decocms 4.192.6 → 4.192.8

package/dist/server/server.js

@@ -1232,7 +1232,7 @@ ${H}`:H;return{...J,description:N,inputExamples:X?void 0:J.inputExamples}});retu
 `);let Q=Z.pax;if(Q)for(let Y in Q)X+=Xn0(" "+Y+"="+Q[Y]+`
 `);return C4.from(X)};VG4.decodePax=function(Z){let X={};while(Z.length){let Q=0;while(Q<Z.length&&Z[Q]!==32)Q++;let Y=parseInt(C4.toString(Z.subarray(0,Q)),10);if(!Y)return X;let G=C4.toString(Z.subarray(Q+1,Y-1)),J=G.indexOf("=");if(J===-1)return X;X[G.slice(0,J)]=G.slice(J+1),Z=Z.subarray(Y)}return X};VG4.encode=function(Z){let X=C4.alloc(512),Q=Z.name,Y="";if(Z.typeflag===5&&Q[Q.length-1]!=="/")Q+="/";if(C4.byteLength(Q)!==Q.length)return null;while(C4.byteLength(Q)>100){let G=Q.indexOf("/");if(G===-1)return null;Y+=Y?"/"+Q.slice(0,G):Q.slice(0,G),Q=Q.slice(G+1)}if(C4.byteLength(Q)>100||C4.byteLength(Y)>155)return null;if(Z.linkname&&C4.byteLength(Z.linkname)>100)return null;if(C4.write(X,Q),C4.write(X,tw(Z.mode&4095,6),100),C4.write(X,tw(Z.uid,6),108),C4.write(X,tw(Z.gid,6),116),kG4(Z.size,X,124),C4.write(X,tw(Z.mtime.getTime()/1000|0,11),136),X[156]=48+qG4(Z.type),Z.linkname)C4.write(X,Z.linkname,157);if(C4.copy(cQ$,X,257),C4.copy(jG4,X,263),Z.uname)C4.write(X,Z.uname,265);if(Z.gname)C4.write(X,Z.gname,297);if(C4.write(X,tw(Z.devmajor||0,6),329),C4.write(X,tw(Z.devminor||0,6),337),Y)C4.write(X,Y,345);return C4.write(X,tw(dQ$(X),6),148),X};VG4.decode=function(Z,X,Q){let Y=Z[156]===0?0:Z[156]-48,G=dx(Z,0,100,X),J=pw(Z,100,8),W=pw(Z,108,8),K=pw(Z,116,8),H=pw(Z,124,12),N=pw(Z,136,12),F=IG4(Y),U=Z[157]===0?null:dx(Z,157,100,X),w=dx(Z,265,32),O=dx(Z,297,32),D=pw(Z,329,8),L=pw(Z,337,8),E=dQ$(Z);if(E===256)return null;if(E!==pw(Z,148,8))throw Error("Invalid tar header. Maybe the tar is corrupted or it needs to be gunzipped?");if(AG4(Z)){if(Z[345])G=dx(Z,345,155,X)+"/"+G}else if(TG4(Z));else if(!Q)throw Error("Invalid tar header: unknown format.");if(Y===0&&G&&G[G.length-1]==="/")Y=5;return{name:G,mode:J,uid:W,gid:K,size:H,mtime:new Date(1000*N),type:F,linkname:U,uname:w,gname:O,devmajor:D,devminor:L,pax:null}};function AG4($){return C4.equals(cQ$,$.subarray(257,263))}function TG4($){return C4.equals(zG4,$.subarray(257,263))&&C4.equals(PG4,$.subarray(263,265))}function RG4($,Z,X){if(typeof $!=="number")return X;if($=~~$,$>=Z)return Z;if($>=0)return $;if($+=Z,$>=0)return $;return 0}function IG4($){switch($){case 0:return"file";case 1:return"link";case 2:return"symlink";case 3:return"character-device";case 4:return"block-device";case 5:return"directory";case 6:return"fifo";case 7:return"contiguous-file";case 72:return"pax-header";case 55:return"pax-global-header";case 27:return"gnu-long-link-path";case 28:case 30:return"gnu-long-path"}return null}function qG4($){switch($){case"file":return 0;case"link":return 1;case"symlink":return 2;case"character-device":return 3;case"block-device":return 4;case"directory":return 5;case"fifo":return 6;case"contiguous-file":return 7;case"pax-header":return 72}return 0}function lQ$($,Z,X,Q){for(;X<Q;X++)if($[X]===Z)return X;return Q}function dQ$($){let Z=256;for(let X=0;X<148;X++)Z+=$[X];for(let X=156;X<512;X++)Z+=$[X];return Z}function tw($,Z){if($=$.toString(8),$.length>Z)return"7777777777777777777".slice(0,Z)+" ";return"0000000000000000000".slice(0,Z-$.length)+$+" "}function MG4($,Z,X){Z[X]=128;for(let Q=11;Q>0;Q--)Z[X+Q]=$&255,$=Math.floor($/256)}function kG4($,Z,X){if($.toString(8).length>11)MG4($,Z,X);else C4.write(Z,tw($,11),X)}function SG4($){let Z;if($[0]===128)Z=!0;else if($[0]===255)Z=!1;else return null;let X=[],Q;for(Q=$.length-1;Q>0;Q--){let J=$[Q];if(Z)X.push(J);else X.push(255-J)}let Y=0,G=X.length;for(Q=0;Q<G;Q++)Y+=X[Q]*Math.pow(256,Q);return Z?Y:-1*Y}function pw($,Z,X){if($=$.subarray(Z,Z+X),Z=0,$[Z]&128)return SG4($);else{while(Z<$.length&&$[Z]===32)Z++;let Q=RG4(lQ$($,32,Z,$.length),$.length,$.length);while(Z<Q&&$[Z]===0)Z++;if(Q===Z)return 0;return parseInt(C4.toString($.subarray(Z,Q)),8)}}function dx($,Z,X,Q){return C4.toString($.subarray(Z,lQ$($,0,Z,Z+X)),Q)}function Xn0($){let Z=C4.byteLength($),X=Math.floor(Math.log(Z)/Math.log(10))+1;if(Z+X>=Math.pow(10,X))X++;return Z+X+$}});var aQ$=C((bE9,rQ$)=>{var{Writable:xG4,Readable:yG4,getStreamError:mQ$}=Zn0(),gG4=oi0(),iQ$=lx(),mx=Qn0(),hG4=iQ$.alloc(0);class nQ${constructor(){this.buffered=0,this.shifted=0,this.queue=new gG4,this._offset=0}push($){this.buffered+=$.byteLength,this.queue.push($)}shiftFirst($){return this._buffered===0?null:this._next($)}shift($){if($>this.buffered)return null;if($===0)return hG4;let Z=this._next($);if($===Z.byteLength)return Z;let X=[Z];while(($-=Z.byteLength)>0)Z=this._next($),X.push(Z);return iQ$.concat(X)}_next($){let Z=this.queue.peek(),X=Z.byteLength-this._offset;if($>=X){let Q=this._offset?Z.subarray(this._offset,Z.byteLength):Z;return this.queue.shift(),this._offset=0,this.buffered-=X,this.shifted+=X,Q}return this.buffered-=$,this.shifted+=$,Z.subarray(this._offset,this._offset+=$)}}class pQ$ extends yG4{constructor($,Z,X){super();this.header=Z,this.offset=X,this._parent=$}_read($){if(this.header.size===0)this.push(null);if(this._parent._stream===this)this._parent._update();$(null)}_predestroy(){this._parent.destroy(mQ$(this))}_detach(){if(this._parent._stream===this)this._parent._stream=null,this._parent._missing=oQ$(this.header.size),this._parent._update()}_destroy($){this._detach(),$(null)}}class tQ$ extends xG4{constructor($){super($);if(!$)$={};this._buffer=new nQ$,this._offset=0,this._header=null,this._stream=null,this._missing=0,this._longHeader=!1,this._callback=Yn0,this._locked=!1,this._finished=!1,this._pax=null,this._paxGlobal=null,this._gnuLongPath=null,this._gnuLongLinkPath=null,this._filenameEncoding=$.filenameEncoding||"utf-8",this._allowUnknownFormat=!!$.allowUnknownFormat,this._unlockBound=this._unlock.bind(this)}_unlock($){if(this._locked=!1,$){this.destroy($),this._continueWrite($);return}this._update()}_consumeHeader(){if(this._locked)return!1;this._offset=this._buffer.shifted;try{this._header=mx.decode(this._buffer.shift(512),this._filenameEncoding,this._allowUnknownFormat)}catch($){return this._continueWrite($),!1}if(!this._header)return!0;switch(this._header.type){case"gnu-long-path":case"gnu-long-link-path":case"pax-global-header":case"pax-header":return this._longHeader=!0,this._missing=this._header.size,!0}if(this._locked=!0,this._applyLongHeaders(),this._header.size===0||this._header.type==="directory")return this.emit("entry",this._header,this._createStream(),this._unlockBound),!0;return this._stream=this._createStream(),this._missing=this._header.size,this.emit("entry",this._header,this._stream,this._unlockBound),!0}_applyLongHeaders(){if(this._gnuLongPath)this._header.name=this._gnuLongPath,this._gnuLongPath=null;if(this._gnuLongLinkPath)this._header.linkname=this._gnuLongLinkPath,this._gnuLongLinkPath=null;if(this._pax){if(this._pax.path)this._header.name=this._pax.path;if(this._pax.linkpath)this._header.linkname=this._pax.linkpath;if(this._pax.size)this._header.size=parseInt(this._pax.size,10);this._header.pax=this._pax,this._pax=null}}_decodeLongHeader($){switch(this._header.type){case"gnu-long-path":this._gnuLongPath=mx.decodeLongPath($,this._filenameEncoding);break;case"gnu-long-link-path":this._gnuLongLinkPath=mx.decodeLongPath($,this._filenameEncoding);break;case"pax-global-header":this._paxGlobal=mx.decodePax($);break;case"pax-header":this._pax=this._paxGlobal===null?mx.decodePax($):Object.assign({},this._paxGlobal,mx.decodePax($));break}}_consumeLongHeader(){this._longHeader=!1,this._missing=oQ$(this._header.size);let $=this._buffer.shift(this._header.size);try{this._decodeLongHeader($)}catch(Z){return this._continueWrite(Z),!1}return!0}_consumeStream(){let $=this._buffer.shiftFirst(this._missing);if($===null)return!1;this._missing-=$.byteLength;let Z=this._stream.push($);if(this._missing===0){if(this._stream.push(null),Z)this._stream._detach();return Z&&this._locked===!1}return Z}_createStream(){return new pQ$(this,this._header,this._offset)}_update(){while(this._buffer.buffered>0&&!this.destroying){if(this._missing>0){if(this._stream!==null){if(this._consumeStream()===!1)return;continue}if(this._longHeader===!0){if(this._missing>this._buffer.buffered)break;if(this._consumeLongHeader()===!1)return!1;continue}let $=this._buffer.shiftFirst(this._missing);if($!==null)this._missing-=$.byteLength;continue}if(this._buffer.buffered<512)break;if(this._stream!==null||this._consumeHeader()===!1)return}this._continueWrite(null)}_continueWrite($){let Z=this._callback;this._callback=Yn0,Z($)}_write($,Z){this._callback=Z,this._buffer.push($),this._update()}_final($){this._finished=this._missing===0&&this._buffer.buffered===0,$(this._finished?null:Error("Unexpected end of data"))}_predestroy(){this._continueWrite(null)}_destroy($){if(this._stream)this._stream.destroy(mQ$(this));$(null)}[Symbol.asyncIterator](){let $=null,Z=null,X=null,Q=null,Y=null,G=this;return this.on("entry",K),this.on("error",(F)=>{$=F}),this.on("close",H),{[Symbol.asyncIterator](){return this},next(){return new Promise(W)},return(){return N(null)},throw(F){return N(F)}};function J(F){if(!Y)return;let U=Y;Y=null,U(F)}function W(F,U){if($)return U($);if(Q){F({value:Q,done:!1}),Q=null;return}if(Z=F,X=U,J(null),G._finished&&Z)Z({value:void 0,done:!0}),Z=X=null}function K(F,U,w){if(Y=w,U.on("error",Yn0),Z)Z({value:U,done:!1}),Z=X=null;else Q=U}function H(){if(J($),!Z)return;if($)X($);else Z({value:void 0,done:!0});Z=X=null}function N(F){return G.destroy(F),J(F),new Promise((U,w)=>{if(G.destroyed)return U({value:void 0,done:!0});G.once("close",function(){if(F)w(F);else U({value:void 0,done:!0})})})}}}rQ$.exports=function(Z){return new tQ$(Z)};function Yn0(){}function oQ$($){return $&=511,$&&512-$}});var eQ$=C((fE9,Gn0)=>{var sQ$={S_IFMT:61440,S_IFDIR:16384,S_IFCHR:8192,S_IFBLK:24576,S_IFIFO:4096,S_IFLNK:40960};try{Gn0.exports=z0("fs").constants||sQ$}catch{Gn0.exports=sQ$}});var JY$=C((xE9,GY$)=>{var{Readable:uG4,Writable:cG4,getStreamError:$Y$}=Zn0(),IV=lx(),ix=eQ$(),pU0=Qn0(),ZY$=IV.alloc(1024);class XY$ extends cG4{constructor($,Z,X){super({mapWritable:dG4,eagerOpen:!0});if(this.written=0,this.header=Z,this._callback=X,this._linkname=null,this._isLinkname=Z.type==="symlink"&&!Z.linkname,this._isVoid=Z.type!=="file"&&Z.type!=="contiguous-file",this._finished=!1,this._pack=$,this._openCallback=null,this._pack._stream===null)this._pack._stream=this;else this._pack._pending.push(this)}_open($){if(this._openCallback=$,this._pack._stream===this)this._continueOpen()}_continuePack($){if(this._callback===null)return;let Z=this._callback;this._callback=null,Z($)}_continueOpen(){if(this._pack._stream===null)this._pack._stream=this;let $=this._openCallback;if(this._openCallback=null,$===null)return;if(this._pack.destroying)return $(Error("pack stream destroyed"));if(this._pack._finalized)return $(Error("pack stream is already finalized"));if(this._pack._stream=this,!this._isLinkname)this._pack._encode(this.header);if(this._isVoid)this._finish(),this._continuePack(null);$(null)}_write($,Z){if(this._isLinkname)return this._linkname=this._linkname?IV.concat([this._linkname,$]):$,Z(null);if(this._isVoid){if($.byteLength>0)return Z(Error("No body allowed for this entry"));return Z()}if(this.written+=$.byteLength,this._pack.push($))return Z();this._pack._drain=Z}_finish(){if(this._finished)return;if(this._finished=!0,this._isLinkname)this.header.linkname=this._linkname?IV.toString(this._linkname,"utf-8"):"",this._pack._encode(this.header);YY$(this._pack,this.header.size),this._pack._done(this)}_final($){if(this.written!==this.header.size)return $(Error("Size mismatch"));this._finish(),$(null)}_getError(){return $Y$(this)||Error("tar entry destroyed")}_predestroy(){this._pack.destroy(this._getError())}_destroy($){this._pack._done(this),this._continuePack(this._finished?null:this._getError()),$()}}class QY$ extends uG4{constructor($){super($);this._drain=Jn0,this._finalized=!1,this._finalizing=!1,this._pending=[],this._stream=null}entry($,Z,X){if(this._finalized||this.destroying)throw Error("already finalized or destroyed");if(typeof Z==="function")X=Z,Z=null;if(!X)X=Jn0;if(!$.size||$.type==="symlink")$.size=0;if(!$.type)$.type=lG4($.mode);if(!$.mode)$.mode=$.type==="directory"?493:420;if(!$.uid)$.uid=0;if(!$.gid)$.gid=0;if(!$.mtime)$.mtime=new Date;if(typeof Z==="string")Z=IV.from(Z);let Q=new XY$(this,$,X);if(IV.isBuffer(Z))return $.size=Z.byteLength,Q.write(Z),Q.end(),Q;if(Q._isVoid)return Q;return Q}finalize(){if(this._stream||this._pending.length>0){this._finalizing=!0;return}if(this._finalized)return;this._finalized=!0,this.push(ZY$),this.push(null)}_done($){if($!==this._stream)return;if(this._stream=null,this._finalizing)this.finalize();if(this._pending.length)this._pending.shift()._continueOpen()}_encode($){if(!$.pax){let Z=pU0.encode($);if(Z){this.push(Z);return}}this._encodePax($)}_encodePax($){let Z=pU0.encodePax({name:$.name,linkname:$.linkname,pax:$.pax}),X={name:"PaxHeader",mode:$.mode,uid:$.uid,gid:$.gid,size:Z.byteLength,mtime:$.mtime,type:"pax-header",linkname:$.linkname&&"PaxHeader",uname:$.uname,gname:$.gname,devmajor:$.devmajor,devminor:$.devminor};this.push(pU0.encode(X)),this.push(Z),YY$(this,Z.byteLength),X.size=$.size,X.type=$.type,this.push(pU0.encode(X))}_doDrain(){let $=this._drain;this._drain=Jn0,$()}_predestroy(){let $=$Y$(this);if(this._stream)this._stream.destroy($);while(this._pending.length){let Z=this._pending.shift();Z.destroy($),Z._continueOpen()}this._doDrain()}_read($){this._doDrain(),$()}}GY$.exports=function(Z){return new QY$(Z)};function lG4($){switch($&ix.S_IFMT){case ix.S_IFBLK:return"block-device";case ix.S_IFCHR:return"character-device";case ix.S_IFDIR:return"directory";case ix.S_IFIFO:return"fifo";case ix.S_IFLNK:return"symlink"}return"file"}function Jn0(){}function YY$($,Z){if(Z&=511,Z)$.push(ZY$.subarray(0,512-Z))}function dG4($){return IV.isBuffer($)?$:IV.from($)}});var WY$=C((mG4)=>{mG4.extract=aQ$();mG4.pack=JY$()});var NY$=C((gE9,HY$)=>{HY$.exports=KY$;function KY$($,Z){if($&&Z)return KY$($)(Z);if(typeof $!=="function")throw TypeError("need wrapper function");return Object.keys($).forEach(function(Q){X[Q]=$[Q]}),X;function X(){var Q=Array(arguments.length);for(var Y=0;Y<Q.length;Y++)Q[Y]=arguments[Y];var G=$.apply(this,Q),J=Q[Q.length-1];if(typeof G==="function"&&G!==J)Object.keys(J).forEach(function(W){G[W]=J[W]});return G}}});var Kn0=C((hE9,Wn0)=>{var FY$=NY$();Wn0.exports=FY$(tU0);Wn0.exports.strict=FY$(UY$);tU0.proto=tU0(function(){Object.defineProperty(Function.prototype,"once",{value:function(){return tU0(this)},configurable:!0}),Object.defineProperty(Function.prototype,"onceStrict",{value:function(){return UY$(this)},configurable:!0})});function tU0($){var Z=function(){if(Z.called)return Z.value;return Z.called=!0,Z.value=$.apply(this,arguments)};return Z.called=!1,Z}function UY$($){var Z=function(){if(Z.called)throw Error(Z.onceError);return Z.called=!0,Z.value=$.apply(this,arguments)},X=$.name||"Function wrapped with `once`";return Z.onceError=X+" shouldn't be called more than once",Z.called=!1,Z}});var BY$=C((uE9,OY$)=>{var pG4=Kn0(),tG4=function(){},oG4=global.Bare?queueMicrotask:process.nextTick.bind(process),rG4=function($){return $.setHeader&&typeof $.abort==="function"},aG4=function($){return $.stdio&&Array.isArray($.stdio)&&$.stdio.length===3},wY$=function($,Z,X){if(typeof Z==="function")return wY$($,null,Z);if(!Z)Z={};X=pG4(X||tG4);var{_writableState:Q,_readableState:Y}=$,G=Z.readable||Z.readable!==!1&&$.readable,J=Z.writable||Z.writable!==!1&&$.writable,W=!1,K=function(){if(!$.writable)H()},H=function(){if(J=!1,!G)X.call($)},N=function(){if(G=!1,!J)X.call($)},F=function(L){X.call($,L?Error("exited with error code: "+L):null)},U=function(L){X.call($,L)},w=function(){oG4(O)},O=function(){if(W)return;if(G&&!(Y&&(Y.ended&&!Y.destroyed)))return X.call($,Error("premature close"));if(J&&!(Q&&(Q.ended&&!Q.destroyed)))return X.call($,Error("premature close"))},D=function(){$.req.on("finish",H)};if(rG4($))if($.on("complete",H),$.on("abort",w),$.req)D();else $.on("request",D);else if(J&&!Q)$.on("end",K),$.on("close",K);if(aG4($))$.on("exit",F);if($.on("end",N),$.on("finish",H),Z.error!==!1)$.on("error",U);return $.on("close",w),function(){if(W=!0,$.removeListener("complete",H),$.removeListener("abort",w),$.removeListener("request",D),$.req)$.req.removeListener("finish",H);$.removeListener("end",K),$.removeListener("close",K),$.removeListener("finish",H),$.removeListener("exit",F),$.removeListener("end",N),$.removeListener("error",U),$.removeListener("close",w)}};OY$.exports=wY$});var EY$=C((cE9,LY$)=>{var sG4=Kn0(),eG4=BY$(),oU0;try{oU0=z0("fs")}catch($){}var tn=function(){},$J4=typeof process>"u"?!1:/^v?\.0/.test(process.version),rU0=function($){return typeof $==="function"},ZJ4=function($){if(!$J4)return!1;if(!oU0)return!1;return($ instanceof(oU0.ReadStream||tn)||$ instanceof(oU0.WriteStream||tn))&&rU0($.close)},XJ4=function($){return $.setHeader&&rU0($.abort)},QJ4=function($,Z,X,Q){Q=sG4(Q);var Y=!1;$.on("close",function(){Y=!0}),eG4($,{readable:Z,writable:X},function(J){if(J)return Q(J);Y=!0,Q()});var G=!1;return function(J){if(Y)return;if(G)return;if(G=!0,ZJ4($))return $.close(tn);if(XJ4($))return $.abort();if(rU0($.destroy))return $.destroy();Q(J||Error("stream was destroyed"))}},DY$=function($){$()},YJ4=function($,Z){return $.pipe(Z)},GJ4=function(){var $=Array.prototype.slice.call(arguments),Z=rU0($[$.length-1]||tn)&&$.pop()||tn;if(Array.isArray($[0]))$=$[0];if($.length<2)throw Error("pump requires two streams per minimum");var X,Q=$.map(function(Y,G){var J=G<$.length-1,W=G>0;return QJ4(Y,J,W,function(K){if(!X)X=K;if(K)Q.forEach(DY$);if(J)return;Q.forEach(DY$),Z(X)})});return $.reduce(YJ4)};LY$.exports=GJ4});var MY$=C((HJ4)=>{var jY$=WY$(),zY$=EY$(),PY$=z0("fs"),r5=z0("path"),on=(global.Bare?global.Bare.platform:process.platform)==="win32";HJ4.pack=function(Z,X){if(!Z)Z=".";if(!X)X={};let Q=X.fs||PY$,Y=X.ignore||X.filter||rn,G=X.mapStream||IY$,J=KJ4(Q,X.dereference?Q.stat:Q.lstat,Z,Y,X.entries,X.sort),W=X.strict!==!1,K=typeof X.umask==="number"?~X.umask:~AY$(),H=X.pack||jY$.pack(),N=X.finish||rn,F=X.map||rn,U=typeof X.dmode==="number"?X.dmode:0,w=typeof X.fmode==="number"?X.fmode:0;if(X.strip)F=qY$(F,X.strip);if(X.readable)U|=parseInt(555,8),w|=parseInt(444,8);if(X.writable)U|=parseInt(333,8),w|=parseInt(222,8);L();function O(E,j){Q.readlink(r5.join(Z,E),function(z,A){if(z)return H.destroy(z);j.linkname=Hn0(A),H.entry(j,L)})}function D(E,j,z){if(H.destroyed)return;if(E)return H.destroy(E);if(!j){if(X.finalize!==!1)H.finalize();return N(H)}if(z.isSocket())return L();let A={name:Hn0(j),mode:(z.mode|(z.isDirectory()?U:w))&K,mtime:z.mtime,size:z.size,type:"file",uid:z.uid,gid:z.gid};if(z.isDirectory())return A.size=0,A.type="directory",A=F(A)||A,H.entry(A,L);if(z.isSymbolicLink())return A.size=0,A.type="symlink",A=F(A)||A,O(j,A);if(A=F(A)||A,!z.isFile()){if(W)return H.destroy(Error("unsupported type for "+j));return L()}let P=H.entry(A,L),M=G(Q.createReadStream(r5.join(Z,j),{start:0,end:A.size>0?A.size-1:A.size}),A);M.on("error",function(k){P.destroy(k)}),zY$(M,P)}function L(E){if(E)return H.destroy(E);J(D)}return H};function JJ4($){return $.length?$[$.length-1]:null}function WJ4(){return!global.Bare&&process.getuid?process.getuid():-1}function AY$(){return!global.Bare&&process.umask?process.umask():0}HJ4.extract=function(Z,X){if(!Z)Z=".";if(!X)X={};Z=r5.resolve(Z);let Q=X.fs||PY$,Y=X.ignore||X.filter||rn,G=X.mapStream||IY$,J=X.chown!==!1&&!on&&WJ4()===0,W=X.extract||jY$.extract(),K=[],H=new Date,N=typeof X.umask==="number"?~X.umask:~AY$(),F=X.strict!==!1,U=X.validateSymlinks!==!1,w=X.map||rn,O=typeof X.dmode==="number"?X.dmode:0,D=typeof X.fmode==="number"?X.fmode:0;if(X.strip)w=qY$(w,X.strip);if(X.readable)O|=parseInt(555,8),D|=parseInt(444,8);if(X.writable)O|=parseInt(333,8),D|=parseInt(222,8);if(W.on("entry",L),X.finish)W.on("finish",X.finish);return W;function L(P,M,k){P=w(P)||P,P.name=Hn0(P.name);let q=r5.join(Z,r5.join("/",P.name));if(Y(q,P))return M.resume(),k();let _=r5.join(q,".")===r5.join(Z,".")?Z:r5.dirname(q);RY$(Q,_,r5.join(Z,"."),function(Y0,L0){if(Y0)return k(Y0);if(!L0)return k(Error(_+" is not a valid path"));if(P.type==="directory")return K.push([q,P.mtime]),A(q,{fs:Q,own:J,uid:P.uid,gid:P.gid,mode:P.mode},h);A(_,{fs:Q,own:J,uid:P.uid,gid:P.gid,mode:493},function(E0){if(E0)return k(E0);switch(P.type){case"file":return m();case"link":return x();case"symlink":return b()}if(F)return k(Error("unsupported type for "+q+" ("+P.type+")"));M.resume(),k()})});function h(Y0){if(Y0)return k(Y0);j(q,P,function(L0){if(L0)return k(L0);if(on)return k();z(q,P,k)})}function b(){if(on)return k();Q.unlink(q,function(){let Y0=r5.resolve(r5.dirname(q),P.linkname);if(!p(Y0)&&U)return k(Error(q+" is not a valid symlink"));TY$(Q,Y0,r5.join(Z,"."),function(L0,E0){if(L0)return k(L0);if(!E0&&U)return k(Error(q+" is not a valid symlink"));Q.symlink(P.linkname,q,h)})})}function x(){if(on)return k();Q.unlink(q,function(){let Y0=r5.join(Z,r5.join("/",P.linkname));Q.realpath(Y0,function(L0,E0){if(L0||!p(E0))return k(Error(q+" is not a valid hardlink"));Q.link(E0,q,function(e){if(e&&e.code==="EPERM"&&X.hardlinkAsFilesFallback)return M=Q.createReadStream(E0),m();h(e)})})})}function p(Y0){return Y0===Z||Y0.startsWith(Z+r5.sep)}function m(){let Y0=Q.createWriteStream(q),L0=G(M,P);Y0.on("error",function(E0){L0.destroy(E0)}),zY$(L0,Y0,function(E0){if(E0)return k(E0);Y0.on("close",h)})}}function E(P,M){let k;while((k=JJ4(K))&&P.slice(0,k[0].length)!==k[0])K.pop();if(!k)return M();Q.utimes(k[0],H,k[1],M)}function j(P,M,k){if(X.utimes===!1)return k();if(M.type==="directory")return Q.utimes(P,H,M.mtime,k);if(M.type==="symlink")return E(P,k);Q.utimes(P,H,M.mtime,function(q){if(q)return k(q);E(P,k)})}function z(P,M,k){let q=M.type==="symlink",_=q?Q.lchmod:Q.chmod,h=q?Q.lchown:Q.chown;if(!_)return k();let b=(M.mode|(M.type==="directory"?O:D))&N;if(h&&J)h.call(Q,P,M.uid,M.gid,x);else x(null);function x(p){if(p)return k(p);if(!_)return k();_.call(Q,P,b,k)}}function A(P,M,k){Q.stat(P,function(q){if(!q)return k(null);if(q.code!=="ENOENT")return k(q);Q.mkdir(P,{mode:M.mode,recursive:!0},function(_,h){if(_)return k(_);z(P,M,k)})})}};function TY$($,Z,X,Q){if(Z===X)return Q(null,!0);if(!Z.startsWith(X+r5.sep))return Q(null,!1);$.lstat(Z,function(Y,G){if(Y&&Y.code!=="ENOENT"&&Y.code!=="EPERM")return Q(Y);if(Y||!G.isSymbolicLink())return TY$($,r5.join(Z,".."),X,Q);Q(null,!1)})}function RY$($,Z,X,Q){if(Z===X)return Q(null,!0);$.lstat(Z,function(Y,G){if(Y&&Y.code!=="ENOENT"&&Y.code!=="EPERM")return Q(Y);if(Y||G.isDirectory())return RY$($,r5.join(Z,".."),X,Q);Q(null,!1)})}function rn(){}function IY$($){return $}function Hn0($){return on?$.replace(/\\/g,"/").replace(/[:?<>|]/g,"_"):$}function KJ4($,Z,X,Q,Y,G){if(!Y)Y=["."];let J=Y.slice(0);return function(K){if(!J.length)return K(null);let H=J.shift(),N=r5.join(X,H);Z.call($,N,function(F,U){if(F)return K(Y.indexOf(H)===-1&&F.code==="ENOENT"?null:F);if(!U.isDirectory())return K(null,H,U);$.readdir(N,function(w,O){if(w)return K(w);if(G)O.sort();for(let D=0;D<O.length;D++)if(!Q(r5.join(X,H,O[D])))J.push(r5.join(H,O[D]));K(null,H,U)})})}}function qY$($,Z){return function(X){X.name=X.name.split("/").slice(Z).join("/");let Q=X.linkname;if(Q&&(X.type==="link"||r5.isAbsolute(Q)))X.linkname=Q.split("/").slice(Z).join("/");return $(X)}}});var UJ4,wJ4;var kY$=B(()=>{pi0();UJ4=S(BQ$(),1),wJ4=S(MY$(),1)});var aU0=()=>{};var SY$=B(()=>{FU0()});var VY$=B(()=>{gU0();yU0();aU0()});var CY$=()=>{};var _Y$=()=>{};var Nn0=B(()=>{rX$();ii0();gU0();ZQ$();di0();pi0();XQ$();QQ$();YQ$();GQ$();mi0();JQ$();kY$();aU0();SY$();VY$();CY$();_Y$();aU0()});var O9,k9,qV,an;var sn=B(()=>{O9={CLAIM_API_GROUP:"extensions.agents.x-k8s.io",CLAIM_API_VERSION:"v1alpha1",CLAIM_PLURAL:"sandboxclaims",SANDBOX_API_GROUP:"agents.x-k8s.io",SANDBOX_API_VERSION:"v1alpha1",SANDBOX_PLURAL:"sandboxes",POD_NAME_ANNOTATION:"agents.x-k8s.io/pod-name"};k9=class k9 extends Error{cause;constructor($,Z){super($);if(this.name="SandboxError",this.cause=Z,Z instanceof Error&&Z.stack)this.stack=`${this.stack}
 Caused by: ${Z.stack}`}};qV=class qV extends k9{constructor($,Z){super($,Z);this.name="SandboxTimeoutError"}};an=class an extends k9{constructor($,Z){super($,Z);this.name="SandboxAlreadyExistsError"}}});async function OJ4($){let Z=$.getCurrentCluster();if(!Z)throw new k9("No active cluster in kubeconfig");let X={};await $.applyToHTTPSOptions(X);let Q={},Y=X.headers??{};for(let[G,J]of Object.entries(Y))if(Array.isArray(J))Q[G]=J.join(", ");else if(J!==void 0)Q[G]=String(J);if(typeof X.auth==="string"&&!Q.Authorization)Q.Authorization=`Basic ${Buffer.from(X.auth).toString("base64")}`;return{server:Z.server.replace(/\/+$/,""),headers:Q,tls:{cert:Fn0(X.cert),key:Fn0(X.key),ca:Fn0(X.ca),rejectUnauthorized:Z.skipTLSVerify?!1:void 0}}}function Fn0($){if($==null)return;if(typeof $==="string")return $;if(Buffer.isBuffer($))return $.toString("utf8");return String($)}async function B3($,Z){let X=await OJ4($),Q={...X.headers,...Z.headers};if(Z.method==="PATCH")Q["content-type"]=Z.patchType==="apply"?"application/apply-patch+yaml":Z.patchType==="strategic-merge"?"application/strategic-merge-patch+json":"application/merge-patch+json";else if(Z.body!==void 0&&!("content-type"in Q))Q["content-type"]="application/json";let Y={method:Z.method,headers:Q,body:Z.body===void 0?void 0:JSON.stringify(Z.body),signal:Z.signal,tls:X.tls,...Z.stream?{timeout:!1}:{}};return fetch(`${X.server}${Z.path}`,Y)}async function Un0($){try{return await $.json()}catch{return null}}async function sU0($,Z){if($.ok)return;let X=await Un0($),Q=X?.message??`${Z} failed: ${$.status} ${$.statusText}`;throw new vY$($.status,X,Q)}async function nx($,Z,X,Q,Y="none"){try{let G=await B3($,Z);if(G.status===404)return null;if(await sU0(G,X),Y==="json")return await G.json();return null}catch(G){throw new k9(Q,G)}}async function en($,Z,X){let Q=`${wn0}/${encodeURIComponent(Z)}/${O9.CLAIM_PLURAL}`,Y;try{Y=await B3($,{method:"POST",path:Q,body:X})}catch(H){let N=H instanceof Error?H.message:String(H);throw console.warn(`[agent-sandbox/client] createSandboxClaim ${X.metadata.name} transport error: ${N}`),new k9(`Failed to create SandboxClaim: ${X.metadata.name} (transport error: ${N})`,H)}if(Y.ok)return;let G=await Un0(Y),J=G?.reason?` ${G.reason}`:"",W=G?.message??Y.statusText,K=`Failed to create SandboxClaim: ${X.metadata.name} (${Y.status}${J}: ${W})`;if(console.warn(`[agent-sandbox/client] createSandboxClaim ${X.metadata.name} rejected: status=${Y.status} reason=${G?.reason??"<none>"} message=${W}`),Y.status===409)throw new an(K);throw new k9(K)}async function eU0($,Z,X,Q=60000){let Y=Date.now()+Q,G=500,J;while(!0){let W=await D3($,Z,X).catch(()=>{return});if(!W)return;if(J=W,Date.now()>=Y){let K=J.metadata?.finalizers??[],H=J.metadata?.deletionTimestamp??"<unknown>";throw new qV(`SandboxClaim ${X} still terminating after ${Q}ms (deletionTimestamp=${H}, finalizers=[${K.join(", ")}])`)}await y$(500)}}function On0($,Z){return`${wn0}/${encodeURIComponent($)}/${O9.CLAIM_PLURAL}/${encodeURIComponent(Z)}`}async function $w0($,Z,X,Q){await nx($,{method:"PATCH",path:On0(Z,X),patchType:"merge",body:{spec:{lifecycle:{shutdownPolicy:"Delete",shutdownTime:Q}}}},"patchSandboxClaimShutdown",`Failed to patch SandboxClaim shutdownTime: ${X}`)}async function ow($,Z,X){await nx($,{method:"DELETE",path:On0(Z,X)},"deleteSandboxClaim",`Failed to delete SandboxClaim: ${X}`)}async function D3($,Z,X){return await nx($,{method:"GET",path:On0(Z,X)},"getSandboxClaim",`Failed to get SandboxClaim: ${X}`,"json")??void 0}async function bY$($,Z,X,Q=60){let Y=Date.now()+Q*1000,G=200;while(Date.now()<Y){let W=(await D3($,Z,X).catch(()=>{return}))?.status?.sandbox?.name;if(W)return W;await y$(200)}throw new qV(`SandboxClaim ${X} did not record an adopted Sandbox (status.sandbox.name) within ${Q}s`)}async function fY$($,Z,X){let Y=(await nx($,{method:"GET",path:`${wn0}/${encodeURIComponent(Z)}/sandboxwarmpools/${encodeURIComponent(X)}`},"getSandboxWarmPool",`Failed to get SandboxWarmPool: ${X}`,"json"))?.status?.selector;if(!Y)return null;let G=await B3($,{method:"GET",path:`/api/v1/namespaces/${encodeURIComponent(Z)}/pods?labelSelector=${encodeURIComponent(Y)}`});return await sU0(G,"listWarmPoolPods"),((await G.json()).items??[]).filter((W)=>W.status?.phase==="Running").flatMap((W)=>W.metadata?.name&&W.metadata.uid?[{name:W.metadata.name,uid:W.metadata.uid,labels:W.metadata.labels??{}}]:[])}async function xY$($,Z,X,Q){try{let Y=await B3($,{method:"GET",path:`/api/v1/namespaces/${encodeURIComponent(Z)}/pods/${encodeURIComponent(X)}`});if(!Y.ok)return!1;return!(await Y.json()).metadata?.labels?.[Q]}catch{return!1}}function Bn0($,Z){return`${BJ4}/${encodeURIComponent($)}/${hY$}/${encodeURIComponent(Z)}`}async function Zw0($,Z,X){let Q=new URLSearchParams({fieldManager:cY$,force:"true"}),Y=`${Bn0(Z,X.metadata.name)}?${Q}`;try{let G=await B3($,{method:"PATCH",path:Y,patchType:"apply",body:X});await sU0(G,"applyHttpRoute")}catch(G){throw new k9(`Failed to apply HTTPRoute: ${X.metadata.name}`,G)}}async function Xw0($,Z,X){await nx($,{method:"DELETE",path:Bn0(Z,X)},"deleteHttpRoute",`Failed to delete HTTPRoute: ${X}`)}async function uY$($,Z,X){return await nx($,{method:"GET",path:Bn0(Z,X)},"getHttpRoute",`Failed to get HTTPRoute: ${X}`,"json")??void 0}async function lY$($,Z,X,Q){let Y={apiVersion:"v1",kind:"Service",metadata:{name:X},spec:{ports:[{name:Q.name,port:Q.port,targetPort:Q.targetPort,protocol:Q.protocol??"TCP"}]}},G=new URLSearchParams({fieldManager:cY$,force:"true"}),J=`/api/v1/namespaces/${encodeURIComponent(Z)}/services/${encodeURIComponent(X)}?${G}`;try{let W=await B3($,{method:"PATCH",path:J,patchType:"apply",body:Y});await sU0(W,"ensureServicePort")}catch(W){throw new k9(`Failed to apply Service ports: ${X}`,W)}}function Qw0($,Z,X,Q=180){let Y=`/apis/${O9.SANDBOX_API_GROUP}/${O9.SANDBOX_API_VERSION}/namespaces/${encodeURIComponent(Z)}/${O9.SANDBOX_PLURAL}?watch=true&fieldSelector=${encodeURIComponent(`metadata.name=${X}`)}`,{resolve:G,reject:J,promise:W}=Promise.withResolvers(),K=new AbortController,H=!1,N=setTimeout(()=>{if(H)return;H=!0,K.abort(),J(new qV(`Sandbox did not become ready within ${Q} seconds`))},Q*1000),F=(U)=>{if(H)return;H=!0,clearTimeout(N),K.abort(),U()};return(async()=>{let U;try{U=await B3($,{method:"GET",path:Y,signal:K.signal,headers:{accept:"application/json"},stream:!0})}catch(w){F(()=>J(new k9("Failed to start watch for sandbox readiness",w)));return}if(!U.ok||!U.body){let w=await Un0(U).catch(()=>null);F(()=>J(new k9(`Watch handshake failed (${U.status}): ${w?.message??U.statusText}`)));return}try{for await(let w of Dn0(U.body)){if(H)return;if(w.type==="ERROR"){let j=w.object;F(()=>J(new k9(`Watch stream error while waiting for sandbox: ${j.message??"unknown"}`)));return}if(w.type!=="ADDED"&&w.type!=="MODIFIED")continue;let O=w.object;if(!O.status?.conditions?.find((j)=>j.type==="Ready"&&j.status==="True"))continue;let L=O.metadata?.name;if(!L){F(()=>J(new k9("Sandbox metadata or name is missing")));return}let E=O.metadata?.annotations?.[O9.POD_NAME_ANNOTATION]??L;F(()=>G({sandboxName:L,podName:E}));return}F(()=>J(new k9("Watch stream closed before sandbox became ready")))}catch(w){if(H)return;if(w instanceof Error&&(w.name==="AbortError"||K.signal.aborted))return;F(()=>J(new k9("Watch stream error while waiting for sandbox",w)))}})(),W}async function*Dn0($){let Z=$.getReader(),X=new TextDecoder,Q="";try{while(!0){let{value:G,done:J}=await Z.read();if(J)break;Q+=X.decode(G,{stream:!0});let W;while((W=Q.indexOf(`
