decocms 4.155.2 → 4.155.3

package/dist/server/cli.js

@@ -83538,7 +83538,7 @@ ${w}`;v(B);return}if(c(null,F),t.strategy==="count"){if($--,$===0)v()}if(t.strat
   `);function v(d){if(t===void 0)return!0;let D=Pq(d),_=D&&Pq(t)?bau(t):t,N=D?bau(d):Cau(d),Z=Drt(_,N);return Z===""||!Z.startsWith("..")&&!vrt(Z)}return{upsert(d){f.run({$handle:d.handle,$status:d.status,$sandboxPath:d.sandboxPath,$port:d.port??null,$previewUrl:d.previewUrl??null,$repoCloneUrl:d.repoCloneUrl??null,$branch:d.branch??null,$projectName:d.projectName??null,$error:d.error??null,$now:Date.now()})},list(){return l.all().map(l6i)},reconcile(){let d=Date.now();for(let D of l.all().map(l6i)){if(!v(D.sandboxPath)){E.run({$handle:D.handle,$now:d});continue}if(!Pq(D.sandboxPath)){c.run({$handle:D.handle,$now:d});continue}if(D.status==="spawning"||D.status==="ready"||D.status==="failed"||D.status==="missing")w.run({$handle:D.handle,$now:d})}return l.all().map(l6i)},prune(d){let D=[],_=[],N=this.reconcile();for(let Z of N){if(!v(Z.sandboxPath)){_.push({handle:Z.handle,sandboxPath:Z.sandboxPath,reason:"outside_root",deletedFiles:!1});continue}if(d.missing&&Z.status==="missing"){$.run({$handle:Z.handle}),D.push({handle:Z.handle,sandboxPath:Z.sandboxPath,reason:"missing",deletedFiles:!1});continue}if(!d.merged||!Pq(Z.sandboxPath))continue;if(Z.branch===null||Z.branch.trim()===""){_.push({handle:Z.handle,sandboxPath:Z.sandboxPath,reason:"no_branch",deletedFiles:!1});continue}if(!W_(Z.sandboxPath,["rev-parse","--is-inside-work-tree"]).ok){_.push({handle:Z.handle,sandboxPath:Z.sandboxPath,reason:"git_unavailable",deletedFiles:!1});continue}let B=W_(Z.sandboxPath,["status","--porcelain"]);if(!B.ok){_.push({handle:Z.handle,sandboxPath:Z.sandboxPath,reason:"git_unavailable",deletedFiles:!1});continue}if(B.stdout.trim()!==""){_.push({handle:Z.handle,sandboxPath:Z.sandboxPath,reason:"dirty_worktree",deletedFiles:!1});continue}let F=qau(Z.sandboxPath,Z.branch);if(F===null){_.push({handle:Z.handle,sandboxPath:Z.sandboxPath,reason:"git_unavailable",deletedFiles:!1});continue}if(!F){_.push({handle:Z.handle,sandboxPath:Z.sandboxPath,reason:"branch_not_merged",deletedFiles:!1});continue}$rt(Z.sandboxPath,{recursive:!0,force:!0}),$.run({$handle:Z.handle}),D.push({handle:Z.handle,sandboxPath:Z.sandboxPath,reason:"merged",deletedFiles:!0})}return{removed:D,skipped:_}},delete(d){$.run({$handle:d})},inspect(d){let D=h.get({$handle:d});if(D===null)return null;let _=l6i(D),N=0,Z=null;if(Pq(_.sandboxPath)&&W_(_.sandboxPath,["rev-parse","--is-inside-work-tree"]).ok){let B=W_(_.sandboxPath,["status","--porcelain"]);if(B.ok){let F=B.stdout.trim();N=F===""?0:F.split(`
 `).length}if(_.branch!==null&&_.branch.trim()!=="")Z=qau(_.sandboxPath,_.branch)}return{handle:_.handle,branch:_.branch,sandboxPath:_.sandboxPath,dirtyCount:N,merged:Z}},close(){u.close()}}}var Ybi=()=>{};function Zrt(i,u){return u?[["umount","-f",i]]:[["fusermount","-uz",i],["umount","-l",i]]}function rau(i,u){if(process.platform==="win32")return;for(let t of Zrt(i,u))if(Bun.spawnSync(t,{stdout:"ignore",stderr:"ignore",timeout:5000}).exitCode===0)break}var mau=()=>{};import{existsSync as Brt,readdirSync as Frt}from"fs";import{rm as grt}from"fs/promises";import{join as eau}from"path";async function aau(i,u={}){let t=u.detach??Urt,f=u.exists??Brt,l=u.readdir??((w)=>Frt(w)),E=u.rm??((w)=>grt(w,{recursive:!0,force:!0})),c=eau(i,"org");if(f(c))for(let w of l(c))t(eau(c,w));await E(i)}var Urt=(i)=>rau(i,process.platform==="darwin");var oau=O(()=>{mau()});import{join as Trt}from"path";function sau(i){let u=i.purge??aau;return{stopSandbox(t){return i.provider.deleteSandbox(t)},inspectSandbox(t){return i.registry.inspect(t)},async removeSandbox(t){try{return await F1(async()=>{if(await i.provider.deleteSandbox(t),i.provider.hasHandle(t))throw Error("Can't delete \u2014 run in progress");let l=i.registry.inspect(t)?.sandboxPath??Trt(i.dataDir,"sandboxes",t);await u(l)},{maxAttempts:2,minTimeout:250,jitter:0}),i.registry.delete(t),{ok:!0}}catch(f){let l=f instanceof H6?f.cause:f;return{ok:!1,error:l instanceof Error?l.message:String(l)}}}}}var pau=O(()=>{Z4();oau()});import{randomBytes as Art}from"crypto";import{mkdir as Prt}from"fs/promises";import{createServer as yrt}from"net";import{join as Grt}from"path";function iou(i,u){return Error(`sandbox failed to start: ${i}`,{cause:u})}function uou(i){if(!(i instanceof Error))return!1;return i.name==="TimeoutError"||/timed out|timeout|operation was aborted|aborted/i.test(i.message)}function tou(i){if(i instanceof Error){let u=i.cause;if(u instanceof Error&&u.message)return u.message;return i.message}return String(i)}function Irt(i){if(!i)return null;let u=i.trim().replace(/\/+$/,"");if(!u)return null;let t=u.split(/[/:]/).filter(Boolean).at(-1);if(!t)return null;return t.replace(/\.git$/i,"")||null}function xrt(i){return{repoCloneUrl:i.repo?.cloneUrl??null,branch:i.repo?.branch??null,projectName:Irt(i.repo?.cloneUrl)}}function fou(i){let u=i.maxSandboxes??20,t=new Map,f=i.pickPort??krt,l=i.fetchImpl??fetch,E=i.resolvePreviewUrl??((N,Z)=>`http://127.0.0.1:${Z}`),c=(N)=>Grt(i.dataDir,"sandboxes",N),w=(N)=>{try{i.registry?.upsert(N)}catch(Z){console.warn(`[user-desktop] failed to persist sandbox lifecycle handle=${N.handle} status=${N.status}:`,Z)}},$=(N)=>{try{i.onEvent?.(N)}catch{}},h=async(N)=>{let Z=new AbortController,B=setTimeout(()=>Z.abort(),1500);try{let F=await l(`${N}/health`,{signal:Z.signal});if(!F.ok)console.warn(`[user-desktop] probe ${N}/health \u2192 ${F.status} (treating as dead)`);return F.ok}catch(F){return console.warn(`[user-desktop] probe ${N}/health failed: ${F instanceof Error?F.message:String(F)} (treating as dead)`),!1}finally{clearTimeout(B)}},v=(N)=>{console.warn(`[user-desktop] evicting dead daemon handle=${N.handle} port=${N.port}`);try{N.process.kill("SIGTERM")}catch{}if(t.get(N.handle)===N)t.delete(N.handle),w({handle:N.handle,status:"stopped",sandboxPath:c(N.handle),port:null,previewUrl:null,...N.registryMetadata,error:null}),$({handle:N.handle,phase:"evicted"})},d=new Map;function D(){if(t.size<u)return;let N=[...t.values()].filter((B)=>B.activeDispatchCount===0).sort((B,F)=>B.lastUsedAt-F.lastUsedAt);if(N.length===0){console.warn(`[user-desktop] at cap ${t.size}/${u} but every sandbox is pinned (active dispatch) \u2014 exceeding cap temporarily`);return}let Z=N[0];console.log(`[user-desktop] evicting LRU victim handle=${Z.handle} port=${Z.port} (cap ${u} reached, size=${t.size})`);try{Z.process.kill("SIGTERM")}catch{}t.delete(Z.handle),w({handle:Z.handle,status:"stopped",sandboxPath:c(Z.handle),port:null,previewUrl:null,...Z.registryMetadata,error:null}),$({handle:Z.handle,phase:"evicted"})}let _=async(N)=>{let Z=xrt(N),B=c(N.handle);w({handle:N.handle,status:"spawning",sandboxPath:B,port:null,previewUrl:null,...Z,error:null}),$({handle:N.handle,phase:"spawning",sandboxPath:B,projectName:Z.projectName,branch:Z.branch}),D();let F,g=null,U;try{await Prt(B,{recursive:!0}),console.log(`[user-desktop] ensure handle=${N.handle} repo=${N.repo?.cloneUrl??"(none)"} branch=${N.repo?.branch??"(none)"} runtime=${N.workload?.runtime??"(autodetect)"} pm=${N.workload?.packageManager??"(autodetect)"}`),U=Art(24).toString("hex");let[k,I]=await Promise.all([f(),f()]);F=k,console.log(`[user-desktop] spawn handle=${N.handle} port=${F} devPort=${I} workdir=${B}`),g=await Promise.resolve(i.spawnDaemon({workdir:B,handle:N.handle,port:F,daemonToken:U,offloadAllowedHosts:N.offloadAllowedHosts??[],offloadAllowSameHostDev:N.offloadAllowSameHostDev??!1,orgFsConfigJson:N.orgFsConfigJson}));try{await i.waitForHealth(F)}catch(j){throw iou("the sandbox didn't come online in time",j)}console.log(`[user-desktop] healthy handle=${N.handle} port=${F} \u2014 posting config`);try{await i.postConfig(F,I,{repo:N.repo,workload:N.workload,operator:N.operator},U)}catch(j){throw iou(uou(j)?"configuration timed out":"the sandbox rejected its configuration",j)}}catch(k){if((uou(k)?console.warn:console.error)(`[user-desktop] sandbox bring-up failed handle=${N.handle} port=${F??"(none)"}${g?" (killing daemon)":""}:`,k),g)try{g.kill("SIGKILL")}catch{}throw $({handle:N.handle,phase:"failed",error:tou(k),sandboxPath:B,projectName:Z.projectName,branch:Z.branch}),w({handle:N.handle,status:"failed",sandboxPath:B,port:null,previewUrl:null,...Z,error:tou(k)}),k}if(!g||F===void 0)throw Error("sandbox bring-up invariant violated");let T=`http://127.0.0.1:${F}`,A=E(N.handle,F);console.log(`[user-desktop] ready handle=${N.handle} port=${F} sandboxApiUrl=${T} previewUrl=${A}`);let G={handle:N.handle,port:F,process:g,sandboxApiUrl:T,previewUrl:A,lastUsedAt:Date.now(),activeDispatchCount:0,daemonToken:U,registryMetadata:Z};if(t.set(N.handle,G),w({handle:N.handle,status:"ready",sandboxPath:B,port:F,previewUrl:A,...Z,error:null}),$({handle:N.handle,phase:"ready",port:F,previewUrl:A,sandboxPath:B,projectName:Z.projectName,branch:Z.branch}),g.exited)g.exited.then(()=>{if(t.get(N.handle)===G)console.warn(`[user-desktop] daemon process exited unexpectedly handle=${N.handle} port=${F} \u2014 removing from cache`),t.delete(N.handle),w({handle:N.handle,status:"stopped",sandboxPath:B,port:null,previewUrl:null,...Z,error:null}),$({handle:N.handle,phase:"evicted"});else console.log(`[user-desktop] daemon process exited handle=${N.handle} port=${F} (already replaced/removed)`)});return{sandboxApiUrl:T,previewUrl:A,port:F}};return{async ensureSandbox(N){let Z=t.get(N.handle);if(Z){if(await h(Z.sandboxApiUrl))return console.log(`[user-desktop] cache hit handle=${N.handle} port=${Z.port} (alive)`),Z.lastUsedAt=Date.now(),{sandboxApiUrl:Z.sandboxApiUrl,previewUrl:Z.previewUrl,port:Z.port};console.warn(`[user-desktop] cache stale handle=${N.handle} port=${Z.port} \u2014 respawning`),v(Z)}let B=d.get(N.handle);if(B)return console.log(`[user-desktop] joining in-flight ensure handle=${N.handle}`),B;let F=_(N).finally(()=>{d.delete(N.handle)});return d.set(N.handle,F),F},proxyPort(N){let Z=t.get(N);if(Z)Z.lastUsedAt=Date.now();return Z?.port??null},getDaemonToken(N){return t.get(N)?.daemonToken??null},hasHandle(N){return t.has(N)||d.has(N)},recordHit(N){let Z=t.get(N);if(Z)Z.lastUsedAt=Date.now()},acquireDispatch(N){let Z=t.get(N);if(!Z)return()=>{};Z.activeDispatchCount+=1;let B=!1;return()=>{if(B)return;B=!0;let F=t.get(N);if(F)F.activeDispatchCount=Math.max(0,F.activeDispatchCount-1)}},listSandboxes(){return[...t.values()]},async deleteSandbox(N){let Z=t.get(N);if(!Z){console.log(`[user-desktop] delete handle=${N} (not found, no-op)`);return}if(Z.activeDispatchCount>0){console.warn(`[user-desktop] delete handle=${N} port=${Z.port} REFUSED \u2014 ${Z.activeDispatchCount} active dispatch(es) in flight`);return}console.log(`[user-desktop] delete handle=${N} port=${Z.port}`);try{Z.process.kill("SIGTERM")}catch{}t.delete(N),w({handle:N,status:"stopped",sandboxPath:c(N),port:null,previewUrl:null,repoCloneUrl:null,branch:null,projectName:null,error:null}),$({handle:N,phase:"deleted"})},async shutdown(){console.log(`[user-desktop] shutdown \u2014 killing ${t.size} sandbox(es)`);for(let N of t.values())try{N.process.kill("SIGTERM")}catch{}t.clear()}}}function krt(){return new Promise((i,u)=>{let t=yrt();t.unref(),t.on("error",u),t.listen(0,"127.0.0.1",()=>{let f=t.address();if(f&&typeof f==="object"){let l=f.port;t.close(()=>i(l))}else t.close(()=>u(Error("could not allocate port")))})})}var lou=()=>{};import{randomUUID as jrt}from"crypto";import{hostname as Xrt}from"os";async function Eou(i){let u=Xrt()||void 0;i.monitor?.onMachine?.(u??"this machine");let t=HMu(i.dataDir,{outFd:i.logFd,perSandboxLog:i.perSandboxLogs,hotReload:i.hotReload}),f=c6i({path:E6i(i.dataDir),managedSandboxRoot:`${i.dataDir}/sandboxes`}),l=!1,E=()=>{if(l)return;l=!0;try{f.close()}catch{}};try{let c=0,w=fou({dataDir:i.dataDir,registry:f,resolvePreviewUrl:(j,C)=>c>0?`http://${j}.localhost:${c}`:`http://127.0.0.1:${C}`,spawnDaemon:async(j)=>{let C={DAEMON_BOOT_ID:jrt(),APP_ROOT:j.workdir,PROXY_PORT:String(j.port),DAEMON_TOKEN:j.daemonToken,OFFLOAD_ALLOWED_HOSTS:j.offloadAllowedHosts.join(","),...j.offloadAllowSameHostDev?{OFFLOAD_ALLOW_SAME_HOST_DEV:"1"}:{}};if(j.orgFsConfigJson){let S=await bMu(i.dataDir);if(S)C.ORGFS_CONFIG=j.orgFsConfigJson,C.ORGFS_RCLONE_PATH=S}let K=await t({workdir:j.workdir,env:C,daemonPort:j.port});return{port:j.port,kill:(S)=>K.kill(S),exited:K.exited.then(()=>{return})}},postConfig:async(j,C,K,S)=>{let r={port:C};if(K.workload)r.runtime=K.workload.runtime,r.packageManager={name:K.workload.packageManager,...K.workload.packageManagerPath?{path:K.workload.packageManagerPath}:{}};let Q={application:r},fi=gh(K.operator??null);if(fi)Q.operator=fi;if(K.repo)Q.git={repository:{cloneUrl:K.repo.cloneUrl,branch:K.repo.branch,...K.repo.submoduleCredentials&&K.repo.submoduleCredentials.length>0?{submoduleCredentials:K.repo.submoduleCredentials}:{}},...K.repo.userName&&K.repo.userEmail?{identity:{userName:K.repo.userName,userEmail:K.repo.userEmail}}:{}};await P_(`http://127.0.0.1:${j}`,S,Q)},waitForHealth:async(j)=>{await lli(`http://127.0.0.1:${j}`)},maxSandboxes:20,onEvent:i.monitor?.onEvent}),$=await Xau({port:i.port,lookupSandboxPort:(j)=>w.proxyPort(j)});c=$.port,console.log(`Local ingress listening on http://127.0.0.1:${$.port} (use http://<handle>.localhost:${$.port}/)`),i.monitor?.onIngress?.($.port);let h=MMu({provider:w}),v=async()=>{let j=await A_({dataDir:i.dataDir,target:i.clusterBaseUrl});if(!j)throw Object.assign(Error(`Session for ${i.clusterBaseUrl} is no longer valid \u2014 run \`deco auth login --target ${i.clusterBaseUrl}\` and restart \`deco link\`.`),{fatal:!0});return j.accessToken},d=await nau(i.dataDir),D=process.env.npm_package_version??"0.0.0",_=await Kbi(),N=Hau(_,{onChange:(j)=>{console.log(`[link-daemon] capabilities detected: +${j.join(",")} (now: ${_.join(",")})`)}}),Z=Tni({path:`${i.dataDir}/link/outbox.sqlite`});Z.clear();let B=()=>{},F=new AbortController,g={clusterBaseUrl:i.clusterBaseUrl,getAccessToken:v,provider:w,outbox:Z,controlHandler:h,capabilities:_,machineId:d,cliVersion:D,previewPort:$.port,onConnected:()=>{i.monitor?.onCluster?.("linked"),console.log(`Linked to ${i.clusterBaseUrl}`)},onShutdown:()=>B(),runLifetimeSignal:F.signal};console.log(`[link-daemon] transport=tunnel cluster=${i.clusterBaseUrl}`);let U=await Fau(g);console.log("[link-daemon] active transport=tunnel");let T,A=new Promise((j)=>{T=j}),G=!1,k=async()=>{if(G)return;G=!0,F.abort(),console.log(`
 Shutting down\u2026`),N();try{await U.close()}catch{}try{await $.stop()}catch{}try{await w.shutdown()}catch{}try{Z.close()}catch{}E(),T(0)};process.on("SIGINT",()=>void k()),process.on("SIGTERM",()=>void k()),B=()=>{console.log("Disconnect requested from the Studio web UI \u2014 shutting down. Run `bunx decocms@latest link` to reconnect."),k()},U.closed.then(()=>{if(i.monitor?.onCluster?.("closed"),!G)console.error("Cluster connection closed permanently; exiting."),k()});let I=sau({provider:w,registry:f,dataDir:i.dataDir});return{stopped:A,stop:k,stopSandbox:I.stopSandbox,removeSandbox:I.removeSandbox,inspectSandbox:I.inspectSandbox}}catch(c){throw E(),c}}var cou=O(()=>{Nni();rM();zMu();CMu();qMu();Ani();gau();Jau();zau();Rau();VM();Ybi();pau();lou()});function Wbi(i){return i.map((u)=>typeof u==="string"?u:String(u)).join(" ")}import{createServer as Jrt}from"net";async function Yrt(i){for(let u of Krt)if(await Lbi(i,u))return u;return null}async function wou(i,{intervalMs:u=1000,sleepFn:t=y0}={}){for(;;){let f=await Yrt(i);if(f)return f;await t(u)}}function Lbi(i,u){return new Promise((t)=>{let f=Jrt();f.once("error",(l)=>{t(l.code==="EADDRINUSE")}),f.listen(i,u,()=>{f.close(()=>t(!1))})})}var Krt;var Sbi=O(()=>{Z4();Krt=["localhost","127.0.0.1","0.0.0.0"]});function $ou(i){return typeof i==="object"&&i!==null&&"code"in i&&i.code==="EADDRINUSE"}function Wrt(i,u=process.platform){if(u==="win32")return`for /f "tokens=5" %P in ('netstat -ano ^| findstr /R /C:":${i} .*LISTENING"') do taskkill /F /PID %P`;return`kill -9 $(lsof -ti tcp:${i})`}function hou(i,u=process.platform){return[`Port ${i} is already in use.`,"Run this command to stop the process listening on it, then retry `decocms link`:","",`  ${Wrt(i,u)}`].join(`
-`)}var Qbi;var vou=O(()=>{Qbi=class Qbi extends Error{port;code="EADDRINUSE";constructor(i){super(`Port ${i} is already in use.`);this.port=i;this.name="PortInUseError"}}});var IS;var w6i=O(()=>{IS={name:"decocms",version:"4.155.2",description:"Deco CMS \u2014 Self-hostable MCP Gateway for managing AI connections and tools",author:"Deco team",repository:{type:"git",url:"git+https://github.com/decocms/studio.git",directory:"apps/api"},bugs:{url:"https://github.com/decocms/studio/issues"},type:"module",bin:{deco:"./dist/server/cli.js"},files:["dist/**/*"],scripts:{dev:"bun run migrate && bun run dev:server","dev:server":"bun run --cwd=../../packages/sandbox build && NODE_ENV=development bun --env-file=.env --hot run src/index.ts",build:"bun run build:server","build:server":"bun run scripts/bundle-server-script.ts --dist ./dist/server","generate:tool-contracts":"bun run scripts/generate-tool-contracts.ts","db:migrate":"bun run ./dist/server/migrate.js",check:"tsc --noEmit",start:"bun run ./dist/server/server.js",migrate:"bun run src/database/migrate.ts",test:"bun test src","better-auth:migrate":"bunx --bun @better-auth/cli migrate -y --config src/auth/index.ts","smoke:link":"bun run scripts/smoke-link.ts",prepublishOnly:"bun run --cwd=../.. build:studio"},optionalDependencies:{"@anthropic-ai/claude-agent-sdk":"^0.3.181","@duckdb/node-api":"^1.5.0-r.1","@openai/codex":"0.144.3","@openai/codex-darwin-arm64":"npm:@openai/codex@0.144.3-darwin-arm64","@openai/codex-darwin-x64":"npm:@openai/codex@0.144.3-darwin-x64","@openai/codex-linux-arm64":"npm:@openai/codex@0.144.3-linux-arm64","@openai/codex-linux-x64":"npm:@openai/codex@0.144.3-linux-x64","@openai/codex-win32-arm64":"npm:@openai/codex@0.144.3-win32-arm64","@openai/codex-win32-x64":"npm:@openai/codex@0.144.3-win32-x64"},dependencies:{"@ai-sdk/anthropic":"^3.0.85","@ai-sdk/google":"^3.0.83","@ai-sdk/openai":"^3.0.73","@anthropic-ai/sdk":"^0.105.0","@aws-sdk/client-s3":"^3.1013.0","@aws-sdk/client-sts":"^3.1013.0","@aws-sdk/lib-storage":"^3.1013.0","@aws-sdk/s3-request-presigner":"^3.1013.0","@clickhouse/client":"^1.8.1","@dbos-inc/dbos-sdk":"^4.21.6","@inkjs/ui":"^2.0.0","@nats-io/jetstream":"3.4.0","@nats-io/kv":"3.4.0","@nats-io/nats-core":"3.4.0","@nats-io/transport-node":"3.4.0","@openrouter/ai-sdk-provider":"^2.9.1","@opentelemetry/core":"^2.6.0","@resvg/resvg-js":"^2.6.2","embedded-postgres":"^18.3.0-beta.16",ink:"^6.8.0",kysely:"^0.28.12","node-pty":"^1.0.0","posthog-node":"^5.0.0",react:"^19.2.6","react-dom":"^19.2.6",satori:"^0.28.2"},devDependencies:{"@ai-sdk/provider":"^3.0.10","@better-auth/sso":"1.4.1","@decocms/better-auth":"1.5.17","@decocms/bindings":"workspace:*","@decocms/harness":"workspace:*","@decocms/mcp-utils":"workspace:*","@decocms/runtime":"workspace:*","@decocms/sandbox":"workspace:*","@decocms/shared":"workspace:*","@decocms/tunnel":"workspace:*","@jitl/quickjs-wasmfile-release-sync":"0.31.0","@modelcontextprotocol/sdk":"1.29.0","@nats-io/jwt":"0.0.10-5","@opentelemetry/api":"^1.9.0","@opentelemetry/api-logs":"^0.211.0","@opentelemetry/exporter-logs-otlp-proto":"^0.211.0","@opentelemetry/exporter-prometheus":"^0.208.0","@opentelemetry/exporter-trace-otlp-proto":"^0.207.0","@opentelemetry/instrumentation-runtime-node":"^0.24.0","@opentelemetry/resources":"^2.6.0","@opentelemetry/sdk-logs":"^0.211.0","@opentelemetry/sdk-metrics":"^2.2.0","@opentelemetry/sdk-node":"^0.207.0","@opentelemetry/sdk-trace-base":"^2.5.0","@types/bun":"^1.3.1","@types/google.maps":"^3.65.2","@types/pg":"^8.15.6","@types/react-syntax-highlighter":"^15.5.13","@vercel/nft":"^1.1.1",ai:"^6.0.208","better-auth":"1.4.22",croner:"^9.1.0",degit:"^2.8.4",hono:"^4.10.7",jose:"^6.0.11",nanoid:"^5.1.6",pg:"^8.16.3",typescript:"^7.0.2",typescript5:"npm:typescript@^5.9.3",vite:"^7.2.1",zod:"4.3.6"},homepage:"https://github.com/decocms/studio",keywords:["mcp","model-context-protocol","ai","gateway","self-hosted","tools"],license:"MIT",publishConfig:{access:"public"}}});var yq={};yi(yq,{printBanner:()=>Qrt,bannerLines:()=>dou,BANNER_LINES:()=>$6i,BANNER_GRADIENT:()=>h6i});function Srt(i){let u=Number.parseInt(i.slice(1),16);return[u>>16&255,u>>8&255,u&255]}function dou(i){let u=$6i.map((t,f)=>{let[l,E,c]=Srt(h6i[f]);return`\x1B[38;2;${l};${E};${c}m${t}\x1B[39m`});if(i!==void 0)u.push(`\x1B[2m  v${i}\x1B[22m`);return u}function Qrt(i){console.log("");for(let u of dou(i))console.log(u);console.log("")}var $6i,h6i;var xS=O(()=>{$6i=[" \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588     \u2588\u2588\u2588\u2588\u2588\u2588\u2588   ","\u2591\u2591\u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2588\u2588\u2588 \u2591\u2591\u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2591\u2588  \u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2591\u2588\u2588\u2588  \u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2591\u2588\u2588\u2588 "," \u2591\u2588\u2588\u2588   \u2591\u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588  \u2588 \u2591  \u2588\u2588\u2588     \u2591\u2591\u2591  \u2588\u2588\u2588     \u2591\u2591\u2588\u2588\u2588"," \u2591\u2588\u2588\u2588    \u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588\u2588\u2588\u2588   \u2591\u2588\u2588\u2588         \u2591\u2588\u2588\u2588      \u2591\u2588\u2588\u2588"," \u2591\u2588\u2588\u2588    \u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588\u2591\u2591\u2588   \u2591\u2588\u2588\u2588         \u2591\u2588\u2588\u2588      \u2591\u2588\u2588\u2588"," \u2591\u2588\u2588\u2588    \u2588\u2588\u2588  \u2591\u2588\u2588\u2588 \u2591   \u2588\u2591\u2591\u2588\u2588\u2588     \u2588\u2588\u2588\u2591\u2591\u2588\u2588\u2588     \u2588\u2588\u2588 "," \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588 \u2591\u2591\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588  \u2591\u2591\u2591\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2591  ","\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591   \u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591   \u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591     \u2591\u2591\u2591\u2591\u2591\u2591\u2591   "],h6i=["#00ff64","#00ee5e","#00dc56","#00c84e","#00b444","#00a03c","#008832","#006e28"]});import{Box as Hrt,Text as Dou}from"ink";import{jsx as zrt,jsxs as _ou}from"react/jsx-runtime";function v6i({version:i}){return _ou(Hrt,{flexDirection:"column",marginTop:1,children:[$6i.map((u,t)=>zrt(Dou,{color:h6i[t],children:u},t)),_ou(Dou,{dimColor:!0,children:[" v",i]})]})}var Hbi=O(()=>{xS()});function Nou(i){let u=i.branch??i.handle,t=[];if(i.dirtyCount>0)t.push(`${i.dirtyCount} uncommitted file${i.dirtyCount===1?"":"s"}`);if(i.merged===!1)t.push("branch not merged");return t.length>0?`\u26A0 ${t.join(", ")} \u2014 delete ${u}? (y/n)`:`Delete ${u}? (y/n)`}function kS(i){return[...i.values()].map((u)=>u.handle).sort((u,t)=>u.localeCompare(t))}function Oou(i,u,t){if(i.length===0)return null;let f=u===null?-1:i.indexOf(u);if(f===-1)return t>0?i[0]:i[i.length-1];let l=Math.max(0,Math.min(i.length-1,f+t));return i[l]}function Zou(i,u,t){if(t!==u)return t;let f=i.indexOf(u);if(f===-1)return t;return i[f+1]??i[f-1]??null}var bbi={};yi(bbi,{subscribeLinkState:()=>zbi,setSelectedHandle:()=>nbi,setRemoving:()=>_6i,setPersistedSandboxes:()=>ert,setPendingConfirm:()=>Iq,setMachine:()=>qrt,setLogPath:()=>rrt,setLinkActions:()=>mrt,setIngress:()=>Mrt,setDaemonError:()=>Vrt,setClusterUrl:()=>Crt,setCluster:()=>brt,setActionError:()=>D6i,resetLinkStateForTests:()=>ort,removeSandboxRow:()=>Rbi,pushSandboxEvent:()=>art,getLinkState:()=>Gq,applySandboxEvent:()=>Bou});function Rrt(i){return i==="spawning"||i==="ready"||i==="failed"}function Bou(i,u){let t=new Map(i),f=t.get(u.handle);if(u.phase==="evicted"||u.phase==="deleted"){if(f)t.set(u.handle,{...f,port:null,previewUrl:null,status:"stopped",error:null});return t}return t.set(u.handle,{handle:u.handle,port:u.port??f?.port??null,previewUrl:u.previewUrl??f?.previewUrl??null,status:u.phase,error:u.phase==="failed"?u.error??"failed":null,projectName:u.projectName??f?.projectName??null,branch:u.branch??f?.branch??null,sandboxPath:u.sandboxPath??f?.sandboxPath??null}),t}function Fou(){return{cluster:"connecting",clusterUrl:null,ingressUrl:null,ingressPort:null,machine:null,cap:nrt,sandboxes:new Map,daemonError:null,logPath:null,selectedHandle:null,pendingConfirm:null,removingHandles:new Set,actionError:null,actions:null}}function Cw(){for(let i of d6i)i()}function Gq(){return Ef}function zbi(i){return d6i.add(i),()=>d6i.delete(i)}function brt(i){Ef={...Ef,cluster:i},Cw()}function Crt(i){Ef={...Ef,clusterUrl:i},Cw()}function Mrt(i,u){Ef={...Ef,ingressPort:i,ingressUrl:u},Cw()}function qrt(i){Ef={...Ef,machine:i},Cw()}function Vrt(i){Ef={...Ef,daemonError:i},Cw()}function rrt(i){Ef={...Ef,logPath:i},Cw()}function nbi(i){Ef={...Ef,selectedHandle:i},Cw()}function Iq(i){Ef={...Ef,pendingConfirm:i},Cw()}function D6i(i){Ef={...Ef,actionError:i},Cw()}function _6i(i,u){if(Ef.removingHandles.has(i)===u)return;let t=new Set(Ef.removingHandles);if(u)t.add(i);else t.delete(i);Ef={...Ef,removingHandles:t},Cw()}function mrt(i){Ef={...Ef,actions:i},Cw()}function Rbi(i){let u=kS(Ef.sandboxes),t=Zou(u,i,Ef.selectedHandle),f=new Map(Ef.sandboxes);f.delete(i);let l=new Set(Ef.removingHandles);l.delete(i),Ef={...Ef,sandboxes:f,selectedHandle:t,pendingConfirm:null,removingHandles:l},Cw()}function ert(i){let u=new Map;for(let t of i)u.set(t.handle,{handle:t.handle,port:t.port,previewUrl:t.previewUrl,status:t.status,error:t.error,projectName:t.projectName,branch:t.branch,sandboxPath:t.sandboxPath});for(let[t,f]of Ef.sandboxes)if(Rrt(f.status))u.set(t,f);Ef={...Ef,sandboxes:u},Cw()}function art(i){Ef={...Ef,sandboxes:Bou(Ef.sandboxes,i)},Cw()}function ort(){Ef=Fou(),d6i.clear()}var nrt=20,Ef,d6i;var xq=O(()=>{Ef=Fou(),d6i=new Set});import{spawn as srt}from"child_process";function prt(i){if(i==="darwin")return"open";if(i==="win32")return"start";return"xdg-open"}function gou(i,u=process.platform){let t=prt(u);try{srt(t,[i],{stdio:"ignore",detached:!0}).unref()}catch{}}var Uou=()=>{};function Tou(i,u={}){let t=u.openUrl??gou,f=Gq(),l=kS(f.sandboxes),E=f.selectedHandle!==null&&l.includes(f.selectedHandle)?f.selectedHandle:l[0]??null,c=f.actions;switch(i.type){case"move":nbi(Oou(l,f.selectedHandle,i.delta));return;case"open":{if(E===null)return;let w=f.sandboxes.get(E);if(w?.status==="ready"&&w.previewUrl)t(w.previewUrl);return}case"stop":if(E!==null&&c)c.stopSandbox(E);return;case"delete":{if(E===null||!c)return;let w=c.inspectSandbox(E),$=f.sandboxes.get(E);D6i(null),Iq({handle:E,branch:w?.branch??$?.branch??null,dirtyCount:w?.dirtyCount??0,merged:w?.merged??null});return}case"confirmYes":{let w=f.pendingConfirm;if(Iq(null),w===null||!c)return;_6i(w.handle,!0),c.removeSandbox(w.handle).then(($)=>{if($.ok)Rbi(w.handle);else _6i(w.handle,!1),D6i($.error)});return}case"confirmNo":Iq(null);return;case"quit":if(c)c.quit();return}}var Aou=O(()=>{xq();Uou()});function Pou(i,u,t){if(t)return i==="y"||i==="Y"?{type:"confirmYes"}:{type:"confirmNo"};if(u.upArrow||i==="k")return{type:"move",delta:-1};if(u.downArrow||i==="j")return{type:"move",delta:1};if(i==="s")return{type:"stop"};if(i==="d")return{type:"delete"};if(i==="o")return{type:"open"};if(i==="q"||u.ctrl===!0&&i==="c")return{type:"quit"};return null}var you={};yi(you,{LinkApp:()=>fmt});import{Box as C1,Text as vl,useInput as imt}from"ink";import{useSyncExternalStore as umt}from"react";import{jsx as Xf,jsxs as Xh}from"react/jsx-runtime";function tmt(i,u){if(u)return{color:"yellow",text:"\u25CC Removing\u2026"};if(i.status==="ready")return{color:"green",text:"\u25CF Live"};if(i.status==="spawning")return{color:"yellow",text:"\u25CC Starting\u2026"};if(i.status==="stopped")return{color:"gray",text:"\u25A0 Stopped"};if(i.status==="missing")return{color:"yellow",text:"\u25A1 Missing"};if(i.status==="merged")return{color:"cyan",text:"\u2713 Merged"};if(i.status==="invalid")return{color:"red",text:"\u2717 Invalid"};if(i.status==="failed")return{color:"red",text:`\u2717 Failed: ${i.error??"failed"}`};return{color:"red",text:`\u2717 Error: ${i.error??""}`}}function fmt(){let i=umt(zbi,Gq),u=[...i.sandboxes.values()].sort((l,E)=>l.handle.localeCompare(E.handle)),t=kS(i.sandboxes),f=i.selectedHandle!==null&&t.includes(i.selectedHandle)?i.selectedHandle:t[0]??null;return imt((l,E)=>{let c=Pou(l,E,i.pendingConfirm!==null);if(c!==null)Tou(c)}),Xh(C1,{flexDirection:"column",children:[Xf(v6i,{version:IS.version}),Xf(C1,{marginBottom:1,children:Xf(vl,{dimColor:!0,children:"\u2500".repeat(80)})}),Xf(C1,{children:i.cluster==="linked"?Xh(vl,{color:"green",children:["\u2713 Connected to ",i.clusterUrl??"deco"]}):i.cluster==="connecting"?Xh(vl,{color:"yellow",children:["\u25CC Connecting to ",i.clusterUrl??"deco","\u2026"]}):Xh(vl,{color:"red",children:["\u2717 Disconnected from ",i.clusterUrl??"deco"]})}),Xf(C1,{children:i.ingressUrl?Xh(vl,{color:"green",children:["\u2713 Serving at ",i.ingressUrl]}):Xf(vl,{dimColor:!0,children:"\u25CC Starting local server\u2026"})}),Xf(C1,{marginBottom:1,children:Xf(vl,{dimColor:!0,children:`${"Computer".padEnd(16)}${i.machine??"this computer"} \xB7 ${u.length} of ${i.cap} previews`})}),u.length===0?Xf(vl,{dimColor:!0,children:"No previews running yet."}):Xh(C1,{flexDirection:"column",children:[Xh(C1,{children:[Xf(C1,{width:2,flexShrink:0}),Xf(C1,{width:jS.project,flexShrink:0,marginRight:1,children:Xf(vl,{dimColor:!0,wrap:"truncate-end",children:"PROJECT"})}),Xf(C1,{width:jS.branch,flexShrink:0,marginRight:1,children:Xf(vl,{dimColor:!0,wrap:"truncate-end",children:"BRANCH"})}),Xf(C1,{width:jS.status,flexShrink:0,marginRight:1,children:Xf(vl,{dimColor:!0,wrap:"truncate-end",children:"STATUS"})}),Xf(C1,{flexGrow:1,children:Xf(vl,{dimColor:!0,wrap:"truncate-end",children:"PREVIEW URL"})})]}),u.map((l)=>{let E=tmt(l,i.removingHandles.has(l.handle)),c=l.handle===f;return Xh(C1,{children:[Xf(C1,{width:2,flexShrink:0,children:Xf(vl,{color:"cyan",children:c?"\u203A":" "})}),Xf(C1,{width:jS.project,flexShrink:0,marginRight:1,children:Xf(vl,{bold:c,wrap:"truncate-end",children:l.projectName??l.handle})}),Xf(C1,{width:jS.branch,flexShrink:0,marginRight:1,children:Xf(vl,{bold:c,wrap:"truncate-end",children:l.branch??"\u2014"})}),Xf(C1,{width:jS.status,flexShrink:0,marginRight:1,children:Xf(vl,{color:E.color,bold:c,wrap:"truncate-end",children:E.text})}),Xf(C1,{flexGrow:1,children:Xf(vl,{dimColor:!0,wrap:"truncate-end",children:l.previewUrl??"\u2014"})})]},l.handle)})]}),i.daemonError?Xf(C1,{marginTop:1,children:Xh(vl,{color:"red",children:["\u26A0 ",i.daemonError]})}):null,i.logPath?Xf(C1,{marginTop:1,children:Xh(vl,{dimColor:!0,children:["Logs: ",i.logPath]})}):null,i.pendingConfirm?Xf(C1,{marginTop:1,children:Xf(vl,{color:"yellow",children:Nou(i.pendingConfirm)})}):null,i.actionError?Xf(C1,{marginTop:1,children:Xh(vl,{color:"red",children:["\u2717 ",i.actionError]})}):null,Xf(C1,{marginTop:1,children:Xf(vl,{dimColor:!0,children:"\u2191\u2193 move \xB7 s stop \xB7 d delete \xB7 o open \xB7 q quit"})})]})}var jS;var Gou=O(()=>{w6i();Hbi();Aou();xq();jS={project:18,branch:22,status:14}});var Iou={};yi(Iou,{runLinkCommand:()=>dmt});import{closeSync as lmt,mkdirSync as Emt,openSync as cmt,writeSync as wmt}from"fs";import{homedir as $mt}from"os";import{join as Cbi}from"path";function hmt(i,u){let t={log:console.log,warn:console.warn,error:console.error},f=(l)=>{if(u===void 0)return;try{wmt(u,`${Wbi(l)}
