decocms 4.193.0 → 4.193.2

package/dist/server/cli.js

@@ -1310,7 +1310,7 @@ Usage: deco services <up|down|status>`),process.exit(1)}}var Nc1=O(()=>{Tx()});f
       `.execute($);if(Number(W.rows[0]?.cnt)===0){console.warn(`Failed to migrate ${J}/${K}, keeping in old table`);continue}}await af`
       DELETE FROM kysely_migration WHERE name = ${X}
     `.execute($)}}async function Ii1($){await ku6($),await Vu6($);let Z=new Ti1({db:$,provider:{getMigrations:()=>Promise.resolve(ql0)}}),{error:X,results:Q}=await Z.migrateToLatest(),Y=0;if(Q?.forEach((G)=>{if(G.status==="Success")Y++;else if(G.status==="Error")console.error(`Failed to execute migration "${G.migrationName}"`)}),X)throw console.error("Failed to migrate"),console.error(X),X;return Y}async function Su6($){let{keepOpen:Z=!1,database:X,skipBetterAuth:Q=!1}=$??{},Y="skipped";if(!Q&&!X)Y=await Zh0();let G=X??H6(),J=async()=>{if(!Z&&!X)await Nw(G).catch((K)=>{console.warn("Warning: Error closing database:",K)})};try{let K=await Ii1(G.db);return await J(),{betterAuth:Y,kysely:K}}catch(K){throw await J(),K}}async function Cu6(){let $=H6(),Z=new Ti1({db:$.db,provider:{getMigrations:()=>Promise.resolve(ql0)}}),{error:X,results:Q}=await Z.migrateDown();if(Q?.forEach((Y)=>{if(Y.status==="Success")console.log(`\u2705 Migration "${Y.migrationName}" rolled back successfully`);else if(Y.status==="Error")console.error(`\u274C Failed to rollback migration "${Y.migrationName}"`)}),X)throw console.error("Failed to rollback migration"),console.error(X),X}var Mi1=O(()=>{Ai1();Xh0();n7()});async function h50($){let Z={...process.env},X=v00($,Z);console.log(mU1(X.settings.encryptionKey));let Q=X.settings.betterAuthSecret||(X.settings.localMode?cl1(X.settings.dataDir):""),{ensureServices:Y}=await Promise.resolve().then(() => (r$0(),o$0)),{outputs:G,services:J}=await Y({home:X.settings.dataDir,externalDatabaseUrl:X.externalDatabaseUrl,externalNatsUrl:X.externalNatsUrl});if(!X.skipMigrations){let{migrateBetterAuth:W}=await Promise.resolve().then(() => (Xh0(),dl1));await W(G.databaseUrl);let{createDatabase:H}=await Promise.resolve().then(() => (n7(),Gl1)),{migrateToLatest:N}=await Promise.resolve().then(() => (Mi1(),qi1)),U=H(G.databaseUrl);await N({keepOpen:!0,database:U,skipBetterAuth:!0})}let K={...X.settings,betterAuthSecret:Q,databaseUrl:G.databaseUrl,natsUrls:G.natsUrls,...G.s3?{s3Endpoint:G.s3.endpoint,s3Bucket:G.s3.bucket,s3AccessKeyId:G.s3.accessKeyId,s3SecretAccessKey:G.s3.secretAccessKey,s3ForcePathStyle:G.s3.forcePathStyle}:{},...G.natsTunnel?{natsPublicUrl:G.natsTunnel.publicUrl,natsAccountJwt:G.natsTunnel.accountJwt,natsAccountSigningKey:G.natsTunnel.accountSigningKey,natsOperatorJwt:G.natsTunnel.operatorJwt,natsTunnelPublicEnabled:!0,natsCredsPath:G.natsTunnel.credsPath}:{}};return Uc1(K),{settings:K,services:J.map((W)=>({name:W.name==="PostgreSQL"?"Postgres":W.name,port:W.port})),managedServiceNames:J.filter((W)=>W.owner==="managed").map((W)=>W.name)}}var Ml0=O(()=>{Tx();ll1();b8()});var Si1={};w0(Si1,{updateService:()=>dD,subscribeCliState:()=>Sl0,setTuiConsoleIntercepted:()=>u50,setServerUrl:()=>Am,setMigrationsDone:()=>Pm,setDevMode:()=>xu6,resetCliStateForTests:()=>_u6,isTuiConsoleIntercepted:()=>c50,getCliState:()=>Vl0,addLogEntry:()=>Ow});function ki1(){return{services:[{name:"Postgres",status:"pending",port:0},{name:"NATS",status:"pending",port:0}],migrationsStatus:"pending",serverUrl:null,logs:[]}}function _u6(){VQ=ki1()}function vu6(){return[{name:"Postgres",status:"pending",port:0},{name:"NATS",status:"pending",port:0}]}function jm(){for(let $ of kl0)$()}function Vl0(){return VQ}function Sl0($){return kl0.add($),()=>kl0.delete($)}function dD($){VQ={...VQ,services:VQ.services.map((Z)=>Z.name===$.name?$:Z)},jm()}function Pm(){VQ={...VQ,migrationsStatus:"done"},jm()}function Am($){VQ={...VQ,serverUrl:$},jm()}function Ow($){let Z=[...VQ.logs,$];VQ={...VQ,logs:Z.length>500?Z.slice(-500):Z},jm()}function xu6(){VQ={...VQ,services:[...vu6(),{name:"API",status:"pending",port:0},{name:"Vite",status:"pending",port:0}]},jm()}function u50($){Vi1=$}function c50(){return Vi1}var VQ,kl0,Vi1=!1;var mD=O(()=>{VQ=ki1();kl0=new Set});import{createServer as Ci1}from"net";function fu6($){return new Promise((Z)=>{let X=Ci1();X.once("error",()=>Z(!1)),X.listen($,"0.0.0.0",()=>{X.close(()=>Z(!0))})})}async function Tm($){if(await fu6($))return $;let Z=await new Promise((X,Q)=>{let Y=Ci1();Y.once("error",Q),Y.listen(0,"0.0.0.0",()=>{let G=Y.address(),J=typeof G==="object"&&G?G.port:0;Y.close(()=>X(J))})});return console.warn(`Port ${$} is in use, using port ${Z} instead.`),Z}var Cl0=()=>{};function Rm($){return $.replace(/\x1b\[[0-9;]*m/g,"")}var _l0={};w0(_l0,{startDevServer:()=>yu6});import{join as bu6}from"path";function _i1($){let Z=$.getReader(),X=new TextDecoder,Q="";function Y(){let G=Q.split(`
-`);Q=G.pop()??"";for(let J of G){let K=Rm(J).replace(/^\[\d+\]\s*/,"").trim();if(!K)continue;Ow({method:"",path:"",status:0,duration:0,timestamp:new Date,rawLine:K})}}(async()=>{for(;;){let{done:G,value:J}=await Z.read();if(G)break;Q+=X.decode(J,{stream:!0}),Y()}if(Q.trim()){let G=Rm(Q).replace(/^\[\d+\]\s*/,"").trim();if(G)Ow({method:"",path:"",status:0,duration:0,timestamp:new Date,rawLine:G})}})()}async function yu6($){let{baseUrl:Z,noTui:X}=$,Q=process.env.HOST==="0.0.0.0"&&Boolean(process.env.PORT),Y=Q?process.env.PORT:$.vitePort,G=Z||`http://localhost:${Y}`,J=Q?await Tm(Number(Y)+1):await Tm(Number($.port)),{settings:K,services:W,managedServiceNames:H}=await h50({port:String(J),home:$.home,baseUrl:$.baseUrl,localMode:$.localMode,skipMigrations:$.skipMigrations,noTui:$.noTui,vitePort:$.vitePort});for(let L of W)dD({name:L.name,status:"ready",port:L.port});Pm();let N=bu6(import.meta.dir,"..","..","..","..",".."),U=X===!0,F=Bun.spawn(["bun","run","dev:servers"],{cwd:N,env:{...process.env,PORT:String(K.port),VITE_PORT:String(Y),DATABASE_URL:K.databaseUrl,NATS_URL:K.natsUrls.join(","),NODE_ENV:K.nodeEnv,BASE_URL:G,DECOCMS_LOCAL_MODE:String(K.localMode),DECOCMS_HOME:K.dataDir,DATA_DIR:K.dataDir,DECO_CLI:"1",...K.betterAuthSecret?{BETTER_AUTH_SECRET:K.betterAuthSecret}:{},...K.s3Endpoint?{S3_ENDPOINT:K.s3Endpoint,S3_BUCKET:K.s3Bucket??"",S3_ACCESS_KEY_ID:K.s3AccessKeyId??"",S3_SECRET_ACCESS_KEY:K.s3SecretAccessKey??"",S3_FORCE_PATH_STYLE:String(K.s3ForcePathStyle)}:{},...K.natsPublicUrl&&K.natsAccountJwt&&K.natsAccountSigningKey?{NATS_PUBLIC_URL:K.natsPublicUrl,NATS_ACCOUNT_JWT:K.natsAccountJwt,NATS_ACCOUNT_SIGNING_KEY:K.natsAccountSigningKey,NATS_OPERATOR_JWT:K.natsOperatorJwt??"",NATS_TUNNEL_PUBLIC_ENABLED:"true",...K.natsCredsPath?{NATS_CREDS:K.natsCredsPath}:{}}:{}},stdio:["inherit",U?"inherit":"pipe",U?"inherit":"pipe"]});if(!U)_i1(F.stdout),_i1(F.stderr);Am(G),dD({name:"Vite",status:"ready",port:Number(Y)}),dD({name:"API",status:"ready",port:Number(K.port)});let B=async(L)=>{if(F.kill(L),await F.exited,H.length>0){let{stopServices:D}=await Promise.resolve().then(() => (r$0(),o$0));await D(K.dataDir)}};return process.on("SIGINT",()=>B("SIGINT")),process.on("SIGTERM",()=>B("SIGTERM")),{port:Number(Y),process:F}}var vl0=O(()=>{Ml0();mD();Cl0()});var l50;var xl0=O(()=>{l50={name:"decocms",version:"4.193.0",description:"Deco CMS \u2014 Self-hostable MCP Gateway for managing AI connections and tools",author:"Deco team",repository:{type:"git",url:"git+https://github.com/decocms/studio.git",directory:"apps/api"},bugs:{url:"https://github.com/decocms/studio/issues"},type:"module",bin:{deco:"./dist/server/cli.js"},files:["dist/**/*"],scripts:{dev:"bun run migrate && bun run dev:server","dev:server":"bun run --cwd=../../packages/sandbox build && NODE_ENV=development bun --env-file=.env --hot run src/index.ts",build:"bun run build:server","build:server":"bun run scripts/bundle-server-script.ts --dist ./dist/server","generate:tool-contracts":"bun run scripts/generate-tool-contracts.ts","db:migrate":"bun run ./dist/server/migrate.js",check:"tsc --noEmit",start:"bun run ./dist/server/server.js",migrate:"bun run src/database/migrate.ts",test:"bun test src","better-auth:migrate":"bunx --bun @better-auth/cli migrate -y --config src/auth/index.ts",prepublishOnly:"bun run --cwd=../.. build:studio"},optionalDependencies:{"@duckdb/node-api":"^1.5.0-r.1"},dependencies:{"@ai-sdk/anthropic":"^3.0.85","@ai-sdk/google":"^3.0.83","@ai-sdk/openai":"^3.0.73","@anthropic-ai/sdk":"^0.105.0","@aws-sdk/client-s3":"^3.1013.0","@aws-sdk/client-sts":"^3.1013.0","@aws-sdk/lib-storage":"^3.1013.0","@aws-sdk/s3-request-presigner":"^3.1013.0","@clickhouse/client":"^1.8.1","@dbos-inc/dbos-sdk":"^4.21.6","@inkjs/ui":"^2.0.0","@nats-io/jetstream":"3.4.0","@nats-io/kv":"3.4.0","@nats-io/nats-core":"3.4.0","@nats-io/transport-node":"3.4.0","@openrouter/ai-sdk-provider":"^2.9.1","@opentelemetry/core":"^2.6.0","embedded-postgres":"^18.3.0-beta.16",ink:"^6.8.0",kysely:"^0.28.12","posthog-node":"^5.0.0",react:"^19.2.6","react-dom":"^19.2.6"},devDependencies:{"@ai-sdk/provider":"^3.0.10","@better-auth/sso":"1.4.1","@decocms/better-auth":"1.5.17","@decocms/bindings":"workspace:*","@decocms/mcp-utils":"workspace:*","@decocms/runtime":"workspace:*","@decocms/sandbox":"workspace:*","@decocms/shared":"workspace:*","@jitl/quickjs-wasmfile-release-sync":"0.31.0","@modelcontextprotocol/sdk":"1.29.0","@nats-io/jwt":"0.0.10-5","@opentelemetry/api":"^1.9.0","@opentelemetry/api-logs":"^0.211.0","@opentelemetry/exporter-logs-otlp-proto":"^0.211.0","@opentelemetry/exporter-prometheus":"^0.208.0","@opentelemetry/exporter-trace-otlp-proto":"^0.207.0","@opentelemetry/instrumentation-runtime-node":"^0.24.0","@opentelemetry/resources":"^2.6.0","@opentelemetry/sdk-logs":"^0.211.0","@opentelemetry/sdk-metrics":"^2.2.0","@opentelemetry/sdk-node":"^0.207.0","@opentelemetry/sdk-trace-base":"^2.5.0","@types/bun":"^1.3.1","@types/google.maps":"^3.65.2","@types/pg":"^8.15.6","@types/react-syntax-highlighter":"^15.5.13","@vercel/nft":"^1.1.1",ai:"^6.0.208","better-auth":"1.4.22",croner:"^9.1.0",degit:"^2.8.4",hono:"^4.10.7",jose:"^6.0.11",nanoid:"^5.1.6",pg:"^8.16.3",typescript:"^7.0.2",typescript5:"npm:typescript@^5.9.3",zod:"4.3.6"},homepage:"https://github.com/decocms/studio",keywords:["mcp","model-context-protocol","ai","gateway","self-hosted","tools"],license:"MIT",publishConfig:{access:"public"}}});import{Box as hu6,Text as vi1}from"ink";import{jsx as uu6,jsxs as xi1}from"react/jsx-runtime";function fi1({version:$}){return xi1(hu6,{flexDirection:"column",marginTop:1,children:[D50.map((Z,X)=>uu6(vi1,{color:E50[X],children:Z},X)),xi1(vi1,{dimColor:!0,children:[" v",$]})]})}var bi1=O(()=>{Hm()});import{Box as iD,Text as Lw}from"ink";import{Spinner as cu6}from"@inkjs/ui";import{jsx as yY,jsxs as sf}from"react/jsx-runtime";function yi1({status:$}){if($==="pending")return yY(cu6,{label:""});return yY(Lw,{color:"green",children:"\u2713"})}function lu6($){return`${$.name}: ${$.port||"...."}`}function gi1({services:$,migrationsStatus:Z,home:X,serverUrl:Q}){return sf(iD,{flexDirection:"column",paddingBottom:1,children:[yY(fi1,{version:l50.version}),yY(iD,{marginBottom:1,children:yY(Lw,{dimColor:!0,children:"\u2500".repeat(80)})}),yY(iD,{children:sf(Lw,{dimColor:!0,children:["Home: ",X]})}),sf(iD,{gap:2,children:[$.map((Y)=>sf(iD,{gap:1,children:[yY(Lw,{children:lu6(Y)}),yY(yi1,{status:Y.status})]},Y.name)),sf(iD,{gap:1,children:[yY(Lw,{children:"Migrations"}),yY(yi1,{status:Z})]})]}),yY(iD,{children:Q?sf(Lw,{children:["Open in browser: ",yY(Lw,{color:"cyan",children:Q})]}):yY(Lw,{dimColor:!0,children:"Starting..."})})]})}var hi1=O(()=>{xl0();bi1()});import{Box as du6,Text as Im}from"ink";import{jsx as fl0,jsxs as bl0}from"react/jsx-runtime";function mu6($){if($>=500)return"red";if($>=400)return"yellow";if($>=300)return"cyan";return"green"}function ui1({logs:$}){return fl0(du6,{flexDirection:"column",children:$.map((Z,X)=>{if(Z.rawLine)return fl0(Im,{dimColor:!0,children:Z.rawLine},X);let Q=Z.duration<1000?`${Z.duration}ms`:`${(Z.duration/1000).toFixed(1)}s`;return bl0(Im,{children:[bl0(Im,{dimColor:!0,children:[Z.method.padEnd(6)," ",Z.path.padEnd(30)," "]}),fl0(Im,{color:mu6(Z.status),children:Z.status}),bl0(Im,{dimColor:!0,children:[" ",Q.padStart(8)]})]},X)})})}var ci1=()=>{};var yl0={};w0(yl0,{App:()=>pu6});import{Box as iu6}from"ink";import{useSyncExternalStore as nu6}from"react";import{jsx as li1,jsxs as tu6}from"react/jsx-runtime";function pu6({home:$}){let Z=nu6(Sl0,Vl0);return tu6(iu6,{flexDirection:"column",children:[li1(gi1,{services:Z.services,migrationsStatus:Z.migrationsStatus,home:$,serverUrl:Z.serverUrl}),li1(ui1,{logs:Z.logs})]})}var gl0=O(()=>{hi1();ci1();mD()});var KJ="thread-gate",kN="decopilot-hosted-harness",mG="automations",Dw="background-tools";var di1="7";function mi1($){return{name:"decocms",systemDatabaseUrl:$.systemDatabaseUrl,systemDatabaseSchemaName:"dbos",systemDatabasePoolSize:$.poolSize,runAdminServer:!1,executorID:$.executorID,applicationVersion:di1,...$.listenQueues!==void 0?{listenQueues:$.listenQueues}:{}}}var ii1=()=>{};function ou6(){let $=(process.env.BUN_OPTIONS??"").split(/\s+/).filter(Boolean);return[...process.argv.slice(1),...$]}function hl0($,Z){for(let X=0;X<$.length;X++){let Q=$[X];if(Q===void 0)continue;if(Q===Z)return $[X+1];if(Q.startsWith(`${Z}=`))return Q.slice(Z.length+1)}return}function ni1(){let $=ou6();if($.includes("--cpu-prof")){console.log(JSON.stringify({msg:"cpu-profiling-active",dir:hl0($,"--cpu-prof-dir")??process.cwd(),name:hl0($,"--cpu-prof-name"),markdown:$.includes("--cpu-prof-md"),intervalUs:Number(hl0($,"--cpu-prof-interval")??1000),note:"profile is written on process exit"}));return}if(process.env.CPU_PROFILE)console.warn(JSON.stringify({msg:"cpu-profiling-requested-but-inactive",hint:'CPU profiling is a Bun launch flag. Set BUN_OPTIONS="--cpu-prof --cpu-prof-md --cpu-prof-dir=/tmp" before starting the process.'}))}function pi1(){if(process.env.HEAP_WATCH!=="1")return()=>{};let $=Number(process.env.HEAP_WATCH_INTERVAL_MS??60000),Z=async()=>{let X=hD();if(!X)return;let Q={};try{let{heapStats:Y}=await import("bun:jsc"),G=Y(),J=Object.entries(G.objectTypeCounts).sort((K,W)=>W[1]-K[1]).slice(0,20);Q={objectCount:G.objectCount,heapSize:G.heapSize,top:Object.fromEntries(J)}}catch{}console.log(JSON.stringify({msg:"heap-watch",ts:new Date().toISOString(),uptimeS:Math.round(process.uptime()),rss:X.rss,heapUsed:X.heapUsed,heapTotal:X.heapTotal,external:X.external,arrayBuffers:X.arrayBuffers,...Q}))};return Z().catch(()=>{}),d50=setInterval(()=>void Z().catch(()=>{}),$),d50.unref?.(),process.on("SIGUSR2",()=>{try{let X=Bun.generateHeapSnapshot("v8"),Q=typeof X==="string"?X:JSON.stringify(X),Y=`/tmp/heap-${process.pid}-${Date.now()}.heapsnapshot`;Bun.write(Y,Q),console.log(JSON.stringify({msg:"heap-snapshot-written",path:Y}))}catch(X){console.error("[heap-watch] snapshot failed:",X)}}),()=>{if(d50)clearInterval(d50)}}var d50;var ti1=()=>{};import*as ru6 from"bun:jsc";function oi1(){if(process.env.STALL_WATCHDOG!=="1")return()=>{};let $=Number(process.env.STALL_WATCHDOG_MS??100),Z=Number(process.env.STALL_WATCHDOG_TICK_MS??50);try{au6()}catch(G){return console.error("[stall-watchdog] failed to start sampling profiler:",G),()=>{}}let X,Q=performance.now()+Z,Y=()=>{let G=performance.now(),J=G-Q;Q=G+Z;let K=[];try{K=su6()?.traces??[]}catch{}if(J>$&&K.length>0){let W=new Map;for(let N of K){let U=N.frames.find((B)=>B.sourceURL&&!/Unknown Executable/.test(B.category??""))??N.frames[0];if(!U)continue;let F=(U.sourceURL??"?").replace(/^.*\/node_modules\//,"node_modules/"),w=`${U.name??"?"} @ ${F}:${U.line??"?"}`;W.set(w,(W.get(w)??0)+1)}let H=[...W.entries()].sort((N,U)=>U[1]-N[1]).slice(0,8).map(([N,U])=>({frame:N,count:U}));console.warn(JSON.stringify({msg:"stall-stack",ts:new Date().toISOString(),lagMs:Math.round(J),samplesInWindow:K.length,top:H}))}X=setTimeout(Y,Z),X.unref?.()};return X=setTimeout(Y,Z),X.unref?.(),()=>{if(X)clearTimeout(X)}}var au6,su6;var ri1=O(()=>{({startSamplingProfiler:au6,samplingProfilerStackTraces:su6}=ru6)});function ai1(){ni1();let $=[pi1(),ac1(),oi1()];return()=>{for(let Z of $)Z()}}var si1=O(()=>{ig0();ti1();ri1()});var nD=_((ei1)=>{Object.defineProperty(ei1,"__esModule",{value:!0});ei1.RepublishHeaders=ei1.DirectMsgHeaders=ei1.JsHeaders=ei1.AdvisoryKind=void 0;ei1.isOrderedPushConsumerOptions=eu6;ei1.isPullConsumer=$c6;ei1.isPushConsumer=Zc6;ei1.isBoundPushConsumerOptions=Xc6;function eu6($){if($&&typeof $==="object")return"name_prefix"in $||"deliver_subject_prefix"in $||"filter_subjects"in $||"filter_subject"in $||"deliver_policy"in $||"opt_start_seq"in $||"opt_start_time"in $||"replay_policy"in $||"inactive_threshold"in $||"headers_only"in $||"deliver_prefix"in $;return!1}function $c6($){return $.isPullConsumer()}function Zc6($){return $.isPushConsumer()}function Xc6($){if($&&typeof $==="object")return"deliver_subject"in $||"deliver_group"in $||"idle_heartbeat"in $;return!1}ei1.AdvisoryKind={API:"api_audit",StreamAction:"stream_action",ConsumerAction:"consumer_action",SnapshotCreate:"snapshot_create",SnapshotComplete:"snapshot_complete",RestoreCreate:"restore_create",RestoreComplete:"restore_complete",MaxDeliver:"max_deliver",Terminated:"terminated",Ack:"consumer_ack",StreamLeaderElected:"stream_leader_elected",StreamQuorumLost:"stream_quorum_lost",ConsumerLeaderElected:"consumer_leader_elected",ConsumerQuorumLost:"consumer_quorum_lost"};ei1.JsHeaders={StreamSourceHdr:"Nats-Stream-Source",LastConsumerSeqHdr:"Nats-Last-Consumer",LastStreamSeqHdr:"Nats-Last-Stream",ConsumerStalledHdr:"Nats-Consumer-Stalled",MessageSizeHdr:"Nats-Msg-Size",RollupHdr:"Nats-Rollup",RollupValueSubject:"sub",RollupValueAll:"all",PendingMessagesHdr:"Nats-Pending-Messages",PendingBytesHdr:"Nats-Pending-Bytes",RequiredApiLevel:"Nats-Required-Api-Level"};ei1.DirectMsgHeaders={Stream:"Nats-Stream",Sequence:"Nats-Sequence",TimeStamp:"Nats-Time-Stamp",Subject:"Nats-Subject",LastSequence:"Nats-Last-Sequence",NumPending:"Nats-Num-Pending"};ei1.RepublishHeaders={Stream:"Nats-Stream",Subject:"Nats-Subject",Sequence:"Nats-Sequence",LastSequence:"Nats-Last-Sequence",Size:"Nats-Msg-Size"}});var gY=_((Zn1)=>{Object.defineProperty(Zn1,"__esModule",{value:!0});Zn1.TD=Zn1.TE=Zn1.Empty=void 0;Zn1.encode=Uc6;Zn1.decode=Fc6;Zn1.Empty=new Uint8Array(0);Zn1.TE=new TextEncoder;Zn1.TD=new TextDecoder;function Nc6(...$){let Z=0;for(let Y=0;Y<$.length;Y++)Z+=$[Y].length;let X=new Uint8Array(Z),Q=0;for(let Y=0;Y<$.length;Y++)X.set($[Y],Q),Q+=$[Y].length;return X}function Uc6(...$){let Z=[];for(let X=0;X<$.length;X++)Z.push(Zn1.TE.encode($[X]));if(Z.length===0)return Zn1.Empty;if(Z.length===1)return Z[0];return Nc6(...Z)}function Fc6($){if(!$||$.length===0)return"";return Zn1.TD.decode($)}});var hY=_((Yn1)=>{Object.defineProperty(Yn1,"__esModule",{value:!0});Yn1.errors=Yn1.PermissionViolationError=Yn1.NoRespondersError=Yn1.TimeoutError=Yn1.RequestError=Yn1.ProtocolError=Yn1.ConnectionError=Yn1.DrainingConnectionError=Yn1.ClosedConnectionError=Yn1.AuthorizationError=Yn1.UserAuthenticationExpiredError=Yn1.InvalidOperationError=Yn1.InvalidArgumentError=Yn1.InvalidSubjectError=void 0;class cl0 extends Error{constructor($,Z){super(`illegal subject: '${$}'`,Z);this.name="InvalidSubjectError"}}Yn1.InvalidSubjectError=cl0;class m50 extends Error{constructor($,Z){super($,Z);this.name="InvalidArgumentError"}static format($,Z,X){if(Array.isArray(Z)&&Z.length>1)Z=Z[0];if(Array.isArray($))$=$.map((Q)=>`'${Q}'`),$=$.join(",");else $=`'${$}'`;return new m50(`${$} ${Z}`,X)}}Yn1.InvalidArgumentError=m50;class ll0 extends Error{constructor($,Z){super($,Z);this.name="InvalidOperationError"}}Yn1.InvalidOperationError=ll0;class i50 extends Error{constructor($,Z){super($,Z);this.name="UserAuthenticationExpiredError"}static parse($){if($.toLowerCase().indexOf("user authentication expired")!