&&(i.sandboxProviderKind==null||i.sandboxProviderKind==="agent-sandbox")}function anf(i){return{type:"data-run-status",id:"run-status",data:{stage:i}}}function ux0(i){if(!i||typeof i!=="object")return!1;return i.type==="data-run-status"}async function q2(i,u,t){if(!i)return;try{await i.publishRawChunk(u,anf(t))}catch{}}var enf,Io,J36;var xo=O(()=>{enf=["waiting-runner","starting-run","gathering-context","preparing-tools","starting-assistant","analyzing-scope"],Io=["gathering-context","preparing-tools","starting-assistant","analyzing-scope"],J36=new Set(enf)});function tTi(){return crypto.randomUUID()}var clu=Y((W36,lx0)=>{var{defineProperty:Elu,getOwnPropertyDescriptor:onf,getOwnPropertyNames:snf}=Object,pnf=Object.prototype.hasOwnProperty,iRf=(i,u)=>{for(var t in u)Elu(i,t,{get:u[t],enumerable:!0})},uRf=(i,u,t,f)=>{if(u&&typeof u==="object"||typeof u==="function"){for(let l of snf(u))if(!pnf.call(i,l)&&l!==t)Elu(i,l,{get:()=>u[l],enumerable:!(f=onf(u,l))||f.enumerable})}return i},tRf=(i)=>uRf(Elu({},"__esModule",{value:!0}),i),tx0={};iRf(tx0,{SYMBOL_FOR_REQ_CONTEXT:()=>fx0,getContext:()=>fRf});lx0.exports=tRf(tx0);var fx0=Symbol.for("@vercel/request-context");function fRf(){return globalThis[fx0]?.get?.()??{}}});var ko=Y((S36,wx0)=>{var{defineProperty:wlu,getOwnPropertyDescriptor:lRf,getOwnPropertyNames:ERf}=Object,cRf=Object.prototype.hasOwnProperty,wRf=(i,u)=>{for(var t in u)wlu(i,t,{get:u[t],enumerable:!0})},$Rf=(i,u,t,f)=>{if(u&&typeof u==="object"||typeof u==="function"){for(let l of ERf(u))if(!cRf.call(i,l)&&l!==t)wlu(i,l,{get:()=>u[l],enumerable:!(f=lRf(u,l))||f.enumerable})}return i},hRf=(i)=>$Rf(wlu({},"__esModule",{value:!0}),i),Ex0={};wRf(Ex0,{VercelOidcTokenError:()=>cx0});wx0.exports=hRf(Ex0);class cx0 extends Error{constructor(i,u){super(i);this.name="VercelOidcTokenError",this.cause=u}toString(){if(this.cause)return`${this.name}: ${this.message}: ${this.cause}`;return`${this.name}: ${this.message}`}}});var dx0=Y((L36,vx0)=>{var{create:vRf,defineProperty:fTi,getOwnPropertyDescriptor:dRf,getOwnPropertyNames:DRf,getPrototypeOf:_Rf}=Object,NRf=Object.prototype.hasOwnProperty,ORf=(i,u)=>{for(var t in u)fTi(i,t,{get:u[t],enumerable:!0})},$x0=(i,u,t,f)=>{if(u&&typeof u==="object"||typeof u==="function"){for(let l of DRf(u))if(!NRf.call(i,l)&&l!==t)fTi(i,l,{get:()=>u[l],enumerable:!(f=dRf(u,l))||f.enumerable})}return i},hlu=(i,u,t)=>(t=i!=null?vRf(_Rf(i)):{},$x0(u||!i||!i.__esModule?fTi(t,"default",{value:i,enumerable:!0}):t,i)),ZRf=(i)=>$x0(fTi({},"__esModule",{value:!0}),i),hx0={};ORf(hx0,{findRootDir:()=>gRf,getUserDataDir:()=>TRf});vx0.exports=ZRf(hx0);var jo=hlu(Fi("path")),BRf=hlu(Fi("fs")),$lu=hlu(Fi("os")),FRf=ko();function gRf(){try{let i=process.cwd();while(i!==jo.default.dirname(i)){let u=jo.default.join(i,".vercel");if(BRf.default.existsSync(u))return i;i=jo.default.dirname(i)}}catch(i){throw new FRf.VercelOidcTokenError("Token refresh only supported in node server environments")}return null}function TRf(){if(process.env.XDG_DATA_HOME)return process.env.XDG_DATA_HOME;switch($lu.default.platform()){case"darwin":return jo.default.join($lu.default.homedir(),"Library/Application Support");case"linux":return jo.default.join($lu.default.homedir(),".local/share");case"win32":if(process.env.LOCALAPPDATA)return process.env.LOCALAPPDATA;return null;default:return null}}});var Fx0=Y((Q36,Bx0)=>{var{create:URf,defineProperty:lTi,getOwnPropertyDescriptor:ARf,getOwnPropertyNames:yRf,getPrototypeOf:PRf}=Object,GRf=Object.prototype.hasOwnProperty,IRf=(i,u)=>{for(var t in u)lTi(i,t,{get:u[t],enumerable:!0})},Dx0=(i,u,t,f)=>{if(u&&typeof u==="object"||typeof u==="function"){for(let l of yRf(u))if(!GRf.call(i,l)&&l!==t)lTi(i,l,{get:()=>u[l],enumerable:!(f=ARf(u,l))||f.enumerable})}return i},_x0=(i,u,t)=>(t=i!=null?URf(PRf(i)):{},Dx0(u||!i||!i.__esModule?lTi(t,"default",{value:i,enumerable:!0}):t,i)),xRf=(i)=>Dx0(lTi({},"__esModule",{value:!0}),i),Nx0={};IRf(Nx0,{isValidAccessToken:()=>JRf,readAuthConfig:()=>jRf,writeAuthConfig:()=>XRf});Bx0.exports=xRf(Nx0);var Xo=_x0(Fi("fs")),Ox0=_x0(Fi("path")),kRf=Jo();function Zx0(){let i=(0,kRf.getVercelDataDir)();if(!i)throw Error(`Unable to find Vercel CLI data directory. Your platform: ${process.platform}. Supported: darwin, linux, win32.`);return Ox0.join(i,"auth.json")}function jRf(){try{let i=Zx0();if(!Xo.existsSync(i))return null;let u=Xo.readFileSync(i,"utf8");if(!u)return null;return JSON.parse(u)}catch(i){return null}}function XRf(i){let u=Zx0(),t=Ox0.dirname(u);if(!Xo.existsSync(t))Xo.mkdirSync(t,{mode:504,recursive:!0});Xo.writeFileSync(u,JSON.stringify(i,null,2),{mode:384})}function JRf(i,u=0){if(!i.token)return!1;if(typeof i.expiresAt!=="number")return!0;let t=Math.floor(Date.now()/1000),f=u/1000;return i.expiresAt>=t+f}});var Ax0=Y((H36,Ux0)=>{var{defineProperty:Dlu,getOwnPropertyDescriptor:KRf,getOwnPropertyNames:YRf}=Object,WRf=Object.prototype.hasOwnProperty,SRf=(i,u)=>{for(var t in u)Dlu(i,t,{get:u[t],enumerable:!0})},LRf=(i,u,t,f)=>{if(u&&typeof u==="object"||typeof u==="function"){for(let l of YRf(u))if(!WRf.call(i,l)&&l!==t)Dlu(i,l,{get:()=>u[l],enumerable:!(f=KRf(u,l))||f.enumerable})}return i},QRf=(i)=>LRf(Dlu({},"__esModule",{value:!0}),i),gx0={};SRf(gx0,{processTokenResponse:()=>bRf,refreshTokenRequest:()=>RRf});Ux0.exports=QRf(gx0);var vlu=Fi("os"),HRf="https://vercel.com",zRf="cl_HYyOPBNtFMfHhaUn9L4QPfTZz6TP47bp",Tx0=`@vercel/oidc node-${process.version} ${(0,vlu.platform)()} (${(0,vlu.arch)()}) ${(0,vlu.hostname)()}`,dlu=null;async function nRf(){if(dlu)return dlu;let i=`${HRf}/.well-known/openid-configuration`,u=await fetch(i,{headers:{"user-agent":Tx0}});if(!u.ok)throw Error("Failed to discover OAuth endpoints");let t=await u.json();if(!t||typeof t.token_endpoint!=="string")throw Error("Invalid OAuth discovery response");let f=t.token_endpoint;return dlu=f,f}async function RRf(i){let u=await nRf();return await fetch(u,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded","user-agent":Tx0},body:new URLSearchParams({client_id:zRf,grant_type:"refresh_token",...i})})}async function bRf(i){let u=await i.json();if(!i.ok){let t=typeof u==="object"&&u&&"error"in u?String(u.error):"Token refresh failed";return[Error(t)]}if(typeof u!=="object"||u===null)return[Error("Invalid token response")];if(typeof u.access_token!=="string")return[Error("Missing access_token in response")];if(u.token_type!=="Bearer")return[Error("Invalid token_type in response")];if(typeof u.expires_in!=="number")return[Error("Missing expires_in in response")];return[null,u]}});var Nlu=Y((z36,Ix0)=>{var{defineProperty:_lu,getOwnPropertyDescriptor:CRf,getOwnPropertyNames:MRf}=Object,qRf=Object.prototype.hasOwnProperty,VRf=(i,u)=>{for(var t in u)_lu(i,t,{get:u[t],enumerable:!0})},rRf=(i,u,t,f)=>{if(u&&typeof u==="object"||typeof u==="function"){for(let l of MRf(u))if(!qRf.call(i,l)&&l!==t)_lu(i,l,{get:()=>u[l],enumerable:!(f=CRf(u,l))||f.enumerable})}return i},mRf=(i)=>rRf(_lu({},"__esModule",{value:!0}),i),yx0={};VRf(yx0,{AccessTokenMissingError:()=>Px0,RefreshAccessTokenFailedError:()=>Gx0});Ix0.exports=mRf(yx0);class Px0 extends Error{constructor(){super("No authentication found. Please log in with the Vercel CLI (vercel login).");this.name="AccessTokenMissingError"}}class Gx0 extends Error{constructor(i){super("Failed to refresh authentication token.",{cause:i});this.name="RefreshAccessTokenFailedError"}}});var Jo=Y((n36,Jx0)=>{var{create:eRf,defineProperty:ETi,getOwnPropertyDescriptor:aRf,getOwnPropertyNames:oRf,getPrototypeOf:sRf}=Object,pRf=Object.prototype.hasOwnProperty,ibf=(i,u)=>{for(var t in u)ETi(i,t,{get:u[t],enumerable:!0})},kx0=(i,u,t,f)=>{if(u&&typeof u==="object"||typeof u==="function"){for(let l of oRf(u))if(!pRf.call(i,l)&&l!==t)ETi(i,l,{get:()=>u[l],enumerable:!(f=aRf(u,l))||f.enumerable})}return i},jx0=(i,u,t)=>(t=i!=null?eRf(sRf(i)):{},kx0(u||!i||!i.__esModule?ETi(t,"default",{value:i,enumerable:!0}):t,i)),ubf=(i)=>kx0(ETi({},"__esModule",{value:!0}),i),Xx0={};ibf(Xx0,{assertVercelOidcTokenResponse:()=>Olu,findProjectInfo:()=>Ebf,getTokenPayload:()=>$bf,getVercelDataDir:()=>tbf,getVercelOidcToken:()=>lbf,getVercelToken:()=>fbf,isExpired:()=>hbf,loadToken:()=>wbf,saveToken:()=>cbf});Jx0.exports=ubf(Xx0);var Ko=jx0(Fi("path")),RK=jx0(Fi("fs")),hn=ko(),cTi=dx0(),wn=Fx0(),xx0=Ax0(),$n=Nlu();function tbf(){let u=(0,cTi.getUserDataDir)();if(!u)return null;return Ko.join(u,"com.vercel.cli")}async function fbf(i){let u=(0,wn.readAuthConfig)();if(!u?.token)throw new $n.AccessTokenMissingError;if((0,wn.isValidAccessToken)(u,i?.expirationBufferMs))return u.token;if(!u.refreshToken)throw(0,wn.writeAuthConfig)({}),new $n.RefreshAccessTokenFailedError("No refresh token available");try{let t=await(0,xx0.refreshTokenRequest)({refresh_token:u.refreshToken}),[f,l]=await(0,xx0.processTokenResponse)(t);if(f||!l)throw(0,wn.writeAuthConfig)({}),new $n.RefreshAccessTokenFailedError(f);let E={token:l.access_token,expiresAt:Math.floor(Date.now()/1000)+l.expires_in};if(l.refresh_token)E.refreshToken=l.refresh_token;return(0,wn.writeAuthConfig)(E),E.token}catch(t){if((0,wn.writeAuthConfig)({}),t instanceof $n.AccessTokenMissingError||t instanceof $n.RefreshAccessTokenFailedError)throw t;throw new $n.RefreshAccessTokenFailedError(t)}}async function lbf(i,u,t){let f=`https://api.vercel.com/v1/projects/${u}/token?source=vercel-oidc-refresh${t?`&teamId=${t}`:""}`,l=await fetch(f,{method:"POST",headers:{Authorization:`Bearer ${i}`}});if(!l.ok)throw new hn.VercelOidcTokenError(`Failed to refresh OIDC token: ${l.statusText}`);let E=await l.json();return Olu(E),E}function Olu(i){if(!i||typeof i!=="object")throw TypeError("Vercel OIDC token is malformed. Expected an object. Please run `vc env pull` and try again");if(!("token"in i)||typeof i.token!=="string")throw TypeError("Vercel OIDC token is malformed. Expected a string-valued token property. Please run `vc env pull` and try again")}function Ebf(){let i=(0,cTi.findRootDir)();if(!i)throw new hn.VercelOidcTokenError("Unable to find project root directory. Have you linked your project with `vc link?`");let u=Ko.join(i,".vercel","project.json");if(!RK.existsSync(u))throw new hn.VercelOidcTokenError("project.json not found, have you linked your project with `vc link?`");let t=JSON.parse(RK.readFileSync(u,"utf8"));if(typeof t.projectId!=="string"&&typeof t.orgId!=="string")throw TypeError("Expected a string-valued projectId property. Try running `vc link` to re-link your project.");return{projectId:t.projectId,teamId:t.orgId}}function cbf(i,u){let t=(0,cTi.getUserDataDir)();if(!t)throw new hn.VercelOidcTokenError("Unable to find user data directory. Please reach out to Vercel support.");let f=Ko.join(t,"com.vercel.token",`${u}.json`),l=JSON.stringify(i);RK.mkdirSync(Ko.dirname(f),{mode:504,recursive:!0}),RK.writeFileSync(f,l),RK.chmodSync(f,432);return}function wbf(i){let u=(0,cTi.getUserDataDir)();if(!u)throw new hn.VercelOidcTokenError("Unable to find user data directory. Please reach out to Vercel support.");let t=Ko.join(u,"com.vercel.token",`${i}.json`);if(!RK.existsSync(t))return null;let f=JSON.parse(RK.readFileSync(t,"utf8"));return Olu(f),f}function $bf(i){let u=i.split(".");if(u.length!==3)throw new hn.VercelOidcTokenError("Invalid token. Please run `vc env pull` and try again");let t=u[1].replace(/-/g,"+").replace(/_/g,"/"),f=t.padEnd(t.length+(4-t.length%4)%4,"=");return JSON.parse(Buffer.from(f,"base64").toString("utf8"))}function hbf(i,u=0){return i.exp*1000<Date.now()+u}});var Sx0=Y((R36,Wx0)=>{var{defineProperty:Zlu,getOwnPropertyDescriptor:vbf,getOwnPropertyNames:dbf}=Object,Dbf=Object.prototype.hasOwnProperty,_bf=(i,u)=>{for(var t in u)Zlu(i,t,{get:u[t],enumerable:!0})},Nbf=(i,u,t,f)=>{if(u&&typeof u==="object"||typeof u==="function"){for(let l of dbf(u))if(!Dbf.call(i,l)&&l!==t)Zlu(i,l,{get:()=>u[l],enumerable:!(f=vbf(u,l))||f.enumerable})}return i},Obf=(i)=>Nbf(Zlu({},"__esModule",{value:!0}),i),Yx0={};_bf(Yx0,{refreshToken:()=>Zbf});Wx0.exports=Obf(Yx0);var Kx0=ko(),bN=Jo();async function Zbf(i){let u=i?.project,t=i?.team;if(!u&&!t){let l=(0,bN.findProjectInfo)();u=l.projectId,t=l.teamId}else if(!u||!t){let l=(0,bN.findProjectInfo)();u=u??l.projectId,t=t??l.teamId}if(!u)throw new Kx0.VercelOidcTokenError("Failed to refresh OIDC token: No project specified. Try re-linking your project with `vc link`");let f=(0,bN.loadToken)(u);if(!f||(0,bN.isExpired)((0,bN.getTokenPayload)(f.token),i?.expirationBufferMs)){let l=await(0,bN.getVercelToken)({expirationBufferMs:i?.expirationBufferMs});if(f=await(0,bN.getVercelOidcToken)(l,u,t),!f)throw new Kx0.VercelOidcTokenError("Failed to refresh OIDC token");(0,bN.saveToken)(f,u)}process.env.VERCEL_OIDC_TOKEN=f.token;return}});var Hx0=Y((b36,Qx0)=>{var{defineProperty:Flu,getOwnPropertyDescriptor:Bbf,getOwnPropertyNames:Fbf}=Object,gbf=Object.prototype.hasOwnProperty,Tbf=(i,u)=>{for(var t in u)Flu(i,t,{get:u[t],enumerable:!0})},Ubf=(i,u,t,f)=>{if(u&&typeof u==="object"||typeof u==="function"){for(let l of Fbf(u))if(!gbf.call(i,l)&&l!==t)Flu(i,l,{get:()=>u[l],enumerable:!(f=Bbf(u,l))||f.enumerable})}return i},Abf=(i)=>Ubf(Flu({},"__esModule",{value:!0}),i),Lx0={};Tbf(Lx0,{getVercelOidcToken:()=>Gbf,getVercelOidcTokenSync:()=>Blu});Qx0.exports=Abf(Lx0);var ybf=clu(),Pbf=ko();async function Gbf(i){let u="",t;try{u=Blu()}catch(f){t=f}try{let[{getTokenPayload:f,isExpired:l},{refreshToken:E}]=await Promise.all([await Promise.resolve().then(() => j(Jo())),await Promise.resolve().then(() => j(Sx0()))]);if(!u||l(f(u),i?.expirationBufferMs))await E(i),u=Blu()}catch(f){let l=t instanceof Error?t.message:"";if(f instanceof Error)l=`${l}
+`))>=0){let $=f.slice(0,w).trim();if(f=f.slice(w+1),!$)continue;yield JSON.parse($)}}let l=f.trim();if(l)yield JSON.parse(l)}finally{u.releaseLock()}}var gG0,TG0,yG0="gateway.networking.k8s.io",PG0="v1",GG0="httproutes",Azf,No,xG0="mesh-sandbox-runner";var qgi=O(()=>{O4();vo();gG0=class gG0 extends Error{status;body;constructor(i,u,t){super(t);this.status=i;this.body=u;this.name="KubeHttpError"}};TG0=`/apis/${Wl.CLAIM_API_GROUP}/${Wl.CLAIM_API_VERSION}/namespaces`;Azf=`/apis/${yG0}/${PG0}/namespaces`;No={API_GROUP:yG0,API_VERSION:PG0,PLURAL:GG0}});async function*JG0(i){let u=i.now??(()=>Date.now()),t=u(),f=i.schedulingTimeoutMs??Gzf,l={pod:{},sandbox:{},events:{hasPulling:!1,hasPulled:!1},startedAt:t},E=[],c=null,w=!1,$=(g)=>{if(w)return;if(c){let T=c;c=null,T(g)}else E.push(g)},h=()=>{if(E.length>0)return Promise.resolve(E.shift());if(w)return Promise.resolve(null);return new Promise((g)=>{c=g})},v=()=>{if(w)return;if(w=!0,c){let g=c;c=null,g(null)}},d=new AbortController,D=()=>{d.abort(),v()};if(i.signal)if(i.signal.aborted)d.abort(),v();else i.signal.addEventListener("abort",D,{once:!0});let _=Math.max(0,f-(u()-t)),N=setTimeout(()=>$("tick"),_+100),Z,B=new Promise((g)=>{Z=g}),F=Promise.allSettled([Izf(i.kc,i.namespace,i.claimName,d.signal,l,$,u,Z),kzf(i.kc,i.namespace,i.claimName,d.signal,l,$),jzf(i.kc,i.namespace,i.claimName,B,d.signal,l,$,u)]);try{let g=null,T=-1,U=jG0(l,f,u);if(g=q4u(U),!M4u(U))T=XG0(U);if(yield U,M4u(U))return;while(!w){if(await h()===null)break;let G=jG0(l,f,u);if(M4u(G)){let X=q4u(G);if(X!==g)g=X,yield G;return}let k=XG0(G);if(k<T)continue;let I=q4u(G);if(I!==g)g=I,T=k,yield G}}finally{if(clearTimeout(N),d.abort(),i.signal)i.signal.removeEventListener("abort",D);v(),await F.catch(()=>{})}}function jG0(i,u,t){let{pod:f,sandbox:l,events:E,startedAt:c}=i;if(l.ready)return{kind:"ready"};let w=f.containerWaitingReason;if(w==="ImagePullBackOff"||w==="ErrImagePull")return{kind:"failed",reason:"image-pull-backoff",message:"Sandbox image failed to download. The cluster may be missing pull credentials or the image tag may not exist."};if(w==="CrashLoopBackOff")return{kind:"failed",reason:"crash-loop-backoff",message:"Sandbox crashed during startup and is now in CrashLoopBackOff. Check pod logs."};if(!f.scheduled&&E.lastFailedSchedulingAt!==void 0&&t()-c>u)return{kind:"failed",reason:"scheduling-timeout",message:E.failedSchedulingMessage??`Pod could not be scheduled within ${Math.round(u/1000)}s.`};if(f.containerRunning&&!f.containerReady)return{kind:"warming-daemon",since:c};if(E.hasPulling&&!E.hasPulled)return{kind:"pulling-image",since:c};if(w==="ContainerCreating"||w==="PodInitializing"||f.scheduled&&!f.containerRunning)return{kind:"starting-container",since:c};if(f.scheduledFalseReason==="Unschedulable"||E.lastFailedSchedulingAt!==void 0&&!f.scheduled)return{kind:"waiting-for-capacity",since:c,message:E.failedSchedulingMessage??f.scheduledFalseMessage,nodeClaim:E.nominatedNodeClaim};return{kind:"claiming",since:c}}function M4u(i){return i.kind==="ready"||i.kind==="failed"}function XG0(i){switch(i.kind){case"claiming":return 0;case"waiting-for-capacity":return 1;case"pulling-image":return 2;case"starting-container":return 3;case"warming-daemon":return 4;case"ready":case"failed":return 99}}function q4u(i){switch(i.kind){case"claiming":case"pulling-image":case"starting-container":case"warming-daemon":return i.kind;case"waiting-for-capacity":return`waiting-for-capacity:${i.message??""}:${i.nodeClaim??""}`;case"ready":return"ready";case"failed":return`failed:${i.reason}:${i.message}`}}async function Izf(i,u,t,f,l,E,c,w){let $=`/api/v1/namespaces/${encodeURIComponent(u)}/pods?watch=true&labelSelector=${encodeURIComponent(`${yzf}=${t}`)}`;return Vgi({kc:i,path:$,signal:f,label:`pod/${t}`,onEvent:(h)=>{if(h.type!=="ADDED"&&h.type!=="MODIFIED")return;let v=h.object;if(v.metadata?.name)w(v.metadata.name);xzf(v,l,c),E("pod")}})}function xzf(i,u,t){let l=(i.status?.conditions??[]).find((c)=>c.type==="PodScheduled");if(l?.status==="True")u.pod.scheduled=!0,u.pod.scheduledFalseReason=void 0,u.pod.scheduledFalseMessage=void 0;else if(l?.status==="False")u.pod.scheduled=!1,u.pod.scheduledFalseReason=l.reason,u.pod.scheduledFalseMessage=l.message;let E=(i.status?.containerStatuses??[]).find((c)=>c.name===Pzf);if(E)u.pod.containerWaitingReason=E.state?.waiting?.reason,u.pod.containerRunning=!!E.state?.running,u.pod.containerReady=E.ready===!0}async function kzf(i,u,t,f,l,E){let c=`/apis/${Wl.CLAIM_API_GROUP}/${Wl.CLAIM_API_VERSION}/namespaces/${encodeURIComponent(u)}/${Wl.CLAIM_PLURAL}?watch=true&fieldSelector=${encodeURIComponent(`metadata.name=${t}`)}`;return Vgi({kc:i,path:c,signal:f,label:`sandboxclaim/${t}`,onEvent:(w)=>{if(w.type!=="ADDED"&&w.type!=="MODIFIED")return;let h=w.object.status?.conditions?.find((v)=>v.type==="Ready");if(!h)return;if(h.status==="True")l.sandbox.ready=!0,l.sandbox.notReadyReason=void 0,l.sandbox.notReadyMessage=void 0;else l.sandbox.ready=!1,l.sandbox.notReadyReason=h.reason,l.sandbox.notReadyMessage=h.message;E("sandbox")}})}async function jzf(i,u,t,f,l,E,c,w){let $=await Promise.race([f,new Promise((v)=>{if(l.aborted){v(t);return}l.addEventListener("abort",()=>v(t),{once:!0})})]);if(l.aborted)return;let h=`/api/v1/namespaces/${encodeURIComponent(u)}/events?watch=true&fieldSelector=${encodeURIComponent(`involvedObject.name=${$},involvedObject.kind=Pod`)}`;return Vgi({kc:i,path:h,signal:l,label:`events/${t}`,onEvent:(v)=>{if(v.type!=="ADDED"&&v.type!