+`)}var Qbi;var vou=O(()=>{Qbi=class Qbi extends Error{port;code="EADDRINUSE";constructor(i){super(`Port ${i} is already in use.`);this.port=i;this.name="PortInUseError"}}});var IS;var w6i=O(()=>{IS={name:"decocms",version:"4.155.3",description:"Deco CMS \u2014 Self-hostable MCP Gateway for managing AI connections and tools",author:"Deco team",repository:{type:"git",url:"git+https://github.com/decocms/studio.git",directory:"apps/api"},bugs:{url:"https://github.com/decocms/studio/issues"},type:"module",bin:{deco:"./dist/server/cli.js"},files:["dist/**/*"],scripts:{dev:"bun run migrate && bun run dev:server","dev:server":"bun run --cwd=../../packages/sandbox build && NODE_ENV=development bun --env-file=.env --hot run src/index.ts",build:"bun run build:server","build:server":"bun run scripts/bundle-server-script.ts --dist ./dist/server","generate:tool-contracts":"bun run scripts/generate-tool-contracts.ts","db:migrate":"bun run ./dist/server/migrate.js",check:"tsc --noEmit",start:"bun run ./dist/server/server.js",migrate:"bun run src/database/migrate.ts",test:"bun test src","better-auth:migrate":"bunx --bun @better-auth/cli migrate -y --config src/auth/index.ts","smoke:link":"bun run scripts/smoke-link.ts",prepublishOnly:"bun run --cwd=../.. build:studio"},optionalDependencies:{"@anthropic-ai/claude-agent-sdk":"^0.3.181","@duckdb/node-api":"^1.5.0-r.1","@openai/codex":"0.144.3","@openai/codex-darwin-arm64":"npm:@openai/codex@0.144.3-darwin-arm64","@openai/codex-darwin-x64":"npm:@openai/codex@0.144.3-darwin-x64","@openai/codex-linux-arm64":"npm:@openai/codex@0.144.3-linux-arm64","@openai/codex-linux-x64":"npm:@openai/codex@0.144.3-linux-x64","@openai/codex-win32-arm64":"npm:@openai/codex@0.144.3-win32-arm64","@openai/codex-win32-x64":"npm:@openai/codex@0.144.3-win32-x64"},dependencies:{"@ai-sdk/anthropic":"^3.0.85","@ai-sdk/google":"^3.0.83","@ai-sdk/openai":"^3.0.73","@anthropic-ai/sdk":"^0.105.0","@aws-sdk/client-s3":"^3.1013.0","@aws-sdk/client-sts":"^3.1013.0","@aws-sdk/lib-storage":"^3.1013.0","@aws-sdk/s3-request-presigner":"^3.1013.0","@clickhouse/client":"^1.8.1","@dbos-inc/dbos-sdk":"^4.21.6","@inkjs/ui":"^2.0.0","@nats-io/jetstream":"3.4.0","@nats-io/kv":"3.4.0","@nats-io/nats-core":"3.4.0","@nats-io/transport-node":"3.4.0","@openrouter/ai-sdk-provider":"^2.9.1","@opentelemetry/core":"^2.6.0","@resvg/resvg-js":"^2.6.2","embedded-postgres":"^18.3.0-beta.16",ink:"^6.8.0",kysely:"^0.28.12","node-pty":"^1.0.0","posthog-node":"^5.0.0",react:"^19.2.6","react-dom":"^19.2.6",satori:"^0.28.2"},devDependencies:{"@ai-sdk/provider":"^3.0.10","@better-auth/sso":"1.4.1","@decocms/better-auth":"1.5.17","@decocms/bindings":"workspace:*","@decocms/harness":"workspace:*","@decocms/mcp-utils":"workspace:*","@decocms/runtime":"workspace:*","@decocms/sandbox":"workspace:*","@decocms/shared":"workspace:*","@decocms/tunnel":"workspace:*","@jitl/quickjs-wasmfile-release-sync":"0.31.0","@modelcontextprotocol/sdk":"1.29.0","@nats-io/jwt":"0.0.10-5","@opentelemetry/api":"^1.9.0","@opentelemetry/api-logs":"^0.211.0","@opentelemetry/exporter-logs-otlp-proto":"^0.211.0","@opentelemetry/exporter-prometheus":"^0.208.0","@opentelemetry/exporter-trace-otlp-proto":"^0.207.0","@opentelemetry/instrumentation-runtime-node":"^0.24.0","@opentelemetry/resources":"^2.6.0","@opentelemetry/sdk-logs":"^0.211.0","@opentelemetry/sdk-metrics":"^2.2.0","@opentelemetry/sdk-node":"^0.207.0","@opentelemetry/sdk-trace-base":"^2.5.0","@types/bun":"^1.3.1","@types/google.maps":"^3.65.2","@types/pg":"^8.15.6","@types/react-syntax-highlighter":"^15.5.13","@vercel/nft":"^1.1.1",ai:"^6.0.208","better-auth":"1.4.22",croner:"^9.1.0",degit:"^2.8.4",hono:"^4.10.7",jose:"^6.0.11",nanoid:"^5.1.6",pg:"^8.16.3",typescript:"^7.0.2",typescript5:"npm:typescript@^5.9.3",vite:"^7.2.1",zod:"4.3.6"},homepage:"https://github.com/decocms/studio",keywords:["mcp","model-context-protocol","ai","gateway","self-hosted","tools"],license:"MIT",publishConfig:{access:"public"}}});var yq={};yi(yq,{printBanner:()=>Qrt,bannerLines:()=>dou,BANNER_LINES:()=>$6i,BANNER_GRADIENT:()=>h6i});function Srt(i){let u=Number.parseInt(i.slice(1),16);return[u>>16&255,u>>8&255,u&255]}function dou(i){let u=$6i.map((t,f)=>{let[l,E,c]=Srt(h6i[f]);return`\x1B[38;2;${l};${E};${c}m${t}\x1B[39m`});if(i!==void 0)u.push(`\x1B[2m  v${i}\x1B[22m`);return u}function Qrt(i){console.log("");for(let u of dou(i))console.log(u);console.log("")}var $6i,h6i;var xS=O(()=>{$6i=[" \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588     \u2588\u2588\u2588\u2588\u2588\u2588\u2588   ","\u2591\u2591\u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2588\u2588\u2588 \u2591\u2591\u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2591\u2588  \u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2591\u2588\u2588\u2588  \u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2591\u2588\u2588\u2588 "," \u2591\u2588\u2588\u2588   \u2591\u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588  \u2588 \u2591  \u2588\u2588\u2588     \u2591\u2591\u2591  \u2588\u2588\u2588     \u2591\u2591\u2588\u2588\u2588"," \u2591\u2588\u2588\u2588    \u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588\u2588\u2588\u2588   \u2591\u2588\u2588\u2588         \u2591\u2588\u2588\u2588      \u2591\u2588\u2588\u2588"," \u2591\u2588\u2588\u2588    \u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588\u2591\u2591\u2588   \u2591\u2588\u2588\u2588         \u2591\u2588\u2588\u2588      \u2591\u2588\u2588\u2588"," \u2591\u2588\u2588\u2588    \u2588\u2588\u2588  \u2591\u2588\u2588\u2588 \u2591   \u2588\u2591\u2591\u2588\u2588\u2588     \u2588\u2588\u2588\u2591\u2591\u2588\u2588\u2588     \u2588\u2588\u2588 "," \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588 \u2591\u2591\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588  \u2591\u2591\u2591\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2591  ","\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591   \u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591   \u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591     \u2591\u2591\u2591\u2591\u2591\u2591\u2591   "],h6i=["#00ff64","#00ee5e","#00dc56","#00c84e","#00b444","#00a03c","#008832","#006e28"]});import{Box as Hrt,Text as Dou}from"ink";import{jsx as zrt,jsxs as _ou}from"react/jsx-runtime";function v6i({version:i}){return _ou(Hrt,{flexDirection:"column",marginTop:1,children:[$6i.map((u,t)=>zrt(Dou,{color:h6i[t],children:u},t)),_ou(Dou,{dimColor:!0,children:[" v",i]})]})}var Hbi=O(()=>{xS()});function Nou(i){let u=i.branch??i.handle,t=[];if(i.dirtyCount>0)t.push(`${i.dirtyCount} uncommitted file${i.dirtyCount===1?"":"s"}`);if(i.merged===!1)t.push("branch not merged");return t.length>0?`\u26A0 ${t.join(", ")} \u2014 delete ${u}? (y/n)`:`Delete ${u}? (y/n)`}function kS(i){return[...i.values()].map((u)=>u.handle).sort((u,t)=>u.localeCompare(t))}function Oou(i,u,t){if(i.length===0)return null;let f=u===null?-1:i.indexOf(u);if(f===-1)return t>0?i[0]:i[i.length-1];let l=Math.max(0,Math.min(i.length-1,f+t));return i[l]}function Zou(i,u,t){if(t!==u)return t;let f=i.indexOf(u);if(f===-1)return t;return i[f+1]??i[f-1]??null}var bbi={};yi(bbi,{subscribeLinkState:()=>zbi,setSelectedHandle:()=>nbi,setRemoving:()=>_6i,setPersistedSandboxes:()=>ert,setPendingConfirm:()=>Iq,setMachine:()=>qrt,setLogPath:()=>rrt,setLinkActions:()=>mrt,setIngress:()=>Mrt,setDaemonError:()=>Vrt,setClusterUrl:()=>Crt,setCluster:()=>brt,setActionError:()=>D6i,resetLinkStateForTests:()=>ort,removeSandboxRow:()=>Rbi,pushSandboxEvent:()=>art,getLinkState:()=>Gq,applySandboxEvent:()=>Bou});function Rrt(i){return i==="spawning"||i==="ready"||i==="failed"}function Bou(i,u){let t=new Map(i),f=t.get(u.handle);if(u.phase==="evicted"||u.phase==="deleted"){if(f)t.set(u.handle,{...f,port:null,previewUrl:null,status:"stopped",error:null});return t}return t.set(u.handle,{handle:u.handle,port:u.port??f?.port??null,previewUrl:u.previewUrl??f?.previewUrl??null,status:u.phase,error:u.phase==="failed"?u.error??"failed":null,projectName:u.projectName??f?.projectName??null,branch:u.branch??f?.branch??null,sandboxPath:u.sandboxPath??f?.sandboxPath??null}),t}function Fou(){return{cluster:"connecting",clusterUrl:null,ingressUrl:null,ingressPort:null,machine:null,cap:nrt,sandboxes:new Map,daemonError:null,logPath:null,selectedHandle:null,pendingConfirm:null,removingHandles:new Set,actionError:null,actions:null}}function Cw(){for(let i of d6i)i()}function Gq(){return Ef}function zbi(i){return d6i.add(i),()=>d6i.delete(i)}function brt(i){Ef={...Ef,cluster:i},Cw()}function Crt(i){Ef={...Ef,clusterUrl:i},Cw()}function Mrt(i,u){Ef={...Ef,ingressPort:i,ingressUrl:u},Cw()}function qrt(i){Ef={...Ef,machine:i},Cw()}function Vrt(i){Ef={...Ef,daemonError:i},Cw()}function rrt(i){Ef={...Ef,logPath:i},Cw()}function nbi(i){Ef={...Ef,selectedHandle:i},Cw()}function Iq(i){Ef={...Ef,pendingConfirm:i},Cw()}function D6i(i){Ef={...Ef,actionError:i},Cw()}function _6i(i,u){if(Ef.removingHandles.has(i)===u)return;let t=new Set(Ef.removingHandles);if(u)t.add(i);else t.delete(i);Ef={...Ef,removingHandles:t},Cw()}function mrt(i){Ef={...Ef,actions:i},Cw()}function Rbi(i){let u=kS(Ef.sandboxes),t=Zou(u,i,Ef.selectedHandle),f=new Map(Ef.sandboxes);f.delete(i);let l=new Set(Ef.removingHandles);l.delete(i),Ef={...Ef,sandboxes:f,selectedHandle:t,pendingConfirm:null,removingHandles:l},Cw()}function ert(i){let u=new Map;for(let t of i)u.set(t.handle,{handle:t.handle,port:t.port,previewUrl:t.previewUrl,status:t.status,error:t.error,projectName:t.projectName,branch:t.branch,sandboxPath:t.sandboxPath});for(let[t,f]of Ef.sandboxes)if(Rrt(f.status))u.set(t,f);Ef={...Ef,sandboxes:u},Cw()}function art(i){Ef={...Ef,sandboxes:Bou(Ef.sandboxes,i)},Cw()}function ort(){Ef=Fou(),d6i.clear()}var nrt=20,Ef,d6i;var xq=O(()=>{Ef=Fou(),d6i=new Set});import{spawn as srt}from"child_process";function prt(i){if(i==="darwin")return"open";if(i==="win32")return"start";return"xdg-open"}function gou(i,u=process.platform){let t=prt(u);try{srt(t,[i],{stdio:"ignore",detached:!0}).unref()}catch{}}var Uou=()=>{};function Tou(i,u={}){let t=u.openUrl??gou,f=Gq(),l=kS(f.sandboxes),E=f.selectedHandle!==null&&l.includes(f.selectedHandle)?f.selectedHandle:l[0]??null,c=f.actions;switch(i.type){case"move":nbi(Oou(l,f.selectedHandle,i.delta));return;case"open":{if(E===null)return;let w=f.sandboxes.get(E);if(w?.status==="ready"&&w.previewUrl)t(w.previewUrl);return}case"stop":if(E!==null&&c)c.stopSandbox(E);return;case"delete":{if(E===null||!c)return;let w=c.inspectSandbox(E),$=f.sandboxes.get(E);D6i(null),Iq({handle:E,branch:w?.branch??$?.branch??null,dirtyCount:w?.dirtyCount??0,merged:w?.merged??null});return}case"confirmYes":{let w=f.pendingConfirm;if(Iq(null),w===null||!c)return;_6i(w.handle,!0),c.removeSandbox(w.handle).then(($)=>{if($.ok)Rbi(w.handle);else _6i(w.handle,!1),D6i($.error)});return}case"confirmNo":Iq(null);return;case"quit":if(c)c.quit();return}}var Aou=O(()=>{xq();Uou()});function Pou(i,u,t){if(t)return i==="y"||i==="Y"?{type:"confirmYes"}:{type:"confirmNo"};if(u.upArrow||i==="k")return{type:"move",delta:-1};if(u.downArrow||i==="j")return{type:"move",delta:1};if(i==="s")return{type:"stop"};if(i==="d")return{type:"delete"};if(i==="o")return{type:"open"};if(i==="q"||u.ctrl===!0&&i==="c")return{type:"quit"};return null}var you={};yi(you,{LinkApp:()=>fmt});import{Box as C1,Text as vl,useInput as imt}from"ink";import{useSyncExternalStore as umt}from"react";import{jsx as Xf,jsxs as Xh}from"react/jsx-runtime";function tmt(i,u){if(u)return{color:"yellow",text:"\u25CC Removing\u2026"};if(i.status==="ready")return{color:"green",text:"\u25CF Live"};if(i.status==="spawning")return{color:"yellow",text:"\u25CC Starting\u2026"};if(i.status==="stopped")return{color:"gray",text:"\u25A0 Stopped"};if(i.status==="missing")return{color:"yellow",text:"\u25A1 Missing"};if(i.status==="merged")return{color:"cyan",text:"\u2713 Merged"};if(i.status==="invalid")return{color:"red",text:"\u2717 Invalid"};if(i.status==="failed")return{color:"red",text:`\u2717 Failed: ${i.error??"failed"}`};return{color:"red",text:`\u2717 Error: ${i.error??""}`}}function fmt(){let i=umt(zbi,Gq),u=[...i.sandboxes.values()].sort((l,E)=>l.handle.localeCompare(E.handle)),t=kS(i.sandboxes),f=i.selectedHandle!==null&&t.includes(i.selectedHandle)?i.selectedHandle:t[0]??null;return imt((l,E)=>{let c=Pou(l,E,i.pendingConfirm!==null);if(c!==null)Tou(c)}),Xh(C1,{flexDirection:"column",children:[Xf(v6i,{version:IS.version}),Xf(C1,{marginBottom:1,children:Xf(vl,{dimColor:!0,children:"\u2500".repeat(80)})}),Xf(C1,{children:i.cluster==="linked"?Xh(vl,{color:"green",children:["\u2713 Connected to ",i.clusterUrl??"deco"]}):i.cluster==="connecting"?Xh(vl,{color:"yellow",children:["\u25CC Connecting to ",i.clusterUrl??"deco","\u2026"]}):Xh(vl,{color:"red",children:["\u2717 Disconnected from ",i.clusterUrl??"deco"]})}),Xf(C1,{children:i.ingressUrl?Xh(vl,{color:"green",children:["\u2713 Serving at ",i.ingressUrl]}):Xf(vl,{dimColor:!0,children:"\u25CC Starting local server\u2026"})}),Xf(C1,{marginBottom:1,children:Xf(vl,{dimColor:!0,children:`${"Computer".padEnd(16)}${i.machine??"this computer"} \xB7 ${u.length} of ${i.cap} previews`})}),u.length===0?Xf(vl,{dimColor:!0,children:"No previews running yet."}):Xh(C1,{flexDirection:"column",children:[Xh(C1,{children:[Xf(C1,{width:2,flexShrink:0}),Xf(C1,{width:jS.project,flexShrink:0,marginRight:1,children:Xf(vl,{dimColor:!0,wrap:"truncate-end",children:"PROJECT"})}),Xf(C1,{width:jS.branch,flexShrink:0,marginRight:1,children:Xf(vl,{dimColor:!0,wrap:"truncate-end",children:"BRANCH"})}),Xf(C1,{width:jS.status,flexShrink:0,marginRight:1,children:Xf(vl,{dimColor:!0,wrap:"truncate-end",children:"STATUS"})}),Xf(C1,{flexGrow:1,children:Xf(vl,{dimColor:!0,wrap:"truncate-end",children:"PREVIEW URL"})})]}),u.map((l)=>{let E=tmt(l,i.removingHandles.has(l.handle)),c=l.handle===f;return Xh(C1,{children:[Xf(C1,{width:2,flexShrink:0,children:Xf(vl,{color:"cyan",children:c?"\u203A":" "})}),Xf(C1,{width:jS.project,flexShrink:0,marginRight:1,children:Xf(vl,{bold:c,wrap:"truncate-end",children:l.projectName??l.handle})}),Xf(C1,{width:jS.branch,flexShrink:0,marginRight:1,children:Xf(vl,{bold:c,wrap:"truncate-end",children:l.branch??"\u2014"})}),Xf(C1,{width:jS.status,flexShrink:0,marginRight:1,children:Xf(vl,{color:E.color,bold:c,wrap:"truncate-end",children:E.text})}),Xf(C1,{flexGrow:1,children:Xf(vl,{dimColor:!0,wrap:"truncate-end",children:l.previewUrl??"\u2014"})})]},l.handle)})]}),i.daemonError?Xf(C1,{marginTop:1,children:Xh(vl,{color:"red",children:["\u26A0 ",i.daemonError]})}):null,i.logPath?Xf(C1,{marginTop:1,children:Xh(vl,{dimColor:!0,children:["Logs: ",i.logPath]})}):null,i.pendingConfirm?Xf(C1,{marginTop:1,children:Xf(vl,{color:"yellow",children:Nou(i.pendingConfirm)})}):null,i.actionError?Xf(C1,{marginTop:1,children:Xh(vl,{color:"red",children:["\u2717 ",i.actionError]})}):null,Xf(C1,{marginTop:1,children:Xf(vl,{dimColor:!0,children:"\u2191\u2193 move \xB7 s stop \xB7 d delete \xB7 o open \xB7 q quit"})})]})}var jS;var Gou=O(()=>{w6i();Hbi();Aou();xq();jS={project:18,branch:22,status:14}});var Iou={};yi(Iou,{runLinkCommand:()=>dmt});import{closeSync as lmt,mkdirSync as Emt,openSync as cmt,writeSync as wmt}from"fs";import{homedir as $mt}from"os";import{join as Cbi}from"path";function hmt(i,u){let t={log:console.log,warn:console.warn,error:console.error},f=(l)=>{if(u===void 0)return;try{wmt(u,`${Wbi(l)}
 `)}catch{}};return console.log=(...l)=>f(l),console.warn=(...l)=>f(l),console.error=(...l)=>{f(l),i(Wbi(l))},()=>{console.log=t.log,console.warn=t.warn,console.error=t.error}}async function vmt(i,u){let t;try{t=await fetch(`${i}/api/links/me`,{headers:{authorization:`Bearer ${u}`},signal:AbortSignal.timeout(1e4)})}catch{return}if(t.status===401||t.status===403)throw Error(`Authentication rejected by ${i} \u2014 the session token was not accepted. `+`Run \`deco auth login --target ${i}\` and try again.`)}async function dmt(i={}){let u=i.port??5174,t=i.dataDir??process.env.DATA_DIR??process.env.DECOCMS_HOME??Cbi($mt(),"deco"),f=i.clusterBaseUrl??process.env.STUDIO_CLUSTER_URL??process.env.MESH_CLUSTER_URL??"https://studio.decocms.com",l,E,c,w=()=>{if(c===void 0)return;try{c.close()}catch{}finally{c=void 0}};try{if(await Lbi(u,"127.0.0.1"))throw new Qbi(u);let $=Cbi(t,"sandboxes");c=c6i({path:E6i(t),managedSandboxRoot:$});let h=await ili({dataDir:t,intent:"Link",target:f});if(process.env.DECOCMS_LINK_MANAGED!=="1")await vmt(f,h.accessToken);let v=c.reconcile();if(i.prune){let N=c.prune({missing:!0,merged:!0});if(!i.tui)console.log(`Pruned local sandboxes: removed ${N.removed.length}, skipped ${N.skipped.length}.`);v=c.reconcile()}let d;if(i.tui){let{render:N}=await import("ink"),{createElement:Z}=await import("react"),{LinkApp:B}=await Promise.resolve().then(() => (Gou(),you)),{pushSandboxEvent:F,setCluster:g,setClusterUrl:U,setDaemonError:T,setIngress:A,setLogPath:G,setMachine:k,setPersistedSandboxes:I}=await Promise.resolve().then(() => (xq(),bbi));Emt(t,{recursive:!0});let j=Cbi(t,"link.log");E=cmt(j,"w"),G(j),I(v),U(f),g("connecting"),d={onEvent:(C)=>F(C),onIngress:(C)=>A(C,`http://127.0.0.1:${C}`),onCluster:(C)=>g(C),onMachine:(C)=>k(C)},l=hmt(T,E),N(Z(B),{patchConsole:!1})}else if(i.banner!==!1){let{printBanner:N}=await Promise.resolve().then(() => (xS(),yq));N(i.version??"0.0.0")}w();let D=process.env.DECOCMS_LINK_MANAGED!=="1",_=await Eou({port:u,clusterBaseUrl:f,dataDir:t,session:h,monitor:d,logFd:E,perSandboxLogs:D,hotReload:i.hotReload});if(i.tui){let{setLinkActions:N}=await Promise.resolve().then(() => (xq(),bbi));N({stopSandbox:_.stopSandbox,removeSandbox:_.removeSandbox,inspectSandbox:_.inspectSandbox,quit:_.stop})}return await _.stopped}catch($){return l?.(),console.error($ou($)?hou(u):$ instanceof Error?$.message:String($)),1}finally{if(l?.(),E!==void 0)try{lmt(E)}catch{}w()}}var xou=O(()=>{_ni();cou();Sbi();vou();Ybi()});var ebi={};yi(ebi,{resolveDevLinkClusterUrl:()=>Omt,populateDevLinkToxiProxy:()=>You,isDevLinkToxiProxyEnabled:()=>Nmt,ensureDevLinkToxiProxy:()=>Umt,buildDevLinkToxiProxyConfig:()=>Jou,DEV_LINK_TOXIPROXY_SERVICE_NAME:()=>jou,DEV_LINK_TOXIPROXY_PROXY_NAME:()=>Xou});function Nmt(i=process.env){return i.DECO_DEV_LINK_TOXIPROXY==="1"}function Mbi(i,u){if(!Number.isInteger(i)||i<1||i>65535)throw Error(`${u} must be an integer port in 1..65535`);return i}function Jou(i){let u=new URL(i.serverUrl);if(u.protocol!=="http:")throw Error("DECO_DEV_LINK_TOXIPROXY only supports http local Studio URLs");let t=Mbi(i.apiPort,"apiPort"),f=Mbi(i.listenPort,"listenPort");if(u.port.length===0)throw Error("serverUrl must include an explicit valid port");let l=Mbi(Number.parseInt(u.port,10),"upstreamPort"),E=`http://127.0.0.1:${l}`,c=`http://127.0.0.1:${f}`;return{serviceName:jou,proxyName:Xou,apiUrl:`http://127.0.0.1:${t}`,listen:`0.0.0.0:${f}`,upstream:`host.docker.internal:${l}`,publicTargetUrl:E,clusterUrl:c,logLine:`[dev-link-toxiproxy] ready: ${c} -> ${E}`}}function Omt(i){return i.toxiproxy?.clusterUrl??i.serverUrl}async function qbi(i,u,t){if(i.ok)return;let f=await i.text();throw Error(`ToxiProxy ${u} failed for ${t}: status=${i.status} statusText=${i.statusText} body=${f}`)}function mbi(i){if(i instanceof Error)return i.name==="Error"?i.message:`${i.name}: ${i.message}`;return String(i)}function Kou(i){if(!(i instanceof Error))return!1;if(i.name==="TimeoutError")return!0;return Kou(i.cause)}async function Vbi(i,u,t,f){try{return await i(t,f)}catch(l){throw Error(`ToxiProxy ${u} failed for ${t}: ${mbi(l)}`,{cause:l})}}async function You(i,u=fetch){let t=`${i.apiUrl}/reset`,f=await Vbi(u,"reset",t,{method:"POST"});await qbi(f,"reset",t);let l=`${i.apiUrl}/populate`,E=await Vbi(u,"populate",l,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify([{name:i.proxyName,listen:i.listen,upstream:i.upstream,enabled:!0}])});await qbi(E,"populate",l)}async function Zmt(i,u){let t=`${i.apiUrl}/version`;try{await F1(async()=>{let f=await Vbi(u,"readiness check",t,{method:"GET",signal:AbortSignal.timeout(_mt)});await qbi(f,"readiness check",t)},{maxAttempts:Dmt,minTimeout:kou,maxTimeout:kou,multiplier:1,jitter:0,isRetriable:(f)=>!Kou(f)})}catch(f){let l=f instanceof H6?f.cause:f;throw Error(`ToxiProxy API did not become ready at ${t}: ${mbi(l)}`,{cause:l})}}async function Bmt(i){if(i===null)return"";return await new Response(i).text()}async function rbi(i,u={}){let t=["docker",...i].join(" "),f=(()=>{try{return Bun.spawn(["docker",...i],{stdout:"ignore",stderr:"pipe"})}catch(w){throw Error(`Docker command failed to start (${t}): ${mbi(w)}`,{cause:w})}})(),[l,E]=await Promise.all([f.exited,Bmt(f.stderr)]);if(l===0||u.ignoreFailure===!0)return;let c=E.trim().length>0?`: ${E.trim()}`:"";throw Error(`Docker command failed (${t}) with exit ${l}${c}`)}async function Fmt(i,u){let t=`deco-dev-link-toxiproxy-${i}`;await rbi(["rm","-f",t],{ignoreFailure:!0}),await rbi(["run","--rm","-d","--name",t,"-p",`127.0.0.1:${i}:8474`,"-p",`127.0.0.1:${u}:${u}`,"ghcr.io/shopify/toxiproxy:2.12.0","-host=0.0.0.0"])}async function gmt(i,u){let t=`deco-dev-link-toxiproxy-${i}`;await rbi(["rm","-f",t],{ignoreFailure:!0})}async function Umt(i){let u=Jou(i),t=i.startDaemon??Fmt,f=i.stopDaemon??(i.startDaemon===void 0?gmt:void 0);await t(i.apiPort,i.listenPort);let l=i.fetchImpl??fetch;try{await Zmt(u,l),await You(u,l)}catch(E){if(f!==void 0)try{await f(i.apiPort,i.listenPort)}catch{}throw E}return{config:u,stop:async()=>{if(f!