decocms 4.158.8 → 4.159.0

package/dist/server/cli.js

@@ -90637,7 +90637,7 @@ ${_}`;w(S);return}if(c(null,O),t.strategy==="count"){if(T--,T===0)w()}if(t.strat
   `);function w(n){if(t===void 0)return!0;let h=Gr(n),A=h&&Gr(t)?Pou(t):t,D=h?Pou(n):gou(n),N=pV0(A,D);return N===""||!N.startsWith("..")&&!oV0(N)}return{upsert(n){f.run({$handle:n.handle,$status:n.status,$sandboxPath:n.sandboxPath,$port:n.port??null,$previewUrl:n.previewUrl??null,$repoCloneUrl:n.repoCloneUrl??null,$branch:n.branch??null,$projectName:n.projectName??null,$error:n.error??null,$now:Date.now()})},list(){return l.all().map(A1i)},reconcile(){let n=Date.now();for(let h of l.all().map(A1i)){if(!w(h.sandboxPath)){E.run({$handle:h.handle,$now:n});continue}if(!Gr(h.sandboxPath)){c.run({$handle:h.handle,$now:n});continue}if(h.status==="spawning"||h.status==="ready"||h.status==="failed"||h.status==="missing")_.run({$handle:h.handle,$now:n})}return l.all().map(A1i)},prune(n){let h=[],A=[],D=this.reconcile();for(let N of D){if(!w(N.sandboxPath)){A.push({handle:N.handle,sandboxPath:N.sandboxPath,reason:"outside_root",deletedFiles:!1});continue}if(n.missing&&N.status==="missing"){T.run({$handle:N.handle}),h.push({handle:N.handle,sandboxPath:N.sandboxPath,reason:"missing",deletedFiles:!1});continue}if(!n.merged||!Gr(N.sandboxPath))continue;if(N.branch===null||N.branch.trim()===""){A.push({handle:N.handle,sandboxPath:N.sandboxPath,reason:"no_branch",deletedFiles:!1});continue}if(!QS(N.sandboxPath,["rev-parse","--is-inside-work-tree"]).ok){A.push({handle:N.handle,sandboxPath:N.sandboxPath,reason:"git_unavailable",deletedFiles:!1});continue}let S=QS(N.sandboxPath,["status","--porcelain"]);if(!S.ok){A.push({handle:N.handle,sandboxPath:N.sandboxPath,reason:"git_unavailable",deletedFiles:!1});continue}if(S.stdout.trim()!==""){A.push({handle:N.handle,sandboxPath:N.sandboxPath,reason:"dirty_worktree",deletedFiles:!1});continue}let O=Bou(N.sandboxPath,N.branch);if(O===null){A.push({handle:N.handle,sandboxPath:N.sandboxPath,reason:"git_unavailable",deletedFiles:!1});continue}if(!O){A.push({handle:N.handle,sandboxPath:N.sandboxPath,reason:"branch_not_merged",deletedFiles:!1});continue}eV0(N.sandboxPath,{recursive:!0,force:!0}),T.run({$handle:N.handle}),h.push({handle:N.handle,sandboxPath:N.sandboxPath,reason:"merged",deletedFiles:!0})}return{removed:h,skipped:A}},delete(n){T.run({$handle:n})},inspect(n){let h=d.get({$handle:n});if(h===null)return null;let A=A1i(h),D=0,N=null;if(Gr(A.sandboxPath)&&QS(A.sandboxPath,["rev-parse","--is-inside-work-tree"]).ok){let S=QS(A.sandboxPath,["status","--porcelain"]);if(S.ok){let O=S.stdout.trim();D=O===""?0:O.split(`
 `).length}if(A.branch!==null&&A.branch.trim()!=="")N=Bou(A.sandboxPath,A.branch)}return{handle:A.handle,branch:A.branch,sandboxPath:A.sandboxPath,dirtyCount:D,merged:N}},close(){u.close()}}}var iMi=()=>{};function fm0(i,u){return u?[["umount","-f",i]]:[["fusermount","-uz",i],["umount","-l",i]]}function xou(i,u){if(process.platform==="win32")return;for(let t of fm0(i,u))if(Bun.spawnSync(t,{stdout:"ignore",stderr:"ignore",timeout:5000}).exitCode===0)break}var you=()=>{};import{existsSync as lm0,readdirSync as Em0}from"fs";import{rm as cm0}from"fs/promises";import{join as Rou}from"path";async function Fou(i,u={}){let t=u.detach??_m0,f=u.exists??lm0,l=u.readdir??((_)=>Em0(_)),E=u.rm??((_)=>cm0(_,{recursive:!0,force:!0})),c=Rou(i,"org");if(f(c))for(let _ of l(c))t(Rou(c,_));await E(i)}var _m0=(i)=>xou(i,process.platform==="darwin");var Lou=v(()=>{you()});import{join as Tm0}from"path";function Zou(i){let u=i.purge??Fou;return{stopSandbox(t){return i.provider.deleteSandbox(t)},inspectSandbox(t){return i.registry.inspect(t)},async removeSandbox(t){try{return await OE(async()=>{if(await i.provider.deleteSandbox(t),i.provider.hasHandle(t))throw Error("Can't delete \u2014 run in progress");let l=i.registry.inspect(t)?.sandboxPath??Tm0(i.dataDir,"sandboxes",t);await u(l)},{maxAttempts:2,minTimeout:250,jitter:0}),i.registry.delete(t),{ok:!0}}catch(f){let l=f instanceof J1?f.cause:f;return{ok:!1,error:l instanceof Error?l.message:String(l)}}}}}var Gou=v(()=>{Nl();Lou()});import{randomBytes as dm0}from"crypto";import{mkdir as wm0}from"fs/promises";import{createServer as nm0}from"net";import{join as hm0}from"path";function kou(i,u){return Error(`sandbox failed to start: ${i}`,{cause:u})}function Cou(i){if(!(i instanceof Error))return!1;return i.name==="TimeoutError"||/timed out|timeout|operation was aborted|aborted/i.test(i.message)}function You(i){if(i instanceof Error){let u=i.cause;if(u instanceof Error&&u.message)return u.message;return i.message}return String(i)}function Am0(i){if(!i)return null;let u=i.trim().replace(/\/+$/,"");if(!u)return null;let t=u.split(/[/:]/).filter(Boolean).at(-1);if(!t)return null;return t.replace(/\.git$/i,"")||null}function Dm0(i){return{repoCloneUrl:i.repo?.cloneUrl??null,branch:i.repo?.branch??null,projectName:Am0(i.repo?.cloneUrl)}}function jou(i){let u=i.maxSandboxes??20,t=new Map,f=i.pickPort??vm0,l=i.fetchImpl??fetch,E=i.resolvePreviewUrl??((D,N)=>`http://127.0.0.1:${N}`),c=(D)=>hm0(i.dataDir,"sandboxes",D),_=(D)=>{try{i.registry?.upsert(D)}catch(N){console.warn(`[user-desktop] failed to persist sandbox lifecycle handle=${D.handle} status=${D.status}:`,N)}},T=(D)=>{try{i.onEvent?.(D)}catch{}},d=async(D)=>{let N=new AbortController,S=setTimeout(()=>N.abort(),1500);try{let O=await l(`${D}/health`,{signal:N.signal});if(!O.ok)console.warn(`[user-desktop] probe ${D}/health \u2192 ${O.status} (treating as dead)`);return O.ok}catch(O){return console.warn(`[user-desktop] probe ${D}/health failed: ${O instanceof Error?O.message:String(O)} (treating as dead)`),!1}finally{clearTimeout(S)}},w=(D)=>{console.warn(`[user-desktop] evicting dead daemon handle=${D.handle} port=${D.port}`);try{D.process.kill("SIGTERM")}catch{}if(t.get(D.handle)===D)t.delete(D.handle),_({handle:D.handle,status:"stopped",sandboxPath:c(D.handle),port:null,previewUrl:null,...D.registryMetadata,error:null}),T({handle:D.handle,phase:"evicted"})},n=new Map;function h(){if(t.size<u)return;let D=[...t.values()].filter((S)=>S.activeDispatchCount===0).sort((S,O)=>S.lastUsedAt-O.lastUsedAt);if(D.length===0){console.warn(`[user-desktop] at cap ${t.size}/${u} but every sandbox is pinned (active dispatch) \u2014 exceeding cap temporarily`);return}let N=D[0];console.log(`[user-desktop] evicting LRU victim handle=${N.handle} port=${N.port} (cap ${u} reached, size=${t.size})`);try{N.process.kill("SIGTERM")}catch{}t.delete(N.handle),_({handle:N.handle,status:"stopped",sandboxPath:c(N.handle),port:null,previewUrl:null,...N.registryMetadata,error:null}),T({handle:N.handle,phase:"evicted"})}let A=async(D)=>{let N=Dm0(D),S=c(D.handle);_({handle:D.handle,status:"spawning",sandboxPath:S,port:null,previewUrl:null,...N,error:null}),T({handle:D.handle,phase:"spawning",sandboxPath:S,projectName:N.projectName,branch:N.branch}),h();let O,$=null,P;try{await wm0(S,{recursive:!0}),console.log(`[user-desktop] ensure handle=${D.handle} repo=${D.repo?.cloneUrl??"(none)"} branch=${D.repo?.branch??"(none)"} runtime=${D.workload?.runtime??"(autodetect)"} pm=${D.workload?.packageManager??"(autodetect)"}`),P=dm0(24).toString("hex");let[F,y]=await Promise.all([f(),f()]);O=F,console.log(`[user-desktop] spawn handle=${D.handle} port=${O} devPort=${y} workdir=${S}`),$=await Promise.resolve(i.spawnDaemon({workdir:S,handle:D.handle,port:O,daemonToken:P,offloadAllowedHosts:D.offloadAllowedHosts??[],offloadAllowSameHostDev:D.offloadAllowSameHostDev??!1,orgFsConfigJson:D.orgFsConfigJson}));try{await i.waitForHealth(O)}catch(L){throw kou("the sandbox didn't come online in time",L)}console.log(`[user-desktop] healthy handle=${D.handle} port=${O} \u2014 posting config`);try{await i.postConfig(O,y,{repo:D.repo,workload:D.workload,operator:D.operator},P)}catch(L){throw kou(Cou(L)?"configuration timed out":"the sandbox rejected its configuration",L)}}catch(F){if((Cou(F)?console.warn:console.error)(`[user-desktop] sandbox bring-up failed handle=${D.handle} port=${O??"(none)"}${$?" (killing daemon)":""}:`,F),$)try{$.kill("SIGKILL")}catch{}throw T({handle:D.handle,phase:"failed",error:You(F),sandboxPath:S,projectName:N.projectName,branch:N.branch}),_({handle:D.handle,status:"failed",sandboxPath:S,port:null,previewUrl:null,...N,error:You(F)}),F}if(!$||O===void 0)throw Error("sandbox bring-up invariant violated");let g=`http://127.0.0.1:${O}`,U=E(D.handle,O);console.log(`[user-desktop] ready handle=${D.handle} port=${O} sandboxApiUrl=${g} previewUrl=${U}`);let x={handle:D.handle,port:O,process:$,sandboxApiUrl:g,previewUrl:U,lastUsedAt:Date.now(),activeDispatchCount:0,daemonToken:P,registryMetadata:N};if(t.set(D.handle,x),_({handle:D.handle,status:"ready",sandboxPath:S,port:O,previewUrl:U,...N,error:null}),T({handle:D.handle,phase:"ready",port:O,previewUrl:U,sandboxPath:S,projectName:N.projectName,branch:N.branch}),$.exited)$.exited.then(()=>{if(t.get(D.handle)===x)console.warn(`[user-desktop] daemon process exited unexpectedly handle=${D.handle} port=${O} \u2014 removing from cache`),t.delete(D.handle),_({handle:D.handle,status:"stopped",sandboxPath:S,port:null,previewUrl:null,...N,error:null}),T({handle:D.handle,phase:"evicted"});else console.log(`[user-desktop] daemon process exited handle=${D.handle} port=${O} (already replaced/removed)`)});return{sandboxApiUrl:g,previewUrl:U,port:O}};return{async ensureSandbox(D){let N=t.get(D.handle);if(N){if(await d(N.sandboxApiUrl))return console.log(`[user-desktop] cache hit handle=${D.handle} port=${N.port} (alive)`),N.lastUsedAt=Date.now(),{sandboxApiUrl:N.sandboxApiUrl,previewUrl:N.previewUrl,port:N.port};console.warn(`[user-desktop] cache stale handle=${D.handle} port=${N.port} \u2014 respawning`),w(N)}let S=n.get(D.handle);if(S)return console.log(`[user-desktop] joining in-flight ensure handle=${D.handle}`),S;let O=A(D).finally(()=>{n.delete(D.handle)});return n.set(D.handle,O),O},proxyPort(D){let N=t.get(D);if(N)N.lastUsedAt=Date.now();return N?.port??null},getDaemonToken(D){return t.get(D)?.daemonToken??null},hasHandle(D){return t.has(D)||n.has(D)},recordHit(D){let N=t.get(D);if(N)N.lastUsedAt=Date.now()},acquireDispatch(D){let N=t.get(D);if(!N)return()=>{};N.activeDispatchCount+=1;let S=!1;return()=>{if(S)return;S=!0;let O=t.get(D);if(O)O.activeDispatchCount=Math.max(0,O.activeDispatchCount-1)}},listSandboxes(){return[...t.values()]},async deleteSandbox(D){let N=t.get(D);if(!N){console.log(`[user-desktop] delete handle=${D} (not found, no-op)`);return}if(N.activeDispatchCount>0){console.warn(`[user-desktop] delete handle=${D} port=${N.port} REFUSED \u2014 ${N.activeDispatchCount} active dispatch(es) in flight`);return}console.log(`[user-desktop] delete handle=${D} port=${N.port}`);try{N.process.kill("SIGTERM")}catch{}t.delete(D),_({handle:D,status:"stopped",sandboxPath:c(D),port:null,previewUrl:null,repoCloneUrl:null,branch:null,projectName:null,error:null}),T({handle:D,phase:"deleted"})},async shutdown(){console.log(`[user-desktop] shutdown \u2014 killing ${t.size} sandbox(es)`);for(let D of t.values())try{D.process.kill("SIGTERM")}catch{}t.clear()}}}function vm0(){return new Promise((i,u)=>{let t=nm0();t.unref(),t.on("error",u),t.listen(0,"127.0.0.1",()=>{let f=t.address();if(f&&typeof f==="object"){let l=f.port;t.close(()=>i(l))}else t.close(()=>u(Error("could not allocate port")))})})}var Kou=()=>{};import{randomUUID as Nm0}from"crypto";import{hostname as Sm0}from"os";async function Hou(i){let u=Sm0()||void 0;i.monitor?.onMachine?.(u??"this machine");let t=Nru(i.dataDir,{outFd:i.logFd,perSandboxLog:i.perSandboxLogs,hotReload:i.hotReload}),f=v1i({path:D1i(i.dataDir),managedSandboxRoot:`${i.dataDir}/sandboxes`}),l=!1,E=()=>{if(l)return;l=!0;try{f.close()}catch{}};try{let c=0,_=jou({dataDir:i.dataDir,registry:f,resolvePreviewUrl:(L,M)=>c>0?`http://${L}.localhost:${c}`:`http://127.0.0.1:${M}`,spawnDaemon:async(L)=>{let M={DAEMON_BOOT_ID:Nm0(),APP_ROOT:L.workdir,PROXY_PORT:String(L.port),DAEMON_TOKEN:L.daemonToken,OFFLOAD_ALLOWED_HOSTS:L.offloadAllowedHosts.join(","),...L.offloadAllowSameHostDev?{OFFLOAD_ALLOW_SAME_HOST_DEV:"1"}:{}};if(L.orgFsConfigJson){let K=await Pru(i.dataDir);if(K)M.ORGFS_CONFIG=L.orgFsConfigJson,M.ORGFS_RCLONE_PATH=K}let k=await t({workdir:L.workdir,env:M,daemonPort:L.port});return{port:L.port,kill:(K)=>k.kill(K),exited:k.exited.then(()=>{return})}},postConfig:async(L,M,k,K)=>{let q={port:M};if(k.workload)q.runtime=k.workload.runtime,q.packageManager={name:k.workload.packageManager,...k.workload.packageManagerPath?{path:k.workload.packageManagerPath}:{}};let H={application:q},fi=Un(k.operator??null);if(fi)H.operator=fi;if(k.repo)H.git={repository:{cloneUrl:k.repo.cloneUrl,branch:k.repo.branch,...k.repo.submoduleCredentials&&k.repo.submoduleCredentials.length>0?{submoduleCredentials:k.repo.submoduleCredentials}:{}},...k.repo.userName&&k.repo.userEmail?{identity:{userName:k.repo.userName,userEmail:k.repo.userEmail}}:{}};await GS(`http://127.0.0.1:${L}`,K,H)},waitForHealth:async(L)=>{await A4i(`http://127.0.0.1:${L}`)},maxSandboxes:20,onEvent:i.monitor?.onEvent}),T=await Tou({port:i.port,lookupSandboxPort:(L)=>_.proxyPort(L)});c=T.port,console.log(`Local ingress listening on http://127.0.0.1:${T.port} (use http://<handle>.localhost:${T.port}/)`),i.monitor?.onIngress?.(T.port);let d=Uru({provider:_}),w=async()=>{let L=await ZS({dataDir:i.dataDir,target:i.clusterBaseUrl});if(!L)throw Object.assign(Error(`Session for ${i.clusterBaseUrl} is no longer valid \u2014 run \`deco auth login --target ${i.clusterBaseUrl}\` and restart \`deco link\`.`),{fatal:!0});return L.accessToken},n=await Oou(i.dataDir),h=process.env.npm_package_version??"0.0.0",A=await pQi(),D=Nou(A,{onChange:(L)=>{console.log(`[link-daemon] capabilities detected: +${L.join(",")} (now: ${A.join(",")})`)}}),N=QWi({path:`${i.dataDir}/link/outbox.sqlite`});N.clear();let S=()=>{},O=new AbortController,$={clusterBaseUrl:i.clusterBaseUrl,getAccessToken:w,provider:_,outbox:N,controlHandler:d,capabilities:A,machineId:n,cliVersion:h,previewPort:T.port,onConnected:()=>{i.monitor?.onCluster?.("linked"),console.log(`Linked to ${i.clusterBaseUrl}`)},onShutdown:()=>S(),runLifetimeSignal:O.signal};console.log(`[link-daemon] transport=tunnel cluster=${i.clusterBaseUrl}`);let P=await aau($);console.log("[link-daemon] active transport=tunnel");let g,U=new Promise((L)=>{g=L}),x=!1,F=async()=>{if(x)return;x=!0,O.abort(),console.log(`
 Shutting down\u2026`),D();try{await P.close()}catch{}try{await T.stop()}catch{}try{await _.shutdown()}catch{}try{N.close()}catch{}E(),g(0)};process.on("SIGINT",()=>void F()),process.on("SIGTERM",()=>void F()),S=()=>{console.log("Disconnect requested from the Studio web UI \u2014 shutting down. Run `bunx decocms@latest link` to reconnect."),F()},P.closed.then(()=>{if(i.monitor?.onCluster?.("closed"),!x)console.error("Cluster connection closed permanently; exiting."),F()});let y=Zou({provider:_,registry:f,dataDir:i.dataDir});return{stopped:U,stop:F,stopSandbox:y.stopSandbox,removeSandbox:y.removeSandbox,inspectSandbox:y.inspectSandbox}}catch(c){throw E(),c}}var Xou=v(()=>{jWi();ur();Sru();gru();Bru();MWi();oau();dou();Sou();$ou();ir();iMi();Gou();Kou()});function uMi(i){return i.map((u)=>typeof u==="string"?u:String(u)).join(" ")}import{createServer as Om0}from"net";async function Pm0(i){for(let u of $m0)if(await tMi(i,u))return u;return null}async function Jou(i,{intervalMs:u=1000,sleepFn:t=yt}={}){for(;;){let f=await Pm0(i);if(f)return f;await t(u)}}function tMi(i,u){return new Promise((t)=>{let f=Om0();f.once("error",(l)=>{t(l.code==="EADDRINUSE")}),f.listen(i,u,()=>{f.close(()=>t(!1))})})}var $m0;var fMi=v(()=>{Nl();$m0=["localhost","127.0.0.1","0.0.0.0"]});function Wou(i){return typeof i==="object"&&i!==null&&"code"in i&&i.code==="EADDRINUSE"}function gm0(i,u=process.platform){if(u==="win32")return`for /f "tokens=5" %P in ('netstat -ano ^| findstr /R /C:":${i} .*LISTENING"') do taskkill /F /PID %P`;return`kill -9 $(lsof -ti tcp:${i})`}function bou(i,u=process.platform){return[`Port ${i} is already in use.`,"Run this command to stop the process listening on it, then retry `decocms link`:","",`  ${gm0(i,u)}`].join(`
-`)}var lMi;var Qou=v(()=>{lMi=class lMi extends Error{port;code="EADDRINUSE";constructor(i){super(`Port ${i} is already in use.`);this.port=i;this.name="PortInUseError"}}});var kK;var N1i=v(()=>{kK={name:"decocms",version:"4.158.8",description:"Deco CMS \u2014 Self-hostable MCP Gateway for managing AI connections and tools",author:"Deco team",repository:{type:"git",url:"git+https://github.com/decocms/studio.git",directory:"apps/api"},bugs:{url:"https://github.com/decocms/studio/issues"},type:"module",bin:{deco:"./dist/server/cli.js"},files:["dist/**/*"],scripts:{dev:"bun run migrate && bun run dev:server","dev:server":"bun run --cwd=../../packages/sandbox build && NODE_ENV=development bun --env-file=.env --hot run src/index.ts",build:"bun run build:server","build:server":"bun run scripts/bundle-server-script.ts --dist ./dist/server","generate:tool-contracts":"bun run scripts/generate-tool-contracts.ts","db:migrate":"bun run ./dist/server/migrate.js",check:"tsc --noEmit",start:"bun run ./dist/server/server.js",migrate:"bun run src/database/migrate.ts",test:"bun test src","better-auth:migrate":"bunx --bun @better-auth/cli migrate -y --config src/auth/index.ts","smoke:link":"bun run scripts/smoke-link.ts",prepublishOnly:"bun run --cwd=../.. build:studio"},optionalDependencies:{"@anthropic-ai/claude-agent-sdk":"^0.3.181","@duckdb/node-api":"^1.5.0-r.1","@openai/codex":"0.144.3","@openai/codex-darwin-arm64":"npm:@openai/codex@0.144.3-darwin-arm64","@openai/codex-darwin-x64":"npm:@openai/codex@0.144.3-darwin-x64","@openai/codex-linux-arm64":"npm:@openai/codex@0.144.3-linux-arm64","@openai/codex-linux-x64":"npm:@openai/codex@0.144.3-linux-x64","@openai/codex-win32-arm64":"npm:@openai/codex@0.144.3-win32-arm64","@openai/codex-win32-x64":"npm:@openai/codex@0.144.3-win32-x64"},dependencies:{"@ai-sdk/anthropic":"^3.0.85","@ai-sdk/google":"^3.0.83","@ai-sdk/openai":"^3.0.73","@anthropic-ai/sdk":"^0.105.0","@aws-sdk/client-s3":"^3.1013.0","@aws-sdk/client-sts":"^3.1013.0","@aws-sdk/lib-storage":"^3.1013.0","@aws-sdk/s3-request-presigner":"^3.1013.0","@clickhouse/client":"^1.8.1","@dbos-inc/dbos-sdk":"^4.21.6","@inkjs/ui":"^2.0.0","@nats-io/jetstream":"3.4.0","@nats-io/kv":"3.4.0","@nats-io/nats-core":"3.4.0","@nats-io/transport-node":"3.4.0","@openrouter/ai-sdk-provider":"^2.9.1","@opentelemetry/core":"^2.6.0","@resvg/resvg-js":"^2.6.2","embedded-postgres":"^18.3.0-beta.16",ink:"^6.8.0",kysely:"^0.28.12","node-pty":"^1.0.0","posthog-node":"^5.0.0",react:"^19.2.6","react-dom":"^19.2.6",satori:"^0.28.2"},devDependencies:{"@ai-sdk/provider":"^3.0.10","@better-auth/sso":"1.4.1","@decocms/better-auth":"1.5.17","@decocms/bindings":"workspace:*","@decocms/harness":"workspace:*","@decocms/mcp-utils":"workspace:*","@decocms/runtime":"workspace:*","@decocms/sandbox":"workspace:*","@decocms/shared":"workspace:*","@decocms/tunnel":"workspace:*","@jitl/quickjs-wasmfile-release-sync":"0.31.0","@modelcontextprotocol/sdk":"1.29.0","@nats-io/jwt":"0.0.10-5","@opentelemetry/api":"^1.9.0","@opentelemetry/api-logs":"^0.211.0","@opentelemetry/exporter-logs-otlp-proto":"^0.211.0","@opentelemetry/exporter-prometheus":"^0.208.0","@opentelemetry/exporter-trace-otlp-proto":"^0.207.0","@opentelemetry/instrumentation-runtime-node":"^0.24.0","@opentelemetry/resources":"^2.6.0","@opentelemetry/sdk-logs":"^0.211.0","@opentelemetry/sdk-metrics":"^2.2.0","@opentelemetry/sdk-node":"^0.207.0","@opentelemetry/sdk-trace-base":"^2.5.0","@types/bun":"^1.3.1","@types/google.maps":"^3.65.2","@types/pg":"^8.15.6","@types/react-syntax-highlighter":"^15.5.13","@vercel/nft":"^1.1.1",ai:"^6.0.208","better-auth":"1.4.22",croner:"^9.1.0",degit:"^2.8.4",hono:"^4.10.7",jose:"^6.0.11",nanoid:"^5.1.6",pg:"^8.16.3",typescript:"^7.0.2",typescript5:"npm:typescript@^5.9.3",vite:"^7.2.1",zod:"4.3.6"},homepage:"https://github.com/decocms/studio",keywords:["mcp","model-context-protocol","ai","gateway","self-hosted","tools"],license:"MIT",publishConfig:{access:"public"}}});var kr={};gi(kr,{printBanner:()=>Im0,bannerLines:()=>Mou,BANNER_LINES:()=>S1i,BANNER_GRADIENT:()=>O1i});function Bm0(i){let u=Number.parseInt(i.slice(1),16);return[u>>16&255,u>>8&255,u&255]}function Mou(i){let u=S1i.map((t,f)=>{let[l,E,c]=Bm0(O1i[f]);return`\x1B[38;2;${l};${E};${c}m${t}\x1B[39m`});if(i!==void 0)u.push(`\x1B[2m  v${i}\x1B[22m`);return u}function Im0(i){console.log("");for(let u of Mou(i))console.log(u);console.log("")}var S1i,O1i;var CK=v(()=>{S1i=[" \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588     \u2588\u2588\u2588\u2588\u2588\u2588\u2588   ","\u2591\u2591\u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2588\u2588\u2588 \u2591\u2591\u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2591\u2588  \u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2591\u2588\u2588\u2588  \u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2591\u2588\u2588\u2588 "," \u2591\u2588\u2588\u2588   \u2591\u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588  \u2588 \u2591  \u2588\u2588\u2588     \u2591\u2591\u2591  \u2588\u2588\u2588     \u2591\u2591\u2588\u2588\u2588"," \u2591\u2588\u2588\u2588    \u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588\u2588\u2588\u2588   \u2591\u2588\u2588\u2588         \u2591\u2588\u2588\u2588      \u2591\u2588\u2588\u2588"," \u2591\u2588\u2588\u2588    \u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588\u2591\u2591\u2588   \u2591\u2588\u2588\u2588         \u2591\u2588\u2588\u2588      \u2591\u2588\u2588\u2588"," \u2591\u2588\u2588\u2588    \u2588\u2588\u2588  \u2591\u2588\u2588\u2588 \u2591   \u2588\u2591\u2591\u2588\u2588\u2588     \u2588\u2588\u2588\u2591\u2591\u2588\u2588\u2588     \u2588\u2588\u2588 "," \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588 \u2591\u2591\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588  \u2591\u2591\u2591\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2591  ","\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591   \u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591   \u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591     \u2591\u2591\u2591\u2591\u2591\u2591\u2591   "],O1i=["#00ff64","#00ee5e","#00dc56","#00c84e","#00b444","#00a03c","#008832","#006e28"]});import{Box as xm0,Text as zou}from"ink";import{jsx as ym0,jsxs as rou}from"react/jsx-runtime";function $1i({version:i}){return rou(xm0,{flexDirection:"column",marginTop:1,children:[S1i.map((u,t)=>ym0(zou,{color:O1i[t],children:u},t)),rou(zou,{dimColor:!0,children:[" v",i]})]})}var EMi=v(()=>{CK()});function qou(i){let u=i.branch??i.handle,t=[];if(i.dirtyCount>0)t.push(`${i.dirtyCount} uncommitted file${i.dirtyCount===1?"":"s"}`);if(i.merged===!1)t.push("branch not merged");return t.length>0?`\u26A0 ${t.join(", ")} \u2014 delete ${u}? (y/n)`:`Delete ${u}? (y/n)`}function YK(i){return[...i.values()].map((u)=>u.handle).sort((u,t)=>u.localeCompare(t))}function Vou(i,u,t){if(i.length===0)return null;let f=u===null?-1:i.indexOf(u);if(f===-1)return t>0?i[0]:i[i.length-1];let l=Math.max(0,Math.min(i.length-1,f+t));return i[l]}function mou(i,u,t){if(t!==u)return t;let f=i.indexOf(u);if(f===-1)return t;return i[f+1]??i[f-1]??null}var dMi={};gi(dMi,{subscribeLinkState:()=>cMi,setSelectedHandle:()=>_Mi,setRemoving:()=>U1i,setPersistedSandboxes:()=>Km0,setPendingConfirm:()=>Yr,setMachine:()=>km0,setLogPath:()=>Ym0,setLinkActions:()=>jm0,setIngress:()=>Gm0,setDaemonError:()=>Cm0,setClusterUrl:()=>Zm0,setCluster:()=>Lm0,setActionError:()=>g1i,resetLinkStateForTests:()=>Xm0,removeSandboxRow:()=>TMi,pushSandboxEvent:()=>Hm0,getLinkState:()=>Cr,applySandboxEvent:()=>eou});function Fm0(i){return i==="spawning"||i==="ready"||i==="failed"}function eou(i,u){let t=new Map(i),f=t.get(u.handle);if(u.phase==="evicted"||u.phase==="deleted"){if(f)t.set(u.handle,{...f,port:null,previewUrl:null,status:"stopped",error:null});return t}return t.set(u.handle,{handle:u.handle,port:u.port??f?.port??null,previewUrl:u.previewUrl??f?.previewUrl??null,status:u.phase,error:u.phase==="failed"?u.error??"failed":null,projectName:u.projectName??f?.projectName??null,branch:u.branch??f?.branch??null,sandboxPath:u.sandboxPath??f?.sandboxPath??null}),t}function aou(){return{cluster:"connecting",clusterUrl:null,ingressUrl:null,ingressPort:null,machine:null,cap:Rm0,sandboxes:new Map,daemonError:null,logPath:null,selectedHandle:null,pendingConfirm:null,removingHandles:new Set,actionError:null,actions:null}}function VT(){for(let i of P1i)i()}function Cr(){return Ef}function cMi(i){return P1i.add(i),()=>P1i.delete(i)}function Lm0(i){Ef={...Ef,cluster:i},VT()}function Zm0(i){Ef={...Ef,clusterUrl:i},VT()}function Gm0(i,u){Ef={...Ef,ingressPort:i,ingressUrl:u},VT()}function km0(i){Ef={...Ef,machine:i},VT()}function Cm0(i){Ef={...Ef,daemonError:i},VT()}function Ym0(i){Ef={...Ef,logPath:i},VT()}function _Mi(i){Ef={...Ef,selectedHandle:i},VT()}function Yr(i){Ef={...Ef,pendingConfirm:i},VT()}function g1i(i){Ef={...Ef,actionError:i},VT()}function U1i(i,u){if(Ef.removingHandles.has(i)===u)return;let t=new Set(Ef.removingHandles);if(u)t.add(i);else t.delete(i);Ef={...Ef,removingHandles:t},VT()}function jm0(i){Ef={...Ef,actions:i},VT()}function TMi(i){let u=YK(Ef.sandboxes),t=mou(u,i,Ef.selectedHandle),f=new Map(Ef.sandboxes);f.delete(i);let l=new Set(Ef.removingHandles);l.delete(i),Ef={...Ef,sandboxes:f,selectedHandle:t,pendingConfirm:null,removingHandles:l},VT()}function Km0(i){let u=new Map;for(let t of i)u.set(t.handle,{handle:t.handle,port:t.port,previewUrl:t.previewUrl,status:t.status,error:t.error,projectName:t.projectName,branch:t.branch,sandboxPath:t.sandboxPath});for(let[t,f]of Ef.sandboxes)if(Fm0(f.status))u.set(t,f);Ef={...Ef,sandboxes:u},VT()}function Hm0(i){Ef={...Ef,sandboxes:eou(Ef.sandboxes,i)},VT()}function Xm0(){Ef=aou(),P1i.clear()}var Rm0=20,Ef,P1i;var jr=v(()=>{Ef=aou(),P1i=new Set});import{spawn as Jm0}from"child_process";function Wm0(i){if(i==="darwin")return"open";if(i==="win32")return"start";return"xdg-open"}function oou(i,u=process.platform){let t=Wm0(u);try{Jm0(t,[i],{stdio:"ignore",detached:!0}).unref()}catch{}}var sou=()=>{};function pou(i,u={}){let t=u.openUrl??oou,f=Cr(),l=YK(f.sandboxes),E=f.selectedHandle!==null&&l.includes(f.selectedHandle)?f.selectedHandle:l[0]??null,c=f.actions;switch(i.type){case"move":_Mi(Vou(l,f.selectedHandle,i.delta));return;case"open":{if(E===null)return;let _=f.sandboxes.get(E);if(_?.status==="ready"&&_.previewUrl)t(_.previewUrl);return}case"stop":if(E!==null&&c)c.stopSandbox(E);return;case"delete":{if(E===null||!c)return;let _=c.inspectSandbox(E),T=f.sandboxes.get(E);g1i(null),Yr({handle:E,branch:_?.branch??T?.branch??null,dirtyCount:_?.dirtyCount??0,merged:_?.merged??null});return}case"confirmYes":{let _=f.pendingConfirm;if(Yr(null),_===null||!c)return;U1i(_.handle,!0),c.removeSandbox(_.handle).then((T)=>{if(T.ok)TMi(_.handle);else U1i(_.handle,!1),g1i(T.error)});return}case"confirmNo":Yr(null);return;case"quit":if(c)c.quit();return}}var isu=v(()=>{jr();sou()});function usu(i,u,t){if(t)return i==="y"||i==="Y"?{type:"confirmYes"}:{type:"confirmNo"};if(u.upArrow||i==="k")return{type:"move",delta:-1};if(u.downArrow||i==="j")return{type:"move",delta:1};if(i==="s")return{type:"stop"};if(i==="d")return{type:"delete"};if(i==="o")return{type:"open"};if(i==="q"||u.ctrl===!0&&i==="c")return{type:"quit"};return null}var tsu={};gi(tsu,{LinkApp:()=>zm0});import{Box as ME,Text as w4,useInput as bm0}from"ink";import{useSyncExternalStore as Qm0}from"react";import{jsx as Zf,jsxs as Cn}from"react/jsx-runtime";function Mm0(i,u){if(u)return{color:"yellow",text:"\u25CC Removing\u2026"};if(i.status==="ready")return{color:"green",text:"\u25CF Live"};if(i.status==="spawning")return{color:"yellow",text:"\u25CC Starting\u2026"};if(i.status==="stopped")return{color:"gray",text:"\u25A0 Stopped"};if(i.status==="missing")return{color:"yellow",text:"\u25A1 Missing"};if(i.status==="merged")return{color:"cyan",text:"\u2713 Merged"};if(i.status==="invalid")return{color:"red",text:"\u2717 Invalid"};if(i.status==="failed")return{color:"red",text:`\u2717 Failed: ${i.error??"failed"}`};return{color:"red",text:`\u2717 Error: ${i.error??""}`}}function zm0(){let i=Qm0(cMi,Cr),u=[...i.sandboxes.values()].sort((l,E)=>l.handle.localeCompare(E.handle)),t=YK(i.sandboxes),f=i.selectedHandle!==null&&t.includes(i.selectedHandle)?i.selectedHandle:t[0]??null;return bm0((l,E)=>{let c=usu(l,E,i.pendingConfirm!==null);if(c!==null)pou(c)}),Cn(ME,{flexDirection:"column",children:[Zf($1i,{version:kK.version}),Zf(ME,{marginBottom:1,children:Zf(w4,{dimColor:!0,children:"\u2500".repeat(80)})}),Zf(ME,{children:i.cluster==="linked"?Cn(w4,{color:"green",children:["\u2713 Connected to ",i.clusterUrl??"deco"]}):i.cluster==="connecting"?Cn(w4,{color:"yellow",children:["\u25CC Connecting to ",i.clusterUrl??"deco","\u2026"]}):Cn(w4,{color:"red",children:["\u2717 Disconnected from ",i.clusterUrl??"deco"]})}),Zf(ME,{children:i.ingressUrl?Cn(w4,{color:"green",children:["\u2713 Serving at ",i.ingressUrl]}):Zf(w4,{dimColor:!0,children:"\u25CC Starting local server\u2026"})}),Zf(ME,{marginBottom:1,children:Zf(w4,{dimColor:!0,children:`${"Computer".padEnd(16)}${i.machine??"this computer"} \xB7 ${u.length} of ${i.cap} previews`})}),u.length===0?Zf(w4,{dimColor:!0,children:"No previews running yet."}):Cn(ME,{flexDirection:"column",children:[Cn(ME,{children:[Zf(ME,{width:2,flexShrink:0}),Zf(ME,{width:jK.project,flexShrink:0,marginRight:1,children:Zf(w4,{dimColor:!0,wrap:"truncate-end",children:"PROJECT"})}),Zf(ME,{width:jK.branch,flexShrink:0,marginRight:1,children:Zf(w4,{dimColor:!0,wrap:"truncate-end",children:"BRANCH"})}),Zf(ME,{width:jK.status,flexShrink:0,marginRight:1,children:Zf(w4,{dimColor:!0,wrap:"truncate-end",children:"STATUS"})}),Zf(ME,{flexGrow:1,children:Zf(w4,{dimColor:!0,wrap:"truncate-end",children:"PREVIEW URL"})})]}),u.map((l)=>{let E=Mm0(l,i.removingHandles.has(l.handle)),c=l.handle===f;return Cn(ME,{children:[Zf(ME,{width:2,flexShrink:0,children:Zf(w4,{color:"cyan",children:c?"\u203A":" "})}),Zf(ME,{width:jK.project,flexShrink:0,marginRight:1,children:Zf(w4,{bold:c,wrap:"truncate-end",children:l.projectName??l.handle})}),Zf(ME,{width:jK.branch,flexShrink:0,marginRight:1,children:Zf(w4,{bold:c,wrap:"truncate-end",children:l.branch??"\u2014"})}),Zf(ME,{width:jK.status,flexShrink:0,marginRight:1,children:Zf(w4,{color:E.color,bold:c,wrap:"truncate-end",children:E.text})}),Zf(ME,{flexGrow:1,children:Zf(w4,{dimColor:!0,wrap:"truncate-end",children:l.previewUrl??"\u2014"})})]},l.handle)})]}),i.daemonError?Zf(ME,{marginTop:1,children:Cn(w4,{color:"red",children:["\u26A0 ",i.daemonError]})}):null,i.logPath?Zf(ME,{marginTop:1,children:Cn(w4,{dimColor:!0,children:["Logs: ",i.logPath]})}):null,i.pendingConfirm?Zf(ME,{marginTop:1,children:Zf(w4,{color:"yellow",children:qou(i.pendingConfirm)})}):null,i.actionError?Zf(ME,{marginTop:1,children:Cn(w4,{color:"red",children:["\u2717 ",i.actionError]})}):null,Zf(ME,{marginTop:1,children:Zf(w4,{dimColor:!0,children:"\u2191\u2193 move \xB7 s stop \xB7 d delete \xB7 o open \xB7 q quit"})})]})}var jK;var fsu=v(()=>{N1i();EMi();isu();jr();jK={project:18,branch:22,status:14}});var lsu={};gi(lsu,{runLinkCommand:()=>sm0});import{closeSync as rm0,mkdirSync as qm0,openSync as Vm0,writeSync as mm0}from"fs";import{homedir as em0}from"os";import{join as wMi}from"path";function am0(i,u){let t={log:console.log,warn:console.warn,error:console.error},f=(l)=>{if(u===void 0)return;try{mm0(u,`${uMi(l)}
+`)}var lMi;var Qou=v(()=>{lMi=class lMi extends Error{port;code="EADDRINUSE";constructor(i){super(`Port ${i} is already in use.`);this.port=i;this.name="PortInUseError"}}});var kK;var N1i=v(()=>{kK={name:"decocms",version:"4.159.0",description:"Deco CMS \u2014 Self-hostable MCP Gateway for managing AI connections and tools",author:"Deco team",repository:{type:"git",url:"git+https://github.com/decocms/studio.git",directory:"apps/api"},bugs:{url:"https://github.com/decocms/studio/issues"},type:"module",bin:{deco:"./dist/server/cli.js"},files:["dist/**/*"],scripts:{dev:"bun run migrate && bun run dev:server","dev:server":"bun run --cwd=../../packages/sandbox build && NODE_ENV=development bun --env-file=.env --hot run src/index.ts",build:"bun run build:server","build:server":"bun run scripts/bundle-server-script.ts --dist ./dist/server","generate:tool-contracts":"bun run scripts/generate-tool-contracts.ts","db:migrate":"bun run ./dist/server/migrate.js",check:"tsc --noEmit",start:"bun run ./dist/server/server.js",migrate:"bun run src/database/migrate.ts",test:"bun test src","better-auth:migrate":"bunx --bun @better-auth/cli migrate -y --config src/auth/index.ts","smoke:link":"bun run scripts/smoke-link.ts",prepublishOnly:"bun run --cwd=../.. build:studio"},optionalDependencies:{"@anthropic-ai/claude-agent-sdk":"^0.3.181","@duckdb/node-api":"^1.5.0-r.1","@openai/codex":"0.144.3","@openai/codex-darwin-arm64":"npm:@openai/codex@0.144.3-darwin-arm64","@openai/codex-darwin-x64":"npm:@openai/codex@0.144.3-darwin-x64","@openai/codex-linux-arm64":"npm:@openai/codex@0.144.3-linux-arm64","@openai/codex-linux-x64":"npm:@openai/codex@0.144.3-linux-x64","@openai/codex-win32-arm64":"npm:@openai/codex@0.144.3-win32-arm64","@openai/codex-win32-x64":"npm:@openai/codex@0.144.3-win32-x64"},dependencies:{"@ai-sdk/anthropic":"^3.0.85","@ai-sdk/google":"^3.0.83","@ai-sdk/openai":"^3.0.73","@anthropic-ai/sdk":"^0.105.0","@aws-sdk/client-s3":"^3.1013.0","@aws-sdk/client-sts":"^3.1013.0","@aws-sdk/lib-storage":"^3.1013.0","@aws-sdk/s3-request-presigner":"^3.1013.0","@clickhouse/client":"^1.8.1","@dbos-inc/dbos-sdk":"^4.21.6","@inkjs/ui":"^2.0.0","@nats-io/jetstream":"3.4.0","@nats-io/kv":"3.4.0","@nats-io/nats-core":"3.4.0","@nats-io/transport-node":"3.4.0","@openrouter/ai-sdk-provider":"^2.9.1","@opentelemetry/core":"^2.6.0","@resvg/resvg-js":"^2.6.2","embedded-postgres":"^18.3.0-beta.16",ink:"^6.8.0",kysely:"^0.28.12","node-pty":"^1.0.0","posthog-node":"^5.0.0",react:"^19.2.6","react-dom":"^19.2.6",satori:"^0.28.2"},devDependencies:{"@ai-sdk/provider":"^3.0.10","@better-auth/sso":"1.4.1","@decocms/better-auth":"1.5.17","@decocms/bindings":"workspace:*","@decocms/harness":"workspace:*","@decocms/mcp-utils":"workspace:*","@decocms/runtime":"workspace:*","@decocms/sandbox":"workspace:*","@decocms/shared":"workspace:*","@decocms/tunnel":"workspace:*","@jitl/quickjs-wasmfile-release-sync":"0.31.0","@modelcontextprotocol/sdk":"1.29.0","@nats-io/jwt":"0.0.10-5","@opentelemetry/api":"^1.9.0","@opentelemetry/api-logs":"^0.211.0","@opentelemetry/exporter-logs-otlp-proto":"^0.211.0","@opentelemetry/exporter-prometheus":"^0.208.0","@opentelemetry/exporter-trace-otlp-proto":"^0.207.0","@opentelemetry/instrumentation-runtime-node":"^0.24.0","@opentelemetry/resources":"^2.6.0","@opentelemetry/sdk-logs":"^0.211.0","@opentelemetry/sdk-metrics":"^2.2.0","@opentelemetry/sdk-node":"^0.207.0","@opentelemetry/sdk-trace-base":"^2.5.0","@types/bun":"^1.3.1","@types/google.maps":"^3.65.2","@types/pg":"^8.15.6","@types/react-syntax-highlighter":"^15.5.13","@vercel/nft":"^1.1.1",ai:"^6.0.208","better-auth":"1.4.22",croner:"^9.1.0",degit:"^2.8.4",hono:"^4.10.7",jose:"^6.0.11",nanoid:"^5.1.6",pg:"^8.16.3",typescript:"^7.0.2",typescript5:"npm:typescript@^5.9.3",vite:"^7.2.1",zod:"4.3.6"},homepage:"https://github.com/decocms/studio",keywords:["mcp","model-context-protocol","ai","gateway","self-hosted","tools"],license:"MIT",publishConfig:{access:"public"}}});var kr={};gi(kr,{printBanner:()=>Im0,bannerLines:()=>Mou,BANNER_LINES:()=>S1i,BANNER_GRADIENT:()=>O1i});function Bm0(i){let u=Number.parseInt(i.slice(1),16);return[u>>16&255,u>>8&255,u&255]}function Mou(i){let u=S1i.map((t,f)=>{let[l,E,c]=Bm0(O1i[f]);return`\x1B[38;2;${l};${E};${c}m${t}\x1B[39m`});if(i!==void 0)u.push(`\x1B[2m  v${i}\x1B[22m`);return u}function Im0(i){console.log("");for(let u of Mou(i))console.log(u);console.log("")}var S1i,O1i;var CK=v(()=>{S1i=[" \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588     \u2588\u2588\u2588\u2588\u2588\u2588\u2588   ","\u2591\u2591\u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2588\u2588\u2588 \u2591\u2591\u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2591\u2588  \u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2591\u2588\u2588\u2588  \u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2591\u2588\u2588\u2588 "," \u2591\u2588\u2588\u2588   \u2591\u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588  \u2588 \u2591  \u2588\u2588\u2588     \u2591\u2591\u2591  \u2588\u2588\u2588     \u2591\u2591\u2588\u2588\u2588"," \u2591\u2588\u2588\u2588    \u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588\u2588\u2588\u2588   \u2591\u2588\u2588\u2588         \u2591\u2588\u2588\u2588      \u2591\u2588\u2588\u2588"," \u2591\u2588\u2588\u2588    \u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588\u2591\u2591\u2588   \u2591\u2588\u2588\u2588         \u2591\u2588\u2588\u2588      \u2591\u2588\u2588\u2588"," \u2591\u2588\u2588\u2588    \u2588\u2588\u2588  \u2591\u2588\u2588\u2588 \u2591   \u2588\u2591\u2591\u2588\u2588\u2588     \u2588\u2588\u2588\u2591\u2591\u2588\u2588\u2588     \u2588\u2588\u2588 "," \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588 \u2591\u2591\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588  \u2591\u2591\u2591\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2591  ","\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591   \u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591   \u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591     \u2591\u2591\u2591\u2591\u2591\u2591\u2591   "],O1i=["#00ff64","#00ee5e","#00dc56","#00c84e","#00b444","#00a03c","#008832","#006e28"]});import{Box as xm0,Text as zou}from"ink";import{jsx as ym0,jsxs as rou}from"react/jsx-runtime";function $1i({version:i}){return rou(xm0,{flexDirection:"column",marginTop:1,children:[S1i.map((u,t)=>ym0(zou,{color:O1i[t],children:u},t)),rou(zou,{dimColor:!0,children:[" v",i]})]})}var EMi=v(()=>{CK()});function qou(i){let u=i.branch??i.handle,t=[];if(i.dirtyCount>0)t.push(`${i.dirtyCount} uncommitted file${i.dirtyCount===1?"":"s"}`);if(i.merged===!1)t.push("branch not merged");return t.length>0?`\u26A0 ${t.join(", ")} \u2014 delete ${u}? (y/n)`:`Delete ${u}? (y/n)`}function YK(i){return[...i.values()].map((u)=>u.handle).sort((u,t)=>u.localeCompare(t))}function Vou(i,u,t){if(i.length===0)return null;let f=u===null?-1:i.indexOf(u);if(f===-1)return t>0?i[0]:i[i.length-1];let l=Math.max(0,Math.min(i.length-1,f+t));return i[l]}function mou(i,u,t){if(t!==u)return t;let f=i.indexOf(u);if(f===-1)return t;return i[f+1]??i[f-1]??null}var dMi={};gi(dMi,{subscribeLinkState:()=>cMi,setSelectedHandle:()=>_Mi,setRemoving:()=>U1i,setPersistedSandboxes:()=>Km0,setPendingConfirm:()=>Yr,setMachine:()=>km0,setLogPath:()=>Ym0,setLinkActions:()=>jm0,setIngress:()=>Gm0,setDaemonError:()=>Cm0,setClusterUrl:()=>Zm0,setCluster:()=>Lm0,setActionError:()=>g1i,resetLinkStateForTests:()=>Xm0,removeSandboxRow:()=>TMi,pushSandboxEvent:()=>Hm0,getLinkState:()=>Cr,applySandboxEvent:()=>eou});function Fm0(i){return i==="spawning"||i==="ready"||i==="failed"}function eou(i,u){let t=new Map(i),f=t.get(u.handle);if(u.phase==="evicted"||u.phase==="deleted"){if(f)t.set(u.handle,{...f,port:null,previewUrl:null,status:"stopped",error:null});return t}return t.set(u.handle,{handle:u.handle,port:u.port??f?.port??null,previewUrl:u.previewUrl??f?.previewUrl??null,status:u.phase,error:u.phase==="failed"?u.error??"failed":null,projectName:u.projectName??f?.projectName??null,branch:u.branch??f?.branch??null,sandboxPath:u.sandboxPath??f?.sandboxPath??null}),t}function aou(){return{cluster:"connecting",clusterUrl:null,ingressUrl:null,ingressPort:null,machine:null,cap:Rm0,sandboxes:new Map,daemonError:null,logPath:null,selectedHandle:null,pendingConfirm:null,removingHandles:new Set,actionError:null,actions:null}}function VT(){for(let i of P1i)i()}function Cr(){return Ef}function cMi(i){return P1i.add(i),()=>P1i.delete(i)}function Lm0(i){Ef={...Ef,cluster:i},VT()}function Zm0(i){Ef={...Ef,clusterUrl:i},VT()}function Gm0(i,u){Ef={...Ef,ingressPort:i,ingressUrl:u},VT()}function km0(i){Ef={...Ef,machine:i},VT()}function Cm0(i){Ef={...Ef,daemonError:i},VT()}function Ym0(i){Ef={...Ef,logPath:i},VT()}function _Mi(i){Ef={...Ef,selectedHandle:i},VT()}function Yr(i){Ef={...Ef,pendingConfirm:i},VT()}function g1i(i){Ef={...Ef,actionError:i},VT()}function U1i(i,u){if(Ef.removingHandles.has(i)===u)return;let t=new Set(Ef.removingHandles);if(u)t.add(i);else t.delete(i);Ef={...Ef,removingHandles:t},VT()}function jm0(i){Ef={...Ef,actions:i},VT()}function TMi(i){let u=YK(Ef.sandboxes),t=mou(u,i,Ef.selectedHandle),f=new Map(Ef.sandboxes);f.delete(i);let l=new Set(Ef.removingHandles);l.delete(i),Ef={...Ef,sandboxes:f,selectedHandle:t,pendingConfirm:null,removingHandles:l},VT()}function Km0(i){let u=new Map;for(let t of i)u.set(t.handle,{handle:t.handle,port:t.port,previewUrl:t.previewUrl,status:t.status,error:t.error,projectName:t.projectName,branch:t.branch,sandboxPath:t.sandboxPath});for(let[t,f]of Ef.sandboxes)if(Fm0(f.status))u.set(t,f);Ef={...Ef,sandboxes:u},VT()}function Hm0(i){Ef={...Ef,sandboxes:eou(Ef.sandboxes,i)},VT()}function Xm0(){Ef=aou(),P1i.clear()}var Rm0=20,Ef,P1i;var jr=v(()=>{Ef=aou(),P1i=new Set});import{spawn as Jm0}from"child_process";function Wm0(i){if(i==="darwin")return"open";if(i==="win32")return"start";return"xdg-open"}function oou(i,u=process.platform){let t=Wm0(u);try{Jm0(t,[i],{stdio:"ignore",detached:!0}).unref()}catch{}}var sou=()=>{};function pou(i,u={}){let t=u.openUrl??oou,f=Cr(),l=YK(f.sandboxes),E=f.selectedHandle!==null&&l.includes(f.selectedHandle)?f.selectedHandle:l[0]??null,c=f.actions;switch(i.type){case"move":_Mi(Vou(l,f.selectedHandle,i.delta));return;case"open":{if(E===null)return;let _=f.sandboxes.get(E);if(_?.status==="ready"&&_.previewUrl)t(_.previewUrl);return}case"stop":if(E!==null&&c)c.stopSandbox(E);return;case"delete":{if(E===null||!c)return;let _=c.inspectSandbox(E),T=f.sandboxes.get(E);g1i(null),Yr({handle:E,branch:_?.branch??T?.branch??null,dirtyCount:_?.dirtyCount??0,merged:_?.merged??null});return}case"confirmYes":{let _=f.pendingConfirm;if(Yr(null),_===null||!c)return;U1i(_.handle,!0),c.removeSandbox(_.handle).then((T)=>{if(T.ok)TMi(_.handle);else U1i(_.handle,!1),g1i(T.error)});return}case"confirmNo":Yr(null);return;case"quit":if(c)c.quit();return}}var isu=v(()=>{jr();sou()});function usu(i,u,t){if(t)return i==="y"||i==="Y"?{type:"confirmYes"}:{type:"confirmNo"};if(u.upArrow||i==="k")return{type:"move",delta:-1};if(u.downArrow||i==="j")return{type:"move",delta:1};if(i==="s")return{type:"stop"};if(i==="d")return{type:"delete"};if(i==="o")return{type:"open"};if(i==="q"||u.ctrl===!0&&i==="c")return{type:"quit"};return null}var tsu={};gi(tsu,{LinkApp:()=>zm0});import{Box as ME,Text as w4,useInput as bm0}from"ink";import{useSyncExternalStore as Qm0}from"react";import{jsx as Zf,jsxs as Cn}from"react/jsx-runtime";function Mm0(i,u){if(u)return{color:"yellow",text:"\u25CC Removing\u2026"};if(i.status==="ready")return{color:"green",text:"\u25CF Live"};if(i.status==="spawning")return{color:"yellow",text:"\u25CC Starting\u2026"};if(i.status==="stopped")return{color:"gray",text:"\u25A0 Stopped"};if(i.status==="missing")return{color:"yellow",text:"\u25A1 Missing"};if(i.status==="merged")return{color:"cyan",text:"\u2713 Merged"};if(i.status==="invalid")return{color:"red",text:"\u2717 Invalid"};if(i.status==="failed")return{color:"red",text:`\u2717 Failed: ${i.error??"failed"}`};return{color:"red",text:`\u2717 Error: ${i.error??""}`}}function zm0(){let i=Qm0(cMi,Cr),u=[...i.sandboxes.values()].sort((l,E)=>l.handle.localeCompare(E.handle)),t=YK(i.sandboxes),f=i.selectedHandle!==null&&t.includes(i.selectedHandle)?i.selectedHandle:t[0]??null;return bm0((l,E)=>{let c=usu(l,E,i.pendingConfirm!==null);if(c!==null)pou(c)}),Cn(ME,{flexDirection:"column",children:[Zf($1i,{version:kK.version}),Zf(ME,{marginBottom:1,children:Zf(w4,{dimColor:!0,children:"\u2500".repeat(80)})}),Zf(ME,{children:i.cluster==="linked"?Cn(w4,{color:"green",children:["\u2713 Connected to ",i.clusterUrl??"deco"]}):i.cluster==="connecting"?Cn(w4,{color:"yellow",children:["\u25CC Connecting to ",i.clusterUrl??"deco","\u2026"]}):Cn(w4,{color:"red",children:["\u2717 Disconnected from ",i.clusterUrl??"deco"]})}),Zf(ME,{children:i.ingressUrl?Cn(w4,{color:"green",children:["\u2713 Serving at ",i.ingressUrl]}):Zf(w4,{dimColor:!0,children:"\u25CC Starting local server\u2026"})}),Zf(ME,{marginBottom:1,children:Zf(w4,{dimColor:!0,children:`${"Computer".padEnd(16)}${i.machine??"this computer"} \xB7 ${u.length} of ${i.cap} previews`})}),u.length===0?Zf(w4,{dimColor:!0,children:"No previews running yet."}):Cn(ME,{flexDirection:"column",children:[Cn(ME,{children:[Zf(ME,{width:2,flexShrink:0}),Zf(ME,{width:jK.project,flexShrink:0,marginRight:1,children:Zf(w4,{dimColor:!0,wrap:"truncate-end",children:"PROJECT"})}),Zf(ME,{width:jK.branch,flexShrink:0,marginRight:1,children:Zf(w4,{dimColor:!0,wrap:"truncate-end",children:"BRANCH"})}),Zf(ME,{width:jK.status,flexShrink:0,marginRight:1,children:Zf(w4,{dimColor:!0,wrap:"truncate-end",children:"STATUS"})}),Zf(ME,{flexGrow:1,children:Zf(w4,{dimColor:!0,wrap:"truncate-end",children:"PREVIEW URL"})})]}),u.map((l)=>{let E=Mm0(l,i.removingHandles.has(l.handle)),c=l.handle===f;return Cn(ME,{children:[Zf(ME,{width:2,flexShrink:0,children:Zf(w4,{color:"cyan",children:c?"\u203A":" "})}),Zf(ME,{width:jK.project,flexShrink:0,marginRight:1,children:Zf(w4,{bold:c,wrap:"truncate-end",children:l.projectName??l.handle})}),Zf(ME,{width:jK.branch,flexShrink:0,marginRight:1,children:Zf(w4,{bold:c,wrap:"truncate-end",children:l.branch??"\u2014"})}),Zf(ME,{width:jK.status,flexShrink:0,marginRight:1,children:Zf(w4,{color:E.color,bold:c,wrap:"truncate-end",children:E.text})}),Zf(ME,{flexGrow:1,children:Zf(w4,{dimColor:!0,wrap:"truncate-end",children:l.previewUrl??"\u2014"})})]},l.handle)})]}),i.daemonError?Zf(ME,{marginTop:1,children:Cn(w4,{color:"red",children:["\u26A0 ",i.daemonError]})}):null,i.logPath?Zf(ME,{marginTop:1,children:Cn(w4,{dimColor:!0,children:["Logs: ",i.logPath]})}):null,i.pendingConfirm?Zf(ME,{marginTop:1,children:Zf(w4,{color:"yellow",children:qou(i.pendingConfirm)})}):null,i.actionError?Zf(ME,{marginTop:1,children:Cn(w4,{color:"red",children:["\u2717 ",i.actionError]})}):null,Zf(ME,{marginTop:1,children:Zf(w4,{dimColor:!0,children:"\u2191\u2193 move \xB7 s stop \xB7 d delete \xB7 o open \xB7 q quit"})})]})}var jK;var fsu=v(()=>{N1i();EMi();isu();jr();jK={project:18,branch:22,status:14}});var lsu={};gi(lsu,{runLinkCommand:()=>sm0});import{closeSync as rm0,mkdirSync as qm0,openSync as Vm0,writeSync as mm0}from"fs";import{homedir as em0}from"os";import{join as wMi}from"path";function am0(i,u){let t={log:console.log,warn:console.warn,error:console.error},f=(l)=>{if(u===void 0)return;try{mm0(u,`${uMi(l)}
 `)}catch{}};return console.log=(...l)=>f(l),console.warn=(...l)=>f(l),console.error=(...l)=>{f(l),i(uMi(l))},()=>{console.log=t.log,console.warn=t.warn,console.error=t.error}}async function om0(i,u){let t;try{t=await fetch(`${i}/api/links/me`,{headers:{authorization:`Bearer ${u}`},signal:AbortSignal.timeout(1e4)})}catch{return}if(t.status===401||t.status===403)throw Error(`Authentication rejected by ${i} \u2014 the session token was not accepted. `+`Run \`deco auth login --target ${i}\` and try again.`)}async function sm0(i={}){let u=i.port??5174,t=i.dataDir??process.env.DATA_DIR??process.env.DECOCMS_HOME??wMi(em0(),"deco"),f=i.clusterBaseUrl??process.env.STUDIO_CLUSTER_URL??process.env.MESH_CLUSTER_URL??"https://studio.decocms.com",l,E,c,_=()=>{if(c===void 0)return;try{c.close()}catch{}finally{c=void 0}};try{if(await tMi(u,"127.0.0.1"))throw new lMi(u);let T=wMi(t,"sandboxes");c=v1i({path:D1i(t),managedSandboxRoot:T});let d=await d4i({dataDir:t,intent:"Link",target:f});if(process.env.DECOCMS_LINK_MANAGED!=="1")await om0(f,d.accessToken);let w=c.reconcile();if(i.prune){let D=c.prune({missing:!0,merged:!0});if(!i.tui)console.log(`Pruned local sandboxes: removed ${D.removed.length}, skipped ${D.skipped.length}.`);w=c.reconcile()}let n;if(i.tui){let{render:D}=await import("ink"),{createElement:N}=await import("react"),{LinkApp:S}=await Promise.resolve().then(() => (fsu(),tsu)),{pushSandboxEvent:O,setCluster:$,setClusterUrl:P,setDaemonError:g,setIngress:U,setLogPath:x,setMachine:F,setPersistedSandboxes:y}=await Promise.resolve().then(() => (jr(),dMi));qm0(t,{recursive:!0});let L=wMi(t,"link.log");E=Vm0(L,"w"),x(L),y(w),P(f),$("connecting"),n={onEvent:(M)=>O(M),onIngress:(M)=>U(M,`http://127.0.0.1:${M}`),onCluster:(M)=>$(M),onMachine:(M)=>F(M)},l=am0(g,E),D(N(S),{patchConsole:!1})}else if(i.banner!==!1){let{printBanner:D}=await Promise.resolve().then(() => (CK(),kr));D(i.version??"0.0.0")}_();let h=process.env.DECOCMS_LINK_MANAGED!=="1",A=await Hou({port:u,clusterBaseUrl:f,dataDir:t,session:d,monitor:n,logFd:E,perSandboxLogs:h,hotReload:i.hotReload});if(i.tui){let{setLinkActions:D}=await Promise.resolve().then(() => (jr(),dMi));D({stopSandbox:A.stopSandbox,removeSandbox:A.removeSandbox,inspectSandbox:A.inspectSandbox,quit:A.stop})}return await A.stopped}catch(T){return l?.(),console.error(Wou(T)?bou(u):T instanceof Error?T.message:String(T)),1}finally{if(l?.(),E!==void 0)try{rm0(E)}catch{}_()}}var Esu=v(()=>{YWi();Xou();fMi();Qou();iMi()});var NMi={};gi(NMi,{resolveDevLinkClusterUrl:()=>te0,populateDevLinkToxiProxy:()=>nsu,isDevLinkToxiProxyEnabled:()=>ue0,ensureDevLinkToxiProxy:()=>_e0,buildDevLinkToxiProxyConfig:()=>dsu,DEV_LINK_TOXIPROXY_SERVICE_NAME:()=>_su,DEV_LINK_TOXIPROXY_PROXY_NAME:()=>Tsu});function ue0(i=process.env){return i.DECO_DEV_LINK_TOXIPROXY==="1"}function nMi(i,u){if(!Number.isInteger(i)||i<1||i>65535)throw Error(`${u} must be an integer port in 1..65535`);return i}function dsu(i){let u=new URL(i.serverUrl);if(u.protocol!=="http:")throw Error("DECO_DEV_LINK_TOXIPROXY only supports http local Studio URLs");let t=nMi(i.apiPort,"apiPort"),f=nMi(i.listenPort,"listenPort");if(u.port.length===0)throw Error("serverUrl must include an explicit valid port");let l=nMi(Number.parseInt(u.port,10),"upstreamPort"),E=`http://127.0.0.1:${l}`,c=`http://127.0.0.1:${f}`;return{serviceName:_su,proxyName:Tsu,apiUrl:`http://127.0.0.1:${t}`,listen:`0.0.0.0:${f}`,upstream:`host.docker.internal:${l}`,publicTargetUrl:E,clusterUrl:c,logLine:`[dev-link-toxiproxy] ready: ${c} -> ${E}`}}function te0(i){return i.toxiproxy?.clusterUrl??i.serverUrl}async function hMi(i,u,t){if(i.ok)return;let f=await i.text();throw Error(`ToxiProxy ${u} failed for ${t}: status=${i.status} statusText=${i.statusText} body=${f}`)}function vMi(i){if(i instanceof Error)return i.name==="Error"?i.message:`${i.name}: ${i.message}`;return String(i)}function wsu(i){if(!(i instanceof Error))return!1;if(i.name==="TimeoutError")return!0;return wsu(i.cause)}async function AMi(i,u,t,f){try{return await i(t,f)}catch(l){throw Error(`ToxiProxy ${u} failed for ${t}: ${vMi(l)}`,{cause:l})}}async function nsu(i,u=fetch){let t=`${i.apiUrl}/reset`,f=await AMi(u,"reset",t,{method:"POST"});await hMi(f,"reset",t);let l=`${i.apiUrl}/populate`,E=await AMi(u,"populate",l,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify([{name:i.proxyName,listen:i.listen,upstream:i.upstream,enabled:!0}])});await hMi(E,"populate",l)}async function fe0(i,u){let t=`${i.apiUrl}/version`;try{await OE(async()=>{let f=await AMi(u,"readiness check",t,{method:"GET",signal:AbortSignal.timeout(ie0)});await hMi(f,"readiness check",t)},{maxAttempts:pm0,minTimeout:csu,maxTimeout:csu,multiplier:1,jitter:0,isRetriable:(f)=>!wsu(f)})}catch(f){let l=f instanceof J1?f.cause:f;throw Error(`ToxiProxy API did not become ready at ${t}: ${vMi(l)}`,{cause:l})}}async function le0(i){if(i===null)return"";return await new Response(i).text()}async function DMi(i,u={}){let t=["docker",...i].join(" "),f=(()=>{try{return Bun.spawn(["docker",...i],{stdout:"ignore",stderr:"pipe"})}catch(_){throw Error(`Docker command failed to start (${t}): ${vMi(_)}`,{cause:_})}})(),[l,E]=await Promise.all([f.exited,le0(f.stderr)]);if(l===0||u.ignoreFailure===!0)return;let c=E.trim().length>0?`: ${E.trim()}`:"";throw Error(`Docker command failed (${t}) with exit ${l}${c}`)}async function Ee0(i,u){let t=`deco-dev-link-toxiproxy-${i}`;await DMi(["rm","-f",t],{ignoreFailure:!0}),await DMi(["run","--rm","-d","--name",t,"-p",`127.0.0.1:${i}:8474`,"-p",`127.0.0.1:${u}:${u}`,"ghcr.io/shopify/toxiproxy:2.12.0","-host=0.0.0.0"])}async function ce0(i,u){let t=`deco-dev-link-toxiproxy-${i}`;await DMi(["rm","-f",t],{ignoreFailure:!0})}async function _e0(i){let u=dsu(i),t=i.startDaemon??Ee0,f=i.stopDaemon??(i.startDaemon===void 0?ce0:void 0);await t(i.apiPort,i.listenPort);let l=i.fetchImpl??fetch;try{await fe0(u,l),await nsu(u,l)}catch(E){if(f!==void 0)try{await f(i.apiPort,i.listenPort)}catch{}throw E}return{config:u,stop:async()=>{if(f!==void 0)await f(i.apiPort,i.listenPort)}}}var _su="ToxiProxy",Tsu="dev_link_studio",pm0=20,csu=100,ie0=100;var SMi=v(()=>{Nl()});var hsu={};gi(hsu,{migrateBetterAuth:()=>OMi});import{getMigrations as Te0}from"better-auth/db";import{sso as de0}from"@better-auth/sso";import{organization as we0}from"@decocms/better-auth/plugins";import{admin as ne0,apiKey as he0,jwt as Ae0,magicLink as De0,mcp as ve0,openAPI as Ne0}from"better-auth/plugins";import{emailOTP as Se0}from"better-auth/plugins/email-otp";async function OMi(i){let t={database:mz(i||yS()),plugins:[we0({dynamicAccessControl:{enabled:!0,enableCustomResources:!0}}),ne0(),he0(),Ae0(),Ne0(),ve0({loginPage:"/login"}),de0(),De0({sendMagicLink:async()=>{}}),Se0({sendVerificationOTP:async()=>{}})]},{toBeAdded:f,toBeCreated:l,runMigrations:E}=await Te0(t);if(!f.length&&!l.length)return"up to date";return await E(),`${l.length+f.length} table(s) migrated`}var $Mi=v(()=>{M1()});var PMi={};gi(PMi,{up:()=>Oe0,down:()=>$e0});import{sql as gA}from"kysely";async function Oe0(i){await i.schema.createTable("connections").addColumn("id","text",(u)=>u.primaryKey()).addColumn("organizationId","text",(u)=>u.notNull().references("organization.id").onDelete("cascade")).addColumn("createdById","text",(u)=>u.notNull().references("user.id").onDelete("cascade")).addColumn("name","text",(u)=>u.notNull()).addColumn("description","text").addColumn("icon","text").addColumn("appName","text").addColumn("appId","text").addColumn("connectionType","text",(u)=>u.notNull()).addColumn("connectionUrl","text",(u)=>u.notNull()).addColumn("connectionToken","text").addColumn("connectionHeaders","text").addColumn("oauthConfig","text").addColumn("metadata","text").addColumn("tools","text").addColumn("bindings","text").addColumn("status","text",(u)=>u.notNull().defaultTo("active")).addColumn("createdAt","text",(u)=>u.notNull().defaultTo(gA`CURRENT_TIMESTAMP`)).addColumn("updatedAt","text",(u)=>u.notNull().defaultTo(gA`CURRENT_TIMESTAMP`)).execute(),await i.schema.createTable("api_keys").addColumn("id","text",(u)=>u.primaryKey()).addColumn("userId","text",(u)=>u.notNull().references("user.id").onDelete("cascade")).addColumn("name","text",(u)=>u.notNull()).addColumn("hashedKey","text",(u)=>u.notNull().unique()).addColumn("permissions","text",(u)=>u.notNull()).addColumn("expiresAt","text").addColumn("remaining","integer").addColumn("metadata","text").addColumn("createdAt","text",(u)=>u.notNull().defaultTo(gA`CURRENT_TIMESTAMP`)).addColumn("updatedAt","text",(u)=>u.notNull().defaultTo(gA`CURRENT_TIMESTAMP`)).execute(),await i.schema.createTable("audit_logs").addColumn("id","text",(u)=>u.primaryKey()).addColumn("organizationId","text").addColumn("userId","text",(u)=>u.references("user.id").onDelete("set null")).addColumn("connectionId","text",(u)=>u.references("connections.id").onDelete("set null")).addColumn("toolName","text",(u)=>u.notNull()).addColumn("allowed","integer",(u)=>u.notNull()).addColumn("duration","integer").addColumn("timestamp","text",(u)=>u.notNull().defaultTo(gA`CURRENT_TIMESTAMP`)).addColumn("requestMetadata","text").execute(),await i.schema.createTable("oauth_clients").addColumn("id","text",(u)=>u.primaryKey()).addColumn("clientId","text",(u)=>u.notNull().unique()).addColumn("clientSecret","text").addColumn("clientName","text",(u)=>u.notNull()).addColumn("redirectUris","text",(u)=>u.notNull()).addColumn("grantTypes","text",(u)=>u.notNull()).addColumn("scope","text").addColumn("clientUri","text").addColumn("logoUri","text").addColumn("createdAt","text",(u)=>u.notNull().defaultTo(gA`CURRENT_TIMESTAMP`)).execute(),await i.schema.createTable("oauth_authorization_codes").addColumn("code","text",(u)=>u.primaryKey()).addColumn("clientId","text",(u)=>u.notNull().references("oauth_clients.clientId").onDelete("cascade")).addColumn("userId","text",(u)=>u.notNull().references("user.id").onDelete("cascade")).addColumn("redirectUri","text",(u)=>u.notNull()).addColumn("scope","text").addColumn("codeChallenge","text").addColumn("codeChallengeMethod","text").addColumn("expiresAt","text",(u)=>u.notNull()).addColumn("createdAt","text",(u)=>u.notNull().defaultTo(gA`CURRENT_TIMESTAMP`)).execute(),await i.schema.createTable("oauth_refresh_tokens").addColumn("token","text",(u)=>u.primaryKey()).addColumn("clientId","text",(u)=>u.notNull().references("oauth_clients.clientId").onDelete("cascade")).addColumn("userId","text",(u)=>u.notNull().references("user.id").onDelete("cascade")).addColumn("scope","text").addColumn("expiresAt","text").addColumn("createdAt","text",(u)=>u.notNull().defaultTo(gA`CURRENT_TIMESTAMP`)).execute(),await i.schema.createTable("downstream_tokens").addColumn("id","text",(u)=>u.primaryKey()).addColumn("connectionId","text",(u)=>u.notNull().references("connections.id").onDelete("cascade")).addColumn("userId","text",(u)=>u.references("user.id").onDelete("cascade")).addColumn("accessToken","text",(u)=>u.notNull()).addColumn("refreshToken","text").addColumn("scope","text").addColumn("expiresAt","text").addColumn("createdAt","text",(u)=>u.notNull().defaultTo(gA`CURRENT_TIMESTAMP`)).addColumn("updatedAt","text",(u)=>u.notNull().defaultTo(gA`CURRENT_TIMESTAMP`)).execute(),await i.schema.createIndex("idx_connections_organizationId").on("connections").column("organizationId").execute(),await i.schema.createIndex("idx_audit_logs_organizationId").on("audit_logs").column("organizationId").execute(),await i.schema.createIndex("idx_audit_logs_userId").on("audit_logs").column("userId").execute(),await i.schema.createIndex("idx_audit_logs_timestamp").on("audit_logs").column("timestamp").execute()}async function $e0(i){await i.schema.dropTable("downstream_tokens").execute(),await i.schema.dropTable("oauth_refresh_tokens").execute(),await i.schema.dropTable("oauth_authorization_codes").execute(),await i.schema.dropTable("oauth_clients").execute(),await i.schema.dropTable("audit_logs").execute(),await i.schema.dropTable("api_keys").execute(),await i.schema.dropTable("connections").execute()}var Asu=()=>{};var gMi={};gi(gMi,{up:()=>Pe0,down:()=>ge0});import{sql as Dsu}from"kysely";async function Pe0(i){await i.schema.createTable("organization_settings").addColumn("organizationId","text",(u)=>u.primaryKey().references("organization.id").onDelete("cascade")).addColumn("modelsBindingConnectionId","text",(u)=>u.references("connections.id").onDelete("set null")).addColumn("createdAt","text",(u)=>u.notNull().defaultTo(Dsu`CURRENT_TIMESTAMP`)).addColumn("updatedAt","text",(u)=>u.notNull().defaultTo(Dsu`CURRENT_TIMESTAMP`)).execute()}async function ge0(i){await i.schema.dropTable("organization_settings").execute()}var vsu=()=>{};var UMi={};gi(UMi,{up:()=>Ue0,down:()=>Be0});async function Ue0(i){await i.schema.alterTable("connections").renameColumn("name","title").execute(),await i.schema.alterTable("connections").renameColumn("createdById","created_by").execute(),await i.schema.alterTable("connections").renameColumn("createdAt","created_at").execute(),await i.schema.alterTable("connections").renameColumn("updatedAt","updated_at").execute(),await i.schema.alterTable("connections").renameColumn("organizationId","organization_id").execute(),await i.schema.alterTable("connections").renameColumn("connectionType","connection_type").execute(),await i.schema.alterTable("connections").renameColumn("connectionUrl","connection_url").execute(),await i.schema.alterTable("connections").renameColumn("connectionToken","connection_token").execute(),await i.schema.alterTable("connections").renameColumn("connectionHeaders","connection_headers").execute(),await i.schema.alterTable("connections").renameColumn("oauthConfig","oauth_config").execute(),await i.schema.alterTable("connections").renameColumn("appName","app_name").execute(),await i.schema.alterTable("connections").renameColumn("appId","app_id").execute()}async function Be0(i){await i.schema.alterTable("connections").renameColumn("title","name").execute(),await i.schema.alterTable("connections").renameColumn("created_by","createdById").execute(),await i.schema.alterTable("connections").renameColumn("created_at","createdAt").execute(),await i.schema.alterTable("connections").renameColumn("updated_at","updatedAt").execute(),await i.schema.alterTable("connections").renameColumn("organization_id","organizationId").execute(),await i.schema.alterTable("connections").renameColumn("connection_type","connectionType").execute(),await i.schema.alterTable("connections").renameColumn("connection_url","connectionUrl").execute(),await i.schema.alterTable("connections").renameColumn("connection_token","connectionToken").execute(),await i.schema.alterTable("connections").renameColumn("connection_headers","connectionHeaders").execute(),await i.schema.alterTable("connections").renameColumn("oauth_config","oauthConfig").execute(),await i.schema.alterTable("connections").renameColumn("app_name","appName").execute(),await i.schema.alterTable("connections").renameColumn("app_id","appId").execute()}var BMi={};gi(BMi,{up:()=>Ie0,down:()=>xe0});async function Ie0(i){await i.schema.createTable("organization_settings_new").addColumn("organizationId","text",(u)=>u.primaryKey().references("organization.id").onDelete("cascade")).addColumn("createdAt","text",(u)=>u.notNull()).addColumn("updatedAt","text",(u)=>u.notNull()).execute(),await i.insertInto("organization_settings_new").columns(["organizationId","createdAt","updatedAt"]).expression((u)=>u.selectFrom("organization_settings").select(["organizationId","createdAt","updatedAt"])).execute(),await i.schema.dropTable("organization_settings").execute(),await i.schema.alterTable("organization_settings_new").renameTo("organization_settings").execute()}async function xe0(i){await i.schema.createTable("organization_settings_new").addColumn("organizationId","text",(u)=>u.primaryKey().references("organization.id").onDelete("cascade")).addColumn("modelsBindingConnectionId","text",(u)=>u.references("connections.id").onDelete("set null")).addColumn("createdAt","text",(u)=>u.notNull()).addColumn("updatedAt","text",(u)=>u.notNull()).execute(),await i.insertInto("organization_settings_new").columns(["organizationId","modelsBindingConnectionId","createdAt","updatedAt"]).expression((u)=>u.selectFrom("organization_settings").select(["organizationId",u.val(null).as("modelsBindingConnectionId"),"createdAt","updatedAt"])).execute(),await i.schema.dropTable("organization_settings").execute(),await i.schema.alterTable("organization_settings_new").renameTo("organization_settings").execute()}var IMi={};gi(IMi,{up:()=>ye0,down:()=>Re0});async function ye0(i){await i.schema.alterTable("connections").addColumn("configuration_state","text").execute(),await i.schema.alterTable("connections").addColumn("configuration_scopes","text").execute()}async function Re0(i){await i.schema.alterTable("connections").dropColumn("configuration_state").execute(),await i.schema.alterTable("connections").dropColumn("configuration_scopes").execute()}var xMi={};gi(xMi,{up:()=>Le0,down:()=>Ze0});import{sql as Fe0}from"kysely";async function Le0(i){await i.schema.alterTable("organization_settings").addColumn("sidebar_items",Fe0`text`).execute()}async function Ze0(i){await i.schema.alterTable("organization_settings").dropColumn("sidebar_items").execute()}var Nsu=()=>{};var yMi={};gi(yMi,{up:()=>Ge0,down:()=>ke0});async function Ge0(i){await i.schema.createTable("monitoring_logs").addColumn("id","text",(u)=>u.primaryKey()).addColumn("organization_id","text",(u)=>u.notNull().references("organization.id").onDelete("cascade")).addColumn("connection_id","text",(u)=>u.notNull().references("connections.id").onDelete("cascade")).addColumn("connection_title","text",(u)=>u.notNull()).addColumn("tool_name","text",(u)=>u.notNull()).addColumn("input","text",(u)=>u.notNull()).addColumn("output","text",(u)=>u.notNull()).addColumn("is_error","integer",(u)=>u.notNull()).addColumn("error_message","text").addColumn("duration_ms","integer",(u)=>u.notNull()).addColumn("timestamp","text",(u)=>u.notNull()).addColumn("user_id","text").addColumn("request_id","text",(u)=>u.notNull()).execute(),await i.schema.createIndex("monitoring_logs_org_timestamp").on("monitoring_logs").columns(["organization_id","timestamp"]).execute(),await i.schema.createIndex("monitoring_logs_connection_timestamp").on("monitoring_logs").columns(["connection_id","timestamp"]).execute(),await i.schema.createIndex("monitoring_logs_is_error").on("monitoring_logs").columns(["organization_id","is_error","timestamp"]).execute()}async function ke0(i){await i.schema.dropIndex("monitoring_logs_is_error").execute(),await i.schema.dropIndex("monitoring_logs_connection_timestamp").execute(),await i.schema.dropIndex("monitoring_logs_org_timestamp").execute(),await i.schema.dropTable("monitoring_logs").execute()}var RMi={};gi(RMi,{up:()=>Ce0,down:()=>Ye0});import{sql as Kr}from"kysely";async function Ce0(i){await i.schema.createTable("events").addColumn("id","text",(u)=>u.primaryKey()).addColumn("organization_id","text",(u)=>u.notNull().references("organization.id").onDelete("cascade")).addColumn("type","text",(u)=>u.notNull()).addColumn("source","text",(u)=>u.notNull()).addColumn("specversion","text",(u)=>u.notNull().defaultTo("1.0")).addColumn("subject","text").addColumn("time","text",(u)=>u.notNull()).addColumn("datacontenttype","text",(u)=>u.notNull().defaultTo("application/json")).addColumn("dataschema","text").addColumn("data","text").addColumn("cron","varchar(255)").addColumn("status","text",(u)=>u.notNull().defaultTo("pending")).addColumn("attempts","integer",(u)=>u.notNull().defaultTo(0)).addColumn("last_error","text").addColumn("next_retry_at","text").addColumn("created_at","text",(u)=>u.notNull().defaultTo(Kr`CURRENT_TIMESTAMP`)).addColumn("updated_at","text",(u)=>u.notNull().defaultTo(Kr`CURRENT_TIMESTAMP`)).execute(),await i.schema.createTable("event_subscriptions").addColumn("id","text",(u)=>u.primaryKey()).addColumn("organization_id","text",(u)=>u.notNull().references("organization.id").onDelete("cascade")).addColumn("connection_id","text",(u)=>u.notNull().references("connections.id").onDelete("cascade")).addColumn("publisher","text").addColumn("event_type","text",(u)=>u.notNull()).addColumn("filter","text").addColumn("enabled","integer",(u)=>u.notNull().defaultTo(1)).addColumn("created_at","text",(u)=>u.notNull().defaultTo(Kr`CURRENT_TIMESTAMP`)).addColumn("updated_at","text",(u)=>u.notNull().defaultTo(Kr`CURRENT_TIMESTAMP`)).execute(),await i.schema.createTable("event_deliveries").addColumn("id","text",(u)=>u.primaryKey()).addColumn("event_id","text",(u)=>u.notNull()).addColumn("subscription_id","text",(u)=>u.notNull().references("event_subscriptions.id").onDelete("cascade")).addColumn("status","text",(u)=>u.notNull().defaultTo("pending")).addColumn("attempts","integer",(u)=>u.notNull().defaultTo(0)).addColumn("last_error","text").addColumn("delivered_at","text").addColumn("next_retry_at","text").addColumn("created_at","text",(u)=>u.notNull().defaultTo(Kr`CURRENT_TIMESTAMP`)).execute(),await i.schema.createIndex("idx_events_org_status").on("events").columns(["organization_id","status"]).execute(),await i.schema.createIndex("idx_events_source").on("events").columns(["source"]).execute(),await i.schema.createIndex("idx_events_type").on("events").columns(["type"]).execute(),await i.schema.createIndex("idx_events_retry").on("events").columns(["status","next_retry_at"]).execute(),await i.schema.createIndex("idx_subscriptions_connection").on("event_subscriptions").columns(["connection_id"]).execute(),await i.schema.createIndex("idx_subscriptions_type").on("event_subscriptions").columns(["event_type"]).execute(),await i.schema.createIndex("idx_subscriptions_org_enabled").on("event_subscriptions").columns(["organization_id","enabled"]).execute(),await i.schema.createIndex("idx_subscriptions_unique").on("event_subscriptions").columns(["connection_id","event_type","publisher","filter"]).unique().execute(),await i.schema.createIndex("idx_deliveries_event").on("event_deliveries").columns(["event_id"]).execute(),await i.schema.createIndex("idx_deliveries_subscription_status").on("event_deliveries").columns(["subscription_id","status"]).execute(),await i.schema.createIndex("idx_deliveries_retry").on("event_deliveries").columns(["status","next_retry_at"]).execute()}async function Ye0(i){await i.schema.dropIndex("idx_deliveries_retry").execute(),await i.schema.dropIndex("idx_deliveries_subscription_status").execute(),await i.schema.dropIndex("idx_deliveries_event").execute(),await i.schema.dropIndex("idx_subscriptions_unique").execute(),await i.schema.dropIndex("idx_subscriptions_org_enabled").execute(),await i.schema.dropIndex("idx_subscriptions_type").execute(),await i.schema.dropIndex("idx_subscriptions_connection").execute(),await i.schema.dropIndex("idx_events_retry").execute(),await i.schema.dropIndex("idx_events_type").execute(),await i.schema.dropIndex("idx_events_source").execute(),await i.schema.dropIndex("idx_events_org_status").execute(),await i.schema.dropTable("event_deliveries").execute(),await i.schema.dropTable("event_subscriptions").execute(),await i.schema.dropTable("events").execute()}var Ssu=()=>{};var FMi={};gi(FMi,{up:()=>Ke0,down:()=>He0});import{sql as je0}from"kysely";async function Ke0(i){await i.schema.dropTable("audit_logs").ifExists().execute()}async function He0(i){await i.schema.createTable("audit_logs").ifNotExists().addColumn("id","text",(u)=>u.primaryKey()).addColumn("organizationId","text").addColumn("userId","text",(u)=>u.references("user.id").onDelete("set null")).addColumn("connectionId","text",(u)=>u.references("connections.id").onDelete("set null")).addColumn("toolName","text",(u)=>u.notNull()).addColumn("allowed","integer",(u)=>u.notNull()).addColumn("duration","integer").addColumn("timestamp","text",(u)=>u.notNull().defaultTo(je0`CURRENT_TIMESTAMP`)).addColumn("requestMetadata","text").execute(),await i.schema.createIndex("idx_audit_logs_organizationId").on("audit_logs").column("organizationId").execute(),await i.schema.createIndex("idx_audit_logs_userId").on("audit_logs").column("userId").execute(),await i.schema.createIndex("idx_audit_logs_timestamp").on("audit_logs").column("timestamp").execute()}var Osu=()=>{};var LMi={};gi(LMi,{up:()=>Xe0,down:()=>Je0});import{sql as B1i}from"kysely";async function Xe0(i){await i.schema.createTable("gateways").addColumn("id","text",(u)=>u.primaryKey()).addColumn("organization_id","text",(u)=>u.notNull().references("organization.id").onDelete("cascade")).addColumn("title","text",(u)=>u.notNull()).addColumn("description","text").addColumn("tool_selection_strategy","text").addColumn("status","text",(u)=>u.notNull().defaultTo("active")).addColumn("is_default","integer",(u)=>u.notNull().defaultTo(0)).addColumn("created_at","text",(u)=>u.notNull().defaultTo(B1i`CURRENT_TIMESTAMP`)).addColumn("updated_at","text",(u)=>u.notNull().defaultTo(B1i`CURRENT_TIMESTAMP`)).addColumn("created_by","text",(u)=>u.notNull().references("user.id").onDelete("cascade")).addColumn("updated_by","text").execute(),await i.schema.createTable("gateway_connections").addColumn("id","text",(u)=>u.primaryKey()).addColumn("gateway_id","text",(u)=>u.notNull().references("gateways.id").onDelete("cascade")).addColumn("connection_id","text",(u)=>u.notNull().references("connections.id").onDelete("cascade")).addColumn("selected_tools","text").addColumn("created_at","text",(u)=>u.notNull().defaultTo(B1i`CURRENT_TIMESTAMP`)).execute(),await i.schema.createIndex("idx_gateways_org").on("gateways").columns(["organization_id"]).execute(),await i.schema.createIndex("idx_gateways_org_status").on("gateways").columns(["organization_id","status"]).execute(),await B1i`CREATE UNIQUE INDEX idx_gateways_default_per_org ON gateways (organization_id) WHERE is_default = 1`.execute(i),await i.schema.createIndex("idx_gateway_connections_gateway").on("gateway_connections").columns(["gateway_id"]).execute(),await i.schema.createIndex("idx_gateway_connections_connection").on("gateway_connections").columns(["connection_id"]).execute(),await i.schema.createIndex("idx_gateway_connections_unique").on("gateway_connections").columns(["gateway_id","connection_id"]).unique().execute()}async function Je0(i){await i.schema.dropIndex("idx_gateway_connections_unique").execute(),await i.schema.dropIndex("idx_gateway_connections_connection").execute(),await i.schema.dropIndex("idx_gateway_connections_gateway").execute(),await i.schema.dropIndex("idx_gateways_default_per_org").execute(),await i.schema.dropIndex("idx_gateways_org_status").execute(),await i.schema.dropIndex("idx_gateways_org").execute(),await i.schema.dropTable("gateway_connections").execute(),await i.schema.dropTable("gateways").execute()}var $su=()=>{};var ZMi={};gi(ZMi,{up:()=>We0,down:()=>be0});async function We0(i){await i.schema.alterTable("gateways").addColumn("icon","text").execute()}async function be0(i){await i.schema.alterTable("gateways").dropColumn("icon").execute()}var GMi={};gi(GMi,{up:()=>Qe0,down:()=>Me0});import{sql as I1i}from"kysely";async function Qe0(i){await i.schema.alterTable("gateways").addColumn("tool_selection_mode","text",(u)=>u.notNull().defaultTo("inclusion")).execute(),await I1i`
     UPDATE gateways
     SET tool_selection_mode = CASE
@@ -92785,7 +92785,7 @@ conversation.