=="MODIFIED")return;let d=v.object,D=d.reason;if(!D)return;switch(D){case"Pulling":E.events.hasPulling=!0;break;case"Pulled":E.events.hasPulling=!0,E.events.hasPulled=!0;break;case"FailedScheduling":E.events.lastFailedSchedulingAt=w(),E.events.failedSchedulingMessage=d.message;break;case"Nominated":{let _=d.message?.match(/nodeclaim\/([\w-]+)/);if(_)E.events.nominatedNodeClaim=_[1];break}default:return}c("event")}})}async function KG0(i){let{kc:u,namespace:t,labelSelector:f,signal:l,onDelete:E}=i,c=`/apis/${Wl.CLAIM_API_GROUP}/${Wl.CLAIM_API_VERSION}/namespaces/${encodeURIComponent(t)}/${Wl.CLAIM_PLURAL}?watch=true&labelSelector=${encodeURIComponent(f)}`;return Vgi({kc:u,path:c,signal:l,label:"sandboxclaim-reaper",onEvent:(w)=>{if(w.type!=="DELETED")return;let $=w.object.metadata?.name;if($)E($)}})}async function Vgi(i){let{kc:u,path:t,signal:f,label:l,onEvent:E}=i,c=0;while(!f.aborted){try{let $=await WK(u,{method:"GET",path:t,signal:f,headers:{accept:"application/json"},stream:!0});if(!$.ok||!$.body){try{await $.body?.cancel()}catch{}if($.status===401||$.status===403){console.warn(`[lifecycle-watcher] ${l} stopped: watch denied (${$.status} ${$.statusText}). `+"The kubeconfig in use cannot watch SandboxClaims \u2014 if you are running locally, "+"this provider should not be active (check STUDIO_SANDBOX_PROVIDER / your sandbox preference).");return}throw Error(`watch handshake failed: ${$.status} ${$.statusText}`)}c=0;for await(let h of C4u($.body)){if(f.aborted)return;try{E(h)}catch(v){console.warn(`[lifecycle-watcher] ${l} onEvent threw: ${v instanceof Error?v.message:String(v)}`)}}}catch($){if(f.aborted)return;let h=$ instanceof Error?$.message:String($);console.warn(`[lifecycle-watcher] ${l} watch ended: ${h}`)}if(f.aborted)return;let w=hE(5000,250,c,2,0);c+=1,await y0(w,{signal:f}).catch(()=>{})}}var yzf="studio.decocms.com/sandbox-handle",Pzf="sandbox",Gzf=300000;var YG0=O(()=>{O4();vo();qgi()});async function WG0(i,u,t){let f=new Map;for(let l of i){let E=u(l);if(!E)continue;let c=f.get(E);if(c)c.push(l);else f.set(E,[l])}await Promise.allSettled([...f.values()].map(async(l)=>{for(let E of l)await t(E).catch(()=>{})}))}import{createHash as Xzf,randomBytes as Jzf,randomUUID as Kzf}from"crypto";import*as HG0 from"net";import{PassThrough as Yzf}from"stream";function Wzf(i){if(i instanceof Error)return i.message;if(i&&typeof i==="object"){let u=i;if(u.error instanceof Error)return u.error.message;if(typeof u.message==="string"&&u.message)return u.message}return String(i)}class o4u{kind=Xc;records=new Map;inflight=new T5i;stateStore;previewUrlPattern;kubeConfig;portForward;namespace;sandboxTemplateName;envName;tokenGenerator;idleTtlMs;metrics;previewGateway;sentinelToken;mintCloneUrl;closed=!1;claimWatchAbort=new AbortController;constructor(i={}){this.stateStore=i.stateStore??null,this.previewUrlPattern=i.previewUrlPattern??null,this.kubeConfig=i.kubeConfig??Vzf(),this.portForward=new U4u(this.kubeConfig),this.namespace=i.namespace??Szf,this.sandboxTemplateName=i.sandboxTemplateName??Lzf,this.envName=szf(i.envName),this.tokenGenerator=i.tokenGenerator??(()=>Jzf(Hzf).toString("hex")),this.idleTtlMs=i.idleTtlMs??nzf,this.metrics=i.meter?qzf(i.meter):null,this.previewGateway=i.previewGateway&&i.previewUrlPattern?{...i.previewGateway}:null;let u=i.sentinelToken?.trim()??"";this.sentinelToken=u.length>0?u:null,this.mintCloneUrl=i.mintCloneUrl,this.startClaimReaper(),this.startCredentialRefresher()}startClaimReaper(){let i=["app.kubernetes.io/managed-by=studio","app.kubernetes.io/name=studio-sandbox",...this.envName?[`${zh.env}=${this.envName}`]:[]].join(",");KG0({kc:this.kubeConfig,namespace:this.namespace,labelSelector:i,signal:this.claimWatchAbort.signal,onDelete:(u)=>this.invalidateRecord(u)})}async ensure(i,u={}){let t=TN(i,u.branch??u.repo?.branch??null);return this.inflight.run(t,()=>na(this.stateStore,i,Xc,(f)=>this.ensureLocked(i,t,u,f)))}async delete(i,u){if(u&&this.stateStore){await na(this.stateStore,u,Xc,(t)=>this.deleteLocked(i,u,t));return}await this.deleteLocked(i,u,this.stateStore)}async deleteLocked(i,u,t){let f=this.records.get(i)??null;if(this.records.delete(i),f)this.closeForwarder(f.daemonForward),this.metrics?.active.add(-1,e4u(f.tenant));if(await this.deleteHttpRouteIfManaged(i).catch((l)=>{console.warn(`[${i6}] HTTPRoute delete failed for ${i}: ${l instanceof Error?l.message:String(l)}`)}),await KN(this.kubeConfig,this.namespace,i),t)if(u)await t.delete(u,Xc);else if(f)await t.delete(f.id,Xc);else await t.deleteByHandle(Xc,i)}async alive(i){return await n2(this.kubeConfig,this.namespace,i)!==void 0}watchClaimLifecycle(i,u){return JG0({kc:this.kubeConfig,namespace:this.namespace,claimName:i,signal:u})}async getPreviewUrl(i){let u=await this.getRecord(i);if(!u)return null;return this.composePreviewUrl(u)}async proxyDaemonRequest(i,u,t){let f=await this.getRecord(i);if(!f&&this.previewUrlPattern&&this.stateStore){let $=await this.stateStore.getByHandle(Xc,i),h=$?.state,v=h?.token;if($&&v){let D=`http://${h?.adoptedSandboxName??i}.${this.namespace}.svc.cluster.local:${YN}`;try{let _=await nM(D,v,u,t);if(_.status!==404)return _;try{await _.body?.cancel()}catch{}}catch{}}}if(!f)f=await this.resurrectByHandle(i);if(!f)return new Response(JSON.stringify({error:"sandbox not found"}),{status:404,headers:{"content-type":"application/json"}});let l=f,E=performance.now(),c=0,w=!(t.body instanceof ReadableStream);try{let $=await nM(f.daemonUrl,f.token,u,t);if($.status===401&&w){this.invalidateRecord(i);let h=await this.getRecord(i).catch(()=>null)??await this.resurrectByHandle(i).catch(()=>null);if(h)l=h,$=await nM(h.daemonUrl,h.token,u,t)}return c=$.status,$}catch($){if(!w)throw $;this.invalidateRecord(i);let h=await this.resurrectByHandle(i)??await this.getRecord(i).catch(()=>null);if(!h)throw $;l=h;let v=await nM(h.daemonUrl,h.token,u,t);return c=v.status,v}finally{this.recordProxyDuration("daemon",c,l,performance.now()-E)}}async adoptLiveClaim(i,u){if(this.records.has(u))return!0;let t=await n2(this.kubeConfig,this.namespace,u).catch(()=>{return});if(!t||t.metadata?.deletionTimestamp)return!1;return await this.inflight.run(u,async()=>{let l=this.records.get(u);if(l)return this.toSandbox(l);let E=await this.adopt(i,u,t);if(!E)throw Error(`cannot adopt live claim ${u}`);return na(this.stateStore,i,Xc,(c)=>this.finish(E,c,!0,!0,"adopt"))}).catch(()=>null)!=null}async resolvePreviewUpstreamUrl(i){if(this.previewUrlPattern)return`http://${await this.resolveServiceNameForHandle(i)}.${this.namespace}.svc.cluster.local:${YN}`;let u=await this.getRecord(i);if(u)return u.daemonUrl;let t=await this.resurrectByHandle(i);return t?t.daemonUrl:null}async resolveServiceNameForHandle(i){let u=this.records.get(i);if(u)return u.adoptedSandboxName;if(this.stateStore){let f=(await this.stateStore.getByHandle(Xc,i).catch(()=>null))?.state?.adoptedSandboxName;if(f)return f}return i}async proxyPreviewRequest(i,u){let t=performance.now(),f=this.records.get(i)??null,l=0;try{let E=await this.resolvePreviewUpstreamUrl(i);if(!E){l=404;let N=r4u(404,{error:"sandbox not found"});return N.headers.set(LK,"1"),N}let c=new URL(u.url);if((c.pathname==="/_sandbox"||c.pathname.startsWith("/_sandbox/")||c.pathname==="/_decopilot_vm"||c.pathname.startsWith("/_decopilot_vm/"))&&u.method!=="GET")return l=404,r4u(404,{error:"not found"});let $=(N)=>`${N}${c.pathname}${c.search}`,h=new Headers(u.headers);for(let N of Czf)h.delete(N);let v=u.method!=="GET"&&u.method!=="HEAD",d={method:u.method,headers:h,body:v?u.body:void 0,redirect:"manual",signal:u.signal,duplex:v?"half":void 0},D;try{D=await fetch($(E),d)}catch(N){let Z=`${E}${c.pathname}`;if(console.warn(`[${i6}] preview fetch to ${Z} failed: ${N instanceof Error?N.message:String(N)}`),u.method==="GET"||u.method==="HEAD"){if(this.invalidateRecord(i),await this.resurrectByHandle(i).catch(()=>null)){let g=await this.resolvePreviewUpstreamUrl(i);if(g)try{D=await fetch($(g),d);let T=new Headers;for(let[U,A]of D.headers.entries())if(!SG0.includes(U.toLowerCase()))T.set(U,A);return l=D.status,new Response(D.body,{status:D.status,statusText:D.statusText,headers:T})}catch(T){console.warn(`[${i6}] preview fetch retry to ${Z} failed: ${T instanceof Error?T.message:String(T)}`)}}}else this.invalidateRecord(i);l=502;let B=r4u(502,{error:"sandbox daemon unreachable"});return B.headers.set(LK,"1"),B}let _=new Headers;for(let[N,Z]of D.headers.entries())if(!SG0.includes(N.toLowerCase()))_.set(N,Z);return l=D.status,new Response(D.body,{status:D.status,statusText:D.statusText,headers:_})}finally{this.recordProxyDuration("preview",l,f,performance.now()-t,i)}}async ensureLocked(i,u,t,f){if(t.image)console.warn(`[${i6}] opts.image ignored (template ${this.sandboxTemplateName} pins image): got ${t.image}`);if(f){let c=await f.get(i,Xc);if(c){let w=await this.rehydrate(i,u,c);if(w)return await this.refreshDaemonGitCredential(w,t),this.finish(w,f,!1,!0,"resume");await f.delete(i,Xc)}}let l=await n2(this.kubeConfig,this.namespace,u).catch(()=>{return});if(l)if(l.metadata?.deletionTimestamp)await Rgi(this.kubeConfig,this.namespace,u).catch((c)=>{console.warn(`[${i6}] wait for terminating claim ${u} failed: ${c instanceof Error?c.message:String(c)}`)});else{let c=await this.adopt(i,u,l).catch((w)=>{return console.warn(`[${i6}] adopt ${u} failed, recreating: ${w instanceof Error?w.message:String(w)}`),null});if(c)return await this.refreshDaemonGitCredential(c,t),this.finish(c,f,!0,!0,"adopt");await KN(this.kubeConfig,this.namespace,u).catch(()=>{}),await Rgi(this.kubeConfig,this.namespace,u).catch((w)=>{console.warn(`[${i6}] wait for deleted claim ${u} failed: ${w instanceof Error?w.message:String(w)}`)})}let E=await this.provision(i,u,t);return this.finish(E,f,!0,!1,"fresh")}async finish(i,u,t,f,l){let E=this.records.get(i.handle),c=E!==void 0;if(E&&E.daemonForward!==i.daemonForward)this.closeForwarder(E.daemonForward);if(this.records.set(i.handle,i),t)await this.persist(u,i);if(f)await UG0(this.kubeConfig,this.namespace,i.handle,this.computeShutdownTime()).catch((w)=>console.warn(`[${i6}] TTL refresh failed for ${i.handle}: ${w instanceof Error?w.message:String(w)}`));if(this.metrics){let w=e4u(i.tenant);if(this.metrics.ensureOutcome.add(1,{...w,outcome:l}),!c)this.metrics.active.add(1,w)}return this.toSandbox(i)}buildEnvMap(i,u){let t={},f=[];for(let[l,E]of Object.entries(i.env??{}))if(zzf.has(l))f.push(l);else t[l]=E;if(f.length>0)console.warn(`[${i6}] opts.env keys overlap reserved bootstrap names and were dropped: ${f.join(",")}`);return{...t,DAEMON_TOKEN:u.token,DAEMON_BOOT_ID:u.daemonBootId,APP_ROOT:u.workdir,PROXY_PORT:String(YN)}}buildClaim(i,u,t){let f=this.sentinelToken!==null,l=f?[]:Object.entries(this.buildEnvMap(u,t)).sort(([w],[$])=>w<$?-1:w>$?1:0).map(([w,$])=>({name:w,value:$})),E=unf(u),c=Object.keys(E).length>0;return{apiVersion:`${Wl.CLAIM_API_GROUP}/${Wl.CLAIM_API_VERSION}`,kind:"SandboxClaim",metadata:{name:i,namespace:this.namespace,labels:{"app.kubernetes.io/name":"studio-sandbox","app.kubernetes.io/managed-by":"studio",...this.envName?{[zh.env]:this.envName}:{},...m4u(u.tenant)},...c?{annotations:E}:{}},spec:{sandboxTemplateRef:{name:this.sandboxTemplateName},additionalPodMetadata:{labels:m4u(u.tenant,{[zh.role]:"claimed",[zh.sandboxHandle]:i,...this.envName?{[zh.env]:this.envName}:{}}),...c?{annotations:E}:{}},env:l,warmpool:f?"default":"none",lifecycle:{shutdownPolicy:"Delete",shutdownTime:this.computeShutdownTime()}}}}async provision(i,u,t){let f=this.tokenGenerator(),l=Kzf(),E=V4u,c=this.buildClaim(u,t,{token:f,daemonBootId:l,workdir:E});try{await _o(this.kubeConfig,this.namespace,c)}catch(D){if(D instanceof ho)await Rgi(this.kubeConfig,this.namespace,u),await _o(this.kubeConfig,this.namespace,c);else throw D}let w;try{w=await AG0(this.kubeConfig,this.namespace,u),await Mgi(this.kubeConfig,this.namespace,w)}catch(D){throw await KN(this.kubeConfig,this.namespace,u).catch(()=>{}),D}try{await this.ensureServicePortForAdoptedSandbox(w),await this.ensureHttpRouteForHandle(u,w,t.tenant??null)}catch(D){throw await KN(this.kubeConfig,this.namespace,u).catch(()=>{}),D}let $=await this.openForwarder(w,YN,u),h=`http://127.0.0.1:${$.localPort}`,v=this.workloadConfigPayload(t),d=l;try{if(await uli(h),this.sentinelToken!==null){let D=await ili(h);if(D)d=D.bootId;await B_(h,this.sentinelToken,v??{},{rotateToken:f})}else if(v)await B_(h,f,v);if(t.orgFsConfigJson)await uMu(h,f,t.orgFsConfigJson).catch((D)=>console.warn("[org-fs] sidecar config relay failed",D))}catch(D){throw this.closeForwarder($),await this.deleteHttpRouteIfManaged(u).catch(()=>{}),await KN(this.kubeConfig,this.namespace,u).catch(()=>{}),D}return{id:i,handle:u,adoptedSandboxName:w,token:f,workdir:E,daemonUrl:h,daemonForward:$,workload:t.workload??null,daemonBootId:d,tenant:t.tenant??null,ensureOpts:fnf(t)}}workloadConfigPayload(i){return ntu({runtime:i?.workload?.runtime??"node",packageManager:i?.workload?.packageManager?{name:i.workload.packageManager,...i.workload.packageManagerPath?{path:i.workload.packageManagerPath}:{}}:null,repo:i?.repo??null,port:i?.workload?.devPort??Qzf,tenant:i?.tenant??void 0})}async refreshDaemonGitCredential(i,u){let t=Rtu(u);if(!t)return;try{await B_(i.daemonUrl,i.token,t)}catch(f){console.warn(`[${i6}] git credential refresh failed for ${i.handle}: ${f instanceof Error?f.message:String(f)}`)}}async withFreshCloneUrl(i,u){if(!this.mintCloneUrl)return i;try{let t=await this.mintCloneUrl(i,u!==void 0?{bufferMs:u}:void 0);return t?{...i,cloneUrl:t}:i}catch(t){return console.warn(`[${i6}] clone credential re-mint failed: ${t instanceof Error?t.message:String(t)}`),i}}startCredentialRefresher(){if(!this.mintCloneUrl)return;let{signal:i}=this.claimWatchAbort;(async()=>{while(!i.aborted){if(await y0(Rzf,{signal:i}).catch(()=>{}),i.aborted)break;try{await this.refreshAllGitCredentials()}catch(u){console.warn(`[${i6}] periodic credential refresh failed: ${u instanceof Error?u.message:String(u)}`)}}})()}async refreshAllGitCredentials(){await WG0(this.records.values(),(i)=>i.ensureOpts?.repo?.connectionId,async(i)=>{if(this.claimWatchAbort.signal.aborted)return;let u=i.ensureOpts?.repo;if(!u)return;let t=await this.withFreshCloneUrl(u,bzf);await this.refreshDaemonGitCredential(i,{...i.ensureOpts,repo:t}),i.ensureOpts={...i.ensureOpts,repo:t}})}async rebootstrapDaemon(i,u,t){if(this.sentinelToken===null)return!1;let f=this.workloadConfigPayload(t)??{};try{return await B_(i,this.sentinelToken,f,{rotateToken:u}),!0}catch(l){if(l instanceof p1i&&l.status===401)try{return await B_(i,u,f,{rotateToken:u}),!0}catch(E){return console.warn(`[${i6}] re-bootstrap retry with claim token failed: ${E instanceof Error?E.message:String(E)}`),!1}return console.warn(`[${i6}] re-bootstrap failed: ${l instanceof Error?l.message:String(l)}`),!1}}async ensureServicePortForAdoptedSandbox(i){if(!this.previewGateway||!this.previewUrlPattern)return;await kG0(this.kubeConfig,this.namespace,i,{name:"daemon",port:YN,targetPort:YN})}async ensureHttpRouteForHandle(i,u,t){if(!this.previewGateway||!this.previewUrlPattern)return;let f=lnf(this.previewUrlPattern,i);if(!f)throw new pl(`Unable to derive preview hostname for ${i} from pattern: ${this.previewUrlPattern}`);let l={apiVersion:`${No.API_GROUP}/${No.API_VERSION}`,kind:"HTTPRoute",metadata:{name:i,namespace:this.namespace,labels:m4u(t??void 0,{[zh.role]:"claimed",[zh.sandboxHandle]:i,"app.kubernetes.io/name":"studio-sandbox","app.kubernetes.io/managed-by":"studio",...this.envName?{[zh.env]:this.envName}:{}})},spec:{parentRefs:[{kind:"Gateway",group:"gateway.networking.k8s.io",name:this.previewGateway.name,namespace:this.previewGateway.namespace}],hostnames:[f],rules:[{backendRefs:[{group:"",kind:"Service",name:u,port:YN}]}]}};await bgi(this.kubeConfig,this.namespace,l)}async deleteHttpRouteIfManaged(i){if(!this.previewGateway)return;await Cgi(this.kubeConfig,this.namespace,i)}async rehydrate(i,u,t){let f=t.state;if(!f.adoptedSandboxName&&!f.podName||!f.token)return null;let l=await n2(this.kubeConfig,this.namespace,u).catch(()=>{return});if(!l||!LG0(l))return null;let E=l.status?.sandbox?.name??f.adoptedSandboxName??f.podName??u,c=await this.openAndProbeDaemon(E,u);if(!c)return null;if(f.daemonBootId&&f.daemonBootId!==c.bootId){if(this.sentinelToken!==null){let w=f.ensureOpts?.repo?{...f.ensureOpts,repo:await this.withFreshCloneUrl(f.ensureOpts.repo)}:f.ensureOpts??null;if(!await this.rebootstrapDaemon(c.daemonUrl,f.token,w))return this.closeForwarder(c.daemonForward),null}else console.warn(`[${i6}] daemon restart detected (handle=${u}): stored bootId=${f.daemonBootId} live bootId=${c.bootId}`);await this.stateStore?.put(i,Xc,{handle:u,state:{...f,daemonBootId:c.bootId}}).catch((w)=>console.warn(`[${i6}] bootId persist failed for ${u}: ${w instanceof Error?w.message:String(w)}`))}return{id:i,handle:u,adoptedSandboxName:E,token:f.token,workdir:f.workdir??V4u,daemonUrl:c.daemonUrl,daemonForward:c.daemonForward,workload:f.workload??null,daemonBootId:c.bootId,tenant:f.tenant??null,ensureOpts:f.ensureOpts??null}}async adopt(i,u,t){if(!LG0(t))return null;let f=t.status?.sandbox?.name??u;if(this.sentinelToken!==null)return null;let l=rzf(t);if(!l)return null;let E=await this.openAndProbeDaemon(f,u);if(!E)return null;let c=tnf(t);if(this.previewGateway)await this.ensureServicePortForAdoptedSandbox(f).catch((w)=>{console.warn(`[${i6}] Service port backfill failed for ${u}: ${w instanceof Error?w.message:String(w)}`)}),await this.ensureHttpRouteForHandle(u,f,c).catch((w)=>{console.warn(`[${i6}] HTTPRoute backfill failed for ${u}: ${w instanceof Error?w.message:String(w)}`)});return{id:i,handle:u,adoptedSandboxName:f,token:l,workdir:V4u,daemonUrl:E.daemonUrl,daemonForward:E.daemonForward,workload:null,daemonBootId:E.bootId,tenant:c,ensureOpts:null}}async openAndProbeDaemon(i,u){let t=await this.openForwarder(i,YN,u).catch(()=>null);if(!t)return null;let f=`http://127.0.0.1:${t.localPort}`,l=await ili(f);if(!l)return this.closeForwarder(t),null;return{daemonForward:t,daemonUrl:f,bootId:l.bootId}}async getRecord(i){let u=this.records.get(i);if(u)return u;if(!this.stateStore)return null;let t=await this.stateStore.getByHandle(Xc,i);if(!t)return null;let f=await this.rehydrate(t.id,i,t);if(f)this.records.set(i,f);return f}async resurrectByHandle(i){if(!this.stateStore)return null;let u=await this.stateStore.getByHandle(Xc,i);if(!u)return null;let t=u.state.ensureOpts;if(!t)return null;let f=t.repo?{...t,repo:await this.withFreshCloneUrl(t.repo)}:t;return await this.ensure(u.id,f),this.records.get(i)??null}invalidateRecord(i){let u=this.records.get(i);if(!u)return;this.records.delete(i),this.closeForwarder(u.daemonForward)}recordProxyDuration(i,u,t,f,l){if(!this.metrics)return;this.metrics.proxyDurationMs.record(f,{...e4u(t?.tenant??null),source:i,sandbox_handle:t?.handle??l??"",status_code:u||0})}composePreviewUrl(i){if(this.previewUrlPattern)return U5i(this.previewUrlPattern,i.handle);return`http://127.0.0.1:${i.daemonForward.localPort}/`}toSandbox(i){return{handle:i.handle,workdir:i.workdir,previewUrl:this.composePreviewUrl(i)}}async persist(i,u){if(!i)return;let t={adoptedSandboxName:u.adoptedSandboxName,token:u.token,workdir:u.workdir,workload:u.workload,daemonBootId:u.daemonBootId,tenant:u.tenant,...u.ensureOpts?