==void 0)await f(i.apiPort,i.listenPort)}}}var jou="ToxiProxy",Xou="dev_link_studio",Dmt=20,kou=100,_mt=100;var abi=O(()=>{Z4()});var Wou={};yi(Wou,{migrateBetterAuth:()=>obi});import{getMigrations as Tmt}from"better-auth/db";import{sso as Amt}from"@better-auth/sso";import{organization as Pmt}from"@decocms/better-auth/plugins";import{admin as ymt,apiKey as Gmt,jwt as Imt,magicLink as xmt,mcp as kmt,openAPI as jmt}from"better-auth/plugins";import{emailOTP as Xmt}from"better-auth/plugins/email-otp";async function obi(i){let t={database:nM(i||F_()),plugins:[Pmt({dynamicAccessControl:{enabled:!0,enableCustomResources:!0}}),ymt(),Gmt(),Imt(),jmt(),kmt({loginPage:"/login"}),Amt(),xmt({sendMagicLink:async()=>{}}),Xmt({sendVerificationOTP:async()=>{}})]},{toBeAdded:f,toBeCreated:l,runMigrations:E}=await Tmt(t);if(!f.length&&!l.length)return"up to date";return await E(),`${l.length+f.length} table(s) migrated`}var sbi=O(()=>{b6()});var pbi={};yi(pbi,{up:()=>Jmt,down:()=>Kmt});import{sql as Fd}from"kysely";async function Jmt(i){await i.schema.createTable("connections").addColumn("id","text",(u)=>u.primaryKey()).addColumn("organizationId","text",(u)=>u.notNull().references("organization.id").onDelete("cascade")).addColumn("createdById","text",(u)=>u.notNull().references("user.id").onDelete("cascade")).addColumn("name","text",(u)=>u.notNull()).addColumn("description","text").addColumn("icon","text").addColumn("appName","text").addColumn("appId","text").addColumn("connectionType","text",(u)=>u.notNull()).addColumn("connectionUrl","text",(u)=>u.notNull()).addColumn("connectionToken","text").addColumn("connectionHeaders","text").addColumn("oauthConfig","text").addColumn("metadata","text").addColumn("tools","text").addColumn("bindings","text").addColumn("status","text",(u)=>u.notNull().defaultTo("active")).addColumn("createdAt","text",(u)=>u.notNull().defaultTo(Fd`CURRENT_TIMESTAMP`)).addColumn("updatedAt","text",(u)=>u.notNull().defaultTo(Fd`CURRENT_TIMESTAMP`)).execute(),await i.schema.createTable("api_keys").addColumn("id","text",(u)=>u.primaryKey()).addColumn("userId","text",(u)=>u.notNull().references("user.id").onDelete("cascade")).addColumn("name","text",(u)=>u.notNull()).addColumn("hashedKey","text",(u)=>u.notNull().unique()).addColumn("permissions","text",(u)=>u.notNull()).addColumn("expiresAt","text").addColumn("remaining","integer").addColumn("metadata","text").addColumn("createdAt","text",(u)=>u.notNull().defaultTo(Fd`CURRENT_TIMESTAMP`)).addColumn("updatedAt","text",(u)=>u.notNull().defaultTo(Fd`CURRENT_TIMESTAMP`)).execute(),await i.schema.createTable("audit_logs").addColumn("id","text",(u)=>u.primaryKey()).addColumn("organizationId","text").addColumn("userId","text",(u)=>u.references("user.id").onDelete("set null")).addColumn("connectionId","text",(u)=>u.references("connections.id").onDelete("set null")).addColumn("toolName","text",(u)=>u.notNull()).addColumn("allowed","integer",(u)=>u.notNull()).addColumn("duration","integer").addColumn("timestamp","text",(u)=>u.notNull().defaultTo(Fd`CURRENT_TIMESTAMP`)).addColumn("requestMetadata","text").execute(),await i.schema.createTable("oauth_clients").addColumn("id","text",(u)=>u.primaryKey()).addColumn("clientId","text",(u)=>u.notNull().unique()).addColumn("clientSecret","text").addColumn("clientName","text",(u)=>u.notNull()).addColumn("redirectUris","text",(u)=>u.notNull()).addColumn("grantTypes","text",(u)=>u.notNull()).addColumn("scope","text").addColumn("clientUri","text").addColumn("logoUri","text").addColumn("createdAt","text",(u)=>u.notNull().defaultTo(Fd`CURRENT_TIMESTAMP`)).execute(),await i.schema.createTable("oauth_authorization_codes").addColumn("code","text",(u)=>u.primaryKey()).addColumn("clientId","text",(u)=>u.notNull().references("oauth_clients.clientId").onDelete("cascade")).addColumn("userId","text",(u)=>u.notNull().references("user.id").onDelete("cascade")).addColumn("redirectUri","text",(u)=>u.notNull()).addColumn("scope","text").addColumn("codeChallenge","text").addColumn("codeChallengeMethod","text").addColumn("expiresAt","text",(u)=>u.notNull()).addColumn("createdAt","text",(u)=>u.notNull().defaultTo(Fd`CURRENT_TIMESTAMP`)).execute(),await i.schema.createTable("oauth_refresh_tokens").addColumn("token","text",(u)=>u.primaryKey()).addColumn("clientId","text",(u)=>u.notNull().references("oauth_clients.clientId").onDelete("cascade")).addColumn("userId","text",(u)=>u.notNull().references("user.id").onDelete("cascade")).addColumn("scope","text").addColumn("expiresAt","text").addColumn("createdAt","text",(u)=>u.notNull().defaultTo(Fd`CURRENT_TIMESTAMP`)).execute(),await i.schema.createTable("downstream_tokens").addColumn("id","text",(u)=>u.primaryKey()).addColumn("connectionId","text",(u)=>u.notNull().references("connections.id").onDelete("cascade")).addColumn("userId","text",(u)=>u.references("user.id").onDelete("cascade")).addColumn("accessToken","text",(u)=>u.notNull()).addColumn("refreshToken","text").addColumn("scope","text").addColumn("expiresAt","text").addColumn("createdAt","text",(u)=>u.notNull().defaultTo(Fd`CURRENT_TIMESTAMP`)).addColumn("updatedAt","text",(u)=>u.notNull().defaultTo(Fd`CURRENT_TIMESTAMP`)).execute(),await i.schema.createIndex("idx_connections_organizationId").on("connections").column("organizationId").execute(),await i.schema.createIndex("idx_audit_logs_organizationId").on("audit_logs").column("organizationId").execute(),await i.schema.createIndex("idx_audit_logs_userId").on("audit_logs").column("userId").execute(),await i.schema.createIndex("idx_audit_logs_timestamp").on("audit_logs").column("timestamp").execute()}async function Kmt(i){await i.schema.dropTable("downstream_tokens").execute(),await i.schema.dropTable("oauth_refresh_tokens").execute(),await i.schema.dropTable("oauth_authorization_codes").execute(),await i.schema.dropTable("oauth_clients").execute(),await i.schema.dropTable("audit_logs").execute(),await i.schema.dropTable("api_keys").execute(),await i.schema.dropTable("connections").execute()}var Lou=()=>{};var iCi={};yi(iCi,{up:()=>Ymt,down:()=>Wmt});import{sql as Sou}from"kysely";async function Ymt(i){await i.schema.createTable("organization_settings").addColumn("organizationId","text",(u)=>u.primaryKey().references("organization.id").onDelete("cascade")).addColumn("modelsBindingConnectionId","text",(u)=>u.references("connections.id").onDelete("set null")).addColumn("createdAt","text",(u)=>u.notNull().defaultTo(Sou`CURRENT_TIMESTAMP`)).addColumn("updatedAt","text",(u)=>u.notNull().defaultTo(Sou`CURRENT_TIMESTAMP`)).execute()}async function Wmt(i){await i.schema.dropTable("organization_settings").execute()}var Qou=()=>{};var uCi={};yi(uCi,{up:()=>Lmt,down:()=>Smt});async function Lmt(i){await i.schema.alterTable("connections").renameColumn("name","title").execute(),await i.schema.alterTable("connections").renameColumn("createdById","created_by").execute(),await i.schema.alterTable("connections").renameColumn("createdAt","created_at").execute(),await i.schema.alterTable("connections").renameColumn("updatedAt","updated_at").execute(),await i.schema.alterTable("connections").renameColumn("organizationId","organization_id").execute(),await i.schema.alterTable("connections").renameColumn("connectionType","connection_type").execute(),await i.schema.alterTable("connections").renameColumn("connectionUrl","connection_url").execute(),await i.schema.alterTable("connections").renameColumn("connectionToken","connection_token").execute(),await i.schema.alterTable("connections").renameColumn("connectionHeaders","connection_headers").execute(),await i.schema.alterTable("connections").renameColumn("oauthConfig","oauth_config").execute(),await i.schema.alterTable("connections").renameColumn("appName","app_name").execute(),await i.schema.alterTable("connections").renameColumn("appId","app_id").execute()}async function Smt(i){await i.schema.alterTable("connections").renameColumn("title","name").execute(),await i.schema.alterTable("connections").renameColumn("created_by","createdById").execute(),await i.schema.alterTable("connections").renameColumn("created_at","createdAt").execute(),await i.schema.alterTable("connections").renameColumn("updated_at","updatedAt").execute(),await i.schema.alterTable("connections").renameColumn("organization_id","organizationId").execute(),await i.schema.alterTable("connections").renameColumn("connection_type","connectionType").execute(),await i.schema.alterTable("connections").renameColumn("connection_url","connectionUrl").execute(),await i.schema.alterTable("connections").renameColumn("connection_token","connectionToken").execute(),await i.schema.alterTable("connections").renameColumn("connection_headers","connectionHeaders").execute(),await i.schema.alterTable("connections").renameColumn("oauth_config","oauthConfig").execute(),await i.schema.alterTable("connections").renameColumn("app_name","appName").execute(),await i.schema.alterTable("connections").renameColumn("app_id","appId").execute()}var tCi={};yi(tCi,{up:()=>Qmt,down:()=>Hmt});async function Qmt(i){await i.schema.createTable("organization_settings_new").addColumn("organizationId","text",(u)=>u.primaryKey().references("organization.id").onDelete("cascade")).addColumn("createdAt","text",(u)=>u.notNull()).addColumn("updatedAt","text",(u)=>u.notNull()).execute(),await i.insertInto("organization_settings_new").columns(["organizationId","createdAt","updatedAt"]).expression((u)=>u.selectFrom("organization_settings").select(["organizationId","createdAt","updatedAt"])).execute(),await i.schema.dropTable("organization_settings").execute(),await i.schema.alterTable("organization_settings_new").renameTo("organization_settings").execute()}async function Hmt(i){await i.schema.createTable("organization_settings_new").addColumn("organizationId","text",(u)=>u.primaryKey().references("organization.id").onDelete("cascade")).addColumn("modelsBindingConnectionId","text",(u)=>u.references("connections.id").onDelete("set null")).addColumn("createdAt","text",(u)=>u.notNull()).addColumn("updatedAt","text",(u)=>u.notNull()).execute(),await i.insertInto("organization_settings_new").columns(["organizationId","modelsBindingConnectionId","createdAt","updatedAt"]).expression((u)=>u.selectFrom("organization_settings").select(["organizationId",u.val(null).as("modelsBindingConnectionId"),"createdAt","updatedAt"])).execute(),await i.schema.dropTable("organization_settings").execute(),await i.schema.alterTable("organization_settings_new").renameTo("organization_settings").execute()}var fCi={};yi(fCi,{up:()=>zmt,down:()=>nmt});async function zmt(i){await i.schema.alterTable("connections").addColumn("configuration_state","text").execute(),await i.schema.alterTable("connections").addColumn("configuration_scopes","text").execute()}async function nmt(i){await i.schema.alterTable("connections").dropColumn("configuration_state").execute(),await i.schema.alterTable("connections").dropColumn("configuration_scopes").execute()}var lCi={};yi(lCi,{up:()=>bmt,down:()=>Cmt});import{sql as Rmt}from"kysely";async function bmt(i){await i.schema.alterTable("organization_settings").addColumn("sidebar_items",Rmt`text`).execute()}async function Cmt(i){await i.schema.alterTable("organization_settings").dropColumn("sidebar_items").execute()}var Hou=()=>{};var ECi={};yi(ECi,{up:()=>Mmt,down:()=>qmt});async function Mmt(i){await i.schema.createTable("monitoring_logs").addColumn("id","text",(u)=>u.primaryKey()).addColumn("organization_id","text",(u)=>u.notNull().references("organization.id").onDelete("cascade")).addColumn("connection_id","text",(u)=>u.notNull().references("connections.id").onDelete("cascade")).addColumn("connection_title","text",(u)=>u.notNull()).addColumn("tool_name","text",(u)=>u.notNull()).addColumn("input","text",(u)=>u.notNull()).addColumn("output","text",(u)=>u.notNull()).addColumn("is_error","integer",(u)=>u.notNull()).addColumn("error_message","text").addColumn("duration_ms","integer",(u)=>u.notNull()).addColumn("timestamp","text",(u)=>u.notNull()).addColumn("user_id","text").addColumn("request_id","text",(u)=>u.notNull()).execute(),await i.schema.createIndex("monitoring_logs_org_timestamp").on("monitoring_logs").columns(["organization_id","timestamp"]).execute(),await i.schema.createIndex("monitoring_logs_connection_timestamp").on("monitoring_logs").columns(["connection_id","timestamp"]).execute(),await i.schema.createIndex("monitoring_logs_is_error").on("monitoring_logs").columns(["organization_id","is_error","timestamp"]).execute()}async function qmt(i){await i.schema.dropIndex("monitoring_logs_is_error").execute(),await i.schema.dropIndex("monitoring_logs_connection_timestamp").execute(),await i.schema.dropIndex("monitoring_logs_org_timestamp").execute(),await i.schema.dropTable("monitoring_logs").execute()}var cCi={};yi(cCi,{up:()=>Vmt,down:()=>rmt});import{sql as kq}from"kysely";async function Vmt(i){await i.schema.createTable("events").addColumn("id","text",(u)=>u.primaryKey()).addColumn("organization_id","text",(u)=>u.notNull().references("organization.id").onDelete("cascade")).addColumn("type","text",(u)=>u.notNull()).addColumn("source","text",(u)=>u.notNull()).addColumn("specversion","text",(u)=>u.notNull().defaultTo("1.0")).addColumn("subject","text").addColumn("time","text",(u)=>u.notNull()).addColumn("datacontenttype","text",(u)=>u.notNull().defaultTo("application/json")).addColumn("dataschema","text").addColumn("data","text").addColumn("cron","varchar(255)").addColumn("status","text",(u)=>u.notNull().defaultTo("pending")).addColumn("attempts","integer",(u)=>u.notNull().defaultTo(0)).addColumn("last_error","text").addColumn("next_retry_at","text").addColumn("created_at","text",(u)=>u.notNull().defaultTo(kq`CURRENT_TIMESTAMP`)).addColumn("updated_at","text",(u)=>u.notNull().defaultTo(kq`CURRENT_TIMESTAMP`)).execute(),await i.schema.createTable("event_subscriptions").addColumn("id","text",(u)=>u.primaryKey()).addColumn("organization_id","text",(u)=>u.notNull().references("organization.id").onDelete("cascade")).addColumn("connection_id","text",(u)=>u.notNull().references("connections.id").onDelete("cascade")).addColumn("publisher","text").addColumn("event_type","text",(u)=>u.notNull()).addColumn("filter","text").addColumn("enabled","integer",(u)=>u.notNull().defaultTo(1)).addColumn("created_at","text",(u)=>u.notNull().defaultTo(kq`CURRENT_TIMESTAMP`)).addColumn("updated_at","text",(u)=>u.notNull().defaultTo(kq`CURRENT_TIMESTAMP`)).execute(),await i.schema.createTable("event_deliveries").addColumn("id","text",(u)=>u.primaryKey()).addColumn("event_id","text",(u)=>u.notNull()).addColumn("subscription_id","text",(u)=>u.notNull().references("event_subscriptions.id").onDelete("cascade")).addColumn("status","text",(u)=>u.notNull().defaultTo("pending")).addColumn("attempts","integer",(u)=>u.notNull().defaultTo(0)).addColumn("last_error","text").addColumn("delivered_at","text").addColumn("next_retry_at","text").addColumn("created_at","text",(u)=>u.notNull().defaultTo(kq`CURRENT_TIMESTAMP`)).execute(),await i.schema.createIndex("idx_events_org_status").on("events").columns(["organization_id","status"]).execute(),await i.schema.createIndex("idx_events_source").on("events").columns(["source"]).execute(),await i.schema.createIndex("idx_events_type").on("events").columns(["type"]).execute(),await i.schema.createIndex("idx_events_retry").on("events").columns(["status","next_retry_at"]).execute(),await i.schema.createIndex("idx_subscriptions_connection").on("event_subscriptions").columns(["connection_id"]).execute(),await i.schema.createIndex("idx_subscriptions_type").on("event_subscriptions").columns(["event_type"]).execute(),await i.schema.createIndex("idx_subscriptions_org_enabled").on("event_subscriptions").columns(["organization_id","enabled"]).execute(),await i.schema.createIndex("idx_subscriptions_unique").on("event_subscriptions").columns(["connection_id","event_type","publisher","filter"]).unique().execute(),await i.schema.createIndex("idx_deliveries_event").on("event_deliveries").columns(["event_id"]).execute(),await i.schema.createIndex("idx_deliveries_subscription_status").on("event_deliveries").columns(["subscription_id","status"]).execute(),await i.schema.createIndex("idx_deliveries_retry").on("event_deliveries").columns(["status","next_retry_at"]).execute()}async function rmt(i){await i.schema.dropIndex("idx_deliveries_retry").execute(),await i.schema.dropIndex("idx_deliveries_subscription_status").execute(),await i.schema.dropIndex("idx_deliveries_event").execute(),await i.schema.dropIndex("idx_subscriptions_unique").execute(),await i.schema.dropIndex("idx_subscriptions_org_enabled").execute(),await i.schema.dropIndex("idx_subscriptions_type").execute(),await i.schema.dropIndex("idx_subscriptions_connection").execute(),await i.schema.dropIndex("idx_events_retry").execute(),await i.schema.dropIndex("idx_events_type").execute(),await i.schema.dropIndex("idx_events_source").execute(),await i.schema.dropIndex("idx_events_org_status").execute(),await i.schema.dropTable("event_deliveries").execute(),await i.schema.dropTable("event_subscriptions").execute(),await i.schema.dropTable("events").execute()}var zou=()=>{};var wCi={};yi(wCi,{up:()=>emt,down:()=>amt});import{sql as mmt}from"kysely";async function emt(i){await i.schema.dropTable("audit_logs").ifExists().execute()}async function amt(i){await i.schema.createTable("audit_logs").ifNotExists().addColumn("id","text",(u)=>u.primaryKey()).addColumn("organizationId","text").addColumn("userId","text",(u)=>u.references("user.id").onDelete("set null")).addColumn("connectionId","text",(u)=>u.references("connections.id").onDelete("set null")).addColumn("toolName","text",(u)=>u.notNull()).addColumn("allowed","integer",(u)=>u.notNull()).addColumn("duration","integer").addColumn("timestamp","text",(u)=>u.notNull().defaultTo(mmt`CURRENT_TIMESTAMP`)).addColumn("requestMetadata","text").execute(),await i.schema.createIndex("idx_audit_logs_organizationId").on("audit_logs").column("organizationId").execute(),await i.schema.createIndex("idx_audit_logs_userId").on("audit_logs").column("userId").execute(),await i.schema.createIndex("idx_audit_logs_timestamp").on("audit_logs").column("timestamp").execute()}var nou=()=>{};var $Ci={};yi($Ci,{up:()=>omt,down:()=>smt});import{sql as N6i}from"kysely";async function omt(i){await i.schema.createTable("gateways").addColumn("id","text",(u)=>u.primaryKey()).addColumn("organization_id","text",(u)=>u.notNull().references("organization.id").onDelete("cascade")).addColumn("title","text",(u)=>u.notNull()).addColumn("description","text").addColumn("tool_selection_strategy","text").addColumn("status","text",(u)=>u.notNull().defaultTo("active")).addColumn("is_default","integer",(u)=>u.notNull().defaultTo(0)).addColumn("created_at","text",(u)=>u.notNull().defaultTo(N6i`CURRENT_TIMESTAMP`)).addColumn("updated_at","text",(u)=>u.notNull().defaultTo(N6i`CURRENT_TIMESTAMP`)).addColumn("created_by","text",(u)=>u.notNull().references("user.id").onDelete("cascade")).addColumn("updated_by","text").execute(),await i.schema.createTable("gateway_connections").addColumn("id","text",(u)=>u.primaryKey()).addColumn("gateway_id","text",(u)=>u.notNull().references("gateways.id").onDelete("cascade")).addColumn("connection_id","text",(u)=>u.notNull().references("connections.id").onDelete("cascade")).addColumn("selected_tools","text").addColumn("created_at","text",(u)=>u.notNull().defaultTo(N6i`CURRENT_TIMESTAMP`)).execute(),await i.schema.createIndex("idx_gateways_org").on("gateways").columns(["organization_id"]).execute(),await i.schema.createIndex("idx_gateways_org_status").on("gateways").columns(["organization_id","status"]).execute(),await N6i`CREATE UNIQUE INDEX idx_gateways_default_per_org ON gateways (organization_id) WHERE is_default = 1`.execute(i),await i.schema.createIndex("idx_gateway_connections_gateway").on("gateway_connections").columns(["gateway_id"]).execute(),await i.schema.createIndex("idx_gateway_connections_connection").on("gateway_connections").columns(["connection_id"]).execute(),await i.schema.createIndex("idx_gateway_connections_unique").on("gateway_connections").columns(["gateway_id","connection_id"]).unique().execute()}async function smt(i){await i.schema.dropIndex("idx_gateway_connections_unique").execute(),await i.schema.dropIndex("idx_gateway_connections_connection").execute(),await i.schema.dropIndex("idx_gateway_connections_gateway").execute(),await i.schema.dropIndex("idx_gateways_default_per_org").execute(),await i.schema.dropIndex("idx_gateways_org_status").execute(),await i.schema.dropIndex("idx_gateways_org").execute(),await i.schema.dropTable("gateway_connections").execute(),await i.schema.dropTable("gateways").execute()}var Rou=()=>{};var hCi={};yi(hCi,{up:()=>pmt,down:()=>iet});async function pmt(i){await i.schema.alterTable("gateways").addColumn("icon","text").execute()}async function iet(i){await i.schema.alterTable("gateways").dropColumn("icon").execute()}var vCi={};yi(vCi,{up:()=>uet,down:()=>tet});import{sql as O6i}from"kysely";async function uet(i){await i.schema.alterTable("gateways").addColumn("tool_selection_mode","text",(u)=>u.notNull().defaultTo("inclusion")).execute(),await O6i`
     UPDATE gateways
     SET tool_selection_mode = CASE
@@ -85795,7 +85795,7 @@ ${gzf}`:""}
 `);let f=u.pax;if(f)for(let l in f)t+=uEu(" "+l+"="+f[l]+`
 `);return af.from(t)};Jrf.decodePax=function(u){let t={};while(u.length){let f=0;while(f<u.length&&u[f]!==32)f++;let l=parseInt(af.toString(u.subarray(0,f)),10);if(!l)return t;let E=af.toString(u.subarray(f+1,l-1)),c=E.indexOf("=");if(c===-1)return t;t[E.slice(0,c)]=E.slice(c+1),u=u.subarray(l)}return t};Jrf.encode=function(u){let t=af.alloc(512),f=u.name,l="";if(u.typeflag===5&&f[f.length-1]!=="/")f+="/";if(af.byteLength(f)!==f.length)return null;while(af.byteLength(f)>100){let E=f.indexOf("/");if(E===-1)return null;l+=l?"/"+f.slice(0,E):f.slice(0,E),f=f.slice(E+1)}if(af.byteLength(f)>100||af.byteLength(l)>155)return null;if(u.linkname&&af.byteLength(u.linkname)>100)return null;if(af.write(t,f),af.write(t,tO(u.mode&4095,6),100),af.write(t,tO(u.uid,6),108),af.write(t,tO(u.gid,6),116),jrf(u.size,t,124),af.write(t,tO(u.mtime.getTime()/1000|0,11),136),t[156]=48+xrf(u.type),u.linkname)af.write(t,u.linkname,157);if(af.copy(_K0,t,257),af.copy(Urf,t,263),u.uname)af.write(t,u.uname,265);if(u.gname)af.write(t,u.gname,297);if(af.write(t,tO(u.devmajor||0,6),329),af.write(t,tO(u.devminor||0,6),337),l)af.write(t,l,345);return af.write(t,tO(OK0(t),6),148),t};Jrf.decode=function(u,t,f){let l=u[156]===0?0:u[156]-48,E=In(u,0,100,t),c=uO(u,100,8),w=uO(u,108,8),$=uO(u,116,8),h=uO(u,124,12),v=uO(u,136,12),d=Irf(l),D=u[157]===0?null:In(u,157,100,t),_=In(u,265,32),N=In(u,297,32),Z=uO(u,329,8),B=uO(u,337,8),F=OK0(u);if(F===256)return null;if(F!==uO(u,148,8))throw Error("Invalid tar header. Maybe the tar is corrupted or it needs to be gunzipped?");if(Prf(u)){if(u[345])E=In(u,345,155,t)+"/"+E}else if(yrf(u));else if(!f)throw Error("Invalid tar header: unknown format.");if(l===0&&E&&E[E.length-1]==="/")l=5;return{name:E,mode:c,uid:w,gid:$,size:h,mtime:new Date(1000*v),type:d,linkname:D,uname:_,gname:N,devmajor:Z,devminor:B,pax:null}};function Prf(i){return af.equals(_K0,i.subarray(257,263))}function yrf(i){return af.equals(Trf,i.subarray(257,263))&&af.equals(Arf,i.subarray(263,265))}function Grf(i,u,t){if(typeof i!=="number")return t;if(i=~~i,i>=u)return u;if(i>=0)return i;if(i+=u,i>=0)return i;return 0}function Irf(i){switch(i){case 0:return"file";case 1:return"link";case 2:return"symlink";case 3:return"character-device";case 4:return"block-device";case 5:return"directory";case 6:return"fifo";case 7:return"contiguous-file";case 72:return"pax-header";case 55:return"pax-global-header";case 27:return"gnu-long-link-path";case 28:case 30:return"gnu-long-path"}return null}function xrf(i){switch(i){case"file":return 0;case"link":return 1;case"symlink":return 2;case"character-device":return 3;case"block-device":return 4;case"directory":return 5;case"fifo":return 6;case"contiguous-file":return 7;case"pax-header":return 72}return 0}function NK0(i,u,t,f){for(;t<f;t++)if(i[t]===u)return t;return f}function OK0(i){let u=256;for(let t=0;t<148;t++)u+=i[t];for(let t=156;t<512;t++)u+=i[t];return u}function tO(i,u){if(i=i.toString(8),i.length>u)return"7777777777777777777".slice(0,u)+" ";return"0000000000000000000".slice(0,u-i.length)+i+" "}function krf(i,u,t){u[t]=128;for(let f=11;f>0;f--)u[t+f]=i&255,i=Math.floor(i/256)}function jrf(i,u,t){if(i.toString(8).length>11)krf(i,u,t);else af.write(u,tO(i,11),t)}function Xrf(i){let u;if(i[0]===128)u=!0;else if(i[0]===255)u=!1;else return null;let t=[],f;for(f=i.length-1;f>0;f--){let c=i[f];if(u)t.push(c);else t.push(255-c)}let l=0,E=t.length;for(f=0;f<E;f++)l+=t[f]*Math.pow(256,f);return u?l:-1*l}function uO(i,u,t){if(i=i.subarray(u,u+t),u=0,i[u]&128)return Xrf(i);else{while(u<i.length&&i[u]===32)u++;let f=Grf(NK0(i,32,u,i.length),i.length,i.length);while(u<f&&i[u]===0)u++;if(f===u)return 0;return parseInt(af.toString(i.subarray(u,f)),8)}}function In(i,u,t,f){return af.toString(i.subarray(u,NK0(i,0,u,u+t)),f)}function uEu(i){let u=af.byteLength(i),t=Math.floor(Math.log(u)/Math.log(10))+1;if(u+t>=Math.pow(10,t))t++;return u+t+i}});var PK0=Y((d26,AK0)=>{var{Writable:Qrf,Readable:Hrf,getStreamError:ZK0}=iEu(),zrf=m6u(),BK0=Gn(),xn=tEu(),nrf=BK0.alloc(0);class FK0{constructor(){this.buffered=0,this.shifted=0,this.queue=new zrf,this._offset=0}push(i){this.buffered+=i.byteLength,this.queue.push(i)}shiftFirst(i){return this._buffered===0?null:this._next(i)}shift(i){if(i>this.buffered)return null;if(i===0)return nrf;let u=this._next(i);if(i===u.byteLength)return u;let t=[u];while((i-=u.byteLength)>0)u=this._next(i),t.push(u);return BK0.concat(t)}_next(i){let u=this.queue.peek(),t=u.byteLength-this._offset;if(i>=t){let f=this._offset?u.subarray(this._offset,u.byteLength):u;return this.queue.shift(),this._offset=0,this.buffered-=t,this.shifted+=t,f}return this.buffered-=i,this.shifted+=i,u.subarray(this._offset,this._offset+=i)}}class gK0 extends Hrf{constructor(i,u,t){super();this.header=u,this.offset=t,this._parent=i}_read(i){if(this.header.size===0)this.push(null);if(this._parent._stream===this)this._parent._update();i(null)}_predestroy(){this._parent.destroy(ZK0(this))}_detach(){if(this._parent._stream===this)this._parent._stream=null,this._parent._missing=TK0(this.header.size),this._parent._update()}_destroy(i){this._detach(),i(null)}}class UK0 extends Qrf{constructor(i){super(i);if(!i)i={};this._buffer=new FK0,this._offset=0,this._header=null,this._stream=null,this._missing=0,this._longHeader=!1,this._callback=fEu,this._locked=!1,this._finished=!1,this._pax=null,this._paxGlobal=null,this._gnuLongPath=null,this._gnuLongLinkPath=null,this._filenameEncoding=i.filenameEncoding||"utf-8",this._allowUnknownFormat=!!i.allowUnknownFormat,this._unlockBound=this._unlock.bind(this)}_unlock(i){if(this._locked=!1,i){this.destroy(i),this._continueWrite(i);return}this._update()}_consumeHeader(){if(this._locked)return!1;this._offset=this._buffer.shifted;try{this._header=xn.decode(this._buffer.shift(512),this._filenameEncoding,this._allowUnknownFormat)}catch(i){return this._continueWrite(i),!1}if(!this._header)return!0;switch(this._header.type){case"gnu-long-path":case"gnu-long-link-path":case"pax-global-header":case"pax-header":return this._longHeader=!0,this._missing=this._header.size,!0}if(this._locked=!0,this._applyLongHeaders(),this._header.size===0||this._header.type==="directory")return this.emit("entry",this._header,this._createStream(),this._unlockBound),!0;return this._stream=this._createStream(),this._missing=this._header.size,this.emit("entry",this._header,this._stream,this._unlockBound),!0}_applyLongHeaders(){if(this._gnuLongPath)this._header.name=this._gnuLongPath,this._gnuLongPath=null;if(this._gnuLongLinkPath)this._header.linkname=this._gnuLongLinkPath,this._gnuLongLinkPath=null;if(this._pax){if(this._pax.path)this._header.name=this._pax.path;if(this._pax.linkpath)this._header.linkname=this._pax.linkpath;if(this._pax.size)this._header.size=parseInt(this._pax.size,10);this._header.pax=this._pax,this._pax=null}}_decodeLongHeader(i){switch(this._header.type){case"gnu-long-path":this._gnuLongPath=xn.decodeLongPath(i,this._filenameEncoding);break;case"gnu-long-link-path":this._gnuLongLinkPath=xn.decodeLongPath(i,this._filenameEncoding);break;case"pax-global-header":this._paxGlobal=xn.decodePax(i);break;case"pax-header":this._pax=this._paxGlobal===null?xn.decodePax(i):Object.assign({},this._paxGlobal,xn.decodePax(i));break}}_consumeLongHeader(){this._longHeader=!1,this._missing=TK0(this._header.size);let i=this._buffer.shift(this._header.size);try{this._decodeLongHeader(i)}catch(u){return this._continueWrite(u),!1}return!0}_consumeStream(){let i=this._buffer.shiftFirst(this._missing);if(i===null)return!1;this._missing-=i.byteLength;let u=this._stream.push(i);if(this._missing===0){if(this._stream.push(null),u)this._stream._detach();return u&&this._locked===!1}return u}_createStream(){return new gK0(this,this._header,this._offset)}_update(){while(this._buffer.buffered>0&&!this.destroying){if(this._missing>0){if(this._stream!==null){if(this._consumeStream()===!1)return;continue}if(this._longHeader===!0){if(this._missing>this._buffer.buffered)break;if(this._consumeLongHeader()===!1)return!1;continue}let i=this._buffer.shiftFirst(this._missing);if(i!==null)this._missing-=i.byteLength;continue}if(this._buffer.buffered<512)break;if(this._stream!