==-1)return new i50($);return null}}Yn1.UserAuthenticationExpiredError=i50;class n50 extends Error{constructor($,Z){super($,Z);this.name="AuthorizationError"}static parse($){let Z=["authorization violation","account authentication expired","authentication timeout"],X=$.toLowerCase();for(let Q=0;Q<Z.length;Q++)if(X.indexOf(Z[Q])!==-1)return new n50($);return null}}Yn1.AuthorizationError=n50;class dl0 extends Error{constructor(){super("closed connection");this.name="ClosedConnectionError"}}Yn1.ClosedConnectionError=dl0;class ml0 extends Error{constructor(){super("connection draining");this.name="DrainingConnectionError"}}Yn1.DrainingConnectionError=ml0;class il0 extends Error{constructor($,Z){super($,Z);this.name="ConnectionError"}}Yn1.ConnectionError=il0;class nl0 extends Error{constructor($,Z){super($,Z);this.name="ProtocolError"}}Yn1.ProtocolError=nl0;class pl0 extends Error{constructor($="",Z){super($,Z);this.name="RequestError"}isNoResponders(){return this.cause instanceof p50}}Yn1.RequestError=pl0;class tl0 extends Error{constructor($){super("timeout",$);this.name="TimeoutError"}}Yn1.TimeoutError=tl0;class p50 extends Error{subject;constructor($,Z){super(`no responders: '${$}'`,Z);this.subject=$,this.name="NoResponders"}}Yn1.NoRespondersError=p50;class t50 extends Error{operation;subject;queue;constructor($,Z,X,Q,Y){super($,Y);this.name="PermissionViolationError",this.operation=Z,this.subject=X,this.queue=Q}static parse($){if(($?$.toLowerCase():"").indexOf("permissions violation")===-1)return null;let X="publish",Q="",Y=void 0,G=$.match(/(Publish|Subscription) to "(\S+)"/);if(G){if(X=G[1].toLowerCase(),Q=G[2],X==="subscription"){let J=$.match(/using queue "(\S+)"/);if(J)Y=J[1]}}return new t50($,X,Q,Y)}}Yn1.PermissionViolationError=t50;Yn1.errors={AuthorizationError:n50,ClosedConnectionError:dl0,ConnectionError:il0,DrainingConnectionError:ml0,InvalidArgumentError:m50,InvalidOperationError:ll0,InvalidSubjectError:cl0,NoRespondersError:p50,PermissionViolationError:t50,ProtocolError:nl0,RequestError:pl0,TimeoutError:tl0,UserAuthenticationExpiredError:i50}});var WJ=_((Hn1)=>{Object.defineProperty(Hn1,"__esModule",{value:!0});Hn1.SimpleMutex=Hn1.Perf=void 0;Hn1.extend=Vc6;Hn1.render=Sc6;Hn1.timeout=Cc6;Hn1.delay=_c6;Hn1.deadline=vc6;Hn1.deferred=rl0;Hn1.debugDeferred=xc6;Hn1.shuffle=fc6;Hn1.collect=bc6;Hn1.jitter=Wn1;Hn1.backoff=yc6;Hn1.nanos=gc6;Hn1.millis=hc6;Hn1.randomToken=lc6;var kc6=gY(),ol0=hY();function Vc6($,...Z){for(let X=0;X<Z.length;X++){let Q=Z[X];Object.keys(Q).forEach(function(Y){$[Y]=Q[Y]})}return $}function Sc6($){return kc6.TD.decode($).replace(/\n/g,"\u240A").replace(/\r/g,"\u240D")}function Cc6($,Z=!0){let X=Z?new ol0.TimeoutError:null,Q,Y,G=new Promise((J,K)=>{Q={cancel:()=>{if(Y)clearTimeout(Y)}},Y=setTimeout(()=>{if(X===null)K(new ol0.TimeoutError);else K(X)},$)});return Object.assign(G,Q)}function _c6($=0){let Z,X=new Promise((Q)=>{let Y=setTimeout(()=>{Q()},$);Z={cancel:()=>{if(Y)clearTimeout(Y),Q()}}});return Object.assign(X,Z)}async function vc6($,Z=1000){let X=rl0(),Q=setTimeout(()=>{X.reject(new ol0.TimeoutError)},Z);try{return await Promise.race([$,X])}finally{clearTimeout(Q)}}function rl0(){let $={},Z=new Promise((X,Q)=>{$={resolve:X,reject:Q}});return Object.assign(Z,$)}function xc6(){let $={},Z=new Promise((X,Q)=>{$={resolve:(Y)=>{console.trace("resolve",Y),X(Y)},reject:(Y)=>{console.trace("reject"),Q(Y)}}});return Object.assign(Z,$)}function fc6($){for(let Z=$.length-1;Z>0;Z--){let X=Math.floor(Math.random()*(Z+1));[$[Z],$[X]]=[$[X],$[Z]]}return $}async function bc6($){let Z=[];for await(let X of $)Z.push(X);return Z}class Jn1{timers;measures;constructor(){this.timers=new Map,this.measures=new Map}mark($){this.timers.set($,performance.now())}measure($,Z,X){let Q=this.timers.get(Z);if(Q===void 0)throw Error(`${Z} is not defined`);let Y=this.timers.get(X);if(Y===void 0)throw Error(`${X} is not defined`);this.measures.set($,Y-Q)}getEntries(){let $=[];return this.measures.forEach((Z,X)=>{$.push({name:X,duration:Z})}),$}}Hn1.Perf=Jn1;class Kn1{max;current;waiting;constructor($=1){this.max=$,this.current=0,this.waiting=[]}lock(){if(this.current++,this.current<=this.max)return Promise.resolve();let $=rl0();return this.waiting.push($),$}unlock(){this.current--,this.waiting.pop()?.resolve()}}Hn1.SimpleMutex=Kn1;function Wn1($){if($===0)return 0;return Math.floor($/2+Math.random()*$)}function yc6($=[0,250,250,500,500,3000,5000]){if(!Array.isArray($))$=[0,250,250,500,500,3000,5000];let Z=$.length-1;return{backoff(X){return Wn1(X>Z?$[Z]:$[X])}}}function gc6($){return $*1e6}function hc6($){return Math.floor($/1e6)}var uc6="0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz",VN=new Uint8Array(62);for(let $=0;$<62;$++)VN[$]=uc6.charCodeAt($);var cc6=218340105584896;function lc6(){let $=Math.floor(Math.random()*cc6),Z=$%62,X=VN[Z];$=($-Z)/62,Z=$%62;let Q=VN[Z];$=($-Z)/62,Z=$%62;let Y=VN[Z];$=($-Z)/62,Z=$%62;let G=VN[Z];$=($-Z)/62,Z=$%62;let J=VN[Z];$=($-Z)/62,Z=$%62;let K=VN[Z];$=($-Z)/62,Z=$%62;let W=VN[Z];$=($-Z)/62;let H=VN[$];return String.fromCharCode(X,Q,Y,G,J,K,W,H)}});var Dn1=_((On1)=>{Object.defineProperty(On1,"__esModule",{value:!0});On1.nuid=On1.NuidImpl=void 0;var Yl6="0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz",Ew=62,r50=12,wn1=10,Un1=33,Gl6=333,Fn1=r50+wn1,sl0=new Uint8Array(Ew);for(let $=0;$<Ew;$++)sl0[$]=Yl6.charCodeAt($);var o50=4294967296,Bn1=BigInt(Ew)**BigInt(wn1),qm=Number(Bn1/(1n<<32n)),al0=Number(Bn1%(1n<<32n));function Jl6($){for(let Z=0;Z<$.length;Z++)$[Z]=Math.floor(Math.random()*256)}function Kl6($){if(globalThis?.crypto?.getRandomValues)globalThis.crypto.getRandomValues($);else Jl6($)}class el0{buf;cbuf;seqHi;seqLo;inc;inited;constructor(){this.buf=new Uint8Array(Fn1),this.cbuf=new Uint8Array(r50),this.inited=!1}init(){this.inited=!0,this.setPre(),this.initSeqAndInc(),this.fillSeq()}initSeqAndInc(){let $=0;do this.seqHi=Math.floor(Math.random()*(qm+1)),this.seqLo=Math.floor(Math.random()*o50);while($++<8&&this.seqHi===qm&&this.seqLo>=al0);if(this.seqHi===qm&&this.seqLo>=al0)this.seqLo=0;this.inc=Math.random()*(Gl6-Un1)+Un1|0}setPre(){Kl6(this.cbuf);for(let $=0;$<r50;$++)this.buf[$]=sl0[this.cbuf[$]%Ew]}fillSeq(){let $=this.seqHi,Z=this.seqLo;for(let X=Fn1-1;X>=r50;X--){let Q=Math.floor($/Ew),G=($-Q*Ew)*o50+Z,J=Math.floor(G/Ew),K=G-J*Ew;this.buf[X]=sl0[K],$=Q,Z=J}}next(){if(!this.inited)this.init();if(this.seqLo+=this.inc,this.seqLo>=o50)this.seqLo-=o50,this.seqHi+=1;if(this.seqHi>qm||this.seqHi===qm&&this.seqLo>=al0)this.setPre(),this.initSeqAndInc();this.fillSeq();let $=this.buf;return String.fromCharCode($[0],$[1],$[2],$[3],$[4],$[5],$[6],$[7],$[8],$[9],$[10],$[11],$[12],$[13],$[14],$[15],$[16],$[17],$[18],$[19],$[20],$[21])}reset(){this.init()}}On1.NuidImpl=el0;On1.nuid=new el0});var Pn1=_((zn1)=>{Object.defineProperty(zn1,"__esModule",{value:!0});zn1.nuid=zn1.Nuid=void 0;var En1=Dn1();zn1.Nuid=En1.NuidImpl;zn1.nuid=En1.nuid});var s50=_((a50)=>{Object.defineProperty(a50,"__esModule",{value:!0});a50.nuid=a50.Nuid=void 0;var An1=Pn1();Object.defineProperty(a50,"Nuid",{enumerable:!0,get:function(){return An1.Nuid}});Object.defineProperty(a50,"nuid",{enumerable:!0,get:function(){return An1.nuid}})});var zw=_((Tn1)=>{Object.defineProperty(Tn1,"__esModule",{value:!0});Tn1.DEFAULT_HOST=Tn1.DEFAULT_PORT=Tn1.Match=void 0;Tn1.syncIterator=wl6;Tn1.createInbox=Bl6;var Ul6=s50(),Fl6=hY();Tn1.Match={Exact:"exact",CanonicalMIME:"canonical",IgnoreCase:"insensitive"};function wl6($){let Z=$[Symbol.asyncIterator]();return{async next(){let X=await Z.next();if(X.done)return Promise.resolve(null);return Promise.resolve(X.value)}}}function Bl6($=""){if($=$||"_INBOX",typeof $!=="string")throw TypeError("prefix must be a string");return $.split(".").forEach((Z)=>{if(Z==="*"||Z===">")throw Fl6.InvalidArgumentError.format("prefix",`cannot have wildcards ('${$}')`)}),`${$}.${Ul6.nuid.next()}`}Tn1.DEFAULT_PORT=4222;Tn1.DEFAULT_HOST="127.0.0.1"});var Mm=_((Mn1)=>{Object.defineProperty(Mn1,"__esModule",{value:!0});Mn1.DataBuffer=void 0;var In1=gY();class qn1{buffers;byteLength;constructor(){this.buffers=[],this.byteLength=0}static concat(...$){let Z=0;for(let Y=0;Y<$.length;Y++)Z+=$[Y].length;let X=new Uint8Array(Z),Q=0;for(let Y=0;Y<$.length;Y++)X.set($[Y],Q),Q+=$[Y].length;return X}static fromAscii($){if(!$)$="";return In1.TE.encode($)}static toAscii($){return In1.TD.decode($)}reset(){this.buffers.length=0,this.byteLength=0}pack(){if(this.buffers.length>1){let $=new Uint8Array(this.byteLength),Z=0;for(let X=0;X<this.buffers.length;X++)$.set(this.buffers[X],Z),Z+=this.buffers[X].length;this.buffers.length=0,this.buffers.push($)}}shift(){if(this.buffers.length){let $=this.buffers.shift();if($)return this.byteLength-=$.length,$}return new Uint8Array(0)}drain($){if(this.buffers.length){this.pack();let Z=this.buffers.pop();if(Z){let X=this.byteLength;if($===void 0||$>X)$=X;let Q=Z.subarray(0,$);if(X>$)this.buffers.push(Z.subarray($));return this.byteLength=X-$,Q}}return new Uint8Array(0)}fill($,...Z){if($)this.buffers.push($),this.byteLength+=$.length;for(let X=0;X<Z.length;X++)if(Z[X]&&Z[X].length)this.buffers.push(Z[X]),this.byteLength+=Z[X].length}peek(){if(this.buffers.length)return this.pack(),this.buffers[0];return new Uint8Array(0)}size(){return this.byteLength}length(){return this.buffers.length}}Mn1.DataBuffer=qn1});var pD=_((Sn1)=>{Object.defineProperty(Sn1,"__esModule",{value:!0});Sn1.LF=Sn1.CR=Sn1.CRLF=Sn1.CR_LF_LEN=Sn1.CR_LF=void 0;Sn1.setTransportFactory=Al6;Sn1.defaultPort=Tl6;Sn1.getUrlParseFn=Rl6;Sn1.newTransport=Il6;Sn1.getResolveFn=ql6;Sn1.protoLen=Vn1;Sn1.extractProtocolMessage=Ml6;var zl6=gY(),jl6=zw(),Pl6=Mm(),uY;function Al6($){uY=$}function Tl6(){return uY!==void 0&&uY.defaultPort!==void 0?uY.defaultPort:jl6.DEFAULT_PORT}function Rl6(){return uY!==void 0&&uY.urlParseFn?uY.urlParseFn:void 0}function Il6(){if(!uY||typeof uY.factory!=="function")throw Error("transport fn is not set");return uY.factory()}function ql6(){return uY!==void 0&&uY.dnsResolveFn?uY.dnsResolveFn:void 0}Sn1.CR_LF=`\r
+`);Q=G.pop()??"";for(let J of G){let K=Rm(J).replace(/^\[\d+\]\s*/,"").trim();if(!K)continue;Ow({method:"",path:"",status:0,duration:0,timestamp:new Date,rawLine:K})}}(async()=>{for(;;){let{done:G,value:J}=await Z.read();if(G)break;Q+=X.decode(J,{stream:!0}),Y()}if(Q.trim()){let G=Rm(Q).replace(/^\[\d+\]\s*/,"").trim();if(G)Ow({method:"",path:"",status:0,duration:0,timestamp:new Date,rawLine:G})}})()}async function yu6($){let{baseUrl:Z,noTui:X}=$,Q=process.env.HOST==="0.0.0.0"&&Boolean(process.env.PORT),Y=Q?process.env.PORT:$.vitePort,G=Z||`http://localhost:${Y}`,J=Q?await Tm(Number(Y)+1):await Tm(Number($.port)),{settings:K,services:W,managedServiceNames:H}=await h50({port:String(J),home:$.home,baseUrl:$.baseUrl,localMode:$.localMode,skipMigrations:$.skipMigrations,noTui:$.noTui,vitePort:$.vitePort});for(let L of W)dD({name:L.name,status:"ready",port:L.port});Pm();let N=bu6(import.meta.dir,"..","..","..","..",".."),U=X===!0,F=Bun.spawn(["bun","run","dev:servers"],{cwd:N,env:{...process.env,PORT:String(K.port),VITE_PORT:String(Y),DATABASE_URL:K.databaseUrl,NATS_URL:K.natsUrls.join(","),NODE_ENV:K.nodeEnv,BASE_URL:G,DECOCMS_LOCAL_MODE:String(K.localMode),DECOCMS_HOME:K.dataDir,DATA_DIR:K.dataDir,DECO_CLI:"1",...K.betterAuthSecret?{BETTER_AUTH_SECRET:K.betterAuthSecret}:{},...K.s3Endpoint?{S3_ENDPOINT:K.s3Endpoint,S3_BUCKET:K.s3Bucket??"",S3_ACCESS_KEY_ID:K.s3AccessKeyId??"",S3_SECRET_ACCESS_KEY:K.s3SecretAccessKey??"",S3_FORCE_PATH_STYLE:String(K.s3ForcePathStyle)}:{},...K.natsPublicUrl&&K.natsAccountJwt&&K.natsAccountSigningKey?{NATS_PUBLIC_URL:K.natsPublicUrl,NATS_ACCOUNT_JWT:K.natsAccountJwt,NATS_ACCOUNT_SIGNING_KEY:K.natsAccountSigningKey,NATS_OPERATOR_JWT:K.natsOperatorJwt??"",NATS_TUNNEL_PUBLIC_ENABLED:"true",...K.natsCredsPath?{NATS_CREDS:K.natsCredsPath}:{}}:{}},stdio:["inherit",U?"inherit":"pipe",U?"inherit":"pipe"]});if(!U)_i1(F.stdout),_i1(F.stderr);Am(G),dD({name:"Vite",status:"ready",port:Number(Y)}),dD({name:"API",status:"ready",port:Number(K.port)});let B=async(L)=>{if(F.kill(L),await F.exited,H.length>0){let{stopServices:D}=await Promise.resolve().then(() => (r$0(),o$0));await D(K.dataDir)}};return process.on("SIGINT",()=>B("SIGINT")),process.on("SIGTERM",()=>B("SIGTERM")),{port:Number(Y),process:F}}var vl0=O(()=>{Ml0();mD();Cl0()});var l50;var xl0=O(()=>{l50={name:"decocms",version:"4.193.2",description:"Deco CMS \u2014 Self-hostable MCP Gateway for managing AI connections and tools",author:"Deco team",repository:{type:"git",url:"git+https://github.com/decocms/studio.git",directory:"apps/api"},bugs:{url:"https://github.com/decocms/studio/issues"},type:"module",bin:{deco:"./dist/server/cli.js"},files:["dist/**/*"],scripts:{dev:"bun run migrate && bun run dev:server","dev:server":"bun run --cwd=../../packages/sandbox build && NODE_ENV=development bun --env-file=.env --hot run src/index.ts",build:"bun run build:server","build:server":"bun run scripts/bundle-server-script.ts --dist ./dist/server","generate:tool-contracts":"bun run scripts/generate-tool-contracts.ts","db:migrate":"bun run ./dist/server/migrate.js",check:"tsc --noEmit",start:"bun run ./dist/server/server.js",migrate:"bun run src/database/migrate.ts",test:"bun test src","better-auth:migrate":"bunx --bun @better-auth/cli migrate -y --config src/auth/index.ts",prepublishOnly:"bun run --cwd=../.. build:studio"},optionalDependencies:{"@duckdb/node-api":"^1.5.0-r.1"},dependencies:{"@ai-sdk/anthropic":"^3.0.85","@ai-sdk/google":"^3.0.83","@ai-sdk/openai":"^3.0.73","@anthropic-ai/sdk":"^0.105.0","@aws-sdk/client-s3":"^3.1013.0","@aws-sdk/client-sts":"^3.1013.0","@aws-sdk/lib-storage":"^3.1013.0","@aws-sdk/s3-request-presigner":"^3.1013.0","@clickhouse/client":"^1.8.1","@dbos-inc/dbos-sdk":"^4.21.6","@inkjs/ui":"^2.0.0","@nats-io/jetstream":"3.4.0","@nats-io/kv":"3.4.0","@nats-io/nats-core":"3.4.0","@nats-io/transport-node":"3.4.0","@openrouter/ai-sdk-provider":"^2.9.1","@opentelemetry/core":"^2.6.0","embedded-postgres":"^18.3.0-beta.16",ink:"^6.8.0",kysely:"^0.28.12","posthog-node":"^5.0.0",react:"^19.2.6","react-dom":"^19.2.6"},devDependencies:{"@ai-sdk/provider":"^3.0.10","@better-auth/sso":"1.4.1","@decocms/better-auth":"1.5.17","@decocms/bindings":"workspace:*","@decocms/mcp-utils":"workspace:*","@decocms/runtime":"workspace:*","@decocms/sandbox":"workspace:*","@decocms/shared":"workspace:*","@jitl/quickjs-wasmfile-release-sync":"0.31.0","@modelcontextprotocol/sdk":"1.29.0","@nats-io/jwt":"0.0.10-5","@opentelemetry/api":"^1.9.0","@opentelemetry/api-logs":"^0.211.0","@opentelemetry/exporter-logs-otlp-proto":"^0.211.0","@opentelemetry/exporter-prometheus":"^0.208.0","@opentelemetry/exporter-trace-otlp-proto":"^0.207.0","@opentelemetry/instrumentation-runtime-node":"^0.24.0","@opentelemetry/resources":"^2.6.0","@opentelemetry/sdk-logs":"^0.211.0","@opentelemetry/sdk-metrics":"^2.2.0","@opentelemetry/sdk-node":"^0.207.0","@opentelemetry/sdk-trace-base":"^2.5.0","@types/bun":"^1.3.1","@types/google.maps":"^3.65.2","@types/pg":"^8.15.6","@types/react-syntax-highlighter":"^15.5.13","@vercel/nft":"^1.1.1",ai:"^6.0.208","better-auth":"1.4.22",croner:"^9.1.0",degit:"^2.8.4",hono:"^4.10.7",jose:"^6.0.11",nanoid:"^5.1.6",pg:"^8.16.3",typescript:"^7.0.2",typescript5:"npm:typescript@^5.9.3",zod:"4.3.6"},homepage:"https://github.com/decocms/studio",keywords:["mcp","model-context-protocol","ai","gateway","self-hosted","tools"],license:"MIT",publishConfig:{access:"public"}}});import{Box as hu6,Text as vi1}from"ink";import{jsx as uu6,jsxs as xi1}from"react/jsx-runtime";function fi1({version:$}){return xi1(hu6,{flexDirection:"column",marginTop:1,children:[D50.map((Z,X)=>uu6(vi1,{color:E50[X],children:Z},X)),xi1(vi1,{dimColor:!0,children:[" v",$]})]})}var bi1=O(()=>{Hm()});import{Box as iD,Text as Lw}from"ink";import{Spinner as cu6}from"@inkjs/ui";import{jsx as yY,jsxs as sf}from"react/jsx-runtime";function yi1({status:$}){if($==="pending")return yY(cu6,{label:""});return yY(Lw,{color:"green",children:"\u2713"})}function lu6($){return`${$.name}: ${$.port||"...."}`}function gi1({services:$,migrationsStatus:Z,home:X,serverUrl:Q}){return sf(iD,{flexDirection:"column",paddingBottom:1,children:[yY(fi1,{version:l50.version}),yY(iD,{marginBottom:1,children:yY(Lw,{dimColor:!0,children:"\u2500".repeat(80)})}),yY(iD,{children:sf(Lw,{dimColor:!0,children:["Home: ",X]})}),sf(iD,{gap:2,children:[$.map((Y)=>sf(iD,{gap:1,children:[yY(Lw,{children:lu6(Y)}),yY(yi1,{status:Y.status})]},Y.name)),sf(iD,{gap:1,children:[yY(Lw,{children:"Migrations"}),yY(yi1,{status:Z})]})]}),yY(iD,{children:Q?sf(Lw,{children:["Open in browser: ",yY(Lw,{color:"cyan",children:Q})]}):yY(Lw,{dimColor:!0,children:"Starting..."})})]})}var hi1=O(()=>{xl0();bi1()});import{Box as du6,Text as Im}from"ink";import{jsx as fl0,jsxs as bl0}from"react/jsx-runtime";function mu6($){if($>=500)return"red";if($>=400)return"yellow";if($>=300)return"cyan";return"green"}function ui1({logs:$}){return fl0(du6,{flexDirection:"column",children:$.map((Z,X)=>{if(Z.rawLine)return fl0(Im,{dimColor:!0,children:Z.rawLine},X);let Q=Z.duration<1000?`${Z.duration}ms`:`${(Z.duration/1000).toFixed(1)}s`;return bl0(Im,{children:[bl0(Im,{dimColor:!0,children:[Z.method.padEnd(6)," ",Z.path.padEnd(30)," "]}),fl0(Im,{color:mu6(Z.status),children:Z.status}),bl0(Im,{dimColor:!0,children:[" ",Q.padStart(8)]})]},X)})})}var ci1=()=>{};var yl0={};w0(yl0,{App:()=>pu6});import{Box as iu6}from"ink";import{useSyncExternalStore as nu6}from"react";import{jsx as li1,jsxs as tu6}from"react/jsx-runtime";function pu6({home:$}){let Z=nu6(Sl0,Vl0);return tu6(iu6,{flexDirection:"column",children:[li1(gi1,{services:Z.services,migrationsStatus:Z.migrationsStatus,home:$,serverUrl:Z.serverUrl}),li1(ui1,{logs:Z.logs})]})}var gl0=O(()=>{hi1();ci1();mD()});var KJ="thread-gate",kN="decopilot-hosted-harness",mG="automations",Dw="background-tools";var di1="7";function mi1($){return{name:"decocms",systemDatabaseUrl:$.systemDatabaseUrl,systemDatabaseSchemaName:"dbos",systemDatabasePoolSize:$.poolSize,runAdminServer:!1,executorID:$.executorID,applicationVersion:di1,...$.listenQueues!==void 0?{listenQueues:$.listenQueues}:{}}}var ii1=()=>{};function ou6(){let $=(process.env.BUN_OPTIONS??"").split(/\s+/).filter(Boolean);return[...process.argv.slice(1),...$]}function hl0($,Z){for(let X=0;X<$.length;X++){let Q=$[X];if(Q===void 0)continue;if(Q===Z)return $[X+1];if(Q.startsWith(`${Z}=`))return Q.slice(Z.length+1)}return}function ni1(){let $=ou6();if($.includes("--cpu-prof")){console.log(JSON.stringify({msg:"cpu-profiling-active",dir:hl0($,"--cpu-prof-dir")??process.cwd(),name:hl0($,"--cpu-prof-name"),markdown:$.includes("--cpu-prof-md"),intervalUs:Number(hl0($,"--cpu-prof-interval")??1000),note:"profile is written on process exit"}));return}if(process.env.CPU_PROFILE)console.warn(JSON.stringify({msg:"cpu-profiling-requested-but-inactive",hint:'CPU profiling is a Bun launch flag. Set BUN_OPTIONS="--cpu-prof --cpu-prof-md --cpu-prof-dir=/tmp" before starting the process.'}))}function pi1(){if(process.env.HEAP_WATCH!=="1")return()=>{};let $=Number(process.env.HEAP_WATCH_INTERVAL_MS??60000),Z=async()=>{let X=hD();if(!X)return;let Q={};try{let{heapStats:Y}=await import("bun:jsc"),G=Y(),J=Object.entries(G.objectTypeCounts).sort((K,W)=>W[1]-K[1]).slice(0,20);Q={objectCount:G.objectCount,heapSize:G.heapSize,top:Object.fromEntries(J)}}catch{}console.log(JSON.stringify({msg:"heap-watch",ts:new Date().toISOString(),uptimeS:Math.round(process.uptime()),rss:X.rss,heapUsed:X.heapUsed,heapTotal:X.heapTotal,external:X.external,arrayBuffers:X.arrayBuffers,...Q}))};return Z().catch(()=>{}),d50=setInterval(()=>void Z().catch(()=>{}),$),d50.unref?.(),process.on("SIGUSR2",()=>{try{let X=Bun.generateHeapSnapshot("v8"),Q=typeof X==="string"?X:JSON.stringify(X),Y=`/tmp/heap-${process.pid}-${Date.now()}.heapsnapshot`;Bun.write(Y,Q),console.log(JSON.stringify({msg:"heap-snapshot-written",path:Y}))}catch(X){console.error("[heap-watch] snapshot failed:",X)}}),()=>{if(d50)clearInterval(d50)}}var d50;var ti1=()=>{};import*as ru6 from"bun:jsc";function oi1(){if(process.env.STALL_WATCHDOG!