 
 `);return new nni({connections:[i],superUser:t,mcpListCache:h4()??void 0,listTimeoutMs:f?.listTimeoutMs,instructions:E},u)}var eJ=v(()=>{Z0();nd();Jv();kgt();Jgt()});var dgt={};gi(dgt,{clientFromConnection:()=>D4});async function D4(i,u,t=!1){if(i.connection_type==="VIRTUAL")return bgt(i,u,t);return Igt(i,u,t)}var ce=v(()=>{xgt();eJ()});async function dfu(i,u,t){let f=new AbortController,l,E=new Promise((_,T)=>{l=setTimeout(()=>{f.abort(),T(new Mgt(i.id,t))},t)}),c=(async()=>{let _=await D4(i,u,!0);try{return(await _.listTools(void 0,{timeout:t,signal:f.signal})).tools}finally{await _.close().catch(()=>{})}})();c.catch(()=>{});try{return await Promise.race([c,E])}finally{if(l)clearTimeout(l)}}var Mgt;var zgt=v(()=>{ce();Mgt=class Mgt extends Error{constructor(i,u){super(`listTools timed out after ${u}ms for connection ${i}`);this.name="ListToolsTimeoutError"}}});function vni(i){return(u)=>{if(u instanceof ku&&u.code===Wu.MethodNotFound)return i;throw u}}var rgt=v(()=>{n4()});function Nni(i,u,t){let f=l$(i,u,t,h4()??void 0),l=fg(f,{name:"studio-mcp-server",version:"1.0.0"},{capabilities:PZf,toolCallTimeoutMs:$H});l.server.setRequestHandler(sS,async()=>{return await f.listResources().catch(vni({resources:[]}))}),l.server.setRequestHandler(pS,async()=>{return await f.listResourceTemplates().catch(vni({resourceTemplates:[]}))}),l.server.setRequestHandler(iO,async()=>{return await f.listPrompts().catch(vni({prompts:[]}))});let E=l.close.bind(l);return l.close=async()=>{await E(),await f.close().catch(()=>{})},l}var PZf;var qgt=v(()=>{nT();n4();Ee();nd();rgt();PZf={tools:{},resources:{},prompts:{}}});var Qv=v(()=>{ce();zgt();qgt()});function ra(i,u,t){if(u.some((f)=>f!=="*"&&f.startsWith("SELF::"))&&i.SELF===void 0)i.SELF={value:`${t}_self`}}function qa(i,u){let t=new Map;for(let f of u){if(f==="*")continue;let[l,E]=w6i(f);if(!gZf.has(E))continue;let c=XV(l,i);if(typeof c!=="object"||c===null||!("value"in c))continue;let _=c.value;if(typeof _!=="string")continue;t.set(`${_}:${E}`,{targetConnectionId:_,scope:E})}return[...t.values()]}async function Va(i,u,t,f){for(let E of u){if(E==="*")continue;let[c]=w6i(E),_=XV(c,i);if(_===void 0||_===null)throw Error(`Scope references key "${c}" but it's not present in state`)}let l=pnt(i,u);for(let E of l){if(E.endsWith("_self"))continue;let c=await f.storage.connections.findById(E);if(!c||c.organization_id!==t)throw Error(`Referenced connection not found: ${E}`);try{await f.access.check(E)}catch(_){throw Error(`Access denied to referenced connection: ${E}. ${_.message}`)}}}var gZf;var wfu=v(()=>{$si();A6i();gZf=new Set([n6i,h6i])});import{z as Vgt}from"zod";var UZf,BZf,nfu;var mgt=v(()=>{Jl();uu();jt();nd();Qv();wfu();GV();KA();UZf=Vgt.object({data:Dci.describe("Data for the new connection (id is auto-generated if not provided)")}),BZf=Vgt.object({item:w_.describe("The created connection entity")}),nfu=p({name:"COLLECTION_CONNECTIONS_CREATE",description:"Create a new MCP connection. Auto-fetches and caches the server's tool list.",annotations:{title:"Create Connection",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!1,openWorldHint:!1},inputSchema:UZf,outputSchema:BZf,handler:async(i,u)=>{$i(u);let t=Si(u);await u.access.check();let f=Cu(u);if(!f)throw Error("User ID required to create connection");let l={...i.data,organization_id:t.id,created_by:f};if(l.id){if((await u.storage.connections.findById(l.id))?.organization_id===t.id)throw Error("Connection already exists in organization")}if(l.connection_type==="VIRTUAL"){let n=iH(l.connection_url);if(!n)throw Error("VIRTUAL connection requires connection_url in format: virtual://$virtual_mcp_id");let h=await u.storage.virtualMcps.findById(n);if(!h)throw Error(`Virtual MCP not found: ${n}`);if(h.organization_id!==t.id)throw Error("Virtual MCP does not belong to the current organization");l.connection_url=uH(n)}if(l.connection_type==="STDIO"&&!_u().localMode)throw Error("STDIO connections are only available in local mode (--local-mode).");let E=await xO({id:`pending-${Date.now()}`,title:l.title,connection_type:l.connection_type,connection_url:l.connection_url,connection_token:l.connection_token,connection_headers:l.connection_headers}).catch(()=>null),c=E?.tools?.length?E.tools:null,_=E?.scopes?.length?E.scopes:l.configuration_scopes??null,T=l.configuration_state??null;if(T&&_?.length)ra(T,_,t.id),await Va(T,_,t.id,u);let d=await u.storage.connections.createNew({...l,tools:null,configuration_state:T,configuration_scopes:_}),w=T&&_?.length?qa(T,_):[];if(w.length>0){let n;try{await u.storage.connectionCredentialVault.replaceGrantsForSubject({organizationId:t.id,subjectConnectionId:d.id,createdBy:f,grants:w});let{plaintextToken:h,record:A}=await u.storage.connectionCredentialVault.createOrRotateWorkloadToken({organizationId:t.id,subjectConnectionId:d.id});n=A.id,await(await D4(d,u,!1)).callTool({name:"ON_MCP_CONFIGURATION",arguments:{state:T,scopes:_,firstRun:!0,vault:{baseUrl:u.baseUrl,org:t.slug??t.id,subjectConnectionId:d.id,token:h}}})}catch(h){if(n)await u.storage.connectionCredentialVault.revokeWorkloadToken({organizationId:t.id,subjectConnectionId:d.id,tokenId:n});throw await u.storage.connections.delete(d.id),h}}if(c)h4()?.set("tools",d.id,c).catch(()=>{});return mu.capture({distinctId:f,event:"connection_created",groups:{organization:t.id},properties:{connection_id:d.id,connection_type:d.connection_type,app_name:d.app_name??null,organization_id:t.id,tools_count:c?.length??0}}),{item:d}}})});import{z as Jw}from"zod/v4";import{z as egt}from"zod/v4";import{z as Sni}from"zod/v4";import{z as D3}from"zod/v4";import{z as RZf}from"zod/v4";import{z as N8}from"zod/v4";import{z as v3}from"zod/v4";import{z as uc}from"zod/v4";import{z as agt}from"zod/v4";import{z as Pni}from"zod/v4";import{z as aZf}from"zod/v4";import{z as ogt}from"zod/v4";import{z as Oni}from"zod/v4";import{z as EGf}from"zod/v4";function ma(i,u){if(i===u)return!0;if(i==null||u==null)return i===u;if(typeof i!==typeof u)return!1;if(Array.isArray(i)&&Array.isArray(u)){if(i.length!==u.length)return!1;return i.every((t,f)=>ma(t,u[f]))}if(typeof i==="object"&&typeof u==="object"){let t=Object.keys(i),f=Object.keys(u);if(t.length!==f.length)return!1;return t.every((l)=>f.includes(l)&&ma(i[l],u[l]))}return!1}function VZf(){return(i)=>{if(!Array.isArray(i))return!0;let u=[];return i.every((t)=>{if(u.some((l)=>ma(t,l)))return!1;return u.push(t),!0})}}function $ni(i,u){return i.safeParse(u).success}function Yc(i){if(typeof i==="boolean")return i?Jw.any():Jw.never();let u={};for(let l of dGf)l.apply(u,i);let t=[];if(u.string!==!1)t.push(u.string||Jw.string());if(u.number!==!1)t.push(u.number||Jw.number());if(u.boolean!==!1)t.push(u.boolean||Jw.boolean());if(u.null!==!1)t.push(u.null||Jw.null());if(u.array!==!1)t.push(u.array||Jw.array(Jw.any()));if(u.tuple!==!1&&u.tuple!==void 0)t.push(u.tuple);if(u.object!==!1)if(u.object)t.push(u.object);else{let l=Jw.custom((E)=>{return typeof E==="object"&&E!==null&&!Array.isArray(E)},"Must be an object, not an array");t.push(l)}if(u.file!==!1&&u.file!==void 0)t.push(u.file);let f;if(t.length===0)f=Jw.never();else if(t.length===1)f=t[0];else if(!Object.keys(i).some((E)=>E!=="$schema"&&E!=="title"&&E!=="description"))f=Jw.any();else f=Jw.union(t);for(let l of wGf)f=l.apply(f,i);return f}var IZf=class{apply(i,u){if(!u.type)return;let t=Array.isArray(u.type)?u.type:[u.type],f=new Set(t);if(!f.has("string"))i.string=!1;if(!f.has("number")&&!f.has("integer"))i.number=!1;if(!f.has("boolean"))i.boolean=!1;if(!f.has("null"))i.null=!1;if(!f.has("array"))i.array=!1;if(!f.has("object"))i.object=!1;if(f.has("integer")&&i.number!==!1){let l=i.number||egt.number();if(l instanceof egt.ZodNumber)i.number=l.int()}}},xZf=class{apply(i,u){if(u.const===void 0)return;let t=u.const;if(i.string=!1,i.number=!1,i.boolean=!1,i.null=!1,i.array=!1,i.object=!1,typeof t==="string")i.string=Sni.literal(t);else if(typeof t==="number")i.number=Sni.literal(t);else if(typeof t==="boolean")i.boolean=Sni.literal(t);else if(t===null)i.null=Sni.null();else if(Array.isArray(t))i.array=void 0;else if(typeof t==="object")i.object=void 0}},yZf=class{apply(i,u){if(!u.enum)return;if(u.enum.length===0){if(!u.type)i.string=!1,i.number=!1,i.boolean=!1,i.null=!1,i.array=!1,i.object=!1;return}let t={string:u.enum.filter((f)=>typeof f==="string"),number:u.enum.filter((f)=>typeof f==="number"),boolean:u.enum.filter((f)=>typeof f==="boolean"),null:u.enum.filter((f)=>f===null),array:u.enum.filter((f)=>Array.isArray(f)),object:u.enum.filter((f)=>typeof f==="object"&&f!==null&&!Array.isArray(f))};i.string=this.createTypeSchema(t.string,"string"),i.number=this.createTypeSchema(t.number,"number"),i.boolean=this.createTypeSchema(t.boolean,"boolean"),i.null=t.null.length>0?D3.null():!1,i.array=t.array.length>0?void 0:!1,i.object=t.object.length>0?void 0:!1}createTypeSchema(i,u){if(i.length===0)return!1;if(i.length===1)return D3.literal(i[0]);if(u==="string")return D3.enum(i);if(u==="number"){let[t,f,...l]=i;return D3.union([D3.literal(t),D3.literal(f),...l.map((E)=>D3.literal(E))])}if(u==="boolean")return D3.union([D3.literal(!0),D3.literal(!1)]);return!1}},FZf=class{apply(i,u){let t=u;if(t.type==="string"&&t.format==="binary"&&t.contentEncoding==="binary"){let f=RZf.file();if(t.minLength!==void 0)f=f.min(t.minLength);if(t.maxLength!==void 0)f=f.max(t.maxLength);if(t.contentMediaType!==void 0)f=f.mime(t.contentMediaType);i.file=f,i.string=!1}}},LZf=class{apply(i,u){let t=u;if(u.type===void 0&&(t.minLength!==void 0||t.maxLength!==void 0||t.pattern!==void 0)){if(i.string===void 0)i.string=N8.string()}}},ZZf=class{apply(i,u){let t=u;if(t.minLength===void 0)return;if(i.string!==!1){let f=i.string||N8.string();if(f instanceof N8.ZodString)i.string=f.refine((l)=>{return Array.from(l).length>=t.minLength},{message:`String must be at least ${t.minLength} characters long`})}}},GZf=class{apply(i,u){let t=u;if(t.maxLength===void 0)return;if(i.string!==!1){let f=i.string||N8.string();if(f instanceof N8.ZodString)i.string=f.refine((l)=>{return Array.from(l).length<=t.maxLength},{message:`String must be at most ${t.maxLength} characters long`})}}},kZf=class{apply(i,u){let t=u;if(!t.pattern)return;if(i.string!==!1){let f=i.string||N8.string();if(f instanceof N8.ZodString){let l=new RegExp(t.pattern);i.string=f.regex(l)}}}},CZf=class{apply(i,u){let t=u;if(t.minimum===void 0)return;if(i.number!==!1){let f=i.number||v3.number();if(f instanceof v3.ZodNumber)i.number=f.min(t.minimum)}}},YZf=class{apply(i,u){let t=u;if(t.maximum===void 0)return;if(i.number!==!1){let f=i.number||v3.number();if(f instanceof v3.ZodNumber)i.number=f.max(t.maximum)}}},jZf=class{apply(i,u){let t=u;if(t.exclusiveMinimum===void 0)return;if(i.number!==!1){let f=i.number||v3.number();if(f instanceof v3.ZodNumber)if(typeof t.exclusiveMinimum==="number")i.number=f.gt(t.exclusiveMinimum);else i.number=!1}}},KZf=class{apply(i,u){let t=u;if(t.exclusiveMaximum===void 0)return;if(i.number!==!1){let f=i.number||v3.number();if(f instanceof v3.ZodNumber)if(typeof t.exclusiveMaximum==="number")i.number=f.lt(t.exclusiveMaximum);else i.number=!1}}},HZf=class{apply(i,u){let t=u;if(t.multipleOf===void 0)return;if(i.number!==!1){let f=i.number||v3.number();if(f instanceof v3.ZodNumber)i.number=f.refine((l)=>{if(t.multipleOf===0)return!1;let E=l/t.multipleOf,c=Math.round(E),_=Math.min(Math.abs(l)*Number.EPSILON*10,Math.abs(t.multipleOf)*Number.EPSILON*10);return Math.abs(E-c)<=_/Math.abs(t.multipleOf)},{message:`Must be a multiple of ${t.multipleOf}`})}}},XZf=class{apply(i,u){let t=u;if(u.type===void 0&&(t.minItems!==void 0||t.maxItems!==void 0||t.items!==void 0||t.prefixItems!==void 0)){if(i.array===void 0)i.array=uc.array(uc.any())}}},JZf=class{apply(i,u){let t=u;if(t.minItems===void 0)return;if(i.array!==!1)i.array=(i.array||uc.array(uc.any())).min(t.minItems)}},WZf=class{apply(i,u){let t=u;if(t.maxItems===void 0)return;if(i.array!==!1)i.array=(i.array||uc.array(uc.any())).max(t.maxItems)}},bZf=class{apply(i,u){let t=u;if(i.array===!1)return;if(Array.isArray(t.items))i.array=i.array||uc.array(uc.any());else if(t.items&&typeof t.items!=="boolean"&&!t.prefixItems){let f=Yc(t.items),l=uc.array(f);if(i.array&&i.array instanceof uc.ZodArray){let E=i.array._def;if(E.checks)E.checks.forEach((c)=>{if(c._zod&&c._zod.def){let _=c._zod.def;if(_.check==="min_length"&&_.minimum!==void 0)l=l.min(_.minimum);else if(_.check==="max_length"&&_.maximum!==void 0)l=l.max(_.maximum)}})}i.array=l}else if(typeof t.items==="boolean"&&t.items===!1)if(!t.prefixItems)i.array=uc.array(uc.any()).max(0);else i.array=i.array||uc.array(uc.any());else if(typeof t.items==="boolean"&&t.items===!0)i.array=i.array||uc.array(uc.any());else if(t.prefixItems)i.array=i.array||uc.array(uc.any())}},QZf=class{apply(i,u){if(u.type!=="array")return;let t=u;if(!Array.isArray(t.items))return;if(i.array===!1)return;let f=t.items.map((E)=>Yc(E)),l;if(f.length===0)l=agt.tuple([]);else l=agt.tuple(f);if(t.minItems!==void 0&&t.minItems>f.length)l=!1;if(t.maxItems!==void 0&&t.maxItems<f.length)l=!1;i.tuple=l,i.array=!1}},MZf=class{apply(i,u){let t=u;if(i.object===!1)return;if(t.properties||t.required||t.additionalProperties!==void 0)i.object=i.object||Pni.object({}).passthrough()}},zZf=class{apply(i,u){let t=u;if(u.type===void 0&&(t.maxProperties!==void 0||t.minProperties!==void 0)){if(i.object===void 0)i.object=Pni.object({}).passthrough()}}},rZf=class{apply(i,u){let t=u;if(t.maxProperties===void 0)return;if(i.object!==!1){let f=i.object||Pni.object({}).passthrough();i.object=f.refine((l)=>Object.keys(l).length<=t.maxProperties,{message:`Object must have at most ${t.maxProperties} properties`})}}},qZf=class{apply(i,u){let t=u;if(t.minProperties===void 0)return;if(i.object!==!1){let f=i.object||Pni.object({}).passthrough();i.object=f.refine((l)=>Object.keys(l).length>=t.minProperties,{message:`Object must have at least ${t.minProperties} properties`})}}},mZf=class{apply(i,u){if(!u.not)return i;let t=Yc(u.not);return i.refine((f)=>!$ni(t,f),{message:"Value must not match the 'not' schema"})}},eZf=class{apply(i,u){if(u.uniqueItems!==!0)return i;return i.refine(VZf(),{message:"Array items must be unique"})}},oZf=class{apply(i,u){if(!u.allOf||u.allOf.length===0)return i;return u.allOf.map((f)=>Yc(f)).reduce((f,l)=>aZf.intersection(f,l),i)}},sZf=class{apply(i,u){if(!u.anyOf||u.anyOf.length===0)return i;let t=u.anyOf.length===1?Yc(u.anyOf[0]):ogt.union([Yc(u.anyOf[0]),Yc(u.anyOf[1]),...u.anyOf.slice(2).map((f)=>Yc(f))]);return ogt.intersection(i,t)}},pZf=class{apply(i,u){if(!u.oneOf||u.oneOf.length===0)return i;let t=u.oneOf.map((f)=>Yc(f));return i.refine((f)=>{let l=0;for(let E of t)if(E.safeParse(f).success){if(l++,l>1)return!1}return l===1},{message:"Value must match exactly one of the oneOf schemas"})}},iGf=class{apply(i,u){let t=u;if(t.prefixItems&&Array.isArray(t.prefixItems)){let l=t.prefixItems.map((E)=>Yc(E));return i.refine((E)=>{if(!Array.isArray(E))return!0;for(let c=0;c<Math.min(E.length,l.length);c++)if(!$ni(l[c],E[c]))return!1;if(E.length>l.length){if(typeof t.items==="boolean"&&t.items===!1)return!1;else if(t.items&&typeof t.items==="object"&&!Array.isArray(t.items)){let c=Yc(t.items);for(let _=l.length;_<E.length;_++)if(!$ni(c,E[_]))return!1}}return!0},{message:"Array does not match prefixItems schema"})}return i}},uGf=class{apply(i,u){let t=u;if(!t.properties&&!t.required&&t.additionalProperties!==!1)return i;if(i instanceof Oni.ZodObject||i instanceof Oni.ZodRecord){let f={};if(t.properties){for(let[l,E]of Object.entries(t.properties))if(E!==void 0)f[l]=Yc(E)}if(t.required&&Array.isArray(t.required)){let l=new Set(t.required);for(let E of Object.keys(f))if(!l.has(E))f[E]=f[E].optional()}else for(let l of Object.keys(f))f[l]=f[l].optional();if(t.additionalProperties===!1)return Oni.object(f);else return Oni.object(f).passthrough()}return i.refine((f)=>{if(typeof f!=="object"||f===null||Array.isArray(f))return!0;if(t.properties){for(let[l,E]of Object.entries(t.properties))if(E!==void 0){if(Object.getOwnPropertyDescriptor(f,l)!==void 0){if(!Yc(E).safeParse(f[l]).success)return!1}}}if(t.required&&Array.isArray(t.required)){for(let l of t.required)if(Object.getOwnPropertyDescriptor(f,l)===void 0)return!1}if(t.additionalProperties===!1&&t.properties){let l=new Set(Object.keys(t.properties));for(let E in f)if(!l.has(E))return!1}return!0},{message:"Object constraints validation failed"})}},tGf=class{apply(i,u){if(!u.enum||u.enum.length===0)return i;let t=u.enum.filter((f)=>Array.isArray(f)||typeof f==="object"&&f!==null);if(t.length===0)return i;return i.refine((f)=>{if(typeof f!=="object"||f===null)return!0;return t.some((l)=>ma(f,l))},{message:"Value must match one of the enum values"})}},fGf=class{apply(i,u){if(u.const===void 0)return i;let t=u.const;if(typeof t!=="object"||t===null)return i;return i.refine((f)=>ma(f,t),{message:"Value must equal the const value"})}},lGf=class{apply(i,u){if(u.description)i=i.describe(u.description);return i}},cGf=class{apply(i,u){var t;let f=u;if(!((t=f.required)==null?void 0:t.includes("__proto__"))||u.type!==void 0)return i;return EGf.any().refine((l)=>this.validateRequired(l,f.required),{message:"Missing required properties"})}validateRequired(i,u){if(typeof i!=="object"||i===null||Array.isArray(i))return!0;return u.every((t)=>Object.prototype.hasOwnProperty.call(i,t))}},_Gf=class{apply(i,u){var t;let f=u;if(f.contains===void 0)return i;let l=Yc(f.contains),E=(t=f.minContains)!=null?t:1,c=f.maxContains;return i.refine((_)=>{if(!Array.isArray(_))return!0;let T=0;for(let d of _)if($ni(l,d))T++;if(T<E)return!1;if(c!==void 0&&T>c)return!1;return!0},{message:"Array must contain required items matching the schema"})}},TGf=class{apply(i,u){let{default:t}=u;if(t===void 0)return i;if(!i.safeParse(t).success)return i;return i.default(t)}},dGf,wGf;var sgt=v(()=>{dGf=[new xZf,new yZf,new IZf,new FZf,new LZf,new XZf,new zZf,new ZZf,new GZf,new kZf,new CZf,new YZf,new jZf,new KZf,new HZf,new QZf,new JZf,new WZf,new bZf,new rZf,new qZf,new MZf],wGf=[new cGf,new tGf,new fGf,new oZf,new sZf,new pZf,new iGf,new uGf,new _Gf,new mZf,new eZf,new TGf,new lGf]});class hfu{constructor(i){this._url=i}start(){if(this._socket)throw Error("WebSocketClientTransport already started! If using Client class, note that connect() calls start() automatically.");return new Promise((i,u)=>{this._socket=new WebSocket(this._url,nGf),this._socket.onerror=(t)=>{let f="error"in t?t.error:Error(`WebSocket error: ${JSON.stringify(t)}`);u(f),this.onerror?.(f)},this._socket.onopen=()=>{i()},this._socket.onclose=()=>{this.onclose?.()},this._socket.onmessage=(t)=>{let f;try{f=Ed.parse(JSON.parse(t.data))}catch(l){this.onerror?.(l);return}this.onmessage?.(f)}})}async close(){this._socket?.close()}send(i){return new Promise((u,t)=>{if(!this._socket){t(Error("Not connected"));return}this._socket?.send(JSON.stringify(i)),u()})}}var nGf="mcp";var pgt=v(()=>{n4()});function hGf(i){let u=i;if(!u||typeof u!=="object"||!("method"in u))return null;switch(u.method){case"initialize":{let t=u?.params?.protocolVersion;if(!t)return null;return{type:"emit",message:{result:{protocolVersion:t,capabilities:{tools:{}},serverInfo:{name:"deco-chat-server",version:"1.0.0"}},jsonrpc:u.jsonrpc??"2.0",id:u.id}}}case"notifications/roots/list_changed":case"notifications/initialized":case"notifications/cancelled":case"notifications/progress":return{type:"suppress"};default:return null}}var gni;var Afu=v(()=>{oH();gni=class gni extends QA{constructor(i,u){super(i,u)}send(i,u){let t=hGf(i);if(t?.type==="emit")return this.onmessage?.(t.message),Promise.resolve();if(t?.type==="suppress")return Promise.resolve();return super.send(i,u)}}});var i8t,u8t=async(i,u,t)=>{let f=AGf(i.connection,u,t);if(!f)throw Error("Unknown MCP connection type");let l=new i8t({name:i?.name??"MCP Client",version:"1.0.0"});return await l.connect(f),{client:l}},AGf=(i,u,t)=>{if(i.type==="Websocket")return new hfu(new URL(i.url));if(i.type!=="SSE"&&i.type!=="HTTP")return null;let l={...i.token?{authorization:`Bearer ${i.token}`}:{},...t??{},..."headers"in i?i.headers||{}:{}};if(i.type==="SSE"){let E={requestInit:{headers:l,signal:u}};if(i.token)E.eventSourceInit={fetch:(c,_)=>{return fetch(c,{..._,headers:{...l,Accept:"text/event-stream"},signal:u})}};return new gv(new URL(i.url),E)}return new gni(new URL(i.url),{requestInit:{headers:l,signal:u,credentials:"include"}})};var t8t=v(()=>{bA();RV();pgt();n4();nT();Afu();i8t=class i8t extends e4{constructor(i,u){super(i,{jsonSchemaValidator:CE,...u})}async listTools(i,u){return await this.request({method:"tools/list",params:i},nq,u)}}});function E8t(i){let u=(t)=>{if("connection"in i)return u8t({connection:i.connection},void 0,t);return i.client};return new Proxy({},{get(t,f){if(f==="toJSON")return null;if(typeof f!=="string")throw Error("Name must be a string");if(f==="listTools")return _;async function l(T,d=f){let w=i?.debugId?.(),n=w?{"x-trace-debug-id":w}:void 0,{client:h}=await u(n),{structuredContent:A,isError:D,content:N}=await h.callTool({name:String(d),arguments:T});if(D){let O=N?.[0]?.text,$=typeof O==="string"?f8t(O):null,P=$?.code&&typeof i?.getErrorByStatusCode==="function"?i.getErrorByStatusCode($.code,$.message,$.traceId):null;if(P)throw P;throw Error(`Tool ${String(d)} returned an error: ${JSON.stringify(A??N)}`)}if(A!==void 0)return A;let S=N?.[0]?.text;return typeof S==="string"?f8t(S):void 0}async function E(){let{client:T}=await u(),{tools:d}=await T.listTools();return d}async function c(){if(!("connection"in i))return E();let T=i.connection,d=JSON.stringify(T);try{if(!Uni.has(d))Uni.set(d,E());return await Uni.get(d)}catch(w){console.error("Failed to list tools",w),Uni.delete(d);return}}async function _(){return(await c()??[]).map((d)=>l8t(d,l))}return l.asTool=async()=>{let d=(await c()??[]).find((w)=>w.name===f);if(!d)throw Error(`Tool ${f} not found`);return l8t(d,l)},l}})}var f8t=(i)=>{try{return JSON.parse(i)}catch{return i}},Uni,l8t=(i,u)=>{return{...i,id:i.name,inputSchema:i.inputSchema?Yc(i.inputSchema):void 0,outputSchema:i.outputSchema?Yc(i.outputSchema):void 0,execute:(t)=>{return u(t.context,i.name)}}};var c8t=v(()=>{sgt();t8t();Uni=new Map});function F$(i){return E8t(i)}var aJ;var Dfu=v(()=>{c8t();aJ=new Proxy({},{get(i,u){if(u==="toJSON")return null;if(u==="forConnection")return(t)=>F$({connection:t});if(u==="forClient")return(t)=>F$({client:t});return globalThis[u]}})});function Bni(i){return{isImplementedBy:(u)=>{for(let t of i){let f=typeof t.name==="string"?new RegExp(`^${t.name}$`):t.name,l=u.find((E)=>f.test(E.name));if(!l&&t.opt)continue;if(!l)return!1}return!0}}}var N3=(i)=>{return{...Bni(i),forClient:(u)=>{return F$({client:u})},forConnection:(u)=>{return F$({connection:u})}}};var S8=v(()=>{Dfu()});import{z as mE}from"zod";var _8t,Ini,T8t,xni,d8t,DGf;var w8t=v(()=>{S8();_8t=mE.object({specversion:mE.literal("1.0").describe("CloudEvents specification version"),id:mE.string().describe("Unique identifier for this event (UUID recommended)"),source:mE.string().describe("Connection ID of the event publisher"),type:mE.string().describe("Event type (e.g., 'order.created', 'user.signup')"),time:mE.string().datetime().optional().describe("Timestamp of when the event occurred (ISO 8601)"),subject:mE.string().optional().describe("Subject/resource identifier (e.g., order ID, user ID)"),datacontenttype:mE.string().optional().default("application/json").describe("Content type of the data attribute"),dataschema:mE.string().url().optional().describe("URI to the schema for the data attribute"),data:mE.unknown().optional().describe("Event payload (any JSON value)")}),Ini=mE.object({events:mE.array(_8t).min(1).describe("Batch of CloudEvents to process")}),T8t=mE.object({success:mE.boolean().optional().describe("Whether this event was processed successfully"),error:mE.string().optional().describe("Error message for this event"),retryAfter:mE.number().int().positive().optional().describe("Re-deliver this event after this many ms")}),xni=mE.object({success:mE.boolean().optional().describe("Batch success - applies to events not in results"),error:mE.string().optional().describe("Batch error message - applies to events not in results"),processedCount:mE.number().int().min(0).optional().describe("Number of events successfully processed"),retryAfter:mE.number().int().positive().optional().describe("Batch retryAfter - applies to events not in results"),results:mE.record(mE.string(),T8t).optional().describe("Per-event results keyed by event ID")}),d8t=[{name:"ON_EVENTS",inputSchema:Ini,outputSchema:xni}],DGf=N3(d8t)});import{z as eE}from"zod";var n8t,h8t,A8t,D8t,v8t,N8t,yni,vfu;var Nfu=v(()=>{S8();n8t=eE.object({type:eE.literal("string"),enum:eE.array(eE.string()).optional(),description:eE.string().optional()}),h8t=eE.object({type:eE.string(),description:eE.string(),paramsSchema:eE.record(eE.string(),n8t)}),A8t=eE.object({}),D8t=eE.object({triggers:eE.array(h8t)}),v8t=eE.object({type:eE.string(),params:eE.record(eE.string(),eE.string()),enabled:eE.boolean(),callbackUrl:eE.url().optional(),callbackToken:eE.string().min(1).optional()}),N8t=eE.object({success:eE.boolean()}),yni=[{name:"TRIGGER_LIST",inputSchema:A8t,outputSchema:D8t},{name:"TRIGGER_CONFIGURE",inputSchema:v8t,outputSchema:N8t}],vfu=N3(yni)});import{z as kl}from"zod";var S8t,O8t,$8t,ea,Rni,Fni,Lni,Zni,vGf;var Sfu=v(()=>{S8();S8t=kl.object({primary:kl.string().optional().describe("Primary brand color (hex)"),secondary:kl.string().optional().describe("Secondary brand color (hex)"),accent:kl.string().optional().describe("Accent / highlight color (hex)"),background:kl.string().optional().describe("Background color (hex)"),foreground:kl.string().optional().describe("Foreground / text color (hex)")}),O8t=kl.object({heading:kl.string().optional().describe("Font family for headings"),body:kl.string().optional().describe("Font family for body text"),code:kl.string().optional().describe("Font family for code / monospace")}),$8t=kl.object({logo:kl.string().optional().describe("Logo URL"),favicon:kl.string().optional().describe("Favicon URL"),ogImage:kl.string().optional().describe("Open Graph image URL")}),ea=kl.object({id:kl.string(),name:kl.string().describe("Brand / company name"),domain:kl.string().optional().describe("Company domain (e.g. example.com)"),colors:S8t.optional().describe("Semantic color palette"),fonts:O8t.optional().describe("Font families by role"),assets:$8t.optional().describe("Visual identity assets"),overview:kl.string().optional().describe("Company overview / description"),tagline:kl.string().optional().describe("Brand tagline"),tone:kl.string().optional().describe("Tone of voice description"),metadata:kl.record(kl.string(),kl.unknown()).optional().describe("Extra design tokens and metadata")}),Rni=kl.object({id:kl.string().optional().describe("Brand ID. Omit to get the default brand.")}),Fni=kl.object({}),Lni=kl.object({items:kl.array(ea)}),Zni=[{name:"BRAND_GET",inputSchema:Rni,outputSchema:ea},{name:"BRAND_LIST",inputSchema:Fni,outputSchema:Lni,opt:!0}],vGf=N3(Zni)});var Ofu=v(()=>{S8();w8t();Nfu();Sq();Sfu()});import{z as R0}from"zod";function Mv(i){return R0.object({items:R0.array(i).describe("Array of collection items"),totalCount:R0.number().int().min(0).optional().describe("Total number of matching items (if available)"),hasMore:R0.boolean().optional().describe("Whether there are more items available")})}function oa(i){return R0.object({item:i.nullable().describe("The retrieved item, or null if not found")})}function OGf(i){return R0.object({data:i.partial().describe("Data for the new entity (id may be auto-generated)")})}function $Gf(i){return R0.object({item:i.describe("The created entity with generated id")})}function PGf(i){return R0.object({id:R0.string().describe("ID of the entity to update"),data:i.partial().describe("Partial entity data to update")})}function gGf(i){return R0.object({item:i.describe("The updated entity")})}function pa(i){return R0.object({item:i.describe("The deleted entity")})}function kni(i,u,t){let f=i.toUpperCase(),l=t?.readOnly??!1,E=[{name:`COLLECTION_${f}_LIST`,inputSchema:Bh,outputSchema:Mv(u)},{name:`COLLECTION_${f}_GET`,inputSchema:aa,outputSchema:oa(u)}];if(!l)E.push({name:`COLLECTION_${f}_CREATE`,inputSchema:OGf(u),outputSchema:$Gf(u),opt:!0},{name:`COLLECTION_${f}_UPDATE`,inputSchema:PGf(u),outputSchema:gGf(u),opt:!0},{name:`COLLECTION_${f}_DELETE`,inputSchema:sa,outputSchema:pa(u),opt:!0});return E}var Gni,NGf,P8t,SGf,Bh,aa,sa;var Ww=v(()=>{Gni=R0.object({id:R0.string().describe("Unique identifier for the entity"),title:R0.string().describe("Human-readable title for the entity"),description:R0.string().nullish().describe("Description of the entity"),created_at:R0.string().datetime(),updated_at:R0.string().datetime(),created_by:R0.string().optional(),updated_by:R0.string().optional()}),NGf=R0.object({field:R0.array(R0.string()),operator:R0.enum(["eq","gt","gte","lt","lte","in","like","contains"]),value:R0.unknown()}),P8t=R0.lazy(()=>R0.union([NGf,R0.object({operator:R0.enum(["and","or","not"]),conditions:R0.array(P8t)})])),SGf=R0.object({field:R0.array(R0.string()),direction:R0.enum(["asc","desc"]),nulls:R0.enum(["first","last"]).optional()}),Bh=R0.object({where:P8t.optional().describe("Filter expression"),orderBy:R0.array(SGf).optional().describe("Sort expressions"),limit:R0.number().int().min(1).max(1000).optional().describe("Maximum number of items to return"),offset:R0.number().int().min(0).optional().describe("Number of items to skip")});aa=R0.object({id:R0.string().describe("ID of the entity to retrieve")});sa=R0.object({id:R0.string().describe("ID of the entity to delete")})});import{z as oJ}from"zod";var UGf,BGf,g8t;var U8t=v(()=>{Ww();UGf=Gni.extend({avatar:oJ.string().describe("URL or data URI to the assistant's avatar image"),system_prompt:oJ.string().describe("System prompt that defines the assistant's behavior"),virtual_mcp_id:oJ.string().describe("Virtual MCP ID to use for this assistant"),model:oJ.object({id:oJ.string().describe("Model ID"),connectionId:oJ.string().describe("Connection ID that provides the model")}).describe("Selected model reference for this assistant")}),BGf=kni("assistant",UGf),g8t=[...BGf]});import{z as Fi}from"zod";var io,zv,I8t,IGf,xGf,x8t,yGf,RGf,FGf,LGf,ZGf,GGf,y8t,kGf,CGf,YGf,jGf,KGf,HGf,XGf,JGf,WGf,bGf,EpE,QGf,cpE,B8t,MGf,zGf,Cni,_pE;var R8t=v(()=>{S8();Ww();io=Fi.lazy(()=>Fi.union([Fi.null(),Fi.string(),Fi.number(),Fi.boolean(),Fi.record(Fi.string(),io),Fi.array(io)])),zv=Fi.record(Fi.string(),Fi.record(Fi.string(),io)).optional().describe("Additional provider-specific options. Outer record keyed by provider name, inner by option key"),I8t=Fi.object({type:Fi.literal("text"),text:Fi.string().describe("The text content"),providerOptions:zv}),IGf=Fi.object({type:Fi.literal("text"),text:Fi.string().describe("The text content"),providerMetadata:Fi.any().optional().describe("Additional provider-specific metadata")}),xGf=Fi.string().describe("File data as URL string"),x8t=Fi.object({type:Fi.literal("file"),filename:Fi.string().optional().describe("Optional filename of the file"),data:xGf,mediaType:Fi.string().describe("IANA media type of the file (e.g., image/png, audio/mp3)"),providerOptions:zv}),yGf=Fi.object({type:Fi.literal("file"),mediaType:Fi.string().describe("IANA media type of the file (e.g., image/png, audio/mp3)"),data:Fi.string().describe("Generated file data as base64 encoded string")}),RGf=Fi.object({type:Fi.literal("reasoning"),text:Fi.string().describe("The reasoning text"),providerOptions:zv}),FGf=Fi.object({type:Fi.literal("reasoning"),text:Fi.string().describe("The reasoning text"),providerMetadata:Fi.any().optional().describe("Additional provider-specific metadata")}),LGf=Fi.object({type:Fi.literal("tool-call"),toolCallId:Fi.string().describe("ID of the tool call, used to match with tool result"),toolName:Fi.string().describe("Name of the tool being called"),input:Fi.string().describe("Arguments of the tool call (JSON-serializable object matching tool input schema)"),providerExecuted:Fi.boolean().optional().describe("Whether the tool call will be executed by the provider"),providerOptions:zv}),ZGf=Fi.object({type:Fi.literal("tool-call"),toolCallId:Fi.string().describe("ID of the tool call"),toolName:Fi.string().describe("Name of the tool being called"),input:Fi.string().describe("Stringified JSON object with the tool call arguments"),providerExecuted:Fi.boolean().optional().describe("Whether the tool call will be executed by the provider"),providerMetadata:Fi.any().optional().describe("Additional provider-specific metadata")}),GGf=Fi.union([Fi.object({type:Fi.literal("text"),value:Fi.string()}),Fi.object({type:Fi.literal("json"),value:io}),Fi.object({type:Fi.literal("error-text"),value:Fi.string()}),Fi.object({type:Fi.literal("error-json"),value:io}),Fi.object({type:Fi.literal("content"),value:Fi.array(Fi.union([Fi.object({type:Fi.literal("text"),text:Fi.string().describe("Text content")}),Fi.object({type:Fi.literal("media"),data:Fi.string().describe("Base-64 encoded media data"),mediaType:Fi.string().describe("IANA media type")})]))}),Fi.object({type:Fi.literal("execution-denied"),reason:Fi.string().optional()}),Fi.string().describe("Raw or JSON-serialized output (e.g. from AI SDK mapToolResultOutput)")]),y8t=Fi.object({type:Fi.literal("tool-result"),toolCallId:Fi.string().describe("ID of the tool call that this result is associated with"),toolName:Fi.string().describe("Name of the tool that generated this result"),output:GGf.describe("Result of the tool call"),result:Fi.unknown().describe("Unknown result of the tool call"),providerOptions:zv}),kGf=Fi.object({type:Fi.literal("tool-result"),toolCallId:Fi.string().describe("ID of the tool call that this result is associated with"),toolName:Fi.string().describe("Name of the tool that generated this result"),result:Fi.any().describe("Result of the tool call (JSON-serializable)"),isError:Fi.boolean().optional().describe("Whether the result is an error or error message"),providerExecuted:Fi.boolean().optional().describe("Whether the tool result was generated by the provider"),providerMetadata:Fi.any().optional().describe("Additional provider-specific metadata")}),CGf=Fi.union([Fi.object({type:Fi.literal("source"),sourceType:Fi.literal("url"),id:Fi.string().describe("The ID of the source"),url:Fi.string().describe("The URL of the source"),title:Fi.string().optional().describe("The title of the source"),providerMetadata:Fi.any().optional().describe("Additional provider-specific metadata")}),Fi.object({type:Fi.literal("source"),sourceType:Fi.literal("document"),id:Fi.string().describe("The ID of the source"),mediaType:Fi.string().describe("IANA media type of the document (e.g., application/pdf)"),title:Fi.string().describe("The title of the document"),filename:Fi.string().optional().describe("Optional filename of the document"),providerMetadata:Fi.any().optional().describe("Additional provider-specific metadata")})]),YGf=Fi.object({role:Fi.literal("system"),content:Fi.string().describe("System message content"),providerOptions:zv}),jGf=Fi.object({role:Fi.literal("user"),content:Fi.array(Fi.union([I8t,x8t])).describe("User message content parts (text or file)"),providerOptions:zv}),KGf=Fi.object({role:Fi.literal("assistant"),content:Fi.array(Fi.union([I8t,x8t,RGf,LGf,y8t])).describe("Assistant message content parts (text, file, reasoning, tool-call, or tool-result)"),providerOptions:zv}),HGf=Fi.object({role:Fi.literal("tool"),content:Fi.array(y8t).describe("Tool message content (tool results)"),providerOptions:zv}),XGf=Fi.union([YGf,jGf,KGf,HGf]),JGf=Fi.array(XGf).describe("A list of messages forming the prompt"),WGf=Fi.object({prompt:JGf.describe("A language model prompt is a standardized prompt type (array of messages with roles: system, user, assistant, tool)"),maxOutputTokens:Fi.number().optional().describe("Maximum number of tokens to generate"),temperature:Fi.number().optional().describe("Temperature setting. The range depends on the provider and model"),topP:Fi.number().optional().describe("Nucleus sampling parameter"),topK:Fi.number().optional().describe("Only sample from the top K options for each subsequent token. Used to remove long tail low probability responses"),presencePenalty:Fi.number().optional().describe("Presence penalty setting. It affects the likelihood of the model to repeat information that is already in the prompt"),frequencyPenalty:Fi.number().optional().describe("Frequency penalty setting. It affects the likelihood of the model to repeatedly use the same words or phrases"),seed:Fi.number().optional().describe("The seed (integer) to use for random sampling. If set and supported by the model, calls will generate deterministic results"),stopSequences:Fi.array(Fi.string()).optional().describe("Stop sequences. If set, the model will stop generating text when one of the stop sequences is generated"),responseFormat:Fi.union([Fi.object({type:Fi.literal("text")}),Fi.object({type:Fi.literal("json"),schema:Fi.any().optional().describe("JSON schema that the generated output should conform to"),name:Fi.string().optional().describe("Name of output that should be generated"),description:Fi.string().optional().describe("Description of the output that should be generated")})]).optional().describe("Response format. The output can either be text or JSON. Default is text"),tools:Fi.array(Fi.any()).optional().describe("The tools that are available for the model"),toolChoice:Fi.any().optional().describe("Specifies how the tool should be selected. Defaults to 'auto'"),includeRawChunks:Fi.boolean().optional().describe("Include raw chunks in the stream. Only applicable for streaming calls"),abortSignal:Fi.any().optional().describe("Abort signal for cancelling the operation"),providerOptions:Fi.any().optional().describe("Additional provider-specific options")}),bGf=Fi.object({content:Fi.array(Fi.union([IGf,yGf,FGf,ZGf,kGf,CGf])).describe("Ordered content that the model has generated (text, tool-calls, reasoning, files, sources)"),finishReason:Fi.enum(["stop","length","content-filter","tool-calls","error","other","unknown"]).describe("Reason why generation stopped"),usage:Fi.looseObject({inputTokens:Fi.number().optional(),outputTokens:Fi.number().optional(),totalTokens:Fi.number().optional(),reasoningTokens:Fi.number().optional()}).describe("Usage information for the language model call"),providerMetadata:Fi.any().optional().describe("Additional provider-specific metadata"),request:Fi.object({body:Fi.any().optional().describe("Request HTTP body sent to the provider API")}).optional().describe("Optional request information for telemetry and debugging"),response:Fi.object({id:Fi.string().optional().describe("ID for the generated response"),timestamp:Fi.iso.datetime().optional().describe("Timestamp for the start of the generated response"),modelId:Fi.string().optional().describe("The ID of the response model that was used"),headers:Fi.record(Fi.string(),Fi.string()).optional().describe("Response headers"),body:Fi.any().optional().describe("Response HTTP body")}).optional().describe("Optional response information for telemetry and debugging"),warnings:Fi.array(Fi.any()).describe("Warnings for the call, e.g. unsupported settings")}),EpE=Fi.object({stream:Fi.any().describe("ReadableStream of LanguageModelV2StreamPart"),request:Fi.object({body:Fi.any().optional().describe("Request HTTP body sent to the provider API")}).optional().describe("Optional request information for telemetry and debugging"),response:Fi.object({headers:Fi.record(Fi.string(),Fi.string()).optional().describe("Response headers")}).optional().describe("Optional response data")}),QGf=Fi.object({supportedUrls:Fi.record(Fi.string(),Fi.array(Fi.string())).describe("Supported URL patterns by media type for the provider")}),cpE=Fi.object({modelId:Fi.string().describe("The ID of the model"),logo:Fi.string().nullable(),description:Fi.string().nullable(),capabilities:Fi.array(Fi.string()),limits:Fi.object({contextWindow:Fi.number(),maxOutputTokens:Fi.number()}).nullable(),costs:Fi.object({input:Fi.number(),output:Fi.number()}).nullable(),provider:Fi.enum(["openai","anthropic","google","x-ai","deepseek","openai-compatible","openrouter"]).nullable()}),B8t=Fi.object({modelId:Fi.string().describe("The ID of the model"),callOptions:WGf}),MGf=Gni.extend({logo:Fi.string().nullable(),description:Fi.string().nullable(),capabilities:Fi.array(Fi.string()),limits:Fi.object({contextWindow:Fi.number(),maxOutputTokens:Fi.number()}).nullable(),costs:Fi.object({input:Fi.number(),output:Fi.number()}).nullable(),provider:Fi.enum(["openai","anthropic","google","xai","deepseek","openai-compatible","openrouter"]).nullable()}),zGf=kni("llm",MGf,{readOnly:!0}),Cni=[{name:"LLM_METADATA",inputSchema:Fi.object({modelId:Fi.string().describe("The ID of the model")}),outputSchema:QGf},{name:"LLM_DO_STREAM",inputSchema:B8t},{name:"LLM_DO_GENERATE",inputSchema:B8t,outputSchema:bGf},...zGf],_pE=N3(Cni)});import{z as O8}from"zod";var rGf,F8t;var L8t=v(()=>{rGf=O8.object({scopes:O8.array(O8.string()).describe("List of scopes available"),stateSchema:O8.record(O8.string(),O8.unknown()).describe("JSON Schema (draft-07) defining the state structure")}),F8t=[{name:"MCP_CONFIGURATION",inputSchema:O8.object({}),outputSchema:rGf}]});import{z as aE}from"zod";var qGf,VGf,Z8t;var G8t=v(()=>{qGf=aE.object({}).strict(),VGf=aE.object({billing:aE.object({mode:aE.enum(["prepaid","postpaid"]),limitPeriod:aE.enum(["daily","weekly","monthly"]).nullable()}),limit:aE.object({total:aE.number().nullable(),remaining:aE.number().nullable(),reset:aE.string().nullable()}),usage:aE.object({total:aE.number(),daily:aE.number(),weekly:aE.number(),monthly:aE.number()}),alert:aE.object({enabled:aE.boolean(),threshold_usd:aE.number(),email:aE.string().nullable()}),connectionId:aE.string()}),Z8t=[{name:"GATEWAY_USAGE",inputSchema:qGf,outputSchema:VGf},{name:"GATEWAY_SET_LIMIT",inputSchema:aE.object({}),outputSchema:aE.object({}),opt:!0},{name:"GATEWAY_SET_ALERT",inputSchema:aE.object({}),outputSchema:aE.object({}),opt:!0}]});function k8t(i,u){return i||u===0}function C8t(i,u,t,f,l){let E=u?l+1:l,c=u?i.slice(0,t):i,_=f+t<E;return{items:c,totalCount:E,hasMore:_}}function mGf(i,u){if(u.length===0)return;let[t,...f]=u,l=t==="slug"?AO(i):i[t];for(let E of f){if(l===null||typeof l!=="object")return;l=l[E]}return l}function eGf(i){let t=i.replace(/[.*+?^${}()|[\]\\]/g,"\\$&").replace(/%/g,".*").replace(/_/g,".");return new RegExp(`^${t}$`,"i")}function aGf(i,u,t){if(i===void 0)return!0;switch(u){case"eq":return t===null?i===null:i===t;case"gt":return i>t;case"gte":return i>=t;case"lt":return i<t;case"lte":return i<=t;case"in":return Array.isArray(t)&&t.includes(i);case"like":return typeof i==="string"&&eGf(String(t)).test(i);case"contains":return String(i).toLowerCase().includes(String(t).toLowerCase());default:return!0}}function uo(i,u){if(!u)return!0;if("conditions"in u){let{operator:f,conditions:l}=u;if(l.length===0)return!0;switch(f){case"and":return l.every((E)=>uo(i,E));case"or":return l.some((E)=>uo(i,E));case"not":return!l.every((E)=>uo(i,E));default:return!0}}let t=mGf(i,u.field);return aGf(t,u.operator,u.value)}var Y8t=v(()=>{F_i()});async function j8t(i,u,t){if(i.length===0)return;let f=0;async function l(){while(f<i.length){let E=f++;await t(i[E])}}await Promise.all(Array.from({length:Math.min(u,i.length)},()=>l()))}import{z as L$}from"zod";var oGf=8,sGf,pGf,ikf,ukf,$fu;var K8t=v(()=>{Ofu();U8t();Ww();R8t();L8t();Sq();G8t();Z0();uu();q4();nd();Qv();cH();KA();F_i();Y8t();sGf=[{name:/^(COLLECTION_REGISTRY_APP_LIST|REGISTRY_ITEM_LIST)$/,inputSchema:L$.object({})}],pGf={LLM:Cni,LLMS:Cni,ASSISTANTS:g8t,MCP:F8t,OBJECT_STORAGE:jP,AI_GATEWAY_BILLING:Z8t,TRIGGER:yni,REGISTRY:sGf,BRAND:Zni},ikf=Bh.extend({binding:L$.union([L$.array(L$.object({}).passthrough()),L$.object({}).passthrough(),L$.string()]).optional(),include_virtual:L$.boolean().optional().describe("Whether to include VIRTUAL connections in the results. Defaults to false."),slug:L$.string().optional().describe("Filter by connection slug. Matches against app_name, or a slug derived from connection_url or title.")}),ukf=Mv(w_),$fu=p({name:"COLLECTION_CONNECTIONS_LIST",description:"List all connections in the organization with filtering, sorting, and pagination",annotations:{title:"List Connections",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:ikf,outputSchema:ukf,handler:async(i,u)=>{await u.access.check();let t=Si(u),f=i.binding?typeof i.binding==="string"?(()=>{let n=pGf[i.binding.toUpperCase()];if(!n)throw Error(`Unknown binding: ${i.binding}`);return n})():i.binding:void 0,l=f?Bni(f):void 0,E=!!l,c=i.limit??100,_=i.offset??0,{items:T,totalCount:d}=await u.storage.connections.list(t.id,{includeVirtual:i.include_virtual??!1,slug:i.slug,where:i.where,orderBy:i.orderBy,limit:E?void 0:c,offset:E?void 0:_});if(l){let n=h4(),h=tl.SELF(t.id);await j8t(T,oGf,async(A)=>{if(A.tools!==null)return;let D=A.id===h?async()=>{let{listManagementTools:S}=await Promise.resolve().then(() => ($8(),Yni));return S(u)}:()=>dfu(A,u,L_i),N=await ZO("tools",A.id,D,n,(S)=>u.pendingRevalidations.push(S),LO);if(N!==null)A.tools=N})}let w=!1;if(zn()&&k8t(E,_)){let n=_4(),h=tl.DEV_ASSETS(t.id);if(!T.some((A)=>A.id===h)){let A=EH(t.id,n),D=!i.slug||AO(A)===i.slug,N=uo(A,i.where);if(D&&N)T.unshift(A),w=!0}}if(E){let n=(await Promise.all(T.map(async(N)=>{if(!N.tools||N.tools.length===0)return null;return l.isImplementedBy(N.tools.map((O)=>({name:O.name,inputSchema:O.inputSchema,outputSchema:O.outputSchema})))?N:null}))).filter((N)=>N!==null),h=n.length,A=n.slice(_,_+c),D=_+c<h;return{items:A,totalCount:h,hasMore:D}}return C8t(T,w,c,_,d)}})});var tkf,Pfu;var H8t=v(()=>{Ww();Z0();uu();q4();nd();Qv();cH();KA();tkf=oa(w_),Pfu=p({name:"COLLECTION_CONNECTIONS_GET",description:"Get a connection's configuration, tools list, and status by ID.",annotations:{title:"Get Connection",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},_meta:{ui:{visibility:["app"]}},inputSchema:aa,outputSchema:tkf,handler:async(i,u)=>{let t=Si(u);if(await u.access.check(),zn()&&Zci(i.id,t.id))return{item:EH(t.id,_4())};let f=await u.storage.connections.findById(i.id);if(!f||f.organization_id!==t.id)return{item:null};if(f.tools===null){let l=tl.SELF(t.id),E=f.id===l?async()=>{let{listManagementTools:_}=await Promise.resolve().then(() => ($8(),Yni));return _(u)}:async()=>{let _=await D4(f,u,!0);try{return(await _.listTools()).tools}finally{await _.close().catch(()=>{})}},c=await ZO("tools",f.id,E,h4(),(_)=>u.pendingRevalidations.push(_),LO);if(c!==null)f.tools=c}return{item:f}}})});import{z as gfu}from"zod";function Ekf(i,u){return i.length===u.length&&i.every((t,f)=>t===u[f])}var fkf,lkf,Ufu;var X8t=v(()=>{Qv();Uh();uu();jt();nd();le();wfu();GV();KA();fkf=gfu.object({id:gfu.string().describe("ID of the connection to update"),data:vci.describe("Partial connection data to update")}),lkf=gfu.object({item:w_.describe("The updated connection entity")});Ufu=p({name:"COLLECTION_CONNECTIONS_UPDATE",description:"Update a connection's configuration. Re-fetches tools from the server on URL change.",annotations:{title:"Update Connection",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:fkf,outputSchema:lkf,handler:async(i,u)=>{$i(u);let t=Si(u);await u.access.check();let f=Cu(u);if(!f)throw Error("User ID required to update connection");let{id:l,data:E}=i,c=E.configuration_state!==void 0||E.configuration_scopes!==void 0,_=await u.storage.connections.findById(l);if(!_||_.organization_id!==t.id)throw Error("Connection not found in organization");let T=E.connection_type??_.connection_type,d=E.connection_url??_.connection_url;if(T==="VIRTUAL"){let k=iH(d);if(!k)throw Error("VIRTUAL connection requires connection_url in format: virtual://$virtual_mcp_id");let K=await u.storage.virtualMcps.findById(k);if(!K)throw Error(`Virtual MCP not found: ${k}`);if(K.organization_id!==t.id)throw Error("Virtual MCP does not belong to the current organization");d=uH(k)}let w=E.configuration_state??_.configuration_state??{},n=E.configuration_scopes??_.configuration_scopes??[];if(c){if(E.configuration_state!==void 0)w=E.configuration_state??{};else if(w===null||w===void 0)w={};if(E.configuration_scopes!==void 0)n=E.configuration_scopes??[];if(n.length>0){let k=w;ra(k,n,t.id),await Va(k,n,t.id,u)}}if(T==="STDIO"&&!_u().localMode)throw Error("STDIO connections are only available in local mode (--local-mode).");let h=E.connection_token??_.connection_token;if(!h)try{let K=await new VE(u.db,u.vault).get(l);if(K?.accessToken)h=K.accessToken}catch{}let A=await xO({id:_.id,title:E.title??_.title,connection_type:T,connection_url:d,connection_token:h,connection_headers:E.connection_headers??_.connection_headers}).catch(()=>null),D=A?.tools?.length?A.tools:null,N=!1;if(E.configuration_scopes===void 0&&A?.scopes?.length)N=!Ekf(n,A.scopes),n=A.scopes;if(ra(w,n,t.id),N&&n.length>0)await Va(w,n,t.id,u);let S=c||N,O=S?qa(w,n):[],$=S?qa(_.configuration_state??{},_.configuration_scopes??[]):[],P=_.configuration_state,g=P==null||Object.keys(P).length===0,U,x,F=async()=>{try{await u.storage.connectionCredentialVault.replaceGrantsForSubject({organizationId:t.id,subjectConnectionId:l,createdBy:f,grants:$})}catch(k){console.error("Failed to restore credential grants after credential vault mutation failed",k)}},y={...E,connection_url:d,tools:null,configuration_state:w,configuration_scopes:n,updated_by:f},L={..._,...y};if(S)try{if(await u.storage.connectionCredentialVault.replaceGrantsForSubject({organizationId:t.id,subjectConnectionId:l,createdBy:f,grants:O}),O.length>0){if(!await u.storage.connectionCredentialVault.findActiveWorkloadToken({organizationId:t.id,subjectConnectionId:l})){let{plaintextToken:K,record:q}=await u.storage.connectionCredentialVault.createOrRotateWorkloadToken({organizationId:t.id,subjectConnectionId:l});x=q.id,U={baseUrl:u.baseUrl,org:t.slug??t.id,subjectConnectionId:l,token:K}}}}catch(k){if(x)await u.storage.connectionCredentialVault.revokeWorkloadToken({organizationId:t.id,subjectConnectionId:l,tokenId:x});throw await F(),k}if(S&&w&&n)try{await(await D4(L,u,!1)).callTool({name:"ON_MCP_CONFIGURATION",arguments:{state:w,scopes:n,firstRun:g,...U?{vault:U}:{}}})}catch(k){if(console.error("Failed to invoke ON_MCP_CONFIGURATION callback",k),x)throw await u.storage.connectionCredentialVault.revokeWorkloadToken({organizationId:t.id,subjectConnectionId:l,tokenId:x}),await F(),k}let M;try{M=await u.storage.connections.update(l,y)}catch(k){if(S){if(x)await u.storage.connectionCredentialVault.revokeWorkloadToken({organizationId:t.id,subjectConnectionId:l,tokenId:x});await F()}throw k}if(D)h4()?.set("tools",l,D).catch(()=>{});return cJ(l),{item:M}}})});import{z as ckf}from"zod";var _kf,Bfu;var J8t=v(()=>{Ww();Jl();uu();nd();le();KA();_kf=sa.extend({force:ckf.boolean().optional().describe("If true, removes this connection from all agents that reference it before deleting")}),Bfu=p({name:"COLLECTION_CONNECTIONS_DELETE",description:"Permanently delete a connection. Set force=true to auto-remove from referencing Virtual MCPs.",annotations:{title:"Delete Connection",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:_kf,outputSchema:pa(w_),handler:async(i,u)=>{$i(u);let t=Si(u);await u.access.check();let f=await u.storage.connections.findById(i.id);if(!f)throw Error(`Connection not found: ${i.id}`);if(f.organization_id!==t.id)throw Error("Connection not found in organization");if(f.metadata?.isFixed===!0)throw Error("This connection is a fixed system connection and cannot be deleted");let E=await u.storage.virtualMcps.listByConnectionId(t.id,i.id);if(E.length>0)if(i.force)await u.storage.virtualMcps.removeConnectionReferences(i.id);else throw Error(JSON.stringify({code:"CONNECTION_IN_USE",agentNames:E.map((T)=>T.title)}));await u.storage.connections.delete(i.id);let c=await u.storage.organizationSettings.get(t.id);if(c?.registry_config){let{registries:T,blockedMcps:d}=c.registry_config;if(i.id in T){let{[i.id]:w,...n}=T;await u.storage.organizationSettings.upsert(t.id,{registry_config:{registries:n,blockedMcps:d}})}}h4()?.invalidate(i.id).catch(()=>{}),cJ(i.id);let _=Cu(u);if(_)mu.capture({distinctId:_,event:"connection_deleted",groups:{organization:t.id},properties:{connection_id:f.id,connection_type:f.connection_type,app_name:f.app_name??null,organization_id:t.id,forced:i.force??!1}});return{item:f}}})});import{z as sJ}from"zod";var Ifu;var W8t=v(()=>{uu();Ifu=p({name:"CONNECTION_TEST",description:"Test connection health and latency",annotations:{title:"Test Connection",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!0},inputSchema:sJ.object({id:sJ.string()}),outputSchema:sJ.object({id:sJ.string(),healthy:sJ.boolean(),latencyMs:sJ.number()}),handler:async(i,u)=>{let t=Si(u);await u.access.check();let f=await u.storage.connections.findById(i.id);if(!f||f.organization_id!==t.id)throw Error("Connection not found");let l=await u.storage.connections.testConnection(i.id);return{id:i.id,...l}}})});var b8t=v(()=>{mgt();K8t();H8t();X8t();J8t();W8t()});import{sql as Vf}from"kysely";import{z as S3}from"zod";function Q8t(i){if(i===null||i===void 0)return"NULL";if(typeof i==="number")return String(i);if(typeof i==="boolean")return i?"TRUE":"FALSE";if(typeof i==="string")return`'${i.replace(/'/g,"''")}'`;if(i instanceof Date)return`'${i.toISOString()}'`;return`'${JSON.stringify(i).replace(/'/g,"''")}'`}function wkf(i,u){let t=i;for(let l=u.length;l>=1;l--){let E=`$${l}`;if(t.includes(E))t=t.replaceAll(E,Q8t(u[l-1]))}let f=[];for(let l=0;l<t.length;l++)if(t[l]==="?")f.push(l);for(let l=Math.min(f.length,u.length)-1;l>=0;l--){let E=f[l],c=Q8t(u[l]);t=t.slice(0,E)+c+t.slice(E+1)}return t}function M8t(i){return i.replace(/-/g,"_")}function hkf(i){return`app_${M8t(i)}`}function Akf(i){return`app_role_${M8t(i)}`}function Dkf(i){if(i instanceof Error){let u=i.message.toLowerCase(),t=i.code;return t==="3F000"||t==="42704"||t==="22023"||u.includes("schema")&&u.includes("does not exist")||u.includes("role")&&u.includes("does not exist")}return!1}async function vkf(i,u,t){if(await Vf`CREATE SCHEMA IF NOT EXISTS ${Vf.id(u)}`.execute(i),!(await Vf`
     SELECT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = ${t}) as exists