-`))>=0){let K=Q.slice(0,W).trim();if(Q=Q.slice(W+1),!K)continue;yield JSON.parse(K)}}let Y=Q.trim();if(Y)yield JSON.parse(Y)}finally{Z.releaseLock()}}var vY$,wn0,yY$="gateway.networking.k8s.io",gY$="v1",hY$="httproutes",BJ4,$p,cY$="mesh-sandbox-runner";var Zp=B(()=>{B6();sn();vY$=class vY$ extends Error{status;body;constructor($,Z,X){super(X);this.status=$;this.body=Z;this.name="KubeHttpError"}};wn0=`/apis/${O9.CLAIM_API_GROUP}/${O9.CLAIM_API_VERSION}/namespaces`;BJ4=`/apis/${yY$}/${gY$}/namespaces`;$p={API_GROUP:yY$,API_VERSION:gY$,PLURAL:hY$}});function LJ4($){return($.items??[]).some((Z)=>{if(Z.status?.phase!=="Pending")return!1;return(Z.status?.conditions??[]).some((X)=>X.type==="PodScheduled"&&X.status==="False"&&X.reason==="Unschedulable")})}function mY$($,Z){let X=0,Q=!0,Y=null,G=async()=>{try{let J=await B3($,{method:"GET",path:`/api/v1/namespaces/${encodeURIComponent(Z)}/pods?fieldSelector=status.phase%3DPending`});if(!J.ok)return dY$;let W=await J.json();return!LJ4(W)}catch{return dY$}};return async()=>{if(Date.now()-X<DJ4)return Q;return Y??=G().finally(()=>{Y=null}),Q=await Y,X=Date.now(),Q}}var DJ4=3000,dY$=!0;var iY$=B(()=>{Zp()});var Ln0=B(()=>{B6();Um0()});async function Gw0($){try{let Z=await fetch(`${$}/health`,{signal:AbortSignal.timeout(EJ4)});if(!Z.ok)return null;let X=await Z.json();if(typeof X==="object"&&X!==null&&typeof X.bootId==="string"&&typeof X.ready==="boolean"&&X.setup&&typeof X.setup.running==="boolean"&&typeof X.setup.done==="boolean")return X;return null}catch{return null}}async function jn0($){for(let Z=0;Z<nY$;Z++){if(await Gw0($)!==null)return;let X=(Math.random()*2-1)*jJ4;await y$(pY$+X)}throw Error(`sandbox daemon at ${$} did not respond on /health within ${nY$*pY$/1000}s`)}async function MV($,Z,X,Q,Y){return zJ4($,Z,"POST",X,Q,Y)}async function zJ4($,Z,X,Q,Y,G){let J={...Q};if(Y&&Y.rotateToken!==void 0)J.auth=Y;let W=await fetch(`${$}/_sandbox/config`,{method:X,headers:{"Content-Type":"application/json",Authorization:`Bearer ${Z}`},body:JSON.stringify(J),signal:AbortSignal.timeout(G?.timeoutMs??En0)}),K=await W.text();if(!W.ok)throw new Yw0(W.status,K);return JSON.parse(K)}async function tY$($,Z,X){let Q=await fetch(`${$}/_sandbox/setup/${X}`,{method:"POST",headers:{Authorization:`Bearer ${Z}`},signal:AbortSignal.timeout(En0)});if(!Q.ok)throw Error(`sandbox daemon /_sandbox/setup/${X} returned ${Q.status}: ${await Q.text()}`)}async function oY$($,Z,X){let Q=await fetch(`${$}/_sandbox/orgfs-config`,{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${Z}`},body:X,signal:AbortSignal.timeout(En0)}),Y=await Q.text();if(!Q.ok)throw Error(`sandbox daemon /_sandbox/orgfs-config returned ${Q.status}: ${Y}`);return JSON.parse(Y)}async function Xp($,Z,X,Q){let Y=new Headers(Q.headers);for(let W of PJ4)Y.delete(W);Y.set("authorization",`Bearer ${Z}`);let G=Q.method!=="GET"&&Q.method!=="HEAD",J=`${$}${X.startsWith("/")?X:`/${X}`}`;return fetch(J,{method:Q.method,headers:Y,body:G?Q.body:void 0,redirect:"manual",signal:Q.signal,duplex:G?"half":void 0})}var Yw0,EJ4=500,En0=30000,nY$=25,pY$=200,jJ4=50,PJ4;var rY$=B(()=>{Ln0();Yw0=class Yw0 extends Error{status;constructor($,Z){super(`sandbox daemon /_sandbox/config returned ${$}: ${Z}`);this.status=$;this.name="ConfigRequestError"}};PJ4=["cookie","host","connection","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","accept-encoding","content-length"]});async function*eY$($){let Z=$.now??(()=>Date.now()),X=Z(),Q=$.schedulingTimeoutMs??RJ4,Y={pod:{},sandbox:{},events:{hasPulling:!1,hasPulled:!1},startedAt:X},G=[],J=null,W=!1,K=(j)=>{if(W)return;if(J){let z=J;J=null,z(j)}else G.push(j)},H=()=>{if(G.length>0)return Promise.resolve(G.shift());if(W)return Promise.resolve(null);return new Promise((j)=>{J=j})},N=()=>{if(W)return;if(W=!0,J){let j=J;J=null,j(null)}},F=new AbortController,U=()=>{F.abort(),N()};if($.signal)if($.signal.aborted)F.abort(),N();else $.signal.addEventListener("abort",U,{once:!0});let w=Math.max(0,Q-(Z()-X)),O=setTimeout(()=>K("tick"),w+100),D,L=new Promise((j)=>{D=j}),E=Promise.allSettled([IJ4($.kc,$.namespace,$.claimName,F.signal,Y,K,Z,D),MJ4($.kc,$.namespace,$.claimName,F.signal,Y,K),kJ4($.kc,$.namespace,$.claimName,L,F.signal,Y,K,Z)]);try{let j=null,z=-1,A=aY$(Y,Q,Z);if(j=Pn0(A),!zn0(A))z=sY$(A);if(yield A,zn0(A))return;while(!W){if(await H()===null)break;let M=aY$(Y,Q,Z);if(zn0(M)){let _=Pn0(M);if(_!==j)j=_,yield M;return}let k=sY$(M);if(k<z)continue;let q=Pn0(M);if(q!==j)j=q,z=k,yield M}}finally{if(clearTimeout(O),F.abort(),$.signal)$.signal.removeEventListener("abort",U);N(),await E.catch(()=>{})}}function aY$($,Z,X){let{pod:Q,sandbox:Y,events:G,startedAt:J}=$;if(Y.ready)return{kind:"ready"};let W=Q.containerWaitingReason;if(W==="ImagePullBackOff"||W==="ErrImagePull")return{kind:"failed",reason:"image-pull-backoff",message:"Sandbox image failed to download. The cluster may be missing pull credentials or the image tag may not exist."};if(W==="CrashLoopBackOff")return{kind:"failed",reason:"crash-loop-backoff",message:"Sandbox crashed during startup and is now in CrashLoopBackOff. Check pod logs."};if(!Q.scheduled&&G.lastFailedSchedulingAt!==void 0&&X()-J>Z)return{kind:"failed",reason:"scheduling-timeout",message:G.failedSchedulingMessage??`Pod could not be scheduled within ${Math.round(Z/1000)}s.`};if(Q.containerRunning&&!Q.containerReady)return{kind:"warming-daemon",since:J};if(G.hasPulling&&!G.hasPulled)return{kind:"pulling-image",since:J};if(W==="ContainerCreating"||W==="PodInitializing"||Q.scheduled&&!Q.containerRunning)return{kind:"starting-container",since:J};if(Q.scheduledFalseReason==="Unschedulable"||G.lastFailedSchedulingAt!==void 0&&!Q.scheduled)return{kind:"waiting-for-capacity",since:J,message:G.failedSchedulingMessage??Q.scheduledFalseMessage,nodeClaim:G.nominatedNodeClaim};return{kind:"claiming",since:J}}function zn0($){return $.kind==="ready"||$.kind==="failed"}function sY$($){switch($.kind){case"claiming":return 0;case"waiting-for-capacity":return 1;case"pulling-image":return 2;case"starting-container":return 3;case"warming-daemon":return 4;case"ready":case"failed":return 99}}function Pn0($){switch($.kind){case"claiming":case"pulling-image":case"starting-container":case"warming-daemon":return $.kind;case"waiting-for-capacity":return`waiting-for-capacity:${$.message??""}:${$.nodeClaim??""}`;case"ready":return"ready";case"failed":return`failed:${$.reason}:${$.message}`}}async function IJ4($,Z,X,Q,Y,G,J,W){let K=`/api/v1/namespaces/${encodeURIComponent(Z)}/pods?watch=true&labelSelector=${encodeURIComponent(`${AJ4}=${X}`)}`;return Jw0({kc:$,path:K,signal:Q,label:`pod/${X}`,onEvent:(H)=>{if(H.type!=="ADDED"&&H.type!=="MODIFIED")return;let N=H.object;if(N.metadata?.name)W(N.metadata.name);qJ4(N,Y,J),G("pod")}})}function qJ4($,Z,X){let Y=($.status?.conditions??[]).find((J)=>J.type==="PodScheduled");if(Y?.status==="True")Z.pod.scheduled=!0,Z.pod.scheduledFalseReason=void 0,Z.pod.scheduledFalseMessage=void 0;else if(Y?.status==="False")Z.pod.scheduled=!1,Z.pod.scheduledFalseReason=Y.reason,Z.pod.scheduledFalseMessage=Y.message;let G=($.status?.containerStatuses??[]).find((J)=>J.name===TJ4);if(G)Z.pod.containerWaitingReason=G.state?.waiting?.reason,Z.pod.containerRunning=!!G.state?.running,Z.pod.containerReady=G.ready===!0}async function MJ4($,Z,X,Q,Y,G){let J=`/apis/${O9.CLAIM_API_GROUP}/${O9.CLAIM_API_VERSION}/namespaces/${encodeURIComponent(Z)}/${O9.CLAIM_PLURAL}?watch=true&fieldSelector=${encodeURIComponent(`metadata.name=${X}`)}`;return Jw0({kc:$,path:J,signal:Q,label:`sandboxclaim/${X}`,onEvent:(W)=>{if(W.type!=="ADDED"&&W.type!=="MODIFIED")return;let H=W.object.status?.conditions?.find((N)=>N.type==="Ready");if(!H)return;if(H.status==="True")Y.sandbox.ready=!0,Y.sandbox.notReadyReason=void 0,Y.sandbox.notReadyMessage=void 0;else Y.sandbox.ready=!1,Y.sandbox.notReadyReason=H.reason,Y.sandbox.notReadyMessage=H.message;G("sandbox")}})}async function kJ4($,Z,X,Q,Y,G,J,W){let K=await Promise.race([Q,new Promise((N)=>{if(Y.aborted){N(X);return}Y.addEventListener("abort",()=>N(X),{once:!0})})]);if(Y.aborted)return;let H=`/api/v1/namespaces/${encodeURIComponent(Z)}/events?watch=true&fieldSelector=${encodeURIComponent(`involvedObject.name=${K},involvedObject.kind=Pod`)}`;return Jw0({kc:$,path:H,signal:Y,label:`events/${X}`,onEvent:(N)=>{if(N.type!=="ADDED"&&N.type!=="MODIFIED")return;let F=N.object,U=F.reason;if(!U)return;switch(U){case"Pulling":G.events.hasPulling=!0;break;case"Pulled":G.events.hasPulling=!0,G.events.hasPulled=!0;break;case"FailedScheduling":G.events.lastFailedSchedulingAt=W(),G.events.failedSchedulingMessage=F.message;break;case"Nominated":{let w=F.message?.match(/nodeclaim\/([\w-]+)/);if(w)G.events.nominatedNodeClaim=w[1];break}default:return}J("event")}})}async function $G$($){let{kc:Z,namespace:X,labelSelector:Q,signal:Y,onDelete:G}=$,J=`/apis/${O9.CLAIM_API_GROUP}/${O9.CLAIM_API_VERSION}/namespaces/${encodeURIComponent(X)}/${O9.CLAIM_PLURAL}?watch=true&labelSelector=${encodeURIComponent(Q)}`;return Jw0({kc:Z,path:J,signal:Y,label:"sandboxclaim-reaper",onEvent:(W)=>{if(W.type!=="DELETED")return;let K=W.object.metadata?.name;if(K)G(K)}})}async function Jw0($){let{kc:Z,path:X,signal:Q,label:Y,onEvent:G}=$,J=0;while(!Q.aborted){try{let K=await B3(Z,{method:"GET",path:X,signal:Q,headers:{accept:"application/json"},stream:!0});if(!K.ok||!K.body){try{await K.body?.cancel()}catch{}if(K.status===401||K.status===403){console.warn(`[lifecycle-watcher] ${Y} stopped: watch denied (${K.status} ${K.statusText}). `+"The kubeconfig in use cannot watch SandboxClaims \u2014 if you are running locally, "+"this provider should not be active (check STUDIO_SANDBOX_PROVIDER / your sandbox preference).");return}throw Error(`watch handshake failed: ${K.status} ${K.statusText}`)}J=0;for await(let H of Dn0(K.body)){if(Q.aborted)return;try{G(H)}catch(N){console.warn(`[lifecycle-watcher] ${Y} onEvent threw: ${N instanceof Error?N.message:String(N)}`)}}}catch(K){if(Q.aborted)return;let H=K instanceof Error?K.message:String(K);console.warn(`[lifecycle-watcher] ${Y} watch ended: ${H}`)}if(Q.aborted)return;let W=JX(5000,250,J,2,0);J+=1,await y$(W,{signal:Q}).catch(()=>{})}}var AJ4="studio.decocms.com/sandbox-handle",TJ4="sandbox",RJ4=300000;var ZG$=B(()=>{B6();sn();Zp()});import{z as vG}from"zod";function XG$($){if(!$||$.trim()==="")return[];let Z=vG.array(SJ4).parse(JSON.parse($)),X=new Set;for(let Q of Z){if(X.has(Q.name))throw Error(`STUDIO_SANDBOX_TENANT_POOLS: duplicate pool name ${Q.name}`);X.add(Q.name)}return Z}function VJ4($){try{let[Z,X]=new URL($).pathname.replace(/^\/+/,"").split("/"),Q=X?.replace(/\.git$/,"");return Z&&Q?`${Z}/${Q}`.toLowerCase():null}catch{return null}}function QG$($,Z){let{orgId:X,cloneUrl:Q}=Z;if(Z.cloneOnly===!0)return null;if(!X||!Q)return null;let Y=VJ4(Q);if(!Y)return null;return $.find((G)=>G.orgId===X&&G.repo.toLowerCase()===Y)??null}function YG$($,Z){return $?.name??(Z?"default":"none")}function GG$($,Z,X){let Q=X.replace(/^refs\/heads\//,"");return $.filter((Y)=>Y.repo.toLowerCase()===Z.toLowerCase()&&Y.branch===Q)}function JG$($){return`https://github.com/${$.repo}.git`}var SJ4;var An0=B(()=>{SJ4=vG.object({name:vG.string().regex(/^[a-z0-9]([-a-z0-9]*[a-z0-9])?$/,"pool name must be a DNS label (lowercase alphanumeric and '-')"),orgId:vG.string().min(1),repo:vG.string().regex(/^[^/\s]+\/[^/\s]+$/,"repo must be `owner/name`"),connectionId:vG.string().min(1).optional(),branch:vG.string().min(1).default("main"),workload:vG.object({runtime:vG.enum(["node","bun","deno"]).default("node"),packageManager:vG.enum(["npm","pnpm","yarn","bun","deno"]).optional(),packageManagerPath:vG.string().optional(),devPort:vG.number().int().positive().optional()}).default({runtime:"node"})})});async function WG$($,Z,X){let Q=new Map;for(let Y of $){let G=Z(Y);if(!G)continue;let J=Q.get(G);if(J)J.push(Y);else Q.set(G,[Y])}await Promise.allSettled([...Q.values()].map(async(Y)=>{for(let G of Y)await X(G).catch(()=>{})}))}import{createHash as CJ4,randomBytes as _J4,randomUUID as vJ4}from"crypto";import*as wG$ from"net";import{PassThrough as bJ4}from"stream";function fJ4($){if($ instanceof Error)return $.message;if($&&typeof $==="object"){let Z=$;if(Z.error instanceof Error)return Z.error.message;if(typeof Z.message==="string"&&Z.message)return Z.message}return String($)}class kn0{kind=bQ;records=new Map;inflight=new C90;stateStore;previewUrlPattern;kubeConfig;capacityProbe;portForward;namespace;sandboxTemplateName;envName;tokenGenerator;idleTtlMs;metrics;previewGateway;sentinelToken;mintCloneUrl;tenantPools;tenantPoolRefreshMs;poolPods=new Map;dirtyPools=new Set;closed=!1;claimWatchAbort=new AbortController;constructor($={}){this.stateStore=$.stateStore??null,this.previewUrlPattern=$.previewUrlPattern??null,this.kubeConfig=$.kubeConfig??tJ4(),this.portForward=new ti0(this.kubeConfig),this.namespace=$.namespace??xJ4,this.sandboxTemplateName=$.sandboxTemplateName??yJ4,this.envName=$34($.envName),this.tokenGenerator=$.tokenGenerator??(()=>_J4(gJ4).toString("hex")),this.idleTtlMs=$.idleTtlMs??uJ4,this.metrics=$.meter?pJ4($.meter):null,this.previewGateway=$.previewGateway&&$.previewUrlPattern?{...$.previewGateway}:null;let Z=$.sentinelToken?.trim()??"";if(this.sentinelToken=Z.length>0?Z:null,this.mintCloneUrl=$.mintCloneUrl,this.tenantPools=this.sentinelToken!==null?$.tenantPools??[]:[],this.sentinelToken===null&&($.tenantPools?.length??0)>0)console.warn(`[${y6}] tenant pools configured without a sentinel token \u2014 ignoring them (warm-pool mode is off)`);this.tenantPoolRefreshMs=$.tenantPoolRefreshMs??lJ4,this.startClaimReaper(),this.startCredentialRefresher(),this.startTenantPoolReconciler()}startClaimReaper(){let $=["app.kubernetes.io/managed-by=studio","app.kubernetes.io/name=studio-sandbox",...this.envName?[`${fQ.env}=${this.envName}`]:[]].join(",");$G$({kc:this.kubeConfig,namespace:this.namespace,labelSelector:$,signal:this.claimWatchAbort.signal,onDelete:(Z)=>this.invalidateRecord(Z)})}async ensure($,Z={}){let X=sL($);if(X.startsWith("s-"))throw Error(`ensure: projectRef has no slug source: ${$.projectRef}`);return this.inflight.run(X,()=>_90(this.stateStore,$,bQ,(Q)=>this.ensureLocked($,X,Z,Q)))}async delete($){let Z=await this.getRecord($);if(this.records.delete($),Z)this.closeForwarder(Z.daemonForward),this.metrics?.active.add(-1,qn0(Z.tenant));if(await this.deleteHttpRouteIfManaged($).catch((X)=>{console.warn(`[${y6}] HTTPRoute delete failed for ${$}: ${X instanceof Error?X.message:String(X)}`)}),await ow(this.kubeConfig,this.namespace,$),this.stateStore)if(Z)await this.stateStore.delete(Z.id,bQ);else await this.stateStore.deleteByHandle(bQ,$)}async alive($){return await D3(this.kubeConfig,this.namespace,$)!==void 0}watchClaimLifecycle($,Z){return eY$({kc:this.kubeConfig,namespace:this.namespace,claimName:$,signal:Z})}hasSchedulableCapacity(){return this.capacityProbe??=mY$(this.kubeConfig,this.namespace),this.capacityProbe()}async getPreviewUrl($){let Z=await this.getRecord($);if(!Z)return null;return this.composePreviewUrl(Z)}async proxyDaemonRequest($,Z,X){let Q=await this.getRecord($);if(!Q&&this.previewUrlPattern&&this.stateStore){let K=await this.stateStore.getByHandle(bQ,$),H=K?.state,N=H?.token;if(K&&N){let U=`http://${H?.adoptedSandboxName??$}.${this.namespace}.svc.cluster.local:${EN}`;try{let w=await Xp(U,N,Z,X);if(w.status!==404)return w;try{await w.body?.cancel()}catch{}}catch{}}}if(!Q)Q=await this.resurrectByHandle($);if(!Q)return new Response(JSON.stringify({error:"sandbox not found"}),{status:404,headers:{"content-type":"application/json"}});let Y=Q,G=performance.now(),J=0,W=!(X.body instanceof ReadableStream);try{let K=await Xp(Q.daemonUrl,Q.token,Z,X);if(K.status===401&&W){this.invalidateRecord($);let H=await this.getRecord($).catch(()=>null)??await this.resurrectByHandle($).catch(()=>null);if(H)Y=H,K=await Xp(H.daemonUrl,H.token,Z,X)}return J=K.status,K}catch(K){if(!W)throw K;this.invalidateRecord($);let H=await this.resurrectByHandle($)??await this.getRecord($).catch(()=>null);if(!H)throw K;Y=H;let N=await Xp(H.daemonUrl,H.token,Z,X);return J=N.status,N}finally{this.recordProxyDuration("daemon",J,Y,performance.now()-G)}}async adoptLiveClaim($,Z){if(this.records.has(Z))return!0;let X=await D3(this.kubeConfig,this.namespace,Z).catch(()=>{return});if(!X||X.metadata?.deletionTimestamp)return!1;return await this.inflight.run(Z,async()=>{let Y=this.records.get(Z);if(Y)return this.toSandbox(Y);let G=await this.adopt($,Z,X);if(!G)throw Error(`cannot adopt live claim ${Z}`);return _90(this.stateStore,$,bQ,(J)=>this.finish(G,J,!0,!0,"adopt"))}).catch(()=>null)!=null}async resolvePreviewUpstreamUrl($){if(this.previewUrlPattern)return`http://${await this.resolveServiceNameForHandle($)}.${this.namespace}.svc.cluster.local:${EN}`;let Z=await this.getRecord($);if(Z)return Z.daemonUrl;let X=await this.resurrectByHandle($);return X?X.daemonUrl:null}async resolveServiceNameForHandle($){let Z=this.records.get($);if(Z)return Z.adoptedSandboxName;if(this.stateStore){let Q=(await this.stateStore.getByHandle(bQ,$).catch(()=>null))?.state?.adoptedSandboxName;if(Q)return Q}return $}async proxyPreviewRequest($,Z){let X=performance.now(),Q=this.records.get($)??null,Y=0;try{let G=await this.resolvePreviewUpstreamUrl($);if(!G){Y=404;let O=Rn0(404,{error:"sandbox not found"});return O.headers.set(SV,"1"),O}let J=new URL(Z.url);if((J.pathname==="/_sandbox"||J.pathname.startsWith("/_sandbox/")||J.pathname==="/_decopilot_vm"||J.pathname.startsWith("/_decopilot_vm/"))&&Z.method!=="GET")return Y=404,Rn0(404,{error:"not found"});let K=(O)=>`${O}${J.pathname}${J.search}`,H=new Headers(Z.headers);for(let O of iJ4)H.delete(O);let N=Z.method!=="GET"&&Z.method!=="HEAD",F={method:Z.method,headers:H,body:N?Z.body:void 0,redirect:"manual",signal:Z.signal,duplex:N?"half":void 0},U;try{U=await fetch(K(G),F)}catch(O){let D=`${G}${J.pathname}`;if(console.warn(`[${y6}] preview fetch to ${D} failed: ${O instanceof Error?O.message:String(O)}`),Z.method==="GET"||Z.method==="HEAD"){if(this.invalidateRecord($),await this.resurrectByHandle($).catch(()=>null)){let j=await this.resolvePreviewUpstreamUrl($);if(j)try{U=await fetch(K(j),F);let z=new Headers;for(let[A,P]of U.headers.entries())if(!NG$.includes(A.toLowerCase()))z.set(A,P);return Y=U.status,new Response(U.body,{status:U.status,statusText:U.statusText,headers:z})}catch(z){console.warn(`[${y6}] preview fetch retry to ${D} failed: ${z instanceof Error?z.message:String(z)}`)}}}else this.invalidateRecord($);Y=502;let L=Rn0(502,{error:"sandbox daemon unreachable"});return L.headers.set(SV,"1"),L}let w=new Headers;for(let[O,D]of U.headers.entries())if(!NG$.includes(O.toLowerCase()))w.set(O,D);return Y=U.status,new Response(U.body,{status:U.status,statusText:U.statusText,headers:w})}finally{this.recordProxyDuration("preview",Y,Q,performance.now()-X,$)}}async ensureLocked($,Z,X,Q){if(X.image)console.warn(`[${y6}] opts.image ignored (template ${this.sandboxTemplateName} pins image): got ${X.image}`);if(Q){let J=await Q.get($,bQ);if(J){let W=await this.rehydrate($,Z,J);if(W)return await this.refreshDaemonGitCredential(W,X),this.finish(W,Q,!1,!0,"resume");await Q.delete($,bQ)}}let Y=await D3(this.kubeConfig,this.namespace,Z).catch(()=>{return});if(Y)if(Y.metadata?.deletionTimestamp)await eU0(this.kubeConfig,this.namespace,Z).catch((J)=>{console.warn(`[${y6}] wait for terminating claim ${Z} failed: ${J instanceof Error?J.message:String(J)}`)});else{let J=await this.adopt($,Z,Y).catch((W)=>{return console.warn(`[${y6}] adopt ${Z} failed, recreating: ${W instanceof Error?W.message:String(W)}`),null});if(J)return await this.refreshDaemonGitCredential(J,X),this.finish(J,Q,!0,!0,"adopt");await ow(this.kubeConfig,this.namespace,Z).catch(()=>{}),await eU0(this.kubeConfig,this.namespace,Z).catch((W)=>{console.warn(`[${y6}] wait for deleted claim ${Z} failed: ${W instanceof Error?W.message:String(W)}`)})}let G=await this.provision($,Z,X);return this.finish(G,Q,!0,!1,"fresh")}async finish($,Z,X,Q,Y){let G=this.records.get($.handle),J=G!==void 0;if(G&&G.daemonForward!==$.daemonForward)this.closeForwarder(G.daemonForward);if(this.records.set($.handle,$),X)await this.persist(Z,$);if(Q)await $w0(this.kubeConfig,this.namespace,$.handle,this.computeShutdownTime()).catch((W)=>console.warn(`[${y6}] TTL refresh failed for ${$.handle}: ${W instanceof Error?W.message:String(W)}`));if(this.metrics){let W=qn0($.tenant);if(this.metrics.ensureOutcome.add(1,{...W,outcome:Y}),!J)this.metrics.active.add(1,W)}return this.toSandbox($)}buildEnvMap($,Z){let X={},Q=[];for(let[Y,G]of Object.entries($.env??{}))if(hJ4.has(Y))Q.push(Y);else X[Y]=G;if(Q.length>0)console.warn(`[${y6}] opts.env keys overlap reserved bootstrap names and were dropped: ${Q.join(",")}`);return{...X,DAEMON_TOKEN:Z.token,DAEMON_BOOT_ID:Z.daemonBootId,APP_ROOT:Z.workdir,PROXY_PORT:String(EN)}}buildClaim($,Z,X){let Q=this.sentinelToken!==null,Y=QG$(this.tenantPools,{orgId:Z.tenant?.orgId,cloneUrl:Z.repo?.cloneUrl,cloneOnly:Z.cloneOnly}),G=Q?[]:Object.entries(this.buildEnvMap(Z,X)).sort(([K],[H])=>K<H?-1:K>H?1:0).map(([K,H])=>({name:K,value:H})),J=Q34(Z),W=Object.keys(J).length>0;return{apiVersion:`${O9.CLAIM_API_GROUP}/${O9.CLAIM_API_VERSION}`,kind:"SandboxClaim",metadata:{name:$,namespace:this.namespace,labels:{"app.kubernetes.io/name":"studio-sandbox","app.kubernetes.io/managed-by":"studio",...this.envName?{[fQ.env]:this.envName}:{},...In0(Z.tenant)},...W?{annotations:J}:{}},spec:{sandboxTemplateRef:{name:this.sandboxTemplateName},additionalPodMetadata:{labels:In0(Z.tenant,{[fQ.role]:"claimed",[fQ.sandboxHandle]:$,...this.envName?{[fQ.env]:this.envName}:{}}),...W?{annotations:J}:{}},env:G,warmpool:YG$(Y,Q),lifecycle:{shutdownPolicy:"Delete",shutdownTime:this.computeShutdownTime()}}}}async provision($,Z,X){let Q=this.tokenGenerator(),Y=vJ4(),G=Tn0,J=this.buildClaim(Z,X,{token:Q,daemonBootId:Y,workdir:G});try{await en(this.kubeConfig,this.namespace,J)}catch(U){if(U instanceof an)await eU0(this.kubeConfig,this.namespace,Z),await en(this.kubeConfig,this.namespace,J);else throw U}let W;try{W=await bY$(this.kubeConfig,this.namespace,Z),await Qw0(this.kubeConfig,this.namespace,W)}catch(U){throw await ow(this.kubeConfig,this.namespace,Z).catch(()=>{}),U}try{await this.ensureServicePortForAdoptedSandbox(W),await this.ensureHttpRouteForHandle(Z,W,X.tenant??null)}catch(U){throw await ow(this.kubeConfig,this.namespace,Z).catch(()=>{}),U}let K=await this.openForwarder(W,EN,Z),H=`http://127.0.0.1:${K.localPort}`,N=this.workloadConfigPayload(X),F=Y;try{if(await jn0(H),this.sentinelToken!==null){let U=await Gw0(H);if(U)F=U.bootId;await MV(H,this.sentinelToken,N??{},{rotateToken:Q})}else if(N)await MV(H,Q,N);await this.relayOrgFsConfig(H,Q,X.orgFsConfigJson)}catch(U){throw this.closeForwarder(K),await this.deleteHttpRouteIfManaged(Z).catch(()=>{}),await ow(this.kubeConfig,this.namespace,Z).catch(()=>{}),U}return{id:$,handle:Z,adoptedSandboxName:W,token:Q,workdir:G,daemonUrl:H,daemonForward:K,workload:X.workload??null,daemonBootId:F,tenant:X.tenant??null,ensureOpts:W34(X)}}workloadConfigPayload($){return b90({runtime:$?.workload?.runtime??"node",packageManager:$?.workload?.packageManager?{name:$.workload.packageManager,...$.workload.packageManagerPath?{path:$.workload.packageManagerPath}:{}}:null,repo:$?.repo??null,port:$?.workload?.devPort??KG$,tenant:$?.tenant??void 0,...$?{cloneOnly:$.cloneOnly===!0}:{}})}async relayOrgFsConfig($,Z,X){if(!X)return;await oY$($,Z,X).catch((Q)=>console.warn("[org-fs] sidecar config relay failed",Q))}async refreshDaemonGitCredential($,Z){let X=wm0(Z);if(!X)return;try{await MV($.daemonUrl,$.token,X)}catch(Q){console.warn(`[${y6}] git credential refresh failed for ${$.handle}: ${Q instanceof Error?Q.message:String(Q)}`)}}async withFreshCloneUrl($,Z){if(!this.mintCloneUrl)return $;try{let X=await this.mintCloneUrl($,Z!==void 0?{bufferMs:Z}:void 0);return X?{...$,cloneUrl:X}:$}catch(X){return console.warn(`[${y6}] clone credential re-mint failed: ${X instanceof Error?X.message:String(X)}`),$}}startCredentialRefresher(){if(!this.mintCloneUrl)return;let{signal:$}=this.claimWatchAbort;(async()=>{while(!$.aborted){if(await y$(dJ4,{signal:$}).catch(()=>{}),$.aborted)break;try{await this.refreshAllGitCredentials()}catch(Z){console.warn(`[${y6}] periodic credential refresh failed: ${Z instanceof Error?Z.message:String(Z)}`)}}})()}startTenantPoolReconciler(){if(this.tenantPools.length===0)return;let{signal:$}=this.claimWatchAbort;(async()=>{while(!$.aborted){try{await this.reconcileTenantPools()}catch(Z){console.warn(`[${y6}] tenant pool reconcile failed: ${Z instanceof Error?Z.message:String(Z)}`)}await y$(cJ4,{signal:$}).catch(()=>{})}})()}markTenantPoolsDirty($,Z){let X=GG$(this.tenantPools,$,Z);for(let Q of X)this.dirtyPools.add(Q.name);return X.map((Q)=>Q.name)}async reconcileTenantPools(){for(let $ of this.tenantPools){let Z=await fY$(this.kubeConfig,this.namespace,$.name);if(Z===null){console.warn(`[${y6}] tenant pool ${$.name}: no SandboxWarmPool (or no selector yet) in ${this.namespace}`);continue}let X=this.dirtyPools.delete($.name),Q=Z.filter((Y)=>!Y.labels[fQ.sandboxHandle]);for(let[Y]of this.poolPods)if(!Z.some((G)=>G.uid===Y))this.poolPods.delete(Y);for(let Y of Q){if(this.claimWatchAbort.signal.aborted)return;await this.warmPoolPod($,Y,X)}this.recordPoolDepth($,Z,Q)}}recordPoolDepth($,Z,X){let Q=this.metrics?.poolPods;if(!Q)return;let Y=0,G=0;for(let W of X){let K=this.poolPods.get(W.uid);if(!K)continue;if(K.failures>=Ww0)G++;else if(K.lastConfigAt>0)Y++}let J={pool:$.name,org:$.orgId};Q.record(Y,{...J,state:"ready"}),Q.record(Z.length-X.length,{...J,state:"bound"}),Q.record(X.length-Y-G,{...J,state:"pending"}),Q.record(G,{...J,state:"failed"})}async warmPoolPod($,Z,X){let Q=this.poolPods.get(Z.uid);if(Q&&Q.failures>=Ww0){if(Date.now()-Q.lastFailureAt<HG$)return;this.poolPods.set(Z.uid,{...Q,failures:0})}let Y=X||Q!==void 0&&Date.now()-Q.lastConfigAt>=this.tenantPoolRefreshMs;if(Q&&!Y)return;let G={cloneUrl:JG$($),connectionId:$.connectionId,branch:$.branch,userName:"",userEmail:""},J=await this.withFreshCloneUrl(G);if($.connectionId&&J.cloneUrl===G.cloneUrl){this.recordPoolFailure(Z,$,"clone credential mint failed");return}let W=await this.openForwarder(Z.name,EN,Z.name).catch(()=>null);if(!W){this.recordPoolFailure(Z,$,"port-forward failed");return}let K=`http://127.0.0.1:${W.localPort}`;try{await jn0(K);let H=this.sentinelToken;if(!H)return;if(!await this.isPoolPodUnbound(Z))return;let N=b90({runtime:$.workload.runtime,packageManager:$.workload.packageManager?{name:$.workload.packageManager,...$.workload.packageManagerPath?{path:$.workload.packageManagerPath}:{}}:null,repo:J,port:$.workload.devPort??KG$})??{},{transition:F}=await MV(K,H,N);if(Y&&F!=="bootstrap"&&await this.isPoolPodUnbound(Z))await tY$(K,H,"clone");this.poolPods.set(Z.uid,{lastConfigAt:Date.now(),lastFailureAt:0,failures:0}),console.log(`[${y6}] tenant pool ${$.name}: warmed ${Z.name} (${F})`)}catch(H){this.recordPoolFailure(Z,$,H instanceof Error?H.message:String(H))}finally{this.closeForwarder(W)}}isPoolPodUnbound($){return xY$(this.kubeConfig,this.namespace,$.name,fQ.sandboxHandle)}recordPoolFailure($,Z,X){let Q=this.poolPods.get($.uid),Y=(Q?.failures??0)+1;this.poolPods.set($.uid,{lastConfigAt:Q?.lastConfigAt??0,lastFailureAt:Date.now(),failures:Y});let G=Y>=Ww0?` \u2014 backing off ${HG$/60000}min`:"";console.warn(`[${y6}] tenant pool ${Z.name}: warming ${$.name} failed (${Y}/${Ww0})${G}: ${X}`)}async refreshAllGitCredentials(){await WG$(this.records.values(),($)=>$.ensureOpts?.repo?.connectionId,async($)=>{if(this.claimWatchAbort.signal.aborted)return;let Z=$.ensureOpts?.repo;if(!Z)return;let X=await this.withFreshCloneUrl(Z,mJ4);await this.refreshDaemonGitCredential($,{...$.ensureOpts,repo:X}),$.ensureOpts={...$.ensureOpts,repo:X}})}async rebootstrapDaemon($,Z,X){if(this.sentinelToken===null)return!1;let Q=this.workloadConfigPayload(X)??{};try{return await MV($,this.sentinelToken,Q,{rotateToken:Z}),await this.relayOrgFsConfig($,Z,X?.orgFsConfigJson),!0}catch(Y){if(Y instanceof Yw0&&Y.status===401)try{return await MV($,Z,Q,{rotateToken:Z}),await this.relayOrgFsConfig($,Z,X?.orgFsConfigJson),!0}catch(G){return console.warn(`[${y6}] re-bootstrap retry with claim token failed: ${G instanceof Error?G.message:String(G)}`),!1}return console.warn(`[${y6}] re-bootstrap failed: ${Y instanceof Error?Y.message:String(Y)}`),!1}}async ensureServicePortForAdoptedSandbox($){if(!this.previewGateway||!this.previewUrlPattern)return;await lY$(this.kubeConfig,this.namespace,$,{name:"daemon",port:EN,targetPort:EN})}async ensureHttpRouteForHandle($,Z,X){if(!this.previewGateway||!this.previewUrlPattern)return;let Q=K34(this.previewUrlPattern,$);if(!Q)throw new k9(`Unable to derive preview hostname for ${$} from pattern: ${this.previewUrlPattern}`);let Y={apiVersion:`${$p.API_GROUP}/${$p.API_VERSION}`,kind:"HTTPRoute",metadata:{name:$,namespace:this.namespace,labels:In0(X??void 0,{[fQ.role]:"claimed",[fQ.sandboxHandle]:$,"app.kubernetes.io/name":"studio-sandbox","app.kubernetes.io/managed-by":"studio",...this.envName?{[fQ.env]:this.envName}:{}})},spec:{parentRefs:[{kind:"Gateway",group:"gateway.networking.k8s.io",name:this.previewGateway.name,namespace:this.previewGateway.namespace}],hostnames:[Q],rules:[{backendRefs:[{group:"",kind:"Service",name:Z,port:EN}]}]}};await Zw0(this.kubeConfig,this.namespace,Y)}async deleteHttpRouteIfManaged($){if(!this.previewGateway)return;await Xw0(this.kubeConfig,this.namespace,$)}async rehydrate($,Z,X){let Q=X.state;if(!Q.adoptedSandboxName&&!Q.podName||!Q.token)return null;let Y=await D3(this.kubeConfig,this.namespace,Z).catch(()=>{return});if(!Y||!FG$(Y))return null;let G=Y.status?.sandbox?.name??Q.adoptedSandboxName??Q.podName??Z,J=await this.openAndProbeDaemon(G,Z);if(!J)return null;if(Q.daemonBootId&&Q.daemonBootId!==J.bootId){if(this.sentinelToken!==null){let W=Q.ensureOpts?.repo?{...Q.ensureOpts,repo:await this.withFreshCloneUrl(Q.ensureOpts.repo)}:Q.ensureOpts??null;if(!await this.rebootstrapDaemon(J.daemonUrl,Q.token,W))return this.closeForwarder(J.daemonForward),null}else console.warn(`[${y6}] daemon restart detected (handle=${Z}): stored bootId=${Q.daemonBootId} live bootId=${J.bootId}`);await this.stateStore?.put($,bQ,{handle:Z,state:{...Q,daemonBootId:J.bootId}}).catch((W)=>console.warn(`[${y6}] bootId persist failed for ${Z}: ${W instanceof Error?W.message:String(W)}`))}return{id:$,handle:Z,adoptedSandboxName:G,token:Q.token,workdir:Q.workdir??Tn0,daemonUrl:J.daemonUrl,daemonForward:J.daemonForward,workload:Q.workload??null,daemonBootId:J.bootId,tenant:Q.tenant??null,ensureOpts:Q.ensureOpts??null}}async adopt($,Z,X){if(!FG$(X))return null;let Q=X.status?.sandbox?.name??Z;if(this.sentinelToken!==null)return null;let Y=oJ4(X);if(!Y)return null;let G=await this.openAndProbeDaemon(Q,Z);if(!G)return null;let J=Y34(X);if(this.previewGateway)await this.ensureServicePortForAdoptedSandbox(Q).catch((W)=>{console.warn(`[${y6}] Service port backfill failed for ${Z}: ${W instanceof Error?W.message:String(W)}`)}),await this.ensureHttpRouteForHandle(Z,Q,J).catch((W)=>{console.warn(`[${y6}] HTTPRoute backfill failed for ${Z}: ${W instanceof Error?W.message:String(W)}`)});return{id:$,handle:Z,adoptedSandboxName:Q,token:Y,workdir:Tn0,daemonUrl:G.daemonUrl,daemonForward:G.daemonForward,workload:null,daemonBootId:G.bootId,tenant:J,ensureOpts:null}}async openAndProbeDaemon($,Z){let X=await this.openForwarder($,EN,Z).catch(()=>null);if(!X)return null;let Q=`http://127.0.0.1:${X.localPort}`,Y=await Gw0(Q);if(!Y)return this.closeForwarder(X),null;return{daemonForward:X,daemonUrl:Q,bootId:Y.bootId}}async getRecord($){let Z=this.records.get($);if(Z)return Z;if(!this.stateStore)return null;let X=await this.stateStore.getByHandle(bQ,$);if(!X)return null;let Q=await this.rehydrate(X.id,$,X);if(Q)this.records.set($,Q);return Q}async resurrectByHandle($){if(!this.stateStore)return null;let Z=await this.stateStore.getByHandle(bQ,$);if(!Z)return null;let X=Z.state.ensureOpts;if(!X)return null;let Q=X.repo?{...X,repo:await this.withFreshCloneUrl(X.repo)}:X;if(sL(Z.id)!==$)return null;return await this.ensure(Z.id,Q),this.records.get($)??null}invalidateRecord($){let Z=this.records.get($);if(!Z)return;this.records.delete($),this.closeForwarder(Z.daemonForward)}recordProxyDuration($,Z,X,Q,Y){if(!this.metrics)return;this.metrics.proxyDurationMs.record(Q,{...qn0(X?.tenant??null),source:$,sandbox_handle:X?.handle??Y??"",status_code:Z||0})}composePreviewUrl($){if(this.previewUrlPattern)return v90(this.previewUrlPattern,$.handle);return`http://127.0.0.1:${$.daemonForward.localPort}/`}toSandbox($){return{handle:$.handle,workdir:$.workdir,previewUrl:this.composePreviewUrl($)}}async persist($,Z){if(!$)return;let X={adoptedSandboxName:Z.adoptedSandboxName,token:Z.token,workdir:Z.workdir,workload:Z.workload,daemonBootId:Z.daemonBootId,tenant:Z.tenant,...Z.ensureOpts?{ensureOpts:Z.ensureOpts}:{}};await $.put(Z.id,bQ,{handle:Z.handle,state:X})}computeShutdownTime(){return new Date(Date.now()+this.idleTtlMs).toISOString()}async releaseAfter($,Z){let X=await D3(this.kubeConfig,this.namespace,$);if(!X)return;let Q=G34(X.spec?.lifecycle?.shutdownTime,new Date(Date.now()+Z));if(!Q)return;await $w0(this.kubeConfig,this.namespace,$,Q).catch((Y)=>console.warn(`[${y6}] release failed for ${$}: ${Y instanceof Error?Y.message:String(Y)}`))}async renewTtl($){let Z=await D3(this.kubeConfig,this.namespace,$);if(!Z)return;let X=J34(Z.spec?.lifecycle?.shutdownTime,new Date(Date.now()+this.idleTtlMs));if(!X)return;await $w0(this.kubeConfig,this.namespace,$,X).catch((Q)=>console.warn(`[${y6}] TTL renew failed for ${$}: ${Q instanceof Error?Q.message:String(Q)}`))}openForwarder($,Z,X=$){let Q=rJ4(X,Z);return new Promise((Y,G)=>{let J=(W,K)=>{let H=wG$.createServer((N)=>this.handleForwardedConnection(N,$,Z,X));H.once("error",(N)=>{if(N.code==="EADDRINUSE"&&K<nJ4){try{H.close()}catch{}let F=Mn0+(W-Mn0+1)%OG$;J(F,K+1);return}G(N)}),H.listen(W,"127.0.0.1",()=>{let N=H.address();if(!N||typeof N==="string"){H.close(),G(Error("port-forward listener failed to bind"));return}Y({server:H,localPort:N.port})})};J(Q,0)})}handleForwardedConnection($,Z,X,Q){let Y=new bJ4,G=null,J=!1,W=()=>{if(J)return;if(J=!0,Y.destroy(),G)try{G.close()}catch{}if(!$.destroyed)$.destroy()};$.pipe(Y),$.on("error",W),$.on("close",W),this.portForward.portForward(this.namespace,Z,[X],$,null,Y).then((K)=>{let H=typeof K==="function"?K():K;if(!H){W();return}if(G=H,G.on("close",W),G.on("error",()=>{this.invalidateRecord(Q),W()}),J)try{G.close()}catch{}}).catch((K)=>{console.warn(`[${y6}] port-forward to ${Z}:${X} failed: ${fJ4(K)}`,JSON.stringify(BG$(K))),this.invalidateRecord(Q),W()})}closeForwarder($){$.server.close((Z)=>{if(Z)console.warn(`[${y6}] port-forward close on :${$.localPort} errored: ${Z instanceof Error?Z.message:String(Z)}`)})}close(){if(this.closed)return;this.closed=!0,this.claimWatchAbort.abort();for(let $ of this.records.values())this.closeForwarder($.daemonForward);this.records.clear()}}function pJ4($){return{active:$.createUpDownCounter("studio.sandbox.active",{description:"Active sandbox count, by runner kind, owning org, and daemon impl. Cross-checks the cAdvisor-derived count from the cluster \u2014 divergence between the two indicates orphaned claims (studio deleted but K8s didn't reap) or unattributed pods.",unit:"{sandbox}"}),ensureOutcome:$.createCounter("studio.sandbox.ensure.outcome",{description:"Outcome of each ensure() call: fresh provision, resume from state-store after restart, or adopt of a cluster-side claim studio didn't know about. Cold-start ratio is the primary input for warm-pool sizing.",unit:"{call}"}),proxyDurationMs:$.createHistogram("studio.sandbox.proxy.duration_ms",{description:"Wall-clock latency of studio-mediated requests to the sandbox daemon: tool exec proxies (source=daemon) and preview iframe traffic (source=preview).",unit:"ms"}),poolPods:$.createGauge("studio.sandbox.pool.pods",{description:"Tenant warm pool depth by pool and state: ready (warmed and unbound \u2014 what a claim can actually bind instantly), bound (serving a user), pending (unbound, not yet warmed), failed (gave up after repeated bootstrap failures). Alert on sustained ready=0: a pool that is always empty is doing nothing while costing N pods.",unit:"{pod}"})}}function BG$($){let Z=[],X=$;for(let Q=0;Q<5&&X instanceof Error;Q++){let Y=X;if(Z.push({name:Y.name,message:Y.message,...Y.code!==void 0?{code:Y.code}:{},...Y.errno!==void 0?{errno:Y.errno}:{}}),Y.cause===X)break;X=Y.cause}if(X!==void 0&&!(X instanceof Error)&&X!==null){let Q=X,Y=Q.error instanceof Error?BG$(Q.error).chain:void 0;Z.push({nonError:String(X),...typeof Q.type==="string"?{type:Q.type}:{},...typeof Q.message==="string"?{message:Q.message}:{},...Q.code!==void 0?{code:Q.code}:{},...typeof Q.reason==="string"?{reason:Q.reason}:{},...Y?{error:Y}:{},...Y===void 0&&Q.error!==void 0?{rawError:String(Q.error)}:{},keys:Object.keys(Q)})}return{chain:Z}}function tJ4(){let $=new cx;return $.loadFromDefault(),$}function FG$($){return Boolean($.status?.conditions?.some((Z)=>Z.type==="Ready"&&Z.status==="True"))}function oJ4($){let Z=$.spec?.env;if(!Z)return null;for(let X of Z)if(X.name==="DAEMON_TOKEN"&&X.value)return X.value;return null}function rJ4($,Z){let X=CJ4("sha256").update(`${$}:${Z}`).digest();return Mn0+X.readUInt32BE(0)%OG$}function Rn0($,Z){return new Response(JSON.stringify(Z),{status:$,headers:{"content-type":"application/json","access-control-allow-origin":"*"}})}function UG$($){let Z=$.slice(0,sJ4);return aJ4.test(Z)?Z:""}function $34($){if($===void 0)return null;let Z=$.trim();if(Z==="")return null;if(!eJ4.test(Z))throw Error(`AgentSandboxProvider: envName=${JSON.stringify(Z)} is not a valid DNS-label-safe environment name (lowercase alphanumeric or '-', starts with a letter, ends alphanumeric, \u226432 chars). Studio sets this from STUDIO_ENV; check the studio chart's configMap.`);return Z}function In0($,Z={}){let X={...Z};if($){let Q=UG$($.orgId),Y=UG$($.userId);if(Q)X[fQ.orgId]=Q;if(Y)X[fQ.userId]=Y}return X}function kV($){let Z="";for(let X of $){let Q=X.codePointAt(0)??0;Z+=Q<32||Q===127?" ":X}return Z.slice(0,Z34)}function X34($){try{let Z=new URL($);return Z.username="",Z.password="",Z.toString()}catch{return""}}function Q34($){let Z={},X=$.tenant;if(X?.orgSlug)Z[L3.orgSlug]=kV(X.orgSlug);if(X?.orgName)Z[L3.orgName]=kV(X.orgName);if(X?.userEmail)Z[L3.userEmail]=kV(X.userEmail);if(X?.userName)Z[L3.userName]=kV(X.userName);let Q=$.repo;if(Q){if(Q.displayName)Z[L3.gitRepo]=kV(Q.displayName);let Y=X34(Q.cloneUrl);if(Y)Z[L3.gitRepoUrl]=kV(Y);let G=$.branch??Q.branch;if(G)Z[L3.gitBranch]=kV(G)}return Z}function Y34($){let Z=$.metadata?.labels;if(!Z)return null;let X=Z[fQ.orgId],Q=Z[fQ.userId];if(!X||!Q)return null;let Y=$.metadata?.annotations??