=="1")return()=>{};let $=Number(process.env.STALL_WATCHDOG_MS??100),Z=Number(process.env.STALL_WATCHDOG_TICK_MS??50);try{au6()}catch(G){return console.error("[stall-watchdog] failed to start sampling profiler:",G),()=>{}}let X,Q=performance.now()+Z,Y=()=>{let G=performance.now(),J=G-Q;Q=G+Z;let K=[];try{K=su6()?.traces??[]}catch{}if(J>$&&K.length>0){let W=new Map;for(let N of K){let U=N.frames.find((B)=>B.sourceURL&&!/Unknown Executable/.test(B.category??""))??N.frames[0];if(!U)continue;let F=(U.sourceURL??"?").replace(/^.*\/node_modules\//,"node_modules/"),w=`${U.name??"?"} @ ${F}:${U.line??"?"}`;W.set(w,(W.get(w)??0)+1)}let H=[...W.entries()].sort((N,U)=>U[1]-N[1]).slice(0,8).map(([N,U])=>({frame:N,count:U}));console.warn(JSON.stringify({msg:"stall-stack",ts:new Date().toISOString(),lagMs:Math.round(J),samplesInWindow:K.length,top:H}))}X=setTimeout(Y,Z),X.unref?.()};return X=setTimeout(Y,Z),X.unref?.(),()=>{if(X)clearTimeout(X)}}var au6,su6;var ri1=O(()=>{({startSamplingProfiler:au6,samplingProfilerStackTraces:su6}=ru6)});function ai1(){ni1();let $=[pi1(),ac1(),oi1()];return()=>{for(let Z of $)Z()}}var si1=O(()=>{ig0();ti1();ri1()});var nD=_((ei1)=>{Object.defineProperty(ei1,"__esModule",{value:!0});ei1.RepublishHeaders=ei1.DirectMsgHeaders=ei1.JsHeaders=ei1.AdvisoryKind=void 0;ei1.isOrderedPushConsumerOptions=eu6;ei1.isPullConsumer=$c6;ei1.isPushConsumer=Zc6;ei1.isBoundPushConsumerOptions=Xc6;function eu6($){if($&&typeof $==="object")return"name_prefix"in $||"deliver_subject_prefix"in $||"filter_subjects"in $||"filter_subject"in $||"deliver_policy"in $||"opt_start_seq"in $||"opt_start_time"in $||"replay_policy"in $||"inactive_threshold"in $||"headers_only"in $||"deliver_prefix"in $;return!1}function $c6($){return $.isPullConsumer()}function Zc6($){return $.isPushConsumer()}function Xc6($){if($&&typeof $==="object")return"deliver_subject"in $||"deliver_group"in $||"idle_heartbeat"in $;return!1}ei1.AdvisoryKind={API:"api_audit",StreamAction:"stream_action",ConsumerAction:"consumer_action",SnapshotCreate:"snapshot_create",SnapshotComplete:"snapshot_complete",RestoreCreate:"restore_create",RestoreComplete:"restore_complete",MaxDeliver:"max_deliver",Terminated:"terminated",Ack:"consumer_ack",StreamLeaderElected:"stream_leader_elected",StreamQuorumLost:"stream_quorum_lost",ConsumerLeaderElected:"consumer_leader_elected",ConsumerQuorumLost:"consumer_quorum_lost"};ei1.JsHeaders={StreamSourceHdr:"Nats-Stream-Source",LastConsumerSeqHdr:"Nats-Last-Consumer",LastStreamSeqHdr:"Nats-Last-Stream",ConsumerStalledHdr:"Nats-Consumer-Stalled",MessageSizeHdr:"Nats-Msg-Size",RollupHdr:"Nats-Rollup",RollupValueSubject:"sub",RollupValueAll:"all",PendingMessagesHdr:"Nats-Pending-Messages",PendingBytesHdr:"Nats-Pending-Bytes",RequiredApiLevel:"Nats-Required-Api-Level"};ei1.DirectMsgHeaders={Stream:"Nats-Stream",Sequence:"Nats-Sequence",TimeStamp:"Nats-Time-Stamp",Subject:"Nats-Subject",LastSequence:"Nats-Last-Sequence",NumPending:"Nats-Num-Pending"};ei1.RepublishHeaders={Stream:"Nats-Stream",Subject:"Nats-Subject",Sequence:"Nats-Sequence",LastSequence:"Nats-Last-Sequence",Size:"Nats-Msg-Size"}});var gY=_((Zn1)=>{Object.defineProperty(Zn1,"__esModule",{value:!0});Zn1.TD=Zn1.TE=Zn1.Empty=void 0;Zn1.encode=Uc6;Zn1.decode=Fc6;Zn1.Empty=new Uint8Array(0);Zn1.TE=new TextEncoder;Zn1.TD=new TextDecoder;function Nc6(...$){let Z=0;for(let Y=0;Y<$.length;Y++)Z+=$[Y].length;let X=new Uint8Array(Z),Q=0;for(let Y=0;Y<$.length;Y++)X.set($[Y],Q),Q+=$[Y].length;return X}function Uc6(...$){let Z=[];for(let X=0;X<$.length;X++)Z.push(Zn1.TE.encode($[X]));if(Z.length===0)return Zn1.Empty;if(Z.length===1)return Z[0];return Nc6(...Z)}function Fc6($){if(!$||$.length===0)return"";return Zn1.TD.decode($)}});var hY=_((Yn1)=>{Object.defineProperty(Yn1,"__esModule",{value:!0});Yn1.errors=Yn1.PermissionViolationError=Yn1.NoRespondersError=Yn1.TimeoutError=Yn1.RequestError=Yn1.ProtocolError=Yn1.ConnectionError=Yn1.DrainingConnectionError=Yn1.ClosedConnectionError=Yn1.AuthorizationError=Yn1.UserAuthenticationExpiredError=Yn1.InvalidOperationError=Yn1.InvalidArgumentError=Yn1.InvalidSubjectError=void 0;class cl0 extends Error{constructor($,Z){super(`illegal subject: '${$}'`,Z);this.name="InvalidSubjectError"}}Yn1.InvalidSubjectError=cl0;class m50 extends Error{constructor($,Z){super($,Z);this.name="InvalidArgumentError"}static format($,Z,X){if(Array.isArray(Z)&&Z.length>1)Z=Z[0];if(Array.isArray($))$=$.map((Q)=>`'${Q}'`),$=$.join(",");else $=`'${$}'`;return new m50(`${$} ${Z}`,X)}}Yn1.InvalidArgumentError=m50;class ll0 extends Error{constructor($,Z){super($,Z);this.name="InvalidOperationError"}}Yn1.InvalidOperationError=ll0;class i50 extends Error{constructor($,Z){super($,Z);this.name="UserAuthenticationExpiredError"}static parse($){if($.toLowerCase().indexOf("user authentication expired")!==-1)return new i50($);return null}}Yn1.UserAuthenticationExpiredError=i50;class n50 extends Error{constructor($,Z){super($,Z);this.name="AuthorizationError"}static parse($){let Z=["authorization violation","account authentication expired","authentication timeout"],X=$.toLowerCase();for(let Q=0;Q<Z.length;Q++)if(X.indexOf(Z[Q])!==-1)return new n50($);return null}}Yn1.AuthorizationError=n50;class dl0 extends Error{constructor(){super("closed connection");this.name="ClosedConnectionError"}}Yn1.ClosedConnectionError=dl0;class ml0 extends Error{constructor(){super("connection draining");this.name="DrainingConnectionError"}}Yn1.DrainingConnectionError=ml0;class il0 extends Error{constructor($,Z){super($,Z);this.name="ConnectionError"}}Yn1.ConnectionError=il0;class nl0 extends Error{constructor($,Z){super($,Z);this.name="ProtocolError"}}Yn1.ProtocolError=nl0;class pl0 extends Error{constructor($="",Z){super($,Z);this.name="RequestError"}isNoResponders(){return this.cause instanceof p50}}Yn1.RequestError=pl0;class tl0 extends Error{constructor($){super("timeout",$);this.name="TimeoutError"}}Yn1.TimeoutError=tl0;class p50 extends Error{subject;constructor($,Z){super(`no responders: '${$}'`,Z);this.subject=$,this.name="NoResponders"}}Yn1.NoRespondersError=p50;class t50 extends Error{operation;subject;queue;constructor($,Z,X,Q,Y){super($,Y);this.name="PermissionViolationError",this.operation=Z,this.subject=X,this.queue=Q}static parse($){if(($?$.toLowerCase():"").indexOf("permissions violation")===-1)return null;let X="publish",Q="",Y=void 0,G=$.match(/(Publish|Subscription) to "(\S+)"/);if(G){if(X=G[1].toLowerCase(),Q=G[2],X==="subscription"){let J=$.match(/using queue "(\S+)"/);if(J)Y=J[1]}}return new t50($,X,Q,Y)}}Yn1.PermissionViolationError=t50;Yn1.errors={AuthorizationError:n50,ClosedConnectionError:dl0,ConnectionError:il0,DrainingConnectionError:ml0,InvalidArgumentError:m50,InvalidOperationError:ll0,InvalidSubjectError:cl0,NoRespondersError:p50,PermissionViolationError:t50,ProtocolError:nl0,RequestError:pl0,TimeoutError:tl0,UserAuthenticationExpiredError:i50}});var WJ=_((Hn1)=>{Object.defineProperty(Hn1,"__esModule",{value:!0});Hn1.SimpleMutex=Hn1.Perf=void 0;Hn1.extend=Vc6;Hn1.render=Sc6;Hn1.timeout=Cc6;Hn1.delay=_c6;Hn1.deadline=vc6;Hn1.deferred=rl0;Hn1.debugDeferred=xc6;Hn1.shuffle=fc6;Hn1.collect=bc6;Hn1.jitter=Wn1;Hn1.backoff=yc6;Hn1.nanos=gc6;Hn1.millis=hc6;Hn1.randomToken=lc6;var kc6=gY(),ol0=hY();function Vc6($,...Z){for(let X=0;X<Z.length;X++){let Q=Z[X];Object.keys(Q).forEach(function(Y){$[Y]=Q[Y]})}return $}function Sc6($){return kc6.TD.decode($).replace(/\n/g,"\u240A").replace(/\r/g,"\u240D")}function Cc6($,Z=!0){let X=Z?new ol0.TimeoutError:null,Q,Y,G=new Promise((J,K)=>{Q={cancel:()=>{if(Y)clearTimeout(Y)}},Y=setTimeout(()=>{if(X===null)K(new ol0.TimeoutError);else K(X)},$)});return Object.assign(G,Q)}function _c6($=0){let Z,X=new Promise((Q)=>{let Y=setTimeout(()=>{Q()},$);Z={cancel:()=>{if(Y)clearTimeout(Y),Q()}}});return Object.assign(X,Z)}async function vc6($,Z=1000){let X=rl0(),Q=setTimeout(()=>{X.reject(new ol0.TimeoutError)},Z);try{return await Promise.race([$,X])}finally{clearTimeout(Q)}}function rl0(){let $={},Z=new Promise((X,Q)=>{$={resolve:X,reject:Q}});return Object.assign(Z,$)}function xc6(){let $={},Z=new Promise((X,Q)=>{$={resolve:(Y)=>{console.trace("resolve",Y),X(Y)},reject:(Y)=>{console.trace("reject"),Q(Y)}}});return Object.assign(Z,$)}function fc6($){for(let Z=$.length-1;Z>0;Z--){let X=Math.floor(Math.random()*(Z+1));[$[Z],$[X]]=[$[X],$[Z]]}return $}async function bc6($){let Z=[];for await(let X of $)Z.push(X);return Z}class Jn1{timers;measures;constructor(){this.timers=new Map,this.measures=new Map}mark($){this.timers.set($,performance.now())}measure($,Z,X){let Q=this.timers.get(Z);if(Q===void 0)throw Error(`${Z} is not defined`);let Y=this.timers.get(X);if(Y===void 0)throw Error(`${X} is not defined`);this.measures.set($,Y-Q)}getEntries(){let $=[];return this.measures.forEach((Z,X)=>{$.push({name:X,duration:Z})}),$}}Hn1.Perf=Jn1;class Kn1{max;current;waiting;constructor($=1){this.max=$,this.current=0,this.waiting=[]}lock(){if(this.current++,this.current<=this.max)return Promise.resolve();let $=rl0();return this.waiting.push($),$}unlock(){this.current--,this.waiting.pop()?.resolve()}}Hn1.SimpleMutex=Kn1;function Wn1($){if($===0)return 0;return Math.floor($/2+Math.random()*$)}function yc6($=[0,250,250,500,500,3000,5000]){if(!Array.isArray($))$=[0,250,250,500,500,3000,5000];let Z=$.length-1;return{backoff(X){return Wn1(X>Z?$[Z]:$[X])}}}function gc6($){return $*1e6}function hc6($){return Math.floor($/1e6)}var uc6="0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz",VN=new Uint8Array(62);for(let $=0;$<62;$++)VN[$]=uc6.charCodeAt($);var cc6=218340105584896;function lc6(){let $=Math.floor(Math.random()*cc6),Z=$%62,X=VN[Z];$=($-Z)/62,Z=$%62;let Q=VN[Z];$=($-Z)/62,Z=$%62;let Y=VN[Z];$=($-Z)/62,Z=$%62;let G=VN[Z];$=($-Z)/62,Z=$%62;let J=VN[Z];$=($-Z)/62,Z=$%62;let K=VN[Z];$=($-Z)/62,Z=$%62;let W=VN[Z];$=($-Z)/62;let H=VN[$];return String.fromCharCode(X,Q,Y,G,J,K,W,H)}});var Dn1=_((On1)=>{Object.defineProperty(On1,"__esModule",{value:!0});On1.nuid=On1.NuidImpl=void 0;var Yl6="0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz",Ew=62,r50=12,wn1=10,Un1=33,Gl6=333,Fn1=r50+wn1,sl0=new Uint8Array(Ew);for(let $=0;$<Ew;$++)sl0[$]=Yl6.charCodeAt($);var o50=4294967296,Bn1=BigInt(Ew)**BigInt(wn1),qm=Number(Bn1/(1n<<32n)),al0=Number(Bn1%(1n<<32n));function Jl6($){for(let Z=0;Z<$.length;Z++)$[Z]=Math.floor(Math.random()*256)}function Kl6($){if(globalThis?.crypto?.getRandomValues)globalThis.crypto.getRandomValues($);else Jl6($)}class el0{buf;cbuf;seqHi;seqLo;inc;inited;constructor(){this.buf=new Uint8Array(Fn1),this.cbuf=new Uint8Array(r50),this.inited=!1}init(){this.inited=!0,this.setPre(),this.initSeqAndInc(),this.fillSeq()}initSeqAndInc(){let $=0;do this.seqHi=Math.floor(Math.random()*(qm+1)),this.seqLo=Math.floor(Math.random()*o50);while($++<8&&this.seqHi===qm&&this.seqLo>=al0);if(this.seqHi===qm&&this.seqLo>=al0)this.seqLo=0;this.inc=Math.random()*(Gl6-Un1)+Un1|0}setPre(){Kl6(this.cbuf);for(let $=0;$<r50;$++)this.buf[$]=sl0[this.cbuf[$]%Ew]}fillSeq(){let $=this.seqHi,Z=this.seqLo;for(let X=Fn1-1;X>=r50;X--){let Q=Math.floor($/Ew),G=($-Q*Ew)*o50+Z,J=Math.floor(G/Ew),K=G-J*Ew;this.buf[X]=sl0[K],$=Q,Z=J}}next(){if(!this.inited)this.init();if(this.seqLo+=this.inc,this.seqLo>=o50)this.seqLo-=o50,this.seqHi+=1;if(this.seqHi>qm||this.seqHi===qm&&this.seqLo>=al0)this.setPre(),this.initSeqAndInc();this.fillSeq();let $=this.buf;return String.fromCharCode($[0],$[1],$[2],$[3],$[4],$[5],$[6],$[7],$[8],$[9],$[10],$[11],$[12],$[13],$[14],$[15],$[16],$[17],$[18],$[19],$[20],$[21])}reset(){this.init()}}On1.NuidImpl=el0;On1.nuid=new el0});var Pn1=_((zn1)=>{Object.defineProperty(zn1,"__esModule",{value:!0});zn1.nuid=zn1.Nuid=void 0;var En1=Dn1();zn1.Nuid=En1.NuidImpl;zn1.nuid=En1.nuid});var s50=_((a50)=>{Object.defineProperty(a50,"__esModule",{value:!0});a50.nuid=a50.Nuid=void 0;var An1=Pn1();Object.defineProperty(a50,"Nuid",{enumerable:!0,get:function(){return An1.Nuid}});Object.defineProperty(a50,"nuid",{enumerable:!0,get:function(){return An1.nuid}})});var zw=_((Tn1)=>{Object.defineProperty(Tn1,"__esModule",{value:!0});Tn1.DEFAULT_HOST=Tn1.DEFAULT_PORT=Tn1.Match=void 0;Tn1.syncIterator=wl6;Tn1.createInbox=Bl6;var Ul6=s50(),Fl6=hY();Tn1.Match={Exact:"exact",CanonicalMIME:"canonical",IgnoreCase:"insensitive"};function wl6($){let Z=$[Symbol.asyncIterator]();return{async next(){let X=await Z.next();if(X.done)return Promise.resolve(null);return Promise.resolve(X.value)}}}function Bl6($=""){if($=$||"_INBOX",typeof $!=="string")throw TypeError("prefix must be a string");return $.split(".").forEach((Z)=>{if(Z==="*"||Z===">")throw Fl6.InvalidArgumentError.format("prefix",`cannot have wildcards ('${$}')`)}),`${$}.${Ul6.nuid.next()}`}Tn1.DEFAULT_PORT=4222;Tn1.DEFAULT_HOST="127.0.0.1"});var Mm=_((Mn1)=>{Object.defineProperty(Mn1,"__esModule",{value:!0});Mn1.DataBuffer=void 0;var In1=gY();class qn1{buffers;byteLength;constructor(){this.buffers=[],this.byteLength=0}static concat(...$){let Z=0;for(let Y=0;Y<$.length;Y++)Z+=$[Y].length;let X=new Uint8Array(Z),Q=0;for(let Y=0;Y<$.length;Y++)X.set($[Y],Q),Q+=$[Y].length;return X}static fromAscii($){if(!$)$="";return In1.TE.encode($)}static toAscii($){return In1.TD.decode($)}reset(){this.buffers.length=0,this.byteLength=0}pack(){if(this.buffers.length>1){let $=new Uint8Array(this.byteLength),Z=0;for(let X=0;X<this.buffers.length;X++)$.set(this.buffers[X],Z),Z+=this.buffers[X].length;this.buffers.length=0,this.buffers.push($)}}shift(){if(this.buffers.length){let $=this.buffers.shift();if($)return this.byteLength-=$.length,$}return new Uint8Array(0)}drain($){if(this.buffers.length){this.pack();let Z=this.buffers.pop();if(Z){let X=this.byteLength;if($===void 0||$>X)$=X;let Q=Z.subarray(0,$);if(X>$)this.buffers.push(Z.subarray($));return this.byteLength=X-$,Q}}return new Uint8Array(0)}fill($,...Z){if($)this.buffers.push($),this.byteLength+=$.length;for(let X=0;X<Z.length;X++)if(Z[X]&&Z[X].length)this.buffers.push(Z[X]),this.byteLength+=Z[X].length}peek(){if(this.buffers.length)return this.pack(),this.buffers[0];return new Uint8Array(0)}size(){return this.byteLength}length(){return this.buffers.length}}Mn1.DataBuffer=qn1});var pD=_((Sn1)=>{Object.defineProperty(Sn1,"__esModule",{value:!0});Sn1.LF=Sn1.CR=Sn1.CRLF=Sn1.CR_LF_LEN=Sn1.CR_LF=void 0;Sn1.setTransportFactory=Al6;Sn1.defaultPort=Tl6;Sn1.getUrlParseFn=Rl6;Sn1.newTransport=Il6;Sn1.getResolveFn=ql6;Sn1.protoLen=Vn1;Sn1.extractProtocolMessage=Ml6;var zl6=gY(),jl6=zw(),Pl6=Mm(),uY;function Al6($){uY=$}function Tl6(){return uY!==void 0&&uY.defaultPort!==void 0?uY.defaultPort:jl6.DEFAULT_PORT}function Rl6(){return uY!==void 0&&uY.urlParseFn?uY.urlParseFn:void 0}function Il6(){if(!uY||typeof uY.factory!=="function")throw Error("transport fn is not set");return uY.factory()}function ql6(){return uY!==void 0&&uY.dnsResolveFn?uY.dnsResolveFn:void 0}Sn1.CR_LF=`\r
 `;Sn1.CR_LF_LEN=Sn1.CR_LF.length;Sn1.CRLF=Pl6.DataBuffer.fromAscii(Sn1.CR_LF);Sn1.CR=new Uint8Array(Sn1.CRLF)[0];Sn1.LF=new Uint8Array(Sn1.CRLF)[1];function Vn1($){for(let Z=0;Z<$.length;Z++){let X=Z+1;if($.byteLength>X&&$[Z]===Sn1.CR&&$[X]===Sn1.LF)return X+1}return 0}function Ml6($){let Z=Vn1($);if(Z>0){let Q=new Uint8Array($).slice(0,Z);return zl6.TD.decode(Q)}return""}});var Yd0=_((gn1)=>{Object.defineProperty(gn1,"__esModule",{value:!0});gn1.ipV4=fn1;gn1.isIP=gl6;gn1.parseIP=bn1;var km=4,tD=16,e50=48,xn1=57,_n1=65,bl6=70,vn1=97,yl6=102,Qd0=16777215;function fn1($,Z,X,Q){let Y=new Uint8Array(tD);return[0,0,0,0,0,0,0,0,0,0,255,255].forEach((J,K)=>{Y[K]=J}),Y[12]=$,Y[13]=Z,Y[14]=X,Y[15]=Q,Y}function gl6($){return bn1($)!==void 0}function bn1($){for(let Z=0;Z<$.length;Z++)switch($[Z]){case".":return yn1($);case":":return hl6($)}return}function yn1($){let Z=new Uint8Array(km);for(let X=0;X<km;X++){if($.length===0)return;if(X>0){if($[0]!==".")return;$=$.substring(1)}let{n:Q,c:Y,ok:G}=ul6($);if(!G||Q>255)return;$=$.substring(Y),Z[X]=Q}return fn1(Z[0],Z[1],Z[2],Z[3])}function hl6($){let Z=new Uint8Array(tD),X=-1;if($.length>=2&&$[0]===":"&&$[1]===":"){if(X=0,$=$.substring(2),$.length===0)return Z}let Q=0;while(Q<tD){let{n:Y,c:G,ok:J}=cl6($);if(!J||Y>65535)return;if(G<$.length&&$[G]==="."){if(X<0&&Q!=tD-km)return;if(Q+km>tD)return;let K=yn1($);if(K===void 0)return;Z[Q]=K[12],Z[Q+1]=K[13],Z[Q+2]=K[14],Z[Q+3]=K[15],$="",Q+=km;break}if(Z[Q]=Y>>8,Z[Q+1]=Y,Q+=2,$=$.substring(G),$.length===0)break;if($[0]!==":"||$.length==1)return;if($=$.substring(1),$[0]===":"){if(X>=0)return;if(X=Q,$=$.substring(1),$.length===0)break}}if($.length!==0)return;if(Q<tD){if(X<0)return;let Y=tD-Q;for(let G=Q-1;G>=X;G--)Z[G+Y]=Z[G];for(let G=X+Y-1;G>=X;G--)Z[G]=0}else if(X>=0)return;return Z}function ul6($){let Z=0,X=0;for(Z=0;Z<$.length&&e50<=$.charCodeAt(Z)&&$.charCodeAt(Z)<=xn1;Z++)if(X=X*10+($.charCodeAt(Z)-e50),X>=Qd0)return{n:Qd0,c:Z,ok:!1};if(Z===0)return{n:0,c:0,ok:!1};return{n:X,c:Z,ok:!0}}function cl6($){let Z=0,X=0;for(X=0;X<$.length;X++){if(e50<=$.charCodeAt(X)&&$.charCodeAt(X)<=xn1)Z*=16,Z+=$.charCodeAt(X)-e50;else if(vn1<=$.charCodeAt(X)&&$.charCodeAt(X)<=yl6)Z*=16,Z+=$.charCodeAt(X)-vn1+10;else if(_n1<=$.charCodeAt(X)&&$.charCodeAt(X)<=bl6)Z*=16,Z+=$.charCodeAt(X)-_n1+10;else break;if(Z>=Qd0)return{n:0,c:X,ok:!1}}if(X===0)return{n:0,c:X,ok:!1};return{n:Z,c:X,ok:!0}}});var Nd0=_((un1)=>{Object.defineProperty(un1,"__esModule",{value:!0});un1.Servers=un1.ServerImpl=void 0;un1.isIPV4OrHostname=hn1;un1.hostPort=Hd0;var Gd0=pD(),Jd0=WJ(),Kd0=Yd0(),il6=zw(),nl6=hY();function hn1($){if($.indexOf("[")!==-1||$.indexOf("::")!==-1)return!1;if($.indexOf(".")!==-1)return!0;if($.split(":").length<=2)return!0;return!1}function Wd0($){return!hn1($)}function pl6($){let X=$.toUpperCase().indexOf("::FFFF:");if(X!==-1&&$.indexOf(".")!==-1){let Q=$.substring(X+7);return Q=Q.replace("[",""),Q.replace("]","")}return $}function Hd0($){if($=$.trim(),$.match(/^(.*:\/\/)(.*)/m))$=$.replace(/^(.*:\/\/)(.*)/gm,"$2");if($=pl6($),Wd0($)&&$.indexOf("[")===-1)$=`[${$}]`;let Z=Wd0($)?$.match(/(]:)(\d+)/):$.match(/(:)(\d+)/),X=Z&&Z.length===3&&Z[1]&&Z[2]?parseInt(Z[2]):il6.DEFAULT_PORT,Y=new URL(`${X===80?"https":"http"}://${$}`);Y.port=`${X}`;let G=Y.hostname;if(G.charAt(0)==="[")G=G.substring(1,G.length-1);return{listen:Y.host,hostname:G,port:X}}class ef{src;listen;hostname;port;didConnect;reconnects;lastConnect;gossiped;tlsName;resolves;constructor($,Z=!1){this.src=$,this.tlsName="";let X=Hd0($);this.listen=X.listen,this.hostname=X.hostname,this.port=X.port,this.didConnect=!1,this.reconnects=0,this.lastConnect=0,this.gossiped=Z}toString(){return this.listen}async resolve($){if(!$.fn||$.resolve===!1)return[this];let Z=[];if((0,Kd0.isIP)(this.hostname))return[this];else{let X=await $.fn(this.hostname);if($.debug)console.log(`resolve ${this.hostname} = ${X.join(",")}`);for(let Q of X){let Y=this.port===80?"https":"http",G=new URL(`${Y}://${Wd0(Q)?"["+Q+"]":Q}`);G.port=`${this.port}`;let J=new ef(G.host,!1);J.tlsName=this.hostname,Z.push(J)}}if($.randomize)(0,Jd0.shuffle)(Z);return this.resolves=Z,Z}}un1.ServerImpl=ef;class $90{firstSelect;servers;currentServer;tlsName;randomize;constructor($={}){this.firstSelect=!0,this.servers=[],this.tlsName="",this.randomize=$.randomize||!1}setServers($){if(!Array.isArray($)||$.length===0)throw nl6.InvalidArgumentError.format("servers","cannot be empty");let Z=(0,Gd0.getUrlParseFn)(),X=new Map;for(let Y of this.servers)X.set(Y.listen,Y);let Q=[];for(let Y of $){Y=Z?Z(Y):Y;let{listen:G}=Hd0(Y),J=X.get(G);if(J)J.gossiped=!1,Q.push(J);else Q.push(new ef(Y))}if(this.randomize)(0,Jd0.shuffle)(Q);if(this.servers=Q,this.currentServer===void 0||!Q.includes(this.currentServer))this.currentServer=Q[0],this.firstSelect=!0}clear(){this.servers.length=0}updateTLSName(){let $=this.getCurrentServer();if(!