{ensureOpts:u.ensureOpts}:{}};await i.put(u.id,Xc,{handle:u.handle,state:t})}computeShutdownTime(){return new Date(Date.now()+this.idleTtlMs).toISOString()}openForwarder(i,u,t=i){let f=mzf(t,u);return new Promise((l,E)=>{let c=(w,$)=>{let h=HG0.createServer((v)=>this.handleForwardedConnection(v,i,u,t));h.once("error",(v)=>{if(v.code==="EADDRINUSE"&&$<Mzf){try{h.close()}catch{}let d=a4u+(w-a4u+1)%zG0;c(d,$+1);return}E(v)}),h.listen(w,"127.0.0.1",()=>{let v=h.address();if(!v||typeof v==="string"){h.close(),E(Error("port-forward listener failed to bind"));return}l({server:h,localPort:v.port})})};c(f,0)})}handleForwardedConnection(i,u,t,f){let l=new Yzf,E=null,c=!1,w=()=>{if(c)return;if(c=!0,l.destroy(),E)try{E.close()}catch{}if(!i.destroyed)i.destroy()};i.pipe(l),i.on("error",w),i.on("close",w),this.portForward.portForward(this.namespace,u,[t],i,null,l).then(($)=>{let h=typeof $==="function"?$():$;if(!h){w();return}if(E=h,E.on("close",w),E.on("error",()=>{this.invalidateRecord(f),w()}),c)try{E.close()}catch{}}).catch(($)=>{console.warn(`[${i6}] port-forward to ${u}:${t} failed: ${Wzf($)}`),this.invalidateRecord(f),w()})}closeForwarder(i){i.server.close((u)=>{if(u)console.warn(`[${i6}] port-forward close on :${i.localPort} errored: ${u instanceof Error?u.message:String(u)}`)})}close(){if(this.closed)return;this.closed=!0,this.claimWatchAbort.abort();for(let i of this.records.values())this.closeForwarder(i.daemonForward);this.records.clear()}}function qzf(i){return{active:i.createUpDownCounter("studio.sandbox.active",{description:"Active sandbox count, by runner kind and owning org. Cross-checks the cAdvisor-derived count from the cluster \u2014 divergence between the two indicates orphaned claims (studio deleted but K8s didn't reap) or unattributed pods.",unit:"{sandbox}"}),ensureOutcome:i.createCounter("studio.sandbox.ensure.outcome",{description:"Outcome of each ensure() call: fresh provision, resume from state-store after restart, or adopt of a cluster-side claim studio didn't know about. Cold-start ratio is the primary input for warm-pool sizing.",unit:"{call}"}),proxyDurationMs:i.createHistogram("studio.sandbox.proxy.duration_ms",{description:"Wall-clock latency of studio-mediated requests to the sandbox daemon: tool exec proxies (source=daemon) and preview iframe traffic (source=preview).",unit:"ms"})}}function Vzf(){let i=new az;return i.loadFromDefault(),i}function LG0(i){return Boolean(i.status?.conditions?.some((u)=>u.type==="Ready"&&u.status==="True"))}function rzf(i){let u=i.spec?.env;if(!u)return null;for(let t of u)if(t.name==="DAEMON_TOKEN"&&t.value)return t.value;return null}function mzf(i,u){let t=Xzf("sha256").update(`${i}:${u}`).digest();return a4u+t.readUInt32BE(0)%zG0}function r4u(i,u){return new Response(JSON.stringify(u),{status:i,headers:{"content-type":"application/json","access-control-allow-origin":"*"}})}function QG0(i){let u=i.slice(0,azf);return ezf.test(u)?u:""}function szf(i){if(i===void 0)return null;let u=i.trim();if(u==="")return null;if(!ozf.test(u))throw Error(`AgentSandboxProvider: envName=${JSON.stringify(u)} is not a valid DNS-label-safe environment name (lowercase alphanumeric or '-', starts with a letter, ends alphanumeric, \u226432 chars). Studio sets this from STUDIO_ENV; check the studio chart's configMap.`);return u}function m4u(i,u={}){let t={...u};if(i){let f=QG0(i.orgId),l=i.userId?QG0(i.userId):"";if(f)t[zh.orgId]=f;if(l)t[zh.userId]=l}return t}function SK(i){let u="";for(let t of i){let f=t.codePointAt(0)??0;u+=f<32||f===127?" ":t}return u.slice(0,pzf)}function inf(i){try{let u=new URL(i);return u.username="",u.password="",u.toString()}catch{return""}}function unf(i){let u={},t=i.tenant;if(t?.orgSlug)u[Gv.orgSlug]=SK(t.orgSlug);if(t?.orgName)u[Gv.orgName]=SK(t.orgName);if(t?.userEmail)u[Gv.userEmail]=SK(t.userEmail);if(t?.userName)u[Gv.userName]=SK(t.userName);let f=i.repo;if(f){if(f.displayName)u[Gv.gitRepo]=SK(f.displayName);let l=inf(f.cloneUrl);if(l)u[Gv.gitRepoUrl]=SK(l);let E=i.branch??f.branch;if(E)u[Gv.gitBranch]=SK(E)}return u}function tnf(i){let u=i.metadata?.labels;if(!u)return null;let t=u[zh.orgId],f=u[zh.userId];if(!t)return null;let l=i.metadata?.annotations??{};return{orgId:t,...f?{userId:f}:{},orgSlug:l[Gv.orgSlug],orgName:l[Gv.orgName],userEmail:l[Gv.userEmail],userName:l[Gv.userName]}}function e4u(i){return{org_id:i?.orgId??"",user_id:i?.userId??"",runner_kind:Xc}}function fnf(i){let u={};if(i.repo)u.repo=i.repo;if(i.workload)u.workload=i.workload;if(i.env&&Object.keys(i.env).length>0)u.env=i.env;if(i.tenant)u.tenant=i.tenant;return Object.keys(u).length>0?u:null}function lnf(i,u){try{return new URL(U5i(i,u)).hostname||null}catch{return null}}var Xc="agent-sandbox",i6="AgentSandboxProvider",LK="x-sandbox-preview-not-ready",Szf="agent-sandbox-system",Lzf="studio-sandbox",YN=9000,Qzf=3000,V4u="/app",Hzf=32,zzf,nzf=900000,Rzf=900000,bzf=1800000,Czf,SG0,a4u=40000,zG0=1e4,Mzf=256,zh,Gv,ezf,azf=63,ozf,pzf=253;var nG0=O(()=>{O4();Q4u();Eni();A5i();qgi();vo();YG0();zzf=new Set(["DAEMON_TOKEN","DAEMON_BOOT_ID","APP_ROOT","PROXY_PORT"]),Czf=["cookie","host","connection","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","accept-encoding","content-length","upgrade"],SG0=["connection","keep-alive","transfer-encoding","content-encoding","content-length"];zh={role:"studio.decocms.com/role",sandboxHandle:"studio.decocms.com/sandbox-handle",orgId:"studio.decocms.com/org-id",userId:"studio.decocms.com/user-id",env:"studio.decocms.com/env"},Gv={orgSlug:"studio.decocms.com/org-slug",orgName:"studio.decocms.com/org-name",userEmail:"studio.decocms.com/user-email",userName:"studio.decocms.com/user-name",gitRepo:"studio.decocms.com/git-repo",gitRepoUrl:"studio.decocms.com/git-repo-url",gitBranch:"studio.decocms.com/git-branch"},ezf=/^([A-Za-z0-9]([-A-Za-z0-9_.]*[A-Za-z0-9])?)?$/;ozf=/^[a-z]([a-z0-9-]{0,30}[a-z0-9])?$/});var RG0={};ji(RG0,{waitForSandboxReady:()=>Mgi,getSandboxClaim:()=>n2,getHttpRoute:()=>IG0,deleteSandboxClaim:()=>KN,deleteHttpRoute:()=>Cgi,createSandboxClaim:()=>_o,applyHttpRoute:()=>bgi,SandboxTimeoutError:()=>YK,SandboxError:()=>pl,PREVIEW_NOT_READY_HEADER:()=>LK,KubeConfig:()=>az,K8S_CONSTANTS:()=>Wl,HTTPROUTE_CONSTANTS:()=>No,AgentSandboxProvider:()=>o4u});var s4u=O(()=>{Q4u();vo();qgi();nG0()});class rgi{kind=WN;userSub;dispatch;stateStore;records=new Map;constructor(i){if(!i.userSub)throw Error("DesktopSandboxProvider requires userSub");if(!i.dispatch)throw Error("DesktopSandboxProvider requires dispatch");this.userSub=i.userSub,this.dispatch=i.dispatch,this.stateStore=i.stateStore??null}async ensure(i,u={}){let t=u.branch??u.repo?.branch,f=TN(i,t),l=this.records.get(f);if(l){if(await this.probeHealth(f))return this.toSandbox(l);if(this.records.delete(f),this.stateStore)await this.stateStore.deleteByHandle(WN,f).catch(()=>{})}else if(this.stateStore){let D=(await this.stateStore.getByHandle(WN,f))?.state,_=D?.sandboxApiUrl;if(_){if(await this.probeHealth(f)){let N={handle:f,sandboxApiUrl:_,previewUrl:D?.previewUrl??_};return this.records.set(f,N),this.toSandbox(N)}await this.stateStore.deleteByHandle(WN,f).catch(()=>{})}}let E=T5({userName:u.tenant?.userName,userEmail:u.tenant?.userEmail}),c=JSON.stringify({handle:f,repo:u.repo,branch:t,...u.workload?{workload:u.workload}:{},...E?{operator:E}:{},...u.offloadAllowedHosts?{offloadAllowedHosts:u.offloadAllowedHosts}:{},...u.offloadAllowSameHostDev!==void 0?{offloadAllowSameHostDev:u.offloadAllowSameHostDev}:{},...u.orgFsConfigJson?{orgFsConfigJson:u.orgFsConfigJson}:{}}),w=await this.dispatchJson("POST","/api/sandboxes",c),$=JSON.parse(w);if(typeof $.sandboxApiUrl!=="string")throw Error("desktop ensure: daemon did not return a sandboxApiUrl string");let h=typeof $.previewUrl==="string"?$.previewUrl:$.sandboxApiUrl,v={handle:f,sandboxApiUrl:$.sandboxApiUrl,previewUrl:h};if(this.records.set(f,v),this.stateStore)await this.stateStore.put(i,WN,{handle:f,state:{handle:f,sandboxApiUrl:$.sandboxApiUrl,previewUrl:h}});return this.toSandbox(v)}async proxyDaemonRequest(i,u,t){let f=u.startsWith("/")?u:`/${u}`,l=f.startsWith("/_sandbox/")?f.slice(9):f,E=`/_sandbox/${encodeURIComponent(i)}${l}`,c=new Headers(t.headers);for(let F of["host","cookie","connection","keep-alive","transfer-encoding","upgrade","authorization"])c.delete(F);let w={};c.forEach((F,g)=>{w[g]=F});let $;if(t.body!=null)$=await cnf(t.body);let v=this.dispatch(this.userSub,{method:t.method,path:E,headers:w,body:$},{signal:t.signal})[Symbol.asyncIterator](),d=Enf(),D=200,_={"content-type":"application/octet-stream"},N=[];try{while(!0){let F=await v.next();if(F.done)break;let g=F.value;if(g.headers){D=g.headers.status,_=g.headers.headers;break}if(g.data!=null){let T=d.push(g.data);if(T.length)N.push(T)}}}catch(F){let g=F instanceof Error?F.message:"dispatch error";return new Response(JSON.stringify({error:g}),{status:502,headers:{"content-type":"application/json"}})}let Z=!1,B=new ReadableStream({async start(F){for(let g of N)F.enqueue(g)},async pull(F){try{while(!0){let g=await v.next();if(Z)return;if(g.done){let U=d.flush();if(U.length)F.enqueue(U);F.close();return}let T=g.value;if(T.data!=null){let U=d.push(T.data);if(U.length){F.enqueue(U);return}}}}catch(g){if(!Z)F.error(g)}},cancel(){Z=!0,v.return?.()}});return new Response(B,{status:D,headers:_})}async alive(i){return this.probeHealth(i)}async probeHealth(i){let u=new AbortController,t=setTimeout(()=>u.abort(),3000);try{return await this.dispatchJson("GET",`/api/sandboxes/${encodeURIComponent(i)}`,void 0,u.signal),!0}catch{return!1}finally{clearTimeout(t)}}async forgetHandle(i){if(this.records.delete(i),this.stateStore)await this.stateStore.deleteByHandle(WN,i).catch(()=>{})}async delete(i){if(this.records.delete(i),this.stateStore)await this.stateStore.deleteByHandle(WN,i).catch(()=>{});try{await this.dispatchJson("DELETE",`/api/sandboxes/${encodeURIComponent(i)}`)}catch(u){if(!(u instanceof Error?u.message:String(u)).includes("404"))throw u}}async getPreviewUrl(i){return(await this.resolveRecord(i))?.previewUrl??null}async localWorkdir(i){return null}async*watchClaimLifecycle(i,u){yield{kind:"ready"}}toSandbox(i){return{handle:i.handle,workdir:i.sandboxApiUrl,previewUrl:i.previewUrl}}async resolveRecord(i){let u=this.records.get(i);if(u)return u;if(!this.stateStore)return null;let f=(await this.stateStore.getByHandle(WN,i))?.state,l=f?.sandboxApiUrl;if(!l)return null;let E={handle:i,sandboxApiUrl:l,previewUrl:f?.previewUrl??l};return this.records.set(i,E),E}async dispatchJson(i,u,t,f){let l={accept:"application/json"};if(t!==void 0)l["content-type"]="application/json";let E=this.dispatch(this.userSub,{method:i,path:u,headers:l,body:t},{signal:f}),c=null,w="";for await(let h of E)if(h.headers)c=h.headers.status;else if(h.data!=null)w+=h.data;let $=Buffer.from(w,"base64").toString("utf8");if(c!=null&&(c<200||c>=300))throw Error(`daemon returned ${c}: ${$}`);return $}}function bG0(i){return new rgi(i)}function Enf(){let i="";return{push(u){if(u.length===0)return p4u;i+=u;let t=i.length-i.length%4;if(t===0)return p4u;let f=i.slice(0,t);return i=i.slice(t),new Uint8Array(Buffer.from(f,"base64"))},flush(){if(i.length===0)return p4u;let u=i;return i="",new Uint8Array(Buffer.from(u,"base64"))}}}async function cnf(i){if(typeof i==="string")return i;if(i instanceof ArrayBuffer)return Buffer.from(i).toString("utf8");if(ArrayBuffer.isView(i))return Buffer.from(i.buffer,i.byteOffset,i.byteLength).toString("utf8");if(i instanceof URLSearchParams)return i.toString();return await new Response(i).text()}var WN="user-desktop",p4u;var CG0=O(()=>{A5i();s1i();p4u=new Uint8Array(0)});var MG0={};ji(MG0,{createDesktopProvider:()=>bG0,DesktopSandboxProvider:()=>rgi});var qG0=O(()=>{CG0()});var oG0={};ji(oG0,{subscribeLifecycle:()=>u1u,getSandboxProviderByKind:()=>Oo,getOrInitSharedRunner:()=>Nnf,buildDesktopProvider:()=>mgi,__resetSharedLifecyclesForTesting:()=>gnf});function eG0(i,u){let t=VG0[i];if(t)return Promise.resolve(t);let f=i1u[i];if(f)return f;let l=u().then((E)=>{return VG0[i]=E,E}).finally(()=>{delete i1u[i]});return i1u[i]=l,l}function hnf(){let i=process.env.STUDIO_SANDBOX_PREVIEW_URL_PATTERN;return i&&i.trim()!==""?i:void 0}function vnf(){let i=process.env.STUDIO_SANDBOX_TEMPLATE_NAME;return i&&i.trim()!==""?i:void 0}function dnf(){let i=process.env.STUDIO_ENV;return i&&i.trim()!==""?i:void 0}function Dnf(){let i=process.env.STUDIO_SANDBOX_SENTINEL_TOKEN;return i&&i.trim()!==""?i:void 0}function _nf(){let i=process.env.STUDIO_SANDBOX_PREVIEW_GATEWAY_NAME?.trim(),u=process.env.STUDIO_SANDBOX_PREVIEW_GATEWAY_NAMESPACE?.trim();if(!i&&!u)return;if(!i||!u)throw Error("STUDIO_SANDBOX_PREVIEW_GATEWAY_NAME and STUDIO_SANDBOX_PREVIEW_GATEWAY_NAMESPACE must both be set, or both unset. Half-configured per-claim HTTPRoute routing would silently fail to attach.");return{name:i,namespace:u}}async function aG0(i,u){let t=hnf();switch(i){case"agent-sandbox":{let f=new Mtu(u),{AgentSandboxProvider:l}=await Promise.resolve().then(() => (s4u(),RG0)),E=new u2(hu().encryptionKey);return new l({stateStore:f,previewUrlPattern:t,sandboxTemplateName:vnf(),envName:dnf(),previewGateway:_nf(),sentinelToken:Dnf(),meter:At,mintCloneUrl:async(c,w)=>{if(!c.connectionId)return null;let $=mF0(c.cloneUrl);if(!$)return null;let{cloneUrl:h}=await UN(c.connectionId,$.owner,$.name,u,E,{bufferMs:w?.bufferMs});return h}})}case"user-desktop":throw Error("user-desktop provider cannot be instantiated without a per-run link claim \u2014 call resolveSandboxProvider, which binds the link before constructing the provider.");default:throw Error(`Unknown sandbox provider kind: ${String(i)}`)}}async function mgi(i,u){let{DesktopSandboxProvider:t}=await Promise.resolve().then(() => (qG0(),MG0)),{getProxyDispatch:f}=await Promise.resolve().then(() => (f1u(),t1u)),l=new Ctu(i.db);if(!u)throw Error("buildDesktopProvider: userSub must be a non-empty string");let E=f();return new t({userSub:u,dispatch:E,stateStore:l})}function Oo(i,u){return eG0(u,()=>aG0(u,i.db))}async function Nnf(){let i;try{i=cg()}catch(t){return console.warn("[lifecycle] cannot resolve sandbox runner:",t instanceof Error?t.message:String(t)),null}return await eG0(i,()=>aG0(i,m0().db))}function u1u(i,u,t){let f=SN.get(u);if(f){if(f.terminated){if(f.lastPhase)try{t(f.lastPhase)}catch{}return{unsubscribe:Bnf}}if(f.listeners.add(t),f.lastPhase)try{t(f.lastPhase)}catch{}return rG0(u,f,t)}let l=new AbortController,E={lastPhase:null,terminated:!1,listeners:new Set([t]),abort:l};return SN.set(u,E),Fnf(i,u,E),rG0(u,E,t)}function Bnf(){}function rG0(i,u,t){return{unsubscribe(){if(SN.get(i)!==u)return;if(u.listeners.delete(t),u.listeners.size===0)SN.delete(i),u.abort.abort()}}}async function Fnf(i,u,t){let f=null;try{for await(let l of i.watchClaimLifecycle(u,t.abort.signal)){if(t.abort.signal.aborted)break;t.lastPhase=l;let E=l.kind==="ready"||l.kind==="failed";if(E)t.terminated=!0;let c=Array.from(t.listeners);for(let w of c)try{w(l)}catch{}if(E)break}}catch(l){f=l}finally{if(!t.terminated&&!t.abort.signal.aborted&&t.listeners.size>0){let l={kind:"failed",reason:"unknown",message:f instanceof Error?f.message:"Lifecycle watcher ended unexpectedly"};t.lastPhase=l,t.terminated=!0;for(let E of Array.from(t.listeners))try{E(l)}catch{}}if(SN.get(u)===t)SN.delete(u)}}function gnf(){for(let i of SN.values())i.abort.abort();SN.clear()}var wnf,$nf,mG0,VG0,i1u,Onf,Znf,SN;var Zo=O(()=>{Qh();b6();X1();QF0();MF0();Ma();XV();z0();wnf=Symbol.for("decocms.sandbox.lifecycle.runners"),$nf=Symbol.for("decocms.sandbox.lifecycle.inflight"),mG0=globalThis,VG0=mG0[wnf]??={},i1u=mG0[$nf]??={};Onf=Symbol.for("decocms.sandbox.lifecycle.shared-lifecycles"),Znf=globalThis,SN=Znf[Onf]??=new Map});function LN(i,u){return TN(i,u)}var Bo=O(()=>{Qh()});async function l1u(i,u){if(u.length===0)return;let t=await Oo(i,"agent-sandbox");for(let f=0;f<u.length;f+=sG0){let l=u.slice(f,f+sG0);await Promise.all(l.map(async(E)=>{let c=Lh({orgId:E.organizationId,virtualMcpId:E.virtualMcpId,branch:E.branch}),w=v8(c),$={organizationId:E.organizationId,virtualMcpId:E.virtualMcpId,branch:E.branch},h=await i.storage.agentSandboxSessions.withLock($,(v)=>v.beginDelete($,E.lastStartedBy));if(!h)return;await t.delete(h.sandboxHandle??LN(w,E.branch),w),await i.storage.agentSandboxSessions.withLock($,(v)=>v.completeDelete($,h.generation))}))}}async function pG0(i,u,t){while(!0){let f=await i.storage.agentSandboxSessions.listByVirtualMcp(u,t,{limit:200});if(f.length===0)return;await l1u(i,f)}}var sG0=20;var E1u=O(()=>{Qh();Zo();Bo()});import{z as c1u}from"zod";var Tnf,Unf,w1u;var iI0=O(()=>{ZN();Tv();fu();xa();N9();E1u();Tnf=c1u.object({id:c1u.string().describe("ID of the virtual MCP to delete")}),Unf=c1u.object({item:$c.describe("The deleted virtual MCP entity")}),w1u=ui({name:"COLLECTION_VIRTUAL_MCP_DELETE",description:"Permanently delete a Virtual MCP and its virtual tools.",annotations:{title:"Delete Virtual MCP",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:Tnf,outputSchema:Unf,handler:async(i,u)=>{gi(u);let t=Oi(u);await u.access.check();let f=await u.storage.virtualMcps.findById(i.id);if(!f)throw Error(`Virtual MCP not found: ${i.id}`);if(f.organization_id!==t.id)throw Error(`Virtual MCP not found: ${i.id}`);if(await pG0(u,t.id,i.id),await u.storage.virtualMcps.delete(i.id),u.orgFs)await Dtu(u.orgFs,i.id,Wu(u)??"system");let l=f.metadata?.githubRepo?.connectionId;if(l)try{let E=await u.storage.connections.findById(l,t.id);if(E&&Yh(E)){let w=await new r1(u.db,u.vault).get(l);if(w?.accessToken)try{await fetch("https://api.github.com/installation/token",{method:"DELETE",headers:{Authorization:`Bearer ${w.accessToken}`,Accept:"application/vnd.github+json","X-GitHub-Api-Version":"2022-11-28"},signal:AbortSignal.timeout(5000)})}catch{}await u.storage.connections.delete(l)}}catch(E){console.error("[VIRTUAL_MCP_DELETE] failed to tear down repo-scoped connection",{childConnectionId:l,error:E.message})}return{item:f}}})});import{z as Bw}from"zod";var Anf,$1u;var uI0=O(()=>{fu();Anf=Bw.object({id:Bw.string(),virtualMcpId:Bw.string(),pluginId:Bw.string(),connectionId:Bw.string().nullable(),settings:Bw.record(Bw.string(),Bw.unknown()).nullable(),createdAt:Bw.string(),updatedAt:Bw.string()}),$1u=ui({name:"VIRTUAL_MCP_PLUGIN_CONFIG_GET",description:"Get a plugin's current configuration for a specific virtual MCP.",annotations:{title:"Get Virtual MCP Plugin Config",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:Bw.object({virtualMcpId:Bw.string().describe("Virtual MCP ID"),pluginId:Bw.string().describe("Plugin ID")}),outputSchema:Bw.object({config:Anf.nullable()}),handler:async(i,u)=>{gi(u);let t=Oi(u);await u.access.check();let{virtualMcpId:f,pluginId:l}=i,E=await u.storage.connections.findById(f);if(!E||E.organization_id!==t.id)return{config:null};if(E.connection_type!