{};return{orgId:X,userId:Q,orgSlug:Y[L3.orgSlug],orgName:Y[L3.orgName],userEmail:Y[L3.userEmail],userName:Y[L3.userName]}}function G34($,Z){if($){let X=new Date($).getTime();if(Number.isFinite(X)&&X<=Z.getTime())return null}return Z.toISOString()}function J34($,Z){if($){let X=new Date($).getTime();if(Number.isFinite(X)&&X>=Z.getTime())return null}return Z.toISOString()}function qn0($){return{org_id:$?.orgId??"",user_id:$?.userId??"",runner_kind:bQ}}function W34($){let Z={};if($.branch)Z.branch=$.branch;if($.repo)Z.repo=$.repo;if($.workload)Z.workload=$.workload;if($.env&&Object.keys($.env).length>0)Z.env=$.env;if($.tenant)Z.tenant=$.tenant;if($.orgFsConfigJson)Z.orgFsConfigJson=$.orgFsConfigJson;return Object.keys(Z).length>0?Z:null}function K34($,Z){try{return new URL(v90($,Z)).hostname||null}catch{return null}}var bQ="agent-sandbox",y6="AgentSandboxProvider",SV="x-sandbox-preview-not-ready",xJ4="agent-sandbox-system",yJ4="studio-sandbox",EN=9000,KG$=3000,Tn0="/app",gJ4=32,hJ4,uJ4=900000,cJ4=60000,lJ4=1800000,Ww0=3,HG$=1800000,dJ4=900000,mJ4=1800000,iJ4,NG$,Mn0=40000,OG$=1e4,nJ4=256,fQ,L3,aJ4,sJ4=63,eJ4,Z34=253;var DG$=B(()=>{B6();iY$();Nn0();rY$();Om0();Zp();sn();ZG$();An0();hJ4=new Set(["DAEMON_TOKEN","DAEMON_BOOT_ID","APP_ROOT","PROXY_PORT"]),iJ4=["cookie","host","connection","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","accept-encoding","content-length","upgrade"],NG$=["connection","keep-alive","transfer-encoding","content-encoding","content-length"];fQ={role:"studio.decocms.com/role",sandboxHandle:"studio.decocms.com/sandbox-handle",orgId:"studio.decocms.com/org-id",userId:"studio.decocms.com/user-id",env:"studio.decocms.com/env"},L3={orgSlug:"studio.decocms.com/org-slug",orgName:"studio.decocms.com/org-name",userEmail:"studio.decocms.com/user-email",userName:"studio.decocms.com/user-name",gitRepo:"studio.decocms.com/git-repo",gitRepoUrl:"studio.decocms.com/git-repo-url",gitBranch:"studio.decocms.com/git-branch"},aJ4=/^([A-Za-z0-9]([-A-Za-z0-9_.]*[A-Za-z0-9])?)?$/;eJ4=/^[a-z]([a-z0-9-]{0,30}[a-z0-9])?$/});var LG$={};H4(LG$,{waitForSandboxReady:()=>Qw0,parseTenantPools:()=>XG$,getSandboxClaim:()=>D3,getHttpRoute:()=>uY$,deleteSandboxClaim:()=>ow,deleteHttpRoute:()=>Xw0,createSandboxClaim:()=>en,applyHttpRoute:()=>Zw0,SandboxTimeoutError:()=>qV,SandboxError:()=>k9,PREVIEW_NOT_READY_HEADER:()=>SV,KubeConfig:()=>cx,K8S_CONSTANTS:()=>O9,HTTPROUTE_CONSTANTS:()=>$p,AgentSandboxProvider:()=>kn0});var Sn0=B(()=>{Nn0();sn();Zp();DG$();An0()});var TG$={};H4(TG$,{subscribeLifecycle:()=>vn0,getSandboxProviderByKind:()=>Cn0,getOrInitSharedRunner:()=>_n0,__resetSharedLifecyclesForTesting:()=>z34});function PG$($,Z){let X=EG$[$];if(X)return Promise.resolve(X);let Q=Vn0[$];if(Q)return Q;let Y=Z().then((G)=>{return EG$[$]=G,G}).finally(()=>{delete Vn0[$]});return Vn0[$]=Y,Y}function F34(){let $=process.env.STUDIO_SANDBOX_PREVIEW_URL_PATTERN;return $&&$.trim()!==""?$:void 0}function U34(){let $=process.env.STUDIO_SANDBOX_TEMPLATE_NAME;return $&&$.trim()!==""?$:void 0}function w34(){let $=process.env.STUDIO_ENV;return $&&$.trim()!==""?$:void 0}function O34(){let $=process.env.STUDIO_SANDBOX_SENTINEL_TOKEN;return $&&$.trim()!==""?$:void 0}function B34(){let $=process.env.STUDIO_SANDBOX_PREVIEW_GATEWAY_NAME?.trim(),Z=process.env.STUDIO_SANDBOX_PREVIEW_GATEWAY_NAMESPACE?.trim();if(!$&&!Z)return;if(!$||!Z)throw Error("STUDIO_SANDBOX_PREVIEW_GATEWAY_NAME and STUDIO_SANDBOX_PREVIEW_GATEWAY_NAMESPACE must both be set, or both unset. Half-configured per-claim HTTPRoute routing would silently fail to attach.");return{name:$,namespace:Z}}async function AG$($,Z){let X=new Vn(Z),Q=F34();switch($){case"agent-sandbox":{let{AgentSandboxProvider:Y,parseTenantPools:G}=await Promise.resolve().then(() => (Sn0(),LG$)),J=new qH(c0().encryptionKey);return new Y({stateStore:X,previewUrlPattern:Q,sandboxTemplateName:U34(),envName:w34(),previewGateway:B34(),sentinelToken:O34(),tenantPools:G(process.env.STUDIO_SANDBOX_TENANT_POOLS),meter:W8,mintCloneUrl:async(W,K)=>{if(!W.connectionId)return null;let H=K5$(W.cloneUrl);if(!H)return null;let{cloneUrl:N}=await gw(W.connectionId,H.owner,H.name,Z,J,{bufferMs:K?.bufferMs});return N}})}case"user-desktop":throw Error("user-desktop provider cannot be instantiated without a per-run link claim \u2014 call resolveSandboxProvider, which binds the link before constructing the provider.");default:throw Error(`Unknown sandbox provider kind: ${String($)}`)}}function Cn0($,Z){return PG$(Z,()=>AG$(Z,$.db))}async function _n0(){let $;try{$=eL()}catch(X){return console.warn("[lifecycle] cannot resolve sandbox runner:",X instanceof Error?X.message:String(X)),null}return await PG$($,()=>AG$($,c8().db))}function vn0($,Z,X){let Q=rw.get(Z);if(Q){if(Q.terminated){if(Q.lastPhase)try{X(Q.lastPhase)}catch{}return{unsubscribe:E34}}if(Q.listeners.add(X),Q.lastPhase)try{X(Q.lastPhase)}catch{}return jG$(Z,Q,X)}let Y=new AbortController,G={lastPhase:null,terminated:!1,listeners:new Set([X]),abort:Y};return rw.set(Z,G),j34($,Z,G),jG$(Z,G,X)}function E34(){}function jG$($,Z,X){return{unsubscribe(){if(rw.get($)!==Z)return;if(Z.listeners.delete(X),Z.listeners.size===0)rw.delete($),Z.abort.abort()}}}async function j34($,Z,X){let Q=null;try{for await(let Y of $.watchClaimLifecycle(Z,X.abort.signal)){if(X.abort.signal.aborted)break;X.lastPhase=Y;let G=Y.kind==="ready"||Y.kind==="failed";if(G)X.terminated=!0;let J=Array.from(X.listeners);for(let W of J)try{W(Y)}catch{}if(G)break}}catch(Y){Q=Y}finally{if(!X.terminated&&!X.abort.signal.aborted&&X.listeners.size>0){let Y={kind:"failed",reason:"unknown",message:Q instanceof Error?Q.message:"Lifecycle watcher ended unexpectedly"};X.lastPhase=Y,X.terminated=!0;for(let G of Array.from(X.listeners))try{G(Y)}catch{}}if(rw.get(Z)===X)rw.delete(Z)}}function z34(){for(let $ of rw.values())$.abort.abort();rw.clear()}var H34,N34,zG$,EG$,Vn0,D34,L34,rw;var Qp=B(()=>{FN();GG();N5();Lm0();Cn();xc();S$();H34=Symbol.for("decocms.sandbox.lifecycle.runners"),N34=Symbol.for("decocms.sandbox.lifecycle.inflight"),zG$=globalThis,EG$=zG$[H34]??={},Vn0=zG$[N34]??={};D34=Symbol.for("decocms.sandbox.lifecycle.shared-lifecycles"),L34=globalThis,rw=L34[D34]??=new Map});async function hX($,Z){let{userId:X,branch:Q,virtualMcpMetadata:Y,explicitKind:G}=Z;if(G)return Yp($,G);if($.sandboxPreference==="agent-sandbox")return Yp($,"agent-sandbox");if($.sandboxPreference==="cluster-default")return Yp($,eL());let[J,...W]=P34(Y,X,Q);if(J)return Yp($,W.length===0?J:A34(J,W));return Yp($,RG$())}function P34($,Z,X){let Q=C5($)[Z]?.[X];if(!Q)return[];let Y=AJ(Q);return Object.keys(Y)}function A34($,Z){let X=RG$();if(X===$||Z.includes(X))return X;return $}function RG$(){return eL()}async function Yp($,Z){let X=Z==="user-desktop"?"agent-sandbox":Z;return{provider:await Cn0($,X),kind:X}}var aw=B(()=>{B8();FN();kQ();Qp()});var Gp;var bn0=B(()=>{Gp={npm:{install:"npm install",run:($)=>`npm run ${$}`,runtime:"node"},pnpm:{install:"pnpm install",run:($)=>`pnpm run ${$}`,runtime:"node"},yarn:{install:"yarn install",run:($)=>`yarn run ${$}`,runtime:"node"},bun:{install:"bun install",run:($)=>`bun run ${$}`,runtime:"bun"},deno:{install:"deno install",run:($)=>`deno task ${$}`,runtime:"deno"}}});function E3($,Z){return Z?`thread:${$}/${Z}`:`thread:${$}`}function jN($){return`sandbox/thread-${$.replace(/^thread:/,"").replace(/\//g,"-")}`}function sw($){if(!$||!$.startsWith("thread:"))return null;return $.slice(7).split("/")[0]||null}async function zN($,Z,X){let Q=sw(Z);if(!Q)return X;return(await $.storage.threads.get(Q).catch(()=>null))?.created_by??X}async function VV($,Z){if(!Z)return null;let X=await $.storage.threads.get(Z).catch(()=>null);if(!X)return null;return X.metadata??{}}async function IG$($,Z){let Q=(await VV($,Z))?.headRef;return typeof Q==="string"&&Q.length>0?Q:null}async function qG$($,Z,X){let Q=await VV($,Z);if(!Q)return;if(Q.headRef===X)return;await $.storage.threads.update(Z,{metadata:{...Q,headRef:X}}).catch((Y)=>console.warn("[thread-repo] setThreadHeadRef failed",Y))}async function ew($,Z){return(await VV($,Z))?.githubRepo??null}function fn0($){if($.pinnedRef)return $.pinnedRef;if($.runBranch&&$.runBranch===E3($.threadId))return $.runBranch;if($.threadRepo)return E3($.threadId,$.threadRepo.connectionId);if(!$.agentRepo)return"ephemeral";return $.runBranch??`thread:${$.threadId}`}async function xn0($,Z){let Q=(await VV($,Z))?.pinnedRef;return typeof Q==="string"&&Q.length>0?Q:null}async function MG$($,Z){let[X,Q]=await Promise.all([ew($,Z.threadId),xn0($,Z.threadId)]);return fn0({...Z,threadRepo:X,pinnedRef:Q})}async function kG$($,Z,X,Q,Y,G){let J=await VV($,Z);if(!J)return;let W=Sn(C5(J),X,Q,Y,G);await $.storage.threads.update(Z,{metadata:{...J,sandboxMap:W}}).catch((K)=>console.warn("[thread-repo] setThreadSandboxMapEntry failed",K))}async function Kw0($,Z){return C5(await VV($,Z))}async function SG$($,Z,X,Q,Y){let G=await VV($,Z);if(!G)return;let J=Dm0(C5(G),X,Q,Y);if(!J)return;await $.storage.threads.update(Z,{metadata:{...G,sandboxMap:J}}).catch((W)=>console.warn("[thread-repo] removeThreadSandboxMapEntry failed",W))}var j3=B(()=>{kQ()});function Hw0($){if(!$)return null;let Z=$.runtime;if(!Z||typeof Z!=="object")return null;let X=Z.env;if(!Array.isArray(X))return null;let Q=[];for(let Y of X){if(!Y||typeof Y!=="object")continue;let G=Y;if(typeof G.key!=="string"||!f00.test(G.key))continue;if(G.kind==="literal"&&typeof G.value==="string"){Q.push({key:G.key,kind:"literal",value:G.value});continue}if(G.kind==="secret"&&typeof G.secretId==="string"&&G.secretId.length>0)Q.push({key:G.key,kind:"secret",secretId:G.secretId})}return Q.length===0?null:Q}function VG$($){if(!$)return null;let Z=$.runtime;if(!Z||typeof Z!=="object")return null;let X=Z.submoduleCredentials;if(!Array.isArray(X))return null;let Q=[];for(let Y of X){if(!Y||typeof Y!=="object")continue;let G=Y;if(typeof G.host==="string"&&G.host.length>0&&typeof G.secretId==="string"&&G.secretId.length>0)Q.push({host:G.host,secretId:G.secretId})}return Q.length===0?null:Q}async function CG$($,Z){$0(Z);let X=r(Z);await Z.access.check();let Q=W1(Z);if(!Q)throw Error("User ID required");let Y=await Z.storage.virtualMcps.findById($.virtualMcpId);if(!Y||Y.organization_id!==X.id)throw Error("Virtual MCP not found");let G=Y.metadata??{},J=C5(G),W=await zN(Z,$.branch,Q),K=eW(J,W,$.branch,$.sandboxProviderKind);return{virtualMcp:Y,metadata:G,userId:Q,sandboxUserId:W,entry:K,organization:X}}function T34($){if($===null||!/^\d+$/.test($))return null;let Z=Number($);return Z>=1&&Z<=65535?$:null}function _G$($){let Z=$.runtime??null,Q=Z?.selected??null,Y=T34(Z?.port??null),G=Z?.path??null;if(!Q||!(Q in Gp))return{packageManager:null,runtime:null,port:Y,packageManagerPath:G,runtimeBinPath:null};let J=Gp[Q].runtime;return{packageManager:Q,runtime:J,port:Y,packageManagerPath:G,runtimeBinPath:J==="deno"?"/opt/deno/bin":J==="bun"?"/opt/bun/bin":null}}var Jp=B(()=>{B8();bn0();kQ();j3()});async function $O($,Z){let X=$.body?.getReader();if(!X)return $.text();let Q=new TextDecoder,Y="",G=0;for(;;){let{done:J,value:W}=await X.read();if(J)break;if(G+=W.byteLength,G>Z)throw await X.cancel().catch(()=>{}),new vG$(`Upstream response exceeded ${Z} bytes`);Y+=Q.decode(W,{stream:!0})}return Y+=Q.decode(),Y}var vG$;var Wp=B(()=>{vG$=class vG$ extends Error{}});async function Nw0({ctx:$,runner:Z,handle:X,orgId:Q,userId:Y,entries:G}){if(!G||G.length===0)return;let J={};for(let K of G){if(K.kind==="literal"){J[K.key]=K.value;continue}try{let{value:H}=await $.storage.secrets.resolveById(K.secretId,Q,Y);J[K.key]=H}catch(H){if(H instanceof BG||H instanceof $w){console.warn(`[SANDBOX_START] skipping env ${K.key}: ${H.message}. Re-link or recreate the secret to restore.`);continue}throw H}}if(Object.keys(J).length===0)return;let W=await Z.proxyDaemonRequest(X,"/_sandbox/config",{method:"PUT",headers:new Headers({"content-type":"application/json"}),body:JSON.stringify({env:J})});if(!W.ok){let K=await $O(W,R34).catch(()=>W.statusText);console.warn(`[SANDBOX_START] daemon rejected env patch (${W.status}): ${K}`)}}var R34=10485760;var yn0=B(()=>{Xm();Wp()});async function bG$({ctx:$,orgId:Z,userId:X,entries:Q}){if(!Q||Q.length===0)return[];let Y=[];for(let G of Q)try{let{value:J}=await $.storage.secrets.resolveById(G.secretId,Z,X);Y.push({host:G.host,token:J})}catch(J){if(J instanceof BG||J instanceof $w){console.warn(`[SANDBOX_START] skipping submodule credential for ${G.host}: ${J.message}. Re-link or recreate the secret to restore.`);continue}throw J}return Y}var fG$=B(()=>{Xm()});async function gG$($,Z,X,Q,Y){let G=await eH({connectionId:$,tokenStorage:new E5(Q,Y)});if(!G.accessToken)return null;return uG$(Z,X,G.accessToken)}function hG$($,Z){return uG$($,Z,null)}async function uG$($,Z,X){let Q=new Map,Y=new Set(xG$.map((K)=>K.path));for(let K of Object.values(yG$))for(let H of K??[])Y.add(H);await Promise.all(Array.from(Y).map(async(K)=>{Q.set(K,await q34($,Z,K,X))}));let G=xG$.find(({path:K})=>Q.get(K)!==null);if(!G)return null;let J=yG$[G.pm]??[],W=null;for(let K of J)if(W=M34(Q.get(K)??null),W)break;return{packageManager:G.pm,devPort:W}}async function q34($,Z,X,Q){let Y=`https://api.github.com/repos/${$}/${Z}/contents/${encodeURIComponent(X)}`;try{let G={Accept:"application/vnd.github+json","User-Agent":"studio-runtime-detect"};if(Q)G.Authorization=`token ${Q}`;let J=await fetch(Y,{headers:G,signal:AbortSignal.timeout(5000)});if(!J.ok)return null;let W=await J.json();if(!W.content||W.encoding!=="base64")return null;return Buffer.from(W.content,"base64").toString("utf8")}catch{return null}}function M34($){if(!$)return null;try{let Z=JSON.parse($),X=Z.tasks??Z.scripts??{};return(X.dev??X.start??"").match(I34)?.[1]??null}catch{return null}}var xG$,yG$,I34;var cG$=B(()=>{Pw();X3();xG$=[{path:"deno.json",pm:"deno"},{path:"deno.jsonc",pm:"deno"},{path:"bun.lock",pm:"bun"},{path:"bunfig.toml",pm:"bun"},{path:"pnpm-lock.yaml",pm:"pnpm"},{path:"yarn.lock",pm:"yarn"},{path:"package-lock.json",pm:"npm"},{path:"package.json",pm:"bun"}],yG$={deno:["deno.json","deno.jsonc"],bun:["package.json"],pnpm:["package.json"],yarn:["package.json"],npm:["package.json"]},I34=/(?:--port|PORT=|:)(\d{4,5})/});function k34($){return($??"").normalize("NFKD").replace(/[\u0300-\u036F]/g,"").toLowerCase().replace(/[^a-z0-9]+/g,"-").replace(/^-+|-+$/g,"")||"user"}function Fw0($){return $?.name||$?.email?.split("@")[0]||void 0}function Uw0($){let Z=k34($),X=Date.now().toString(36).split("").reverse().join("");return`${Z}-${X}`}function lG$($){let{current:Z,detached:X,base:Q}=$.status??{};if(typeof Z!=="string"||Z.length===0)return null;if(X===!0)return null;if(Z===$.requestedRef)return null;if(S34.has(Z))return null;if(typeof Q==="string"&&Q.length>0&&Z===Q)return null;return Z}function dG$($){if(!$.branch.startsWith("thread:"))return $.branch;if($.sticky&&$.recordedHeadRef)return $.recordedHeadRef;return $.derivedRef}var S34;var gn0=B(()=>{S34=new Set(["main","master","trunk","develop","HEAD"])});async function mG$($,Z){if(!$)return{hosts:[],allowSameHostDev:!1};let X;try{X=await $.presignedGetUrl("link-dispatch/_allowlist_probe",60,{requireFetchable:!0})}catch{return{hosts:[],allowSameHostDev:!1}}let Q;try{Q=new URL(X)}catch{return{hosts:[],allowSameHostDev:!1}}if(Q.protocol!=="https:"&&Q.protocol!=="http:")return{hosts:[],allowSameHostDev:!1};let Y=Q.hostname,G=V34.has(Y);return{hosts:[Y],allowSameHostDev:G&&!Z.isProduction}}var V34;var iG$=B(()=>{V34=new Set(["127.0.0.1","localhost","::1","[::1]","0.0.0.0"])});import{z as GK}from"zod";async function px($,Z){$0(Z);let X=r(Z),Q=W1(Z);if(!Q)throw Error("User ID required");let Y=await Z.storage.virtualMcps.findById($.virtualMcpId);if(!Y||Y.organization_id!==X.id)throw Error("Virtual MCP not found");let G=Y.metadata??{},J=await zN(Z,$.branch,Q),W=eW(C5(G),J,$.branch,$.sandboxProviderKind),K=$.sandboxProviderKind,{provider:H}=await hX(Z,{userId:J,branch:$.branch,virtualMcpMetadata:G,explicitKind:K});if(W){if(K!=="user-desktop")return W;if(await H.alive(W.sandboxHandle).catch(()=>!1))return W;await yw(Z.storage.virtualMcps,$.virtualMcpId,Q,J,$.branch,K).catch((O)=>{console.warn("[ensureSandbox] failed to reap stale user-desktop entry",O)})}let F=await ew(Z,sw($.branch)??Z.metadata?.threadId)??G.githubRepo??null,{entry:U}=await pG$({ctx:Z,userId:Q,sandboxUserId:J,orgId:X.id,virtualMcpId:$.virtualMcpId,branch:$.branch,metadata:G,githubRepo:F,existing:null,providerKind:K,runner:H,...$.cloneOnly?{cloneOnly:!0}:{}});return U}async function pG$($){let{ctx:Z,userId:X,sandboxUserId:Q,orgId:Y,virtualMcpId:G,branch:J,metadata:W,githubRepo:K,existing:H,runner:N,cloneOnly:F}=$,{runtime:U,packageManager:w,port:O,packageManagerPath:D}=_G$(W),L;if(K){if(K.connectionId)await Vx({ctx:Z,connectionId:K.connectionId,organizationId:Y,forceRefresh:!0,onLegacyMintError:(f0)=>{console.error("[provisionSandbox] repo-scoped legacy token mint failed",{connectionId:K.connectionId,error:f0.message})}});let{cloneUrl:E0,gitUserName:e,gitUserEmail:t}=K.connectionId?await gw(K.connectionId,K.owner,K.name,Z.db,Z.vault):W5$(K.owner,K.name);if(!w){let f0=K.connectionId?await gG$(K.connectionId,K.owner,K.name,Z.db,Z.vault):await hG$(K.owner,K.name);if(f0)w=f0.packageManager,U=Gp[f0.packageManager].runtime,O=f0.devPort??O,await _34(Z,G,X,f0.packageManager,f0.devPort)}let P0=c0().sandboxStickyHeadRefEnabled,Q0=dG$({branch:J,derivedRef:jN(J),recordedHeadRef:P0?await IG$(Z,sw(J)):null,sticky:P0}),j0=await bG$({ctx:Z,orgId:Y,userId:X,entries:VG$(W)});L={cloneUrl:E0,...K.connectionId?{connectionId:K.connectionId}:{},userName:e,userEmail:t,branch:Q0,displayName:`${K.owner}/${K.name}`,...j0.length>0?{submoduleCredentials:j0}:{}}}let E=typeof W.productionUrl==="string"&&W.productionUrl.trim()?W.productionUrl.trim():void 0,j=U&&w&&!F?{runtime:U,packageManager:w,...O!==null?{devPort:Number(O)}:{},...D?{packageManagerPath:D}:{},...E?{productionUrl:E}:{}}:void 0,z=qn({orgId:Y,virtualMcpId:G,branch:J}),A=N.kind==="user-desktop"?await mG$(Z.objectStorage,{isProduction:c0().nodeEnv==="production"}):null,P=(N.kind==="user-desktop"||N.kind==="agent-sandbox")&&!c0().orgFsMountsDisabled,M;if(P){let E0=Z.organization?.slug??(await Z.db.selectFrom("organization").select(["slug"]).where("id","=",Y).executeTakeFirst())?.slug;if(E0)M=await De1(Z,{orgSlug:E0,orgId:Y,baseUrl:eX()})}await b34(N);let k=await N.ensure({userId:Q,projectRef:z},{branch:J,repo:L,workload:j,cloneOnly:F===!0,tenant:{orgId:Y,userId:Q,...Z.organization?.slug?{orgSlug:Z.organization.slug}:{},...Z.organization?.name?{orgName:Z.organization.name}:{},...Z.auth.user?.email?{userEmail:Z.auth.user.email}:{},...Z.auth.user?.name?{userName:Z.auth.user.name}:{}},...A?{offloadAllowedHosts:A.hosts,offloadAllowSameHostDev:A.allowSameHostDev}:{},...M?{orgFsConfigJson:M}:{}}),q=W.runtime?.env??null;await Nw0({ctx:Z,runner:N,handle:k.handle,orgId:Y,userId:X,entries:q});let h=!!H&&H.sandboxHandle===k.handle&&H?.createdAt?H.createdAt:Date.now(),b=W.runtime?.selected??null,x=W.runtime?.port??null,p=W.runtime?.path??null,m={sandboxHandle:k.handle,previewUrl:k.previewUrl,sandboxApiUrl:k.previewUrl,sandboxProviderKind:N.kind,createdAt:h,startedWith:{packageManager:b,port:x,path:p}};await a6$(Z.storage.virtualMcps,G,X,Q,J,$.providerKind,m);let Y0=sw(J);if(Y0)await kG$(Z,Y0,Q,J,$.providerKind,m);let L0=!H||H.sandboxHandle!==k.handle;return{entry:m,isNewVm:L0}}async function _34($,Z,X,Q,Y){let G=await $.storage.virtualMcps.findById(Z);if(!G)return;let J=G.metadata??{};await $.storage.virtualMcps.update(Z,X,{metadata:{...J,runtime:{selected:Q,port:Y}}})}async function b34($){if(!$.hasSchedulableCapacity)return;let Z=Date.now()+nG$,X=!1;while(!await $.hasSchedulableCapacity()){if(Date.now()>=Z)throw Error(`sandbox provisioning failed: the cluster has had no room to schedule another sandbox for ${Math.round(nG$/1000)}s`);if(!X)X=!0,console.warn("[ensureSandbox] waiting for cluster capacity \u2014 a sandbox pod cannot be scheduled right now");await y$(v34)}}var C34,hn0,nG$=150000,v34=5000;var Kp=B(()=>{FN();B6();b0();Jp();yn0();fG$();kQ();Cn();cG$();bn0();aw();j3();gn0();iG$();S$();BZ();ci();kQ();C34=GK.enum(["agent-sandbox","user-desktop","cluster"]),hn0=d({name:"SANDBOX_START",description:"Start a sandbox with the connected GitHub repo and dev server.",annotations:{title:"Start VM Preview",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!1,openWorldHint:!0},_meta:{ui:{visibility:"app"}},inputSchema:GK.object({virtualMcpId:GK.string().describe("Virtual MCP ID"),branch:GK.string().min(1).optional().describe("Git branch to check out. Pass the thread's branch whenever the caller has one: when omitted the handler mints a fresh `<user-slug>-<timestamp>` name, which becomes a SEPARATE sandbox from the one the thread's own branch resolves to. The resolved branch is returned in the response so callers can persist it."),sandboxProviderKind:C34.optional().describe("Explicit runtime choice. Hosted provider is `agent-sandbox`; legacy `cluster` input is accepted only for compatibility and normalized to `agent-sandbox`. When omitted, defaults to `user-desktop` if the acting user's link daemon is online, else the env kind.")}),outputSchema:GK.object({previewUrl:GK.string().nullable(),sandboxHandle:GK.string(),branch:GK.string(),isNewVm:GK.boolean(),sandboxProviderKind:GK.enum(["agent-sandbox","user-desktop"])}),handler:async($,Z)=>{$0(Z);let X=r(Z);await Z.access.check();let Q=$.branch??Uw0(Fw0(Z.auth.user)),Y=W1(Z);if(!Y)throw Error("User ID required");let G=await zN(Z,Q,Y),J=await Z.storage.virtualMcps.findById($.virtualMcpId);if(!J||J.organization_id!==X.id)throw Error("Virtual MCP not found");let W=J.metadata??{},K=$.sandboxProviderKind?aL($.sandboxProviderKind):void 0,{provider:H,kind:N}=await hX(Z,{userId:G,branch:Q,virtualMcpMetadata:W,explicitKind:K}),F=eW(C5(W),G,Q,N),w=await ew(Z,sw(Q)??Z.metadata?.threadId)??W.githubRepo??null,{entry:O,isNewVm:D}=await pG$({ctx:Z,userId:Y,sandboxUserId:G,orgId:X.id,virtualMcpId:$.virtualMcpId,branch:Q,metadata:W,githubRepo:w,existing:F,providerKind:N,runner:H});return{...O,branch:Q,isNewVm:D,sandboxProviderKind:N}}})});function f34($){let{publicUrl:Z,agentId:X,organization:Q,target:Y,threadId:G}=$;if(Y==="agent-tools")return`${Z}/mcp/virtual-mcp/${X}`;if(!Q.slug)throw new oG$(Q.id);if(Y==="task-run"){if(!G)throw Error("a task-run MCP endpoint is scoped to a run: threadId is required");return`${Z}/api/${Q.slug}/mcp/task-run/${encodeURIComponent(G)}`}return`${Z}/api/${Q.slug}/mcp/self`}async function ww0($,Z,X,Q,Y="agent-tools",G){let J=f34({publicUrl:eX(),agentId:Z,organization:X,target:Y,...G?{threadId:G}:{}}),W=await $.boundAuth.apiKey.create({name:Q,permissions:{"*":["*"]},expiresIn:tG$,metadata:{organization:{id:X.id,slug:X.slug,name:X.name}}});return{url:J,headers:{Authorization:`Bearer ${W.key}`,"x-org-id":X.id},expiresAt:Date.now()+tG$*1000}}var tG$=3600,oG$;var un0=B(()=>{BZ();oG$=class oG$ extends Error{constructor($){super(`cannot mint a management MCP endpoint for organization "${$}": the org-scoped path /api/<slug>/mcp/self needs the org slug, which was not loaded.`);this.name="MissingOrganizationSlugError"}}});async function x34($,Z,X,Q){try{let Y=$.organization;if(!Y)return;let G=await ww0($,Q.virtualMcpId,Y,"tool-scripting"),J=await Z.proxyDaemonRequest(X,"/_sandbox/tools/sync",{method:"POST",headers:new Headers({"content-type":"application/json"}),body:JSON.stringify(G)});if(!J.ok)console.warn("[cluster-sandbox-fs] tools/sync failed",J.status,await J.text().catch(()=>""))}catch(Y){console.warn("[cluster-sandbox-fs] tools/sync failed",Y)}}async function tx($,Z){let{provider:X,kind:Q}=await hX($,{userId:Z.userId,branch:Z.branch,virtualMcpMetadata:null}),Y=null,G=()=>{if(!Y){if(Y=px({virtualMcpId:Z.virtualMcpId,branch:Z.branch,sandboxProviderKind:Q},$).then((K)=>K.sandboxHandle),Y.catch(()=>{Y=null}),Z.syncTools)Y.then((K)=>x34($,X,K,{virtualMcpId:Z.virtualMcpId,providerKind:Q})).catch(()=>{})}return Y},J=Z.branch==="ephemeral"||Q==="user-desktop";return Bm0(X,{ensureHandle:G,invalidateHandle:async(K)=>{let H=Y;if(Y=null,!J&&!K?.force)return;try{await yw($.storage.virtualMcps,Z.virtualMcpId,Z.userId,Z.userId,Z.branch,Q)}catch(N){console.warn("[cluster-sandbox-fs] failed to reap vmMap entry",N)}if(H&&typeof X.forgetHandle==="function")try{let N=await H;await X.forgetHandle(N)}catch(N){console.warn("[cluster-sandbox-fs] forgetHandle failed",N)}},canAutoRestart:J})}async function rG$($,Z){try{let X=await tx($,Z),{stdout:Q}=await X.onBash("test -d .deco && echo __DECO_SITE__");return Q.includes("__DECO_SITE__")}catch(X){return console.warn("[cluster-sandbox-fs] .deco probe failed; assuming deco site",X),!0}}var Ow0=B(()=>{FN();un0();aw();Kp();kQ()});import{z as aG$}from"zod";function ox($){let Z=[];for(let X of $){if(X.status!=="active")continue;let Q=_X(X);if(!Q)continue;Z.push({connectionId:X.id,owner:Q.owner,repo:Q.repo,installationId:Q.installationId})}return Z}async function g34($,Z){let{items:X}=await $.storage.connections.list(Z,{slug:"mcp-github"});return ox(X)}function h34($){let Z=$.split(`
+`))>=0){let K=Q.slice(0,W).trim();if(Q=Q.slice(W+1),!K)continue;yield JSON.parse(K)}}let Y=Q.trim();if(Y)yield JSON.parse(Y)}finally{Z.releaseLock()}}var vY$,wn0,yY$="gateway.networking.k8s.io",gY$="v1",hY$="httproutes",BJ4,$p,cY$="mesh-sandbox-runner";var Zp=B(()=>{B6();sn();vY$=class vY$ extends Error{status;body;constructor($,Z,X){super(X);this.status=$;this.body=Z;this.name="KubeHttpError"}};wn0=`/apis/${O9.CLAIM_API_GROUP}/${O9.CLAIM_API_VERSION}/namespaces`;BJ4=`/apis/${yY$}/${gY$}/namespaces`;$p={API_GROUP:yY$,API_VERSION:gY$,PLURAL:hY$}});function LJ4($){return($.items??[]).some((Z)=>{if(Z.status?.phase!=="Pending")return!1;return(Z.status?.conditions??[]).some((X)=>X.type==="PodScheduled"&&X.status==="False"&&X.reason==="Unschedulable")})}function mY$($,Z){let X=0,Q=!0,Y=null,G=async()=>{try{let J=await B3($,{method:"GET",path:`/api/v1/namespaces/${encodeURIComponent(Z)}/pods?fieldSelector=status.phase%3DPending`});if(!J.ok)return dY$;let W=await J.json();return!LJ4(W)}catch{return dY$}};return async()=>{if(Date.now()-X<DJ4)return Q;return Y??=G().finally(()=>{Y=null}),Q=await Y,X=Date.now(),Q}}var DJ4=3000,dY$=!0;var iY$=B(()=>{Zp()});var Ln0=B(()=>{B6();Um0()});async function Gw0($){try{let Z=await fetch(`${$}/health`,{signal:AbortSignal.timeout(EJ4)});if(!Z.ok)return null;let X=await Z.json();if(typeof X==="object"&&X!==null&&typeof X.bootId==="string"&&typeof X.ready==="boolean"&&X.setup&&typeof X.setup.running==="boolean"&&typeof X.setup.done==="boolean")return X;return null}catch{return null}}async function jn0($){for(let Z=0;Z<nY$;Z++){if(await Gw0($)!==null)return;let X=(Math.random()*2-1)*jJ4;await y$(pY$+X)}throw Error(`sandbox daemon at ${$} did not respond on /health within ${nY$*pY$/1000}s`)}async function MV($,Z,X,Q,Y){return zJ4($,Z,"POST",X,Q,Y)}async function zJ4($,Z,X,Q,Y,G){let J={...Q};if(Y&&Y.rotateToken!==void 0)J.auth=Y;let W=await fetch(`${$}/_sandbox/config`,{method:X,headers:{"Content-Type":"application/json",Authorization:`Bearer ${Z}`},body:JSON.stringify(J),signal:AbortSignal.timeout(G?.timeoutMs??En0)}),K=await W.text();if(!W.ok)throw new Yw0(W.status,K);return JSON.parse(K)}async function tY$($,Z,X){let Q=await fetch(`${$}/_sandbox/setup/${X}`,{method:"POST",headers:{Authorization:`Bearer ${Z}`},signal:AbortSignal.timeout(En0)});if(!Q.ok)throw Error(`sandbox daemon /_sandbox/setup/${X} returned ${Q.status}: ${await Q.text()}`)}async function oY$($,Z,X){let Q=await fetch(`${$}/_sandbox/orgfs-config`,{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${Z}`},body:X,signal:AbortSignal.timeout(En0)}),Y=await Q.text();if(!Q.ok)throw Error(`sandbox daemon /_sandbox/orgfs-config returned ${Q.status}: ${Y}`);return JSON.parse(Y)}async function Xp($,Z,X,Q){let Y=new Headers(Q.headers);for(let W of PJ4)Y.delete(W);Y.set("authorization",`Bearer ${Z}`);let G=Q.method!=="GET"&&Q.method!=="HEAD",J=`${$}${X.startsWith("/")?X:`/${X}`}`;return fetch(J,{method:Q.method,headers:Y,body:G?Q.body:void 0,redirect:"manual",signal:Q.signal,duplex:G?"half":void 0})}var Yw0,EJ4=500,En0=30000,nY$=25,pY$=200,jJ4=50,PJ4;var rY$=B(()=>{Ln0();Yw0=class Yw0 extends Error{status;constructor($,Z){super(`sandbox daemon /_sandbox/config returned ${$}: ${Z}`);this.status=$;this.name="ConfigRequestError"}};PJ4=["cookie","host","connection","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","accept-encoding","content-length"]});async function*eY$($){let Z=$.now??(()=>Date.now()),X=Z(),Q=$.schedulingTimeoutMs??RJ4,Y={pod:{},sandbox:{},events:{hasPulling:!1,hasPulled:!1},startedAt:X},G=[],J=null,W=!1,K=(j)=>{if(W)return;if(J){let z=J;J=null,z(j)}else G.push(j)},H=()=>{if(G.length>0)return Promise.resolve(G.shift());if(W)return Promise.resolve(null);return new Promise((j)=>{J=j})},N=()=>{if(W)return;if(W=!0,J){let j=J;J=null,j(null)}},F=new AbortController,U=()=>{F.abort(),N()};if($.signal)if($.signal.aborted)F.abort(),N();else $.signal.addEventListener("abort",U,{once:!0});let w=Math.max(0,Q-(Z()-X)),O=setTimeout(()=>K("tick"),w+100),D,L=new Promise((j)=>{D=j}),E=Promise.allSettled([IJ4($.kc,$.namespace,$.claimName,F.signal,Y,K,Z,D),MJ4($.kc,$.namespace,$.claimName,F.signal,Y,K),kJ4($.kc,$.namespace,$.claimName,L,F.signal,Y,K,Z)]);try{let j=null,z=-1,A=aY$(Y,Q,Z);if(j=Pn0(A),!zn0(A))z=sY$(A);if(yield A,zn0(A))return;while(!W){if(await H()===null)break;let M=aY$(Y,Q,Z);if(zn0(M)){let _=Pn0(M);if(_!==j)j=_,yield M;return}let k=sY$(M);if(k<z)continue;let q=Pn0(M);if(q!==j)j=q,z=k,yield M}}finally{if(clearTimeout(O),F.abort(),$.signal)$.signal.removeEventListener("abort",U);N(),await E.catch(()=>{})}}function aY$($,Z,X){let{pod:Q,sandbox:Y,events:G,startedAt:J}=$;if(Y.ready)return{kind:"ready"};let W=Q.containerWaitingReason;if(W==="ImagePullBackOff"||W==="ErrImagePull")return{kind:"failed",reason:"image-pull-backoff",message:"Sandbox image failed to download. The cluster may be missing pull credentials or the image tag may not exist."};if(W==="CrashLoopBackOff")return{kind:"failed",reason:"crash-loop-backoff",message:"Sandbox crashed during startup and is now in CrashLoopBackOff. Check pod logs."};if(!Q.scheduled&&G.lastFailedSchedulingAt!==void 0&&X()-J>Z)return{kind:"failed",reason:"scheduling-timeout",message:G.failedSchedulingMessage??`Pod could not be scheduled within ${Math.round(Z/1000)}s.`};if(Q.containerRunning&&!Q.containerReady)return{kind:"warming-daemon",since:J};if(G.hasPulling&&!G.hasPulled)return{kind:"pulling-image",since:J};if(W==="ContainerCreating"||W==="PodInitializing"||Q.scheduled&&!Q.containerRunning)return{kind:"starting-container",since:J};if(Q.scheduledFalseReason==="Unschedulable"||G.lastFailedSchedulingAt!==void 0&&!Q.scheduled)return{kind:"waiting-for-capacity",since:J,message:G.failedSchedulingMessage??Q.scheduledFalseMessage,nodeClaim:G.nominatedNodeClaim};return{kind:"claiming",since:J}}function zn0($){return $.kind==="ready"||$.kind==="failed"}function sY$($){switch($.kind){case"claiming":return 0;case"waiting-for-capacity":return 1;case"pulling-image":return 2;case"starting-container":return 3;case"warming-daemon":return 4;case"ready":case"failed":return 99}}function Pn0($){switch($.kind){case"claiming":case"pulling-image":case"starting-container":case"warming-daemon":return $.kind;case"waiting-for-capacity":return`waiting-for-capacity:${$.message??""}:${$.nodeClaim??""}`;case"ready":return"ready";case"failed":return`failed:${$.reason}:${$.message}`}}async function IJ4($,Z,X,Q,Y,G,J,W){let K=`/api/v1/namespaces/${encodeURIComponent(Z)}/pods?watch=true&labelSelector=${encodeURIComponent(`${AJ4}=${X}`)}`;return Jw0({kc:$,path:K,signal:Q,label:`pod/${X}`,onEvent:(H)=>{if(H.type!=="ADDED"&&H.type!=="MODIFIED")return;let N=H.object;if(N.metadata?.name)W(N.metadata.name);qJ4(N,Y,J),G("pod")}})}function qJ4($,Z,X){let Y=($.status?.conditions??[]).find((J)=>J.type==="PodScheduled");if(Y?.status==="True")Z.pod.scheduled=!0,Z.pod.scheduledFalseReason=void 0,Z.pod.scheduledFalseMessage=void 0;else if(Y?.status==="False")Z.pod.scheduled=!1,Z.pod.scheduledFalseReason=Y.reason,Z.pod.scheduledFalseMessage=Y.message;let G=($.status?.containerStatuses??[]).find((J)=>J.name===TJ4);if(G)Z.pod.containerWaitingReason=G.state?.waiting?.reason,Z.pod.containerRunning=!!G.state?.running,Z.pod.containerReady=G.ready===!0}async function MJ4($,Z,X,Q,Y,G){let J=`/apis/${O9.CLAIM_API_GROUP}/${O9.CLAIM_API_VERSION}/namespaces/${encodeURIComponent(Z)}/${O9.CLAIM_PLURAL}?watch=true&fieldSelector=${encodeURIComponent(`metadata.name=${X}`)}`;return Jw0({kc:$,path:J,signal:Q,label:`sandboxclaim/${X}`,onEvent:(W)=>{if(W.type!=="ADDED"&&W.type!=="MODIFIED")return;let H=W.object.status?.conditions?.find((N)=>N.type==="Ready");if(!H)return;if(H.status==="True")Y.sandbox.ready=!0,Y.sandbox.notReadyReason=void 0,Y.sandbox.notReadyMessage=void 0;else Y.sandbox.ready=!1,Y.sandbox.notReadyReason=H.reason,Y.sandbox.notReadyMessage=H.message;G("sandbox")}})}async function kJ4($,Z,X,Q,Y,G,J,W){let K=await Promise.race([Q,new Promise((N)=>{if(Y.aborted){N(X);return}Y.addEventListener("abort",()=>N(X),{once:!0})})]);if(Y.aborted)return;let H=`/api/v1/namespaces/${encodeURIComponent(Z)}/events?watch=true&fieldSelector=${encodeURIComponent(`involvedObject.name=${K},involvedObject.kind=Pod`)}`;return Jw0({kc:$,path:H,signal:Y,label:`events/${X}`,onEvent:(N)=>{if(N.type!=="ADDED"&&N.type!=="MODIFIED")return;let F=N.object,U=F.reason;if(!U)return;switch(U){case"Pulling":G.events.hasPulling=!0;break;case"Pulled":G.events.hasPulling=!0,G.events.hasPulled=!0;break;case"FailedScheduling":G.events.lastFailedSchedulingAt=W(),G.events.failedSchedulingMessage=F.message;break;case"Nominated":{let w=F.message?.match(/nodeclaim\/([\w-]+)/);if(w)G.events.nominatedNodeClaim=w[1];break}default:return}J("event")}})}async function $G$($){let{kc:Z,namespace:X,labelSelector:Q,signal:Y,onDelete:G}=$,J=`/apis/${O9.CLAIM_API_GROUP}/${O9.CLAIM_API_VERSION}/namespaces/${encodeURIComponent(X)}/${O9.CLAIM_PLURAL}?watch=true&labelSelector=${encodeURIComponent(Q)}`;return Jw0({kc:Z,path:J,signal:Y,label:"sandboxclaim-reaper",onEvent:(W)=>{if(W.type!=="DELETED")return;let K=W.object.metadata?.name;if(K)G(K)}})}async function Jw0($){let{kc:Z,path:X,signal:Q,label:Y,onEvent:G}=$,J=0;while(!Q.aborted){try{let K=await B3(Z,{method:"GET",path:X,signal:Q,headers:{accept:"application/json"},stream:!0});if(!K.ok||!K.body){try{await K.body?.cancel()}catch{}if(K.status===401||K.status===403){console.warn(`[lifecycle-watcher] ${Y} stopped: watch denied (${K.status} ${K.statusText}). `+"The kubeconfig in use cannot watch SandboxClaims \u2014 if you are running locally, "+"this provider should not be active (check STUDIO_SANDBOX_PROVIDER / your sandbox preference).");return}throw Error(`watch handshake failed: ${K.status} ${K.statusText}`)}J=0;for await(let H of Dn0(K.body)){if(Q.aborted)return;try{G(H)}catch(N){console.warn(`[lifecycle-watcher] ${Y} onEvent threw: ${N instanceof Error?N.message:String(N)}`)}}}catch(K){if(Q.aborted)return;let H=K instanceof Error?K.message:String(K);console.warn(`[lifecycle-watcher] ${Y} watch ended: ${H}`)}if(Q.aborted)return;let W=JX(5000,250,J,2,0);J+=1,await y$(W,{signal:Q}).catch(()=>{})}}var AJ4="studio.decocms.com/sandbox-handle",TJ4="sandbox",RJ4=300000;var ZG$=B(()=>{B6();sn();Zp()});import{z as vG}from"zod";function XG$($){if(!