(0,Kd0.isIP)($.hostname))this.tlsName=$.hostname,this.servers.forEach((Z)=>{if(Z.gossiped)Z.tlsName=this.tlsName})}getCurrentServer(){return this.currentServer}addServer($,Z=!1){let X=(0,Gd0.getUrlParseFn)();$=X?X($):$;let Q=new ef($,Z);if((0,Kd0.isIP)(Q.hostname))Q.tlsName=this.tlsName;this.servers.push(Q)}selectServer(){if(this.firstSelect)return this.firstSelect=!1,this.currentServer;let $=this.servers.shift();if($)this.servers.push($),this.currentServer=$;return $}removeCurrentServer(){this.removeServer(this.currentServer)}removeServer($){if($){let Z=this.servers.indexOf($);this.servers.splice(Z,1)}}snapshot(){return $90.freezeAll(this.servers)}snapshotForHandler(){let $=this.currentServer;if(!$)return this.snapshot();let Z=this.servers.indexOf($);if(Z<=0)return this.snapshot();return $90.freezeAll([$,...this.servers.slice(0,Z),...this.servers.slice(Z+1)])}static freezeAll($){return $.map((Z)=>Object.freeze({hostname:Z.hostname,port:Z.port,listen:Z.listen,src:Z.src,tlsName:Z.tlsName,reconnects:Z.reconnects,lastConnect:Z.lastConnect,gossiped:Z.gossiped,didConnect:Z.didConnect}))}find($){return this.servers.find((Z)=>Z.listen===$.listen)}setCurrent($){this.currentServer=$}length(){return this.servers.length}next(){return this.servers.length?this.servers[0]:void 0}getServers(){return this.servers}update($,Z){let X=[],Q=[],Y=(0,Gd0.getUrlParseFn)(),G=new Map;if($.connect_urls&&$.connect_urls.length>0)$.connect_urls.forEach((K)=>{K=Y?Y(K,Z):K;let W=new ef(K,!0);G.set(K,W)});let J=[];if(this.servers.forEach((K,W)=>{let H=K.listen;if(K.gossiped&&this.currentServer.listen!==H&&G.get(H)===void 0)J.push(W);G.delete(H)}),J.reverse(),J.forEach((K)=>{let W=this.servers.splice(K,1);Q=Q.concat(W[0].listen)}),G.forEach((K,W)=>{this.servers.push(K),X.push(W)}),this.randomize&&X.length>0){let K=this.currentServer,W=this.servers.filter((H)=>H!==K);(0,Jd0.shuffle)(W),this.servers=K?[K,...W]:W}return{added:X,deleted:Q}}}un1.Servers=$90});var Z90=_((mn1)=>{Object.defineProperty(mn1,"__esModule",{value:!0});mn1.QueuedIteratorImpl=void 0;var Ud0=WJ(),ln1=hY();class dn1{inflight;processed;received;noIterator;iterClosed;done;signal;yields;filtered;pendingFiltered;ctx;_data;err;time;profile;yielding;didBreak;constructor(){this.inflight=0,this.filtered=0,this.pendingFiltered=0,this.processed=0,this.received=0,this.noIterator=!1,this.done=!1,this.signal=(0,Ud0.deferred)(),this.yields=[],this.iterClosed=(0,Ud0.deferred)(),this.time=0,this.yielding=!1,this.didBreak=!1,this.profile=!1}[Symbol.asyncIterator](){return this.iterate()}push($){if(this.done)return;if(this.didBreak){if(typeof $==="function"){let Z=$;try{Z()}catch(X){}}return}if(typeof $==="function")this.pendingFiltered++;this.yields.push($),this.signal.resolve()}async*iterate(){if(this.noIterator)throw new ln1.InvalidOperationError("iterator cannot be used when a callback is registered");if(this.yielding)throw new ln1.InvalidOperationError("iterator is already yielding");this.yielding=!0;try{while(!0){if(this.yields.length===0)await this.signal;if(this.err)throw this.err;let $=this.yields;this.inflight=$.length,this.yields=[];for(let Z=0;Z<$.length;Z++){if(typeof $[Z]==="function"){this.pendingFiltered--;let Q=$[Z];try{Q()}catch(Y){throw Y}if(this.err)throw this.err;continue}this.processed++,this.inflight--;let X=this.profile?Date.now():0;yield $[Z],this.time=this.profile?Date.now()-X:0}if(this.done)break;else if(this.yields.length===0)$.length=0,this.yields=$,this.signal=(0,Ud0.deferred)()}}finally{this.didBreak=!0,this.stop()}}stop($){if(this.done)return;this.err=$,this.done=!0,this.signal.resolve(),this.iterClosed.resolve($)}getProcessed(){return this.noIterator?this.received:this.processed}getPending(){return this.yields.length+this.inflight-this.pendingFiltered}getReceived(){return this.received-this.filtered}}mn1.QueuedIteratorImpl=dn1});var Fd0=_((tn1)=>{Object.defineProperty(tn1,"__esModule",{value:!0});tn1.MuxSubscription=void 0;var al6=zw(),nn1=hY();class pn1{baseInbox;reqs;constructor(){this.reqs=new Map}size(){return this.reqs.size}init($){return this.baseInbox=`${(0,al6.createInbox)($)}.`,this.baseInbox}add($){if(!isNaN($.received))$.received=0;this.reqs.set($.token,$)}get($){return this.reqs.get($)}cancel($){this.reqs.delete($.token)}getToken($){let Z=$.subject||"";if(Z.indexOf(this.baseInbox)===0)return Z.substring(this.baseInbox.length);return null}all(){return Array.from(this.reqs.values())}handleError($,Z){if($)return this.all().forEach((X)=>{X.resolver(Z,{})}),!0;if(Z.operation==="publish"){let X=this.all().find((Q)=>{return Q.requestSubject===Z.subject});if(X)return X.resolver(Z,{}),!0}return!1}dispatcher(){return($,Z)=>{let X=this.getToken(Z);if(X){let Q=this.get(X);if(Q){if($===null)$=Z?.data?.length===0&&Z.headers?.code===503?new nn1.NoRespondersError(Q.requestSubject):null;Q.resolver($,Z)}}}}close(){let $=new nn1.RequestError("connection closed");this.reqs.forEach((Z)=>{Z.resolver($,{})})}}tn1.MuxSubscription=pn1});var wd0=_((an1)=>{Object.defineProperty(an1,"__esModule",{value:!0});an1.Heartbeat=void 0;var sl6=WJ();class rn1{ph;interval;maxOut;timer;pendings;constructor($,Z,X){this.ph=$,this.interval=Z,this.maxOut=X,this.pendings=[]}start(){this.cancel(),this._schedule()}cancel($){if(this.timer)clearTimeout(this.timer),this.timer=void 0;if(this._reset(),$)this.ph.disconnect()}_schedule(){this.timer=setTimeout(()=>{if(this.ph.dispatchStatus({type:"ping",pendingPings:this.pendings.length+1}),this.pendings.length===this.maxOut){this.cancel(!0);return}let $=(0,sl6.deferred)();this.ph.flush($).then(()=>{this._reset()}).catch(()=>{this.cancel()}),this.pendings.push($),this._schedule()},this.interval)}_reset(){this.pendings=this.pendings.filter(($)=>{return $.resolve(),!1})}}an1.Heartbeat=rn1});var Ld0=_((Xp1)=>{Object.defineProperty(Xp1,"__esModule",{value:!0});Xp1.DenoBuffer=Xp1.MAX_SIZE=Xp1.AssertionError=void 0;Xp1.assert=$p1;Xp1.concat=Zp1;Xp1.append=$d6;Xp1.readAll=Zd6;Xp1.writeAll=Xd6;var el6=gY();class Bd0 extends Error{constructor($){super($);this.name="AssertionError"}}Xp1.AssertionError=Bd0;function $p1($,Z="Assertion failed."){if(!$)throw new Bd0(Z)}var en1=32768;Xp1.MAX_SIZE=4294967294;function X90($,Z,X=0){let Q=Z.byteLength-X;if($.byteLength>Q)$=$.subarray(0,Q);return Z.set($,X),$.byteLength}function Zp1($,Z){if($===void 0&&Z===void 0)return new Uint8Array(0);if($===void 0)return Z;if(Z===void 0)return $;let X=new Uint8Array($.length+Z.length);return X.set($,0),X.set(Z,$.length),X}function $d6($,Z){return Zp1($,Uint8Array.of(Z))}class Od0{_buf;_off;constructor($){if(this._off=0,$==null){this._buf=new Uint8Array(0);return}this._buf=new Uint8Array($)}bytes($={copy:!0}){if($.copy===!1)return this._buf.subarray(this._off);return this._buf.slice(this._off)}empty(){return this._buf.byteLength<=this._off}get length(){return this._buf.byteLength-this._off}get capacity(){return this._buf.buffer.byteLength}truncate($){if($===0){this.reset();return}if($<0||$>this.length)throw Error("bytes.Buffer: truncation out of range");this._reslice(this._off+$)}reset(){this._reslice(0),this._off=0}_tryGrowByReslice($){let Z=this._buf.byteLength;if($<=this.capacity-Z)return this._reslice(Z+$),Z;return-1}_reslice($){$p1($<=this._buf.buffer.byteLength),this._buf=new Uint8Array(this._buf.buffer,0,$)}readByte(){let $=new Uint8Array(1);if(this.read($))return $[0];return null}read($){if(this.empty()){if(this.reset(),$.byteLength===0)return 0;return null}let Z=X90(this._buf.subarray(this._off),$);return this._off+=Z,Z}writeByte($){return this.write(Uint8Array.of($))}writeString($){return this.write(el6.TE.encode($))}write($){let Z=this._grow($.byteLength);return X90($,this._buf,Z)}_grow($){let Z=this.length;if(Z===0&&this._off!==0)this.reset();let X=this._tryGrowByReslice($);if(X>=0)return X;let Q=this.capacity;if($<=Math.floor(Q/2)-Z)X90(this._buf.subarray(this._off),this._buf);else if(Q+$>Xp1.MAX_SIZE)throw Error("The buffer cannot be grown beyond the maximum size.");else{let Y=new Uint8Array(Math.min(2*Q+$,Xp1.MAX_SIZE));X90(this._buf.subarray(this._off),Y),this._buf=Y}return this._off=0,this._reslice(Math.min(Z+$,Xp1.MAX_SIZE)),Z}grow($){if($<0)throw Error("Buffer._grow: negative count");let Z=this._grow($);this._reslice(Z)}readFrom($){let Z=0,X=new Uint8Array(en1);while(!0){let Q=this.capacity-this.length<en1,Y=Q?X:new Uint8Array(this._buf.buffer,this.length),G=$.read(Y);if(G===null)return Z;if(Q)this.write(Y.subarray(0,G));else this._reslice(this.length+G);Z+=G}}}Xp1.DenoBuffer=Od0;function Zd6($){let Z=new Od0;return Z.readFrom($),Z.bytes()}function Xd6($,Z){let X=0;while(X<Z.length)X+=$.write(Z.subarray(X))}});var zd0=_((Kp1)=>{Object.defineProperty(Kp1,"__esModule",{value:!0});Kp1.cc=Kp1.State=Kp1.Parser=Kp1.Kind=void 0;Kp1.describe=Hd6;var Dd0=Ld0(),Ed0=gY();Kp1.Kind={OK:0,ERR:1,MSG:2,INFO:3,PING:4,PONG:5};function Hd6($){let Z,X="";switch($.kind){case Kp1.Kind.MSG:Z="MSG";break;case Kp1.Kind.OK:Z="OK";break;case Kp1.Kind.ERR:Z="ERR",X=Ed0.TD.decode($.data);break;case Kp1.Kind.PING:Z="PING";break;case Kp1.Kind.PONG:Z="PONG";break;case Kp1.Kind.INFO:Z="INFO",X=Ed0.TD.decode($.data)}return`${Z}: ${X}`}function Yp1(){let $={};return $.sid=-1,$.hdr=-1,$.size=-1,$}var Gp1=48,Nd6=57,$b=67108864;class Jp1{dispatcher;state;as;drop;hdr;ma;argBuf;msgBuf;constructor($){this.dispatcher=$,this.state=Kp1.State.OP_START,this.as=0,this.drop=0,this.hdr=0}parse($){let Z;for(Z=0;Z<$.length;Z++){let X=$[Z];switch(this.state){case Kp1.State.OP_START:switch(X){case Kp1.cc.M:case Kp1.cc.m:this.state=Kp1.State.OP_M,this.hdr=-1,this.ma=Yp1();break;case Kp1.cc.H:case Kp1.cc.h:this.state=Kp1.State.OP_H,this.hdr=0,this.ma=Yp1();break;case Kp1.cc.P:case Kp1.cc.p:this.state=Kp1.State.OP_P;break;case Kp1.cc.PLUS:this.state=Kp1.State.OP_PLUS;break;case Kp1.cc.MINUS:this.state=Kp1.State.OP_MINUS;break;case Kp1.cc.I:case Kp1.cc.i:this.state=Kp1.State.OP_I;break;default:throw this.fail($.subarray(Z))}break;case Kp1.State.OP_H:switch(X){case Kp1.cc.M:case Kp1.cc.m:this.state=Kp1.State.OP_M;break;default:throw this.fail($.subarray(Z))}break;case Kp1.State.OP_M:switch(X){case Kp1.cc.S:case Kp1.cc.s:this.state=Kp1.State.OP_MS;break;default:throw this.fail($.subarray(Z))}break;case Kp1.State.OP_MS:switch(X){case Kp1.cc.G:case Kp1.cc.g:this.state=Kp1.State.OP_MSG;break;default:throw this.fail($.subarray(Z))}break;case Kp1.State.OP_MSG:switch(X){case Kp1.cc.SPACE:case Kp1.cc.TAB:this.state=Kp1.State.OP_MSG_SPC;break;default:throw this.fail($.subarray(Z))}break;case Kp1.State.OP_MSG_SPC:switch(X){case Kp1.cc.SPACE:case Kp1.cc.TAB:continue;default:this.state=Kp1.State.MSG_ARG,this.as=Z}break;case Kp1.State.MSG_ARG:switch(X){case Kp1.cc.CR:this.drop=1;break;case Kp1.cc.NL:{let Q=this.argBuf?this.argBuf.bytes():$.subarray(this.as,Z-this.drop);this.processMsgArgs(Q),this.drop=0,this.as=Z+1,this.state=Kp1.State.MSG_PAYLOAD,Z=this.as+this.ma.size-1;break}default:if(this.argBuf)this.argBuf.writeByte(X)}break;case Kp1.State.MSG_PAYLOAD:if(this.msgBuf)if(this.msgBuf.length>=this.ma.size){let Q=this.msgBuf.bytes({copy:!1});this.dispatcher.push({kind:Kp1.Kind.MSG,msg:this.ma,data:Q}),this.argBuf=void 0,this.msgBuf=void 0,this.state=Kp1.State.MSG_END}else{let Q=this.ma.size-this.msgBuf.length,Y=$.length-Z;if(Y<Q)Q=Y;if(Q>0)this.msgBuf.write($.subarray(Z,Z+Q)),Z=Z+Q-1;else this.msgBuf.writeByte(X)}else if(Z-this.as>=this.ma.size)this.dispatcher.push({kind:Kp1.Kind.MSG,msg:this.ma,data:$.subarray(this.as,Z)}),this.argBuf=void 0,this.msgBuf=void 0,this.state=Kp1.State.MSG_END;break;case Kp1.State.MSG_END:switch(X){case Kp1.cc.NL:this.drop=0,this.as=Z+1,this.state=Kp1.State.OP_START;break;default:continue}break;case Kp1.State.OP_PLUS:switch(X){case Kp1.cc.O:case Kp1.cc.o:this.state=Kp1.State.OP_PLUS_O;break;default:throw this.fail($.subarray(Z))}break;case Kp1.State.OP_PLUS_O:switch(X){case Kp1.cc.K:case Kp1.cc.k:this.state=Kp1.State.OP_PLUS_OK;break;default:throw this.fail($.subarray(Z))}break;case Kp1.State.OP_PLUS_OK:switch(X){case Kp1.cc.NL:this.dispatcher.push({kind:Kp1.Kind.OK}),this.drop=0,this.state=Kp1.State.OP_START;break}break;case Kp1.State.OP_MINUS:switch(X){case Kp1.cc.E:case Kp1.cc.e:this.state=Kp1.State.OP_MINUS_E;break;default:throw this.fail($.subarray(Z))}break;case Kp1.State.OP_MINUS_E:switch(X){case Kp1.cc.R:case Kp1.cc.r:this.state=Kp1.State.OP_MINUS_ER;break;default:throw this.fail($.subarray(Z))}break;case Kp1.State.OP_MINUS_ER:switch(X){case Kp1.cc.R:case Kp1.cc.r:this.state=Kp1.State.OP_MINUS_ERR;break;default:throw this.fail($.subarray(Z))}break;case Kp1.State.OP_MINUS_ERR:switch(X){case Kp1.cc.SPACE:case Kp1.cc.TAB:this.state=Kp1.State.OP_MINUS_ERR_SPC;break;default:throw this.fail($.subarray(Z))}break;case Kp1.State.OP_MINUS_ERR_SPC:switch(X){case Kp1.cc.SPACE:case Kp1.cc.TAB:continue;default:this.state=Kp1.State.MINUS_ERR_ARG,this.as=Z}break;case Kp1.State.MINUS_ERR_ARG:switch(X){case Kp1.cc.CR:this.drop=1;break;case Kp1.cc.NL:{let Q;if(this.argBuf)Q=this.argBuf.bytes(),this.argBuf=void 0;else Q=$.subarray(this.as,Z-this.drop);this.dispatcher.push({kind:Kp1.Kind.ERR,data:Q}),this.drop=0,this.as=Z+1,this.state=Kp1.State.OP_START;break}default:if(this.argBuf)this.argBuf.write(Uint8Array.of(X))}break;case Kp1.State.OP_P:switch(X){case Kp1.cc.I:case Kp1.cc.i:this.state=Kp1.State.OP_PI;break;case Kp1.cc.O:case Kp1.cc.o:this.state=Kp1.State.OP_PO;break;default:throw this.fail($.subarray(Z))}break;case Kp1.State.OP_PO:switch(X){case Kp1.cc.N:case Kp1.cc.n:this.state=Kp1.State.OP_PON;break;default:throw this.fail($.subarray(Z))}break;case Kp1.State.OP_PON:switch(X){case Kp1.cc.G:case Kp1.cc.g:this.state=Kp1.State.OP_PONG;break;default:throw this.fail($.subarray(Z))}break;case Kp1.State.OP_PONG:switch(X){case Kp1.cc.NL:this.dispatcher.push({kind:Kp1.Kind.PONG}),this.drop=0,this.state=Kp1.State.OP_START;break}break;case Kp1.State.OP_PI:switch(X){case Kp1.cc.N:case Kp1.cc.n:this.state=Kp1.State.OP_PIN;break;default:throw this.fail($.subarray(Z))}break;case Kp1.State.OP_PIN:switch(X){case Kp1.cc.G:case Kp1.cc.g:this.state=Kp1.State.OP_PING;break;default:throw this.fail($.subarray(Z))}break;case Kp1.State.OP_PING:switch(X){case Kp1.cc.NL:this.dispatcher.push({kind:Kp1.Kind.PING}),this.drop=0,this.state=Kp1.State.OP_START;break}break;case Kp1.State.OP_I:switch(X){case Kp1.cc.N:case Kp1.cc.n:this.state=Kp1.State.OP_IN;break;default:throw this.fail($.subarray(Z))}break;case Kp1.State.OP_IN:switch(X){case Kp1.cc.F:case Kp1.cc.f:this.state=Kp1.State.OP_INF;break;default:throw this.fail($.subarray(Z))}break;case Kp1.State.OP_INF:switch(X){case Kp1.cc.O:case Kp1.cc.o:this.state=Kp1.State.OP_INFO;break;default:throw this.fail($.subarray(Z))}break;case Kp1.State.OP_INFO:switch(X){case Kp1.cc.SPACE:case Kp1.cc.TAB:this.state=Kp1.State.OP_INFO_SPC;break;default:throw this.fail($.subarray(Z))}break;case Kp1.State.OP_INFO_SPC:switch(X){case Kp1.cc.SPACE:case Kp1.cc.TAB:continue;default:this.state=Kp1.State.INFO_ARG,this.as=Z}break;case Kp1.State.INFO_ARG:switch(X){case Kp1.cc.CR:this.drop=1;break;case Kp1.cc.NL:{let Q;if(this.argBuf)Q=this.argBuf.bytes(),this.argBuf=void 0;else Q=$.subarray(this.as,Z-this.drop);this.dispatcher.push({kind:Kp1.Kind.INFO,data:Q}),this.drop=0,this.as=Z+1,this.state=Kp1.State.OP_START;break}default:if(this.argBuf)this.argBuf.writeByte(X)}break;default:throw this.fail($.subarray(Z))}}if((this.state===Kp1.State.MSG_ARG||this.state===Kp1.State.MINUS_ERR_ARG||this.state===Kp1.State.INFO_ARG)&&!this.argBuf)this.argBuf=new Dd0.DenoBuffer($.subarray(this.as,Z-this.drop));if(this.state===Kp1.State.MSG_PAYLOAD&&!this.msgBuf){if(!this.argBuf)this.cloneMsgArg();this.msgBuf=new Dd0.DenoBuffer($.subarray(this.as))}}cloneMsgArg(){let $=this.ma.subject.length,Z=this.ma.reply?this.ma.reply.length:0,X=new Uint8Array($+Z);if(X.set(this.ma.subject),this.ma.reply)X.set(this.ma.reply,$);if(this.argBuf=new Dd0.DenoBuffer(X),this.ma.subject=X.subarray(0,$),this.ma.reply)this.ma.reply=X.subarray($)}processMsgArgs($){if(this.hdr>=0)return this.processHeaderMsgArgs($);let Z=[],X=-1;for(let Q=0;Q<$.length;Q++)switch($[Q]){case Kp1.cc.SPACE:case Kp1.cc.TAB:case Kp1.cc.CR:case Kp1.cc.NL:if(X>=0)Z.push($.subarray(X,Q)),X=-1;break;default:if(X<0)X=Q}if(X>=0)Z.push($.subarray(X));switch(Z.length){case 3:this.ma.subject=Z[0],this.ma.sid=this.protoParseInt(Z[1]),this.ma.reply=void 0,this.ma.size=this.protoParseInt(Z[2],$b);break;case 4:this.ma.subject=Z[0],this.ma.sid=this.protoParseInt(Z[1]),this.ma.reply=Z[2],this.ma.size=this.protoParseInt(Z[3],$b);break;default:throw this.fail($,"processMsgArgs Parse Error")}if(this.ma.sid<0)throw this.fail($,"processMsgArgs Bad or Missing Sid Error");if(this.ma.size<0)throw this.fail($,"processMsgArgs Bad or Missing Size Error")}fail($,Z=""){if(!Z)Z=`parse error [${this.state}]`;else Z=`${Z} [${this.state}]`;return Error(`${Z}: ${Ed0.TD.decode($)}`)}processHeaderMsgArgs($){let Z=[],X=-1;for(let Q=0;Q<$.length;Q++)switch($[Q]){case Kp1.cc.SPACE:case Kp1.cc.TAB:case Kp1.cc.CR:case Kp1.cc.NL:if(X>=0)Z.push($.subarray(X,Q)),X=-1;break;default:if(X<0)X=Q}if(X>=0)Z.push($.subarray(X));switch(Z.length){case 4:this.ma.subject=Z[0],this.ma.sid=this.protoParseInt(Z[1]),this.ma.reply=void 0,this.ma.hdr=this.protoParseInt(Z[2],$b),this.ma.size=this.protoParseInt(Z[3],$b);break;case 5:this.ma.subject=Z[0],this.ma.sid=this.protoParseInt(Z[1]),this.ma.reply=Z[2],this.ma.hdr=this.protoParseInt(Z[3],$b),this.ma.size=this.protoParseInt(Z[4],$b);break;default:throw this.fail($,"processHeaderMsgArgs Parse Error")}if(this.ma.sid<0)throw this.fail($,"processHeaderMsgArgs Bad or Missing Sid Error");if(this.ma.hdr<0||this.ma.hdr>this.ma.size)throw this.fail($,"processHeaderMsgArgs Bad or Missing Header Size Error");if(this.ma.size<0)throw this.fail($,"processHeaderMsgArgs Bad or Missing Size Error")}protoParseInt($,Z){if($.length===0||$.length>15)return-1;let X=0;for(let Q=0;Q<$.length;Q++){if($[Q]<Gp1||$[Q]>Nd6)return-1;X=X*10+($[Q]-Gp1)}return Z!==void 0&&X>Z?-1:X}}Kp1.Parser=Jp1;Kp1.State={OP_START:0,OP_PLUS:1,OP_PLUS_O:2,OP_PLUS_OK:3,OP_MINUS:4,OP_MINUS_E:5,OP_MINUS_ER:6,OP_MINUS_ERR:7,OP_MINUS_ERR_SPC:8,MINUS_ERR_ARG:9,OP_M:10,OP_MS:11,OP_MSG:12,OP_MSG_SPC:13,MSG_ARG:14,MSG_PAYLOAD:15,MSG_END:16,OP_H:17,OP_P:18,OP_PI:19,OP_PIN:20,OP_PING:21,OP_PO:22,OP_PON:23,OP_PONG:24,OP_I:25,OP_IN:26,OP_INF:27,OP_INFO:28,OP_INFO_SPC:29,INFO_ARG:30};Kp1.cc={CR:13,E:69,e:101,F:70,f:102,G:71,g:103,H:72,h:104,I:73,i:105,K:75,k:107,M:77,m:109,MINUS:45,N:78,n:110,NL:10,O:79,o:111,P:80,p:112,PLUS:43,R:82,r:114,S:83,s:115,SPACE:32,TAB:9}});var G90=_((Hp1)=>{Object.defineProperty(Hp1,"__esModule",{value:!0});Hp1.MsgHdrsImpl=void 0;Hp1.canonicalMIMEHeaderKey=Pd0;Hp1.headers=wd6;var Wp1=gY(),HJ=zw(),Y90=hY();function Pd0($){let N=!0,U=Array($.length);for(let F=0;F<$.length;F++){let w=$.charCodeAt(F);if(w===58||w<33||w>126)throw Y90.InvalidArgumentError.format("header",`'${$[F]}' is not a valid character in a header name`);if(N&&97<=w&&w<=122)w-=32;else if(!N&&65<=w&&w<=90)w+=32;U[F]=w,N=w==45}return String.fromCharCode(...U)}function wd6($=0,Z=""){if($===0&&Z!=="")throw Y90.InvalidArgumentError.format("code","is required");else if($>0&&Z==="")throw Y90.InvalidArgumentError.format("description","is required");return new Zb($,Z)}var jd0="NATS/1.0";class Zb{_code;headers;_description;constructor($=0,Z=""){this._code=$,this._description=Z,this.headers=new Map}[Symbol.iterator](){return this.headers.entries()}size(){return this.headers.size}equals($){if($&&this.headers.size===$.headers.size&&this._code===$._code){for(let[Z,X]of this.headers){let Q=$.values(Z);if(X.length!==Q.length)return!1;let Y=[...X].sort(),G=[...Q].sort();for(let J=0;J<Y.length;J++)if(Y[J]!==G[J])return!1}return!0}return!1}static decode($){let Z=new Zb,Q=Wp1.TD.decode($).split(`\r