-  `.execute(i)).rows[0]?.exists)await Vf`CREATE ROLE ${Vf.id(t)} NOLOGIN`.execute(i);await Vf`GRANT ${Vf.id(t)} TO CURRENT_USER`.execute(i),await Vf`GRANT USAGE, CREATE ON SCHEMA ${Vf.id(u)} TO ${Vf.id(t)}`.execute(i),await Vf`GRANT ALL ON ALL TABLES IN SCHEMA ${Vf.id(u)} TO ${Vf.id(t)}`.execute(i),await Vf`GRANT ALL ON ALL SEQUENCES IN SCHEMA ${Vf.id(u)} TO ${Vf.id(t)}`.execute(i),await Vf`ALTER DEFAULT PRIVILEGES IN SCHEMA ${Vf.id(u)} GRANT ALL ON TABLES TO ${Vf.id(t)}`.execute(i),await Vf`ALTER DEFAULT PRIVILEGES IN SCHEMA ${Vf.id(u)} GRANT ALL ON SEQUENCES TO ${Vf.id(t)}`.execute(i),await Vf`REVOKE ALL ON SCHEMA public FROM ${Vf.id(t)}`.execute(i)}async function Nkf(i,u,t,f){try{return await i.transaction().execute(async(l)=>{return await Vf`SET LOCAL ROLE ${Vf.id(t)}`.execute(l),await Vf`SET LOCAL search_path TO ${Vf.id(u)}`.execute(l),await Vf.raw(f).execute(l)})}catch(l){if(Dkf(l))return await vkf(i,u,t),await i.transaction().execute(async(E)=>{return await Vf`SET LOCAL ROLE ${Vf.id(t)}`.execute(E),await Vf`SET LOCAL search_path TO ${Vf.id(u)}`.execute(E),await Vf.raw(f).execute(E)});throw l}}var dkf,nkf,z8t;var r8t=v(()=>{uu();dkf=S3.object({results:S3.array(S3.unknown()).optional(),success:S3.boolean().optional()});nkf=S3.object({sql:S3.string().describe("The SQL query to run"),params:S3.array(S3.any()).describe("The parameters to pass to the SQL query").optional()});z8t=p({name:"DATABASES_RUN_SQL",description:"Run a SQL query in a connection-scoped isolated schema. Supports SELECT, DDL, and DML.",annotations:{title:"Run SQL Query",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!1,openWorldHint:!1},inputSchema:nkf,outputSchema:S3.object({result:S3.array(dkf)}),handler:async(i,u)=>{$i(u),await u.access.check();let t=wkf(i.sql,i.params||[]);if(!u.connectionId)throw Error("Connection context required for database access");console.warn("DATABASES_RUN_SQL invoked",{"tool.deprecation_probe":"DATABASES_RUN_SQL","connection.id":u.connectionId,"organization.id":u.organization?.id??null,"user.id":u.auth.user?.id??null});let f=hkf(u.connectionId),l=Akf(u.connectionId);return{result:[{results:(await Nkf(u.db,f,l,t)).rows,success:!0}]}}})});function jni(i){let u=i.access.getRole();if(!yw(u))throw new pA("Only organization owners and admins can change org-wide pin status")}var xfu=v(()=>{Rw();Kg()});async function Kni(i,u,t){let f=[...new Set(t)],l=await Promise.all(f.map((c)=>i.storage.connections.findById(c,u))),E=f.filter((c,_)=>!l[_]);if(E.length>0)throw Error(`Connection not found: ${E.join(", ")}`)}import{z as m8t}from"zod";function Okf(){let i=q8t[Math.floor(Math.random()*q8t.length)];return`icon://${V8t[Math.floor(Math.random()*V8t.length)]}?color=${i}`}var q8t,V8t,$kf,Pkf,yfu;var e8t=v(()=>{uu();RO();xfu();za();q8t=["red","orange","amber","yellow","lime","green","emerald","cyan","sky","blue","indigo","violet","purple","fuchsia","pink","rose"],V8t=["Star01","Zap","Heart","Globe01","Compass03","Lightbulb02","Rocket01","Flag01","BookOpen01","Shield01","Key01","Diamond01","Cube01","Target04","Award01","Briefcase01","Coffee","Feather","Hexagon01","Layers3_01","Map01","Palette","Package","Terminal"];$kf=m8t.object({data:Oci.describe("Data for the new virtual MCP")}),Pkf=m8t.object({item:n_.describe("The created virtual MCP entity")}),yfu=p({name:"COLLECTION_VIRTUAL_MCP_CREATE",description:"Create a Virtual MCP (agent) that aggregates tools from multiple connections into one endpoint. Pass `prompts` to seed the agent with kickstart prompts (conversation starters shown as icebreakers). Author them from the agent's role/instructions and the descriptions of the tools it will have, so the starters are coherent and immediately useful.",annotations:{title:"Create Virtual MCP",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!1,openWorldHint:!1},inputSchema:$kf,outputSchema:Pkf,handler:async(i,u)=>{$i(u);let t=Si(u);await u.access.check();let f=Cu(u);if(!f)throw Error("User ID required to create virtual MCP");if(i.data.pinned===!0)jni(u);let{prompts:l,...E}=i.data;if(E.connections.length>0)await Kni(u,t.id,E.connections.map((T)=>T.connection_id));let c={...E,icon:E.icon??Okf()},_=await u.storage.virtualMcps.create(t.id,f,c);if(l?.length&&u.orgFs&&_.id)await Tni(u.orgFs,_.id,f,l);return{item:_}}})});function gkf(i){let u=[],t=0;while(t<i.length){let f=i[t];if(f==="%")u.push(".*");else if(f==="_")u.push(".");else if(/[.*+?^${}()|[\]\\]/.test(f))u.push("\\"+f);else u.push(f);t++}return u.join("")}function Z$(i){return typeof i==="string"||typeof i==="number"}function Rfu(i,u){let t=u.split("."),f=i;for(let l of t){if(f==null||typeof f!=="object")return;f=f[l]}return f}function Ukf(i,u){return i.connections.some((t)=>t.connection_id===u)}function Hni(i,u){if("conditions"in u){let{operator:_,conditions:T}=u;switch(_){case"and":return T.every((d)=>Hni(i,d));case"or":return T.some((d)=>Hni(i,d));case"not":return!T.every((d)=>Hni(i,d));default:return!0}}let{field:t,operator:f,value:l}=u,E=t.join(".");if(E==="connection_id"){if(f!=="eq"||typeof l!=="string")return!1;return Ukf(i,l)}let c=Rfu(i,E);switch(f){case"eq":return c===l;case"gt":return Z$(c)&&Z$(l)&&c>l;case"gte":return Z$(c)&&Z$(l)&&c>=l;case"lt":return Z$(c)&&Z$(l)&&c<l;case"lte":return Z$(c)&&Z$(l)&&c<=l;case"in":return Array.isArray(l)&&l.includes(c);case"like":if(typeof c!=="string"||typeof l!=="string")return!1;if(l.length>100)return!1;let _=gkf(l);return new RegExp(`^${_}$`,"i").test(c);case"contains":if(typeof c!=="string"||typeof l!=="string")return!1;return c.toLowerCase().includes(l.toLowerCase());default:return!0}}function Bkf(i,u){return[...i].sort((t,f)=>{for(let l of u){let E=l.field.join("."),c=Rfu(t,E),_=Rfu(f,E),T=0;if(c==null&&_==null)continue;if(c==null)T=l.nulls==="first"?-1:1;else if(_==null)T=l.nulls==="first"?1:-1;else if(typeof c==="string"&&typeof _==="string")T=c.localeCompare(_);else if(typeof c==="number"&&typeof _==="number")T=c-_;else T=String(c).localeCompare(String(_));if(T!==0)return l.direction==="desc"?-T:T}return 0})}var Ikf,xkf,Ffu;var a8t=v(()=>{Ww();uu();RO();Ikf=Bh,xkf=Mv(n_),Ffu=p({name:"COLLECTION_VIRTUAL_MCP_LIST",description:"List all MCP virtual MCPs in the organization",annotations:{title:"List Virtual MCPs",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:Ikf,outputSchema:xkf,handler:async(i,u)=>{await u.access.check();let t=Si(u),f=i.where&&!("conditions"in i.where)&&i.where.field.join(".")==="connection_id"&&i.where.operator==="eq"&&typeof i.where.value==="string"?i.where.value:void 0,l=i.where&&!("conditions"in i.where)&&i.where.field.join(".")==="pinned"&&i.where.operator==="eq"&&typeof i.where.value==="boolean"?i.where.value:void 0,c=f?await u.storage.virtualMcps.listByConnectionId(t.id,f):await u.storage.virtualMcps.list(t.id,l!==void 0?{pinnedOnly:l}:void 0);if(i.where)c=c.filter((h)=>Hni(h,i.where));if(i.orderBy&&i.orderBy.length>0)c=Bkf(c,i.orderBy);let _=c.length,T=i.offset??0,d=i.limit??100,w=c.slice(T,T+d),n=T+d<_;return{items:w,totalCount:_,hasMore:n}}})});import{z as Lfu}from"zod";var ykf,Rkf,Zfu;var o8t=v(()=>{uu();RO();ykf=Lfu.object({id:Lfu.string().describe("ID of the virtual MCP to retrieve")}),Rkf=Lfu.object({item:n_.nullable().describe("The retrieved virtual MCP, or null if not found")}),Zfu=p({name:"COLLECTION_VIRTUAL_MCP_GET",description:"Get a Virtual MCP's configuration, connections, and virtual tools by ID.",annotations:{title:"Get Virtual MCP",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:ykf,outputSchema:Rkf,handler:async(i,u)=>{$i(u);let t=Si(u);await u.access.check();let f=await u.storage.virtualMcps.findById(i.id);if(f&&f.organization_id!==t.id)return{item:null};if(!f)return{item:null};return{item:f}}})});import{z as Gfu}from"zod";var Fkf,Lkf,kfu;var s8t=v(()=>{uu();za();RO();xfu();Fkf=Gfu.object({id:Gfu.string().describe("ID of the virtual MCP to update"),data:$ci.describe("Partial virtual MCP data to update")}),Lkf=Gfu.object({item:n_.describe("The updated virtual MCP entity")}),kfu=p({name:"COLLECTION_VIRTUAL_MCP_UPDATE",description:"Update a Virtual MCP's name, slug, connection list, or kickstart prompts. Pass `prompts` to replace the agent's conversation starters (full set; empty array clears them).",annotations:{title:"Update Virtual MCP",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:Fkf,outputSchema:Lkf,handler:async(i,u)=>{$i(u);let t=Si(u);await u.access.check();let f=Cu(u);if(!f)throw Error("User ID required to update virtual MCP");let l=await u.storage.virtualMcps.findById(i.id);if(!l)throw Error(`Virtual MCP not found: ${i.id}`);if(l.organization_id!==t.id)throw Error(`Virtual MCP not found: ${i.id}`);let{prompts:E,...c}=i.data;if(c.metadata&&l.metadata)c.metadata={...l.metadata,...c.metadata};if(c.pinned!==void 0&&c.pinned!==l.pinned)jni(u);if(c.connections?.length)await Kni(u,t.id,c.connections.map((T)=>T.connection_id));let _=await u.storage.virtualMcps.update(i.id,f,c);if(E!==void 0&&u.orgFs)await Tni(u.orgFs,i.id,f,E);return{item:_}}})});function p8t(i){return Nw(i)!==null||Bci(i)!==null}var iUt=v(()=>{Z0()});import{z as Cfu}from"zod";var Zkf,Gkf,Yfu;var uUt=v(()=>{Jv();Uh();uu();za();RO();iUt();Zkf=Cfu.object({id:Cfu.string().describe("ID of the virtual MCP to delete")}),Gkf=Cfu.object({item:n_.describe("The deleted virtual MCP entity")}),Yfu=p({name:"COLLECTION_VIRTUAL_MCP_DELETE",description:"Permanently delete a Virtual MCP and its virtual tools.",annotations:{title:"Delete Virtual MCP",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:Zkf,outputSchema:Gkf,handler:async(i,u)=>{$i(u);let t=Si(u);if(await u.access.check(),p8t(i.id))throw Error(`Virtual MCP not found: ${i.id}`);let f=await u.storage.virtualMcps.findById(i.id);if(!f)throw Error(`Virtual MCP not found: ${i.id}`);if(f.organization_id!==t.id)throw Error(`Virtual MCP not found: ${i.id}`);await u.storage.virtualMcps.delete(i.id);try{if((await u.storage.organizationSettings.get(t.id))?.main_agent_id===i.id)await u.storage.organizationSettings.upsert(t.id,{main_agent_id:null})}catch(E){console.error("[VIRTUAL_MCP_DELETE] failed to clear main agent pointer",{id:i.id,error:E.message})}if(u.orgFs)await cfu(u.orgFs,i.id,Cu(u)??"system");let l=f.metadata?.githubRepo?.connectionId;if(l)try{let E=await u.storage.connections.findById(l,t.id);if(E&&NT(E)){let _=await new VE(u.db,u.vault).get(l);if(_?.accessToken)try{await fetch("https://api.github.com/installation/token",{method:"DELETE",headers:{Authorization:`Bearer ${_.accessToken}`,Accept:"application/vnd.github+json","X-GitHub-Api-Version":"2022-11-28"},signal:AbortSignal.timeout(5000)})}catch{}await u.storage.connections.delete(l)}}catch(E){console.error("[VIRTUAL_MCP_DELETE] failed to tear down repo-scoped connection",{childConnectionId:l,error:E.message})}return{item:f}}})});import{z as N6}from"zod";var kkf,jfu;var tUt=v(()=>{uu();kkf=N6.object({id:N6.string(),virtualMcpId:N6.string(),pluginId:N6.string(),connectionId:N6.string().nullable(),settings:N6.record(N6.string(),N6.unknown()).nullable(),createdAt:N6.string(),updatedAt:N6.string()}),jfu=p({name:"VIRTUAL_MCP_PLUGIN_CONFIG_GET",description:"Get a plugin's current configuration for a specific virtual MCP.",annotations:{title:"Get Virtual MCP Plugin Config",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:N6.object({virtualMcpId:N6.string().describe("Virtual MCP ID"),pluginId:N6.string().describe("Plugin ID")}),outputSchema:N6.object({config:kkf.nullable()}),handler:async(i,u)=>{$i(u);let t=Si(u);await u.access.check();let{virtualMcpId:f,pluginId:l}=i,E=await u.storage.connections.findById(f);if(!E||E.organization_id!==t.id)return{config:null};if(E.connection_type!=="VIRTUAL")return{config:null};let c=await u.storage.virtualMcpPluginConfigs.get(f,l);if(!c)return{config:null};return{config:{id:c.id,virtualMcpId:c.virtualMcpId,pluginId:c.pluginId,connectionId:c.connectionId,settings:c.settings,createdAt:c.createdAt instanceof Date?c.createdAt.toISOString():c.createdAt,updatedAt:c.updatedAt instanceof Date?c.updatedAt.toISOString():c.updatedAt}}}})});import{z as tc}from"zod";var Ckf,Kfu;var fUt=v(()=>{uu();cH();q4();Ckf=tc.object({id:tc.string(),virtualMcpId:tc.string(),pluginId:tc.string(),connectionId:tc.string().nullable(),settings:tc.record(tc.string(),tc.unknown()).nullable(),createdAt:tc.string(),updatedAt:tc.string()}),Kfu=p({name:"VIRTUAL_MCP_PLUGIN_CONFIG_UPDATE",description:"Set or update a plugin's configuration for a specific virtual MCP.",annotations:{title:"Update Virtual MCP Plugin Config",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:tc.object({virtualMcpId:tc.string().describe("Virtual MCP ID"),pluginId:tc.string().describe("Plugin ID"),connectionId:tc.string().nullable().optional().describe("MCP connection to bind"),settings:tc.record(tc.string(),tc.unknown()).nullable().optional().describe("Plugin-specific settings")}),outputSchema:tc.object({config:Ckf}),handler:async(i,u)=>{$i(u);let t=Si(u);await u.access.check();let{virtualMcpId:f,pluginId:l,connectionId:E,settings:c}=i,_=Cu(u),T=await u.storage.connections.findById(f);if(!T)throw Error(`Connection not found: ${f}`);if(T.organization_id!==t.id)throw Error(`Connection not found: ${f}`);if(T.connection_type!=="VIRTUAL")throw Error(`Connection not found: ${f}`);let d=E?await u.storage.connections.findById(E):null;if(E&&d&&d.organization_id!==t.id)throw Error(`Connection not found: ${E}`);if(E&&T.organization_id&&!d&&zn()&&Zci(E,T.organization_id)){if(!_)throw Error("User ID required to create dev-assets connection");let n=EH(T.organization_id,_4());await u.storage.connections.create({...n,organization_id:T.organization_id,created_by:_})}else if(E&&!d)throw Error(`Connection not found: ${E}`);let w=await u.storage.virtualMcpPluginConfigs.upsert(f,l,{connectionId:E,settings:c});return{config:{id:w.id,virtualMcpId:w.virtualMcpId,pluginId:w.pluginId,connectionId:w.connectionId,settings:w.settings,createdAt:w.createdAt instanceof Date?w.createdAt.toISOString():w.createdAt,updatedAt:w.updatedAt instanceof Date?w.updatedAt.toISOString():w.updatedAt}}}})});import{z as ST}from"zod";var Ykf,Hfu;var lUt=v(()=>{uu();RO();Ykf=ST.object({connectionId:ST.string(),toolName:ST.string(),label:ST.string(),icon:ST.string().nullable().optional()}),Hfu=p({name:"VIRTUAL_MCP_PINNED_VIEWS_UPDATE",description:"Update the pinned sidebar views for a virtual MCP. Replaces all current pins.",annotations:{title:"Update Pinned Views",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:ST.object({virtualMcpId:ST.string().describe("Virtual MCP ID"),pinnedViews:ST.array(Ykf).describe("Pinned views to set for the virtual MCP sidebar"),layout:ST.object({defaultMainView:ST.object({type:ST.string(),id:ST.string().optional(),toolName:ST.string().optional()}).nullable().optional(),chatDefaultOpen:ST.boolean().nullable().optional()}).optional()}),outputSchema:ST.object({item:n_.nullable()}),handler:async(i,u)=>{$i(u);let t=Si(u);await u.access.check();let{virtualMcpId:f,pinnedViews:l,layout:E}=i,c=Cu(u),_=await u.storage.virtualMcps.findById(f);if(!_)throw Error(`Virtual MCP not found: ${f}`);if(_.organization_id!==t.id)throw Error(`Virtual MCP not found: ${f}`);let T=_.metadata?.ui??{},d={...T,pinnedViews:l.length>0?l:null,layout:E??T.layout??null};return{item:await u.storage.virtualMcps.update(f,c??"system",{metadata:{..._.metadata,ui:d}})}}})});import{z as rv}from"zod";var jkf,Kkf,Xfu;var EUt=v(()=>{uu();jkf=rv.object({ids:rv.array(rv.string()).describe("Virtual MCP ids to look up")}),Kkf=rv.object({items:rv.array(rv.object({id:rv.string(),last_used_at:rv.string().optional(),last_used_by:rv.string().optional()}))}),Xfu=p({name:"VIRTUAL_MCP_LAST_USED_LIST",description:"Get last-used info (timestamp + user) for one or more virtual MCPs, derived from the most recent thread per agent.",annotations:{title:"List Virtual MCP Last Used",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:jkf,outputSchema:Kkf,handler:async(i,u)=>{$i(u),Si(u),await u.access.check();let t=await u.storage.threads.findLastUsedByVirtualMcpIds(i.ids);return{items:i.ids.map((f)=>({id:f,last_used_at:t.get(f)?.last_used_at,last_used_by:t.get(f)?.last_used_by}))}}})});var cUt=v(()=>{e8t();a8t();o8t();s8t();uUt();tUt();fUt();lUt();EUt()});import{z as xE}from"zod";var Jfu;var _Ut=v(()=>{GE();uu();Jfu=p({name:"MONITORING_LOG_GET",description:"Get a single monitoring log by ID with full input and output data.",annotations:{title:"Get Monitoring Log",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:xE.object({id:xE.string().describe("Log ID to fetch")}),outputSchema:xE.object({log:xE.object({id:xE.string().optional(),organizationId:xE.string(),connectionId:xE.string(),toolName:xE.string(),input:xE.record(xE.string(),xE.unknown()),output:xE.record(xE.string(),xE.unknown()),isError:xE.boolean(),errorMessage:xE.string().nullish(),durationMs:xE.number(),timestamp:xE.string(),userId:xE.string().nullish(),requestId:xE.string(),userAgent:xE.string().nullish(),virtualMcpId:xE.string().nullish(),properties:xE.record(xE.string(),xE.string()).nullish()}).nullable().describe("The monitoring log, or null if not found")}),handler:async(i,u)=>{await u.access.check(),await Tw();let t=Si(u),f=await u.storage.monitoring.getById(t.id,i.id);if(!f)return{log:null};return{log:{...f,timestamp:f.timestamp instanceof Date?f.timestamp.toISOString():f.timestamp}}}})});import{z as U0}from"zod";var Xkf,Wfu;var TUt=v(()=>{GE();uu();Xkf=U0.object({id:U0.string().optional().describe("Unique log identifier"),organizationId:U0.string().describe("Organization ID"),connectionId:U0.string().describe("Connection ID"),toolName:U0.string().describe("Name of the tool that was called"),isError:U0.boolean().describe("Whether the call resulted in an error"),errorMessage:U0.string().nullish().describe("Error message if applicable"),durationMs:U0.number().describe("Call duration in milliseconds"),timestamp:U0.string().describe("ISO 8601 timestamp of the call"),userId:U0.string().nullish().describe("User who triggered the call"),requestId:U0.string().describe("Unique request identifier"),userAgent:U0.string().nullish().describe("Client identifier (x-studio-client header)"),virtualMcpId:U0.string().nullish().describe("Virtual MCP (Agent) ID if routed through an agent"),properties:U0.record(U0.string(),U0.string()).nullish().describe("Custom key-value metadata attached to the log")}),Wfu=p({name:"MONITORING_LOGS_LIST",description:"List monitoring logs for tool calls with filtering and pagination.",annotations:{title:"List Monitoring Logs",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:U0.object({connectionId:U0.string().optional().describe("Filter by connection ID"),excludeConnectionIds:U0.array(U0.string()).optional().describe("Exclude logs from these connection IDs (e.g. system connections)"),virtualMcpId:U0.string().optional().describe("Filter by Virtual MCP (Agent) ID"),toolName:U0.string().optional().describe("Filter by tool name"),isError:U0.boolean().optional().describe("Filter by error status"),startDate:U0.string().datetime().optional().describe("Filter by start date (ISO 8601 datetime string)"),endDate:U0.string().datetime().optional().describe("Filter by end date (ISO 8601 datetime string)"),limit:U0.number().default(20).describe("Maximum number of results"),offset:U0.number().default(0).describe("Offset for pagination"),properties:U0.record(U0.string(),U0.string()).optional().describe("Filter by exact property key=value matches"),propertyKeys:U0.array(U0.string()).optional().describe("Filter by logs that have these property keys"),propertyPatterns:U0.record(U0.string(),U0.string()).optional().describe("Filter by property value patterns (SQL LIKE, use % as wildcard)"),propertyInValues:U0.record(U0.string(),U0.string()).optional().describe("Filter by exact match within comma-separated values (e.g., user_tags in 'Engineering')")}),outputSchema:U0.object({logs:U0.array(Xkf).describe("Array of monitoring logs"),total:U0.number().describe("Total number of logs matching filters"),offset:U0.number().describe("Current offset for pagination"),limit:U0.number().describe("Current limit for pagination")}),handler:async(i,u)=>{await Tw();let t=Si(u),l=i.properties||i.propertyKeys||i.propertyPatterns||i.propertyInValues?{properties:i.properties,propertyKeys:i.propertyKeys,propertyPatterns:i.propertyPatterns,propertyInValues:i.propertyInValues}:void 0,E={organizationId:t.id,connectionId:i.connectionId,excludeConnectionIds:i.excludeConnectionIds,virtualMcpId:i.virtualMcpId,toolName:i.toolName,isError:i.isError,startDate:i.startDate?new Date(i.startDate):void 0,endDate:i.endDate?new Date(i.endDate):void 0,limit:i.limit,offset:i.offset,propertyFilters:l},c=await u.storage.monitoring.query(E);return{logs:c.logs.map(({input:_,output:T,...d})=>({...d,timestamp:d.timestamp instanceof Date?d.timestamp.toISOString():d.timestamp})),total:c.total,offset:i.offset,limit:i.limit}}})});import{z as At}from"zod";var bfu;var dUt=v(()=>{GE();uu();bfu=p({name:"MONITORING_STATS",description:"Get aggregated statistics (counts, latency, error rates) for tool call monitoring.",annotations:{title:"Get Monitoring Stats",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:At.object({startDate:At.string().datetime().optional().describe("Filter by start date (ISO 8601 datetime string)"),endDate:At.string().datetime().optional().describe("Filter by end date (ISO 8601 datetime string)"),interval:At.string().regex(/^\d+[mhd]$/).optional().describe("Bucket interval for timeseries data (e.g. 1m, 5m, 2h, 1d). When provided, returns timeseries array."),connectionIds:At.array(At.string()).max(100).optional().describe("Filter by specific connection IDs (max 100)"),excludeConnectionIds:At.array(At.string()).max(100).optional().describe("Exclude specific connection IDs (max 100)"),toolNames:At.array(At.string()).max(100).optional().describe("Filter by specific tool names (max 100)"),status:At.enum(["success","error"]).optional().describe("Filter metrics by execution status"),topN:At.number().int().min(1).max(20).optional().describe("When provided with interval, also return top tools and their timeseries"),userIds:At.array(At.string()).max(100).optional().describe("Filter LLM usage by user IDs (only applied when llmUsage is true)"),llmUsage:At.boolean().optional().describe("Aggregate LLM-call usage (tokens + USD cost) from raw log rows for the given connection. Returns token/cost totals and timeseries. Requires interval.")}),outputSchema:At.object({totalCalls:At.number().describe("Total number of tool calls"),errorRate:At.number().optional().describe("Error rate as a decimal (0 to 1)"),avgDurationMs:At.number().describe("Average call duration in milliseconds"),errorRatePercent:At.string().optional().describe("Error rate as a percentage string"),totalErrors:At.number().optional().describe("Total number of errors"),p50DurationMs:At.number().optional().describe("50th percentile duration in milliseconds"),p95DurationMs:At.number().optional().describe("95th percentile duration in milliseconds"),connectionBreakdown:At.array(At.object({connectionId:At.string(),calls:At.number(),errors:At.number(),errorRate:At.number(),avgDurationMs:At.number()})).optional().describe("Per-connection metric breakdown"),totalInputTokens:At.number().optional().describe("Total input tokens (LLM usage mode)"),totalOutputTokens:At.number().optional().describe("Total output tokens (LLM usage mode)"),totalTokens:At.number().optional().describe("Total tokens (LLM usage mode)"),totalCostUsd:At.number().optional().describe("Total USD cost (LLM usage mode; only non-zero for providers that report cost)"),topTools:At.array(At.object({toolName:At.string(),connectionId:At.string().nullable(),calls:At.number(),inputTokens:At.number().optional(),outputTokens:At.number().optional(),costUsd:At.number().optional()})).optional().describe("Top tools ranked by calls"),topToolsTimeseries:At.array(At.object({timestamp:At.string(),toolName:At.string(),calls:At.number(),errors:At.number(),avg:At.number(),p95:At.number()})).optional().describe("Per-tool metric timeseries for the top tools"),timeseries:At.array(At.object({timestamp:At.string(),calls:At.number(),errors:At.number(),errorRate:At.number(),avg:At.number(),p50:At.number(),p95:At.number(),inputTokens:At.number().optional(),outputTokens:At.number().optional(),totalTokens:At.number().optional(),costUsd:At.number().optional()})).optional().describe("Timeseries data points bucketed by interval")}),handler:async(i,u)=>{let t=Si(u);if(await u.access.check(),await Tw(),i.interval&&i.llmUsage)return u.storage.monitoring.queryLlmUsageStats({organizationId:t.id,interval:i.interval,connectionId:i.connectionIds?.[0]??"decopilot",startDate:i.startDate?new Date(i.startDate):void 0,endDate:i.endDate?new Date(i.endDate):void 0,userIds:i.userIds,topN:i.topN});if(i.interval){let l=await u.storage.monitoring.queryMetricTimeseries({organizationId:t.id,interval:i.interval,startDate:i.startDate?new Date(i.startDate):void 0,endDate:i.endDate?new Date(i.endDate):void 0,filters:{connectionIds:i.connectionIds,excludeConnectionIds:i.excludeConnectionIds,toolNames:i.toolNames,status:i.status}});if(!i.topN)return l;let E=await u.storage.monitoring.queryMetricTopToolsTimeseries({organizationId:t.id,interval:i.interval,startDate:i.startDate?new Date(i.startDate):void 0,endDate:i.endDate?new Date(i.endDate):void 0,topN:i.topN,filters:{connectionIds:i.connectionIds,excludeConnectionIds:i.excludeConnectionIds,toolNames:i.toolNames,status:i.status}});return{...l,topTools:E.topTools,topToolsTimeseries:E.timeseries}}let f=await u.storage.monitoring.getStats({organizationId:t.id,startDate:i.startDate?new Date(i.startDate):void 0,endDate:i.endDate?new Date(i.endDate):void 0});return{...f,errorRatePercent:(f.errorRate*100).toFixed(2)}}})});import{z as OT}from"zod";var Qfu;var wUt=v(()=>{GE();uu();Qfu=p({name:"MONITORING_THREAD_USAGE",description:"Aggregate LLM token usage and USD cost per thread for the given thread IDs.",annotations:{title:"Get Thread Usage",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:OT.object({threadIds:OT.array(OT.string()).min(1).max(500).describe("Thread IDs to aggregate usage for (max 500)"),connectionId:OT.string().optional().describe("LLM connection ID (defaults to 'decopilot')"),startDate:OT.string().datetime().optional().describe("Filter by start date (ISO 8601 datetime string)"),endDate:OT.string().datetime().optional().describe("Filter by end date (ISO 8601 datetime string)")}),outputSchema:OT.object({items:OT.array(OT.object({threadId:OT.string(),calls:OT.number(),inputTokens:OT.number(),outputTokens:OT.number(),totalTokens:OT.number(),costUsd:OT.number()}))}),handler:async(i,u)=>{let t=Si(u);return await u.access.check(),await Tw(),{items:await u.storage.monitoring.queryThreadUsage({organizationId:t.id,connectionId:i.connectionId??"decopilot",threadIds:i.threadIds,startDate:i.startDate?new Date(i.startDate):void 0,endDate:i.endDate?new Date(i.endDate):void 0})}}})});var nUt=v(()=>{_Ut();TUt();dUt();wUt()});function Xni(i){return typeof i==="string"&&Wkf.has(i.trim().toLowerCase())}var Wkf;var Mfu=v(()=>{Wkf=new Set([".well-known","_admin","api","auth","cli","commerce-onboarding","dbos-queue-depth","health","hosted-run-pending","login","mcp","metrics","oauth","oauth-proxy","onboarding","org","report","reset-password"])});import{z as xd}from"zod";var zfu;var hUt=v(()=>{uu();Mfu();zfu=p({name:"ORGANIZATION_CREATE",description:"Create a new organization. The caller becomes the owner automatically.",annotations:{title:"Create Organization",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!1,openWorldHint:!1},inputSchema:xd.object({slug:xd.string().min(1).max(50).regex(/^[a-z0-9-]+$/,"Slug must be lowercase alphanumeric with hyphens").refine((i)=>!Xni(i),"Slug is reserved by Studio"),name:xd.string().min(1).max(255),description:xd.string().optional()}),outputSchema:xd.object({id:xd.string(),name:xd.string(),slug:xd.string(),logo:xd.string().nullable().optional(),metadata:xd.any().optional(),createdAt:xd.string().datetime().describe("ISO 8601 timestamp"),members:xd.array(xd.any()).optional()}),handler:async(i,u)=>{$i(u),await u.access.check();let t=Cu(u);if(!t)throw Error("User ID required to create organization");let f=await u.boundAuth.organization.create({name:i.name,slug:i.slug,metadata:i.description?{description:i.description}:void 0,userId:t});if(!f)throw Error("Failed to create organization");return{...f,createdAt:f.createdAt instanceof Date?f.createdAt.toISOString():f.createdAt}}})});import{z as Ih}from"zod";var rfu;var AUt=v(()=>{uu();rfu=p({name:"ORGANIZATION_LIST",description:"List organizations the current user belongs to.",annotations:{title:"List Organizations",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},_meta:{ui:{visibility:"app"}},inputSchema:Ih.object({userId:Ih.string().optional()}),outputSchema:Ih.object({organizations:Ih.array(Ih.object({id:Ih.string(),name:Ih.string(),slug:Ih.string(),logo:Ih.string().nullable().optional(),metadata:Ih.any().optional(),createdAt:Ih.string().datetime().describe("ISO 8601 timestamp")}))}),handler:async(i,u)=>{$i(u),await u.access.check();let t=Cu(u),f=i.userId||t;if(!f)throw Error("User ID required to list organizations");return{organizations:(await u.boundAuth.organization.list(f)).map((E)=>({...E,createdAt:E.createdAt instanceof Date?E.createdAt.toISOString():E.createdAt}))}}})});import{z as bw}from"zod";var qfu;var DUt=v(()=>{uu();qfu=p({name:"ORGANIZATION_GET",description:"Get an organization's details, members, and settings by slug or ID.",annotations:{title:"Get Organization",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:bw.object({}),outputSchema:bw.object({id:bw.string(),name:bw.string(),slug:bw.string(),logo:bw.string().nullable().optional(),metadata:bw.any().optional(),createdAt:bw.string().datetime().describe("ISO 8601 timestamp"),members:bw.array(bw.any()).optional(),invitations:bw.array(bw.any()).optional()}),handler:async(i,u)=>{$i(u),await u.access.check();let t=u.organization?.id;if(!t)throw Error("Organization ID required (no active organization in context)");let f=await u.boundAuth.organization.get(t);if(!f)throw Error("No active organization found");let l=new Date,E=f.invitations?.filter((c)=>new Date(c.expiresAt)>l);return{...f,invitations:E,createdAt:f.createdAt instanceof Date?f.createdAt.toISOString():f.createdAt}}})});import{z as xh}from"zod";var Vfu;var vUt=v(()=>{uu();Vfu=p({name:"ORGANIZATION_UPDATE",description:"Update an organization's name or description.",annotations:{title:"Update Organization",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:xh.object({id:xh.string(),name:xh.string().min(1).max(255).optional(),description:xh.string().optional()}),outputSchema:xh.object({id:xh.string(),name:xh.string(),slug:xh.string(),logo:xh.string().nullable().optional(),metadata:xh.any().optional(),createdAt:xh.string().datetime().describe("ISO 8601 timestamp")}),handler:async(i,u)=>{$i(u),await u.access.check();let t={};if(i.name)t.name=i.name;if(i.description)t.metadata={description:i.description};let f=await u.boundAuth.organization.update({organizationId:i.id,data:t});if(!f)throw Error("Failed to update organization");return{...f,createdAt:f.createdAt instanceof Date?f.createdAt.toISOString():f.createdAt}}})});import{z as to}from"zod";var mfu;var NUt=v(()=>{uu();mfu=p({name:"ORGANIZATION_DELETE",description:"Archive an organization (soft delete).",annotations:{title:"Delete Organization",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:to.object({id:to.string()}),outputSchema:to.object({success:to.boolean(),id:to.string()}),handler:async(i,u)=>{return $i(u),await u.access.check(),await u.boundAuth.organization.update({organizationId:i.id,data:{metadata:{archived:!0,archivedAt:new Date().toISOString()}}}),{success:!0,id:i.id}}})});import{z as It}from"zod";var fo,lo,qv,SUt,O3,Eo,co,_o,To,G$;var yd=v(()=>{fo=It.object({title:It.string(),url:It.string(),icon:It.string()}),lo=It.object({registries:It.record(It.string(),It.object({enabled:It.boolean()})).describe("Per-registry enabled/disabled state. Key is connection ID. Absent registries are treated as enabled."),blockedMcps:It.array(It.string()).describe("List of MCP app_name or app_id values to hide from the store.")}),qv=It.object({keyId:It.string(),modelId:It.string(),title:It.string().optional()}).nullable(),SUt=It.enum(["fast","smart","thinking","image","web_search","deep_research"]),O3=It.enum(["fast","smart","thinking"]),Eo=It.object({tiers:It.object({fast:qv,smart:qv,thinking:qv,image:qv,web_search:qv,deep_research:qv})}),co=It.object({tiers:It.object({fast:qv.optional(),smart:qv.optional(),thinking:qv.optional()})}),_o=It.object({ids:It.array(It.string()).describe("Ordered list of custom virtual MCP agent ids to show on the home view.")}),To=It.object({demo_mode:It.boolean().optional().describe("Curated demo org: the commerce connect modal proceeds without a configured required data source."),reports_only:It.boolean().optional().describe("Curated commerce (reports) look: hides agent navigation, the home Customize button, and the Settings/Automations tabs. Defaulted on for orgs created by commerce onboarding."),qa_agent_enabled:It.boolean().optional().describe("Run the QA Agent on a task's pull request once it's In Review \u2014 it verifies the task actually solved the problem (exercises the feature, not just the diff)."),code_reviewer_enabled:It.boolean().optional().describe("Run the Code Reviewer on a task's pull request once it's In Review \u2014 it reviews the code using the repo's stack-appropriate review skills."),auto_merge:It.boolean().optional().describe("When every enabled reviewer (QA Agent / Code Reviewer) approves a task's pull request, merge it automatically instead of leaving the merge to a human."),sandbox_go_daemon:It.boolean().optional().describe("Provision this org's new sandboxes on the Go sandbox daemon instead of the TypeScript one. Affects the NEXT sandbox only \u2014 live sandboxes drain on the binary they booted with. Ignored unless the deployment sets STUDIO_SANDBOX_GO_TEMPLATE_NAME (the global kill switch); SANDBOX_START's `daemonImpl` overrides it per sandbox in either direction.")}),G$=It.object({id:It.string().describe("Brand context ID"),name:It.string().describe("Company name"),domain:It.string().describe("Company domain (e.g. example.com)"),overview:It.string().describe("Company overview / description"),logo:It.string().nullable().optional().describe("Logo URL"),favicon:It.string().nullable().optional().describe("Favicon URL"),ogImage:It.string().nullable().optional().describe("OG image URL"),fonts:It.object({heading:It.string().optional().describe("Font family for headings"),body:It.string().optional().describe("Font family for body text"),code:It.string().optional().describe("Font family for code / monospace")}).nullable().optional().describe("Font families by semantic role"),colors:It.object({primary:It.string().optional().describe("Primary brand color (hex)"),secondary:It.string().optional().describe("Secondary brand color (hex)"),accent:It.string().optional().describe("Accent / highlight color (hex)"),background:It.string().optional().describe("Background color (hex)"),foreground:It.string().optional().describe("Foreground / text color (hex)")}).nullable().optional().describe("Semantic color palette"),images:It.array(It.record(It.string(),It.unknown())).nullable().optional().describe("Brand images"),metadata:It.record(It.string(),It.unknown()).nullable().optional().describe("Extra design tokens (typography, components, spacing, layout, tone, etc.)"),archivedAt:It.string().nullable().optional().describe("Archive timestamp (null to unarchive)"),isDefault:It.boolean().optional().describe("Whether this is the default brand for the organization")})});import{z as Vv}from"zod";var efu;var OUt=v(()=>{uu();yd();efu=p({name:"ORGANIZATION_SETTINGS_GET",description:"Get organization-level settings including sidebar configuration, store registry settings, simple model mode, and default home agents.",annotations:{title:"Get Organization Settings",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:Vv.object({}),outputSchema:Vv.object({organizationId:Vv.string(),sidebar_items:Vv.array(fo).nullable().optional(),enabled_plugins:Vv.array(Vv.string()).nullable().optional(),registry_config:lo.nullable().optional(),simple_mode:Eo.nullable().optional(),default_home_agents:_o.nullable().optional(),flags:To.nullable().optional(),main_agent_id:Vv.string().nullable().optional(),createdAt:Vv.string().datetime().optional().describe("ISO 8601 timestamp"),updatedAt:Vv.string().datetime().optional().describe("ISO 8601 timestamp")}),handler:async(i,u)=>{$i(u),await u.access.check();let t=u.organization?.id;if(!t)throw Error("Organization ID required (no active organization in context)");let f=await u.storage.organizationSettings.get(t);if(!f)return{organizationId:t};return{...f,createdAt:f.createdAt instanceof Date?f.createdAt.toISOString():f.createdAt,updatedAt:f.updatedAt instanceof Date?f.updatedAt.toISOString():f.updatedAt}}})});import{z as S6}from"zod";var afu;var $Ut=v(()=>{uu();yd();afu=p({name:"ORGANIZATION_SETTINGS_UPDATE",description:"Update organization-level settings such as sidebar configuration, store registry settings, simple model mode, and default home agents.",annotations:{title:"Update Organization Settings",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:S6.object({organizationId:S6.string(),sidebar_items:S6.array(fo).optional(),enabled_plugins:S6.array(S6.string()).optional(),registry_config:lo.optional(),simple_mode:Eo.optional(),default_home_agents:_o.optional(),flags:To.strict().optional().describe("Org boolean toggles. Shallow-merged into the stored flags: keys you pass win (explicit false persists), omitted keys keep their value."),main_agent_id:S6.string().nullable().optional().describe("Virtual MCP id the org lands on instead of the Super Agent. Pass null to clear.")}),outputSchema:S6.object({organizationId:S6.string(),sidebar_items:S6.array(fo).nullable().optional(),enabled_plugins:S6.array(S6.string()).nullable().optional(),registry_config:lo.nullable().optional(),simple_mode:Eo.nullable().optional(),default_home_agents:_o.nullable().optional(),flags:To.nullable().optional(),main_agent_id:S6.string().nullable().optional(),createdAt:S6.string().datetime().describe("ISO 8601 timestamp"),updatedAt:S6.string().datetime().describe("ISO 8601 timestamp")}),handler:async(i,u)=>{if($i(u),await u.access.check(),Si(u).id!==i.organizationId)throw Error("Cannot update settings for a different organization");let f=await u.storage.organizationSettings.upsert(i.organizationId,{sidebar_items:i.sidebar_items,enabled_plugins:i.enabled_plugins,registry_config:i.registry_config,simple_mode:i.simple_mode,default_home_agents:i.default_home_agents,flags:i.flags,main_agent_id:i.main_agent_id});return{...f,createdAt:f.createdAt instanceof Date?f.createdAt.toISOString():f.createdAt,updatedAt:f.updatedAt instanceof Date?f.updatedAt.toISOString():f.updatedAt}}})});import{z as yh}from"zod";var PUt,ofu,sfu;var gUt=v(()=>{uu();yd();PUt=G$.extend({organizationId:yh.string(),archivedAt:yh.string().nullable().optional().describe("ISO 8601 timestamp"),createdAt:yh.string().describe("ISO 8601 timestamp"),updatedAt:yh.string().describe("ISO 8601 timestamp")}),ofu=p({name:"BRAND_CONTEXT_LIST",description:"List all brand contexts (company profiles) for the current organization.",annotations:{title:"List Brand Contexts",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:yh.object({includeArchived:yh.boolean().optional().describe("Include archived brands in the list")}),outputSchema:yh.object({items:yh.array(PUt)}),handler:async(i,u)=>{$i(u),await u.access.check();let t=u.organization?.id;if(!t)throw Error("Organization ID required (no active organization in context)");return{items:(await u.storage.brandContext.list(t,{includeArchived:i.includeArchived})).map((l)=>({...l,archivedAt:l.archivedAt instanceof Date?l.archivedAt.toISOString():l.archivedAt,createdAt:l.createdAt instanceof Date?l.createdAt.toISOString():l.createdAt,updatedAt:l.updatedAt instanceof Date?l.updatedAt.toISOString():l.updatedAt}))}}}),sfu=p({name:"BRAND_CONTEXT_GET",description:"Get a specific brand context by ID.",annotations:{title:"Get Brand Context",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:yh.object({id:yh.string().describe("Brand context ID")}),outputSchema:PUt.extend({organizationId:yh.string()}),handler:async(i,u)=>{$i(u),await u.access.check();let t=u.organization?.id;if(!t)throw Error("Organization ID required (no active organization in context)");let f=await u.storage.brandContext.get(i.id,t);if(!f)throw Error("Brand context not found");return{...f,archivedAt:f.archivedAt instanceof Date?f.archivedAt.toISOString():f.archivedAt,createdAt:f.createdAt instanceof Date?f.createdAt.toISOString():f.createdAt,updatedAt:f.updatedAt instanceof Date?f.updatedAt.toISOString():f.updatedAt}}})});import{z as P8}from"zod";var UUt,pfu,ilu,ulu;var BUt=v(()=>{uu();yd();UUt=G$.extend({organizationId:P8.string(),createdAt:P8.string().describe("ISO 8601 timestamp"),updatedAt:P8.string().describe("ISO 8601 timestamp")}),pfu=p({name:"BRAND_CONTEXT_CREATE",description:"Create a new brand context (company profile) for the current organization.",annotations:{title:"Create Brand Context",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!1,openWorldHint:!1},inputSchema:G$.omit({id:!0}),outputSchema:UUt,handler:async(i,u)=>{$i(u),await u.access.check();let t=u.organization?.id;if(!t)throw Error("Organization ID required (no active organization in context)");let f=await u.storage.brandContext.create(t,{name:i.name,domain:i.domain,overview:i.overview,logo:i.logo??null,favicon:i.favicon??null,ogImage:i.ogImage??null,fonts:i.fonts??null,colors:i.colors??null,images:i.images??null,metadata:i.metadata??null});return{...f,archivedAt:f.archivedAt instanceof Date?f.archivedAt.toISOString():f.archivedAt,createdAt:f.createdAt instanceof Date?f.createdAt.toISOString():f.createdAt,updatedAt:f.updatedAt instanceof Date?f.updatedAt.toISOString():f.updatedAt}}}),ilu=p({name:"BRAND_CONTEXT_UPDATE",description:"Update an existing brand context by ID.",annotations:{title:"Update Brand Context",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:G$.partial().required({id:!0}),outputSchema:UUt,handler:async(i,u)=>{$i(u),await u.access.check();let t=u.organization?.id;if(!t)throw Error("Organization ID required (no active organization in context)");if(!await u.storage.brandContext.get(i.id,t))throw Error("Brand context not found");let{id:l,...E}=i;if(E.isDefault===!0)await u.storage.brandContext.setDefault(l,t);let c=await u.storage.brandContext.update(l,t,{name:E.name,domain:E.domain,overview:E.overview,logo:E.logo!==void 0?E.logo??null:void 0,favicon:E.favicon!==void 0?E.favicon??null:void 0,ogImage:E.ogImage!==void 0?E.ogImage??null:void 0,fonts:E.fonts!==void 0?E.fonts??null:void 0,colors:E.colors!==void 0?E.colors??null:void 0,images:E.images!==void 0?E.images??null:void 0,metadata:E.metadata!==void 0?E.metadata??null:void 0,archivedAt:E.archivedAt!==void 0?E.archivedAt??null:void 0,isDefault:E.isDefault===!1?!1:void 0});return{...c,archivedAt:c.archivedAt instanceof Date?c.archivedAt.toISOString():c.archivedAt,createdAt:c.createdAt instanceof Date?c.createdAt.toISOString():c.createdAt,updatedAt:c.updatedAt instanceof Date?c.updatedAt.toISOString():c.updatedAt}}}),ulu=p({name:"BRAND_CONTEXT_DELETE",description:"Archive a brand context by ID (soft delete).",annotations:{title:"Archive Brand Context",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:P8.object({id:P8.string().describe("Brand context ID")}),outputSchema:P8.object({success:P8.boolean()}),handler:async(i,u)=>{$i(u),await u.access.check();let t=u.organization?.id;if(!t)throw Error("Organization ID required (no active organization in context)");if(!await u.storage.brandContext.get(i.id,t))throw Error("Brand context not found");return await u.storage.brandContext.update(i.id,t,{archivedAt:new Date().toISOString(),isDefault:!1}),{success:!0}}})});async function Jni(i,u,t){let f=i.trim();if(!f.startsWith("http"))f=`https://${f}`;let l=await fetch("https://api.firecrawl.dev/v1/scrape",{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${u}`},body:JSON.stringify({url:f,formats:["branding"]})});if(!l.ok){let h=await l.text().catch(()=>"");throw Error(`Firecrawl API error: ${l.status} ${h.slice(0,200)}`)}let E=await l.json();if(!E.success||!E.data?.branding)return null;let c=E.data.branding,_=E.data.metadata??{},T=Mkf(c,_);return{name:_.title?.split(/[|\u2013\u2014]|\s+-\s+/).map((h)=>h.trim()).filter(Boolean)?.slice().sort((h,A)=>h.length-A.length)[0]??_.ogSiteName??t??i,domain:i,overview:_.description??"",logo:T.logo,favicon:T.favicon,ogImage:T.ogImage,fonts:T.fonts,colors:T.colors,images:null,metadata:Object.keys(T.metadata).length>0?T.metadata:null}}function Mkf(i,u){let t=i.images??{},f=i.colors??{},l={};for(let[w,n]of Object.entries(f))if(typeof n==="string"&&n&&bkf.has(w))l[w]=n;let E={},_=(i.typography??{}).fontFamilies??{};for(let[w,n]of Object.entries(_))if(typeof n==="string"&&n){let h=Qkf[w.toLowerCase()];if(h&&!E[h])E[h]=n}let T=i.fonts;if(Array.isArray(T))for(let w of T){let n=w.family;if(typeof n==="string"&&n&&!E.body)E.body=n}let d={};for(let w of["typography","components","spacing","layout","animations","icons","tone","personality","colorScheme"])if(i[w]!==void 0)d[w]=i[w];return{logo:t.logo??null,favicon:t.favicon??null,ogImage:t.ogImage??u.ogImage??null,fonts:Object.keys(E).length>0?E:null,colors:Object.keys(l).length>0?l:null,metadata:d}}var bkf,Qkf;var tlu=v(()=>{bkf=new Set(["primary","secondary","accent","background","foreground"]),Qkf={heading:"heading",headings:"heading",head:"heading",title:"heading",body:"body",primary:"body",text:"body",code:"code",monospace:"code",mono:"code"}});import{z as Wni}from"zod";var zkf,flu;var IUt=v(()=>{uu();tlu();yd();zkf=G$.pick({id:!0,name:!0,domain:!0,overview:!0,logo:!0,favicon:!0,ogImage:!0,fonts:!0,colors:!0}).extend({success:Wni.boolean()}),flu=p({name:"BRAND_CONTEXT_EXTRACT",description:"Extract brand context (colors, fonts, logos) from a website URL using Firecrawl.",annotations:{title:"Extract Brand Context",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!0},inputSchema:Wni.object({domain:Wni.string().describe("Website domain to extract brand from"),brandId:Wni.string().optional().describe("Existing brand context ID to update (creates new if omitted)")}),outputSchema:zkf,modelSummary:(i)=>i.success?`Brand saved (id=${i.id}, name=${i.name}, domain=${i.domain}). The UI rendered the logo, colors, fonts, and overview.`:"Brand extraction failed.",handler:async(i,u)=>{$i(u),await u.access.check();let t=u.organization?.id;if(!t)throw Error("Organization ID required (no active organization in context)");let f=u.firecrawlApiKey;if(!f)throw Error("FIRECRAWL_API_KEY is not configured. Set the environment variable to enable brand extraction.");let l=await Jni(i.domain,f,i.domain);if(!l)throw Error("Firecrawl did not return branding data for this URL");let E={name:l.name,domain:l.domain,overview:l.overview,logo:l.logo,favicon:l.favicon,ogImage:l.ogImage,fonts:l.fonts,colors:l.colors,images:l.images,metadata:l.metadata},c=i.brandId?await(async()=>{if(!await u.storage.brandContext.get(i.brandId,t))throw Error("Brand context not found");return u.storage.brandContext.update(i.brandId,t,E)})():await u.storage.brandContext.create(t,E);return{id:c.id,name:c.name,domain:c.domain,overview:c.overview,logo:c.logo,favicon:c.favicon,ogImage:c.ogImage,fonts:c.fonts,colors:c.colors,success:!0}}})});function xUt(i){let u=i.metadata??{};return{id:i.id,name:i.name,domain:i.domain||void 0,colors:i.colors??void 0,fonts:i.fonts??void 0,assets:i.logo||i.favicon||i.ogImage?{logo:i.logo??void 0,favicon:i.favicon??void 0,ogImage:i.ogImage??void 0}:void 0,overview:i.overview||void 0,tagline:typeof u.tagline==="string"?u.tagline:void 0,tone:typeof u.tone==="string"?u.tone:void 0,metadata:(()=>{let t=Object.fromEntries(Object.entries(u).filter(([f])=>f!=="tagline"&&f!=="tone"));return Object.keys(t).length>0?t:void 0})()}}var llu,Elu;var yUt=v(()=>{Sfu();uu();llu=p({name:"BRAND_GET",description:"Get a brand context by ID. Omit the ID to get the default brand for the organization.",annotations:{title:"Get Brand",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:Rni,outputSchema:ea,handler:async(i,u)=>{$i(u),await u.access.check();let t=u.organization?.id;if(!t)throw Error("Organization ID required (no active organization in context)");let f=i.id?await u.storage.brandContext.get(i.id,t):await u.storage.brandContext.getDefault(t);if(!f)throw Error(i.id?"Brand not found":"No default brand configured");return xUt(f)}}),Elu=p({name:"BRAND_LIST",description:"List all active brands for the current organization.",annotations:{title:"List Brands",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:Fni,outputSchema:Lni,handler:async(i,u)=>{$i(u),await u.access.check();let t=u.organization?.id;if(!t)throw Error("Organization ID required (no active organization in context)");return{items:(await u.storage.brandContext.list(t)).map(xUt)}}})});import{resolveTxt as rkf}from"dns/promises";function clu(i){return`${qkf}.${i.toLowerCase()}`}function RUt(){return`deco-verify-${crypto.randomUUID().replace(/-/g,"")}`}async function FUt(i,u,t=rkf){if(!u)return!1;try{return(await t(clu(i))).some((l)=>l.join("").trim()===u)}catch{return!1}}var qkf="_deco-verify";var LUt=()=>{};import{z as HE}from"zod";function k$(i){let u=i.verificationStatus==="pending"&&Boolean(i.verificationToken);return{id:i.id,domain:i.domain,joinMode:i.joinMode,verificationStatus:i.verificationStatus,verificationMethod:i.verificationMethod,verifiedAt:i.verifiedAt?new Date(i.verifiedAt).toISOString():null,recordName:u?clu(i.domain):null,recordValue:u?i.verificationToken:null}}function mkf(i){let u=i.toLowerCase().trim();if(!Vkf.test(u))throw Error(`Invalid domain format: "${u}". Must be a valid domain like "acme.com"`);if(Rh.has(u))throw Error(`Cannot claim generic email domain "${u}". Only corporate domains are allowed.`);return u}var Vkf,_lu,bni,Tlu,dlu,wlu,nlu,hlu;var ZUt=v(()=>{Id();LUt();uu();Vkf=/^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+$/,_lu=HE.enum(["off","auto","request"]),bni=HE.object({id:HE.string(),domain:HE.string(),joinMode:_lu,verificationStatus:HE.enum(["pending","verified"]),verificationMethod:HE.enum(["email","dns"]).nullable(),verifiedAt:HE.string().nullable(),recordName:HE.string().nullable(),recordValue:HE.string().nullable()});Tlu=p({name:"ORGANIZATION_DOMAIN_LIST",description:"List the email domains claimed by an organization.",annotations:{title:"List Organization Domains",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:HE.object({}),outputSchema:HE.object({domains:HE.array(bni)}),handler:async(i,u)=>{$i(u),await u.access.check();let t=Si(u);return{domains:(await u.storage.organizationDomains.listByOrganizationId(t.id)).map(k$)}}}),dlu=p({name:"ORGANIZATION_DOMAIN_ADD",description:"Claim an email domain for an organization. If the caller's verified email matches the domain it is trusted immediately; otherwise it requires DNS verification.",annotations:{title:"Add Organization Domain",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:HE.object({domain:HE.string().min(1).max(255).describe("Domain to claim, e.g. acme.com"),joinMode:_lu.optional().describe("Initial join mode (only applied when the domain is trusted immediately via email match).")}),outputSchema:bni,handler:async(i,u)=>{$i(u),await u.access.check();let t=Si(u),f=mkf(i.domain),E=u.auth.user?.email?.split("@")[1]?.toLowerCase(),c=Boolean(u.auth.user?.emailVerified)&&E===f,_=await u.storage.organizationDomains.getByOrgAndDomain(t.id,f);if(_){if(_.verificationStatus!=="verified"&&c){let d=await u.storage.organizationDomains.markVerified(_.id,"email");return k$(d)}return k$(_)}let T=c?await u.storage.organizationDomains.add(t.id,f,{joinMode:i.joinMode??"off",verificationStatus:"verified",verificationMethod:"email"}):await u.storage.organizationDomains.add(t.id,f,{joinMode:"off",verificationStatus:"pending",verificationToken:RUt()});return k$(T)}}),wlu=p({name:"ORGANIZATION_DOMAIN_UPDATE",description:"Set the join mode for a claimed domain. Discoverable modes (auto/request) require the domain to be verified.",annotations:{title:"Update Organization Domain",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:HE.object({id:HE.string(),joinMode:_lu}),outputSchema:bni,handler:async(i,u)=>{$i(u),await u.access.check();let t=Si(u),f=await u.storage.organizationDomains.getById(i.id);if(!f||f.organizationId!==t.id)throw Error("Domain not found");if(i.joinMode!=="off"&&f.verificationStatus!=="verified")throw Error("Verify the domain before enabling auto-join or requests.");let l=await u.storage.organizationDomains.updateJoinMode(i.id,i.joinMode);return k$(l)}}),nlu=p({name:"ORGANIZATION_DOMAIN_VERIFY",description:"Check the DNS TXT record for a pending domain and mark it verified if present.",annotations:{title:"Verify Organization Domain",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!0},inputSchema:HE.object({id:HE.string()}),outputSchema:HE.object({verified:HE.boolean(),domain:bni}),handler:async(i,u)=>{$i(u),await u.access.check();let t=Si(u),f=await u.storage.organizationDomains.getById(i.id);if(!f||f.organizationId!==t.id)throw Error("Domain not found");if(f.verificationStatus==="verified")return{verified:!0,domain:k$(f)};if(!f.verificationToken)throw Error("Domain has no pending DNS verification.");if(!await FUt(f.domain,f.verificationToken))return{verified:!1,domain:k$(f)};let E=await u.storage.organizationDomains.markVerified(i.id,"dns");return{verified:!0,domain:k$(E)}}}),hlu=p({name:"ORGANIZATION_DOMAIN_REMOVE",description:"Remove a claimed domain from an organization.",annotations:{title:"Remove Organization Domain",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:HE.object({id:HE.string()}),outputSchema:HE.object({success:HE.boolean()}),handler:async(i,u)=>{$i(u),await u.access.check();let t=Si(u),f=await u.storage.organizationDomains.getById(i.id);if(!f||f.organizationId!==t.id)throw Error("Domain not found");return await u.storage.organizationDomains.removeById(i.id),{success:!0}}})});function C$(i){return(i instanceof Error?i.message.toLowerCase():"").includes("already a member")}import{z as K4}from"zod";var ekf,Alu,Dlu,vlu;var GUt=v(()=>{uu();Jl();ekf=K4.object({id:K4.string(),userId:K4.string(),status:K4.enum(["pending","approved","denied"]),createdAt:K4.string(),user:K4.object({id:K4.string(),name:K4.string(),email:K4.string(),image:K4.string().nullable()}).nullable()}),Alu=p({name:"ORGANIZATION_JOIN_REQUEST_LIST",description:"List pending requests to join the organization.",annotations:{title:"List Join Requests",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:K4.object({}),outputSchema:K4.object({requests:K4.array(ekf)}),handler:async(i,u)=>{$i(u),await u.access.check();let t=Si(u);return{requests:(await u.storage.organizationJoinRequests.listPendingWithUser(t.id)).map((l)=>({id:l.id,userId:l.userId,status:l.status,createdAt:new Date(l.createdAt).toISOString(),user:l.user}))}}}),Dlu=p({name:"ORGANIZATION_JOIN_REQUEST_APPROVE",description:"Approve a pending join request, adding the user as a member.",annotations:{title:"Approve Join Request",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:K4.object({requestId:K4.string()}),outputSchema:K4.object({success:K4.boolean()}),handler:async(i,u)=>{$i(u),await u.access.check();let t=Si(u),f=await u.storage.organizationJoinRequests.getById(i.requestId);if(!f||f.organizationId!==t.id)throw Error("Join request not found");if(f.status!=="pending")throw Error("Join request has already been decided");let l=Cu(u);if(!await u.storage.organizationJoinRequests.decide(f.id,"approved",l??f.userId))return{success:!0};try{await u.boundAuth.organization.addMember({organizationId:t.id,userId:f.userId,role:["user"]})}catch(c){if(!C$(c))throw c}if(l)mu.capture({distinctId:l,event:"organization_join_request_approved",groups:{organization:t.id},properties:{organization_id:t.id,user_id:f.userId}});return{success:!0}}}),vlu=p({name:"ORGANIZATION_JOIN_REQUEST_DENY",description:"Deny a pending join request.",annotations:{title:"Deny Join Request",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:K4.object({requestId:K4.string()}),outputSchema:K4.object({success:K4.boolean()}),handler:async(i,u)=>{$i(u),await u.access.check();let t=Si(u),f=await u.storage.organizationJoinRequests.getById(i.requestId);if(!f||f.organizationId!==t.id)throw Error("Join request not found");if(f.status!=="pending")throw Error("Join request has already been decided");let l=Cu(u);if(await u.storage.organizationJoinRequests.decide(f.id,"denied",l??f.userId)&&l)mu.capture({distinctId:l,event:"organization_join_request_denied",groups:{organization:t.id},properties:{organization_id:t.id,user_id:f.userId}});return{success:!0}}})});import{z as O6}from"zod";var Nlu;var kUt=v(()=>{Jl();uu();Rw();Nlu=p({name:"ORGANIZATION_MEMBER_ADD",description:"Invite a member to the organization by email with an assigned role.",annotations:{title:"Add Organization Member",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:O6.object({organizationId:O6.string().optional(),userId:O6.string(),role:O6.array(O6.string())}),outputSchema:O6.object({id:O6.string(),organizationId:O6.string(),userId:O6.string(),role:O6.union([O6.string(),O6.array(O6.string())]),createdAt:O6.string().datetime().describe("ISO 8601 timestamp")}),handler:async(i,u)=>{$i(u),await u.access.check();let t=i.organizationId||u.organization?.id;if(!t)throw Error("Organization ID required (no active organization in context)");if(t!==u.organization?.id)throw Error("Organization ID does not match authenticated organization");let f=await u.db.selectFrom("member").select(["role"]).where("userId","=",Cu(u)??"").where("organizationId","=",t).executeTakeFirst();if(!Idi(f?.role,i.role))throw Error(`Insufficient privileges to assign role "${i.role.join(",")}"`);let l=await u.boundAuth.organization.addMember({organizationId:t,userId:i.userId,role:i.role});if(!l)throw Error("Failed to add member");let E=Cu(u);if(E)mu.capture({distinctId:E,event:"organization_member_added",groups:{organization:t},properties:{organization_id:t,added_user_id:i.userId,role:i.role}});return{...l,role:l.role,createdAt:l.createdAt instanceof Date?l.createdAt.toISOString():l.createdAt}}})});import{z as pJ}from"zod";var Slu;var CUt=v(()=>{Jl();uu();Slu=p({name:"ORGANIZATION_MEMBER_REMOVE",description:"Remove a member from the organization. Revokes all their access immediately.",annotations:{title:"Remove Organization Member",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:pJ.object({organizationId:pJ.string().optional(),memberIdOrEmail:pJ.string()}),outputSchema:pJ.object({success:pJ.boolean(),memberIdOrEmail:pJ.string()}),handler:async(i,u)=>{$i(u),await u.access.check();let t=i.organizationId||u.organization?.id;if(!t)throw Error("Organization ID required (no active organization in context)");if(t!==u.organization?.id)throw Error("Organization ID does not match authenticated organization");let f=await u.boundAuth.organization.removeMember({organizationId:t,memberIdOrEmail:i.memberIdOrEmail});u.invalidateMemberRole?.(f.member.userId,t);let l=Cu(u);if(l)mu.capture({distinctId:l,event:"organization_member_removed",groups:{organization:t},properties:{organization_id:t,member_id_or_email:i.memberIdOrEmail}});return{success:!0,memberIdOrEmail:i.memberIdOrEmail}}})});import{z as G_}from"zod";var Olu;var YUt=v(()=>{uu();Olu=p({name:"ORGANIZATION_MEMBER_LIST",description:"List all members in the organization with their roles.",annotations:{title:"List Organization Members",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:G_.object({limit:G_.number().optional(),offset:G_.number().optional()}),outputSchema:G_.object({members:G_.array(G_.object({id:G_.string(),organizationId:G_.string(),userId:G_.string(),role:G_.string(),createdAt:G_.string().datetime().describe("ISO 8601 timestamp"),user:G_.object({id:G_.string(),name:G_.string(),email:G_.string(),image:G_.string().optional()}).optional()}))}),handler:async(i,u)=>{$i(u),await u.access.check();let t=u.organization?.id;if(!t)throw Error("Organization ID required (no active organization in context)");let f=await u.boundAuth.organization.listMembers({organizationId:t,limit:i.limit,offset:i.offset});return{members:(Array.isArray(f)?f:[]).map((E)=>({...E,createdAt:E.createdAt instanceof Date?E.createdAt.toISOString():E.createdAt}))}}})});import{z as fc}from"zod";var $lu;var jUt=v(()=>{Jl();uu();Rw();$lu=p({name:"ORGANIZATION_MEMBER_UPDATE_ROLE",description:"Change a member's role (e.g., admin, member) within the organization.",annotations:{title:"Update Member Role",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:fc.object({organizationId:fc.string().optional(),memberId:fc.string(),role:fc.array(fc.string())}),outputSchema:fc.object({id:fc.string(),organizationId:fc.string(),userId:fc.string(),role:fc.union([fc.string(),fc.array(fc.string())]),createdAt:fc.string().datetime().describe("ISO 8601 timestamp"),user:fc.object({email:fc.string(),name:fc.string(),image:fc.string().optional()})}),handler:async(i,u)=>{$i(u),await u.access.check();let t=i.organizationId||u.organization?.id;if(!t)throw Error("Organization ID required (no active organization in context)");let f=await u.db.selectFrom("member").select(["role"]).where("userId","=",Cu(u)??"").where("organizationId","=",t).executeTakeFirst();if(!Idi(f?.role,i.role))throw Error(`Insufficient privileges to assign role "${i.role.join(",")}"`);let l=await u.boundAuth.organization.updateMemberRole({organizationId:t,memberId:i.memberId,role:i.role});if(!l)throw Error("Failed to update member role");u.invalidateMemberRole?.(l.userId,t);let E=Cu(u);if(E)mu.capture({distinctId:E,event:"organization_member_role_updated",groups:{organization:t},properties:{organization_id:t,member_id:i.memberId,target_user_id:l.userId,new_role:Array.isArray(i.role)?i.role.join(","):i.role}});return{...l,createdAt:l.createdAt instanceof Date?l.createdAt.toISOString():l.createdAt}}})});async function KUt(){if(wo&&Date.now()-wo.fetchedAt<600000)return wo.rate;try{let u=await(await fetch("https://economia.awesomeapi.com.br/json/last/USD-BRL",{signal:AbortSignal.timeout(5000)})).json(),t=parseFloat(u.USDBRL?.bid??"");if(Number.isNaN(t)||t<=0)throw Error("Invalid rate");return wo={rate:t,fetchedAt:Date.now()},t}catch{return wo?.rate??5.5}}function HUt(i,u,t){if(u==="brl")return Math.round(i/t);return i}var wo=null;function Plu(i,u="",t=new URLSearchParams){for(let[f,l]of Object.entries(i)){if(l===void 0||l===null)continue;let E=u?