=="VIRTUAL")return{config:null};let c=await u.storage.virtualMcpPluginConfigs.get(f,l);if(!c)return{config:null};return{config:{id:c.id,virtualMcpId:c.virtualMcpId,pluginId:c.pluginId,connectionId:c.connectionId,settings:c.settings,createdAt:c.createdAt instanceof Date?c.createdAt.toISOString():c.createdAt,updatedAt:c.updatedAt instanceof Date?c.updatedAt.toISOString():c.updatedAt}}}})});import{z as fE}from"zod";var ynf,h1u;var tI0=O(()=>{fu();rL();Ml();ynf=fE.object({id:fE.string(),virtualMcpId:fE.string(),pluginId:fE.string(),connectionId:fE.string().nullable(),settings:fE.record(fE.string(),fE.unknown()).nullable(),createdAt:fE.string(),updatedAt:fE.string()}),h1u=ui({name:"VIRTUAL_MCP_PLUGIN_CONFIG_UPDATE",description:"Set or update a plugin's configuration for a specific virtual MCP.",annotations:{title:"Update Virtual MCP Plugin Config",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:fE.object({virtualMcpId:fE.string().describe("Virtual MCP ID"),pluginId:fE.string().describe("Plugin ID"),connectionId:fE.string().nullable().optional().describe("MCP connection to bind"),settings:fE.record(fE.string(),fE.unknown()).nullable().optional().describe("Plugin-specific settings")}),outputSchema:fE.object({config:ynf}),handler:async(i,u)=>{gi(u);let t=Oi(u);await u.access.check();let{virtualMcpId:f,pluginId:l,connectionId:E,settings:c}=i,w=Wu(u),$=await u.storage.connections.findById(f);if(!$)throw Error(`Connection not found: ${f}`);if($.organization_id!==t.id)throw Error(`Connection not found: ${f}`);if($.connection_type!=="VIRTUAL")throw Error(`Connection not found: ${f}`);let h=E?await u.storage.connections.findById(E):null;if(E&&h&&h.organization_id!==t.id)throw Error(`Connection not found: ${E}`);if(E&&$.organization_id&&!h&&b5()&&_Ei(E,$.organization_id)){if(!w)throw Error("User ID required to create dev-assets connection");let d=VL($.organization_id,cl());await u.storage.connections.create({...d,organization_id:$.organization_id,created_by:w})}else if(E&&!h)throw Error(`Connection not found: ${E}`);let v=await u.storage.virtualMcpPluginConfigs.upsert(f,l,{connectionId:E,settings:c});return{config:{id:v.id,virtualMcpId:v.virtualMcpId,pluginId:v.pluginId,connectionId:v.connectionId,settings:v.settings,createdAt:v.createdAt instanceof Date?v.createdAt.toISOString():v.createdAt,updatedAt:v.updatedAt instanceof Date?v.updatedAt.toISOString():v.updatedAt}}}})});import{z as F3}from"zod";var Pnf,v1u;var fI0=O(()=>{fu();N9();Pnf=F3.object({connectionId:F3.string(),toolName:F3.string(),label:F3.string(),icon:F3.string().nullable().optional()}),v1u=ui({name:"VIRTUAL_MCP_PINNED_VIEWS_UPDATE",description:"Update the pinned sidebar views for a virtual MCP. Replaces all current pins.",annotations:{title:"Update Pinned Views",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:F3.object({virtualMcpId:F3.string().describe("Virtual MCP ID"),pinnedViews:F3.array(Pnf).describe("Pinned views to set for the virtual MCP sidebar"),layout:F3.object({defaultMainView:F3.object({type:F3.string(),id:F3.string().optional(),toolName:F3.string().optional()}).nullable().optional(),chatDefaultOpen:F3.boolean().nullable().optional()}).optional()}),outputSchema:F3.object({item:$c.nullable()}),handler:async(i,u)=>{gi(u);let t=Oi(u);await u.access.check();let{virtualMcpId:f,pinnedViews:l,layout:E}=i,c=Wu(u),w=await u.storage.virtualMcps.findById(f);if(!w)throw Error(`Virtual MCP not found: ${f}`);if(w.organization_id!==t.id)throw Error(`Virtual MCP not found: ${f}`);let $=w.metadata?.ui??{},h={...$,pinnedViews:l.length>0?l:null,layout:E??$.layout??null};return{item:await u.storage.virtualMcps.update(f,c??"system",{metadata:{...w.metadata,ui:h}})}}})});import{z as R2}from"zod";var Gnf,Inf,d1u;var lI0=O(()=>{fu();Gnf=R2.object({ids:R2.array(R2.string()).describe("Virtual MCP ids to look up")}),Inf=R2.object({items:R2.array(R2.object({id:R2.string(),last_used_at:R2.string().optional(),last_used_by:R2.string().optional()}))}),d1u=ui({name:"VIRTUAL_MCP_LAST_USED_LIST",description:"Get last-used info (timestamp + user) for one or more virtual MCPs, derived from the most recent thread per agent.",annotations:{title:"List Virtual MCP Last Used",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:Gnf,outputSchema:Inf,handler:async(i,u)=>{gi(u),Oi(u),await u.access.check();let t=await u.storage.threads.findLastUsedByVirtualMcpIds(i.ids);return{items:i.ids.map((f)=>({id:f,last_used_at:t.get(f)?.last_used_at,last_used_by:t.get(f)?.last_used_by}))}}})});var EI0=O(()=>{PF0();GF0();IF0();xF0();iI0();uI0();tI0();fI0();lI0()});import{z as I1}from"zod";var D1u;var cI0=O(()=>{X1();fu();D1u=ui({name:"MONITORING_LOG_GET",description:"Get a single monitoring log by ID with full input and output data.",annotations:{title:"Get Monitoring Log",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:I1.object({id:I1.string().describe("Log ID to fetch")}),outputSchema:I1.object({log:I1.object({id:I1.string().optional(),organizationId:I1.string(),connectionId:I1.string(),toolName:I1.string(),input:I1.record(I1.string(),I1.unknown()),output:I1.record(I1.string(),I1.unknown()),isError:I1.boolean(),errorMessage:I1.string().nullish(),durationMs:I1.number(),timestamp:I1.string(),userId:I1.string().nullish(),requestId:I1.string(),userAgent:I1.string().nullish(),virtualMcpId:I1.string().nullish(),properties:I1.record(I1.string(),I1.string()).nullish()}).nullable().describe("The monitoring log, or null if not found")}),handler:async(i,u)=>{await u.access.check(),await fh();let t=Oi(u),f=await u.storage.monitoring.getById(t.id,i.id);if(!f)return{log:null};return{log:{...f,timestamp:f.timestamp instanceof Date?f.timestamp.toISOString():f.timestamp}}}})});import{z as Ut}from"zod";var knf,_1u;var wI0=O(()=>{X1();fu();knf=Ut.object({id:Ut.string().optional().describe("Unique log identifier"),organizationId:Ut.string().describe("Organization ID"),connectionId:Ut.string().describe("Connection ID"),toolName:Ut.string().describe("Name of the tool that was called"),isError:Ut.boolean().describe("Whether the call resulted in an error"),errorMessage:Ut.string().nullish().describe("Error message if applicable"),durationMs:Ut.number().describe("Call duration in milliseconds"),timestamp:Ut.string().describe("ISO 8601 timestamp of the call"),userId:Ut.string().nullish().describe("User who triggered the call"),requestId:Ut.string().describe("Unique request identifier"),userAgent:Ut.string().nullish().describe("Client identifier (x-studio-client header)"),virtualMcpId:Ut.string().nullish().describe("Virtual MCP (Agent) ID if routed through an agent"),properties:Ut.record(Ut.string(),Ut.string()).nullish().describe("Custom key-value metadata attached to the log")}),_1u=ui({name:"MONITORING_LOGS_LIST",description:"List monitoring logs for tool calls with filtering and pagination.",annotations:{title:"List Monitoring Logs",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:Ut.object({connectionId:Ut.string().optional().describe("Filter by connection ID"),excludeConnectionIds:Ut.array(Ut.string()).optional().describe("Exclude logs from these connection IDs (e.g. system connections)"),virtualMcpId:Ut.string().optional().describe("Filter by Virtual MCP (Agent) ID"),toolName:Ut.string().optional().describe("Filter by tool name"),isError:Ut.boolean().optional().describe("Filter by error status"),startDate:Ut.string().datetime().optional().describe("Filter by start date (ISO 8601 datetime string)"),endDate:Ut.string().datetime().optional().describe("Filter by end date (ISO 8601 datetime string)"),limit:Ut.number().default(20).describe("Maximum number of results"),offset:Ut.number().default(0).describe("Offset for pagination"),properties:Ut.record(Ut.string(),Ut.string()).optional().describe("Filter by exact property key=value matches"),propertyKeys:Ut.array(Ut.string()).optional().describe("Filter by logs that have these property keys"),propertyPatterns:Ut.record(Ut.string(),Ut.string()).optional().describe("Filter by property value patterns (SQL LIKE, use % as wildcard)"),propertyInValues:Ut.record(Ut.string(),Ut.string()).optional().describe("Filter by exact match within comma-separated values (e.g., user_tags in 'Engineering')")}),outputSchema:Ut.object({logs:Ut.array(knf).describe("Array of monitoring logs"),total:Ut.number().describe("Total number of logs matching filters"),offset:Ut.number().describe("Current offset for pagination"),limit:Ut.number().describe("Current limit for pagination")}),handler:async(i,u)=>{await fh();let t=Oi(u),l=i.properties||i.propertyKeys||i.propertyPatterns||i.propertyInValues?{properties:i.properties,propertyKeys:i.propertyKeys,propertyPatterns:i.propertyPatterns,propertyInValues:i.propertyInValues}:void 0,E={organizationId:t.id,connectionId:i.connectionId,excludeConnectionIds:i.excludeConnectionIds,virtualMcpId:i.virtualMcpId,toolName:i.toolName,isError:i.isError,startDate:i.startDate?new Date(i.startDate):void 0,endDate:i.endDate?new Date(i.endDate):void 0,limit:i.limit,offset:i.offset,propertyFilters:l},c=await u.storage.monitoring.query(E);return{logs:c.logs.map(({input:w,output:$,...h})=>({...h,timestamp:h.timestamp instanceof Date?h.timestamp.toISOString():h.timestamp})),total:c.total,offset:i.offset,limit:i.limit}}})});import{z as D0}from"zod";var N1u;var $I0=O(()=>{X1();fu();N1u=ui({name:"MONITORING_STATS",description:"Get aggregated statistics (counts, latency, error rates) for tool call monitoring.",annotations:{title:"Get Monitoring Stats",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:D0.object({startDate:D0.string().datetime().optional().describe("Filter by start date (ISO 8601 datetime string)"),endDate:D0.string().datetime().optional().describe("Filter by end date (ISO 8601 datetime string)"),interval:D0.string().regex(/^\d+[mhd]$/).optional().describe("Bucket interval for timeseries data (e.g. 1m, 5m, 2h, 1d). When provided, returns timeseries array."),connectionIds:D0.array(D0.string()).max(100).optional().describe("Filter by specific connection IDs (max 100)"),excludeConnectionIds:D0.array(D0.string()).max(100).optional().describe("Exclude specific connection IDs (max 100)"),toolNames:D0.array(D0.string()).max(100).optional().describe("Filter by specific tool names (max 100)"),status:D0.enum(["success","error"]).optional().describe("Filter metrics by execution status"),topN:D0.number().int().min(1).max(20).optional().describe("When provided with interval, also return top tools and their timeseries"),userIds:D0.array(D0.string()).max(100).optional().describe("Filter LLM usage by user IDs (only applied when llmUsage is true)"),llmUsage:D0.boolean().optional().describe("Aggregate LLM-call usage (tokens + USD cost) from raw log rows for the given connection. Returns token/cost totals and timeseries. Requires interval.")}),outputSchema:D0.object({totalCalls:D0.number().describe("Total number of tool calls"),errorRate:D0.number().optional().describe("Error rate as a decimal (0 to 1)"),avgDurationMs:D0.number().describe("Average call duration in milliseconds"),errorRatePercent:D0.string().optional().describe("Error rate as a percentage string"),totalErrors:D0.number().optional().describe("Total number of errors"),p50DurationMs:D0.number().optional().describe("50th percentile duration in milliseconds"),p95DurationMs:D0.number().optional().describe("95th percentile duration in milliseconds"),connectionBreakdown:D0.array(D0.object({connectionId:D0.string(),calls:D0.number(),errors:D0.number(),errorRate:D0.number(),avgDurationMs:D0.number()})).optional().describe("Per-connection metric breakdown"),totalInputTokens:D0.number().optional().describe("Total input tokens (LLM usage mode)"),totalOutputTokens:D0.number().optional().describe("Total output tokens (LLM usage mode)"),totalTokens:D0.number().optional().describe("Total tokens (LLM usage mode)"),totalCostUsd:D0.number().optional().describe("Total USD cost (LLM usage mode; only non-zero for providers that report cost)"),topTools:D0.array(D0.object({toolName:D0.string(),connectionId:D0.string().nullable(),calls:D0.number(),inputTokens:D0.number().optional(),outputTokens:D0.number().optional(),costUsd:D0.number().optional()})).optional().describe("Top tools ranked by calls"),topToolsTimeseries:D0.array(D0.object({timestamp:D0.string(),toolName:D0.string(),calls:D0.number(),errors:D0.number(),avg:D0.number(),p95:D0.number()})).optional().describe("Per-tool metric timeseries for the top tools"),timeseries:D0.array(D0.object({timestamp:D0.string(),calls:D0.number(),errors:D0.number(),errorRate:D0.number(),avg:D0.number(),p50:D0.number(),p95:D0.number(),inputTokens:D0.number().optional(),outputTokens:D0.number().optional(),totalTokens:D0.number().optional(),costUsd:D0.number().optional()})).optional().describe("Timeseries data points bucketed by interval")}),handler:async(i,u)=>{let t=Oi(u);if(await u.access.check(),await fh(),i.interval&&i.llmUsage)return u.storage.monitoring.queryLlmUsageStats({organizationId:t.id,interval:i.interval,connectionId:i.connectionIds?.[0]??"decopilot",startDate:i.startDate?new Date(i.startDate):void 0,endDate:i.endDate?new Date(i.endDate):void 0,userIds:i.userIds,topN:i.topN});if(i.interval){let l=await u.storage.monitoring.queryMetricTimeseries({organizationId:t.id,interval:i.interval,startDate:i.startDate?new Date(i.startDate):void 0,endDate:i.endDate?new Date(i.endDate):void 0,filters:{connectionIds:i.connectionIds,excludeConnectionIds:i.excludeConnectionIds,toolNames:i.toolNames,status:i.status}});if(!i.topN)return l;let E=await u.storage.monitoring.queryMetricTopToolsTimeseries({organizationId:t.id,interval:i.interval,startDate:i.startDate?new Date(i.startDate):void 0,endDate:i.endDate?new Date(i.endDate):void 0,topN:i.topN,filters:{connectionIds:i.connectionIds,excludeConnectionIds:i.excludeConnectionIds,toolNames:i.toolNames,status:i.status}});return{...l,topTools:E.topTools,topToolsTimeseries:E.timeseries}}let f=await u.storage.monitoring.getStats({organizationId:t.id,startDate:i.startDate?new Date(i.startDate):void 0,endDate:i.endDate?new Date(i.endDate):void 0});return{...f,errorRatePercent:(f.errorRate*100).toFixed(2)}}})});import{z as g3}from"zod";var O1u;var hI0=O(()=>{X1();fu();O1u=ui({name:"MONITORING_THREAD_USAGE",description:"Aggregate LLM token usage and USD cost per thread for the given thread IDs.",annotations:{title:"Get Thread Usage",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:g3.object({threadIds:g3.array(g3.string()).min(1).max(500).describe("Thread IDs to aggregate usage for (max 500)"),connectionId:g3.string().optional().describe("LLM connection ID (defaults to 'decopilot')"),startDate:g3.string().datetime().optional().describe("Filter by start date (ISO 8601 datetime string)"),endDate:g3.string().datetime().optional().describe("Filter by end date (ISO 8601 datetime string)")}),outputSchema:g3.object({items:g3.array(g3.object({threadId:g3.string(),calls:g3.number(),inputTokens:g3.number(),outputTokens:g3.number(),totalTokens:g3.number(),costUsd:g3.number()}))}),handler:async(i,u)=>{let t=Oi(u);return await u.access.check(),await fh(),{items:await u.storage.monitoring.queryThreadUsage({organizationId:t.id,connectionId:i.connectionId??"decopilot",threadIds:i.threadIds,startDate:i.startDate?new Date(i.startDate):void 0,endDate:i.endDate?new Date(i.endDate):void 0})}}})});var vI0=O(()=>{cI0();wI0();$I0();hI0()});function egi(i){return typeof i==="string"&&Xnf.has(i.trim().toLowerCase())}var Xnf;var Z1u=O(()=>{Xnf=new Set([".well-known","_admin","api","auth","cli","commerce-onboarding","dbos-queue-depth","health","hosted-run-pending","login","mcp","metrics","oauth","oauth-proxy","onboarding","org","report","reset-password"])});import{z as A$}from"zod";var B1u;var dI0=O(()=>{fu();Z1u();B1u=ui({name:"ORGANIZATION_CREATE",description:"Create a new organization. The caller becomes the owner automatically.",annotations:{title:"Create Organization",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!1,openWorldHint:!1},inputSchema:A$.object({slug:A$.string().min(1).max(50).regex(/^[a-z0-9-]+$/,"Slug must be lowercase alphanumeric with hyphens").refine((i)=>!egi(i),"Slug is reserved by Studio"),name:A$.string().min(1).max(255),description:A$.string().optional()}),outputSchema:A$.object({id:A$.string(),name:A$.string(),slug:A$.string(),logo:A$.string().nullable().optional(),metadata:A$.any().optional(),createdAt:A$.string().datetime().describe("ISO 8601 timestamp"),members:A$.array(A$.any()).optional()}),handler:async(i,u)=>{gi(u),await u.access.check();let t=Wu(u);if(!t)throw Error("User ID required to create organization");let f=await u.boundAuth.organization.create({name:i.name,slug:i.slug,metadata:i.description?{description:i.description}:void 0,userId:t});if(!f)throw Error("Failed to create organization");return{...f,createdAt:f.createdAt instanceof Date?f.createdAt.toISOString():f.createdAt}}})});import{z as Iv}from"zod";var F1u;var DI0=O(()=>{fu();F1u=ui({name:"ORGANIZATION_LIST",description:"List organizations the current user belongs to.",annotations:{title:"List Organizations",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},_meta:{ui:{visibility:"app"}},inputSchema:Iv.object({userId:Iv.string().optional()}),outputSchema:Iv.object({organizations:Iv.array(Iv.object({id:Iv.string(),name:Iv.string(),slug:Iv.string(),logo:Iv.string().nullable().optional(),metadata:Iv.any().optional(),createdAt:Iv.string().datetime().describe("ISO 8601 timestamp")}))}),handler:async(i,u)=>{gi(u),await u.access.check();let t=Wu(u),f=i.userId||t;if(!f)throw Error("User ID required to list organizations");return{organizations:(await u.boundAuth.organization.list(f)).map((E)=>({...E,createdAt:E.createdAt instanceof Date?E.createdAt.toISOString():E.createdAt}))}}})});import{z as nh}from"zod";var g1u;var _I0=O(()=>{fu();g1u=ui({name:"ORGANIZATION_GET",description:"Get an organization's details, members, and settings by slug or ID.",annotations:{title:"Get Organization",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:nh.object({}),outputSchema:nh.object({id:nh.string(),name:nh.string(),slug:nh.string(),logo:nh.string().nullable().optional(),metadata:nh.any().optional(),createdAt:nh.string().datetime().describe("ISO 8601 timestamp"),members:nh.array(nh.any()).optional(),invitations:nh.array(nh.any()).optional()}),handler:async(i,u)=>{gi(u),await u.access.check();let t=u.organization?.id;if(!t)throw Error("Organization ID required (no active organization in context)");let f=await u.boundAuth.organization.get(t);if(!f)throw Error("No active organization found");let l=new Date,E=f.invitations?.filter((c)=>new Date(c.expiresAt)>l);return{...f,invitations:E,createdAt:f.createdAt instanceof Date?f.createdAt.toISOString():f.createdAt}}})});import{z as xv}from"zod";var T1u;var NI0=O(()=>{fu();T1u=ui({name:"ORGANIZATION_UPDATE",description:"Update an organization's name or description.",annotations:{title:"Update Organization",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:xv.object({id:xv.string(),name:xv.string().min(1).max(255).optional(),description:xv.string().optional()}),outputSchema:xv.object({id:xv.string(),name:xv.string(),slug:xv.string(),logo:xv.string().nullable().optional(),metadata:xv.any().optional(),createdAt:xv.string().datetime().describe("ISO 8601 timestamp")}),handler:async(i,u)=>{gi(u),await u.access.check();let t={};if(i.name)t.name=i.name;if(i.description)t.metadata={description:i.description};let f=await u.boundAuth.organization.update({organizationId:i.id,data:t});if(!f)throw Error("Failed to update organization");return{...f,createdAt:f.createdAt instanceof Date?f.createdAt.toISOString():f.createdAt}}})});import{z as Fo}from"zod";var U1u;var OI0=O(()=>{fu();U1u=ui({name:"ORGANIZATION_DELETE",description:"Archive an organization (soft delete).",annotations:{title:"Delete Organization",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:Fo.object({id:Fo.string()}),outputSchema:Fo.object({success:Fo.boolean(),id:Fo.string()}),handler:async(i,u)=>{return gi(u),await u.access.check(),await u.boundAuth.organization.update({organizationId:i.id,data:{metadata:{archived:!0,archivedAt:new Date().toISOString()}}}),{success:!0,id:i.id}}})});import{z as M0}from"zod";var go,To,tn,ZI0,agi,Uo,Ao,QN;var b2=O(()=>{go=M0.object({title:M0.string(),url:M0.string(),icon:M0.string()}),To=M0.object({registries:M0.record(M0.string(),M0.object({enabled:M0.boolean()})).describe("Per-registry enabled/disabled state. Key is connection ID. Absent registries are treated as enabled."),blockedMcps:M0.array(M0.string()).describe("List of MCP app_name or app_id values to hide from the store.")