 `),Y=Q[0];if(Y!==jd0){let G=Y.replace(jd0,"").trim();if(G.length>0){if(Z._code=parseInt(G,10),isNaN(Z._code))Z._code=0;let J=Z._code.toString();G=G.replace(J,""),Z._description=G.trim()}}if(Q.length>=1)Q.slice(1).map((G)=>{if(G){let J=G.indexOf(":");if(J>-1){let K=G.slice(0,J),W=G.slice(J+1).trim();Z.append(K,W)}}});return Z}toString(){if(this.headers.size===0&&this._code===0)return"";let $=jd0;if(this._code>0&&this._description!=="")$+=` ${this._code} ${this._description}`;for(let[Z,X]of this.headers)for(let Q=0;Q<X.length;Q++)$=`${$}\r
 ${Z}: ${X[Q]}`;return`${$}\r
@@ -2451,8 +2451,8 @@ ${H}`:H;return{...J,description:N,inputExamples:X?void 0:J.inputExamples}});retu
 
 `)},flush($){$.enqueue(`data: [DONE]
 
-`)}})}},p61={"content-type":"text/event-stream","cache-control":"no-cache",connection:"keep-alive","x-vercel-ai-ui-message-stream":"v1","x-accel-buffering":"no"};jr=w1.record(w1.string(),Zj.optional()),t61=V0(()=>K0(w1.union([w1.strictObject({type:w1.literal("text-start"),id:w1.string(),providerMetadata:L8.optional()}),w1.strictObject({type:w1.literal("text-delta"),id:w1.string(),delta:w1.string(),providerMetadata:L8.optional()}),w1.strictObject({type:w1.literal("text-end"),id:w1.string(),providerMetadata:L8.optional()}),w1.strictObject({type:w1.literal("error"),errorText:w1.string()}),w1.strictObject({type:w1.literal("tool-input-start"),toolCallId:w1.string(),toolName:w1.string(),providerExecuted:w1.boolean().optional(),providerMetadata:L8.optional(),toolMetadata:jr.optional(),dynamic:w1.boolean().optional(),title:w1.string().optional()}),w1.strictObject({type:w1.literal("tool-input-delta"),toolCallId:w1.string(),inputTextDelta:w1.string()}),w1.strictObject({type:w1.literal("tool-input-available"),toolCallId:w1.string(),toolName:w1.string(),input:w1.unknown(),providerExecuted:w1.boolean().optional(),providerMetadata:L8.optional(),toolMetadata:jr.optional(),dynamic:w1.boolean().optional(),title:w1.string().optional()}),w1.strictObject({type:w1.literal("tool-input-error"),toolCallId:w1.string(),toolName:w1.string(),input:w1.unknown(),providerExecuted:w1.boolean().optional(),providerMetadata:L8.optional(),toolMetadata:jr.optional(),dynamic:w1.boolean().optional(),errorText:w1.string(),title:w1.string().optional()}),w1.strictObject({type:w1.literal("tool-approval-request"),approvalId:w1.string(),toolCallId:w1.string(),signature:w1.string().optional()}),w1.strictObject({type:w1.literal("tool-output-available"),toolCallId:w1.string(),output:w1.unknown(),providerExecuted:w1.boolean().optional(),providerMetadata:L8.optional(),toolMetadata:jr.optional(),dynamic:w1.boolean().optional(),preliminary:w1.boolean().optional()}),w1.strictObject({type:w1.literal("tool-output-error"),toolCallId:w1.string(),errorText:w1.string(),providerExecuted:w1.boolean().optional(),providerMetadata:L8.optional(),toolMetadata:jr.optional(),dynamic:w1.boolean().optional()}),w1.strictObject({type:w1.literal("tool-output-denied"),toolCallId:w1.string()}),w1.strictObject({type:w1.literal("reasoning-start"),id:w1.string(),providerMetadata:L8.optional()}),w1.strictObject({type:w1.literal("reasoning-delta"),id:w1.string(),delta:w1.string(),providerMetadata:L8.optional()}),w1.strictObject({type:w1.literal("reasoning-end"),id:w1.string(),providerMetadata:L8.optional()}),w1.strictObject({type:w1.literal("source-url"),sourceId:w1.string(),url:w1.string(),title:w1.string().optional(),providerMetadata:L8.optional()}),w1.strictObject({type:w1.literal("source-document"),sourceId:w1.string(),mediaType:w1.string(),title:w1.string(),filename:w1.string().optional(),providerMetadata:L8.optional()}),w1.strictObject({type:w1.literal("file"),url:w1.string(),mediaType:w1.string(),providerMetadata:L8.optional()}),w1.strictObject({type:w1.custom(($)=>typeof $==="string"&&$.startsWith("data-"),{message:'Type must start with "data-"'}),id:w1.string().optional(),data:w1.unknown(),transient:w1.boolean().optional()}),w1.strictObject({type:w1.literal("start-step")}),w1.strictObject({type:w1.literal("finish-step")}),w1.strictObject({type:w1.literal("start"),messageId:w1.string().optional(),messageMetadata:w1.unknown().optional()}),w1.strictObject({type:w1.literal("finish"),finishReason:w1.enum(["stop","length","content-filter","tool-calls","error","other"]).optional(),messageMetadata:w1.unknown().optional()}),w1.strictObject({type:w1.literal("abort"),reason:w1.string().optional()}),w1.strictObject({type:w1.literal("message-metadata"),messageMetadata:w1.unknown()})])));fM4=T3;bM4=Tr;gM4=mJ({prefix:"aitxt",size:24}),hM4={file:!0,source:!0,"text-start":!0,"text-end":!0,"text-delta":!0,"reasoning-start":!0,"reasoning-end":!0,"reasoning-delta":!0,"tool-input-start":!0,"tool-input-end":!0,"tool-input-delta":!0,"tool-approval-request":!0,"tool-call":!0,"tool-result":!0,"tool-error":!0,"stream-start":!1,"response-metadata":!1,finish:!1,error:!1,raw:!1};YY=B0.record(B0.string(),Zj.optional()),mM4=V0(()=>K0(B0.array(B0.object({id:B0.string(),role:B0.enum(["system","user","assistant"]),metadata:B0.unknown().optional(),parts:B0.array(B0.union([B0.object({type:B0.literal("text"),text:B0.string(),state:B0.enum(["streaming","done"]).optional(),providerMetadata:L8.optional()}),B0.object({type:B0.literal("reasoning"),text:B0.string(),state:B0.enum(["streaming","done"]).optional(),providerMetadata:L8.optional()}),B0.object({type:B0.literal("source-url"),sourceId:B0.string(),url:B0.string(),title:B0.string().optional(),providerMetadata:L8.optional()}),B0.object({type:B0.literal("source-document"),sourceId:B0.string(),mediaType:B0.string(),title:B0.string(),filename:B0.string().optional(),providerMetadata:L8.optional()}),B0.object({type:B0.literal("file"),mediaType:B0.string(),filename:B0.string().optional(),url:B0.string(),providerMetadata:L8.optional()}),B0.object({type:B0.literal("step-start")}),B0.object({type:B0.string().startsWith("data-"),id:B0.string().optional(),data:B0.unknown()}),B0.object({type:B0.literal("dynamic-tool"),toolName:B0.string(),toolCallId:B0.string(),toolMetadata:YY.optional(),state:B0.literal("input-streaming"),input:B0.unknown().optional(),providerExecuted:B0.boolean().optional(),callProviderMetadata:L8.optional(),output:B0.never().optional(),errorText:B0.never().optional(),approval:B0.never().optional()}),B0.object({type:B0.literal("dynamic-tool"),toolName:B0.string(),toolCallId:B0.string(),toolMetadata:YY.optional(),state:B0.literal("input-available"),input:B0.unknown(),providerExecuted:B0.boolean().optional(),output:B0.never().optional(),errorText:B0.never().optional(),callProviderMetadata:L8.optional(),approval:B0.never().optional()}),B0.object({type:B0.literal("dynamic-tool"),toolName:B0.string(),toolCallId:B0.string(),toolMetadata:YY.optional(),state:B0.literal("approval-requested"),input:B0.unknown(),providerExecuted:B0.boolean().optional(),output:B0.never().optional(),errorText:B0.never().optional(),callProviderMetadata:L8.optional(),approval:B0.object({id:B0.string(),approved:B0.never().optional(),reason:B0.never().optional(),signature:B0.string().optional()})}),B0.object({type:B0.literal("dynamic-tool"),toolName:B0.string(),toolCallId:B0.string(),toolMetadata:YY.optional(),state:B0.literal("approval-responded"),input:B0.unknown(),providerExecuted:B0.boolean().optional(),output:B0.never().optional(),errorText:B0.never().optional(),callProviderMetadata:L8.optional(),approval:B0.object({id:B0.string(),approved:B0.boolean(),reason:B0.string().optional(),signature:B0.string().optional()})}),B0.object({type:B0.literal("dynamic-tool"),toolName:B0.string(),toolCallId:B0.string(),toolMetadata:YY.optional(),state:B0.literal("output-available"),input:B0.unknown(),providerExecuted:B0.boolean().optional(),output:B0.unknown(),errorText:B0.never().optional(),callProviderMetadata:L8.optional(),resultProviderMetadata:L8.optional(),preliminary:B0.boolean().optional(),approval:B0.object({id:B0.string(),approved:B0.literal(!0),reason:B0.string().optional(),signature:B0.string().optional()}).optional()}),B0.object({type:B0.literal("dynamic-tool"),toolName:B0.string(),toolCallId:B0.string(),toolMetadata:YY.optional(),state:B0.literal("output-error"),input:B0.unknown().optional(),rawInput:B0.unknown().optional(),providerExecuted:B0.boolean().optional(),output:B0.never().optional(),errorText:B0.string(),callProviderMetadata:L8.optional(),resultProviderMetadata:L8.optional(),approval:B0.object({id:B0.string(),approved:B0.literal(!0),reason:B0.string().optional(),signature:B0.string().optional()}).optional()}),B0.object({type:B0.literal("dynamic-tool"),toolName:B0.string(),toolCallId:B0.string(),toolMetadata:YY.optional(),state:B0.literal("output-denied"),input:B0.unknown(),providerExecuted:B0.boolean().optional(),output:B0.never().optional(),errorText:B0.never().optional(),callProviderMetadata:L8.optional(),approval:B0.object({id:B0.string(),approved:B0.literal(!1),reason:B0.string().optional(),signature:B0.string().optional()})}),B0.object({type:B0.string().startsWith("tool-"),toolCallId:B0.string(),toolMetadata:YY.optional(),state:B0.literal("input-streaming"),providerExecuted:B0.boolean().optional(),callProviderMetadata:L8.optional(),input:B0.unknown().optional(),output:B0.never().optional(),errorText:B0.never().optional(),approval:B0.never().optional()}),B0.object({type:B0.string().startsWith("tool-"),toolCallId:B0.string(),toolMetadata:YY.optional(),state:B0.literal("input-available"),providerExecuted:B0.boolean().optional(),input:B0.unknown(),output:B0.never().optional(),errorText:B0.never().optional(),callProviderMetadata:L8.optional(),approval:B0.never().optional()}),B0.object({type:B0.string().startsWith("tool-"),toolCallId:B0.string(),toolMetadata:YY.optional(),state:B0.literal("approval-requested"),input:B0.unknown(),providerExecuted:B0.boolean().optional(),output:B0.never().optional(),errorText:B0.never().optional(),callProviderMetadata:L8.optional(),approval:B0.object({id:B0.string(),approved:B0.never().optional(),reason:B0.never().optional(),signature:B0.string().optional()})}),B0.object({type:B0.string().startsWith("tool-"),toolCallId:B0.string(),toolMetadata:YY.optional(),state:B0.literal("approval-responded"),input:B0.unknown(),providerExecuted:B0.boolean().optional(),output:B0.never().optional(),errorText:B0.never().optional(),callProviderMetadata:L8.optional(),approval:B0.object({id:B0.string(),approved:B0.boolean(),reason:B0.string().optional(),signature:B0.string().optional()})}),B0.object({type:B0.string().startsWith("tool-"),toolCallId:B0.string(),toolMetadata:YY.optional(),state:B0.literal("output-available"),providerExecuted:B0.boolean().optional(),input:B0.unknown(),output:B0.unknown(),errorText:B0.never().optional(),callProviderMetadata:L8.optional(),resultProviderMetadata:L8.optional(),preliminary:B0.boolean().optional(),approval:B0.object({id:B0.string(),approved:B0.literal(!0),reason:B0.string().optional(),signature:B0.string().optional()}).optional()}),B0.object({type:B0.string().startsWith("tool-"),toolCallId:B0.string(),toolMetadata:YY.optional(),state:B0.literal("output-error"),providerExecuted:B0.boolean().optional(),input:B0.unknown().optional(),rawInput:B0.unknown().optional(),output:B0.never().optional(),errorText:B0.string(),callProviderMetadata:L8.optional(),resultProviderMetadata:L8.optional(),approval:B0.object({id:B0.string(),approved:B0.literal(!0),reason:B0.string().optional(),signature:B0.string().optional()}).optional()}),B0.object({type:B0.string().startsWith("tool-"),toolCallId:B0.string(),toolMetadata:YY.optional(),state:B0.literal("output-denied"),providerExecuted:B0.boolean().optional(),input:B0.unknown(),output:B0.never().optional(),errorText:B0.never().optional(),callProviderMetadata:L8.optional(),approval:B0.object({id:B0.string(),approved:B0.literal(!1),reason:B0.string().optional(),signature:B0.string().optional()})})])).nonempty("Message must contain at least one part")})).nonempty("Messages array must not be empty")));eM4=t30,$k4={type:"no-schema",jsonSchema:async()=>{return},async validatePartialResult({value:$,textDelta:Z}){return{success:!0,value:{partial:$,textDelta:Z}}},async validateFinalResult($,Z){return $===void 0?{success:!1,error:new JY({message:"No object generated: response did not match schema.",text:Z.text,response:Z.response,usage:Z.usage,finishReason:Z.finishReason})}:{success:!0,value:$}},createElementStream(){throw new x4({functionality:"element streams in no-schema mode"})}};Yk4=mJ({prefix:"aiobj",size:24});Hk4=mJ({prefix:"aiobj",size:24});Fk4=class extends DO{constructor({data:$,mediaType:Z}){super({data:$,mediaType:Z});let X="mp3";if(Z){let Q=Z.split("/");if(Q.length===2){if(Z!=="audio/mpeg")X=Q[1]}}if(!X)throw Error("Audio format must be provided or determinable from media type");this.format=X}};Ok4={word:/\S+\s+/m,line:/\n+/m};Dk4=$41();fk4=lj8,mj8=`vercel.ai.error.${dj8}`,bk4=Symbol.for(mj8),nj8=class extends c5{constructor({modelId:$,modelType:Z,providerId:X,availableProviders:Q,message:Y=`No such provider: ${X} (available providers: ${Q.join()})`}){super({errorName:dj8,modelId:$,modelType:Z,message:Y});this[ij8]=!0,this.providerId=X,this.availableProviders=Q}static isInstance($){return D1.hasMarker($,mj8)}};ij8=bk4;yk4=pj8;uk4=$41();oj8=class extends Q41{constructor($={}){super($)}processResponseStream($){return HU({stream:$,schema:t61}).pipeThrough(new TransformStream({async transform(Z,X){if(!Z.success)throw Z.error;X.enqueue(Z.value)}}))}};ak4=class extends Q41{constructor($={}){super($)}processResponseStream($){return rk4({stream:$.pipeThrough(new TextDecoderStream)})}}});import{z as sk4}from"zod";function Kj($){return $==="cluster"?"agent-sandbox":$}function G41($){return`${$.userId}:${$.projectRef}`}var ek4;var o30=O(()=>{ek4=sk4.enum(["agent-sandbox","user-desktop"])});class r30{map=new Map;async run($,Z){let X=this.map.get($);if(X)return X;let Q=Z();this.map.set($,Q);try{return await Q}finally{this.map.delete($)}}}function a30($,Z,X,Q){if(!$)return Q(null);if(!$.withLock)return Q($);return $.withLock(Z,X,Q)}function Cr($){if("threadId"in $){if(!$.threadId)throw Error("composeSandboxRef: threadId required");return`thread:${$.threadId}`}if(!$.orgId||!$.virtualMcpId||!$.branch)throw Error("composeSandboxRef: orgId, virtualMcpId and branch are all required for agent refs");return`agent:${$.orgId}:${$.virtualMcpId}:${$.branch}`}function rj8($){if($.startsWith("thread:"))return $.slice(7);if(!$.startsWith("agent:"))return"";let Z=$.split(":");return Z.length>=4?Z.slice(3).join(":"):""}import{createHash as $V4}from"crypto";function XV4($,Z=16){return $V4("sha256").update(G41($)).digest("hex").slice(0,Z)}function Wj($){let Z=XV4($),X=QV4(rj8($.projectRef));return X?`${X}-${Z}`:`s-${Z}`}function QV4($){if(!$)return"";return($.split("/").pop()??"").toLowerCase().replace(/[^a-z0-9]+/g,"-").replace(/^-+|-+$/g,"").slice(0,ZV4).replace(/-+$/g,"")}var ZV4=24;var aj8=O(()=>{o30()});function s30($,Z){let X=$.replace(/\/+$/,"");if(X.includes("{handle}"))return`${X.replace("{handle}",Z)}/`;try{let Q=new URL(X);return Q.hostname=`${Z}.${Q.hostname}`,`${Q.toString()}/`}catch{return`${X}/${Z}/`}}function _r($){let Z=$?.userName?.trim();if(!Z||sj8.test(Z))return null;let X=$?.userEmail?.trim();if(!X||sj8.test(X))return{userName:Z};if(!YV4.test(X))return{userName:Z};return{userName:Z,userEmail:X}}var sj8,YV4;var J41=O(()=>{sj8=/[\r\n<>]/,YV4=/^[^\s@<>]+@[^\s@<>]+\.[^\s@<>]+$/});function e30($){let Z=$.repo,X=Z?{repository:{cloneUrl:Z.cloneUrl,repoName:Z.displayName??GV4(Z.cloneUrl),...Z.branch?{branch:Z.branch}:{},...Z.submoduleCredentials&&Z.submoduleCredentials.length>0?{submoduleCredentials:Z.submoduleCredentials}:{}},...Z.userName.trim()||Z.userEmail.trim()?{identity:{userName:Z.userName,userEmail:Z.userEmail}}:{}}:void 0,Q=$.tenant,Y=_r({userName:Q?.userName,userEmail:Q?.userEmail})??void 0,G=$.packageManager?{name:$.packageManager.name,...$.packageManager.path?{path:$.packageManager.path}:{}}:void 0,J=G?{packageManager:G,runtime:$.runtime,...$.port!==void 0?{port:$.port}:{}}:void 0;if(!X&&!J&&!Y&&!$.cloneOnly)return null;return{...X?{git:X}:{},...Y?{operator:Y}:{},...$.cloneOnly!==void 0?{cloneOnly:$.cloneOnly}:{},...J?{application:J}:{}}}function GV4($){try{let Z=new URL($);return Z.pathname.replace(/^\/+/,"").replace(/\.git$/,"")||Z.hostname}catch{return $}}var ej8=O(()=>{J41()});function JV4($){try{return new URL($).username.length>0}catch{return!1}}function K41($){let Z=$.repo?.cloneUrl;if(!Z||!JV4(Z))return null;return{git:{repository:{cloneUrl:Z}}}}var W41=O(()=>{aj8();ej8()});function KV4($){return(typeof $.timeout==="number"&&$.timeout>0?Math.min($.timeout,120000):30000)+15000}function WV4($,Z){if($.aborted)return Z.catch(()=>{}),Promise.reject($.reason??Error("aborted"));return new Promise((X,Q)=>{let Y=()=>{Z.catch(()=>{}),Q($.reason??Error("aborted"))};$.addEventListener("abort",Y,{once:!0}),Z.then(X,Q).finally(()=>{$.removeEventListener("abort",Y)})})}async function HV4($,Z,X,Q,Y="POST",G){let J=G?.timeoutMs??KV4(Q??{}),K=AbortSignal.timeout(J),W=G?.signal?AbortSignal.any([G.signal,K]):K,H,N;try{let F={method:Y,headers:new Headers({"content-type":"application/json"}),body:null,signal:W};if(Y!=="GET"&&Q!==null)F.body=JSON.stringify(Q);({res:H,rawText:N}=await WV4(W,(async()=>{let w=await $.proxyDaemonRequest(Z,X,F);return{res:w,rawText:await w.text()}})()))}catch(F){if(G?.signal?.aborted)throw F;if(K.aborted)throw Error(`Sandbox ${Y} ${X} timed out after ${Math.round(J/1000)}s \u2014 the sandbox may be overloaded or its filesystem stalled. Retry, or use a smaller operation.`);throw new vr(F)}let U;try{U=JSON.parse(N)}catch{console.error("[sandbox-fs-hooks] Failed to parse JSON response runner=%s path=%s status=%d rawText=%s",$.kind,X,H.status,N.slice(0,2000));let F=H.status>=500?" (server error)":H.status===0?" (no response)":"";throw Error(`Daemon ${X} returned invalid JSON (HTTP ${H.status}${F}): ${N.slice(0,800)}`)}if(!H.ok){console.error("[sandbox-fs-hooks] Non-OK response runner=%s path=%s status=%d body=%s",$.kind,X,H.status,N.slice(0,2000));let F=U.error??`Daemon ${X} failed (${H.status})`;if(H.status===404&&F==="sandbox not found")throw new vr(Error(F),!0);throw Error(F)}return U}function NV4($){let Z=[];for(let X of $.split(`