==null||this._consumeHeader()===!1)return}this._continueWrite(null)}_continueWrite(i){let u=this._callback;this._callback=fEu,u(i)}_write(i,u){this._callback=u,this._buffer.push(i),this._update()}_final(i){this._finished=this._missing===0&&this._buffer.buffered===0,i(this._finished?null:Error("Unexpected end of data"))}_predestroy(){this._continueWrite(null)}_destroy(i){if(this._stream)this._stream.destroy(ZK0(this));i(null)}[Symbol.asyncIterator](){let i=null,u=null,t=null,f=null,l=null,E=this;return this.on("entry",$),this.on("error",(d)=>{i=d}),this.on("close",h),{[Symbol.asyncIterator](){return this},next(){return new Promise(w)},return(){return v(null)},throw(d){return v(d)}};function c(d){if(!l)return;let D=l;l=null,D(d)}function w(d,D){if(i)return D(i);if(f){d({value:f,done:!1}),f=null;return}if(u=d,t=D,c(null),E._finished&&u)u({value:void 0,done:!0}),u=t=null}function $(d,D,_){if(l=_,D.on("error",fEu),u)u({value:D,done:!1}),u=t=null;else f=D}function h(){if(c(i),!u)return;if(i)t(i);else u({value:void 0,done:!0});u=t=null}function v(d){return E.destroy(d),c(d),new Promise((D,_)=>{if(E.destroyed)return D({value:void 0,done:!0});E.once("close",function(){if(d)_(d);else D({value:void 0,done:!0})})})}}}AK0.exports=function(u){return new UK0(u)};function fEu(){}function TK0(i){return i&=511,i&&512-i}});var GK0=Y((D26,lEu)=>{var yK0={S_IFMT:61440,S_IFDIR:16384,S_IFCHR:8192,S_IFBLK:24576,S_IFIFO:4096,S_IFLNK:40960};try{lEu.exports=Fi("fs").constants||yK0}catch{lEu.exports=yK0}});var KK0=Y((_26,JK0)=>{var{Readable:Rrf,Writable:brf,getStreamError:IK0}=iEu(),vY=Gn(),kn=GK0(),oUi=tEu(),xK0=vY.alloc(1024);class kK0 extends brf{constructor(i,u,t){super({mapWritable:Mrf,eagerOpen:!0});if(this.written=0,this.header=u,this._callback=t,this._linkname=null,this._isLinkname=u.type==="symlink"&&!u.linkname,this._isVoid=u.type!=="file"&&u.type!=="contiguous-file",this._finished=!1,this._pack=i,this._openCallback=null,this._pack._stream===null)this._pack._stream=this;else this._pack._pending.push(this)}_open(i){if(this._openCallback=i,this._pack._stream===this)this._continueOpen()}_continuePack(i){if(this._callback===null)return;let u=this._callback;this._callback=null,u(i)}_continueOpen(){if(this._pack._stream===null)this._pack._stream=this;let i=this._openCallback;if(this._openCallback=null,i===null)return;if(this._pack.destroying)return i(Error("pack stream destroyed"));if(this._pack._finalized)return i(Error("pack stream is already finalized"));if(this._pack._stream=this,!this._isLinkname)this._pack._encode(this.header);if(this._isVoid)this._finish(),this._continuePack(null);i(null)}_write(i,u){if(this._isLinkname)return this._linkname=this._linkname?vY.concat([this._linkname,i]):i,u(null);if(this._isVoid){if(i.byteLength>0)return u(Error("No body allowed for this entry"));return u()}if(this.written+=i.byteLength,this._pack.push(i))return u();this._pack._drain=u}_finish(){if(this._finished)return;if(this._finished=!0,this._isLinkname)this.header.linkname=this._linkname?vY.toString(this._linkname,"utf-8"):"",this._pack._encode(this.header);XK0(this._pack,this.header.size),this._pack._done(this)}_final(i){if(this.written!==this.header.size)return i(Error("Size mismatch"));this._finish(),i(null)}_getError(){return IK0(this)||Error("tar entry destroyed")}_predestroy(){this._pack.destroy(this._getError())}_destroy(i){this._pack._done(this),this._continuePack(this._finished?null:this._getError()),i()}}class jK0 extends Rrf{constructor(i){super(i);this._drain=EEu,this._finalized=!1,this._finalizing=!1,this._pending=[],this._stream=null}entry(i,u,t){if(this._finalized||this.destroying)throw Error("already finalized or destroyed");if(typeof u==="function")t=u,u=null;if(!t)t=EEu;if(!i.size||i.type==="symlink")i.size=0;if(!i.type)i.type=Crf(i.mode);if(!i.mode)i.mode=i.type==="directory"?493:420;if(!i.uid)i.uid=0;if(!i.gid)i.gid=0;if(!i.mtime)i.mtime=new Date;if(typeof u==="string")u=vY.from(u);let f=new kK0(this,i,t);if(vY.isBuffer(u))return i.size=u.byteLength,f.write(u),f.end(),f;if(f._isVoid)return f;return f}finalize(){if(this._stream||this._pending.length>0){this._finalizing=!0;return}if(this._finalized)return;this._finalized=!0,this.push(xK0),this.push(null)}_done(i){if(i!==this._stream)return;if(this._stream=null,this._finalizing)this.finalize();if(this._pending.length)this._pending.shift()._continueOpen()}_encode(i){if(!i.pax){let u=oUi.encode(i);if(u){this.push(u);return}}this._encodePax(i)}_encodePax(i){let u=oUi.encodePax({name:i.name,linkname:i.linkname,pax:i.pax}),t={name:"PaxHeader",mode:i.mode,uid:i.uid,gid:i.gid,size:u.byteLength,mtime:i.mtime,type:"pax-header",linkname:i.linkname&&"PaxHeader",uname:i.uname,gname:i.gname,devmajor:i.devmajor,devminor:i.devminor};this.push(oUi.encode(t)),this.push(u),XK0(this,u.byteLength),t.size=i.size,t.type=i.type,this.push(oUi.encode(t))}_doDrain(){let i=this._drain;this._drain=EEu,i()}_predestroy(){let i=IK0(this);if(this._stream)this._stream.destroy(i);while(this._pending.length){let u=this._pending.shift();u.destroy(i),u._continueOpen()}this._doDrain()}_read(i){this._doDrain(),i()}}JK0.exports=function(u){return new jK0(u)};function Crf(i){switch(i&kn.S_IFMT){case kn.S_IFBLK:return"block-device";case kn.S_IFCHR:return"character-device";case kn.S_IFDIR:return"directory";case kn.S_IFIFO:return"fifo";case kn.S_IFLNK:return"symlink"}return"file"}function EEu(){}function XK0(i,u){if(u&=511,u)i.push(xK0.subarray(0,512-u))}function Mrf(i){return vY.isBuffer(i)?i:vY.from(i)}});var YK0=Y((qrf)=>{qrf.extract=PK0();qrf.pack=KK0()});var SK0=Y((O26,LK0)=>{LK0.exports=WK0;function WK0(i,u){if(i&&u)return WK0(i)(u);if(typeof i!=="function")throw TypeError("need wrapper function");return Object.keys(i).forEach(function(f){t[f]=i[f]}),t;function t(){var f=Array(arguments.length);for(var l=0;l<f.length;l++)f[l]=arguments[l];var E=i.apply(this,f),c=f[f.length-1];if(typeof E==="function"&&E!==c)Object.keys(c).forEach(function(w){E[w]=c[w]});return E}}});var wEu=Y((Z26,cEu)=>{var QK0=SK0();cEu.exports=QK0(sUi);cEu.exports.strict=QK0(HK0);sUi.proto=sUi(function(){Object.defineProperty(Function.prototype,"once",{value:function(){return sUi(this)},configurable:!0}),Object.defineProperty(Function.prototype,"onceStrict",{value:function(){return HK0(this)},configurable:!0})});function sUi(i){var u=function(){if(u.called)return u.value;return u.called=!0,u.value=i.apply(this,arguments)};return u.called=!1,u}function HK0(i){var u=function(){if(u.called)throw Error(u.onceError);return u.called=!0,u.value=i.apply(this,arguments)},t=i.name||"Function wrapped with `once`";return u.onceError=t+" shouldn't be called more than once",u.called=!1,u}});var RK0=Y((B26,nK0)=>{var mrf=wEu(),erf=function(){},arf=global.Bare?queueMicrotask:process.nextTick.bind(process),orf=function(i){return i.setHeader&&typeof i.abort==="function"},srf=function(i){return i.stdio&&Array.isArray(i.stdio)&&i.stdio.length===3},zK0=function(i,u,t){if(typeof u==="function")return zK0(i,null,u);if(!u)u={};t=mrf(t||erf);var{_writableState:f,_readableState:l}=i,E=u.readable||u.readable!==!1&&i.readable,c=u.writable||u.writable!==!1&&i.writable,w=!1,$=function(){if(!i.writable)h()},h=function(){if(c=!1,!E)t.call(i)},v=function(){if(E=!1,!c)t.call(i)},d=function(B){t.call(i,B?Error("exited with error code: "+B):null)},D=function(B){t.call(i,B)},_=function(){arf(N)},N=function(){if(w)return;if(E&&!(l&&(l.ended&&!l.destroyed)))return t.call(i,Error("premature close"));if(c&&!(f&&(f.ended&&!f.destroyed)))return t.call(i,Error("premature close"))},Z=function(){i.req.on("finish",h)};if(orf(i))if(i.on("complete",h),i.on("abort",_),i.req)Z();else i.on("request",Z);else if(c&&!f)i.on("end",$),i.on("close",$);if(srf(i))i.on("exit",d);if(i.on("end",v),i.on("finish",h),u.error!==!1)i.on("error",D);return i.on("close",_),function(){if(w=!0,i.removeListener("complete",h),i.removeListener("abort",_),i.removeListener("request",Z),i.req)i.req.removeListener("finish",h);i.removeListener("end",$),i.removeListener("close",$),i.removeListener("finish",h),i.removeListener("exit",d),i.removeListener("end",v),i.removeListener("error",D),i.removeListener("close",_)}};nK0.exports=zK0});var MK0=Y((F26,CK0)=>{var prf=wEu(),imf=RK0(),pUi;try{pUi=Fi("fs")}catch(i){}var Co=function(){},umf=typeof process>"u"?!1:/^v?\.0/.test(process.version),iTi=function(i){return typeof i==="function"},tmf=function(i){if(!umf)return!1;if(!pUi)return!1;return(i instanceof(pUi.ReadStream||Co)||i instanceof(pUi.WriteStream||Co))&&iTi(i.close)},fmf=function(i){return i.setHeader&&iTi(i.abort)},lmf=function(i,u,t,f){f=prf(f);var l=!1;i.on("close",function(){l=!0}),imf(i,{readable:u,writable:t},function(c){if(c)return f(c);l=!0,f()});var E=!1;return function(c){if(l)return;if(E)return;if(E=!0,tmf(i))return i.close(Co);if(fmf(i))return i.abort();if(iTi(i.destroy))return i.destroy();f(c||Error("stream was destroyed"))}},bK0=function(i){i()},Emf=function(i,u){return i.pipe(u)},cmf=function(){var i=Array.prototype.slice.call(arguments),u=iTi(i[i.length-1]||Co)&&i.pop()||Co;if(Array.isArray(i[0]))i=i[0];if(i.length<2)throw Error("pump requires two streams per minimum");var t,f=i.map(function(l,E){var c=E<i.length-1,w=E>0;return lmf(l,c,w,function($){if(!t)t=$;if($)f.forEach(bK0);if(c)return;f.forEach(bK0),u(t)})});return i.reduce(Emf)};CK0.exports=cmf});var pK0=Y((vmf)=>{var qK0=YK0(),VK0=MK0(),rK0=Fi("fs"),Ul=Fi("path"),Mo=(global.Bare?global.Bare.platform:process.platform)==="win32";vmf.pack=function(u,t){if(!u)u=".";if(!t)t={};let f=t.fs||rK0,l=t.ignore||t.filter||qo,E=t.mapStream||oK0,c=hmf(f,t.dereference?f.stat:f.lstat,u,l,t.entries,t.sort),w=t.strict!==!1,$=typeof t.umask==="number"?~t.umask:~mK0(),h=t.pack||qK0.pack(),v=t.finish||qo,d=t.map||qo,D=typeof t.dmode==="number"?t.dmode:0,_=typeof t.fmode==="number"?t.fmode:0;if(t.strip)d=sK0(d,t.strip);if(t.readable)D|=parseInt(555,8),_|=parseInt(444,8);if(t.writable)D|=parseInt(333,8),_|=parseInt(222,8);B();function N(F,g){f.readlink(Ul.join(u,F),function(U,T){if(U)return h.destroy(U);g.linkname=$Eu(T),h.entry(g,B)})}function Z(F,g,U){if(h.destroyed)return;if(F)return h.destroy(F);if(!g){if(t.finalize!==!1)h.finalize();return v(h)}if(U.isSocket())return B();let T={name:$Eu(g),mode:(U.mode|(U.isDirectory()?D:_))&$,mtime:U.mtime,size:U.size,type:"file",uid:U.uid,gid:U.gid};if(U.isDirectory())return T.size=0,T.type="directory",T=d(T)||T,h.entry(T,B);if(U.isSymbolicLink())return T.size=0,T.type="symlink",T=d(T)||T,N(g,T);if(T=d(T)||T,!U.isFile()){if(w)return h.destroy(Error("unsupported type for "+g));return B()}let A=h.entry(T,B),G=E(f.createReadStream(Ul.join(u,g),{start:0,end:T.size>0?T.size-1:T.size}),T);G.on("error",function(k){A.destroy(k)}),VK0(G,A)}function B(F){if(F)return h.destroy(F);c(Z)}return h};function wmf(i){return i.length?i[i.length-1]:null}function $mf(){return!global.Bare&&process.getuid?process.getuid():-1}function mK0(){return!global.Bare&&process.umask?process.umask():0}vmf.extract=function(u,t){if(!u)u=".";if(!t)t={};u=Ul.resolve(u);let f=t.fs||rK0,l=t.ignore||t.filter||qo,E=t.mapStream||oK0,c=t.chown!==!1&&!Mo&&$mf()===0,w=t.extract||qK0.extract(),$=[],h=new Date,v=typeof t.umask==="number"?~t.umask:~mK0(),d=t.strict!==!1,D=t.validateSymlinks!==!1,_=t.map||qo,N=typeof t.dmode==="number"?t.dmode:0,Z=typeof t.fmode==="number"?t.fmode:0;if(t.strip)_=sK0(_,t.strip);if(t.readable)N|=parseInt(555,8),Z|=parseInt(444,8);if(t.writable)N|=parseInt(333,8),Z|=parseInt(222,8);if(w.on("entry",B),t.finish)w.on("finish",t.finish);return w;function B(A,G,k){A=_(A)||A,A.name=$Eu(A.name);let I=Ul.join(u,Ul.join("/",A.name));if(l(I,A))return G.resume(),k();let j=Ul.join(I,".")===Ul.join(u,".")?u:Ul.dirname(I);aK0(f,j,Ul.join(u,"."),function(fi,hi){if(fi)return k(fi);if(!hi)return k(Error(j+" is not a valid path"));if(A.type==="directory")return $.push([I,A.mtime]),T(I,{fs:f,own:c,uid:A.uid,gid:A.gid,mode:A.mode},C);T(j,{fs:f,own:c,uid:A.uid,gid:A.gid,mode:493},function(ci){if(ci)return k(ci);switch(A.type){case"file":return Q();case"link":return S();case"symlink":return K()}if(d)return k(Error("unsupported type for "+I+" ("+A.type+")"));G.resume(),k()})});function C(fi){if(fi)return k(fi);g(I,A,function(hi){if(hi)return k(hi);if(Mo)return k();U(I,A,k)})}function K(){if(Mo)return k();f.unlink(I,function(){let fi=Ul.resolve(Ul.dirname(I),A.linkname);if(!r(fi)&&D)return k(Error(I+" is not a valid symlink"));eK0(f,fi,Ul.join(u,"."),function(hi,ci){if(hi)return k(hi);if(!ci&&D)return k(Error(I+" is not a valid symlink"));f.symlink(A.linkname,I,C)})})}function S(){if(Mo)return k();f.unlink(I,function(){let fi=Ul.join(u,Ul.join("/",A.linkname));f.realpath(fi,function(hi,ci){if(hi||!r(ci))return k(Error(I+" is not a valid hardlink"));f.link(ci,I,function(ii){if(ii&&ii.code==="EPERM"&&t.hardlinkAsFilesFallback)return G=f.createReadStream(ci),Q();C(ii)})})})}function r(fi){return fi===u||fi.startsWith(u+Ul.sep)}function Q(){let fi=f.createWriteStream(I),hi=E(G,A);fi.on("error",function(ci){hi.destroy(ci)}),VK0(hi,fi,function(ci){if(ci)return k(ci);fi.on("close",C)})}}function F(A,G){let k;while((k=wmf($))&&A.slice(0,k[0].length)!==k[0])$.pop();if(!k)return G();f.utimes(k[0],h,k[1],G)}function g(A,G,k){if(t.utimes===!1)return k();if(G.type==="directory")return f.utimes(A,h,G.mtime,k);if(G.type==="symlink")return F(A,k);f.utimes(A,h,G.mtime,function(I){if(I)return k(I);F(A,k)})}function U(A,G,k){let I=G.type==="symlink",j=I?f.lchmod:f.chmod,C=I?f.lchown:f.chown;if(!j)return k();let K=(G.mode|(G.type==="directory"?N:Z))&v;if(C&&c)C.call(f,A,G.uid,G.gid,S);else S(null);function S(r){if(r)return k(r);if(!j)return k();j.call(f,A,K,k)}}function T(A,G,k){f.stat(A,function(I){if(!I)return k(null);if(I.code!=="ENOENT")return k(I);f.mkdir(A,{mode:G.mode,recursive:!0},function(j,C){if(j)return k(j);U(A,G,k)})})}};function eK0(i,u,t,f){if(u===t)return f(null,!0);if(!u.startsWith(t+Ul.sep))return f(null,!1);i.lstat(u,function(l,E){if(l&&l.code!=="ENOENT"&&l.code!=="EPERM")return f(l);if(l||!E.isSymbolicLink())return eK0(i,Ul.join(u,".."),t,f);f(null,!1)})}function aK0(i,u,t,f){if(u===t)return f(null,!0);i.lstat(u,function(l,E){if(l&&l.code!=="ENOENT"&&l.code!=="EPERM")return f(l);if(l||E.isDirectory())return aK0(i,Ul.join(u,".."),t,f);f(null,!1)})}function qo(){}function oK0(i){return i}function $Eu(i){return Mo?i.replace(/\\/g,"/").replace(/[:?<>|]/g,"_"):i}function hmf(i,u,t,f,l,E){if(!l)l=["."];let c=l.slice(0);return function($){if(!c.length)return $(null);let h=c.shift(),v=Ul.join(t,h);u.call(i,v,function(d,D){if(d)return $(l.indexOf(h)===-1&&d.code==="ENOENT"?null:d);if(!D.isDirectory())return $(null,h,D);i.readdir(v,function(_,N){if(_)return $(_);if(E)N.sort();for(let Z=0;Z<N.length;Z++)if(!f(Ul.join(t,h,N[Z])))c.push(Ul.join(h,N[Z]));$(null,h,D)})})}}function sK0(i,u){return function(t){t.name=t.name.split("/").slice(u).join("/");let f=t.linkname;if(f&&(t.type==="link"||Ul.isAbsolute(f)))t.linkname=f.split("/").slice(u).join("/");return i(t)}}});var _mf,Nmf;var iY0=O(()=>{V6u();_mf=X(RJ0(),1),Nmf=X(pK0(),1)});var uTi=()=>{};var uY0=O(()=>{OUi()});var tY0=O(()=>{bUi();RUi();uTi()});var fY0=()=>{};var lY0=()=>{};var hEu=O(()=>{AJ0();M6u();bUi();xJ0();b6u();V6u();kJ0();jJ0();XJ0();JJ0();C6u();KJ0();iY0();uTi();uY0();tY0();fY0();lY0();uTi()});var nl,u6,dY,Vo;var ro=O(()=>{nl={CLAIM_API_GROUP:"extensions.agents.x-k8s.io",CLAIM_API_VERSION:"v1alpha1",CLAIM_PLURAL:"sandboxclaims",SANDBOX_API_GROUP:"agents.x-k8s.io",SANDBOX_API_VERSION:"v1alpha1",SANDBOX_PLURAL:"sandboxes",POD_NAME_ANNOTATION:"agents.x-k8s.io/pod-name"};u6=class u6 extends Error{cause;constructor(i,u){super(i);if(this.name="SandboxError",this.cause=u,u instanceof Error&&u.stack)this.stack=`${this.stack}
 Caused by: ${u.stack}`}};dY=class dY extends u6{constructor(i,u){super(i,u);this.name="SandboxTimeoutError"}};Vo=class Vo extends u6{constructor(i,u){super(i,u);this.name="SandboxAlreadyExistsError"}}});async function Omf(i){let u=i.getCurrentCluster();if(!u)throw new u6("No active cluster in kubeconfig");let t={};await i.applyToHTTPSOptions(t);let f={},l=t.headers??{};for(let[E,c]of Object.entries(l))if(Array.isArray(c))f[E]=c.join(", ");else if(c!==void 0)f[E]=String(c);if(typeof t.auth==="string"&&!f.Authorization)f.Authorization=`Basic ${Buffer.from(t.auth).toString("base64")}`;return{server:u.server.replace(/\/+$/,""),headers:f,tls:{cert:vEu(t.cert),key:vEu(t.key),ca:vEu(t.ca),rejectUnauthorized:u.skipTLSVerify?!1:void 0}}}function vEu(i){if(i==null)return;if(typeof i==="string")return i;if(Buffer.isBuffer(i))return i.toString("utf8");return String(i)}async function DY(i,u){let t=await Omf(i),f={...t.headers,...u.headers};if(u.method==="PATCH")f["content-type"]=u.patchType==="apply"?"application/apply-patch+yaml":u.patchType==="strategic-merge"?"application/strategic-merge-patch+json":"application/merge-patch+json";else if(u.body!==void 0&&!("content-type"in f))f["content-type"]="application/json";let l={method:u.method,headers:f,body:u.body===void 0?void 0:JSON.stringify(u.body),signal:u.signal,tls:t.tls,...u.stream?{timeout:!1}:{}};return fetch(`${t.server}${u.path}`,l)}async function dEu(i){try{return await i.json()}catch{return null}}async function DEu(i,u){if(i.ok)return;let t=await dEu(i),f=t?.message??`${u} failed: ${i.status} ${i.statusText}`;throw new EY0(i.status,t,f)}async function mo(i,u,t,f,l="none"){try{let E=await DY(i,u);if(E.status===404)return null;if(await DEu(E,t),l==="json")return await E.json();return null}catch(E){throw new u6(f,E)}}async function eo(i,u,t){let f=`${cY0}/${encodeURIComponent(u)}/${nl.CLAIM_PLURAL}`,l;try{l=await DY(i,{method:"POST",path:f,body:t})}catch(h){let v=h instanceof Error?h.message:String(h);throw console.warn(`[agent-sandbox/client] createSandboxClaim ${t.metadata.name} transport error: ${v}`),new u6(`Failed to create SandboxClaim: ${t.metadata.name} (transport error: ${v})`,h)}if(l.ok)return;let E=await dEu(l),c=E?.reason?` ${E.reason}`:"",w=E?.message??l.statusText,$=`Failed to create SandboxClaim: ${t.metadata.name} (${l.status}${c}: ${w})`;if(console.warn(`[agent-sandbox/client] createSandboxClaim ${t.metadata.name} rejected: status=${l.status} reason=${E?.reason??"<none>"} message=${w}`),l.status===409)throw new Vo($);throw new u6($)}async function tTi(i,u,t,f=60000){let l=Date.now()+f,E=500,c;while(!0){let w=await t7(i,u,t).catch(()=>{return});if(!w)return;if(c=w,Date.now()>=l){let $=c.metadata?.finalizers??[],h=c.metadata?.deletionTimestamp??"<unknown>";throw new dY(`SandboxClaim ${t} still terminating after ${f}ms (deletionTimestamp=${h}, finalizers=[${$.join(", ")}])`)}await y0(500)}}function _Eu(i,u){return`${cY0}/${encodeURIComponent(i)}/${nl.CLAIM_PLURAL}/${encodeURIComponent(u)}`}async function wY0(i,u,t,f){await mo(i,{method:"PATCH",path:_Eu(u,t),patchType:"merge",body:{spec:{lifecycle:{shutdownPolicy:"Delete",shutdownTime:f}}}},"patchSandboxClaimShutdown",`Failed to patch SandboxClaim shutdownTime: ${t}`)}async function fO(i,u,t){await mo(i,{method:"DELETE",path:_Eu(u,t)},"deleteSandboxClaim",`Failed to delete SandboxClaim: ${t}`)}async function t7(i,u,t){return await mo(i,{method:"GET",path:_Eu(u,t)},"getSandboxClaim",`Failed to get SandboxClaim: ${t}`,"json")??void 0}async function $Y0(i,u,t,f=60){let l=Date.now()+f*1000,E=200;while(Date.now()<l){let w=(await t7(i,u,t).catch(()=>{return}))?.status?.sandbox?.name;if(w)return w;await y0(200)}throw new dY(`SandboxClaim ${t} did not record an adopted Sandbox (status.sandbox.name) within ${f}s`)}function NEu(i,u){return`${Zmf}/${encodeURIComponent(i)}/${dY0}/${encodeURIComponent(u)}`}async function fTi(i,u,t){let f=new URLSearchParams({fieldManager:_Y0,force:"true"}),l=`${NEu(u,t.metadata.name)}?${f}`;try{let E=await DY(i,{method:"PATCH",path:l,patchType:"apply",body:t});await DEu(E,"applyHttpRoute")}catch(E){throw new u6(`Failed to apply HTTPRoute: ${t.metadata.name}`,E)}}async function lTi(i,u,t){await mo(i,{method:"DELETE",path:NEu(u,t)},"deleteHttpRoute",`Failed to delete HTTPRoute: ${t}`)}async function DY0(i,u,t){return await mo(i,{method:"GET",path:NEu(u,t)},"getHttpRoute",`Failed to get HTTPRoute: ${t}`,"json")??void 0}async function NY0(i,u,t,f){let l={apiVersion:"v1",kind:"Service",metadata:{name:t},spec:{ports:[{name:f.name,port:f.port,targetPort:f.targetPort,protocol:f.protocol??"TCP"}]}},E=new URLSearchParams({fieldManager:_Y0,force:"true"}),c=`/api/v1/namespaces/${encodeURIComponent(u)}/services/${encodeURIComponent(t)}?${E}`;try{let w=await DY(i,{method:"PATCH",path:c,patchType:"apply",body:l});await DEu(w,"ensureServicePort")}catch(w){throw new u6(`Failed to apply Service ports: ${t}`,w)}}function ETi(i,u,t,f=180){let l=`/apis/${nl.SANDBOX_API_GROUP}/${nl.SANDBOX_API_VERSION}/namespaces/${encodeURIComponent(u)}/${nl.SANDBOX_PLURAL}?watch=true&fieldSelector=${encodeURIComponent(`metadata.name=${t}`)}`,{resolve:E,reject:c,promise:w}=Promise.withResolvers(),$=new AbortController,h=!1,v=setTimeout(()=>{if(h)return;h=!0,$.abort(),c(new dY(`Sandbox did not become ready within ${f} seconds`))},f*1000),d=(D)=>{if(h)return;h=!0,clearTimeout(v),$.abort(),D()};return(async()=>{let D;try{D=await DY(i,{method:"GET",path:l,signal:$.signal,headers:{accept:"application/json"},stream:!0})}catch(_){d(()=>c(new u6("Failed to start watch for sandbox readiness",_)));return}if(!D.ok||!D.body){let _=await dEu(D).catch(()=>null);d(()=>c(new u6(`Watch handshake failed (${D.status}): ${_?.message??D.statusText}`)));return}try{for await(let _ of OEu(D.body)){if(h)return;if(_.type==="ERROR"){let g=_.object;d(()=>c(new u6(`Watch stream error while waiting for sandbox: ${g.message??"unknown"}`)));return}if(_.type!=="ADDED"&&_.type!=="MODIFIED")continue;let N=_.object;if(!N.status?.conditions?.find((g)=>g.type==="Ready"&&g.status==="True"))continue;let B=N.metadata?.name;if(!B){d(()=>c(new u6("Sandbox metadata or name is missing")));return}let F=N.metadata?.annotations?.[nl.POD_NAME_ANNOTATION]??B;d(()=>E({sandboxName:B,podName:F}));return}d(()=>c(new u6("Watch stream closed before sandbox became ready")))}catch(_){if(h)return;if(_ instanceof Error&&(_.name==="AbortError"||$.signal.aborted))return;d(()=>c(new u6("Watch stream error while waiting for sandbox",_)))}})(),w}async function*OEu(i){let u=i.getReader(),t=new TextDecoder,f="";try{while(!0){let{value:E,done:c}=await u.read();if(c)break;f+=t.decode(E,{stream:!0});let w;while((w=f.indexOf(`
-`))>=0){let $=f.slice(0,w).trim();if(f=f.slice(w+1),!$)continue;yield JSON.parse($)}}let l=f.trim();if(l)yield JSON.parse(l)}finally{u.releaseLock()}}var EY0,cY0,hY0="gateway.networking.k8s.io",vY0="v1",dY0="httproutes",Zmf,ao,_Y0="mesh-sandbox-runner";var cTi=O(()=>{Z4();ro();EY0=class EY0 extends Error{status;body;constructor(i,u,t){super(t);this.status=i;this.body=u;this.name="KubeHttpError"}};cY0=`/apis/${nl.CLAIM_API_GROUP}/${nl.CLAIM_API_VERSION}/namespaces`;Zmf=`/apis/${hY0}/${vY0}/namespaces`;ao={API_GROUP:hY0,API_VERSION:vY0,PLURAL:dY0}});async function*BY0(i){let u=i.now??(()=>Date.now()),t=u(),f=i.schedulingTimeoutMs??gmf,l={pod:{},sandbox:{},events:{hasPulling:!1,hasPulled:!1},startedAt:t},E=[],c=null,w=!1,$=(g)=>{if(w)return;if(c){let U=c;c=null,U(g)}else E.push(g)},h=()=>{if(E.length>0)return Promise.resolve(E.shift());if(w)return Promise.resolve(null);return new Promise((g)=>{c=g})},v=()=>{if(w)return;if(w=!0,c){let g=c;c=null,g(null)}},d=new AbortController,D=()=>{d.abort(),v()};if(i.signal)if(i.signal.aborted)d.abort(),v();else i.signal.addEventListener("abort",D,{once:!0});let _=Math.max(0,f-(u()-t)),N=setTimeout(()=>$("tick"),_+100),Z,B=new Promise((g)=>{Z=g}),F=Promise.allSettled([Umf(i.kc,i.namespace,i.claimName,d.signal,l,$,u,Z),Amf(i.kc,i.namespace,i.claimName,d.signal,l,$),Pmf(i.kc,i.namespace,i.claimName,B,d.signal,l,$,u)]);try{let g=null,U=-1,T=OY0(l,f,u);if(g=BEu(T),!ZEu(T))U=ZY0(T);if(yield T,ZEu(T))return;while(!w){if(await h()===null)break;let G=OY0(l,f,u);if(ZEu(G)){let j=BEu(G);if(j!==g)g=j,yield G;return}let k=ZY0(G);if(k<U)continue;let I=BEu(G);if(I!==g)g=I,U=k,yield G}}finally{if(clearTimeout(N),d.abort(),i.signal)i.signal.removeEventListener("abort",D);v(),await F.catch(()=>{})}}function OY0(i,u,t){let{pod:f,sandbox:l,events:E,startedAt:c}=i;if(l.ready)return{kind:"ready"};let w=f.containerWaitingReason;if(w==="ImagePullBackOff"||w==="ErrImagePull")return{kind:"failed",reason:"image-pull-backoff",message:"Sandbox image failed to download. The cluster may be missing pull credentials or the image tag may not exist."};if(w==="CrashLoopBackOff")return{kind:"failed",reason:"crash-loop-backoff",message:"Sandbox crashed during startup and is now in CrashLoopBackOff. Check pod logs."};if(!f.scheduled&&E.lastFailedSchedulingAt!==void 0&&t()-c>u)return{kind:"failed",reason:"scheduling-timeout",message:E.failedSchedulingMessage??`Pod could not be scheduled within ${Math.round(u/1000)}s.`};if(f.containerRunning&&!f.containerReady)return{kind:"warming-daemon",since:c};if(E.hasPulling&&!E.hasPulled)return{kind:"pulling-image",since:c};if(w==="ContainerCreating"||w==="PodInitializing"||f.scheduled&&!f.containerRunning)return{kind:"starting-container",since:c};if(f.scheduledFalseReason==="Unschedulable"||E.lastFailedSchedulingAt!==void 0&&!f.scheduled)return{kind:"waiting-for-capacity",since:c,message:E.failedSchedulingMessage??f.scheduledFalseMessage,nodeClaim:E.nominatedNodeClaim};return{kind:"claiming",since:c}}function ZEu(i){return i.kind==="ready"||i.kind==="failed"}function ZY0(i){switch(i.kind){case"claiming":return 0;case"waiting-for-capacity":return 1;case"pulling-image":return 2;case"starting-container":return 3;case"warming-daemon":return 4;case"ready":case"failed":return 99}}function BEu(i){switch(i.kind){case"claiming":case"pulling-image":case"starting-container":case"warming-daemon":return i.kind;case"waiting-for-capacity":return`waiting-for-capacity:${i.message??""}:${i.nodeClaim??""}`;case"ready":return"ready";case"failed":return`failed:${i.reason}:${i.message}`}}async function Umf(i,u,t,f,l,E,c,w){let $=`/api/v1/namespaces/${encodeURIComponent(u)}/pods?watch=true&labelSelector=${encodeURIComponent(`${Bmf}=${t}`)}`;return wTi({kc:i,path:$,signal:f,label:`pod/${t}`,onEvent:(h)=>{if(h.type!=="ADDED"&&h.type!=="MODIFIED")return;let v=h.object;if(v.metadata?.name)w(v.metadata.name);Tmf(v,l,c),E("pod")}})}function Tmf(i,u,t){let l=(i.status?.conditions??[]).find((c)=>c.type==="PodScheduled");if(l?.status==="True")u.pod.scheduled=!0,u.pod.scheduledFalseReason=void 0,u.pod.scheduledFalseMessage=void 0;else if(l?.status==="False")u.pod.scheduled=!1,u.pod.scheduledFalseReason=l.reason,u.pod.scheduledFalseMessage=l.message;let E=(i.status?.containerStatuses??[]).find((c)=>c.name===Fmf);if(E)u.pod.containerWaitingReason=E.state?.waiting?.reason,u.pod.containerRunning=!!E.state?.running,u.pod.containerReady=E.ready===!0}async function Amf(i,u,t,f,l,E){let c=`/apis/${nl.CLAIM_API_GROUP}/${nl.CLAIM_API_VERSION}/namespaces/${encodeURIComponent(u)}/${nl.CLAIM_PLURAL}?watch=true&fieldSelector=${encodeURIComponent(`metadata.name=${t}`)}`;return wTi({kc:i,path:c,signal:f,label:`sandboxclaim/${t}`,onEvent:(w)=>{if(w.type!=="ADDED"&&w.type!=="MODIFIED")return;let h=w.object.status?.conditions?.find((v)=>v.type==="Ready");if(!h)return;if(h.status==="True")l.sandbox.ready=!0,l.sandbox.notReadyReason=void 0,l.sandbox.notReadyMessage=void 0;else l.sandbox.ready=!1,l.sandbox.notReadyReason=h.reason,l.sandbox.notReadyMessage=h.message;E("sandbox")}})}async function Pmf(i,u,t,f,l,E,c,w){let $=await Promise.race([f,new Promise((v)=>{if(l.aborted){v(t);return}l.addEventListener("abort",()=>v(t),{once:!0})})]);if(l.aborted)return;let h=`/api/v1/namespaces/${encodeURIComponent(u)}/events?watch=true&fieldSelector=${encodeURIComponent(`involvedObject.name=${$},involvedObject.kind=Pod`)}`;return wTi({kc:i,path:h,signal:l,label:`events/${t}`,onEvent:(v)=>{if(v.type!=="ADDED"&&v.type!