}),tn=M0.object({keyId:M0.string(),modelId:M0.string(),title:M0.string().optional()}).nullable(),ZI0=M0.enum(["fast","smart","thinking","image","web_search","deep_research"]),agi=M0.enum(["fast","smart","thinking"]),Uo=M0.object({tiers:M0.object({fast:tn,smart:tn,thinking:tn,image:tn,web_search:tn,deep_research:tn})}),Ao=M0.object({ids:M0.array(M0.string()).describe("Ordered list of custom virtual MCP agent ids to show on the home view.")}),QN=M0.object({id:M0.string().describe("Brand context ID"),name:M0.string().describe("Company name"),domain:M0.string().describe("Company domain (e.g. example.com)"),overview:M0.string().describe("Company overview / description"),logo:M0.string().nullable().optional().describe("Logo URL"),favicon:M0.string().nullable().optional().describe("Favicon URL"),ogImage:M0.string().nullable().optional().describe("OG image URL"),fonts:M0.object({heading:M0.string().optional().describe("Font family for headings"),body:M0.string().optional().describe("Font family for body text"),code:M0.string().optional().describe("Font family for code / monospace")}).nullable().optional().describe("Font families by semantic role"),colors:M0.object({primary:M0.string().optional().describe("Primary brand color (hex)"),secondary:M0.string().optional().describe("Secondary brand color (hex)"),accent:M0.string().optional().describe("Accent / highlight color (hex)"),background:M0.string().optional().describe("Background color (hex)"),foreground:M0.string().optional().describe("Foreground / text color (hex)")}).nullable().optional().describe("Semantic color palette"),images:M0.array(M0.record(M0.string(),M0.unknown())).nullable().optional().describe("Brand images"),metadata:M0.record(M0.string(),M0.unknown()).nullable().optional().describe("Extra design tokens (typography, components, spacing, layout, tone, etc.)"),archivedAt:M0.string().nullable().optional().describe("Archive timestamp (null to unarchive)"),isDefault:M0.boolean().optional().describe("Whether this is the default brand for the organization")})});import{z as C2}from"zod";var A1u;var BI0=O(()=>{fu();b2();A1u=ui({name:"ORGANIZATION_SETTINGS_GET",description:"Get organization-level settings including sidebar configuration, store registry settings, simple model mode, and default home agents.",annotations:{title:"Get Organization Settings",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:C2.object({}),outputSchema:C2.object({organizationId:C2.string(),sidebar_items:C2.array(go).nullable().optional(),enabled_plugins:C2.array(C2.string()).nullable().optional(),registry_config:To.nullable().optional(),simple_mode:Uo.nullable().optional(),default_home_agents:Ao.nullable().optional(),reports_only:C2.boolean().nullable().optional(),createdAt:C2.string().datetime().optional().describe("ISO 8601 timestamp"),updatedAt:C2.string().datetime().optional().describe("ISO 8601 timestamp")}),handler:async(i,u)=>{gi(u),await u.access.check();let t=u.organization?.id;if(!t)throw Error("Organization ID required (no active organization in context)");let f=await u.storage.organizationSettings.get(t);if(!f)return{organizationId:t};return{...f,createdAt:f.createdAt instanceof Date?f.createdAt.toISOString():f.createdAt,updatedAt:f.updatedAt instanceof Date?f.updatedAt.toISOString():f.updatedAt}}})});import{z as Fw}from"zod";var y1u;var FI0=O(()=>{fu();b2();y1u=ui({name:"ORGANIZATION_SETTINGS_UPDATE",description:"Update organization-level settings such as sidebar configuration, store registry settings, simple model mode, and default home agents.",annotations:{title:"Update Organization Settings",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:Fw.object({organizationId:Fw.string(),sidebar_items:Fw.array(go).optional(),enabled_plugins:Fw.array(Fw.string()).optional(),registry_config:To.optional(),simple_mode:Uo.optional(),default_home_agents:Ao.optional(),reports_only:Fw.boolean().optional()}),outputSchema:Fw.object({organizationId:Fw.string(),sidebar_items:Fw.array(go).nullable().optional(),enabled_plugins:Fw.array(Fw.string()).nullable().optional(),registry_config:To.nullable().optional(),simple_mode:Uo.nullable().optional(),default_home_agents:Ao.nullable().optional(),reports_only:Fw.boolean().nullable().optional(),createdAt:Fw.string().datetime().describe("ISO 8601 timestamp"),updatedAt:Fw.string().datetime().describe("ISO 8601 timestamp")}),handler:async(i,u)=>{if(gi(u),await u.access.check(),Oi(u).id!==i.organizationId)throw Error("Cannot update settings for a different organization");let f=await u.storage.organizationSettings.upsert(i.organizationId,{sidebar_items:i.sidebar_items,enabled_plugins:i.enabled_plugins,registry_config:i.registry_config,simple_mode:i.simple_mode,default_home_agents:i.default_home_agents,reports_only:i.reports_only});return{...f,createdAt:f.createdAt instanceof Date?f.createdAt.toISOString():f.createdAt,updatedAt:f.updatedAt instanceof Date?f.updatedAt.toISOString():f.updatedAt}}})});import{z as kv}from"zod";var gI0,P1u,G1u;var TI0=O(()=>{fu();b2();gI0=QN.extend({organizationId:kv.string(),archivedAt:kv.string().nullable().optional().describe("ISO 8601 timestamp"),createdAt:kv.string().describe("ISO 8601 timestamp"),updatedAt:kv.string().describe("ISO 8601 timestamp")}),P1u=ui({name:"BRAND_CONTEXT_LIST",description:"List all brand contexts (company profiles) for the current organization.",annotations:{title:"List Brand Contexts",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:kv.object({includeArchived:kv.boolean().optional().describe("Include archived brands in the list")}),outputSchema:kv.object({items:kv.array(gI0)}),handler:async(i,u)=>{gi(u),await u.access.check();let t=u.organization?.id;if(!t)throw Error("Organization ID required (no active organization in context)");return{items:(await u.storage.brandContext.list(t,{includeArchived:i.includeArchived})).map((l)=>({...l,archivedAt:l.archivedAt instanceof Date?l.archivedAt.toISOString():l.archivedAt,createdAt:l.createdAt instanceof Date?l.createdAt.toISOString():l.createdAt,updatedAt:l.updatedAt instanceof Date?l.updatedAt.toISOString():l.updatedAt}))}}}),G1u=ui({name:"BRAND_CONTEXT_GET",description:"Get a specific brand context by ID.",annotations:{title:"Get Brand Context",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:kv.object({id:kv.string().describe("Brand context ID")}),outputSchema:gI0.extend({organizationId:kv.string()}),handler:async(i,u)=>{gi(u),await u.access.check();let t=u.organization?.id;if(!t)throw Error("Organization ID required (no active organization in context)");let f=await u.storage.brandContext.get(i.id,t);if(!f)throw Error("Brand context not found");return{...f,archivedAt:f.archivedAt instanceof Date?f.archivedAt.toISOString():f.archivedAt,createdAt:f.createdAt instanceof Date?f.createdAt.toISOString():f.createdAt,updatedAt:f.updatedAt instanceof Date?f.updatedAt.toISOString():f.updatedAt}}})});import{z as QK}from"zod";var UI0,I1u,x1u,k1u;var AI0=O(()=>{fu();b2();UI0=QN.extend({organizationId:QK.string(),createdAt:QK.string().describe("ISO 8601 timestamp"),updatedAt:QK.string().describe("ISO 8601 timestamp")}),I1u=ui({name:"BRAND_CONTEXT_CREATE",description:"Create a new brand context (company profile) for the current organization.",annotations:{title:"Create Brand Context",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!1,openWorldHint:!1},inputSchema:QN.omit({id:!0}),outputSchema:UI0,handler:async(i,u)=>{gi(u),await u.access.check();let t=u.organization?.id;if(!t)throw Error("Organization ID required (no active organization in context)");let f=await u.storage.brandContext.create(t,{name:i.name,domain:i.domain,overview:i.overview,logo:i.logo??null,favicon:i.favicon??null,ogImage:i.ogImage??null,fonts:i.fonts??null,colors:i.colors??null,images:i.images??null,metadata:i.metadata??null});return{...f,archivedAt:f.archivedAt instanceof Date?f.archivedAt.toISOString():f.archivedAt,createdAt:f.createdAt instanceof Date?f.createdAt.toISOString():f.createdAt,updatedAt:f.updatedAt instanceof Date?f.updatedAt.toISOString():f.updatedAt}}}),x1u=ui({name:"BRAND_CONTEXT_UPDATE",description:"Update an existing brand context by ID.",annotations:{title:"Update Brand Context",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:QN.partial().required({id:!0}),outputSchema:UI0,handler:async(i,u)=>{gi(u),await u.access.check();let t=u.organization?.id;if(!t)throw Error("Organization ID required (no active organization in context)");if(!await u.storage.brandContext.get(i.id,t))throw Error("Brand context not found");let{id:l,...E}=i;if(E.isDefault===!0)await u.storage.brandContext.setDefault(l,t);let c=await u.storage.brandContext.update(l,t,{name:E.name,domain:E.domain,overview:E.overview,logo:E.logo!==void 0?E.logo??null:void 0,favicon:E.favicon!==void 0?E.favicon??null:void 0,ogImage:E.ogImage!==void 0?E.ogImage??null:void 0,fonts:E.fonts!==void 0?E.fonts??null:void 0,colors:E.colors!==void 0?E.colors??null:void 0,images:E.images!==void 0?E.images??null:void 0,metadata:E.metadata!==void 0?E.metadata??null:void 0,archivedAt:E.archivedAt!==void 0?E.archivedAt??null:void 0,isDefault:E.isDefault===!1?!1:void 0});return{...c,archivedAt:c.archivedAt instanceof Date?c.archivedAt.toISOString():c.archivedAt,createdAt:c.createdAt instanceof Date?c.createdAt.toISOString():c.createdAt,updatedAt:c.updatedAt instanceof Date?c.updatedAt.toISOString():c.updatedAt}}}),k1u=ui({name:"BRAND_CONTEXT_DELETE",description:"Archive a brand context by ID (soft delete).",annotations:{title:"Archive Brand Context",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:QK.object({id:QK.string().describe("Brand context ID")}),outputSchema:QK.object({success:QK.boolean()}),handler:async(i,u)=>{gi(u),await u.access.check();let t=u.organization?.id;if(!t)throw Error("Organization ID required (no active organization in context)");if(!await u.storage.brandContext.get(i.id,t))throw Error("Brand context not found");return await u.storage.brandContext.update(i.id,t,{archivedAt:new Date().toISOString(),isDefault:!1}),{success:!0}}})});async function ogi(i,u,t){let f=i.trim();if(!f.startsWith("http"))f=`https://${f}`;let l=await fetch("https://api.firecrawl.dev/v1/scrape",{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${u}`},body:JSON.stringify({url:f,formats:["branding"]})});if(!l.ok){let D=await l.text().catch(()=>"");throw Error(`Firecrawl API error: ${l.status} ${D.slice(0,200)}`)}let E=await l.json();if(!E.success||!E.data?.branding)return null;let c=E.data.branding,w=E.data.metadata??{},$=Ynf(c,w);return{name:w.title?.split(/[|\u2013\u2014]|\s+-\s+/).map((D)=>D.trim()).filter(Boolean)?.slice().sort((D,_)=>D.length-_.length)[0]??w.ogSiteName??t??i,domain:i,overview:w.description??"",logo:$.logo,favicon:$.favicon,ogImage:$.ogImage,fonts:$.fonts,colors:$.colors,images:null,metadata:Object.keys($.metadata).length>0?$.metadata:null}}function Ynf(i,u){let t=i.images??{},f=i.colors??{},l={};for(let[v,d]of Object.entries(f))if(typeof d==="string"&&d&&Jnf.has(v))l[v]=d;let E={},w=(i.typography??{}).fontFamilies??{};for(let[v,d]of Object.entries(w))if(typeof d==="string"&&d){let D=Knf[v.toLowerCase()];if(D&&!E[D])E[D]=d}let $=i.fonts;if(Array.isArray($))for(let v of $){let d=v.family;if(typeof d==="string"&&d&&!E.body)E.body=d}let h={};for(let v of["typography","components","spacing","layout","animations","icons","tone","personality","colorScheme"])if(i[v]!==void 0)h[v]=i[v];return{logo:t.logo??null,favicon:t.favicon??null,ogImage:t.ogImage??u.ogImage??null,fonts:Object.keys(E).length>0?E:null,colors:Object.keys(l).length>0?l:null,metadata:h}}var Jnf,Knf;var j1u=O(()=>{Jnf=new Set(["primary","secondary","accent","background","foreground"]),Knf={heading:"heading",headings:"heading",head:"heading",title:"heading",body:"body",primary:"body",text:"body",code:"code",monospace:"code",mono:"code"}});import{z as sgi}from"zod";var Wnf,X1u;var yI0=O(()=>{fu();j1u();b2();Wnf=QN.pick({id:!0,name:!0,domain:!0,overview:!0,logo:!0,favicon:!0,ogImage:!0,fonts:!0,colors:!0}).extend({success:sgi.boolean()}),X1u=ui({name:"BRAND_CONTEXT_EXTRACT",description:"Extract brand context (colors, fonts, logos) from a website URL using Firecrawl.",annotations:{title:"Extract Brand Context",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!0},inputSchema:sgi.object({domain:sgi.string().describe("Website domain to extract brand from"),brandId:sgi.string().optional().describe("Existing brand context ID to update (creates new if omitted)")}),outputSchema:Wnf,modelSummary:(i)=>i.success?`Brand saved (id=${i.id}, name=${i.name}, domain=${i.domain}). The UI rendered the logo, colors, fonts, and overview.`:"Brand extraction failed.",handler:async(i,u)=>{gi(u),await u.access.check();let t=u.organization?.id;if(!t)throw Error("Organization ID required (no active organization in context)");let f=u.firecrawlApiKey;if(!f)throw Error("FIRECRAWL_API_KEY is not configured. Set the environment variable to enable brand extraction.");let l=await ogi(i.domain,f,i.domain);if(!l)throw Error("Firecrawl did not return branding data for this URL");let E={name:l.name,domain:l.domain,overview:l.overview,logo:l.logo,favicon:l.favicon,ogImage:l.ogImage,fonts:l.fonts,colors:l.colors,images:l.images,metadata:l.metadata},c=i.brandId?await(async()=>{if(!await u.storage.brandContext.get(i.brandId,t))throw Error("Brand context not found");return u.storage.brandContext.update(i.brandId,t,E)})():await u.storage.brandContext.create(t,E);return{id:c.id,name:c.name,domain:c.domain,overview:c.overview,logo:c.logo,favicon:c.favicon,ogImage:c.ogImage,fonts:c.fonts,colors:c.colors,success:!0}}})});function PI0(i){let u=i.metadata??{};return{id:i.id,name:i.name,domain:i.domain||void 0,colors:i.colors??void 0,fonts:i.fonts??void 0,assets:i.logo||i.favicon||i.ogImage?{logo:i.logo??void 0,favicon:i.favicon??void 0,ogImage:i.ogImage??void 0}:void 0,overview:i.overview||void 0,tagline:typeof u.tagline==="string"?u.tagline:void 0,tone:typeof u.tone==="string"?u.tone:void 0,metadata:(()=>{let t=Object.fromEntries(Object.entries(u).filter(([f])=>f!=="tagline"&&f!=="tone"));return Object.keys(t).length>0?t:void 0})()}}var J1u,K1u;var GI0=O(()=>{ytu();fu();J1u=ui({name:"BRAND_GET",description:"Get a brand context by ID. Omit the ID to get the default brand for the organization.",annotations:{title:"Get Brand",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:h5i,outputSchema:Ka,handler:async(i,u)=>{gi(u),await u.access.check();let t=u.organization?.id;if(!t)throw Error("Organization ID required (no active organization in context)");let f=i.id?await u.storage.brandContext.get(i.id,t):await u.storage.brandContext.getDefault(t);if(!f)throw Error(i.id?"Brand not found":"No default brand configured");return PI0(f)}}),K1u=ui({name:"BRAND_LIST",description:"List all active brands for the current organization.",annotations:{title:"List Brands",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:v5i,outputSchema:d5i,handler:async(i,u)=>{gi(u),await u.access.check();let t=u.organization?.id;if(!t)throw Error("Organization ID required (no active organization in context)");return{items:(await u.storage.brandContext.list(t)).map(PI0)}}})});import{resolveTxt as Snf}from"dns/promises";function Y1u(i){return`${Lnf}.${i.toLowerCase()}`}function II0(){return`deco-verify-${crypto.randomUUID().replace(/-/g,"")}`}async function xI0(i,u,t=Snf){if(!u)return!1;try{return(await t(Y1u(i))).some((l)=>l.join("").trim()===u)}catch{return!1}}var Lnf="_deco-verify";var kI0=()=>{};import{z as L1}from"zod";function HN(i){let u=i.verificationStatus==="pending"&&Boolean(i.verificationToken);return{id:i.id,domain:i.domain,joinMode:i.joinMode,verificationStatus:i.verificationStatus,verificationMethod:i.verificationMethod,verifiedAt:i.verifiedAt?new Date(i.verifiedAt).toISOString():null,recordName:u?Y1u(i.domain):null,recordValue:u?i.verificationToken:null}}function Hnf(i){let u=i.toLowerCase().trim();if(!Qnf.test(u))throw Error(`Invalid domain format: "${u}". Must be a valid domain like "acme.com"`);if(jv.has(u))throw Error(`Cannot claim generic email domain "${u}". Only corporate domains are allowed.`);return u}var Qnf,W1u,pgi,S1u,L1u,Q1u,H1u,z1u;var jI0=O(()=>{F$();kI0();fu();Qnf=/^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+$/,W1u=L1.enum(["off","auto","request"]),pgi=L1.object({id:L1.string(),domain:L1.string(),joinMode:W1u,verificationStatus:L1.enum(["pending","verified"]),verificationMethod:L1.enum(["email","dns"]).nullable(),verifiedAt:L1.string().nullable(),recordName:L1.string().nullable(),recordValue:L1.string().nullable()});S1u=ui({name:"ORGANIZATION_DOMAIN_LIST",description:"List the email domains claimed by an organization.",annotations:{title:"List Organization Domains",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:L1.object({}),outputSchema:L1.object({domains:L1.array(pgi)}),handler:async(i,u)=>{gi(u),await u.access.check();let t=Oi(u);return{domains:(await u.storage.organizationDomains.listByOrganizationId(t.id)).map(HN)}}}),L1u=ui({name:"ORGANIZATION_DOMAIN_ADD",description:"Claim an email domain for an organization. If the caller's verified email matches the domain it is trusted immediately; otherwise it requires DNS verification.",annotations:{title:"Add Organization Domain",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:L1.object({domain:L1.string().min(1).max(255).describe("Domain to claim, e.g. acme.com"),joinMode:W1u.optional().describe("Initial join mode (only applied when the domain is trusted immediately via email match).")}),outputSchema:pgi,handler:async(i,u)=>{gi(u),await u.access.check();let t=Oi(u),f=Hnf(i.domain),E=u.auth.user?.email?.split("@")[1]?.toLowerCase(),c=Boolean(u.auth.user?.emailVerified)&&E===f,w=await u.storage.organizationDomains.getByOrgAndDomain(t.id,f);if(w){if(w.verificationStatus!=="verified"&&c){let h=await u.storage.organizationDomains.markVerified(w.id,"email");return HN(h)}return HN(w)}let $=c?await u.storage.organizationDomains.add(t.id,f,{joinMode:i.joinMode??"off",verificationStatus:"verified",verificationMethod:"email"}):await u.storage.organizationDomains.add(t.id,f,{joinMode:"off",verificationStatus:"pending",verificationToken:II0()});return HN($)}}),Q1u=ui({name:"ORGANIZATION_DOMAIN_UPDATE",description:"Set the join mode for a claimed domain. Discoverable modes (auto/request) require the domain to be verified.",annotations:{title:"Update Organization Domain",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:L1.object({id:L1.string(),joinMode:W1u}),outputSchema:pgi,handler:async(i,u)=>{gi(u),await u.access.check();let t=Oi(u),f=await u.storage.organizationDomains.getById(i.id);if(!f||f.organizationId!