$||$.trim()==="")return[];let Z=vG.array(SJ4).parse(JSON.parse($)),X=new Set;for(let Q of Z){if(X.has(Q.name))throw Error(`STUDIO_SANDBOX_TENANT_POOLS: duplicate pool name ${Q.name}`);X.add(Q.name)}return Z}function VJ4($){try{let[Z,X]=new URL($).pathname.replace(/^\/+/,"").split("/"),Q=X?.replace(/\.git$/,"");return Z&&Q?`${Z}/${Q}`.toLowerCase():null}catch{return null}}function QG$($,Z){let{orgId:X,cloneUrl:Q}=Z;if(Z.cloneOnly===!0)return null;if(!X||!Q)return null;let Y=VJ4(Q);if(!Y)return null;return $.find((G)=>G.orgId===X&&G.repo.toLowerCase()===Y)??null}function YG$($,Z,X){return $?.name??(Z?X:"none")}function GG$($,Z,X){let Q=X.replace(/^refs\/heads\//,"");return $.filter((Y)=>Y.repo.toLowerCase()===Z.toLowerCase()&&Y.branch===Q)}function JG$($){return`https://github.com/${$.repo}.git`}var SJ4;var An0=B(()=>{SJ4=vG.object({name:vG.string().regex(/^[a-z0-9]([-a-z0-9]*[a-z0-9])?$/,"pool name must be a DNS label (lowercase alphanumeric and '-')"),orgId:vG.string().min(1),repo:vG.string().regex(/^[^/\s]+\/[^/\s]+$/,"repo must be `owner/name`"),connectionId:vG.string().min(1).optional(),branch:vG.string().min(1).default("main"),workload:vG.object({runtime:vG.enum(["node","bun","deno"]).default("node"),packageManager:vG.enum(["npm","pnpm","yarn","bun","deno"]).optional(),packageManagerPath:vG.string().optional(),devPort:vG.number().int().positive().optional()}).default({runtime:"node"})})});async function WG$($,Z,X){let Q=new Map;for(let Y of $){let G=Z(Y);if(!G)continue;let J=Q.get(G);if(J)J.push(Y);else Q.set(G,[Y])}await Promise.allSettled([...Q.values()].map(async(Y)=>{for(let G of Y)await X(G).catch(()=>{})}))}import{createHash as CJ4,randomBytes as _J4,randomUUID as vJ4}from"crypto";import*as wG$ from"net";import{PassThrough as bJ4}from"stream";function fJ4($){if($ instanceof Error)return $.message;if($&&typeof $==="object"){let Z=$;if(Z.error instanceof Error)return Z.error.message;if(typeof Z.message==="string"&&Z.message)return Z.message}return String($)}class kn0{kind=bQ;records=new Map;inflight=new C90;stateStore;previewUrlPattern;kubeConfig;capacityProbe;portForward;namespace;sandboxTemplateName;envName;tokenGenerator;idleTtlMs;metrics;previewGateway;sentinelToken;mintCloneUrl;tenantPools;tenantPoolRefreshMs;poolPods=new Map;dirtyPools=new Set;closed=!1;claimWatchAbort=new AbortController;constructor($={}){this.stateStore=$.stateStore??null,this.previewUrlPattern=$.previewUrlPattern??null,this.kubeConfig=$.kubeConfig??tJ4(),this.portForward=new ti0(this.kubeConfig),this.namespace=$.namespace??xJ4,this.sandboxTemplateName=$.sandboxTemplateName??yJ4,this.envName=$34($.envName),this.tokenGenerator=$.tokenGenerator??(()=>_J4(gJ4).toString("hex")),this.idleTtlMs=$.idleTtlMs??uJ4,this.metrics=$.meter?pJ4($.meter):null,this.previewGateway=$.previewGateway&&$.previewUrlPattern?{...$.previewGateway}:null;let Z=$.sentinelToken?.trim()??"";if(this.sentinelToken=Z.length>0?Z:null,this.mintCloneUrl=$.mintCloneUrl,this.tenantPools=this.sentinelToken!==null?$.tenantPools??[]:[],this.sentinelToken===null&&($.tenantPools?.length??0)>0)console.warn(`[${y6}] tenant pools configured without a sentinel token \u2014 ignoring them (warm-pool mode is off)`);this.tenantPoolRefreshMs=$.tenantPoolRefreshMs??lJ4,this.startClaimReaper(),this.startCredentialRefresher(),this.startTenantPoolReconciler()}startClaimReaper(){let $=["app.kubernetes.io/managed-by=studio","app.kubernetes.io/name=studio-sandbox",...this.envName?[`${fQ.env}=${this.envName}`]:[]].join(",");$G$({kc:this.kubeConfig,namespace:this.namespace,labelSelector:$,signal:this.claimWatchAbort.signal,onDelete:(Z)=>this.invalidateRecord(Z)})}async ensure($,Z={}){let X=sL($);if(X.startsWith("s-"))throw Error(`ensure: projectRef has no slug source: ${$.projectRef}`);return this.inflight.run(X,()=>_90(this.stateStore,$,bQ,(Q)=>this.ensureLocked($,X,Z,Q)))}async delete($){let Z=await this.getRecord($);if(this.records.delete($),Z)this.closeForwarder(Z.daemonForward),this.metrics?.active.add(-1,qn0(Z.tenant));if(await this.deleteHttpRouteIfManaged($).catch((X)=>{console.warn(`[${y6}] HTTPRoute delete failed for ${$}: ${X instanceof Error?X.message:String(X)}`)}),await ow(this.kubeConfig,this.namespace,$),this.stateStore)if(Z)await this.stateStore.delete(Z.id,bQ);else await this.stateStore.deleteByHandle(bQ,$)}async alive($){return await D3(this.kubeConfig,this.namespace,$)!==void 0}watchClaimLifecycle($,Z){return eY$({kc:this.kubeConfig,namespace:this.namespace,claimName:$,signal:Z})}hasSchedulableCapacity(){return this.capacityProbe??=mY$(this.kubeConfig,this.namespace),this.capacityProbe()}async getPreviewUrl($){let Z=await this.getRecord($);if(!Z)return null;return this.composePreviewUrl(Z)}async proxyDaemonRequest($,Z,X){let Q=await this.getRecord($);if(!Q&&this.previewUrlPattern&&this.stateStore){let K=await this.stateStore.getByHandle(bQ,$),H=K?.state,N=H?.token;if(K&&N){let U=`http://${H?.adoptedSandboxName??$}.${this.namespace}.svc.cluster.local:${EN}`;try{let w=await Xp(U,N,Z,X);if(w.status!==404)return w;try{await w.body?.cancel()}catch{}}catch{}}}if(!Q)Q=await this.resurrectByHandle($);if(!Q)return new Response(JSON.stringify({error:"sandbox not found"}),{status:404,headers:{"content-type":"application/json"}});let Y=Q,G=performance.now(),J=0,W=!(X.body instanceof ReadableStream);try{let K=await Xp(Q.daemonUrl,Q.token,Z,X);if(K.status===401&&W){this.invalidateRecord($);let H=await this.getRecord($).catch(()=>null)??await this.resurrectByHandle($).catch(()=>null);if(H)Y=H,K=await Xp(H.daemonUrl,H.token,Z,X)}return J=K.status,K}catch(K){if(!W)throw K;this.invalidateRecord($);let H=await this.resurrectByHandle($)??await this.getRecord($).catch(()=>null);if(!H)throw K;Y=H;let N=await Xp(H.daemonUrl,H.token,Z,X);return J=N.status,N}finally{this.recordProxyDuration("daemon",J,Y,performance.now()-G)}}async adoptLiveClaim($,Z){if(this.records.has(Z))return!0;let X=await D3(this.kubeConfig,this.namespace,Z).catch(()=>{return});if(!X||X.metadata?.deletionTimestamp)return!1;return await this.inflight.run(Z,async()=>{let Y=this.records.get(Z);if(Y)return this.toSandbox(Y);let G=await this.adopt($,Z,X);if(!G)throw Error(`cannot adopt live claim ${Z}`);return _90(this.stateStore,$,bQ,(J)=>this.finish(G,J,!0,!0,"adopt"))}).catch(()=>null)!=null}async resolvePreviewUpstreamUrl($){if(this.previewUrlPattern)return`http://${await this.resolveServiceNameForHandle($)}.${this.namespace}.svc.cluster.local:${EN}`;let Z=await this.getRecord($);if(Z)return Z.daemonUrl;let X=await this.resurrectByHandle($);return X?X.daemonUrl:null}async resolveServiceNameForHandle($){let Z=this.records.get($);if(Z)return Z.adoptedSandboxName;if(this.stateStore){let Q=(await this.stateStore.getByHandle(bQ,$).catch(()=>null))?.state?.adoptedSandboxName;if(Q)return Q}return $}async proxyPreviewRequest($,Z){let X=performance.now(),Q=this.records.get($)??null,Y=0;try{let G=await this.resolvePreviewUpstreamUrl($);if(!G){Y=404;let O=Rn0(404,{error:"sandbox not found"});return O.headers.set(SV,"1"),O}let J=new URL(Z.url);if((J.pathname==="/_sandbox"||J.pathname.startsWith("/_sandbox/")||J.pathname==="/_decopilot_vm"||J.pathname.startsWith("/_decopilot_vm/"))&&Z.method!=="GET")return Y=404,Rn0(404,{error:"not found"});let K=(O)=>`${O}${J.pathname}${J.search}`,H=new Headers(Z.headers);for(let O of iJ4)H.delete(O);let N=Z.method!=="GET"&&Z.method!=="HEAD",F={method:Z.method,headers:H,body:N?Z.body:void 0,redirect:"manual",signal:Z.signal,duplex:N?"half":void 0},U;try{U=await fetch(K(G),F)}catch(O){let D=`${G}${J.pathname}`;if(console.warn(`[${y6}] preview fetch to ${D} failed: ${O instanceof Error?O.message:String(O)}`),Z.method==="GET"||Z.method==="HEAD"){if(this.invalidateRecord($),await this.resurrectByHandle($).catch(()=>null)){let j=await this.resolvePreviewUpstreamUrl($);if(j)try{U=await fetch(K(j),F);let z=new Headers;for(let[A,P]of U.headers.entries())if(!NG$.includes(A.toLowerCase()))z.set(A,P);return Y=U.status,new Response(U.body,{status:U.status,statusText:U.statusText,headers:z})}catch(z){console.warn(`[${y6}] preview fetch retry to ${D} failed: ${z instanceof Error?z.message:String(z)}`)}}}else this.invalidateRecord($);Y=502;let L=Rn0(502,{error:"sandbox daemon unreachable"});return L.headers.set(SV,"1"),L}let w=new Headers;for(let[O,D]of U.headers.entries())if(!NG$.includes(O.toLowerCase()))w.set(O,D);return Y=U.status,new Response(U.body,{status:U.status,statusText:U.statusText,headers:w})}finally{this.recordProxyDuration("preview",Y,Q,performance.now()-X,$)}}async ensureLocked($,Z,X,Q){if(X.image)console.warn(`[${y6}] opts.image ignored (template ${this.sandboxTemplateName} pins image): got ${X.image}`);if(Q){let J=await Q.get($,bQ);if(J){let W=await this.rehydrate($,Z,J);if(W)return await this.refreshDaemonGitCredential(W,X),this.finish(W,Q,!1,!0,"resume");await Q.delete($,bQ)}}let Y=await D3(this.kubeConfig,this.namespace,Z).catch(()=>{return});if(Y)if(Y.metadata?.deletionTimestamp)await eU0(this.kubeConfig,this.namespace,Z).catch((J)=>{console.warn(`[${y6}] wait for terminating claim ${Z} failed: ${J instanceof Error?J.message:String(J)}`)});else{let J=await this.adopt($,Z,Y).catch((W)=>{return console.warn(`[${y6}] adopt ${Z} failed, recreating: ${W instanceof Error?W.message:String(W)}`),null});if(J)return await this.refreshDaemonGitCredential(J,X),this.finish(J,Q,!0,!0,"adopt");await ow(this.kubeConfig,this.namespace,Z).catch(()=>{}),await eU0(this.kubeConfig,this.namespace,Z).catch((W)=>{console.warn(`[${y6}] wait for deleted claim ${Z} failed: ${W instanceof Error?W.message:String(W)}`)})}let G=await this.provision($,Z,X);return this.finish(G,Q,!0,!1,"fresh")}async finish($,Z,X,Q,Y){let G=this.records.get($.handle),J=G!==void 0;if(G&&G.daemonForward!==$.daemonForward)this.closeForwarder(G.daemonForward);if(this.records.set($.handle,$),X)await this.persist(Z,$);if(Q)await $w0(this.kubeConfig,this.namespace,$.handle,this.computeShutdownTime()).catch((W)=>console.warn(`[${y6}] TTL refresh failed for ${$.handle}: ${W instanceof Error?W.message:String(W)}`));if(this.metrics){let W=qn0($.tenant);if(this.metrics.ensureOutcome.add(1,{...W,outcome:Y}),!J)this.metrics.active.add(1,W)}return this.toSandbox($)}buildEnvMap($,Z){let X={},Q=[];for(let[Y,G]of Object.entries($.env??{}))if(hJ4.has(Y))Q.push(Y);else X[Y]=G;if(Q.length>0)console.warn(`[${y6}] opts.env keys overlap reserved bootstrap names and were dropped: ${Q.join(",")}`);return{...X,DAEMON_TOKEN:Z.token,DAEMON_BOOT_ID:Z.daemonBootId,APP_ROOT:Z.workdir,PROXY_PORT:String(EN)}}buildClaim($,Z,X){let Q=this.sentinelToken!==null,Y=QG$(this.tenantPools,{orgId:Z.tenant?.orgId,cloneUrl:Z.repo?.cloneUrl,cloneOnly:Z.cloneOnly}),G=Q?[]:Object.entries(this.buildEnvMap(Z,X)).sort(([K],[H])=>K<H?-1:K>H?1:0).map(([K,H])=>({name:K,value:H})),J=Q34(Z),W=Object.keys(J).length>0;return{apiVersion:`${O9.CLAIM_API_GROUP}/${O9.CLAIM_API_VERSION}`,kind:"SandboxClaim",metadata:{name:$,namespace:this.namespace,labels:{"app.kubernetes.io/name":"studio-sandbox","app.kubernetes.io/managed-by":"studio",...this.envName?{[fQ.env]:this.envName}:{},...In0(Z.tenant)},...W?{annotations:J}:{}},spec:{sandboxTemplateRef:{name:this.sandboxTemplateName},additionalPodMetadata:{labels:In0(Z.tenant,{[fQ.role]:"claimed",[fQ.sandboxHandle]:$,...this.envName?{[fQ.env]:this.envName}:{}}),...W?{annotations:J}:{}},env:G,warmpool:YG$(Y,Q,this.sandboxTemplateName),lifecycle:{shutdownPolicy:"Delete",shutdownTime:this.computeShutdownTime()}}}}async provision($,Z,X){let Q=this.tokenGenerator(),Y=vJ4(),G=Tn0,J=this.buildClaim(Z,X,{token:Q,daemonBootId:Y,workdir:G});try{await en(this.kubeConfig,this.namespace,J)}catch(U){if(U instanceof an)await eU0(this.kubeConfig,this.namespace,Z),await en(this.kubeConfig,this.namespace,J);else throw U}let W;try{W=await bY$(this.kubeConfig,this.namespace,Z),await Qw0(this.kubeConfig,this.namespace,W)}catch(U){throw await ow(this.kubeConfig,this.namespace,Z).catch(()=>{}),U}try{await this.ensureServicePortForAdoptedSandbox(W),await this.ensureHttpRouteForHandle(Z,W,X.tenant??null)}catch(U){throw await ow(this.kubeConfig,this.namespace,Z).catch(()=>{}),U}let K=await this.openForwarder(W,EN,Z),H=`http://127.0.0.1:${K.localPort}`,N=this.workloadConfigPayload(X),F=Y;try{if(await jn0(H),this.sentinelToken!==null){let U=await Gw0(H);if(U)F=U.bootId;await MV(H,this.sentinelToken,N??{},{rotateToken:Q})}else if(N)await MV(H,Q,N);await this.relayOrgFsConfig(H,Q,X.orgFsConfigJson)}catch(U){throw this.closeForwarder(K),await this.deleteHttpRouteIfManaged(Z).catch(()=>{}),await ow(this.kubeConfig,this.namespace,Z).catch(()=>{}),U}return{id:$,handle:Z,adoptedSandboxName:W,token:Q,workdir:G,daemonUrl:H,daemonForward:K,workload:X.workload??null,daemonBootId:F,tenant:X.tenant??null,ensureOpts:W34(X)}}workloadConfigPayload($){return b90({runtime:$?.workload?.runtime??"node",packageManager:$?.workload?.packageManager?{name:$.workload.packageManager,...$.workload.packageManagerPath?{path:$.workload.packageManagerPath}:{}}:null,repo:$?.repo??null,port:$?.workload?.devPort??KG$,tenant:$?.tenant??void 0,...$?{cloneOnly:$.cloneOnly===!0}:{}})}async relayOrgFsConfig($,Z,X){if(!X)return;await oY$($,Z,X).catch((Q)=>console.warn("[org-fs] sidecar config relay failed",Q))}async refreshDaemonGitCredential($,Z){let X=wm0(Z);if(!X)return;try{await MV($.daemonUrl,$.token,X)}catch(Q){console.warn(`[${y6}] git credential refresh failed for ${$.handle}: ${Q instanceof Error?Q.message:String(Q)}`)}}async withFreshCloneUrl($,Z){if(!this.mintCloneUrl)return $;try{let X=await this.mintCloneUrl($,Z!==void 0?{bufferMs:Z}:void 0);return X?{...$,cloneUrl:X}:$}catch(X){return console.warn(`[${y6}] clone credential re-mint failed: ${X instanceof Error?X.message:String(X)}`),$}}startCredentialRefresher(){if(!this.mintCloneUrl)return;let{signal:$}=this.claimWatchAbort;(async()=>{while(!$.aborted){if(await y$(dJ4,{signal:$}).catch(()=>{}),$.aborted)break;try{await this.refreshAllGitCredentials()}catch(Z){console.warn(`[${y6}] periodic credential refresh failed: ${Z instanceof Error?Z.message:String(Z)}`)}}})()}startTenantPoolReconciler(){if(this.tenantPools.length===0)return;let{signal:$}=this.claimWatchAbort;(async()=>{while(!$.aborted){try{await this.reconcileTenantPools()}catch(Z){console.warn(`[${y6}] tenant pool reconcile failed: ${Z instanceof Error?Z.message:String(Z)}`)}await y$(cJ4,{signal:$}).catch(()=>{})}})()}markTenantPoolsDirty($,Z){let X=GG$(this.tenantPools,$,Z);for(let Q of X)this.dirtyPools.add(Q.name);return X.map((Q)=>Q.name)}async reconcileTenantPools(){for(let $ of this.tenantPools){let Z=await fY$(this.kubeConfig,this.namespace,$.name);if(Z===null){console.warn(`[${y6}] tenant pool ${$.name}: no SandboxWarmPool (or no selector yet) in ${this.namespace}`);continue}let X=this.dirtyPools.delete($.name),Q=Z.filter((Y)=>!Y.labels[fQ.sandboxHandle]);for(let[Y]of this.poolPods)if(!Z.some((G)=>G.uid===Y))this.poolPods.delete(Y);for(let Y of Q){if(this.claimWatchAbort.signal.aborted)return;await this.warmPoolPod($,Y,X)}this.recordPoolDepth($,Z,Q)}}recordPoolDepth($,Z,X){let Q=this.metrics?.poolPods;if(!Q)return;let Y=0,G=0;for(let W of X){let K=this.poolPods.get(W.uid);if(!K)continue;if(K.failures>=Ww0)G++;else if(K.lastConfigAt>0)Y++}let J={pool:$.name,org:$.orgId};Q.record(Y,{...J,state:"ready"}),Q.record(Z.length-X.length,{...J,state:"bound"}),Q.record(X.length-Y-G,{...J,state:"pending"}),Q.record(G,{...J,state:"failed"})}async warmPoolPod($,Z,X){let Q=this.poolPods.get(Z.uid);if(Q&&Q.failures>=Ww0){if(Date.now()-Q.lastFailureAt<HG$)return;this.poolPods.set(Z.uid,{...Q,failures:0})}let Y=X||Q!==void 0&&Date.now()-Q.lastConfigAt>=this.tenantPoolRefreshMs;if(Q&&!Y)return;let G={cloneUrl:JG$($),connectionId:$.connectionId,branch:$.branch,userName:"",userEmail:""},J=await this.withFreshCloneUrl(G);if($.connectionId&&J.cloneUrl===G.cloneUrl){this.recordPoolFailure(Z,$,"clone credential mint failed");return}let W=await this.openForwarder(Z.name,EN,Z.name).catch(()=>null);if(!W){this.recordPoolFailure(Z,$,"port-forward failed");return}let K=`http://127.0.0.1:${W.localPort}`;try{await jn0(K);let H=this.sentinelToken;if(!H)return;if(!await this.isPoolPodUnbound(Z))return;let N=b90({runtime:$.workload.runtime,packageManager:$.workload.packageManager?{name:$.workload.packageManager,...$.workload.packageManagerPath?{path:$.workload.packageManagerPath}:{}}:null,repo:J,port:$.workload.devPort??KG$})??{},{transition:F}=await MV(K,H,N);if(Y&&F!=="bootstrap"&&await this.isPoolPodUnbound(Z))await tY$(K,H,"clone");this.poolPods.set(Z.uid,{lastConfigAt:Date.now(),lastFailureAt:0,failures:0}),console.log(`[${y6}] tenant pool ${$.name}: warmed ${Z.name} (${F})`)}catch(H){this.recordPoolFailure(Z,$,H instanceof Error?H.message:String(H))}finally{this.closeForwarder(W)}}isPoolPodUnbound($){return xY$(this.kubeConfig,this.namespace,$.name,fQ.sandboxHandle)}recordPoolFailure($,Z,X){let Q=this.poolPods.get($.uid),Y=(Q?.failures??0)+1;this.poolPods.set($.uid,{lastConfigAt:Q?.lastConfigAt??0,lastFailureAt:Date.now(),failures:Y});let G=Y>=Ww0?` \u2014 backing off ${HG$/60000}min`:"";console.warn(`[${y6}] tenant pool ${Z.name}: warming ${$.name} failed (${Y}/${Ww0})${G}: ${X}`)}async refreshAllGitCredentials(){await WG$(this.records.values(),($)=>$.ensureOpts?.repo?.connectionId,async($)=>{if(this.claimWatchAbort.signal.aborted)return;let Z=$.ensureOpts?.repo;if(!Z)return;let X=await this.withFreshCloneUrl(Z,mJ4);await this.refreshDaemonGitCredential($,{...$.ensureOpts,repo:X}),$.ensureOpts={...$.ensureOpts,repo:X}})}async rebootstrapDaemon($,Z,X){if(this.sentinelToken===null)return!1;let Q=this.workloadConfigPayload(X)??{};try{return await MV($,this.sentinelToken,Q,{rotateToken:Z}),await this.relayOrgFsConfig($,Z,X?.orgFsConfigJson),!0}catch(Y){if(Y instanceof Yw0&&Y.status===401)try{return await MV($,Z,Q,{rotateToken:Z}),await this.relayOrgFsConfig($,Z,X?.orgFsConfigJson),!0}catch(G){return console.warn(`[${y6}] re-bootstrap retry with claim token failed: ${G instanceof Error?G.message:String(G)}`),!1}return console.warn(`[${y6}] re-bootstrap failed: ${Y instanceof Error?Y.message:String(Y)}`),!1}}async ensureServicePortForAdoptedSandbox($){if(!this.previewGateway||!this.previewUrlPattern)return;await lY$(this.kubeConfig,this.namespace,$,{name:"daemon",port:EN,targetPort:EN})}async ensureHttpRouteForHandle($,Z,X){if(!this.previewGateway||!this.previewUrlPattern)return;let Q=K34(this.previewUrlPattern,$);if(!Q)throw new k9(`Unable to derive preview hostname for ${$} from pattern: ${this.previewUrlPattern}`);let Y={apiVersion:`${$p.API_GROUP}/${$p.API_VERSION}`,kind:"HTTPRoute",metadata:{name:$,namespace:this.namespace,labels:In0(X??void 0,{[fQ.role]:"claimed",[fQ.sandboxHandle]:$,"app.kubernetes.io/name":"studio-sandbox","app.kubernetes.io/managed-by":"studio",...this.envName?{[fQ.env]:this.envName}:{}})},spec:{parentRefs:[{kind:"Gateway",group:"gateway.networking.k8s.io",name:this.previewGateway.name,namespace:this.previewGateway.namespace}],hostnames:[Q],rules:[{backendRefs:[{group:"",kind:"Service",name:Z,port:EN}]}]}};await Zw0(this.kubeConfig,this.namespace,Y)}async deleteHttpRouteIfManaged($){if(!this.previewGateway)return;await Xw0(this.kubeConfig,this.namespace,$)}async rehydrate($,Z,X){let Q=X.state;if(!Q.adoptedSandboxName&&!Q.podName||!Q.token)return null;let Y=await D3(this.kubeConfig,this.namespace,Z).catch(()=>{return});if(!Y||!FG$(Y))return null;let G=Y.status?.sandbox?.name??Q.adoptedSandboxName??Q.podName??Z,J=await this.openAndProbeDaemon(G,Z);if(!J)return null;if(Q.daemonBootId&&Q.daemonBootId!==J.bootId){if(this.sentinelToken!==null){let W=Q.ensureOpts?.repo?{...Q.ensureOpts,repo:await this.withFreshCloneUrl(Q.ensureOpts.repo)}:Q.ensureOpts??null;if(!await this.rebootstrapDaemon(J.daemonUrl,Q.token,W))return this.closeForwarder(J.daemonForward),null}else console.warn(`[${y6}] daemon restart detected (handle=${Z}): stored bootId=${Q.daemonBootId} live bootId=${J.bootId}`);await this.stateStore?.put($,bQ,{handle:Z,state:{...Q,daemonBootId:J.bootId}}).catch((W)=>console.warn(`[${y6}] bootId persist failed for ${Z}: ${W instanceof Error?W.message:String(W)}`))}return{id:$,handle:Z,adoptedSandboxName:G,token:Q.token,workdir:Q.workdir??Tn0,daemonUrl:J.daemonUrl,daemonForward:J.daemonForward,workload:Q.workload??null,daemonBootId:J.bootId,tenant:Q.tenant??null,ensureOpts:Q.ensureOpts??null}}async adopt($,Z,X){if(!FG$(X))return null;let Q=X.status?.sandbox?.name??Z;if(this.sentinelToken!==null)return null;let Y=oJ4(X);if(!Y)return null;let G=await this.openAndProbeDaemon(Q,Z);if(!G)return null;let J=Y34(X);if(this.previewGateway)await this.ensureServicePortForAdoptedSandbox(Q).catch((W)=>{console.warn(`[${y6}] Service port backfill failed for ${Z}: ${W instanceof Error?W.message:String(W)}`)}),await this.ensureHttpRouteForHandle(Z,Q,J).catch((W)=>{console.warn(`[${y6}] HTTPRoute backfill failed for ${Z}: ${W instanceof Error?W.message:String(W)}`)});return{id:$,handle:Z,adoptedSandboxName:Q,token:Y,workdir:Tn0,daemonUrl:G.daemonUrl,daemonForward:G.daemonForward,workload:null,daemonBootId:G.bootId,tenant:J,ensureOpts:null}}async openAndProbeDaemon($,Z){let X=await this.openForwarder($,EN,Z).catch(()=>null);if(!X)return null;let Q=`http://127.0.0.1:${X.localPort}`,Y=await Gw0(Q);if(!Y)return this.closeForwarder(X),null;return{daemonForward:X,daemonUrl:Q,bootId:Y.bootId}}async getRecord($){let Z=this.records.get($);if(Z)return Z;if(!this.stateStore)return null;let X=await this.stateStore.getByHandle(bQ,$);if(!X)return null;let Q=await this.rehydrate(X.id,$,X);if(Q)this.records.set($,Q);return Q}async resurrectByHandle($){if(!this.stateStore)return null;let Z=await this.stateStore.getByHandle(bQ,$);if(!Z)return null;let X=Z.state.ensureOpts;if(!X)return null;let Q=X.repo?{...X,repo:await this.withFreshCloneUrl(X.repo)}:X;if(sL(Z.id)!==$)return null;return await this.ensure(Z.id,Q),this.records.get($)??null}invalidateRecord($){let Z=this.records.get($);if(!Z)return;this.records.delete($),this.closeForwarder(Z.daemonForward)}recordProxyDuration($,Z,X,Q,Y){if(!this.metrics)return;this.metrics.proxyDurationMs.record(Q,{...qn0(X?.tenant??null),source:$,sandbox_handle:X?.handle??Y??"",status_code:Z||0})}composePreviewUrl($){if(this.previewUrlPattern)return v90(this.previewUrlPattern,$.handle);return`http://127.0.0.1:${$.daemonForward.localPort}/`}toSandbox($){return{handle:$.handle,workdir:$.workdir,previewUrl:this.composePreviewUrl($)}}async persist($,Z){if(!$)return;let X={adoptedSandboxName:Z.adoptedSandboxName,token:Z.token,workdir:Z.workdir,workload:Z.workload,daemonBootId:Z.daemonBootId,tenant:Z.tenant,...Z.ensureOpts?{ensureOpts:Z.ensureOpts}:{}};await $.put(Z.id,bQ,{handle:Z.handle,state:X})}computeShutdownTime(){return new Date(Date.now()+this.idleTtlMs).toISOString()}async releaseAfter($,Z){let X=await D3(this.kubeConfig,this.namespace,$);if(!X)return;let Q=G34(X.spec?.lifecycle?.shutdownTime,new Date(Date.now()+Z));if(!Q)return;await $w0(this.kubeConfig,this.namespace,$,Q).catch((Y)=>console.warn(`[${y6}] release failed for ${$}: ${Y instanceof Error?Y.message:String(Y)}`))}async renewTtl($){let Z=await D3(this.kubeConfig,this.namespace,$);if(!Z)return;let X=J34(Z.spec?.lifecycle?.shutdownTime,new Date(Date.now()+this.idleTtlMs));if(!X)return;await $w0(this.kubeConfig,this.namespace,$,X).catch((Q)=>console.warn(`[${y6}] TTL renew failed for ${$}: ${Q instanceof Error?Q.message:String(Q)}`))}openForwarder($,Z,X=$){let Q=rJ4(X,Z);return new Promise((Y,G)=>{let J=(W,K)=>{let H=wG$.createServer((N)=>this.handleForwardedConnection(N,$,Z,X));H.once("error",(N)=>{if(N.code==="EADDRINUSE"&&K<nJ4){try{H.close()}catch{}let F=Mn0+(W-Mn0+1)%OG$;J(F,K+1);return}G(N)}),H.listen(W,"127.0.0.1",()=>{let N=H.address();if(!N||typeof N==="string"){H.close(),G(Error("port-forward listener failed to bind"));return}Y({server:H,localPort:N.port})})};J(Q,0)})}handleForwardedConnection($,Z,X,Q){let Y=new bJ4,G=null,J=!1,W=()=>{if(J)return;if(J=!0,Y.destroy(),G)try{G.close()}catch{}if(!$.destroyed)$.destroy()};$.pipe(Y),$.on("error",W),$.on("close",W),this.portForward.portForward(this.namespace,Z,[X],$,null,Y).then((K)=>{let H=typeof K==="function"?K():K;if(!H){W();return}if(G=H,G.on("close",W),G.on("error",()=>{this.invalidateRecord(Q),W()}),J)try{G.close()}catch{}}).catch((K)=>{console.warn(`[${y6}] port-forward to ${Z}:${X} failed: ${fJ4(K)}`,JSON.stringify(BG$(K))),this.invalidateRecord(Q),W()})}closeForwarder($){$.server.close((Z)=>{if(Z)console.warn(`[${y6}] port-forward close on :${$.localPort} errored: ${Z instanceof Error?Z.message:String(Z)}`)})}close(){if(this.closed)return;this.closed=!0,this.claimWatchAbort.abort();for(let $ of this.records.values())this.closeForwarder($.daemonForward);this.records.clear()}}function pJ4($){return{active:$.createUpDownCounter("studio.sandbox.active",{description:"Active sandbox count, by runner kind, owning org, and daemon impl. Cross-checks the cAdvisor-derived count from the cluster \u2014 divergence between the two indicates orphaned claims (studio deleted but K8s didn't reap) or unattributed pods.",unit:"{sandbox}"}),ensureOutcome:$.createCounter("studio.sandbox.ensure.outcome",{description:"Outcome of each ensure() call: fresh provision, resume from state-store after restart, or adopt of a cluster-side claim studio didn't know about. Cold-start ratio is the primary input for warm-pool sizing.",unit:"{call}"}),proxyDurationMs:$.createHistogram("studio.sandbox.proxy.duration_ms",{description:"Wall-clock latency of studio-mediated requests to the sandbox daemon: tool exec proxies (source=daemon) and preview iframe traffic (source=preview).",unit:"ms"}),poolPods:$.createGauge("studio.sandbox.pool.pods",{description:"Tenant warm pool depth by pool and state: ready (warmed and unbound \u2014 what a claim can actually bind instantly), bound (serving a user), pending (unbound, not yet warmed), failed (gave up after repeated bootstrap failures). Alert on sustained ready=0: a pool that is always empty is doing nothing while costing N pods.",unit:"{pod}"})}}function BG$($){let Z=[],X=$;for(let Q=0;Q<5&&X instanceof Error;Q++){let Y=X;if(Z.push({name:Y.name,message:Y.message,...Y.code!==void 0?{code:Y.code}:{},...Y.errno!==void 0?{errno:Y.errno}:{}}),Y.cause===X)break;X=Y.cause}if(X!==void 0&&!(X instanceof Error)&&X!==null){let Q=X,Y=Q.error instanceof Error?BG$(Q.error).chain:void 0;Z.push({nonError:String(X),...typeof Q.type==="string"?{type:Q.type}:{},...typeof Q.message==="string"?{message:Q.message}:{},...Q.code!==void 0?{code:Q.code}:{},...typeof Q.reason==="string"?{reason:Q.reason}:{},...Y?{error:Y}:{},...Y===void 0&&Q.error!==void 0?{rawError:String(Q.error)}:{},keys:Object.keys(Q)})}return{chain:Z}}function tJ4(){let $=new cx;return $.loadFromDefault(),$}function FG$($){return Boolean($.status?.conditions?.some((Z)=>Z.type==="Ready"&&Z.status==="True"))}function oJ4($){let Z=$.spec?.env;if(!Z)return null;for(let X of Z)if(X.name==="DAEMON_TOKEN"&&X.value)return X.value;return null}function rJ4($,Z){let X=CJ4("sha256").update(`${$}:${Z}`).digest();return Mn0+X.readUInt32BE(0)%OG$}function Rn0($,Z){return new Response(JSON.stringify(Z),{status:$,headers:{"content-type":"application/json","access-control-allow-origin":"*"}})}function UG$($){let Z=$.slice(0,sJ4);return aJ4.test(Z)?Z:""}function $34($){if($===void 0)return null;let Z=$.trim();if(Z==="")return null;if(!eJ4.test(Z))throw Error(`AgentSandboxProvider: envName=${JSON.stringify(Z)} is not a valid DNS-label-safe environment name (lowercase alphanumeric or '-', starts with a letter, ends alphanumeric, \u226432 chars). Studio sets this from STUDIO_ENV; check the studio chart's configMap.`);return Z}function In0($,Z={}){let X={...Z};if($){let Q=UG$($.orgId),Y=UG$($.userId);if(Q)X[fQ.orgId]=Q;if(Y)X[fQ.userId]=Y}return X}function kV($){let Z="";for(let X of $){let Q=X.codePointAt(0)??0;Z+=Q<32||Q===127?" ":X}return Z.slice(0,Z34)}function X34($){try{let Z=new URL($);return Z.username="",Z.password="",Z.toString()}catch{return""}}function Q34($){let Z={},X=$.tenant;if(X?.orgSlug)Z[L3.orgSlug]=kV(X.orgSlug);if(X?.orgName)Z[L3.orgName]=kV(X.orgName);if(X?.userEmail)Z[L3.userEmail]=kV(X.userEmail);if(X?.userName)Z[L3.userName]=kV(X.userName);let Q=$.repo;if(Q){if(Q.displayName)Z[L3.gitRepo]=kV(Q.displayName);let Y=X34(Q.cloneUrl);if(Y)Z[L3.gitRepoUrl]=kV(Y);let G=$.branch??Q.branch;if(G)Z[L3.gitBranch]=kV(G)}return Z}function Y34($){let Z=$.metadata?.labels;if(!Z)return null;let X=Z[fQ.orgId],Q=Z[fQ.userId];if(!X||!Q)return null;let Y=$.metadata?.annotations??{};return{orgId:X,userId:Q,orgSlug:Y[L3.orgSlug],orgName:Y[L3.orgName],userEmail:Y[L3.userEmail],userName:Y[L3.userName]}}function G34($,Z){if($){let X=new Date($).getTime();if(Number.isFinite(X)&&X<=Z.getTime())return null}return Z.toISOString()}function J34($,Z){if($){let X=new Date($).getTime();if(Number.isFinite(X)&&X>=Z.getTime())return null}return Z.toISOString()}function qn0($){return{org_id:$?.orgId??"",user_id:$?.userId??"",runner_kind:bQ}}function W34($){let Z={};if($.branch)Z.branch=$.branch;if($.repo)Z.repo=$.repo;if($.workload)Z.workload=$.workload;if($.env&&Object.keys($.env).length>0)Z.env=$.env;if($.tenant)Z.tenant=$.tenant;if($.orgFsConfigJson)Z.orgFsConfigJson=$.orgFsConfigJson;return Object.keys(Z).length>0?Z:null}function K34($,Z){try{return new URL(v90($,Z)).hostname||null}catch{return null}}var bQ="agent-sandbox",y6="AgentSandboxProvider",SV="x-sandbox-preview-not-ready",xJ4="agent-sandbox-system",yJ4="studio-sandbox",EN=9000,KG$=3000,Tn0="/app",gJ4=32,hJ4,uJ4=900000,cJ4=60000,lJ4=1800000,Ww0=3,HG$=1800000,dJ4=900000,mJ4=1800000,iJ4,NG$,Mn0=40000,OG$=1e4,nJ4=256,fQ,L3,aJ4,sJ4=63,eJ4,Z34=253;var DG$=B(()=>{B6();iY$();Nn0();rY$();Om0();Zp();sn();ZG$();An0();hJ4=new Set(["DAEMON_TOKEN","DAEMON_BOOT_ID","APP_ROOT","PROXY_PORT"]),iJ4=["cookie","host","connection","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","accept-encoding","content-length","upgrade"],NG$=["connection","keep-alive","transfer-encoding","content-encoding","content-length"];fQ={role:"studio.decocms.com/role",sandboxHandle:"studio.decocms.com/sandbox-handle",orgId:"studio.decocms.com/org-id",userId:"studio.decocms.com/user-id",env:"studio.decocms.com/env"},L3={orgSlug:"studio.decocms.com/org-slug",orgName:"studio.decocms.com/org-name",userEmail:"studio.decocms.com/user-email",userName:"studio.decocms.com/user-name",gitRepo:"studio.decocms.com/git-repo",gitRepoUrl:"studio.decocms.com/git-repo-url",gitBranch:"studio.decocms.com/git-branch"},aJ4=/^([A-Za-z0-9]([-A-Za-z0-9_.]*[A-Za-z0-9])?)?$/;eJ4=/^[a-z]([a-z0-9-]{0,30}[a-z0-9])?$/});var LG$={};H4(LG$,{waitForSandboxReady:()=>Qw0,parseTenantPools:()=>XG$,getSandboxClaim:()=>D3,getHttpRoute:()=>uY$,deleteSandboxClaim:()=>ow,deleteHttpRoute:()=>Xw0,createSandboxClaim:()=>en,applyHttpRoute:()=>Zw0,SandboxTimeoutError:()=>qV,SandboxError:()=>k9,PREVIEW_NOT_READY_HEADER:()=>SV,KubeConfig:()=>cx,K8S_CONSTANTS:()=>O9,HTTPROUTE_CONSTANTS:()=>$p,AgentSandboxProvider:()=>kn0});var Sn0=B(()=>{Nn0();sn();Zp();DG$();An0()});var TG$={};H4(TG$,{subscribeLifecycle:()=>vn0,getSandboxProviderByKind:()=>Cn0,getOrInitSharedRunner:()=>_n0,__resetSharedLifecyclesForTesting:()=>z34});function PG$($,Z){let X=EG$[$];if(X)return Promise.resolve(X);let Q=Vn0[$];if(Q)return Q;let Y=Z().then((G)=>{return EG$[$]=G,G}).finally(()=>{delete Vn0[$]});return Vn0[$]=Y,Y}function F34(){let $=process.env.STUDIO_SANDBOX_PREVIEW_URL_PATTERN;return $&&$.trim()!==""?$:void 0}function U34(){let $=process.env.STUDIO_SANDBOX_TEMPLATE_NAME;return $&&$.trim()!==""?$:void 0}function w34(){let $=process.env.STUDIO_ENV;return $&&$.trim()!==""?$:void 0}function O34(){let $=process.env.STUDIO_SANDBOX_SENTINEL_TOKEN;return $&&$.trim()!==""?$:void 0}function B34(){let $=process.env.STUDIO_SANDBOX_PREVIEW_GATEWAY_NAME?.trim(),Z=process.env.STUDIO_SANDBOX_PREVIEW_GATEWAY_NAMESPACE?.trim();if(!$&&!Z)return;if(!$||!Z)throw Error("STUDIO_SANDBOX_PREVIEW_GATEWAY_NAME and STUDIO_SANDBOX_PREVIEW_GATEWAY_NAMESPACE must both be set, or both unset. Half-configured per-claim HTTPRoute routing would silently fail to attach.");return{name:$,namespace:Z}}async function AG$($,Z){let X=new Vn(Z),Q=F34();switch($){case"agent-sandbox":{let{AgentSandboxProvider:Y,parseTenantPools:G}=await Promise.resolve().then(() => (Sn0(),LG$)),J=new qH(c0().encryptionKey);return new Y({stateStore:X,previewUrlPattern:Q,sandboxTemplateName:U34(),envName:w34(),previewGateway:B34(),sentinelToken:O34(),tenantPools:G(process.env.STUDIO_SANDBOX_TENANT_POOLS),meter:W8,mintCloneUrl:async(W,K)=>{if(!W.connectionId)return null;let H=K5$(W.cloneUrl);if(!H)return null;let{cloneUrl:N}=await gw(W.connectionId,H.owner,H.name,Z,J,{bufferMs:K?.bufferMs});return N}})}case"user-desktop":throw Error("user-desktop provider cannot be instantiated without a per-run link claim \u2014 call resolveSandboxProvider, which binds the link before constructing the provider.");default:throw Error(`Unknown sandbox provider kind: ${String($)}`)}}function Cn0($,Z){return PG$(Z,()=>AG$(Z,$.db))}async function _n0(){let $;try{$=eL()}catch(X){return console.warn("[lifecycle] cannot resolve sandbox runner:",X instanceof Error?X.message:String(X)),null}return await PG$($,()=>AG$($,c8().db))}function vn0($,Z,X){let Q=rw.get(Z);if(Q){if(Q.terminated){if(Q.lastPhase)try{X(Q.lastPhase)}catch{}return{unsubscribe:E34}}if(Q.listeners.add(X),Q.lastPhase)try{X(Q.lastPhase)}catch{}return jG$(Z,Q,X)}let Y=new AbortController,G={lastPhase:null,terminated:!1,listeners:new Set([X]),abort:Y};return rw.set(Z,G),j34($,Z,G),jG$(Z,G,X)}function E34(){}function jG$($,Z,X){return{unsubscribe(){if(rw.get($)!==Z)return;if(Z.listeners.delete(X),Z.listeners.size===0)rw.delete($),Z.abort.abort()}}}async function j34($,Z,X){let Q=null;try{for await(let Y of $.watchClaimLifecycle(Z,X.abort.signal)){if(X.abort.signal.aborted)break;X.lastPhase=Y;let G=Y.kind==="ready"||Y.kind==="failed";if(G)X.terminated=!0;let J=Array.from(X.listeners);for(let W of J)try{W(Y)}catch{}if(G)break}}catch(Y){Q=Y}finally{if(!X.terminated&&!X.abort.signal.aborted&&X.listeners.size>0){let Y={kind:"failed",reason:"unknown",message:Q instanceof Error?Q.message:"Lifecycle watcher ended unexpectedly"};X.lastPhase=Y,X.terminated=!0;for(let G of Array.from(X.listeners))try{G(Y)}catch{}}if(rw.get(Z)===X)rw.delete(Z)}}function z34(){for(let $ of rw.values())$.abort.abort();rw.clear()}var H34,N34,zG$,EG$,Vn0,D34,L34,rw;var Qp=B(()=>{FN();GG();N5();Lm0();Cn();xc();S$();H34=Symbol.for("decocms.sandbox.lifecycle.runners"),N34=Symbol.for("decocms.sandbox.lifecycle.inflight"),zG$=globalThis,EG$=zG$[H34]??={},Vn0=zG$[N34]??={};D34=Symbol.for("decocms.sandbox.lifecycle.shared-lifecycles"),L34=globalThis,rw=L34[D34]??