=="MODIFIED")return;let d=v.object,D=d.reason;if(!D)return;switch(D){case"Pulling":E.events.hasPulling=!0;break;case"Pulled":E.events.hasPulling=!0,E.events.hasPulled=!0;break;case"FailedScheduling":E.events.lastFailedSchedulingAt=w(),E.events.failedSchedulingMessage=d.message;break;case"Nominated":{let _=d.message?.match(/nodeclaim\/([\w-]+)/);if(_)E.events.nominatedNodeClaim=_[1];break}default:return}c("event")}})}async function FY0(i){let{kc:u,namespace:t,labelSelector:f,signal:l,onDelete:E}=i,c=`/apis/${nl.CLAIM_API_GROUP}/${nl.CLAIM_API_VERSION}/namespaces/${encodeURIComponent(t)}/${nl.CLAIM_PLURAL}?watch=true&labelSelector=${encodeURIComponent(f)}`;return wTi({kc:u,path:c,signal:l,label:"sandboxclaim-reaper",onEvent:(w)=>{if(w.type!=="DELETED")return;let $=w.object.metadata?.name;if($)E($)}})}async function wTi(i){let{kc:u,path:t,signal:f,label:l,onEvent:E}=i,c=0;while(!f.aborted){try{let $=await DY(u,{method:"GET",path:t,signal:f,headers:{accept:"application/json"},stream:!0});if(!$.ok||!$.body){try{await $.body?.cancel()}catch{}if($.status===401||$.status===403){console.warn(`[lifecycle-watcher] ${l} stopped: watch denied (${$.status} ${$.statusText}). `+"The kubeconfig in use cannot watch SandboxClaims \u2014 if you are running locally, "+"this provider should not be active (check STUDIO_SANDBOX_PROVIDER / your sandbox preference).");return}throw Error(`watch handshake failed: ${$.status} ${$.statusText}`)}c=0;for await(let h of OEu($.body)){if(f.aborted)return;try{E(h)}catch(v){console.warn(`[lifecycle-watcher] ${l} onEvent threw: ${v instanceof Error?v.message:String(v)}`)}}}catch($){if(f.aborted)return;let h=$ instanceof Error?$.message:String($);console.warn(`[lifecycle-watcher] ${l} watch ended: ${h}`)}if(f.aborted)return;let w=hE(5000,250,c,2,0);c+=1,await y0(w,{signal:f}).catch(()=>{})}}var Bmf="studio.decocms.com/sandbox-handle",Fmf="sandbox",gmf=300000;var gY0=O(()=>{Z4();ro();cTi()});async function UY0(i,u,t){let f=new Map;for(let l of i){let E=u(l);if(!E)continue;let c=f.get(E);if(c)c.push(l);else f.set(E,[l])}await Promise.allSettled([...f.values()].map(async(l)=>{for(let E of l)await t(E).catch(()=>{})}))}import{createHash as ymf,randomBytes as Gmf,randomUUID as Imf}from"crypto";import*as GY0 from"net";import{PassThrough as xmf}from"stream";function kmf(i){if(i instanceof Error)return i.message;if(i&&typeof i==="object"){let u=i;if(u.error instanceof Error)return u.error.message;if(typeof u.message==="string"&&u.message)return u.message}return String(i)}class PEu{kind=G3;records=new Map;inflight=new Avi;stateStore;previewUrlPattern;kubeConfig;portForward;namespace;sandboxTemplateName;goSandboxTemplateName;envName;tokenGenerator;idleTtlMs;metrics;previewGateway;sentinelToken;mintCloneUrl;closed=!1;claimWatchAbort=new AbortController;constructor(i={}){this.stateStore=i.stateStore??null,this.previewUrlPattern=i.previewUrlPattern??null,this.kubeConfig=i.kubeConfig??nmf(),this.portForward=new r6u(this.kubeConfig),this.namespace=i.namespace??jmf,this.sandboxTemplateName=i.sandboxTemplateName??Xmf;let u=i.goSandboxTemplateName?.trim()??"";this.goSandboxTemplateName=u.length>0?u:null,this.envName=Vmf(i.envName),this.tokenGenerator=i.tokenGenerator??(()=>Gmf(Kmf).toString("hex")),this.idleTtlMs=i.idleTtlMs??Wmf,this.metrics=i.meter?zmf(i.meter):null,this.previewGateway=i.previewGateway&&i.previewUrlPattern?{...i.previewGateway}:null;let t=i.sentinelToken?.trim()??"";this.sentinelToken=t.length>0?t:null,this.mintCloneUrl=i.mintCloneUrl,this.startClaimReaper(),this.startCredentialRefresher()}startClaimReaper(){let i=["app.kubernetes.io/managed-by=studio","app.kubernetes.io/name=studio-sandbox",...this.envName?[`${I3.env}=${this.envName}`]:[]].join(",");FY0({kc:this.kubeConfig,namespace:this.namespace,labelSelector:i,signal:this.claimWatchAbort.signal,onDelete:(u)=>this.invalidateRecord(u)})}async ensure(i,u={}){let t=bN(i,u.branch??u.repo?.branch??null);return this.inflight.run(t,()=>Pvi(this.stateStore,i,G3,(f)=>this.ensureLocked(i,t,u,f)))}async delete(i){let u=await this.getRecord(i);if(this.records.delete(i),u)this.closeForwarder(u.daemonForward),this.metrics?.active.add(-1,TEu(u.tenant));if(await this.deleteHttpRouteIfManaged(i).catch((t)=>{console.warn(`[${Rl}] HTTPRoute delete failed for ${i}: ${t instanceof Error?t.message:String(t)}`)}),await fO(this.kubeConfig,this.namespace,i),this.stateStore)if(u)await this.stateStore.delete(u.id,G3);else await this.stateStore.deleteByHandle(G3,i)}async alive(i){return await t7(this.kubeConfig,this.namespace,i)!==void 0}watchClaimLifecycle(i,u){return BY0({kc:this.kubeConfig,namespace:this.namespace,claimName:i,signal:u})}async getPreviewUrl(i){let u=await this.getRecord(i);if(!u)return null;return this.composePreviewUrl(u)}async proxyDaemonRequest(i,u,t){let f=await this.getRecord(i);if(!f&&this.previewUrlPattern&&this.stateStore){let $=await this.stateStore.getByHandle(G3,i),h=$?.state,v=h?.token;if($&&v){let D=`http://${h?.adoptedSandboxName??i}.${this.namespace}.svc.cluster.local:${lO}`;try{let _=await mM(D,v,u,t);if(_.status!==404)return _;try{await _.body?.cancel()}catch{}}catch{}}}if(!f)f=await this.resurrectByHandle(i);if(!f)return new Response(JSON.stringify({error:"sandbox not found"}),{status:404,headers:{"content-type":"application/json"}});let l=f,E=performance.now(),c=0,w=!(t.body instanceof ReadableStream);try{let $=await mM(f.daemonUrl,f.token,u,t);if($.status===401&&w){this.invalidateRecord(i);let h=await this.getRecord(i).catch(()=>null)??await this.resurrectByHandle(i).catch(()=>null);if(h)l=h,$=await mM(h.daemonUrl,h.token,u,t)}return c=$.status,$}catch($){if(!w)throw $;this.invalidateRecord(i);let h=await this.resurrectByHandle(i)??await this.getRecord(i).catch(()=>null);if(!h)throw $;l=h;let v=await mM(h.daemonUrl,h.token,u,t);return c=v.status,v}finally{this.recordProxyDuration("daemon",c,l,performance.now()-E)}}async adoptLiveClaim(i,u){if(this.records.has(u))return!0;let t=await t7(this.kubeConfig,this.namespace,u).catch(()=>{return});if(!t||t.metadata?.deletionTimestamp)return!1;return await this.inflight.run(u,async()=>{let l=this.records.get(u);if(l)return this.toSandbox(l);let E=await this.adopt(i,u,t);if(!E)throw Error(`cannot adopt live claim ${u}`);return Pvi(this.stateStore,i,G3,(c)=>this.finish(E,c,!0,!0,"adopt"))}).catch(()=>null)!=null}async resolvePreviewUpstreamUrl(i){if(this.previewUrlPattern)return`http://${await this.resolveServiceNameForHandle(i)}.${this.namespace}.svc.cluster.local:${lO}`;let u=await this.getRecord(i);if(u)return u.daemonUrl;let t=await this.resurrectByHandle(i);return t?t.daemonUrl:null}async resolveServiceNameForHandle(i){let u=this.records.get(i);if(u)return u.adoptedSandboxName;if(this.stateStore){let f=(await this.stateStore.getByHandle(G3,i).catch(()=>null))?.state?.adoptedSandboxName;if(f)return f}return i}async proxyPreviewRequest(i,u){let t=performance.now(),f=this.records.get(i)??null,l=0;try{let E=await this.resolvePreviewUpstreamUrl(i);if(!E){l=404;let N=gEu(404,{error:"sandbox not found"});return N.headers.set(NY,"1"),N}let c=new URL(u.url);if((c.pathname==="/_sandbox"||c.pathname.startsWith("/_sandbox/")||c.pathname==="/_decopilot_vm"||c.pathname.startsWith("/_decopilot_vm/"))&&u.method!=="GET")return l=404,gEu(404,{error:"not found"});let $=(N)=>`${N}${c.pathname}${c.search}`,h=new Headers(u.headers);for(let N of Qmf)h.delete(N);let v=u.method!=="GET"&&u.method!=="HEAD",d={method:u.method,headers:h,body:v?u.body:void 0,redirect:"manual",signal:u.signal,duplex:v?"half":void 0},D;try{D=await fetch($(E),d)}catch(N){let Z=`${E}${c.pathname}`;if(console.warn(`[${Rl}] preview fetch to ${Z} failed: ${N instanceof Error?N.message:String(N)}`),u.method==="GET"||u.method==="HEAD"){if(this.invalidateRecord(i),await this.resurrectByHandle(i).catch(()=>null)){let g=await this.resolvePreviewUpstreamUrl(i);if(g)try{D=await fetch($(g),d);let U=new Headers;for(let[T,A]of D.headers.entries())if(!TY0.includes(T.toLowerCase()))U.set(T,A);return l=D.status,new Response(D.body,{status:D.status,statusText:D.statusText,headers:U})}catch(U){console.warn(`[${Rl}] preview fetch retry to ${Z} failed: ${U instanceof Error?U.message:String(U)}`)}}}else this.invalidateRecord(i);l=502;let B=gEu(502,{error:"sandbox daemon unreachable"});return B.headers.set(NY,"1"),B}let _=new Headers;for(let[N,Z]of D.headers.entries())if(!TY0.includes(N.toLowerCase()))_.set(N,Z);return l=D.status,new Response(D.body,{status:D.status,statusText:D.statusText,headers:_})}finally{this.recordProxyDuration("preview",l,f,performance.now()-t,i)}}async ensureLocked(i,u,t,f){if(t.image)console.warn(`[${Rl}] opts.image ignored (template ${this.sandboxTemplateName} pins image): got ${t.image}`);if(f){let c=await f.get(i,G3);if(c){let w=await this.rehydrate(i,u,c);if(w)return await this.refreshDaemonGitCredential(w,t),this.finish(w,f,!1,!0,"resume");await f.delete(i,G3)}}let l=await t7(this.kubeConfig,this.namespace,u).catch(()=>{return});if(l)if(l.metadata?.deletionTimestamp)await tTi(this.kubeConfig,this.namespace,u).catch((c)=>{console.warn(`[${Rl}] wait for terminating claim ${u} failed: ${c instanceof Error?c.message:String(c)}`)});else{let c=await this.adopt(i,u,l).catch((w)=>{return console.warn(`[${Rl}] adopt ${u} failed, recreating: ${w instanceof Error?w.message:String(w)}`),null});if(c)return await this.refreshDaemonGitCredential(c,t),this.finish(c,f,!0,!0,"adopt");await fO(this.kubeConfig,this.namespace,u).catch(()=>{}),await tTi(this.kubeConfig,this.namespace,u).catch((w)=>{console.warn(`[${Rl}] wait for deleted claim ${u} failed: ${w instanceof Error?w.message:String(w)}`)})}let E=await this.provision(i,u,t);return this.finish(E,f,!0,!1,"fresh")}async finish(i,u,t,f,l){let E=this.records.get(i.handle),c=E!==void 0;if(E&&E.daemonForward!==i.daemonForward)this.closeForwarder(E.daemonForward);if(this.records.set(i.handle,i),t)await this.persist(u,i);if(f)await wY0(this.kubeConfig,this.namespace,i.handle,this.computeShutdownTime()).catch((w)=>console.warn(`[${Rl}] TTL refresh failed for ${i.handle}: ${w instanceof Error?w.message:String(w)}`));if(this.metrics){let w=TEu(i.tenant);if(this.metrics.ensureOutcome.add(1,{...w,outcome:l}),!c)this.metrics.active.add(1,w)}return this.toSandbox(i)}buildEnvMap(i,u){let t={},f=[];for(let[l,E]of Object.entries(i.env??{}))if(Ymf.has(l))f.push(l);else t[l]=E;if(f.length>0)console.warn(`[${Rl}] opts.env keys overlap reserved bootstrap names and were dropped: ${f.join(",")}`);return{...t,DAEMON_TOKEN:u.token,DAEMON_BOOT_ID:u.daemonBootId,APP_ROOT:u.workdir,PROXY_PORT:String(lO)}}buildClaim(i,u,t){let f=this.sentinelToken!==null,l=f?[]:Object.entries(this.buildEnvMap(u,t)).sort(([h],[v])=>h<v?-1:h>v?1:0).map(([h,v])=>({name:h,value:v})),E=emf(u),c=Object.keys(E).length>0,{impl:w,templateName:$}=PY0(u.daemonImpl,this.sandboxTemplateName,this.goSandboxTemplateName);if(u.daemonImpl==="go"&&w!=="go")console.warn(`[${Rl}] daemonImpl=go requested for ${i} but no Go SandboxTemplate is configured (STUDIO_SANDBOX_GO_TEMPLATE_NAME); landing on ts`);return{apiVersion:`${nl.CLAIM_API_GROUP}/${nl.CLAIM_API_VERSION}`,kind:"SandboxClaim",metadata:{name:i,namespace:this.namespace,labels:{"app.kubernetes.io/name":"studio-sandbox","app.kubernetes.io/managed-by":"studio",[I3.daemonImpl]:w,...this.envName?{[I3.env]:this.envName}:{},...UEu(u.tenant)},...c?{annotations:E}:{}},spec:{sandboxTemplateRef:{name:$},additionalPodMetadata:{labels:UEu(u.tenant,{[I3.role]:"claimed",[I3.sandboxHandle]:i,[I3.daemonImpl]:w,...this.envName?{[I3.env]:this.envName}:{}}),...c?{annotations:E}:{}},env:l,warmpool:f?"default":"none",lifecycle:{shutdownPolicy:"Delete",shutdownTime:this.computeShutdownTime()}}}}async provision(i,u,t){let f=this.tokenGenerator(),l=Imf(),E=FEu,c=this.buildClaim(u,t,{token:f,daemonBootId:l,workdir:E});try{await eo(this.kubeConfig,this.namespace,c)}catch(D){if(D instanceof Vo)await tTi(this.kubeConfig,this.namespace,u),await eo(this.kubeConfig,this.namespace,c);else throw D}let w;try{w=await $Y0(this.kubeConfig,this.namespace,u),await ETi(this.kubeConfig,this.namespace,w)}catch(D){throw await fO(this.kubeConfig,this.namespace,u).catch(()=>{}),D}try{await this.ensureServicePortForAdoptedSandbox(w),await this.ensureHttpRouteForHandle(u,w,t.tenant??null)}catch(D){throw await fO(this.kubeConfig,this.namespace,u).catch(()=>{}),D}let $=await this.openForwarder(w,lO,u),h=`http://127.0.0.1:${$.localPort}`,v=this.workloadConfigPayload(t),d=l;try{if(await lli(h),this.sentinelToken!==null){let D=await fli(h);if(D)d=D.bootId;await P_(h,this.sentinelToken,v??{},{rotateToken:f})}else if(v)await P_(h,f,v);if(t.orgFsConfigJson)await JMu(h,f,t.orgFsConfigJson).catch((D)=>console.warn("[org-fs] sidecar config relay failed",D))}catch(D){throw this.closeForwarder($),await this.deleteHttpRouteIfManaged(u).catch(()=>{}),await fO(this.kubeConfig,this.namespace,u).catch(()=>{}),D}return{id:i,handle:u,adoptedSandboxName:w,token:f,workdir:E,daemonUrl:h,daemonForward:$,workload:t.workload??null,daemonBootId:d,tenant:t.tenant??null,ensureOpts:omf({...t,daemonImpl:PY0(t.daemonImpl,this.sandboxTemplateName,this.goSandboxTemplateName).impl})}}workloadConfigPayload(i){return ilu({runtime:i?.workload?.runtime??"node",packageManager:i?.workload?.packageManager?{name:i.workload.packageManager,...i.workload.packageManagerPath?{path:i.workload.packageManagerPath}:{}}:null,repo:i?.repo??null,port:i?.workload?.devPort??Jmf,tenant:i?.tenant??void 0})}async refreshDaemonGitCredential(i,u){let t=ulu(u);if(!t)return;try{await P_(i.daemonUrl,i.token,t)}catch(f){console.warn(`[${Rl}] git credential refresh failed for ${i.handle}: ${f instanceof Error?f.message:String(f)}`)}}async withFreshCloneUrl(i,u){if(!this.mintCloneUrl)return i;try{let t=await this.mintCloneUrl(i,u!==void 0?{bufferMs:u}:void 0);return t?{...i,cloneUrl:t}:i}catch(t){return console.warn(`[${Rl}] clone credential re-mint failed: ${t instanceof Error?t.message:String(t)}`),i}}startCredentialRefresher(){if(!this.mintCloneUrl)return;let{signal:i}=this.claimWatchAbort;(async()=>{while(!i.aborted){if(await y0(Lmf,{signal:i}).catch(()=>{}),i.aborted)break;try{await this.refreshAllGitCredentials()}catch(u){console.warn(`[${Rl}] periodic credential refresh failed: ${u instanceof Error?u.message:String(u)}`)}}})()}async refreshAllGitCredentials(){await UY0(this.records.values(),(i)=>i.ensureOpts?.repo?.connectionId,async(i)=>{if(this.claimWatchAbort.signal.aborted)return;let u=i.ensureOpts?.repo;if(!u)return;let t=await this.withFreshCloneUrl(u,Smf);await this.refreshDaemonGitCredential(i,{...i.ensureOpts,repo:t}),i.ensureOpts={...i.ensureOpts,repo:t}})}async rebootstrapDaemon(i,u,t){if(this.sentinelToken===null)return!1;let f=this.workloadConfigPayload(t)??{};try{return await P_(i,this.sentinelToken,f,{rotateToken:u}),!0}catch(l){if(l instanceof tli&&l.status===401)try{return await P_(i,u,f,{rotateToken:u}),!0}catch(E){return console.warn(`[${Rl}] re-bootstrap retry with claim token failed: ${E instanceof Error?E.message:String(E)}`),!1}return console.warn(`[${Rl}] re-bootstrap failed: ${l instanceof Error?l.message:String(l)}`),!1}}async ensureServicePortForAdoptedSandbox(i){if(!this.previewGateway||!this.previewUrlPattern)return;await NY0(this.kubeConfig,this.namespace,i,{name:"daemon",port:lO,targetPort:lO})}async ensureHttpRouteForHandle(i,u,t){if(!this.previewGateway||!this.previewUrlPattern)return;let f=smf(this.previewUrlPattern,i);if(!f)throw new u6(`Unable to derive preview hostname for ${i} from pattern: ${this.previewUrlPattern}`);let l={apiVersion:`${ao.API_GROUP}/${ao.API_VERSION}`,kind:"HTTPRoute",metadata:{name:i,namespace:this.namespace,labels:UEu(t??void 0,{[I3.role]:"claimed",[I3.sandboxHandle]:i,"app.kubernetes.io/name":"studio-sandbox","app.kubernetes.io/managed-by":"studio",...this.envName?{[I3.env]:this.envName}:{}})},spec:{parentRefs:[{kind:"Gateway",group:"gateway.networking.k8s.io",name:this.previewGateway.name,namespace:this.previewGateway.namespace}],hostnames:[f],rules:[{backendRefs:[{group:"",kind:"Service",name:u,port:lO}]}]}};await fTi(this.kubeConfig,this.namespace,l)}async deleteHttpRouteIfManaged(i){if(!this.previewGateway)return;await lTi(this.kubeConfig,this.namespace,i)}async rehydrate(i,u,t){let f=t.state;if(!f.adoptedSandboxName&&!f.podName||!f.token)return null;let l=await t7(this.kubeConfig,this.namespace,u).catch(()=>{return});if(!l||!AY0(l))return null;let E=l.status?.sandbox?.name??f.adoptedSandboxName??f.podName??u,c=await this.openAndProbeDaemon(E,u);if(!c)return null;if(f.daemonBootId&&f.daemonBootId!==c.bootId){if(this.sentinelToken!==null){let w=f.ensureOpts?.repo?{...f.ensureOpts,repo:await this.withFreshCloneUrl(f.ensureOpts.repo)}:f.ensureOpts??null;if(!await this.rebootstrapDaemon(c.daemonUrl,f.token,w))return this.closeForwarder(c.daemonForward),null}else console.warn(`[${Rl}] daemon restart detected (handle=${u}): stored bootId=${f.daemonBootId} live bootId=${c.bootId}`);await this.stateStore?.put(i,G3,{handle:u,state:{...f,daemonBootId:c.bootId}}).catch((w)=>console.warn(`[${Rl}] bootId persist failed for ${u}: ${w instanceof Error?w.message:String(w)}`))}return{id:i,handle:u,adoptedSandboxName:E,token:f.token,workdir:f.workdir??FEu,daemonUrl:c.daemonUrl,daemonForward:c.daemonForward,workload:f.workload??null,daemonBootId:c.bootId,tenant:f.tenant??null,ensureOpts:f.ensureOpts??null}}async adopt(i,u,t){if(!AY0(t))return null;let f=t.status?.sandbox?.name??u;if(this.sentinelToken!==null)return null;let l=Rmf(t);if(!l)return null;let E=await this.openAndProbeDaemon(f,u);if(!E)return null;let c=amf(t);if(this.previewGateway)await this.ensureServicePortForAdoptedSandbox(f).catch((w)=>{console.warn(`[${Rl}] Service port backfill failed for ${u}: ${w instanceof Error?w.message:String(w)}`)}),await this.ensureHttpRouteForHandle(u,f,c).catch((w)=>{console.warn(`[${Rl}] HTTPRoute backfill failed for ${u}: ${w instanceof Error?w.message:String(w)}`)});return{id:i,handle:u,adoptedSandboxName:f,token:l,workdir:FEu,daemonUrl:E.daemonUrl,daemonForward:E.daemonForward,workload:null,daemonBootId:E.bootId,tenant:c,ensureOpts:null}}async openAndProbeDaemon(i,u){let t=await this.openForwarder(i,lO,u).catch(()=>null);if(!t)return null;let f=`http://127.0.0.1:${t.localPort}`,l=await fli(f);if(!l)return this.closeForwarder(t),null;return{daemonForward:t,daemonUrl:f,bootId:l.bootId}}async getRecord(i){let u=this.records.get(i);if(u)return u;if(!this.stateStore)return null;let t=await this.stateStore.getByHandle(G3,i);if(!t)return null;let f=await this.rehydrate(t.id,i,t);if(f)this.records.set(i,f);return f}async resurrectByHandle(i){if(!this.stateStore)return null;let u=await this.stateStore.getByHandle(G3,i);if(!u)return null;let t=u.state.ensureOpts;if(!t)return null;let f=t.repo?{...t,repo:await this.withFreshCloneUrl(t.repo)}:t;return await this.ensure(u.id,f),this.records.get(i)??null}invalidateRecord(i){let u=this.records.get(i);if(!u)return;this.records.delete(i),this.closeForwarder(u.daemonForward)}recordProxyDuration(i,u,t,f,l){if(!this.metrics)return;this.metrics.proxyDurationMs.record(f,{...TEu(t?.tenant??null),source:i,sandbox_handle:t?.handle??l??"",status_code:u||0})}composePreviewUrl(i){if(this.previewUrlPattern)return yvi(this.previewUrlPattern,i.handle);return`http://127.0.0.1:${i.daemonForward.localPort}/`}toSandbox(i){return{handle:i.handle,workdir:i.workdir,previewUrl:this.composePreviewUrl(i)}}async persist(i,u){if(!i)return;let t={adoptedSandboxName:u.adoptedSandboxName,token:u.token,workdir:u.workdir,workload:u.workload,daemonBootId:u.daemonBootId,tenant:u.tenant,...u.ensureOpts?{ensureOpts:u.ensureOpts}:{}};await i.put(u.id,G3,{handle:u.handle,state:t})}computeShutdownTime(){return new Date(Date.now()+this.idleTtlMs).toISOString()}openForwarder(i,u,t=i){let f=bmf(t,u);return new Promise((l,E)=>{let c=(w,$)=>{let h=GY0.createServer((v)=>this.handleForwardedConnection(v,i,u,t));h.once("error",(v)=>{if(v.code==="EADDRINUSE"&&$<Hmf){try{h.close()}catch{}let d=AEu+(w-AEu+1)%IY0;c(d,$+1);return}E(v)}),h.listen(w,"127.0.0.1",()=>{let v=h.address();if(!v||typeof v==="string"){h.close(),E(Error("port-forward listener failed to bind"));return}l({server:h,localPort:v.port})})};c(f,0)})}handleForwardedConnection(i,u,t,f){let l=new xmf,E=null,c=!1,w=()=>{if(c)return;if(c=!0,l.destroy(),E)try{E.close()}catch{}if(!i.destroyed)i.destroy()};i.pipe(l),i.on("error",w),i.on("close",w),this.portForward.portForward(this.namespace,u,[t],i,null,l).then(($)=>{let h=typeof $==="function"?$():$;if(!h){w();return}if(E=h,E.on("close",w),E.on("error",()=>{this.invalidateRecord(f),w()}),c)try{E.close()}catch{}}).catch(($)=>{console.warn(`[${Rl}] port-forward to ${u}:${t} failed: ${kmf($)}`),this.invalidateRecord(f),w()})}closeForwarder(i){i.server.close((u)=>{if(u)console.warn(`[${Rl}] port-forward close on :${i.localPort} errored: ${u instanceof Error?u.message:String(u)}`)})}close(){if(this.closed)return;this.closed=!0,this.claimWatchAbort.abort();for(let i of this.records.values())this.closeForwarder(i.daemonForward);this.records.clear()}}function zmf(i){return{active:i.createUpDownCounter("studio.sandbox.active",{description:"Active sandbox count, by runner kind and owning org. Cross-checks the cAdvisor-derived count from the cluster \u2014 divergence between the two indicates orphaned claims (studio deleted but K8s didn't reap) or unattributed pods.",unit:"{sandbox}"}),ensureOutcome:i.createCounter("studio.sandbox.ensure.outcome",{description:"Outcome of each ensure() call: fresh provision, resume from state-store after restart, or adopt of a cluster-side claim studio didn't know about. Cold-start ratio is the primary input for warm-pool sizing.",unit:"{call}"}),proxyDurationMs:i.createHistogram("studio.sandbox.proxy.duration_ms",{description:"Wall-clock latency of studio-mediated requests to the sandbox daemon: tool exec proxies (source=daemon) and preview iframe traffic (source=preview).",unit:"ms"})}}function nmf(){let i=new yn;return i.loadFromDefault(),i}function AY0(i){return Boolean(i.status?.conditions?.some((u)=>u.type==="Ready"&&u.status==="True"))}function Rmf(i){let u=i.spec?.env;if(!u)return null;for(let t of u)if(t.name==="DAEMON_TOKEN"&&t.value)return t.value;return null}function bmf(i,u){let t=ymf("sha256").update(`${i}:${u}`).digest();return AEu+t.readUInt32BE(0)%IY0}function gEu(i,u){return new Response(JSON.stringify(u),{status:i,headers:{"content-type":"application/json","access-control-allow-origin":"*"}})}function PY0(i,u,t){if(i==="go"&&t)return{impl:"go",templateName:t};return{impl:"ts",templateName:u}}function yY0(i){let u=i.slice(0,Mmf);return Cmf.test(u)?u:""}function Vmf(i){if(i===void 0)return null;let u=i.trim();if(u==="")return null;if(!qmf.test(u))throw Error(`AgentSandboxProvider: envName=${JSON.stringify(u)} is not a valid DNS-label-safe environment name (lowercase alphanumeric or '-', starts with a letter, ends alphanumeric, \u226432 chars). Studio sets this from STUDIO_ENV; check the studio chart's configMap.`);return u}function UEu(i,u={}){let t={...u};if(i){let f=yY0(i.orgId),l=yY0(i.userId);if(f)t[I3.orgId]=f;if(l)t[I3.userId]=l}return t}function _Y(i){let u="";for(let t of i){let f=t.codePointAt(0)??0;u+=f<32||f===127?" ":t}return u.slice(0,rmf)}function mmf(i){try{let u=new URL(i);return u.username="",u.password="",u.toString()}catch{return""}}function emf(i){let u={},t=i.tenant;if(t?.orgSlug)u[Wv.orgSlug]=_Y(t.orgSlug);if(t?.orgName)u[Wv.orgName]=_Y(t.orgName);if(t?.userEmail)u[Wv.userEmail]=_Y(t.userEmail);if(t?.userName)u[Wv.userName]=_Y(t.userName);let f=i.repo;if(f){if(f.displayName)u[Wv.gitRepo]=_Y(f.displayName);let l=mmf(f.cloneUrl);if(l)u[Wv.gitRepoUrl]=_Y(l);let E=i.branch??f.branch;if(E)u[Wv.gitBranch]=_Y(E)}return u}function amf(i){let u=i.metadata?.labels;if(!u)return null;let t=u[I3.orgId],f=u[I3.userId];if(!t||!f)return null;let l=i.metadata?.annotations??{};return{orgId:t,userId:f,orgSlug:l[Wv.orgSlug],orgName:l[Wv.orgName],userEmail:l[Wv.userEmail],userName:l[Wv.userName]}}function TEu(i){return{org_id:i?.orgId??"",user_id:i?.userId??"",runner_kind:G3}}function omf(i){let u={};if(i.repo)u.repo=i.repo;if(i.workload)u.workload=i.workload;if(i.env&&Object.keys(i.env).length>0)u.env=i.env;if(i.tenant)u.tenant=i.tenant;if(i.daemonImpl)u.daemonImpl=i.daemonImpl;return Object.keys(u).length>0?u:null}function smf(i,u){try{return new URL(yvi(i,u)).hostname||null}catch{return null}}var G3="agent-sandbox",Rl="AgentSandboxProvider",NY="x-sandbox-preview-not-ready",jmf="agent-sandbox-system",Xmf="studio-sandbox",lO=9000,Jmf=3000,FEu="/app",Kmf=32,Ymf,Wmf=900000,Lmf=900000,Smf=1800000,Qmf,TY0,AEu=40000,IY0=1e4,Hmf=256,I3,Wv,Cmf,Mmf=63,qmf,rmf=253;var xY0=O(()=>{Z4();hEu();Nni();Gvi();cTi();ro();gY0();Ymf=new Set(["DAEMON_TOKEN","DAEMON_BOOT_ID","APP_ROOT","PROXY_PORT"]),Qmf=["cookie","host","connection","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","accept-encoding","content-length","upgrade"],TY0=["connection","keep-alive","transfer-encoding","content-encoding","content-length"];I3={role:"studio.decocms.com/role",sandboxHandle:"studio.decocms.com/sandbox-handle",orgId:"studio.decocms.com/org-id",userId:"studio.decocms.com/user-id",env:"studio.decocms.com/env",daemonImpl:"studio.decocms.com/daemon-impl"};Wv={orgSlug:"studio.decocms.com/org-slug",orgName:"studio.decocms.com/org-name",userEmail:"studio.decocms.com/user-email",userName:"studio.decocms.com/user-name",gitRepo:"studio.decocms.com/git-repo",gitRepoUrl:"studio.decocms.com/git-repo-url",gitBranch:"studio.decocms.com/git-branch"},Cmf=/^([A-Za-z0-9]([-A-Za-z0-9_.]*[A-Za-z0-9])?)?$/;qmf=/^[a-z]([a-z0-9-]{0,30}[a-z0-9])?$/});var kY0={};yi(kY0,{waitForSandboxReady:()=>ETi,getSandboxClaim:()=>t7,getHttpRoute:()=>DY0,deleteSandboxClaim:()=>fO,deleteHttpRoute:()=>lTi,createSandboxClaim:()=>eo,applyHttpRoute:()=>fTi,SandboxTimeoutError:()=>dY,SandboxError:()=>u6,PREVIEW_NOT_READY_HEADER:()=>NY,KubeConfig:()=>yn,K8S_CONSTANTS:()=>nl,HTTPROUTE_CONSTANTS:()=>ao,AgentSandboxProvider:()=>PEu});var yEu=O(()=>{hEu();ro();cTi();xY0()});class $Ti{kind=EO;userSub;dispatch;stateStore;records=new Map;constructor(i){if(!i.userSub)throw Error("DesktopSandboxProvider requires userSub");if(!i.dispatch)throw Error("DesktopSandboxProvider requires dispatch");this.userSub=i.userSub,this.dispatch=i.dispatch,this.stateStore=i.stateStore??null}async ensure(i,u={}){let t=u.branch??u.repo?.branch,f=bN(i,t),l=this.records.get(f);if(l){if(await this.probeHealth(f))return this.toSandbox(l);if(this.records.delete(f),this.stateStore)await this.stateStore.deleteByHandle(EO,f).catch(()=>{})}else if(this.stateStore){let D=(await this.stateStore.getByHandle(EO,f))?.state,_=D?.sandboxApiUrl;if(_){if(await this.probeHealth(f)){let N={handle:f,sandboxApiUrl:_,previewUrl:D?.previewUrl??_};return this.records.set(f,N),this.toSandbox(N)}await this.stateStore.deleteByHandle(EO,f).catch(()=>{})}}let E=gh({userName:u.tenant?.userName,userEmail:u.tenant?.userEmail}),c=JSON.stringify({handle:f,repo:u.repo,branch:t,...u.workload?{workload:u.workload}:{},...E?{operator:E}:{},...u.offloadAllowedHosts?{offloadAllowedHosts:u.offloadAllowedHosts}:{},...u.offloadAllowSameHostDev!==void 0?{offloadAllowSameHostDev:u.offloadAllowSameHostDev}:{},...u.orgFsConfigJson?{orgFsConfigJson:u.orgFsConfigJson}:{}}),w=await this.dispatchJson("POST","/api/sandboxes",c),$=JSON.parse(w);if(typeof $.sandboxApiUrl!=="string")throw Error("desktop ensure: daemon did not return a sandboxApiUrl string");let h=typeof $.previewUrl==="string"?$.previewUrl:$.sandboxApiUrl,v={handle:f,sandboxApiUrl:$.sandboxApiUrl,previewUrl:h};if(this.records.set(f,v),this.stateStore)await this.stateStore.put(i,EO,{handle:f,state:{handle:f,sandboxApiUrl:$.sandboxApiUrl,previewUrl:h}});return this.toSandbox(v)}async proxyDaemonRequest(i,u,t){let f=u.startsWith("/")?u:`/${u}`,l=f.startsWith("/_sandbox/")?f.slice(9):f,E=`/_sandbox/${encodeURIComponent(i)}${l}`,c=new Headers(t.headers);for(let F of["host","cookie","connection","keep-alive","transfer-encoding","upgrade","authorization"])c.delete(F);let w={};c.forEach((F,g)=>{w[g]=F});let $;if(t.body!