==t.id)throw Error("Domain not found");if(i.joinMode!=="off"&&f.verificationStatus!=="verified")throw Error("Verify the domain before enabling auto-join or requests.");let l=await u.storage.organizationDomains.updateJoinMode(i.id,i.joinMode);return HN(l)}}),H1u=ui({name:"ORGANIZATION_DOMAIN_VERIFY",description:"Check the DNS TXT record for a pending domain and mark it verified if present.",annotations:{title:"Verify Organization Domain",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!0},inputSchema:L1.object({id:L1.string()}),outputSchema:L1.object({verified:L1.boolean(),domain:pgi}),handler:async(i,u)=>{gi(u),await u.access.check();let t=Oi(u),f=await u.storage.organizationDomains.getById(i.id);if(!f||f.organizationId!==t.id)throw Error("Domain not found");if(f.verificationStatus==="verified")return{verified:!0,domain:HN(f)};if(!f.verificationToken)throw Error("Domain has no pending DNS verification.");if(!await xI0(f.domain,f.verificationToken))return{verified:!1,domain:HN(f)};let E=await u.storage.organizationDomains.markVerified(i.id,"dns");return{verified:!0,domain:HN(E)}}}),z1u=ui({name:"ORGANIZATION_DOMAIN_REMOVE",description:"Remove a claimed domain from an organization.",annotations:{title:"Remove Organization Domain",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:L1.object({id:L1.string()}),outputSchema:L1.object({success:L1.boolean()}),handler:async(i,u)=>{gi(u),await u.access.check();let t=Oi(u),f=await u.storage.organizationDomains.getById(i.id);if(!f||f.organizationId!==t.id)throw Error("Domain not found");return await u.storage.organizationDomains.removeById(i.id),{success:!0}}})});function zN(i){return(i instanceof Error?i.message.toLowerCase():"").includes("already a member")}import{z as Sl}from"zod";var znf,n1u,R1u,b1u;var XI0=O(()=>{fu();H4();znf=Sl.object({id:Sl.string(),userId:Sl.string(),status:Sl.enum(["pending","approved","denied"]),createdAt:Sl.string(),user:Sl.object({id:Sl.string(),name:Sl.string(),email:Sl.string(),image:Sl.string().nullable()}).nullable()}),n1u=ui({name:"ORGANIZATION_JOIN_REQUEST_LIST",description:"List pending requests to join the organization.",annotations:{title:"List Join Requests",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:Sl.object({}),outputSchema:Sl.object({requests:Sl.array(znf)}),handler:async(i,u)=>{gi(u),await u.access.check();let t=Oi(u);return{requests:(await u.storage.organizationJoinRequests.listPendingWithUser(t.id)).map((l)=>({id:l.id,userId:l.userId,status:l.status,createdAt:new Date(l.createdAt).toISOString(),user:l.user}))}}}),R1u=ui({name:"ORGANIZATION_JOIN_REQUEST_APPROVE",description:"Approve a pending join request, adding the user as a member.",annotations:{title:"Approve Join Request",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:Sl.object({requestId:Sl.string()}),outputSchema:Sl.object({success:Sl.boolean()}),handler:async(i,u)=>{gi(u),await u.access.check();let t=Oi(u),f=await u.storage.organizationJoinRequests.getById(i.requestId);if(!f||f.organizationId!==t.id)throw Error("Join request not found");if(f.status!=="pending")throw Error("Join request has already been decided");let l=Wu(u);if(!await u.storage.organizationJoinRequests.decide(f.id,"approved",l??f.userId))return{success:!0};try{await u.boundAuth.organization.addMember({organizationId:t.id,userId:f.userId,role:["user"]})}catch(c){if(!zN(c))throw c}if(l)mu.capture({distinctId:l,event:"organization_join_request_approved",groups:{organization:t.id},properties:{organization_id:t.id,user_id:f.userId}});return{success:!0}}}),b1u=ui({name:"ORGANIZATION_JOIN_REQUEST_DENY",description:"Deny a pending join request.",annotations:{title:"Deny Join Request",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:Sl.object({requestId:Sl.string()}),outputSchema:Sl.object({success:Sl.boolean()}),handler:async(i,u)=>{gi(u),await u.access.check();let t=Oi(u),f=await u.storage.organizationJoinRequests.getById(i.requestId);if(!f||f.organizationId!==t.id)throw Error("Join request not found");if(f.status!=="pending")throw Error("Join request has already been decided");let l=Wu(u);if(await u.storage.organizationJoinRequests.decide(f.id,"denied",l??f.userId)&&l)mu.capture({distinctId:l,event:"organization_join_request_denied",groups:{organization:t.id},properties:{organization_id:t.id,user_id:f.userId}});return{success:!0}}})});import{z as gw}from"zod";var C1u;var JI0=O(()=>{H4();fu();Uh();C1u=ui({name:"ORGANIZATION_MEMBER_ADD",description:"Invite a member to the organization by email with an assigned role.",annotations:{title:"Add Organization Member",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:gw.object({organizationId:gw.string().optional(),userId:gw.string(),role:gw.array(gw.string())}),outputSchema:gw.object({id:gw.string(),organizationId:gw.string(),userId:gw.string(),role:gw.union([gw.string(),gw.array(gw.string())]),createdAt:gw.string().datetime().describe("ISO 8601 timestamp")}),handler:async(i,u)=>{gi(u),await u.access.check();let t=i.organizationId||u.organization?.id;if(!t)throw Error("Organization ID required (no active organization in context)");if(t!==u.organization?.id)throw Error("Organization ID does not match authenticated organization");let f=await u.db.selectFrom("member").select(["role"]).where("userId","=",Wu(u)??"").where("organizationId","=",t).executeTakeFirst();if(!l$i(f?.role,i.role))throw Error(`Insufficient privileges to assign role "${i.role.join(",")}"`);let l=await u.boundAuth.organization.addMember({organizationId:t,userId:i.userId,role:i.role});if(!l)throw Error("Failed to add member");let E=Wu(u);if(E)mu.capture({distinctId:E,event:"organization_member_added",groups:{organization:t},properties:{organization_id:t,added_user_id:i.userId,role:i.role}});return{...l,role:l.role,createdAt:l.createdAt instanceof Date?l.createdAt.toISOString():l.createdAt}}})});import{z as fn}from"zod";var M1u;var KI0=O(()=>{H4();fu();M1u=ui({name:"ORGANIZATION_MEMBER_REMOVE",description:"Remove a member from the organization. Revokes all their access immediately.",annotations:{title:"Remove Organization Member",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:fn.object({organizationId:fn.string().optional(),memberIdOrEmail:fn.string()}),outputSchema:fn.object({success:fn.boolean(),memberIdOrEmail:fn.string()}),handler:async(i,u)=>{gi(u),await u.access.check();let t=i.organizationId||u.organization?.id;if(!t)throw Error("Organization ID required (no active organization in context)");if(t!==u.organization?.id)throw Error("Organization ID does not match authenticated organization");await u.boundAuth.organization.removeMember({organizationId:t,memberIdOrEmail:i.memberIdOrEmail});let f=Wu(u);if(f)mu.capture({distinctId:f,event:"organization_member_removed",groups:{organization:t},properties:{organization_id:t,member_id_or_email:i.memberIdOrEmail}});return{success:!0,memberIdOrEmail:i.memberIdOrEmail}}})});import{z as Jc}from"zod";var q1u;var YI0=O(()=>{fu();q1u=ui({name:"ORGANIZATION_MEMBER_LIST",description:"List all members in the organization with their roles.",annotations:{title:"List Organization Members",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:Jc.object({limit:Jc.number().optional(),offset:Jc.number().optional()}),outputSchema:Jc.object({members:Jc.array(Jc.object({id:Jc.string(),organizationId:Jc.string(),userId:Jc.string(),role:Jc.string(),createdAt:Jc.string().datetime().describe("ISO 8601 timestamp"),user:Jc.object({id:Jc.string(),name:Jc.string(),email:Jc.string(),image:Jc.string().optional()}).optional()}))}),handler:async(i,u)=>{gi(u),await u.access.check();let t=u.organization?.id;if(!t)throw Error("Organization ID required (no active organization in context)");let f=await u.boundAuth.organization.listMembers({organizationId:t,limit:i.limit,offset:i.offset});return{members:(Array.isArray(f)?f:[]).map((E)=>({...E,createdAt:E.createdAt instanceof Date?E.createdAt.toISOString():E.createdAt}))}}})});import{z as lE}from"zod";var V1u;var WI0=O(()=>{H4();fu();Uh();V1u=ui({name:"ORGANIZATION_MEMBER_UPDATE_ROLE",description:"Change a member's role (e.g., admin, member) within the organization.",annotations:{title:"Update Member Role",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:lE.object({organizationId:lE.string().optional(),memberId:lE.string(),role:lE.array(lE.string())}),outputSchema:lE.object({id:lE.string(),organizationId:lE.string(),userId:lE.string(),role:lE.union([lE.string(),lE.array(lE.string())]),createdAt:lE.string().datetime().describe("ISO 8601 timestamp"),user:lE.object({email:lE.string(),name:lE.string(),image:lE.string().optional()})}),handler:async(i,u)=>{gi(u),await u.access.check();let t=i.organizationId||u.organization?.id;if(!t)throw Error("Organization ID required (no active organization in context)");let f=await u.db.selectFrom("member").select(["role"]).where("userId","=",Wu(u)??"").where("organizationId","=",t).executeTakeFirst();if(!l$i(f?.role,i.role))throw Error(`Insufficient privileges to assign role "${i.role.join(",")}"`);let l=await u.boundAuth.organization.updateMemberRole({organizationId:t,memberId:i.memberId,role:i.role});if(!l)throw Error("Failed to update member role");u.invalidateMemberRole?.(l.userId,t);let E=Wu(u);if(E)mu.capture({distinctId:E,event:"organization_member_role_updated",groups:{organization:t},properties:{organization_id:t,member_id:i.memberId,target_user_id:l.userId,new_role:Array.isArray(i.role)?i.role.join(","):i.role}});return{...l,createdAt:l.createdAt instanceof Date?l.createdAt.toISOString():l.createdAt}}})});async function SI0(){if(yo&&Date.now()-yo.fetchedAt<600000)return yo.rate;try{let u=await(await fetch("https://economia.awesomeapi.com.br/json/last/USD-BRL",{signal:AbortSignal.timeout(5000)})).json(),t=parseFloat(u.USDBRL?.bid??"");if(Number.isNaN(t)||t<=0)throw Error("Invalid rate");return yo={rate:t,fetchedAt:Date.now()},t}catch{return yo?.rate??5.5}}function LI0(i,u,t){if(u==="brl")return Math.round(i/t);return i}var yo=null;function r1u(i,u="",t=new URLSearchParams){for(let[f,l]of Object.entries(i)){if(l===void 0||l===null)continue;let E=u?`${u}[${f}]`:f;if(Array.isArray(l))l.forEach((c,w)=>{if(typeof c==="object"&&c!==null)r1u(c,`${E}[${w}]`,t);else t.append(`${E}[${w}]`,String(c))});else if(typeof l==="object")r1u(l,E,t);else t.append(E,String(l))}return t}async function nN(i,u){let t=hu().stripeSecretKey;if(!t)throw new Tw(503,"billing is not configured");let f=u?.params?r1u(u.params).toString():void 0,l=await fetch(`${nnf}${i}`,{method:u?.method??(f?"POST":"GET"),headers:{Authorization:`Bearer ${t}`,...f&&{"Content-Type":"application/x-www-form-urlencoded"}},body:f,signal:AbortSignal.timeout(Rnf)}),E=await l.json().catch(()=>({}));if(!l.ok){let c=E.error?.message??`HTTP ${l.status}`;throw new Tw(l.status,c)}return E}async function QI0(i){let u=hu().stripeSeatPriceId;if(!u)throw new Tw(503,"billing is not configured");let t=await nN("/checkout/sessions",{params:{mode:"subscription",line_items:[{price:u,quantity:i.quantity}],success_url:i.successUrl,cancel_url:i.cancelUrl,metadata:{orgId:i.organizationId},subscription_data:{metadata:{orgId:i.organizationId}}}});if(!t.url)throw new Tw(500,"checkout session lacks url");return{url:t.url}}async function m1u(i){let t=(await nN(`/subscriptions/${encodeURIComponent(i)}`)).items?.data??[],f=hu().stripeSeatPriceId,l=f?t.find((E)=>E.price?.id===f):t.length===1?t[0]:void 0;if(!l)throw new Tw(500,"subscription has no seat item");return{itemId:l.id,quantity:l.quantity??0}}async function HI0(i){let{itemId:u}=await m1u(i.subscriptionId),t=await nN("/invoices/create_preview",{params:{subscription:i.subscriptionId,subscription_details:{items:[{id:u,quantity:i.quantity}],proration_behavior:"always_invoice"}}});return{amountDueCents:t.amount_due??0,currency:t.currency??"usd"}}function bnf(i,u){return Math.round(i*(1+u/100))}async function zI0(i){let u=bnf(i.amountCents,i.feePercent),t=LI0(i.amountCents,i.currency,await SI0()),f=i.currency==="brl"?`Studio AI credits (R$ ${(i.amountCents/100).toFixed(2)})`:`Studio AI credits ($${(i.amountCents/100).toFixed(2)})`,l=await nN("/checkout/sessions",{params:{mode:"payment",...i.customerId&&{customer:i.customerId},line_items:[{quantity:1,price_data:{currency:i.currency,unit_amount:u,product_data:{name:f}}}],success_url:i.successUrl,cancel_url:i.cancelUrl,metadata:{kind:"topup",orgId:i.organizationId,creditCents:t}}});if(!l.url)throw new Tw(500,"checkout session lacks url");return{url:l.url}}async function nI0(i){let u=await nN("/billing_portal/sessions",{params:{customer:i.customerId,return_url:i.returnUrl}});if(!u.url)throw new Tw(500,"portal session lacks url");return{url:u.url}}async function RI0(i){let{itemId:u}=await m1u(i.subscriptionId);await nN(`/subscriptions/${encodeURIComponent(i.subscriptionId)}`,{params:{items:[{id:u,quantity:i.quantity}],proration_behavior:"always_invoice",payment_behavior:"pending_if_incomplete"}})}async function bI0(i){await nN(`/subscriptions/${encodeURIComponent(i)}`,{method:"DELETE"})}async function CI0(i){if(i.targetQuantity<1)return!1;let{itemId:u,quantity:t}=await m1u(i.subscriptionId);if(t===i.targetQuantity)return!1;return await nN(`/subscriptions/${encodeURIComponent(i.subscriptionId)}`,{params:{items:[{id:u,quantity:i.targetQuantity}],proration_behavior:"always_invoice",payment_behavior:"pending_if_incomplete"}}),!0}var nnf="https://api.stripe.com/v1",Tw,Rnf=15000;var ln=O(()=>{z0();Tw=class Tw extends Error{status;constructor(i,u){super(`Stripe API ${i}: ${u}`);this.status=i;this.name="StripeApiError"}}});import{z as Ll}from"zod";var Cnf,e1u,a1u;var MI0=O(()=>{ln();qL();fu();YL();Cnf=Ll.object({legacy:Ll.boolean(),billingMode:Ll.string(),status:Ll.string(),includedReportUrl:Ll.string().nullable()}),e1u=ui({name:"ORGANIZATION_SEATS_GET",description:"Get the organization's billing identity and which members hold paid seats.",annotations:{title:"Get Organization Seats",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:Ll.object({}),outputSchema:Ll.object({billing:Cnf.nullable(),paidSeatUserIds:Ll.array(Ll.string())}),handler:async(i,u)=>{gi(u),await u.access.check();let t=u.organization?.id;if(!t)throw Error("Organization context required");let[f,l]=await Promise.all([u.storage.organizationBilling.getBilling(t),u.storage.organizationBilling.listPaidSeatUserIds(t)]);return{billing:f?{legacy:f.legacy,billingMode:f.billingMode,status:f.status,includedReportUrl:f.includedReportUrl}:null,paidSeatUserIds:l}}}),a1u=ui({name:"ORGANIZATION_SEATS_SET",description:"Set members' seats (paid/free). Invoiced organizations apply directly; self-serve organizations with an active subscription also charge the prorated difference on the saved card (preview it with ORGANIZATION_SEATS_PREVIEW first).",annotations:{title:"Set Organization Seats",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:Ll.object({seats:Ll.array(Ll.object({userId:Ll.string().min(1),seat:Ll.enum(["paid","free"])})).min(1).max(200)}),outputSchema:Ll.object({applied:Ll.array(Ll.object({userId:Ll.string(),seat:Ll.enum(["paid","free"])})),paidSeatCount:Ll.number(),benefitsSyncQueued:Ll.boolean()}),handler:async(i,u)=>{gi(u),await u.access.check();let t=u.organization?.id;if(!t)throw Error("Organization context required");let f=Wu(u);if(!f)throw Error("User ID required");let l=await u.storage.organizationBilling.getBilling(t);if(!l||l.legacy)throw Error("This organization is on the legacy plan \u2014 seats do not apply.");let E=ML(l)?l.stripeSubscriptionId:null,c;try{c=await u.storage.organizationBilling.setSeats(t,i.seats,f,{markBenefitsPending:gB()})}catch($){if($ instanceof W6i)throw Error($.message);throw $}if(E)try{await RI0({subscriptionId:E,quantity:c.paidSeatCount})}catch($){let h=$ instanceof Tw?$.message:"Stripe update failed";throw Error(`Seats saved, but updating the subscription failed: ${h}. Apply again to retry the charge.`)}let w=!1;if(c.benefitsReferenceId)try{await eD(t,c.benefitsReferenceId,"apply"),w=!0}catch($){console.error("Failed to enqueue benefit sync (sweep covers):",$)}return{applied:c.applied,paidSeatCount:c.paidSeatCount,benefitsSyncQueued:w}}})});import{z as M2}from"zod";var o1u,s1u;var qI0=O(()=>{ln();Ml();fu();o1u=ui({name:"ORGANIZATION_BILLING_CHECKOUT_START",description:"Start the organization's seat subscription: creates a Stripe Checkout session for the current paid-seat count and returns its URL.",annotations:{title:"Start Billing Checkout",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!1,openWorldHint:!0},inputSchema:M2.object({}),outputSchema:M2.object({url:M2.string(),quantity:M2.number()}),handler:async(i,u)=>{gi(u),await u.access.check();let t=u.organization?.id,f=u.organization?.slug;if(!t||!f)throw Error("Organization context required");let[l,E]=await Promise.all([u.storage.organizationBilling.getBilling(t),u.storage.organizationBilling.listPaidSeatUserIds(t)]);if(!l||l.legacy)throw Error("This organization is on the legacy plan \u2014 no subscription needed.");if(l.billingMode!=="self_serve")throw Error("Contract-billed organizations do not use checkout.");if(l.status==="active")throw Error("This organization already has an active subscription \u2014 seat changes apply directly.");if(l.stripeSubscriptionId)throw Error("This organization still has a subscription on file \u2014 settle or cancel it before starting a new checkout.");let c=E.length;if(c<1)throw Error("Mark at least one member as a paid seat before subscribing.");let w=`${FE()}/${encodeURIComponent(f)}/members`,{url:$}=await QI0({organizationId:t,quantity:c,successUrl:`${w}?checkout=success`,cancelUrl:`${w}?checkout=canceled`});return{url:$,quantity:c}}}),s1u=ui({name:"ORGANIZATION_SEATS_PREVIEW",description:"Preview what the organization pays now for changing its paid-seat count (Stripe prorated invoice preview). Read-only \u2014 nothing is charged.",annotations:{title:"Preview Seat Change",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!0},inputSchema:M2.object({quantity:M2.number().int().min(1).max(1000)}),outputSchema:M2.object({amountDueCents:M2.number(),currency:M2.string()}),handler:async(i,u)=>{gi(u),await u.access.check();let t=u.organization?.id;if(!t)throw Error("Organization context required");let f=await u.storage.organizationBilling.getBilling(t);if(!ML(f))throw Error("Seat previews need an active self-serve subscription.");return await HI0({subscriptionId:f.stripeSubscriptionId,quantity:i.quantity})}})});import{z as RN}from"zod";var p1u,ilu;var VI0=O(()=>{ln();qL();Ml();fu();mB();p1u=ui({name:"ORGANIZATION_BILLING_PORTAL",description:"Open the organization's Stripe billing portal (manage card, invoices, cancellation). Returns the portal URL.",annotations:{title:"Open Billing Portal",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!1,openWorldHint:!0},inputSchema:RN.object({}),outputSchema:RN.object({url:RN.string()}),handler:async(i,u)=>{gi(u),await u.access.check();let t=Oi(u);if(!t.slug)throw Error("Organization context required");let f=await u.storage.organizationBilling.getBilling(t.id);if(!f?.stripeCustomerId)throw Error("This organization has no billing account yet \u2014 subscribe first.");if(f.legacy||f.billingMode!