=new Map});async function hX($,Z){let{userId:X,branch:Q,virtualMcpMetadata:Y,explicitKind:G}=Z;if(G)return Yp($,G);if($.sandboxPreference==="agent-sandbox")return Yp($,"agent-sandbox");if($.sandboxPreference==="cluster-default")return Yp($,eL());let[J,...W]=P34(Y,X,Q);if(J)return Yp($,W.length===0?J:A34(J,W));return Yp($,RG$())}function P34($,Z,X){let Q=C5($)[Z]?.[X];if(!Q)return[];let Y=AJ(Q);return Object.keys(Y)}function A34($,Z){let X=RG$();if(X===$||Z.includes(X))return X;return $}function RG$(){return eL()}async function Yp($,Z){let X=Z==="user-desktop"?"agent-sandbox":Z;return{provider:await Cn0($,X),kind:X}}var aw=B(()=>{B8();FN();kQ();Qp()});var Gp;var bn0=B(()=>{Gp={npm:{install:"npm install",run:($)=>`npm run ${$}`,runtime:"node"},pnpm:{install:"pnpm install",run:($)=>`pnpm run ${$}`,runtime:"node"},yarn:{install:"yarn install",run:($)=>`yarn run ${$}`,runtime:"node"},bun:{install:"bun install",run:($)=>`bun run ${$}`,runtime:"bun"},deno:{install:"deno install",run:($)=>`deno task ${$}`,runtime:"deno"}}});function E3($,Z){return Z?`thread:${$}/${Z}`:`thread:${$}`}function jN($){return`sandbox/thread-${$.replace(/^thread:/,"").replace(/\//g,"-")}`}function sw($){if(!$||!$.startsWith("thread:"))return null;return $.slice(7).split("/")[0]||null}async function zN($,Z,X){let Q=sw(Z);if(!Q)return X;return(await $.storage.threads.get(Q).catch(()=>null))?.created_by??X}async function VV($,Z){if(!Z)return null;let X=await $.storage.threads.get(Z).catch(()=>null);if(!X)return null;return X.metadata??{}}async function IG$($,Z){let Q=(await VV($,Z))?.headRef;return typeof Q==="string"&&Q.length>0?Q:null}async function qG$($,Z,X){let Q=await VV($,Z);if(!Q)return;if(Q.headRef===X)return;await $.storage.threads.update(Z,{metadata:{...Q,headRef:X}}).catch((Y)=>console.warn("[thread-repo] setThreadHeadRef failed",Y))}async function ew($,Z){return(await VV($,Z))?.githubRepo??null}function fn0($){if($.pinnedRef)return $.pinnedRef;if($.runBranch&&$.runBranch===E3($.threadId))return $.runBranch;if($.threadRepo)return E3($.threadId,$.threadRepo.connectionId);if(!$.agentRepo)return"ephemeral";return $.runBranch??`thread:${$.threadId}`}async function xn0($,Z){let Q=(await VV($,Z))?.pinnedRef;return typeof Q==="string"&&Q.length>0?Q:null}async function MG$($,Z){let[X,Q]=await Promise.all([ew($,Z.threadId),xn0($,Z.threadId)]);return fn0({...Z,threadRepo:X,pinnedRef:Q})}async function kG$($,Z,X,Q,Y,G){let J=await VV($,Z);if(!J)return;let W=Sn(C5(J),X,Q,Y,G);await $.storage.threads.update(Z,{metadata:{...J,sandboxMap:W}}).catch((K)=>console.warn("[thread-repo] setThreadSandboxMapEntry failed",K))}async function Kw0($,Z){return C5(await VV($,Z))}async function SG$($,Z,X,Q,Y){let G=await VV($,Z);if(!G)return;let J=Dm0(C5(G),X,Q,Y);if(!J)return;await $.storage.threads.update(Z,{metadata:{...G,sandboxMap:J}}).catch((W)=>console.warn("[thread-repo] removeThreadSandboxMapEntry failed",W))}var j3=B(()=>{kQ()});function Hw0($){if(!$)return null;let Z=$.runtime;if(!Z||typeof Z!=="object")return null;let X=Z.env;if(!Array.isArray(X))return null;let Q=[];for(let Y of X){if(!Y||typeof Y!=="object")continue;let G=Y;if(typeof G.key!=="string"||!f00.test(G.key))continue;if(G.kind==="literal"&&typeof G.value==="string"){Q.push({key:G.key,kind:"literal",value:G.value});continue}if(G.kind==="secret"&&typeof G.secretId==="string"&&G.secretId.length>0)Q.push({key:G.key,kind:"secret",secretId:G.secretId})}return Q.length===0?null:Q}function VG$($){if(!$)return null;let Z=$.runtime;if(!Z||typeof Z!=="object")return null;let X=Z.submoduleCredentials;if(!Array.isArray(X))return null;let Q=[];for(let Y of X){if(!Y||typeof Y!=="object")continue;let G=Y;if(typeof G.host==="string"&&G.host.length>0&&typeof G.secretId==="string"&&G.secretId.length>0)Q.push({host:G.host,secretId:G.secretId})}return Q.length===0?null:Q}async function CG$($,Z){$0(Z);let X=r(Z);await Z.access.check();let Q=W1(Z);if(!Q)throw Error("User ID required");let Y=await Z.storage.virtualMcps.findById($.virtualMcpId);if(!Y||Y.organization_id!==X.id)throw Error("Virtual MCP not found");let G=Y.metadata??{},J=C5(G),W=await zN(Z,$.branch,Q),K=eW(J,W,$.branch,$.sandboxProviderKind);return{virtualMcp:Y,metadata:G,userId:Q,sandboxUserId:W,entry:K,organization:X}}function T34($){if($===null||!/^\d+$/.test($))return null;let Z=Number($);return Z>=1&&Z<=65535?$:null}function _G$($){let Z=$.runtime??null,Q=Z?.selected??null,Y=T34(Z?.port??null),G=Z?.path??null;if(!Q||!(Q in Gp))return{packageManager:null,runtime:null,port:Y,packageManagerPath:G,runtimeBinPath:null};let J=Gp[Q].runtime;return{packageManager:Q,runtime:J,port:Y,packageManagerPath:G,runtimeBinPath:J==="deno"?"/opt/deno/bin":J==="bun"?"/opt/bun/bin":null}}var Jp=B(()=>{B8();bn0();kQ();j3()});async function $O($,Z){let X=$.body?.getReader();if(!X)return $.text();let Q=new TextDecoder,Y="",G=0;for(;;){let{done:J,value:W}=await X.read();if(J)break;if(G+=W.byteLength,G>Z)throw await X.cancel().catch(()=>{}),new vG$(`Upstream response exceeded ${Z} bytes`);Y+=Q.decode(W,{stream:!0})}return Y+=Q.decode(),Y}var vG$;var Wp=B(()=>{vG$=class vG$ extends Error{}});async function Nw0({ctx:$,runner:Z,handle:X,orgId:Q,userId:Y,entries:G}){if(!G||G.length===0)return;let J={};for(let K of G){if(K.kind==="literal"){J[K.key]=K.value;continue}try{let{value:H}=await $.storage.secrets.resolveById(K.secretId,Q,Y);J[K.key]=H}catch(H){if(H instanceof BG||H instanceof $w){console.warn(`[SANDBOX_START] skipping env ${K.key}: ${H.message}. Re-link or recreate the secret to restore.`);continue}throw H}}if(Object.keys(J).length===0)return;let W=await Z.proxyDaemonRequest(X,"/_sandbox/config",{method:"PUT",headers:new Headers({"content-type":"application/json"}),body:JSON.stringify({env:J})});if(!W.ok){let K=await $O(W,R34).catch(()=>W.statusText);console.warn(`[SANDBOX_START] daemon rejected env patch (${W.status}): ${K}`)}}var R34=10485760;var yn0=B(()=>{Xm();Wp()});async function bG$({ctx:$,orgId:Z,userId:X,entries:Q}){if(!Q||Q.length===0)return[];let Y=[];for(let G of Q)try{let{value:J}=await $.storage.secrets.resolveById(G.secretId,Z,X);Y.push({host:G.host,token:J})}catch(J){if(J instanceof BG||J instanceof $w){console.warn(`[SANDBOX_START] skipping submodule credential for ${G.host}: ${J.message}. Re-link or recreate the secret to restore.`);continue}throw J}return Y}var fG$=B(()=>{Xm()});async function gG$($,Z,X,Q,Y){let G=await eH({connectionId:$,tokenStorage:new E5(Q,Y)});if(!G.accessToken)return null;return uG$(Z,X,G.accessToken)}function hG$($,Z){return uG$($,Z,null)}async function uG$($,Z,X){let Q=new Map,Y=new Set(xG$.map((K)=>K.path));for(let K of Object.values(yG$))for(let H of K??[])Y.add(H);await Promise.all(Array.from(Y).map(async(K)=>{Q.set(K,await q34($,Z,K,X))}));let G=xG$.find(({path:K})=>Q.get(K)!==null);if(!G)return null;let J=yG$[G.pm]??[],W=null;for(let K of J)if(W=M34(Q.get(K)??null),W)break;return{packageManager:G.pm,devPort:W}}async function q34($,Z,X,Q){let Y=`https://api.github.com/repos/${$}/${Z}/contents/${encodeURIComponent(X)}`;try{let G={Accept:"application/vnd.github+json","User-Agent":"studio-runtime-detect"};if(Q)G.Authorization=`token ${Q}`;let J=await fetch(Y,{headers:G,signal:AbortSignal.timeout(5000)});if(!J.ok)return null;let W=await J.json();if(!W.content||W.encoding!=="base64")return null;return Buffer.from(W.content,"base64").toString("utf8")}catch{return null}}function M34($){if(!$)return null;try{let Z=JSON.parse($),X=Z.tasks??Z.scripts??{};return(X.dev??X.start??"").match(I34)?.[1]??null}catch{return null}}var xG$,yG$,I34;var cG$=B(()=>{Pw();X3();xG$=[{path:"deno.json",pm:"deno"},{path:"deno.jsonc",pm:"deno"},{path:"bun.lock",pm:"bun"},{path:"bunfig.toml",pm:"bun"},{path:"pnpm-lock.yaml",pm:"pnpm"},{path:"yarn.lock",pm:"yarn"},{path:"package-lock.json",pm:"npm"},{path:"package.json",pm:"bun"}],yG$={deno:["deno.json","deno.jsonc"],bun:["package.json"],pnpm:["package.json"],yarn:["package.json"],npm:["package.json"]},I34=/(?:--port|PORT=|:)(\d{4,5})/});function k34($){return($??"").normalize("NFKD").replace(/[\u0300-\u036F]/g,"").toLowerCase().replace(/[^a-z0-9]+/g,"-").replace(/^-+|-+$/g,"")||"user"}function Fw0($){return $?.name||$?.email?.split("@")[0]||void 0}function Uw0($){let Z=k34($),X=Date.now().toString(36).split("").reverse().join("");return`${Z}-${X}`}function lG$($){let{current:Z,detached:X,base:Q}=$.status??{};if(typeof Z!=="string"||Z.length===0)return null;if(X===!0)return null;if(Z===$.requestedRef)return null;if(S34.has(Z))return null;if(typeof Q==="string"&&Q.length>0&&Z===Q)return null;return Z}function dG$($){if(!$.branch.startsWith("thread:"))return $.branch;if($.sticky&&$.recordedHeadRef)return $.recordedHeadRef;return $.derivedRef}var S34;var gn0=B(()=>{S34=new Set(["main","master","trunk","develop","HEAD"])});async function mG$($,Z){if(!$)return{hosts:[],allowSameHostDev:!1};let X;try{X=await $.presignedGetUrl("link-dispatch/_allowlist_probe",60,{requireFetchable:!0})}catch{return{hosts:[],allowSameHostDev:!1}}let Q;try{Q=new URL(X)}catch{return{hosts:[],allowSameHostDev:!1}}if(Q.protocol!=="https:"&&Q.protocol!=="http:")return{hosts:[],allowSameHostDev:!1};let Y=Q.hostname,G=V34.has(Y);return{hosts:[Y],allowSameHostDev:G&&!Z.isProduction}}var V34;var iG$=B(()=>{V34=new Set(["127.0.0.1","localhost","::1","[::1]","0.0.0.0"])});import{z as GK}from"zod";async function px($,Z){$0(Z);let X=r(Z),Q=W1(Z);if(!Q)throw Error("User ID required");let Y=await Z.storage.virtualMcps.findById($.virtualMcpId);if(!Y||Y.organization_id!==X.id)throw Error("Virtual MCP not found");let G=Y.metadata??{},J=await zN(Z,$.branch,Q),W=eW(C5(G),J,$.branch,$.sandboxProviderKind),K=$.sandboxProviderKind,{provider:H}=await hX(Z,{userId:J,branch:$.branch,virtualMcpMetadata:G,explicitKind:K});if(W){if(K!=="user-desktop")return W;if(await H.alive(W.sandboxHandle).catch(()=>!1))return W;await yw(Z.storage.virtualMcps,$.virtualMcpId,Q,J,$.branch,K).catch((O)=>{console.warn("[ensureSandbox] failed to reap stale user-desktop entry",O)})}let F=await ew(Z,sw($.branch)??Z.metadata?.threadId)??G.githubRepo??null,{entry:U}=await pG$({ctx:Z,userId:Q,sandboxUserId:J,orgId:X.id,virtualMcpId:$.virtualMcpId,branch:$.branch,metadata:G,githubRepo:F,existing:null,providerKind:K,runner:H,...$.cloneOnly?{cloneOnly:!0}:{}});return U}async function pG$($){let{ctx:Z,userId:X,sandboxUserId:Q,orgId:Y,virtualMcpId:G,branch:J,metadata:W,githubRepo:K,existing:H,runner:N,cloneOnly:F}=$,{runtime:U,packageManager:w,port:O,packageManagerPath:D}=_G$(W),L;if(K){if(K.connectionId)await Vx({ctx:Z,connectionId:K.connectionId,organizationId:Y,forceRefresh:!0,onLegacyMintError:(f0)=>{console.error("[provisionSandbox] repo-scoped legacy token mint failed",{connectionId:K.connectionId,error:f0.message})}});let{cloneUrl:E0,gitUserName:e,gitUserEmail:t}=K.connectionId?await gw(K.connectionId,K.owner,K.name,Z.db,Z.vault):W5$(K.owner,K.name);if(!w){let f0=K.connectionId?await gG$(K.connectionId,K.owner,K.name,Z.db,Z.vault):await hG$(K.owner,K.name);if(f0)w=f0.packageManager,U=Gp[f0.packageManager].runtime,O=f0.devPort??O,await _34(Z,G,X,f0.packageManager,f0.devPort)}let P0=c0().sandboxStickyHeadRefEnabled,Q0=dG$({branch:J,derivedRef:jN(J),recordedHeadRef:P0?await IG$(Z,sw(J)):null,sticky:P0}),j0=await bG$({ctx:Z,orgId:Y,userId:X,entries:VG$(W)});L={cloneUrl:E0,...K.connectionId?{connectionId:K.connectionId}:{},userName:e,userEmail:t,branch:Q0,displayName:`${K.owner}/${K.name}`,...j0.length>0?{submoduleCredentials:j0}:{}}}let E=typeof W.productionUrl==="string"&&W.productionUrl.trim()?W.productionUrl.trim():void 0,j=U&&w&&!F?{runtime:U,packageManager:w,...O!==null?{devPort:Number(O)}:{},...D?{packageManagerPath:D}:{},...E?{productionUrl:E}:{}}:void 0,z=qn({orgId:Y,virtualMcpId:G,branch:J}),A=N.kind==="user-desktop"?await mG$(Z.objectStorage,{isProduction:c0().nodeEnv==="production"}):null,P=(N.kind==="user-desktop"||N.kind==="agent-sandbox")&&!c0().orgFsMountsDisabled,M;if(P){let E0=Z.organization?.slug??(await Z.db.selectFrom("organization").select(["slug"]).where("id","=",Y).executeTakeFirst())?.slug;if(E0)M=await De1(Z,{orgSlug:E0,orgId:Y,baseUrl:eX()})}await b34(N);let k=await N.ensure({userId:Q,projectRef:z},{branch:J,repo:L,workload:j,cloneOnly:F===!0,tenant:{orgId:Y,userId:Q,...Z.organization?.slug?{orgSlug:Z.organization.slug}:{},...Z.organization?.name?{orgName:Z.organization.name}:{},...Z.auth.user?.email?{userEmail:Z.auth.user.email}:{},...Z.auth.user?.name?{userName:Z.auth.user.name}:{}},...A?{offloadAllowedHosts:A.hosts,offloadAllowSameHostDev:A.allowSameHostDev}:{},...M?{orgFsConfigJson:M}:{}}),q=W.runtime?.env??null;await Nw0({ctx:Z,runner:N,handle:k.handle,orgId:Y,userId:X,entries:q});let h=!!H&&H.sandboxHandle===k.handle&&H?.createdAt?H.createdAt:Date.now(),b=W.runtime?.selected??null,x=W.runtime?.port??null,p=W.runtime?.path??null,m={sandboxHandle:k.handle,previewUrl:k.previewUrl,sandboxApiUrl:k.previewUrl,sandboxProviderKind:N.kind,createdAt:h,startedWith:{packageManager:b,port:x,path:p}};await a6$(Z.storage.virtualMcps,G,X,Q,J,$.providerKind,m);let Y0=sw(J);if(Y0)await kG$(Z,Y0,Q,J,$.providerKind,m);let L0=!H||H.sandboxHandle!==k.handle;return{entry:m,isNewVm:L0}}async function _34($,Z,X,Q,Y){let G=await $.storage.virtualMcps.findById(Z);if(!G)return;let J=G.metadata??{};await $.storage.virtualMcps.update(Z,X,{metadata:{...J,runtime:{selected:Q,port:Y}}})}async function b34($){if(!$.hasSchedulableCapacity)return;let Z=Date.now()+nG$,X=!1;while(!await $.hasSchedulableCapacity()){if(Date.now()>=Z)throw Error(`sandbox provisioning failed: the cluster has had no room to schedule another sandbox for ${Math.round(nG$/1000)}s`);if(!X)X=!0,console.warn("[ensureSandbox] waiting for cluster capacity \u2014 a sandbox pod cannot be scheduled right now");await y$(v34)}}var C34,hn0,nG$=150000,v34=5000;var Kp=B(()=>{FN();B6();b0();Jp();yn0();fG$();kQ();Cn();cG$();bn0();aw();j3();gn0();iG$();S$();BZ();ci();kQ();C34=GK.enum(["agent-sandbox","user-desktop","cluster"]),hn0=d({name:"SANDBOX_START",description:"Start a sandbox with the connected GitHub repo and dev server.",annotations:{title:"Start VM Preview",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!1,openWorldHint:!0},_meta:{ui:{visibility:"app"}},inputSchema:GK.object({virtualMcpId:GK.string().describe("Virtual MCP ID"),branch:GK.string().min(1).optional().describe("Git branch to check out. Pass the thread's branch whenever the caller has one: when omitted the handler mints a fresh `<user-slug>-<timestamp>` name, which becomes a SEPARATE sandbox from the one the thread's own branch resolves to. The resolved branch is returned in the response so callers can persist it."),sandboxProviderKind:C34.optional().describe("Explicit runtime choice. Hosted provider is `agent-sandbox`; legacy `cluster` input is accepted only for compatibility and normalized to `agent-sandbox`. When omitted, defaults to `user-desktop` if the acting user's link daemon is online, else the env kind.")}),outputSchema:GK.object({previewUrl:GK.string().nullable(),sandboxHandle:GK.string(),branch:GK.string(),isNewVm:GK.boolean(),sandboxProviderKind:GK.enum(["agent-sandbox","user-desktop"])}),handler:async($,Z)=>{$0(Z);let X=r(Z);await Z.access.check();let Q=$.branch??Uw0(Fw0(Z.auth.user)),Y=W1(Z);if(!Y)throw Error("User ID required");let G=await zN(Z,Q,Y),J=await Z.storage.virtualMcps.findById($.virtualMcpId);if(!J||J.organization_id!==X.id)throw Error("Virtual MCP not found");let W=J.metadata??{},K=$.sandboxProviderKind?aL($.sandboxProviderKind):void 0,{provider:H,kind:N}=await hX(Z,{userId:G,branch:Q,virtualMcpMetadata:W,explicitKind:K}),F=eW(C5(W),G,Q,N),w=await ew(Z,sw(Q)??Z.metadata?.threadId)??W.githubRepo??null,{entry:O,isNewVm:D}=await pG$({ctx:Z,userId:Y,sandboxUserId:G,orgId:X.id,virtualMcpId:$.virtualMcpId,branch:Q,metadata:W,githubRepo:w,existing:F,providerKind:N,runner:H});return{...O,branch:Q,isNewVm:D,sandboxProviderKind:N}}})});function f34($){let{publicUrl:Z,agentId:X,organization:Q,target:Y,threadId:G}=$;if(Y==="agent-tools")return`${Z}/mcp/virtual-mcp/${X}`;if(!Q.slug)throw new oG$(Q.id);if(Y==="task-run"){if(!G)throw Error("a task-run MCP endpoint is scoped to a run: threadId is required");return`${Z}/api/${Q.slug}/mcp/task-run/${encodeURIComponent(G)}`}return`${Z}/api/${Q.slug}/mcp/self`}async function ww0($,Z,X,Q,Y="agent-tools",G){let J=f34({publicUrl:eX(),agentId:Z,organization:X,target:Y,...G?{threadId:G}:{}}),W=await $.boundAuth.apiKey.create({name:Q,permissions:{"*":["*"]},expiresIn:tG$,metadata:{organization:{id:X.id,slug:X.slug,name:X.name}}});return{url:J,headers:{Authorization:`Bearer ${W.key}`,"x-org-id":X.id},expiresAt:Date.now()+tG$*1000}}var tG$=3600,oG$;var un0=B(()=>{BZ();oG$=class oG$ extends Error{constructor($){super(`cannot mint a management MCP endpoint for organization "${$}": the org-scoped path /api/<slug>/mcp/self needs the org slug, which was not loaded.`);this.name="MissingOrganizationSlugError"}}});async function x34($,Z,X,Q){try{let Y=$.organization;if(!Y)return;let G=await ww0($,Q.virtualMcpId,Y,"tool-scripting"),J=await Z.proxyDaemonRequest(X,"/_sandbox/tools/sync",{method:"POST",headers:new Headers({"content-type":"application/json"}),body:JSON.stringify(G)});if(!J.ok)console.warn("[cluster-sandbox-fs] tools/sync failed",J.status,await J.text().catch(()=>""))}catch(Y){console.warn("[cluster-sandbox-fs] tools/sync failed",Y)}}async function tx($,Z){let{provider:X,kind:Q}=await hX($,{userId:Z.userId,branch:Z.branch,virtualMcpMetadata:null}),Y=null,G=()=>{if(!Y){if(Y=px({virtualMcpId:Z.virtualMcpId,branch:Z.branch,sandboxProviderKind:Q},$).then((K)=>K.sandboxHandle),Y.catch(()=>{Y=null}),Z.syncTools)Y.then((K)=>x34($,X,K,{virtualMcpId:Z.virtualMcpId,providerKind:Q})).catch(()=>{})}return Y},J=Z.branch==="ephemeral"||Q==="user-desktop";return Bm0(X,{ensureHandle:G,invalidateHandle:async(K)=>{let H=Y;if(Y=null,!J&&!K?.force)return;try{await yw($.storage.virtualMcps,Z.virtualMcpId,Z.userId,Z.userId,Z.branch,Q)}catch(N){console.warn("[cluster-sandbox-fs] failed to reap vmMap entry",N)}if(H&&typeof X.forgetHandle==="function")try{let N=await H;await X.forgetHandle(N)}catch(N){console.warn("[cluster-sandbox-fs] forgetHandle failed",N)}},canAutoRestart:J})}async function rG$($,Z){try{let X=await tx($,Z),{stdout:Q}=await X.onBash("test -d .deco && echo __DECO_SITE__");return Q.includes("__DECO_SITE__")}catch(X){return console.warn("[cluster-sandbox-fs] .deco probe failed; assuming deco site",X),!0}}var Ow0=B(()=>{FN();un0();aw();Kp();kQ()});import{z as aG$}from"zod";function ox($){let Z=[];for(let X of $){if(X.status!=="active")continue;let Q=_X(X);if(!Q)continue;Z.push({connectionId:X.id,owner:Q.owner,repo:Q.repo,installationId:Q.installationId})}return Z}async function g34($,Z){let{items:X}=await $.storage.connections.list(Z,{slug:"mcp-github"});return ox(X)}function h34($){let Z=$.split(`
 `).map((Q)=>Q.trim()).filter((Q)=>Q&&Q!==".git"&&Q!=="__CLONED__"),X=Z.length>0;return{cloned:X,listing:X?Z.join(`
 `):""}}function u34($){let Z="Load a GitHub repository into this conversation's sandbox so the file tools (read/write/edit/bash/grep/glob) and dev server operate on that repo, and open its live Preview. Waits until the repo is cloned before returning. Calling it again switches the repo. File tools operate on the loaded repo from your NEXT message (this turn's tools are still bound to the previous workspace), so after loading, prefer the file listing this tool returns over re-running bash in the same turn.",X=$.map((Q)=>`- ${Q.owner}/${Q.repo} (connectionId: ${Q.connectionId})`).join(`
 `);return`${Z}
@@ -2726,7 +2726,7 @@ Do NOT require review (requiresReview = false) when the changes are low-risk, su
 
 When unsure between the two, lean toward NOT requiring review for small frontend-only diffs, and toward requiring it for anything backend or large.
 
-Respond with the structured verdict and a short reason.`,oC$;var aC$=B(()=>{S4();ZO();R81();N$6=I81.object({requiresReview:I81.boolean().describe("true if the changes should go through pull-request review"),reason:I81.string().describe("One short sentence explaining the decision (max ~120 chars)")});oC$={requiresReview:!1,reason:""}});function O$6($){if(!$||$.includes(".."))return!1;return w$6.test($)}function sC$($){let Z=typeof $.__resolveType==="string"?$.__resolveType:null;if(!Z||!O$6(Z))return null;let{__resolveType:X,...Q}=$;return{resolveType:Z,payload:Q}}function eC$($,Z){return`${$.replace(/\/+$/,"")}/deco/invoke/${Z}`}var w$6;var $_$=B(()=>{w$6=/^[\w./@-]+$/});function q81($){let Z;try{Z=new URL($)}catch{return null}if(!Z.hostname.endsWith(".localhost"))return null;let X=Z.host;return Z.hostname="127.0.0.1",{url:Z.toString(),hostHeader:X}}function Z_$($,Z){let X=$?.githubRepo;if(!X?.owner||!X?.name)return null;if(!X.connectionId)return X;if(!Z.includes(X.connectionId))return null;return X}async function X_$($,Z,X,Q){if(!Q.connectionId)throw new ug("Push requires a connected GitHub account. Connect mcp-github for this project and restart the sandbox.");let Y=$.organization?.id;if(!Y)throw new ug(m7);await Vx({ctx:$,connectionId:Q.connectionId,organizationId:Y,forceRefresh:!0,onLegacyMintError:(N)=>{let F=N instanceof Error?N.message:m7;throw new ug(F)}});let{cloneUrl:G,gitUserName:J,gitUserEmail:W}=await gw(Q.connectionId,Q.owner,Q.name,$.db,$.vault),K=Zj0($),H=await Z.proxyDaemonRequest(X,"/_sandbox/config",{method:"PUT",headers:new Headers({"content-type":"application/json"}),body:JSON.stringify({git:{repository:{cloneUrl:G},identity:{userName:J,userEmail:W}},...K?{operator:K}:{}})});if(!H.ok){let N=await $O(H,B$6).catch(()=>H.statusText);throw Error(`Failed to refresh sandbox git credentials (${H.status}): ${N}`)}}var B$6=10485760,ug;var Q_$=B(()=>{Pw();L81();Wp();Cn();ug=class ug extends Error{constructor($){super($);this.name="GitPushAuthError"}}});function L$6($){let Z=$.startsWith("thread:")?$.slice(7):$;if(!Z||Z.length>255||Z.includes("..")||Z.startsWith("/")||Z.endsWith("/")||Z.endsWith(".lock")||!D$6.test(Z))throw Error(`Invalid branch name: ${$}`)}function xC($){return AbortSignal.any([$.req.raw.signal,AbortSignal.timeout(j$6)])}function yC($){let{runner:Z}=$.get("vmClaim");if(!Z)return $.json({error:"No sandbox runner configured"},503);return Z}function M81($,Z){let Q=(Xj0.get($)??Promise.resolve()).catch(()=>{}).then(Z),Y=Q.catch(()=>{});return Xj0.set($,Y),Y.finally(()=>{if(Xj0.get($)===Y)Xj0.delete($)}),Q}async function _Z($,Z,X){let Q=yC($);if(Q instanceof Response)return Q;let{claimName:Y,userId:G,projectRef:J}=$.get("vmClaim"),W=X?.method??"POST",K=null,H=new Headers;if(X?.jsonBody!==void 0)K=X.jsonBody,H.set("content-type","application/json");else if(X?.forwardJsonBody)K=await $.req.text(),H.set("content-type","application/json");let N=X?.signal,F={method:W,headers:H,body:K,...N?{signal:N}:{}},U=async()=>{let w=await Q.proxyDaemonRequest(Y,Z,F);if(X?.map404to410&&w.status===404){try{await w.body?.cancel()}catch{}if(await Q.adoptLiveClaim?.({userId:G,projectRef:J},Y))w=await Q.proxyDaemonRequest(Y,Z,F);if(w.status===404){try{await w.body?.cancel()}catch{}return new Response(JSON.stringify({error:"Sandbox handle is gone. The sandbox needs to be re-provisioned."}),{status:410,headers:{"content-type":"application/json",...xY}})}}let O=await w.text(),D=X?.redactRepoDirUnlessDesktop&&Q.kind!=="user-desktop"?P$6(O):O,L=w.headers.get("content-type")??"application/json";return new Response(D,{status:w.status,headers:{"content-type":L,...xY}})};try{if(N){let w=U();return w.catch(()=>{}),await Promise.race([w,new Promise((D,L)=>{if(N.aborted)return L(N.reason);N.addEventListener("abort",()=>L(N.reason),{once:!0})})])}return await U()}catch(w){let O=w instanceof Error?w.message:String(w);return $.json({error:`Daemon unreachable: ${O}`},502)}}function P$6($){try{let Z=JSON.parse($);if(Z&&typeof Z==="object"&&!Array.isArray(Z)&&"repoDir"in Z)return JSON.stringify({...Z,repoDir:null})}catch{}return $}async function Qj0($,Z,X,Q="GET",Y){let G=await $.proxyDaemonRequest(Z,X,{method:Q,headers:new Headers,body:null});if(G.status===404&&Y){try{await G.body?.cancel()}catch{}if(await $.adoptLiveClaim?.(Y,Z))G=await $.proxyDaemonRequest(Z,X,{method:Q,headers:new Headers,body:null})}if(G.status===404){try{await G.body?.cancel()}catch{}throw Error("SANDBOX_GONE")}let J=await G.text();if(!G.ok)try{let W=JSON.parse(J);throw Error(W.error??`Daemon error (${G.status})`)}catch(W){if(W instanceof Error&&W.message!==J)throw W;throw Error(`Daemon error (${G.status})`)}return JSON.parse(J)}function A$6($){return J_$.includes($)}var D$6,Y_$=524288,E$6=65536,j$6=1e4,G_$=2000,z$6,Xj0,xY,J_$,W_$=()=>{let $=new B1;return $.use("/:virtualMcpId/:branch/*",z$6),$.post("/:virtualMcpId/:branch/write",(Z)=>_Z(Z,"/_sandbox/write",{forwardJsonBody:!0,signal:xC(Z)})),$.post("/:virtualMcpId/:branch/unlink",(Z)=>_Z(Z,"/_sandbox/unlink",{forwardJsonBody:!0,signal:xC(Z)})),$.post("/:virtualMcpId/:branch/mkdir",(Z)=>_Z(Z,"/_sandbox/mkdir",{forwardJsonBody:!0,signal:xC(Z)})),$.post("/:virtualMcpId/:branch/rename",(Z)=>_Z(Z,"/_sandbox/rename",{forwardJsonBody:!0,signal:xC(Z)})),$.post("/:virtualMcpId/:branch/read",(Z)=>_Z(Z,"/_sandbox/read",{forwardJsonBody:!0,signal:xC(Z)})),$.post("/:virtualMcpId/:branch/glob",(Z)=>_Z(Z,"/_sandbox/glob",{forwardJsonBody:!0,signal:xC(Z)})),$.post("/:virtualMcpId/:branch/grep",(Z)=>_Z(Z,"/_sandbox/grep",{forwardJsonBody:!0,signal:xC(Z)})),$.post("/:virtualMcpId/:branch/exec/:script",async(Z)=>{let X=Z.req.param("script");if(!X)return Z.json({error:"missing script name"},400);return _Z(Z,`/_sandbox/exec/${encodeURIComponent(X)}`)}),$.post("/:virtualMcpId/:branch/exec/:script/kill",async(Z)=>{let X=Z.req.param("script");if(!X)return Z.json({error:"missing script name"},400);return _Z(Z,`/_sandbox/exec/${encodeURIComponent(X)}/kill`)}),$.get("/:virtualMcpId/:branch/config",(Z)=>_Z(Z,"/_sandbox/config",{method:"GET",map404to410:!0,redactRepoDirUnlessDesktop:!0})),$.put("/:virtualMcpId/:branch/config",(Z)=>_Z(Z,"/_sandbox/config",{method:"PUT",forwardJsonBody:!0,map404to410:!0})),$.post("/:virtualMcpId/:branch/setup/:step",async(Z)=>{let X=Z.req.param("step");if(!X||!A$6(X))return Z.json({error:`step must be one of: ${J_$.join(", ")}`},400);if(X==="start"){let Q=Z.get("vmClaim");if(Q.runner){let Y=r(Z.var.studioContext),G=Hw0(Q.virtualMcpMetadata);try{await Nw0({ctx:Z.var.studioContext,runner:Q.runner,handle:Q.claimName,orgId:Y.id,userId:Q.callerUserId,entries:G})}catch(J){let W=J instanceof Error?J.message:String(J);return Z.json({error:`Failed to push env to daemon: ${W}`},502)}}}return _Z(Z,`/_sandbox/setup/${X}`,{signal:Z.req.raw.signal,map404to410:!0})}),$.get("/:virtualMcpId/:branch/events",(Z)=>{let X=Z.get("vmClaim");if(!X.runner)return sN(Z,async(Q)=>{await Q.writeSSE({event:"phase",data:JSON.stringify({kind:"failed",reason:"unknown",message:"No sandbox runner configured on this studio instance."})})});return dC$(Z,{ctx:Z.var.studioContext,claimName:X.claimName,runner:X.runner,virtualMcpId:X.virtualMcpId,branch:X.branch,userId:X.userId,projectRef:X.projectRef,virtualMcpMetadata:X.virtualMcpMetadata})}),$.get("/:virtualMcpId/:branch/git/status",(Z)=>_Z(Z,"/_sandbox/git/status",{method:"GET",map404to410:!0,signal:AbortSignal.any([Z.req.raw.signal,AbortSignal.timeout(G_$)])})),$.post("/:virtualMcpId/:branch/git/status",(Z)=>_Z(Z,"/_sandbox/git/status",{map404to410:!0,signal:AbortSignal.any([Z.req.raw.signal,AbortSignal.timeout(G_$)])})),$.post("/:virtualMcpId/:branch/git/diff",(Z)=>_Z(Z,"/_sandbox/git/diff",{forwardJsonBody:!0,map404to410:!0})),$.post("/:virtualMcpId/:branch/git/publish",async(Z)=>{let X=yC(Z);if(X instanceof Response)return X;let{claimName:Q,virtualMcpMetadata:Y,connectionIds:G}=Z.get("vmClaim"),J=Z.var.studioContext;return M81(Q,async()=>{try{await E81(J,X,Q);let W=Z_$(Y,G);if(W)await X_$(J,X,Q,W)}catch(W){if(W instanceof ug)return Z.json({error:W.message},403,xY);let K=W instanceof Error?W.message:String(W);return Z.json({error:K},502,xY)}return _Z(Z,"/_sandbox/git/publish",{forwardJsonBody:!0,map404to410:!0})})}),$.post("/:virtualMcpId/:branch/git/discard",(Z)=>{let{claimName:X}=Z.get("vmClaim");return M81(X,()=>_Z(Z,"/_sandbox/git/discard",{forwardJsonBody:!0,map404to410:!0}))}),$.post("/:virtualMcpId/:branch/git/rebase",async(Z)=>{let X=yC(Z);if(X instanceof Response)return X;let{claimName:Q}=Z.get("vmClaim"),Y=Z.var.studioContext;return M81(Q,async()=>{try{await E81(Y,X,Q)}catch(G){let J=G instanceof Error?G.message:String(G);return Z.json({error:J},502,xY)}return _Z(Z,"/_sandbox/git/rebase",{forwardJsonBody:!0,map404to410:!0})})}),$.post("/:virtualMcpId/:branch/git/suggest-commit",GZ({maxSize:Y_$,onError:(Z)=>Z.json({error:"Payload too large"},413,xY)}),async(Z)=>{let X=yC(Z);if(X instanceof Response)return X;let{claimName:Q,userId:Y,projectRef:G}=Z.get("vmClaim"),J=Z.var.studioContext;try{let W=await Z.req.json().catch(()=>({})),K=W.status,H=W.diff,N=H!=null&&typeof H.diffs==="object"&&H.diffs!==null,[F,U]=P81(K)&&N?[K,H]:await Promise.all([Qj0(X,Q,"/_sandbox/git/status","GET",{userId:Y,projectRef:G}),Qj0(X,Q,"/_sandbox/git/diff","GET",{userId:Y,projectRef:G})]),w=await tC$(J,F,U);return Z.json(w,200,xY)}catch(W){let K=W instanceof Error?W.message:String(W);if(K==="SANDBOX_GONE")return Z.json({error:"Sandbox handle is gone. The sandbox needs to be re-provisioned."},410,xY);return Z.json({error:K},502,xY)}}),$.post("/:virtualMcpId/:branch/git/judge-review",GZ({maxSize:Y_$,onError:(Z)=>Z.json({error:"Payload too large"},413,xY)}),async(Z)=>{let X=yC(Z);if(X instanceof Response)return X;let{claimName:Q,userId:Y,projectRef:G}=Z.get("vmClaim"),J=Z.var.studioContext;try{let W=await Z.req.json().catch(()=>({})),K=W.status,H=W.diff,N=H!=null&&typeof H.diffs==="object"&&H.diffs!==null,[F,U]=P81(K)&&N?[K,H]:await Promise.all([Qj0(X,Q,"/_sandbox/git/status","GET",{userId:Y,projectRef:G}),Qj0(X,Q,"/_sandbox/git/diff","GET",{userId:Y,projectRef:G})]),w=await rC$(J,F,U,typeof W.language==="string"?W.language:void 0);return Z.json(w,200,xY)}catch(W){let K=W instanceof Error?W.message:String(W);if(K==="SANDBOX_GONE")return Z.json({error:"Sandbox handle is gone. The sandbox needs to be re-provisioned."},410,xY);return Z.json({error:K},502,xY)}}),$.get("/:virtualMcpId/:branch/preview-fetch",async(Z)=>{let X=yC(Z);if(X instanceof Response)return X;let{claimName:Q}=Z.get("vmClaim"),Y=Z.req.query("path");if(!Y||!Y.startsWith("/")||Y.startsWith("//")||Y.includes("..")||Y.includes("\\"))return Z.json({error:"Path not allowed"},403);let G;try{G=await X.getPreviewUrl(Q)}catch{return Z.json({error:"Preview not available"},502)}if(!G)return Z.json({error:"Preview not available"},502);let J=G.replace(/\/+$/,""),W=q81(`${J}${Y}`),K;try{K=await fetch(W?.url??`${J}${Y}`,{...W?{headers:{host:W.hostHeader}}:{}})}catch{return Z.json({error:"Preview unreachable"},502)}let H;try{H=await K.text()}catch{return Z.json({error:"Preview unreachable"},502)}return new Response(H,{status:K.status,headers:{"content-type":K.headers.get("content-type")??"application/json"}})}),$.post("/:virtualMcpId/:branch/preview-invoke",GZ({maxSize:E$6,onError:(Z)=>Z.json({error:"Payload too large"},413)}),async(Z)=>{let X=yC(Z);if(X instanceof Response)return X;let{claimName:Q}=Z.get("vmClaim"),Y;try{Y=await X.getPreviewUrl(Q)}catch{return Z.json({error:"Preview not available"},502)}if(!Y)return Z.json({error:"Preview not available"},502);let G;try{G=await Z.req.json()}catch{return Z.json({error:"Invalid JSON body"},400)}if(!G||typeof G!=="object"||Array.isArray(G))return Z.json({error:"Invalid JSON body"},400);let J=sC$(G);if(!J)return Z.json({error:"Invalid or missing __resolveType"},400);let W=eC$(Y,J.resolveType),K=q81(W),H;try{H=await fetch(K?.url??W,{method:"POST",headers:{"content-type":"application/json",...K?{host:K.hostHeader}:{}},body:JSON.stringify(J.payload),signal:AbortSignal.timeout(30000)})}catch{return Z.json({error:"Preview unreachable"},502)}let N;try{N=await H.text()}catch{return Z.json({error:"Preview unreachable"},502)}return new Response(N,{status:H.status,headers:{"content-type":H.headers.get("content-type")??"application/json"}})}),$};var K_$=B(()=>{v8();gO();hg();hC$();FN();cC$();j3();aw();lC$();mC$();yn0();Jp();R81();aC$();$_$();Q_$();D$6=/^[a-zA-Z0-9][a-zA-Z0-9/._-]*$/;z$6=gC$(async($,Z)=>{let X=$.var.studioContext;try{$0(X)}catch{return $.json({error:"Unauthorized"},401)}let Q=W1(X);if(!Q)return $.json({error:"Unauthorized"},401);let Y;try{Y=r(X)}catch{return $.json({error:"Organization scope required"},403)}let G=$.req.param("virtualMcpId"),J=$.req.param("branch");if(!G||!J)return $.json({error:"virtualMcpId and branch are required"},400);try{L$6(J)}catch(w){let O=w instanceof Error?w.message:String(w);return $.json({error:O},400)}let W=await X.storage.virtualMcps.findById(G);if(!W||W.organization_id!==Y.id)return $.json({error:"Virtual MCP not found"},404);let K=qn({orgId:Y.id,virtualMcpId:G,branch:J}),H=await zN(X,J,Q),N=uC$({userId:H,projectRef:K}),F=W.metadata??null,U;try{U=(await hX(X,{userId:H,branch:J,virtualMcpMetadata:F})).provider}catch{U=null}if(!U)return $.json({error:"No sandbox runner found"},404);return $.set("vmClaim",{claimName:N,callerUserId:Q,runner:U,virtualMcpId:G,branch:J,userId:H,projectRef:K,virtualMcpMetadata:F,connectionIds:W.connections?.map((w)=>w.connection_id)??[]}),Z()});Xj0=new Map;xY={"Cache-Control":"no-store, no-cache, must-revalidate",Pragma:"no-cache"};J_$=["clone","install","start"]});var H_$=($)=>{let Z=new B1;if(Z.use("*",MC),Z.route("/",EE0()),Z.route("/",Ak$()),Z.route("/",IC$()),Z.route("/",AC$()),Z.route("/",sE0()),Z.route("/tools",_C$()),Z.route("/",SC$()),Z.route("/",YC$({kvStorage:$.kvStorage})),Z.route("/",XC$()),Z.route("/fs",BC$({getConnection:$.getNatsConnection})),Z.route("/sandbox",W_$()),Z.route("/",jC$()),Z.route("/deco-sites",zE0()),Z.route("/sso",FE0()),Z.route("/",eE0({tokenStorage:$.tokenStorage,automationEventDispatcher:$.automationEventDispatcher})),Z.route("/webhooks",Ok$()),$.mountDevAssets)Z.route("/dev-assets",PE0({orgFromPath:!0}));return Z.use("/mcp/:connectionId?",$.mcpAuth),Z.use("/mcp/:connectionId/ui-resource",$.mcpAuth),Z.use("/mcp/gateway/:virtualMcpId?",$.mcpAuth),Z.use("/mcp/virtual-mcp/:virtualMcpId?",$.mcpAuth),Z.use("/mcp/self",$.mcpAuth),Z.use("/mcp/task-run/:threadId",$.mcpAuth),Z.route("/",ls1()),Z.get("/mcp/:gateway?/:connectionId/.well-known/oauth-protected-resource/*",$.betterAuthProtectedResourceHandler),Z.get("/mcp/.well-known/oauth-protected-resource",$.betterAuthProtectedResourceHandler),Z.route("/mcp/task-run",LC$()),Z.route("/mcp",nO0()),Z.route("/mcp/self",aE0()),Z.route("/mcp",oO0()),Z.all("/oauth-proxy/:connectionId/*",$.oauthProxyHandler),Z.get("/watch",$.watchHandler),Z};var N_$=B(()=>{v8();g11();Bk$();d11();AE0();et();x11();QC$();GC$();DC$();fi();M11();rO0();N81();EC$();zC$();TC$();qC$();VC$();U81();vC$();w81();pO0();K_$()});function R$6($){return $.filter((Z)=>Z.vendors?.alias).map((Z)=>({name:Z.name,title:Z.title,description:Z.description,logo:Z.logo,category:Z.category,vendor:{alias:Z.vendors.alias,url:Z.vendors.url}}))}async function I$6($,Z){let X=await fetch(`${$}/rest/v1/apps?select=name,title,description,logo,category,vendors(alias,url)`,{headers:{apikey:Z,Authorization:`Bearer ${Z}`,Accept:"application/json"},signal:AbortSignal.timeout(T$6)});if(!X.ok){let Q=await X.text().catch(()=>X.statusText);throw console.error(`[deco-apps] Supabase error (${X.status}): ${Q.slice(0,200)}`),Error(`External service error (${X.status})`)}return await X.json()}var T$6=1e4,q$6=async($,Z)=>{if(!