`${u}[${f}]`:f;if(Array.isArray(l))l.forEach((c,_)=>{if(typeof c==="object"&&c!==null)Plu(c,`${E}[${_}]`,t);else t.append(`${E}[${_}]`,String(c))});else if(typeof l==="object")Plu(l,E,t);else t.append(E,String(l))}return t}async function Y$(i,u){let t=_u().stripeSecretKey;if(!t)throw new $6(503,"billing is not configured");let f=u?.params?Plu(u.params).toString():void 0,l=await fetch(`${akf}${i}`,{method:u?.method??(f?"POST":"GET"),headers:{Authorization:`Bearer ${t}`,...f&&{"Content-Type":"application/x-www-form-urlencoded"}},body:f,signal:AbortSignal.timeout(okf)}),E=await l.json().catch(()=>({}));if(!l.ok){let c=E.error?.message??`HTTP ${l.status}`;throw new $6(l.status,c)}return E}async function XUt(i){let u=_u().stripeSeatPriceId;if(!u)throw new $6(503,"billing is not configured");let t=await Y$("/checkout/sessions",{params:{mode:"subscription",line_items:[{price:u,quantity:i.quantity}],success_url:i.successUrl,cancel_url:i.cancelUrl,metadata:{orgId:i.organizationId},subscription_data:{metadata:{orgId:i.organizationId}}}});if(!t.url)throw new $6(500,"checkout session lacks url");return{url:t.url}}async function glu(i){let t=(await Y$(`/subscriptions/${encodeURIComponent(i)}`)).items?.data??[],f=_u().stripeSeatPriceId,l=f?t.find((E)=>E.price?.id===f):t.length===1?t[0]:void 0;if(!l)throw new $6(500,"subscription has no seat item");return{itemId:l.id,quantity:l.quantity??0}}async function JUt(i){let{itemId:u}=await glu(i.subscriptionId),t=await Y$("/invoices/create_preview",{params:{subscription:i.subscriptionId,subscription_details:{items:[{id:u,quantity:i.quantity}],proration_behavior:"always_invoice"}}});return{amountDueCents:t.amount_due??0,currency:t.currency??"usd"}}function skf(i,u){return Math.round(i*(1+u/100))}async function WUt(i){let u=skf(i.amountCents,i.feePercent),t=HUt(i.amountCents,i.currency,await KUt()),f=i.currency==="brl"?`Studio AI credits (R$ ${(i.amountCents/100).toFixed(2)})`:`Studio AI credits ($${(i.amountCents/100).toFixed(2)})`,l=await Y$("/checkout/sessions",{params:{mode:"payment",...i.customerId&&{customer:i.customerId},line_items:[{quantity:1,price_data:{currency:i.currency,unit_amount:u,product_data:{name:f}}}],success_url:i.successUrl,cancel_url:i.cancelUrl,metadata:{kind:"topup",orgId:i.organizationId,creditCents:t}}});if(!l.url)throw new $6(500,"checkout session lacks url");return{url:l.url}}async function bUt(i){let u=await Y$("/billing_portal/sessions",{params:{customer:i.customerId,return_url:i.returnUrl}});if(!u.url)throw new $6(500,"portal session lacks url");return{url:u.url}}async function QUt(i){let{itemId:u}=await glu(i.subscriptionId);await Y$(`/subscriptions/${encodeURIComponent(i.subscriptionId)}`,{params:{items:[{id:u,quantity:i.quantity}],proration_behavior:"always_invoice",payment_behavior:"pending_if_incomplete"}})}async function MUt(i){await Y$(`/subscriptions/${encodeURIComponent(i)}`,{method:"DELETE"})}async function zUt(i){if(i.targetQuantity<1)return!1;let{itemId:u,quantity:t}=await glu(i.subscriptionId);if(t===i.targetQuantity)return!1;return await Y$(`/subscriptions/${encodeURIComponent(i.subscriptionId)}`,{params:{items:[{id:u,quantity:i.targetQuantity}],proration_behavior:"always_invoice",payment_behavior:"pending_if_incomplete"}}),!0}var akf="https://api.stripe.com/v1",$6,okf=15000;var iW=v(()=>{jt();$6=class $6 extends Error{status;constructor(i,u){super(`Stripe API ${i}: ${u}`);this.status=i;this.name="StripeApiError"}}});import{z as H4}from"zod";var pkf,Ulu,Blu;var rUt=v(()=>{iW();lH();uu();qK();pkf=H4.object({legacy:H4.boolean(),billingMode:H4.string(),status:H4.string(),includedReportUrl:H4.string().nullable()}),Ulu=p({name:"ORGANIZATION_SEATS_GET",description:"Get the organization's billing identity and which members hold paid seats.",annotations:{title:"Get Organization Seats",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:H4.object({}),outputSchema:H4.object({billing:pkf.nullable(),paidSeatUserIds:H4.array(H4.string())}),handler:async(i,u)=>{$i(u),await u.access.check();let t=u.organization?.id;if(!t)throw Error("Organization context required");let[f,l]=await Promise.all([u.storage.organizationBilling.getBilling(t),u.storage.organizationBilling.listPaidSeatUserIds(t)]);return{billing:f?{legacy:f.legacy,billingMode:f.billingMode,status:f.status,includedReportUrl:f.includedReportUrl}:null,paidSeatUserIds:l}}}),Blu=p({name:"ORGANIZATION_SEATS_SET",description:"Set members' seats (paid/free). Invoiced organizations apply directly; self-serve organizations with an active subscription also charge the prorated difference on the saved card (preview it with ORGANIZATION_SEATS_PREVIEW first).",annotations:{title:"Set Organization Seats",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:H4.object({seats:H4.array(H4.object({userId:H4.string().min(1),seat:H4.enum(["paid","free"])})).min(1).max(200)}),outputSchema:H4.object({applied:H4.array(H4.object({userId:H4.string(),seat:H4.enum(["paid","free"])})),paidSeatCount:H4.number(),benefitsSyncQueued:H4.boolean()}),handler:async(i,u)=>{$i(u),await u.access.check();let t=u.organization?.id;if(!t)throw Error("Organization context required");let f=Cu(u);if(!f)throw Error("User ID required");let l=await u.storage.organizationBilling.getBilling(t);if(!l||l.legacy)throw Error("This organization is on the legacy plan \u2014 seats do not apply.");let E=fH(l)?l.stripeSubscriptionId:null,c;try{c=await u.storage.organizationBilling.setSeats(t,i.seats,f,{markBenefitsPending:YP()})}catch(T){if(T instanceof a1i)throw Error(T.message);throw T}if(E)try{await QUt({subscriptionId:E,quantity:c.paidSeatCount})}catch(T){let d=T instanceof $6?T.message:"Stripe update failed";throw Error(`Seats saved, but updating the subscription failed: ${d}. Apply again to retry the charge.`)}let _=!1;if(c.benefitsReferenceId)try{await Ev(t,c.benefitsReferenceId,"apply"),_=!0}catch(T){console.error("Failed to enqueue benefit sync (sweep covers):",T)}return{applied:c.applied,paidSeatCount:c.paidSeatCount,benefitsSyncQueued:_}}})});import{z as mv}from"zod";var Ilu,xlu;var qUt=v(()=>{iW();q4();uu();Ilu=p({name:"ORGANIZATION_BILLING_CHECKOUT_START",description:"Start the organization's seat subscription: creates a Stripe Checkout session for the current paid-seat count and returns its URL.",annotations:{title:"Start Billing Checkout",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!1,openWorldHint:!0},inputSchema:mv.object({}),outputSchema:mv.object({url:mv.string(),quantity:mv.number()}),handler:async(i,u)=>{$i(u),await u.access.check();let t=u.organization?.id,f=u.organization?.slug;if(!t||!f)throw Error("Organization context required");let[l,E]=await Promise.all([u.storage.organizationBilling.getBilling(t),u.storage.organizationBilling.listPaidSeatUserIds(t)]);if(!l||l.legacy)throw Error("This organization is on the legacy plan \u2014 no subscription needed.");if(l.billingMode!=="self_serve")throw Error("Contract-billed organizations do not use checkout.");if(l.status==="active")throw Error("This organization already has an active subscription \u2014 seat changes apply directly.");if(l.stripeSubscriptionId)throw Error("This organization still has a subscription on file \u2014 settle or cancel it before starting a new checkout.");let c=E.length;if(c<1)throw Error("Mark at least one member as a paid seat before subscribing.");let _=`${$c()}/${encodeURIComponent(f)}/members`,{url:T}=await XUt({organizationId:t,quantity:c,successUrl:`${_}?checkout=success`,cancelUrl:`${_}?checkout=canceled`});return{url:T,quantity:c}}}),xlu=p({name:"ORGANIZATION_SEATS_PREVIEW",description:"Preview what the organization pays now for changing its paid-seat count (Stripe prorated invoice preview). Read-only \u2014 nothing is charged.",annotations:{title:"Preview Seat Change",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!0},inputSchema:mv.object({quantity:mv.number().int().min(1).max(1000)}),outputSchema:mv.object({amountDueCents:mv.number(),currency:mv.string()}),handler:async(i,u)=>{$i(u),await u.access.check();let t=u.organization?.id;if(!t)throw Error("Organization context required");let f=await u.storage.organizationBilling.getBilling(t);if(!fH(f))throw Error("Seat previews need an active self-serve subscription.");return await JUt({subscriptionId:f.stripeSubscriptionId,quantity:i.quantity})}})});import{z as j$}from"zod";var ylu,Rlu;var VUt=v(()=>{iW();lH();q4();uu();dg();ylu=p({name:"ORGANIZATION_BILLING_PORTAL",description:"Open the organization's Stripe billing portal (manage card, invoices, cancellation). Returns the portal URL.",annotations:{title:"Open Billing Portal",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!1,openWorldHint:!0},inputSchema:j$.object({}),outputSchema:j$.object({url:j$.string()}),handler:async(i,u)=>{$i(u),await u.access.check();let t=Si(u);if(!t.slug)throw Error("Organization context required");let f=await u.storage.organizationBilling.getBilling(t.id);if(!f?.stripeCustomerId)throw Error("This organization has no billing account yet \u2014 subscribe first.");if(f.legacy||f.billingMode!=="self_serve")throw Error("This organization's billing is managed by deco \u2014 contact support.");try{return await bUt({customerId:f.stripeCustomerId,returnUrl:`${$c()}/${encodeURIComponent(t.slug)}/members`})}catch(l){if(l instanceof $6)throw Error(l.message);throw l}}}),Rlu=p({name:"ORGANIZATION_INCLUDED_REPORT_SET",description:"Choose which site's weekly report re-run the organization's subscription includes (null clears it).",annotations:{title:"Set Included Report Site",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:j$.object({url:j$.string().trim().min(1).max(255).nullable()}),outputSchema:j$.object({includedReportUrl:j$.string().nullable(),benefitsSyncQueued:j$.boolean()}),handler:async(i,u)=>{$i(u),await u.access.check();let t=Si(u),f=await u.storage.organizationBilling.getBilling(t.id);if(!f||f.legacy)throw Error("This organization is on the legacy plan \u2014 included reports do not apply.");let l=i.url===null?null:l6i(i.url);if(i.url!==null&&!l)throw Error(`"${i.url}" is not a valid site URL.`);let{updated:E,benefitsReferenceId:c}=await u.storage.organizationBilling.setIncludedReportUrl(t.id,l,{markBenefitsPending:YP()});if(!E)throw Error("Organization billing row missing.");let _=!1;if(c)try{await Ev(t.id,c,"apply"),_=!0}catch(T){console.error("Failed to enqueue benefit sync (sweep covers):",T)}return{includedReportUrl:l,benefitsSyncQueued:_}}})});import{z as no}from"zod";function iCf(i){return`[CREDITS] Paid report runs need at least $${(mUt/100).toFixed(2)} of AI credit balance \u2014 current balance is $${(i/100).toFixed(2)}. Top up and try again.`}var mUt=500,Flu;var eUt=v(()=>{MVi();uu();A3();yO();dg();Flu=p({name:"ORGANIZATION_REPORT_RUN_PAID",description:"Trigger a paid report run for one of the organization's sites, billed against its AI credits (requires at least $5 of balance; the run's real cost plus markup is debited at completion).",annotations:{title:"Run Paid Report",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!1,openWorldHint:!0},inputSchema:no.object({url:no.string().trim().min(1).max(255).optional()}),outputSchema:no.object({url:no.string(),started:no.boolean()}),handler:async(i,u)=>{$i(u),await u.access.check();let t=Si(u),f=Cu(u);if(!f)throw Error("User ID required");if(!Nq())throw Error("Reports are not available on this deployment.");let l;if(i.url)l=l6i(i.url);else l=(await u.storage.organizationBilling.getBilling(t.id))?.includedReportUrl??null;if(!l)throw Error(i.url?`"${i.url}" is not a valid site URL.`:"No site chosen \u2014 pass a url or set the included report site first.");let E=F1().deco;if(!E?.getCreditsBalance)throw Error("AI credit balance is not available on this deployment.");let c=await MA(f,u.auth.user?.email),{balanceCents:_}=await E.getCreditsBalance(c,t.id);if(!(_>=mUt))throw Error(iCf(_??0));return await Ytt({host:l,organizationId:t.id}),{url:l,started:!0}}})});var aUt=v(()=>{hUt();AUt();DUt();vUt();NUt();OUt();$Ut();gUt();BUt();IUt();yUt();ZUt();GUt();kUt();CUt();YUt();jUt();rUt();qUt();VUt();eUt()});function oUt(i,u){return i?.startsWith(`${ho[u]}:`)??!1}function Llu(i){let u=0;for(let t of i){if(t.action!=="status_changed")continue;if(t.data?.to!=="in_review")continue;u=Math.max(u,new Date(t.occurredAt).getTime())}return u}function tCf(i,u){let t=Llu(i),f=new Map;for(let l of i){if(l.action!=="review_approved"&&l.action!=="review_changes_requested")continue;if(new Date(l.occurredAt).getTime()<t)continue;let E=l.data??{};if(E.reviewer!=="qa"&&E.reviewer!=="code_review")continue;if(l.action==="review_approved"){if(u?.verifiedOnly&&E.verified!==!0)continue;f.set(E.reviewer,"approved")}else f.set(E.reviewer,"changes_requested")}return f}function Qni(i,u,t){if(u.length===0)return!1;let f=tCf(i,t);return u.every((l)=>f.get(l)==="approved")}var jc="super-agent",uW,ho,tW,sUt="task-board.item.updated",pUt="task-board.item.deleted";var ev=v(()=>{uW=["qa","code_review"],ho={qa:"QA Agent",code_review:"Code Reviewer"},tW={qa:"qa_agent_enabled",code_review:"code_reviewer_enabled"}});import{z as Nt}from"zod";var av,g8,fCf,lCf,i7t,fW,ECf,cCf,u7t;var $3=v(()=>{ev();av=Nt.enum(["triage","todo","in_progress","in_review","done"]),g8=Nt.enum(["none","low","medium","high","urgent"]),fCf=Nt.object({threadId:Nt.string(),virtualMcpId:Nt.string().nullable(),status:Nt.enum(["in_progress","requires_action","failed","completed","expired"]).nullable(),title:Nt.string().nullable(),lastMessage:Nt.string().nullable(),hasPreview:Nt.boolean(),hasMessages:Nt.boolean(),createdAt:Nt.string()}),lCf=Nt.object({id:Nt.string(),name:Nt.string(),color:Nt.string().nullable().describe('Hex color, e.g. "#3b82f6"'),createdBy:Nt.string(),createdAt:Nt.string().datetime()}),i7t=Nt.object({url:Nt.string(),number:Nt.number(),repoOwner:Nt.string(),repoName:Nt.string(),createdAt:Nt.string(),title:Nt.string().nullable(),body:Nt.string().nullable(),state:Nt.enum(["open","closed"]).nullable(),draft:Nt.boolean().nullable(),merged:Nt.boolean().nullable(),checksStatus:Nt.enum(["pending","passing","failing"]).nullable(),checks:Nt.array(Nt.object({name:Nt.string(),status:Nt.string(),conclusion:Nt.string().nullable(),detailsUrl:Nt.string().nullable(),summary:Nt.string().nullable()})),previewUrl:Nt.string().nullable()}),fW=Nt.object({id:Nt.string(),organizationId:Nt.string(),title:Nt.string(),description:Nt.string().nullable(),status:av,priority:g8,assigneeId:Nt.string().nullable(),assignedBy:Nt.string().nullable(),dueDate:Nt.string().datetime().nullable(),sortOrder:Nt.number(),threads:Nt.array(fCf),tags:Nt.array(lCf),createdBy:Nt.string(),createdAt:Nt.string().datetime(),updatedBy:Nt.string(),updatedAt:Nt.string().datetime()}),ECf=["created","status_changed","assignee_changed","priority_changed","due_date_changed","title_changed","description_changed","tags_changed","review_requested","review_approved","review_changes_requested"],cCf=Nt.enum(ECf),u7t=Nt.object({id:Nt.string(),taskBoardItemId:Nt.string(),action:cCf,actorId:Nt.string().nullable(),data:Nt.record(Nt.string(),Nt.unknown()),occurredAt:Nt.string().datetime()})});async function Mni(i,u,t){if(t===jc)return;let{members:f}=await i.boundAuth.organization.listMembers({organizationId:u,filterField:"userId",filterValue:t});if(!f.some((l)=>l.userId===t))throw Error("assigneeId is not a member of the organization")}var Zlu=v(()=>{$3()});async function Glu(i,u,t){let f;try{return await Promise.race([i.aiProviders.listModels(u,t),new Promise((E,c)=>{f=setTimeout(()=>c(Error("listModels timeout")),_Cf)})])}finally{if(f)clearTimeout(f)}}function TCf(i,u){switch(i){case"fast":return u.chat.fast;case"smart":return u.chat.smart;case"thinking":return u.chat.thinking;case"image":return u.image;case"web_search":return u.webSearch;case"deep_research":return u.deepResearch}}function klu(i,u,t){let f=i.find((l)=>l.modelId===u);return{title:f?.title??t??u,providerId:f?.providerId,capabilities:f?.capabilities,limits:f?.limits??null}}async function $T(i,u,t){let f=i.organization?.id;if(!f)throw Error("resolveTier called without an organization");let E=(await i.storage.organizationSettings.get(f))?.simple_mode?.tiers?.[u]??null,c=i.auth?.user?.id,_=O3.safeParse(u),T=t?.applyUserPrefs&&_.success&&c?(await i.storage.userModelPreferences.get(c,f))?.tiers?.[_.data]??null:null,d=await i.storage.aiProviderKeys.list({organizationId:f});for(let D of[T,E])if(D&&d.some((N)=>N.id===D.keyId)){let N=await Glu(i,D.keyId,f).catch(()=>[]);return{credentialId:D.keyId,modelId:D.modelId,modelMeta:klu(N,D.modelId,D.title)}}if(d.length===0)throw new lW(u);let w={};await Promise.all(d.map(async(D)=>{w[D.id]=await Glu(i,D.id,f).catch(()=>[])}));let n=d.map((D)=>({id:D.id,providerId:D.providerId,label:D.label,presetId:D.presetId,createdBy:D.createdBy,createdAt:D.createdAt})),h=Utt(n,w),A=TCf(u,h);if(!A)throw new lW(u);return{credentialId:A.keyId,modelId:A.modelId,modelMeta:klu(w[A.keyId]??[],A.modelId,A.title)}}async function t7t(i,u,t){let f=i.organization?.id;if(!f)throw Error("resolveSpecificModel called without an organization");let l=await Glu(i,u,f).catch(()=>[]);return{credentialId:u,modelId:t,modelMeta:klu(l,t)}}async function Qw(i,u){try{return await $T(i,u)}catch(t){if(t instanceof lW)return null;return console.warn(`[resolveTier] tier "${u}" resolution failed:`,t),null}}var lW,_Cf=5000;var K$=v(()=>{yd();Z0();lW=class lW extends Error{tier;constructor(i){super(`No model available for tier "${i}". Connect a provider or configure the tier in organization settings.`);this.tier=i;this.name="TierUnavailableError"}}});function zni(i){return i.sandboxProviderKind==="agent-sandbox"&&i.harnessId==="decopilot"}function f7t(i){return i.harnessId==="decopilot"&&(i.sandboxProviderKind==null||i.sandboxProviderKind==="agent-sandbox")}function wCf(i){return{type:"data-run-status",id:"run-status",data:{stage:i}}}function l7t(i){if(!i||typeof i!=="object")return!1;return i.type==="data-run-status"}async function Fh(i,u,t){if(!i)return;try{await i.publishRawChunk(u,wCf(t))}catch{}}var dCf,Ao,dl4;var EW=v(()=>{dCf=["waiting-runner","starting-run","waiting-capacity","gathering-context","preparing-tools","starting-assistant","analyzing-scope"],Ao=["gathering-context","preparing-tools","starting-assistant","analyzing-scope"],dl4=new Set(dCf)});function rni(){return crypto.randomUUID()}var Ylu=C((hl4,_7t)=>{var{defineProperty:Clu,getOwnPropertyDescriptor:nCf,getOwnPropertyNames:hCf}=Object,ACf=Object.prototype.hasOwnProperty,DCf=(i,u)=>{for(var t in u)Clu(i,t,{get:u[t],enumerable:!0})},vCf=(i,u,t,f)=>{if(u&&typeof u==="object"||typeof u==="function"){for(let l of hCf(u))if(!ACf.call(i,l)&&l!==t)Clu(i,l,{get:()=>u[l],enumerable:!(f=nCf(u,l))||f.enumerable})}return i},NCf=(i)=>vCf(Clu({},"__esModule",{value:!0}),i),E7t={};DCf(E7t,{SYMBOL_FOR_REQ_CONTEXT:()=>c7t,getContext:()=>SCf});_7t.exports=NCf(E7t);var c7t=Symbol.for("@vercel/request-context");function SCf(){return globalThis[c7t]?.get?.()??{}}});var Do=C((Al4,w7t)=>{var{defineProperty:jlu,getOwnPropertyDescriptor:OCf,getOwnPropertyNames:$Cf}=Object,PCf=Object.prototype.hasOwnProperty,gCf=(i,u)=>{for(var t in u)jlu(i,t,{get:u[t],enumerable:!0})},UCf=(i,u,t,f)=>{if(u&&typeof u==="object"||typeof u==="function"){for(let l of $Cf(u))if(!PCf.call(i,l)&&l!==t)jlu(i,l,{get:()=>u[l],enumerable:!(f=OCf(u,l))||f.enumerable})}return i},BCf=(i)=>UCf(jlu({},"__esModule",{value:!0}),i),T7t={};gCf(T7t,{VercelOidcTokenError:()=>d7t});w7t.exports=BCf(T7t);class d7t extends Error{constructor(i,u){super(i);this.name="VercelOidcTokenError",this.cause=u}toString(){if(this.cause)return`${this.name}: ${this.message}: ${this.cause}`;return`${this.name}: ${this.message}`}}});var D7t=C((Dl4,A7t)=>{var{create:ICf,defineProperty:qni,getOwnPropertyDescriptor:xCf,getOwnPropertyNames:yCf,getPrototypeOf:RCf}=Object,FCf=Object.prototype.hasOwnProperty,LCf=(i,u)=>{for(var t in u)qni(i,t,{get:u[t],enumerable:!0})},n7t=(i,u,t,f)=>{if(u&&typeof u==="object"||typeof u==="function"){for(let l of yCf(u))if(!FCf.call(i,l)&&l!==t)qni(i,l,{get:()=>u[l],enumerable:!(f=xCf(u,l))||f.enumerable})}return i},Hlu=(i,u,t)=>(t=i!=null?ICf(RCf(i)):{},n7t(u||!i||!i.__esModule?qni(t,"default",{value:i,enumerable:!0}):t,i)),ZCf=(i)=>n7t(qni({},"__esModule",{value:!0}),i),h7t={};LCf(h7t,{findRootDir:()=>CCf,getUserDataDir:()=>YCf});A7t.exports=ZCf(h7t);var vo=Hlu(Oi("path")),GCf=Hlu(Oi("fs")),Klu=Hlu(Oi("os")),kCf=Do();function CCf(){try{let i=process.cwd();while(i!==vo.default.dirname(i)){let u=vo.default.join(i,".vercel");if(GCf.default.existsSync(u))return i;i=vo.default.dirname(i)}}catch(i){throw new kCf.VercelOidcTokenError("Token refresh only supported in node server environments")}return null}function YCf(){if(process.env.XDG_DATA_HOME)return process.env.XDG_DATA_HOME;switch(Klu.default.platform()){case"darwin":return vo.default.join(Klu.default.homedir(),"Library/Application Support");case"linux":return vo.default.join(Klu.default.homedir(),".local/share");case"win32":if(process.env.LOCALAPPDATA)return process.env.LOCALAPPDATA;return null;default:return null}}});var g7t=C((vl4,P7t)=>{var{create:jCf,defineProperty:Vni,getOwnPropertyDescriptor:KCf,getOwnPropertyNames:HCf,getPrototypeOf:XCf}=Object,JCf=Object.prototype.hasOwnProperty,WCf=(i,u)=>{for(var t in u)Vni(i,t,{get:u[t],enumerable:!0})},v7t=(i,u,t,f)=>{if(u&&typeof u==="object"||typeof u==="function"){for(let l of HCf(u))if(!JCf.call(i,l)&&l!==t)Vni(i,l,{get:()=>u[l],enumerable:!(f=KCf(u,l))||f.enumerable})}return i},N7t=(i,u,t)=>(t=i!=null?jCf(XCf(i)):{},v7t(u||!i||!i.__esModule?Vni(t,"default",{value:i,enumerable:!0}):t,i)),bCf=(i)=>v7t(Vni({},"__esModule",{value:!0}),i),S7t={};WCf(S7t,{isValidAccessToken:()=>rCf,readAuthConfig:()=>MCf,writeAuthConfig:()=>zCf});P7t.exports=bCf(S7t);var No=N7t(Oi("fs")),O7t=N7t(Oi("path")),QCf=So();function $7t(){let i=(0,QCf.getVercelDataDir)();if(!i)throw Error(`Unable to find Vercel CLI data directory. Your platform: ${process.platform}. Supported: darwin, linux, win32.`);return O7t.join(i,"auth.json")}function MCf(){try{let i=$7t();if(!No.existsSync(i))return null;let u=No.readFileSync(i,"utf8");if(!u)return null;return JSON.parse(u)}catch(i){return null}}function zCf(i){let u=$7t(),t=O7t.dirname(u);if(!No.existsSync(t))No.mkdirSync(t,{mode:504,recursive:!0});No.writeFileSync(u,JSON.stringify(i,null,2),{mode:384})}function rCf(i,u=0){if(!i.token)return!1;if(typeof i.expiresAt!=="number")return!0;let t=Math.floor(Date.now()/1000),f=u/1000;return i.expiresAt>=t+f}});var x7t=C((Nl4,I7t)=>{var{defineProperty:Wlu,getOwnPropertyDescriptor:qCf,getOwnPropertyNames:VCf}=Object,mCf=Object.prototype.hasOwnProperty,eCf=(i,u)=>{for(var t in u)Wlu(i,t,{get:u[t],enumerable:!0})},aCf=(i,u,t,f)=>{if(u&&typeof u==="object"||typeof u==="function"){for(let l of VCf(u))if(!mCf.call(i,l)&&l!==t)Wlu(i,l,{get:()=>u[l],enumerable:!(f=qCf(u,l))||f.enumerable})}return i},oCf=(i)=>aCf(Wlu({},"__esModule",{value:!0}),i),U7t={};eCf(U7t,{processTokenResponse:()=>tYf,refreshTokenRequest:()=>uYf});I7t.exports=oCf(U7t);var Xlu=Oi("os"),sCf="https://vercel.com",pCf="cl_HYyOPBNtFMfHhaUn9L4QPfTZz6TP47bp",B7t=`@vercel/oidc node-${process.version} ${(0,Xlu.platform)()} (${(0,Xlu.arch)()}) ${(0,Xlu.hostname)()}`,Jlu=null;async function iYf(){if(Jlu)return Jlu;let i=`${sCf}/.well-known/openid-configuration`,u=await fetch(i,{headers:{"user-agent":B7t}});if(!u.ok)throw Error("Failed to discover OAuth endpoints");let t=await u.json();if(!t||typeof t.token_endpoint!=="string")throw Error("Invalid OAuth discovery response");let f=t.token_endpoint;return Jlu=f,f}async function uYf(i){let u=await iYf();return await fetch(u,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded","user-agent":B7t},body:new URLSearchParams({client_id:pCf,grant_type:"refresh_token",...i})})}async function tYf(i){let u=await i.json();if(!i.ok){let t=typeof u==="object"&&u&&"error"in u?String(u.error):"Token refresh failed";return[Error(t)]}if(typeof u!=="object"||u===null)return[Error("Invalid token response")];if(typeof u.access_token!=="string")return[Error("Missing access_token in response")];if(u.token_type!=="Bearer")return[Error("Invalid token_type in response")];if(typeof u.expires_in!=="number")return[Error("Missing expires_in in response")];return[null,u]}});var Qlu=C((Sl4,L7t)=>{var{defineProperty:blu,getOwnPropertyDescriptor:fYf,getOwnPropertyNames:lYf}=Object,EYf=Object.prototype.hasOwnProperty,cYf=(i,u)=>{for(var t in u)blu(i,t,{get:u[t],enumerable:!0})},_Yf=(i,u,t,f)=>{if(u&&typeof u==="object"||typeof u==="function"){for(let l of lYf(u))if(!EYf.call(i,l)&&l!==t)blu(i,l,{get:()=>u[l],enumerable:!(f=fYf(u,l))||f.enumerable})}return i},TYf=(i)=>_Yf(blu({},"__esModule",{value:!0}),i),y7t={};cYf(y7t,{AccessTokenMissingError:()=>R7t,RefreshAccessTokenFailedError:()=>F7t});L7t.exports=TYf(y7t);class R7t extends Error{constructor(){super("No authentication found. Please log in with the Vercel CLI (vercel login).");this.name="AccessTokenMissingError"}}class F7t extends Error{constructor(i){super("Failed to refresh authentication token.",{cause:i});this.name="RefreshAccessTokenFailedError"}}});var So=C((Ol4,Y7t)=>{var{create:dYf,defineProperty:mni,getOwnPropertyDescriptor:wYf,getOwnPropertyNames:nYf,getPrototypeOf:hYf}=Object,AYf=Object.prototype.hasOwnProperty,DYf=(i,u)=>{for(var t in u)mni(i,t,{get:u[t],enumerable:!0})},G7t=(i,u,t,f)=>{if(u&&typeof u==="object"||typeof u==="function"){for(let l of nYf(u))if(!AYf.call(i,l)&&l!==t)mni(i,l,{get:()=>u[l],enumerable:!(f=wYf(u,l))||f.enumerable})}return i},k7t=(i,u,t)=>(t=i!=null?dYf(hYf(i)):{},G7t(u||!i||!i.__esModule?mni(t,"default",{value:i,enumerable:!0}):t,i)),vYf=(i)=>G7t(mni({},"__esModule",{value:!0}),i),C7t={};DYf(C7t,{assertVercelOidcTokenResponse:()=>Mlu,findProjectInfo:()=>$Yf,getTokenPayload:()=>UYf,getVercelDataDir:()=>NYf,getVercelOidcToken:()=>OYf,getVercelToken:()=>SYf,isExpired:()=>BYf,loadToken:()=>gYf,saveToken:()=>PYf});Y7t.exports=vYf(C7t);var Oo=k7t(Oi("path")),U8=k7t(Oi("fs")),TW=Do(),eni=D7t(),cW=g7t(),Z7t=x7t(),_W=Qlu();function NYf(){let u=(0,eni.getUserDataDir)();if(!u)return null;return Oo.join(u,"com.vercel.cli")}async function SYf(i){let u=(0,cW.readAuthConfig)();if(!u?.token)throw new _W.AccessTokenMissingError;if((0,cW.isValidAccessToken)(u,i?.expirationBufferMs))return u.token;if(!u.refreshToken)throw(0,cW.writeAuthConfig)({}),new _W.RefreshAccessTokenFailedError("No refresh token available");try{let t=await(0,Z7t.refreshTokenRequest)({refresh_token:u.refreshToken}),[f,l]=await(0,Z7t.processTokenResponse)(t);if(f||!l)throw(0,cW.writeAuthConfig)({}),new _W.RefreshAccessTokenFailedError(f);let E={token:l.access_token,expiresAt:Math.floor(Date.now()/1000)+l.expires_in};if(l.refresh_token)E.refreshToken=l.refresh_token;return(0,cW.writeAuthConfig)(E),E.token}catch(t){if((0,cW.writeAuthConfig)({}),t instanceof _W.AccessTokenMissingError||t instanceof _W.RefreshAccessTokenFailedError)throw t;throw new _W.RefreshAccessTokenFailedError(t)}}async function OYf(i,u,t){let f=`https://api.vercel.com/v1/projects/${u}/token?source=vercel-oidc-refresh${t?`&teamId=${t}`:""}`,l=await fetch(f,{method:"POST",headers:{Authorization:`Bearer ${i}`}});if(!l.ok)throw new TW.VercelOidcTokenError(`Failed to refresh OIDC token: ${l.statusText}`);let E=await l.json();return Mlu(E),E}function Mlu(i){if(!i||typeof i!=="object")throw TypeError("Vercel OIDC token is malformed. Expected an object. Please run `vc env pull` and try again");if(!("token"in i)||typeof i.token!=="string")throw TypeError("Vercel OIDC token is malformed. Expected a string-valued token property. Please run `vc env pull` and try again")}function $Yf(){let i=(0,eni.findRootDir)();if(!i)throw new TW.VercelOidcTokenError("Unable to find project root directory. Have you linked your project with `vc link?`");let u=Oo.join(i,".vercel","project.json");if(!U8.existsSync(u))throw new TW.VercelOidcTokenError("project.json not found, have you linked your project with `vc link?`");let t=JSON.parse(U8.readFileSync(u,"utf8"));if(typeof t.projectId!=="string"&&typeof t.orgId!=="string")throw TypeError("Expected a string-valued projectId property. Try running `vc link` to re-link your project.");return{projectId:t.projectId,teamId:t.orgId}}function PYf(i,u){let t=(0,eni.getUserDataDir)();if(!t)throw new TW.VercelOidcTokenError("Unable to find user data directory. Please reach out to Vercel support.");let f=Oo.join(t,"com.vercel.token",`${u}.json`),l=JSON.stringify(i);U8.mkdirSync(Oo.dirname(f),{mode:504,recursive:!0}),U8.writeFileSync(f,l),U8.chmodSync(f,432);return}function gYf(i){let u=(0,eni.getUserDataDir)();if(!u)throw new TW.VercelOidcTokenError("Unable to find user data directory. Please reach out to Vercel support.");let t=Oo.join(u,"com.vercel.token",`${i}.json`);if(!U8.existsSync(t))return null;let f=JSON.parse(U8.readFileSync(t,"utf8"));return Mlu(f),f}function UYf(i){let u=i.split(".");if(u.length!==3)throw new TW.VercelOidcTokenError("Invalid token. Please run `vc env pull` and try again");let t=u[1].replace(/-/g,"+").replace(/_/g,"/"),f=t.padEnd(t.length+(4-t.length%4)%4,"=");return JSON.parse(Buffer.from(f,"base64").toString("utf8"))}function BYf(i,u=0){return i.exp*1000<Date.now()+u}});var X7t=C(($l4,H7t)=>{var{defineProperty:zlu,getOwnPropertyDescriptor:IYf,getOwnPropertyNames:xYf}=Object,yYf=Object.prototype.hasOwnProperty,RYf=(i,u)=>{for(var t in u)zlu(i,t,{get:u[t],enumerable:!0})},FYf=(i,u,t,f)=>{if(u&&typeof u==="object"||typeof u==="function"){for(let l of xYf(u))if(!yYf.call(i,l)&&l!==t)zlu(i,l,{get:()=>u[l],enumerable:!(f=IYf(u,l))||f.enumerable})}return i},LYf=(i)=>FYf(zlu({},"__esModule",{value:!0}),i),K7t={};RYf(K7t,{refreshToken:()=>ZYf});H7t.exports=LYf(K7t);var j7t=Do(),H$=So();async function ZYf(i){let u=i?.project,t=i?.team;if(!u&&!t){let l=(0,H$.findProjectInfo)();u=l.projectId,t=l.teamId}else if(!u||!t){let l=(0,H$.findProjectInfo)();u=u??l.projectId,t=t??l.teamId}if(!u)throw new j7t.VercelOidcTokenError("Failed to refresh OIDC token: No project specified. Try re-linking your project with `vc link`");let f=(0,H$.loadToken)(u);if(!f||(0,H$.isExpired)((0,H$.getTokenPayload)(f.token),i?.expirationBufferMs)){let l=await(0,H$.getVercelToken)({expirationBufferMs:i?.expirationBufferMs});if(f=await(0,H$.getVercelOidcToken)(l,u,t),!f)throw new j7t.VercelOidcTokenError("Failed to refresh OIDC token");(0,H$.saveToken)(f,u)}process.env.VERCEL_OIDC_TOKEN=f.token;return}});var b7t=C((Pl4,W7t)=>{var{defineProperty:qlu,getOwnPropertyDescriptor:GYf,getOwnPropertyNames:kYf}=Object,CYf=Object.prototype.hasOwnProperty,YYf=(i,u)=>{for(var t in u)qlu(i,t,{get:u[t],enumerable:!0})},jYf=(i,u,t,f)=>{if(u&&typeof u==="object"||typeof u==="function"){for(let l of kYf(u))if(!CYf.call(i,l)&&l!==t)qlu(i,l,{get:()=>u[l],enumerable:!(f=GYf(u,l))||f.enumerable})}return i},KYf=(i)=>jYf(qlu({},"__esModule",{value:!0}),i),J7t={};YYf(J7t,{getVercelOidcToken:()=>JYf,getVercelOidcTokenSync:()=>rlu});W7t.exports=KYf(J7t);var HYf=Ylu(),XYf=Do();async function JYf(i){let u="",t;try{u=rlu()}catch(f){t=f}try{let[{getTokenPayload:f,isExpired:l},{refreshToken:E}]=await Promise.all([await Promise.resolve().then(() => Z(So())),await Promise.resolve().then(() => Z(X7t()))]);if(!u||l(f(u),i?.expirationBufferMs))await E(i),u=rlu()}catch(f){let l=t instanceof Error?t.message:"";if(f instanceof Error)l=`${l}
+  `.execute(i)).rows[0]?.exists)await Vf`CREATE ROLE ${Vf.id(t)} NOLOGIN`.execute(i);await Vf`GRANT ${Vf.id(t)} TO CURRENT_USER`.execute(i),await Vf`GRANT USAGE, CREATE ON SCHEMA ${Vf.id(u)} TO ${Vf.id(t)}`.execute(i),await Vf`GRANT ALL ON ALL TABLES IN SCHEMA ${Vf.id(u)} TO ${Vf.id(t)}`.execute(i),await Vf`GRANT ALL ON ALL SEQUENCES IN SCHEMA ${Vf.id(u)} TO ${Vf.id(t)}`.execute(i),await Vf`ALTER DEFAULT PRIVILEGES IN SCHEMA ${Vf.id(u)} GRANT ALL ON TABLES TO ${Vf.id(t)}`.execute(i),await Vf`ALTER DEFAULT PRIVILEGES IN SCHEMA ${Vf.id(u)} GRANT ALL ON SEQUENCES TO ${Vf.id(t)}`.execute(i),await Vf`REVOKE ALL ON SCHEMA public FROM ${Vf.id(t)}`.execute(i)}async function Nkf(i,u,t,f){try{return await i.transaction().execute(async(l)=>{return await Vf`SET LOCAL ROLE ${Vf.id(t)}`.execute(l),await Vf`SET LOCAL search_path TO ${Vf.id(u)}`.execute(l),await Vf.raw(f).execute(l)})}catch(l){if(Dkf(l))return await vkf(i,u,t),await i.transaction().execute(async(E)=>{return await Vf`SET LOCAL ROLE ${Vf.id(t)}`.execute(E),await Vf`SET LOCAL search_path TO ${Vf.id(u)}`.execute(E),await Vf.raw(f).execute(E)});throw l}}var dkf,nkf,z8t;var r8t=v(()=>{uu();dkf=S3.object({results:S3.array(S3.unknown()).optional(),success:S3.boolean().optional()});nkf=S3.object({sql:S3.string().describe("The SQL query to run"),params:S3.array(S3.any()).describe("The parameters to pass to the SQL query").optional()});z8t=p({name:"DATABASES_RUN_SQL",description:"Run a SQL query in a connection-scoped isolated schema. Supports SELECT, DDL, and DML.",annotations:{title:"Run SQL Query",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!1,openWorldHint:!1},inputSchema:nkf,outputSchema:S3.object({result:S3.array(dkf)}),handler:async(i,u)=>{$i(u),await u.access.check();let t=wkf(i.sql,i.params||[]);if(!u.connectionId)throw Error("Connection context required for database access");console.warn("DATABASES_RUN_SQL invoked",{"tool.deprecation_probe":"DATABASES_RUN_SQL","connection.id":u.connectionId,"organization.id":u.organization?.id??null,"user.id":u.auth.user?.id??null});let f=hkf(u.connectionId),l=Akf(u.connectionId);return{result:[{results:(await Nkf(u.db,f,l,t)).rows,success:!0}]}}})});function jni(i){let u=i.access.getRole();if(!yw(u))throw new pA("Only organization owners and admins can change org-wide pin status")}var xfu=v(()=>{Rw();Kg()});async function Kni(i,u,t){let f=[...new Set(t)],l=await Promise.all(f.map((c)=>i.storage.connections.findById(c,u))),E=f.filter((c,_)=>!l[_]);if(E.length>0)throw Error(`Connection not found: ${E.join(", ")}`)}import{z as m8t}from"zod";function Okf(){let i=q8t[Math.floor(Math.random()*q8t.length)];return`icon://${V8t[Math.floor(Math.random()*V8t.length)]}?color=${i}`}var q8t,V8t,$kf,Pkf,yfu;var e8t=v(()=>{uu();RO();xfu();za();q8t=["red","orange","amber","yellow","lime","green","emerald","cyan","sky","blue","indigo","violet","purple","fuchsia","pink","rose"],V8t=["Star01","Zap","Heart","Globe01","Compass03","Lightbulb02","Rocket01","Flag01","BookOpen01","Shield01","Key01","Diamond01","Cube01","Target04","Award01","Briefcase01","Coffee","Feather","Hexagon01","Layers3_01","Map01","Palette","Package","Terminal"];$kf=m8t.object({data:Oci.describe("Data for the new virtual MCP")}),Pkf=m8t.object({item:n_.describe("The created virtual MCP entity")}),yfu=p({name:"COLLECTION_VIRTUAL_MCP_CREATE",description:"Create a Virtual MCP (agent) that aggregates tools from multiple connections into one endpoint. Pass `prompts` to seed the agent with kickstart prompts (conversation starters shown as icebreakers). Author them from the agent's role/instructions and the descriptions of the tools it will have, so the starters are coherent and immediately useful.",annotations:{title:"Create Virtual MCP",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!1,openWorldHint:!1},inputSchema:$kf,outputSchema:Pkf,handler:async(i,u)=>{$i(u);let t=Si(u);await u.access.check();let f=Cu(u);if(!f)throw Error("User ID required to create virtual MCP");if(i.data.pinned===!0)jni(u);let{prompts:l,...E}=i.data;if(E.connections.length>0)await Kni(u,t.id,E.connections.map((T)=>T.connection_id));let c={...E,icon:E.icon??Okf()},_=await u.storage.virtualMcps.create(t.id,f,c);if(l?.length&&u.orgFs&&_.id)await Tni(u.orgFs,_.id,f,l);return{item:_}}})});function gkf(i){let u=[],t=0;while(t<i.length){let f=i[t];if(f==="%")u.push(".*");else if(f==="_")u.push(".");else if(/[.*+?^${}()|[\]\\]/.test(f))u.push("\\"+f);else u.push(f);t++}return u.join("")}function Z$(i){return typeof i==="string"||typeof i==="number"}function Rfu(i,u){let t=u.split("."),f=i;for(let l of t){if(f==null||typeof f!=="object")return;f=f[l]}return f}function Ukf(i,u){return i.connections.some((t)=>t.connection_id===u)}function Hni(i,u){if("conditions"in u){let{operator:_,conditions:T}=u;switch(_){case"and":return T.every((d)=>Hni(i,d));case"or":return T.some((d)=>Hni(i,d));case"not":return!T.every((d)=>Hni(i,d));default:return!0}}let{field:t,operator:f,value:l}=u,E=t.join(".");if(E==="connection_id"){if(f!=="eq"||typeof l!=="string")return!1;return Ukf(i,l)}let c=Rfu(i,E);switch(f){case"eq":return c===l;case"gt":return Z$(c)&&Z$(l)&&c>l;case"gte":return Z$(c)&&Z$(l)&&c>=l;case"lt":return Z$(c)&&Z$(l)&&c<l;case"lte":return Z$(c)&&Z$(l)&&c<=l;case"in":return Array.isArray(l)&&l.includes(c);case"like":if(typeof c!=="string"||typeof l!=="string")return!1;if(l.length>100)return!1;let _=gkf(l);return new RegExp(`^${_}$`,"i").test(c);case"contains":if(typeof c!=="string"||typeof l!=="string")return!1;return c.toLowerCase().includes(l.toLowerCase());default:return!0}}function Bkf(i,u){return[...i].sort((t,f)=>{for(let l of u){let E=l.field.join("."),c=Rfu(t,E),_=Rfu(f,E),T=0;if(c==null&&_==null)continue;if(c==null)T=l.nulls==="first"?-1:1;else if(_==null)T=l.nulls==="first"?1:-1;else if(typeof c==="string"&&typeof _==="string")T=c.localeCompare(_);else if(typeof c==="number"&&typeof _==="number")T=c-_;else T=String(c).localeCompare(String(_));if(T!==0)return l.direction==="desc"?-T:T}return 0})}var Ikf,xkf,Ffu;var a8t=v(()=>{Ww();uu();RO();Ikf=Bh,xkf=Mv(n_),Ffu=p({name:"COLLECTION_VIRTUAL_MCP_LIST",description:"List all MCP virtual MCPs in the organization",annotations:{title:"List Virtual MCPs",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:Ikf,outputSchema:xkf,handler:async(i,u)=>{await u.access.check();let t=Si(u),f=i.where&&!("conditions"in i.where)&&i.where.field.join(".")==="connection_id"&&i.where.operator==="eq"&&typeof i.where.value==="string"?i.where.value:void 0,l=i.where&&!("conditions"in i.where)&&i.where.field.join(".")==="pinned"&&i.where.operator==="eq"&&typeof i.where.value==="boolean"?i.where.value:void 0,c=f?await u.storage.virtualMcps.listByConnectionId(t.id,f):await u.storage.virtualMcps.list(t.id,l!==void 0?{pinnedOnly:l}:void 0);if(i.where)c=c.filter((h)=>Hni(h,i.where));if(i.orderBy&&i.orderBy.length>0)c=Bkf(c,i.orderBy);let _=c.length,T=i.offset??0,d=i.limit??100,w=c.slice(T,T+d),n=T+d<_;return{items:w,totalCount:_,hasMore:n}}})});import{z as Lfu}from"zod";var ykf,Rkf,Zfu;var o8t=v(()=>{uu();RO();ykf=Lfu.object({id:Lfu.string().describe("ID of the virtual MCP to retrieve")}),Rkf=Lfu.object({item:n_.nullable().describe("The retrieved virtual MCP, or null if not found")}),Zfu=p({name:"COLLECTION_VIRTUAL_MCP_GET",description:"Get a Virtual MCP's configuration, connections, and virtual tools by ID.",annotations:{title:"Get Virtual MCP",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:ykf,outputSchema:Rkf,handler:async(i,u)=>{$i(u);let t=Si(u);await u.access.check();let f=await u.storage.virtualMcps.findById(i.id);if(f&&f.organization_id!==t.id)return{item:null};if(!f)return{item:null};return{item:f}}})});import{z as Gfu}from"zod";var Fkf,Lkf,kfu;var s8t=v(()=>{uu();za();RO();xfu();Fkf=Gfu.object({id:Gfu.string().describe("ID of the virtual MCP to update"),data:$ci.describe("Partial virtual MCP data to update")}),Lkf=Gfu.object({item:n_.describe("The updated virtual MCP entity")}),kfu=p({name:"COLLECTION_VIRTUAL_MCP_UPDATE",description:"Update a Virtual MCP's name, slug, connection list, or kickstart prompts. Pass `prompts` to replace the agent's conversation starters (full set; empty array clears them).",annotations:{title:"Update Virtual MCP",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:Fkf,outputSchema:Lkf,handler:async(i,u)=>{$i(u);let t=Si(u);await u.access.check();let f=Cu(u);if(!f)throw Error("User ID required to update virtual MCP");let l=await u.storage.virtualMcps.findById(i.id);if(!l)throw Error(`Virtual MCP not found: ${i.id}`);if(l.organization_id!==t.id)throw Error(`Virtual MCP not found: ${i.id}`);let{prompts:E,...c}=i.data;if(c.metadata&&l.metadata)c.metadata={...l.metadata,...c.metadata};if(c.pinned!==void 0&&c.pinned!==l.pinned)jni(u);if(c.connections?.length)await Kni(u,t.id,c.connections.map((T)=>T.connection_id));let _=await u.storage.virtualMcps.update(i.id,f,c);if(E!==void 0&&u.orgFs)await Tni(u.orgFs,i.id,f,E);return{item:_}}})});function p8t(i){return Nw(i)!==null||Bci(i)!==null}var iUt=v(()=>{Z0()});import{z as Cfu}from"zod";var Zkf,Gkf,Yfu;var uUt=v(()=>{Jv();Uh();uu();za();RO();iUt();Zkf=Cfu.object({id:Cfu.string().describe("ID of the virtual MCP to delete")}),Gkf=Cfu.object({item:n_.describe("The deleted virtual MCP entity")}),Yfu=p({name:"COLLECTION_VIRTUAL_MCP_DELETE",description:"Permanently delete a Virtual MCP and its virtual tools.",annotations:{title:"Delete Virtual MCP",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:Zkf,outputSchema:Gkf,handler:async(i,u)=>{$i(u);let t=Si(u);if(await u.access.check(),p8t(i.id))throw Error(`Virtual MCP not found: ${i.id}`);let f=await u.storage.virtualMcps.findById(i.id);if(!f)throw Error(`Virtual MCP not found: ${i.id}`);if(f.organization_id!==t.id)throw Error(`Virtual MCP not found: ${i.id}`);await u.storage.virtualMcps.delete(i.id);try{if((await u.storage.organizationSettings.get(t.id))?.main_agent_id===i.id)await u.storage.organizationSettings.upsert(t.id,{main_agent_id:null})}catch(E){console.error("[VIRTUAL_MCP_DELETE] failed to clear main agent pointer",{id:i.id,error:E.message})}if(u.orgFs)await cfu(u.orgFs,i.id,Cu(u)??"system");let l=f.metadata?.githubRepo?.connectionId;if(l)try{let E=await u.storage.connections.findById(l,t.id);if(E&&NT(E)){let _=await new VE(u.db,u.vault).get(l);if(_?.accessToken)try{await fetch("https://api.github.com/installation/token",{method:"DELETE",headers:{Authorization:`Bearer ${_.accessToken}`,Accept:"application/vnd.github+json","X-GitHub-Api-Version":"2022-11-28"},signal:AbortSignal.timeout(5000)})}catch{}await u.storage.connections.delete(l)}}catch(E){console.error("[VIRTUAL_MCP_DELETE] failed to tear down repo-scoped connection",{childConnectionId:l,error:E.message})}return{item:f}}})});import{z as N6}from"zod";var kkf,jfu;var tUt=v(()=>{uu();kkf=N6.object({id:N6.string(),virtualMcpId:N6.string(),pluginId:N6.string(),connectionId:N6.string().nullable(),settings:N6.record(N6.string(),N6.unknown()).nullable(),createdAt:N6.string(),updatedAt:N6.string()}),jfu=p({name:"VIRTUAL_MCP_PLUGIN_CONFIG_GET",description:"Get a plugin's current configuration for a specific virtual MCP.",annotations:{title:"Get Virtual MCP Plugin Config",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:N6.object({virtualMcpId:N6.string().describe("Virtual MCP ID"),pluginId:N6.string().describe("Plugin ID")}),outputSchema:N6.object({config:kkf.nullable()}),handler:async(i,u)=>{$i(u);let t=Si(u);await u.access.check();let{virtualMcpId:f,pluginId:l}=i,E=await u.storage.connections.findById(f);if(!E||E.organization_id!==t.id)return{config:null};if(E.connection_type!=="VIRTUAL")return{config:null};let c=await u.storage.virtualMcpPluginConfigs.get(f,l);if(!c)return{config:null};return{config:{id:c.id,virtualMcpId:c.virtualMcpId,pluginId:c.pluginId,connectionId:c.connectionId,settings:c.settings,createdAt:c.createdAt instanceof Date?c.createdAt.toISOString():c.createdAt,updatedAt:c.updatedAt instanceof Date?c.updatedAt.toISOString():c.updatedAt}}}})});import{z as tc}from"zod";var Ckf,Kfu;var fUt=v(()=>{uu();cH();q4();Ckf=tc.object({id:tc.string(),virtualMcpId:tc.string(),pluginId:tc.string(),connectionId:tc.string().nullable(),settings:tc.record(tc.string(),tc.unknown()).nullable(),createdAt:tc.string(),updatedAt:tc.string()}),Kfu=p({name:"VIRTUAL_MCP_PLUGIN_CONFIG_UPDATE",description:"Set or update a plugin's configuration for a specific virtual MCP.",annotations:{title:"Update Virtual MCP Plugin Config",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:tc.object({virtualMcpId:tc.string().describe("Virtual MCP ID"),pluginId:tc.string().describe("Plugin ID"),connectionId:tc.string().nullable().optional().describe("MCP connection to bind"),settings:tc.record(tc.string(),tc.unknown()).nullable().optional().describe("Plugin-specific settings")}),outputSchema:tc.object({config:Ckf}),handler:async(i,u)=>{$i(u);let t=Si(u);await u.access.check();let{virtualMcpId:f,pluginId:l,connectionId:E,settings:c}=i,_=Cu(u),T=await u.storage.connections.findById(f);if(!T)throw Error(`Connection not found: ${f}`);if(T.organization_id!==t.id)throw Error(`Connection not found: ${f}`);if(T.connection_type!=="VIRTUAL")throw Error(`Connection not found: ${f}`);let d=E?await u.storage.connections.findById(E):null;if(E&&d&&d.organization_id!==t.id)throw Error(`Connection not found: ${E}`);if(E&&T.organization_id&&!d&&zn()&&Zci(E,T.organization_id)){if(!_)throw Error("User ID required to create dev-assets connection");let n=EH(T.organization_id,_4());await u.storage.connections.create({...n,organization_id:T.organization_id,created_by:_})}else if(E&&!d)throw Error(`Connection not found: ${E}`);let w=await u.storage.virtualMcpPluginConfigs.upsert(f,l,{connectionId:E,settings:c});return{config:{id:w.id,virtualMcpId:w.virtualMcpId,pluginId:w.pluginId,connectionId:w.connectionId,settings:w.settings,createdAt:w.createdAt instanceof Date?w.createdAt.toISOString():w.createdAt,updatedAt:w.updatedAt instanceof Date?w.updatedAt.toISOString():w.updatedAt}}}})});import{z as ST}from"zod";var Ykf,Hfu;var lUt=v(()=>{uu();RO();Ykf=ST.object({connectionId:ST.string(),toolName:ST.string(),label:ST.string(),icon:ST.string().nullable().optional()}),Hfu=p({name:"VIRTUAL_MCP_PINNED_VIEWS_UPDATE",description:"Update the pinned sidebar views for a virtual MCP. Replaces all current pins.",annotations:{title:"Update Pinned Views",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:ST.object({virtualMcpId:ST.string().describe("Virtual MCP ID"),pinnedViews:ST.array(Ykf).describe("Pinned views to set for the virtual MCP sidebar"),layout:ST.object({defaultMainView:ST.object({type:ST.string(),id:ST.string().optional(),toolName:ST.string().optional()}).nullable().optional(),chatDefaultOpen:ST.boolean().nullable().optional()}).optional()}),outputSchema:ST.object({item:n_.nullable()}),handler:async(i,u)=>{$i(u);let t=Si(u);await u.access.check();let{virtualMcpId:f,pinnedViews:l,layout:E}=i,c=Cu(u),_=await u.storage.virtualMcps.findById(f);if(!_)throw Error(`Virtual MCP not found: ${f}`);if(_.organization_id!==t.id)throw Error(`Virtual MCP not found: ${f}`);let T=_.metadata?.ui??{},d={...T,pinnedViews:l.length>0?l:null,layout:E??T.layout??null};return{item:await u.storage.virtualMcps.update(f,c??"system",{metadata:{..._.metadata,ui:d}})}}})});import{z as rv}from"zod";var jkf,Kkf,Xfu;var EUt=v(()=>{uu();jkf=rv.object({ids:rv.array(rv.string()).describe("Virtual MCP ids to look up")}),Kkf=rv.object({items:rv.array(rv.object({id:rv.string(),last_used_at:rv.string().optional(),last_used_by:rv.string().optional()}))}),Xfu=p({name:"VIRTUAL_MCP_LAST_USED_LIST",description:"Get last-used info (timestamp + user) for one or more virtual MCPs, derived from the most recent thread per agent.",annotations:{title:"List Virtual MCP Last Used",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:jkf,outputSchema:Kkf,handler:async(i,u)=>{$i(u),Si(u),await u.access.check();let t=await u.storage.threads.findLastUsedByVirtualMcpIds(i.ids);return{items:i.ids.map((f)=>({id:f,last_used_at:t.get(f)?.last_used_at,last_used_by:t.get(f)?.last_used_by}))}}})});var cUt=v(()=>{e8t();a8t();o8t();s8t();uUt();tUt();fUt();lUt();EUt()});import{z as xE}from"zod";var Jfu;var _Ut=v(()=>{GE();uu();Jfu=p({name:"MONITORING_LOG_GET",description:"Get a single monitoring log by ID with full input and output data.",annotations:{title:"Get Monitoring Log",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:xE.object({id:xE.string().describe("Log ID to fetch")}),outputSchema:xE.object({log:xE.object({id:xE.string().optional(),organizationId:xE.string(),connectionId:xE.string(),toolName:xE.string(),input:xE.record(xE.string(),xE.unknown()),output:xE.record(xE.string(),xE.unknown()),isError:xE.boolean(),errorMessage:xE.string().nullish(),durationMs:xE.number(),timestamp:xE.string(),userId:xE.string().nullish(),requestId:xE.string(),userAgent:xE.string().nullish(),virtualMcpId:xE.string().nullish(),properties:xE.record(xE.string(),xE.string()).nullish()}).nullable().describe("The monitoring log, or null if not found")}),handler:async(i,u)=>{await u.access.check(),await Tw();let t=Si(u),f=await u.storage.monitoring.getById(t.id,i.id);if(!f)return{log:null};return{log:{...f,timestamp:f.timestamp instanceof Date?f.timestamp.toISOString():f.timestamp}}}})});import{z as U0}from"zod";var Xkf,Wfu;var TUt=v(()=>{GE();uu();Xkf=U0.object({id:U0.string().optional().describe("Unique log identifier"),organizationId:U0.string().describe("Organization ID"),connectionId:U0.string().describe("Connection ID"),toolName:U0.string().describe("Name of the tool that was called"),isError:U0.boolean().describe("Whether the call resulted in an error"),errorMessage:U0.string().nullish().describe("Error message if applicable"),durationMs:U0.number().describe("Call duration in milliseconds"),timestamp:U0.string().describe("ISO 8601 timestamp of the call"),userId:U0.string().nullish().describe("User who triggered the call"),requestId:U0.string().describe("Unique request identifier"),userAgent:U0.string().nullish().describe("Client identifier (x-studio-client header)"),virtualMcpId:U0.string().nullish().describe("Virtual MCP (Agent) ID if routed through an agent"),properties:U0.record(U0.string(),U0.string()).nullish().describe("Custom key-value metadata attached to the log")}),Wfu=p({name:"MONITORING_LOGS_LIST",description:"List monitoring logs for tool calls with filtering and pagination.",annotations:{title:"List Monitoring Logs",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:U0.object({connectionId:U0.string().optional().describe("Filter by connection ID"),excludeConnectionIds:U0.array(U0.string()).optional().describe("Exclude logs from these connection IDs (e.g. system connections)"),virtualMcpId:U0.string().optional().describe("Filter by Virtual MCP (Agent) ID"),toolName:U0.string().optional().describe("Filter by tool name"),isError:U0.boolean().optional().describe("Filter by error status"),startDate:U0.string().datetime().optional().describe("Filter by start date (ISO 8601 datetime string)"),endDate:U0.string().datetime().optional().describe("Filter by end date (ISO 8601 datetime string)"),limit:U0.number().default(20).describe("Maximum number of results"),offset:U0.number().default(0).describe("Offset for pagination"),properties:U0.record(U0.string(),U0.string()).optional().describe("Filter by exact property key=value matches"),propertyKeys:U0.array(U0.string()).optional().describe("Filter by logs that have these property keys"),propertyPatterns:U0.record(U0.string(),U0.string()).optional().describe("Filter by property value patterns (SQL LIKE, use % as wildcard)"),propertyInValues:U0.record(U0.string(),U0.string()).optional().describe("Filter by exact match within comma-separated values (e.g., user_tags in 'Engineering')")}),outputSchema:U0.object({logs:U0.array(Xkf).describe("Array of monitoring logs"),total:U0.number().describe("Total number of logs matching filters"),offset:U0.number().describe("Current offset for pagination"),limit:U0.number().describe("Current limit for pagination")}),handler:async(i,u)=>{await Tw();let t=Si(u),l=i.properties||i.propertyKeys||i.propertyPatterns||i.propertyInValues?{properties:i.properties,propertyKeys:i.propertyKeys,propertyPatterns:i.propertyPatterns,propertyInValues:i.propertyInValues}:void 0,E={organizationId:t.id,connectionId:i.connectionId,excludeConnectionIds:i.excludeConnectionIds,virtualMcpId:i.virtualMcpId,toolName:i.toolName,isError:i.isError,startDate:i.startDate?new Date(i.startDate):void 0,endDate:i.endDate?new Date(i.endDate):void 0,limit:i.limit,offset:i.offset,propertyFilters:l},c=await u.storage.monitoring.query(E);return{logs:c.logs.map(({input:_,output:T,...d})=>({...d,timestamp:d.timestamp instanceof Date?d.timestamp.toISOString():d.timestamp})),total:c.total,offset:i.offset,limit:i.limit}}})});import{z as At}from"zod";var bfu;var dUt=v(()=>{GE();uu();bfu=p({name:"MONITORING_STATS",description:"Get aggregated statistics (counts, latency, error rates) for tool call monitoring.",annotations:{title:"Get Monitoring Stats",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:At.object({startDate:At.string().datetime().optional().describe("Filter by start date (ISO 8601 datetime string)"),endDate:At.string().datetime().optional().describe("Filter by end date (ISO 8601 datetime string)"),interval:At.string().regex(/^\d+[mhd]$/).optional().describe("Bucket interval for timeseries data (e.g. 1m, 5m, 2h, 1d). When provided, returns timeseries array."),connectionIds:At.array(At.string()).max(100).optional().describe("Filter by specific connection IDs (max 100)"),excludeConnectionIds:At.array(At.string()).max(100).optional().describe("Exclude specific connection IDs (max 100)"),toolNames:At.array(At.string()).max(100).optional().describe("Filter by specific tool names (max 100)"),status:At.enum(["success","error"]).optional().describe("Filter metrics by execution status"),topN:At.number().int().min(1).max(20).optional().describe("When provided with interval, also return top tools and their timeseries"),userIds:At.array(At.string()).max(100).optional().describe("Filter LLM usage by user IDs (only applied when llmUsage is true)"),llmUsage:At.boolean().optional().describe("Aggregate LLM-call usage (tokens + USD cost) from raw log rows for the given connection. Returns token/cost totals and timeseries. Requires interval.")}),outputSchema:At.object({totalCalls:At.number().describe("Total number of tool calls"),errorRate:At.number().optional().describe("Error rate as a decimal (0 to 1)"),avgDurationMs:At.number().describe("Average call duration in milliseconds"),errorRatePercent:At.string().optional().describe("Error rate as a percentage string"),totalErrors:At.number().optional().describe("Total number of errors"),p50DurationMs:At.number().optional().describe("50th percentile duration in milliseconds"),p95DurationMs:At.number().optional().describe("95th percentile duration in milliseconds"),connectionBreakdown:At.array(At.object({connectionId:At.string(),calls:At.number(),errors:At.number(),errorRate:At.number(),avgDurationMs:At.number()})).optional().describe("Per-connection metric breakdown"),totalInputTokens:At.number().optional().describe("Total input tokens (LLM usage mode)"),totalOutputTokens:At.number().optional().describe("Total output tokens (LLM usage mode)"),totalTokens:At.number().optional().describe("Total tokens (LLM usage mode)"),totalCostUsd:At.number().optional().describe("Total USD cost (LLM usage mode; only non-zero for providers that report cost)"),topTools:At.array(At.object({toolName:At.string(),connectionId:At.string().nullable(),calls:At.number(),inputTokens:At.number().optional(),outputTokens:At.number().optional(),costUsd:At.number().optional()})).optional().describe("Top tools ranked by calls"),topToolsTimeseries:At.array(At.object({timestamp:At.string(),toolName:At.string(),calls:At.number(),errors:At.number(),avg:At.number(),p95:At.number()})).optional().describe("Per-tool metric timeseries for the top tools"),timeseries:At.array(At.object({timestamp:At.string(),calls:At.number(),errors:At.number(),errorRate:At.number(),avg:At.number(),p50:At.number(),p95:At.number(),inputTokens:At.number().optional(),outputTokens:At.number().optional(),totalTokens:At.number().optional(),costUsd:At.number().optional()})).optional().describe("Timeseries data points bucketed by interval")}),handler:async(i,u)=>{let t=Si(u);if(await u.access.check(),await Tw(),i.interval&&i.llmUsage)return u.storage.monitoring.queryLlmUsageStats({organizationId:t.id,interval:i.interval,connectionId:i.connectionIds?.[0]??"decopilot",startDate:i.startDate?new Date(i.startDate):void 0,endDate:i.endDate?new Date(i.endDate):void 0,userIds:i.userIds,topN:i.topN});if(i.interval){let l=await u.storage.monitoring.queryMetricTimeseries({organizationId:t.id,interval:i.interval,startDate:i.startDate?new Date(i.startDate):void 0,endDate:i.endDate?new Date(i.endDate):void 0,filters:{connectionIds:i.connectionIds,excludeConnectionIds:i.excludeConnectionIds,toolNames:i.toolNames,status:i.status}});if(!i.topN)return l;let E=await u.storage.monitoring.queryMetricTopToolsTimeseries({organizationId:t.id,interval:i.interval,startDate:i.startDate?new Date(i.startDate):void 0,endDate:i.endDate?new Date(i.endDate):void 0,topN:i.topN,filters:{connectionIds:i.connectionIds,excludeConnectionIds:i.excludeConnectionIds,toolNames:i.toolNames,status:i.status}});return{...l,topTools:E.topTools,topToolsTimeseries:E.timeseries}}let f=await u.storage.monitoring.getStats({organizationId:t.id,startDate:i.startDate?new Date(i.startDate):void 0,endDate:i.endDate?new Date(i.endDate):void 0});return{...f,errorRatePercent:(f.errorRate*100).toFixed(2)}}})});import{z as OT}from"zod";var Qfu;var wUt=v(()=>{GE();uu();Qfu=p({name:"MONITORING_THREAD_USAGE",description:"Aggregate LLM token usage and USD cost per thread for the given thread IDs.",annotations:{title:"Get Thread Usage",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:OT.object({threadIds:OT.array(OT.string()).min(1).max(500).describe("Thread IDs to aggregate usage for (max 500)"),connectionId:OT.string().optional().describe("LLM connection ID (defaults to 'decopilot')"),startDate:OT.string().datetime().optional().describe("Filter by start date (ISO 8601 datetime string)"),endDate:OT.string().datetime().optional().describe("Filter by end date (ISO 8601 datetime string)")}),outputSchema:OT.object({items:OT.array(OT.object({threadId:OT.string(),calls:OT.number(),inputTokens:OT.number(),outputTokens:OT.number(),totalTokens:OT.number(),costUsd:OT.number()}))}),handler:async(i,u)=>{let t=Si(u);return await u.access.check(),await Tw(),{items:await u.storage.monitoring.queryThreadUsage({organizationId:t.id,connectionId:i.connectionId??"decopilot",threadIds:i.threadIds,startDate:i.startDate?new Date(i.startDate):void 0,endDate:i.endDate?new Date(i.endDate):void 0})}}})});var nUt=v(()=>{_Ut();TUt();dUt();wUt()});function Xni(i){return typeof i==="string"&&Wkf.has(i.trim().toLowerCase())}var Wkf;var Mfu=v(()=>{Wkf=new Set([".well-known","_admin","api","auth","cli","commerce-onboarding","dbos-queue-depth","health","hosted-run-pending","login","mcp","metrics","oauth","oauth-proxy","onboarding","org","report","reset-password"])});import{z as xd}from"zod";var zfu;var hUt=v(()=>{uu();Mfu();zfu=p({name:"ORGANIZATION_CREATE",description:"Create a new organization. The caller becomes the owner automatically.",annotations:{title:"Create Organization",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!1,openWorldHint:!1},inputSchema:xd.object({slug:xd.string().min(1).max(50).regex(/^[a-z0-9-]+$/,"Slug must be lowercase alphanumeric with hyphens").refine((i)=>!Xni(i),"Slug is reserved by Studio"),name:xd.string().min(1).max(255),description:xd.string().optional()}),outputSchema:xd.object({id:xd.string(),name:xd.string(),slug:xd.string(),logo:xd.string().nullable().optional(),metadata:xd.any().optional(),createdAt:xd.string().datetime().describe("ISO 8601 timestamp"),members:xd.array(xd.any()).optional()}),handler:async(i,u)=>{$i(u),await u.access.check();let t=Cu(u);if(!t)throw Error("User ID required to create organization");let f=await u.boundAuth.organization.create({name:i.name,slug:i.slug,metadata:i.description?