=="self_serve")throw Error("This organization's billing is managed by deco \u2014 contact support.");try{return await nI0({customerId:f.stripeCustomerId,returnUrl:`${FE()}/${encodeURIComponent(t.slug)}/members`})}catch(l){if(l instanceof Tw)throw Error(l.message);throw l}}}),ilu=ui({name:"ORGANIZATION_INCLUDED_REPORT_SET",description:"Choose which site's weekly report re-run the organization's subscription includes (null clears it).",annotations:{title:"Set Included Report Site",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:RN.object({url:RN.string().trim().min(1).max(255).nullable()}),outputSchema:RN.object({includedReportUrl:RN.string().nullable(),benefitsSyncQueued:RN.boolean()}),handler:async(i,u)=>{gi(u),await u.access.check();let t=Oi(u),f=await u.storage.organizationBilling.getBilling(t.id);if(!f||f.legacy)throw Error("This organization is on the legacy plan \u2014 included reports do not apply.");let l=i.url===null?null:Q3i(i.url);if(i.url!==null&&!l)throw Error(`"${i.url}" is not a valid site URL.`);let{updated:E,benefitsReferenceId:c}=await u.storage.organizationBilling.setIncludedReportUrl(t.id,l,{markBenefitsPending:gB()});if(!E)throw Error("Organization billing row missing.");let w=!1;if(c)try{await eD(t.id,c,"apply"),w=!0}catch($){console.error("Failed to enqueue benefit sync (sweep covers):",$)}return{includedReportUrl:l,benefitsSyncQueued:w}}})});import{z as Po}from"zod";function Mnf(i){return`[CREDITS] Paid report runs need at least $${(rI0/100).toFixed(2)} of AI credit balance \u2014 current balance is $${(i/100).toFixed(2)}. Top up and try again.`}var rI0=500,ulu;var mI0=O(()=>{uri();fu();E8();_9();mB();ulu=ui({name:"ORGANIZATION_REPORT_RUN_PAID",description:"Trigger a paid report run for one of the organization's sites, billed against its AI credits (requires at least $5 of balance; the run's real cost plus markup is debited at completion).",annotations:{title:"Run Paid Report",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!1,openWorldHint:!0},inputSchema:Po.object({url:Po.string().trim().min(1).max(255).optional()}),outputSchema:Po.object({url:Po.string(),started:Po.boolean()}),handler:async(i,u)=>{gi(u),await u.access.check();let t=Oi(u),f=Wu(u);if(!f)throw Error("User ID required");if(!uV())throw Error("Reports are not available on this deployment.");let l;if(i.url)l=Q3i(i.url);else l=(await u.storage.organizationBilling.getBilling(t.id))?.includedReportUrl??null;if(!l)throw Error(i.url?`"${i.url}" is not a valid site URL.`:"No site chosen \u2014 pass a url or set the included report site first.");let E=x6().deco;if(!E?.getCreditsBalance)throw Error("AI credit balance is not available on this deployment.");let c=await Sd(f,u.auth.user?.email),{balanceCents:w}=await E.getCreditsBalance(c,t.id);if(!(w>=rI0))throw Error(Mnf(w??0));return await Du0({host:l,organizationId:t.id}),{url:l,started:!0}}})});var eI0=O(()=>{dI0();DI0();_I0();NI0();OI0();BI0();FI0();TI0();AI0();yI0();GI0();jI0();XI0();JI0();KI0();YI0();WI0();MI0();qI0();VI0();mI0()});var y$="super-agent",aI0="task-board.item.updated",oI0="task-board.item.deleted";import{z as ef}from"zod";var Go,HK,Vnf,sI0,En;var zK=O(()=>{Go=ef.enum(["triage","todo","in_progress","in_review","done"]),HK=ef.enum(["none","low","medium","high","urgent"]),Vnf=ef.object({threadId:ef.string(),virtualMcpId:ef.string().nullable(),status:ef.enum(["in_progress","requires_action","failed","completed","expired"]).nullable(),title:ef.string().nullable(),lastMessage:ef.string().nullable(),hasPreview:ef.boolean(),createdAt:ef.string()}),sI0=ef.object({url:ef.string(),number:ef.number(),repoOwner:ef.string(),repoName:ef.string(),createdAt:ef.string(),title:ef.string().nullable(),body:ef.string().nullable(),state:ef.enum(["open","closed"]).nullable(),draft:ef.boolean().nullable(),merged:ef.boolean().nullable()}),En=ef.object({id:ef.string(),organizationId:ef.string(),title:ef.string(),description:ef.string().nullable(),status:Go,priority:HK,assigneeId:ef.string().nullable(),assignedBy:ef.string().nullable(),dueDate:ef.string().datetime().nullable(),threads:ef.array(Vnf),createdBy:ef.string(),createdAt:ef.string().datetime(),updatedBy:ef.string(),updatedAt:ef.string().datetime()})});async function iTi(i,u,t){if(t===y$)return;let{members:f}=await i.boundAuth.organization.listMembers({organizationId:u,filterField:"userId",filterValue:t});if(!f.some((l)=>l.userId===t))throw Error("assigneeId is not a member of the organization")}var tlu=O(()=>{zK()});async function flu(i,u,t){let f;try{return await Promise.race([i.aiProviders.listModels(u,t),new Promise((E,c)=>{f=setTimeout(()=>c(Error("listModels timeout")),rnf)})])}finally{if(f)clearTimeout(f)}}function mnf(i,u){switch(i){case"fast":return u.chat.fast;case"smart":return u.chat.smart;case"thinking":return u.chat.thinking;case"image":return u.image;case"web_search":return u.webSearch;case"deep_research":return u.deepResearch}}function llu(i,u,t){let f=i.find((l)=>l.modelId===u);return{title:f?.title??t??u,providerId:f?.providerId,capabilities:f?.capabilities,limits:f?.limits??null}}async function P$(i,u){let t=i.organization?.id;if(!t)throw Error("resolveTier called without an organization");let l=(await i.storage.organizationSettings.get(t))?.simple_mode?.tiers?.[u]??null,E=await i.storage.aiProviderKeys.list({organizationId:t});if(l&&E.some((v)=>v.id===l.keyId)){let v=await flu(i,l.keyId,t).catch(()=>[]);return{credentialId:l.keyId,modelId:l.modelId,modelMeta:llu(v,l.modelId,l.title)}}if(E.length===0)throw new cn(u);let c={};await Promise.all(E.map(async(v)=>{c[v.id]=await flu(i,v.id,t).catch(()=>[])}));let w=E.map((v)=>({id:v.id,providerId:v.providerId,label:v.label,presetId:v.presetId,createdBy:v.createdBy,createdAt:v.createdAt})),$=iu0(w,c),h=mnf(u,$);if(!h)throw new cn(u);return{credentialId:h.keyId,modelId:h.modelId,modelMeta:llu(c[h.keyId]??[],h.modelId,h.title)}}async function pI0(i,u,t){let f=i.organization?.id;if(!f)throw Error("resolveSpecificModel called without an organization");let l=await flu(i,u,f).catch(()=>[]);return{credentialId:u,modelId:t,modelMeta:llu(l,t)}}async function Rh(i,u){try{return await P$(i,u)}catch(t){if(t instanceof cn)return null;return console.warn(`[resolveTier] tier "${u}" resolution failed:`,t),null}}var cn,rnf=5000;var nK=O(()=>{Ef();cn=class cn extends Error{tier;constructor(i){super(`No model available for tier "${i}". Connect a provider or configure the tier in organization settings.`);this.tier=i;this.name="TierUnavailableError"}}});function uTi(i){return i.sandboxProviderKind==="agent-sandbox"&&i.harnessId==="decopilot"}function ix0(i){return i.harnessId==="decopilot"&&(i.sandboxProviderKind==null||i.sandboxProviderKind==="agent-sandbox")}function anf(i){return{type:"data-run-status",id:"run-status",data:{stage:i}}}function ux0(i){if(!i||typeof i!=="object")return!1;return i.type==="data-run-status"}async function q2(i,u,t){if(!i)return;try{await i.publishRawChunk(u,anf(t))}catch{}}var enf,Io,J36;var xo=O(()=>{enf=["waiting-runner","starting-run","gathering-context","preparing-tools","starting-assistant","analyzing-scope"],Io=["gathering-context","preparing-tools","starting-assistant","analyzing-scope"],J36=new Set(enf)});function tTi(){return crypto.randomUUID()}var clu=Y((W36,lx0)=>{var{defineProperty:Elu,getOwnPropertyDescriptor:onf,getOwnPropertyNames:snf}=Object,pnf=Object.prototype.hasOwnProperty,iRf=(i,u)=>{for(var t in u)Elu(i,t,{get:u[t],enumerable:!0})},uRf=(i,u,t,f)=>{if(u&&typeof u==="object"||typeof u==="function"){for(let l of snf(u))if(!pnf.call(i,l)&&l!==t)Elu(i,l,{get:()=>u[l],enumerable:!(f=onf(u,l))||f.enumerable})}return i},tRf=(i)=>uRf(Elu({},"__esModule",{value:!0}),i),tx0={};iRf(tx0,{SYMBOL_FOR_REQ_CONTEXT:()=>fx0,getContext:()=>fRf});lx0.exports=tRf(tx0);var fx0=Symbol.for("@vercel/request-context");function fRf(){return globalThis[fx0]?.get?.()??{}}});var ko=Y((S36,wx0)=>{var{defineProperty:wlu,getOwnPropertyDescriptor:lRf,getOwnPropertyNames:ERf}=Object,cRf=Object.prototype.hasOwnProperty,wRf=(i,u)=>{for(var t in u)wlu(i,t,{get:u[t],enumerable:!0})},$Rf=(i,u,t,f)=>{if(u&&typeof u==="object"||typeof u==="function"){for(let l of ERf(u))if(!cRf.call(i,l)&&l!==t)wlu(i,l,{get:()=>u[l],enumerable:!(f=lRf(u,l))||f.enumerable})}return i},hRf=(i)=>$Rf(wlu({},"__esModule",{value:!0}),i),Ex0={};wRf(Ex0,{VercelOidcTokenError:()=>cx0});wx0.exports=hRf(Ex0);class cx0 extends Error{constructor(i,u){super(i);this.name="VercelOidcTokenError",this.cause=u}toString(){if(this.cause)return`${this.name}: ${this.message}: ${this.cause}`;return`${this.name}: ${this.message}`}}});var dx0=Y((L36,vx0)=>{var{create:vRf,defineProperty:fTi,getOwnPropertyDescriptor:dRf,getOwnPropertyNames:DRf,getPrototypeOf:_Rf}=Object,NRf=Object.prototype.hasOwnProperty,ORf=(i,u)=>{for(var t in u)fTi(i,t,{get:u[t],enumerable:!0})},$x0=(i,u,t,f)=>{if(u&&typeof u==="object"||typeof u==="function"){for(let l of DRf(u))if(!NRf.call(i,l)&&l!==t)fTi(i,l,{get:()=>u[l],enumerable:!(f=dRf(u,l))||f.enumerable})}return i},hlu=(i,u,t)=>(t=i!=null?vRf(_Rf(i)):{},$x0(u||!i||!i.__esModule?fTi(t,"default",{value:i,enumerable:!0}):t,i)),ZRf=(i)=>$x0(fTi({},"__esModule",{value:!0}),i),hx0={};ORf(hx0,{findRootDir:()=>gRf,getUserDataDir:()=>TRf});vx0.exports=ZRf(hx0);var jo=hlu(Fi("path")),BRf=hlu(Fi("fs")),$lu=hlu(Fi("os")),FRf=ko();function gRf(){try{let i=process.cwd();while(i!==jo.default.dirname(i)){let u=jo.default.join(i,".vercel");if(BRf.default.existsSync(u))return i;i=jo.default.dirname(i)}}catch(i){throw new FRf.VercelOidcTokenError("Token refresh only supported in node server environments")}return null}function TRf(){if(process.env.XDG_DATA_HOME)return process.env.XDG_DATA_HOME;switch($lu.default.platform()){case"darwin":return jo.default.join($lu.default.homedir(),"Library/Application Support");case"linux":return jo.default.join($lu.default.homedir(),".local/share");case"win32":if(process.env.LOCALAPPDATA)return process.env.LOCALAPPDATA;return null;default:return null}}});var Fx0=Y((Q36,Bx0)=>{var{create:URf,defineProperty:lTi,getOwnPropertyDescriptor:ARf,getOwnPropertyNames:yRf,getPrototypeOf:PRf}=Object,GRf=Object.prototype.hasOwnProperty,IRf=(i,u)=>{for(var t in u)lTi(i,t,{get:u[t],enumerable:!0})},Dx0=(i,u,t,f)=>{if(u&&typeof u==="object"||typeof u==="function"){for(let l of yRf(u))if(!GRf.call(i,l)&&l!==t)lTi(i,l,{get:()=>u[l],enumerable:!(f=ARf(u,l))||f.enumerable})}return i},_x0=(i,u,t)=>(t=i!=null?URf(PRf(i)):{},Dx0(u||!i||!i.__esModule?lTi(t,"default",{value:i,enumerable:!0}):t,i)),xRf=(i)=>Dx0(lTi({},"__esModule",{value:!0}),i),Nx0={};IRf(Nx0,{isValidAccessToken:()=>JRf,readAuthConfig:()=>jRf,writeAuthConfig:()=>XRf});Bx0.exports=xRf(Nx0);var Xo=_x0(Fi("fs")),Ox0=_x0(Fi("path")),kRf=Jo();function Zx0(){let i=(0,kRf.getVercelDataDir)();if(!i)throw Error(`Unable to find Vercel CLI data directory. Your platform: ${process.platform}. Supported: darwin, linux, win32.`);return Ox0.join(i,"auth.json")}function jRf(){try{let i=Zx0();if(!Xo.existsSync(i))return null;let u=Xo.readFileSync(i,"utf8");if(!u)return null;return JSON.parse(u)}catch(i){return null}}function XRf(i){let u=Zx0(),t=Ox0.dirname(u);if(!Xo.existsSync(t))Xo.mkdirSync(t,{mode:504,recursive:!0});Xo.writeFileSync(u,JSON.stringify(i,null,2),{mode:384})}function JRf(i,u=0){if(!i.token)return!1;if(typeof i.expiresAt!=="number")return!0;let t=Math.floor(Date.now()/1000),f=u/1000;return i.expiresAt>=t+f}});var Ax0=Y((H36,Ux0)=>{var{defineProperty:Dlu,getOwnPropertyDescriptor:KRf,getOwnPropertyNames:YRf}=Object,WRf=Object.prototype.hasOwnProperty,SRf=(i,u)=>{for(var t in u)Dlu(i,t,{get:u[t],enumerable:!0})},LRf=(i,u,t,f)=>{if(u&&typeof u==="object"||typeof u==="function"){for(let l of YRf(u))if(!WRf.call(i,l)&&l!==t)Dlu(i,l,{get:()=>u[l],enumerable:!(f=KRf(u,l))||f.enumerable})}return i},QRf=(i)=>LRf(Dlu({},"__esModule",{value:!0}),i),gx0={};SRf(gx0,{processTokenResponse:()=>bRf,refreshTokenRequest:()=>RRf});Ux0.exports=QRf(gx0);var vlu=Fi("os"),HRf="https://vercel.com",zRf="cl_HYyOPBNtFMfHhaUn9L4QPfTZz6TP47bp",Tx0=`@vercel/oidc node-${process.version} ${(0,vlu.platform)()} (${(0,vlu.arch)()}) ${(0,vlu.hostname)()}`,dlu=null;async function nRf(){if(dlu)return dlu;let i=`${HRf}/.well-known/openid-configuration`,u=await fetch(i,{headers:{"user-agent":Tx0}});if(!u.ok)throw Error("Failed to discover OAuth endpoints");let t=await u.json();if(!t||typeof t.token_endpoint!=="string")throw Error("Invalid OAuth discovery response");let f=t.token_endpoint;return dlu=f,f}async function RRf(i){let u=await nRf();return await fetch(u,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded","user-agent":Tx0},body:new URLSearchParams({client_id:zRf,grant_type:"refresh_token",...i})})}async function bRf(i){let u=await i.json();if(!i.ok){let t=typeof u==="object"&&u&&"error"in u?String(u.error):"Token refresh failed";return[Error(t)]}if(typeof u!=="object"||u===null)return[Error("Invalid token response")];if(typeof u.access_token!=="string")return[Error("Missing access_token in response")];if(u.token_type!=="Bearer")return[Error("Invalid token_type in response")];if(typeof u.expires_in!=="number")return[Error("Missing expires_in in response")];return[null,u]}});var Nlu=Y((z36,Ix0)=>{var{defineProperty:_lu,getOwnPropertyDescriptor:CRf,getOwnPropertyNames:MRf}=Object,qRf=Object.prototype.hasOwnProperty,VRf=(i,u)=>{for(var t in u)_lu(i,t,{get:u[t],enumerable:!0})},rRf=(i,u,t,f)=>{if(u&&typeof u==="object"||typeof u==="function"){for(let l of MRf(u))if(!qRf.call(i,l)&&l!==t)_lu(i,l,{get:()=>u[l],enumerable:!(f=CRf(u,l))||f.enumerable})}return i},mRf=(i)=>rRf(_lu({},"__esModule",{value:!0}),i),yx0={};VRf(yx0,{AccessTokenMissingError:()=>Px0,RefreshAccessTokenFailedError:()=>Gx0});Ix0.exports=mRf(yx0);class Px0 extends Error{constructor(){super("No authentication found. Please log in with the Vercel CLI (vercel login).");this.name="AccessTokenMissingError"}}class Gx0 extends Error{constructor(i){super("Failed to refresh authentication token.",{cause:i});this.name="RefreshAccessTokenFailedError"}}});var Jo=Y((n36,Jx0)=>{var{create:eRf,defineProperty:ETi,getOwnPropertyDescriptor:aRf,getOwnPropertyNames:oRf,getPrototypeOf:sRf}=Object,pRf=Object.prototype.hasOwnProperty,ibf=(i,u)=>{for(var t in u)ETi(i,t,{get:u[t],enumerable:!0})},kx0=(i,u,t,f)=>{if(u&&typeof u==="object"||typeof u==="function"){for(let l of oRf(u))if(!pRf.call(i,l)&&l!==t)ETi(i,l,{get:()=>u[l],enumerable:!(f=aRf(u,l))||f.enumerable})}return i},jx0=(i,u,t)=>(t=i!=null?eRf(sRf(i)):{},kx0(u||!i||!i.__esModule?ETi(t,"default",{value:i,enumerable:!0}):t,i)),ubf=(i)=>kx0(ETi({},"__esModule",{value:!0}),i),Xx0={};ibf(Xx0,{assertVercelOidcTokenResponse:()=>Olu,findProjectInfo:()=>Ebf,getTokenPayload:()=>$bf,getVercelDataDir:()=>tbf,getVercelOidcToken:()=>lbf,getVercelToken:()=>fbf,isExpired:()=>hbf,loadToken:()=>wbf,saveToken:()=>cbf});Jx0.exports=ubf(Xx0);var Ko=jx0(Fi("path")),RK=jx0(Fi("fs")),hn=ko(),cTi=dx0(),wn=Fx0(),xx0=Ax0(),$n=Nlu();function tbf(){let u=(0,cTi.getUserDataDir)();if(!u)return null;return Ko.join(u,"com.vercel.cli")}async function fbf(i){let u=(0,wn.readAuthConfig)();if(!u?.token)throw new $n.AccessTokenMissingError;if((0,wn.isValidAccessToken)(u,i?.expirationBufferMs))return u.token;if(!u.refreshToken)throw(0,wn.writeAuthConfig)({}),new $n.RefreshAccessTokenFailedError("No refresh token available");try{let t=await(0,xx0.refreshTokenRequest)({refresh_token:u.refreshToken}),[f,l]=await(0,xx0.processTokenResponse)(t);if(f||!l)throw(0,wn.writeAuthConfig)({}),new $n.RefreshAccessTokenFailedError(f);let E={token:l.access_token,expiresAt:Math.floor(Date.now()/1000)+l.expires_in};if(l.refresh_token)E.refreshToken=l.refresh_token;return(0,wn.writeAuthConfig)(E),E.token}catch(t){if((0,wn.writeAuthConfig)({}),t instanceof $n.AccessTokenMissingError||t instanceof $n.RefreshAccessTokenFailedError)throw t;throw new $n.RefreshAccessTokenFailedError(t)}}async function lbf(i,u,t){let f=`https://api.vercel.com/v1/projects/${u}/token?source=vercel-oidc-refresh${t?`&teamId=${t}`:""}`,l=await fetch(f,{method:"POST",headers:{Authorization:`Bearer ${i}`}});if(!l.ok)throw new hn.VercelOidcTokenError(`Failed to refresh OIDC token: ${l.statusText}`);let E=await l.json();return Olu(E),E}function Olu(i){if(!i||typeof i!=="object")throw TypeError("Vercel OIDC token is malformed. Expected an object. Please run `vc env pull` and try again");if(!("token"in i)||typeof i.token!=="string")throw TypeError("Vercel OIDC token is malformed. Expected a string-valued token property. Please run `vc env pull` and try again")}function Ebf(){let i=(0,cTi.findRootDir)();if(!i)throw new hn.VercelOidcTokenError("Unable to find project root directory. Have you linked your project with `vc link?`");let u=Ko.join(i,".vercel","project.json");if(!RK.existsSync(u))throw new hn.VercelOidcTokenError("project.json not found, have you linked your project with `vc link?`");let t=JSON.parse(RK.readFileSync(u,"utf8"));if(typeof t.projectId!=="string"&&typeof t.orgId!=="string")throw TypeError("Expected a string-valued projectId property. Try running `vc link` to re-link your project.");return{projectId:t.projectId,teamId:t.orgId}}function cbf(i,u){let t=(0,cTi.getUserDataDir)();if(!t)throw new hn.VercelOidcTokenError("Unable to find user data directory. Please reach out to Vercel support.");let f=Ko.join(t,"com.vercel.token",`${u}.json`),l=JSON.stringify(i);RK.mkdirSync(Ko.dirname(f),{mode:504,recursive:!0}),RK.writeFileSync(f,l),RK.chmodSync(f,432);return}function wbf(i){let u=(0,cTi.getUserDataDir)();if(!u)throw new hn.VercelOidcTokenError("Unable to find user data directory. Please reach out to Vercel support.");let t=Ko.join(u,"com.vercel.token",`${i}.json`);if(!RK.existsSync(t))return null;let f=JSON.parse(RK.readFileSync(t,"utf8"));return Olu(f),f}function $bf(i){let u=i.split(".");if(u.length!==3)throw new hn.VercelOidcTokenError("Invalid token. Please run `vc env pull` and try again");let t=u[1].replace(/-/g,"+").replace(/_/g,"/"),f=t.padEnd(t.length+(4-t.length%4)%4,"=");return JSON.parse(Buffer.from(f,"base64").toString("utf8"))}function hbf(i,u=0){return i.exp*1000<Date.now()+u}});var Sx0=Y((R36,Wx0)=>{var{defineProperty:Zlu,getOwnPropertyDescriptor:vbf,getOwnPropertyNames:dbf}=Object,Dbf=Object.prototype.hasOwnProperty,_bf=(i,u)=>{for(var t in u)Zlu(i,t,{get:u[t],enumerable:!0})},Nbf=(i,u,t,f)=>{if(u&&typeof u==="object"||typeof u==="function"){for(let l of dbf(u))if(!Dbf.call(i,l)&&l!==t)Zlu(i,l,{get:()=>u[l],enumerable:!(f=vbf(u,l))||f.enumerable})}return i},Obf=(i)=>Nbf(Zlu({},"__esModule",{value:!0}),i),Yx0={};_bf(Yx0,{refreshToken:()=>Zbf});Wx0.exports=Obf(Yx0);var Kx0=ko(),bN=Jo();async function Zbf(i){let u=i?.project,t=i?.team;if(!u&&!t){let l=(0,bN.findProjectInfo)();u=l.projectId,t=l.teamId}else if(!u||!t){let l=(0,bN.findProjectInfo)();u=u??l.projectId,t=t??l.teamId}if(!u)throw new Kx0.VercelOidcTokenError("Failed to refresh OIDC token: No project specified. Try re-linking your project with `vc link`");let f=(0,bN.loadToken)(u);if(!f||(0,bN.isExpired)((0,bN.getTokenPayload)(f.token),i?.expirationBufferMs)){let l=await(0,bN.getVercelToken)({expirationBufferMs:i?.expirationBufferMs});if(f=await(0,bN.getVercelOidcToken)(l,u,t),!f)throw new Kx0.VercelOidcTokenError("Failed to refresh OIDC token");(0,bN.saveToken)(f,u)}process.env.VERCEL_OIDC_TOKEN=f.token;return}});var Hx0=Y((b36,Qx0)=>{var{defineProperty:Flu,getOwnPropertyDescriptor:Bbf,getOwnPropertyNames:Fbf}=Object,gbf=Object.prototype.hasOwnProperty,Tbf=(i,u)=>{for(var t in u)Flu(i,t,{get:u[t],enumerable:!0})},Ubf=(i,u,t,f)=>{if(u&&typeof u==="object"||typeof u==="function"){for(let l of Fbf(u))if(!gbf.call(i,l)&&l!==t)Flu(i,l,{get:()=>u[l],enumerable:!(f=Bbf(u,l))||f.enumerable})}return i},Abf=(i)=>Ubf(Flu({},"__esModule",{value:!0}),i),Lx0={};Tbf(Lx0,{getVercelOidcToken:()=>Gbf,getVercelOidcTokenSync:()=>Blu});Qx0.exports=Abf(Lx0);var ybf=clu(),Pbf=ko();async function Gbf(i){let u="",t;try{u=Blu()}catch(f){t=f}try{let[{getTokenPayload:f,isExpired:l},{refreshToken:E}]=await Promise.all([await Promise.resolve().then(() => j(Jo())),await Promise.resolve().then(() => j(Sx0()))]);if(!u||l(f(u),i?.expirationBufferMs))await E(i),u=Blu()}catch(f){let l=t instanceof Error?t.message:"";if(f instanceof Error)l=`${l}