$.get("studioContext").auth.user?.id)return $.json({error:"Unauthorized"},401);return Z()},F_$=()=>{let $=new B1;return $.use("*",q$6),$.get("/",async(Z)=>{let X=c0(),Q=X.decoSupabaseUrl,Y=X.decoSupabaseServiceKey;if(!Q||!Y)return Z.json({apps:[]});try{let G=await I$6(Q,Y);return Z.json({apps:R$6(G)})}catch(G){return console.error("[deco-apps] GET error:",G),Z.json({error:"Failed to fetch apps"},502)}}),$};var U_$=B(()=>{v8();S$()});import{z as M1}from"zod";function bK($,Z="invalid_request_error",X=null,Q=null){return{error:{message:$,type:Z,param:X,code:Q}}}function x$6($){if(!$)return null;let Z=$.indexOf(":");if(Z===-1)return{credentialId:null,modelId:$};let X=$.substring(0,Z),Q=$.substring(Z+1);if(!X||!Q)return null;return{credentialId:X,modelId:Q}}function y$6($,Z,X){try{return JSON.parse($)}catch{throw new B_$(`Invalid JSON in tool call arguments for function '${X}' (tool_call_id: ${Z}): ${$}`)}}function g$6($){let Z={};for(let X of $)if(X.role==="assistant"&&X.tool_calls)for(let Q of X.tool_calls)Z[Q.id]=Q.function.name;return $.map((X)=>{switch(X.role){case"system":return{role:"system",content:X.content};case"user":if(typeof X.content==="string")return{role:"user",content:X.content};return{role:"user",content:X.content.map((Y)=>{if(Y.type==="text")return{type:"text",text:Y.text};return{type:"image",image:Y.image_url.url}})};case"assistant":if(X.tool_calls&&X.tool_calls.length>0)return{role:"assistant",content:X.tool_calls.map((Y)=>({type:"tool-call",toolCallId:Y.id,toolName:Y.function.name,input:y$6(Y.function.arguments,Y.id,Y.function.name)}))};return{role:"assistant",content:X.content??""};case"tool":let Q=Z[X.tool_call_id]??"unknown";return{role:"tool",content:[{type:"tool-result",toolCallId:X.tool_call_id,toolName:Q,output:{type:"text",value:X.content}}]}}})}function h$6($){let Z=$.map((X)=>{let Q=X.function.parameters?DY(X.function.parameters):DY({type:"object",properties:{}});return[X.function.name,_$({description:X.function.description,inputSchema:Q})]});return Object.fromEntries(Z)}function u$6($){if(!$)return;return{openai:{response_format:$}}}function c$6(){return`chatcmpl-${crypto.randomUUID().replace(/-/g,"").substring(0,29)}`}function w_$($,Z,X,Q,Y,G){let J={model:$,messages:Z,tools:X,temperature:Q.temperature,maxTokens:Q.max_tokens,topP:Q.top_p,frequencyPenalty:Q.frequency_penalty,presencePenalty:Q.presence_penalty,stopSequences:Q.stop?Array.isArray(Q.stop)?Q.stop:[Q.stop]:void 0,abortSignal:G};return Y?{...J,providerOptions:Y}:J}function O_$($){if($==="tool-calls")return"tool_calls";if($==="length")return"length";return"stop"}var M$6=256,k$6,S$6,V$6,C$6,_$6,v$6,b$6,f$6,B_$,D_$,L_$;var E_$=B(()=>{S4();v8();hg();CN();k$6=M1.object({type:M1.literal("function"),function:M1.object({name:M1.string(),description:M1.string().optional(),parameters:M1.record(M1.string(),M1.unknown()).optional()})}),S$6=M1.object({id:M1.string(),type:M1.literal("function"),function:M1.object({name:M1.string(),arguments:M1.string()})}),V$6=M1.discriminatedUnion("role",[M1.object({role:M1.literal("system"),content:M1.string(),name:M1.string().optional()}),M1.object({role:M1.literal("user"),content:M1.union([M1.string(),M1.array(M1.union([M1.object({type:M1.literal("text"),text:M1.string()}),M1.object({type:M1.literal("image_url"),image_url:M1.object({url:M1.string(),detail:M1.string().optional()})})]))]),name:M1.string().optional()}),M1.object({role:M1.literal("assistant"),content:M1.string().nullable().optional(),name:M1.string().optional(),tool_calls:M1.array(S$6).optional()}),M1.object({role:M1.literal("tool"),content:M1.string(),tool_call_id:M1.string()})]),C$6=M1.object({type:M1.literal("text")}),_$6=M1.object({type:M1.literal("json_object")}),v$6=M1.object({type:M1.literal("json_schema"),json_schema:M1.object({name:M1.string(),description:M1.string().optional(),schema:M1.record(M1.string(),M1.unknown()),strict:M1.boolean().optional()})}),b$6=M1.union([C$6,_$6,v$6]),f$6=M1.object({model:M1.string().describe("Format: 'model_id' or 'credential_id:model_id'"),messages:M1.array(V$6),stream:M1.boolean().optional().default(!1),temperature:M1.number().min(0).max(2).optional(),max_tokens:M1.number().positive().optional(),top_p:M1.number().min(0).max(1).optional(),frequency_penalty:M1.number().min(-2).max(2).optional(),presence_penalty:M1.number().min(-2).max(2).optional(),stop:M1.union([M1.string(),M1.array(M1.string())]).optional(),tools:M1.array(k$6).optional(),tool_choice:M1.union([M1.literal("auto"),M1.literal("none"),M1.literal("required"),M1.object({type:M1.literal("function"),function:M1.object({name:M1.string()})})]).optional(),response_format:b$6.optional(),user:M1.string().optional()});B_$=class B_$ extends Error{constructor($){super($);this.name="MessageConversionError"}};D_$=new B1;D_$.post("/:org/v1/chat/completions",async($)=>{let Z=$.get("studioContext"),X=$.req.param("org");try{if(!Z.auth.apiKey?.id)return $.json(bK("API key authentication required. Provide a valid API key via Authorization header.","authentication_error"),401);if(!Z.organization)return $.json(bK("Organization context is required. Ensure your API key has organization metadata.","invalid_request_error","organization"),400);if((Z.organization.slug??Z.organization.id)!==X)return $.json(bK("Organization mismatch. The API key's organization does not match the requested organization.","invalid_request_error","organization"),403);let Q=await $.req.json(),Y=f$6.safeParse(Q);if(!Y.success){let L=Y.error.issues[0]??{message:"Invalid request",path:[]};return $.json(bK(`Invalid request: ${L.message}`,"invalid_request_error",L.path.length>0?L.path.join("."):null),400)}let G=Y.data,J=x$6(G.model);if(!J)return $.json(bK("Invalid model format. Expected 'model_id' or 'credential_id:model_id' (e.g., 'claude-sonnet-4-6' or 'key_abc123:claude-sonnet-4-6')","invalid_request_error","model"),400);let{credentialId:W}=J,{modelId:K}=J;if(!W){let E=(await Z.storage.aiProviderKeys.list({organizationId:Z.organization.id})).find((j)=>aB(j.providerId));if(!E)return $.json(bK("No AI provider credentials configured for this organization. Add a credential in settings or specify one explicitly via 'credential_id:model_id'.","invalid_request_error","model"),400);W=E.id}let H;try{H=await Z.aiProviders.activate(W,Z.organization.id)}catch{return $.json(bK(`AI provider credential not found or inaccessible: ${W}`,"invalid_request_error","model"),404)}let N=H.aiSdk.languageModel(K),F=g$6(G.messages),U=G.tools?h$6(G.tools):void 0,w=u$6(G.response_format),O=c$6(),D=Math.floor(Date.now()/1000);if(G.stream)return sN($,async(L)=>{let E=w_$(N,F,U,G,w,$.req.raw.signal);try{let j=xw(E),z=!1,A=0,P="",M=async()=>{if(P.length===0)return;let k=P;P="",await L.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:D,model:G.model,choices:[{index:0,delta:{content:k},finish_reason:null}]})})};for await(let k of j.fullStream){if(!z&&(k.type==="text-delta"||k.type==="tool-call"))await L.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:D,model:G.model,choices:[{index:0,delta:{role:"assistant",content:""},finish_reason:null}]})}),z=!0;if(k.type==="text-delta"){if(P+=k.text,P.length>=M$6)await M()}else if(k.type==="tool-call"){await M();let q=A++;await L.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:D,model:G.model,choices:[{index:0,delta:{tool_calls:[{index:q,id:k.toolCallId,type:"function",function:{name:k.toolName,arguments:JSON.stringify(k.input)}}]},finish_reason:null}]})})}else if(k.type==="finish")await M(),await L.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:D,model:G.model,choices:[{index:0,delta:{},finish_reason:O_$(k.finishReason)}],usage:k.totalUsage?{prompt_tokens:k.totalUsage.inputTokens??0,completion_tokens:k.totalUsage.outputTokens??0,total_tokens:k.totalUsage.totalTokens??0}:void 0})})}await M(),await L.writeSSE({data:"[DONE]"})}catch(j){let z=j;console.error("[openai-compat:stream] Error:",z.message),await L.writeSSE({data:JSON.stringify({error:{message:z.message,type:"server_error"}})})}});else{let L=w_$(N,F,U,G,w,$.req.raw.signal),E=await bw(L),j={role:"assistant",content:E.text||null};if(E.toolCalls&&E.toolCalls.length>0)j.tool_calls=E.toolCalls.map((z)=>({id:z.toolCallId,type:"function",function:{name:z.toolName,arguments:JSON.stringify("input"in z?z.input:{})}})),j.content=null;return $.json({id:O,object:"chat.completion",created:D,model:G.model,choices:[{index:0,message:j,finish_reason:O_$(E.finishReason)}],usage:{prompt_tokens:E.usage?.inputTokens??0,completion_tokens:E.usage?.outputTokens??0,total_tokens:E.usage?.totalTokens??0}})}}catch(Q){let Y=Q;if(Y.name==="AbortError")return $.json(bK("Request aborted","invalid_request_error"),400);if(Y.name==="MessageConversionError")return $.json(bK(Y.message,"invalid_request_error","messages"),400);return console.error("[openai-compat] Error:",Y.message,Y.stack),$.json(bK(Y.message,"server_error"),500)}});L_$=D_$});var z_$;var j_$=B(()=>{z_$={name:"decocms",version:"4.192.6",description:"Deco CMS \u2014 Self-hostable MCP Gateway for managing AI connections and tools",author:"Deco team",repository:{type:"git",url:"git+https://github.com/decocms/studio.git",directory:"apps/api"},bugs:{url:"https://github.com/decocms/studio/issues"},type:"module",bin:{deco:"./dist/server/cli.js"},files:["dist/**/*"],scripts:{dev:"bun run migrate && bun run dev:server","dev:server":"bun run --cwd=../../packages/sandbox build && NODE_ENV=development bun --env-file=.env --hot run src/index.ts",build:"bun run build:server","build:server":"bun run scripts/bundle-server-script.ts --dist ./dist/server","generate:tool-contracts":"bun run scripts/generate-tool-contracts.ts","db:migrate":"bun run ./dist/server/migrate.js",check:"tsc --noEmit",start:"bun run ./dist/server/server.js",migrate:"bun run src/database/migrate.ts",test:"bun test src","better-auth:migrate":"bunx --bun @better-auth/cli migrate -y --config src/auth/index.ts",prepublishOnly:"bun run --cwd=../.. build:studio"},optionalDependencies:{"@duckdb/node-api":"^1.5.0-r.1"},dependencies:{"@ai-sdk/anthropic":"^3.0.85","@ai-sdk/google":"^3.0.83","@ai-sdk/openai":"^3.0.73","@anthropic-ai/sdk":"^0.105.0","@aws-sdk/client-s3":"^3.1013.0","@aws-sdk/client-sts":"^3.1013.0","@aws-sdk/lib-storage":"^3.1013.0","@aws-sdk/s3-request-presigner":"^3.1013.0","@clickhouse/client":"^1.8.1","@dbos-inc/dbos-sdk":"^4.21.6","@inkjs/ui":"^2.0.0","@nats-io/jetstream":"3.4.0","@nats-io/kv":"3.4.0","@nats-io/nats-core":"3.4.0","@nats-io/transport-node":"3.4.0","@openrouter/ai-sdk-provider":"^2.9.1","@opentelemetry/core":"^2.6.0","embedded-postgres":"^18.3.0-beta.16",ink:"^6.8.0",kysely:"^0.28.12","posthog-node":"^5.0.0",react:"^19.2.6","react-dom":"^19.2.6"},devDependencies:{"@ai-sdk/provider":"^3.0.10","@better-auth/sso":"1.4.1","@decocms/better-auth":"1.5.17","@decocms/bindings":"workspace:*","@decocms/mcp-utils":"workspace:*","@decocms/runtime":"workspace:*","@decocms/sandbox":"workspace:*","@decocms/shared":"workspace:*","@jitl/quickjs-wasmfile-release-sync":"0.31.0","@modelcontextprotocol/sdk":"1.29.0","@nats-io/jwt":"0.0.10-5","@opentelemetry/api":"^1.9.0","@opentelemetry/api-logs":"^0.211.0","@opentelemetry/exporter-logs-otlp-proto":"^0.211.0","@opentelemetry/exporter-prometheus":"^0.208.0","@opentelemetry/exporter-trace-otlp-proto":"^0.207.0","@opentelemetry/instrumentation-runtime-node":"^0.24.0","@opentelemetry/resources":"^2.6.0","@opentelemetry/sdk-logs":"^0.211.0","@opentelemetry/sdk-metrics":"^2.2.0","@opentelemetry/sdk-node":"^0.207.0","@opentelemetry/sdk-trace-base":"^2.5.0","@types/bun":"^1.3.1","@types/google.maps":"^3.65.2","@types/pg":"^8.15.6","@types/react-syntax-highlighter":"^15.5.13","@vercel/nft":"^1.1.1",ai:"^6.0.208","better-auth":"1.4.22",croner:"^9.1.0",degit:"^2.8.4",hono:"^4.10.7",jose:"^6.0.11",nanoid:"^5.1.6",pg:"^8.16.3",typescript:"^7.0.2",typescript5:"npm:typescript@^5.9.3",zod:"4.3.6"},homepage:"https://github.com/decocms/studio",keywords:["mcp","model-context-protocol","ai","gateway","self-hosted","tools"],license:"MIT",publishConfig:{access:"public"}}});function m$6(){let $=process.env.POSTHOG_KEY;if(!$)return null;return{key:$,host:process.env.POSTHOG_HOST??d$6}}var P_$,d$6="https://ph.studio.decocms.com",A_$;var T_$=B(()=>{v8();cC0();hV();BZ();S$();A11();j_$();P_$=new B1;P_$.get("/",($)=>{let Z={version:z_$.version,theme:iM1(),...XD().logo&&{logo:XD().logo},...NK()&&{internalUrl:p21()},...c0().enableDecoImport&&{enableDecoImport:!0},brandExtractEnabled:!!c0().firecrawlApiKey,auth:SM$(),posthog:m$6(),googleMapsApiKey:process.env.GOOGLE_MAPS_API_KEY?.trim()||null,runtime:{agentSandbox:!NK()&&c0().sandboxProviderKind==="agent-sandbox"}};return $.header("Cache-Control","no-store"),$.json({success:!0,config:Z})});A_$=P_$});function cg($){let Z=($??"").trim().toLowerCase();return Z=Z.replace(/^https?:\/\//,""),Z=Z.replace(/^www\./,""),Z=Z.split(/[/?#]/)[0]??"",Z.replace(/\/+$/,"")}function k81($){return(cg($).split(".")[0]||$).replace(/[-_]/g," ").split(" ").filter(Boolean).map((X)=>X.charAt(0).toUpperCase()+X.slice(1)).join(" ")}function I_$($,Z=64){return`https://www.google.com/s2/favicons?domain=${encodeURIComponent(cg($))}&sz=${Z}`}function R_$($,Z){let X=$.trim();if(X.length<=Z)return X;let Q=X.slice(0,Z-1),Y=Q.lastIndexOf(" ");return`${(Y>Z*0.6?Q.slice(0,Y):Q).trimEnd()}\u2026`}function q_$($){let{brand:Z,domain:X,score:Q,verdict:Y}=$,G=typeof Q==="number"?`${Z} commerce report \u2014 ${Math.round(Q)}/100 \xB7 decocms`:`${Z} commerce report \xB7 decocms`,J=`See the full ${Z} scorecard \u2014 SEO, performance, conversion & AEO signals scored by decocms.`,W=Y?.trim()?R_$(`${Y.trim().replace(/\s+/g," ")} \u2014 ${J}`,200):R_$(`How does ${X} really perform? ${J}`,200);return{title:G,description:W}}import{z as l0}from"zod";var gC,i$6,n$6,p$6,t$6,M_$;var k_$=B(()=>{gC=l0.enum(["good","bad","neutral"]),i$6=l0.preprocess(($)=>{if(Array.isArray($))return{kind:"text",value:$.find((X)=>X!==null&&typeof X!=="object")??""};return $!==null&&typeof $==="object"?$:{kind:"text",value:$}},l0.object({kind:l0.enum(["text","number","sparkline","badge","score"]).catch("text"),value:l0.coerce.string().optional(),tone:gC.optional(),muted:l0.boolean().optional(),delta:l0.coerce.string().optional(),deltaDir:l0.enum(["up","down","neutral"]).optional(),points:l0.array(l0.coerce.number()).optional(),label:l0.coerce.string().optional()}).transform(($)=>{if($.kind==="badge"&&$.label==null)$.label=$.value??"";if($.kind==="score"){let Z=Number($.value);if(Number.isNaN(Z))return{...$,kind:"text"}}return $})),n$6=l0.preprocess(($)=>{let Z=$;if(Z&&typeof Z==="object"&&!Array.isArray(Z)&&Array.isArray(Z.cells))Z=Z.cells;if(Array.isArray(Z)&&Z.length===1&&Array.isArray(Z[0]))Z=Z[0];if(Array.isArray(Z))return Z;if(Z&&typeof Z==="object")return Object.values(Z);return Z},l0.array(i$6)),p$6={key:l0.coerce.string(),title:l0.coerce.string(),eyebrow:l0.coerce.string().optional(),headline:l0.coerce.string(),annotation:l0.coerce.string().optional(),methodology:l0.coerce.string().optional(),sources:l0.array(l0.object({name:l0.coerce.string(),logoUrl:l0.coerce.string()})).optional()},t$6=l0.discriminatedUnion("template",[l0.object({template:l0.literal("cover"),score:l0.object({value:l0.coerce.number(),max:l0.coerce.number().optional(),grade:l0.coerce.string().optional(),label:l0.coerce.string().optional()}).optional(),brandImage:l0.coerce.string().optional(),screenshot:l0.coerce.string().optional(),mobileScreenshot:l0.coerce.string().optional()}),l0.object({template:l0.literal("cta"),ctaUrl:l0.coerce.string().optional(),ctaLabel:l0.coerce.string().optional(),bullets:l0.array(l0.coerce.string()).optional()}),l0.object({template:l0.literal("series"),points:l0.array(l0.coerce.number()).min(2),xLabels:l0.array(l0.coerce.string()).min(1),unit:l0.coerce.string().optional(),callout:l0.object({index:l0.coerce.number(),value:l0.coerce.string(),tone:gC.optional()})}),l0.object({template:l0.literal("threshold"),value:l0.coerce.string().default(""),metricLabel:l0.coerce.string().optional(),ratio:l0.coerce.number(),thresholdRatio:l0.coerce.number().optional(),thresholdLabel:l0.coerce.string().default(""),tone:gC.optional()}),l0.object({template:l0.literal("stats"),stats:l0.array(l0.object({value:l0.coerce.string(),label:l0.coerce.string(),tone:gC.optional()})).min(1)}),l0.object({template:l0.literal("bars"),items:l0.array(l0.object({value:l0.coerce.string(),label:l0.coerce.string(),ratio:l0.coerce.number(),tone:gC.optional()})).min(1)}),l0.object({template:l0.literal("gauges"),gauges:l0.array(l0.object({label:l0.coerce.string(),value:l0.coerce.string(),status:l0.enum(["good","warn","bad"]).catch("warn"),caption:l0.coerce.string().optional(),ratio:l0.coerce.number().optional()})).min(1)}),l0.object({template:l0.literal("checklist"),checks:l0.array(l0.object({label:l0.coerce.string(),status:l0.enum(["pass","fail","warn"]).catch("fail"),value:l0.coerce.string().optional()})).min(1)}),l0.object({template:l0.literal("table"),columns:l0.array(l0.object({label:l0.coerce.string(),align:l0.enum(["left","right"]).optional()})).min(1),rows:l0.array(n$6).min(1),highlightRow:l0.coerce.number().optional()}),l0.object({template:l0.literal("products"),products:l0.array(l0.object({name:l0.coerce.string(),price:l0.coerce.string().optional(),image:l0.coerce.string().optional(),url:l0.coerce.string().optional()})).min(1)}),l0.object({template:l0.literal("list"),entries:l0.array(l0.object({label:l0.coerce.string(),severity:l0.enum(["error","warning","notice"]).catch("notice")})).min(1),moreCount:l0.coerce.number().optional()}),l0.object({template:l0.literal("keywords"),volumeLabel:l0.coerce.string().optional(),keywords:l0.array(l0.object({term:l0.coerce.string(),volume:l0.coerce.string(),position:l0.coerce.number().catch(0)})).min(1)}),l0.object({template:l0.literal("competitor"),metricLabel:l0.coerce.string().optional(),competitors:l0.array(l0.object({name:l0.coerce.string(),value:l0.coerce.string(),tone:gC.optional(),isYou:l0.boolean().optional()})).min(1)}),l0.object({template:l0.literal("scorecard"),rivalLabel:l0.coerce.string().optional(),dimensions:l0.array(l0.object({label:l0.coerce.string(),you:l0.coerce.string(),rival:l0.coerce.string().optional(),rivalName:l0.coerce.string().optional(),tone:gC.optional()})).min(1)})]),M_$=l0.object({...p$6,template:t$6})});function Yj0($){let Z=[],X=[...$.sections].sort((Q,Y)=>Q.position-Y.position).map((Q)=>{let Y=M_$.safeParse(Q.props);if(Y.success)return Y.data;let G=Y.error.issues[0];return Z.push({section_type:Q.section_type,position:Q.position,reason:G?`${G.path.join(".")||"(root)"}: ${G.message}`:"contract violation"}),null}).filter((Q)=>Q!==null);return{deck:{meta:{...$.meta,scores:$.summary?.scores},slides:X},drops:Z}}var S81=B(()=>{k_$()});import{join as S_$}from"path";async function r$6($){try{let Z=await fetch(`${LW({})}/api/v2/public/diagnostics/${encodeURIComponent($)}`,{headers:{Accept:"application/json"},signal:AbortSignal.timeout(o$6)});if(!Z.ok)return null;let X=await Z.json(),{deck:Q}=Yj0(X);if(!Q.slides.length)return null;let Y=Q.slides.find((W)=>W.template.template==="cover"),G=Y?.template,J=G&&G.template==="cover"?G:void 0;return{brand:Q.meta.brand?.trim()||k81($),score:Q.meta.scores?.cover??J?.score?.value,verdict:Y?.annotation?.trim()||Y?.headline?.trim()||void 0}}catch{return null}}function yY($){return $.replaceAll("&","&amp;").replaceAll("<","&lt;").replaceAll(">","&gt;").replaceAll('"',"&quot;")}function a$6($,Z){let X=cg($),Q=Z?.brand?.trim()||k81(X),Y=I_$(X,128),J=`${(c0().baseUrl??"https://studio.decocms.com").replace(/\/+$/,"")}/report/${encodeURIComponent(X)}`,{title:W,description:K}=q_$({brand:Q,domain:X,score:Z?.score,verdict:Z?.verdict}),H=`${J}/og.png`,N=`${Q} commerce report by decocms`;return[`<title>${yY(W)}</title>`,`<meta name="description" content="${yY(K)}" />`,'<meta name="robots" content="noindex, follow" />','<meta property="og:type" content="website" />','<meta property="og:site_name" content="decocms" />',`<meta property="og:title" content="${yY(W)}" />`,`<meta property="og:description" content="${yY(K)}" />`,`<meta property="og:url" content="${yY(J)}" />`,`<meta property="og:image" content="${yY(H)}" />`,'<meta property="og:image:width" content="1200" />','<meta property="og:image:height" content="630" />',`<meta property="og:image:alt" content="${yY(N)}" />`,'<meta name="twitter:card" content="summary_large_image" />',`<meta name="twitter:title" content="${yY(W)}" />`,`<meta name="twitter:description" content="${yY(K)}" />`,`<meta name="twitter:image" content="${yY(H)}" />`,`<meta name="twitter:image:alt" content="${yY(N)}" />`,`<link rel="canonical" href="${yY(J)}" />`,`<link rel="icon" href="${yY(Y)}" sizes="any" />`].join(`
+Respond with the structured verdict and a short reason.`,oC$;var aC$=B(()=>{S4();ZO();R81();N$6=I81.object({requiresReview:I81.boolean().describe("true if the changes should go through pull-request review"),reason:I81.string().describe("One short sentence explaining the decision (max ~120 chars)")});oC$={requiresReview:!1,reason:""}});function O$6($){if(!$||$.includes(".."))return!1;return w$6.test($)}function sC$($){let Z=typeof $.__resolveType==="string"?$.__resolveType:null;if(!Z||!O$6(Z))return null;let{__resolveType:X,...Q}=$;return{resolveType:Z,payload:Q}}function eC$($,Z){return`${$.replace(/\/+$/,"")}/deco/invoke/${Z}`}var w$6;var $_$=B(()=>{w$6=/^[\w./@-]+$/});function q81($){let Z;try{Z=new URL($)}catch{return null}if(!Z.hostname.endsWith(".localhost"))return null;let X=Z.host;return Z.hostname="127.0.0.1",{url:Z.toString(),hostHeader:X}}function Z_$($,Z){let X=$?.githubRepo;if(!X?.owner||!X?.name)return null;if(!X.connectionId)return X;if(!Z.includes(X.connectionId))return null;return X}async function X_$($,Z,X,Q){if(!Q.connectionId)throw new ug("Push requires a connected GitHub account. Connect mcp-github for this project and restart the sandbox.");let Y=$.organization?.id;if(!Y)throw new ug(m7);await Vx({ctx:$,connectionId:Q.connectionId,organizationId:Y,forceRefresh:!0,onLegacyMintError:(N)=>{let F=N instanceof Error?N.message:m7;throw new ug(F)}});let{cloneUrl:G,gitUserName:J,gitUserEmail:W}=await gw(Q.connectionId,Q.owner,Q.name,$.db,$.vault),K=Zj0($),H=await Z.proxyDaemonRequest(X,"/_sandbox/config",{method:"PUT",headers:new Headers({"content-type":"application/json"}),body:JSON.stringify({git:{repository:{cloneUrl:G},identity:{userName:J,userEmail:W}},...K?{operator:K}:{}})});if(!H.ok){let N=await $O(H,B$6).catch(()=>H.statusText);throw Error(`Failed to refresh sandbox git credentials (${H.status}): ${N}`)}}var B$6=10485760,ug;var Q_$=B(()=>{Pw();L81();Wp();Cn();ug=class ug extends Error{constructor($){super($);this.name="GitPushAuthError"}}});function L$6($){let Z=$.startsWith("thread:")?$.slice(7):$;if(!Z||Z.length>255||Z.includes("..")||Z.startsWith("/")||Z.endsWith("/")||Z.endsWith(".lock")||!D$6.test(Z))throw Error(`Invalid branch name: ${$}`)}function xC($){return AbortSignal.any([$.req.raw.signal,AbortSignal.timeout(j$6)])}function yC($){let{runner:Z}=$.get("vmClaim");if(!Z)return $.json({error:"No sandbox runner configured"},503);return Z}function M81($,Z){let Q=(Xj0.get($)??Promise.resolve()).catch(()=>{}).then(Z),Y=Q.catch(()=>{});return Xj0.set($,Y),Y.finally(()=>{if(Xj0.get($)===Y)Xj0.delete($)}),Q}async function _Z($,Z,X){let Q=yC($);if(Q instanceof Response)return Q;let{claimName:Y,userId:G,projectRef:J}=$.get("vmClaim"),W=X?.method??"POST",K=null,H=new Headers;if(X?.jsonBody!==void 0)K=X.jsonBody,H.set("content-type","application/json");else if(X?.forwardJsonBody)K=await $.req.text(),H.set("content-type","application/json");let N=X?.signal,F={method:W,headers:H,body:K,...N?{signal:N}:{}},U=async()=>{let w=await Q.proxyDaemonRequest(Y,Z,F);if(X?.map404to410&&w.status===404){try{await w.body?.cancel()}catch{}if(await Q.adoptLiveClaim?.({userId:G,projectRef:J},Y))w=await Q.proxyDaemonRequest(Y,Z,F);if(w.status===404){try{await w.body?.cancel()}catch{}return new Response(JSON.stringify({error:"Sandbox handle is gone. The sandbox needs to be re-provisioned."}),{status:410,headers:{"content-type":"application/json",...xY}})}}let O=await w.text(),D=X?.redactRepoDirUnlessDesktop&&Q.kind!=="user-desktop"?P$6(O):O,L=w.headers.get("content-type")??"application/json";return new Response(D,{status:w.status,headers:{"content-type":L,...xY}})};try{if(N){let w=U();return w.catch(()=>{}),await Promise.race([w,new Promise((D,L)=>{if(N.aborted)return L(N.reason);N.addEventListener("abort",()=>L(N.reason),{once:!0})})])}return await U()}catch(w){let O=w instanceof Error?w.message:String(w);return $.json({error:`Daemon unreachable: ${O}`},502)}}function P$6($){try{let Z=JSON.parse($);if(Z&&typeof Z==="object"&&!Array.isArray(Z)&&"repoDir"in Z)return JSON.stringify({...Z,repoDir:null})}catch{}return $}async function Qj0($,Z,X,Q="GET",Y){let G=await $.proxyDaemonRequest(Z,X,{method:Q,headers:new Headers,body:null});if(G.status===404&&Y){try{await G.body?.cancel()}catch{}if(await $.adoptLiveClaim?.(Y,Z))G=await $.proxyDaemonRequest(Z,X,{method:Q,headers:new Headers,body:null})}if(G.status===404){try{await G.body?.cancel()}catch{}throw Error("SANDBOX_GONE")}let J=await G.text();if(!G.ok)try{let W=JSON.parse(J);throw Error(W.error??`Daemon error (${G.status})`)}catch(W){if(W instanceof Error&&W.message!==J)throw W;throw Error(`Daemon error (${G.status})`)}return JSON.parse(J)}function A$6($){return J_$.includes($)}var D$6,Y_$=524288,E$6=65536,j$6=1e4,G_$=2000,z$6,Xj0,xY,J_$,W_$=()=>{let $=new B1;return $.use("/:virtualMcpId/:branch/*",z$6),$.post("/:virtualMcpId/:branch/write",(Z)=>_Z(Z,"/_sandbox/write",{forwardJsonBody:!0,signal:xC(Z)})),$.post("/:virtualMcpId/:branch/unlink",(Z)=>_Z(Z,"/_sandbox/unlink",{forwardJsonBody:!0,signal:xC(Z)})),$.post("/:virtualMcpId/:branch/mkdir",(Z)=>_Z(Z,"/_sandbox/mkdir",{forwardJsonBody:!0,signal:xC(Z)})),$.post("/:virtualMcpId/:branch/rename",(Z)=>_Z(Z,"/_sandbox/rename",{forwardJsonBody:!0,signal:xC(Z)})),$.post("/:virtualMcpId/:branch/read",(Z)=>_Z(Z,"/_sandbox/read",{forwardJsonBody:!0,signal:xC(Z)})),$.post("/:virtualMcpId/:branch/glob",(Z)=>_Z(Z,"/_sandbox/glob",{forwardJsonBody:!0,signal:xC(Z)})),$.post("/:virtualMcpId/:branch/grep",(Z)=>_Z(Z,"/_sandbox/grep",{forwardJsonBody:!0,signal:xC(Z)})),$.post("/:virtualMcpId/:branch/exec/:script",async(Z)=>{let X=Z.req.param("script");if(!X)return Z.json({error:"missing script name"},400);return _Z(Z,`/_sandbox/exec/${encodeURIComponent(X)}`)}),$.post("/:virtualMcpId/:branch/exec/:script/kill",async(Z)=>{let X=Z.req.param("script");if(!X)return Z.json({error:"missing script name"},400);return _Z(Z,`/_sandbox/exec/${encodeURIComponent(X)}/kill`)}),$.get("/:virtualMcpId/:branch/config",(Z)=>_Z(Z,"/_sandbox/config",{method:"GET",map404to410:!0,redactRepoDirUnlessDesktop:!0})),$.put("/:virtualMcpId/:branch/config",(Z)=>_Z(Z,"/_sandbox/config",{method:"PUT",forwardJsonBody:!0,map404to410:!0})),$.post("/:virtualMcpId/:branch/setup/:step",async(Z)=>{let X=Z.req.param("step");if(!X||!A$6(X))return Z.json({error:`step must be one of: ${J_$.join(", ")}`},400);if(X==="start"){let Q=Z.get("vmClaim");if(Q.runner){let Y=r(Z.var.studioContext),G=Hw0(Q.virtualMcpMetadata);try{await Nw0({ctx:Z.var.studioContext,runner:Q.runner,handle:Q.claimName,orgId:Y.id,userId:Q.callerUserId,entries:G})}catch(J){let W=J instanceof Error?J.message:String(J);return Z.json({error:`Failed to push env to daemon: ${W}`},502)}}}return _Z(Z,`/_sandbox/setup/${X}`,{signal:Z.req.raw.signal,map404to410:!0})}),$.get("/:virtualMcpId/:branch/events",(Z)=>{let X=Z.get("vmClaim");if(!X.runner)return sN(Z,async(Q)=>{await Q.writeSSE({event:"phase",data:JSON.stringify({kind:"failed",reason:"unknown",message:"No sandbox runner configured on this studio instance."})})});return dC$(Z,{ctx:Z.var.studioContext,claimName:X.claimName,runner:X.runner,virtualMcpId:X.virtualMcpId,branch:X.branch,userId:X.userId,projectRef:X.projectRef,virtualMcpMetadata:X.virtualMcpMetadata})}),$.get("/:virtualMcpId/:branch/git/status",(Z)=>_Z(Z,"/_sandbox/git/status",{method:"GET",map404to410:!0,signal:AbortSignal.any([Z.req.raw.signal,AbortSignal.timeout(G_$)])})),$.post("/:virtualMcpId/:branch/git/status",(Z)=>_Z(Z,"/_sandbox/git/status",{map404to410:!0,signal:AbortSignal.any([Z.req.raw.signal,AbortSignal.timeout(G_$)])})),$.post("/:virtualMcpId/:branch/git/diff",(Z)=>_Z(Z,"/_sandbox/git/diff",{forwardJsonBody:!0,map404to410:!0})),$.post("/:virtualMcpId/:branch/git/publish",async(Z)=>{let X=yC(Z);if(X instanceof Response)return X;let{claimName:Q,virtualMcpMetadata:Y,connectionIds:G}=Z.get("vmClaim"),J=Z.var.studioContext;return M81(Q,async()=>{try{await E81(J,X,Q);let W=Z_$(Y,G);if(W)await X_$(J,X,Q,W)}catch(W){if(W instanceof ug)return Z.json({error:W.message},403,xY);let K=W instanceof Error?W.message:String(W);return Z.json({error:K},502,xY)}return _Z(Z,"/_sandbox/git/publish",{forwardJsonBody:!0,map404to410:!0})})}),$.post("/:virtualMcpId/:branch/git/discard",(Z)=>{let{claimName:X}=Z.get("vmClaim");return M81(X,()=>_Z(Z,"/_sandbox/git/discard",{forwardJsonBody:!0,map404to410:!0}))}),$.post("/:virtualMcpId/:branch/git/rebase",async(Z)=>{let X=yC(Z);if(X instanceof Response)return X;let{claimName:Q}=Z.get("vmClaim"),Y=Z.var.studioContext;return M81(Q,async()=>{try{await E81(Y,X,Q)}catch(G){let J=G instanceof Error?G.message:String(G);return Z.json({error:J},502,xY)}return _Z(Z,"/_sandbox/git/rebase",{forwardJsonBody:!0,map404to410:!0})})}),$.post("/:virtualMcpId/:branch/git/suggest-commit",GZ({maxSize:Y_$,onError:(Z)=>Z.json({error:"Payload too large"},413,xY)}),async(Z)=>{let X=yC(Z);if(X instanceof Response)return X;let{claimName:Q,userId:Y,projectRef:G}=Z.get("vmClaim"),J=Z.var.studioContext;try{let W=await Z.req.json().catch(()=>({})),K=W.status,H=W.diff,N=H!=null&&typeof H.diffs==="object"&&H.diffs!==null,[F,U]=P81(K)&&N?[K,H]:await Promise.all([Qj0(X,Q,"/_sandbox/git/status","GET",{userId:Y,projectRef:G}),Qj0(X,Q,"/_sandbox/git/diff","GET",{userId:Y,projectRef:G})]),w=await tC$(J,F,U);return Z.json(w,200,xY)}catch(W){let K=W instanceof Error?W.message:String(W);if(K==="SANDBOX_GONE")return Z.json({error:"Sandbox handle is gone. The sandbox needs to be re-provisioned."},410,xY);return Z.json({error:K},502,xY)}}),$.post("/:virtualMcpId/:branch/git/judge-review",GZ({maxSize:Y_$,onError:(Z)=>Z.json({error:"Payload too large"},413,xY)}),async(Z)=>{let X=yC(Z);if(X instanceof Response)return X;let{claimName:Q,userId:Y,projectRef:G}=Z.get("vmClaim"),J=Z.var.studioContext;try{let W=await Z.req.json().catch(()=>({})),K=W.status,H=W.diff,N=H!=null&&typeof H.diffs==="object"&&H.diffs!==null,[F,U]=P81(K)&&N?[K,H]:await Promise.all([Qj0(X,Q,"/_sandbox/git/status","GET",{userId:Y,projectRef:G}),Qj0(X,Q,"/_sandbox/git/diff","GET",{userId:Y,projectRef:G})]),w=await rC$(J,F,U,typeof W.language==="string"?W.language:void 0);return Z.json(w,200,xY)}catch(W){let K=W instanceof Error?W.message:String(W);if(K==="SANDBOX_GONE")return Z.json({error:"Sandbox handle is gone. The sandbox needs to be re-provisioned."},410,xY);return Z.json({error:K},502,xY)}}),$.get("/:virtualMcpId/:branch/preview-fetch",async(Z)=>{let X=yC(Z);if(X instanceof Response)return X;let{claimName:Q}=Z.get("vmClaim"),Y=Z.req.query("path");if(!Y||!Y.startsWith("/")||Y.startsWith("//")||Y.includes("..")||Y.includes("\\"))return Z.json({error:"Path not allowed"},403);let G;try{G=await X.getPreviewUrl(Q)}catch{return Z.json({error:"Preview not available"},502)}if(!G)return Z.json({error:"Preview not available"},502);let J=G.replace(/\/+$/,""),W=q81(`${J}${Y}`),K;try{K=await fetch(W?.url??`${J}${Y}`,{...W?{headers:{host:W.hostHeader}}:{}})}catch{return Z.json({error:"Preview unreachable"},502)}let H;try{H=await K.text()}catch{return Z.json({error:"Preview unreachable"},502)}return new Response(H,{status:K.status,headers:{"content-type":K.headers.get("content-type")??"application/json"}})}),$.post("/:virtualMcpId/:branch/preview-invoke",GZ({maxSize:E$6,onError:(Z)=>Z.json({error:"Payload too large"},413)}),async(Z)=>{let X=yC(Z);if(X instanceof Response)return X;let{claimName:Q}=Z.get("vmClaim"),Y;try{Y=await X.getPreviewUrl(Q)}catch{return Z.json({error:"Preview not available"},502)}if(!Y)return Z.json({error:"Preview not available"},502);let G;try{G=await Z.req.json()}catch{return Z.json({error:"Invalid JSON body"},400)}if(!G||typeof G!=="object"||Array.isArray(G))return Z.json({error:"Invalid JSON body"},400);let J=sC$(G);if(!J)return Z.json({error:"Invalid or missing __resolveType"},400);let W=eC$(Y,J.resolveType),K=q81(W),H;try{H=await fetch(K?.url??W,{method:"POST",headers:{"content-type":"application/json",...K?{host:K.hostHeader}:{}},body:JSON.stringify(J.payload),signal:AbortSignal.timeout(30000)})}catch{return Z.json({error:"Preview unreachable"},502)}let N;try{N=await H.text()}catch{return Z.json({error:"Preview unreachable"},502)}return new Response(N,{status:H.status,headers:{"content-type":H.headers.get("content-type")??"application/json"}})}),$};var K_$=B(()=>{v8();gO();hg();hC$();FN();cC$();j3();aw();lC$();mC$();yn0();Jp();R81();aC$();$_$();Q_$();D$6=/^[a-zA-Z0-9][a-zA-Z0-9/._-]*$/;z$6=gC$(async($,Z)=>{let X=$.var.studioContext;try{$0(X)}catch{return $.json({error:"Unauthorized"},401)}let Q=W1(X);if(!Q)return $.json({error:"Unauthorized"},401);let Y;try{Y=r(X)}catch{return $.json({error:"Organization scope required"},403)}let G=$.req.param("virtualMcpId"),J=$.req.param("branch");if(!G||!J)return $.json({error:"virtualMcpId and branch are required"},400);try{L$6(J)}catch(w){let O=w instanceof Error?w.message:String(w);return $.json({error:O},400)}let W=await X.storage.virtualMcps.findById(G);if(!W||W.organization_id!==Y.id)return $.json({error:"Virtual MCP not found"},404);let K=qn({orgId:Y.id,virtualMcpId:G,branch:J}),H=await zN(X,J,Q),N=uC$({userId:H,projectRef:K}),F=W.metadata??null,U;try{U=(await hX(X,{userId:H,branch:J,virtualMcpMetadata:F})).provider}catch{U=null}if(!U)return $.json({error:"No sandbox runner found"},404);return $.set("vmClaim",{claimName:N,callerUserId:Q,runner:U,virtualMcpId:G,branch:J,userId:H,projectRef:K,virtualMcpMetadata:F,connectionIds:W.connections?.map((w)=>w.connection_id)??[]}),Z()});Xj0=new Map;xY={"Cache-Control":"no-store, no-cache, must-revalidate",Pragma:"no-cache"};J_$=["clone","install","start"]});var H_$=($)=>{let Z=new B1;if(Z.use("*",MC),Z.route("/",EE0()),Z.route("/",Ak$()),Z.route("/",IC$()),Z.route("/",AC$()),Z.route("/",sE0()),Z.route("/tools",_C$()),Z.route("/",SC$()),Z.route("/",YC$({kvStorage:$.kvStorage})),Z.route("/",XC$()),Z.route("/fs",BC$({getConnection:$.getNatsConnection})),Z.route("/sandbox",W_$()),Z.route("/",jC$()),Z.route("/deco-sites",zE0()),Z.route("/sso",FE0()),Z.route("/",eE0({tokenStorage:$.tokenStorage,automationEventDispatcher:$.automationEventDispatcher})),Z.route("/webhooks",Ok$()),$.mountDevAssets)Z.route("/dev-assets",PE0({orgFromPath:!0}));return Z.use("/mcp/:connectionId?",$.mcpAuth),Z.use("/mcp/:connectionId/ui-resource",$.mcpAuth),Z.use("/mcp/gateway/:virtualMcpId?",$.mcpAuth),Z.use("/mcp/virtual-mcp/:virtualMcpId?",$.mcpAuth),Z.use("/mcp/self",$.mcpAuth),Z.use("/mcp/task-run/:threadId",$.mcpAuth),Z.route("/",ls1()),Z.get("/mcp/:gateway?