-`)){if(!X)continue;let Q=X.indexOf(":");if(Q<0)continue;let Y=X.indexOf(":",Q+1);if(Y<0)continue;let G=X.slice(0,Q),J=Number.parseInt(X.slice(Q+1,Y),10);if(!Number.isFinite(J))continue;Z.push({file:G,line:J,text:X.slice(Y+1)})}return Z}function H41($,Z){let{ensureHandle:X,invalidateHandle:Q,canAutoRestart:Y}=Z,G=(K)=>{let W=K instanceof Error?K.message:String(K);return Y?`Sandbox is unreachable and auto-restart did not recover it: ${W}`:"The sandbox is not running. Ask the user to start it by clicking the server button (left side of the header bar)."},J=async(K,W,H="POST",N)=>{let U=async(w)=>HV4($,w,K,W,H,{signal:N,timeoutMs:Z.opTimeoutMs}),F=await X();try{return await U(F)}catch(w){if(!(w instanceof vr))throw w;if(!Y&&!w.gone)throw Error(G(w.cause??w));console.warn(`[sandbox-fs-hooks] daemon ${K} unreachable \u2014 reaping sandbox and retrying once`,w.cause??w);try{await Q({force:w.gone})}catch(L){console.warn("[sandbox-fs-hooks] invalidateHandle failed",L)}let B;try{B=await X()}catch(L){throw Error(`Failed to restart sandbox: ${L instanceof Error?L.message:String(L)}`)}try{return await U(B)}catch(L){if(L instanceof vr)throw Error(G(L.cause??L));throw L}}};return{onProxy:(K,W,H,N)=>J(K,W,H,N),onRead:async(K)=>{return(await J("/_sandbox/read",{path:K})).content},onWrite:async(K,W)=>{await J("/_sandbox/write",{path:K,content:W})},onEdit:async(K,W)=>{for(let H of W)await J("/_sandbox/edit",{path:K,old_string:H.oldText,new_string:H.newText,replace_all:H.replaceAll===!0})},onBash:async(K,W)=>{return await J("/_sandbox/bash",{command:K,...W?.cwd!==void 0?{cwd:W.cwd}:{},...W?.timeoutMs!==void 0?{timeout:W.timeoutMs}:{}})},onGlob:async(K)=>{return(await J("/_sandbox/glob",{pattern:K})).files},onGrep:async(K,W)=>{let H=await J("/_sandbox/grep",{pattern:K,output_mode:"content",...W?.path!==void 0?{path:W.path}:{},...W?.glob!==void 0?{glob:W.glob}:{},...W?.caseInsensitive?{ignore_case:!0}:{}});return NV4(H.results)}}}var vr;var $P8=O(()=>{vr=class vr extends Error{code="DAEMON_UNREACHABLE";gone;constructor($,Z=!1){super($ instanceof Error?$.message:"Daemon proxy failed");if(this.gone=Z,$ instanceof Error)this.cause=$}}});function UV4($){return $==="agent-sandbox"||$==="cluster"||$==="user-desktop"}function Hj(){let $=process.env.STUDIO_SANDBOX_PROVIDER,Z=$&&$.length>0?$:"user-desktop";if(!UV4(Z))throw Error(`Unknown STUDIO_SANDBOX_PROVIDER="${$}" \u2014 expected "agent-sandbox", "cluster", or "user-desktop".`);return Kj(Z)}var SU=O(()=>{o30();o30();W41();$P8()});function n5($){if(!$||typeof $!=="object")return{};let Z=$.sandboxMap;if(!Z||typeof Z!=="object")return{};return Z}function WH($,Z,X,Q){let Y=$[Z]?.[X];if(!Y)return null;return zJ(Y)[Q]??null}function xr($,Z,X,Q,Y){let J={...zJ($[Z]?.[X]),[Q]:Y};return{...$,[Z]:{...$[Z]??{},[X]:J}}}async function ZP8($,Z,X,Q,Y,G,J){let K=await $.findById(Z);if(!K)return;let W=K.metadata??{},H=xr(n5(W),Q,Y,G,J);await $.update(Z,X,{metadata:{...W,sandboxMap:H}})}function N41($,Z,X,Q){let Y=zJ($[Z]?.[X]);if(!Y[Q])return null;let G={...Y};delete G[Q];let J={...$[Z]??{}};if(Object.keys(G).length===0)delete J[X];else J[X]=G;let K={...$};if(Object.keys(J).length===0)delete K[Z];else K[Z]=J;return K}async function TO($,Z,X,Q,Y,G){let J=await $.findById(Z);if(!J)return;let K=J.metadata??{},W=N41(n5(K),Q,Y,G);if(!W)return;await $.update(Z,X,{metadata:{...K,sandboxMap:W}})}var KY=O(()=>{R6()});import{createHash as FV4}from"crypto";import{sql as $J0}from"kysely";function wV4($,Z){return FV4("sha256").update($.userId).update("\x00").update($.projectRef).update("\x00").update(Z).digest().readBigInt64BE(0)}async function QP8($,Z,X){let Q=await $.selectFrom("sandbox_runner_state").select(["handle","state","updated_at"]).where("user_id","=",Z.userId).where("project_ref","=",Z.projectRef).where("sandbox_provider_kind","=",X).executeTakeFirst();if(!Q)return null;return{handle:Q.handle,state:Q.state,updatedAt:Q.updated_at}}async function YP8($,Z,X){let Q=await $.selectFrom("sandbox_runner_state").select(["user_id","project_ref","handle","state","updated_at"]).where("sandbox_provider_kind","=",Z).where("handle","=",X).executeTakeFirst();if(!Q)return null;return{id:{userId:Q.user_id,projectRef:Q.project_ref},handle:Q.handle,state:Q.state,updatedAt:Q.updated_at}}async function GP8($,Z,X,Q){let Y=JSON.stringify(Q.state),G=new Date().toISOString();await $.insertInto("sandbox_runner_state").values({user_id:Z.userId,project_ref:Z.projectRef,sandbox_provider_kind:X,handle:Q.handle,state:Y,updated_at:G}).onConflict((J)=>J.columns(["user_id","project_ref","sandbox_provider_kind"]).doUpdateSet({handle:Q.handle,state:Y,updated_at:G})).execute()}async function JP8($,Z,X){await $.deleteFrom("sandbox_runner_state").where("user_id","=",Z.userId).where("project_ref","=",Z.projectRef).where("sandbox_provider_kind","=",X).execute()}async function KP8($,Z,X){await $.deleteFrom("sandbox_runner_state").where("sandbox_provider_kind","=",Z).where("handle","=",X).execute()}function BV4($){return{get:(Z,X)=>QP8($,Z,X),getByHandle:(Z,X)=>YP8($,Z,X),put:(Z,X,Q)=>GP8($,Z,X,Q),delete:(Z,X)=>JP8($,Z,X),deleteByHandle:(Z,X)=>KP8($,Z,X)}}class fr{db;constructor($){this.db=$}get($,Z){return QP8(this.db,$,Z)}getByHandle($,Z){return YP8(this.db,$,Z)}put($,Z,X){return GP8(this.db,$,Z,X)}delete($,Z){return JP8(this.db,$,Z)}deleteByHandle($,Z){return KP8(this.db,$,Z)}async withLock($,Z,X){let Q=wV4($,Z);return this.db.transaction().execute(async(Y)=>{try{await $J0`set local statement_timeout = ${$J0.lit(XP8)}`.execute(Y),await $J0`select pg_advisory_xact_lock(${Q}::bigint)`.execute(Y)}catch(G){if(OV4(G))throw Error(`sandbox advisory lock busy >${XP8}ms for user=${$.userId} projectRef=${$.projectRef} kind=${Z} \u2014 provisioner is slow or stuck; retry shortly`);throw G}return await $J0`set local statement_timeout = 0`.execute(Y),X(BV4(Y))})}}function OV4($){if(!($ instanceof Error))return!1;return $.code==="57014"||/statement timeout/i.test($.message)}var XP8=90000;var U41=()=>{};function HP8($,Z){return`${$}::${Z}`}var WP8;var NP8=O(()=>{WP8={githubNotAuthenticated:"GITHUB_NOT_AUTHENTICATED"}});function UP8($,Z){return{cloneUrl:`https://github.com/${$}/${Z}.git`,gitUserName:ZJ0.name,gitUserEmail:ZJ0.email}}async function Sh($){let Z=await $.ctx.storage.connections.findById($.connectionId,$.organizationId),X=Z?YQ(Z):null;if(!Z||!X?.sourceConnectionId)return;try{await cG0($.ctx,Z,{forceRefresh:$.forceRefresh})}catch(Q){$.onLegacyMintError?.(Q)}}async function RO($,Z,X,Q,Y,G){let J=new _5(Q,Y),K=await EU({connectionId:$,tokenStorage:J,bufferMs:G?.bufferMs});if(!K.accessToken)throw Error(HP8(WP8.githubNotAuthenticated,K.state==="refresh_failed"?BX:"No GitHub token found. Ensure the mcp-github connection is authenticated."));let W=K.accessToken,H=`https://x-access-token:${W}@github.com/${Z}/${X}.git`,N=ZJ0.name,U=ZJ0.email;if(!W.startsWith("ghs_"))try{let F=await fetch("https://api.github.com/user",{headers:{Authorization:`token ${W}`,Accept:"application/vnd.github+json"}});if(F.ok){let w=await F.json();N=w.name||w.login,U=w.email||`${w.login}@users.noreply.github.com`}}catch{}return{cloneUrl:H,gitUserName:N,gitUserEmail:U}}var ZJ0;var br=O(()=>{f11();eJ();KO();sW();NP8();ZJ0={name:"Deco Bot",email:"114028756+decobot@users.noreply.github.com"}});function FP8($){try{let[Z,X]=new URL($).pathname.replace(/^\//,"").split("/"),Q=X?.replace(/\.git$/,"");return Z&&Q?{owner:Z,name:Q}:null}catch{return null}}function kP8($){return typeof $>"u"||$===null}function LV4($){return typeof $==="object"&&$!==null}function DV4($){if(Array.isArray($))return $;else if(kP8($))return[];return[$]}function EV4($,Z){var X,Q,Y,G;if(Z){G=Object.keys(Z);for(X=0,Q=G.length;X<Q;X+=1)Y=G[X],$[Y]=Z[Y]}return $}function zV4($,Z){var X="",Q;for(Q=0;Q<Z;Q+=1)X+=$;return X}function jV4($){return $===0&&Number.NEGATIVE_INFINITY===1/$}function VP8($,Z){var X="",Q=$.reason||"(unknown reason)";if(!$.mark)return Q;if($.mark.name)X+='in "'+$.mark.name+'" ';if(X+="("+($.mark.line+1)+":"+($.mark.column+1)+")",!Z&&$.mark.snippet)X+=`
+`)}})}},p61={"content-type":"text/event-stream","cache-control":"no-cache",connection:"keep-alive","x-vercel-ai-ui-message-stream":"v1","x-accel-buffering":"no"};jr=w1.record(w1.string(),Zj.optional()),t61=V0(()=>K0(w1.union([w1.strictObject({type:w1.literal("text-start"),id:w1.string(),providerMetadata:L8.optional()}),w1.strictObject({type:w1.literal("text-delta"),id:w1.string(),delta:w1.string(),providerMetadata:L8.optional()}),w1.strictObject({type:w1.literal("text-end"),id:w1.string(),providerMetadata:L8.optional()}),w1.strictObject({type:w1.literal("error"),errorText:w1.string()}),w1.strictObject({type:w1.literal("tool-input-start"),toolCallId:w1.string(),toolName:w1.string(),providerExecuted:w1.boolean().optional(),providerMetadata:L8.optional(),toolMetadata:jr.optional(),dynamic:w1.boolean().optional(),title:w1.string().optional()}),w1.strictObject({type:w1.literal("tool-input-delta"),toolCallId:w1.string(),inputTextDelta:w1.string()}),w1.strictObject({type:w1.literal("tool-input-available"),toolCallId:w1.string(),toolName:w1.string(),input:w1.unknown(),providerExecuted:w1.boolean().optional(),providerMetadata:L8.optional(),toolMetadata:jr.optional(),dynamic:w1.boolean().optional(),title:w1.string().optional()}),w1.strictObject({type:w1.literal("tool-input-error"),toolCallId:w1.string(),toolName:w1.string(),input:w1.unknown(),providerExecuted:w1.boolean().optional(),providerMetadata:L8.optional(),toolMetadata:jr.optional(),dynamic:w1.boolean().optional(),errorText:w1.string(),title:w1.string().optional()}),w1.strictObject({type:w1.literal("tool-approval-request"),approvalId:w1.string(),toolCallId:w1.string(),signature:w1.string().optional()}),w1.strictObject({type:w1.literal("tool-output-available"),toolCallId:w1.string(),output:w1.unknown(),providerExecuted:w1.boolean().optional(),providerMetadata:L8.optional(),toolMetadata:jr.optional(),dynamic:w1.boolean().optional(),preliminary:w1.boolean().optional()}),w1.strictObject({type:w1.literal("tool-output-error"),toolCallId:w1.string(),errorText:w1.string(),providerExecuted:w1.boolean().optional(),providerMetadata:L8.optional(),toolMetadata:jr.optional(),dynamic:w1.boolean().optional()}),w1.strictObject({type:w1.literal("tool-output-denied"),toolCallId:w1.string()}),w1.strictObject({type:w1.literal("reasoning-start"),id:w1.string(),providerMetadata:L8.optional()}),w1.strictObject({type:w1.literal("reasoning-delta"),id:w1.string(),delta:w1.string(),providerMetadata:L8.optional()}),w1.strictObject({type:w1.literal("reasoning-end"),id:w1.string(),providerMetadata:L8.optional()}),w1.strictObject({type:w1.literal("source-url"),sourceId:w1.string(),url:w1.string(),title:w1.string().optional(),providerMetadata:L8.optional()}),w1.strictObject({type:w1.literal("source-document"),sourceId:w1.string(),mediaType:w1.string(),title:w1.string(),filename:w1.string().optional(),providerMetadata:L8.optional()}),w1.strictObject({type:w1.literal("file"),url:w1.string(),mediaType:w1.string(),providerMetadata:L8.optional()}),w1.strictObject({type:w1.custom(($)=>typeof $==="string"&&$.startsWith("data-"),{message:'Type must start with "data-"'}),id:w1.string().optional(),data:w1.unknown(),transient:w1.boolean().optional()}),w1.strictObject({type:w1.literal("start-step")}),w1.strictObject({type:w1.literal("finish-step")}),w1.strictObject({type:w1.literal("start"),messageId:w1.string().optional(),messageMetadata:w1.unknown().optional()}),w1.strictObject({type:w1.literal("finish"),finishReason:w1.enum(["stop","length","content-filter","tool-calls","error","other"]).optional(),messageMetadata:w1.unknown().optional()}),w1.strictObject({type:w1.literal("abort"),reason:w1.string().optional()}),w1.strictObject({type:w1.literal("message-metadata"),messageMetadata:w1.unknown()})])));fM4=T3;bM4=Tr;gM4=mJ({prefix:"aitxt",size:24}),hM4={file:!0,source:!0,"text-start":!0,"text-end":!0,"text-delta":!0,"reasoning-start":!0,"reasoning-end":!0,"reasoning-delta":!0,"tool-input-start":!0,"tool-input-end":!0,"tool-input-delta":!0,"tool-approval-request":!0,"tool-call":!0,"tool-result":!0,"tool-error":!0,"stream-start":!1,"response-metadata":!1,finish:!1,error:!1,raw:!1};YY=B0.record(B0.string(),Zj.optional()),mM4=V0(()=>K0(B0.array(B0.object({id:B0.string(),role:B0.enum(["system","user","assistant"]),metadata:B0.unknown().optional(),parts:B0.array(B0.union([B0.object({type:B0.literal("text"),text:B0.string(),state:B0.enum(["streaming","done"]).optional(),providerMetadata:L8.optional()}),B0.object({type:B0.literal("reasoning"),text:B0.string(),state:B0.enum(["streaming","done"]).optional(),providerMetadata:L8.optional()}),B0.object({type:B0.literal("source-url"),sourceId:B0.string(),url:B0.string(),title:B0.string().optional(),providerMetadata:L8.optional()}),B0.object({type:B0.literal("source-document"),sourceId:B0.string(),mediaType:B0.string(),title:B0.string(),filename:B0.string().optional(),providerMetadata:L8.optional()}),B0.object({type:B0.literal("file"),mediaType:B0.string(),filename:B0.string().optional(),url:B0.string(),providerMetadata:L8.optional()}),B0.object({type:B0.literal("step-start")}),B0.object({type:B0.string().startsWith("data-"),id:B0.string().optional(),data:B0.unknown()}),B0.object({type:B0.literal("dynamic-tool"),toolName:B0.string(),toolCallId:B0.string(),toolMetadata:YY.optional(),state:B0.literal("input-streaming"),input:B0.unknown().optional(),providerExecuted:B0.boolean().optional(),callProviderMetadata:L8.optional(),output:B0.never().optional(),errorText:B0.never().optional(),approval:B0.never().optional()}),B0.object({type:B0.literal("dynamic-tool"),toolName:B0.string(),toolCallId:B0.string(),toolMetadata:YY.optional(),state:B0.literal("input-available"),input:B0.unknown(),providerExecuted:B0.boolean().optional(),output:B0.never().optional(),errorText:B0.never().optional(),callProviderMetadata:L8.optional(),approval:B0.never().optional()}),B0.object({type:B0.literal("dynamic-tool"),toolName:B0.string(),toolCallId:B0.string(),toolMetadata:YY.optional(),state:B0.literal("approval-requested"),input:B0.unknown(),providerExecuted:B0.boolean().optional(),output:B0.never().optional(),errorText:B0.never().optional(),callProviderMetadata:L8.optional(),approval:B0.object({id:B0.string(),approved:B0.never().optional(),reason:B0.never().optional(),signature:B0.string().optional()})}),B0.object({type:B0.literal("dynamic-tool"),toolName:B0.string(),toolCallId:B0.string(),toolMetadata:YY.optional(),state:B0.literal("approval-responded"),input:B0.unknown(),providerExecuted:B0.boolean().optional(),output:B0.never().optional(),errorText:B0.never().optional(),callProviderMetadata:L8.optional(),approval:B0.object({id:B0.string(),approved:B0.boolean(),reason:B0.string().optional(),signature:B0.string().optional()})}),B0.object({type:B0.literal("dynamic-tool"),toolName:B0.string(),toolCallId:B0.string(),toolMetadata:YY.optional(),state:B0.literal("output-available"),input:B0.unknown(),providerExecuted:B0.boolean().optional(),output:B0.unknown(),errorText:B0.never().optional(),callProviderMetadata:L8.optional(),resultProviderMetadata:L8.optional(),preliminary:B0.boolean().optional(),approval:B0.object({id:B0.string(),approved:B0.literal(!0),reason:B0.string().optional(),signature:B0.string().optional()}).optional()}),B0.object({type:B0.literal("dynamic-tool"),toolName:B0.string(),toolCallId:B0.string(),toolMetadata:YY.optional(),state:B0.literal("output-error"),input:B0.unknown().optional(),rawInput:B0.unknown().optional(),providerExecuted:B0.boolean().optional(),output:B0.never().optional(),errorText:B0.string(),callProviderMetadata:L8.optional(),resultProviderMetadata:L8.optional(),approval:B0.object({id:B0.string(),approved:B0.literal(!0),reason:B0.string().optional(),signature:B0.string().optional()}).optional()}),B0.object({type:B0.literal("dynamic-tool"),toolName:B0.string(),toolCallId:B0.string(),toolMetadata:YY.optional(),state:B0.literal("output-denied"),input:B0.unknown(),providerExecuted:B0.boolean().optional(),output:B0.never().optional(),errorText:B0.never().optional(),callProviderMetadata:L8.optional(),approval:B0.object({id:B0.string(),approved:B0.literal(!1),reason:B0.string().optional(),signature:B0.string().optional()})}),B0.object({type:B0.string().startsWith("tool-"),toolCallId:B0.string(),toolMetadata:YY.optional(),state:B0.literal("input-streaming"),providerExecuted:B0.boolean().optional(),callProviderMetadata:L8.optional(),input:B0.unknown().optional(),output:B0.never().optional(),errorText:B0.never().optional(),approval:B0.never().optional()}),B0.object({type:B0.string().startsWith("tool-"),toolCallId:B0.string(),toolMetadata:YY.optional(),state:B0.literal("input-available"),providerExecuted:B0.boolean().optional(),input:B0.unknown(),output:B0.never().optional(),errorText:B0.never().optional(),callProviderMetadata:L8.optional(),approval:B0.never().optional()}),B0.object({type:B0.string().startsWith("tool-"),toolCallId:B0.string(),toolMetadata:YY.optional(),state:B0.literal("approval-requested"),input:B0.unknown(),providerExecuted:B0.boolean().optional(),output:B0.never().optional(),errorText:B0.never().optional(),callProviderMetadata:L8.optional(),approval:B0.object({id:B0.string(),approved:B0.never().optional(),reason:B0.never().optional(),signature:B0.string().optional()})}),B0.object({type:B0.string().startsWith("tool-"),toolCallId:B0.string(),toolMetadata:YY.optional(),state:B0.literal("approval-responded"),input:B0.unknown(),providerExecuted:B0.boolean().optional(),output:B0.never().optional(),errorText:B0.never().optional(),callProviderMetadata:L8.optional(),approval:B0.object({id:B0.string(),approved:B0.boolean(),reason:B0.string().optional(),signature:B0.string().optional()})}),B0.object({type:B0.string().startsWith("tool-"),toolCallId:B0.string(),toolMetadata:YY.optional(),state:B0.literal("output-available"),providerExecuted:B0.boolean().optional(),input:B0.unknown(),output:B0.unknown(),errorText:B0.never().optional(),callProviderMetadata:L8.optional(),resultProviderMetadata:L8.optional(),preliminary:B0.boolean().optional(),approval:B0.object({id:B0.string(),approved:B0.literal(!0),reason:B0.string().optional(),signature:B0.string().optional()}).optional()}),B0.object({type:B0.string().startsWith("tool-"),toolCallId:B0.string(),toolMetadata:YY.optional(),state:B0.literal("output-error"),providerExecuted:B0.boolean().optional(),input:B0.unknown().optional(),rawInput:B0.unknown().optional(),output:B0.never().optional(),errorText:B0.string(),callProviderMetadata:L8.optional(),resultProviderMetadata:L8.optional(),approval:B0.object({id:B0.string(),approved:B0.literal(!0),reason:B0.string().optional(),signature:B0.string().optional()}).optional()}),B0.object({type:B0.string().startsWith("tool-"),toolCallId:B0.string(),toolMetadata:YY.optional(),state:B0.literal("output-denied"),providerExecuted:B0.boolean().optional(),input:B0.unknown(),output:B0.never().optional(),errorText:B0.never().optional(),callProviderMetadata:L8.optional(),approval:B0.object({id:B0.string(),approved:B0.literal(!1),reason:B0.string().optional(),signature:B0.string().optional()})})])).nonempty("Message must contain at least one part")})).nonempty("Messages array must not be empty")));eM4=t30,$k4={type:"no-schema",jsonSchema:async()=>{return},async validatePartialResult({value:$,textDelta:Z}){return{success:!0,value:{partial:$,textDelta:Z}}},async validateFinalResult($,Z){return $===void 0?{success:!1,error:new JY({message:"No object generated: response did not match schema.",text:Z.text,response:Z.response,usage:Z.usage,finishReason:Z.finishReason})}:{success:!0,value:$}},createElementStream(){throw new x4({functionality:"element streams in no-schema mode"})}};Yk4=mJ({prefix:"aiobj",size:24});Hk4=mJ({prefix:"aiobj",size:24});Fk4=class extends DO{constructor({data:$,mediaType:Z}){super({data:$,mediaType:Z});let X="mp3";if(Z){let Q=Z.split("/");if(Q.length===2){if(Z!=="audio/mpeg")X=Q[1]}}if(!X)throw Error("Audio format must be provided or determinable from media type");this.format=X}};Ok4={word:/\S+\s+/m,line:/\n+/m};Dk4=$41();fk4=lj8,mj8=`vercel.ai.error.${dj8}`,bk4=Symbol.for(mj8),nj8=class extends c5{constructor({modelId:$,modelType:Z,providerId:X,availableProviders:Q,message:Y=`No such provider: ${X} (available providers: ${Q.join()})`}){super({errorName:dj8,modelId:$,modelType:Z,message:Y});this[ij8]=!0,this.providerId=X,this.availableProviders=Q}static isInstance($){return D1.hasMarker($,mj8)}};ij8=bk4;yk4=pj8;uk4=$41();oj8=class extends Q41{constructor($={}){super($)}processResponseStream($){return HU({stream:$,schema:t61}).pipeThrough(new TransformStream({async transform(Z,X){if(!Z.success)throw Z.error;X.enqueue(Z.value)}}))}};ak4=class extends Q41{constructor($={}){super($)}processResponseStream($){return rk4({stream:$.pipeThrough(new TextDecoderStream)})}}});import{z as sk4}from"zod";function Kj($){return $==="cluster"?"agent-sandbox":$}function G41($){return`${$.userId}:${$.projectRef}`}var ek4;var o30=O(()=>{ek4=sk4.enum(["agent-sandbox","user-desktop"])});class r30{map=new Map;async run($,Z){let X=this.map.get($);if(X)return X;let Q=Z();this.map.set($,Q);try{return await Q}finally{this.map.delete($)}}}function a30($,Z,X,Q){if(!$)return Q(null);if(!$.withLock)return Q($);return $.withLock(Z,X,Q)}function Cr($){if("threadId"in $){if(!$.threadId)throw Error("composeSandboxRef: threadId required");return`thread:${$.threadId}`}if(!