=null)$=await ief(t.body);let v=this.dispatch(this.userSub,{method:t.method,path:E,headers:w,body:$},{signal:t.signal})[Symbol.asyncIterator](),d=pmf(),D=200,_={"content-type":"application/octet-stream"},N=[];try{while(!0){let F=await v.next();if(F.done)break;let g=F.value;if(g.headers){D=g.headers.status,_=g.headers.headers;break}if(g.data!=null){let U=d.push(g.data);if(U.length)N.push(U)}}}catch(F){let g=F instanceof Error?F.message:"dispatch error";return new Response(JSON.stringify({error:g}),{status:502,headers:{"content-type":"application/json"}})}let Z=!1,B=new ReadableStream({async start(F){for(let g of N)F.enqueue(g)},async pull(F){try{while(!0){let g=await v.next();if(Z)return;if(g.done){let T=d.flush();if(T.length)F.enqueue(T);F.close();return}let U=g.value;if(U.data!=null){let T=d.push(U.data);if(T.length){F.enqueue(T);return}}}}catch(g){if(!Z)F.error(g)}},cancel(){Z=!0,v.return?.()}});return new Response(B,{status:D,headers:_})}async alive(i){return this.probeHealth(i)}async probeHealth(i){let u=new AbortController,t=setTimeout(()=>u.abort(),3000);try{return await this.dispatchJson("GET",`/api/sandboxes/${encodeURIComponent(i)}`,void 0,u.signal),!0}catch{return!1}finally{clearTimeout(t)}}async forgetHandle(i){if(this.records.delete(i),this.stateStore)await this.stateStore.deleteByHandle(EO,i).catch(()=>{})}async delete(i){if(this.records.delete(i),this.stateStore)await this.stateStore.deleteByHandle(EO,i).catch(()=>{});try{await this.dispatchJson("DELETE",`/api/sandboxes/${encodeURIComponent(i)}`)}catch(u){if(!(u instanceof Error?u.message:String(u)).includes("404"))throw u}}async getPreviewUrl(i){return(await this.resolveRecord(i))?.previewUrl??null}async localWorkdir(i){return null}async*watchClaimLifecycle(i,u){yield{kind:"ready"}}toSandbox(i){return{handle:i.handle,workdir:i.sandboxApiUrl,previewUrl:i.previewUrl}}async resolveRecord(i){let u=this.records.get(i);if(u)return u;if(!this.stateStore)return null;let f=(await this.stateStore.getByHandle(EO,i))?.state,l=f?.sandboxApiUrl;if(!l)return null;let E={handle:i,sandboxApiUrl:l,previewUrl:f?.previewUrl??l};return this.records.set(i,E),E}async dispatchJson(i,u,t,f){let l={accept:"application/json"};if(t!==void 0)l["content-type"]="application/json";let E=this.dispatch(this.userSub,{method:i,path:u,headers:l,body:t},{signal:f}),c=null,w="";for await(let h of E)if(h.headers)c=h.headers.status;else if(h.data!=null)w+=h.data;let $=Buffer.from(w,"base64").toString("utf8");if(c!=null&&(c<200||c>=300))throw Error(`daemon returned ${c}: ${$}`);return $}}function jY0(i){return new $Ti(i)}function pmf(){let i="";return{push(u){if(u.length===0)return GEu;i+=u;let t=i.length-i.length%4;if(t===0)return GEu;let f=i.slice(0,t);return i=i.slice(t),new Uint8Array(Buffer.from(f,"base64"))},flush(){if(i.length===0)return GEu;let u=i;return i="",new Uint8Array(Buffer.from(u,"base64"))}}}async function ief(i){if(typeof i==="string")return i;if(i instanceof ArrayBuffer)return Buffer.from(i).toString("utf8");if(ArrayBuffer.isView(i))return Buffer.from(i.buffer,i.byteOffset,i.byteLength).toString("utf8");if(i instanceof URLSearchParams)return i.toString();return await new Response(i).text()}var EO="user-desktop",GEu;var XY0=O(()=>{Gvi();uli();GEu=new Uint8Array(0)});var JY0={};yi(JY0,{createDesktopProvider:()=>jY0,DesktopSandboxProvider:()=>$Ti});var KY0=O(()=>{XY0()});var HY0={};yi(HY0,{subscribeLifecycle:()=>kEu,getSandboxProviderByKind:()=>xEu,getOrInitSharedRunner:()=>hef,buildDesktopProvider:()=>hTi,__resetSharedLifecyclesForTesting:()=>Nef});function SY0(i,u){let t=YY0[i];if(t)return Promise.resolve(t);let f=IEu[i];if(f)return f;let l=u().then((E)=>{return YY0[i]=E,E}).finally(()=>{delete IEu[i]});return IEu[i]=l,l}function fef(){let i=process.env.STUDIO_SANDBOX_PREVIEW_URL_PATTERN;return i&&i.trim()!==""?i:void 0}function lef(){let i=process.env.STUDIO_SANDBOX_TEMPLATE_NAME;return i&&i.trim()!==""?i:void 0}function Eef(){let i=process.env.STUDIO_SANDBOX_GO_TEMPLATE_NAME;return i&&i.trim()!==""?i:void 0}function cef(){let i=process.env.STUDIO_ENV;return i&&i.trim()!==""?i:void 0}function wef(){let i=process.env.STUDIO_SANDBOX_SENTINEL_TOKEN;return i&&i.trim()!==""?i:void 0}function $ef(){let i=process.env.STUDIO_SANDBOX_PREVIEW_GATEWAY_NAME?.trim(),u=process.env.STUDIO_SANDBOX_PREVIEW_GATEWAY_NAMESPACE?.trim();if(!i&&!u)return;if(!i||!u)throw Error("STUDIO_SANDBOX_PREVIEW_GATEWAY_NAME and STUDIO_SANDBOX_PREVIEW_GATEWAY_NAMESPACE must both be set, or both unset. Half-configured per-claim HTTPRoute routing would silently fail to attach.");return{name:i,namespace:u}}async function QY0(i,u){let t=new Dn(u),f=fef();switch(i){case"agent-sandbox":{let{AgentSandboxProvider:l}=await Promise.resolve().then(() => (yEu(),kY0)),E=new w2($u().encryptionKey);return new l({stateStore:t,previewUrlPattern:f,sandboxTemplateName:lef(),goSandboxTemplateName:Eef(),envName:cef(),previewGateway:$ef(),sentinelToken:wef(),meter:Pt,mintCloneUrl:async(c,w)=>{if(!c.connectionId)return null;let $=WI0(c.cloneUrl);if(!$)return null;let{cloneUrl:h}=await VN(c.connectionId,$.owner,$.name,u,E,{bufferMs:w?.bufferMs});return h}})}case"user-desktop":throw Error("user-desktop provider cannot be instantiated without a per-run link claim \u2014 call resolveSandboxProvider, which binds the link before constructing the provider.");default:throw Error(`Unknown sandbox provider kind: ${String(i)}`)}}async function hTi(i,u){let{DesktopSandboxProvider:t}=await Promise.resolve().then(() => (KY0(),JY0)),{getProxyDispatch:f}=await Promise.resolve().then(() => (XEu(),jEu)),l=new Dn(i.db);if(!u)throw Error("buildDesktopProvider: userSub must be a non-empty string");let E=f();return new t({userSub:u,dispatch:E,stateStore:l})}function xEu(i,u){return SY0(u,()=>QY0(u,i.db))}async function hef(){let i;try{i=m2()}catch(t){return console.warn("[lifecycle] cannot resolve sandbox runner:",t instanceof Error?t.message:String(t)),null}return await SY0(i,()=>QY0(i,e0().db))}function kEu(i,u,t){let f=cO.get(u);if(f){if(f.terminated){if(f.lastPhase)try{t(f.lastPhase)}catch{}return{unsubscribe:Def}}if(f.listeners.add(t),f.lastPhase)try{t(f.lastPhase)}catch{}return WY0(u,f,t)}let l=new AbortController,E={lastPhase:null,terminated:!1,listeners:new Set([t]),abort:l};return cO.set(u,E),_ef(i,u,E),WY0(u,E,t)}function Def(){}function WY0(i,u,t){return{unsubscribe(){if(cO.get(i)!==u)return;if(u.listeners.delete(t),u.listeners.size===0)cO.delete(i),u.abort.abort()}}}async function _ef(i,u,t){let f=null;try{for await(let l of i.watchClaimLifecycle(u,t.abort.signal)){if(t.abort.signal.aborted)break;t.lastPhase=l;let E=l.kind==="ready"||l.kind==="failed";if(E)t.terminated=!0;let c=Array.from(t.listeners);for(let w of c)try{w(l)}catch{}if(E)break}}catch(l){f=l}finally{if(!t.terminated&&!t.abort.signal.aborted&&t.listeners.size>0){let l={kind:"failed",reason:"unknown",message:f instanceof Error?f.message:"Lifecycle watcher ended unexpectedly"};t.lastPhase=l,t.terminated=!0;for(let E of Array.from(t.listeners))try{E(l)}catch{}}if(cO.get(u)===t)cO.delete(u)}}function Nef(){for(let i of cO.values())i.abort.abort();cO.clear()}var uef,tef,LY0,YY0,IEu,vef,def,cO;var vTi=O(()=>{q5();b6();J1();Zlu();xo();QV();W0();uef=Symbol.for("decocms.sandbox.lifecycle.runners"),tef=Symbol.for("decocms.sandbox.lifecycle.inflight"),LY0=globalThis,YY0=LY0[uef]??={},IEu=LY0[tef]??={};vef=Symbol.for("decocms.sandbox.lifecycle.shared-lifecycles"),def=globalThis,cO=def[vef]??=new Map});async function Lv(i,u){let{userId:t,branch:f,virtualMcpMetadata:l,explicitKind:E}=u;if(E)return{provider:await oo(i,t,E),kind:E};if(i.sandboxPreference==="agent-sandbox")return{provider:await oo(i,t,"agent-sandbox"),kind:"agent-sandbox"};if(i.sandboxPreference==="user-desktop")return{provider:await hTi(i,t),kind:"user-desktop"};if(i.sandboxPreference==="cluster-default"){let v=m2();return{provider:await oo(i,t,v),kind:v}}let[c,...w]=Oef(l,t,f);if(c){let v=w.length===0?c:Zef(c,w);return{provider:await oo(i,t,v),kind:v}}let $=zY0();return{provider:await oo(i,t,$),kind:$}}function Oef(i,u,t){let f=o1(i)[u]?.[t];if(!f)return[];let l=zh(f);return Object.keys(l)}function Zef(i,u){let t=zY0();if(t===i||u.includes(t))return t;return i}function zY0(){return m2()}async function oo(i,u,t){if(t!=="user-desktop")return xEu(i,t);return hTi(i,u)}var jn=O(()=>{Rt();q5();I$();vTi()});var so;var JEu=O(()=>{so={npm:{install:"npm install",run:(i)=>`npm run ${i}`,runtime:"node"},pnpm:{install:"pnpm install",run:(i)=>`pnpm run ${i}`,runtime:"node"},yarn:{install:"yarn install",run:(i)=>`yarn run ${i}`,runtime:"node"},bun:{install:"bun install",run:(i)=>`bun run ${i}`,runtime:"bun"},deno:{install:"deno install",run:(i)=>`deno task ${i}`,runtime:"deno"}}});function dTi(i,u){return u?`thread:${i}/${u}`:`thread:${i}`}function DTi(i){return`sandbox/thread-${i.replace(/^thread:/,"").replace(/\//g,"-")}`}function wO(i){if(!i||!i.startsWith("thread:"))return null;return i.slice(7).split("/")[0]||null}async function f7(i,u,t){let f=wO(u);if(!f)return t;return(await i.storage.threads.get(f).catch(()=>null))?.created_by??t}async function Xn(i,u){if(!u)return null;let t=await i.storage.threads.get(u).catch(()=>null);if(!t)return null;return t.metadata??{}}async function nY0(i,u){let f=(await Xn(i,u))?.headRef;return typeof f==="string"&&f.length>0?f:null}async function RY0(i,u,t){let f=await Xn(i,u);if(!f)return;if(f.headRef===t)return;await i.storage.threads.update(u,{metadata:{...f,headRef:t}}).catch((l)=>console.warn("[thread-repo] setThreadHeadRef failed",l))}async function po(i,u){return(await Xn(i,u))?.githubRepo??null}async function bY0(i,u,t,f,l,E){let c=await Xn(i,u);if(!c)return;let w=Io(o1(c),t,f,l,E);await i.storage.threads.update(u,{metadata:{...c,sandboxMap:w}}).catch(($)=>console.warn("[thread-repo] setThreadSandboxMapEntry failed",$))}async function CY0(i,u){return o1(await Xn(i,u))}async function MY0(i,u,t,f,l){let E=await Xn(i,u);if(!E)return;let c=Olu(o1(E),t,f,l);if(!c)return;await i.storage.threads.update(u,{metadata:{...E,sandboxMap:c}}).catch((w)=>console.warn("[thread-repo] removeThreadSandboxMapEntry failed",w))}var $O=O(()=>{I$()});function _Ti(i){if(!i)return null;let u=i.runtime;if(!u||typeof u!=="object")return null;let t=u.env;if(!Array.isArray(t))return null;let f=[];for(let l of t){if(!l||typeof l!=="object")continue;let E=l;if(typeof E.key!=="string"||!EEi.test(E.key))continue;if(E.kind==="literal"&&typeof E.value==="string"){f.push({key:E.key,kind:"literal",value:E.value});continue}if(E.kind==="secret"&&typeof E.secretId==="string"&&E.secretId.length>0)f.push({key:E.key,kind:"secret",secretId:E.secretId})}return f.length===0?null:f}function qY0(i){if(!i)return null;let u=i.runtime;if(!u||typeof u!=="object")return null;let t=u.submoduleCredentials;if(!Array.isArray(t))return null;let f=[];for(let l of t){if(!l||typeof l!=="object")continue;let E=l;if(typeof E.host==="string"&&E.host.length>0&&typeof E.secretId==="string"&&E.secretId.length>0)f.push({host:E.host,secretId:E.secretId})}return f.length===0?null:f}async function VY0(i,u){gi(u);let t=Bi(u);await u.access.check();let f=Yu(u);if(!f)throw Error("User ID required");let l=await u.storage.virtualMcps.findById(i.virtualMcpId);if(!l||l.organization_id!==t.id)throw Error("Virtual MCP not found");let E=l.metadata??{},c=o1(E),w=await f7(u,i.branch,f),$=MN(c,w,i.branch,i.sandboxProviderKind);return{virtualMcp:l,metadata:E,userId:f,sandboxUserId:w,entry:$,organization:t}}function NTi(i){let u=i.runtime??null,f=u?.selected??null,l=u?.port??null,E=u?.path??null;if(!f||!(f in so))return{packageManager:null,runtime:null,port:l,packageManagerPath:E,runtimeBinPath:null};let c=so[f].runtime;return{packageManager:f,runtime:c,port:l,packageManagerPath:E,runtimeBinPath:c==="deno"?"/opt/deno/bin":c==="bun"?"/opt/bun/bin":null}}var Jn=O(()=>{Rt();JEu();I$();$O()});async function hO(i,u){let t=i.body?.getReader();if(!t)return i.text();let f=new TextDecoder,l="",E=0;for(;;){let{done:c,value:w}=await t.read();if(c)break;if(E+=w.byteLength,E>u)throw await t.cancel().catch(()=>{}),new rY0(`Upstream response exceeded ${u} bytes`);l+=f.decode(w,{stream:!0})}return l+=f.decode(),l}var rY0;var is=O(()=>{rY0=class rY0 extends Error{}});async function OTi({ctx:i,runner:u,handle:t,orgId:f,userId:l,entries:E}){if(!E||E.length===0)return;let c={};for(let $ of E){if($.kind==="literal"){c[$.key]=$.value;continue}try{let{value:h}=await i.storage.secrets.resolveById($.secretId,f,l);c[$.key]=h}catch(h){if(h instanceof G5||h instanceof s9){console.warn(`[SANDBOX_START] skipping env ${$.key}: ${h.message}. Re-link or recreate the secret to restore.`);continue}throw h}}if(Object.keys(c).length===0)return;let w=await u.proxyDaemonRequest(t,"/_sandbox/config",{method:"PUT",headers:new Headers({"content-type":"application/json"}),body:JSON.stringify({env:c})});if(!w.ok){let $=await hO(w,Bef).catch(()=>w.statusText);console.warn(`[SANDBOX_START] daemon rejected env patch (${w.status}): ${$}`)}}var Bef=10485760;var KEu=O(()=>{ie();is()});async function mY0({ctx:i,orgId:u,userId:t,entries:f}){if(!f||f.length===0)return[];let l=[];for(let E of f)try{let{value:c}=await i.storage.secrets.resolveById(E.secretId,u,t);l.push({host:E.host,token:c})}catch(c){if(c instanceof G5||c instanceof s9){console.warn(`[SANDBOX_START] skipping submodule credential for ${E.host}: ${c.message}. Re-link or recreate the secret to restore.`);continue}throw c}return l}var eY0=O(()=>{ie()});async function sY0(i,u,t,f,l){let E=await FN({connectionId:i,tokenStorage:new r1(f,l)});if(!E.accessToken)return null;return iW0(u,t,E.accessToken)}function pY0(i,u){return iW0(i,u,null)}async function iW0(i,u,t){let f=new Map,l=new Set(aY0.map(($)=>$.path));for(let $ of Object.values(oY0))for(let h of $??[])l.add(h);await Promise.all(Array.from(l).map(async($)=>{f.set($,await gef(i,u,$,t))}));let E=aY0.find(({path:$})=>f.get($)!==null);if(!E)return null;let c=oY0[E.pm]??[],w=null;for(let $ of c)if(w=Uef(f.get($)??null),w)break;return{packageManager:E.pm,devPort:w}}async function gef(i,u,t,f){let l=`https://api.github.com/repos/${i}/${u}/contents/${encodeURIComponent(t)}`;try{let E={Accept:"application/vnd.github+json","User-Agent":"studio-runtime-detect"};if(f)E.Authorization=`token ${f}`;let c=await fetch(l,{headers:E,signal:AbortSignal.timeout(5000)});if(!c.ok)return null;let w=await c.json();if(!w.content||w.encoding!=="base64")return null;return Buffer.from(w.content,"base64").toString("utf8")}catch{return null}}function Uef(i){if(!i)return null;try{let u=JSON.parse(i),t=u.tasks??u.scripts??{};return(t.dev??t.start??"").match(Fef)?.[1]??null}catch{return null}}var aY0,oY0,Fef;var uW0=O(()=>{gN();gv();aY0=[{path:"deno.json",pm:"deno"},{path:"deno.jsonc",pm:"deno"},{path:"bun.lock",pm:"bun"},{path:"bunfig.toml",pm:"bun"},{path:"pnpm-lock.yaml",pm:"pnpm"},{path:"yarn.lock",pm:"yarn"},{path:"package-lock.json",pm:"npm"},{path:"package.json",pm:"bun"}],oY0={deno:["deno.json","deno.jsonc"],bun:["package.json"],pnpm:["package.json"],yarn:["package.json"],npm:["package.json"]},Fef=/(?:--port|PORT=|:)(\d{4,5})/});function tW0(i){if(i.explicit)return i.explicit;return i.flags?.sandbox_go_daemon?"go":"ts"}function fW0(i){let{current:u,detached:t,base:f}=i.status??{};if(typeof u!=="string"||u.length===0)return null;if(t===!0)return null;if(u===i.requestedRef)return null;if(Tef.has(u))return null;if(typeof f==="string"&&f.length>0&&u===f)return null;return u}function lW0(i){if(!i.branch.startsWith("thread:"))return i.branch;if(i.sticky&&i.recordedHeadRef)return i.recordedHeadRef;return i.derivedRef}function EW0(){return process.env.SANDBOX_STICKY_HEAD_REF==="true"}var Tef;var YEu=O(()=>{Tef=new Set(["main","master","trunk","develop","HEAD"])});async function ZTi(i,u){if(!i)return{hosts:[],allowSameHostDev:!1};let t;try{t=await i.presignedGetUrl("link-dispatch/_allowlist_probe",60,{requireFetchable:!0})}catch{return{hosts:[],allowSameHostDev:!1}}let f;try{f=new URL(t)}catch{return{hosts:[],allowSameHostDev:!1}}if(f.protocol!=="https:"&&f.protocol!=="http:")return{hosts:[],allowSameHostDev:!1};let l=f.hostname,E=Aef.has(l);return{hosts:[l],allowSameHostDev:E&&!u.isProduction}}var Aef;var WEu=O(()=>{Aef=new Set(["127.0.0.1","localhost","::1","[::1]","0.0.0.0"])});import{z as K8}from"zod";async function BTi(i,u){gi(u);let t=Bi(u),f=Yu(u);if(!f)throw Error("User ID required");let l=await u.storage.virtualMcps.findById(i.virtualMcpId);if(!l||l.organization_id!==t.id)throw Error("Virtual MCP not found");let E=l.metadata??{},c=await f7(u,i.branch,f),w=MN(o1(E),c,i.branch,i.sandboxProviderKind),$=i.sandboxProviderKind,{provider:h}=await Lv(u,{userId:c,branch:i.branch,virtualMcpMetadata:E,explicitKind:$});if(w){if($!=="user-desktop")return w;if(await h.alive(w.sandboxHandle).catch(()=>!1))return w;await qN(u.storage.virtualMcps,i.virtualMcpId,f,c,i.branch,$).catch((N)=>{console.warn("[ensureSandbox] failed to reap stale user-desktop entry",N)})}let d=await po(u,wO(i.branch)??u.metadata?.threadId)??E.githubRepo??null,{entry:D}=await cW0({ctx:u,userId:f,sandboxUserId:c,orgId:t.id,virtualMcpId:i.virtualMcpId,branch:i.branch,metadata:E,githubRepo:d,existing:null,providerKind:$,runner:h});return D}async function cW0(i){let{ctx:u,userId:t,sandboxUserId:f,orgId:l,virtualMcpId:E,branch:c,metadata:w,githubRepo:$,existing:h,runner:v}=i,{runtime:d,packageManager:D,port:_,packageManagerPath:N}=NTi(w),Z;if($){if($.connectionId)await _n({ctx:u,connectionId:$.connectionId,organizationId:l,forceRefresh:!0,onLegacyMintError:(Ii)=>{console.error("[provisionSandbox] repo-scoped legacy token mint failed",{connectionId:$.connectionId,error:Ii.message})}});let{cloneUrl:hi,gitUserName:ci,gitUserEmail:ii}=$.connectionId?await VN($.connectionId,$.owner,$.name,u.db,u.vault):nvi($.owner,$.name);if(!D){let Ii=$.connectionId?await sY0($.connectionId,$.owner,$.name,u.db,u.vault):await pY0($.owner,$.name);if(Ii)D=Ii.packageManager,d=so[Ii.packageManager].runtime,_=Ii.devPort??_,await yef(u,E,t,Ii.packageManager,Ii.devPort)}let m=EW0(),Ni=lW0({branch:c,derivedRef:DTi(c),recordedHeadRef:m?await nY0(u,wO(c)):null,sticky:m}),wi=await mY0({ctx:u,orgId:l,userId:t,entries:qY0(w)});Z={cloneUrl:hi,...$.connectionId?{connectionId:$.connectionId}:{},userName:ci,userEmail:ii,branch:Ni,displayName:`${$.owner}/${$.name}`,...wi.length>0?{submoduleCredentials:wi}:{}}}let B=d&&D?{runtime:d,packageManager:D,..._!==null?{devPort:Number(_)}:{},...N?{packageManagerPath:N}:{}}:void 0,F=Wg({orgId:l,virtualMcpId:E,branch:c}),g=v.kind==="user-desktop"?await ZTi(u.objectStorage,{isProduction:$u().nodeEnv==="production"}):null,U=(v.kind==="user-desktop"||v.kind==="agent-sandbox")&&!$u().orgFsMountsDisabled,T;if(U){let hi=u.organization?.slug??(await u.db.selectFrom("organization").select(["slug"]).where("id","=",l).executeTakeFirst())?.slug;if(hi)T=await e5i(u,{orgSlug:hi,orgId:l,baseUrl:FE()})}let A=v.kind==="agent-sandbox"?tW0({explicit:i.daemonImpl,flags:i.daemonImpl?null:(await u.storage.organizationSettings.get(l))?.flags??null}):void 0,G=await v.ensure({userId:f,projectRef:F},{branch:c,repo:Z,workload:B,tenant:{orgId:l,userId:f,...u.organization?.slug?{orgSlug:u.organization.slug}:{},...u.organization?.name?{orgName:u.organization.name}:{},...u.auth.user?.email?{userEmail:u.auth.user.email}:{},...u.auth.user?.name?{userName:u.auth.user.name}:{}},...g?{offloadAllowedHosts:g.hosts,offloadAllowSameHostDev:g.allowSameHostDev}:{},...T?{orgFsConfigJson:T}:{},...A?{daemonImpl:A}:{}}),k=w.runtime?.env??null;await OTi({ctx:u,runner:v,handle:G.handle,orgId:l,userId:t,entries:k});let j=!!h&&h.sandboxHandle===G.handle&&h?.createdAt?h.createdAt:Date.now(),C=w.runtime?.selected??null,K=w.runtime?.port??null,S=w.runtime?.path??null,r={sandboxHandle:G.handle,previewUrl:G.previewUrl,sandboxApiUrl:G.previewUrl,sandboxProviderKind:v.kind,createdAt:j,startedWith:{packageManager:C,port:K,path:S}};await yI0(u.storage.virtualMcps,E,t,f,c,i.providerKind,r);let Q=wO(c);if(Q)await bY0(u,Q,f,c,i.providerKind,r);let fi=!h||h.sandboxHandle!==G.handle;return{entry:r,isNewVm:fi}}async function yef(i,u,t,f,l){let E=await i.storage.virtualMcps.findById(u);if(!E)return;let c=E.metadata??{};await i.storage.virtualMcps.update(u,t,{metadata:{...c,runtime:{selected:f,port:l}}})}var Pef,LEu;var FTi=O(()=>{q5();fu();Jn();KEu();eY0();I$();xo();uW0();JEu();jn();$O();YEu();WEu();W0();ql();bz();I$();Pef=K8.enum(["agent-sandbox","user-desktop","cluster"]),LEu=p({name:"SANDBOX_START",description:"Start a sandbox with the connected GitHub repo and dev server.",annotations:{title:"Start VM Preview",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!1,openWorldHint:!0},_meta:{ui:{visibility:"app"}},inputSchema:K8.object({virtualMcpId:K8.string().describe("Virtual MCP ID"),branch:K8.string().min(1).optional().describe("Optional git branch to check out. When omitted the handler generates a Bayer-style `<greek-letter>-<constellation>` name (e.g. `alpha-centauri`) and uses it. The resolved branch is returned in the response so callers can persist it."),sandboxProviderKind:Pef.optional().describe("Explicit runtime choice. Hosted provider is `agent-sandbox`; legacy `cluster` input is accepted only for compatibility and normalized to `agent-sandbox`. When omitted, defaults to `user-desktop` if the acting user's link daemon is online, else the env kind."),daemonImpl:s1u.optional().describe("Target this one sandbox at a specific sandbox daemon implementation, overriding the org's `sandbox_go_daemon` flag in either direction. Only honored on `agent-sandbox`, and only when the deployment configures a Go SandboxTemplate; otherwise the sandbox lands on `ts`. Applies to a sandbox being created \u2014 an existing sandbox keeps the binary it booted with.")}),outputSchema:K8.object({previewUrl:K8.string().nullable(),sandboxHandle:K8.string(),branch:K8.string(),isNewVm:K8.boolean(),sandboxProviderKind:K8.enum(["agent-sandbox","user-desktop"])}),handler:async(i,u)=>{gi(u);let t=Bi(u);await u.access.check();let f=i.branch??gvi(u.auth.user?.name??u.auth.user?.email?.split("@")[0]),l=Yu(u);if(!l)throw Error("User ID required");let E=await f7(u,f,l),c=await u.storage.virtualMcps.findById(i.virtualMcpId);if(!c||c.organization_id!==t.id)throw Error("Virtual MCP not found");let w=c.metadata??{},$=i.sandboxProviderKind?r2(i.sandboxProviderKind):void 0,{provider:h,kind:v}=await Lv(u,{userId:E,branch:f,virtualMcpMetadata:w,explicitKind:$}),d=MN(o1(w),E,f,v),_=await po(u,wO(f)??u.metadata?.threadId)??w.githubRepo??null,{entry:N,isNewVm:Z}=await cW0({ctx:u,userId:l,sandboxUserId:E,orgId:t.id,virtualMcpId:i.virtualMcpId,branch:f,metadata:w,githubRepo:_,existing:d,providerKind:v,runner:h,daemonImpl:i.daemonImpl});return{...N,branch:f,isNewVm:Z,sandboxProviderKind:v}}})});async function Gef(i,u,t,f){try{let l=i.organization;if(!l)return;let E=await Hvi(i,f.virtualMcpId,l,"tool-scripting",f.providerKind),c=await u.proxyDaemonRequest(t,"/_sandbox/tools/sync",{method:"POST",headers:new Headers({"content-type":"application/json"}),body:JSON.stringify(E)});if(!c.ok)console.warn("[cluster-sandbox-fs] tools/sync failed",c.status,await c.text().catch(()=>""))}catch(l){console.warn("[cluster-sandbox-fs] tools/sync failed",l)}}async function Kn(i,u){let{provider:t,kind:f}=await Lv(i,{userId:u.userId,branch:u.branch,virtualMcpMetadata:null}),l=null,E=()=>{if(!l){if(l=BTi({virtualMcpId:u.virtualMcpId,branch:u.branch,sandboxProviderKind:f},i).then(($)=>$.sandboxHandle),l.catch(()=>{l=null}),u.syncTools)l.then(($)=>Gef(i,t,$,{virtualMcpId:u.virtualMcpId,providerKind:f})).catch(()=>{})}return l},c=u.branch==="ephemeral"||f==="user-desktop";return tlu(t,{ensureHandle:E,invalidateHandle:async($)=>{let h=l;if(l=null,!c&&!$?.force)return;try{await qN(i.storage.virtualMcps,u.virtualMcpId,u.userId,u.userId,u.branch,f)}catch(v){console.warn("[cluster-sandbox-fs] failed to reap vmMap entry",v)}if(h&&typeof t.forgetHandle==="function")try{let v=await h;await t.forgetHandle(v)}catch(v){console.warn("[cluster-sandbox-fs] forgetHandle failed",v)}},canAutoRestart:c})}async function wW0(i,u){try{let t=await Kn(i,u),{stdout:f}=await t.onBash("test -d .deco && echo __DECO_SITE__");return f.includes("__DECO_SITE__")}catch(t){return console.warn("[cluster-sandbox-fs] .deco probe failed; assuming deco site",t),!0}}var gTi=O(()=>{q5();Nlu();jn();FTi();I$()});function Yn(i){let u=i.toISOString();return`<current-context>