/:connectionId/.well-known/oauth-protected-resource/*",$.betterAuthProtectedResourceHandler),Z.get("/mcp/.well-known/oauth-protected-resource",$.betterAuthProtectedResourceHandler),Z.route("/mcp/task-run",LC$()),Z.route("/mcp",nO0()),Z.route("/mcp/self",aE0()),Z.route("/mcp",oO0()),Z.all("/oauth-proxy/:connectionId/*",$.oauthProxyHandler),Z.get("/watch",$.watchHandler),Z};var N_$=B(()=>{v8();g11();Bk$();d11();AE0();et();x11();QC$();GC$();DC$();fi();M11();rO0();N81();EC$();zC$();TC$();qC$();VC$();U81();vC$();w81();pO0();K_$()});function R$6($){return $.filter((Z)=>Z.vendors?.alias).map((Z)=>({name:Z.name,title:Z.title,description:Z.description,logo:Z.logo,category:Z.category,vendor:{alias:Z.vendors.alias,url:Z.vendors.url}}))}async function I$6($,Z){let X=await fetch(`${$}/rest/v1/apps?select=name,title,description,logo,category,vendors(alias,url)`,{headers:{apikey:Z,Authorization:`Bearer ${Z}`,Accept:"application/json"},signal:AbortSignal.timeout(T$6)});if(!X.ok){let Q=await X.text().catch(()=>X.statusText);throw console.error(`[deco-apps] Supabase error (${X.status}): ${Q.slice(0,200)}`),Error(`External service error (${X.status})`)}return await X.json()}var T$6=1e4,q$6=async($,Z)=>{if(!$.get("studioContext").auth.user?.id)return $.json({error:"Unauthorized"},401);return Z()},F_$=()=>{let $=new B1;return $.use("*",q$6),$.get("/",async(Z)=>{let X=c0(),Q=X.decoSupabaseUrl,Y=X.decoSupabaseServiceKey;if(!Q||!Y)return Z.json({apps:[]});try{let G=await I$6(Q,Y);return Z.json({apps:R$6(G)})}catch(G){return console.error("[deco-apps] GET error:",G),Z.json({error:"Failed to fetch apps"},502)}}),$};var U_$=B(()=>{v8();S$()});import{z as M1}from"zod";function bK($,Z="invalid_request_error",X=null,Q=null){return{error:{message:$,type:Z,param:X,code:Q}}}function x$6($){if(!$)return null;let Z=$.indexOf(":");if(Z===-1)return{credentialId:null,modelId:$};let X=$.substring(0,Z),Q=$.substring(Z+1);if(!X||!Q)return null;return{credentialId:X,modelId:Q}}function y$6($,Z,X){try{return JSON.parse($)}catch{throw new B_$(`Invalid JSON in tool call arguments for function '${X}' (tool_call_id: ${Z}): ${$}`)}}function g$6($){let Z={};for(let X of $)if(X.role==="assistant"&&X.tool_calls)for(let Q of X.tool_calls)Z[Q.id]=Q.function.name;return $.map((X)=>{switch(X.role){case"system":return{role:"system",content:X.content};case"user":if(typeof X.content==="string")return{role:"user",content:X.content};return{role:"user",content:X.content.map((Y)=>{if(Y.type==="text")return{type:"text",text:Y.text};return{type:"image",image:Y.image_url.url}})};case"assistant":if(X.tool_calls&&X.tool_calls.length>0)return{role:"assistant",content:X.tool_calls.map((Y)=>({type:"tool-call",toolCallId:Y.id,toolName:Y.function.name,input:y$6(Y.function.arguments,Y.id,Y.function.name)}))};return{role:"assistant",content:X.content??""};case"tool":let Q=Z[X.tool_call_id]??"unknown";return{role:"tool",content:[{type:"tool-result",toolCallId:X.tool_call_id,toolName:Q,output:{type:"text",value:X.content}}]}}})}function h$6($){let Z=$.map((X)=>{let Q=X.function.parameters?DY(X.function.parameters):DY({type:"object",properties:{}});return[X.function.name,_$({description:X.function.description,inputSchema:Q})]});return Object.fromEntries(Z)}function u$6($){if(!$)return;return{openai:{response_format:$}}}function c$6(){return`chatcmpl-${crypto.randomUUID().replace(/-/g,"").substring(0,29)}`}function w_$($,Z,X,Q,Y,G){let J={model:$,messages:Z,tools:X,temperature:Q.temperature,maxTokens:Q.max_tokens,topP:Q.top_p,frequencyPenalty:Q.frequency_penalty,presencePenalty:Q.presence_penalty,stopSequences:Q.stop?Array.isArray(Q.stop)?Q.stop:[Q.stop]:void 0,abortSignal:G};return Y?{...J,providerOptions:Y}:J}function O_$($){if($==="tool-calls")return"tool_calls";if($==="length")return"length";return"stop"}var M$6=256,k$6,S$6,V$6,C$6,_$6,v$6,b$6,f$6,B_$,D_$,L_$;var E_$=B(()=>{S4();v8();hg();CN();k$6=M1.object({type:M1.literal("function"),function:M1.object({name:M1.string(),description:M1.string().optional(),parameters:M1.record(M1.string(),M1.unknown()).optional()})}),S$6=M1.object({id:M1.string(),type:M1.literal("function"),function:M1.object({name:M1.string(),arguments:M1.string()})}),V$6=M1.discriminatedUnion("role",[M1.object({role:M1.literal("system"),content:M1.string(),name:M1.string().optional()}),M1.object({role:M1.literal("user"),content:M1.union([M1.string(),M1.array(M1.union([M1.object({type:M1.literal("text"),text:M1.string()}),M1.object({type:M1.literal("image_url"),image_url:M1.object({url:M1.string(),detail:M1.string().optional()})})]))]),name:M1.string().optional()}),M1.object({role:M1.literal("assistant"),content:M1.string().nullable().optional(),name:M1.string().optional(),tool_calls:M1.array(S$6).optional()}),M1.object({role:M1.literal("tool"),content:M1.string(),tool_call_id:M1.string()})]),C$6=M1.object({type:M1.literal("text")}),_$6=M1.object({type:M1.literal("json_object")}),v$6=M1.object({type:M1.literal("json_schema"),json_schema:M1.object({name:M1.string(),description:M1.string().optional(),schema:M1.record(M1.string(),M1.unknown()),strict:M1.boolean().optional()})}),b$6=M1.union([C$6,_$6,v$6]),f$6=M1.object({model:M1.string().describe("Format: 'model_id' or 'credential_id:model_id'"),messages:M1.array(V$6),stream:M1.boolean().optional().default(!1),temperature:M1.number().min(0).max(2).optional(),max_tokens:M1.number().positive().optional(),top_p:M1.number().min(0).max(1).optional(),frequency_penalty:M1.number().min(-2).max(2).optional(),presence_penalty:M1.number().min(-2).max(2).optional(),stop:M1.union([M1.string(),M1.array(M1.string())]).optional(),tools:M1.array(k$6).optional(),tool_choice:M1.union([M1.literal("auto"),M1.literal("none"),M1.literal("required"),M1.object({type:M1.literal("function"),function:M1.object({name:M1.string()})})]).optional(),response_format:b$6.optional(),user:M1.string().optional()});B_$=class B_$ extends Error{constructor($){super($);this.name="MessageConversionError"}};D_$=new B1;D_$.post("/:org/v1/chat/completions",async($)=>{let Z=$.get("studioContext"),X=$.req.param("org");try{if(!Z.auth.apiKey?.id)return $.json(bK("API key authentication required. Provide a valid API key via Authorization header.","authentication_error"),401);if(!Z.organization)return $.json(bK("Organization context is required. Ensure your API key has organization metadata.","invalid_request_error","organization"),400);if((Z.organization.slug??Z.organization.id)!==X)return $.json(bK("Organization mismatch. The API key's organization does not match the requested organization.","invalid_request_error","organization"),403);let Q=await $.req.json(),Y=f$6.safeParse(Q);if(!Y.success){let L=Y.error.issues[0]??{message:"Invalid request",path:[]};return $.json(bK(`Invalid request: ${L.message}`,"invalid_request_error",L.path.length>0?L.path.join("."):null),400)}let G=Y.data,J=x$6(G.model);if(!J)return $.json(bK("Invalid model format. Expected 'model_id' or 'credential_id:model_id' (e.g., 'claude-sonnet-4-6' or 'key_abc123:claude-sonnet-4-6')","invalid_request_error","model"),400);let{credentialId:W}=J,{modelId:K}=J;if(!W){let E=(await Z.storage.aiProviderKeys.list({organizationId:Z.organization.id})).find((j)=>aB(j.providerId));if(!E)return $.json(bK("No AI provider credentials configured for this organization. Add a credential in settings or specify one explicitly via 'credential_id:model_id'.","invalid_request_error","model"),400);W=E.id}let H;try{H=await Z.aiProviders.activate(W,Z.organization.id)}catch{return $.json(bK(`AI provider credential not found or inaccessible: ${W}`,"invalid_request_error","model"),404)}let N=H.aiSdk.languageModel(K),F=g$6(G.messages),U=G.tools?h$6(G.tools):void 0,w=u$6(G.response_format),O=c$6(),D=Math.floor(Date.now()/1000);if(G.stream)return sN($,async(L)=>{let E=w_$(N,F,U,G,w,$.req.raw.signal);try{let j=xw(E),z=!1,A=0,P="",M=async()=>{if(P.length===0)return;let k=P;P="",await L.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:D,model:G.model,choices:[{index:0,delta:{content:k},finish_reason:null}]})})};for await(let k of j.fullStream){if(!z&&(k.type==="text-delta"||k.type==="tool-call"))await L.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:D,model:G.model,choices:[{index:0,delta:{role:"assistant",content:""},finish_reason:null}]})}),z=!0;if(k.type==="text-delta"){if(P+=k.text,P.length>=M$6)await M()}else if(k.type==="tool-call"){await M();let q=A++;await L.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:D,model:G.model,choices:[{index:0,delta:{tool_calls:[{index:q,id:k.toolCallId,type:"function",function:{name:k.toolName,arguments:JSON.stringify(k.input)}}]},finish_reason:null}]})})}else if(k.type==="finish")await M(),await L.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:D,model:G.model,choices:[{index:0,delta:{},finish_reason:O_$(k.finishReason)}],usage:k.totalUsage?{prompt_tokens:k.totalUsage.inputTokens??0,completion_tokens:k.totalUsage.outputTokens??0,total_tokens:k.totalUsage.totalTokens??0}:void 0})})}await M(),await L.writeSSE({data:"[DONE]"})}catch(j){let z=j;console.error("[openai-compat:stream] Error:",z.message),await L.writeSSE({data:JSON.stringify({error:{message:z.message,type:"server_error"}})})}});else{let L=w_$(N,F,U,G,w,$.req.raw.signal),E=await bw(L),j={role:"assistant",content:E.text||null};if(E.toolCalls&&E.toolCalls.length>0)j.tool_calls=E.toolCalls.map((z)=>({id:z.toolCallId,type:"function",function:{name:z.toolName,arguments:JSON.stringify("input"in z?z.input:{})}})),j.content=null;return $.json({id:O,object:"chat.completion",created:D,model:G.model,choices:[{index:0,message:j,finish_reason:O_$(E.finishReason)}],usage:{prompt_tokens:E.usage?.inputTokens??0,completion_tokens:E.usage?.outputTokens??0,total_tokens:E.usage?.totalTokens??0}})}}catch(Q){let Y=Q;if(Y.name==="AbortError")return $.json(bK("Request aborted","invalid_request_error"),400);if(Y.name==="MessageConversionError")return $.json(bK(Y.message,"invalid_request_error","messages"),400);return console.error("[openai-compat] Error:",Y.message,Y.stack),$.json(bK(Y.message,"server_error"),500)}});L_$=D_$});var z_$;var j_$=B(()=>{z_$={name:"decocms",version:"4.192.8",description:"Deco CMS \u2014 Self-hostable MCP Gateway for managing AI connections and tools",author:"Deco team",repository:{type:"git",url:"git+https://github.com/decocms/studio.git",directory:"apps/api"},bugs:{url:"https://github.com/decocms/studio/issues"},type:"module",bin:{deco:"./dist/server/cli.js"},files:["dist/**/*"],scripts:{dev:"bun run migrate && bun run dev:server","dev:server":"bun run --cwd=../../packages/sandbox build && NODE_ENV=development bun --env-file=.env --hot run src/index.ts",build:"bun run build:server","build:server":"bun run scripts/bundle-server-script.ts --dist ./dist/server","generate:tool-contracts":"bun run scripts/generate-tool-contracts.ts","db:migrate":"bun run ./dist/server/migrate.js",check:"tsc --noEmit",start:"bun run ./dist/server/server.js",migrate:"bun run src/database/migrate.ts",test:"bun test src","better-auth:migrate":"bunx --bun @better-auth/cli migrate -y --config src/auth/index.ts",prepublishOnly:"bun run --cwd=../.. build:studio"},optionalDependencies:{"@duckdb/node-api":"^1.5.0-r.1"},dependencies:{"@ai-sdk/anthropic":"^3.0.85","@ai-sdk/google":"^3.0.83","@ai-sdk/openai":"^3.0.73","@anthropic-ai/sdk":"^0.105.0","@aws-sdk/client-s3":"^3.1013.0","@aws-sdk/client-sts":"^3.1013.0","@aws-sdk/lib-storage":"^3.1013.0","@aws-sdk/s3-request-presigner":"^3.1013.0","@clickhouse/client":"^1.8.1","@dbos-inc/dbos-sdk":"^4.21.6","@inkjs/ui":"^2.0.0","@nats-io/jetstream":"3.4.0","@nats-io/kv":"3.4.0","@nats-io/nats-core":"3.4.0","@nats-io/transport-node":"3.4.0","@openrouter/ai-sdk-provider":"^2.9.1","@opentelemetry/core":"^2.6.0","embedded-postgres":"^18.3.0-beta.16",ink:"^6.8.0",kysely:"^0.28.12","posthog-node":"^5.0.0",react:"^19.2.6","react-dom":"^19.2.6"},devDependencies:{"@ai-sdk/provider":"^3.0.10","@better-auth/sso":"1.4.1","@decocms/better-auth":"1.5.17","@decocms/bindings":"workspace:*","@decocms/mcp-utils":"workspace:*","@decocms/runtime":"workspace:*","@decocms/sandbox":"workspace:*","@decocms/shared":"workspace:*","@jitl/quickjs-wasmfile-release-sync":"0.31.0","@modelcontextprotocol/sdk":"1.29.0","@nats-io/jwt":"0.0.10-5","@opentelemetry/api":"^1.9.0","@opentelemetry/api-logs":"^0.211.0","@opentelemetry/exporter-logs-otlp-proto":"^0.211.0","@opentelemetry/exporter-prometheus":"^0.208.0","@opentelemetry/exporter-trace-otlp-proto":"^0.207.0","@opentelemetry/instrumentation-runtime-node":"^0.24.0","@opentelemetry/resources":"^2.6.0","@opentelemetry/sdk-logs":"^0.211.0","@opentelemetry/sdk-metrics":"^2.2.0","@opentelemetry/sdk-node":"^0.207.0","@opentelemetry/sdk-trace-base":"^2.5.0","@types/bun":"^1.3.1","@types/google.maps":"^3.65.2","@types/pg":"^8.15.6","@types/react-syntax-highlighter":"^15.5.13","@vercel/nft":"^1.1.1",ai:"^6.0.208","better-auth":"1.4.22",croner:"^9.1.0",degit:"^2.8.4",hono:"^4.10.7",jose:"^6.0.11",nanoid:"^5.1.6",pg:"^8.16.3",typescript:"^7.0.2",typescript5:"npm:typescript@^5.9.3",zod:"4.3.6"},homepage:"https://github.com/decocms/studio",keywords:["mcp","model-context-protocol","ai","gateway","self-hosted","tools"],license:"MIT",publishConfig:{access:"public"}}});function m$6(){let $=process.env.POSTHOG_KEY;if(!$)return null;return{key:$,host:process.env.POSTHOG_HOST??d$6}}var P_$,d$6="https://ph.studio.decocms.com",A_$;var T_$=B(()=>{v8();cC0();hV();BZ();S$();A11();j_$();P_$=new B1;P_$.get("/",($)=>{let Z={version:z_$.version,theme:iM1(),...XD().logo&&{logo:XD().logo},...NK()&&{internalUrl:p21()},...c0().enableDecoImport&&{enableDecoImport:!0},brandExtractEnabled:!!c0().firecrawlApiKey,auth:SM$(),posthog:m$6(),googleMapsApiKey:process.env.GOOGLE_MAPS_API_KEY?.trim()||null,runtime:{agentSandbox:!NK()&&c0().sandboxProviderKind==="agent-sandbox"}};return $.header("Cache-Control","no-store"),$.json({success:!0,config:Z})});A_$=P_$});function cg($){let Z=($??"").trim().toLowerCase();return Z=Z.replace(/^https?:\/\//,""),Z=Z.replace(/^www\./,""),Z=Z.split(/[/?#]/)[0]??"",Z.replace(/\/+$/,"")}function k81($){return(cg($).split(".")[0]||$).replace(/[-_]/g," ").split(" ").filter(Boolean).map((X)=>X.charAt(0).toUpperCase()+X.slice(1)).join(" ")}function I_$($,Z=64){return`https://www.google.com/s2/favicons?domain=${encodeURIComponent(cg($))}&sz=${Z}`}function R_$($,Z){let X=$.trim();if(X.length<=Z)return X;let Q=X.slice(0,Z-1),Y=Q.lastIndexOf(" ");return`${(Y>Z*0.6?Q.slice(0,Y):Q).trimEnd()}\u2026`}function q_$($){let{brand:Z,domain:X,score:Q,verdict:Y}=$,G=typeof Q==="number"?`${Z} commerce report \u2014 ${Math.round(Q)}/100 \xB7 decocms`:`${Z} commerce report \xB7 decocms`,J=`See the full ${Z} scorecard \u2014 SEO, performance, conversion & AEO signals scored by decocms.`,W=Y?.trim()?R_$(`${Y.trim().replace(/\s+/g," ")} \u2014 ${J}`,200):R_$(`How does ${X} really perform? ${J}`,200);return{title:G,description:W}}import{z as l0}from"zod";var gC,i$6,n$6,p$6,t$6,M_$;var k_$=B(()=>{gC=l0.enum(["good","bad","neutral"]),i$6=l0.preprocess(($)=>{if(Array.isArray($))return{kind:"text",value:$.find((X)=>X!==null&&typeof X!=="object")??""};return $!==null&&typeof $==="object"?$:{kind:"text",value:$}},l0.object({kind:l0.enum(["text","number","sparkline","badge","score"]).catch("text"),value:l0.coerce.string().optional(),tone:gC.optional(),muted:l0.boolean().optional(),delta:l0.coerce.string().optional(),deltaDir:l0.enum(["up","down","neutral"]).optional(),points:l0.array(l0.coerce.number()).optional(),label:l0.coerce.string().optional()}).transform(($)=>{if($.kind==="badge"&&$.label==null)$.label=$.value??"";if($.kind==="score"){let Z=Number($.value);if(Number.isNaN(Z))return{...$,kind:"text"}}return $})),n$6=l0.preprocess(($)=>{let Z=$;if(Z&&typeof Z==="object"&&!Array.isArray(Z)&&Array.isArray(Z.cells))Z=Z.cells;if(Array.isArray(Z)&&Z.length===1&&Array.isArray(Z[0]))Z=Z[0];if(Array.isArray(Z))return Z;if(Z&&typeof Z==="object")return Object.values(Z);return Z},l0.array(i$6)),p$6={key:l0.coerce.string(),title:l0.coerce.string(),eyebrow:l0.coerce.string().optional(),headline:l0.coerce.string(),annotation:l0.coerce.string().optional(),methodology:l0.coerce.string().optional(),sources:l0.array(l0.object({name:l0.coerce.string(),logoUrl:l0.coerce.string()})).optional()},t$6=l0.discriminatedUnion("template",[l0.object({template:l0.literal("cover"),score:l0.object({value:l0.coerce.number(),max:l0.coerce.number().optional(),grade:l0.coerce.string().optional(),label:l0.coerce.string().optional()}).optional(),brandImage:l0.coerce.string().optional(),screenshot:l0.coerce.string().optional(),mobileScreenshot:l0.coerce.string().optional()}),l0.object({template:l0.literal("cta"),ctaUrl:l0.coerce.string().optional(),ctaLabel:l0.coerce.string().optional(),bullets:l0.array(l0.coerce.string()).optional()}),l0.object({template:l0.literal("series"),points:l0.array(l0.coerce.number()).min(2),xLabels:l0.array(l0.coerce.string()).min(1),unit:l0.coerce.string().optional(),callout:l0.object({index:l0.coerce.number(),value:l0.coerce.string(),tone:gC.optional()})}),l0.object({template:l0.literal("threshold"),value:l0.coerce.string().default(""),metricLabel:l0.coerce.string().optional(),ratio:l0.coerce.number(),thresholdRatio:l0.coerce.number().optional(),thresholdLabel:l0.coerce.string().default(""),tone:gC.optional()}),l0.object({template:l0.literal("stats"),stats:l0.array(l0.object({value:l0.coerce.string(),label:l0.coerce.string(),tone:gC.optional()})).min(1)}),l0.object({template:l0.literal("bars"),items:l0.array(l0.object({value:l0.coerce.string(),label:l0.coerce.string(),ratio:l0.coerce.number(),tone:gC.optional()})).min(1)}),l0.object({template:l0.literal("gauges"),gauges:l0.array(l0.object({label:l0.coerce.string(),value:l0.coerce.string(),status:l0.enum(["good","warn","bad"]).catch("warn"),caption:l0.coerce.string().optional(),ratio:l0.coerce.number().optional()})).min(1)}),l0.object({template:l0.literal("checklist"),checks:l0.array(l0.object({label:l0.coerce.string(),status:l0.enum(["pass","fail","warn"]).catch("fail"),value:l0.coerce.string().optional()})).min(1)}),l0.object({template:l0.literal("table"),columns:l0.array(l0.object({label:l0.coerce.string(),align:l0.enum(["left","right"]).optional()})).min(1),rows:l0.array(n$6).min(1),highlightRow:l0.coerce.number().optional()}),l0.object({template:l0.literal("products"),products:l0.array(l0.object({name:l0.coerce.string(),price:l0.coerce.string().optional(),image:l0.coerce.string().optional(),url:l0.coerce.string().optional()})).min(1)}),l0.object({template:l0.literal("list"),entries:l0.array(l0.object({label:l0.coerce.string(),severity:l0.enum(["error","warning","notice"]).catch("notice")})).min(1),moreCount:l0.coerce.number().optional()}),l0.object({template:l0.literal("keywords"),volumeLabel:l0.coerce.string().optional(),keywords:l0.array(l0.object({term:l0.coerce.string(),volume:l0.coerce.string(),position:l0.coerce.number().catch(0)})).min(1)}),l0.object({template:l0.literal("competitor"),metricLabel:l0.coerce.string().optional(),competitors:l0.array(l0.object({name:l0.coerce.string(),value:l0.coerce.string(),tone:gC.optional(),isYou:l0.boolean().optional()})).min(1)}),l0.object({template:l0.literal("scorecard"),rivalLabel:l0.coerce.string().optional(),dimensions:l0.array(l0.object({label:l0.coerce.string(),you:l0.coerce.string(),rival:l0.coerce.string().optional(),rivalName:l0.coerce.string().optional(),tone:gC.optional()})).min(1)})]),M_$=l0.object({...p$6,template:t$6})});function Yj0($){let Z=[],X=[...$.sections].sort((Q,Y)=>Q.position-Y.position).map((Q)=>{let Y=M_$.safeParse(Q.props);if(Y.success)return Y.data;let G=Y.error.issues[0];return Z.push({section_type:Q.section_type,position:Q.position,reason:G?`${G.path.join(".")||"(root)"}: ${G.message}`:"contract violation"}),null}).filter((Q)=>Q!==null);return{deck:{meta:{...$.meta,scores:$.summary?.scores},slides:X},drops:Z}}var S81=B(()=>{k_$()});import{join as S_$}from"path";async function r$6($){try{let Z=await fetch(`${LW({})}/api/v2/public/diagnostics/${encodeURIComponent($)}`,{headers:{Accept:"application/json"},signal:AbortSignal.timeout(o$6)});if(!Z.ok)return null;let X=await Z.json(),{deck:Q}=Yj0(X);if(!Q.slides.length)return null;let Y=Q.slides.find((W)=>W.template.template==="cover"),G=Y?.template,J=G&&G.template==="cover"?G:void 0;return{brand:Q.meta.brand?.trim()||k81($),score:Q.meta.scores?.cover??J?.score?.value,verdict:Y?.annotation?.trim()||Y?.headline?.trim()||void 0}}catch{return null}}function yY($){return $.replaceAll("&","&amp;").replaceAll("<","&lt;").replaceAll(">","&gt;").replaceAll('"',"&quot;")}function a$6($,Z){let X=cg($),Q=Z?.brand?.trim()||k81(X),Y=I_$(X,128),J=`${(c0().baseUrl??"https://studio.decocms.com").replace(/\/+$/,"")}/report/${encodeURIComponent(X)}`,{title:W,description:K}=q_$({brand:Q,domain:X,score:Z?.score,verdict:Z?.verdict}),H=`${J}/og.png`,N=`${Q} commerce report by decocms`;return[`<title>${yY(W)}</title>`,`<meta name="description" content="${yY(K)}" />`,'<meta name="robots" content="noindex, follow" />','<meta property="og:type" content="website" />','<meta property="og:site_name" content="decocms" />',`<meta property="og:title" content="${yY(W)}" />`,`<meta property="og:description" content="${yY(K)}" />`,`<meta property="og:url" content="${yY(J)}" />`,`<meta property="og:image" content="${yY(H)}" />`,'<meta property="og:image:width" content="1200" />','<meta property="og:image:height" content="630" />',`<meta property="og:image:alt" content="${yY(N)}" />`,'<meta name="twitter:card" content="summary_large_image" />',`<meta name="twitter:title" content="${yY(W)}" />`,`<meta name="twitter:description" content="${yY(K)}" />`,`<meta name="twitter:image" content="${yY(H)}" />`,`<meta name="twitter:image:alt" content="${yY(N)}" />`,`<link rel="canonical" href="${yY(J)}" />`,`<link rel="icon" href="${yY(Y)}" sizes="any" />`].join(`
     `)}function s$6($,Z){return $.replace(/<title>[\s\S]*?<\/title>\s*/i,"").replace(/<meta\s+name="(?:description|twitter:[^"]*)"[^>]*>\s*/gi,"").replace(/<meta\s+property="og:[^"]*"[^>]*>\s*/gi,"").replace(/<link\s+rel="icon"[^>]*>\s*/gi,"").replace("</head>",`    ${Z}
   </head>`)}function V_$($){let Z=new B1;return Z.get("/:domain/og.png",async(X)=>{let Q=cg(X.req.param("domain")),Y=async()=>{let G=$?Bun.file(S_$($,"report-og-fallback.png")):null;if(!G||!await G.exists())return X.notFound();return X.body(new Uint8Array(await G.arrayBuffer()),200,{"Content-Type":"image/png","Cache-Control":"public, max-age=0, s-maxage=3600"})};try{let G=await fetch(`${LW({})}/api/v2/public/diagnostics/${encodeURIComponent(Q)}/og.png`,{signal:AbortSignal.timeout(e$6)}),J=G.headers.get("content-type")??"";if(!G.ok||!J.startsWith("image/")||!G.body)return Y();return X.body(G.body,200,{"Content-Type":J,"Cache-Control":"public, max-age=0, s-maxage=604800"})}catch{return Y()}}),Z.get("/:domain",async(X)=>{let Q=X.req.param("domain"),Y=$?S_$($,"index.html"):null,G=Y?Bun.file(Y):null;if(!G||!await G.exists())return X.notFound();let J=await G.text();try{let W=await r$6(cg(Q)),K=a$6(Q,W);return X.html(s$6(J,K),200,{"Cache-Control":"public, max-age=0, s-maxage=300"})}catch{return X.html(J)}}),Z}var o$6=2500,e$6=1e4;var C_$=B(()=>{v8();S81();SD();S$()});function qo($,Z){return fetch(`${LW({})}${$}`,Z)}async function $86($,Z,X){let Q=new URLSearchParams;if(Z)Q.set("pw",Z);if(X)Q.set("lang",X);let Y=Q.toString()?`?${Q.toString()}`:"",G=await qo(`/api/v2/public/diagnostics/${encodeURIComponent($)}${Y}`,{headers:{Accept:"application/json"}});if(G.status===404)return{status:"not_found",deck:null,scanned_at:null,drops:[]};if(!G.ok)throw Error(`report read HTTP ${G.status}`);let J=await G.json(),{deck:W,drops:K}=Yj0(J);return{status:W.slides.length?"ready":"empty",deck:W,scanned_at:J.scanned_at,drops:K}}var Z86,x3,Gj0=async($,Z)=>{if(!$.get("reportUser"))return $.json({error:"Authentication required"},401);await Z();return},__$;var v_$=B(()=>{v8();qG();SD();S81();Z86=new Set(["complete","errored","terminated","unknown"]),x3=new B1;x3.use("*",async($,Z)=>{let X=await E8.api.getSession({headers:$.req.raw.headers});$.set("reportUser",X?.user?.id?{email:X.user.email}:void 0),await Z(),$.header("Cache-Control","private, no-store"),$.header("Vary","Cookie");return});x3.use("/run",Gj0);x3.use("/status",Gj0);x3.use("/link-token/*",Gj0);x3.use("/suggest",Gj0);x3.get("/site/:domain",async($)=>{let Z=$.req.param("domain").trim();if(!Z)return $.json({error:"domain is required"},400);let X=$.get("reportUser"),Q=$.req.query("key")?.trim()||void 0,Y=$.req.query("lang")?.trim()||void 0;try{let G=await $86(Z,Q,Y);if($.header("Cache-Control","private, no-store"),X||!G.deck)return $.json(G);return $.json({...G,deck:{...G.deck,slides:G.deck.slides.slice(0,1)},truncated:G.status==="ready"})}catch{return $.json({error:"report read failed"},502)}});x3.post("/run",async($)=>{let Z=$.get("reportUser"),X;try{X=await $.req.json()}catch{return $.json({error:"invalid JSON"},400)}let Q=typeof X.domain==="string"?X.domain.trim():"";if(!Q)return $.json({error:"domain is required"},400);let Y=Z.email,G=typeof X.distinctId==="string"&&X.distinctId.trim()&&X.distinctId.length<=200?X.distinctId.trim():void 0;try{let J=await qo("/api/v2/diagnostics/run",{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${kD({})}`},body:JSON.stringify({url:Q,email:Y,distinct_id:G})});if(!J.ok)return $.json({error:`run HTTP ${J.status}`},502);let W=await J.json(),K=W.blocked?{state:"blocked"}:W.status==="fresh"?{state:"fresh"}:W.mode==="sync"?{state:"sync"}:{state:"running",id:W.id??null};return $.json(K)}catch{return $.json({error:"run failed"},502)}});x3.get("/status",async($)=>{let Z=$.req.query("id");if(!Z)return $.json({error:"id is required"},400);try{let X=await qo(`/api/v2/diagnostics/status?id=${encodeURIComponent(Z)}`,{headers:{Authorization:`Bearer ${kD({})}`}});if(!X.ok)return $.json({error:`status HTTP ${X.status}`},502);let Y=(await X.json()).status??"unknown",G={done:Z86.has(Y),status:Y};return $.json(G)}catch{return $.json({error:"status failed"},502)}});x3.get("/link-token/:id",async($)=>{let Z=$.req.param("id");try{let X=await qo(`/api/v2/public/link-tokens/${encodeURIComponent(Z)}`,{headers:{Accept:"application/json"}});if(X.status===404)return $.json(null);if(!X.ok)return $.json({error:`link token HTTP ${X.status}`},502);return $.json(await X.json())}catch{return $.json({error:"link token resolve failed"},502)}});x3.get("/suggest",async($)=>{let Z=($.req.query("q")??"").trim().slice(0,64);if(Z.length<2)return $.json({suggestions:[]});try{let X=await qo(`/api/v2/public/suggest?q=${encodeURIComponent(Z)}`,{headers:{Accept:"application/json"}});if(!X.ok)return $.json({suggestions:[]});let Q=await X.json();return $.json({suggestions:Array.isArray(Q.suggestions)?Q.suggestions:[]})}catch{return $.json({suggestions:[]})}});__$=x3});import{createHmac as X86,timingSafeEqual as Q86}from"crypto";function b_$($,Z,X,Q=Date.now()){if(!Z||!X)return!1;let Y,G=[];for(let H of Z.split(",")){let N=H.indexOf("=");if(N<=0)continue;let F=H.slice(0,N).trim(),U=H.slice(N+1).trim();if(F==="t")Y=U;else if(F==="v1")G.push(U)}if(!Y||G.length===0)return!1;let J=Number(Y);if(!Number.isFinite(J)||Math.abs(Q/1000-J)>Y86)return!1;let W=X86("sha256",X).update(`${Y}.${$}`).digest("hex"),K=Buffer.from(W,"hex");return G.some((H)=>{let N=Buffer.from(H,"hex");return K.length===N.length&&Q86(K,N)})}function f_$($){let Z;try{Z=JSON.parse($)}catch{return null}let X=oG(Z),Q=oG(oG(X?.data)?.object);if(!X||typeof X.type!=="string"||!Q)return null;return{id:fK(X.id),type:X.type,created:typeof X.created==="number"?X.created:void 0,livemode:typeof X.livemode==="boolean"?X.livemode:void 0,data:{object:Q}}}function G86($){switch($){case"active":case"trialing":return"active";case"past_due":return"past_due";default:return"canceled"}}function fK($){return typeof $==="string"?$:void 0}function oG($){return typeof $==="object"&&$!==null?$:void 0}function Jj0($){return typeof $==="number"?new Date($*1000):null}function _81($){return fK($)??fK(oG($)?.id)}function J86($){return _81($.subscription)??fK(oG(oG($.parent)?.subscription_details)?.subscription)}function W86($){let Z=Jj0($.current_period_end);if(Z)return Z;let X=oG($.items)?.data;if(!Array.isArray(X))return null;let Q=0;for(let Y of X){let G=oG(Y)?.current_period_end;if(typeof G==="number"&&G>Q)Q=G}return Q>0?new Date(Q*1000):null}function V81($,Z){let X=Jj0($.created);return!!X&&!!Z.lastStripeEventAt&&X<Z.lastStripeEventAt}function C81($,Z){let X=Jj0($.created);if(!X)return;return Z.lastStripeEventAt&&Z.lastStripeEventAt>X?void 0:X}async function K86($,Z){let X=Z.data.object;switch(Z.type){case"checkout.session.completed":case"checkout.session.async_payment_succeeded":{let Q=fK(oG(X.metadata)?.orgId);if(!Q)return{handled:!1,reason:"no orgId"};if(fK(oG(X.metadata)?.kind)==="topup"){if(X.mode!=="payment")return{handled:!1,reason:"topup with wrong mode"};if(fK(X.payment_status)!=="paid")return{handled:!1,reason:"payment not confirmed"};let J=fK(X.id);if(!J)return console.error("stripe webhook: topup session without id",{eventId:Z.id,organizationId:Q}),{handled:!1,reason:"topup session without id"};let W=Number(oG(X.metadata)?.creditCents);if(!Number.isInteger(W)||W<=0)return console.error("stripe webhook: paid topup with bad metadata \u2014 credit NOT applied",{eventId:Z.id,organizationId:Q,creditCents:oG(X.metadata)?.creditCents}),{handled:!1,reason:"bad topup metadata"};return{handled:!0,organizationId:Q,topUp:{creditCents:W,referenceId:`stripe-topup:${J}`}}}if(X.mode!=="subscription")return{handled:!1,reason:"not a subscription checkout"};if(fK(X.payment_status)!=="paid")return{handled:!1,reason:"payment not confirmed"};let Y=await $.getBilling(Q);if(!Y)return{handled:!1,reason:"unknown org"};let G=_81(X.subscription);if(Y.stripeSubscriptionId&&G&&Y.stripeSubscriptionId!==G)return console.error("stripe webhook: refused checkout rebind",{organizationId:Q,eventId:Z.id}),{handled:!1,reason:"org already bound to another subscription",orphanSubscriptionId:G};if(V81(Z,Y))return{handled:!1,reason:"stale event"};return await $.updateStripeState(Q,{stripeCustomerId:_81(X.customer),stripeSubscriptionId:G,status:"active",lastStripeEventAt:C81(Z,Y)}),{handled:!0,organizationId:Q}}case"customer.subscription.updated":case"customer.subscription.deleted":{let Q=fK(X.id);if(!Q)return{handled:!1,reason:"no sub id"};let Y=await $.getBillingByStripeSubscriptionId(Q);if(!Y)return{handled:!1,reason:"unknown subscription"};let G=Z.type==="customer.subscription.deleted";if(!G&&V81(Z,Y))return{handled:!1,reason:"stale event"};let J=G?"canceled":G86(X.status);return await $.updateStripeState(Y.organizationId,{status:J,currentPeriodEnd:W86(X),...G&&{stripeSubscriptionId:null},lastStripeEventAt:C81(Z,Y)}),{handled:!0,organizationId:Y.organizationId}}case"invoice.paid":{let Q=J86(X);if(!Q)return{handled:!1,reason:"no sub id"};let Y=await $.getBillingByStripeSubscriptionId(Q);if(!Y)return{handled:!1,reason:"unknown subscription"};if(V81(Z,Y))return{handled:!1,reason:"stale event"};return await $.updateStripeState(Y.organizationId,{status:"active",currentPeriodEnd:Jj0(X.period_end),lastStripeEventAt:C81(Z,Y)}),{handled:!0,organizationId:Y.organizationId}}default:return{handled:!1,reason:`unhandled event ${Z.type}`}}}async function x_$($){let Z=new kW(c8().db),X=await K86(Z,$);if(X.handled&&X.topUp)await hF$({organizationId:X.organizationId,amountCents:X.topUp.creditCents,referenceId:X.topUp.referenceId});if(!X.handled&&X.orphanSubscriptionId)try{await S1$(X.orphanSubscriptionId),console.error("stripe webhook: canceled orphan subscription",{subscriptionId:X.orphanSubscriptionId,eventId:$.id})}catch(Q){if(!(Q instanceof K3&&(Q.status===400||Q.status===404)))throw Q}return X}var Y86=300;var y_$=B(()=>{GG();Wn();Kr0()});var H86=1048576,v81;var g_$=B(()=>{v8();gO();S$();y_$();v81=new B1;v81.post("/webhook",GZ({maxSize:H86,onError:($)=>$.json({error:"payload too large"},413)}),async($)=>{let Z=c0().stripeWebhookSecret;if(!Z)return $.json({error:"stripe billing not configured"},503);let X=await $.req.text();if(!b_$(X,$.req.header("stripe-signature"),Z))return $.json({error:"invalid signature"},400);let Y=f_$(X);if(!Y)return $.json({error:"invalid payload"},400);let G=await x_$(Y);return console.log("stripe webhook",{eventId:Y.id,type:Y.type,livemode:Y.livemode,...G}),$.json({received:!0})})});import{timingSafeEqual as N86}from"crypto";function U86($,Z,X){if(!Z?.startsWith("sha256="))return!1;let Q=new Bun.CryptoHasher("sha256",X).update($).digest("hex"),Y=Z.slice(7);if(Y.length!==Q.length)return!1;return N86(Buffer.from(Y),Buffer.from(Q))}var F86=5242880,b81;var h_$=B(()=>{v8();gO();Qp();b81=new B1;b81.post("/webhook",GZ({maxSize:F86,onError:($)=>$.json({error:"payload too large"},413)}),async($)=>{let Z=process.env.GITHUB_WEBHOOK_SECRET;if(!Z)return $.json({error:"github webhook not configured"},503);let X=await $.req.text();if(!U86(X,$.req.header("x-hub-signature-256"),Z))return $.json({error:"invalid signature"},400);if($.req.header("x-github-event")!=="push")return $.json({ok:!0,ignored:"event"});let Q;try{Q=JSON.parse(X)}catch{return $.json({error:"invalid payload"},400)}let Y=Q.ref,G=Q.repository?.full_name;if(!Y||!G)return $.json({ok:!0,ignored:"shape"});let W=(await _n0())?.markTenantPoolsDirty(G,Y)??[];return $.json({ok:!0,pools:W})})});function u_$($,Z){if(Z.startsWith("text/html")||Z.startsWith("image/svg"))$.set("Content-Security-Policy","sandbox allow-scripts allow-modals allow-same-origin")}var c_$,w86,O86,l_$;var d_$=B(()=>{v8();RJ();Yy();Av();c_$=new B1,w86=["range","if-none-match","if-modified-since"],O86=["content-type","content-length","content-range","accept-ranges","etag","last-modified"];c_$.get("/:org/files/*",async($)=>{let Z=$.get("studioContext"),X=Z.organization?.id;if(!Z.auth?.user?.id){if(zg($))return $.redirect(`/login?next=${encodeURIComponent($.req.path)}`,302);throw new Q$(401,{message:"Authentication required"})}if(!X)throw new Q$(401,{message:"Organization context required"});let Q=$.req.path.replace(/^.*\/files\//,"");if(!Q)throw new Q$(400,{message:"Missing file key"});let Y=await Pp(Q,Z);if(!Y)throw new Q$(503,{message:"Object storage not configured"});if(Y.startsWith("data:")&&TJ()){let K=Y.match(/^data:([^;]+);base64,(.+)$/s);if(!K)throw new Q$(500,{message:"Invalid data URL from storage"});let[,H,N]=K,F=Buffer.from(N,"base64"),U=new Headers({"Content-Type":H,"Cache-Control":"private, max-age=86400"});return u_$(U,H),new Response(F,{status:200,headers:U})}let G=new Headers;for(let K of w86){let H=$.req.header(K);if(H)G.set(K,H)}let J=await fetch(Y,{headers:G});if(J.status===403||J.status===404)throw new Q$(404,{message:"File not found"});if(!J.ok&&J.status!==304&&J.status!