$.orgId||!$.virtualMcpId||!$.branch)throw Error("composeSandboxRef: orgId, virtualMcpId and branch are all required for agent refs");return`agent:${$.orgId}:${$.virtualMcpId}:${$.branch}`}function rj8($){if($.startsWith("thread:"))return $.slice(7);if(!$.startsWith("agent:"))return"";let Z=$.split(":");return Z.length>=4?Z.slice(3).join(":"):""}import{createHash as $V4}from"crypto";function XV4($,Z=16){return $V4("sha256").update(G41($)).digest("hex").slice(0,Z)}function Wj($){let Z=XV4($),X=QV4(rj8($.projectRef));return X?`${X}-${Z}`:`s-${Z}`}function QV4($){if(!$)return"";return($.split("/").pop()??"").toLowerCase().replace(/[^a-z0-9]+/g,"-").replace(/^-+|-+$/g,"").slice(0,ZV4).replace(/-+$/g,"")}var ZV4=24;var aj8=O(()=>{o30()});function s30($,Z){let X=$.replace(/\/+$/,"");if(X.includes("{handle}"))return`${X.replace("{handle}",Z)}/`;try{let Q=new URL(X);return Q.hostname=`${Z}.${Q.hostname}`,`${Q.toString()}/`}catch{return`${X}/${Z}/`}}function _r($){let Z=$?.userName?.trim();if(!Z||sj8.test(Z))return null;let X=$?.userEmail?.trim();if(!X||sj8.test(X))return{userName:Z};if(!YV4.test(X))return{userName:Z};return{userName:Z,userEmail:X}}var sj8,YV4;var J41=O(()=>{sj8=/[\r\n<>]/,YV4=/^[^\s@<>]+@[^\s@<>]+\.[^\s@<>]+$/});function e30($){let Z=$.repo,X=Z?{repository:{cloneUrl:Z.cloneUrl,repoName:Z.displayName??GV4(Z.cloneUrl),...Z.branch?{branch:Z.branch}:{},...Z.submoduleCredentials&&Z.submoduleCredentials.length>0?{submoduleCredentials:Z.submoduleCredentials}:{}},...Z.userName.trim()||Z.userEmail.trim()?{identity:{userName:Z.userName,userEmail:Z.userEmail}}:{}}:void 0,Q=$.tenant,Y=_r({userName:Q?.userName,userEmail:Q?.userEmail})??void 0,G=$.packageManager?{name:$.packageManager.name,...$.packageManager.path?{path:$.packageManager.path}:{}}:void 0,J=G?{packageManager:G,runtime:$.runtime,...$.port!==void 0?{port:$.port}:{}}:void 0;if(!X&&!J&&!Y&&!$.cloneOnly)return null;return{...X?{git:X}:{},...Y?{operator:Y}:{},...$.cloneOnly!==void 0?{cloneOnly:$.cloneOnly}:{},...J?{application:J}:{}}}function GV4($){try{let Z=new URL($);return Z.pathname.replace(/^\/+/,"").replace(/\.git$/,"")||Z.hostname}catch{return $}}var ej8=O(()=>{J41()});function JV4($){try{return new URL($).username.length>0}catch{return!1}}function K41($){let Z=$.repo?.cloneUrl;if(!Z||!JV4(Z))return null;return{git:{repository:{cloneUrl:Z}}}}var W41=O(()=>{aj8();ej8()});function KV4($){return(typeof $.timeout==="number"&&$.timeout>0?Math.min($.timeout,120000):30000)+15000}function WV4($,Z){if($.aborted)return Z.catch(()=>{}),Promise.reject($.reason??Error("aborted"));return new Promise((X,Q)=>{let Y=()=>{Z.catch(()=>{}),Q($.reason??Error("aborted"))};$.addEventListener("abort",Y,{once:!0}),Z.then(X,Q).finally(()=>{$.removeEventListener("abort",Y)})})}async function HV4($,Z,X,Q,Y="POST",G){let J=G?.timeoutMs??KV4(Q??{}),K=AbortSignal.timeout(J),W=G?.signal?AbortSignal.any([G.signal,K]):K,H,N;try{let F=new Headers({"content-type":"application/json"});if(G?.threadId)F.set("x-thread-id",G.threadId);let w={method:Y,headers:F,body:null,signal:W};if(Y!=="GET"&&Q!==null)w.body=JSON.stringify(Q);({res:H,rawText:N}=await WV4(W,(async()=>{let B=await $.proxyDaemonRequest(Z,X,w);return{res:B,rawText:await B.text()}})()))}catch(F){if(G?.signal?.aborted)throw F;if(K.aborted)throw Error(`Sandbox ${Y} ${X} timed out after ${Math.round(J/1000)}s \u2014 the sandbox may be overloaded or its filesystem stalled. Retry, or use a smaller operation.`);throw new vr(F)}let U;try{U=JSON.parse(N)}catch{console.error("[sandbox-fs-hooks] Failed to parse JSON response runner=%s path=%s status=%d rawText=%s",$.kind,X,H.status,N.slice(0,2000));let F=H.status>=500?" (server error)":H.status===0?" (no response)":"";throw Error(`Daemon ${X} returned invalid JSON (HTTP ${H.status}${F}): ${N.slice(0,800)}`)}if(!H.ok){console.error("[sandbox-fs-hooks] Non-OK response runner=%s path=%s status=%d body=%s",$.kind,X,H.status,N.slice(0,2000));let F=U.error??`Daemon ${X} failed (${H.status})`;if(H.status===404&&F==="sandbox not found")throw new vr(Error(F),!0);throw Error(F)}return U}function NV4($){let Z=[];for(let X of $.split(`
+`)){if(!X)continue;let Q=X.indexOf(":");if(Q<0)continue;let Y=X.indexOf(":",Q+1);if(Y<0)continue;let G=X.slice(0,Q),J=Number.parseInt(X.slice(Q+1,Y),10);if(!Number.isFinite(J))continue;Z.push({file:G,line:J,text:X.slice(Y+1)})}return Z}function H41($,Z){let{ensureHandle:X,invalidateHandle:Q,canAutoRestart:Y}=Z,G=(K)=>{let W=K instanceof Error?K.message:String(K);return Y?`Sandbox is unreachable and auto-restart did not recover it: ${W}`:"The sandbox is not running. Ask the user to start it by clicking the server button (left side of the header bar)."},J=async(K,W,H="POST",N)=>{let U=async(w)=>HV4($,w,K,W,H,{signal:N,timeoutMs:Z.opTimeoutMs,threadId:Z.threadId}),F=await X();try{return await U(F)}catch(w){if(!(w instanceof vr))throw w;if(!Y&&!w.gone)throw Error(G(w.cause??w));console.warn(`[sandbox-fs-hooks] daemon ${K} unreachable \u2014 reaping sandbox and retrying once`,w.cause??w);try{await Q({force:w.gone})}catch(L){console.warn("[sandbox-fs-hooks] invalidateHandle failed",L)}let B;try{B=await X()}catch(L){throw Error(`Failed to restart sandbox: ${L instanceof Error?L.message:String(L)}`)}try{return await U(B)}catch(L){if(L instanceof vr)throw Error(G(L.cause??L));throw L}}};return{onProxy:(K,W,H,N)=>J(K,W,H,N),onRead:async(K)=>{return(await J("/_sandbox/read",{path:K})).content},onWrite:async(K,W)=>{await J("/_sandbox/write",{path:K,content:W})},onEdit:async(K,W)=>{for(let H of W)await J("/_sandbox/edit",{path:K,old_string:H.oldText,new_string:H.newText,replace_all:H.replaceAll===!0})},onBash:async(K,W)=>{return await J("/_sandbox/bash",{command:K,...W?.cwd!==void 0?{cwd:W.cwd}:{},...W?.timeoutMs!==void 0?{timeout:W.timeoutMs}:{}})},onGlob:async(K)=>{return(await J("/_sandbox/glob",{pattern:K})).files},onGrep:async(K,W)=>{let H=await J("/_sandbox/grep",{pattern:K,output_mode:"content",...W?.path!==void 0?{path:W.path}:{},...W?.glob!==void 0?{glob:W.glob}:{},...W?.caseInsensitive?{ignore_case:!0}:{}});return NV4(H.results)}}}var vr;var $P8=O(()=>{vr=class vr extends Error{code="DAEMON_UNREACHABLE";gone;constructor($,Z=!1){super($ instanceof Error?$.message:"Daemon proxy failed");if(this.gone=Z,$ instanceof Error)this.cause=$}}});function UV4($){return $==="agent-sandbox"||$==="cluster"||$==="user-desktop"}function Hj(){let $=process.env.STUDIO_SANDBOX_PROVIDER,Z=$&&$.length>0?$:"user-desktop";if(!UV4(Z))throw Error(`Unknown STUDIO_SANDBOX_PROVIDER="${$}" \u2014 expected "agent-sandbox", "cluster", or "user-desktop".`);return Kj(Z)}var SU=O(()=>{o30();o30();W41();$P8()});function n5($){if(!$||typeof $!=="object")return{};let Z=$.sandboxMap;if(!Z||typeof Z!=="object")return{};return Z}function WH($,Z,X,Q){let Y=$[Z]?.[X];if(!Y)return null;return zJ(Y)[Q]??null}function xr($,Z,X,Q,Y){let J={...zJ($[Z]?.[X]),[Q]:Y};return{...$,[Z]:{...$[Z]??{},[X]:J}}}async function ZP8($,Z,X,Q,Y,G,J){let K=await $.findById(Z);if(!K)return;let W=K.metadata??{},H=xr(n5(W),Q,Y,G,J);await $.update(Z,X,{metadata:{...W,sandboxMap:H}})}function N41($,Z,X,Q){let Y=zJ($[Z]?.[X]);if(!Y[Q])return null;let G={...Y};delete G[Q];let J={...$[Z]??{}};if(Object.keys(G).length===0)delete J[X];else J[X]=G;let K={...$};if(Object.keys(J).length===0)delete K[Z];else K[Z]=J;return K}async function TO($,Z,X,Q,Y,G){let J=await $.findById(Z);if(!J)return;let K=J.metadata??{},W=N41(n5(K),Q,Y,G);if(!W)return;await $.update(Z,X,{metadata:{...K,sandboxMap:W}})}var KY=O(()=>{R6()});import{createHash as FV4}from"crypto";import{sql as $J0}from"kysely";function wV4($,Z){return FV4("sha256").update($.userId).update("\x00").update($.projectRef).update("\x00").update(Z).digest().readBigInt64BE(0)}async function QP8($,Z,X){let Q=await $.selectFrom("sandbox_runner_state").select(["handle","state","updated_at"]).where("user_id","=",Z.userId).where("project_ref","=",Z.projectRef).where("sandbox_provider_kind","=",X).executeTakeFirst();if(!Q)return null;return{handle:Q.handle,state:Q.state,updatedAt:Q.updated_at}}async function YP8($,Z,X){let Q=await $.selectFrom("sandbox_runner_state").select(["user_id","project_ref","handle","state","updated_at"]).where("sandbox_provider_kind","=",Z).where("handle","=",X).executeTakeFirst();if(!Q)return null;return{id:{userId:Q.user_id,projectRef:Q.project_ref},handle:Q.handle,state:Q.state,updatedAt:Q.updated_at}}async function GP8($,Z,X,Q){let Y=JSON.stringify(Q.state),G=new Date().toISOString();await $.insertInto("sandbox_runner_state").values({user_id:Z.userId,project_ref:Z.projectRef,sandbox_provider_kind:X,handle:Q.handle,state:Y,updated_at:G}).onConflict((J)=>J.columns(["user_id","project_ref","sandbox_provider_kind"]).doUpdateSet({handle:Q.handle,state:Y,updated_at:G})).execute()}async function JP8($,Z,X){await $.deleteFrom("sandbox_runner_state").where("user_id","=",Z.userId).where("project_ref","=",Z.projectRef).where("sandbox_provider_kind","=",X).execute()}async function KP8($,Z,X){await $.deleteFrom("sandbox_runner_state").where("sandbox_provider_kind","=",Z).where("handle","=",X).execute()}function BV4($){return{get:(Z,X)=>QP8($,Z,X),getByHandle:(Z,X)=>YP8($,Z,X),put:(Z,X,Q)=>GP8($,Z,X,Q),delete:(Z,X)=>JP8($,Z,X),deleteByHandle:(Z,X)=>KP8($,Z,X)}}class fr{db;constructor($){this.db=$}get($,Z){return QP8(this.db,$,Z)}getByHandle($,Z){return YP8(this.db,$,Z)}put($,Z,X){return GP8(this.db,$,Z,X)}delete($,Z){return JP8(this.db,$,Z)}deleteByHandle($,Z){return KP8(this.db,$,Z)}async withLock($,Z,X){let Q=wV4($,Z);return this.db.transaction().execute(async(Y)=>{try{await $J0`set local statement_timeout = ${$J0.lit(XP8)}`.execute(Y),await $J0`select pg_advisory_xact_lock(${Q}::bigint)`.execute(Y)}catch(G){if(OV4(G))throw Error(`sandbox advisory lock busy >${XP8}ms for user=${$.userId} projectRef=${$.projectRef} kind=${Z} \u2014 provisioner is slow or stuck; retry shortly`);throw G}return await $J0`set local statement_timeout = 0`.execute(Y),X(BV4(Y))})}}function OV4($){if(!($ instanceof Error))return!1;return $.code==="57014"||/statement timeout/i.test($.message)}var XP8=90000;var U41=()=>{};function HP8($,Z){return`${$}::${Z}`}var WP8;var NP8=O(()=>{WP8={githubNotAuthenticated:"GITHUB_NOT_AUTHENTICATED"}});function UP8($,Z){return{cloneUrl:`https://github.com/${$}/${Z}.git`,gitUserName:ZJ0.name,gitUserEmail:ZJ0.email}}async function Sh($){let Z=await $.ctx.storage.connections.findById($.connectionId,$.organizationId),X=Z?YQ(Z):null;if(!Z||!X?.sourceConnectionId)return;try{await cG0($.ctx,Z,{forceRefresh:$.forceRefresh})}catch(Q){$.onLegacyMintError?.(Q)}}async function RO($,Z,X,Q,Y,G){let J=new _5(Q,Y),K=await EU({connectionId:$,tokenStorage:J,bufferMs:G?.bufferMs});if(!K.accessToken)throw Error(HP8(WP8.githubNotAuthenticated,K.state==="refresh_failed"?BX:"No GitHub token found. Ensure the mcp-github connection is authenticated."));let W=K.accessToken,H=`https://x-access-token:${W}@github.com/${Z}/${X}.git`,N=ZJ0.name,U=ZJ0.email;if(!W.startsWith("ghs_"))try{let F=await fetch("https://api.github.com/user",{headers:{Authorization:`token ${W}`,Accept:"application/vnd.github+json"}});if(F.ok){let w=await F.json();N=w.name||w.login,U=w.email||`${w.login}@users.noreply.github.com`}}catch{}return{cloneUrl:H,gitUserName:N,gitUserEmail:U}}var ZJ0;var br=O(()=>{f11();eJ();KO();sW();NP8();ZJ0={name:"Deco Bot",email:"114028756+decobot@users.noreply.github.com"}});function FP8($){try{let[Z,X]=new URL($).pathname.replace(/^\//,"").split("/"),Q=X?.replace(/\.git$/,"");return Z&&Q?{owner:Z,name:Q}:null}catch{return null}}function kP8($){return typeof $>"u"||$===null}function LV4($){return typeof $==="object"&&$!==null}function DV4($){if(Array.isArray($))return $;else if(kP8($))return[];return[$]}function EV4($,Z){var X,Q,Y,G;if(Z){G=Object.keys(Z);for(X=0,Q=G.length;X<Q;X+=1)Y=G[X],$[Y]=Z[Y]}return $}function zV4($,Z){var X="",Q;for(Q=0;Q<Z;Q+=1)X+=$;return X}function jV4($){return $===0&&Number.NEGATIVE_INFINITY===1/$}function VP8($,Z){var X="",Q=$.reason||"(unknown reason)";if(!$.mark)return Q;if($.mark.name)X+='in "'+$.mark.name+'" ';if(X+="("+($.mark.line+1)+":"+($.mark.column+1)+")",!Z&&$.mark.snippet)X+=`
 
 `+$.mark.snippet;return Q+" "+X}function gr($,Z){if(Error.call(this),this.name="YAMLException",this.reason=$,this.mark=Z,this.message=VP8(this,!1),Error.captureStackTrace)Error.captureStackTrace(this,this.constructor);else this.stack=Error().stack||""}function F41($,Z,X,Q,Y){var G="",J="",K=Math.floor(Y/2)-1;if(Q-Z>K)G=" ... ",Z=Q-K+G.length;if(X-Q>K)J=" ...",X=Q+K-J.length;return{str:G+$.slice(Z,X).replace(/\t/g,"\u2192")+J,pos:Q-Z+G.length}}function w41($,Z){return jZ.repeat(" ",Z-$.length)+$}function MV4($,Z){if(Z=Object.create(Z||null),!$.buffer)return null;if(!Z.maxLength)Z.maxLength=79;if(typeof Z.indent!=="number")Z.indent=1;if(typeof Z.linesBefore!=="number")Z.linesBefore=3;if(typeof Z.linesAfter!=="number")Z.linesAfter=2;var X=/\r?\n|\r|\0/g,Q=[0],Y=[],G,J=-1;while(G=X.exec($.buffer))if(Y.push(G.index),Q.push(G.index+G[0].length),$.position<=G.index&&J<0)J=Q.length-2;if(J<0)J=Q.length-1;var K="",W,H,N=Math.min($.line+Z.linesAfter,Y.length).toString().length,U=Z.maxLength-(Z.indent+N+3);for(W=1;W<=Z.linesBefore;W++){if(J-W<0)break;H=F41($.buffer,Q[J-W],Y[J-W],$.position-(Q[J]-Q[J-W]),U),K=jZ.repeat(" ",Z.indent)+w41(($.line-W+1).toString(),N)+" | "+H.str+`
 `+K}H=F41($.buffer,Q[J],Y[J],$.position,U),K+=jZ.repeat(" ",Z.indent)+w41(($.line+1).toString(),N)+" | "+H.str+`
@@ -2490,7 +2490,7 @@ ${H}`:H;return{...J,description:N,inputExamples:X?void 0:J.inputExamples}});retu
 `);let Q=Z.pax;if(Q)for(let Y in Q)X+=r$1(" "+Y+"="+Q[Y]+`
 `);return l4.from(X)};Ty4.decodePax=function(Z){let X={};while(Z.length){let Q=0;while(Q<Z.length&&Z[Q]!==32)Q++;let Y=parseInt(l4.toString(Z.subarray(0,Q)),10);if(!Y)return X;let G=l4.toString(Z.subarray(Q+1,Y-1)),J=G.indexOf("=");if(J===-1)return X;X[G.slice(0,J)]=G.slice(J+1),Z=Z.subarray(Y)}return X};Ty4.encode=function(Z){let X=l4.alloc(512),Q=Z.name,Y="";if(Z.typeflag===5&&Q[Q.length-1]!=="/")Q+="/";if(l4.byteLength(Q)!==Q.length)return null;while(l4.byteLength(Q)>100){let G=Q.indexOf("/");if(G===-1)return null;Y+=Y?"/"+Q.slice(0,G):Q.slice(0,G),Q=Q.slice(G+1)}if(l4.byteLength(Q)>100||l4.byteLength(Y)>155)return null;if(Z.linkname&&l4.byteLength(Z.linkname)>100)return null;if(l4.write(X,Q),l4.write(X,xO(Z.mode&4095,6),100),l4.write(X,xO(Z.uid,6),108),l4.write(X,xO(Z.gid,6),116),Py4(Z.size,X,124),l4.write(X,xO(Z.mtime.getTime()/1000|0,11),136),X[156]=48+zy4(Z.type),Z.linkname)l4.write(X,Z.linkname,157);if(l4.copy(i28,X,257),l4.copy(Fy4,X,263),Z.uname)l4.write(X,Z.uname,265);if(Z.gname)l4.write(X,Z.gname,297);if(l4.write(X,xO(Z.devmajor||0,6),329),l4.write(X,xO(Z.devminor||0,6),337),Y)l4.write(X,Y,345);return l4.write(X,xO(p28(X),6),148),X};Ty4.decode=function(Z,X,Q){let Y=Z[156]===0?0:Z[156]-48,G=dh(Z,0,100,X),J=vO(Z,100,8),K=vO(Z,108,8),W=vO(Z,116,8),H=vO(Z,124,12),N=vO(Z,136,12),U=Ey4(Y),F=Z[157]===0?null:dh(Z,157,100,X),w=dh(Z,265,32),B=dh(Z,297,32),L=vO(Z,329,8),D=vO(Z,337,8),E=p28(Z);if(E===256)return null;if(E!==vO(Z,148,8))throw Error("Invalid tar header. Maybe the tar is corrupted or it needs to be gunzipped?");if(Oy4(Z)){if(Z[345])G=dh(Z,345,155,X)+"/"+G}else if(Ly4(Z));else if(!Q)throw Error("Invalid tar header: unknown format.");if(Y===0&&G&&G[G.length-1]==="/")Y=5;return{name:G,mode:J,uid:K,gid:W,size:H,mtime:new Date(1000*N),type:U,linkname:F,uname:w,gname:B,devmajor:L,devminor:D,pax:null}};function Oy4($){return l4.equals(i28,$.subarray(257,263))}function Ly4($){return l4.equals(wy4,$.subarray(257,263))&&l4.equals(By4,$.subarray(263,265))}function Dy4($,Z,X){if(typeof $!=="number")return X;if($=~~$,$>=Z)return Z;if($>=0)return $;if($+=Z,$>=0)return $;return 0}function Ey4($){switch($){case 0:return"file";case 1:return"link";case 2:return"symlink";case 3:return"character-device";case 4:return"block-device";case 5:return"directory";case 6:return"fifo";case 7:return"contiguous-file";case 72:return"pax-header";case 55:return"pax-global-header";case 27:return"gnu-long-link-path";case 28:case 30:return"gnu-long-path"}return null}function zy4($){switch($){case"file":return 0;case"link":return 1;case"symlink":return 2;case"character-device":return 3;case"block-device":return 4;case"directory":return 5;case"fifo":return 6;case"contiguous-file":return 7;case"pax-header":return 72}return 0}function n28($,Z,X,Q){for(;X<Q;X++)if($[X]===Z)return X;return Q}function p28($){let Z=256;for(let X=0;X<148;X++)Z+=$[X];for(let X=156;X<512;X++)Z+=$[X];return Z}function xO($,Z){if($=$.toString(8),$.length>Z)return"7777777777777777777".slice(0,Z)+" ";return"0000000000000000000".slice(0,Z-$.length)+$+" "}function jy4($,Z,X){Z[X]=128;for(let Q=11;Q>0;Q--)Z[X+Q]=$&255,$=Math.floor($/256)}function Py4($,Z,X){if($.toString(8).length>11)jy4($,Z,X);else l4.write(Z,xO($,11),X)}function Ay4($){let Z;if($[0]===128)Z=!0;else if($[0]===255)Z=!1;else return null;let X=[],Q;for(Q=$.length-1;Q>0;Q--){let J=$[Q];if(Z)X.push(J);else X.push(255-J)}let Y=0,G=X.length;for(Q=0;Q<G;Q++)Y+=X[Q]*Math.pow(256,Q);return Z?Y:-1*Y}function vO($,Z,X){if($=$.subarray(Z,Z+X),Z=0,$[Z]&128)return Ay4($);else{while(Z<$.length&&$[Z]===32)Z++;let Q=Dy4(n28($,32,Z,$.length),$.length,$.length);while(Z<Q&&$[Z]===0)Z++;if(Q===Z)return 0;return parseInt(l4.toString($.subarray(Z,Q)),8)}}function dh($,Z,X,Q){return l4.toString($.subarray(Z,n28($,0,Z,Z+X)),Q)}function r$1($){let Z=l4.byteLength($),X=Math.floor(Math.log(Z)/Math.log(10))+1;if(Z+X>=Math.pow(10,X))X++;return Z+X+$}});var Zq8=_((A1Z,$q8)=>{var{Writable:Vy4,Readable:Sy4,getStreamError:t28}=o$1(),Cy4=d$1(),o28=lh(),mh=a$1(),_y4=o28.alloc(0);class r28{constructor(){this.buffered=0,this.shifted=0,this.queue=new Cy4,this._offset=0}push($){this.buffered+=$.byteLength,this.queue.push($)}shiftFirst($){return this._buffered===0?null:this._next($)}shift($){if($>this.buffered)return null;if($===0)return _y4;let Z=this._next($);if($===Z.byteLength)return Z;let X=[Z];while(($-=Z.byteLength)>0)Z=this._next($),X.push(Z);return o28.concat(X)}_next($){let Z=this.queue.peek(),X=Z.byteLength-this._offset;if($>=X){let Q=this._offset?Z.subarray(this._offset,Z.byteLength):Z;return this.queue.shift(),this._offset=0,this.buffered-=X,this.shifted+=X,Q}return this.buffered-=$,this.shifted+=$,Z.subarray(this._offset,this._offset+=$)}}class a28 extends Sy4{constructor($,Z,X){super();this.header=Z,this.offset=X,this._parent=$}_read($){if(this.header.size===0)this.push(null);if(this._parent._stream===this)this._parent._update();$(null)}_predestroy(){this._parent.destroy(t28(this))}_detach(){if(this._parent._stream===this)this._parent._stream=null,this._parent._missing=e28(this.header.size),this._parent._update()}_destroy($){this._detach(),$(null)}}class s28 extends Vy4{constructor($){super($);if(!$)$={};this._buffer=new r28,this._offset=0,this._header=null,this._stream=null,this._missing=0,this._longHeader=!1,this._callback=s$1,this._locked=!1,this._finished=!1,this._pax=null,this._paxGlobal=null,this._gnuLongPath=null,this._gnuLongLinkPath=null,this._filenameEncoding=$.filenameEncoding||"utf-8",this._allowUnknownFormat=!!