{description:i.description}:void 0,userId:t});if(!f)throw Error("Failed to create organization");return{...f,createdAt:f.createdAt instanceof Date?f.createdAt.toISOString():f.createdAt}}})});import{z as Ih}from"zod";var rfu;var AUt=v(()=>{uu();rfu=p({name:"ORGANIZATION_LIST",description:"List organizations the current user belongs to.",annotations:{title:"List Organizations",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},_meta:{ui:{visibility:"app"}},inputSchema:Ih.object({userId:Ih.string().optional()}),outputSchema:Ih.object({organizations:Ih.array(Ih.object({id:Ih.string(),name:Ih.string(),slug:Ih.string(),logo:Ih.string().nullable().optional(),metadata:Ih.any().optional(),createdAt:Ih.string().datetime().describe("ISO 8601 timestamp")}))}),handler:async(i,u)=>{$i(u),await u.access.check();let t=Cu(u),f=i.userId||t;if(!f)throw Error("User ID required to list organizations");return{organizations:(await u.boundAuth.organization.list(f)).map((E)=>({...E,createdAt:E.createdAt instanceof Date?E.createdAt.toISOString():E.createdAt}))}}})});import{z as bw}from"zod";var qfu;var DUt=v(()=>{uu();qfu=p({name:"ORGANIZATION_GET",description:"Get an organization's details, members, and settings by slug or ID.",annotations:{title:"Get Organization",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:bw.object({}),outputSchema:bw.object({id:bw.string(),name:bw.string(),slug:bw.string(),logo:bw.string().nullable().optional(),metadata:bw.any().optional(),createdAt:bw.string().datetime().describe("ISO 8601 timestamp"),members:bw.array(bw.any()).optional(),invitations:bw.array(bw.any()).optional()}),handler:async(i,u)=>{$i(u),await u.access.check();let t=u.organization?.id;if(!t)throw Error("Organization ID required (no active organization in context)");let f=await u.boundAuth.organization.get(t);if(!f)throw Error("No active organization found");let l=new Date,E=f.invitations?.filter((c)=>new Date(c.expiresAt)>l);return{...f,invitations:E,createdAt:f.createdAt instanceof Date?f.createdAt.toISOString():f.createdAt}}})});import{z as xh}from"zod";var Vfu;var vUt=v(()=>{uu();Vfu=p({name:"ORGANIZATION_UPDATE",description:"Update an organization's name or description.",annotations:{title:"Update Organization",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:xh.object({id:xh.string(),name:xh.string().min(1).max(255).optional(),description:xh.string().optional()}),outputSchema:xh.object({id:xh.string(),name:xh.string(),slug:xh.string(),logo:xh.string().nullable().optional(),metadata:xh.any().optional(),createdAt:xh.string().datetime().describe("ISO 8601 timestamp")}),handler:async(i,u)=>{$i(u),await u.access.check();let t={};if(i.name)t.name=i.name;if(i.description)t.metadata={description:i.description};let f=await u.boundAuth.organization.update({organizationId:i.id,data:t});if(!f)throw Error("Failed to update organization");return{...f,createdAt:f.createdAt instanceof Date?f.createdAt.toISOString():f.createdAt}}})});import{z as to}from"zod";var mfu;var NUt=v(()=>{uu();mfu=p({name:"ORGANIZATION_DELETE",description:"Archive an organization (soft delete).",annotations:{title:"Delete Organization",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:to.object({id:to.string()}),outputSchema:to.object({success:to.boolean(),id:to.string()}),handler:async(i,u)=>{return $i(u),await u.access.check(),await u.boundAuth.organization.update({organizationId:i.id,data:{metadata:{archived:!0,archivedAt:new Date().toISOString()}}}),{success:!0,id:i.id}}})});import{z as It}from"zod";var fo,lo,qv,SUt,O3,Eo,co,_o,To,G$;var yd=v(()=>{fo=It.object({title:It.string(),url:It.string(),icon:It.string()}),lo=It.object({registries:It.record(It.string(),It.object({enabled:It.boolean()})).describe("Per-registry enabled/disabled state. Key is connection ID. Absent registries are treated as enabled."),blockedMcps:It.array(It.string()).describe("List of MCP app_name or app_id values to hide from the store.")}),qv=It.object({keyId:It.string(),modelId:It.string(),title:It.string().optional()}).nullable(),SUt=It.enum(["fast","smart","thinking","image","web_search","deep_research"]),O3=It.enum(["fast","smart","thinking"]),Eo=It.object({tiers:It.object({fast:qv,smart:qv,thinking:qv,image:qv,web_search:qv,deep_research:qv})}),co=It.object({tiers:It.object({fast:qv.optional(),smart:qv.optional(),thinking:qv.optional()})}),_o=It.object({ids:It.array(It.string()).describe("Ordered list of custom virtual MCP agent ids to show on the home view.")}),To=It.object({demo_mode:It.boolean().optional().describe("Curated demo org: the commerce connect modal proceeds without a configured required data source."),reports_only:It.boolean().optional().describe("Curated commerce (reports) look: hides agent navigation, the home Customize button, and the Settings/Automations tabs. Defaulted on for orgs created by commerce onboarding."),qa_agent_enabled:It.boolean().optional().describe("Run the QA Agent on a task's pull request once it's In Review \u2014 it verifies the task actually solved the problem (exercises the feature, not just the diff)."),code_reviewer_enabled:It.boolean().optional().describe("Run the Code Reviewer on a task's pull request once it's In Review \u2014 it reviews the code using the repo's stack-appropriate review skills."),auto_merge:It.boolean().optional().describe("When every enabled reviewer (QA Agent / Code Reviewer) approves a task's pull request, merge it automatically instead of leaving the merge to a human."),sandbox_go_daemon:It.boolean().optional().describe("Which sandbox daemon this org's new sandboxes run. Go is the default, so this is an OPT-OUT: set it to `false` to keep the org on the TypeScript daemon; unset (or `true`) means Go. Affects the NEXT sandbox only \u2014 live sandboxes drain on the binary they booted with. Ignored unless the deployment sets STUDIO_SANDBOX_GO_TEMPLATE_NAME (the global kill switch); SANDBOX_START's `daemonImpl` overrides it per sandbox in either direction.")}),G$=It.object({id:It.string().describe("Brand context ID"),name:It.string().describe("Company name"),domain:It.string().describe("Company domain (e.g. example.com)"),overview:It.string().describe("Company overview / description"),logo:It.string().nullable().optional().describe("Logo URL"),favicon:It.string().nullable().optional().describe("Favicon URL"),ogImage:It.string().nullable().optional().describe("OG image URL"),fonts:It.object({heading:It.string().optional().describe("Font family for headings"),body:It.string().optional().describe("Font family for body text"),code:It.string().optional().describe("Font family for code / monospace")}).nullable().optional().describe("Font families by semantic role"),colors:It.object({primary:It.string().optional().describe("Primary brand color (hex)"),secondary:It.string().optional().describe("Secondary brand color (hex)"),accent:It.string().optional().describe("Accent / highlight color (hex)"),background:It.string().optional().describe("Background color (hex)"),foreground:It.string().optional().describe("Foreground / text color (hex)")}).nullable().optional().describe("Semantic color palette"),images:It.array(It.record(It.string(),It.unknown())).nullable().optional().describe("Brand images"),metadata:It.record(It.string(),It.unknown()).nullable().optional().describe("Extra design tokens (typography, components, spacing, layout, tone, etc.)"),archivedAt:It.string().nullable().optional().describe("Archive timestamp (null to unarchive)"),isDefault:It.boolean().optional().describe("Whether this is the default brand for the organization")})});import{z as Vv}from"zod";var efu;var OUt=v(()=>{uu();yd();efu=p({name:"ORGANIZATION_SETTINGS_GET",description:"Get organization-level settings including sidebar configuration, store registry settings, simple model mode, and default home agents.",annotations:{title:"Get Organization Settings",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:Vv.object({}),outputSchema:Vv.object({organizationId:Vv.string(),sidebar_items:Vv.array(fo).nullable().optional(),enabled_plugins:Vv.array(Vv.string()).nullable().optional(),registry_config:lo.nullable().optional(),simple_mode:Eo.nullable().optional(),default_home_agents:_o.nullable().optional(),flags:To.nullable().optional(),main_agent_id:Vv.string().nullable().optional(),createdAt:Vv.string().datetime().optional().describe("ISO 8601 timestamp"),updatedAt:Vv.string().datetime().optional().describe("ISO 8601 timestamp")}),handler:async(i,u)=>{$i(u),await u.access.check();let t=u.organization?.id;if(!t)throw Error("Organization ID required (no active organization in context)");let f=await u.storage.organizationSettings.get(t);if(!f)return{organizationId:t};return{...f,createdAt:f.createdAt instanceof Date?f.createdAt.toISOString():f.createdAt,updatedAt:f.updatedAt instanceof Date?f.updatedAt.toISOString():f.updatedAt}}})});import{z as S6}from"zod";var afu;var $Ut=v(()=>{uu();yd();afu=p({name:"ORGANIZATION_SETTINGS_UPDATE",description:"Update organization-level settings such as sidebar configuration, store registry settings, simple model mode, and default home agents.",annotations:{title:"Update Organization Settings",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:S6.object({organizationId:S6.string(),sidebar_items:S6.array(fo).optional(),enabled_plugins:S6.array(S6.string()).optional(),registry_config:lo.optional(),simple_mode:Eo.optional(),default_home_agents:_o.optional(),flags:To.strict().optional().describe("Org boolean toggles. Shallow-merged into the stored flags: keys you pass win (explicit false persists), omitted keys keep their value."),main_agent_id:S6.string().nullable().optional().describe("Virtual MCP id the org lands on instead of the Super Agent. Pass null to clear.")}),outputSchema:S6.object({organizationId:S6.string(),sidebar_items:S6.array(fo).nullable().optional(),enabled_plugins:S6.array(S6.string()).nullable().optional(),registry_config:lo.nullable().optional(),simple_mode:Eo.nullable().optional(),default_home_agents:_o.nullable().optional(),flags:To.nullable().optional(),main_agent_id:S6.string().nullable().optional(),createdAt:S6.string().datetime().describe("ISO 8601 timestamp"),updatedAt:S6.string().datetime().describe("ISO 8601 timestamp")}),handler:async(i,u)=>{if($i(u),await u.access.check(),Si(u).id!==i.organizationId)throw Error("Cannot update settings for a different organization");let f=await u.storage.organizationSettings.upsert(i.organizationId,{sidebar_items:i.sidebar_items,enabled_plugins:i.enabled_plugins,registry_config:i.registry_config,simple_mode:i.simple_mode,default_home_agents:i.default_home_agents,flags:i.flags,main_agent_id:i.main_agent_id});return{...f,createdAt:f.createdAt instanceof Date?f.createdAt.toISOString():f.createdAt,updatedAt:f.updatedAt instanceof Date?f.updatedAt.toISOString():f.updatedAt}}})});import{z as yh}from"zod";var PUt,ofu,sfu;var gUt=v(()=>{uu();yd();PUt=G$.extend({organizationId:yh.string(),archivedAt:yh.string().nullable().optional().describe("ISO 8601 timestamp"),createdAt:yh.string().describe("ISO 8601 timestamp"),updatedAt:yh.string().describe("ISO 8601 timestamp")}),ofu=p({name:"BRAND_CONTEXT_LIST",description:"List all brand contexts (company profiles) for the current organization.",annotations:{title:"List Brand Contexts",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:yh.object({includeArchived:yh.boolean().optional().describe("Include archived brands in the list")}),outputSchema:yh.object({items:yh.array(PUt)}),handler:async(i,u)=>{$i(u),await u.access.check();let t=u.organization?.id;if(!t)throw Error("Organization ID required (no active organization in context)");return{items:(await u.storage.brandContext.list(t,{includeArchived:i.includeArchived})).map((l)=>({...l,archivedAt:l.archivedAt instanceof Date?l.archivedAt.toISOString():l.archivedAt,createdAt:l.createdAt instanceof Date?l.createdAt.toISOString():l.createdAt,updatedAt:l.updatedAt instanceof Date?l.updatedAt.toISOString():l.updatedAt}))}}}),sfu=p({name:"BRAND_CONTEXT_GET",description:"Get a specific brand context by ID.",annotations:{title:"Get Brand Context",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:yh.object({id:yh.string().describe("Brand context ID")}),outputSchema:PUt.extend({organizationId:yh.string()}),handler:async(i,u)=>{$i(u),await u.access.check();let t=u.organization?.id;if(!t)throw Error("Organization ID required (no active organization in context)");let f=await u.storage.brandContext.get(i.id,t);if(!f)throw Error("Brand context not found");return{...f,archivedAt:f.archivedAt instanceof Date?f.archivedAt.toISOString():f.archivedAt,createdAt:f.createdAt instanceof Date?f.createdAt.toISOString():f.createdAt,updatedAt:f.updatedAt instanceof Date?f.updatedAt.toISOString():f.updatedAt}}})});import{z as P8}from"zod";var UUt,pfu,ilu,ulu;var BUt=v(()=>{uu();yd();UUt=G$.extend({organizationId:P8.string(),createdAt:P8.string().describe("ISO 8601 timestamp"),updatedAt:P8.string().describe("ISO 8601 timestamp")}),pfu=p({name:"BRAND_CONTEXT_CREATE",description:"Create a new brand context (company profile) for the current organization.",annotations:{title:"Create Brand Context",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!1,openWorldHint:!1},inputSchema:G$.omit({id:!0}),outputSchema:UUt,handler:async(i,u)=>{$i(u),await u.access.check();let t=u.organization?.id;if(!t)throw Error("Organization ID required (no active organization in context)");let f=await u.storage.brandContext.create(t,{name:i.name,domain:i.domain,overview:i.overview,logo:i.logo??null,favicon:i.favicon??null,ogImage:i.ogImage??null,fonts:i.fonts??null,colors:i.colors??null,images:i.images??null,metadata:i.metadata??null});return{...f,archivedAt:f.archivedAt instanceof Date?f.archivedAt.toISOString():f.archivedAt,createdAt:f.createdAt instanceof Date?f.createdAt.toISOString():f.createdAt,updatedAt:f.updatedAt instanceof Date?f.updatedAt.toISOString():f.updatedAt}}}),ilu=p({name:"BRAND_CONTEXT_UPDATE",description:"Update an existing brand context by ID.",annotations:{title:"Update Brand Context",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:G$.partial().required({id:!0}),outputSchema:UUt,handler:async(i,u)=>{$i(u),await u.access.check();let t=u.organization?.id;if(!t)throw Error("Organization ID required (no active organization in context)");if(!await u.storage.brandContext.get(i.id,t))throw Error("Brand context not found");let{id:l,...E}=i;if(E.isDefault===!0)await u.storage.brandContext.setDefault(l,t);let c=await u.storage.brandContext.update(l,t,{name:E.name,domain:E.domain,overview:E.overview,logo:E.logo!==void 0?E.logo??null:void 0,favicon:E.favicon!==void 0?E.favicon??null:void 0,ogImage:E.ogImage!==void 0?E.ogImage??null:void 0,fonts:E.fonts!==void 0?E.fonts??null:void 0,colors:E.colors!==void 0?E.colors??null:void 0,images:E.images!==void 0?E.images??null:void 0,metadata:E.metadata!==void 0?E.metadata??null:void 0,archivedAt:E.archivedAt!==void 0?E.archivedAt??null:void 0,isDefault:E.isDefault===!1?!1:void 0});return{...c,archivedAt:c.archivedAt instanceof Date?c.archivedAt.toISOString():c.archivedAt,createdAt:c.createdAt instanceof Date?c.createdAt.toISOString():c.createdAt,updatedAt:c.updatedAt instanceof Date?c.updatedAt.toISOString():c.updatedAt}}}),ulu=p({name:"BRAND_CONTEXT_DELETE",description:"Archive a brand context by ID (soft delete).",annotations:{title:"Archive Brand Context",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:P8.object({id:P8.string().describe("Brand context ID")}),outputSchema:P8.object({success:P8.boolean()}),handler:async(i,u)=>{$i(u),await u.access.check();let t=u.organization?.id;if(!t)throw Error("Organization ID required (no active organization in context)");if(!await u.storage.brandContext.get(i.id,t))throw Error("Brand context not found");return await u.storage.brandContext.update(i.id,t,{archivedAt:new Date().toISOString(),isDefault:!1}),{success:!0}}})});async function Jni(i,u,t){let f=i.trim();if(!f.startsWith("http"))f=`https://${f}`;let l=await fetch("https://api.firecrawl.dev/v1/scrape",{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${u}`},body:JSON.stringify({url:f,formats:["branding"]})});if(!l.ok){let h=await l.text().catch(()=>"");throw Error(`Firecrawl API error: ${l.status} ${h.slice(0,200)}`)}let E=await l.json();if(!E.success||!E.data?.branding)return null;let c=E.data.branding,_=E.data.metadata??{},T=Mkf(c,_);return{name:_.title?.split(/[|\u2013\u2014]|\s+-\s+/).map((h)=>h.trim()).filter(Boolean)?.slice().sort((h,A)=>h.length-A.length)[0]??_.ogSiteName??t??i,domain:i,overview:_.description??"",logo:T.logo,favicon:T.favicon,ogImage:T.ogImage,fonts:T.fonts,colors:T.colors,images:null,metadata:Object.keys(T.metadata).length>0?T.metadata:null}}function Mkf(i,u){let t=i.images??{},f=i.colors??{},l={};for(let[w,n]of Object.entries(f))if(typeof n==="string"&&n&&bkf.has(w))l[w]=n;let E={},_=(i.typography??{}).fontFamilies??{};for(let[w,n]of Object.entries(_))if(typeof n==="string"&&n){let h=Qkf[w.toLowerCase()];if(h&&!E[h])E[h]=n}let T=i.fonts;if(Array.isArray(T))for(let w of T){let n=w.family;if(typeof n==="string"&&n&&!E.body)E.body=n}let d={};for(let w of["typography","components","spacing","layout","animations","icons","tone","personality","colorScheme"])if(i[w]!==void 0)d[w]=i[w];return{logo:t.logo??null,favicon:t.favicon??null,ogImage:t.ogImage??u.ogImage??null,fonts:Object.keys(E).length>0?E:null,colors:Object.keys(l).length>0?l:null,metadata:d}}var bkf,Qkf;var tlu=v(()=>{bkf=new Set(["primary","secondary","accent","background","foreground"]),Qkf={heading:"heading",headings:"heading",head:"heading",title:"heading",body:"body",primary:"body",text:"body",code:"code",monospace:"code",mono:"code"}});import{z as Wni}from"zod";var zkf,flu;var IUt=v(()=>{uu();tlu();yd();zkf=G$.pick({id:!0,name:!0,domain:!0,overview:!0,logo:!0,favicon:!0,ogImage:!0,fonts:!0,colors:!0}).extend({success:Wni.boolean()}),flu=p({name:"BRAND_CONTEXT_EXTRACT",description:"Extract brand context (colors, fonts, logos) from a website URL using Firecrawl.",annotations:{title:"Extract Brand Context",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!0},inputSchema:Wni.object({domain:Wni.string().describe("Website domain to extract brand from"),brandId:Wni.string().optional().describe("Existing brand context ID to update (creates new if omitted)")}),outputSchema:zkf,modelSummary:(i)=>i.success?`Brand saved (id=${i.id}, name=${i.name}, domain=${i.domain}). The UI rendered the logo, colors, fonts, and overview.`:"Brand extraction failed.",handler:async(i,u)=>{$i(u),await u.access.check();let t=u.organization?.id;if(!t)throw Error("Organization ID required (no active organization in context)");let f=u.firecrawlApiKey;if(!f)throw Error("FIRECRAWL_API_KEY is not configured. Set the environment variable to enable brand extraction.");let l=await Jni(i.domain,f,i.domain);if(!l)throw Error("Firecrawl did not return branding data for this URL");let E={name:l.name,domain:l.domain,overview:l.overview,logo:l.logo,favicon:l.favicon,ogImage:l.ogImage,fonts:l.fonts,colors:l.colors,images:l.images,metadata:l.metadata},c=i.brandId?await(async()=>{if(!await u.storage.brandContext.get(i.brandId,t))throw Error("Brand context not found");return u.storage.brandContext.update(i.brandId,t,E)})():await u.storage.brandContext.create(t,E);return{id:c.id,name:c.name,domain:c.domain,overview:c.overview,logo:c.logo,favicon:c.favicon,ogImage:c.ogImage,fonts:c.fonts,colors:c.colors,success:!0}}})});function xUt(i){let u=i.metadata??{};return{id:i.id,name:i.name,domain:i.domain||void 0,colors:i.colors??void 0,fonts:i.fonts??void 0,assets:i.logo||i.favicon||i.ogImage?{logo:i.logo??void 0,favicon:i.favicon??void 0,ogImage:i.ogImage??void 0}:void 0,overview:i.overview||void 0,tagline:typeof u.tagline==="string"?u.tagline:void 0,tone:typeof u.tone==="string"?u.tone:void 0,metadata:(()=>{let t=Object.fromEntries(Object.entries(u).filter(([f])=>f!=="tagline"&&f!=="tone"));return Object.keys(t).length>0?t:void 0})()}}var llu,Elu;var yUt=v(()=>{Sfu();uu();llu=p({name:"BRAND_GET",description:"Get a brand context by ID. Omit the ID to get the default brand for the organization.",annotations:{title:"Get Brand",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:Rni,outputSchema:ea,handler:async(i,u)=>{$i(u),await u.access.check();let t=u.organization?.id;if(!t)throw Error("Organization ID required (no active organization in context)");let f=i.id?await u.storage.brandContext.get(i.id,t):await u.storage.brandContext.getDefault(t);if(!f)throw Error(i.id?"Brand not found":"No default brand configured");return xUt(f)}}),Elu=p({name:"BRAND_LIST",description:"List all active brands for the current organization.",annotations:{title:"List Brands",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:Fni,outputSchema:Lni,handler:async(i,u)=>{$i(u),await u.access.check();let t=u.organization?.id;if(!t)throw Error("Organization ID required (no active organization in context)");return{items:(await u.storage.brandContext.list(t)).map(xUt)}}})});import{resolveTxt as rkf}from"dns/promises";function clu(i){return`${qkf}.${i.toLowerCase()}`}function RUt(){return`deco-verify-${crypto.randomUUID().replace(/-/g,"")}`}async function FUt(i,u,t=rkf){if(!u)return!1;try{return(await t(clu(i))).some((l)=>l.join("").trim()===u)}catch{return!1}}var qkf="_deco-verify";var LUt=()=>{};import{z as HE}from"zod";function k$(i){let u=i.verificationStatus==="pending"&&Boolean(i.verificationToken);return{id:i.id,domain:i.domain,joinMode:i.joinMode,verificationStatus:i.verificationStatus,verificationMethod:i.verificationMethod,verifiedAt:i.verifiedAt?new Date(i.verifiedAt).toISOString():null,recordName:u?clu(i.domain):null,recordValue:u?i.verificationToken:null}}function mkf(i){let u=i.toLowerCase().trim();if(!Vkf.test(u))throw Error(`Invalid domain format: "${u}". Must be a valid domain like "acme.com"`);if(Rh.has(u))throw Error(`Cannot claim generic email domain "${u}". Only corporate domains are allowed.`);return u}var Vkf,_lu,bni,Tlu,dlu,wlu,nlu,hlu;var ZUt=v(()=>{Id();LUt();uu();Vkf=/^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+$/,_lu=HE.enum(["off","auto","request"]),bni=HE.object({id:HE.string(),domain:HE.string(),joinMode:_lu,verificationStatus:HE.enum(["pending","verified"]),verificationMethod:HE.enum(["email","dns"]).nullable(),verifiedAt:HE.string().nullable(),recordName:HE.string().nullable(),recordValue:HE.string().nullable()});Tlu=p({name:"ORGANIZATION_DOMAIN_LIST",description:"List the email domains claimed by an organization.",annotations:{title:"List Organization Domains",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:HE.object({}),outputSchema:HE.object({domains:HE.array(bni)}),handler:async(i,u)=>{$i(u),await u.access.check();let t=Si(u);return{domains:(await u.storage.organizationDomains.listByOrganizationId(t.id)).map(k$)}}}),dlu=p({name:"ORGANIZATION_DOMAIN_ADD",description:"Claim an email domain for an organization. If the caller's verified email matches the domain it is trusted immediately; otherwise it requires DNS verification.",annotations:{title:"Add Organization Domain",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:HE.object({domain:HE.string().min(1).max(255).describe("Domain to claim, e.g. acme.com"),joinMode:_lu.optional().describe("Initial join mode (only applied when the domain is trusted immediately via email match).")}),outputSchema:bni,handler:async(i,u)=>{$i(u),await u.access.check();let t=Si(u),f=mkf(i.domain),E=u.auth.user?.email?.split("@")[1]?.toLowerCase(),c=Boolean(u.auth.user?.emailVerified)&&E===f,_=await u.storage.organizationDomains.getByOrgAndDomain(t.id,f);if(_){if(_.verificationStatus!=="verified"&&c){let d=await u.storage.organizationDomains.markVerified(_.id,"email");return k$(d)}return k$(_)}let T=c?await u.storage.organizationDomains.add(t.id,f,{joinMode:i.joinMode??"off",verificationStatus:"verified",verificationMethod:"email"}):await u.storage.organizationDomains.add(t.id,f,{joinMode:"off",verificationStatus:"pending",verificationToken:RUt()});return k$(T)}}),wlu=p({name:"ORGANIZATION_DOMAIN_UPDATE",description:"Set the join mode for a claimed domain. Discoverable modes (auto/request) require the domain to be verified.",annotations:{title:"Update Organization Domain",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:HE.object({id:HE.string(),joinMode:_lu}),outputSchema:bni,handler:async(i,u)=>{$i(u),await u.access.check();let t=Si(u),f=await u.storage.organizationDomains.getById(i.id);if(!f||f.organizationId!==t.id)throw Error("Domain not found");if(i.joinMode!=="off"&&f.verificationStatus!=="verified")throw Error("Verify the domain before enabling auto-join or requests.");let l=await u.storage.organizationDomains.updateJoinMode(i.id,i.joinMode);return k$(l)}}),nlu=p({name:"ORGANIZATION_DOMAIN_VERIFY",description:"Check the DNS TXT record for a pending domain and mark it verified if present.",annotations:{title:"Verify Organization Domain",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!0},inputSchema:HE.object({id:HE.string()}),outputSchema:HE.object({verified:HE.boolean(),domain:bni}),handler:async(i,u)=>{$i(u),await u.access.check();let t=Si(u),f=await u.storage.organizationDomains.getById(i.id);if(!f||f.organizationId!==t.id)throw Error("Domain not found");if(f.verificationStatus==="verified")return{verified:!0,domain:k$(f)};if(!f.verificationToken)throw Error("Domain has no pending DNS verification.");if(!await FUt(f.domain,f.verificationToken))return{verified:!1,domain:k$(f)};let E=await u.storage.organizationDomains.markVerified(i.id,"dns");return{verified:!0,domain:k$(E)}}}),hlu=p({name:"ORGANIZATION_DOMAIN_REMOVE",description:"Remove a claimed domain from an organization.",annotations:{title:"Remove Organization Domain",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:HE.object({id:HE.string()}),outputSchema:HE.object({success:HE.boolean()}),handler:async(i,u)=>{$i(u),await u.access.check();let t=Si(u),f=await u.storage.organizationDomains.getById(i.id);if(!f||f.organizationId!==t.id)throw Error("Domain not found");return await u.storage.organizationDomains.removeById(i.id),{success:!0}}})});function C$(i){return(i instanceof Error?i.message.toLowerCase():"").includes("already a member")}import{z as K4}from"zod";var ekf,Alu,Dlu,vlu;var GUt=v(()=>{uu();Jl();ekf=K4.object({id:K4.string(),userId:K4.string(),status:K4.enum(["pending","approved","denied"]),createdAt:K4.string(),user:K4.object({id:K4.string(),name:K4.string(),email:K4.string(),image:K4.string().nullable()}).nullable()}),Alu=p({name:"ORGANIZATION_JOIN_REQUEST_LIST",description:"List pending requests to join the organization.",annotations:{title:"List Join Requests",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:K4.object({}),outputSchema:K4.object({requests:K4.array(ekf)}),handler:async(i,u)=>{$i(u),await u.access.check();let t=Si(u);return{requests:(await u.storage.organizationJoinRequests.listPendingWithUser(t.id)).map((l)=>({id:l.id,userId:l.userId,status:l.status,createdAt:new Date(l.createdAt).toISOString(),user:l.user}))}}}),Dlu=p({name:"ORGANIZATION_JOIN_REQUEST_APPROVE",description:"Approve a pending join request, adding the user as a member.",annotations:{title:"Approve Join Request",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:K4.object({requestId:K4.string()}),outputSchema:K4.object({success:K4.boolean()}),handler:async(i,u)=>{$i(u),await u.access.check();let t=Si(u),f=await u.storage.organizationJoinRequests.getById(i.requestId);if(!f||f.organizationId!==t.id)throw Error("Join request not found");if(f.status!=="pending")throw Error("Join request has already been decided");let l=Cu(u);if(!await u.storage.organizationJoinRequests.decide(f.id,"approved",l??f.userId))return{success:!0};try{await u.boundAuth.organization.addMember({organizationId:t.id,userId:f.userId,role:["user"]})}catch(c){if(!C$(c))throw c}if(l)mu.capture({distinctId:l,event:"organization_join_request_approved",groups:{organization:t.id},properties:{organization_id:t.id,user_id:f.userId}});return{success:!0}}}),vlu=p({name:"ORGANIZATION_JOIN_REQUEST_DENY",description:"Deny a pending join request.",annotations:{title:"Deny Join Request",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:K4.object({requestId:K4.string()}),outputSchema:K4.object({success:K4.boolean()}),handler:async(i,u)=>{$i(u),await u.access.check();let t=Si(u),f=await u.storage.organizationJoinRequests.getById(i.requestId);if(!f||f.organizationId!==t.id)throw Error("Join request not found");if(f.status!=="pending")throw Error("Join request has already been decided");let l=Cu(u);if(await u.storage.organizationJoinRequests.decide(f.id,"denied",l??f.userId)&&l)mu.capture({distinctId:l,event:"organization_join_request_denied",groups:{organization:t.id},properties:{organization_id:t.id,user_id:f.userId}});return{success:!0}}})});import{z as O6}from"zod";var Nlu;var kUt=v(()=>{Jl();uu();Rw();Nlu=p({name:"ORGANIZATION_MEMBER_ADD",description:"Invite a member to the organization by email with an assigned role.",annotations:{title:"Add Organization Member",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:O6.object({organizationId:O6.string().optional(),userId:O6.string(),role:O6.array(O6.string())}),outputSchema:O6.object({id:O6.string(),organizationId:O6.string(),userId:O6.string(),role:O6.union([O6.string(),O6.array(O6.string())]),createdAt:O6.string().datetime().describe("ISO 8601 timestamp")}),handler:async(i,u)=>{$i(u),await u.access.check();let t=i.organizationId||u.organization?.id;if(!t)throw Error("Organization ID required (no active organization in context)");if(t!==u.organization?.id)throw Error("Organization ID does not match authenticated organization");let f=await u.db.selectFrom("member").select(["role"]).where("userId","=",Cu(u)??"").where("organizationId","=",t).executeTakeFirst();if(!Idi(f?.role,i.role))throw Error(`Insufficient privileges to assign role "${i.role.join(",")}"`);let l=await u.boundAuth.organization.addMember({organizationId:t,userId:i.userId,role:i.role});if(!l)throw Error("Failed to add member");let E=Cu(u);if(E)mu.capture({distinctId:E,event:"organization_member_added",groups:{organization:t},properties:{organization_id:t,added_user_id:i.userId,role:i.role}});return{...l,role:l.role,createdAt:l.createdAt instanceof Date?l.createdAt.toISOString():l.createdAt}}})});import{z as pJ}from"zod";var Slu;var CUt=v(()=>{Jl();uu();Slu=p({name:"ORGANIZATION_MEMBER_REMOVE",description:"Remove a member from the organization. Revokes all their access immediately.",annotations:{title:"Remove Organization Member",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:pJ.object({organizationId:pJ.string().optional(),memberIdOrEmail:pJ.string()}),outputSchema:pJ.object({success:pJ.boolean(),memberIdOrEmail:pJ.string()}),handler:async(i,u)=>{$i(u),await u.access.check();let t=i.organizationId||u.organization?.id;if(!t)throw Error("Organization ID required (no active organization in context)");if(t!==u.organization?.id)throw Error("Organization ID does not match authenticated organization");let f=await u.boundAuth.organization.removeMember({organizationId:t,memberIdOrEmail:i.memberIdOrEmail});u.invalidateMemberRole?.(f.member.userId,t);let l=Cu(u);if(l)mu.capture({distinctId:l,event:"organization_member_removed",groups:{organization:t},properties:{organization_id:t,member_id_or_email:i.memberIdOrEmail}});return{success:!0,memberIdOrEmail:i.memberIdOrEmail}}})});import{z as G_}from"zod";var Olu;var YUt=v(()=>{uu();Olu=p({name:"ORGANIZATION_MEMBER_LIST",description:"List all members in the organization with their roles.",annotations:{title:"List Organization Members",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:G_.object({limit:G_.number().optional(),offset:G_.number().optional()}),outputSchema:G_.object({members:G_.array(G_.object({id:G_.string(),organizationId:G_.string(),userId:G_.string(),role:G_.string(),createdAt:G_.string().datetime().describe("ISO 8601 timestamp"),user:G_.object({id:G_.string(),name:G_.string(),email:G_.string(),image:G_.string().optional()}).optional()}))}),handler:async(i,u)=>{$i(u),await u.access.check();let t=u.organization?.id;if(!t)throw Error("Organization ID required (no active organization in context)");let f=await u.boundAuth.organization.listMembers({organizationId:t,limit:i.limit,offset:i.offset});return{members:(Array.isArray(f)?f:[]).map((E)=>({...E,createdAt:E.createdAt instanceof Date?E.createdAt.toISOString():E.createdAt}))}}})});import{z as fc}from"zod";var $lu;var jUt=v(()=>{Jl();uu();Rw();$lu=p({name:"ORGANIZATION_MEMBER_UPDATE_ROLE",description:"Change a member's role (e.g., admin, member) within the organization.",annotations:{title:"Update Member Role",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:fc.object({organizationId:fc.string().optional(),memberId:fc.string(),role:fc.array(fc.string())}),outputSchema:fc.object({id:fc.string(),organizationId:fc.string(),userId:fc.string(),role:fc.union([fc.string(),fc.array(fc.string())]),createdAt:fc.string().datetime().describe("ISO 8601 timestamp"),user:fc.object({email:fc.string(),name:fc.string(),image:fc.string().optional()})}),handler:async(i,u)=>{$i(u),await u.access.check();let t=i.organizationId||u.organization?.id;if(!t)throw Error("Organization ID required (no active organization in context)");let f=await u.db.selectFrom("member").select(["role"]).where("userId","=",Cu(u)??"").where("organizationId","=",t).executeTakeFirst();if(!Idi(f?.role,i.role))throw Error(`Insufficient privileges to assign role "${i.role.join(",")}"`);let l=await u.boundAuth.organization.updateMemberRole({organizationId:t,memberId:i.memberId,role:i.role});if(!l)throw Error("Failed to update member role");u.invalidateMemberRole?.(l.userId,t);let E=Cu(u);if(E)mu.capture({distinctId:E,event:"organization_member_role_updated",groups:{organization:t},properties:{organization_id:t,member_id:i.memberId,target_user_id:l.userId,new_role:Array.isArray(i.role)?i.role.join(","):i.role}});return{...l,createdAt:l.createdAt instanceof Date?l.createdAt.toISOString():l.createdAt}}})});async function KUt(){if(wo&&Date.now()-wo.fetchedAt<600000)return wo.rate;try{let u=await(await fetch("https://economia.awesomeapi.com.br/json/last/USD-BRL",{signal:AbortSignal.timeout(5000)})).json(),t=parseFloat(u.USDBRL?.bid??"");if(Number.isNaN(t)||t<=0)throw Error("Invalid rate");return wo={rate:t,fetchedAt:Date.now()},t}catch{return wo?.rate??5.5}}function HUt(i,u,t){if(u==="brl")return Math.round(i/t);return i}var wo=null;function Plu(i,u="",t=new URLSearchParams){for(let[f,l]of Object.entries(i)){if(l===void 0||l===null)continue;let E=u?`${u}[${f}]`:f;if(Array.isArray(l))l.forEach((c,_)=>{if(typeof c==="object"&&c!==null)Plu(c,`${E}[${_}]`,t);else t.append(`${E}[${_}]`,String(c))});else if(typeof l==="object")Plu(l,E,t);else t.append(E,String(l))}return t}async function Y$(i,u){let t=_u().stripeSecretKey;if(!t)throw new $6(503,"billing is not configured");let f=u?.params?Plu(u.params).toString():void 0,l=await fetch(`${akf}${i}`,{method:u?.method??(f?"POST":"GET"),headers:{Authorization:`Bearer ${t}`,...f&&{"Content-Type":"application/x-www-form-urlencoded"}},body:f,signal:AbortSignal.timeout(okf)}),E=await l.json().catch(()=>({}));if(!l.ok){let c=E.error?.message??`HTTP ${l.status}`;throw new $6(l.status,c)}return E}async function XUt(i){let u=_u().stripeSeatPriceId;if(!u)throw new $6(503,"billing is not configured");let t=await Y$("/checkout/sessions",{params:{mode:"subscription",line_items:[{price:u,quantity:i.quantity}],success_url:i.successUrl,cancel_url:i.cancelUrl,metadata:{orgId:i.organizationId},subscription_data:{metadata:{orgId:i.organizationId}}}});if(!t.url)throw new $6(500,"checkout session lacks url");return{url:t.url}}async function glu(i){let t=(await Y$(`/subscriptions/${encodeURIComponent(i)}`)).items?.data??[],f=_u().stripeSeatPriceId,l=f?t.find((E)=>E.price?.id===f):t.length===1?t[0]:void 0;if(!l)throw new $6(500,"subscription has no seat item");return{itemId:l.id,quantity:l.quantity??0}}async function JUt(i){let{itemId:u}=await glu(i.subscriptionId),t=await Y$("/invoices/create_preview",{params:{subscription:i.subscriptionId,subscription_details:{items:[{id:u,quantity:i.quantity}],proration_behavior:"always_invoice"}}});return{amountDueCents:t.amount_due??0,currency:t.currency??"usd"}}function skf(i,u){return Math.round(i*(1+u/100))}async function WUt(i){let u=skf(i.amountCents,i.feePercent),t=HUt(i.amountCents,i.currency,await KUt()),f=i.currency==="brl"?`Studio AI credits (R$ ${(i.amountCents/100).toFixed(2)})`:`Studio AI credits ($${(i.amountCents/100).toFixed(2)})`,l=await Y$("/checkout/sessions",{params:{mode:"payment",...i.customerId&&{customer:i.customerId},line_items:[{quantity:1,price_data:{currency:i.currency,unit_amount:u,product_data:{name:f}}}],success_url:i.successUrl,cancel_url:i.cancelUrl,metadata:{kind:"topup",orgId:i.organizationId,creditCents:t}}});if(!l.url)throw new $6(500,"checkout session lacks url");return{url:l.url}}async function bUt(i){let u=await Y$("/billing_portal/sessions",{params:{customer:i.customerId,return_url:i.returnUrl}});if(!u.url)throw new $6(500,"portal session lacks url");return{url:u.url}}async function QUt(i){let{itemId:u}=await glu(i.subscriptionId);await Y$(`/subscriptions/${encodeURIComponent(i.subscriptionId)}`,{params:{items:[{id:u,quantity:i.quantity}],proration_behavior:"always_invoice",payment_behavior:"pending_if_incomplete"}})}async function MUt(i){await Y$(`/subscriptions/${encodeURIComponent(i)}`,{method:"DELETE"})}async function zUt(i){if(i.targetQuantity<1)return!1;let{itemId:u,quantity:t}=await glu(i.subscriptionId);if(t===i.targetQuantity)return!1;return await Y$(`/subscriptions/${encodeURIComponent(i.subscriptionId)}`,{params:{items:[{id:u,quantity:i.targetQuantity}],proration_behavior:"always_invoice",payment_behavior:"pending_if_incomplete"}}),!0}var akf="https://api.stripe.com/v1",$6,okf=15000;var iW=v(()=>{jt();$6=class $6 extends Error{status;constructor(i,u){super(`Stripe API ${i}: ${u}`);this.status=i;this.name="StripeApiError"}}});import{z as H4}from"zod";var pkf,Ulu,Blu;var rUt=v(()=>{iW();lH();uu();qK();pkf=H4.object({legacy:H4.boolean(),billingMode:H4.string(),status:H4.string(),includedReportUrl:H4.string().nullable()}),Ulu=p({name:"ORGANIZATION_SEATS_GET",description:"Get the organization's billing identity and which members hold paid seats.",annotations:{title:"Get Organization Seats",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:H4.object({}),outputSchema:H4.object({billing:pkf.nullable(),paidSeatUserIds:H4.array(H4.string())}),handler:async(i,u)=>{$i(u),await u.access.check();let t=u.organization?.id;if(!t)throw Error("Organization context required");let[f,l]=await Promise.all([u.storage.organizationBilling.getBilling(t),u.storage.organizationBilling.listPaidSeatUserIds(t)]);return{billing:f?{legacy:f.legacy,billingMode:f.billingMode,status:f.status,includedReportUrl:f.includedReportUrl}:null,paidSeatUserIds:l}}}),Blu=p({name:"ORGANIZATION_SEATS_SET",description:"Set members' seats (paid/free). Invoiced organizations apply directly; self-serve organizations with an active subscription also charge the prorated difference on the saved card (preview it with ORGANIZATION_SEATS_PREVIEW first).",annotations:{title:"Set Organization Seats",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:H4.object({seats:H4.array(H4.object({userId:H4.string().min(1),seat:H4.enum(["paid","free"])})).min(1).max(200)}),outputSchema:H4.object({applied:H4.array(H4.object({userId:H4.string(),seat:H4.enum(["paid","free"])})),paidSeatCount:H4.number(),benefitsSyncQueued:H4.boolean()}),handler:async(i,u)=>{$i(u),await u.access.check();let t=u.organization?.id;if(!t)throw Error("Organization context required");let f=Cu(u);if(!f)throw Error("User ID required");let l=await u.storage.organizationBilling.getBilling(t);if(!l||l.legacy)throw Error("This organization is on the legacy plan \u2014 seats do not apply.");let E=fH(l)?l.stripeSubscriptionId:null,c;try{c=await u.storage.organizationBilling.setSeats(t,i.seats,f,{markBenefitsPending:YP()})}catch(T){if(T instanceof a1i)throw Error(T.message);throw T}if(E)try{await QUt({subscriptionId:E,quantity:c.paidSeatCount})}catch(T){let d=T instanceof $6?T.message:"Stripe update failed";throw Error(`Seats saved, but updating the subscription failed: ${d}. Apply again to retry the charge.`)}let _=!1;if(c.benefitsReferenceId)try{await Ev(t,c.benefitsReferenceId,"apply"),_=!0}catch(T){console.error("Failed to enqueue benefit sync (sweep covers):",T)}return{applied:c.applied,paidSeatCount:c.paidSeatCount,benefitsSyncQueued:_}}})});import{z as mv}from"zod";var Ilu,xlu;var qUt=v(()=>{iW();q4();uu();Ilu=p({name:"ORGANIZATION_BILLING_CHECKOUT_START",description:"Start the organization's seat subscription: creates a Stripe Checkout session for the current paid-seat count and returns its URL.",annotations:{title:"Start Billing Checkout",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!1,openWorldHint:!0},inputSchema:mv.object({}),outputSchema:mv.object({url:mv.string(),quantity:mv.number()}),handler:async(i,u)=>{$i(u),await u.access.check();let t=u.organization?.id,f=u.organization?.slug;if(!t||!f)throw Error("Organization context required");let[l,E]=await Promise.all([u.storage.organizationBilling.getBilling(t),u.storage.organizationBilling.listPaidSeatUserIds(t)]);if(!l||l.legacy)throw Error("This organization is on the legacy plan \u2014 no subscription needed.");if(l.billingMode!=="self_serve")throw Error("Contract-billed organizations do not use checkout.");if(l.status==="active")throw Error("This organization already has an active subscription \u2014 seat changes apply directly.");if(l.stripeSubscriptionId)throw Error("This organization still has a subscription on file \u2014 settle or cancel it before starting a new checkout.");let c=E.length;if(c<1)throw Error("Mark at least one member as a paid seat before subscribing.");let _=`${$c()}/${encodeURIComponent(f)}/members`,{url:T}=await XUt({organizationId:t,quantity:c,successUrl:`${_}?checkout=success`,cancelUrl:`${_}?checkout=canceled`});return{url:T,quantity:c}}}),xlu=p({name:"ORGANIZATION_SEATS_PREVIEW",description:"Preview what the organization pays now for changing its paid-seat count (Stripe prorated invoice preview). Read-only \u2014 nothing is charged.",annotations:{title:"Preview Seat Change",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!0},inputSchema:mv.object({quantity:mv.number().int().min(1).max(1000)}),outputSchema:mv.object({amountDueCents:mv.number(),currency:mv.string()}),handler:async(i,u)=>{$i(u),await u.access.check();let t=u.organization?.id;if(!t)throw Error("Organization context required");let f=await u.storage.organizationBilling.getBilling(t);if(!fH(f))throw Error("Seat previews need an active self-serve subscription.");return await JUt({subscriptionId:f.stripeSubscriptionId,quantity:i.quantity})}})});import{z as j$}from"zod";var ylu,Rlu;var VUt=v(()=>{iW();lH();q4();uu();dg();ylu=p({name:"ORGANIZATION_BILLING_PORTAL",description:"Open the organization's Stripe billing portal (manage card, invoices, cancellation). Returns the portal URL.",annotations:{title:"Open Billing Portal",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!1,openWorldHint:!0},inputSchema:j$.object({}),outputSchema:j$.object({url:j$.string()}),handler:async(i,u)=>{$i(u),await u.access.check();let t=Si(u);if(!t.slug)throw Error("Organization context required");let f=await u.storage.organizationBilling.getBilling(t.id);if(!f?.stripeCustomerId)throw Error("This organization has no billing account yet \u2014 subscribe first.");if(f.legacy||f.billingMode!=="self_serve")throw Error("This organization's billing is managed by deco \u2014 contact support.");try{return await bUt({customerId:f.stripeCustomerId,returnUrl:`${$c()}/${encodeURIComponent(t.slug)}/members`})}catch(l){if(l instanceof $6)throw Error(l.message);throw l}}}),Rlu=p({name:"ORGANIZATION_INCLUDED_REPORT_SET",description:"Choose which site's weekly report re-run the organization's subscription includes (null clears it).",annotations:{title:"Set Included Report Site",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:j$.object({url:j$.string().trim().min(1).max(255).nullable()}),outputSchema:j$.object({includedReportUrl:j$.string().nullable(),benefitsSyncQueued:j$.boolean()}),handler:async(i,u)=>{$i(u),await u.access.check();let t=Si(u),f=await u.storage.organizationBilling.getBilling(t.id);if(!f||f.legacy)throw Error("This organization is on the legacy plan \u2014 included reports do not apply.");let l=i.url===null?null:l6i(i.url);if(i.url!==null&&!l)throw Error(`"${i.url}" is not a valid site URL.`);let{updated:E,benefitsReferenceId:c}=await u.storage.organizationBilling.setIncludedReportUrl(t.id,l,{markBenefitsPending:YP()});if(!E)throw Error("Organization billing row missing.");let _=!1;if(c)try{await Ev(t.id,c,"apply"),_=!0}catch(T){console.error("Failed to enqueue benefit sync (sweep covers):",T)}return{includedReportUrl:l,benefitsSyncQueued:_}}})});import{z as no}from"zod";function iCf(i){return`[CREDITS] Paid report runs need at least $${(mUt/100).toFixed(2)} of AI credit balance \u2014 current balance is $${(i/100).toFixed(2)}. Top up and try again.`}var mUt=500,Flu;var eUt=v(()=>{MVi();uu();A3();yO();dg();Flu=p({name:"ORGANIZATION_REPORT_RUN_PAID",description:"Trigger a paid report run for one of the organization's sites, billed against its AI credits (requires at least $5 of balance; the run's real cost plus markup is debited at completion).",annotations:{title:"Run Paid Report",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!1,openWorldHint:!0},inputSchema:no.object({url:no.string().trim().min(1).max(255).optional()}),outputSchema:no.object({url:no.string(),started:no.boolean()}),handler:async(i,u)=>{$i(u),await u.access.check();let t=Si(u),f=Cu(u);if(!f)throw Error("User ID required");if(!Nq())throw Error("Reports are not available on this deployment.");let l;if(i.url)l=l6i(i.url);else l=(await u.storage.organizationBilling.getBilling(t.id))?.includedReportUrl??null;if(!l)throw Error(i.url?`"${i.url}" is not a valid site URL.`:"No site chosen \u2014 pass a url or set the included report site first.");let E=F1().deco;if(!E?.getCreditsBalance)throw Error("AI credit balance is not available on this deployment.");let c=await MA(f,u.auth.user?.email),{balanceCents:_}=await E.getCreditsBalance(c,t.id);if(!(_>=mUt))throw Error(iCf(_??0));return await Ytt({host:l,organizationId:t.id}),{url:l,started:!0}}})});var aUt=v(()=>{hUt();AUt();DUt();vUt();NUt();OUt();$Ut();gUt();BUt();IUt();yUt();ZUt();GUt();kUt();CUt();YUt();jUt();rUt();qUt();VUt();eUt()});function oUt(i,u){return i?.startsWith(`${ho[u]}:`)??!1}function Llu(i){let u=0;for(let t of i){if(t.action!=="status_changed")continue;if(t.data?.to!=="in_review")continue;u=Math.max(u,new Date(t.occurredAt).getTime())}return u}function tCf(i,u){let t=Llu(i),f=new Map;for(let l of i){if(l.action!=="review_approved"&&l.action!=="review_changes_requested")continue;if(new Date(l.occurredAt).getTime()<t)continue;let E=l.data??{};if(E.reviewer!=="qa"&&E.reviewer!=="code_review")continue;if(l.action==="review_approved"){if(u?.verifiedOnly&&E.verified!==!0)continue;f.set(E.reviewer,"approved")}else f.set(E.reviewer,"changes_requested")}return f}function Qni(i,u,t){if(u.length===0)return!1;let f=tCf(i,t);return u.every((l)=>f.get(l)==="approved")}var jc="super-agent",uW,ho,tW,sUt="task-board.item.updated",pUt="task-board.item.deleted";var ev=v(()=>{uW=["qa","code_review"],ho={qa:"QA Agent",code_review:"Code Reviewer"},tW={qa:"qa_agent_enabled",code_review:"code_reviewer_enabled"}});import{z as Nt}from"zod";var av,g8,fCf,lCf,i7t,fW,ECf,cCf,u7t;var $3=v(()=>{ev();av=Nt.enum(["triage","todo","in_progress","in_review","done"]),g8=Nt.enum(["none","low","medium","high","urgent"]),fCf=Nt.object({threadId:Nt.string(),virtualMcpId:Nt.string().nullable(),status:Nt.enum(["in_progress","requires_action","failed","completed","expired"]).nullable(),title:Nt.string().nullable(),lastMessage:Nt.string().nullable(),hasPreview:Nt.boolean(),hasMessages:Nt.boolean(),createdAt:Nt.string()}),lCf=Nt.object({id:Nt.string(),name:Nt.string(),color:Nt.string().nullable().describe('Hex color, e.g. "#3b82f6"'),createdBy:Nt.string(),createdAt:Nt.string().datetime()}),i7t=Nt.object({url:Nt.string(),number:Nt.number(),repoOwner:Nt.string(),repoName:Nt.string(),createdAt:Nt.string(),title:Nt.string().nullable(),body:Nt.string().nullable(),state:Nt.enum(["open","closed"]).nullable(),draft:Nt.boolean().nullable(),merged:Nt.boolean().nullable(),checksStatus:Nt.enum(["pending","passing","failing"]).nullable(),checks:Nt.array(Nt.object({name:Nt.string(),status:Nt.string(),conclusion:Nt.string().nullable(),detailsUrl:Nt.string().nullable(),summary:Nt.string().nullable()})),previewUrl:Nt.string().nullable()}),fW=Nt.object({id:Nt.string(),organizationId:Nt.string(),title:Nt.string(),description:Nt.string().nullable(),status:av,priority:g8,assigneeId:Nt.string().nullable(),assignedBy:Nt.string().nullable(),dueDate:Nt.string().datetime().nullable(),sortOrder:Nt.number(),threads:Nt.array(fCf),tags:Nt.array(lCf),createdBy:Nt.string(),createdAt:Nt.string().datetime(),updatedBy:Nt.string(),updatedAt:Nt.string().datetime()}),ECf=["created","status_changed","assignee_changed","priority_changed","due_date_changed","title_changed","description_changed","tags_changed","review_requested","review_approved","review_changes_requested"],cCf=Nt.enum(ECf),u7t=Nt.object({id:Nt.string(),taskBoardItemId:Nt.string(),action:cCf,actorId:Nt.string().nullable(),data:Nt.record(Nt.string(),Nt.unknown()),occurredAt:Nt.string().datetime()})});async function Mni(i,u,t){if(t===jc)return;let{members:f}=await i.boundAuth.organization.listMembers({organizationId:u,filterField:"userId",filterValue:t});if(!f.some((l)=>l.userId===t))throw Error("assigneeId is not a member of the organization")}var Zlu=v(()=>{$3()});async function Glu(i,u,t){let f;try{return await Promise.race([i.aiProviders.listModels(u,t),new Promise((E,c)=>{f=setTimeout(()=>c(Error("listModels timeout")),_Cf)})])}finally{if(f)clearTimeout(f)}}function TCf(i,u){switch(i){case"fast":return u.chat.fast;case"smart":return u.chat.smart;case"thinking":return u.chat.thinking;case"image":return u.image;case"web_search":return u.webSearch;case"deep_research":return u.deepResearch}}function klu(i,u,t){let f=i.find((l)=>l.modelId===u);return{title:f?.title??t??u,providerId:f?.providerId,capabilities:f?.capabilities,limits:f?.limits??null}}async function $T(i,u,t){let f=i.organization?.id;if(!f)throw Error("resolveTier called without an organization");let E=(await i.storage.organizationSettings.get(f))?.simple_mode?.tiers?.[u]??null,c=i.auth?.user?.id,_=O3.safeParse(u),T=t?.applyUserPrefs&&_.success&&c?(await i.storage.userModelPreferences.get(c,f))?.tiers?.[_.data]??null:null,d=await i.storage.aiProviderKeys.list({organizationId:f});for(let D of[T,E])if(D&&d.some((N)=>N.id===D.keyId)){let N=await Glu(i,D.keyId,f).catch(()=>[]);return{credentialId:D.keyId,modelId:D.modelId,modelMeta:klu(N,D.modelId,D.title)}}if(d.length===0)throw new lW(u);let w={};await Promise.all(d.map(async(D)=>{w[D.id]=await Glu(i,D.id,f).catch(()=>[])}));let n=d.map((D)=>({id:D.id,providerId:D.providerId,label:D.label,presetId:D.presetId,createdBy:D.createdBy,createdAt:D.createdAt})),h=Utt(n,w),A=TCf(u,h);if(!A)throw new lW(u);return{credentialId:A.keyId,modelId:A.modelId,modelMeta:klu(w[A.keyId]??[],A.modelId,A.title)}}async function t7t(i,u,t){let f=i.organization?.id;if(!f)throw Error("resolveSpecificModel called without an organization");let l=await Glu(i,u,f).catch(()=>[]);return{credentialId:u,modelId:t,modelMeta:klu(l,t)}}async function Qw(i,u){try{return await $T(i,u)}catch(t){if(t instanceof lW)return null;return console.warn(`[resolveTier] tier "${u}" resolution failed:`,t),null}}var lW,_Cf=5000;var K$=v(()=>{yd();Z0();lW=class lW extends Error{tier;constructor(i){super(`No model available for tier "${i}". Connect a provider or configure the tier in organization settings.`);this.tier=i;this.name="TierUnavailableError"}}});function zni(i){return i.sandboxProviderKind==="agent-sandbox"&&i.harnessId==="decopilot"}function f7t(i){return i.harnessId==="decopilot"&&(i.sandboxProviderKind==null||i.sandboxProviderKind==="agent-sandbox")}function wCf(i){return{type:"data-run-status",id:"run-status",data:{stage:i}}}function l7t(i){if(!i||typeof i!=="object")return!1;return i.type==="data-run-status"}async function Fh(i,u,t){if(!i)return;try{await i.publishRawChunk(u,wCf(t))}catch{}}var dCf,Ao,dl4;var EW=v(()=>{dCf=["waiting-runner","starting-run","waiting-capacity","gathering-context","preparing-tools","starting-assistant","analyzing-scope"],Ao=["gathering-context","preparing-tools","starting-assistant","analyzing-scope"],dl4=new Set(dCf)});function rni(){return crypto.randomUUID()}var Ylu=C((hl4,_7t)=>{var{defineProperty:Clu,getOwnPropertyDescriptor:nCf,getOwnPropertyNames:hCf}=Object,ACf=Object.prototype.hasOwnProperty,DCf=(i,u)=>{for(var t in u)Clu(i,t,{get:u[t],enumerable:!0})},vCf=(i,u,t,f)=>{if(u&&typeof u==="object"||typeof u==="function"){for(let l of hCf(u))if(!ACf.call(i,l)&&l!==t)Clu(i,l,{get:()=>u[l],enumerable:!(f=nCf(u,l))||f.enumerable})}return i},NCf=(i)=>vCf(Clu({},"__esModule",{value:!0}),i),E7t={};DCf(E7t,{SYMBOL_FOR_REQ_CONTEXT:()=>c7t,getContext:()=>SCf});_7t.exports=NCf(E7t);var c7t=Symbol.for("@vercel/request-context");function SCf(){return globalThis[c7t]?.get?.()??{}}});var Do=C((Al4,w7t)=>{var{defineProperty:jlu,getOwnPropertyDescriptor:OCf,getOwnPropertyNames:$Cf}=Object,PCf=Object.prototype.hasOwnProperty,gCf=(i,u)=>{for(var t in u)jlu(i,t,{get:u[t],enumerable:!0})},UCf=(i,u,t,f)=>{if(u&&typeof u==="object"||typeof u==="function"){for(let l of $Cf(u))if(!PCf.call(i,l)&&l!==t)jlu(i,l,{get:()=>u[l],enumerable:!(f=OCf(u,l))||f.enumerable})}return i},BCf=(i)=>UCf(jlu({},"__esModule",{value:!0}),i),T7t={};gCf(T7t,{VercelOidcTokenError:()=>d7t});w7t.exports=BCf(T7t);class d7t extends Error{constructor(i,u){super(i);this.name="VercelOidcTokenError",this.cause=u}toString(){if(this.cause)return`${this.name}: ${this.message}: ${this.cause}`;return`${this.name}: ${this.message}`}}});var D7t=C((Dl4,A7t)=>{var{create:ICf,defineProperty:qni,getOwnPropertyDescriptor:xCf,getOwnPropertyNames:yCf,getPrototypeOf:RCf}=Object,FCf=Object.prototype.hasOwnProperty,LCf=(i,u)=>{for(var t in u)qni(i,t,{get:u[t],enumerable:!0})},n7t=(i,u,t,f)=>{if(u&&typeof u==="object"||typeof u==="function"){for(let l of yCf(u))if(!FCf.call(i,l)&&l!==t)qni(i,l,{get:()=>u[l],enumerable:!(f=xCf(u,l))||f.enumerable})}return i},Hlu=(i,u,t)=>(t=i!=null?ICf(RCf(i)):{},n7t(u||!i||!i.__esModule?qni(t,"default",{value:i,enumerable:!0}):t,i)),ZCf=(i)=>n7t(qni({},"__esModule",{value:!0}),i),h7t={};LCf(h7t,{findRootDir:()=>CCf,getUserDataDir:()=>YCf});A7t.exports=ZCf(h7t);var vo=Hlu(Oi("path")),GCf=Hlu(Oi("fs")),Klu=Hlu(Oi("os")),kCf=Do();function CCf(){try{let i=process.cwd();while(i!==vo.default.dirname(i)){let u=vo.default.join(i,".vercel");if(GCf.default.existsSync(u))return i;i=vo.default.dirname(i)}}catch(i){throw new kCf.VercelOidcTokenError("Token refresh only supported in node server environments")}return null}function YCf(){if(process.env.XDG_DATA_HOME)return process.env.XDG_DATA_HOME;switch(Klu.default.platform()){case"darwin":return vo.default.join(Klu.default.homedir(),"Library/Application Support");case"linux":return vo.default.join(Klu.default.homedir(),".local/share");case"win32":if(process.env.LOCALAPPDATA)return process.env.LOCALAPPDATA;return null;default:return null}}});var g7t=C((vl4,P7t)=>{var{create:jCf,defineProperty:Vni,getOwnPropertyDescriptor:KCf,getOwnPropertyNames:HCf,getPrototypeOf:XCf}=Object,JCf=Object.prototype.hasOwnProperty,WCf=(i,u)=>{for(var t in u)Vni(i,t,{get:u[t],enumerable:!0})},v7t=(i,u,t,f)=>{if(u&&typeof u==="object"||typeof u==="function"){for(let l of HCf(u))if(!JCf.call(i,l)&&l!==t)Vni(i,l,{get:()=>u[l],enumerable:!(f=KCf(u,l))||f.enumerable})}return i},N7t=(i,u,t)=>(t=i!=null?jCf(XCf(i)):{},v7t(u||!i||!i.__esModule?Vni(t,"default",{value:i,enumerable:!0}):t,i)),bCf=(i)=>v7t(Vni({},"__esModule",{value:!0}),i),S7t={};WCf(S7t,{isValidAccessToken:()=>rCf,readAuthConfig:()=>MCf,writeAuthConfig:()=>zCf});P7t.exports=bCf(S7t);var No=N7t(Oi("fs")),O7t=N7t(Oi("path")),QCf=So();function $7t(){let i=(0,QCf.getVercelDataDir)();if(!i)throw Error(`Unable to find Vercel CLI data directory. Your platform: ${process.platform}. Supported: darwin, linux, win32.`);return O7t.join(i,"auth.json")}function MCf(){try{let i=$7t();if(!No.existsSync(i))return null;let u=No.readFileSync(i,"utf8");if(!u)return null;return JSON.parse(u)}catch(i){return null}}function zCf(i){let u=$7t(),t=O7t.dirname(u);if(!No.existsSync(t))No.mkdirSync(t,{mode:504,recursive:!0});No.writeFileSync(u,JSON.stringify(i,null,2),{mode:384})}function rCf(i,u=0){if(!i.token)return!1;if(typeof i.expiresAt!