 ${f.message}`;if(l)throw new Pbf.VercelOidcTokenError(l);throw f}return u}function Blu(){let i=(0,ybf.getContext)().headers?.["x-vercel-oidc-token"]??process.env.VERCEL_OIDC_TOKEN;if(!i)throw Error("The 'x-vercel-oidc-token' header is missing from the request. Do you have the OIDC option enabled in the Vercel project settings?");return i}});var Tlu=Y((C36,bx0)=>{var{defineProperty:glu,getOwnPropertyDescriptor:Ibf,getOwnPropertyNames:xbf}=Object,kbf=Object.prototype.hasOwnProperty,jbf=(i,u)=>{for(var t in u)glu(i,t,{get:u[t],enumerable:!0})},Xbf=(i,u,t,f)=>{if(u&&typeof u==="object"||typeof u==="function"){for(let l of xbf(u))if(!kbf.call(i,l)&&l!==t)glu(i,l,{get:()=>u[l],enumerable:!(f=Ibf(u,l))||f.enumerable})}return i},Jbf=(i)=>Xbf(glu({},"__esModule",{value:!0}),i),Rx0={};jbf(Rx0,{AccessTokenMissingError:()=>nx0.AccessTokenMissingError,RefreshAccessTokenFailedError:()=>nx0.RefreshAccessTokenFailedError,getContext:()=>Kbf.getContext,getVercelOidcToken:()=>zx0.getVercelOidcToken,getVercelOidcTokenSync:()=>zx0.getVercelOidcTokenSync,getVercelToken:()=>Ybf.getVercelToken});bx0.exports=Jbf(Rx0);var zx0=Hx0(),Kbf=clu(),nx0=Nlu(),Ybf=Jo()});import{z as V2}from"zod/v4";import{z as ik0}from"zod/v4";import{z as Alu}from"zod/v4";import{z as Hl}from"zod/v4";import{z as j6}from"zod/v4";import{z as Ql}from"zod/v4";import{z as wTi}from"zod/v4";import{z as x1}from"zod/v4";import{z as i1}from"zod/v4";import{z as pt}from"zod/v4";import{z as Q1}from"zod/v4";import{z as d4}from"zod";import{z as w4}from"zod";async function Bk0({response:i,statusCode:u,defaultMessage:t="Gateway request failed",cause:f,authMethod:l}){var E;let c=await _l({value:i,schema:abf});if(!c.success){let d=typeof i==="object"&&i!==null&&"generationId"in i?i.generationId:void 0;return new ebf({message:`Invalid error response format: ${t}`,statusCode:u,response:i,validationError:c.error,cause:f,generationId:d})}let w=c.value,$=w.error.type,h=w.error.message,v=(E=w.generationId)!=null?E:void 0;switch($){case"authentication_error":return $Ti.createContextualError({apiKeyProvided:l==="api-key",oidcTokenProvided:l==="oidc",statusCode:u,cause:f,generationId:v});case"invalid_request_error":return new Qbf({message:h,statusCode:u,cause:f,generationId:v});case"rate_limit_exceeded":return new zbf({message:h,statusCode:u,cause:f,generationId:v});case"model_not_found":{let d=await _l({value:w.error.param,schema:Rbf});return new bbf({message:h,statusCode:u,modelId:d.success?d.value.modelId:void 0,cause:f,generationId:v})}case"internal_server_error":return new wk0({message:h,statusCode:u,cause:f,generationId:v});case"failed_dependency":return new qbf({message:h,statusCode:u,cause:f,generationId:v});case"forbidden":return new rbf({message:h,statusCode:u,cause:f,generationId:v});default:return new wk0({message:h,statusCode:u,cause:f,generationId:v})}}function obf(i){if(i.data!==void 0)return i.data;if(i.responseBody!=null)try{return JSON.parse(i.responseBody)}catch(u){return i.responseBody}return{}}function Ak0(i){if(!(i instanceof Error))return!1;let u=i.code;if(typeof u==="string")return["UND_ERR_HEADERS_TIMEOUT","UND_ERR_BODY_TIMEOUT","UND_ERR_CONNECT_TIMEOUT"].includes(u);return!1}async function Uw(i,u){var t;if(zl.isInstance(i))return i;if(Ak0(i))return Uk0.createTimeoutError({originalMessage:i instanceof Error?i.message:"Unknown error",cause:i});if(Nt.isInstance(i)){if(i.cause&&Ak0(i.cause))return Uk0.createTimeoutError({originalMessage:i.message,cause:i});return await Bk0({response:obf(i),statusCode:(t=i.statusCode)!=null?t:500,defaultMessage:"Gateway request failed",cause:i,authMethod:u})}return await Bk0({response:{},statusCode:500,defaultMessage:i instanceof Error?`Gateway request failed: ${i.message}`:"Unknown Gateway error",cause:i,authMethod:u})}async function Z8(i){let u=await _l({value:i[Wk0],schema:pbf});return u.success?u.value:void 0}function Pk0(i){if(i.type==="file"&&i.data instanceof Uint8Array)return{...i,data:lw(i.data)};return i}function BCf(i){if(i.type==="file"&&i.data instanceof Uint8Array)return{...i,data:lw(i.data)};return i}async function WCf(){var i;return(i=Sk0.getContext().headers)==null?void 0:i["x-vercel-id"]}function ylu(i={}){var u,t;let f=null,l=null,E=(u=i.metadataCacheRefreshMillis)!=null?u:300000,c=0,w=(t=s9(i.baseURL))!=null?t:"https://ai-gateway.vercel.sh/v3/ai",$=async()=>{try{let g=await QCf(i);return c4({Authorization:`Bearer ${g.token}`,"ai-gateway-protocol-version":LCf,[Wk0]:g.authMethod,...i.headers},`ai-sdk/gateway/${SCf}`)}catch(g){throw $Ti.createContextualError({apiKeyProvided:!1,oidcTokenProvided:!1,statusCode:401,cause:g})}},h=()=>{let g=rd({settingValue:void 0,environmentVariableName:"VERCEL_DEPLOYMENT_ID"}),T=rd({settingValue:void 0,environmentVariableName:"VERCEL_ENV"}),U=rd({settingValue:void 0,environmentVariableName:"VERCEL_REGION"}),A=rd({settingValue:void 0,environmentVariableName:"VERCEL_PROJECT_ID"});return async()=>{let G=await WCf();return{...g&&{"ai-o11y-deployment-id":g},...T&&{"ai-o11y-environment":T},...U&&{"ai-o11y-region":U},...G&&{"ai-o11y-request-id":G},...A&&{"ai-o11y-project-id":A}}}},v=(g)=>{return new wCf(g,{provider:"gateway",baseURL:w,headers:$,fetch:i.fetch,o11yHeaders:h()})},d=async()=>{var g,T,U;let A=(U=(T=(g=i._internal)==null?void 0:g.currentDate)==null?void 0:T.call(g).getTime())!=null?U:Date.now();if(!f||A-c>E)c=A,f=new yk0({baseURL:w,headers:$,fetch:i.fetch}).getAvailableModels().then((G)=>{return l=G,G}).catch(async(G)=>{throw await Uw(G,await Z8(await $()))});return l?Promise.resolve(l):f},D=async()=>{return new yk0({baseURL:w,headers:$,fetch:i.fetch}).getCredits().catch(async(g)=>{throw await Uw(g,await Z8(await $()))})},_=async(g)=>{return new fCf({baseURL:w,headers:$,fetch:i.fetch}).getSpendReport(g).catch(async(T)=>{throw await Uw(T,await Z8(await $()))})},N=async(g)=>{return new ECf({baseURL:w,headers:$,fetch:i.fetch}).getGenerationInfo(g).catch(async(T)=>{throw await Uw(T,await Z8(await $()))})},Z=function(g){if(new.target)throw Error("The Gateway Provider model function cannot be called with the new keyword.");return v(g)};Z.specificationVersion="v3",Z.getAvailableModels=d,Z.getCredits=D,Z.getSpendReport=_,Z.getGenerationInfo=N,Z.imageModel=(g)=>{return new dCf(g,{provider:"gateway",baseURL:w,headers:$,fetch:i.fetch,o11yHeaders:h()})},Z.languageModel=v;let B=(g)=>{return new $Cf(g,{provider:"gateway",baseURL:w,headers:$,fetch:i.fetch,o11yHeaders:h()})};Z.embeddingModel=B,Z.textEmbeddingModel=B,Z.videoModel=(g)=>{return new ZCf(g,{provider:"gateway",baseURL:w,headers:$,fetch:i.fetch,o11yHeaders:h()})};let F=(g)=>{return new ACf(g,{provider:"gateway",baseURL:w,headers:$,fetch:i.fetch,o11yHeaders:h()})};return Z.rerankingModel=F,Z.reranking=F,Z.chat=Z.languageModel,Z.embedding=Z.embeddingModel,Z.image=Z.imageModel,Z.video=Z.videoModel,Z.tools=YCf,Z}async function QCf(i){let u=rd({settingValue:i.apiKey,environmentVariableName:"AI_GATEWAY_API_KEY"});if(u)return{token:u,authMethod:"api-key"};return{token:await Lk0.getVercelOidcToken(),authMethod:"oidc"}}var Sk0,Lk0,Wbf="vercel.ai.gateway.error",Ulu,Cx0,Mx0,zl,Gk0="GatewayAuthenticationError",Sbf,qx0,Vx0,rx0,$Ti,Ik0="GatewayInvalidRequestError",Lbf,mx0,ex0,ax0,Qbf,xk0="GatewayRateLimitError",Hbf,ox0,sx0,px0,zbf,kk0="GatewayModelNotFoundError",nbf,uk0,Rbf,tk0,fk0,bbf,jk0="GatewayInternalServerError",Cbf,lk0,Ek0,ck0,wk0,Xk0="GatewayFailedDependencyError",Mbf,$k0,hk0,vk0,qbf,Jk0="GatewayForbiddenError",Vbf,dk0,Dk0,_k0,rbf,Kk0="GatewayResponseError",mbf,Nk0,Ok0,Zk0,ebf,abf,Yk0="GatewayTimeoutError",sbf,Fk0,gk0,Tk0,Uk0,Wk0="ai-gateway-auth-method",pbf,iCf,yk0=class{constructor(i){this.config=i}async getAvailableModels(){try{let{value:i}=await v$({url:`${this.config.baseURL}/config`,headers:await R0(this.config.headers()),successfulResponseHandler:ht(uCf),failedResponseHandler:S1({errorSchema:Hl.any(),errorToMessage:(u)=>u}),fetch:this.config.fetch});return i}catch(i){throw await Uw(i)}}async getCredits(){try{let i=new URL(this.config.baseURL),{value:u}=await v$({url:`${i.origin}/v1/credits`,headers:await R0(this.config.headers()),successfulResponseHandler:ht(tCf),failedResponseHandler:S1({errorSchema:Hl.any(),errorToMessage:(t)=>t}),fetch:this.config.fetch});return u}catch(i){throw await Uw(i)}}},uCf,tCf,fCf=class{constructor(i){this.config=i}async getSpendReport(i){try{let u=new URL(this.config.baseURL),t=new URLSearchParams;if(t.set("start_date",i.startDate),t.set("end_date",i.endDate),i.groupBy)t.set("group_by",i.groupBy);if(i.datePart)t.set("date_part",i.datePart);if(i.userId)t.set("user_id",i.userId);if(i.model)t.set("model",i.model);if(i.provider)t.set("provider",i.provider);if(i.credentialType)t.set("credential_type",i.credentialType);if(i.tags&&i.tags.length>0)t.set("tags",i.tags.join(","));let{value:f}=await v$({url:`${u.origin}/v1/report?${t.toString()}`,headers:await R0(this.config.headers()),successfulResponseHandler:ht(lCf),failedResponseHandler:S1({errorSchema:j6.any(),errorToMessage:(l)=>l}),fetch:this.config.fetch});return f}catch(u){throw await Uw(u)}}},lCf,ECf=class{constructor(i){this.config=i}async getGenerationInfo(i){try{let u=new URL(this.config.baseURL),{value:t}=await v$({url:`${u.origin}/v1/generation?id=${encodeURIComponent(i.id)}`,headers:await R0(this.config.headers()),successfulResponseHandler:ht(cCf),failedResponseHandler:S1({errorSchema:Ql.any(),errorToMessage:(f)=>f}),fetch:this.config.fetch});return t}catch(u){throw await Uw(u)}}},cCf,wCf=class{constructor(i,u){this.modelId=i,this.config=u,this.specificationVersion="v3",this.supportedUrls={"*/*":[/.*/]}}get provider(){return this.config.provider}async getArgs(i){let{abortSignal:u,...t}=i;return{args:this.maybeEncodeFileParts(t),warnings:[]}}async doGenerate(i){let{args:u,warnings:t}=await this.getArgs(i),{abortSignal:f}=i,l=await R0(this.config.headers());try{let{responseHeaders:E,value:c,rawValue:w}=await Tt({url:this.getUrl(),headers:ut(l,i.headers,this.getModelConfigHeaders(this.modelId,!1),await R0(this.config.o11yHeaders)),body:u,successfulResponseHandler:ht(wTi.any()),failedResponseHandler:S1({errorSchema:wTi.any(),errorToMessage:($)=>$}),...f&&{abortSignal:f},fetch:this.config.fetch});return{...c,request:{body:u},response:{headers:E,body:w},warnings:t}}catch(E){throw await Uw(E,await Z8(l))}}async doStream(i){let{args:u,warnings:t}=await this.getArgs(i),{abortSignal:f}=i,l=await R0(this.config.headers());try{let{value:E,responseHeaders:c}=await Tt({url:this.getUrl(),headers:ut(l,i.headers,this.getModelConfigHeaders(this.modelId,!0),await R0(this.config.o11yHeaders)),body:u,successfulResponseHandler:Fc(wTi.any()),failedResponseHandler:S1({errorSchema:wTi.any(),errorToMessage:(w)=>w}),...f&&{abortSignal:f},fetch:this.config.fetch});return{stream:E.pipeThrough(new TransformStream({start(w){if(t.length>0)w.enqueue({type:"stream-start",warnings:t})},transform(w,$){if(w.success){let h=w.value;if(h.type==="raw"&&!i.includeRawChunks)return;if(h.type==="response-metadata"&&h.timestamp&&typeof h.timestamp==="string")h.timestamp=new Date(h.timestamp);$.enqueue(h)}else $.error(w.error)}})),request:{body:u},response:{headers:c}}}catch(E){throw await Uw(E,await Z8(l))}}isFilePart(i){return i&&typeof i==="object"&&"type"in i&&i.type==="file"}maybeEncodeFileParts(i){for(let u of i.prompt)for(let t of u.content)if(this.isFilePart(t)){let f=t;if(f.data instanceof Uint8Array){let l=Uint8Array.from(f.data),E=Buffer.from(l).toString("base64");f.data=new URL(`data:${f.mediaType||"application/octet-stream"};base64,${E}`)}}return i}getUrl(){return`${this.config.baseURL}/language-model`}getModelConfigHeaders(i,u){return{"ai-language-model-specification-version":"3","ai-language-model-id":i,"ai-language-model-streaming":String(u)}}},$Cf=class{constructor(i,u){this.modelId=i,this.config=u,this.specificationVersion="v3",this.maxEmbeddingsPerCall=2048,this.supportsParallelCalls=!0}get provider(){return this.config.provider}async doEmbed({values:i,headers:u,abortSignal:t,providerOptions:f}){var l,E;let c=await R0(this.config.headers());try{let{responseHeaders:w,value:$,rawValue:h}=await Tt({url:this.getUrl(),headers:ut(c,u!=null?u:{},this.getModelConfigHeaders(),await R0(this.config.o11yHeaders)),body:{values:i,...f?{providerOptions:f}:{}},successfulResponseHandler:ht(vCf),failedResponseHandler:S1({errorSchema:x1.any(),errorToMessage:(v)=>v}),...t&&{abortSignal:t},fetch:this.config.fetch});return{embeddings:$.embeddings,usage:(l=$.usage)!=null?l:void 0,providerMetadata:$.providerMetadata,response:{headers:w,body:h},warnings:(E=$.warnings)!=null?E:[]}}catch(w){throw await Uw(w,await Z8(c))}}getUrl(){return`${this.config.baseURL}/embedding-model`}getModelConfigHeaders(){return{"ai-embedding-model-specification-version":"3","ai-model-id":this.modelId}}},hCf,vCf,dCf=class{constructor(i,u){this.modelId=i,this.config=u,this.specificationVersion="v3",this.maxImagesPerCall=Number.MAX_SAFE_INTEGER}get provider(){return this.config.provider}async doGenerate({prompt:i,n:u,size:t,aspectRatio:f,seed:l,files:E,mask:c,providerOptions:w,headers:$,abortSignal:h}){var v,d,D,_;let N=await R0(this.config.headers());try{let{responseHeaders:Z,value:B,rawValue:F}=await Tt({url:this.getUrl(),headers:ut(N,$!=null?$:{},this.getModelConfigHeaders(),await R0(this.config.o11yHeaders)),body:{prompt:i,n:u,...t&&{size:t},...f&&{aspectRatio:f},...l&&{seed:l},...w&&{providerOptions:w},...E&&{files:E.map((g)=>Pk0(g))},...c&&{mask:Pk0(c)}},successfulResponseHandler:ht(OCf),failedResponseHandler:S1({errorSchema:i1.any(),errorToMessage:(g)=>g}),...h&&{abortSignal:h},fetch:this.config.fetch});return{images:B.images,warnings:(v=B.warnings)!=null?v:[],providerMetadata:B.providerMetadata,response:{timestamp:new Date,modelId:this.modelId,headers:Z},...B.usage!=null&&{usage:{inputTokens:(d=B.usage.inputTokens)!=null?d:void 0,outputTokens:(D=B.usage.outputTokens)!=null?D:void 0,totalTokens:(_=B.usage.totalTokens)!=null?_:void 0}}}}catch(Z){throw await Uw(Z,await Z8(N))}}getUrl(){return`${this.config.baseURL}/image-model`}getModelConfigHeaders(){return{"ai-image-model-specification-version":"3","ai-model-id":this.modelId}}},DCf,_Cf,NCf,OCf,ZCf=class{constructor(i,u){this.modelId=i,this.config=u,this.specificationVersion="v3",this.maxVideosPerCall=Number.MAX_SAFE_INTEGER}get provider(){return this.config.provider}async doGenerate({prompt:i,n:u,aspectRatio:t,resolution:f,duration:l,fps:E,seed:c,image:w,providerOptions:$,headers:h,abortSignal:v}){var d;let D=await R0(this.config.headers());try{let{responseHeaders:_,value:N}=await Tt({url:this.getUrl(),headers:ut(D,h!=null?h:{},this.getModelConfigHeaders(),await R0(this.config.o11yHeaders),{accept:"text/event-stream"}),body:{prompt:i,n:u,...t&&{aspectRatio:t},...f&&{resolution:f},...l&&{duration:l},...E&&{fps:E},...c&&{seed:c},...$&&{providerOptions:$},...w&&{image:BCf(w)}},successfulResponseHandler:async({response:Z,url:B,requestBodyValues:F})=>{if(Z.body==null)throw new Nt({message:"SSE response body is empty",url:B,requestBodyValues:F,statusCode:Z.status});let T=U2({stream:Z.body,schema:UCf}).getReader(),{done:U,value:A}=await T.read();if(T.releaseLock(),U||!A)throw new Nt({message:"SSE stream ended without a data event",url:B,requestBodyValues:F,statusCode:Z.status});if(!A.success)throw new Nt({message:"Failed to parse video SSE event",cause:A.error,url:B,requestBodyValues:F,statusCode:Z.status});let G=A.value;if(G.type==="error")throw new Nt({message:G.message,statusCode:G.statusCode,url:B,requestBodyValues:F,responseHeaders:Object.fromEntries([...Z.headers]),responseBody:JSON.stringify(G),data:{error:{message:G.message,type:G.errorType,param:G.param}}});return{value:{videos:G.videos,warnings:G.warnings,providerMetadata:G.providerMetadata},responseHeaders:Object.fromEntries([...Z.headers])}},failedResponseHandler:S1({errorSchema:pt.any(),errorToMessage:(Z)=>Z}),...v&&{abortSignal:v},fetch:this.config.fetch});return{videos:N.videos,warnings:(d=N.warnings)!=null?d:[],providerMetadata:N.providerMetadata,response:{timestamp:new Date,modelId:this.modelId,headers:_}}}catch(_){throw await Uw(_,await Z8(D))}}getUrl(){return`${this.config.baseURL}/video-model`}getModelConfigHeaders(){return{"ai-video-model-specification-version":"3","ai-model-id":this.modelId}}},FCf,gCf,TCf,UCf,ACf=class{constructor(i,u){this.modelId=i,this.config=u,this.specificationVersion="v3"}get provider(){return this.config.provider}async doRerank({documents:i,query:u,topN:t,headers:f,abortSignal:l,providerOptions:E}){var c;let w=await R0(this.config.headers());try{let{responseHeaders:$,value:h,rawValue:v}=await Tt({url:this.getUrl(),headers:ut(w,f!=null?f:{},this.getModelConfigHeaders(),await R0(this.config.o11yHeaders)),body:{documents:i,query:u,...t!=null?{topN:t}:{},...E?{providerOptions:E}:{}},successfulResponseHandler:ht(PCf),failedResponseHandler:S1({errorSchema:Q1.any(),errorToMessage:(d)=>d}),...l&&{abortSignal:l},fetch:this.config.fetch});return{ranking:h.ranking,providerMetadata:h.providerMetadata,response:{headers:$,body:v},warnings:(c=h.warnings)!=null?c:[]}}catch($){throw await Uw($,await Z8(w))}}getUrl(){return`${this.config.baseURL}/reranking-model`}getModelConfigHeaders(){return{"ai-reranking-model-specification-version":"3","ai-model-id":this.modelId}}},yCf,PCf,GCf,ICf,xCf,kCf=(i={})=>xCf(i),jCf,XCf,JCf,KCf=(i={})=>JCf(i),YCf,SCf="3.0.133",LCf="0.0.1",hTi;var Yo=O(()=>{uu();eu();uu();uu();uu();uu();uu();uu();uu();uu();uu();eu();uu();uu();uu();uu();Sk0=j(Tlu(),1),Lk0=j(Tlu(),1),Ulu=Symbol.for(Wbf),zl=class i extends(Mx0=Error,Cx0=Ulu,Mx0){constructor({message:u,statusCode:t=500,cause:f,generationId:l,isRetryable:E=t!=null&&(t===408||t===409||t===429||t>=500)}){super(l?`${u} [${l}]`:u);this[Cx0]=!0,this.statusCode=t,this.cause=f,this.generationId=l,this.isRetryable=E}static isInstance(u){return i.hasMarker(u)}static hasMarker(u){return typeof u==="object"&&u!==null&&Ulu in u&&u[Ulu]===!0}},Sbf=`vercel.ai.gateway.error.${Gk0}`,qx0=Symbol.for(Sbf),$Ti=class i extends(rx0=zl,Vx0=qx0,rx0){constructor({message:u="Authentication failed",statusCode:t=401,cause:f,generationId:l}={}){super({message:u,statusCode:t,cause:f,generationId:l});this[Vx0]=!0,this.name=Gk0,this.type="authentication_error"}static isInstance(u){return zl.hasMarker(u)&&qx0 in u}static createContextualError({apiKeyProvided:u,oidcTokenProvided:t,message:f="Authentication failed",statusCode:l=401,cause:E,generationId:c}){let w;if(u)w=`AI Gateway authentication failed: Invalid API key.
 
 Create a new API key: https://vercel.com/d?to=%2F%5Bteam%5D%2F%7E%2Fai%2Fapi-keys