+`))>=0){let $=f.slice(0,w).trim();if(f=f.slice(w+1),!$)continue;yield JSON.parse($)}}let l=f.trim();if(l)yield JSON.parse(l)}finally{u.releaseLock()}}var EY0,cY0,hY0="gateway.networking.k8s.io",vY0="v1",dY0="httproutes",Zmf,ao,_Y0="mesh-sandbox-runner";var cTi=O(()=>{Z4();ro();EY0=class EY0 extends Error{status;body;constructor(i,u,t){super(t);this.status=i;this.body=u;this.name="KubeHttpError"}};cY0=`/apis/${nl.CLAIM_API_GROUP}/${nl.CLAIM_API_VERSION}/namespaces`;Zmf=`/apis/${hY0}/${vY0}/namespaces`;ao={API_GROUP:hY0,API_VERSION:vY0,PLURAL:dY0}});async function*BY0(i){let u=i.now??(()=>Date.now()),t=u(),f=i.schedulingTimeoutMs??gmf,l={pod:{},sandbox:{},events:{hasPulling:!1,hasPulled:!1},startedAt:t},E=[],c=null,w=!1,$=(g)=>{if(w)return;if(c){let U=c;c=null,U(g)}else E.push(g)},h=()=>{if(E.length>0)return Promise.resolve(E.shift());if(w)return Promise.resolve(null);return new Promise((g)=>{c=g})},v=()=>{if(w)return;if(w=!0,c){let g=c;c=null,g(null)}},d=new AbortController,D=()=>{d.abort(),v()};if(i.signal)if(i.signal.aborted)d.abort(),v();else i.signal.addEventListener("abort",D,{once:!0});let _=Math.max(0,f-(u()-t)),N=setTimeout(()=>$("tick"),_+100),Z,B=new Promise((g)=>{Z=g}),F=Promise.allSettled([Umf(i.kc,i.namespace,i.claimName,d.signal,l,$,u,Z),Amf(i.kc,i.namespace,i.claimName,d.signal,l,$),Pmf(i.kc,i.namespace,i.claimName,B,d.signal,l,$,u)]);try{let g=null,U=-1,T=OY0(l,f,u);if(g=BEu(T),!ZEu(T))U=ZY0(T);if(yield T,ZEu(T))return;while(!w){if(await h()===null)break;let G=OY0(l,f,u);if(ZEu(G)){let j=BEu(G);if(j!==g)g=j,yield G;return}let k=ZY0(G);if(k<U)continue;let I=BEu(G);if(I!==g)g=I,U=k,yield G}}finally{if(clearTimeout(N),d.abort(),i.signal)i.signal.removeEventListener("abort",D);v(),await F.catch(()=>{})}}function OY0(i,u,t){let{pod:f,sandbox:l,events:E,startedAt:c}=i;if(l.ready)return{kind:"ready"};let w=f.containerWaitingReason;if(w==="ImagePullBackOff"||w==="ErrImagePull")return{kind:"failed",reason:"image-pull-backoff",message:"Sandbox image failed to download. The cluster may be missing pull credentials or the image tag may not exist."};if(w==="CrashLoopBackOff")return{kind:"failed",reason:"crash-loop-backoff",message:"Sandbox crashed during startup and is now in CrashLoopBackOff. Check pod logs."};if(!f.scheduled&&E.lastFailedSchedulingAt!==void 0&&t()-c>u)return{kind:"failed",reason:"scheduling-timeout",message:E.failedSchedulingMessage??`Pod could not be scheduled within ${Math.round(u/1000)}s.`};if(f.containerRunning&&!f.containerReady)return{kind:"warming-daemon",since:c};if(E.hasPulling&&!E.hasPulled)return{kind:"pulling-image",since:c};if(w==="ContainerCreating"||w==="PodInitializing"||f.scheduled&&!f.containerRunning)return{kind:"starting-container",since:c};if(f.scheduledFalseReason==="Unschedulable"||E.lastFailedSchedulingAt!==void 0&&!f.scheduled)return{kind:"waiting-for-capacity",since:c,message:E.failedSchedulingMessage??f.scheduledFalseMessage,nodeClaim:E.nominatedNodeClaim};return{kind:"claiming",since:c}}function ZEu(i){return i.kind==="ready"||i.kind==="failed"}function ZY0(i){switch(i.kind){case"claiming":return 0;case"waiting-for-capacity":return 1;case"pulling-image":return 2;case"starting-container":return 3;case"warming-daemon":return 4;case"ready":case"failed":return 99}}function BEu(i){switch(i.kind){case"claiming":case"pulling-image":case"starting-container":case"warming-daemon":return i.kind;case"waiting-for-capacity":return`waiting-for-capacity:${i.message??""}:${i.nodeClaim??""}`;case"ready":return"ready";case"failed":return`failed:${i.reason}:${i.message}`}}async function Umf(i,u,t,f,l,E,c,w){let $=`/api/v1/namespaces/${encodeURIComponent(u)}/pods?watch=true&labelSelector=${encodeURIComponent(`${Bmf}=${t}`)}`;return wTi({kc:i,path:$,signal:f,label:`pod/${t}`,onEvent:(h)=>{if(h.type!=="ADDED"&&h.type!=="MODIFIED")return;let v=h.object;if(v.metadata?.name)w(v.metadata.name);Tmf(v,l,c),E("pod")}})}function Tmf(i,u,t){let l=(i.status?.conditions??[]).find((c)=>c.type==="PodScheduled");if(l?.status==="True")u.pod.scheduled=!0,u.pod.scheduledFalseReason=void 0,u.pod.scheduledFalseMessage=void 0;else if(l?.status==="False")u.pod.scheduled=!1,u.pod.scheduledFalseReason=l.reason,u.pod.scheduledFalseMessage=l.message;let E=(i.status?.containerStatuses??[]).find((c)=>c.name===Fmf);if(E)u.pod.containerWaitingReason=E.state?.waiting?.reason,u.pod.containerRunning=!!E.state?.running,u.pod.containerReady=E.ready===!0}async function Amf(i,u,t,f,l,E){let c=`/apis/${nl.CLAIM_API_GROUP}/${nl.CLAIM_API_VERSION}/namespaces/${encodeURIComponent(u)}/${nl.CLAIM_PLURAL}?watch=true&fieldSelector=${encodeURIComponent(`metadata.name=${t}`)}`;return wTi({kc:i,path:c,signal:f,label:`sandboxclaim/${t}`,onEvent:(w)=>{if(w.type!=="ADDED"&&w.type!=="MODIFIED")return;let h=w.object.status?.conditions?.find((v)=>v.type==="Ready");if(!h)return;if(h.status==="True")l.sandbox.ready=!0,l.sandbox.notReadyReason=void 0,l.sandbox.notReadyMessage=void 0;else l.sandbox.ready=!1,l.sandbox.notReadyReason=h.reason,l.sandbox.notReadyMessage=h.message;E("sandbox")}})}async function Pmf(i,u,t,f,l,E,c,w){let $=await Promise.race([f,new Promise((v)=>{if(l.aborted){v(t);return}l.addEventListener("abort",()=>v(t),{once:!0})})]);if(l.aborted)return;let h=`/api/v1/namespaces/${encodeURIComponent(u)}/events?watch=true&fieldSelector=${encodeURIComponent(`involvedObject.name=${$},involvedObject.kind=Pod`)}`;return wTi({kc:i,path:h,signal:l,label:`events/${t}`,onEvent:(v)=>{if(v.type!=="ADDED"&&v.type!=="MODIFIED")return;let d=v.object,D=d.reason;if(!D)return;switch(D){case"Pulling":E.events.hasPulling=!0;break;case"Pulled":E.events.hasPulling=!0,E.events.hasPulled=!0;break;case"FailedScheduling":E.events.lastFailedSchedulingAt=w(),E.events.failedSchedulingMessage=d.message;break;case"Nominated":{let _=d.message?.match(/nodeclaim\/([\w-]+)/);if(_)E.events.nominatedNodeClaim=_[1];break}default:return}c("event")}})}async function FY0(i){let{kc:u,namespace:t,labelSelector:f,signal:l,onDelete:E}=i,c=`/apis/${nl.CLAIM_API_GROUP}/${nl.CLAIM_API_VERSION}/namespaces/${encodeURIComponent(t)}/${nl.CLAIM_PLURAL}?watch=true&labelSelector=${encodeURIComponent(f)}`;return wTi({kc:u,path:c,signal:l,label:"sandboxclaim-reaper",onEvent:(w)=>{if(w.type!=="DELETED")return;let $=w.object.metadata?.name;if($)E($)}})}async function wTi(i){let{kc:u,path:t,signal:f,label:l,onEvent:E}=i,c=0;while(!f.aborted){try{let $=await DY(u,{method:"GET",path:t,signal:f,headers:{accept:"application/json"},stream:!0});if(!$.ok||!$.body){try{await $.body?.cancel()}catch{}if($.status===401||$.status===403){console.warn(`[lifecycle-watcher] ${l} stopped: watch denied (${$.status} ${$.statusText}). `+"The kubeconfig in use cannot watch SandboxClaims \u2014 if you are running locally, "+"this provider should not be active (check STUDIO_SANDBOX_PROVIDER / your sandbox preference).");return}throw Error(`watch handshake failed: ${$.status} ${$.statusText}`)}c=0;for await(let h of OEu($.body)){if(f.aborted)return;try{E(h)}catch(v){console.warn(`[lifecycle-watcher] ${l} onEvent threw: ${v instanceof Error?v.message:String(v)}`)}}}catch($){if(f.aborted)return;let h=$ instanceof Error?$.message:String($);console.warn(`[lifecycle-watcher] ${l} watch ended: ${h}`)}if(f.aborted)return;let w=hE(5000,250,c,2,0);c+=1,await y0(w,{signal:f}).catch(()=>{})}}var Bmf="studio.decocms.com/sandbox-handle",Fmf="sandbox",gmf=300000;var gY0=O(()=>{Z4();ro();cTi()});async function UY0(i,u,t){let f=new Map;for(let l of i){let E=u(l);if(!E)continue;let c=f.get(E);if(c)c.push(l);else f.set(E,[l])}await Promise.allSettled([...f.values()].map(async(l)=>{for(let E of l)await t(E).catch(()=>{})}))}import{createHash as ymf,randomBytes as Gmf,randomUUID as Imf}from"crypto";import*as GY0 from"net";import{PassThrough as xmf}from"stream";function kmf(i){if(i instanceof Error)return i.message;if(i&&typeof i==="object"){let u=i;if(u.error instanceof Error)return u.error.message;if(typeof u.message==="string"&&u.message)return u.message}return String(i)}class PEu{kind=G3;records=new Map;inflight=new Avi;stateStore;previewUrlPattern;kubeConfig;portForward;namespace;sandboxTemplateName;goSandboxTemplateName;envName;tokenGenerator;idleTtlMs;metrics;previewGateway;sentinelToken;mintCloneUrl;closed=!1;claimWatchAbort=new AbortController;constructor(i={}){this.stateStore=i.stateStore??null,this.previewUrlPattern=i.previewUrlPattern??null,this.kubeConfig=i.kubeConfig??nmf(),this.portForward=new r6u(this.kubeConfig),this.namespace=i.namespace??jmf,this.sandboxTemplateName=i.sandboxTemplateName??Xmf;let u=i.goSandboxTemplateName?.trim()??"";this.goSandboxTemplateName=u.length>0?u:null,this.envName=Vmf(i.envName),this.tokenGenerator=i.tokenGenerator??(()=>Gmf(Kmf).toString("hex")),this.idleTtlMs=i.idleTtlMs??Wmf,this.metrics=i.meter?zmf(i.meter):null,this.previewGateway=i.previewGateway&&i.previewUrlPattern?{...i.previewGateway}:null;let t=i.sentinelToken?.trim()??"";this.sentinelToken=t.length>0?t:null,this.mintCloneUrl=i.mintCloneUrl,this.startClaimReaper(),this.startCredentialRefresher()}startClaimReaper(){let i=["app.kubernetes.io/managed-by=studio","app.kubernetes.io/name=studio-sandbox",...this.envName?[`${I3.env}=${this.envName}`]:[]].join(",");FY0({kc:this.kubeConfig,namespace:this.namespace,labelSelector:i,signal:this.claimWatchAbort.signal,onDelete:(u)=>this.invalidateRecord(u)})}async ensure(i,u={}){let t=bN(i,u.branch??u.repo?.branch??null);return this.inflight.run(t,()=>Pvi(this.stateStore,i,G3,(f)=>this.ensureLocked(i,t,u,f)))}async delete(i){let u=await this.getRecord(i);if(this.records.delete(i),u)this.closeForwarder(u.daemonForward),this.metrics?.active.add(-1,TEu(u.tenant));if(await this.deleteHttpRouteIfManaged(i).catch((t)=>{console.warn(`[${Rl}] HTTPRoute delete failed for ${i}: ${t instanceof Error?t.message:String(t)}`)}),await fO(this.kubeConfig,this.namespace,i),this.stateStore)if(u)await this.stateStore.delete(u.id,G3);else await this.stateStore.deleteByHandle(G3,i)}async alive(i){return await t7(this.kubeConfig,this.namespace,i)!==void 0}watchClaimLifecycle(i,u){return BY0({kc:this.kubeConfig,namespace:this.namespace,claimName:i,signal:u})}async getPreviewUrl(i){let u=await this.getRecord(i);if(!u)return null;return this.composePreviewUrl(u)}async proxyDaemonRequest(i,u,t){let f=await this.getRecord(i);if(!f&&this.previewUrlPattern&&this.stateStore){let $=await this.stateStore.getByHandle(G3,i),h=$?.state,v=h?.token;if($&&v){let D=`http://${h?.adoptedSandboxName??i}.${this.namespace}.svc.cluster.local:${lO}`;try{let _=await mM(D,v,u,t);if(_.status!==404)return _;try{await _.body?.cancel()}catch{}}catch{}}}if(!f)f=await this.resurrectByHandle(i);if(!f)return new Response(JSON.stringify({error:"sandbox not found"}),{status:404,headers:{"content-type":"application/json"}});let l=f,E=performance.now(),c=0,w=!(t.body instanceof ReadableStream);try{let $=await mM(f.daemonUrl,f.token,u,t);if($.status===401&&w){this.invalidateRecord(i);let h=await this.getRecord(i).catch(()=>null)??await this.resurrectByHandle(i).catch(()=>null);if(h)l=h,$=await mM(h.daemonUrl,h.token,u,t)}return c=$.status,$}catch($){if(!w)throw $;this.invalidateRecord(i);let h=await this.resurrectByHandle(i)??await this.getRecord(i).catch(()=>null);if(!h)throw $;l=h;let v=await mM(h.daemonUrl,h.token,u,t);return c=v.status,v}finally{this.recordProxyDuration("daemon",c,l,performance.now()-E)}}async adoptLiveClaim(i,u){if(this.records.has(u))return!0;let t=await t7(this.kubeConfig,this.namespace,u).catch(()=>{return});if(!t||t.metadata?.deletionTimestamp)return!1;return await this.inflight.run(u,async()=>{let l=this.records.get(u);if(l)return this.toSandbox(l);let E=await this.adopt(i,u,t);if(!E)throw Error(`cannot adopt live claim ${u}`);return Pvi(this.stateStore,i,G3,(c)=>this.finish(E,c,!0,!0,"adopt"))}).catch(()=>null)!=null}async resolvePreviewUpstreamUrl(i){if(this.previewUrlPattern)return`http://${await this.resolveServiceNameForHandle(i)}.${this.namespace}.svc.cluster.local:${lO}`;let u=await this.getRecord(i);if(u)return u.daemonUrl;let t=await this.resurrectByHandle(i);return t?t.daemonUrl:null}async resolveServiceNameForHandle(i){let u=this.records.get(i);if(u)return u.adoptedSandboxName;if(this.stateStore){let f=(await this.stateStore.getByHandle(G3,i).catch(()=>null))?.state?.adoptedSandboxName;if(f)return f}return i}async proxyPreviewRequest(i,u){let t=performance.now(),f=this.records.get(i)??null,l=0;try{let E=await this.resolvePreviewUpstreamUrl(i);if(!E){l=404;let N=gEu(404,{error:"sandbox not found"});return N.headers.set(NY,"1"),N}let c=new URL(u.url);if((c.pathname==="/_sandbox"||c.pathname.startsWith("/_sandbox/")||c.pathname==="/_decopilot_vm"||c.pathname.startsWith("/_decopilot_vm/"))&&u.method!=="GET")return l=404,gEu(404,{error:"not found"});let $=(N)=>`${N}${c.pathname}${c.search}`,h=new Headers(u.headers);for(let N of Qmf)h.delete(N);let v=u.method!=="GET"&&u.method!=="HEAD",d={method:u.method,headers:h,body:v?u.body:void 0,redirect:"manual",signal:u.signal,duplex:v?"half":void 0},D;try{D=await fetch($(E),d)}catch(N){let Z=`${E}${c.pathname}`;if(console.warn(`[${Rl}] preview fetch to ${Z} failed: ${N instanceof Error?N.message:String(N)}`),u.method==="GET"||u.method==="HEAD"){if(this.invalidateRecord(i),await this.resurrectByHandle(i).catch(()=>null)){let g=await this.resolvePreviewUpstreamUrl(i);if(g)try{D=await fetch($(g),d);let U=new Headers;for(let[T,A]of D.headers.entries())if(!TY0.includes(T.toLowerCase()))U.set(T,A);return l=D.status,new Response(D.body,{status:D.status,statusText:D.statusText,headers:U})}catch(U){console.warn(`[${Rl}] preview fetch retry to ${Z} failed: ${U instanceof Error?U.message:String(U)}`)}}}else this.invalidateRecord(i);l=502;let B=gEu(502,{error:"sandbox daemon unreachable"});return B.headers.set(NY,"1"),B}let _=new Headers;for(let[N,Z]of D.headers.entries())if(!TY0.includes(N.toLowerCase()))_.set(N,Z);return l=D.status,new Response(D.body,{status:D.status,statusText:D.statusText,headers:_})}finally{this.recordProxyDuration("preview",l,f,performance.now()-t,i)}}async ensureLocked(i,u,t,f){if(t.image)console.warn(`[${Rl}] opts.image ignored (template ${this.sandboxTemplateName} pins image): got ${t.image}`);if(f){let c=await f.get(i,G3);if(c){let w=await this.rehydrate(i,u,c);if(w)return await this.refreshDaemonGitCredential(w,t),this.finish(w,f,!1,!0,"resume");await f.delete(i,G3)}}let l=await t7(this.kubeConfig,this.namespace,u).catch(()=>{return});if(l)if(l.metadata?.deletionTimestamp)await tTi(this.kubeConfig,this.namespace,u).catch((c)=>{console.warn(`[${Rl}] wait for terminating claim ${u} failed: ${c instanceof Error?c.message:String(c)}`)});else{let c=await this.adopt(i,u,l).catch((w)=>{return console.warn(`[${Rl}] adopt ${u} failed, recreating: ${w instanceof Error?w.message:String(w)}`),null});if(c)return await this.refreshDaemonGitCredential(c,t),this.finish(c,f,!0,!0,"adopt");await fO(this.kubeConfig,this.namespace,u).catch(()=>{}),await tTi(this.kubeConfig,this.namespace,u).catch((w)=>{console.warn(`[${Rl}] wait for deleted claim ${u} failed: ${w instanceof Error?w.message:String(w)}`)})}let E=await this.provision(i,u,t);return this.finish(E,f,!0,!1,"fresh")}async finish(i,u,t,f,l){let E=this.records.get(i.handle),c=E!==void 0;if(E&&E.daemonForward!==i.daemonForward)this.closeForwarder(E.daemonForward);if(this.records.set(i.handle,i),t)await this.persist(u,i);if(f)await wY0(this.kubeConfig,this.namespace,i.handle,this.computeShutdownTime()).catch((w)=>console.warn(`[${Rl}] TTL refresh failed for ${i.handle}: ${w instanceof Error?w.message:String(w)}`));if(this.metrics){let w=TEu(i.tenant);if(this.metrics.ensureOutcome.add(1,{...w,outcome:l}),!c)this.metrics.active.add(1,w)}return this.toSandbox(i)}buildEnvMap(i,u){let t={},f=[];for(let[l,E]of Object.entries(i.env??{}))if(Ymf.has(l))f.push(l);else t[l]=E;if(f.length>0)console.warn(`[${Rl}] opts.env keys overlap reserved bootstrap names and were dropped: ${f.join(",")}`);return{...t,DAEMON_TOKEN:u.token,DAEMON_BOOT_ID:u.daemonBootId,APP_ROOT:u.workdir,PROXY_PORT:String(lO)}}buildClaim(i,u,t){let f=this.sentinelToken!==null,l=f?[]:Object.entries(this.buildEnvMap(u,t)).sort(([h],[v])=>h<v?-1:h>v?1:0).map(([h,v])=>({name:h,value:v})),E=emf(u),c=Object.keys(E).length>0,{impl:w,templateName:$}=PY0(u.daemonImpl,this.sandboxTemplateName,this.goSandboxTemplateName);if(u.daemonImpl==="go"&&w!=="go")console.warn(`[${Rl}] daemonImpl=go requested for ${i} but no Go SandboxTemplate is configured (STUDIO_SANDBOX_GO_TEMPLATE_NAME); landing on ts`);return{apiVersion:`${nl.CLAIM_API_GROUP}/${nl.CLAIM_API_VERSION}`,kind:"SandboxClaim",metadata:{name:i,namespace:this.namespace,labels:{"app.kubernetes.io/name":"studio-sandbox","app.kubernetes.io/managed-by":"studio",[I3.daemonImpl]:w,...this.envName?{[I3.env]:this.envName}:{},...UEu(u.tenant)},...c?{annotations:E}:{}},spec:{sandboxTemplateRef:{name:$},additionalPodMetadata:{labels:UEu(u.tenant,{[I3.role]:"claimed",[I3.sandboxHandle]:i,[I3.daemonImpl]:w,...this.envName?{[I3.env]:this.envName}:{}}),...c?{annotations:E}:{}},env:l,warmpool:f?"default":"none",lifecycle:{shutdownPolicy:"Delete",shutdownTime:this.computeShutdownTime()}}}}async provision(i,u,t){let f=this.tokenGenerator(),l=Imf(),E=FEu,c=this.buildClaim(u,t,{token:f,daemonBootId:l,workdir:E});try{await eo(this.kubeConfig,this.namespace,c)}catch(D){if(D instanceof Vo)await tTi(this.kubeConfig,this.namespace,u),await eo(this.kubeConfig,this.namespace,c);else throw D}let w;try{w=await $Y0(this.kubeConfig,this.namespace,u),await ETi(this.kubeConfig,this.namespace,w)}catch(D){throw await fO(this.kubeConfig,this.namespace,u).catch(()=>{}),D}try{await this.ensureServicePortForAdoptedSandbox(w),await this.ensureHttpRouteForHandle(u,w,t.tenant??null)}catch(D){throw await fO(this.kubeConfig,this.namespace,u).catch(()=>{}),D}let $=await this.openForwarder(w,lO,u),h=`http://127.0.0.1:${$.localPort}`,v=this.workloadConfigPayload(t),d=l;try{if(await lli(h),this.sentinelToken!==null){let D=await fli(h);if(D)d=D.bootId;await P_(h,this.sentinelToken,v??{},{rotateToken:f})}else if(v)await P_(h,f,v);if(t.orgFsConfigJson)await JMu(h,f,t.orgFsConfigJson).catch((D)=>console.warn("[org-fs] sidecar config relay failed",D))}catch(D){throw this.closeForwarder($),await this.deleteHttpRouteIfManaged(u).catch(()=>{}),await fO(this.kubeConfig,this.namespace,u).catch(()=>{}),D}return{id:i,handle:u,adoptedSandboxName:w,token:f,workdir:E,daemonUrl:h,daemonForward:$,workload:t.workload??null,daemonBootId:d,tenant:t.tenant??null,ensureOpts:omf({...t,daemonImpl:PY0(t.daemonImpl,this.sandboxTemplateName,this.goSandboxTemplateName).impl})}}workloadConfigPayload(i){return ilu({runtime:i?.workload?.runtime??"node",packageManager:i?.workload?.packageManager?{name:i.workload.packageManager,...i.workload.packageManagerPath?{path:i.workload.packageManagerPath}:{}}:null,repo:i?.repo??null,port:i?.workload?.devPort??Jmf,tenant:i?.tenant??void 0})}async refreshDaemonGitCredential(i,u){let t=ulu(u);if(!t)return;try{await P_(i.daemonUrl,i.token,t)}catch(f){console.warn(`[${Rl}] git credential refresh failed for ${i.handle}: ${f instanceof Error?f.message:String(f)}`)}}async withFreshCloneUrl(i,u){if(!this.mintCloneUrl)return i;try{let t=await this.mintCloneUrl(i,u!==void 0?{bufferMs:u}:void 0);return t?{...i,cloneUrl:t}:i}catch(t){return console.warn(`[${Rl}] clone credential re-mint failed: ${t instanceof Error?t.message:String(t)}`),i}}startCredentialRefresher(){if(!this.mintCloneUrl)return;let{signal:i}=this.claimWatchAbort;(async()=>{while(!i.aborted){if(await y0(Lmf,{signal:i}).catch(()=>{}),i.aborted)break;try{await this.refreshAllGitCredentials()}catch(u){console.warn(`[${Rl}] periodic credential refresh failed: ${u instanceof Error?u.message:String(u)}`)}}})()}async refreshAllGitCredentials(){await UY0(this.records.values(),(i)=>i.ensureOpts?.repo?.connectionId,async(i)=>{if(this.claimWatchAbort.signal.aborted)return;let u=i.ensureOpts?.repo;if(!u)return;let t=await this.withFreshCloneUrl(u,Smf);await this.refreshDaemonGitCredential(i,{...i.ensureOpts,repo:t}),i.ensureOpts={...i.ensureOpts,repo:t}})}async rebootstrapDaemon(i,u,t){if(this.sentinelToken===null)return!1;let f=this.workloadConfigPayload(t)??{};try{return await P_(i,this.sentinelToken,f,{rotateToken:u}),!0}catch(l){if(l instanceof tli&&l.status===401)try{return await P_(i,u,f,{rotateToken:u}),!0}catch(E){return console.warn(`[${Rl}] re-bootstrap retry with claim token failed: ${E instanceof Error?E.message:String(E)}`),!1}return console.warn(`[${Rl}] re-bootstrap failed: ${l instanceof Error?l.message:String(l)}`),!1}}async ensureServicePortForAdoptedSandbox(i){if(!this.previewGateway||!this.previewUrlPattern)return;await NY0(this.kubeConfig,this.namespace,i,{name:"daemon",port:lO,targetPort:lO})}async ensureHttpRouteForHandle(i,u,t){if(!this.previewGateway||!this.previewUrlPattern)return;let f=smf(this.previewUrlPattern,i);if(!f)throw new u6(`Unable to derive preview hostname for ${i} from pattern: ${this.previewUrlPattern}`);let l={apiVersion:`${ao.API_GROUP}/${ao.API_VERSION}`,kind:"HTTPRoute",metadata:{name:i,namespace:this.namespace,labels:UEu(t??void 0,{[I3.role]:"claimed",[I3.sandboxHandle]:i,"app.kubernetes.io/name":"studio-sandbox","app.kubernetes.io/managed-by":"studio",...this.envName?{[I3.env]:this.envName}:{}})},spec:{parentRefs:[{kind:"Gateway",group:"gateway.networking.k8s.io",name:this.previewGateway.name,namespace:this.previewGateway.namespace}],hostnames:[f],rules:[{backendRefs:[{group:"",kind:"Service",name:u,port:lO}]}]}};await fTi(this.kubeConfig,this.namespace,l)}async deleteHttpRouteIfManaged(i){if(!this.previewGateway)return;await lTi(this.kubeConfig,this.namespace,i)}async rehydrate(i,u,t){let f=t.state;if(!f.adoptedSandboxName&&!f.podName||!f.token)return null;let l=await t7(this.kubeConfig,this.namespace,u).catch(()=>{return});if(!l||!AY0(l))return null;let E=l.status?.sandbox?.name??f.adoptedSandboxName??f.podName??u,c=await this.openAndProbeDaemon(E,u);if(!c)return null;if(f.daemonBootId&&f.daemonBootId!==c.bootId){if(this.sentinelToken!==null){let w=f.ensureOpts?.repo?{...f.ensureOpts,repo:await this.withFreshCloneUrl(f.ensureOpts.repo)}:f.ensureOpts??null;if(!await this.rebootstrapDaemon(c.daemonUrl,f.token,w))return this.closeForwarder(c.daemonForward),null}else console.warn(`[${Rl}] daemon restart detected (handle=${u}): stored bootId=${f.daemonBootId} live bootId=${c.bootId}`);await this.stateStore?.put(i,G3,{handle:u,state:{...f,daemonBootId:c.bootId}}).catch((w)=>console.warn(`[${Rl}] bootId persist failed for ${u}: ${w instanceof Error?w.message:String(w)}`))}return{id:i,handle:u,adoptedSandboxName:E,token:f.token,workdir:f.workdir??FEu,daemonUrl:c.daemonUrl,daemonForward:c.daemonForward,workload:f.workload??null,daemonBootId:c.bootId,tenant:f.tenant??null,ensureOpts:f.ensureOpts??null}}async adopt(i,u,t){if(!AY0(t))return null;let f=t.status?.sandbox?.name??u;if(this.sentinelToken!==null)return null;let l=Rmf(t);if(!l)return null;let E=await this.openAndProbeDaemon(f,u);if(!E)return null;let c=amf(t);if(this.previewGateway)await this.ensureServicePortForAdoptedSandbox(f).catch((w)=>{console.warn(`[${Rl}] Service port backfill failed for ${u}: ${w instanceof Error?w.message:String(w)}`)}),await this.ensureHttpRouteForHandle(u,f,c).catch((w)=>{console.warn(`[${Rl}] HTTPRoute backfill failed for ${u}: ${w instanceof Error?w.message:String(w)}`)});return{id:i,handle:u,adoptedSandboxName:f,token:l,workdir:FEu,daemonUrl:E.daemonUrl,daemonForward:E.daemonForward,workload:null,daemonBootId:E.bootId,tenant:c,ensureOpts:null}}async openAndProbeDaemon(i,u){let t=await this.openForwarder(i,lO,u).catch(()=>null);if(!t)return null;let f=`http://127.0.0.1:${t.localPort}`,l=await fli(f);if(!l)return this.closeForwarder(t),null;return{daemonForward:t,daemonUrl:f,bootId:l.bootId}}async getRecord(i){let u=this.records.get(i);if(u)return u;if(!this.stateStore)return null;let t=await this.stateStore.getByHandle(G3,i);if(!t)return null;let f=await this.rehydrate(t.id,i,t);if(f)this.records.set(i,f);return f}async resurrectByHandle(i){if(!this.stateStore)return null;let u=await this.stateStore.getByHandle(G3,i);if(!u)return null;let t=u.state.ensureOpts;if(!t)return null;let f=t.repo?{...t,repo:await this.withFreshCloneUrl(t.repo)}:t;return await this.ensure(u.id,f),this.records.get(i)??null}invalidateRecord(i){let u=this.records.get(i);if(!u)return;this.records.delete(i),this.closeForwarder(u.daemonForward)}recordProxyDuration(i,u,t,f,l){if(!this.metrics)return;this.metrics.proxyDurationMs.record(f,{...TEu(t?.tenant??null),source:i,sandbox_handle:t?.handle??l??"",status_code:u||0})}composePreviewUrl(i){if(this.previewUrlPattern)return yvi(this.previewUrlPattern,i.handle);return`http://127.0.0.1:${i.daemonForward.localPort}/`}toSandbox(i){return{handle:i.handle,workdir:i.workdir,previewUrl:this.composePreviewUrl(i)}}async persist(i,u){if(!i)return;let t={adoptedSandboxName:u.adoptedSandboxName,token:u.token,workdir:u.workdir,workload:u.workload,daemonBootId:u.daemonBootId,tenant:u.tenant,...u.ensureOpts?{ensureOpts:u.ensureOpts}:{}};await i.put(u.id,G3,{handle:u.handle,state:t})}computeShutdownTime(){return new Date(Date.now()+this.idleTtlMs).toISOString()}openForwarder(i,u,t=i){let f=bmf(t,u);return new Promise((l,E)=>{let c=(w,$)=>{let h=GY0.createServer((v)=>this.handleForwardedConnection(v,i,u,t));h.once("error",(v)=>{if(v.code==="EADDRINUSE"&&$<Hmf){try{h.close()}catch{}let d=AEu+(w-AEu+1)%IY0;c(d,$+1);return}E(v)}),h.listen(w,"127.0.0.1",()=>{let v=h.address();if(!v||typeof v==="string"){h.close(),E(Error("port-forward listener failed to bind"));return}l({server:h,localPort:v.port})})};c(f,0)})}handleForwardedConnection(i,u,t,f){let l=new xmf,E=null,c=!1,w=()=>{if(c)return;if(c=!0,l.destroy(),E)try{E.close()}catch{}if(!i.destroyed)i.destroy()};i.pipe(l),i.on("error",w),i.on("close",w),this.portForward.portForward(this.namespace,u,[t],i,null,l).then(($)=>{let h=typeof $==="function"?$():$;if(!h){w();return}if(E=h,E.on("close",w),E.on("error",()=>{this.invalidateRecord(f),w()}),c)try{E.close()}catch{}}).catch(($)=>{console.warn(`[${Rl}] port-forward to ${u}:${t} failed: ${kmf($)}`),this.invalidateRecord(f),w()})}closeForwarder(i){i.server.close((u)=>{if(u)console.warn(`[${Rl}] port-forward close on :${i.localPort} errored: ${u instanceof Error?u.message:String(u)}`)})}close(){if(this.closed)return;this.closed=!0,this.claimWatchAbort.abort();for(let i of this.records.values())this.closeForwarder(i.daemonForward);this.records.clear()}}function zmf(i){return{active:i.createUpDownCounter("studio.sandbox.active",{description:"Active sandbox count, by runner kind and owning org. Cross-checks the cAdvisor-derived count from the cluster \u2014 divergence between the two indicates orphaned claims (studio deleted but K8s didn't reap) or unattributed pods.",unit:"{sandbox}"}),ensureOutcome:i.createCounter("studio.sandbox.ensure.outcome",{description:"Outcome of each ensure() call: fresh provision, resume from state-store after restart, or adopt of a cluster-side claim studio didn't know about. Cold-start ratio is the primary input for warm-pool sizing.",unit:"{call}"}),proxyDurationMs:i.createHistogram("studio.sandbox.proxy.duration_ms",{description:"Wall-clock latency of studio-mediated requests to the sandbox daemon: tool exec proxies (source=daemon) and preview iframe traffic (source=preview).",unit:"ms"})}}function nmf(){let i=new yn;return i.loadFromDefault(),i}function AY0(i){return Boolean(i.status?.conditions?.some((u)=>u.type==="Ready"&&u.status==="True"))}function Rmf(i){let u=i.spec?.env;if(!u)return null;for(let t of u)if(t.name==="DAEMON_TOKEN"&&t.value)return t.value;return null}function bmf(i,u){let t=ymf("sha256").update(`${i}:${u}`).digest();return AEu+t.readUInt32BE(0)%IY0}function gEu(i,u){return new Response(JSON.stringify(u),{status:i,headers:{"content-type":"application/json","access-control-allow-origin":"*"}})}function PY0(i,u,t){if(i==="go"&&t)return{impl:"go",templateName:t};return{impl:"ts",templateName:u}}function yY0(i){let u=i.slice(0,Mmf);return Cmf.test(u)?u:""}function Vmf(i){if(i===void 0)return null;let u=i.trim();if(u==="")return null;if(!qmf.test(u))throw Error(`AgentSandboxProvider: envName=${JSON.stringify(u)} is not a valid DNS-label-safe environment name (lowercase alphanumeric or '-', starts with a letter, ends alphanumeric, \u226432 chars). Studio sets this from STUDIO_ENV; check the studio chart's configMap.`);return u}function UEu(i,u={}){let t={...u};if(i){let f=yY0(i.orgId),l=yY0(i.userId);if(f)t[I3.orgId]=f;if(l)t[I3.userId]=l}return t}function _Y(i){let u="";for(let t of i){let f=t.codePointAt(0)??0;u+=f<32||f===127?" ":t}return u.slice(0,rmf)}function mmf(i){try{let u=new URL(i);return u.username="",u.password="",u.toString()}catch{return""}}function emf(i){let u={},t=i.tenant;if(t?.orgSlug)u[Wv.orgSlug]=_Y(t.orgSlug);if(t?.orgName)u[Wv.orgName]=_Y(t.orgName);if(t?.userEmail)u[Wv.userEmail]=_Y(t.userEmail);if(t?.userName)u[Wv.userName]=_Y(t.userName);let f=i.repo;if(f){if(f.displayName)u[Wv.gitRepo]=_Y(f.displayName);let l=mmf(f.cloneUrl);if(l)u[Wv.gitRepoUrl]=_Y(l);let E=i.branch??f.branch;if(E)u[Wv.gitBranch]=_Y(E)}return u}function amf(i){let u=i.metadata?.labels;if(!u)return null;let t=u[I3.orgId],f=u[I3.userId];if(!t||!f)return null;let l=i.metadata?.annotations??{};return{orgId:t,userId:f,orgSlug:l[Wv.orgSlug],orgName:l[Wv.orgName],userEmail:l[Wv.userEmail],userName:l[Wv.userName]}}function TEu(i){return{org_id:i?.orgId??"",user_id:i?.userId??"",runner_kind:G3}}function omf(i){let u={};if(i.repo)u.repo=i.repo;if(i.workload)u.workload=i.workload;if(i.env&&Object.keys(i.env).length>0)u.env=i.env;if(i.tenant)u.tenant=i.tenant;if(i.daemonImpl)u.daemonImpl=i.daemonImpl;return Object.keys(u).length>0?u:null}function smf(i,u){try{return new URL(yvi(i,u)).hostname||null}catch{return null}}var G3="agent-sandbox",Rl="AgentSandboxProvider",NY="x-sandbox-preview-not-ready",jmf="agent-sandbox-system",Xmf="studio-sandbox",lO=9000,Jmf=3000,FEu="/app",Kmf=32,Ymf,Wmf=900000,Lmf=900000,Smf=1800000,Qmf,TY0,AEu=40000,IY0=1e4,Hmf=256,I3,Wv,Cmf,Mmf=63,qmf,rmf=253;var xY0=O(()=>{Z4();hEu();Nni();Gvi();cTi();ro();gY0();Ymf=new Set(["DAEMON_TOKEN","DAEMON_BOOT_ID","APP_ROOT","PROXY_PORT"]),Qmf=["cookie","host","connection","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","accept-encoding","content-length","upgrade"],TY0=["connection","keep-alive","transfer-encoding","content-encoding","content-length"];I3={role:"studio.decocms.com/role",sandboxHandle:"studio.decocms.com/sandbox-handle",orgId:"studio.decocms.com/org-id",userId:"studio.decocms.com/user-id",env:"studio.decocms.com/env",daemonImpl:"studio.decocms.com/daemon-impl"};Wv={orgSlug:"studio.decocms.com/org-slug",orgName:"studio.decocms.com/org-name",userEmail:"studio.decocms.com/user-email",userName:"studio.decocms.com/user-name",gitRepo:"studio.decocms.com/git-repo",gitRepoUrl:"studio.decocms.com/git-repo-url",gitBranch:"studio.decocms.com/git-branch"},Cmf=/^([A-Za-z0-9]([-A-Za-z0-9_.]