=="number")return!0;let t=Math.floor(Date.now()/1000),f=u/1000;return i.expiresAt>=t+f}});var x7t=C((Nl4,I7t)=>{var{defineProperty:Wlu,getOwnPropertyDescriptor:qCf,getOwnPropertyNames:VCf}=Object,mCf=Object.prototype.hasOwnProperty,eCf=(i,u)=>{for(var t in u)Wlu(i,t,{get:u[t],enumerable:!0})},aCf=(i,u,t,f)=>{if(u&&typeof u==="object"||typeof u==="function"){for(let l of VCf(u))if(!mCf.call(i,l)&&l!==t)Wlu(i,l,{get:()=>u[l],enumerable:!(f=qCf(u,l))||f.enumerable})}return i},oCf=(i)=>aCf(Wlu({},"__esModule",{value:!0}),i),U7t={};eCf(U7t,{processTokenResponse:()=>tYf,refreshTokenRequest:()=>uYf});I7t.exports=oCf(U7t);var Xlu=Oi("os"),sCf="https://vercel.com",pCf="cl_HYyOPBNtFMfHhaUn9L4QPfTZz6TP47bp",B7t=`@vercel/oidc node-${process.version} ${(0,Xlu.platform)()} (${(0,Xlu.arch)()}) ${(0,Xlu.hostname)()}`,Jlu=null;async function iYf(){if(Jlu)return Jlu;let i=`${sCf}/.well-known/openid-configuration`,u=await fetch(i,{headers:{"user-agent":B7t}});if(!u.ok)throw Error("Failed to discover OAuth endpoints");let t=await u.json();if(!t||typeof t.token_endpoint!=="string")throw Error("Invalid OAuth discovery response");let f=t.token_endpoint;return Jlu=f,f}async function uYf(i){let u=await iYf();return await fetch(u,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded","user-agent":B7t},body:new URLSearchParams({client_id:pCf,grant_type:"refresh_token",...i})})}async function tYf(i){let u=await i.json();if(!i.ok){let t=typeof u==="object"&&u&&"error"in u?String(u.error):"Token refresh failed";return[Error(t)]}if(typeof u!=="object"||u===null)return[Error("Invalid token response")];if(typeof u.access_token!=="string")return[Error("Missing access_token in response")];if(u.token_type!=="Bearer")return[Error("Invalid token_type in response")];if(typeof u.expires_in!=="number")return[Error("Missing expires_in in response")];return[null,u]}});var Qlu=C((Sl4,L7t)=>{var{defineProperty:blu,getOwnPropertyDescriptor:fYf,getOwnPropertyNames:lYf}=Object,EYf=Object.prototype.hasOwnProperty,cYf=(i,u)=>{for(var t in u)blu(i,t,{get:u[t],enumerable:!0})},_Yf=(i,u,t,f)=>{if(u&&typeof u==="object"||typeof u==="function"){for(let l of lYf(u))if(!EYf.call(i,l)&&l!==t)blu(i,l,{get:()=>u[l],enumerable:!(f=fYf(u,l))||f.enumerable})}return i},TYf=(i)=>_Yf(blu({},"__esModule",{value:!0}),i),y7t={};cYf(y7t,{AccessTokenMissingError:()=>R7t,RefreshAccessTokenFailedError:()=>F7t});L7t.exports=TYf(y7t);class R7t extends Error{constructor(){super("No authentication found. Please log in with the Vercel CLI (vercel login).");this.name="AccessTokenMissingError"}}class F7t extends Error{constructor(i){super("Failed to refresh authentication token.",{cause:i});this.name="RefreshAccessTokenFailedError"}}});var So=C((Ol4,Y7t)=>{var{create:dYf,defineProperty:mni,getOwnPropertyDescriptor:wYf,getOwnPropertyNames:nYf,getPrototypeOf:hYf}=Object,AYf=Object.prototype.hasOwnProperty,DYf=(i,u)=>{for(var t in u)mni(i,t,{get:u[t],enumerable:!0})},G7t=(i,u,t,f)=>{if(u&&typeof u==="object"||typeof u==="function"){for(let l of nYf(u))if(!AYf.call(i,l)&&l!==t)mni(i,l,{get:()=>u[l],enumerable:!(f=wYf(u,l))||f.enumerable})}return i},k7t=(i,u,t)=>(t=i!=null?dYf(hYf(i)):{},G7t(u||!i||!i.__esModule?mni(t,"default",{value:i,enumerable:!0}):t,i)),vYf=(i)=>G7t(mni({},"__esModule",{value:!0}),i),C7t={};DYf(C7t,{assertVercelOidcTokenResponse:()=>Mlu,findProjectInfo:()=>$Yf,getTokenPayload:()=>UYf,getVercelDataDir:()=>NYf,getVercelOidcToken:()=>OYf,getVercelToken:()=>SYf,isExpired:()=>BYf,loadToken:()=>gYf,saveToken:()=>PYf});Y7t.exports=vYf(C7t);var Oo=k7t(Oi("path")),U8=k7t(Oi("fs")),TW=Do(),eni=D7t(),cW=g7t(),Z7t=x7t(),_W=Qlu();function NYf(){let u=(0,eni.getUserDataDir)();if(!u)return null;return Oo.join(u,"com.vercel.cli")}async function SYf(i){let u=(0,cW.readAuthConfig)();if(!u?.token)throw new _W.AccessTokenMissingError;if((0,cW.isValidAccessToken)(u,i?.expirationBufferMs))return u.token;if(!u.refreshToken)throw(0,cW.writeAuthConfig)({}),new _W.RefreshAccessTokenFailedError("No refresh token available");try{let t=await(0,Z7t.refreshTokenRequest)({refresh_token:u.refreshToken}),[f,l]=await(0,Z7t.processTokenResponse)(t);if(f||!l)throw(0,cW.writeAuthConfig)({}),new _W.RefreshAccessTokenFailedError(f);let E={token:l.access_token,expiresAt:Math.floor(Date.now()/1000)+l.expires_in};if(l.refresh_token)E.refreshToken=l.refresh_token;return(0,cW.writeAuthConfig)(E),E.token}catch(t){if((0,cW.writeAuthConfig)({}),t instanceof _W.AccessTokenMissingError||t instanceof _W.RefreshAccessTokenFailedError)throw t;throw new _W.RefreshAccessTokenFailedError(t)}}async function OYf(i,u,t){let f=`https://api.vercel.com/v1/projects/${u}/token?source=vercel-oidc-refresh${t?`&teamId=${t}`:""}`,l=await fetch(f,{method:"POST",headers:{Authorization:`Bearer ${i}`}});if(!l.ok)throw new TW.VercelOidcTokenError(`Failed to refresh OIDC token: ${l.statusText}`);let E=await l.json();return Mlu(E),E}function Mlu(i){if(!i||typeof i!=="object")throw TypeError("Vercel OIDC token is malformed. Expected an object. Please run `vc env pull` and try again");if(!("token"in i)||typeof i.token!=="string")throw TypeError("Vercel OIDC token is malformed. Expected a string-valued token property. Please run `vc env pull` and try again")}function $Yf(){let i=(0,eni.findRootDir)();if(!i)throw new TW.VercelOidcTokenError("Unable to find project root directory. Have you linked your project with `vc link?`");let u=Oo.join(i,".vercel","project.json");if(!U8.existsSync(u))throw new TW.VercelOidcTokenError("project.json not found, have you linked your project with `vc link?`");let t=JSON.parse(U8.readFileSync(u,"utf8"));if(typeof t.projectId!=="string"&&typeof t.orgId!=="string")throw TypeError("Expected a string-valued projectId property. Try running `vc link` to re-link your project.");return{projectId:t.projectId,teamId:t.orgId}}function PYf(i,u){let t=(0,eni.getUserDataDir)();if(!t)throw new TW.VercelOidcTokenError("Unable to find user data directory. Please reach out to Vercel support.");let f=Oo.join(t,"com.vercel.token",`${u}.json`),l=JSON.stringify(i);U8.mkdirSync(Oo.dirname(f),{mode:504,recursive:!0}),U8.writeFileSync(f,l),U8.chmodSync(f,432);return}function gYf(i){let u=(0,eni.getUserDataDir)();if(!u)throw new TW.VercelOidcTokenError("Unable to find user data directory. Please reach out to Vercel support.");let t=Oo.join(u,"com.vercel.token",`${i}.json`);if(!U8.existsSync(t))return null;let f=JSON.parse(U8.readFileSync(t,"utf8"));return Mlu(f),f}function UYf(i){let u=i.split(".");if(u.length!==3)throw new TW.VercelOidcTokenError("Invalid token. Please run `vc env pull` and try again");let t=u[1].replace(/-/g,"+").replace(/_/g,"/"),f=t.padEnd(t.length+(4-t.length%4)%4,"=");return JSON.parse(Buffer.from(f,"base64").toString("utf8"))}function BYf(i,u=0){return i.exp*1000<Date.now()+u}});var X7t=C(($l4,H7t)=>{var{defineProperty:zlu,getOwnPropertyDescriptor:IYf,getOwnPropertyNames:xYf}=Object,yYf=Object.prototype.hasOwnProperty,RYf=(i,u)=>{for(var t in u)zlu(i,t,{get:u[t],enumerable:!0})},FYf=(i,u,t,f)=>{if(u&&typeof u==="object"||typeof u==="function"){for(let l of xYf(u))if(!yYf.call(i,l)&&l!==t)zlu(i,l,{get:()=>u[l],enumerable:!(f=IYf(u,l))||f.enumerable})}return i},LYf=(i)=>FYf(zlu({},"__esModule",{value:!0}),i),K7t={};RYf(K7t,{refreshToken:()=>ZYf});H7t.exports=LYf(K7t);var j7t=Do(),H$=So();async function ZYf(i){let u=i?.project,t=i?.team;if(!u&&!t){let l=(0,H$.findProjectInfo)();u=l.projectId,t=l.teamId}else if(!u||!t){let l=(0,H$.findProjectInfo)();u=u??l.projectId,t=t??l.teamId}if(!u)throw new j7t.VercelOidcTokenError("Failed to refresh OIDC token: No project specified. Try re-linking your project with `vc link`");let f=(0,H$.loadToken)(u);if(!f||(0,H$.isExpired)((0,H$.getTokenPayload)(f.token),i?.expirationBufferMs)){let l=await(0,H$.getVercelToken)({expirationBufferMs:i?.expirationBufferMs});if(f=await(0,H$.getVercelOidcToken)(l,u,t),!f)throw new j7t.VercelOidcTokenError("Failed to refresh OIDC token");(0,H$.saveToken)(f,u)}process.env.VERCEL_OIDC_TOKEN=f.token;return}});var b7t=C((Pl4,W7t)=>{var{defineProperty:qlu,getOwnPropertyDescriptor:GYf,getOwnPropertyNames:kYf}=Object,CYf=Object.prototype.hasOwnProperty,YYf=(i,u)=>{for(var t in u)qlu(i,t,{get:u[t],enumerable:!0})},jYf=(i,u,t,f)=>{if(u&&typeof u==="object"||typeof u==="function"){for(let l of kYf(u))if(!CYf.call(i,l)&&l!==t)qlu(i,l,{get:()=>u[l],enumerable:!(f=GYf(u,l))||f.enumerable})}return i},KYf=(i)=>jYf(qlu({},"__esModule",{value:!0}),i),J7t={};YYf(J7t,{getVercelOidcToken:()=>JYf,getVercelOidcTokenSync:()=>rlu});W7t.exports=KYf(J7t);var HYf=Ylu(),XYf=Do();async function JYf(i){let u="",t;try{u=rlu()}catch(f){t=f}try{let[{getTokenPayload:f,isExpired:l},{refreshToken:E}]=await Promise.all([await Promise.resolve().then(() => Z(So())),await Promise.resolve().then(() => Z(X7t()))]);if(!u||l(f(u),i?.expirationBufferMs))await E(i),u=rlu()}catch(f){let l=t instanceof Error?t.message:"";if(f instanceof Error)l=`${l}
 ${f.message}`;if(l)throw new XYf.VercelOidcTokenError(l);throw f}return u}function rlu(){let i=(0,HYf.getContext)().headers?.["x-vercel-oidc-token"]??process.env.VERCEL_OIDC_TOKEN;if(!i)throw Error("The 'x-vercel-oidc-token' header is missing from the request. Do you have the OIDC option enabled in the Vercel project settings?");return i}});var mlu=C((gl4,r7t)=>{var{defineProperty:Vlu,getOwnPropertyDescriptor:WYf,getOwnPropertyNames:bYf}=Object,QYf=Object.prototype.hasOwnProperty,MYf=(i,u)=>{for(var t in u)Vlu(i,t,{get:u[t],enumerable:!0})},zYf=(i,u,t,f)=>{if(u&&typeof u==="object"||typeof u==="function"){for(let l of bYf(u))if(!QYf.call(i,l)&&l!==t)Vlu(i,l,{get:()=>u[l],enumerable:!(f=WYf(u,l))||f.enumerable})}return i},rYf=(i)=>zYf(Vlu({},"__esModule",{value:!0}),i),z7t={};MYf(z7t,{AccessTokenMissingError:()=>M7t.AccessTokenMissingError,RefreshAccessTokenFailedError:()=>M7t.RefreshAccessTokenFailedError,getContext:()=>qYf.getContext,getVercelOidcToken:()=>Q7t.getVercelOidcToken,getVercelOidcTokenSync:()=>Q7t.getVercelOidcTokenSync,getVercelToken:()=>VYf.getVercelToken});r7t.exports=rYf(z7t);var Q7t=b7t(),qYf=Ylu(),M7t=Qlu(),VYf=So()});import{z as ov}from"zod/v4";import{z as f9t}from"zod/v4";import{z as alu}from"zod/v4";import{z as J4}from"zod/v4";import{z as L1}from"zod/v4";import{z as X4}from"zod/v4";import{z as ani}from"zod/v4";import{z as yE}from"zod/v4";import{z as uE}from"zod/v4";import{z as uf}from"zod/v4";import{z as XE}from"zod/v4";import{z as nl}from"zod";import{z as _l}from"zod";async function P9t({response:i,statusCode:u,defaultMessage:t="Gateway request failed",cause:f,authMethod:l}){var E;let c=await v4({value:i,schema:wjf});if(!c.success){let n=typeof i==="object"&&i!==null&&"generationId"in i?i.generationId:void 0;return new djf({message:`Invalid error response format: ${t}`,statusCode:u,response:i,validationError:c.error,cause:f,generationId:n})}let _=c.value,T=_.error.type,d=_.error.message,w=(E=_.generationId)!=null?E:void 0;switch(T){case"authentication_error":return oni.createContextualError({apiKeyProvided:l==="api-key",oidcTokenProvided:l==="oidc",statusCode:u,cause:f,generationId:w});case"invalid_request_error":return new oYf({message:d,statusCode:u,cause:f,generationId:w});case"rate_limit_exceeded":return new pYf({message:d,statusCode:u,cause:f,generationId:w});case"model_not_found":{let n=await v4({value:_.error.param,schema:ujf});return new tjf({message:d,statusCode:u,modelId:n.success?n.value.modelId:void 0,cause:f,generationId:w})}case"internal_server_error":return new w9t({message:d,statusCode:u,cause:f,generationId:w});case"failed_dependency":return new Ejf({message:d,statusCode:u,cause:f,generationId:w});case"forbidden":return new _jf({message:d,statusCode:u,cause:f,generationId:w});default:return new w9t({message:d,statusCode:u,cause:f,generationId:w})}}function njf(i){if(i.data!==void 0)return i.data;if(i.responseBody!=null)try{return JSON.parse(i.responseBody)}catch(u){return i.responseBody}return{}}function x9t(i){if(!(i instanceof Error))return!1;let u=i.code;if(typeof u==="string")return["UND_ERR_HEADERS_TIMEOUT","UND_ERR_BODY_TIMEOUT","UND_ERR_CONNECT_TIMEOUT"].includes(u);return!1}async function P6(i,u){var t;if(W4.isInstance(i))return i;if(x9t(i))return I9t.createTimeoutError({originalMessage:i instanceof Error?i.message:"Unknown error",cause:i});if(v0.isInstance(i)){if(i.cause&&x9t(i.cause))return I9t.createTimeoutError({originalMessage:i.message,cause:i});return await P9t({response:njf(i),statusCode:(t=i.statusCode)!=null?t:500,defaultMessage:"Gateway request failed",cause:i,authMethod:u})}return await P9t({response:{},statusCode:500,defaultMessage:i instanceof Error?`Gateway request failed: ${i.message}`:"Unknown Gateway error",cause:i,authMethod:u})}async function P3(i){let u=await v4({value:i[H9t],schema:Ajf});return u.success?u.value:void 0}function R9t(i){if(i.type==="file"&&i.data instanceof Uint8Array)return{...i,data:T6(i.data)};return i}function Gjf(i){if(i.type==="file"&&i.data instanceof Uint8Array)return{...i,data:T6(i.data)};return i}async function mjf(){var i;return(i=X9t.getContext().headers)==null?void 0:i["x-vercel-id"]}function olu(i={}){var u,t;let f=null,l=null,E=(u=i.metadataCacheRefreshMillis)!=null?u:300000,c=0,_=(t=w$(i.baseURL))!=null?t:"https://ai-gateway.vercel.sh/v3/ai",T=async()=>{try{let $=await ojf(i);return cl({Authorization:`Bearer ${$.token}`,"ai-gateway-protocol-version":ajf,[H9t]:$.authMethod,...i.headers},`ai-sdk/gateway/${ejf}`)}catch($){throw oni.createContextualError({apiKeyProvided:!1,oidcTokenProvided:!1,statusCode:401,cause:$})}},d=()=>{let $=u3({settingValue:void 0,environmentVariableName:"VERCEL_DEPLOYMENT_ID"}),P=u3({settingValue:void 0,environmentVariableName:"VERCEL_ENV"}),g=u3({settingValue:void 0,environmentVariableName:"VERCEL_REGION"}),U=u3({settingValue:void 0,environmentVariableName:"VERCEL_PROJECT_ID"});return async()=>{let x=await mjf();return{...$&&{"ai-o11y-deployment-id":$},...P&&{"ai-o11y-environment":P},...g&&{"ai-o11y-region":g},...x&&{"ai-o11y-request-id":x},...U&&{"ai-o11y-project-id":U}}}},w=($)=>{return new gjf($,{provider:"gateway",baseURL:_,headers:T,fetch:i.fetch,o11yHeaders:d()})},n=async()=>{var $,P,g;let U=(g=(P=($=i._internal)==null?void 0:$.currentDate)==null?void 0:P.call($).getTime())!=null?g:Date.now();if(!f||U-c>E)c=U,f=new y9t({baseURL:_,headers:T,fetch:i.fetch}).getAvailableModels().then((x)=>{return l=x,x}).catch(async(x)=>{throw await P6(x,await P3(await T()))});return l?Promise.resolve(l):f},h=async()=>{return new y9t({baseURL:_,headers:T,fetch:i.fetch}).getCredits().catch(async($)=>{throw await P6($,await P3(await T()))})},A=async($)=>{return new Sjf({baseURL:_,headers:T,fetch:i.fetch}).getSpendReport($).catch(async(P)=>{throw await P6(P,await P3(await T()))})},D=async($)=>{return new $jf({baseURL:_,headers:T,fetch:i.fetch}).getGenerationInfo($).catch(async(P)=>{throw await P6(P,await P3(await T()))})},N=function($){if(new.target)throw Error("The Gateway Provider model function cannot be called with the new keyword.");return w($)};N.specificationVersion="v3",N.getAvailableModels=n,N.getCredits=h,N.getSpendReport=A,N.getGenerationInfo=D,N.imageModel=($)=>{return new xjf($,{provider:"gateway",baseURL:_,headers:T,fetch:i.fetch,o11yHeaders:d()})},N.languageModel=w;let S=($)=>{return new Ujf($,{provider:"gateway",baseURL:_,headers:T,fetch:i.fetch,o11yHeaders:d()})};N.embeddingModel=S,N.textEmbeddingModel=S,N.videoModel=($)=>{return new Zjf($,{provider:"gateway",baseURL:_,headers:T,fetch:i.fetch,o11yHeaders:d()})};let O=($)=>{return new Kjf($,{provider:"gateway",baseURL:_,headers:T,fetch:i.fetch,o11yHeaders:d()})};return N.rerankingModel=O,N.reranking=O,N.chat=N.languageModel,N.embedding=N.embeddingModel,N.image=N.imageModel,N.video=N.videoModel,N.tools=Vjf,N}async function ojf(i){let u=u3({settingValue:i.apiKey,environmentVariableName:"AI_GATEWAY_API_KEY"});if(u)return{token:u,authMethod:"api-key"};return{token:await J9t.getVercelOidcToken(),authMethod:"oidc"}}var X9t,J9t,mYf="vercel.ai.gateway.error",elu,q7t,V7t,W4,F9t="GatewayAuthenticationError",eYf,m7t,e7t,a7t,oni,L9t="GatewayInvalidRequestError",aYf,o7t,s7t,p7t,oYf,Z9t="GatewayRateLimitError",sYf,i9t,u9t,t9t,pYf,G9t="GatewayModelNotFoundError",ijf,l9t,ujf,E9t,c9t,tjf,k9t="GatewayInternalServerError",fjf,_9t,T9t,d9t,w9t,C9t="GatewayFailedDependencyError",ljf,n9t,h9t,A9t,Ejf,Y9t="GatewayForbiddenError",cjf,D9t,v9t,N9t,_jf,j9t="GatewayResponseError",Tjf,S9t,O9t,$9t,djf,wjf,K9t="GatewayTimeoutError",hjf,g9t,U9t,B9t,I9t,H9t="ai-gateway-auth-method",Ajf,Djf,y9t=class{constructor(i){this.config=i}async getAvailableModels(){try{let{value:i}=await Nd({url:`${this.config.baseURL}/config`,headers:await Mt(this.config.headers()),successfulResponseHandler:w0(vjf),failedResponseHandler:KE({errorSchema:J4.any(),errorToMessage:(u)=>u}),fetch:this.config.fetch});return i}catch(i){throw await P6(i)}}async getCredits(){try{let i=new URL(this.config.baseURL),{value:u}=await Nd({url:`${i.origin}/v1/credits`,headers:await Mt(this.config.headers()),successfulResponseHandler:w0(Njf),failedResponseHandler:KE({errorSchema:J4.any(),errorToMessage:(t)=>t}),fetch:this.config.fetch});return u}catch(i){throw await P6(i)}}},vjf,Njf,Sjf=class{constructor(i){this.config=i}async getSpendReport(i){try{let u=new URL(this.config.baseURL),t=new URLSearchParams;if(t.set("start_date",i.startDate),t.set("end_date",i.endDate),i.groupBy)t.set("group_by",i.groupBy);if(i.datePart)t.set("date_part",i.datePart);if(i.userId)t.set("user_id",i.userId);if(i.model)t.set("model",i.model);if(i.provider)t.set("provider",i.provider);if(i.credentialType)t.set("credential_type",i.credentialType);if(i.tags&&i.tags.length>0)t.set("tags",i.tags.join(","));let{value:f}=await Nd({url:`${u.origin}/v1/report?${t.toString()}`,headers:await Mt(this.config.headers()),successfulResponseHandler:w0(Ojf),failedResponseHandler:KE({errorSchema:L1.any(),errorToMessage:(l)=>l}),fetch:this.config.fetch});return f}catch(u){throw await P6(u)}}},Ojf,$jf=class{constructor(i){this.config=i}async getGenerationInfo(i){try{let u=new URL(this.config.baseURL),{value:t}=await Nd({url:`${u.origin}/v1/generation?id=${encodeURIComponent(i.id)}`,headers:await Mt(this.config.headers()),successfulResponseHandler:w0(Pjf),failedResponseHandler:KE({errorSchema:X4.any(),errorToMessage:(f)=>f}),fetch:this.config.fetch});return t}catch(u){throw await P6(u)}}},Pjf,gjf=class{constructor(i,u){this.modelId=i,this.config=u,this.specificationVersion="v3",this.supportedUrls={"*/*":[/.*/]}}get provider(){return this.config.provider}async getArgs(i){let{abortSignal:u,...t}=i;return{args:this.maybeEncodeFileParts(t),warnings:[]}}async doGenerate(i){let{args:u,warnings:t}=await this.getArgs(i),{abortSignal:f}=i,l=await Mt(this.config.headers());try{let{responseHeaders:E,value:c,rawValue:_}=await g0({url:this.getUrl(),headers:t0(l,i.headers,this.getModelConfigHeaders(this.modelId,!1),await Mt(this.config.o11yHeaders)),body:u,successfulResponseHandler:w0(ani.any()),failedResponseHandler:KE({errorSchema:ani.any(),errorToMessage:(T)=>T}),...f&&{abortSignal:f},fetch:this.config.fetch});return{...c,request:{body:u},response:{headers:E,body:_},warnings:t}}catch(E){throw await P6(E,await P3(l))}}async doStream(i){let{args:u,warnings:t}=await this.getArgs(i),{abortSignal:f}=i,l=await Mt(this.config.headers());try{let{value:E,responseHeaders:c}=await g0({url:this.getUrl(),headers:t0(l,i.headers,this.getModelConfigHeaders(this.modelId,!0),await Mt(this.config.o11yHeaders)),body:u,successfulResponseHandler:g_(ani.any()),failedResponseHandler:KE({errorSchema:ani.any(),errorToMessage:(_)=>_}),...f&&{abortSignal:f},fetch:this.config.fetch});return{stream:E.pipeThrough(new TransformStream({start(_){if(t.length>0)_.enqueue({type:"stream-start",warnings:t})},transform(_,T){if(_.success){let d=_.value;if(d.type==="raw"&&!i.includeRawChunks)return;if(d.type==="response-metadata"&&d.timestamp&&typeof d.timestamp==="string")d.timestamp=new Date(d.timestamp);T.enqueue(d)}else T.error(_.error)}})),request:{body:u},response:{headers:c}}}catch(E){throw await P6(E,await P3(l))}}isFilePart(i){return i&&typeof i==="object"&&"type"in i&&i.type==="file"}maybeEncodeFileParts(i){for(let u of i.prompt)for(let t of u.content)if(this.isFilePart(t)){let f=t;if(f.data instanceof Uint8Array){let l=Uint8Array.from(f.data),E=Buffer.from(l).toString("base64");f.data=new URL(`data:${f.mediaType||"application/octet-stream"};base64,${E}`)}}return i}getUrl(){return`${this.config.baseURL}/language-model`}getModelConfigHeaders(i,u){return{"ai-language-model-specification-version":"3","ai-language-model-id":i,"ai-language-model-streaming":String(u)}}},Ujf=class{constructor(i,u){this.modelId=i,this.config=u,this.specificationVersion="v3",this.maxEmbeddingsPerCall=2048,this.supportsParallelCalls=!0}get provider(){return this.config.provider}async doEmbed({values:i,headers:u,abortSignal:t,providerOptions:f}){var l,E;let c=await Mt(this.config.headers());try{let{responseHeaders:_,value:T,rawValue:d}=await g0({url:this.getUrl(),headers:t0(c,u!=null?u:{},this.getModelConfigHeaders(),await Mt(this.config.o11yHeaders)),body:{values:i,...f?{providerOptions:f}:{}},successfulResponseHandler:w0(Ijf),failedResponseHandler:KE({errorSchema:yE.any(),errorToMessage:(w)=>w}),...t&&{abortSignal:t},fetch:this.config.fetch});return{embeddings:T.embeddings,usage:(l=T.usage)!=null?l:void 0,providerMetadata:T.providerMetadata,response:{headers:_,body:d},warnings:(E=T.warnings)!=null?E:[]}}catch(_){throw await P6(_,await P3(c))}}getUrl(){return`${this.config.baseURL}/embedding-model`}getModelConfigHeaders(){return{"ai-embedding-model-specification-version":"3","ai-model-id":this.modelId}}},Bjf,Ijf,xjf=class{constructor(i,u){this.modelId=i,this.config=u,this.specificationVersion="v3",this.maxImagesPerCall=Number.MAX_SAFE_INTEGER}get provider(){return this.config.provider}async doGenerate({prompt:i,n:u,size:t,aspectRatio:f,seed:l,files:E,mask:c,providerOptions:_,headers:T,abortSignal:d}){var w,n,h,A;let D=await Mt(this.config.headers());try{let{responseHeaders:N,value:S,rawValue:O}=await g0({url:this.getUrl(),headers:t0(D,T!=null?T:{},this.getModelConfigHeaders(),await Mt(this.config.o11yHeaders)),body:{prompt:i,n:u,...t&&{size:t},...f&&{aspectRatio:f},...l&&{seed:l},..._&&{providerOptions:_},...E&&{files:E.map(($)=>R9t($))},...c&&{mask:R9t(c)}},successfulResponseHandler:w0(Ljf),failedResponseHandler:KE({errorSchema:uE.any(),errorToMessage:($)=>$}),...d&&{abortSignal:d},fetch:this.config.fetch});return{images:S.images,warnings:(w=S.warnings)!=null?w:[],providerMetadata:S.providerMetadata,response:{timestamp:new Date,modelId:this.modelId,headers:N},...S.usage!=null&&{usage:{inputTokens:(n=S.usage.inputTokens)!=null?n:void 0,outputTokens:(h=S.usage.outputTokens)!=null?h:void 0,totalTokens:(A=S.usage.totalTokens)!=null?A:void 0}}}}catch(N){throw await P6(N,await P3(D))}}getUrl(){return`${this.config.baseURL}/image-model`}getModelConfigHeaders(){return{"ai-image-model-specification-version":"3","ai-model-id":this.modelId}}},yjf,Rjf,Fjf,Ljf,Zjf=class{constructor(i,u){this.modelId=i,this.config=u,this.specificationVersion="v3",this.maxVideosPerCall=Number.MAX_SAFE_INTEGER}get provider(){return this.config.provider}async doGenerate({prompt:i,n:u,aspectRatio:t,resolution:f,duration:l,fps:E,seed:c,image:_,providerOptions:T,headers:d,abortSignal:w}){var n;let h=await Mt(this.config.headers());try{let{responseHeaders:A,value:D}=await g0({url:this.getUrl(),headers:t0(h,d!=null?d:{},this.getModelConfigHeaders(),await Mt(this.config.o11yHeaders),{accept:"text/event-stream"}),body:{prompt:i,n:u,...t&&{aspectRatio:t},...f&&{resolution:f},...l&&{duration:l},...E&&{fps:E},...c&&{seed:c},...T&&{providerOptions:T},..._&&{image:Gjf(_)}},successfulResponseHandler:async({response:N,url:S,requestBodyValues:O})=>{if(N.body==null)throw new v0({message:"SSE response body is empty",url:S,requestBodyValues:O,statusCode:N.status});let P=Gv({stream:N.body,schema:jjf}).getReader(),{done:g,value:U}=await P.read();if(P.releaseLock(),g||!U)throw new v0({message:"SSE stream ended without a data event",url:S,requestBodyValues:O,statusCode:N.status});if(!U.success)throw new v0({message:"Failed to parse video SSE event",cause:U.error,url:S,requestBodyValues:O,statusCode:N.status});let x=U.value;if(x.type==="error")throw new v0({message:x.message,statusCode:x.statusCode,url:S,requestBodyValues:O,responseHeaders:Object.fromEntries([...N.headers]),responseBody:JSON.stringify(x),data:{error:{message:x.message,type:x.errorType,param:x.param}}});return{value:{videos:x.videos,warnings:x.warnings,providerMetadata:x.providerMetadata},responseHeaders:Object.fromEntries([...N.headers])}},failedResponseHandler:KE({errorSchema:uf.any(),errorToMessage:(N)=>N}),...w&&{abortSignal:w},fetch:this.config.fetch});return{videos:D.videos,warnings:(n=D.warnings)!=null?n:[],providerMetadata:D.providerMetadata,response:{timestamp:new Date,modelId:this.modelId,headers:A}}}catch(A){throw await P6(A,await P3(h))}}getUrl(){return`${this.config.baseURL}/video-model`}getModelConfigHeaders(){return{"ai-video-model-specification-version":"3","ai-model-id":this.modelId}}},kjf,Cjf,Yjf,jjf,Kjf=class{constructor(i,u){this.modelId=i,this.config=u,this.specificationVersion="v3"}get provider(){return this.config.provider}async doRerank({documents:i,query:u,topN:t,headers:f,abortSignal:l,providerOptions:E}){var c;let _=await Mt(this.config.headers());try{let{responseHeaders:T,value:d,rawValue:w}=await g0({url:this.getUrl(),headers:t0(_,f!=null?f:{},this.getModelConfigHeaders(),await Mt(this.config.o11yHeaders)),body:{documents:i,query:u,...t!=null?{topN:t}:{},...E?{providerOptions:E}:{}},successfulResponseHandler:w0(Xjf),failedResponseHandler:KE({errorSchema:XE.any(),errorToMessage:(n)=>n}),...l&&{abortSignal:l},fetch:this.config.fetch});return{ranking:d.ranking,providerMetadata:d.providerMetadata,response:{headers:T,body:w},warnings:(c=d.warnings)!=null?c:[]}}catch(T){throw await P6(T,await P3(_))}}getUrl(){return`${this.config.baseURL}/reranking-model`}getModelConfigHeaders(){return{"ai-reranking-model-specification-version":"3","ai-model-id":this.modelId}}},Hjf,Xjf,Jjf,Wjf,bjf,Qjf=(i={})=>bjf(i),Mjf,zjf,rjf,qjf=(i={})=>rjf(i),Vjf,ejf="3.0.133",ajf="0.0.1",sni;var $o=v(()=>{fu();eu();fu();fu();fu();fu();fu();fu();fu();fu();fu();eu();fu();fu();fu();fu();X9t=Z(mlu(),1),J9t=Z(mlu(),1),elu=Symbol.for(mYf),W4=class i extends(V7t=Error,q7t=elu,V7t){constructor({message:u,statusCode:t=500,cause:f,generationId:l,isRetryable:E=t!=null&&(t===408||t===409||t===429||t>=500)}){super(l?`${u} [${l}]`:u);this[q7t]=!0,this.statusCode=t,this.cause=f,this.generationId=l,this.isRetryable=E}static isInstance(u){return i.hasMarker(u)}static hasMarker(u){return typeof u==="object"&&u!==null&&elu in u&&u[elu]===!0}},eYf=`vercel.ai.gateway.error.${F9t}`,m7t=Symbol.for(eYf),oni=class i extends(a7t=W4,e7t=m7t,a7t){constructor({message:u="Authentication failed",statusCode:t=401,cause:f,generationId:l}={}){super({message:u,statusCode:t,cause:f,generationId:l});this[e7t]=!0,this.name=F9t,this.type="authentication_error"}static isInstance(u){return W4.hasMarker(u)&&m7t in u}static createContextualError({apiKeyProvided:u,oidcTokenProvided:t,message:f="Authentication failed",statusCode:l=401,cause:E,generationId:c}){let _;if(u)_=`AI Gateway authentication failed: Invalid API key.
 
 Create a new API key: https://vercel.com/d?to=%2F%5Bteam%5D%2F%7E%2Fai%2Fapi-keys
@@ -92905,7 +92905,7 @@ ${kWf}`:""}
 `);let f=u.pax;if(f)for(let l in f)t+=Hcu(" "+l+"="+f[l]+`
 `);return af.from(t)};zmf.decodePax=function(u){let t={};while(u.length){let f=0;while(f<u.length&&u[f]!==32)f++;let l=parseInt(af.toString(u.subarray(0,f)),10);if(!l)return t;let E=af.toString(u.subarray(f+1,l-1)),c=E.indexOf("=");if(c===-1)return t;t[E.slice(0,c)]=E.slice(c+1),u=u.subarray(l)}return t};zmf.encode=function(u){let t=af.alloc(512),f=u.name,l="";if(u.typeflag===5&&f[f.length-1]!=="/")f+="/";if(af.byteLength(f)!==f.length)return null;while(af.byteLength(f)>100){let E=f.indexOf("/");if(E===-1)return null;l+=l?"/"+f.slice(0,E):f.slice(0,E),f=f.slice(E+1)}if(af.byteLength(f)>100||af.byteLength(l)>155)return null;if(u.linkname&&af.byteLength(u.linkname)>100)return null;if(af.write(t,f),af.write(t,T5(u.mode&4095,6),100),af.write(t,T5(u.uid,6),108),af.write(t,T5(u.gid,6),116),Qmf(u.size,t,124),af.write(t,T5(u.mtime.getTime()/1000|0,11),136),t[156]=48+Wmf(u.type),u.linkname)af.write(t,u.linkname,157);if(af.copy(uCt,t,257),af.copy(Cmf,t,263),u.uname)af.write(t,u.uname,265);if(u.gname)af.write(t,u.gname,297);if(af.write(t,T5(u.devmajor||0,6),329),af.write(t,T5(u.devminor||0,6),337),l)af.write(t,l,345);return af.write(t,T5(fCt(t),6),148),t};zmf.decode=function(u,t,f){let l=u[156]===0?0:u[156]-48,E=YW(u,0,100,t),c=_5(u,100,8),_=_5(u,108,8),T=_5(u,116,8),d=_5(u,124,12),w=_5(u,136,12),n=Jmf(l),h=u[157]===0?null:YW(u,157,100,t),A=YW(u,265,32),D=YW(u,297,32),N=_5(u,329,8),S=_5(u,337,8),O=fCt(u);if(O===256)return null;if(O!==_5(u,148,8))throw Error("Invalid tar header. Maybe the tar is corrupted or it needs to be gunzipped?");if(Kmf(u)){if(u[345])E=YW(u,345,155,t)+"/"+E}else if(Hmf(u));else if(!f)throw Error("Invalid tar header: unknown format.");if(l===0&&E&&E[E.length-1]==="/")l=5;return{name:E,mode:c,uid:_,gid:T,size:d,mtime:new Date(1000*w),type:n,linkname:h,uname:A,gname:D,devmajor:N,devminor:S,pax:null}};function Kmf(i){return af.equals(uCt,i.subarray(257,263))}function Hmf(i){return af.equals(Ymf,i.subarray(257,263))&&af.equals(jmf,i.subarray(263,265))}function Xmf(i,u,t){if(typeof i!=="number")return t;if(i=~~i,i>=u)return u;if(i>=0)return i;if(i+=u,i>=0)return i;return 0}function Jmf(i){switch(i){case 0:return"file";case 1:return"link";case 2:return"symlink";case 3:return"character-device";case 4:return"block-device";case 5:return"directory";case 6:return"fifo";case 7:return"contiguous-file";case 72:return"pax-header";case 55:return"pax-global-header";case 27:return"gnu-long-link-path";case 28:case 30:return"gnu-long-path"}return null}function Wmf(i){switch(i){case"file":return 0;case"link":return 1;case"symlink":return 2;case"character-device":return 3;case"block-device":return 4;case"directory":return 5;case"fifo":return 6;case"contiguous-file":return 7;case"pax-header":return 72}return 0}function tCt(i,u,t,f){for(;t<f;t++)if(i[t]===u)return t;return f}function fCt(i){let u=256;for(let t=0;t<148;t++)u+=i[t];for(let t=156;t<512;t++)u+=i[t];return u}function T5(i,u){if(i=i.toString(8),i.length>u)return"7777777777777777777".slice(0,u)+" ";return"0000000000000000000".slice(0,u-i.length)+i+" "}function bmf(i,u,t){u[t]=128;for(let f=11;f>0;f--)u[t+f]=i&255,i=Math.floor(i/256)}function Qmf(i,u,t){if(i.toString(8).length>11)bmf(i,u,t);else af.write(u,T5(i,11),t)}function Mmf(i){let u;if(i[0]===128)u=!0;else if(i[0]===255)u=!1;else return null;let t=[],f;for(f=i.length-1;f>0;f--){let c=i[f];if(u)t.push(c);else t.push(255-c)}let l=0,E=t.length;for(f=0;f<E;f++)l+=t[f]*Math.pow(256,f);return u?l:-1*l}function _5(i,u,t){if(i=i.subarray(u,u+t),u=0,i[u]&128)return Mmf(i);else{while(u<i.length&&i[u]===32)u++;let f=Xmf(tCt(i,32,u,i.length),i.length,i.length);while(u<f&&i[u]===0)u++;if(f===u)return 0;return parseInt(af.toString(i.subarray(u,f)),8)}}function YW(i,u,t,f){return af.toString(i.subarray(u,tCt(i,0,u,u+t)),f)}function Hcu(i){let u=af.byteLength(i),t=Math.floor(Math.log(u)/Math.log(10))+1;if(u+t>=Math.pow(10,t))t++;return u+t+i}});var nCt=C((_S1,wCt)=>{var{Writable:amf,Readable:omf,getStreamError:lCt}=Kcu(),smf=Zcu(),ECt=CW(),jW=Xcu(),pmf=ECt.alloc(0);class cCt{constructor(){this.buffered=0,this.shifted=0,this.queue=new smf,this._offset=0}push(i){this.buffered+=i.byteLength,this.queue.push(i)}shiftFirst(i){return this._buffered===0?null:this._next(i)}shift(i){if(i>this.buffered)return null;if(i===0)return pmf;let u=this._next(i);if(i===u.byteLength)return u;let t=[u];while((i-=u.byteLength)>0)u=this._next(i),t.push(u);return ECt.concat(t)}_next(i){let u=this.queue.peek(),t=u.byteLength-this._offset;if(i>=t){let f=this._offset?u.subarray(this._offset,u.byteLength):u;return this.queue.shift(),this._offset=0,this.buffered-=t,this.shifted+=t,f}return this.buffered-=i,this.shifted+=i,u.subarray(this._offset,this._offset+=i)}}class _Ct extends omf{constructor(i,u,t){super();this.header=u,this.offset=t,this._parent=i}_read(i){if(this.header.size===0)this.push(null);if(this._parent._stream===this)this._parent._update();i(null)}_predestroy(){this._parent.destroy(lCt(this))}_detach(){if(this._parent._stream===this)this._parent._stream=null,this._parent._missing=dCt(this.header.size),this._parent._update()}_destroy(i){this._detach(),i(null)}}class TCt extends amf{constructor(i){super(i);if(!i)i={};this._buffer=new cCt,this._offset=0,this._header=null,this._stream=null,this._missing=0,this._longHeader=!1,this._callback=Jcu,this._locked=!1,this._finished=!1,this._pax=null,this._paxGlobal=null,this._gnuLongPath=null,this._gnuLongLinkPath=null,this._filenameEncoding=i.filenameEncoding||"utf-8",this._allowUnknownFormat=!!i.allowUnknownFormat,this._unlockBound=this._unlock.bind(this)}_unlock(i){if(this._locked=!1,i){this.destroy(i),this._continueWrite(i);return}this._update()}_consumeHeader(){if(this._locked)return!1;this._offset=this._buffer.shifted;try{this._header=jW.decode(this._buffer.shift(512),this._filenameEncoding,this._allowUnknownFormat)}catch(i){return this._continueWrite(i),!1}if(!this._header)return!0;switch(this._header.type){case"gnu-long-path":case"gnu-long-link-path":case"pax-global-header":case"pax-header":return this._longHeader=!0,this._missing=this._header.size,!0}if(this._locked=!0,this._applyLongHeaders(),this._header.size===0||this._header.type==="directory")return this.emit("entry",this._header,this._createStream(),this._unlockBound),!0;return this._stream=this._createStream(),this._missing=this._header.size,this.emit("entry",this._header,this._stream,this._unlockBound),!0}_applyLongHeaders(){if(this._gnuLongPath)this._header.name=this._gnuLongPath,this._gnuLongPath=null;if(this._gnuLongLinkPath)this._header.linkname=this._gnuLongLinkPath,this._gnuLongLinkPath=null;if(this._pax){if(this._pax.path)this._header.name=this._pax.path;if(this._pax.linkpath)this._header.linkname=this._pax.linkpath;if(this._pax.size)this._header.size=parseInt(this._pax.size,10);this._header.pax=this._pax,this._pax=null}}_decodeLongHeader(i){switch(this._header.type){case"gnu-long-path":this._gnuLongPath=jW.decodeLongPath(i,this._filenameEncoding);break;case"gnu-long-link-path":this._gnuLongLinkPath=jW.decodeLongPath(i,this._filenameEncoding);break;case"pax-global-header":this._paxGlobal=jW.decodePax(i);break;case"pax-header":this._pax=this._paxGlobal===null?jW.decodePax(i):Object.assign({},this._paxGlobal,jW.decodePax(i));break}}_consumeLongHeader(){this._longHeader=!1,this._missing=dCt(this._header.size);let i=this._buffer.shift(this._header.size);try{this._decodeLongHeader(i)}catch(u){return this._continueWrite(u),!1}return!0}_consumeStream(){let i=this._buffer.shiftFirst(this._missing);if(i===null)return!1;this._missing-=i.byteLength;let u=this._stream.push(i);if(this._missing===0){if(this._stream.push(null),u)this._stream._detach();return u&&this._locked===!1}return u}_createStream(){return new _Ct(this,this._header,this._offset)}_update(){while(this._buffer.buffered>0&&!this.destroying){if(this._missing>0){if(this._stream!==null){if(this._consumeStream()===!1)return;continue}if(this._longHeader===!0){if(this._missing>this._buffer.buffered)break;if(this._consumeLongHeader()===!1)return!1;continue}let i=this._buffer.shiftFirst(this._missing);if(i!==null)this._missing-=i.byteLength;continue}if(this._buffer.buffered<512)break;if(this._stream!==null||this._consumeHeader()===!1)return}this._continueWrite(null)}_continueWrite(i){let u=this._callback;this._callback=Jcu,u(i)}_write(i,u){this._callback=u,this._buffer.push(i),this._update()}_final(i){this._finished=this._missing===0&&this._buffer.buffered===0,i(this._finished?null:Error("Unexpected end of data"))}_predestroy(){this._continueWrite(null)}_destroy(i){if(this._stream)this._stream.destroy(lCt(this));i(null)}[Symbol.asyncIterator](){let i=null,u=null,t=null,f=null,l=null,E=this;return this.on("entry",T),this.on("error",(n)=>{i=n}),this.on("close",d),{[Symbol.asyncIterator](){return this},next(){return new Promise(_)},return(){return w(null)},throw(n){return w(n)}};function c(n){if(!l)return;let h=l;l=null,h(n)}function _(n,h){if(i)return h(i);if(f){n({value:f,done:!1}),f=null;return}if(u=n,t=h,c(null),E._finished&&u)u({value:void 0,done:!0}),u=t=null}function T(n,h,A){if(l=A,h.on("error",Jcu),u)u({value:h,done:!1}),u=t=null;else f=h}function d(){if(c(i),!u)return;if(i)t(i);else u({value:void 0,done:!0});u=t=null}function w(n){return E.destroy(n),c(n),new Promise((h,A)=>{if(E.destroyed)return h({value:void 0,done:!0});E.once("close",function(){if(n)A(n);else h({value:void 0,done:!0})})})}}}wCt.exports=function(u){return new TCt(u)};function Jcu(){}function dCt(i){return i&=511,i&&512-i}});var ACt=C((TS1,Wcu)=>{var hCt={S_IFMT:61440,S_IFDIR:16384,S_IFCHR:8192,S_IFBLK:24576,S_IFIFO:4096,S_IFLNK:40960};try{Wcu.exports=Oi("fs").constants||hCt}catch{Wcu.exports=hCt}});var PCt=C((dS1,$Ct)=>{var{Readable:ief,Writable:uef,getStreamError:DCt}=Kcu(),NC=CW(),KW=ACt(),O7i=Xcu(),vCt=NC.alloc(1024);class NCt extends uef{constructor(i,u,t){super({mapWritable:fef,eagerOpen:!0});if(this.written=0,this.header=u,this._callback=t,this._linkname=null,this._isLinkname=u.type==="symlink"&&!u.linkname,this._isVoid=u.type!=="file"&&u.type!=="contiguous-file",this._finished=!1,this._pack=i,this._openCallback=null,this._pack._stream===null)this._pack._stream=this;else this._pack._pending.push(this)}_open(i){if(this._openCallback=i,this._pack._stream===this)this._continueOpen()}_continuePack(i){if(this._callback===null)return;let u=this._callback;this._callback=null,u(i)}_continueOpen(){if(this._pack._stream===null)this._pack._stream=this;let i=this._openCallback;if(this._openCallback=null,i===null)return;if(this._pack.destroying)return i(Error("pack stream destroyed"));if(this._pack._finalized)return i(Error("pack stream is already finalized"));if(this._pack._stream=this,!this._isLinkname)this._pack._encode(this.header);if(this._isVoid)this._finish(),this._continuePack(null);i(null)}_write(i,u){if(this._isLinkname)return this._linkname=this._linkname?NC.concat([this._linkname,i]):i,u(null);if(this._isVoid){if(i.byteLength>0)return u(Error("No body allowed for this entry"));return u()}if(this.written+=i.byteLength,this._pack.push(i))return u();this._pack._drain=u}_finish(){if(this._finished)return;if(this._finished=!0,this._isLinkname)this.header.linkname=this._linkname?NC.toString(this._linkname,"utf-8"):"",this._pack._encode(this.header);OCt(this._pack,this.header.size),this._pack._done(this)}_final(i){if(this.written!==this.header.size)return i(Error("Size mismatch"));this._finish(),i(null)}_getError(){return DCt(this)||Error("tar entry destroyed")}_predestroy(){this._pack.destroy(this._getError())}_destroy(i){this._pack._done(this),this._continuePack(this._finished?null:this._getError()),i()}}class SCt extends ief{constructor(i){super(i);this._drain=bcu,this._finalized=!1,this._finalizing=!1,this._pending=[],this._stream=null}entry(i,u,t){if(this._finalized||this.destroying)throw Error("already finalized or destroyed");if(typeof u==="function")t=u,u=null;if(!t)t=bcu;if(!i.size||i.type==="symlink")i.size=0;if(!i.type)i.type=tef(i.mode);if(!i.mode)i.mode=i.type==="directory"?493:420;if(!i.uid)i.uid=0;if(!i.gid)i.gid=0;if(!i.mtime)i.mtime=new Date;if(typeof u==="string")u=NC.from(u);let f=new NCt(this,i,t);if(NC.isBuffer(u))return i.size=u.byteLength,f.write(u),f.end(),f;if(f._isVoid)return f;return f}finalize(){if(this._stream||this._pending.length>0){this._finalizing=!0;return}if(this._finalized)return;this._finalized=!0,this.push(vCt),this.push(null)}_done(i){if(i!==this._stream)return;if(this._stream=null,this._finalizing)this.finalize();if(this._pending.length)this._pending.shift()._continueOpen()}_encode(i){if(!i.pax){let u=O7i.encode(i);if(u){this.push(u);return}}this._encodePax(i)}_encodePax(i){let u=O7i.encodePax({name:i.name,linkname:i.linkname,pax:i.pax}),t={name:"PaxHeader",mode:i.mode,uid:i.uid,gid:i.gid,size:u.byteLength,mtime:i.mtime,type:"pax-header",linkname:i.linkname&&"PaxHeader",uname:i.uname,gname:i.gname,devmajor:i.devmajor,devminor:i.devminor};this.push(O7i.encode(t)),this.push(u),OCt(this,u.byteLength),t.size=i.size,t.type=i.type,this.push(O7i.encode(t))}_doDrain(){let i=this._drain;this._drain=bcu,i()}_predestroy(){let i=DCt(this);if(this._stream)this._stream.destroy(i);while(this._pending.length){let u=this._pending.shift();u.destroy(i),u._continueOpen()}this._doDrain()}_read(i){this._doDrain(),i()}}$Ct.exports=function(u){return new SCt(u)};function tef(i){switch(i&KW.S_IFMT){case KW.S_IFBLK:return"block-device";case KW.S_IFCHR:return"character-device";case KW.S_IFDIR:return"directory";case KW.S_IFIFO:return"fifo";case KW.S_IFLNK:return"symlink"}return"file"}function bcu(){}function OCt(i,u){if(u&=511,u)i.push(vCt.subarray(0,512-u))}function fef(i){return NC.isBuffer(i)?i:NC.from(i)}});var gCt=C((lef)=>{lef.extract=nCt();lef.pack=PCt()});var ICt=C((nS1,BCt)=>{BCt.exports=UCt;function UCt(i,u){if(i&&u)return UCt(i)(u);if(typeof i!=="function")throw TypeError("need wrapper function");return Object.keys(i).forEach(function(f){t[f]=i[f]}),t;function t(){var f=Array(arguments.length);for(var l=0;l<f.length;l++)f[l]=arguments[l];var E=i.apply(this,f),c=f[f.length-1];if(typeof E==="function"&&E!==c)Object.keys(c).forEach(function(_){E[_]=c[_]});return E}}});var Mcu=C((hS1,Qcu)=>{var xCt=ICt();Qcu.exports=xCt($7i);Qcu.exports.strict=xCt(yCt);$7i.proto=$7i(function(){Object.defineProperty(Function.prototype,"once",{value:function(){return $7i(this)},configurable:!0}),Object.defineProperty(Function.prototype,"onceStrict",{value:function(){return yCt(this)},configurable:!0})});function $7i(i){var u=function(){if(u.called)return u.value;return u.called=!0,u.value=i.apply(this,arguments)};return u.called=!1,u}function yCt(i){var u=function(){if(u.called)throw Error(u.onceError);return u.called=!0,u.value=i.apply(this,arguments)},t=i.name||"Function wrapped with `once`";return u.onceError=t+" shouldn't be called more than once",u.called=!1,u}});var LCt=C((AS1,FCt)=>{var _ef=Mcu(),Tef=function(){},def=global.Bare?queueMicrotask:process.nextTick.bind(process),wef=function(i){return i.setHeader&&typeof i.abort==="function"},nef=function(i){return i.stdio&&Array.isArray(i.stdio)&&i.stdio.length===3},RCt=function(i,u,t){if(typeof u==="function")return RCt(i,null,u);if(!u)u={};t=_ef(t||Tef);var{_writableState:f,_readableState:l}=i,E=u.readable||u.readable!==!1&&i.readable,c=u.writable||u.writable!==!1&&i.writable,_=!1,T=function(){if(!i.writable)d()},d=function(){if(c=!1,!E)t.call(i)},w=function(){if(E=!1,!c)t.call(i)},n=function(S){t.call(i,S?Error("exited with error code: "+S):null)},h=function(S){t.call(i,S)},A=function(){def(D)},D=function(){if(_)return;if(E&&!(l&&(l.ended&&!l.destroyed)))return t.call(i,Error("premature close"));if(c&&!(f&&(f.ended&&!f.destroyed)))return t.call(i,Error("premature close"))},N=function(){i.req.on("finish",d)};if(wef(i))if(i.on("complete",d),i.on("abort",A),i.req)N();else i.on("request",N);else if(c&&!f)i.on("end",T),i.on("close",T);if(nef(i))i.on("exit",n);if(i.on("end",w),i.on("finish",d),u.error!==!1)i.on("error",h);return i.on("close",A),function(){if(_=!0,i.removeListener("complete",d),i.removeListener("abort",A),i.removeListener("request",N),i.req)i.req.removeListener("finish",d);i.removeListener("end",T),i.removeListener("close",T),i.removeListener("finish",d),i.removeListener("exit",n),i.removeListener("end",w),i.removeListener("error",h),i.removeListener("close",A)}};FCt.exports=RCt});var kCt=C((DS1,GCt)=>{var hef=Mcu(),Aef=LCt(),P7i;try{P7i=Oi("fs")}catch(i){}var po=function(){},Def=typeof process>"u"?!1:/^v?\.0/.test(process.version),g7i=function(i){return typeof i==="function"},vef=function(i){if(!Def)return!1;if(!P7i)return!1;return(i instanceof(P7i.ReadStream||po)||i instanceof(P7i.WriteStream||po))&&g7i(i.close)},Nef=function(i){return i.setHeader&&g7i(i.abort)},Sef=function(i,u,t,f){f=hef(f);var l=!1;i.on("close",function(){l=!0}),Aef(i,{readable:u,writable:t},function(c){if(c)return f(c);l=!0,f()});var E=!1;return function(c){if(l)return;if(E)return;if(E=!0,vef(i))return i.close(po);if(Nef(i))return i.abort();if(g7i(i.destroy))return i.destroy();f(c||Error("stream was destroyed"))}},ZCt=function(i){i()},Oef=function(i,u){return i.pipe(u)},$ef=function(){var i=Array.prototype.slice.call(arguments),u=g7i(i[i.length-1]||po)&&i.pop()||po;if(Array.isArray(i[0]))i=i[0];if(i.length<2)throw Error("pump requires two streams per minimum");var t,f=i.map(function(l,E){var c=E<i.length-1,_=E>0;return Sef(l,c,_,function(T){if(!t)t=T;if(T)f.forEach(ZCt);if(c)return;f.forEach(ZCt),u(t)})});return i.reduce(Oef)};GCt.exports=$ef});var bCt=C((Bef)=>{var CCt=gCt(),YCt=kCt(),jCt=Oi("fs"),g4=Oi("path"),is=(global.Bare?global.Bare.platform:process.platform)==="win32";Bef.pack=function(u,t){if(!u)u=".";if(!t)t={};let f=t.fs||jCt,l=t.ignore||t.filter||us,E=t.mapStream||JCt,c=Uef(f,t.dereference?f.stat:f.lstat,u,l,t.entries,t.sort),_=t.strict!==!1,T=typeof t.umask==="number"?~t.umask:~KCt(),d=t.pack||CCt.pack(),w=t.finish||us,n=t.map||us,h=typeof t.dmode==="number"?t.dmode:0,A=typeof t.fmode==="number"?t.fmode:0;if(t.strip)n=WCt(n,t.strip);if(t.readable)h|=parseInt(555,8),A|=parseInt(444,8);if(t.writable)h|=parseInt(333,8),A|=parseInt(222,8);S();function D(O,$){f.readlink(g4.join(u,O),function(P,g){if(P)return d.destroy(P);$.linkname=zcu(g),d.entry($,S)})}function N(O,$,P){if(d.destroyed)return;if(O)return d.destroy(O);if(!$){if(t.finalize!==!1)d.finalize();return w(d)}if(P.isSocket())return S();let g={name:zcu($),mode:(P.mode|(P.isDirectory()?h:A))&T,mtime:P.mtime,size:P.size,type:"file",uid:P.uid,gid:P.gid};if(P.isDirectory())return g.size=0,g.type="directory",g=n(g)||g,d.entry(g,S);if(P.isSymbolicLink())return g.size=0,g.type="symlink",g=n(g)||g,D($,g);if(g=n(g)||g,!P.isFile()){if(_)return d.destroy(Error("unsupported type for "+$));return S()}let U=d.entry(g,S),x=E(f.createReadStream(g4.join(u,$),{start:0,end:g.size>0?g.size-1:g.size}),g);x.on("error",function(F){U.destroy(F)}),YCt(x,U)}function S(O){if(O)return d.destroy(O);c(N)}return d};function Pef(i){return i.length?i[i.length-1]:null}function gef(){return!global.Bare&&process.getuid?process.getuid():-1}function KCt(){return!global.Bare&&process.umask?process.umask():0}Bef.extract=function(u,t){if(!u)u=".";if(!t)t={};u=g4.resolve(u);let f=t.fs||jCt,l=t.ignore||t.filter||us,E=t.mapStream||JCt,c=t.chown!==!1&&!is&&gef()===0,_=t.extract||CCt.extract(),T=[],d=new Date,w=typeof t.umask==="number"?~t.umask:~KCt(),n=t.strict!==!1,h=t.validateSymlinks!==!1,A=t.map||us,D=typeof t.dmode==="number"?t.dmode:0,N=typeof t.fmode==="number"?t.fmode:0;if(t.strip)A=WCt(A,t.strip);if(t.readable)D|=parseInt(555,8),N|=parseInt(444,8);if(t.writable)D|=parseInt(333,8),N|=parseInt(222,8);if(_.on("entry",S),t.finish)_.on("finish",t.finish);return _;function S(U,x,F){U=A(U)||U,U.name=zcu(U.name);let y=g4.join(u,g4.join("/",U.name));if(l(y,U))return x.resume(),F();let L=g4.join(y,".")===g4.join(u,".")?u:g4.dirname(y);XCt(f,L,g4.join(u,"."),function(fi,di){if(fi)return F(fi);if(!di)return F(Error(L+" is not a valid path"));if(U.type==="directory")return T.push([y,U.mtime]),g(y,{fs:f,own:c,uid:U.uid,gid:U.gid,mode:U.mode},M);g(L,{fs:f,own:c,uid:U.uid,gid:U.gid,mode:493},function(ci){if(ci)return F(ci);switch(U.type){case"file":return H();case"link":return K();case"symlink":return k()}if(n)return F(Error("unsupported type for "+y+" ("+U.type+")"));x.resume(),F()})});function M(fi){if(fi)return F(fi);$(y,U,function(di){if(di)return F(di);if(is)return F();P(y,U,F)})}function k(){if(is)return F();f.unlink(y,function(){let fi=g4.resolve(g4.dirname(y),U.linkname);if(!q(fi)&&h)return F(Error(y+" is not a valid symlink"));HCt(f,fi,g4.join(u,"."),function(di,ci){if(di)return F(di);if(!ci&&h)return F(Error(y+" is not a valid symlink"));f.symlink(U.linkname,y,M)})})}function K(){if(is)return F();f.unlink(y,function(){let fi=g4.join(u,g4.join("/",U.linkname));f.realpath(fi,function(di,ci){if(di||!q(ci))return F(Error(y+" is not a valid hardlink"));f.link(ci,y,function(ii){if(ii&&ii.code==="EPERM"&&t.hardlinkAsFilesFallback)return x=f.createReadStream(ci),H();M(ii)})})})}function q(fi){return fi===u||fi.startsWith(u+g4.sep)}function H(){let fi=f.createWriteStream(y),di=E(x,U);fi.on("error",function(ci){di.destroy(ci)}),YCt(di,fi,function(ci){if(ci)return F(ci);fi.on("close",M)})}}function O(U,x){let F;while((F=Pef(T))&&U.slice(0,F[0].length)!==F[0])T.pop();if(!F)return x();f.utimes(F[0],d,F[1],x)}function $(U,x,F){if(t.utimes===!1)return F();if(x.type==="directory")return f.utimes(U,d,x.mtime,F);if(x.type==="symlink")return O(U,F);f.utimes(U,d,x.mtime,function(y){if(y)return F(y);O(U,F)})}function P(U,x,F){let y=x.type==="symlink",L=y?f.lchmod:f.chmod,M=y?f.lchown:f.chown;if(!L)return F();let k=(x.mode|(x.type==="directory"?D:N))&w;if(M&&c)M.call(f,U,x.uid,x.gid,K);else K(null);function K(q){if(q)return F(q);if(!L)return F();L.call(f,U,k,F)}}function g(U,x,F){f.stat(U,function(y){if(!y)return F(null);if(y.code!=="ENOENT")return F(y);f.mkdir(U,{mode:x.mode,recursive:!0},function(L,M){if(L)return F(L);P(U,x,F)})})}};function HCt(i,u,t,f){if(u===t)return f(null,!0);if(!u.startsWith(t+g4.sep))return f(null,!1);i.lstat(u,function(l,E){if(l&&l.code!=="ENOENT"&&l.code!=="EPERM")return f(l);if(l||!E.isSymbolicLink())return HCt(i,g4.join(u,".."),t,f);f(null,!1)})}function XCt(i,u,t,f){if(u===t)return f(null,!0);i.lstat(u,function(l,E){if(l&&l.code!=="ENOENT"&&l.code!=="EPERM")return f(l);if(l||E.isDirectory())return XCt(i,g4.join(u,".."),t,f);f(null,!1)})}function us(){}function JCt(i){return i}function zcu(i){return is?i.replace(/\\/g,"/").replace(/[:?<>|]/g,"_"):i}function Uef(i,u,t,f,l,E){if(!l)l=["."];let c=l.slice(0);return function(T){if(!c.length)return T(null);let d=c.shift(),w=g4.join(t,d);u.call(i,w,function(n,h){if(n)return T(l.indexOf(d)===-1&&n.code==="ENOENT"?null:n);if(!h.isDirectory())return T(null,d,h);i.readdir(w,function(A,D){if(A)return T(A);if(E)D.sort();for(let N=0;N<D.length;N++)if(!f(g4.join(t,d,D[N])))c.push(g4.join(d,D[N]));T(null,d,h)})})}}function WCt(i,u){return function(t){t.name=t.name.split("/").slice(u).join("/");let f=t.linkname;if(f&&(t.type==="link"||g4.isAbsolute(f)))t.linkname=f.split("/").slice(u).join("/");return i(t)}}});var yef,Ref;var QCt=v(()=>{Fcu();yef=Z(Lkt(),1),Ref=Z(bCt(),1)});var U7i=()=>{};var MCt=v(()=>{KUi()});var zCt=v(()=>{d7i();T7i();U7i()});var rCt=()=>{};var qCt=()=>{};var rcu=v(()=>{wkt();ycu();d7i();vkt();Icu();Fcu();Nkt();Skt();Okt();$kt();xcu();Pkt();QCt();U7i();MCt();zCt();rCt();qCt();U7i()});var b4,f1,SC,ts;var fs=v(()=>{b4={CLAIM_API_GROUP:"extensions.agents.x-k8s.io",CLAIM_API_VERSION:"v1alpha1",CLAIM_PLURAL:"sandboxclaims",SANDBOX_API_GROUP:"agents.x-k8s.io",SANDBOX_API_VERSION:"v1alpha1",SANDBOX_PLURAL:"sandboxes",POD_NAME_ANNOTATION:"agents.x-k8s.io/pod-name"};f1=class f1 extends Error{cause;constructor(i,u){super(i);if(this.name="SandboxError",this.cause=u,u instanceof Error&&u.stack)this.stack=`${this.stack}
 Caused by: ${u.stack}`}};SC=class SC extends f1{constructor(i,u){super(i,u);this.name="SandboxTimeoutError"}};ts=class ts extends f1{constructor(i,u){super(i,u);this.name="SandboxAlreadyExistsError"}}});async function Fef(i){let u=i.getCurrentCluster();if(!u)throw new f1("No active cluster in kubeconfig");let t={};await i.applyToHTTPSOptions(t);let f={},l=t.headers??{};for(let[E,c]of Object.entries(l))if(Array.isArray(c))f[E]=c.join(", ");else if(c!==void 0)f[E]=String(c);if(typeof t.auth==="string"&&!f.Authorization)f.Authorization=`Basic ${Buffer.from(t.auth).toString("base64")}`;return{server:u.server.replace(/\/+$/,""),headers:f,tls:{cert:qcu(t.cert),key:qcu(t.key),ca:qcu(t.ca),rejectUnauthorized:u.skipTLSVerify?!1:void 0}}}function qcu(i){if(i==null)return;if(typeof i==="string")return i;if(Buffer.isBuffer(i))return i.toString("utf8");return String(i)}async function OC(i,u){let t=await Fef(i),f={...t.headers,...u.headers};if(u.method==="PATCH")f["content-type"]=u.patchType==="apply"?"application/apply-patch+yaml":u.patchType==="strategic-merge"?"application/strategic-merge-patch+json":"application/merge-patch+json";else if(u.body!==void 0&&!("content-type"in f))f["content-type"]="application/json";let l={method:u.method,headers:f,body:u.body===void 0?void 0:JSON.stringify(u.body),signal:u.signal,tls:t.tls,...u.stream?{timeout:!1}:{}};return fetch(`${t.server}${u.path}`,l)}async function Vcu(i){try{return await i.json()}catch{return null}}async function mcu(i,u){if(i.ok)return;let t=await Vcu(i),f=t?.message??`${u} failed: ${i.status} ${i.statusText}`;throw new VCt(i.status,t,f)}async function ls(i,u,t,f,l="none"){try{let E=await OC(i,u);if(E.status===404)return null;if(await mcu(E,t),l==="json")return await E.json();return null}catch(E){throw new f1(f,E)}}async function Es(i,u,t){let f=`${mCt}/${encodeURIComponent(u)}/${b4.CLAIM_PLURAL}`,l;try{l=await OC(i,{method:"POST",path:f,body:t})}catch(d){let w=d instanceof Error?d.message:String(d);throw console.warn(`[agent-sandbox/client] createSandboxClaim ${t.metadata.name} transport error: ${w}`),new f1(`Failed to create SandboxClaim: ${t.metadata.name} (transport error: ${w})`,d)}if(l.ok)return;let E=await Vcu(l),c=E?.reason?` ${E.reason}`:"",_=E?.message??l.statusText,T=`Failed to create SandboxClaim: ${t.metadata.name} (${l.status}${c}: ${_})`;if(console.warn(`[agent-sandbox/client] createSandboxClaim ${t.metadata.name} rejected: status=${l.status} reason=${E?.reason??"<none>"} message=${_}`),l.status===409)throw new ts(T);throw new f1(T)}async function B7i(i,u,t,f=60000){let l=Date.now()+f,E=500,c;while(!0){let _=await dN(i,u,t).catch(()=>{return});if(!_)return;if(c=_,Date.now()>=l){let T=c.metadata?.finalizers??[],d=c.metadata?.deletionTimestamp??"<unknown>";throw new SC(`SandboxClaim ${t} still terminating after ${f}ms (deletionTimestamp=${d}, finalizers=[${T.join(", ")}])`)}await yt(500)}}function ecu(i,u){return`${mCt}/${encodeURIComponent(i)}/${b4.CLAIM_PLURAL}/${encodeURIComponent(u)}`}async function eCt(i,u,t,f){await ls(i,{method:"PATCH",path:ecu(u,t),patchType:"merge",body:{spec:{lifecycle:{shutdownPolicy:"Delete",shutdownTime:f}}}},"patchSandboxClaimShutdown",`Failed to patch SandboxClaim shutdownTime: ${t}`)}async function d5(i,u,t){await ls(i,{method:"DELETE",path:ecu(u,t)},"deleteSandboxClaim",`Failed to delete SandboxClaim: ${t}`)}async function dN(i,u,t){return await ls(i,{method:"GET",path:ecu(u,t)},"getSandboxClaim",`Failed to get SandboxClaim: ${t}`,"json")??void 0}async function aCt(i,u,t,f=60){let l=Date.now()+f*1000,E=200;while(Date.now()<l){let _=(await dN(i,u,t).catch(()=>{return}))?.status?.sandbox?.name;if(_)return _;await yt(200)}throw new SC(`SandboxClaim ${t} did not record an adopted Sandbox (status.sandbox.name) within ${f}s`)}function acu(i,u){return`${Lef}/${encodeURIComponent(i)}/${pCt}/${encodeURIComponent(u)}`}async function I7i(i,u,t){let f=new URLSearchParams({fieldManager:uYt,force:"true"}),l=`${acu(u,t.metadata.name)}?${f}`;try{let E=await OC(i,{method:"PATCH",path:l,patchType:"apply",body:t});await mcu(E,"applyHttpRoute")}catch(E){throw new f1(`Failed to apply HTTPRoute: ${t.metadata.name}`,E)}}async function x7i(i,u,t){await ls(i,{method:"DELETE",path:acu(u,t)},"deleteHttpRoute",`Failed to delete HTTPRoute: ${t}`)}async function iYt(i,u,t){return await ls(i,{method:"GET",path:acu(u,t)},"getHttpRoute",`Failed to get HTTPRoute: ${t}`,"json")??void 0}async function tYt(i,u,t,f){let l={apiVersion:"v1",kind:"Service",metadata:{name:t},spec:{ports:[{name:f.name,port:f.port,targetPort:f.targetPort,protocol:f.protocol??"TCP"}]}},E=new URLSearchParams({fieldManager:uYt,force:"true"}),c=`/api/v1/namespaces/${encodeURIComponent(u)}/services/${encodeURIComponent(t)}?${E}`;try{let _=await OC(i,{method:"PATCH",path:c,patchType:"apply",body:l});await mcu(_,"ensureServicePort")}catch(_){throw new f1(`Failed to apply Service ports: ${t}`,_)}}function y7i(i,u,t,f=180){let l=`/apis/${b4.SANDBOX_API_GROUP}/${b4.SANDBOX_API_VERSION}/namespaces/${encodeURIComponent(u)}/${b4.SANDBOX_PLURAL}?watch=true&fieldSelector=${encodeURIComponent(`metadata.name=${t}`)}`,{resolve:E,reject:c,promise:_}=Promise.withResolvers(),T=new AbortController,d=!1,w=setTimeout(()=>{if(d)return;d=!0,T.abort(),c(new SC(`Sandbox did not become ready within ${f} seconds`))},f*1000),n=(h)=>{if(d)return;d=!0,clearTimeout(w),T.abort(),h()};return(async()=>{let h;try{h=await OC(i,{method:"GET",path:l,signal:T.signal,headers:{accept:"application/json"},stream:!0})}catch(A){n(()=>c(new f1("Failed to start watch for sandbox readiness",A)));return}if(!h.ok||!h.body){let A=await Vcu(h).catch(()=>null);n(()=>c(new f1(`Watch handshake failed (${h.status}): ${A?.message??h.statusText}`)));return}try{for await(let A of ocu(h.body)){if(d)return;if(A.type==="ERROR"){let $=A.object;n(()=>c(new f1(`Watch stream error while waiting for sandbox: ${$.message??"unknown"}`)));return}if(A.type!=="ADDED"&&A.type!=="MODIFIED")continue;let D=A.object;if(!D.status?.conditions?.find(($)=>$.type==="Ready"&&$.status==="True"))continue;let S=D.metadata?.name;if(!S){n(()=>c(new f1("Sandbox metadata or name is missing")));return}let O=D.metadata?.annotations?.[b4.POD_NAME_ANNOTATION]??S;n(()=>E({sandboxName:S,podName:O}));return}n(()=>c(new f1("Watch stream closed before sandbox became ready")))}catch(A){if(d)return;if(A instanceof Error&&(A.name==="AbortError"||T.signal.aborted))return;n(()=>c(new f1("Watch stream error while waiting for sandbox",A)))}})(),_}async function*ocu(i){let u=i.getReader(),t=new TextDecoder,f="";try{while(!0){let{value:E,done:c}=await u.read();if(c)break;f+=t.decode(E,{stream:!0});let _;while((_=f.indexOf(`