==416)throw console.error(`[files] upstream storage error ${J.status} for key:`,Q),new Q$(502,{message:"Upstream storage error"});let W=new Headers;for(let K of O86){let H=J.headers.get(K);if(H)W.set(K,H)}return W.set("Cache-Control","private, max-age=86400"),u_$(W,W.get("content-type")??""),new Response(J.body,{status:J.status,headers:W})});l_$=c_$});var Mo=C((hC)=>{var B86=hC&&hC.__createBinding||(Object.create?function($,Z,X,Q){if(Q===void 0)Q=X;var Y=Object.getOwnPropertyDescriptor(Z,X);if(!Y||("get"in Y?!Z.__esModule:Y.writable||Y.configurable))Y={enumerable:!0,get:function(){return Z[X]}};Object.defineProperty($,Q,Y)}:function($,Z,X,Q){if(Q===void 0)Q=X;$[Q]=Z[X]}),D86=hC&&hC.__exportStar||function($,Z){for(var X in $)if(X!=="default"&&!Object.prototype.hasOwnProperty.call(Z,X))B86(Z,$,X)};Object.defineProperty(hC,"__esModule",{value:!0});D86(oQ(),hC)});var n_$=C((m_$)=>{Object.defineProperty(m_$,"__esModule",{value:!0});m_$.version=void 0;m_$.version="3.4.0"});var o_$=C((xK)=>{var L86=xK&&xK.__importDefault||function($){return $&&$.__esModule?$:{default:$}};Object.defineProperty(xK,"__esModule",{value:!0});xK.NodeTransport=xK.VERSION=void 0;xK.nodeResolveHost=T86;var l6=Mo(),E86=z0("net"),f81=z0("tls"),j86=z0("path"),p_$=z0("fs"),z86=L86(z0("dns")),P86=n_$();xK.VERSION=P86.version;var A86="nats.js";class t_${socket;version;lang;yields=[];signal=(0,l6.deferred)();closedNotification=(0,l6.deferred)();options;connected=!1;tlsName="";done=!1;closeError;constructor(){this.lang=A86,this.version=xK.VERSION}async connect($,Z){this.tlsName=$.tlsName,this.options=Z;let{tls:X}=this.options,{handshakeFirst:Q}=X||{};try{if(Q===!0)this.socket=await this.tlsFirst($);else this.socket=await this.dial($);if(this.done)this.socket?.destroy();let Y=await this.peekInfo();(0,l6.checkOptions)(Y,Z);let{tls_required:G,tls_available:J}=Y,W=J===!0&&Z.tls!==null;if(!Q&&(G||W))this.socket=await this.startTLS();if(this.done)this.socket?.destroy();if(G&&this.socket.encrypted!==!0)throw l6.errors.InvalidArgumentError.format("tls","is not available on this server");return this.connected=!0,this.setupHandlers(),this.signal.resolve(),Promise.resolve()}catch(Y){let G=Y;if(!G)G=new l6.errors.ConnectionError("error connecting - node provided an undefined error");let{code:J}=G,W=J==="ECONNREFUSED"?new l6.errors.ConnectionError("connection refused",{cause:G}):G;throw this.socket?.destroy(),W}}dial($){let Z=(0,l6.deferred)(),X,Q=(0,E86.createConnection)($.port,$.hostname,()=>{Z.resolve(Q),Q.removeAllListeners()});return Q.on("error",(Y)=>{X=Y}),Q.on("close",()=>{Q.removeAllListeners(),Z.reject(X)}),Q.setNoDelay(!0),Z}get isClosed(){return this.done}close($){return this._closed($,!1)}peekInfo(){let $=(0,l6.deferred)(),Z;return this.socket.on("data",(X)=>{this.yields.push(X);let Q=l6.DataBuffer.concat(...this.yields),Y=(0,l6.extractProtocolMessage)(Q);if(Y!=="")try{let G=l6.INFO.exec(Y);if(!G)throw Error("unexpected response from server");let J=JSON.parse(G[1]);$.resolve(J)}catch(G){$.reject(G)}finally{this.socket.removeAllListeners()}}),this.socket.on("error",(X)=>{Z=X}),this.socket.on("close",()=>{this.socket.removeAllListeners(),$.reject(Z)}),$}loadFile($){if(!$)return Promise.resolve();let Z=(0,l6.deferred)();try{if($=(0,j86.resolve)($),!(0,p_$.existsSync)($))Z.reject(Error(`${$} doesn't exist`));(0,p_$.readFile)($,(X,Q)=>{if(X)return Z.reject(X);Z.resolve(Q)})}catch(X){Z.reject(X)}return Z}async loadClientCerts(){let $={},{certFile:Z,cert:X,caFile:Q,ca:Y,keyFile:G,key:J}=this.options.tls;try{if(Z){let W=await this.loadFile(Z);if(W)$.cert=W}else if(X)$.cert=X;if(G){let W=await this.loadFile(G);if(W)$.key=W}else if(J)$.key=J;if(Q){let W=await this.loadFile(Q);if(W)$.ca=[W]}else if(Y)$.ca=Y;return Promise.resolve($)}catch(W){return Promise.reject(W)}}async tlsFirst($){let Z,X={servername:this.tlsName,rejectUnauthorized:!0};if(this.socket)X.socket=this.socket;if(typeof this.options.tls==="object")try{let Y=await this.loadClientCerts()||{};X=(0,l6.extend)(X,this.options.tls,Y)}catch(Y){return Promise.reject(new l6.errors.ConnectionError(Y.message,{cause:Y}))}let Q=(0,l6.deferred)();try{let Y=(0,f81.connect)($.port,$.hostname,X,()=>{Y.removeAllListeners(),Q.resolve(Y)});Y.on("error",(G)=>{Z=G}),Y.on("secureConnect",()=>{if(X.rejectUnauthorized===!1)return;if(!Y.authorized)throw Y.authorizationError}),Y.on("close",()=>{Q.reject(Z),Y.removeAllListeners()}),Y.setNoDelay(!0)}catch(Y){Q.reject(new l6.errors.ConnectionError(Y.message,{cause:Y}))}return Q}async startTLS(){let $,Z={socket:this.socket,servername:this.tlsName,rejectUnauthorized:!0};if(typeof this.options.tls==="object")try{let Q=await this.loadClientCerts()||{};Z=(0,l6.extend)(Z,this.options.tls,Q)}catch(Q){return Promise.reject(new l6.errors.ConnectionError(Q.message,{cause:Q}))}let X=(0,l6.deferred)();try{let Q=(0,f81.connect)(Z,()=>{Q.removeAllListeners(),X.resolve(Q)});Q.on("error",(Y)=>{$=Y}),Q.on("secureConnect",()=>{if(Z.rejectUnauthorized===!1)return;if(!Q.authorized)throw Q.authorizationError}),Q.on("close",()=>{X.reject($),Q.removeAllListeners()})}catch(Q){X.reject(new l6.errors.ConnectionError(Q.message,{cause:Q}))}return X}setupHandlers(){let $;this.socket.on("data",(Z)=>{return this.yields.push(Z),this.signal.resolve()}),this.socket.on("error",(Z)=>{$=Z}),this.socket.on("end",()=>{if(this.socket?.destroyed)return;this.socket?.write(new Uint8Array(0),()=>{this.socket?.end()})}),this.socket.on("close",()=>{this._closed($,!1)})}[Symbol.asyncIterator](){return this.iterate()}async*iterate(){while(!0){if(this.yields.length===0)await this.signal;let $=this.yields;this.yields=[];for(let Z=0;Z<$.length;Z++){if(this.options.debug)console.info(`> ${(0,l6.render)($[Z])}`);yield $[Z]}if(this.done)break;else if(this.yields.length===0)$.length=0,this.yields=$,this.signal=(0,l6.deferred)()}}discard(){if(this.done=!0,this.socket)try{this.socket.removeAllListeners(),this.socket.destroy()}catch{}}disconnect(){this._closed(void 0,!0).then().catch()}isEncrypted(){return this.socket instanceof f81.TLSSocket}_send($){if(this.isClosed||this.socket===void 0)return Promise.resolve();if(this.options.debug)console.info(`< ${(0,l6.render)($)}`);let Z=(0,l6.deferred)();try{this.socket.write($,(X)=>{if(X){if(this.options.debug)console.error(`!!! ${(0,l6.render)($)}: ${X}`);return Z.reject(X)}return Z.resolve()})}catch(X){if(this.options.debug)console.error(`!!! ${(0,l6.render)($)}: ${X}`);Z.reject(X)}return Z}send($){this._send($).catch((X)=>{})}async _closed($,Z=!0){if(!this.connected)return;if(this.done){this.socket?.destroy();return}if(this.closeError=$,!$&&this.socket&&Z)try{await this._send(new TextEncoder().encode(""))}catch(X){if(this.options.debug)console.log("transport close terminated with an error",X)}try{if(this.socket)this.socket.removeAllListeners(),this.socket?.destroy(),this.socket=void 0}catch(X){console.log(X)}this.done=!0,this.closedNotification.resolve(this.closeError)}closed(){return this.closedNotification}}xK.NodeTransport=t_$;function T86($){let Z=(0,l6.deferred)();return z86.default.lookup($,{all:!0},(X,Q)=>{if(X){Z.reject(X);return}let Y=[];for(let G of Q)Y.push(G.address);if(Y.length===0)Y.push($);Z.resolve(Y)}),Z}});var $v$=C((e_$)=>{Object.defineProperty(e_$,"__esModule",{value:!0});e_$.connect=R86;var r_$=o_$(),a_$=Mo(),s_$=Mo();function R86($={}){if((0,s_$.hasWsProtocol)($))return Promise.reject(s_$.errors.InvalidArgumentError.format("servers","node client doesn't support websockets, use the 'wsconnect' function instead"));return(0,a_$.setTransportFactory)({factory:()=>{return new r_$.NodeTransport},dnsResolveFn:r_$.nodeResolveHost}),a_$.NatsConnectionImpl.connect($)}});var Zv$=C((eN)=>{var q86=eN&&eN.__createBinding||(Object.create?function($,Z,X,Q){if(Q===void 0)Q=X;var Y=Object.getOwnPropertyDescriptor(Z,X);if(!Y||("get"in Y?!Z.__esModule:Y.writable||Y.configurable))Y={enumerable:!0,get:function(){return Z[X]}};Object.defineProperty($,Q,Y)}:function($,Z,X,Q){if(Q===void 0)Q=X;$[Q]=Z[X]}),M86=eN&&eN.__exportStar||function($,Z){for(var X in $)if(X!=="default"&&!Object.prototype.hasOwnProperty.call(Z,X))q86(Z,$,X)};Object.defineProperty(eN,"__esModule",{value:!0});eN.connect=void 0;var k86=$v$();Object.defineProperty(eN,"connect",{enumerable:!0,get:function(){return k86.connect}});M86(Mo(),eN)});function Gv$($){let Z=$?.connectFn??_86,X=null,Q=null,Y=!1,G=!1,J=!1,W=[];function K(){return X!==null&&!X.isClosed()&&!X.isDraining()&&!J}function H(){console.log(`[NatsProvider] fireReady: ${W.length} callbacks`);for(let U of W)try{U()}catch{}}function N(U){(async()=>{for await(let w of U.status())if(w.type==="disconnect")console.log("[NatsProvider] Disconnected"),J=!0;else if(w.type==="reconnect")console.log("[NatsProvider] Reconnected, re-firing ready callbacks"),J=!1,Q=null,H()})().catch(()=>{})}async function F(U,w){let O=0;while(!G)try{X=await Z({servers:U,timeout:C86,reconnect:!0,maxReconnectAttempts:-1,...w?{authenticator:w}:{}}),console.log(`[NatsProvider] Connected to ${X.getServer()} after ${O} attempt(s)`),Q=null,J=!1,N(X),H();return}catch{O++;let D=JX(V86,S86,O-1,2,0.5);await y$(D)}}return{init(U,w){if(Y)return;Y=!0,G=!1;let O=w?.creds?Xv$.credsAuthenticator(new TextEncoder().encode(w.creds)):void 0;F(U,O).catch(()=>{})},isConnected(){return K()},getConnection(){return K()?X:null},getJetStream(){if(!K())return null;if(!Q)Q=Yv$.jetstream(X);return Q},onReady(U){if(W.push(U),K())try{U()}catch{}},async drain(){if(G=!0,Y=!1,Q=null,J=!1,X){let U=X;X=null,await U.drain().catch(()=>{})}}}}function _86($){return Qv$.connect($)}var Xv$,Qv$,Yv$,S86=100,V86=3000,C86=3000;var Jv$=B(()=>{B6();Xv$=S(wh(),1),Qv$=S(Zv$(),1),Yv$=S(GB(),1)});function x81($,Z){return`${$}.${Z}`}class y81{cache;constructor($){this.cache=Dg({ttlMs:$?.ttlMs??v86,maxSize:$?.maxSize??b86})}async get($,Z){return this.cache.get(x81($,Z))??null}async set($,Z,X){this.cache.set(x81($,Z),X)}async invalidate($,Z){this.cache.delete(x81($,Z))}teardown(){this.cache.clear()}}var v86=600000,b86=5000;var Wv$=()=>{};function Wj0($,Z){return`${$}:${Z}`}function g81($){let Z=Dg({ttlMs:$?.ttlMs??f86,maxSize:$?.maxSize??x86}),X=$?.getConnection,Q=crypto.randomUUID(),Y=new TextEncoder,G=new TextDecoder,J=null;function W(K,H){let N=X?.();if(!N)return;try{N.publish(Kv$,Y.encode(JSON.stringify({organizationId:K,keyId:H,originId:Q})))}catch(F){console.warn("[ProviderKeyCache] Publish failed (non-critical):",F)}}return{get(K,H){return Z.get(Wj0(K,H))},set(K,H,N){Z.set(Wj0(K,H),N)},invalidate(K,H){Z.delete(Wj0(K,H)),W(K,H)},start(){if(J)return;let K=X?.();if(!K)return;J=K.subscribe(Kv$),(async()=>{for await(let H of J)try{let N=JSON.parse(G.decode(H.data));if(N.originId===Q)continue;Z.delete(Wj0(N.organizationId,N.keyId))}catch{}})().catch(console.error)},teardown(){J?.unsubscribe(),J=null,Z.clear()}}}var Kv$="studio.ai-provider-keys.invalidate",f86=30000,x86=5000;var Hv$=()=>{};class h81{options;subscriptions=[];onCancel=null;encoder=new TextEncoder;originId=crypto.randomUUID();seenMessageIds=new Set;constructor($){this.options=$}async start($){if($)this.onCancel=$;if(this.subscriptions.length>0)return;if(!this.onCancel)return;let Z=this.options.getConnection();if(!Z)return;let X=new TextDecoder;this.subscriptions=Nv$.map((Q)=>Z.subscribe(Q));for(let Q of this.subscriptions)(async()=>{for await(let Y of Q)try{let G=JSON.parse(X.decode(Y.data));if(G.originId===this.originId)continue;if(G.messageId&&this.hasSeen(G.messageId))continue;this.onCancel?.(G.taskId)}catch{}})().catch(console.error)}broadcast($){if(/[.*>\s]/.test($)){console.warn("[NatsCancelBroadcast] Invalid threadId, skipping broadcast");return}this.onCancel?.($);try{let Z=this.options.getConnection();if(!Z)return;let X=this.encoder.encode(JSON.stringify({taskId:$,originId:this.originId,messageId:crypto.randomUUID()}));for(let Q of Nv$)Z.publish(Q,X)}catch(Z){console.warn("[NatsCancelBroadcast] Publish failed (non-critical):",Z)}}publishControlFrame($,Z){}async stop(){for(let $ of this.subscriptions)$.unsubscribe();this.subscriptions=[],this.seenMessageIds.clear(),this.onCancel=null}hasSeen($){if(this.seenMessageIds.has($))return!0;if(this.seenMessageIds.add($),this.seenMessageIds.size>1000){let Z=this.seenMessageIds.values().next().value;if(Z)this.seenMessageIds.delete(Z)}return!1}}var Nv$;var Fv$=B(()=>{Nv$=["studio.decopilot.cancel","mesh.decopilot.cancel"]});var Uv$=($)=>{let Z;return()=>Z??=$()},u81,c81;var wv$=B(()=>{N5();u81=Uv$(()=>W8.createHistogram("decopilot.stream.encode_ms",{description:"Per-chunk JSON.stringify+encode time for decopilot stream",unit:"ms"})),c81=Uv$(()=>W8.createCounter("decopilot.stream.published_chunks",{description:"Logical decopilot stream chunks published to JetStream",unit:"{chunks}"}))});function d86(){return{name:IN,subjects:[`${LO0}.>`],storage:y3.StorageType.File,max_age:h86,max_bytes:c86,max_msgs_per_subject:l86,discard:y3.DiscardPolicy.Old,retention:y3.RetentionPolicy.Limits,duplicate_window:u86,num_replicas:1}}class Dv${chunks=0;encodeMs=0;maxMs=0;bytes=0;windowStart=performance.now();constructor(){setInterval(()=>this.flush(),1e4).unref?.()}record($,Z){if(this.chunks++,this.encodeMs+=$,$>this.maxMs)this.maxMs=$;this.bytes+=Z}flush(){let $=performance.now(),Z=$-this.windowStart;if(this.chunks>0&&Z>0)console.warn(JSON.stringify({msg:"stream-encode-trace",windowMs:Math.round(Z),chunks:this.chunks,encodeMs:Math.round(this.encodeMs),pctOfLoop:+(this.encodeMs/Z*100).toFixed(1),maxChunkMs:+this.maxMs.toFixed(2),mbEncoded:+(this.bytes/1048576).toFixed(2)}));this.chunks=0,this.encodeMs=0,this.maxMs=0,this.bytes=0,this.windowStart=$}}function Ov$($){let Z=Bv$.headers();for(let[X,Q]of Object.entries($))Z.set(X,Q);return Z}function p86($,Z){let X=0;return{publish(Q,Y,G,J){Q.publish(Y,G,J?{headers:J}:void 0).catch((W)=>{if(X++,g86().add(1,{"org.id":Z??"unknown"}),X===1||X%100===0)console.warn(`[Decopilot] JetStream publish failed for thread ${$} (${X} total):`,W)})},get errorCount(){return X}}}function t86($){if(!($ instanceof Error))return!1;if($.name==="TimeoutError")return!0;return/timeout|no responders|503/i.test($.message)}class l81{options;js=null;jsm=null;constructor($){this.options=$}async init(){let $=this.options.getConnection();if(!$){console.log("[Decopilot] StreamBuffer.init skipped: NATS not connected yet");return}let Z=d86(),X=await fZ(async()=>{let Q=this.options.getJetStreamManager?await this.options.getJetStreamManager():await y3.jetstreamManager($);try{await Q.streams.info(IN),await Q.streams.update(IN,Z)}catch(Y){if(Y instanceof Error&&Y.message.includes("stream not found"))await Q.streams.add(Z);else if(Y instanceof Error&&/can ?not change.*storage|storage type/i.test(Y.message))await Q.streams.delete(IN),await Q.streams.add(Z);else throw Y}return Q},{maxAttempts:5,minTimeout:250,maxTimeout:4000,jitter:0.5,isRetriable:t86});this.js=this.options.getJetStream(),this.jsm=X,console.log(`[Decopilot] StreamBuffer.init ${this.js?"ready":"degraded (js=null)"}`)}pump($,Z,X,Q){let Y=this.js;if(!Y)return console.warn(`[Decopilot] pump: JetStream client unavailable for thread ${Z}; chunks NOT published to NATS`),Promise.resolve();let G=p86(Z,Q),J=!1,W=()=>{if(J)return;J=!0;let H=jH$(Z);Y.publish(H.subject,H.data).catch(()=>{})};X.addEventListener("abort",W,{once:!0});let K=(H)=>{let N=performance.now(),F=wt0(H,{runId:Z}),U=performance.now()-N;if(u81().record(U),c81().add(1,{"org.id":Q??"unknown"}),n86?.record(U,F.reduce((w,O)=>w+O.data.length,0)),F.length===0){console.warn(`[Decopilot] dropping oversized stream chunk for thread ${Z}`);return}for(let w of F)G.publish(Y,w.subject,w.data,w.headers?Ov$(w.headers):void 0)};return(async()=>{let H=$.getReader(),N=0,F=0,U;try{while(!0){let{done:w,value:O}=await H.read();if(w)break;if(K(O),F++,++N>=64)N=0,await new Promise((D)=>setImmediate(D))}}catch(w){U=w,console.warn(`[Decopilot] stream pump error for thread ${Z}:`,w?.message??w)}finally{if(H.releaseLock(),W(),i86)console.warn(JSON.stringify({msg:"decopilot-stream-diag",event:"pump-done",taskId:Z,publishedChunks:F,publishErrors:G.errorCount}))}if(U!==void 0)throw U})()}async publishRawChunk($,Z,X){let Q=this.js;if(!Q)return!1;let Y=performance.now(),G=wt0(Z,{runId:$,dedup:X});if(u81().record(performance.now()-Y),c81().add(1),G.length===0)return console.warn(`[Decopilot] dropping oversized raw chunk for thread ${$} (> MAX_CHUNKED_BYTES)`),!0;for(let J of G)await Q.publish(J.subject,J.data,{...J.headers?{headers:Ov$(J.headers)}:{},...J.msgId?{msgID:J.msgId}:{}});return!0}async publishDone($,Z,X){let Q=this.js;if(!Q)return!1;let Y=EH$({runId:$,fenceToken:Z,finalSeq:X});return await Q.publish(Y.subject,Y.data,{msgID:Y.msgId}),!0}async createTailStream($,Z,X){let Q=this.js;if(!Q)return console.warn(`[Decopilot] createTailStream: JetStream client unavailable for thread ${$}; no live tail`),null;let Y=X?.deliverPolicy==="new"?y3.DeliverPolicy.New:y3.DeliverPolicy.All,G=X?.closeOnDone??!1,J=HO($),W;try{W=await(await Q.consumers.get(IN,{filter_subjects:J,deliver_policy:Y})).consume()}catch(D){return console.warn("[Decopilot] JetStream tail unavailable (non-critical):",D?.message??D),null}let N=AO0({messages:async function*(){try{for await(let D of W)yield{subject:D.subject,data:D.data,headers:D.headers}}finally{W.stop()}}(),onCancel:()=>W.stop()}).pipeThrough(EO0()).pipeThrough(jO0()).getReader(),F=!1,U=()=>{if(F)return;F=!0;try{N.releaseLock()}catch{}},w=!1,O=()=>{if(w)return;w=!0,W.stop(),N.cancel().catch(()=>{}),U()};return Z?.addEventListener("abort",O,{once:!0}),new ReadableStream({async pull(D){for(;;){let{done:L,value:E}=await N.read();if(L){O(),D.close();return}let j=E;if(j.kind==="done"){if(G){O(),D.close();return}continue}D.enqueue(j.chunk);return}},cancel(){O()}})}purge($){if(!this.jsm)return;this.jsm.streams.purge(IN,{filter:HO($)}).catch(()=>{})}teardown(){this.js=null,this.jsm=null}}var y3,Bv$,y86=($)=>{let Z;return()=>Z??=$()},g86,h86=86400000000000,u86=120000000000,c86=4294967296,l86=500000,m86,i86,n86;var Lv$=B(()=>{B6();Ot0();TO0();zO0();N5();wv$();y3=S(GB(),1),Bv$=S(wh(),1),g86=y86(()=>W8.createCounter("decopilot.stream.publish_errors",{description:"Number of JetStream publish failures for decopilot stream chunks",unit:"{errors}"}));m86=process.env.STREAM_ENCODE_TRACE==="1",i86=process.env.DECOPILOT_STREAM_TRACE==="1";n86=m86?new Dv$:null});function Kj0($,Z,X,Q){if(!Q)return!1;return $.emit(Z,YW(X,Q.status,{title:Q.title??void 0,virtualMcpId:Q.virtual_mcp_id??void 0,createdBy:Q.created_by??void 0,triggerId:Q.trigger_id??null,branch:Q.branch??null,harnessId:Q.harness_id??void 0,createdAt:Q.created_at,updatedAt:Q.updated_at})),!0}var Ev$=B(()=>{B8()});class d81{storage;options;timer=null;constructor($,Z={}){this.storage=$;this.options=Z}start(){if(this.timer)return;let $=this.options.intervalMs??300000;this.timer=setInterval(()=>{this.runOnce()},$)}async runOnce(){let $=this.options.staleAfterMs??3600000;try{let Z=await this.storage.sweepAbandoned($);if(Z>0)console.log(`[async-research-sweeper] marked ${Z} stale jobs as abandoned`);return Z}catch(Z){return console.error("[async-research-sweeper] sweep failed",Z),0}}dispose(){if(this.timer)clearInterval(this.timer),this.timer=null}}class m81{taskBoard;contextFactory;options;timer=null;running=!1;cursor=null;constructor($,Z,X={}){this.taskBoard=$;this.contextFactory=Z;this.options=X}start(){if(this.timer)return;let $=this.options.intervalMs??o86;this.timer=setInterval(()=>{this.runOnce()},$),this.timer.unref()}async runOnce(){if(this.running)return 0;this.running=!0;let $=0;try{let Z=this.options.batchSize??a86,X=this.options.itemIntervalMs??r86,Q=await this.taskBoard.listItemsPendingReview(Z,this.cursor,new Date(Date.now()-X)),Y=Q.at(-1);this.cursor=Q.length===Z&&Y?{updatedAt:Y.updatedAt,id:Y.id}:null;for(let{id:G,organizationId:J}of Q)try{if(await this.reconcileItem(G,J))$++}catch(W){console.error(`[task-board-review-sweeper] ${G} failed`,W)}await this.reapNeverStartedThreads(Z),$+=await this.dispatchDueRetries(Z),await this.reactToUnhandledFailures(Z)}catch(Z){console.error("[task-board-review-sweeper] sweep failed",Z)}finally{this.running=!1}return $}async reapNeverStartedThreads($){try{let Z=await this.taskBoard.failNeverStartedLinkedThreads($,new Date(Date.now()-PW$),nt0);for(let X of Z)console.warn(`[task-board-review-sweeper] failed never-started thread ${X.threadId} on ${X.itemId}`)}catch(Z){console.error("[task-board-review-sweeper] reaping failed",Z)}}async reactToUnhandledFailures($){let Z=await this.taskBoard.listItemsStuckAfterFailure($,new Date(Date.now()-e86));for(let{id:X,organizationId:Q,threadId:Y}of Z)try{console.warn(`[task-board-review-sweeper] reacting to an unhandled failure on ${X}`),await cp0(this.taskBoard,Y,Q)}catch(G){console.error(`[task-board-review-sweeper] unhandled-failure reaction for ${X} failed`,G)}}async dispatchDueRetries($){let Z=0,X=await this.taskBoard.listItemsDueForRetry($,new Date);for(let{id:Q,organizationId:Y,attempts:G}of X)try{if(!await this.taskBoard.claimDueRetry(Q,Y,new Date))continue;let J=await this.taskBoard.getById(Q,Y);if(!J||J.status!=="in_progress"||J.assigneeId!==p4)continue;let W=await this.contextFactory(Y,J.assignedBy??J.createdBy);if(!W)continue;await qN(W,J,{runClass:"retry"}),Z++,console.warn(`[task-board-review-sweeper] re-dispatched ${Q} after a failure (attempt ${G})`)}catch(J){console.error(`[task-board-review-sweeper] retry dispatch for ${Q} failed`,J),await this.taskBoard.scheduleRunRetry(Q,Y,G,new Date(Date.now()+s86)).catch((W)=>console.error(`[task-board-review-sweeper] re-arming ${Q} failed`,W))}return Z}async reconcileItem($,Z){let X=await this.taskBoard.getById($,Z);if(!X)return!1;if(X.status!=="in_review"||X.assigneeId!==p4)return!1;await this.taskBoard.markSwept($,Z);let Q=await this.taskBoard.listPrs($,Z);if(Q.length===0)return!1;let Y=await this.contextFactory(Z,X.assignedBy??X.createdBy);if(!Y)return!1;let G=await Promise.all(Q.map(async(J)=>({...J,...await dt0(Y,Z,J)})));if(G.every((J)=>J.state===null))console.warn(`[task-board-review-sweeper] ${$}: no live PR state from GitHub (${G.length} PR(s)) \u2014 proceeding on unknown`);if(!lt0(G))return!1;return await SO0(Y,X),!0}dispose(){if(this.timer)clearInterval(this.timer),this.timer=null}}var o86=60000,r86=300000,a86=50,s86=60000,e86=120000;var jv$=B(()=>{b7();gt0();NO();MZ();pt0();Dy()});import{readdir as $46,rm as Hj0}from"fs/promises";import{join as Nj0}from"path";async function Fj0($){let Z=new Date;Z.setUTCDate(Z.getUTCDate()-Z46),Z.setUTCHours(0,0,0,0);let X=0;try{let Q=await uC($);for(let Y of Q)if(/^\d{4}$/.test(Y))X+=await zv$($,Y,Z);else if(!Y.startsWith(".")){let G=Nj0($,Y),J=await uC(G);for(let K of J){if(!/^\d{4}$/.test(K))continue;X+=await zv$(G,K,Z)}if((await uC(G)).length===0)await Hj0(G,{recursive:!0,force:!0})}}catch(Q){console.warn("monitoring retention cleanup failed:",Q)}return X}async function zv$($,Z,X){let Q=0,Y=Nj0($,Z),G=await uC(Y);for(let W of G){if(!/^\d{2}$/.test(W))continue;let K=Nj0(Y,W),H=await uC(K);for(let F of H){if(!/^\d{2}$/.test(F))continue;let U=new Date(`${Z}-${W}-${F}T00:00:00Z`);if(isNaN(U.getTime()))continue;if(U<X){let w=Nj0(K,F);await Hj0(w,{recursive:!0,force:!0}),Q++}}if((await uC(K)).length===0)await Hj0(K,{recursive:!0,force:!0})}if((await uC(Y)).length===0)await Hj0(Y,{recursive:!0,force:!0});return Q}async function uC($){try{return(await $46($)).filter((X)=>!X.startsWith("."))}catch{return[]}}var Z46=30;var i81=()=>{};import{DBOS as n81,SchedulerMode as X46}from"@dbos-inc/dbos-sdk";async function Y46(){let $=[$J(),cC(),gK()],Z=0;for(let X of $)try{Z+=await Fj0(X)}catch(Q){console.error("[monitoring-retention] cleanup failed:",Q)}return console.log(`[monitoring-retention] deleted ${Z} day-dir(s) across ${$.length} signal dir(s)`),{deleted:Z,dirs:$.length}}async function G46($,Z){await n81.runStep(()=>Y46(),{name:"monitoringRetention"})}function Av$(){if(Pv$)return;Pv$=!0;let $=n81.registerWorkflow(G46,{name:"monitoringRetentionWorkflow"});n81.registerScheduled($,{name:"monitoringRetentionWorkflow",crontab:Q46,mode:X46.ExactlyOncePerIntervalWhenActive})}var Q46="23 4 * * *",Pv$=!1;var Tv$=B(()=>{iQ();i81()});function Rv$($){return async(Z,X)=>{let Q=await $.db.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["member.role","organization.id as orgId","organization.slug as orgSlug","organization.name as orgName"]).where("member.userId","=",X).where("member.organizationId","=",Z).executeTakeFirst();if(!Q)return console.warn(`[automationContextFactory] User ${X} not found in org ${Z} \u2014 returning null`),null;let Y=await zw.create();Y.auth.user={id:X,role:Q.role},Y.organization={id:Q.orgId,slug:Q.orgSlug,name:Q.orgName};let G=await _c0($.db,Z,Q.role);return Y.boundAuth=Cc0({auth:Y.authInstance,headers:new Headers,role:Q.role,permissions:G,userId:X}),Y.access=new ZL(X,void 0,Y.boundAuth,Q.role,"self"),L50(Y,{id:Q.orgId,slug:Q.orgSlug}),Y}}var Iv$=B(()=>{XL();_i()});function J46(){return{services:[{name:"Postgres",status:"pending",port:0},{name:"NATS",status:"pending",port:0}],migrationsStatus:"pending",serverUrl:null,logs:[]}}function K46(){for(let $ of W46)$()}function qv$($){let Z=[...p81.logs,$];p81={...p81,logs:Z.length>500?Z.slice(-500):Z},K46()}function t81(){return H46}var p81,W46,H46=!1;var o81=B(()=>{p81=J46(),W46=new Set});import{EventEmitter as N46}from"events";var r81;var Mv$=B(()=>{o81();r81=new N46;r81.on("request",($)=>{qv$($)})});function kv$(){return async($,Z)=>{let X=Date.now(),Q=$.req.method,Y=$.req.path;if(Y==="/api/auth/get-session"||Y.includes("favicon")){await Z();return}let G="",J=!1;if(Y.startsWith("/mcp")&&Q==="POST"){J=!0;try{if($.req.header("Content-Type")?.includes("application/json")){let U=await $.req.raw.clone().json();if(U.method==="tools/call"&&U.params?.name){let w=lg(U.params.name),O=U.params.arguments||{},D=Object.keys(O).map((E)=>lg(E)),L=D.length>0?D.slice(0,3).join(",")+(D.length>3?"\u2026":""):"";G=`${a6.tool}${w}${a6.dim}(${L})${a6.reset}`}else if(U.method)G=`${a6.dim}${lg(U.method)}${a6.reset}`}}catch{}}let W=lg(Y);if(Y.startsWith("/mcp/conn_")){let N=Y.split("/")[2]??"";W=`/mcp/${a6.mcp}${lg(N.slice(0,12))}\u2026${a6.reset}`}else if(Y==="/mcp")W=`${a6.mcp}/mcp${a6.reset}`;else if(Y==="/mcp/registry")W=`${a6.mcp}/mcp/registry${a6.reset}`;let K=U46(Q),H=J?"\u25C0":"\u2190";if(!t81())console.log(`${a6.dim}${H}${a6.reset} ${K}${Q}${a6.reset} ${W}${G?` ${G}`:""}`);try{await Z()}finally{let N=Date.now()-X,F=$.res.status,U=F46(F),w=N<1000?`${N}ms`:`${(N/1000).toFixed(1)}s`,O=J?"\u25B6":"\u2192";if(!t81())console.log(`${a6.dim}${O}${a6.reset} ${K}${Q}${a6.reset} ${W}${G?` ${G}`:""} ${U}${F}${a6.reset} ${a6.duration}${w}${a6.reset}`);r81.emit("request",{method:Q,path:lg(Y),status:F,duration:N,timestamp:new Date})}}}var a6,F46=($)=>{if($>=500)return a6.serverError;if($>=400)return a6.clientError;if($>=300)return a6.redirect;return a6.ok},U46=($)=>{return a6[$]||a6.reset},lg=($)=>{return $.replace(/\r/g,"").replace(/\n/g,"").replace(/\x1b\[[0-9;]*m/g,"").replace(/[\x00-\x1f\x7f-\x9f]/g,"")};var Sv$=B(()=>{o81();Mv$();a6={reset:"\x1B[0m",dim:"\x1B[2m",bold:"\x1B[1m",GET:"\x1B[36m",POST:"\x1B[33m",PUT:"\x1B[35m",DELETE:"\x1B[31m",ok:"\x1B[32m",redirect:"\x1B[36m",clientError:"\x1B[33m",serverError:"\x1B[31m",mcp:"\x1B[35m",tool:"\x1B[96m",duration:"\x1B[90m"}});import{createHmac as vv$}from"crypto";import{mkdir as w46,readdir as O46,rm as Vv$,stat as bv$}from"fs/promises";import{join as s81,relative as B46}from"path";import{z as L$}from"zod";function xv$($){let Z=$.replace(/[^a-zA-Z0-9_-]/g,"_");return s81(D46,Z)}function yv$($){return $.replace(/^\/+/,"").replace(/\.\./g,"")}function a81($,Z){let X=xv$($),Q=yv$(Z);return s81(X,Q)}function L46($,Z,X,Q){let Y=c0().encryptionKey||"dev-secret",G=`${$}:${Z}:${X}:${Q}`;return vv$("sha256",Y).update(G).digest("hex")}function _v$($,Z,X,Q,Y){let G=Math.floor(Date.now()/1000)+Q,J=L46(Z,X,G,Y),W=new URL(`/api/dev-assets/${Z}/${yv$(X)}`,$);return W.searchParams.set("expires",G.toString()),W.searchParams.set("signature",J),W.searchParams.set("method",Y),W.toString()}function gv$($,Z,X){let Q=`${$}:${Z.getTime()}:${X}`;return`"${vv$("md5","etag").update(Q).digest("hex")}"`}async function hv$($,Z,X,Q,Y){try{let G=await O46($,{withFileTypes:!0});for(let J of G){let W=s81($,J.name),H=B46(Z,W).replace(/\\/g,"/");if(X&&!H.startsWith(X))continue;if(J.isDirectory())if(Q){let N=H+"/";if(!X||N.startsWith(X)){if(!(X?H.slice(X.length):H).includes("/"))Y.commonPrefixes.add(N)}}else await hv$(W,Z,X,Q,Y);else if(J.isFile()){if(Q&&X){let N=H.slice(X.length);if(N.includes(Q)){let F=N.indexOf(Q),U=X+N.slice(0,F+1);Y.commonPrefixes.add(U);continue}}try{let N=await bv$(W);Y.objects.push({key:H,size:N.size,lastModified:N.mtime.toISOString(),etag:gv$(W,N.mtime,N.size)})}catch{}}}}catch{}}function uv$($,Z){let Q=r($).id;return[{name:"LIST_OBJECTS",description:"List objects in the local assets directory with pagination support",inputSchema:L$.object({prefix:L$.string().optional(),maxKeys:L$.number().optional().default(1000),continuationToken:L$.string().optional(),delimiter:L$.string().optional()}),outputSchema:L$.object({objects:L$.array(L$.object({key:L$.string(),size:L$.number(),lastModified:L$.string(),etag:L$.string()})),nextContinuationToken:L$.string().optional(),isTruncated:L$.boolean(),commonPrefixes:L$.array(L$.string()).optional()}),handler:async(Y)=>{let G=Y,J=G.prefix||"",W=G.maxKeys??1000,K=G.delimiter,H=G.continuationToken,N=xv$(Q);await w46(N,{recursive:!0});let F={objects:[],commonPrefixes:new Set};await hv$(N,N,J,K,F),F.objects.sort((L,E)=>L.key.localeCompare(E.key));let U=0;if(H){if(U=F.objects.findIndex((L)=>L.key>H),U===-1)U=F.objects.length}let w=F.objects.slice(U,U+W),O=U+W<F.objects.length,D=O?w[w.length-1]?.key:void 0;return{objects:w,isTruncated:O,nextContinuationToken:D,commonPrefixes:Array.from(F.commonPrefixes).sort()}}},{name:"GET_OBJECT_METADATA",description:"Get metadata for a file in the local assets directory",inputSchema:L$.object({key:L$.string()}),outputSchema:L$.object({contentType:L$.string().optional(),contentLength:L$.number(),lastModified:L$.string(),etag:L$.string(),metadata:L$.record(L$.string(),L$.string()).optional()}),handler:async(Y)=>{let G=Y,J=a81(Q,G.key),W=await bv$(J);return{contentType:i11(G.key),contentLength:W.size,lastModified:W.mtime.toISOString(),etag:gv$(J,W.mtime,W.size)}}},{name:"GET_PRESIGNED_URL",description:"Generate a presigned URL for downloading a file from local storage",inputSchema:L$.object({key:L$.string(),expiresIn:L$.number().optional()}),outputSchema:L$.object({url:L$.string(),expiresIn:L$.number()}),handler:async(Y)=>{let G=Y,J=G.expiresIn??Cv$;return{url:_v$(Z,Q,G.key,J,"GET"),expiresIn:J}}},{name:"PUT_PRESIGNED_URL",description:"Generate a presigned URL for uploading a file to local storage",inputSchema:L$.object({key:L$.string(),expiresIn:L$.number().optional(),contentType:L$.string().optional()}),outputSchema:L$.object({url:L$.string(),expiresIn:L$.number()}),handler:async(Y)=>{let G=Y,J=G.expiresIn??Cv$;return{url:_v$(Z,Q,G.key,J,"PUT"),expiresIn:J}}},{name:"DELETE_OBJECT",description:"Delete a single file from local storage",inputSchema:L$.object({key:L$.string()}),outputSchema:L$.object({success:L$.boolean(),key:L$.string()}),handler:async(Y)=>{let G=Y,J=a81(Q,G.key);try{return await Vv$(J),{success:!0,key:G.key}}catch{return{success:!1,key:G.key}}}},{name:"DELETE_OBJECTS",description:"Delete multiple files from local storage",inputSchema:L$.object({keys:L$.array(L$.string()).max(1000)}),outputSchema:L$.object({deleted:L$.array(L$.string()),errors:L$.array(L$.object({key:L$.string(),message:L$.string()}))}),handler:async(Y)=>{let G=Y,J=[],W=[];return await Promise.all(G.keys.map(async(K)=>{let H=a81(Q,K);try{await Vv$(H),J.push(K)}catch(N){W.push({key:K,message:N instanceof Error?N.message:"Unknown error"})}})),{deleted:J,errors:W}}}]}async function e81($,Z,X){let Q=uv$(Z,X),Y=new OW({name:"dev-assets-mcp",version:"1.0.0"},{capabilities:{tools:{}},jsonSchemaValidator:X5});for(let J of Q){let W="shape"in J.inputSchema?J.inputSchema.shape:L$.object({}).shape,K=J.outputSchema&&"shape"in J.outputSchema?J.outputSchema.shape:L$.object({}).shape;Y.registerTool(J.name,{description:J.description??"",inputSchema:W,outputSchema:K,annotations:J.annotations,_meta:J._meta},async(H)=>{try{let N=await J.handler(H);return{content:[{type:"text",text:JSON.stringify(N)}],structuredContent:N}}catch(N){return{content:[{type:"text",text:`Error: ${N.message}`}],isError:!0}}})}let G=new cX({enableJsonResponse:$.headers.get("Accept")?.includes("application/json")??!1});return await Y.connect(G),uG(Y,G,$,"mcp:dev-assets")}async function cv$($,Z,X,Q){let G=uv$(X,Q).find((J)=>J.name===$);if(!G)return{content:[{type:"text",text:`Tool not found: ${$}`}],isError:!0};try{let J=await G.handler(Z);return{content:[{type:"text",text:JSON.stringify(J)}]}}catch(J){return{content:[{type:"text",text:J instanceof Error?J.message:String(J)}],isError:!0}}}var D46="./data/assets",Cv$=3600,fv$,lv$;var dv$=B(()=>{S$();Py();v8();Ul();nV();qX();AE0();fv$=new B1;fv$.all("/",async($)=>{let Z=$.get("studioContext"),X=new URL($.req.url),Q=`${X.protocol}//${X.host}`;return e81($.req.raw,Z,Q)});lv$=fv$});var mv$={};H4(mv$,{mountDevRoutes:()=>E46});function E46($,Z){$.all("/mcp/:connectionId{.*_dev-assets$}",Z,async(Q)=>{let Y=Q.get("studioContext"),G=new URL(Q.req.url),J=`${G.protocol}//${G.host}`;return e81(Q.req.raw,Y,J)}),$.all("/mcp/:connectionId{.*_dev-assets$}/call-tool/:toolName",Z,async(Q)=>{let Y=Q.get("studioContext"),G=new URL(Q.req.url),J=`${G.protocol}//${G.host}`,W=Q.req.param("toolName");if(!W)return Q.json({error:"Missing tool name"},400);let K=await Q.req.json(),H=await cv$(W,K,Y,J);if(H.isError)return Q.json(H.content,500);return Q.json(H.content)}),$.use("/mcp/dev-assets",Z),$.route("/mcp/dev-assets",lv$);let X=new B1;X.use("*",b3({mountPath:"/api/dev-assets"})),X.route("/",PE0({orgFromPath:!1})),$.route("/api/dev-assets",X)}var iv$=B(()=>{v8();y11();AE0();dv$()});import{sql as j46}from"kysely";import{randomUUID as nv$}from"crypto";import{z as z46}from"zod";async function A46($){let Z=new Date().toISOString(),X=nv$(),Q=x4.SELF($.organizationId),Y="registry.publish_request.created",G={requestId:$.request.id,requestedId:$.request.requested_id,title:$.request.title,status:$.request.status,createdAt:$.request.created_at,requester:{name:$.request.requester_name,email:$.request.requester_email}};await $.db.insertInto("events").values({id:X,organization_id:$.organizationId,type:"registry.publish_request.created",source:Q,specversion:"1.0",subject:$.request.id,time:Z,datacontenttype:"application/json",dataschema:null,data:JSON.stringify(G),cron:null,status:"pending",attempts:0,last_error:null,next_retry_at:null,created_at:Z,updated_at:Z}).execute();let J=await $.db.selectFrom("event_subscriptions").select(["id"]).where("organization_id","=",$.organizationId).where("enabled","=",1).where("event_type","=","registry.publish_request.created").where((W)=>W.or([W("publisher","is",null),W("publisher","=",Q)])).execute();if(J.length>0)await $.db.insertInto("event_deliveries").values(J.map((W)=>({id:nv$(),event_id:X,subscription_id:W.id,status:"pending",attempts:0,last_error:null,delivered_at:null,next_retry_at:null,created_at:Z}))).execute();try{await j46`SELECT
       pg_notify('studio_events', ${X}),