*[A-Za-z0-9])?)?$/;qmf=/^[a-z]([a-z0-9-]{0,30}[a-z0-9])?$/});var kY0={};yi(kY0,{waitForSandboxReady:()=>ETi,getSandboxClaim:()=>t7,getHttpRoute:()=>DY0,deleteSandboxClaim:()=>fO,deleteHttpRoute:()=>lTi,createSandboxClaim:()=>eo,applyHttpRoute:()=>fTi,SandboxTimeoutError:()=>dY,SandboxError:()=>u6,PREVIEW_NOT_READY_HEADER:()=>NY,KubeConfig:()=>yn,K8S_CONSTANTS:()=>nl,HTTPROUTE_CONSTANTS:()=>ao,AgentSandboxProvider:()=>PEu});var yEu=O(()=>{hEu();ro();cTi();xY0()});class $Ti{kind=EO;userSub;dispatch;stateStore;records=new Map;constructor(i){if(!i.userSub)throw Error("DesktopSandboxProvider requires userSub");if(!i.dispatch)throw Error("DesktopSandboxProvider requires dispatch");this.userSub=i.userSub,this.dispatch=i.dispatch,this.stateStore=i.stateStore??null}async ensure(i,u={}){let t=u.branch??u.repo?.branch,f=bN(i,t),l=this.records.get(f);if(l){if(await this.probeHealth(f))return this.toSandbox(l);if(this.records.delete(f),this.stateStore)await this.stateStore.deleteByHandle(EO,f).catch(()=>{})}else if(this.stateStore){let D=(await this.stateStore.getByHandle(EO,f))?.state,_=D?.sandboxApiUrl;if(_){if(await this.probeHealth(f)){let N={handle:f,sandboxApiUrl:_,previewUrl:D?.previewUrl??_};return this.records.set(f,N),this.toSandbox(N)}await this.stateStore.deleteByHandle(EO,f).catch(()=>{})}}let E=gh({userName:u.tenant?.userName,userEmail:u.tenant?.userEmail}),c=JSON.stringify({handle:f,repo:u.repo,branch:t,...u.workload?{workload:u.workload}:{},...E?{operator:E}:{},...u.offloadAllowedHosts?{offloadAllowedHosts:u.offloadAllowedHosts}:{},...u.offloadAllowSameHostDev!==void 0?{offloadAllowSameHostDev:u.offloadAllowSameHostDev}:{},...u.orgFsConfigJson?{orgFsConfigJson:u.orgFsConfigJson}:{}}),w=await this.dispatchJson("POST","/api/sandboxes",c),$=JSON.parse(w);if(typeof $.sandboxApiUrl!=="string")throw Error("desktop ensure: daemon did not return a sandboxApiUrl string");let h=typeof $.previewUrl==="string"?$.previewUrl:$.sandboxApiUrl,v={handle:f,sandboxApiUrl:$.sandboxApiUrl,previewUrl:h};if(this.records.set(f,v),this.stateStore)await this.stateStore.put(i,EO,{handle:f,state:{handle:f,sandboxApiUrl:$.sandboxApiUrl,previewUrl:h}});return this.toSandbox(v)}async proxyDaemonRequest(i,u,t){let f=u.startsWith("/")?u:`/${u}`,l=f.startsWith("/_sandbox/")?f.slice(9):f,E=`/_sandbox/${encodeURIComponent(i)}${l}`,c=new Headers(t.headers);for(let F of["host","cookie","connection","keep-alive","transfer-encoding","upgrade","authorization"])c.delete(F);let w={};c.forEach((F,g)=>{w[g]=F});let $;if(t.body!=null)$=await ief(t.body);let v=this.dispatch(this.userSub,{method:t.method,path:E,headers:w,body:$},{signal:t.signal})[Symbol.asyncIterator](),d=pmf(),D=200,_={"content-type":"application/octet-stream"},N=[];try{while(!0){let F=await v.next();if(F.done)break;let g=F.value;if(g.headers){D=g.headers.status,_=g.headers.headers;break}if(g.data!=null){let U=d.push(g.data);if(U.length)N.push(U)}}}catch(F){let g=F instanceof Error?F.message:"dispatch error";return new Response(JSON.stringify({error:g}),{status:502,headers:{"content-type":"application/json"}})}let Z=!1,B=new ReadableStream({async start(F){for(let g of N)F.enqueue(g)},async pull(F){try{while(!0){let g=await v.next();if(Z)return;if(g.done){let T=d.flush();if(T.length)F.enqueue(T);F.close();return}let U=g.value;if(U.data!=null){let T=d.push(U.data);if(T.length){F.enqueue(T);return}}}}catch(g){if(!Z)F.error(g)}},cancel(){Z=!0,v.return?.()}});return new Response(B,{status:D,headers:_})}async alive(i){return this.probeHealth(i)}async probeHealth(i){let u=new AbortController,t=setTimeout(()=>u.abort(),3000);try{return await this.dispatchJson("GET",`/api/sandboxes/${encodeURIComponent(i)}`,void 0,u.signal),!0}catch{return!1}finally{clearTimeout(t)}}async forgetHandle(i){if(this.records.delete(i),this.stateStore)await this.stateStore.deleteByHandle(EO,i).catch(()=>{})}async delete(i){if(this.records.delete(i),this.stateStore)await this.stateStore.deleteByHandle(EO,i).catch(()=>{});try{await this.dispatchJson("DELETE",`/api/sandboxes/${encodeURIComponent(i)}`)}catch(u){if(!(u instanceof Error?u.message:String(u)).includes("404"))throw u}}async getPreviewUrl(i){return(await this.resolveRecord(i))?.previewUrl??null}async localWorkdir(i){return null}async*watchClaimLifecycle(i,u){yield{kind:"ready"}}toSandbox(i){return{handle:i.handle,workdir:i.sandboxApiUrl,previewUrl:i.previewUrl}}async resolveRecord(i){let u=this.records.get(i);if(u)return u;if(!this.stateStore)return null;let f=(await this.stateStore.getByHandle(EO,i))?.state,l=f?.sandboxApiUrl;if(!l)return null;let E={handle:i,sandboxApiUrl:l,previewUrl:f?.previewUrl??l};return this.records.set(i,E),E}async dispatchJson(i,u,t,f){let l={accept:"application/json"};if(t!==void 0)l["content-type"]="application/json";let E=this.dispatch(this.userSub,{method:i,path:u,headers:l,body:t},{signal:f}),c=null,w="";for await(let h of E)if(h.headers)c=h.headers.status;else if(h.data!=null)w+=h.data;let $=Buffer.from(w,"base64").toString("utf8");if(c!=null&&(c<200||c>=300))throw Error(`daemon returned ${c}: ${$}`);return $}}function jY0(i){return new $Ti(i)}function pmf(){let i="";return{push(u){if(u.length===0)return GEu;i+=u;let t=i.length-i.length%4;if(t===0)return GEu;let f=i.slice(0,t);return i=i.slice(t),new Uint8Array(Buffer.from(f,"base64"))},flush(){if(i.length===0)return GEu;let u=i;return i="",new Uint8Array(Buffer.from(u,"base64"))}}}async function ief(i){if(typeof i==="string")return i;if(i instanceof ArrayBuffer)return Buffer.from(i).toString("utf8");if(ArrayBuffer.isView(i))return Buffer.from(i.buffer,i.byteOffset,i.byteLength).toString("utf8");if(i instanceof URLSearchParams)return i.toString();return await new Response(i).text()}var EO="user-desktop",GEu;var XY0=O(()=>{Gvi();uli();GEu=new Uint8Array(0)});var JY0={};yi(JY0,{createDesktopProvider:()=>jY0,DesktopSandboxProvider:()=>$Ti});var KY0=O(()=>{XY0()});var HY0={};yi(HY0,{subscribeLifecycle:()=>kEu,getSandboxProviderByKind:()=>xEu,getOrInitSharedRunner:()=>hef,buildDesktopProvider:()=>hTi,__resetSharedLifecyclesForTesting:()=>Nef});function SY0(i,u){let t=YY0[i];if(t)return Promise.resolve(t);let f=IEu[i];if(f)return f;let l=u().then((E)=>{return YY0[i]=E,E}).finally(()=>{delete IEu[i]});return IEu[i]=l,l}function fef(){let i=process.env.STUDIO_SANDBOX_PREVIEW_URL_PATTERN;return i&&i.trim()!==""?i:void 0}function lef(){let i=process.env.STUDIO_SANDBOX_TEMPLATE_NAME;return i&&i.trim()!==""?i:void 0}function Eef(){let i=process.env.STUDIO_SANDBOX_GO_TEMPLATE_NAME;return i&&i.trim()!==""?i:void 0}function cef(){let i=process.env.STUDIO_ENV;return i&&i.trim()!==""?i:void 0}function wef(){let i=process.env.STUDIO_SANDBOX_SENTINEL_TOKEN;return i&&i.trim()!==""?i:void 0}function $ef(){let i=process.env.STUDIO_SANDBOX_PREVIEW_GATEWAY_NAME?.trim(),u=process.env.STUDIO_SANDBOX_PREVIEW_GATEWAY_NAMESPACE?.trim();if(!i&&!u)return;if(!i||!u)throw Error("STUDIO_SANDBOX_PREVIEW_GATEWAY_NAME and STUDIO_SANDBOX_PREVIEW_GATEWAY_NAMESPACE must both be set, or both unset. Half-configured per-claim HTTPRoute routing would silently fail to attach.");return{name:i,namespace:u}}async function QY0(i,u){let t=new Dn(u),f=fef();switch(i){case"agent-sandbox":{let{AgentSandboxProvider:l}=await Promise.resolve().then(() => (yEu(),kY0)),E=new w2($u().encryptionKey);return new l({stateStore:t,previewUrlPattern:f,sandboxTemplateName:lef(),goSandboxTemplateName:Eef(),envName:cef(),previewGateway:$ef(),sentinelToken:wef(),meter:Pt,mintCloneUrl:async(c,w)=>{if(!c.connectionId)return null;let $=WI0(c.cloneUrl);if(!$)return null;let{cloneUrl:h}=await VN(c.connectionId,$.owner,$.name,u,E,{bufferMs:w?.bufferMs});return h}})}case"user-desktop":throw Error("user-desktop provider cannot be instantiated without a per-run link claim \u2014 call resolveSandboxProvider, which binds the link before constructing the provider.");default:throw Error(`Unknown sandbox provider kind: ${String(i)}`)}}async function hTi(i,u){let{DesktopSandboxProvider:t}=await Promise.resolve().then(() => (KY0(),JY0)),{getProxyDispatch:f}=await Promise.resolve().then(() => (XEu(),jEu)),l=new Dn(i.db);if(!u)throw Error("buildDesktopProvider: userSub must be a non-empty string");let E=f();return new t({userSub:u,dispatch:E,stateStore:l})}function xEu(i,u){return SY0(u,()=>QY0(u,i.db))}async function hef(){let i;try{i=m2()}catch(t){return console.warn("[lifecycle] cannot resolve sandbox runner:",t instanceof Error?t.message:String(t)),null}return await SY0(i,()=>QY0(i,e0().db))}function kEu(i,u,t){let f=cO.get(u);if(f){if(f.terminated){if(f.lastPhase)try{t(f.lastPhase)}catch{}return{unsubscribe:Def}}if(f.listeners.add(t),f.lastPhase)try{t(f.lastPhase)}catch{}return WY0(u,f,t)}let l=new AbortController,E={lastPhase:null,terminated:!1,listeners:new Set([t]),abort:l};return cO.set(u,E),_ef(i,u,E),WY0(u,E,t)}function Def(){}function WY0(i,u,t){return{unsubscribe(){if(cO.get(i)!==u)return;if(u.listeners.delete(t),u.listeners.size===0)cO.delete(i),u.abort.abort()}}}async function _ef(i,u,t){let f=null;try{for await(let l of i.watchClaimLifecycle(u,t.abort.signal)){if(t.abort.signal.aborted)break;t.lastPhase=l;let E=l.kind==="ready"||l.kind==="failed";if(E)t.terminated=!0;let c=Array.from(t.listeners);for(let w of c)try{w(l)}catch{}if(E)break}}catch(l){f=l}finally{if(!t.terminated&&!t.abort.signal.aborted&&t.listeners.size>0){let l={kind:"failed",reason:"unknown",message:f instanceof Error?f.message:"Lifecycle watcher ended unexpectedly"};t.lastPhase=l,t.terminated=!0;for(let E of Array.from(t.listeners))try{E(l)}catch{}}if(cO.get(u)===t)cO.delete(u)}}function Nef(){for(let i of cO.values())i.abort.abort();cO.clear()}var uef,tef,LY0,YY0,IEu,vef,def,cO;var vTi=O(()=>{q5();b6();J1();Zlu();xo();QV();W0();uef=Symbol.for("decocms.sandbox.lifecycle.runners"),tef=Symbol.for("decocms.sandbox.lifecycle.inflight"),LY0=globalThis,YY0=LY0[uef]??={},IEu=LY0[tef]??={};vef=Symbol.for("decocms.sandbox.lifecycle.shared-lifecycles"),def=globalThis,cO=def[vef]??=new Map});async function Lv(i,u){let{userId:t,branch:f,virtualMcpMetadata:l,explicitKind:E}=u;if(E)return{provider:await oo(i,t,E),kind:E};if(i.sandboxPreference==="agent-sandbox")return{provider:await oo(i,t,"agent-sandbox"),kind:"agent-sandbox"};if(i.sandboxPreference==="user-desktop")return{provider:await hTi(i,t),kind:"user-desktop"};if(i.sandboxPreference==="cluster-default"){let v=m2();return{provider:await oo(i,t,v),kind:v}}let[c,...w]=Oef(l,t,f);if(c){let v=w.length===0?c:Zef(c,w);return{provider:await oo(i,t,v),kind:v}}let $=zY0();return{provider:await oo(i,t,$),kind:$}}function Oef(i,u,t){let f=o1(i)[u]?.[t];if(!f)return[];let l=zh(f);return Object.keys(l)}function Zef(i,u){let t=zY0();if(t===i||u.includes(t))return t;return i}function zY0(){return m2()}async function oo(i,u,t){if(t!=="user-desktop")return xEu(i,t);return hTi(i,u)}var jn=O(()=>{Rt();q5();I$();vTi()});var so;var JEu=O(()=>{so={npm:{install:"npm install",run:(i)=>`npm run ${i}`,runtime:"node"},pnpm:{install:"pnpm install",run:(i)=>`pnpm run ${i}`,runtime:"node"},yarn:{install:"yarn install",run:(i)=>`yarn run ${i}`,runtime:"node"},bun:{install:"bun install",run:(i)=>`bun run ${i}`,runtime:"bun"},deno:{install:"deno install",run:(i)=>`deno task ${i}`,runtime:"deno"}}});function dTi(i,u){return u?`thread:${i}/${u}`:`thread:${i}`}function DTi(i){return`sandbox/thread-${i.replace(/^thread:/,"").replace(/\//g,"-")}`}function wO(i){if(!i||!i.startsWith("thread:"))return null;return i.slice(7).split("/")[0]||null}async function f7(i,u,t){let f=wO(u);if(!f)return t;return(await i.storage.threads.get(f).catch(()=>null))?.created_by??t}async function Xn(i,u){if(!u)return null;let t=await i.storage.threads.get(u).catch(()=>null);if(!t)return null;return t.metadata??{}}async function nY0(i,u){let f=(await Xn(i,u))?.headRef;return typeof f==="string"&&f.length>0?f:null}async function RY0(i,u,t){let f=await Xn(i,u);if(!f)return;if(f.headRef===t)return;await i.storage.threads.update(u,{metadata:{...f,headRef:t}}).catch((l)=>console.warn("[thread-repo] setThreadHeadRef failed",l))}async function po(i,u){return(await Xn(i,u))?.githubRepo??null}async function bY0(i,u,t,f,l,E){let c=await Xn(i,u);if(!c)return;let w=Io(o1(c),t,f,l,E);await i.storage.threads.update(u,{metadata:{...c,sandboxMap:w}}).catch(($)=>console.warn("[thread-repo] setThreadSandboxMapEntry failed",$))}async function CY0(i,u){return o1(await Xn(i,u))}async function MY0(i,u,t,f,l){let E=await Xn(i,u);if(!E)return;let c=Olu(o1(E),t,f,l);if(!c)return;await i.storage.threads.update(u,{metadata:{...E,sandboxMap:c}}).catch((w)=>console.warn("[thread-repo] removeThreadSandboxMapEntry failed",w))}var $O=O(()=>{I$()});function _Ti(i){if(!i)return null;let u=i.runtime;if(!u||typeof u!=="object")return null;let t=u.env;if(!Array.isArray(t))return null;let f=[];for(let l of t){if(!l||typeof l!=="object")continue;let E=l;if(typeof E.key!=="string"||!EEi.test(E.key))continue;if(E.kind==="literal"&&typeof E.value==="string"){f.push({key:E.key,kind:"literal",value:E.value});continue}if(E.kind==="secret"&&typeof E.secretId==="string"&&E.secretId.length>0)f.push({key:E.key,kind:"secret",secretId:E.secretId})}return f.length===0?null:f}function qY0(i){if(!i)return null;let u=i.runtime;if(!u||typeof u!=="object")return null;let t=u.submoduleCredentials;if(!Array.isArray(t))return null;let f=[];for(let l of t){if(!l||typeof l!=="object")continue;let E=l;if(typeof E.host==="string"&&E.host.length>0&&typeof E.secretId==="string"&&E.secretId.length>0)f.push({host:E.host,secretId:E.secretId})}return f.length===0?null:f}async function VY0(i,u){gi(u);let t=Bi(u);await u.access.check();let f=Yu(u);if(!f)throw Error("User ID required");let l=await u.storage.virtualMcps.findById(i.virtualMcpId);if(!l||l.organization_id!==t.id)throw Error("Virtual MCP not found");let E=l.metadata??{},c=o1(E),w=await f7(u,i.branch,f),$=MN(c,w,i.branch,i.sandboxProviderKind);return{virtualMcp:l,metadata:E,userId:f,sandboxUserId:w,entry:$,organization:t}}function NTi(i){let u=i.runtime??null,f=u?.selected??null,l=u?.port??null,E=u?.path??null;if(!f||!(f in so))return{packageManager:null,runtime:null,port:l,packageManagerPath:E,runtimeBinPath:null};let c=so[f].runtime;return{packageManager:f,runtime:c,port:l,packageManagerPath:E,runtimeBinPath:c==="deno"?"/opt/deno/bin":c==="bun"?"/opt/bun/bin":null}}var Jn=O(()=>{Rt();JEu();I$();$O()});async function hO(i,u){let t=i.body?.getReader();if(!t)return i.text();let f=new TextDecoder,l="",E=0;for(;;){let{done:c,value:w}=await t.read();if(c)break;if(E+=w.byteLength,E>u)throw await t.cancel().catch(()=>{}),new rY0(`Upstream response exceeded ${u} bytes`);l+=f.decode(w,{stream:!0})}return l+=f.decode(),l}var rY0;var is=O(()=>{rY0=class rY0 extends Error{}});async function OTi({ctx:i,runner:u,handle:t,orgId:f,userId:l,entries:E}){if(!E||E.length===0)return;let c={};for(let $ of E){if($.kind==="literal"){c[$.key]=$.value;continue}try{let{value:h}=await i.storage.secrets.resolveById($.secretId,f,l);c[$.key]=h}catch(h){if(h instanceof G5||h instanceof s9){console.warn(`[SANDBOX_START] skipping env ${$.key}: ${h.message}. Re-link or recreate the secret to restore.`);continue}throw h}}if(Object.keys(c).length===0)return;let w=await u.proxyDaemonRequest(t,"/_sandbox/config",{method:"PUT",headers:new Headers({"content-type":"application/json"}),body:JSON.stringify({env:c})});if(!w.ok){let $=await hO(w,Bef).catch(()=>w.statusText);console.warn(`[SANDBOX_START] daemon rejected env patch (${w.status}): ${$}`)}}var Bef=10485760;var KEu=O(()=>{ie();is()});async function mY0({ctx:i,orgId:u,userId:t,entries:f}){if(!f||f.length===0)return[];let l=[];for(let E of f)try{let{value:c}=await i.storage.secrets.resolveById(E.secretId,u,t);l.push({host:E.host,token:c})}catch(c){if(c instanceof G5||c instanceof s9){console.warn(`[SANDBOX_START] skipping submodule credential for ${E.host}: ${c.message}. Re-link or recreate the secret to restore.`);continue}throw c}return l}var eY0=O(()=>{ie()});async function sY0(i,u,t,f,l){let E=await FN({connectionId:i,tokenStorage:new r1(f,l)});if(!E.accessToken)return null;return iW0(u,t,E.accessToken)}function pY0(i,u){return iW0(i,u,null)}async function iW0(i,u,t){let f=new Map,l=new Set(aY0.map(($)=>$.path));for(let $ of Object.values(oY0))for(let h of $??[])l.add(h);await Promise.all(Array.from(l).map(async($)=>{f.set($,await gef(i,u,$,t))}));let E=aY0.find(({path:$})=>f.get($)!==null);if(!E)return null;let c=oY0[E.pm]??[],w=null;for(let $ of c)if(w=Uef(f.get($)??null),w)break;return{packageManager:E.pm,devPort:w}}async function gef(i,u,t,f){let l=`https://api.github.com/repos/${i}/${u}/contents/${encodeURIComponent(t)}`;try{let E={Accept:"application/vnd.github+json","User-Agent":"studio-runtime-detect"};if(f)E.Authorization=`token ${f}`;let c=await fetch(l,{headers:E,signal:AbortSignal.timeout(5000)});if(!c.ok)return null;let w=await c.json();if(!w.content||w.encoding!=="base64")return null;return Buffer.from(w.content,"base64").toString("utf8")}catch{return null}}function Uef(i){if(!i)return null;try{let u=JSON.parse(i),t=u.tasks??u.scripts??{};return(t.dev??t.start??"").match(Fef)?.[1]??null}catch{return null}}var aY0,oY0,Fef;var uW0=O(()=>{gN();gv();aY0=[{path:"deno.json",pm:"deno"},{path:"deno.jsonc",pm:"deno"},{path:"bun.lock",pm:"bun"},{path:"bunfig.toml",pm:"bun"},{path:"pnpm-lock.yaml",pm:"pnpm"},{path:"yarn.lock",pm:"yarn"},{path:"package-lock.json",pm:"npm"},{path:"package.json",pm:"bun"}],oY0={deno:["deno.json","deno.jsonc"],bun:["package.json"],pnpm:["package.json"],yarn:["package.json"],npm:["package.json"]},Fef=/(?:--port|PORT=|:)(\d{4,5})/});function tW0(i){if(i.explicit)return i.explicit;return i.flags?.sandbox_go_daemon?"go":"ts"}function fW0(i){let{current:u,detached:t,base:f}=i.status??{};if(typeof u!=="string"||u.length===0)return null;if(t===!0)return null;if(u===i.requestedRef)return null;if(Tef.has(u))return null;if(typeof f==="string"&&f.length>0&&u===f)return null;return u}function lW0(i){if(!i.branch.startsWith("thread:"))return i.branch;if(i.sticky&&i.recordedHeadRef)return i.recordedHeadRef;return i.derivedRef}function EW0(){return process.env.SANDBOX_STICKY_HEAD_REF==="true"}var Tef;var YEu=O(()=>{Tef=new Set(["main","master","trunk","develop","HEAD"])});async function ZTi(i,u){if(!i)return{hosts:[],allowSameHostDev:!1};let t;try{t=await i.presignedGetUrl("link-dispatch/_allowlist_probe",60,{requireFetchable:!0})}catch{return{hosts:[],allowSameHostDev:!1}}let f;try{f=new URL(t)}catch{return{hosts:[],allowSameHostDev:!1}}if(f.protocol!=="https:"&&f.protocol!=="http:")return{hosts:[],allowSameHostDev:!1};let l=f.hostname,E=Aef.has(l);return{hosts:[l],allowSameHostDev:E&&!u.isProduction}}var Aef;var WEu=O(()=>{Aef=new Set(["127.0.0.1","localhost","::1","[::1]","0.0.0.0"])});import{z as K8}from"zod";async function BTi(i,u){gi(u);let t=Bi(u),f=Yu(u);if(!f)throw Error("User ID required");let l=await u.storage.virtualMcps.findById(i.virtualMcpId);if(!l||l.organization_id!==t.id)throw Error("Virtual MCP not found");let E=l.metadata??{},c=await f7(u,i.branch,f),w=MN(o1(E),c,i.branch,i.sandboxProviderKind),$=i.sandboxProviderKind,{provider:h}=await Lv(u,{userId:c,branch:i.branch,virtualMcpMetadata:E,explicitKind:$});if(w){if($!=="user-desktop")return w;if(await h.alive(w.sandboxHandle).catch(()=>!1))return w;await qN(u.storage.virtualMcps,i.virtualMcpId,f,c,i.branch,$).catch((N)=>{console.warn("[ensureSandbox] failed to reap stale user-desktop entry",N)})}let d=await po(u,wO(i.branch)??u.metadata?.threadId)??E.githubRepo??null,{entry:D}=await cW0({ctx:u,userId:f,sandboxUserId:c,orgId:t.id,virtualMcpId:i.virtualMcpId,branch:i.branch,metadata:E,githubRepo:d,existing:null,providerKind:$,runner:h});return D}async function cW0(i){let{ctx:u,userId:t,sandboxUserId:f,orgId:l,virtualMcpId:E,branch:c,metadata:w,githubRepo:$,existing:h,runner:v}=i,{runtime:d,packageManager:D,port:_,packageManagerPath:N}=NTi(w),Z;if($){if($.connectionId)await _n({ctx:u,connectionId:$.connectionId,organizationId:l,forceRefresh:!0,onLegacyMintError:(Ii)=>{console.error("[provisionSandbox] repo-scoped legacy token mint failed",{connectionId:$.connectionId,error:Ii.message})}});let{cloneUrl:hi,gitUserName:ci,gitUserEmail:ii}=$.connectionId?await VN($.connectionId,$.owner,$.name,u.db,u.vault):nvi($.owner,$.name);if(!D){let Ii=$.connectionId?await sY0($.connectionId,$.owner,$.name,u.db,u.vault):await pY0($.owner,$.name);if(Ii)D=Ii.packageManager,d=so[Ii.packageManager].runtime,_=Ii.devPort??_,await yef(u,E,t,Ii.packageManager,Ii.devPort)}let m=EW0(),Ni=lW0({branch:c,derivedRef:DTi(c),recordedHeadRef:m?await nY0(u,wO(c)):null,sticky:m}),wi=await mY0({ctx:u,orgId:l,userId:t,entries:qY0(w)});Z={cloneUrl:hi,...$.connectionId?{connectionId:$.connectionId}:{},userName:ci,userEmail:ii,branch:Ni,displayName:`${$.owner}/${$.name}`,...wi.length>0?{submoduleCredentials:wi}:{}}}let B=d&&D?{runtime:d,packageManager:D,..._!==null?{devPort:Number(_)}:{},...N?{packageManagerPath:N}:{}}:void 0,F=Wg({orgId:l,virtualMcpId:E,branch:c}),g=v.kind==="user-desktop"?await ZTi(u.objectStorage,{isProduction:$u().nodeEnv==="production"}):null,U=(v.kind==="user-desktop"||v.kind==="agent-sandbox")&&!$u().orgFsMountsDisabled,T;if(U){let hi=u.organization?.slug??(await u.db.selectFrom("organization").select(["slug"]).where("id","=",l).executeTakeFirst())?.slug;if(hi)T=await e5i(u,{orgSlug:hi,orgId:l,baseUrl:FE()})}let A=v.kind==="agent-sandbox"?tW0({explicit:i.daemonImpl,flags:i.daemonImpl?null:(await u.storage.organizationSettings.get(l))?.flags??null}):void 0,G=await v.ensure({userId:f,projectRef:F},{branch:c,repo:Z,workload:B,tenant:{orgId:l,userId:f,...u.organization?.slug?{orgSlug:u.organization.slug}:{},...u.organization?.name?{orgName:u.organization.name}:{},...u.auth.user?.email?{userEmail:u.auth.user.email}:{},...u.auth.user?.name?{userName:u.auth.user.name}:{}},...g?{offloadAllowedHosts:g.hosts,offloadAllowSameHostDev:g.allowSameHostDev}:{},...T?{orgFsConfigJson:T}:{},...A?{daemonImpl:A}:{}}),k=w.runtime?.env??null;await OTi({ctx:u,runner:v,handle:G.handle,orgId:l,userId:t,entries:k});let j=!!h&&h.sandboxHandle===G.handle&&h?.createdAt?h.createdAt:Date.now(),C=w.runtime?.selected??null,K=w.runtime?.port??null,S=w.runtime?.path??null,r={sandboxHandle:G.handle,previewUrl:G.previewUrl,sandboxApiUrl:G.previewUrl,sandboxProviderKind:v.kind,createdAt:j,startedWith:{packageManager:C,port:K,path:S}};await yI0(u.storage.virtualMcps,E,t,f,c,i.providerKind,r);let Q=wO(c);if(Q)await bY0(u,Q,f,c,i.providerKind,r);let fi=!h||h.sandboxHandle!==G.handle;return{entry:r,isNewVm:fi}}async function yef(i,u,t,f,l){let E=await i.storage.virtualMcps.findById(u);if(!E)return;let c=E.metadata??{};await i.storage.virtualMcps.update(u,t,{metadata:{...c,runtime:{selected:f,port:l}}})}var Pef,LEu;var FTi=O(()=>{q5();fu();Jn();KEu();eY0();I$();xo();uW0();JEu();jn();$O();YEu();WEu();W0();ql();bz();I$();Pef=K8.enum(["agent-sandbox","user-desktop","cluster"]),LEu=p({name:"SANDBOX_START",description:"Start a sandbox with the connected GitHub repo and dev server.",annotations:{title:"Start VM Preview",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!1,openWorldHint:!0},_meta:{ui:{visibility:"app"}},inputSchema:K8.object({virtualMcpId:K8.string().describe("Virtual MCP ID"),branch:K8.string().min(1).optional().describe("Git branch to check out. Pass the thread's branch whenever the caller has one: when omitted the handler mints a fresh `<user-slug>-<timestamp>` name, which becomes a SEPARATE sandbox from the one the thread's own branch resolves to. The resolved branch is returned in the response so callers can persist it."),sandboxProviderKind:Pef.optional().describe("Explicit runtime choice. Hosted provider is `agent-sandbox`; legacy `cluster` input is accepted only for compatibility and normalized to `agent-sandbox`. When omitted, defaults to `user-desktop` if the acting user's link daemon is online, else the env kind."),daemonImpl:s1u.optional().describe("Target this one sandbox at a specific sandbox daemon implementation, overriding the org's `sandbox_go_daemon` flag in either direction. Only honored on `agent-sandbox`, and only when the deployment configures a Go SandboxTemplate; otherwise the sandbox lands on `ts`. Applies to a sandbox being created \u2014 an existing sandbox keeps the binary it booted with.")}),outputSchema:K8.object({previewUrl:K8.string().nullable(),sandboxHandle:K8.string(),branch:K8.string(),isNewVm:K8.boolean(),sandboxProviderKind:K8.enum(["agent-sandbox","user-desktop"])}),handler:async(i,u)=>{gi(u);let t=Bi(u);await u.access.check();let f=i.branch??gvi(u.auth.user?.name??u.auth.user?.email?.split("@")[0]),l=Yu(u);if(!l)throw Error("User ID required");let E=await f7(u,f,l),c=await u.storage.virtualMcps.findById(i.virtualMcpId);if(!c||c.organization_id!==t.id)throw Error("Virtual MCP not found");let w=c.metadata??{},$=i.sandboxProviderKind?r2(i.sandboxProviderKind):void 0,{provider:h,kind:v}=await Lv(u,{userId:E,branch:f,virtualMcpMetadata:w,explicitKind:$}),d=MN(o1(w),E,f,v),_=await po(u,wO(f)??u.metadata?.threadId)??w.githubRepo??null,{entry:N,isNewVm:Z}=await cW0({ctx:u,userId:l,sandboxUserId:E,orgId:t.id,virtualMcpId:i.virtualMcpId,branch:f,metadata:w,githubRepo:_,existing:d,providerKind:v,runner:h,daemonImpl:i.daemonImpl});return{...N,branch:f,isNewVm:Z,sandboxProviderKind:v}}})});async function Gef(i,u,t,f){try{let l=i.organization;if(!l)return;let E=await Hvi(i,f.virtualMcpId,l,"tool-scripting",f.providerKind),c=await u.proxyDaemonRequest(t,"/_sandbox/tools/sync",{method:"POST",headers:new Headers({"content-type":"application/json"}),body:JSON.stringify(E)});if(!c.ok)console.warn("[cluster-sandbox-fs] tools/sync failed",c.status,await c.text().catch(()=>""))}catch(l){console.warn("[cluster-sandbox-fs] tools/sync failed",l)}}async function Kn(i,u){let{provider:t,kind:f}=await Lv(i,{userId:u.userId,branch:u.branch,virtualMcpMetadata:null}),l=null,E=()=>{if(!l){if(l=BTi({virtualMcpId:u.virtualMcpId,branch:u.branch,sandboxProviderKind:f},i).then(($)=>$.sandboxHandle),l.catch(()=>{l=null}),u.syncTools)l.then(($)=>Gef(i,t,$,{virtualMcpId:u.virtualMcpId,providerKind:f})).catch(()=>{})}return l},c=u.branch==="ephemeral"||f==="user-desktop";return tlu(t,{ensureHandle:E,invalidateHandle:async($)=>{let h=l;if(l=null,!c&&!$?.force)return;try{await qN(i.storage.virtualMcps,u.virtualMcpId,u.userId,u.userId,u.branch,f)}catch(v){console.warn("[cluster-sandbox-fs] failed to reap vmMap entry",v)}if(h&&typeof t.forgetHandle==="function")try{let v=await h;await t.forgetHandle(v)}catch(v){console.warn("[cluster-sandbox-fs] forgetHandle failed",v)}},canAutoRestart:c})}async function wW0(i,u){try{let t=await Kn(i,u),{stdout:f}=await t.onBash("test -d .deco && echo __DECO_SITE__");return f.includes("__DECO_SITE__")}catch(t){return console.warn("[cluster-sandbox-fs] .deco probe failed; assuming deco site",t),!0}}var gTi=O(()=>{q5();Nlu();jn();FTi();I$()});function Yn(i){let u=i.toISOString();return`<current-context>
 Current date: ${u.slice(0,10)}
 Current time: ${u.slice(11,16)} UTC
 </current-context>`}var $W0,hW0;var SEu=O(()=>{$W0={type:"ephemeral",ttl:"5m"},hW0={openrouter:{cache_control:{type:"ephemeral",ttl:"5m"}}}});function vW0(i,u){let t=[],f=i.length-1,l=i.length-2;for(let E=0;E<i.length;E++){let c=E===l||E===f;t.push({role:"system",content:i[E],...c?{providerOptions:Ief}:{}})}return t.push({role:"system",content:Yn(u)}),t}var Ief;var dW0=O(()=>{SEu();Ief={anthropic:{cacheControl:$W0}}});function DW0(i){if(i.length===0)return null;return`