-`))>=0){let T=f.slice(0,_).trim();if(f=f.slice(_+1),!T)continue;yield JSON.parse(T)}}let l=f.trim();if(l)yield JSON.parse(l)}finally{u.releaseLock()}}var VCt,mCt,oCt="gateway.networking.k8s.io",sCt="v1",pCt="httproutes",Lef,cs,uYt="mesh-sandbox-runner";var R7i=v(()=>{Nl();fs();VCt=class VCt extends Error{status;body;constructor(i,u,t){super(t);this.status=i;this.body=u;this.name="KubeHttpError"}};mCt=`/apis/${b4.CLAIM_API_GROUP}/${b4.CLAIM_API_VERSION}/namespaces`;Lef=`/apis/${oCt}/${sCt}/namespaces`;cs={API_GROUP:oCt,API_VERSION:sCt,PLURAL:pCt}});async function*EYt(i){let u=i.now??(()=>Date.now()),t=u(),f=i.schedulingTimeoutMs??kef,l={pod:{},sandbox:{},events:{hasPulling:!1,hasPulled:!1},startedAt:t},E=[],c=null,_=!1,T=($)=>{if(_)return;if(c){let P=c;c=null,P($)}else E.push($)},d=()=>{if(E.length>0)return Promise.resolve(E.shift());if(_)return Promise.resolve(null);return new Promise(($)=>{c=$})},w=()=>{if(_)return;if(_=!0,c){let $=c;c=null,$(null)}},n=new AbortController,h=()=>{n.abort(),w()};if(i.signal)if(i.signal.aborted)n.abort(),w();else i.signal.addEventListener("abort",h,{once:!0});let A=Math.max(0,f-(u()-t)),D=setTimeout(()=>T("tick"),A+100),N,S=new Promise(($)=>{N=$}),O=Promise.allSettled([Cef(i.kc,i.namespace,i.claimName,n.signal,l,T,u,N),jef(i.kc,i.namespace,i.claimName,n.signal,l,T),Kef(i.kc,i.namespace,i.claimName,S,n.signal,l,T,u)]);try{let $=null,P=-1,g=fYt(l,f,u);if($=pcu(g),!scu(g))P=lYt(g);if(yield g,scu(g))return;while(!_){if(await d()===null)break;let x=fYt(l,f,u);if(scu(x)){let L=pcu(x);if(L!==$)$=L,yield x;return}let F=lYt(x);if(F<P)continue;let y=pcu(x);if(y!==$)$=y,P=F,yield x}}finally{if(clearTimeout(D),n.abort(),i.signal)i.signal.removeEventListener("abort",h);w(),await O.catch(()=>{})}}function fYt(i,u,t){let{pod:f,sandbox:l,events:E,startedAt:c}=i;if(l.ready)return{kind:"ready"};let _=f.containerWaitingReason;if(_==="ImagePullBackOff"||_==="ErrImagePull")return{kind:"failed",reason:"image-pull-backoff",message:"Sandbox image failed to download. The cluster may be missing pull credentials or the image tag may not exist."};if(_==="CrashLoopBackOff")return{kind:"failed",reason:"crash-loop-backoff",message:"Sandbox crashed during startup and is now in CrashLoopBackOff. Check pod logs."};if(!f.scheduled&&E.lastFailedSchedulingAt!==void 0&&t()-c>u)return{kind:"failed",reason:"scheduling-timeout",message:E.failedSchedulingMessage??`Pod could not be scheduled within ${Math.round(u/1000)}s.`};if(f.containerRunning&&!f.containerReady)return{kind:"warming-daemon",since:c};if(E.hasPulling&&!E.hasPulled)return{kind:"pulling-image",since:c};if(_==="ContainerCreating"||_==="PodInitializing"||f.scheduled&&!f.containerRunning)return{kind:"starting-container",since:c};if(f.scheduledFalseReason==="Unschedulable"||E.lastFailedSchedulingAt!==void 0&&!f.scheduled)return{kind:"waiting-for-capacity",since:c,message:E.failedSchedulingMessage??f.scheduledFalseMessage,nodeClaim:E.nominatedNodeClaim};return{kind:"claiming",since:c}}function scu(i){return i.kind==="ready"||i.kind==="failed"}function lYt(i){switch(i.kind){case"claiming":return 0;case"waiting-for-capacity":return 1;case"pulling-image":return 2;case"starting-container":return 3;case"warming-daemon":return 4;case"ready":case"failed":return 99}}function pcu(i){switch(i.kind){case"claiming":case"pulling-image":case"starting-container":case"warming-daemon":return i.kind;case"waiting-for-capacity":return`waiting-for-capacity:${i.message??""}:${i.nodeClaim??""}`;case"ready":return"ready";case"failed":return`failed:${i.reason}:${i.message}`}}async function Cef(i,u,t,f,l,E,c,_){let T=`/api/v1/namespaces/${encodeURIComponent(u)}/pods?watch=true&labelSelector=${encodeURIComponent(`${Zef}=${t}`)}`;return F7i({kc:i,path:T,signal:f,label:`pod/${t}`,onEvent:(d)=>{if(d.type!=="ADDED"&&d.type!=="MODIFIED")return;let w=d.object;if(w.metadata?.name)_(w.metadata.name);Yef(w,l,c),E("pod")}})}function Yef(i,u,t){let l=(i.status?.conditions??[]).find((c)=>c.type==="PodScheduled");if(l?.status==="True")u.pod.scheduled=!0,u.pod.scheduledFalseReason=void 0,u.pod.scheduledFalseMessage=void 0;else if(l?.status==="False")u.pod.scheduled=!1,u.pod.scheduledFalseReason=l.reason,u.pod.scheduledFalseMessage=l.message;let E=(i.status?.containerStatuses??[]).find((c)=>c.name===Gef);if(E)u.pod.containerWaitingReason=E.state?.waiting?.reason,u.pod.containerRunning=!!E.state?.running,u.pod.containerReady=E.ready===!0}async function jef(i,u,t,f,l,E){let c=`/apis/${b4.CLAIM_API_GROUP}/${b4.CLAIM_API_VERSION}/namespaces/${encodeURIComponent(u)}/${b4.CLAIM_PLURAL}?watch=true&fieldSelector=${encodeURIComponent(`metadata.name=${t}`)}`;return F7i({kc:i,path:c,signal:f,label:`sandboxclaim/${t}`,onEvent:(_)=>{if(_.type!=="ADDED"&&_.type!=="MODIFIED")return;let d=_.object.status?.conditions?.find((w)=>w.type==="Ready");if(!d)return;if(d.status==="True")l.sandbox.ready=!0,l.sandbox.notReadyReason=void 0,l.sandbox.notReadyMessage=void 0;else l.sandbox.ready=!1,l.sandbox.notReadyReason=d.reason,l.sandbox.notReadyMessage=d.message;E("sandbox")}})}async function Kef(i,u,t,f,l,E,c,_){let T=await Promise.race([f,new Promise((w)=>{if(l.aborted){w(t);return}l.addEventListener("abort",()=>w(t),{once:!0})})]);if(l.aborted)return;let d=`/api/v1/namespaces/${encodeURIComponent(u)}/events?watch=true&fieldSelector=${encodeURIComponent(`involvedObject.name=${T},involvedObject.kind=Pod`)}`;return F7i({kc:i,path:d,signal:l,label:`events/${t}`,onEvent:(w)=>{if(w.type!=="ADDED"&&w.type!=="MODIFIED")return;let n=w.object,h=n.reason;if(!h)return;switch(h){case"Pulling":E.events.hasPulling=!0;break;case"Pulled":E.events.hasPulling=!0,E.events.hasPulled=!0;break;case"FailedScheduling":E.events.lastFailedSchedulingAt=_(),E.events.failedSchedulingMessage=n.message;break;case"Nominated":{let A=n.message?.match(/nodeclaim\/([\w-]+)/);if(A)E.events.nominatedNodeClaim=A[1];break}default:return}c("event")}})}async function cYt(i){let{kc:u,namespace:t,labelSelector:f,signal:l,onDelete:E}=i,c=`/apis/${b4.CLAIM_API_GROUP}/${b4.CLAIM_API_VERSION}/namespaces/${encodeURIComponent(t)}/${b4.CLAIM_PLURAL}?watch=true&labelSelector=${encodeURIComponent(f)}`;return F7i({kc:u,path:c,signal:l,label:"sandboxclaim-reaper",onEvent:(_)=>{if(_.type!=="DELETED")return;let T=_.object.metadata?.name;if(T)E(T)}})}async function F7i(i){let{kc:u,path:t,signal:f,label:l,onEvent:E}=i,c=0;while(!f.aborted){try{let T=await OC(u,{method:"GET",path:t,signal:f,headers:{accept:"application/json"},stream:!0});if(!T.ok||!T.body){try{await T.body?.cancel()}catch{}if(T.status===401||T.status===403){console.warn(`[lifecycle-watcher] ${l} stopped: watch denied (${T.status} ${T.statusText}). `+"The kubeconfig in use cannot watch SandboxClaims \u2014 if you are running locally, "+"this provider should not be active (check STUDIO_SANDBOX_PROVIDER / your sandbox preference).");return}throw Error(`watch handshake failed: ${T.status} ${T.statusText}`)}c=0;for await(let d of ocu(T.body)){if(f.aborted)return;try{E(d)}catch(w){console.warn(`[lifecycle-watcher] ${l} onEvent threw: ${w instanceof Error?w.message:String(w)}`)}}}catch(T){if(f.aborted)return;let d=T instanceof Error?T.message:String(T);console.warn(`[lifecycle-watcher] ${l} watch ended: ${d}`)}if(f.aborted)return;let _=wc(5000,250,c,2,0);c+=1,await yt(_,{signal:f}).catch(()=>{})}}var Zef="studio.decocms.com/sandbox-handle",Gef="sandbox",kef=300000;var _Yt=v(()=>{Nl();fs();R7i()});async function TYt(i,u,t){let f=new Map;for(let l of i){let E=u(l);if(!E)continue;let c=f.get(E);if(c)c.push(l);else f.set(E,[l])}await Promise.allSettled([...f.values()].map(async(l)=>{for(let E of l)await t(E).catch(()=>{})}))}import{createHash as Hef,randomBytes as Xef,randomUUID as Jef}from"crypto";import*as AYt from"net";import{PassThrough as Wef}from"stream";function bef(i){if(i instanceof Error)return i.message;if(i&&typeof i==="object"){let u=i;if(u.error instanceof Error)return u.error.message;if(typeof u.message==="string"&&u.message)return u.message}return String(i)}class E_u{kind=Z6;records=new Map;inflight=new Mhi;stateStore;previewUrlPattern;kubeConfig;portForward;namespace;sandboxTemplateName;goSandboxTemplateName;envName;tokenGenerator;idleTtlMs;metrics;previewGateway;sentinelToken;mintCloneUrl;closed=!1;claimWatchAbort=new AbortController;constructor(i={}){this.stateStore=i.stateStore??null,this.previewUrlPattern=i.previewUrlPattern??null,this.kubeConfig=i.kubeConfig??pef(),this.portForward=new Lcu(this.kubeConfig),this.namespace=i.namespace??Qef,this.sandboxTemplateName=i.sandboxTemplateName??Mef;let u=i.goSandboxTemplateName?.trim()??"";this.goSandboxTemplateName=u.length>0?u:null,this.envName=Eaf(i.envName),this.tokenGenerator=i.tokenGenerator??(()=>Xef(ref).toString("hex")),this.idleTtlMs=i.idleTtlMs??Vef,this.metrics=i.meter?sef(i.meter):null,this.previewGateway=i.previewGateway&&i.previewUrlPattern?{...i.previewGateway}:null;let t=i.sentinelToken?.trim()??"";this.sentinelToken=t.length>0?t:null,this.mintCloneUrl=i.mintCloneUrl,this.startClaimReaper(),this.startCredentialRefresher()}startClaimReaper(){let i=["app.kubernetes.io/managed-by=studio","app.kubernetes.io/name=studio-sandbox",...this.envName?[`${xT.env}=${this.envName}`]:[]].join(",");cYt({kc:this.kubeConfig,namespace:this.namespace,labelSelector:i,signal:this.claimWatchAbort.signal,onDelete:(u)=>this.invalidateRecord(u)})}async ensure(i,u={}){let t=m$(i,u.branch??u.repo?.branch??null);return this.inflight.run(t,()=>zhi(this.stateStore,i,Z6,(f)=>this.ensureLocked(i,t,u,f)))}async delete(i){let u=await this.getRecord(i);if(this.records.delete(i),u)this.closeForwarder(u.daemonForward),this.metrics?.active.add(-1,f_u(u.tenant,u.daemonImpl));if(await this.deleteHttpRouteIfManaged(i).catch((t)=>{console.warn(`[${Q4}] HTTPRoute delete failed for ${i}: ${t instanceof Error?t.message:String(t)}`)}),await d5(this.kubeConfig,this.namespace,i),this.stateStore)if(u)await this.stateStore.delete(u.id,Z6);else await this.stateStore.deleteByHandle(Z6,i)}async alive(i){return await dN(this.kubeConfig,this.namespace,i)!==void 0}watchClaimLifecycle(i,u){return EYt({kc:this.kubeConfig,namespace:this.namespace,claimName:i,signal:u})}async getPreviewUrl(i){let u=await this.getRecord(i);if(!u)return null;return this.composePreviewUrl(u)}async proxyDaemonRequest(i,u,t){let f=await this.getRecord(i);if(!f&&this.previewUrlPattern&&this.stateStore){let T=await this.stateStore.getByHandle(Z6,i),d=T?.state,w=d?.token;if(T&&w){let h=`http://${d?.adoptedSandboxName??i}.${this.namespace}.svc.cluster.local:${w5}`;try{let A=await tr(h,w,u,t);if(A.status!==404)return A;try{await A.body?.cancel()}catch{}}catch{}}}if(!f)f=await this.resurrectByHandle(i);if(!f)return new Response(JSON.stringify({error:"sandbox not found"}),{status:404,headers:{"content-type":"application/json"}});let l=f,E=performance.now(),c=0,_=!(t.body instanceof ReadableStream);try{let T=await tr(f.daemonUrl,f.token,u,t);if(T.status===401&&_){this.invalidateRecord(i);let d=await this.getRecord(i).catch(()=>null)??await this.resurrectByHandle(i).catch(()=>null);if(d)l=d,T=await tr(d.daemonUrl,d.token,u,t)}return c=T.status,T}catch(T){if(!_)throw T;this.invalidateRecord(i);let d=await this.resurrectByHandle(i)??await this.getRecord(i).catch(()=>null);if(!d)throw T;l=d;let w=await tr(d.daemonUrl,d.token,u,t);return c=w.status,w}finally{this.recordProxyDuration("daemon",c,l,performance.now()-E)}}async adoptLiveClaim(i,u){if(this.records.has(u))return!0;let t=await dN(this.kubeConfig,this.namespace,u).catch(()=>{return});if(!t||t.metadata?.deletionTimestamp)return!1;return await this.inflight.run(u,async()=>{let l=this.records.get(u);if(l)return this.toSandbox(l);let E=await this.adopt(i,u,t);if(!E)throw Error(`cannot adopt live claim ${u}`);return zhi(this.stateStore,i,Z6,(c)=>this.finish(E,c,!0,!0,"adopt"))}).catch(()=>null)!=null}async resolvePreviewUpstreamUrl(i){if(this.previewUrlPattern)return`http://${await this.resolveServiceNameForHandle(i)}.${this.namespace}.svc.cluster.local:${w5}`;let u=await this.getRecord(i);if(u)return u.daemonUrl;let t=await this.resurrectByHandle(i);return t?t.daemonUrl:null}async resolveServiceNameForHandle(i){let u=this.records.get(i);if(u)return u.adoptedSandboxName;if(this.stateStore){let f=(await this.stateStore.getByHandle(Z6,i).catch(()=>null))?.state?.adoptedSandboxName;if(f)return f}return i}async proxyPreviewRequest(i,u){let t=performance.now(),f=this.records.get(i)??null,l=0;try{let E=await this.resolvePreviewUpstreamUrl(i);if(!E){l=404;let D=u_u(404,{error:"sandbox not found"});return D.headers.set(PC,"1"),D}let c=new URL(u.url);if((c.pathname==="/_sandbox"||c.pathname.startsWith("/_sandbox/")||c.pathname==="/_decopilot_vm"||c.pathname.startsWith("/_decopilot_vm/"))&&u.method!=="GET")return l=404,u_u(404,{error:"not found"});let T=(D)=>`${D}${c.pathname}${c.search}`,d=new Headers(u.headers);for(let D of aef)d.delete(D);let w=u.method!=="GET"&&u.method!=="HEAD",n={method:u.method,headers:d,body:w?u.body:void 0,redirect:"manual",signal:u.signal,duplex:w?"half":void 0},h;try{h=await fetch(T(E),n)}catch(D){let N=`${E}${c.pathname}`;if(console.warn(`[${Q4}] preview fetch to ${N} failed: ${D instanceof Error?D.message:String(D)}`),u.method==="GET"||u.method==="HEAD"){if(this.invalidateRecord(i),await this.resurrectByHandle(i).catch(()=>null)){let $=await this.resolvePreviewUpstreamUrl(i);if($)try{h=await fetch(T($),n);let P=new Headers;for(let[g,U]of h.headers.entries())if(!dYt.includes(g.toLowerCase()))P.set(g,U);return l=h.status,new Response(h.body,{status:h.status,statusText:h.statusText,headers:P})}catch(P){console.warn(`[${Q4}] preview fetch retry to ${N} failed: ${P instanceof Error?P.message:String(P)}`)}}}else this.invalidateRecord(i);l=502;let S=u_u(502,{error:"sandbox daemon unreachable"});return S.headers.set(PC,"1"),S}let A=new Headers;for(let[D,N]of h.headers.entries())if(!dYt.includes(D.toLowerCase()))A.set(D,N);return l=h.status,new Response(h.body,{status:h.status,statusText:h.statusText,headers:A})}finally{this.recordProxyDuration("preview",l,f,performance.now()-t,i)}}async ensureLocked(i,u,t,f){if(t.image)console.warn(`[${Q4}] opts.image ignored (template ${this.sandboxTemplateName} pins image): got ${t.image}`);if(f){let c=await f.get(i,Z6);if(c){let _=await this.rehydrate(i,u,c);if(_)return await this.refreshDaemonGitCredential(_,t),this.finish(_,f,!1,!0,"resume");await f.delete(i,Z6)}}let l=await dN(this.kubeConfig,this.namespace,u).catch(()=>{return});if(l)if(l.metadata?.deletionTimestamp)await B7i(this.kubeConfig,this.namespace,u).catch((c)=>{console.warn(`[${Q4}] wait for terminating claim ${u} failed: ${c instanceof Error?c.message:String(c)}`)});else{let c=await this.adopt(i,u,l).catch((_)=>{return console.warn(`[${Q4}] adopt ${u} failed, recreating: ${_ instanceof Error?_.message:String(_)}`),null});if(c)return await this.refreshDaemonGitCredential(c,t),this.finish(c,f,!0,!0,"adopt");await d5(this.kubeConfig,this.namespace,u).catch(()=>{}),await B7i(this.kubeConfig,this.namespace,u).catch((_)=>{console.warn(`[${Q4}] wait for deleted claim ${u} failed: ${_ instanceof Error?_.message:String(_)}`)})}let E=await this.provision(i,u,t);return this.finish(E,f,!0,!1,"fresh")}async finish(i,u,t,f,l){let E=this.records.get(i.handle),c=E!==void 0;if(E&&E.daemonForward!==i.daemonForward)this.closeForwarder(E.daemonForward);if(this.records.set(i.handle,i),t)await this.persist(u,i);if(f)await eCt(this.kubeConfig,this.namespace,i.handle,this.computeShutdownTime()).catch((_)=>console.warn(`[${Q4}] TTL refresh failed for ${i.handle}: ${_ instanceof Error?_.message:String(_)}`));if(this.metrics){let _=f_u(i.tenant,i.daemonImpl);if(this.metrics.ensureOutcome.add(1,{..._,outcome:l}),!c)this.metrics.active.add(1,_)}return this.toSandbox(i)}buildEnvMap(i,u){let t={},f=[];for(let[l,E]of Object.entries(i.env??{}))if(qef.has(l))f.push(l);else t[l]=E;if(f.length>0)console.warn(`[${Q4}] opts.env keys overlap reserved bootstrap names and were dropped: ${f.join(",")}`);return{...t,DAEMON_TOKEN:u.token,DAEMON_BOOT_ID:u.daemonBootId,APP_ROOT:u.workdir,PROXY_PORT:String(w5)}}buildClaim(i,u,t){let f=this.sentinelToken!==null,l=f?[]:Object.entries(this.buildEnvMap(u,t)).sort(([d],[w])=>d<w?-1:d>w?1:0).map(([d,w])=>({name:d,value:w})),E=Taf(u),c=Object.keys(E).length>0,{impl:_,templateName:T}=nYt(u.daemonImpl,this.sandboxTemplateName,this.goSandboxTemplateName);if(u.daemonImpl==="go"&&_!=="go")console.warn(`[${Q4}] daemonImpl=go requested for ${i} but no Go SandboxTemplate is configured (STUDIO_SANDBOX_GO_TEMPLATE_NAME); landing on ts`);return{apiVersion:`${b4.CLAIM_API_GROUP}/${b4.CLAIM_API_VERSION}`,kind:"SandboxClaim",metadata:{name:i,namespace:this.namespace,labels:{"app.kubernetes.io/name":"studio-sandbox","app.kubernetes.io/managed-by":"studio",[xT.daemonImpl]:_,...this.envName?{[xT.env]:this.envName}:{},...t_u(u.tenant)},...c?{annotations:E}:{}},spec:{sandboxTemplateRef:{name:T},additionalPodMetadata:{labels:t_u(u.tenant,{[xT.role]:"claimed",[xT.sandboxHandle]:i,[xT.daemonImpl]:_,...this.envName?{[xT.env]:this.envName}:{}}),...c?{annotations:E}:{}},env:l,warmpool:f?"default":"none",lifecycle:{shutdownPolicy:"Delete",shutdownTime:this.computeShutdownTime()}}}}async provision(i,u,t){let f=this.tokenGenerator(),l=Jef(),E=i_u,{impl:c}=nYt(t.daemonImpl,this.sandboxTemplateName,this.goSandboxTemplateName),_=this.buildClaim(u,t,{token:f,daemonBootId:l,workdir:E});try{await Es(this.kubeConfig,this.namespace,_)}catch(A){if(A instanceof ts)await B7i(this.kubeConfig,this.namespace,u),await Es(this.kubeConfig,this.namespace,_);else throw A}let T;try{T=await aCt(this.kubeConfig,this.namespace,u),await y7i(this.kubeConfig,this.namespace,T)}catch(A){throw await d5(this.kubeConfig,this.namespace,u).catch(()=>{}),A}try{await this.ensureServicePortForAdoptedSandbox(T),await this.ensureHttpRouteForHandle(u,T,t.tenant??null)}catch(A){throw await d5(this.kubeConfig,this.namespace,u).catch(()=>{}),A}let d=await this.openForwarder(T,w5,u),w=`http://127.0.0.1:${d.localPort}`,n=this.workloadConfigPayload(t),h=l;try{if(await A4i(w),this.sentinelToken!==null){let A=await h4i(w);if(A)h=A.bootId;await GS(w,this.sentinelToken,n??{},{rotateToken:f})}else if(n)await GS(w,f,n);await this.relayOrgFsConfig(w,f,t.orgFsConfigJson)}catch(A){throw this.closeForwarder(d),await this.deleteHttpRouteIfManaged(u).catch(()=>{}),await d5(this.kubeConfig,this.namespace,u).catch(()=>{}),A}return{id:i,handle:u,adoptedSandboxName:T,token:f,workdir:E,daemonUrl:w,daemonForward:d,workload:t.workload??null,daemonBootId:h,tenant:t.tenant??null,daemonImpl:c,ensureOpts:naf({...t,daemonImpl:c})}}workloadConfigPayload(i){return H4u({runtime:i?.workload?.runtime??"node",packageManager:i?.workload?.packageManager?{name:i.workload.packageManager,...i.workload.packageManagerPath?{path:i.workload.packageManagerPath}:{}}:null,repo:i?.repo??null,port:i?.workload?.devPort??zef,tenant:i?.tenant??void 0})}async relayOrgFsConfig(i,u,t){if(!t)return;await dru(i,u,t).catch((f)=>console.warn("[org-fs] sidecar config relay failed",f))}async refreshDaemonGitCredential(i,u){let t=X4u(u);if(!t)return;try{await GS(i.daemonUrl,i.token,t)}catch(f){console.warn(`[${Q4}] git credential refresh failed for ${i.handle}: ${f instanceof Error?f.message:String(f)}`)}}async withFreshCloneUrl(i,u){if(!this.mintCloneUrl)return i;try{let t=await this.mintCloneUrl(i,u!==void 0?{bufferMs:u}:void 0);return t?{...i,cloneUrl:t}:i}catch(t){return console.warn(`[${Q4}] clone credential re-mint failed: ${t instanceof Error?t.message:String(t)}`),i}}startCredentialRefresher(){if(!this.mintCloneUrl)return;let{signal:i}=this.claimWatchAbort;(async()=>{while(!i.aborted){if(await yt(mef,{signal:i}).catch(()=>{}),i.aborted)break;try{await this.refreshAllGitCredentials()}catch(u){console.warn(`[${Q4}] periodic credential refresh failed: ${u instanceof Error?u.message:String(u)}`)}}})()}async refreshAllGitCredentials(){await TYt(this.records.values(),(i)=>i.ensureOpts?.repo?.connectionId,async(i)=>{if(this.claimWatchAbort.signal.aborted)return;let u=i.ensureOpts?.repo;if(!u)return;let t=await this.withFreshCloneUrl(u,eef);await this.refreshDaemonGitCredential(i,{...i.ensureOpts,repo:t}),i.ensureOpts={...i.ensureOpts,repo:t}})}async rebootstrapDaemon(i,u,t){if(this.sentinelToken===null)return!1;let f=this.workloadConfigPayload(t)??{};try{return await GS(i,this.sentinelToken,f,{rotateToken:u}),await this.relayOrgFsConfig(i,u,t?.orgFsConfigJson),!0}catch(l){if(l instanceof n4i&&l.status===401)try{return await GS(i,u,f,{rotateToken:u}),await this.relayOrgFsConfig(i,u,t?.orgFsConfigJson),!0}catch(E){return console.warn(`[${Q4}] re-bootstrap retry with claim token failed: ${E instanceof Error?E.message:String(E)}`),!1}return console.warn(`[${Q4}] re-bootstrap failed: ${l instanceof Error?l.message:String(l)}`),!1}}async ensureServicePortForAdoptedSandbox(i){if(!this.previewGateway||!this.previewUrlPattern)return;await tYt(this.kubeConfig,this.namespace,i,{name:"daemon",port:w5,targetPort:w5})}async ensureHttpRouteForHandle(i,u,t){if(!this.previewGateway||!this.previewUrlPattern)return;let f=haf(this.previewUrlPattern,i);if(!f)throw new f1(`Unable to derive preview hostname for ${i} from pattern: ${this.previewUrlPattern}`);let l={apiVersion:`${cs.API_GROUP}/${cs.API_VERSION}`,kind:"HTTPRoute",metadata:{name:i,namespace:this.namespace,labels:t_u(t??void 0,{[xT.role]:"claimed",[xT.sandboxHandle]:i,"app.kubernetes.io/name":"studio-sandbox","app.kubernetes.io/managed-by":"studio",...this.envName?{[xT.env]:this.envName}:{}})},spec:{parentRefs:[{kind:"Gateway",group:"gateway.networking.k8s.io",name:this.previewGateway.name,namespace:this.previewGateway.namespace}],hostnames:[f],rules:[{backendRefs:[{group:"",kind:"Service",name:u,port:w5}]}]}};await I7i(this.kubeConfig,this.namespace,l)}async deleteHttpRouteIfManaged(i){if(!this.previewGateway)return;await x7i(this.kubeConfig,this.namespace,i)}async rehydrate(i,u,t){let f=t.state;if(!f.adoptedSandboxName&&!f.podName||!f.token)return null;let l=await dN(this.kubeConfig,this.namespace,u).catch(()=>{return});if(!l||!wYt(l))return null;let E=l.status?.sandbox?.name??f.adoptedSandboxName??f.podName??u,c=await this.openAndProbeDaemon(E,u);if(!c)return null;if(f.daemonBootId&&f.daemonBootId!==c.bootId){if(this.sentinelToken!==null){let _=f.ensureOpts?.repo?{...f.ensureOpts,repo:await this.withFreshCloneUrl(f.ensureOpts.repo)}:f.ensureOpts??null;if(!await this.rebootstrapDaemon(c.daemonUrl,f.token,_))return this.closeForwarder(c.daemonForward),null}else console.warn(`[${Q4}] daemon restart detected (handle=${u}): stored bootId=${f.daemonBootId} live bootId=${c.bootId}`);await this.stateStore?.put(i,Z6,{handle:u,state:{...f,daemonBootId:c.bootId}}).catch((_)=>console.warn(`[${Q4}] bootId persist failed for ${u}: ${_ instanceof Error?_.message:String(_)}`))}return{id:i,handle:u,adoptedSandboxName:E,token:f.token,workdir:f.workdir??i_u,daemonUrl:c.daemonUrl,daemonForward:c.daemonForward,workload:f.workload??null,daemonBootId:c.bootId,tenant:f.tenant??null,ensureOpts:f.ensureOpts??null,daemonImpl:f.ensureOpts?.daemonImpl??null}}async adopt(i,u,t){if(!wYt(t))return null;let f=t.status?.sandbox?.name??u;if(this.sentinelToken!==null)return null;let l=iaf(t);if(!l)return null;let E=await this.openAndProbeDaemon(f,u);if(!E)return null;let c=daf(t);if(this.previewGateway)await this.ensureServicePortForAdoptedSandbox(f).catch((_)=>{console.warn(`[${Q4}] Service port backfill failed for ${u}: ${_ instanceof Error?_.message:String(_)}`)}),await this.ensureHttpRouteForHandle(u,f,c).catch((_)=>{console.warn(`[${Q4}] HTTPRoute backfill failed for ${u}: ${_ instanceof Error?_.message:String(_)}`)});return{id:i,handle:u,adoptedSandboxName:f,token:l,workdir:i_u,daemonUrl:E.daemonUrl,daemonForward:E.daemonForward,workload:null,daemonBootId:E.bootId,tenant:c,ensureOpts:null,daemonImpl:waf(t)}}async openAndProbeDaemon(i,u){let t=await this.openForwarder(i,w5,u).catch(()=>null);if(!t)return null;let f=`http://127.0.0.1:${t.localPort}`,l=await h4i(f);if(!l)return this.closeForwarder(t),null;return{daemonForward:t,daemonUrl:f,bootId:l.bootId}}async getRecord(i){let u=this.records.get(i);if(u)return u;if(!this.stateStore)return null;let t=await this.stateStore.getByHandle(Z6,i);if(!t)return null;let f=await this.rehydrate(t.id,i,t);if(f)this.records.set(i,f);return f}async resurrectByHandle(i){if(!this.stateStore)return null;let u=await this.stateStore.getByHandle(Z6,i);if(!u)return null;let t=u.state.ensureOpts;if(!t)return null;let f=t.repo?{...t,repo:await this.withFreshCloneUrl(t.repo)}:t;return await this.ensure(u.id,f),this.records.get(i)??null}invalidateRecord(i){let u=this.records.get(i);if(!u)return;this.records.delete(i),this.closeForwarder(u.daemonForward)}recordProxyDuration(i,u,t,f,l){if(!this.metrics)return;this.metrics.proxyDurationMs.record(f,{...f_u(t?.tenant??null,t?.daemonImpl??null),source:i,sandbox_handle:t?.handle??l??"",status_code:u||0})}composePreviewUrl(i){if(this.previewUrlPattern)return rhi(this.previewUrlPattern,i.handle);return`http://127.0.0.1:${i.daemonForward.localPort}/`}toSandbox(i){return{handle:i.handle,workdir:i.workdir,previewUrl:this.composePreviewUrl(i)}}async persist(i,u){if(!i)return;let t={adoptedSandboxName:u.adoptedSandboxName,token:u.token,workdir:u.workdir,workload:u.workload,daemonBootId:u.daemonBootId,tenant:u.tenant,...u.ensureOpts?{ensureOpts:u.ensureOpts}:{}};await i.put(u.id,Z6,{handle:u.handle,state:t})}computeShutdownTime(){return new Date(Date.now()+this.idleTtlMs).toISOString()}openForwarder(i,u,t=i){let f=uaf(t,u);return new Promise((l,E)=>{let c=(_,T)=>{let d=AYt.createServer((w)=>this.handleForwardedConnection(w,i,u,t));d.once("error",(w)=>{if(w.code==="EADDRINUSE"&&T<oef){try{d.close()}catch{}let n=l_u+(_-l_u+1)%DYt;c(n,T+1);return}E(w)}),d.listen(_,"127.0.0.1",()=>{let w=d.address();if(!w||typeof w==="string"){d.close(),E(Error("port-forward listener failed to bind"));return}l({server:d,localPort:w.port})})};c(f,0)})}handleForwardedConnection(i,u,t,f){let l=new Wef,E=null,c=!1,_=()=>{if(c)return;if(c=!0,l.destroy(),E)try{E.close()}catch{}if(!i.destroyed)i.destroy()};i.pipe(l),i.on("error",_),i.on("close",_),this.portForward.portForward(this.namespace,u,[t],i,null,l).then((T)=>{let d=typeof T==="function"?T():T;if(!d){_();return}if(E=d,E.on("close",_),E.on("error",()=>{this.invalidateRecord(f),_()}),c)try{E.close()}catch{}}).catch((T)=>{console.warn(`[${Q4}] port-forward to ${u}:${t} failed: ${bef(T)}`),this.invalidateRecord(f),_()})}closeForwarder(i){i.server.close((u)=>{if(u)console.warn(`[${Q4}] port-forward close on :${i.localPort} errored: ${u instanceof Error?u.message:String(u)}`)})}close(){if(this.closed)return;this.closed=!0,this.claimWatchAbort.abort();for(let i of this.records.values())this.closeForwarder(i.daemonForward);this.records.clear()}}function sef(i){return{active:i.createUpDownCounter("studio.sandbox.active",{description:"Active sandbox count, by runner kind, owning org, and daemon impl. Cross-checks the cAdvisor-derived count from the cluster \u2014 divergence between the two indicates orphaned claims (studio deleted but K8s didn't reap) or unattributed pods.",unit:"{sandbox}"}),ensureOutcome:i.createCounter("studio.sandbox.ensure.outcome",{description:"Outcome of each ensure() call: fresh provision, resume from state-store after restart, or adopt of a cluster-side claim studio didn't know about. Cold-start ratio is the primary input for warm-pool sizing.",unit:"{call}"}),proxyDurationMs:i.createHistogram("studio.sandbox.proxy.duration_ms",{description:"Wall-clock latency of studio-mediated requests to the sandbox daemon: tool exec proxies (source=daemon) and preview iframe traffic (source=preview).",unit:"ms"})}}function pef(){let i=new kW;return i.loadFromDefault(),i}function wYt(i){return Boolean(i.status?.conditions?.some((u)=>u.type==="Ready"&&u.status==="True"))}function iaf(i){let u=i.spec?.env;if(!u)return null;for(let t of u)if(t.name==="DAEMON_TOKEN"&&t.value)return t.value;return null}function uaf(i,u){let t=Hef("sha256").update(`${i}:${u}`).digest();return l_u+t.readUInt32BE(0)%DYt}function u_u(i,u){return new Response(JSON.stringify(u),{status:i,headers:{"content-type":"application/json","access-control-allow-origin":"*"}})}function nYt(i,u,t){if(i==="go"&&t)return{impl:"go",templateName:t};return{impl:"ts",templateName:u}}function hYt(i){let u=i.slice(0,faf);return taf.test(u)?u:""}function Eaf(i){if(i===void 0)return null;let u=i.trim();if(u==="")return null;if(!laf.test(u))throw Error(`AgentSandboxProvider: envName=${JSON.stringify(u)} is not a valid DNS-label-safe environment name (lowercase alphanumeric or '-', starts with a letter, ends alphanumeric, \u226432 chars). Studio sets this from STUDIO_ENV; check the studio chart's configMap.`);return u}function t_u(i,u={}){let t={...u};if(i){let f=hYt(i.orgId),l=hYt(i.userId);if(f)t[xT.orgId]=f;if(l)t[xT.userId]=l}return t}function $C(i){let u="";for(let t of i){let f=t.codePointAt(0)??0;u+=f<32||f===127?" ":t}return u.slice(0,caf)}function _af(i){try{let u=new URL(i);return u.username="",u.password="",u.toString()}catch{return""}}function Taf(i){let u={},t=i.tenant;if(t?.orgSlug)u[Hh.orgSlug]=$C(t.orgSlug);if(t?.orgName)u[Hh.orgName]=$C(t.orgName);if(t?.userEmail)u[Hh.userEmail]=$C(t.userEmail);if(t?.userName)u[Hh.userName]=$C(t.userName);let f=i.repo;if(f){if(f.displayName)u[Hh.gitRepo]=$C(f.displayName);let l=_af(f.cloneUrl);if(l)u[Hh.gitRepoUrl]=$C(l);let E=i.branch??f.branch;if(E)u[Hh.gitBranch]=$C(E)}return u}function daf(i){let u=i.metadata?.labels;if(!u)return null;let t=u[xT.orgId],f=u[xT.userId];if(!t||!f)return null;let l=i.metadata?.annotations??{};return{orgId:t,userId:f,orgSlug:l[Hh.orgSlug],orgName:l[Hh.orgName],userEmail:l[Hh.userEmail],userName:l[Hh.userName]}}function waf(i){let u=i.metadata?.labels?.[xT.daemonImpl];return u==="go"||u==="ts"?u:null}function f_u(i,u){return{org_id:i?.orgId??"",user_id:i?.userId??"",runner_kind:Z6,daemon_impl:u??""}}function naf(i){let u={};if(i.repo)u.repo=i.repo;if(i.workload)u.workload=i.workload;if(i.env&&Object.keys(i.env).length>0)u.env=i.env;if(i.tenant)u.tenant=i.tenant;if(i.orgFsConfigJson)u.orgFsConfigJson=i.orgFsConfigJson;if(i.daemonImpl)u.daemonImpl=i.daemonImpl;return Object.keys(u).length>0?u:null}function haf(i,u){try{return new URL(rhi(i,u)).hostname||null}catch{return null}}var Z6="agent-sandbox",Q4="AgentSandboxProvider",PC="x-sandbox-preview-not-ready",Qef="agent-sandbox-system",Mef="studio-sandbox",w5=9000,zef=3000,i_u="/app",ref=32,qef,Vef=900000,mef=900000,eef=1800000,aef,dYt,l_u=40000,DYt=1e4,oef=256,xT,Hh,taf,faf=63,laf,caf=253;var vYt=v(()=>{Nl();rcu();jWi();qhi();R7i();fs();_Yt();qef=new Set(["DAEMON_TOKEN","DAEMON_BOOT_ID","APP_ROOT","PROXY_PORT"]),aef=["cookie","host","connection","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","accept-encoding","content-length","upgrade"],dYt=["connection","keep-alive","transfer-encoding","content-encoding","content-length"];xT={role:"studio.decocms.com/role",sandboxHandle:"studio.decocms.com/sandbox-handle",orgId:"studio.decocms.com/org-id",userId:"studio.decocms.com/user-id",env:"studio.decocms.com/env",daemonImpl:"studio.decocms.com/daemon-impl"};Hh={orgSlug:"studio.decocms.com/org-slug",orgName:"studio.decocms.com/org-name",userEmail:"studio.decocms.com/user-email",userName:"studio.decocms.com/user-name",gitRepo:"studio.decocms.com/git-repo",gitRepoUrl:"studio.decocms.com/git-repo-url",gitBranch:"studio.decocms.com/git-branch"},taf=/^([A-Za-z0-9]([-A-Za-z0-9_.]*[A-Za-z0-9])?)?$/;laf=/^[a-z]([a-z0-9-]{0,30}[a-z0-9])?$/});var NYt={};gi(NYt,{waitForSandboxReady:()=>y7i,getSandboxClaim:()=>dN,getHttpRoute:()=>iYt,deleteSandboxClaim:()=>d5,deleteHttpRoute:()=>x7i,createSandboxClaim:()=>Es,applyHttpRoute:()=>I7i,SandboxTimeoutError:()=>SC,SandboxError:()=>f1,PREVIEW_NOT_READY_HEADER:()=>PC,KubeConfig:()=>kW,K8S_CONSTANTS:()=>b4,HTTPROUTE_CONSTANTS:()=>cs,AgentSandboxProvider:()=>E_u});var c_u=v(()=>{rcu();fs();R7i();vYt()});class L7i{kind=n5;userSub;dispatch;stateStore;records=new Map;constructor(i){if(!i.userSub)throw Error("DesktopSandboxProvider requires userSub");if(!i.dispatch)throw Error("DesktopSandboxProvider requires dispatch");this.userSub=i.userSub,this.dispatch=i.dispatch,this.stateStore=i.stateStore??null}async ensure(i,u={}){let t=u.branch??u.repo?.branch,f=m$(i,t),l=this.records.get(f);if(l){if(await this.probeHealth(f))return this.toSandbox(l);if(this.records.delete(f),this.stateStore)await this.stateStore.deleteByHandle(n5,f).catch(()=>{})}else if(this.stateStore){let h=(await this.stateStore.getByHandle(n5,f))?.state,A=h?.sandboxApiUrl;if(A){if(await this.probeHealth(f)){let D={handle:f,sandboxApiUrl:A,previewUrl:h?.previewUrl??A};return this.records.set(f,D),this.toSandbox(D)}await this.stateStore.deleteByHandle(n5,f).catch(()=>{})}}let E=Un({userName:u.tenant?.userName,userEmail:u.tenant?.userEmail}),c=JSON.stringify({handle:f,repo:u.repo,branch:t,...u.workload?{workload:u.workload}:{},...E?{operator:E}:{},...u.offloadAllowedHosts?{offloadAllowedHosts:u.offloadAllowedHosts}:{},...u.offloadAllowSameHostDev!==void 0?{offloadAllowSameHostDev:u.offloadAllowSameHostDev}:{},...u.orgFsConfigJson?{orgFsConfigJson:u.orgFsConfigJson}:{}}),_=await this.dispatchJson("POST","/api/sandboxes",c),T=JSON.parse(_);if(typeof T.sandboxApiUrl!=="string")throw Error("desktop ensure: daemon did not return a sandboxApiUrl string");let d=typeof T.previewUrl==="string"?T.previewUrl:T.sandboxApiUrl,w={handle:f,sandboxApiUrl:T.sandboxApiUrl,previewUrl:d};if(this.records.set(f,w),this.stateStore)await this.stateStore.put(i,n5,{handle:f,state:{handle:f,sandboxApiUrl:T.sandboxApiUrl,previewUrl:d}});return this.toSandbox(w)}async proxyDaemonRequest(i,u,t){let f=u.startsWith("/")?u:`/${u}`,l=f.startsWith("/_sandbox/")?f.slice(9):f,E=`/_sandbox/${encodeURIComponent(i)}${l}`,c=new Headers(t.headers);for(let O of["host","cookie","connection","keep-alive","transfer-encoding","upgrade","authorization"])c.delete(O);let _={};c.forEach((O,$)=>{_[$]=O});let T;if(t.body!=null)T=await Daf(t.body);let w=this.dispatch(this.userSub,{method:t.method,path:E,headers:_,body:T},{signal:t.signal})[Symbol.asyncIterator](),n=Aaf(),h=200,A={"content-type":"application/octet-stream"},D=[];try{while(!0){let O=await w.next();if(O.done)break;let $=O.value;if($.headers){h=$.headers.status,A=$.headers.headers;break}if($.data!=null){let P=n.push($.data);if(P.length)D.push(P)}}}catch(O){let $=O instanceof Error?O.message:"dispatch error";return new Response(JSON.stringify({error:$}),{status:502,headers:{"content-type":"application/json"}})}let N=!1,S=new ReadableStream({async start(O){for(let $ of D)O.enqueue($)},async pull(O){try{while(!0){let $=await w.next();if(N)return;if($.done){let g=n.flush();if(g.length)O.enqueue(g);O.close();return}let P=$.value;if(P.data!=null){let g=n.push(P.data);if(g.length){O.enqueue(g);return}}}}catch($){if(!N)O.error($)}},cancel(){N=!0,w.return?.()}});return new Response(S,{status:h,headers:A})}async alive(i){return this.probeHealth(i)}async probeHealth(i){let u=new AbortController,t=setTimeout(()=>u.abort(),3000);try{return await this.dispatchJson("GET",`/api/sandboxes/${encodeURIComponent(i)}`,void 0,u.signal),!0}catch{return!1}finally{clearTimeout(t)}}async forgetHandle(i){if(this.records.delete(i),this.stateStore)await this.stateStore.deleteByHandle(n5,i).catch(()=>{})}async delete(i){if(this.records.delete(i),this.stateStore)await this.stateStore.deleteByHandle(n5,i).catch(()=>{});try{await this.dispatchJson("DELETE",`/api/sandboxes/${encodeURIComponent(i)}`)}catch(u){if(!(u instanceof Error?u.message:String(u)).includes("404"))throw u}}async getPreviewUrl(i){return(await this.resolveRecord(i))?.previewUrl??null}async localWorkdir(i){return null}async*watchClaimLifecycle(i,u){yield{kind:"ready"}}toSandbox(i){return{handle:i.handle,workdir:i.sandboxApiUrl,previewUrl:i.previewUrl}}async resolveRecord(i){let u=this.records.get(i);if(u)return u;if(!this.stateStore)return null;let f=(await this.stateStore.getByHandle(n5,i))?.state,l=f?.sandboxApiUrl;if(!l)return null;let E={handle:i,sandboxApiUrl:l,previewUrl:f?.previewUrl??l};return this.records.set(i,E),E}async dispatchJson(i,u,t,f){let l={accept:"application/json"};if(t!==void 0)l["content-type"]="application/json";let E=this.dispatch(this.userSub,{method:i,path:u,headers:l,body:t},{signal:f}),c=null,_="";for await(let d of E)if(d.headers)c=d.headers.status;else if(d.data!=null)_+=d.data;let T=Buffer.from(_,"base64").toString("utf8");if(c!=null&&(c<200||c>=300))throw Error(`daemon returned ${c}: ${T}`);return T}}function SYt(i){return new L7i(i)}function Aaf(){let i="";return{push(u){if(u.length===0)return __u;i+=u;let t=i.length-i.length%4;if(t===0)return __u;let f=i.slice(0,t);return i=i.slice(t),new Uint8Array(Buffer.from(f,"base64"))},flush(){if(i.length===0)return __u;let u=i;return i="",new Uint8Array(Buffer.from(u,"base64"))}}}async function Daf(i){if(typeof i==="string")return i;if(i instanceof ArrayBuffer)return Buffer.from(i).toString("utf8");if(ArrayBuffer.isView(i))return Buffer.from(i.buffer,i.byteOffset,i.byteLength).toString("utf8");if(i instanceof URLSearchParams)return i.toString();return await new Response(i).text()}var n5="user-desktop",__u;var OYt=v(()=>{qhi();w4i();__u=new Uint8Array(0)});var $Yt={};gi($Yt,{createDesktopProvider:()=>SYt,DesktopSandboxProvider:()=>L7i});var PYt=v(()=>{OYt()});var yYt={};gi(yYt,{subscribeLifecycle:()=>w_u,getSandboxProviderByKind:()=>d_u,getOrInitSharedRunner:()=>Baf,buildDesktopProvider:()=>Z7i,__resetSharedLifecyclesForTesting:()=>Faf});function IYt(i,u){let t=gYt[i];if(t)return Promise.resolve(t);let f=T_u[i];if(f)return f;let l=u().then((E)=>{return gYt[i]=E,E}).finally(()=>{delete T_u[i]});return T_u[i]=l,l}function Saf(){let i=process.env.STUDIO_SANDBOX_PREVIEW_URL_PATTERN;return i&&i.trim()!==""?i:void 0}function Oaf(){let i=process.env.STUDIO_SANDBOX_TEMPLATE_NAME;return i&&i.trim()!==""?i:void 0}function $af(){let i=process.env.STUDIO_SANDBOX_GO_TEMPLATE_NAME;return i&&i.trim()!==""?i:void 0}function Paf(){let i=process.env.STUDIO_ENV;return i&&i.trim()!==""?i:void 0}function gaf(){let i=process.env.STUDIO_SANDBOX_SENTINEL_TOKEN;return i&&i.trim()!==""?i:void 0}function Uaf(){let i=process.env.STUDIO_SANDBOX_PREVIEW_GATEWAY_NAME?.trim(),u=process.env.STUDIO_SANDBOX_PREVIEW_GATEWAY_NAMESPACE?.trim();if(!i&&!u)return;if(!i||!u)throw Error("STUDIO_SANDBOX_PREVIEW_GATEWAY_NAME and STUDIO_SANDBOX_PREVIEW_GATEWAY_NAMESPACE must both be set, or both unset. Half-configured per-claim HTTPRoute routing would silently fail to attach.");return{name:i,namespace:u}}async function xYt(i,u){let t=new PW(u),f=Saf();switch(i){case"agent-sandbox":{let{AgentSandboxProvider:l}=await Promise.resolve().then(() => (c_u(),NYt)),E=new nv(_u().encryptionKey);return new l({stateStore:t,previewUrlPattern:f,sandboxTemplateName:Oaf(),goSandboxTemplateName:$af(),envName:Paf(),previewGateway:Uaf(),sentinelToken:gaf(),meter:B0,mintCloneUrl:async(c,_)=>{if(!c.connectionId)return null;let T=URt(c.cloneUrl);if(!T)return null;let{cloneUrl:d}=await s$(c.connectionId,T.owner,T.name,u,E,{bufferMs:_?.bufferMs});return d}})}case"user-desktop":throw Error("user-desktop provider cannot be instantiated without a per-run link claim \u2014 call resolveSandboxProvider, which binds the link before constructing the provider.");default:throw Error(`Unknown sandbox provider kind: ${String(i)}`)}}async function Z7i(i,u){let{DesktopSandboxProvider:t}=await Promise.resolve().then(() => (PYt(),$Yt)),{getProxyDispatch:f}=await Promise.resolve().then(() => (h_u(),n_u)),l=new PW(i.db);if(!u)throw Error("buildDesktopProvider: userSub must be a non-empty string");let E=f();return new t({userSub:u,dispatch:E,stateStore:l})}function d_u(i,u){return IYt(u,()=>xYt(u,i.db))}async function Baf(){let i;try{i=Ch()}catch(t){return console.warn("[lifecycle] cannot resolve sandbox runner:",t instanceof Error?t.message:String(t)),null}return await IYt(i,()=>xYt(i,et().db))}function w_u(i,u,t){let f=h5.get(u);if(f){if(f.terminated){if(f.lastPhase)try{t(f.lastPhase)}catch{}return{unsubscribe:yaf}}if(f.listeners.add(t),f.lastPhase)try{t(f.lastPhase)}catch{}return UYt(u,f,t)}let l=new AbortController,E={lastPhase:null,terminated:!1,listeners:new Set([t]),abort:l};return h5.set(u,E),Raf(i,u,E),UYt(u,E,t)}function yaf(){}function UYt(i,u,t){return{unsubscribe(){if(h5.get(i)!==u)return;if(u.listeners.delete(t),u.listeners.size===0)h5.delete(i),u.abort.abort()}}}async function Raf(i,u,t){let f=null;try{for await(let l of i.watchClaimLifecycle(u,t.abort.signal)){if(t.abort.signal.aborted)break;t.lastPhase=l;let E=l.kind==="ready"||l.kind==="failed";if(E)t.terminated=!0;let c=Array.from(t.listeners);for(let _ of c)try{_(l)}catch{}if(E)break}}catch(l){f=l}finally{if(!t.terminated&&!t.abort.signal.aborted&&t.listeners.size>0){let l={kind:"failed",reason:"unknown",message:f instanceof Error?f.message:"Lifecycle watcher ended unexpectedly"};t.lastPhase=l,t.terminated=!0;for(let E of Array.from(t.listeners))try{E(l)}catch{}}if(h5.get(u)===t)h5.delete(u)}}function Faf(){for(let i of h5.values())i.abort.abort();h5.clear()}var vaf,Naf,BYt,gYt,T_u,Iaf,xaf,h5;var G7i=v(()=>{Vw();M1();GE();s4u();Ho();rq();jt();vaf=Symbol.for("decocms.sandbox.lifecycle.runners"),Naf=Symbol.for("decocms.sandbox.lifecycle.inflight"),BYt=globalThis,gYt=BYt[vaf]??={},T_u=BYt[Naf]??={};Iaf=Symbol.for("decocms.sandbox.lifecycle.shared-lifecycles"),xaf=globalThis,h5=xaf[Iaf]??=new Map});async function Xh(i,u){let{userId:t,branch:f,virtualMcpMetadata:l,explicitKind:E}=u;if(E)return{provider:await _s(i,t,E),kind:E};if(i.sandboxPreference==="agent-sandbox")return{provider:await _s(i,t,"agent-sandbox"),kind:"agent-sandbox"};if(i.sandboxPreference==="user-desktop")return{provider:await Z7i(i,t),kind:"user-desktop"};if(i.sandboxPreference==="cluster-default"){let w=Ch();return{provider:await _s(i,t,w),kind:w}}let[c,..._]=Laf(l,t,f);if(c){let w=_.length===0?c:Zaf(c,_);return{provider:await _s(i,t,w),kind:w}}let T=RYt();return{provider:await _s(i,t,T),kind:T}}function Laf(i,u,t){let f=oE(i)[u]?.[t];if(!f)return[];let l=Qn(f);return Object.keys(l)}function Zaf(i,u){let t=RYt();if(t===i||u.includes(t))return t;return i}function RYt(){return Ch()}async function _s(i,u,t){if(t!=="user-desktop")return d_u(i,t);return Z7i(i,u)}var HW=v(()=>{Z0();Vw();Zd();G7i()});var Ts;var A_u=v(()=>{Ts={npm:{install:"npm install",run:(i)=>`npm run ${i}`,runtime:"node"},pnpm:{install:"pnpm install",run:(i)=>`pnpm run ${i}`,runtime:"node"},yarn:{install:"yarn install",run:(i)=>`yarn run ${i}`,runtime:"node"},bun:{install:"bun install",run:(i)=>`bun run ${i}`,runtime:"bun"},deno:{install:"deno install",run:(i)=>`deno task ${i}`,runtime:"deno"}}});function k7i(i,u){return u?`thread:${i}/${u}`:`thread:${i}`}function C7i(i){return`sandbox/thread-${i.replace(/^thread:/,"").replace(/\//g,"-")}`}function A5(i){if(!i||!i.startsWith("thread:"))return null;return i.slice(7).split("/")[0]||null}async function wN(i,u,t){let f=A5(u);if(!f)return t;return(await i.storage.threads.get(f).catch(()=>null))?.created_by??t}async function XW(i,u){if(!u)return null;let t=await i.storage.threads.get(u).catch(()=>null);if(!t)return null;return t.metadata??{}}async function FYt(i,u){let f=(await XW(i,u))?.headRef;return typeof f==="string"&&f.length>0?f:null}async function LYt(i,u,t){let f=await XW(i,u);if(!f)return;if(f.headRef===t)return;await i.storage.threads.update(u,{metadata:{...f,headRef:t}}).catch((l)=>console.warn("[thread-repo] setThreadHeadRef failed",l))}async function ds(i,u){return(await XW(i,u))?.githubRepo??null}async function ZYt(i,u,t,f,l,E){let c=await XW(i,u);if(!c)return;let _=Ko(oE(c),t,f,l,E);await i.storage.threads.update(u,{metadata:{...c,sandboxMap:_}}).catch((T)=>console.warn("[thread-repo] setThreadSandboxMapEntry failed",T))}async function GYt(i,u){return oE(await XW(i,u))}async function kYt(i,u,t,f,l){let E=await XW(i,u);if(!E)return;let c=o4u(oE(E),t,f,l);if(!c)return;await i.storage.threads.update(u,{metadata:{...E,sandboxMap:c}}).catch((_)=>console.warn("[thread-repo] removeThreadSandboxMapEntry failed",_))}var D5=v(()=>{Zd()});function Y7i(i){if(!i)return null;let u=i.runtime;if(!u||typeof u!=="object")return null;let t=u.env;if(!Array.isArray(t))return null;let f=[];for(let l of t){if(!l||typeof l!=="object")continue;let E=l;if(typeof E.key!=="string"||!Nci.test(E.key))continue;if(E.kind==="literal"&&typeof E.value==="string"){f.push({key:E.key,kind:"literal",value:E.value});continue}if(E.kind==="secret"&&typeof E.secretId==="string"&&E.secretId.length>0)f.push({key:E.key,kind:"secret",secretId:E.secretId})}return f.length===0?null:f}function CYt(i){if(!i)return null;let u=i.runtime;if(!u||typeof u!=="object")return null;let t=u.submoduleCredentials;if(!Array.isArray(t))return null;let f=[];for(let l of t){if(!l||typeof l!=="object")continue;let E=l;if(typeof E.host==="string"&&E.host.length>0&&typeof E.secretId==="string"&&E.secretId.length>0)f.push({host:E.host,secretId:E.secretId})}return f.length===0?null:f}async function YYt(i,u){$i(u);let t=Si(u);await u.access.check();let f=Cu(u);if(!f)throw Error("User ID required");let l=await u.storage.virtualMcps.findById(i.virtualMcpId);if(!l||l.organization_id!==t.id)throw Error("Virtual MCP not found");let E=l.metadata??{},c=oE(E),_=await wN(u,i.branch,f),T=a$(c,_,i.branch,i.sandboxProviderKind);return{virtualMcp:l,metadata:E,userId:f,sandboxUserId:_,entry:T,organization:t}}function j7i(i){let u=i.runtime??null,f=u?.selected??null,l=u?.port??null,E=u?.path??null;if(!f||!(f in Ts))return{packageManager:null,runtime:null,port:l,packageManagerPath:E,runtimeBinPath:null};let c=Ts[f].runtime;return{packageManager:f,runtime:c,port:l,packageManagerPath:E,runtimeBinPath:c==="deno"?"/opt/deno/bin":c==="bun"?"/opt/bun/bin":null}}var JW=v(()=>{Z0();A_u();Zd();D5()});async function v5(i,u){let t=i.body?.getReader();if(!t)return i.text();let f=new TextDecoder,l="",E=0;for(;;){let{done:c,value:_}=await t.read();if(c)break;if(E+=_.byteLength,E>u)throw await t.cancel().catch(()=>{}),new jYt(`Upstream response exceeded ${u} bytes`);l+=f.decode(_,{stream:!0})}return l+=f.decode(),l}var jYt;var ws=v(()=>{jYt=class jYt extends Error{}});async function K7i({ctx:i,runner:u,handle:t,orgId:f,userId:l,entries:E}){if(!E||E.length===0)return;let c={};for(let T of E){if(T.kind==="literal"){c[T.key]=T.value;continue}try{let{value:d}=await i.storage.secrets.resolveById(T.secretId,f,l);c[T.key]=d}catch(d){if(d instanceof Lw||d instanceof c$){console.warn(`[SANDBOX_START] skipping env ${T.key}: ${d.message}. Re-link or recreate the secret to restore.`);continue}throw d}}if(Object.keys(c).length===0)return;let _=await u.proxyDaemonRequest(t,"/_sandbox/config",{method:"PUT",headers:new Headers({"content-type":"application/json"}),body:JSON.stringify({env:c})});if(!_.ok){let T=await v5(_,Gaf).catch(()=>_.statusText);console.warn(`[SANDBOX_START] daemon rejected env patch (${_.status}): ${T}`)}}var Gaf=10485760;var D_u=v(()=>{de();ws()});async function KYt({ctx:i,orgId:u,userId:t,entries:f}){if(!f||f.length===0)return[];let l=[];for(let E of f)try{let{value:c}=await i.storage.secrets.resolveById(E.secretId,u,t);l.push({host:E.host,token:c})}catch(c){if(c instanceof Lw||c instanceof c$){console.warn(`[SANDBOX_START] skipping submodule credential for ${E.host}: ${c.message}. Re-link or recreate the secret to restore.`);continue}throw c}return l}var HYt=v(()=>{de()});async function WYt(i,u,t,f,l){let E=await y$({connectionId:i,tokenStorage:new VE(f,l)});if(!E.accessToken)return null;return QYt(u,t,E.accessToken)}function bYt(i,u){return QYt(i,u,null)}async function QYt(i,u,t){let f=new Map,l=new Set(XYt.map((T)=>T.path));for(let T of Object.values(JYt))for(let d of T??[])l.add(d);await Promise.all(Array.from(l).map(async(T)=>{f.set(T,await Caf(i,u,T,t))}));let E=XYt.find(({path:T})=>f.get(T)!==null);if(!E)return null;let c=JYt[E.pm]??[],_=null;for(let T of c)if(_=Yaf(f.get(T)??null),_)break;return{packageManager:E.pm,devPort:_}}async function Caf(i,u,t,f){let l=`https://api.github.com/repos/${i}/${u}/contents/${encodeURIComponent(t)}`;try{let E={Accept:"application/vnd.github+json","User-Agent":"studio-runtime-detect"};if(f)E.Authorization=`token ${f}`;let c=await fetch(l,{headers:E,signal:AbortSignal.timeout(5000)});if(!c.ok)return null;let _=await c.json();if(!_.content||_.encoding!=="base64")return null;return Buffer.from(_.content,"base64").toString("utf8")}catch{return null}}function Yaf(i){if(!i)return null;try{let u=JSON.parse(i),t=u.tasks??u.scripts??{};return(t.dev??t.start??"").match(kaf)?.[1]??null}catch{return null}}var XYt,JYt,kaf;var MYt=v(()=>{R$();Uh();XYt=[{path:"deno.json",pm:"deno"},{path:"deno.jsonc",pm:"deno"},{path:"bun.lock",pm:"bun"},{path:"bunfig.toml",pm:"bun"},{path:"pnpm-lock.yaml",pm:"pnpm"},{path:"yarn.lock",pm:"yarn"},{path:"package-lock.json",pm:"npm"},{path:"package.json",pm:"bun"}],JYt={deno:["deno.json","deno.jsonc"],bun:["package.json"],pnpm:["package.json"],yarn:["package.json"],npm:["package.json"]},kaf=/(?:--port|PORT=|:)(\d{4,5})/});function zYt(i){if(i.explicit)return i.explicit;return i.flags?.sandbox_go_daemon?"go":"ts"}function rYt(i){let{current:u,detached:t,base:f}=i.status??{};if(typeof u!=="string"||u.length===0)return null;if(t===!0)return null;if(u===i.requestedRef)return null;if(jaf.has(u))return null;if(typeof f==="string"&&f.length>0&&u===f)return null;return u}function qYt(i){if(!i.branch.startsWith("thread:"))return i.branch;if(i.sticky&&i.recordedHeadRef)return i.recordedHeadRef;return i.derivedRef}var jaf;var v_u=v(()=>{jaf=new Set(["main","master","trunk","develop","HEAD"])});async function H7i(i,u){if(!i)return{hosts:[],allowSameHostDev:!1};let t;try{t=await i.presignedGetUrl("link-dispatch/_allowlist_probe",60,{requireFetchable:!0})}catch{return{hosts:[],allowSameHostDev:!1}}let f;try{f=new URL(t)}catch{return{hosts:[],allowSameHostDev:!1}}if(f.protocol!=="https:"&&f.protocol!=="http:")return{hosts:[],allowSameHostDev:!1};let l=f.hostname,E=Kaf.has(l);return{hosts:[l],allowSameHostDev:E&&!u.isProduction}}var Kaf;var N_u=v(()=>{Kaf=new Set(["127.0.0.1","localhost","::1","[::1]","0.0.0.0"])});import{z as K3}from"zod";async function X7i(i,u){$i(u);let t=Si(u),f=Cu(u);if(!f)throw Error("User ID required");let l=await u.storage.virtualMcps.findById(i.virtualMcpId);if(!l||l.organization_id!==t.id)throw Error("Virtual MCP not found");let E=l.metadata??{},c=await wN(u,i.branch,f),_=a$(oE(E),c,i.branch,i.sandboxProviderKind),T=i.sandboxProviderKind,{provider:d}=await Xh(u,{userId:c,branch:i.branch,virtualMcpMetadata:E,explicitKind:T});if(_){if(T!=="user-desktop")return _;if(await d.alive(_.sandboxHandle).catch(()=>!1))return _;await o$(u.storage.virtualMcps,i.virtualMcpId,f,c,i.branch,T).catch((D)=>{console.warn("[ensureSandbox] failed to reap stale user-desktop entry",D)})}let n=await ds(u,A5(i.branch)??u.metadata?.threadId)??E.githubRepo??null,{entry:h}=await VYt({ctx:u,userId:f,sandboxUserId:c,orgId:t.id,virtualMcpId:i.virtualMcpId,branch:i.branch,metadata:E,githubRepo:n,existing:null,providerKind:T,runner:d});return h}async function VYt(i){let{ctx:u,userId:t,sandboxUserId:f,orgId:l,virtualMcpId:E,branch:c,metadata:_,githubRepo:T,existing:d,runner:w}=i,{runtime:n,packageManager:h,port:A,packageManagerPath:D}=j7i(_),N;if(T){if(T.connectionId)await gW({ctx:u,connectionId:T.connectionId,organizationId:l,forceRefresh:!0,onLegacyMintError:(yi)=>{console.error("[provisionSandbox] repo-scoped legacy token mint failed",{connectionId:T.connectionId,error:yi.message})}});let{cloneUrl:di,gitUserName:ci,gitUserEmail:ii}=T.connectionId?await s$(T.connectionId,T.owner,T.name,u.db,u.vault):_Ai(T.owner,T.name);if(!h){let yi=T.connectionId?await WYt(T.connectionId,T.owner,T.name,u.db,u.vault):await bYt(T.owner,T.name);if(yi)h=yi.packageManager,n=Ts[yi.packageManager].runtime,A=yi.devPort??A,await Xaf(u,E,t,yi.packageManager,yi.devPort)}let m=_u().sandboxStickyHeadRefEnabled,Di=qYt({branch:c,derivedRef:C7i(c),recordedHeadRef:m?await FYt(u,A5(c)):null,sticky:m}),_i=await KYt({ctx:u,orgId:l,userId:t,entries:CYt(_)});N={cloneUrl:di,...T.connectionId?{connectionId:T.connectionId}:{},userName:ci,userEmail:ii,branch:Di,displayName:`${T.owner}/${T.name}`,..._i.length>0?{submoduleCredentials:_i}:{}}}let S=n&&h?{runtime:n,packageManager:h,...A!==null?{devPort:Number(A)}:{},...D?{packageManagerPath:D}:{}}:void 0,O=W8({orgId:l,virtualMcpId:E,branch:c}),$=w.kind==="user-desktop"?await H7i(u.objectStorage,{isProduction:_u().nodeEnv==="production"}):null,P=(w.kind==="user-desktop"||w.kind==="agent-sandbox")&&!_u().orgFsMountsDisabled,g;if(P){let di=u.organization?.slug??(await u.db.selectFrom("organization").select(["slug"]).where("id","=",l).executeTakeFirst())?.slug;if(di)g=await wni(u,{orgSlug:di,orgId:l,baseUrl:$c()})}let U=w.kind==="agent-sandbox"?zYt({explicit:i.daemonImpl,flags:i.daemonImpl?null:(await u.storage.organizationSettings.get(l))?.flags??null}):void 0,x=await w.ensure({userId:f,projectRef:O},{branch:c,repo:N,workload:S,tenant:{orgId:l,userId:f,...u.organization?.slug?{orgSlug:u.organization.slug}:{},...u.organization?.name?{orgName:u.organization.name}:{},...u.auth.user?.email?{userEmail:u.auth.user.email}:{},...u.auth.user?.name?{userName:u.auth.user.name}:{}},...$?{offloadAllowedHosts:$.hosts,offloadAllowSameHostDev:$.allowSameHostDev}:{},...g?{orgFsConfigJson:g}:{},...U?{daemonImpl:U}:{}}),F=_.runtime?.env??null;await K7i({ctx:u,runner:w,handle:x.handle,orgId:l,userId:t,entries:F});let L=!!d&&d.sandboxHandle===x.handle&&d?.createdAt?d.createdAt:Date.now(),M=_.runtime?.selected??null,k=_.runtime?.port??null,K=_.runtime?.path??null,q={sandboxHandle:x.handle,previewUrl:x.previewUrl,sandboxApiUrl:x.previewUrl,sandboxProviderKind:w.kind,createdAt:L,startedWith:{packageManager:M,port:k,path:K}};await hRt(u.storage.virtualMcps,E,t,f,c,i.providerKind,q);let H=A5(c);if(H)await ZYt(u,H,f,c,i.providerKind,q);let fi=!d||d.sandboxHandle!==x.handle;return{entry:q,isNewVm:fi}}async function Xaf(i,u,t,f,l){let E=await i.storage.virtualMcps.findById(u);if(!E)return;let c=E.metadata??{};await i.storage.virtualMcps.update(u,t,{metadata:{...c,runtime:{selected:f,port:l}}})}var Haf,S_u;var J7i=v(()=>{Vw();uu();JW();D_u();HYt();Zd();Ho();MYt();A_u();HW();D5();v_u();N_u();jt();q4();mJ();Zd();Haf=K3.enum(["agent-sandbox","user-desktop","cluster"]),S_u=p({name:"SANDBOX_START",description:"Start a sandbox with the connected GitHub repo and dev server.",annotations:{title:"Start VM Preview",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!1,openWorldHint:!0},_meta:{ui:{visibility:"app"}},inputSchema:K3.object({virtualMcpId:K3.string().describe("Virtual MCP ID"),branch:K3.string().min(1).optional().describe("Git branch to check out. Pass the thread's branch whenever the caller has one: when omitted the handler mints a fresh `<user-slug>-<timestamp>` name, which becomes a SEPARATE sandbox from the one the thread's own branch resolves to. The resolved branch is returned in the response so callers can persist it."),sandboxProviderKind:Haf.optional().describe("Explicit runtime choice. Hosted provider is `agent-sandbox`; legacy `cluster` input is accepted only for compatibility and normalized to `agent-sandbox`. When omitted, defaults to `user-desktop` if the acting user's link daemon is online, else the env kind."),daemonImpl:j4u.optional().describe("Target this one sandbox at a specific sandbox daemon implementation, overriding the org's `sandbox_go_daemon` flag in either direction. Only honored on `agent-sandbox`, and only when the deployment configures a Go SandboxTemplate; otherwise the sandbox lands on `ts`. Applies to a sandbox being created \u2014 an existing sandbox keeps the binary it booted with.")}),outputSchema:K3.object({previewUrl:K3.string().nullable(),sandboxHandle:K3.string(),branch:K3.string(),isNewVm:K3.boolean(),sandboxProviderKind:K3.enum(["agent-sandbox","user-desktop"])}),handler:async(i,u)=>{$i(u);let t=Si(u);await u.access.check();let f=i.branch??Whi(Jhi(u.auth.user)),l=Cu(u);if(!l)throw Error("User ID required");let E=await wN(u,f,l),c=await u.storage.virtualMcps.findById(i.virtualMcpId);if(!c||c.organization_id!==t.id)throw Error("Virtual MCP not found");let _=c.metadata??{},T=i.sandboxProviderKind?uN(i.sandboxProviderKind):void 0,{provider:d,kind:w}=await Xh(u,{userId:E,branch:f,virtualMcpMetadata:_,explicitKind:T}),n=a$(oE(_),E,f,w),A=await ds(u,A5(f)??u.metadata?.threadId)??_.githubRepo??null,{entry:D,isNewVm:N}=await VYt({ctx:u,userId:l,sandboxUserId:E,orgId:t.id,virtualMcpId:i.virtualMcpId,branch:f,metadata:_,githubRepo:A,existing:n,providerKind:w,runner:d,daemonImpl:i.daemonImpl});return{...D,branch:f,isNewVm:N,sandboxProviderKind:w}}})});async function Jaf(i,u,t,f){try{let l=i.organization;if(!l)return;let E=await EAi(i,f.virtualMcpId,l,"tool-scripting",f.providerKind),c=await u.proxyDaemonRequest(t,"/_sandbox/tools/sync",{method:"POST",headers:new Headers({"content-type":"application/json"}),body:JSON.stringify(E)});if(!c.ok)console.warn("[cluster-sandbox-fs] tools/sync failed",c.status,await c.text().catch(()=>""))}catch(l){console.warn("[cluster-sandbox-fs] tools/sync failed",l)}}async function WW(i,u){let{provider:t,kind:f}=await Xh(i,{userId:u.userId,branch:u.branch,virtualMcpMetadata:null}),l=null,E=()=>{if(!l){if(l=X7i({virtualMcpId:u.virtualMcpId,branch:u.branch,sandboxProviderKind:f},i).then((T)=>T.sandboxHandle),l.catch(()=>{l=null}),u.syncTools)l.then((T)=>Jaf(i,t,T,{virtualMcpId:u.virtualMcpId,providerKind:f})).catch(()=>{})}return l},c=u.branch==="ephemeral"||f==="user-desktop";return J4u(t,{ensureHandle:E,invalidateHandle:async(T)=>{let d=l;if(l=null,!c&&!T?.force)return;try{await o$(i.storage.virtualMcps,u.virtualMcpId,u.userId,u.userId,u.branch,f)}catch(w){console.warn("[cluster-sandbox-fs] failed to reap vmMap entry",w)}if(d&&typeof t.forgetHandle==="function")try{let w=await d;await t.forgetHandle(w)}catch(w){console.warn("[cluster-sandbox-fs] forgetHandle failed",w)}},canAutoRestart:c})}async function mYt(i,u){try{let t=await WW(i,u),{stdout:f}=await t.onBash("test -d .deco && echo __DECO_SITE__");return f.includes("__DECO_SITE__")}catch(t){return console.warn("[cluster-sandbox-fs] .deco probe failed; assuming deco site",t),!0}}var W7i=v(()=>{Vw();a4u();HW();J7i();Zd()});function bW(i){let u=i.toISOString();return`<current-context>
+`))>=0){let T=f.slice(0,_).trim();if(f=f.slice(_+1),!T)continue;yield JSON.parse(T)}}let l=f.trim();if(l)yield JSON.parse(l)}finally{u.releaseLock()}}var VCt,mCt,oCt="gateway.networking.k8s.io",sCt="v1",pCt="httproutes",Lef,cs,uYt="mesh-sandbox-runner";var R7i=v(()=>{Nl();fs();VCt=class VCt extends Error{status;body;constructor(i,u,t){super(t);this.status=i;this.body=u;this.name="KubeHttpError"}};mCt=`/apis/${b4.CLAIM_API_GROUP}/${b4.CLAIM_API_VERSION}/namespaces`;Lef=`/apis/${oCt}/${sCt}/namespaces`;cs={API_GROUP:oCt,API_VERSION:sCt,PLURAL:pCt}});async function*EYt(i){let u=i.now??(()=>Date.now()),t=u(),f=i.schedulingTimeoutMs??kef,l={pod:{},sandbox:{},events:{hasPulling:!1,hasPulled:!1},startedAt:t},E=[],c=null,_=!1,T=($)=>{if(_)return;if(c){let P=c;c=null,P($)}else E.push($)},d=()=>{if(E.length>0)return Promise.resolve(E.shift());if(_)return Promise.resolve(null);return new Promise(($)=>{c=$})},w=()=>{if(_)return;if(_=!0,c){let $=c;c=null,$(null)}},n=new AbortController,h=()=>{n.abort(),w()};if(i.signal)if(i.signal.aborted)n.abort(),w();else i.signal.addEventListener("abort",h,{once:!0});let A=Math.max(0,f-(u()-t)),D=setTimeout(()=>T("tick"),A+100),N,S=new Promise(($)=>{N=$}),O=Promise.allSettled([Cef(i.kc,i.namespace,i.claimName,n.signal,l,T,u,N),jef(i.kc,i.namespace,i.claimName,n.signal,l,T),Kef(i.kc,i.namespace,i.claimName,S,n.signal,l,T,u)]);try{let $=null,P=-1,g=fYt(l,f,u);if($=pcu(g),!scu(g))P=lYt(g);if(yield g,scu(g))return;while(!_){if(await d()===null)break;let x=fYt(l,f,u);if(scu(x)){let L=pcu(x);if(L!==$)$=L,yield x;return}let F=lYt(x);if(F<P)continue;let y=pcu(x);if(y!==$)$=y,P=F,yield x}}finally{if(clearTimeout(D),n.abort(),i.signal)i.signal.removeEventListener("abort",h);w(),await O.catch(()=>{})}}function fYt(i,u,t){let{pod:f,sandbox:l,events:E,startedAt:c}=i;if(l.ready)return{kind:"ready"};let _=f.containerWaitingReason;if(_==="ImagePullBackOff"||_==="ErrImagePull")return{kind:"failed",reason:"image-pull-backoff",message:"Sandbox image failed to download. The cluster may be missing pull credentials or the image tag may not exist."};if(_==="CrashLoopBackOff")return{kind:"failed",reason:"crash-loop-backoff",message:"Sandbox crashed during startup and is now in CrashLoopBackOff. Check pod logs."};if(!f.scheduled&&E.lastFailedSchedulingAt!==void 0&&t()-c>u)return{kind:"failed",reason:"scheduling-timeout",message:E.failedSchedulingMessage??`Pod could not be scheduled within ${Math.round(u/1000)}s.`};if(f.containerRunning&&!f.containerReady)return{kind:"warming-daemon",since:c};if(E.hasPulling&&!E.hasPulled)return{kind:"pulling-image",since:c};if(_==="ContainerCreating"||_==="PodInitializing"||f.scheduled&&!f.containerRunning)return{kind:"starting-container",since:c};if(f.scheduledFalseReason==="Unschedulable"||E.lastFailedSchedulingAt!==void 0&&!f.scheduled)return{kind:"waiting-for-capacity",since:c,message:E.failedSchedulingMessage??f.scheduledFalseMessage,nodeClaim:E.nominatedNodeClaim};return{kind:"claiming",since:c}}function scu(i){return i.kind==="ready"||i.kind==="failed"}function lYt(i){switch(i.kind){case"claiming":return 0;case"waiting-for-capacity":return 1;case"pulling-image":return 2;case"starting-container":return 3;case"warming-daemon":return 4;case"ready":case"failed":return 99}}function pcu(i){switch(i.kind){case"claiming":case"pulling-image":case"starting-container":case"warming-daemon":return i.kind;case"waiting-for-capacity":return`waiting-for-capacity:${i.message??""}:${i.nodeClaim??""}`;case"ready":return"ready";case"failed":return`failed:${i.reason}:${i.message}`}}async function Cef(i,u,t,f,l,E,c,_){let T=`/api/v1/namespaces/${encodeURIComponent(u)}/pods?watch=true&labelSelector=${encodeURIComponent(`${Zef}=${t}`)}`;return F7i({kc:i,path:T,signal:f,label:`pod/${t}`,onEvent:(d)=>{if(d.type!=="ADDED"&&d.type!=="MODIFIED")return;let w=d.object;if(w.metadata?.name)_(w.metadata.name);Yef(w,l,c),E("pod")}})}function Yef(i,u,t){let l=(i.status?.conditions??[]).find((c)=>c.type==="PodScheduled");if(l?.status==="True")u.pod.scheduled=!0,u.pod.scheduledFalseReason=void 0,u.pod.scheduledFalseMessage=void 0;else if(l?.status==="False")u.pod.scheduled=!1,u.pod.scheduledFalseReason=l.reason,u.pod.scheduledFalseMessage=l.message;let E=(i.status?.containerStatuses??[]).find((c)=>c.name===Gef);if(E)u.pod.containerWaitingReason=E.state?.waiting?.reason,u.pod.containerRunning=!!E.state?.running,u.pod.containerReady=E.ready===!0}async function jef(i,u,t,f,l,E){let c=`/apis/${b4.CLAIM_API_GROUP}/${b4.CLAIM_API_VERSION}/namespaces/${encodeURIComponent(u)}/${b4.CLAIM_PLURAL}?watch=true&fieldSelector=${encodeURIComponent(`metadata.name=${t}`)}`;return F7i({kc:i,path:c,signal:f,label:`sandboxclaim/${t}`,onEvent:(_)=>{if(_.type!=="ADDED"&&_.type!=="MODIFIED")return;let d=_.object.status?.conditions?.find((w)=>w.type==="Ready");if(!d)return;if(d.status==="True")l.sandbox.ready=!0,l.sandbox.notReadyReason=void 0,l.sandbox.notReadyMessage=void 0;else l.sandbox.ready=!1,l.sandbox.notReadyReason=d.reason,l.sandbox.notReadyMessage=d.message;E("sandbox")}})}async function Kef(i,u,t,f,l,E,c,_){let T=await Promise.race([f,new Promise((w)=>{if(l.aborted){w(t);return}l.addEventListener("abort",()=>w(t),{once:!0})})]);if(l.aborted)return;let d=`/api/v1/namespaces/${encodeURIComponent(u)}/events?watch=true&fieldSelector=${encodeURIComponent(`involvedObject.name=${T},involvedObject.kind=Pod`)}`;return F7i({kc:i,path:d,signal:l,label:`events/${t}`,onEvent:(w)=>{if(w.type!=="ADDED"&&w.type!=="MODIFIED")return;let n=w.object,h=n.reason;if(!h)return;switch(h){case"Pulling":E.events.hasPulling=!0;break;case"Pulled":E.events.hasPulling=!0,E.events.hasPulled=!0;break;case"FailedScheduling":E.events.lastFailedSchedulingAt=_(),E.events.failedSchedulingMessage=n.message;break;case"Nominated":{let A=n.message?.match(/nodeclaim\/([\w-]+)/);if(A)E.events.nominatedNodeClaim=A[1];break}default:return}c("event")}})}async function cYt(i){let{kc:u,namespace:t,labelSelector:f,signal:l,onDelete:E}=i,c=`/apis/${b4.CLAIM_API_GROUP}/${b4.CLAIM_API_VERSION}/namespaces/${encodeURIComponent(t)}/${b4.CLAIM_PLURAL}?watch=true&labelSelector=${encodeURIComponent(f)}`;return F7i({kc:u,path:c,signal:l,label:"sandboxclaim-reaper",onEvent:(_)=>{if(_.type!=="DELETED")return;let T=_.object.metadata?.name;if(T)E(T)}})}async function F7i(i){let{kc:u,path:t,signal:f,label:l,onEvent:E}=i,c=0;while(!f.aborted){try{let T=await OC(u,{method:"GET",path:t,signal:f,headers:{accept:"application/json"},stream:!0});if(!T.ok||!T.body){try{await T.body?.cancel()}catch{}if(T.status===401||T.status===403){console.warn(`[lifecycle-watcher] ${l} stopped: watch denied (${T.status} ${T.statusText}). `+"The kubeconfig in use cannot watch SandboxClaims \u2014 if you are running locally, "+"this provider should not be active (check STUDIO_SANDBOX_PROVIDER / your sandbox preference).");return}throw Error(`watch handshake failed: ${T.status} ${T.statusText}`)}c=0;for await(let d of ocu(T.body)){if(f.aborted)return;try{E(d)}catch(w){console.warn(`[lifecycle-watcher] ${l} onEvent threw: ${w instanceof Error?w.message:String(w)}`)}}}catch(T){if(f.aborted)return;let d=T instanceof Error?T.message:String(T);console.warn(`[lifecycle-watcher] ${l} watch ended: ${d}`)}if(f.aborted)return;let _=wc(5000,250,c,2,0);c+=1,await yt(_,{signal:f}).catch(()=>{})}}var Zef="studio.decocms.com/sandbox-handle",Gef="sandbox",kef=300000;var _Yt=v(()=>{Nl();fs();R7i()});async function TYt(i,u,t){let f=new Map;for(let l of i){let E=u(l);if(!E)continue;let c=f.get(E);if(c)c.push(l);else f.set(E,[l])}await Promise.allSettled([...f.values()].map(async(l)=>{for(let E of l)await t(E).catch(()=>{})}))}import{createHash as Hef,randomBytes as Xef,randomUUID as Jef}from"crypto";import*as AYt from"net";import{PassThrough as Wef}from"stream";function bef(i){if(i instanceof Error)return i.message;if(i&&typeof i==="object"){let u=i;if(u.error instanceof Error)return u.error.message;if(typeof u.message==="string"&&u.message)return u.message}return String(i)}class E_u{kind=Z6;records=new Map;inflight=new Mhi;stateStore;previewUrlPattern;kubeConfig;portForward;namespace;sandboxTemplateName;goSandboxTemplateName;envName;tokenGenerator;idleTtlMs;metrics;previewGateway;sentinelToken;mintCloneUrl;closed=!1;claimWatchAbort=new AbortController;constructor(i={}){this.stateStore=i.stateStore??null,this.previewUrlPattern=i.previewUrlPattern??null,this.kubeConfig=i.kubeConfig??pef(),this.portForward=new Lcu(this.kubeConfig),this.namespace=i.namespace??Qef,this.sandboxTemplateName=i.sandboxTemplateName??Mef;let u=i.goSandboxTemplateName?.trim()??"";this.goSandboxTemplateName=u.length>0?u:null,this.envName=Eaf(i.envName),this.tokenGenerator=i.tokenGenerator??(()=>Xef(ref).toString("hex")),this.idleTtlMs=i.idleTtlMs??Vef,this.metrics=i.meter?sef(i.meter):null,this.previewGateway=i.previewGateway&&i.previewUrlPattern?{...i.previewGateway}:null;let t=i.sentinelToken?.trim()??"";this.sentinelToken=t.length>0?t:null,this.mintCloneUrl=i.mintCloneUrl,this.startClaimReaper(),this.startCredentialRefresher()}startClaimReaper(){let i=["app.kubernetes.io/managed-by=studio","app.kubernetes.io/name=studio-sandbox",...this.envName?[`${xT.env}=${this.envName}`]:[]].join(",");cYt({kc:this.kubeConfig,namespace:this.namespace,labelSelector:i,signal:this.claimWatchAbort.signal,onDelete:(u)=>this.invalidateRecord(u)})}async ensure(i,u={}){let t=m$(i,u.branch??u.repo?.branch??null);return this.inflight.run(t,()=>zhi(this.stateStore,i,Z6,(f)=>this.ensureLocked(i,t,u,f)))}async delete(i){let u=await this.getRecord(i);if(this.records.delete(i),u)this.closeForwarder(u.daemonForward),this.metrics?.active.add(-1,f_u(u.tenant,u.daemonImpl));if(await this.deleteHttpRouteIfManaged(i).catch((t)=>{console.warn(`[${Q4}] HTTPRoute delete failed for ${i}: ${t instanceof Error?t.message:String(t)}`)}),await d5(this.kubeConfig,this.namespace,i),this.stateStore)if(u)await this.stateStore.delete(u.id,Z6);else await this.stateStore.deleteByHandle(Z6,i)}async alive(i){return await dN(this.kubeConfig,this.namespace,i)!==void 0}watchClaimLifecycle(i,u){return EYt({kc:this.kubeConfig,namespace:this.namespace,claimName:i,signal:u})}async getPreviewUrl(i){let u=await this.getRecord(i);if(!u)return null;return this.composePreviewUrl(u)}async proxyDaemonRequest(i,u,t){let f=await this.getRecord(i);if(!f&&this.previewUrlPattern&&this.stateStore){let T=await this.stateStore.getByHandle(Z6,i),d=T?.state,w=d?.token;if(T&&w){let h=`http://${d?.adoptedSandboxName??i}.${this.namespace}.svc.cluster.local:${w5}`;try{let A=await tr(h,w,u,t);if(A.status!==404)return A;try{await A.body?.cancel()}catch{}}catch{}}}if(!f)f=await this.resurrectByHandle(i);if(!f)return new Response(JSON.stringify({error:"sandbox not found"}),{status:404,headers:{"content-type":"application/json"}});let l=f,E=performance.now(),c=0,_=!(t.body instanceof ReadableStream);try{let T=await tr(f.daemonUrl,f.token,u,t);if(T.status===401&&_){this.invalidateRecord(i);let d=await this.getRecord(i).catch(()=>null)??await this.resurrectByHandle(i).catch(()=>null);if(d)l=d,T=await tr(d.daemonUrl,d.token,u,t)}return c=T.status,T}catch(T){if(!_)throw T;this.invalidateRecord(i);let d=await this.resurrectByHandle(i)??await this.getRecord(i).catch(()=>null);if(!d)throw T;l=d;let w=await tr(d.daemonUrl,d.token,u,t);return c=w.status,w}finally{this.recordProxyDuration("daemon",c,l,performance.now()-E)}}async adoptLiveClaim(i,u){if(this.records.has(u))return!0;let t=await dN(this.kubeConfig,this.namespace,u).catch(()=>{return});if(!t||t.metadata?.deletionTimestamp)return!1;return await this.inflight.run(u,async()=>{let l=this.records.get(u);if(l)return this.toSandbox(l);let E=await this.adopt(i,u,t);if(!E)throw Error(`cannot adopt live claim ${u}`);return zhi(this.stateStore,i,Z6,(c)=>this.finish(E,c,!0,!0,"adopt"))}).catch(()=>null)!=null}async resolvePreviewUpstreamUrl(i){if(this.previewUrlPattern)return`http://${await this.resolveServiceNameForHandle(i)}.${this.namespace}.svc.cluster.local:${w5}`;let u=await this.getRecord(i);if(u)return u.daemonUrl;let t=await this.resurrectByHandle(i);return t?t.daemonUrl:null}async resolveServiceNameForHandle(i){let u=this.records.get(i);if(u)return u.adoptedSandboxName;if(this.stateStore){let f=(await this.stateStore.getByHandle(Z6,i).catch(()=>null))?.state?.adoptedSandboxName;if(f)return f}return i}async proxyPreviewRequest(i,u){let t=performance.now(),f=this.records.get(i)??null,l=0;try{let E=await this.resolvePreviewUpstreamUrl(i);if(!E){l=404;let D=u_u(404,{error:"sandbox not found"});return D.headers.set(PC,"1"),D}let c=new URL(u.url);if((c.pathname==="/_sandbox"||c.pathname.startsWith("/_sandbox/")||c.pathname==="/_decopilot_vm"||c.pathname.startsWith("/_decopilot_vm/"))&&u.method!=="GET")return l=404,u_u(404,{error:"not found"});let T=(D)=>`${D}${c.pathname}${c.search}`,d=new Headers(u.headers);for(let D of aef)d.delete(D);let w=u.method!=="GET"&&u.method!=="HEAD",n={method:u.method,headers:d,body:w?u.body:void 0,redirect:"manual",signal:u.signal,duplex:w?"half":void 0},h;try{h=await fetch(T(E),n)}catch(D){let N=`${E}${c.pathname}`;if(console.warn(`[${Q4}] preview fetch to ${N} failed: ${D instanceof Error?D.message:String(D)}`),u.method==="GET"||u.method==="HEAD"){if(this.invalidateRecord(i),await this.resurrectByHandle(i).catch(()=>null)){let $=await this.resolvePreviewUpstreamUrl(i);if($)try{h=await fetch(T($),n);let P=new Headers;for(let[g,U]of h.headers.entries())if(!dYt.includes(g.toLowerCase()))P.set(g,U);return l=h.status,new Response(h.body,{status:h.status,statusText:h.statusText,headers:P})}catch(P){console.warn(`[${Q4}] preview fetch retry to ${N} failed: ${P instanceof Error?P.message:String(P)}`)}}}else this.invalidateRecord(i);l=502;let S=u_u(502,{error:"sandbox daemon unreachable"});return S.headers.set(PC,"1"),S}let A=new Headers;for(let[D,N]of h.headers.entries())if(!dYt.includes(D.toLowerCase()))A.set(D,N);return l=h.status,new Response(h.body,{status:h.status,statusText:h.statusText,headers:A})}finally{this.recordProxyDuration("preview",l,f,performance.now()-t,i)}}async ensureLocked(i,u,t,f){if(t.image)console.warn(`[${Q4}] opts.image ignored (template ${this.sandboxTemplateName} pins image): got ${t.image}`);if(f){let c=await f.get(i,Z6);if(c){let _=await this.rehydrate(i,u,c);if(_)return await this.refreshDaemonGitCredential(_,t),this.finish(_,f,!1,!0,"resume");await f.delete(i,Z6)}}let l=await dN(this.kubeConfig,this.namespace,u).catch(()=>{return});if(l)if(l.metadata?.deletionTimestamp)await B7i(this.kubeConfig,this.namespace,u).catch((c)=>{console.warn(`[${Q4}] wait for terminating claim ${u} failed: ${c instanceof Error?c.message:String(c)}`)});else{let c=await this.adopt(i,u,l).catch((_)=>{return console.warn(`[${Q4}] adopt ${u} failed, recreating: ${_ instanceof Error?_.message:String(_)}`),null});if(c)return await this.refreshDaemonGitCredential(c,t),this.finish(c,f,!0,!0,"adopt");await d5(this.kubeConfig,this.namespace,u).catch(()=>{}),await B7i(this.kubeConfig,this.namespace,u).catch((_)=>{console.warn(`[${Q4}] wait for deleted claim ${u} failed: ${_ instanceof Error?_.message:String(_)}`)})}let E=await this.provision(i,u,t);return this.finish(E,f,!0,!1,"fresh")}async finish(i,u,t,f,l){let E=this.records.get(i.handle),c=E!==void 0;if(E&&E.daemonForward!==i.daemonForward)this.closeForwarder(E.daemonForward);if(this.records.set(i.handle,i),t)await this.persist(u,i);if(f)await eCt(this.kubeConfig,this.namespace,i.handle,this.computeShutdownTime()).catch((_)=>console.warn(`[${Q4}] TTL refresh failed for ${i.handle}: ${_ instanceof Error?_.message:String(_)}`));if(this.metrics){let _=f_u(i.tenant,i.daemonImpl);if(this.metrics.ensureOutcome.add(1,{..._,outcome:l}),!c)this.metrics.active.add(1,_)}return this.toSandbox(i)}buildEnvMap(i,u){let t={},f=[];for(let[l,E]of Object.entries(i.env??{}))if(qef.has(l))f.push(l);else t[l]=E;if(f.length>0)console.warn(`[${Q4}] opts.env keys overlap reserved bootstrap names and were dropped: ${f.join(",")}`);return{...t,DAEMON_TOKEN:u.token,DAEMON_BOOT_ID:u.daemonBootId,APP_ROOT:u.workdir,PROXY_PORT:String(w5)}}buildClaim(i,u,t){let f=this.sentinelToken!==null,l=f?[]:Object.entries(this.buildEnvMap(u,t)).sort(([d],[w])=>d<w?-1:d>w?1:0).map(([d,w])=>({name:d,value:w})),E=Taf(u),c=Object.keys(E).length>0,{impl:_,templateName:T}=nYt(u.daemonImpl,this.sandboxTemplateName,this.goSandboxTemplateName);if(u.daemonImpl==="go"&&_!=="go")console.warn(`[${Q4}] daemonImpl=go requested for ${i} but no Go SandboxTemplate is configured (STUDIO_SANDBOX_GO_TEMPLATE_NAME); landing on ts`);return{apiVersion:`${b4.CLAIM_API_GROUP}/${b4.CLAIM_API_VERSION}`,kind:"SandboxClaim",metadata:{name:i,namespace:this.namespace,labels:{"app.kubernetes.io/name":"studio-sandbox","app.kubernetes.io/managed-by":"studio",[xT.daemonImpl]:_,...this.envName?{[xT.env]:this.envName}:{},...t_u(u.tenant)},...c?{annotations:E}:{}},spec:{sandboxTemplateRef:{name:T},additionalPodMetadata:{labels:t_u(u.tenant,{[xT.role]:"claimed",[xT.sandboxHandle]:i,[xT.daemonImpl]:_,...this.envName?{[xT.env]:this.envName}:{}}),...c?{annotations:E}:{}},env:l,warmpool:f?"default":"none",lifecycle:{shutdownPolicy:"Delete",shutdownTime:this.computeShutdownTime()}}}}async provision(i,u,t){let f=this.tokenGenerator(),l=Jef(),E=i_u,{impl:c}=nYt(t.daemonImpl,this.sandboxTemplateName,this.goSandboxTemplateName),_=this.buildClaim(u,t,{token:f,daemonBootId:l,workdir:E});try{await Es(this.kubeConfig,this.namespace,_)}catch(A){if(A instanceof ts)await B7i(this.kubeConfig,this.namespace,u),await Es(this.kubeConfig,this.namespace,_);else throw A}let T;try{T=await aCt(this.kubeConfig,this.namespace,u),await y7i(this.kubeConfig,this.namespace,T)}catch(A){throw await d5(this.kubeConfig,this.namespace,u).catch(()=>{}),A}try{await this.ensureServicePortForAdoptedSandbox(T),await this.ensureHttpRouteForHandle(u,T,t.tenant??null)}catch(A){throw await d5(this.kubeConfig,this.namespace,u).catch(()=>{}),A}let d=await this.openForwarder(T,w5,u),w=`http://127.0.0.1:${d.localPort}`,n=this.workloadConfigPayload(t),h=l;try{if(await A4i(w),this.sentinelToken!==null){let A=await h4i(w);if(A)h=A.bootId;await GS(w,this.sentinelToken,n??{},{rotateToken:f})}else if(n)await GS(w,f,n);await this.relayOrgFsConfig(w,f,t.orgFsConfigJson)}catch(A){throw this.closeForwarder(d),await this.deleteHttpRouteIfManaged(u).catch(()=>{}),await d5(this.kubeConfig,this.namespace,u).catch(()=>{}),A}return{id:i,handle:u,adoptedSandboxName:T,token:f,workdir:E,daemonUrl:w,daemonForward:d,workload:t.workload??null,daemonBootId:h,tenant:t.tenant??null,daemonImpl:c,ensureOpts:naf({...t,daemonImpl:c})}}workloadConfigPayload(i){return H4u({runtime:i?.workload?.runtime??"node",packageManager:i?.workload?.packageManager?{name:i.workload.packageManager,...i.workload.packageManagerPath?{path:i.workload.packageManagerPath}:{}}:null,repo:i?.repo??null,port:i?.workload?.devPort??zef,tenant:i?.tenant??void 0})}async relayOrgFsConfig(i,u,t){if(!t)return;await dru(i,u,t).catch((f)=>console.warn("[org-fs] sidecar config relay failed",f))}async refreshDaemonGitCredential(i,u){let t=X4u(u);if(!t)return;try{await GS(i.daemonUrl,i.token,t)}catch(f){console.warn(`[${Q4}] git credential refresh failed for ${i.handle}: ${f instanceof Error?f.message:String(f)}`)}}async withFreshCloneUrl(i,u){if(!this.mintCloneUrl)return i;try{let t=await this.mintCloneUrl(i,u!==void 0?{bufferMs:u}:void 0);return t?{...i,cloneUrl:t}:i}catch(t){return console.warn(`[${Q4}] clone credential re-mint failed: ${t instanceof Error?t.message:String(t)}`),i}}startCredentialRefresher(){if(!this.mintCloneUrl)return;let{signal:i}=this.claimWatchAbort;(async()=>{while(!i.aborted){if(await yt(mef,{signal:i}).catch(()=>{}),i.aborted)break;try{await this.refreshAllGitCredentials()}catch(u){console.warn(`[${Q4}] periodic credential refresh failed: ${u instanceof Error?u.message:String(u)}`)}}})()}async refreshAllGitCredentials(){await TYt(this.records.values(),(i)=>i.ensureOpts?.repo?.connectionId,async(i)=>{if(this.claimWatchAbort.signal.aborted)return;let u=i.ensureOpts?.repo;if(!u)return;let t=await this.withFreshCloneUrl(u,eef);await this.refreshDaemonGitCredential(i,{...i.ensureOpts,repo:t}),i.ensureOpts={...i.ensureOpts,repo:t}})}async rebootstrapDaemon(i,u,t){if(this.sentinelToken===null)return!1;let f=this.workloadConfigPayload(t)??{};try{return await GS(i,this.sentinelToken,f,{rotateToken:u}),await this.relayOrgFsConfig(i,u,t?.orgFsConfigJson),!0}catch(l){if(l instanceof n4i&&l.status===401)try{return await GS(i,u,f,{rotateToken:u}),await this.relayOrgFsConfig(i,u,t?.orgFsConfigJson),!0}catch(E){return console.warn(`[${Q4}] re-bootstrap retry with claim token failed: ${E instanceof Error?E.message:String(E)}`),!1}return console.warn(`[${Q4}] re-bootstrap failed: ${l instanceof Error?l.message:String(l)}`),!1}}async ensureServicePortForAdoptedSandbox(i){if(!this.previewGateway||!this.previewUrlPattern)return;await tYt(this.kubeConfig,this.namespace,i,{name:"daemon",port:w5,targetPort:w5})}async ensureHttpRouteForHandle(i,u,t){if(!this.previewGateway||!this.previewUrlPattern)return;let f=haf(this.previewUrlPattern,i);if(!f)throw new f1(`Unable to derive preview hostname for ${i} from pattern: ${this.previewUrlPattern}`);let l={apiVersion:`${cs.API_GROUP}/${cs.API_VERSION}`,kind:"HTTPRoute",metadata:{name:i,namespace:this.namespace,labels:t_u(t??void 0,{[xT.role]:"claimed",[xT.sandboxHandle]:i,"app.kubernetes.io/name":"studio-sandbox","app.kubernetes.io/managed-by":"studio",...this.envName?{[xT.env]:this.envName}:{}})},spec:{parentRefs:[{kind:"Gateway",group:"gateway.networking.k8s.io",name:this.previewGateway.name,namespace:this.previewGateway.namespace}],hostnames:[f],rules:[{backendRefs:[{group:"",kind:"Service",name:u,port:w5}]}]}};await I7i(this.kubeConfig,this.namespace,l)}async deleteHttpRouteIfManaged(i){if(!this.previewGateway)return;await x7i(this.kubeConfig,this.namespace,i)}async rehydrate(i,u,t){let f=t.state;if(!f.adoptedSandboxName&&!f.podName||!f.token)return null;let l=await dN(this.kubeConfig,this.namespace,u).catch(()=>{return});if(!l||!wYt(l))return null;let E=l.status?.sandbox?.name??f.adoptedSandboxName??f.podName??u,c=await this.openAndProbeDaemon(E,u);if(!c)return null;if(f.daemonBootId&&f.daemonBootId!==c.bootId){if(this.sentinelToken!==null){let _=f.ensureOpts?.repo?{...f.ensureOpts,repo:await this.withFreshCloneUrl(f.ensureOpts.repo)}:f.ensureOpts??null;if(!await this.rebootstrapDaemon(c.daemonUrl,f.token,_))return this.closeForwarder(c.daemonForward),null}else console.warn(`[${Q4}] daemon restart detected (handle=${u}): stored bootId=${f.daemonBootId} live bootId=${c.bootId}`);await this.stateStore?.put(i,Z6,{handle:u,state:{...f,daemonBootId:c.bootId}}).catch((_)=>console.warn(`[${Q4}] bootId persist failed for ${u}: ${_ instanceof Error?_.message:String(_)}`))}return{id:i,handle:u,adoptedSandboxName:E,token:f.token,workdir:f.workdir??i_u,daemonUrl:c.daemonUrl,daemonForward:c.daemonForward,workload:f.workload??null,daemonBootId:c.bootId,tenant:f.tenant??null,ensureOpts:f.ensureOpts??null,daemonImpl:f.ensureOpts?.daemonImpl??null}}async adopt(i,u,t){if(!wYt(t))return null;let f=t.status?.sandbox?.name??u;if(this.sentinelToken!==null)return null;let l=iaf(t);if(!l)return null;let E=await this.openAndProbeDaemon(f,u);if(!E)return null;let c=daf(t);if(this.previewGateway)await this.ensureServicePortForAdoptedSandbox(f).catch((_)=>{console.warn(`[${Q4}] Service port backfill failed for ${u}: ${_ instanceof Error?_.message:String(_)}`)}),await this.ensureHttpRouteForHandle(u,f,c).catch((_)=>{console.warn(`[${Q4}] HTTPRoute backfill failed for ${u}: ${_ instanceof Error?_.message:String(_)}`)});return{id:i,handle:u,adoptedSandboxName:f,token:l,workdir:i_u,daemonUrl:E.daemonUrl,daemonForward:E.daemonForward,workload:null,daemonBootId:E.bootId,tenant:c,ensureOpts:null,daemonImpl:waf(t)}}async openAndProbeDaemon(i,u){let t=await this.openForwarder(i,w5,u).catch(()=>null);if(!t)return null;let f=`http://127.0.0.1:${t.localPort}`,l=await h4i(f);if(!l)return this.closeForwarder(t),null;return{daemonForward:t,daemonUrl:f,bootId:l.bootId}}async getRecord(i){let u=this.records.get(i);if(u)return u;if(!this.stateStore)return null;let t=await this.stateStore.getByHandle(Z6,i);if(!t)return null;let f=await this.rehydrate(t.id,i,t);if(f)this.records.set(i,f);return f}async resurrectByHandle(i){if(!this.stateStore)return null;let u=await this.stateStore.getByHandle(Z6,i);if(!u)return null;let t=u.state.ensureOpts;if(!t)return null;let f=t.repo?{...t,repo:await this.withFreshCloneUrl(t.repo)}:t;return await this.ensure(u.id,f),this.records.get(i)??null}invalidateRecord(i){let u=this.records.get(i);if(!u)return;this.records.delete(i),this.closeForwarder(u.daemonForward)}recordProxyDuration(i,u,t,f,l){if(!this.metrics)return;this.metrics.proxyDurationMs.record(f,{...f_u(t?.tenant??null,t?.daemonImpl??null),source:i,sandbox_handle:t?.handle??l??"",status_code:u||0})}composePreviewUrl(i){if(this.previewUrlPattern)return rhi(this.previewUrlPattern,i.handle);return`http://127.0.0.1:${i.daemonForward.localPort}/`}toSandbox(i){return{handle:i.handle,workdir:i.workdir,previewUrl:this.composePreviewUrl(i)}}async persist(i,u){if(!i)return;let t={adoptedSandboxName:u.adoptedSandboxName,token:u.token,workdir:u.workdir,workload:u.workload,daemonBootId:u.daemonBootId,tenant:u.tenant,...u.ensureOpts?{ensureOpts:u.ensureOpts}:{}};await i.put(u.id,Z6,{handle:u.handle,state:t})}computeShutdownTime(){return new Date(Date.now()+this.idleTtlMs).toISOString()}openForwarder(i,u,t=i){let f=uaf(t,u);return new Promise((l,E)=>{let c=(_,T)=>{let d=AYt.createServer((w)=>this.handleForwardedConnection(w,i,u,t));d.once("error",(w)=>{if(w.code==="EADDRINUSE"&&T<oef){try{d.close()}catch{}let n=l_u+(_-l_u+1)%DYt;c(n,T+1);return}E(w)}),d.listen(_,"127.0.0.1",()=>{let w=d.address();if(!w||typeof w==="string"){d.close(),E(Error("port-forward listener failed to bind"));return}l({server:d,localPort:w.port})})};c(f,0)})}handleForwardedConnection(i,u,t,f){let l=new Wef,E=null,c=!1,_=()=>{if(c)return;if(c=!0,l.destroy(),E)try{E.close()}catch{}if(!i.destroyed)i.destroy()};i.pipe(l),i.on("error",_),i.on("close",_),this.portForward.portForward(this.namespace,u,[t],i,null,l).then((T)=>{let d=typeof T==="function"?T():T;if(!d){_();return}if(E=d,E.on("close",_),E.on("error",()=>{this.invalidateRecord(f),_()}),c)try{E.close()}catch{}}).catch((T)=>{console.warn(`[${Q4}] port-forward to ${u}:${t} failed: ${bef(T)}`),this.invalidateRecord(f),_()})}closeForwarder(i){i.server.close((u)=>{if(u)console.warn(`[${Q4}] port-forward close on :${i.localPort} errored: ${u instanceof Error?u.message:String(u)}`)})}close(){if(this.closed)return;this.closed=!0,this.claimWatchAbort.abort();for(let i of this.records.values())this.closeForwarder(i.daemonForward);this.records.clear()}}function sef(i){return{active:i.createUpDownCounter("studio.sandbox.active",{description:"Active sandbox count, by runner kind, owning org, and daemon impl. Cross-checks the cAdvisor-derived count from the cluster \u2014 divergence between the two indicates orphaned claims (studio deleted but K8s didn't reap) or unattributed pods.",unit:"{sandbox}"}),ensureOutcome:i.createCounter("studio.sandbox.ensure.outcome",{description:"Outcome of each ensure() call: fresh provision, resume from state-store after restart, or adopt of a cluster-side claim studio didn't know about. Cold-start ratio is the primary input for warm-pool sizing.",unit:"{call}"}),proxyDurationMs:i.createHistogram("studio.sandbox.proxy.duration_ms",{description:"Wall-clock latency of studio-mediated requests to the sandbox daemon: tool exec proxies (source=daemon) and preview iframe traffic (source=preview).",unit:"ms"})}}function pef(){let i=new kW;return i.loadFromDefault(),i}function wYt(i){return Boolean(i.status?.conditions?.some((u)=>u.type==="Ready"&&u.status==="True"))}function iaf(i){let u=i.spec?.env;if(!u)return null;for(let t of u)if(t.name==="DAEMON_TOKEN"&&t.value)return t.value;return null}function uaf(i,u){let t=Hef("sha256").update(`${i}:${u}`).digest();return l_u+t.readUInt32BE(0)%DYt}function u_u(i,u){return new Response(JSON.stringify(u),{status:i,headers:{"content-type":"application/json","access-control-allow-origin":"*"}})}function nYt(i,u,t){if(i==="go"&&t)return{impl:"go",templateName:t};return{impl:"ts",templateName:u}}function hYt(i){let u=i.slice(0,faf);return taf.test(u)?u:""}function Eaf(i){if(i===void 0)return null;let u=i.trim();if(u==="")return null;if(!laf.test(u))throw Error(`AgentSandboxProvider: envName=${JSON.stringify(u)} is not a valid DNS-label-safe environment name (lowercase alphanumeric or '-', starts with a letter, ends alphanumeric, \u226432 chars). Studio sets this from STUDIO_ENV; check the studio chart's configMap.`);return u}function t_u(i,u={}){let t={...u};if(i){let f=hYt(i.orgId),l=hYt(i.userId);if(f)t[xT.orgId]=f;if(l)t[xT.userId]=l}return t}function $C(i){let u="";for(let t of i){let f=t.codePointAt(0)??0;u+=f<32||f===127?" ":t}return u.slice(0,caf)}function _af(i){try{let u=new URL(i);return u.username="",u.password="",u.toString()}catch{return""}}function Taf(i){let u={},t=i.tenant;if(t?.orgSlug)u[Hh.orgSlug]=$C(t.orgSlug);if(t?.orgName)u[Hh.orgName]=$C(t.orgName);if(t?.userEmail)u[Hh.userEmail]=$C(t.userEmail);if(t?.userName)u[Hh.userName]=$C(t.userName);let f=i.repo;if(f){if(f.displayName)u[Hh.gitRepo]=$C(f.displayName);let l=_af(f.cloneUrl);if(l)u[Hh.gitRepoUrl]=$C(l);let E=i.branch??f.branch;if(E)u[Hh.gitBranch]=$C(E)}return u}function daf(i){let u=i.metadata?.labels;if(!u)return null;let t=u[xT.orgId],f=u[xT.userId];if(!t||!f)return null;let l=i.metadata?.annotations??{};return{orgId:t,userId:f,orgSlug:l[Hh.orgSlug],orgName:l[Hh.orgName],userEmail:l[Hh.userEmail],userName:l[Hh.userName]}}function waf(i){let u=i.metadata?.labels?.[xT.daemonImpl];return u==="go"||u==="ts"?u:null}function f_u(i,u){return{org_id:i?.orgId??"",user_id:i?.userId??"",runner_kind:Z6,daemon_impl:u??""}}function naf(i){let u={};if(i.repo)u.repo=i.repo;if(i.workload)u.workload=i.workload;if(i.env&&Object.keys(i.env).length>0)u.env=i.env;if(i.tenant)u.tenant=i.tenant;if(i.orgFsConfigJson)u.orgFsConfigJson=i.orgFsConfigJson;if(i.daemonImpl)u.daemonImpl=i.daemonImpl;return Object.keys(u).length>0?u:null}function haf(i,u){try{return new URL(rhi(i,u)).hostname||null}catch{return null}}var Z6="agent-sandbox",Q4="AgentSandboxProvider",PC="x-sandbox-preview-not-ready",Qef="agent-sandbox-system",Mef="studio-sandbox",w5=9000,zef=3000,i_u="/app",ref=32,qef,Vef=900000,mef=900000,eef=1800000,aef,dYt,l_u=40000,DYt=1e4,oef=256,xT,Hh,taf,faf=63,laf,caf=253;var vYt=v(()=>{Nl();rcu();jWi();qhi();R7i();fs();_Yt();qef=new Set(["DAEMON_TOKEN","DAEMON_BOOT_ID","APP_ROOT","PROXY_PORT"]),aef=["cookie","host","connection","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","accept-encoding","content-length","upgrade"],dYt=["connection","keep-alive","transfer-encoding","content-encoding","content-length"];xT={role:"studio.decocms.com/role",sandboxHandle:"studio.decocms.com/sandbox-handle",orgId:"studio.decocms.com/org-id",userId:"studio.decocms.com/user-id",env:"studio.decocms.com/env",daemonImpl:"studio.decocms.com/daemon-impl"};Hh={orgSlug:"studio.decocms.com/org-slug",orgName:"studio.decocms.com/org-name",userEmail:"studio.decocms.com/user-email",userName:"studio.decocms.com/user-name",gitRepo:"studio.decocms.com/git-repo",gitRepoUrl:"studio.decocms.com/git-repo-url",gitBranch:"studio.decocms.com/git-branch"},taf=/^([A-Za-z0-9]([-A-Za-z0-9_.]*[A-Za-z0-9])?)?$/;laf=/^[a-z]([a-z0-9-]{0,30}[a-z0-9])?$/});var NYt={};gi(NYt,{waitForSandboxReady:()=>y7i,getSandboxClaim:()=>dN,getHttpRoute:()=>iYt,deleteSandboxClaim:()=>d5,deleteHttpRoute:()=>x7i,createSandboxClaim:()=>Es,applyHttpRoute:()=>I7i,SandboxTimeoutError:()=>SC,SandboxError:()=>f1,PREVIEW_NOT_READY_HEADER:()=>PC,KubeConfig:()=>kW,K8S_CONSTANTS:()=>b4,HTTPROUTE_CONSTANTS:()=>cs,AgentSandboxProvider:()=>E_u});var c_u=v(()=>{rcu();fs();R7i();vYt()});class L7i{kind=n5;userSub;dispatch;stateStore;records=new Map;constructor(i){if(!i.userSub)throw Error("DesktopSandboxProvider requires userSub");if(!i.dispatch)throw Error("DesktopSandboxProvider requires dispatch");this.userSub=i.userSub,this.dispatch=i.dispatch,this.stateStore=i.stateStore??null}async ensure(i,u={}){let t=u.branch??u.repo?.branch,f=m$(i,t),l=this.records.get(f);if(l){if(await this.probeHealth(f))return this.toSandbox(l);if(this.records.delete(f),this.stateStore)await this.stateStore.deleteByHandle(n5,f).catch(()=>{})}else if(this.stateStore){let h=(await this.stateStore.getByHandle(n5,f))?.state,A=h?.sandboxApiUrl;if(A){if(await this.probeHealth(f)){let D={handle:f,sandboxApiUrl:A,previewUrl:h?.previewUrl??A};return this.records.set(f,D),this.toSandbox(D)}await this.stateStore.deleteByHandle(n5,f).catch(()=>{})}}let E=Un({userName:u.tenant?.userName,userEmail:u.tenant?.userEmail}),c=JSON.stringify({handle:f,repo:u.repo,branch:t,...u.workload?{workload:u.workload}:{},...E?{operator:E}:{},...u.offloadAllowedHosts?{offloadAllowedHosts:u.offloadAllowedHosts}:{},...u.offloadAllowSameHostDev!==void 0?{offloadAllowSameHostDev:u.offloadAllowSameHostDev}:{},...u.orgFsConfigJson?{orgFsConfigJson:u.orgFsConfigJson}:{}}),_=await this.dispatchJson("POST","/api/sandboxes",c),T=JSON.parse(_);if(typeof T.sandboxApiUrl!=="string")throw Error("desktop ensure: daemon did not return a sandboxApiUrl string");let d=typeof T.previewUrl==="string"?T.previewUrl:T.sandboxApiUrl,w={handle:f,sandboxApiUrl:T.sandboxApiUrl,previewUrl:d};if(this.records.set(f,w),this.stateStore)await this.stateStore.put(i,n5,{handle:f,state:{handle:f,sandboxApiUrl:T.sandboxApiUrl,previewUrl:d}});return this.toSandbox(w)}async proxyDaemonRequest(i,u,t){let f=u.startsWith("/")?u:`/${u}`,l=f.startsWith("/_sandbox/")?f.slice(9):f,E=`/_sandbox/${encodeURIComponent(i)}${l}`,c=new Headers(t.headers);for(let O of["host","cookie","connection","keep-alive","transfer-encoding","upgrade","authorization"])c.delete(O);let _={};c.forEach((O,$)=>{_[$]=O});let T;if(t.body!=null)T=await Daf(t.body);let w=this.dispatch(this.userSub,{method:t.method,path:E,headers:_,body:T},{signal:t.signal})[Symbol.asyncIterator](),n=Aaf(),h=200,A={"content-type":"application/octet-stream"},D=[];try{while(!0){let O=await w.next();if(O.done)break;let $=O.value;if($.headers){h=$.headers.status,A=$.headers.headers;break}if($.data!=null){let P=n.push($.data);if(P.length)D.push(P)}}}catch(O){let $=O instanceof Error?O.message:"dispatch error";return new Response(JSON.stringify({error:$}),{status:502,headers:{"content-type":"application/json"}})}let N=!1,S=new ReadableStream({async start(O){for(let $ of D)O.enqueue($)},async pull(O){try{while(!0){let $=await w.next();if(N)return;if($.done){let g=n.flush();if(g.length)O.enqueue(g);O.close();return}let P=$.value;if(P.data!=null){let g=n.push(P.data);if(g.length){O.enqueue(g);return}}}}catch($){if(!N)O.error($)}},cancel(){N=!0,w.return?.()}});return new Response(S,{status:h,headers:A})}async alive(i){return this.probeHealth(i)}async probeHealth(i){let u=new AbortController,t=setTimeout(()=>u.abort(),3000);try{return await this.dispatchJson("GET",`/api/sandboxes/${encodeURIComponent(i)}`,void 0,u.signal),!0}catch{return!1}finally{clearTimeout(t)}}async forgetHandle(i){if(this.records.delete(i),this.stateStore)await this.stateStore.deleteByHandle(n5,i).catch(()=>{})}async delete(i){if(this.records.delete(i),this.stateStore)await this.stateStore.deleteByHandle(n5,i).catch(()=>{});try{await this.dispatchJson("DELETE",`/api/sandboxes/${encodeURIComponent(i)}`)}catch(u){if(!(u instanceof Error?u.message:String(u)).includes("404"))throw u}}async getPreviewUrl(i){return(await this.resolveRecord(i))?.previewUrl??null}async localWorkdir(i){return null}async*watchClaimLifecycle(i,u){yield{kind:"ready"}}toSandbox(i){return{handle:i.handle,workdir:i.sandboxApiUrl,previewUrl:i.previewUrl}}async resolveRecord(i){let u=this.records.get(i);if(u)return u;if(!this.stateStore)return null;let f=(await this.stateStore.getByHandle(n5,i))?.state,l=f?.sandboxApiUrl;if(!l)return null;let E={handle:i,sandboxApiUrl:l,previewUrl:f?.previewUrl??l};return this.records.set(i,E),E}async dispatchJson(i,u,t,f){let l={accept:"application/json"};if(t!==void 0)l["content-type"]="application/json";let E=this.dispatch(this.userSub,{method:i,path:u,headers:l,body:t},{signal:f}),c=null,_="";for await(let d of E)if(d.headers)c=d.headers.status;else if(d.data!=null)_+=d.data;let T=Buffer.from(_,"base64").toString("utf8");if(c!=null&&(c<200||c>=300))throw Error(`daemon returned ${c}: ${T}`);return T}}function SYt(i){return new L7i(i)}function Aaf(){let i="";return{push(u){if(u.length===0)return __u;i+=u;let t=i.length-i.length%4;if(t===0)return __u;let f=i.slice(0,t);return i=i.slice(t),new Uint8Array(Buffer.from(f,"base64"))},flush(){if(i.length===0)return __u;let u=i;return i="",new Uint8Array(Buffer.from(u,"base64"))}}}async function Daf(i){if(typeof i==="string")return i;if(i instanceof ArrayBuffer)return Buffer.from(i).toString("utf8");if(ArrayBuffer.isView(i))return Buffer.from(i.buffer,i.byteOffset,i.byteLength).toString("utf8");if(i instanceof URLSearchParams)return i.toString();return await new Response(i).text()}var n5="user-desktop",__u;var OYt=v(()=>{qhi();w4i();__u=new Uint8Array(0)});var $Yt={};gi($Yt,{createDesktopProvider:()=>SYt,DesktopSandboxProvider:()=>L7i});var PYt=v(()=>{OYt()});var yYt={};gi(yYt,{subscribeLifecycle:()=>w_u,getSandboxProviderByKind:()=>d_u,getOrInitSharedRunner:()=>Baf,buildDesktopProvider:()=>Z7i,__resetSharedLifecyclesForTesting:()=>Faf});function IYt(i,u){let t=gYt[i];if(t)return Promise.resolve(t);let f=T_u[i];if(f)return f;let l=u().then((E)=>{return gYt[i]=E,E}).finally(()=>{delete T_u[i]});return T_u[i]=l,l}function Saf(){let i=process.env.STUDIO_SANDBOX_PREVIEW_URL_PATTERN;return i&&i.trim()!==""?i:void 0}function Oaf(){let i=process.env.STUDIO_SANDBOX_TEMPLATE_NAME;return i&&i.trim()!==""?i:void 0}function $af(){let i=process.env.STUDIO_SANDBOX_GO_TEMPLATE_NAME;return i&&i.trim()!==""?i:void 0}function Paf(){let i=process.env.STUDIO_ENV;return i&&i.trim()!==""?i:void 0}function gaf(){let i=process.env.STUDIO_SANDBOX_SENTINEL_TOKEN;return i&&i.trim()!==""?i:void 0}function Uaf(){let i=process.env.STUDIO_SANDBOX_PREVIEW_GATEWAY_NAME?.trim(),u=process.env.STUDIO_SANDBOX_PREVIEW_GATEWAY_NAMESPACE?.trim();if(!i&&!u)return;if(!i||!u)throw Error("STUDIO_SANDBOX_PREVIEW_GATEWAY_NAME and STUDIO_SANDBOX_PREVIEW_GATEWAY_NAMESPACE must both be set, or both unset. Half-configured per-claim HTTPRoute routing would silently fail to attach.");return{name:i,namespace:u}}async function xYt(i,u){let t=new PW(u),f=Saf();switch(i){case"agent-sandbox":{let{AgentSandboxProvider:l}=await Promise.resolve().then(() => (c_u(),NYt)),E=new nv(_u().encryptionKey);return new l({stateStore:t,previewUrlPattern:f,sandboxTemplateName:Oaf(),goSandboxTemplateName:$af(),envName:Paf(),previewGateway:Uaf(),sentinelToken:gaf(),meter:B0,mintCloneUrl:async(c,_)=>{if(!c.connectionId)return null;let T=URt(c.cloneUrl);if(!T)return null;let{cloneUrl:d}=await s$(c.connectionId,T.owner,T.name,u,E,{bufferMs:_?.bufferMs});return d}})}case"user-desktop":throw Error("user-desktop provider cannot be instantiated without a per-run link claim \u2014 call resolveSandboxProvider, which binds the link before constructing the provider.");default:throw Error(`Unknown sandbox provider kind: ${String(i)}`)}}async function Z7i(i,u){let{DesktopSandboxProvider:t}=await Promise.resolve().then(() => (PYt(),$Yt)),{getProxyDispatch:f}=await Promise.resolve().then(() => (h_u(),n_u)),l=new PW(i.db);if(!u)throw Error("buildDesktopProvider: userSub must be a non-empty string");let E=f();return new t({userSub:u,dispatch:E,stateStore:l})}function d_u(i,u){return IYt(u,()=>xYt(u,i.db))}async function Baf(){let i;try{i=Ch()}catch(t){return console.warn("[lifecycle] cannot resolve sandbox runner:",t instanceof Error?t.message:String(t)),null}return await IYt(i,()=>xYt(i,et().db))}function w_u(i,u,t){let f=h5.get(u);if(f){if(f.terminated){if(f.lastPhase)try{t(f.lastPhase)}catch{}return{unsubscribe:yaf}}if(f.listeners.add(t),f.lastPhase)try{t(f.lastPhase)}catch{}return UYt(u,f,t)}let l=new AbortController,E={lastPhase:null,terminated:!1,listeners:new Set([t]),abort:l};return h5.set(u,E),Raf(i,u,E),UYt(u,E,t)}function yaf(){}function UYt(i,u,t){return{unsubscribe(){if(h5.get(i)!==u)return;if(u.listeners.delete(t),u.listeners.size===0)h5.delete(i),u.abort.abort()}}}async function Raf(i,u,t){let f=null;try{for await(let l of i.watchClaimLifecycle(u,t.abort.signal)){if(t.abort.signal.aborted)break;t.lastPhase=l;let E=l.kind==="ready"||l.kind==="failed";if(E)t.terminated=!0;let c=Array.from(t.listeners);for(let _ of c)try{_(l)}catch{}if(E)break}}catch(l){f=l}finally{if(!t.terminated&&!t.abort.signal.aborted&&t.listeners.size>0){let l={kind:"failed",reason:"unknown",message:f instanceof Error?f.message:"Lifecycle watcher ended unexpectedly"};t.lastPhase=l,t.terminated=!0;for(let E of Array.from(t.listeners))try{E(l)}catch{}}if(h5.get(u)===t)h5.delete(u)}}function Faf(){for(let i of h5.values())i.abort.abort();h5.clear()}var vaf,Naf,BYt,gYt,T_u,Iaf,xaf,h5;var G7i=v(()=>{Vw();M1();GE();s4u();Ho();rq();jt();vaf=Symbol.for("decocms.sandbox.lifecycle.runners"),Naf=Symbol.for("decocms.sandbox.lifecycle.inflight"),BYt=globalThis,gYt=BYt[vaf]??={},T_u=BYt[Naf]??={};Iaf=Symbol.for("decocms.sandbox.lifecycle.shared-lifecycles"),xaf=globalThis,h5=xaf[Iaf]??=new Map});async function Xh(i,u){let{userId:t,branch:f,virtualMcpMetadata:l,explicitKind:E}=u;if(E)return{provider:await _s(i,t,E),kind:E};if(i.sandboxPreference==="agent-sandbox")return{provider:await _s(i,t,"agent-sandbox"),kind:"agent-sandbox"};if(i.sandboxPreference==="user-desktop")return{provider:await Z7i(i,t),kind:"user-desktop"};if(i.sandboxPreference==="cluster-default"){let w=Ch();return{provider:await _s(i,t,w),kind:w}}let[c,..._]=Laf(l,t,f);if(c){let w=_.length===0?c:Zaf(c,_);return{provider:await _s(i,t,w),kind:w}}let T=RYt();return{provider:await _s(i,t,T),kind:T}}function Laf(i,u,t){let f=oE(i)[u]?.[t];if(!f)return[];let l=Qn(f);return Object.keys(l)}function Zaf(i,u){let t=RYt();if(t===i||u.includes(t))return t;return i}function RYt(){return Ch()}async function _s(i,u,t){if(t!=="user-desktop")return d_u(i,t);return Z7i(i,u)}var HW=v(()=>{Z0();Vw();Zd();G7i()});var Ts;var A_u=v(()=>{Ts={npm:{install:"npm install",run:(i)=>`npm run ${i}`,runtime:"node"},pnpm:{install:"pnpm install",run:(i)=>`pnpm run ${i}`,runtime:"node"},yarn:{install:"yarn install",run:(i)=>`yarn run ${i}`,runtime:"node"},bun:{install:"bun install",run:(i)=>`bun run ${i}`,runtime:"bun"},deno:{install:"deno install",run:(i)=>`deno task ${i}`,runtime:"deno"}}});function k7i(i,u){return u?`thread:${i}/${u}`:`thread:${i}`}function C7i(i){return`sandbox/thread-${i.replace(/^thread:/,"").replace(/\//g,"-")}`}function A5(i){if(!i||!i.startsWith("thread:"))return null;return i.slice(7).split("/")[0]||null}async function wN(i,u,t){let f=A5(u);if(!f)return t;return(await i.storage.threads.get(f).catch(()=>null))?.created_by??t}async function XW(i,u){if(!u)return null;let t=await i.storage.threads.get(u).catch(()=>null);if(!t)return null;return t.metadata??{}}async function FYt(i,u){let f=(await XW(i,u))?.headRef;return typeof f==="string"&&f.length>0?f:null}async function LYt(i,u,t){let f=await XW(i,u);if(!f)return;if(f.headRef===t)return;await i.storage.threads.update(u,{metadata:{...f,headRef:t}}).catch((l)=>console.warn("[thread-repo] setThreadHeadRef failed",l))}async function ds(i,u){return(await XW(i,u))?.githubRepo??null}async function ZYt(i,u,t,f,l,E){let c=await XW(i,u);if(!c)return;let _=Ko(oE(c),t,f,l,E);await i.storage.threads.update(u,{metadata:{...c,sandboxMap:_}}).catch((T)=>console.warn("[thread-repo] setThreadSandboxMapEntry failed",T))}async function GYt(i,u){return oE(await XW(i,u))}async function kYt(i,u,t,f,l){let E=await XW(i,u);if(!E)return;let c=o4u(oE(E),t,f,l);if(!c)return;await i.storage.threads.update(u,{metadata:{...E,sandboxMap:c}}).catch((_)=>console.warn("[thread-repo] removeThreadSandboxMapEntry failed",_))}var D5=v(()=>{Zd()});function Y7i(i){if(!i)return null;let u=i.runtime;if(!u||typeof u!=="object")return null;let t=u.env;if(!Array.isArray(t))return null;let f=[];for(let l of t){if(!l||typeof l!=="object")continue;let E=l;if(typeof E.key!=="string"||!Nci.test(E.key))continue;if(E.kind==="literal"&&typeof E.value==="string"){f.push({key:E.key,kind:"literal",value:E.value});continue}if(E.kind==="secret"&&typeof E.secretId==="string"&&E.secretId.length>0)f.push({key:E.key,kind:"secret",secretId:E.secretId})}return f.length===0?null:f}function CYt(i){if(!i)return null;let u=i.runtime;if(!u||typeof u!=="object")return null;let t=u.submoduleCredentials;if(!Array.isArray(t))return null;let f=[];for(let l of t){if(!l||typeof l!=="object")continue;let E=l;if(typeof E.host==="string"&&E.host.length>0&&typeof E.secretId==="string"&&E.secretId.length>0)f.push({host:E.host,secretId:E.secretId})}return f.length===0?null:f}async function YYt(i,u){$i(u);let t=Si(u);await u.access.check();let f=Cu(u);if(!f)throw Error("User ID required");let l=await u.storage.virtualMcps.findById(i.virtualMcpId);if(!l||l.organization_id!==t.id)throw Error("Virtual MCP not found");let E=l.metadata??{},c=oE(E),_=await wN(u,i.branch,f),T=a$(c,_,i.branch,i.sandboxProviderKind);return{virtualMcp:l,metadata:E,userId:f,sandboxUserId:_,entry:T,organization:t}}function j7i(i){let u=i.runtime??null,f=u?.selected??null,l=u?.port??null,E=u?.path??null;if(!f||!(f in Ts))return{packageManager:null,runtime:null,port:l,packageManagerPath:E,runtimeBinPath:null};let c=Ts[f].runtime;return{packageManager:f,runtime:c,port:l,packageManagerPath:E,runtimeBinPath:c==="deno"?"/opt/deno/bin":c==="bun"?"/opt/bun/bin":null}}var JW=v(()=>{Z0();A_u();Zd();D5()});async function v5(i,u){let t=i.body?.getReader();if(!t)return i.text();let f=new TextDecoder,l="",E=0;for(;;){let{done:c,value:_}=await t.read();if(c)break;if(E+=_.byteLength,E>u)throw await t.cancel().catch(()=>{}),new jYt(`Upstream response exceeded ${u} bytes`);l+=f.decode(_,{stream:!0})}return l+=f.decode(),l}var jYt;var ws=v(()=>{jYt=class jYt extends Error{}});async function K7i({ctx:i,runner:u,handle:t,orgId:f,userId:l,entries:E}){if(!E||E.length===0)return;let c={};for(let T of E){if(T.kind==="literal"){c[T.key]=T.value;continue}try{let{value:d}=await i.storage.secrets.resolveById(T.secretId,f,l);c[T.key]=d}catch(d){if(d instanceof Lw||d instanceof c$){console.warn(`[SANDBOX_START] skipping env ${T.key}: ${d.message}. Re-link or recreate the secret to restore.`);continue}throw d}}if(Object.keys(c).length===0)return;let _=await u.proxyDaemonRequest(t,"/_sandbox/config",{method:"PUT",headers:new Headers({"content-type":"application/json"}),body:JSON.stringify({env:c})});if(!_.ok){let T=await v5(_,Gaf).catch(()=>_.statusText);console.warn(`[SANDBOX_START] daemon rejected env patch (${_.status}): ${T}`)}}var Gaf=10485760;var D_u=v(()=>{de();ws()});async function KYt({ctx:i,orgId:u,userId:t,entries:f}){if(!f||f.length===0)return[];let l=[];for(let E of f)try{let{value:c}=await i.storage.secrets.resolveById(E.secretId,u,t);l.push({host:E.host,token:c})}catch(c){if(c instanceof Lw||c instanceof c$){console.warn(`[SANDBOX_START] skipping submodule credential for ${E.host}: ${c.message}. Re-link or recreate the secret to restore.`);continue}throw c}return l}var HYt=v(()=>{de()});async function WYt(i,u,t,f,l){let E=await y$({connectionId:i,tokenStorage:new VE(f,l)});if(!E.accessToken)return null;return QYt(u,t,E.accessToken)}function bYt(i,u){return QYt(i,u,null)}async function QYt(i,u,t){let f=new Map,l=new Set(XYt.map((T)=>T.path));for(let T of Object.values(JYt))for(let d of T??[])l.add(d);await Promise.all(Array.from(l).map(async(T)=>{f.set(T,await Caf(i,u,T,t))}));let E=XYt.find(({path:T})=>f.get(T)!==null);if(!E)return null;let c=JYt[E.pm]??[],_=null;for(let T of c)if(_=Yaf(f.get(T)??null),_)break;return{packageManager:E.pm,devPort:_}}async function Caf(i,u,t,f){let l=`https://api.github.com/repos/${i}/${u}/contents/${encodeURIComponent(t)}`;try{let E={Accept:"application/vnd.github+json","User-Agent":"studio-runtime-detect"};if(f)E.Authorization=`token ${f}`;let c=await fetch(l,{headers:E,signal:AbortSignal.timeout(5000)});if(!c.ok)return null;let _=await c.json();if(!_.content||_.encoding!=="base64")return null;return Buffer.from(_.content,"base64").toString("utf8")}catch{return null}}function Yaf(i){if(!i)return null;try{let u=JSON.parse(i),t=u.tasks??u.scripts??{};return(t.dev??t.start??"").match(kaf)?.[1]??null}catch{return null}}var XYt,JYt,kaf;var MYt=v(()=>{R$();Uh();XYt=[{path:"deno.json",pm:"deno"},{path:"deno.jsonc",pm:"deno"},{path:"bun.lock",pm:"bun"},{path:"bunfig.toml",pm:"bun"},{path:"pnpm-lock.yaml",pm:"pnpm"},{path:"yarn.lock",pm:"yarn"},{path:"package-lock.json",pm:"npm"},{path:"package.json",pm:"bun"}],JYt={deno:["deno.json","deno.jsonc"],bun:["package.json"],pnpm:["package.json"],yarn:["package.json"],npm:["package.json"]},kaf=/(?:--port|PORT=|:)(\d{4,5})/});function zYt(i){if(i.explicit)return i.explicit;return i.flags?.sandbox_go_daemon===!1?"ts":"go"}function rYt(i){let{current:u,detached:t,base:f}=i.status??{};if(typeof u!=="string"||u.length===0)return null;if(t===!0)return null;if(u===i.requestedRef)return null;if(jaf.has(u))return null;if(typeof f==="string"&&f.length>0&&u===f)return null;return u}function qYt(i){if(!i.branch.startsWith("thread:"))return i.branch;if(i.sticky&&i.recordedHeadRef)return i.recordedHeadRef;return i.derivedRef}var jaf;var v_u=v(()=>{jaf=new Set(["main","master","trunk","develop","HEAD"])});async function H7i(i,u){if(!i)return{hosts:[],allowSameHostDev:!1};let t;try{t=await i.presignedGetUrl("link-dispatch/_allowlist_probe",60,{requireFetchable:!0})}catch{return{hosts:[],allowSameHostDev:!1}}let f;try{f=new URL(t)}catch{return{hosts:[],allowSameHostDev:!1}}if(f.protocol!=="https:"&&f.protocol!=="http:")return{hosts:[],allowSameHostDev:!1};let l=f.hostname,E=Kaf.has(l);return{hosts:[l],allowSameHostDev:E&&!u.isProduction}}var Kaf;var N_u=v(()=>{Kaf=new Set(["127.0.0.1","localhost","::1","[::1]","0.0.0.0"])});import{z as K3}from"zod";async function X7i(i,u){$i(u);let t=Si(u),f=Cu(u);if(!f)throw Error("User ID required");let l=await u.storage.virtualMcps.findById(i.virtualMcpId);if(!l||l.organization_id!==t.id)throw Error("Virtual MCP not found");let E=l.metadata??{},c=await wN(u,i.branch,f),_=a$(oE(E),c,i.branch,i.sandboxProviderKind),T=i.sandboxProviderKind,{provider:d}=await Xh(u,{userId:c,branch:i.branch,virtualMcpMetadata:E,explicitKind:T});if(_){if(T!=="user-desktop")return _;if(await d.alive(_.sandboxHandle).catch(()=>!1))return _;await o$(u.storage.virtualMcps,i.virtualMcpId,f,c,i.branch,T).catch((D)=>{console.warn("[ensureSandbox] failed to reap stale user-desktop entry",D)})}let n=await ds(u,A5(i.branch)??u.metadata?.threadId)??E.githubRepo??null,{entry:h}=await VYt({ctx:u,userId:f,sandboxUserId:c,orgId:t.id,virtualMcpId:i.virtualMcpId,branch:i.branch,metadata:E,githubRepo:n,existing:null,providerKind:T,runner:d});return h}async function VYt(i){let{ctx:u,userId:t,sandboxUserId:f,orgId:l,virtualMcpId:E,branch:c,metadata:_,githubRepo:T,existing:d,runner:w}=i,{runtime:n,packageManager:h,port:A,packageManagerPath:D}=j7i(_),N;if(T){if(T.connectionId)await gW({ctx:u,connectionId:T.connectionId,organizationId:l,forceRefresh:!0,onLegacyMintError:(yi)=>{console.error("[provisionSandbox] repo-scoped legacy token mint failed",{connectionId:T.connectionId,error:yi.message})}});let{cloneUrl:di,gitUserName:ci,gitUserEmail:ii}=T.connectionId?await s$(T.connectionId,T.owner,T.name,u.db,u.vault):_Ai(T.owner,T.name);if(!h){let yi=T.connectionId?await WYt(T.connectionId,T.owner,T.name,u.db,u.vault):await bYt(T.owner,T.name);if(yi)h=yi.packageManager,n=Ts[yi.packageManager].runtime,A=yi.devPort??A,await Xaf(u,E,t,yi.packageManager,yi.devPort)}let m=_u().sandboxStickyHeadRefEnabled,Di=qYt({branch:c,derivedRef:C7i(c),recordedHeadRef:m?await FYt(u,A5(c)):null,sticky:m}),_i=await KYt({ctx:u,orgId:l,userId:t,entries:CYt(_)});N={cloneUrl:di,...T.connectionId?{connectionId:T.connectionId}:{},userName:ci,userEmail:ii,branch:Di,displayName:`${T.owner}/${T.name}`,..._i.length>0?{submoduleCredentials:_i}:{}}}let S=n&&h?{runtime:n,packageManager:h,...A!==null?{devPort:Number(A)}:{},...D?{packageManagerPath:D}:{}}:void 0,O=W8({orgId:l,virtualMcpId:E,branch:c}),$=w.kind==="user-desktop"?await H7i(u.objectStorage,{isProduction:_u().nodeEnv==="production"}):null,P=(w.kind==="user-desktop"||w.kind==="agent-sandbox")&&!_u().orgFsMountsDisabled,g;if(P){let di=u.organization?.slug??(await u.db.selectFrom("organization").select(["slug"]).where("id","=",l).executeTakeFirst())?.slug;if(di)g=await wni(u,{orgSlug:di,orgId:l,baseUrl:$c()})}let U=w.kind==="agent-sandbox"?zYt({explicit:i.daemonImpl,flags:i.daemonImpl?null:(await u.storage.organizationSettings.get(l))?.flags??null}):void 0,x=await w.ensure({userId:f,projectRef:O},{branch:c,repo:N,workload:S,tenant:{orgId:l,userId:f,...u.organization?.slug?{orgSlug:u.organization.slug}:{},...u.organization?.name?{orgName:u.organization.name}:{},...u.auth.user?.email?{userEmail:u.auth.user.email}:{},...u.auth.user?.name?{userName:u.auth.user.name}:{}},...$?{offloadAllowedHosts:$.hosts,offloadAllowSameHostDev:$.allowSameHostDev}:{},...g?{orgFsConfigJson:g}:{},...U?{daemonImpl:U}:{}}),F=_.runtime?.env??null;await K7i({ctx:u,runner:w,handle:x.handle,orgId:l,userId:t,entries:F});let L=!!d&&d.sandboxHandle===x.handle&&d?.createdAt?d.createdAt:Date.now(),M=_.runtime?.selected??null,k=_.runtime?.port??null,K=_.runtime?.path??null,q={sandboxHandle:x.handle,previewUrl:x.previewUrl,sandboxApiUrl:x.previewUrl,sandboxProviderKind:w.kind,createdAt:L,startedWith:{packageManager:M,port:k,path:K}};await hRt(u.storage.virtualMcps,E,t,f,c,i.providerKind,q);let H=A5(c);if(H)await ZYt(u,H,f,c,i.providerKind,q);let fi=!d||d.sandboxHandle!==x.handle;return{entry:q,isNewVm:fi}}async function Xaf(i,u,t,f,l){let E=await i.storage.virtualMcps.findById(u);if(!E)return;let c=E.metadata??{};await i.storage.virtualMcps.update(u,t,{metadata:{...c,runtime:{selected:f,port:l}}})}var Haf,S_u;var J7i=v(()=>{Vw();uu();JW();D_u();HYt();Zd();Ho();MYt();A_u();HW();D5();v_u();N_u();jt();q4();mJ();Zd();Haf=K3.enum(["agent-sandbox","user-desktop","cluster"]),S_u=p({name:"SANDBOX_START",description:"Start a sandbox with the connected GitHub repo and dev server.",annotations:{title:"Start VM Preview",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!1,openWorldHint:!0},_meta:{ui:{visibility:"app"}},inputSchema:K3.object({virtualMcpId:K3.string().describe("Virtual MCP ID"),branch:K3.string().min(1).optional().describe("Git branch to check out. Pass the thread's branch whenever the caller has one: when omitted the handler mints a fresh `<user-slug>-<timestamp>` name, which becomes a SEPARATE sandbox from the one the thread's own branch resolves to. The resolved branch is returned in the response so callers can persist it."),sandboxProviderKind:Haf.optional().describe("Explicit runtime choice. Hosted provider is `agent-sandbox`; legacy `cluster` input is accepted only for compatibility and normalized to `agent-sandbox`. When omitted, defaults to `user-desktop` if the acting user's link daemon is online, else the env kind."),daemonImpl:j4u.optional().describe("Target this one sandbox at a specific sandbox daemon implementation, overriding both the `go` default and the org's `sandbox_go_daemon` opt-out. Only honored on `agent-sandbox`, and only when the deployment configures a Go SandboxTemplate; otherwise the sandbox lands on `ts`. Applies to a sandbox being created \u2014 an existing sandbox keeps the binary it booted with.")}),outputSchema:K3.object({previewUrl:K3.string().nullable(),sandboxHandle:K3.string(),branch:K3.string(),isNewVm:K3.boolean(),sandboxProviderKind:K3.enum(["agent-sandbox","user-desktop"])}),handler:async(i,u)=>{$i(u);let t=Si(u);await u.access.check();let f=i.branch??Whi(Jhi(u.auth.user)),l=Cu(u);if(!l)throw Error("User ID required");let E=await wN(u,f,l),c=await u.storage.virtualMcps.findById(i.virtualMcpId);if(!c||c.organization_id!==t.id)throw Error("Virtual MCP not found");let _=c.metadata??{},T=i.sandboxProviderKind?uN(i.sandboxProviderKind):void 0,{provider:d,kind:w}=await Xh(u,{userId:E,branch:f,virtualMcpMetadata:_,explicitKind:T}),n=a$(oE(_),E,f,w),A=await ds(u,A5(f)??u.metadata?.threadId)??_.githubRepo??null,{entry:D,isNewVm:N}=await VYt({ctx:u,userId:l,sandboxUserId:E,orgId:t.id,virtualMcpId:i.virtualMcpId,branch:f,metadata:_,githubRepo:A,existing:n,providerKind:w,runner:d,daemonImpl:i.daemonImpl});return{...D,branch:f,isNewVm:N,sandboxProviderKind:w}}})});async function Jaf(i,u,t,f){try{let l=i.organization;if(!l)return;let E=await EAi(i,f.virtualMcpId,l,"tool-scripting",f.providerKind),c=await u.proxyDaemonRequest(t,"/_sandbox/tools/sync",{method:"POST",headers:new Headers({"content-type":"application/json"}),body:JSON.stringify(E)});if(!c.ok)console.warn("[cluster-sandbox-fs] tools/sync failed",c.status,await c.text().catch(()=>""))}catch(l){console.warn("[cluster-sandbox-fs] tools/sync failed",l)}}async function WW(i,u){let{provider:t,kind:f}=await Xh(i,{userId:u.userId,branch:u.branch,virtualMcpMetadata:null}),l=null,E=()=>{if(!l){if(l=X7i({virtualMcpId:u.virtualMcpId,branch:u.branch,sandboxProviderKind:f},i).then((T)=>T.sandboxHandle),l.catch(()=>{l=null}),u.syncTools)l.then((T)=>Jaf(i,t,T,{virtualMcpId:u.virtualMcpId,providerKind:f})).catch(()=>{})}return l},c=u.branch==="ephemeral"||f==="user-desktop";return J4u(t,{ensureHandle:E,invalidateHandle:async(T)=>{let d=l;if(l=null,!c&&!T?.force)return;try{await o$(i.storage.virtualMcps,u.virtualMcpId,u.userId,u.userId,u.branch,f)}catch(w){console.warn("[cluster-sandbox-fs] failed to reap vmMap entry",w)}if(d&&typeof t.forgetHandle==="function")try{let w=await d;await t.forgetHandle(w)}catch(w){console.warn("[cluster-sandbox-fs] forgetHandle failed",w)}},canAutoRestart:c})}async function mYt(i,u){try{let t=await WW(i,u),{stdout:f}=await t.onBash("test -d .deco && echo __DECO_SITE__");return f.includes("__DECO_SITE__")}catch(t){return console.warn("[cluster-sandbox-fs] .deco probe failed; assuming deco site",t),!0}}var W7i=v(()=>{Vw();a4u();HW();J7i();Zd()});function bW(i){let u=i.toISOString();return`<current-context>
 Current date: ${u.slice(0,10)}
 Current time: ${u.slice(11,16)} UTC
 </current-context>`}var eYt,aYt;var O_u=v(()=>{eYt={type:"ephemeral",ttl:"5m"},aYt={openrouter:{cache_control:{type:"ephemeral",ttl:"5m"}}}});function oYt(i,u){let t=[],f=i.length-1,l=i.length-2;for(let E=0;E<i.length;E++){let c=E===l||E===f;t.push({role:"system",content:i[E],...c?{providerOptions:Waf}:{}})}return t.push({role:"system",content:bW(u)}),t}var Waf;var sYt=v(()=>{O_u();Waf={anthropic:{cacheControl:eYt}}});function pYt(i){if(i.length===0)return null;return`