$.allowUnknownFormat,this._unlockBound=this._unlock.bind(this)}_unlock($){if(this._locked=!1,$){this.destroy($),this._continueWrite($);return}this._update()}_consumeHeader(){if(this._locked)return!1;this._offset=this._buffer.shifted;try{this._header=mh.decode(this._buffer.shift(512),this._filenameEncoding,this._allowUnknownFormat)}catch($){return this._continueWrite($),!1}if(!this._header)return!0;switch(this._header.type){case"gnu-long-path":case"gnu-long-link-path":case"pax-global-header":case"pax-header":return this._longHeader=!0,this._missing=this._header.size,!0}if(this._locked=!0,this._applyLongHeaders(),this._header.size===0||this._header.type==="directory")return this.emit("entry",this._header,this._createStream(),this._unlockBound),!0;return this._stream=this._createStream(),this._missing=this._header.size,this.emit("entry",this._header,this._stream,this._unlockBound),!0}_applyLongHeaders(){if(this._gnuLongPath)this._header.name=this._gnuLongPath,this._gnuLongPath=null;if(this._gnuLongLinkPath)this._header.linkname=this._gnuLongLinkPath,this._gnuLongLinkPath=null;if(this._pax){if(this._pax.path)this._header.name=this._pax.path;if(this._pax.linkpath)this._header.linkname=this._pax.linkpath;if(this._pax.size)this._header.size=parseInt(this._pax.size,10);this._header.pax=this._pax,this._pax=null}}_decodeLongHeader($){switch(this._header.type){case"gnu-long-path":this._gnuLongPath=mh.decodeLongPath($,this._filenameEncoding);break;case"gnu-long-link-path":this._gnuLongLinkPath=mh.decodeLongPath($,this._filenameEncoding);break;case"pax-global-header":this._paxGlobal=mh.decodePax($);break;case"pax-header":this._pax=this._paxGlobal===null?mh.decodePax($):Object.assign({},this._paxGlobal,mh.decodePax($));break}}_consumeLongHeader(){this._longHeader=!1,this._missing=e28(this._header.size);let $=this._buffer.shift(this._header.size);try{this._decodeLongHeader($)}catch(Z){return this._continueWrite(Z),!1}return!0}_consumeStream(){let $=this._buffer.shiftFirst(this._missing);if($===null)return!1;this._missing-=$.byteLength;let Z=this._stream.push($);if(this._missing===0){if(this._stream.push(null),Z)this._stream._detach();return Z&&this._locked===!1}return Z}_createStream(){return new a28(this,this._header,this._offset)}_update(){while(this._buffer.buffered>0&&!this.destroying){if(this._missing>0){if(this._stream!==null){if(this._consumeStream()===!1)return;continue}if(this._longHeader===!0){if(this._missing>this._buffer.buffered)break;if(this._consumeLongHeader()===!1)return!1;continue}let $=this._buffer.shiftFirst(this._missing);if($!==null)this._missing-=$.byteLength;continue}if(this._buffer.buffered<512)break;if(this._stream!==null||this._consumeHeader()===!1)return}this._continueWrite(null)}_continueWrite($){let Z=this._callback;this._callback=s$1,Z($)}_write($,Z){this._callback=Z,this._buffer.push($),this._update()}_final($){this._finished=this._missing===0&&this._buffer.buffered===0,$(this._finished?null:Error("Unexpected end of data"))}_predestroy(){this._continueWrite(null)}_destroy($){if(this._stream)this._stream.destroy(t28(this));$(null)}[Symbol.asyncIterator](){let $=null,Z=null,X=null,Q=null,Y=null,G=this;return this.on("entry",W),this.on("error",(U)=>{$=U}),this.on("close",H),{[Symbol.asyncIterator](){return this},next(){return new Promise(K)},return(){return N(null)},throw(U){return N(U)}};function J(U){if(!Y)return;let F=Y;Y=null,F(U)}function K(U,F){if($)return F($);if(Q){U({value:Q,done:!1}),Q=null;return}if(Z=U,X=F,J(null),G._finished&&Z)Z({value:void 0,done:!0}),Z=X=null}function W(U,F,w){if(Y=w,F.on("error",s$1),Z)Z({value:F,done:!1}),Z=X=null;else Q=F}function H(){if(J($),!Z)return;if($)X($);else Z({value:void 0,done:!0});Z=X=null}function N(U){return G.destroy(U),J(U),new Promise((F,w)=>{if(G.destroyed)return F({value:void 0,done:!0});G.once("close",function(){if(U)w(U);else F({value:void 0,done:!0})})})}}}$q8.exports=function(Z){return new s28(Z)};function s$1(){}function e28($){return $&=511,$&&512-$}});var Qq8=_((T1Z,e$1)=>{var Xq8={S_IFMT:61440,S_IFDIR:16384,S_IFCHR:8192,S_IFBLK:24576,S_IFIFO:4096,S_IFLNK:40960};try{e$1.exports=U0("fs").constants||Xq8}catch{e$1.exports=Xq8}});var Nq8=_((R1Z,Hq8)=>{var{Readable:vy4,Writable:xy4,getStreamError:Yq8}=o$1(),f_=lh(),ih=Qq8(),Fj0=a$1(),Gq8=f_.alloc(1024);class Jq8 extends xy4{constructor($,Z,X){super({mapWritable:by4,eagerOpen:!0});if(this.written=0,this.header=Z,this._callback=X,this._linkname=null,this._isLinkname=Z.type==="symlink"&&!Z.linkname,this._isVoid=Z.type!=="file"&&Z.type!=="contiguous-file",this._finished=!1,this._pack=$,this._openCallback=null,this._pack._stream===null)this._pack._stream=this;else this._pack._pending.push(this)}_open($){if(this._openCallback=$,this._pack._stream===this)this._continueOpen()}_continuePack($){if(this._callback===null)return;let Z=this._callback;this._callback=null,Z($)}_continueOpen(){if(this._pack._stream===null)this._pack._stream=this;let $=this._openCallback;if(this._openCallback=null,$===null)return;if(this._pack.destroying)return $(Error("pack stream destroyed"));if(this._pack._finalized)return $(Error("pack stream is already finalized"));if(this._pack._stream=this,!this._isLinkname)this._pack._encode(this.header);if(this._isVoid)this._finish(),this._continuePack(null);$(null)}_write($,Z){if(this._isLinkname)return this._linkname=this._linkname?f_.concat([this._linkname,$]):$,Z(null);if(this._isVoid){if($.byteLength>0)return Z(Error("No body allowed for this entry"));return Z()}if(this.written+=$.byteLength,this._pack.push($))return Z();this._pack._drain=Z}_finish(){if(this._finished)return;if(this._finished=!0,this._isLinkname)this.header.linkname=this._linkname?f_.toString(this._linkname,"utf-8"):"",this._pack._encode(this.header);Wq8(this._pack,this.header.size),this._pack._done(this)}_final($){if(this.written!==this.header.size)return $(Error("Size mismatch"));this._finish(),$(null)}_getError(){return Yq8(this)||Error("tar entry destroyed")}_predestroy(){this._pack.destroy(this._getError())}_destroy($){this._pack._done(this),this._continuePack(this._finished?null:this._getError()),$()}}class Kq8 extends vy4{constructor($){super($);this._drain=$51,this._finalized=!1,this._finalizing=!1,this._pending=[],this._stream=null}entry($,Z,X){if(this._finalized||this.destroying)throw Error("already finalized or destroyed");if(typeof Z==="function")X=Z,Z=null;if(!X)X=$51;if(!$.size||$.type==="symlink")$.size=0;if(!$.type)$.type=fy4($.mode);if(!$.mode)$.mode=$.type==="directory"?493:420;if(!$.uid)$.uid=0;if(!$.gid)$.gid=0;if(!$.mtime)$.mtime=new Date;if(typeof Z==="string")Z=f_.from(Z);let Q=new Jq8(this,$,X);if(f_.isBuffer(Z))return $.size=Z.byteLength,Q.write(Z),Q.end(),Q;if(Q._isVoid)return Q;return Q}finalize(){if(this._stream||this._pending.length>0){this._finalizing=!0;return}if(this._finalized)return;this._finalized=!0,this.push(Gq8),this.push(null)}_done($){if($!==this._stream)return;if(this._stream=null,this._finalizing)this.finalize();if(this._pending.length)this._pending.shift()._continueOpen()}_encode($){if(!$.pax){let Z=Fj0.encode($);if(Z){this.push(Z);return}}this._encodePax($)}_encodePax($){let Z=Fj0.encodePax({name:$.name,linkname:$.linkname,pax:$.pax}),X={name:"PaxHeader",mode:$.mode,uid:$.uid,gid:$.gid,size:Z.byteLength,mtime:$.mtime,type:"pax-header",linkname:$.linkname&&"PaxHeader",uname:$.uname,gname:$.gname,devmajor:$.devmajor,devminor:$.devminor};this.push(Fj0.encode(X)),this.push(Z),Wq8(this,Z.byteLength),X.size=$.size,X.type=$.type,this.push(Fj0.encode(X))}_doDrain(){let $=this._drain;this._drain=$51,$()}_predestroy(){let $=Yq8(this);if(this._stream)this._stream.destroy($);while(this._pending.length){let Z=this._pending.shift();Z.destroy($),Z._continueOpen()}this._doDrain()}_read($){this._doDrain(),$()}}Hq8.exports=function(Z){return new Kq8(Z)};function fy4($){switch($&ih.S_IFMT){case ih.S_IFBLK:return"block-device";case ih.S_IFCHR:return"character-device";case ih.S_IFDIR:return"directory";case ih.S_IFIFO:return"fifo";case ih.S_IFLNK:return"symlink"}return"file"}function $51(){}function Wq8($,Z){if(Z&=511,Z)$.push(Gq8.subarray(0,512-Z))}function by4($){return f_.isBuffer($)?$:f_.from($)}});var Uq8=_((yy4)=>{yy4.extract=Zq8();yy4.pack=Nq8()});var Bq8=_((q1Z,wq8)=>{wq8.exports=Fq8;function Fq8($,Z){if($&&Z)return Fq8($)(Z);if(typeof $!=="function")throw TypeError("need wrapper function");return Object.keys($).forEach(function(Q){X[Q]=$[Q]}),X;function X(){var Q=Array(arguments.length);for(var Y=0;Y<Q.length;Y++)Q[Y]=arguments[Y];var G=$.apply(this,Q),J=Q[Q.length-1];if(typeof G==="function"&&G!==J)Object.keys(J).forEach(function(K){G[K]=J[K]});return G}}});var X51=_((M1Z,Z51)=>{var Oq8=Bq8();Z51.exports=Oq8(wj0);Z51.exports.strict=Oq8(Lq8);wj0.proto=wj0(function(){Object.defineProperty(Function.prototype,"once",{value:function(){return wj0(this)},configurable:!0}),Object.defineProperty(Function.prototype,"onceStrict",{value:function(){return Lq8(this)},configurable:!0})});function wj0($){var Z=function(){if(Z.called)return Z.value;return Z.called=!0,Z.value=$.apply(this,arguments)};return Z.called=!1,Z}function Lq8($){var Z=function(){if(Z.called)throw Error(Z.onceError);return Z.called=!0,Z.value=$.apply(this,arguments)},X=$.name||"Function wrapped with `once`";return Z.onceError=X+" shouldn't be called more than once",Z.called=!1,Z}});var zq8=_((k1Z,Eq8)=>{var uy4=X51(),cy4=function(){},ly4=global.Bare?queueMicrotask:process.nextTick.bind(process),dy4=function($){return $.setHeader&&typeof $.abort==="function"},my4=function($){return $.stdio&&Array.isArray($.stdio)&&$.stdio.length===3},Dq8=function($,Z,X){if(typeof Z==="function")return Dq8($,null,Z);if(!Z)Z={};X=uy4(X||cy4);var{_writableState:Q,_readableState:Y}=$,G=Z.readable||Z.readable!==!1&&$.readable,J=Z.writable||Z.writable!==!1&&$.writable,K=!1,W=function(){if(!$.writable)H()},H=function(){if(J=!1,!G)X.call($)},N=function(){if(G=!1,!J)X.call($)},U=function(D){X.call($,D?Error("exited with error code: "+D):null)},F=function(D){X.call($,D)},w=function(){ly4(B)},B=function(){if(K)return;if(G&&!(Y&&(Y.ended&&!Y.destroyed)))return X.call($,Error("premature close"));if(J&&!(Q&&(Q.ended&&!Q.destroyed)))return X.call($,Error("premature close"))},L=function(){$.req.on("finish",H)};if(dy4($))if($.on("complete",H),$.on("abort",w),$.req)L();else $.on("request",L);else if(J&&!Q)$.on("end",W),$.on("close",W);if(my4($))$.on("exit",U);if($.on("end",N),$.on("finish",H),Z.error!==!1)$.on("error",F);return $.on("close",w),function(){if(K=!0,$.removeListener("complete",H),$.removeListener("abort",w),$.removeListener("request",L),$.req)$.req.removeListener("finish",H);$.removeListener("end",W),$.removeListener("close",W),$.removeListener("finish",H),$.removeListener("exit",U),$.removeListener("end",N),$.removeListener("error",F),$.removeListener("close",w)}};Eq8.exports=Dq8});var Aq8=_((V1Z,Pq8)=>{var iy4=X51(),ny4=zq8(),Bj0;try{Bj0=U0("fs")}catch($){}var sr=function(){},py4=typeof process>"u"?!1:/^v?\.0/.test(process.version),Oj0=function($){return typeof $==="function"},ty4=function($){if(!py4)return!1;if(!Bj0)return!1;return($ instanceof(Bj0.ReadStream||sr)||$ instanceof(Bj0.WriteStream||sr))&&Oj0($.close)},oy4=function($){return $.setHeader&&Oj0($.abort)},ry4=function($,Z,X,Q){Q=iy4(Q);var Y=!1;$.on("close",function(){Y=!0}),ny4($,{readable:Z,writable:X},function(J){if(J)return Q(J);Y=!0,Q()});var G=!1;return function(J){if(Y)return;if(G)return;if(G=!0,ty4($))return $.close(sr);if(oy4($))return $.abort();if(Oj0($.destroy))return $.destroy();Q(J||Error("stream was destroyed"))}},jq8=function($){$()},ay4=function($,Z){return $.pipe(Z)},sy4=function(){var $=Array.prototype.slice.call(arguments),Z=Oj0($[$.length-1]||sr)&&$.pop()||sr;if(Array.isArray($[0]))$=$[0];if($.length<2)throw Error("pump requires two streams per minimum");var X,Q=$.map(function(Y,G){var J=G<$.length-1,K=G>0;return ry4(Y,J,K,function(W){if(!X)X=W;if(W)Q.forEach(jq8);if(J)return;Q.forEach(jq8),Z(X)})});return $.reduce(ay4)};Pq8.exports=sy4});var Cq8=_((Xg4)=>{var Tq8=Uq8(),Rq8=Aq8(),Iq8=U0("fs"),w9=U0("path"),er=(global.Bare?global.Bare.platform:process.platform)==="win32";Xg4.pack=function(Z,X){if(!Z)Z=".";if(!X)X={};let Q=X.fs||Iq8,Y=X.ignore||X.filter||$a,G=X.mapStream||Vq8,J=Zg4(Q,X.dereference?Q.stat:Q.lstat,Z,Y,X.entries,X.sort),K=X.strict!==!1,W=typeof X.umask==="number"?~X.umask:~qq8(),H=X.pack||Tq8.pack(),N=X.finish||$a,U=X.map||$a,F=typeof X.dmode==="number"?X.dmode:0,w=typeof X.fmode==="number"?X.fmode:0;if(X.strip)U=Sq8(U,X.strip);if(X.readable)F|=parseInt(555,8),w|=parseInt(444,8);if(X.writable)F|=parseInt(333,8),w|=parseInt(222,8);D();function B(E,z){Q.readlink(w9.join(Z,E),function(j,A){if(j)return H.destroy(j);z.linkname=Q51(A),H.entry(z,D)})}function L(E,z,j){if(H.destroyed)return;if(E)return H.destroy(E);if(!z){if(X.finalize!==!1)H.finalize();return N(H)}if(j.isSocket())return D();let A={name:Q51(z),mode:(j.mode|(j.isDirectory()?F:w))&W,mtime:j.mtime,size:j.size,type:"file",uid:j.uid,gid:j.gid};if(j.isDirectory())return A.size=0,A.type="directory",A=U(A)||A,H.entry(A,D);if(j.isSymbolicLink())return A.size=0,A.type="symlink",A=U(A)||A,B(z,A);if(A=U(A)||A,!j.isFile()){if(K)return H.destroy(Error("unsupported type for "+z));return D()}let P=H.entry(A,D),q=G(Q.createReadStream(w9.join(Z,z),{start:0,end:A.size>0?A.size-1:A.size}),A);q.on("error",function(k){P.destroy(k)}),Rq8(q,P)}function D(E){if(E)return H.destroy(E);J(L)}return H};function ey4($){return $.length?$[$.length-1]:null}function $g4(){return!global.Bare&&process.getuid?process.getuid():-1}function qq8(){return!global.Bare&&process.umask?process.umask():0}Xg4.extract=function(Z,X){if(!Z)Z=".";if(!X)X={};Z=w9.resolve(Z);let Q=X.fs||Iq8,Y=X.ignore||X.filter||$a,G=X.mapStream||Vq8,J=X.chown!==!1&&!er&&$g4()===0,K=X.extract||Tq8.extract(),W=[],H=new Date,N=typeof X.umask==="number"?~X.umask:~qq8(),U=X.strict!==!1,F=X.validateSymlinks!==!1,w=X.map||$a,B=typeof X.dmode==="number"?X.dmode:0,L=typeof X.fmode==="number"?X.fmode:0;if(X.strip)w=Sq8(w,X.strip);if(X.readable)B|=parseInt(555,8),L|=parseInt(444,8);if(X.writable)B|=parseInt(333,8),L|=parseInt(222,8);if(K.on("entry",D),X.finish)K.on("finish",X.finish);return K;function D(P,q,k){P=w(P)||P,P.name=Q51(P.name);let M=w9.join(Z,w9.join("/",P.name));if(Y(M,P))return q.resume(),k();let C=w9.join(M,".")===w9.join(Z,".")?Z:w9.dirname(M);kq8(Q,C,w9.join(Z,"."),function(Z0,D0){if(Z0)return k(Z0);if(!D0)return k(Error(C+" is not a valid path"));if(P.type==="directory")return W.push([M,P.mtime]),A(M,{fs:Q,own:J,uid:P.uid,gid:P.gid,mode:P.mode},d);A(C,{fs:Q,own:J,uid:P.uid,gid:P.gid,mode:493},function(R0){if(R0)return k(R0);switch(P.type){case"file":return y();case"link":return b();case"symlink":return v()}if(U)return k(Error("unsupported type for "+M+" ("+P.type+")"));q.resume(),k()})});function d(Z0){if(Z0)return k(Z0);z(M,P,function(D0){if(D0)return k(D0);if(er)return k();j(M,P,k)})}function v(){if(er)return k();Q.unlink(M,function(){let Z0=w9.resolve(w9.dirname(M),P.linkname);if(!t(Z0)&&F)return k(Error(M+" is not a valid symlink"));Mq8(Q,Z0,w9.join(Z,"."),function(D0,R0){if(D0)return k(D0);if(!R0&&F)return k(Error(M+" is not a valid symlink"));Q.symlink(P.linkname,M,d)})})}function b(){if(er)return k();Q.unlink(M,function(){let Z0=w9.join(Z,w9.join("/",P.linkname));Q.realpath(Z0,function(D0,R0){if(D0||!t(R0))return k(Error(M+" is not a valid hardlink"));Q.link(R0,M,function($0){if($0&&$0.code==="EPERM"&&X.hardlinkAsFilesFallback)return q=Q.createReadStream(R0),y();d($0)})})})}function t(Z0){return Z0===Z||Z0.startsWith(Z+w9.sep)}function y(){let Z0=Q.createWriteStream(M),D0=G(q,P);Z0.on("error",function(R0){D0.destroy(R0)}),Rq8(D0,Z0,function(R0){if(R0)return k(R0);Z0.on("close",d)})}}function E(P,q){let k;while((k=ey4(W))&&P.slice(0,k[0].length)!==k[0])W.pop();if(!k)return q();Q.utimes(k[0],H,k[1],q)}function z(P,q,k){if(X.utimes===!1)return k();if(q.type==="directory")return Q.utimes(P,H,q.mtime,k);if(q.type==="symlink")return E(P,k);Q.utimes(P,H,q.mtime,function(M){if(M)return k(M);E(P,k)})}function j(P,q,k){let M=q.type==="symlink",C=M?Q.lchmod:Q.chmod,d=M?Q.lchown:Q.chown;if(!C)return k();let v=(q.mode|(q.type==="directory"?B:L))&N;if(d&&J)d.call(Q,P,q.uid,q.gid,b);else b(null);function b(t){if(t)return k(t);if(!C)return k();C.call(Q,P,v,k)}}function A(P,q,k){Q.stat(P,function(M){if(!M)return k(null);if(M.code!=="ENOENT")return k(M);Q.mkdir(P,{mode:q.mode,recursive:!0},function(C,d){if(C)return k(C);j(P,q,k)})})}};function Mq8($,Z,X,Q){if(Z===X)return Q(null,!0);if(!Z.startsWith(X+w9.sep))return Q(null,!1);$.lstat(Z,function(Y,G){if(Y&&Y.code!=="ENOENT"&&Y.code!=="EPERM")return Q(Y);if(Y||!G.isSymbolicLink())return Mq8($,w9.join(Z,".."),X,Q);Q(null,!1)})}function kq8($,Z,X,Q){if(Z===X)return Q(null,!0);$.lstat(Z,function(Y,G){if(Y&&Y.code!=="ENOENT"&&Y.code!=="EPERM")return Q(Y);if(Y||G.isDirectory())return kq8($,w9.join(Z,".."),X,Q);Q(null,!1)})}function $a(){}function Vq8($){return $}function Q51($){return er?$.replace(/\\/g,"/").replace(/[:?<>|]/g,"_"):$}function Zg4($,Z,X,Q,Y,G){if(!Y)Y=["."];let J=Y.slice(0);return function(W){if(!J.length)return W(null);let H=J.shift(),N=w9.join(X,H);Z.call($,N,function(U,F){if(U)return W(Y.indexOf(H)===-1&&U.code==="ENOENT"?null:U);if(!F.isDirectory())return W(null,H,F);$.readdir(N,function(w,B){if(w)return W(w);if(G)B.sort();for(let L=0;L<B.length;L++)if(!Q(w9.join(X,H,B[L])))J.push(w9.join(H,B[L]));W(null,H,F)})})}}function Sq8($,Z){return function(X){X.name=X.name.split("/").slice(Z).join("/");let Q=X.linkname;if(Q&&(X.type==="link"||w9.isAbsolute(Q)))X.linkname=Q.split("/").slice(Z).join("/");return $(X)}}});var Gg4,Jg4;var _q8=O(()=>{c$1();Gg4=V(z28(),1),Jg4=V(Cq8(),1)});var Lj0=()=>{};var vq8=O(()=>{Sz0()});var xq8=O(()=>{Qj0();Xj0();Lj0()});var fq8=()=>{};var bq8=()=>{};var Y51=O(()=>{$28();h$1();Qj0();G28();y$1();c$1();J28();K28();W28();H28();g$1();N28();_q8();Lj0();vq8();xq8();fq8();bq8();Lj0()});var v9,p9,b_,Za;var Xa=O(()=>{v9={CLAIM_API_GROUP:"extensions.agents.x-k8s.io",CLAIM_API_VERSION:"v1alpha1",CLAIM_PLURAL:"sandboxclaims",SANDBOX_API_GROUP:"agents.x-k8s.io",SANDBOX_API_VERSION:"v1alpha1",SANDBOX_PLURAL:"sandboxes",POD_NAME_ANNOTATION:"agents.x-k8s.io/pod-name"};p9=class p9 extends Error{cause;constructor($,Z){super($);if(this.name="SandboxError",this.cause=Z,Z instanceof Error&&Z.stack)this.stack=`${this.stack}
 Caused by: ${Z.stack}`}};b_=class b_ extends p9{constructor($,Z){super($,Z);this.name="SandboxTimeoutError"}};Za=class Za extends p9{constructor($,Z){super($,Z);this.name="SandboxAlreadyExistsError"}}});async function Kg4($){let Z=$.getCurrentCluster();if(!Z)throw new p9("No active cluster in kubeconfig");let X={};await $.applyToHTTPSOptions(X);let Q={},Y=X.headers??{};for(let[G,J]of Object.entries(Y))if(Array.isArray(J))Q[G]=J.join(", ");else if(J!==void 0)Q[G]=String(J);if(typeof X.auth==="string"&&!Q.Authorization)Q.Authorization=`Basic ${Buffer.from(X.auth).toString("base64")}`;return{server:Z.server.replace(/\/+$/,""),headers:Q,tls:{cert:G51(X.cert),key:G51(X.key),ca:G51(X.ca),rejectUnauthorized:Z.skipTLSVerify?!1:void 0}}}function G51($){if($==null)return;if(typeof $==="string")return $;if(Buffer.isBuffer($))return $.toString("utf8");return String($)}async function FK($,Z){let X=await Kg4($),Q={...X.headers,...Z.headers};if(Z.method==="PATCH")Q["content-type"]=Z.patchType==="apply"?"application/apply-patch+yaml":Z.patchType==="strategic-merge"?"application/strategic-merge-patch+json":"application/merge-patch+json";else if(Z.body!==void 0&&!("content-type"in Q))Q["content-type"]="application/json";let Y={method:Z.method,headers:Q,body:Z.body===void 0?void 0:JSON.stringify(Z.body),signal:Z.signal,tls:X.tls,...Z.stream?{timeout:!1}:{}};return fetch(`${X.server}${Z.path}`,Y)}async function J51($){try{return await $.json()}catch{return null}}async function Dj0($,Z){if($.ok)return;let X=await J51($),Q=X?.message??`${Z} failed: ${$.status} ${$.statusText}`;throw new yq8($.status,X,Q)}async function nh($,Z,X,Q,Y="none"){try{let G=await FK($,Z);if(G.status===404)return null;if(await Dj0(G,X),Y==="json")return await G.json();return null}catch(G){throw new p9(Q,G)}}async function Qa($,Z,X){let Q=`${K51}/${encodeURIComponent(Z)}/${v9.CLAIM_PLURAL}`,Y;try{Y=await FK($,{method:"POST",path:Q,body:X})}catch(H){let N=H instanceof Error?H.message:String(H);throw console.warn(`[agent-sandbox/client] createSandboxClaim ${X.metadata.name} transport error: ${N}`),new p9(`Failed to create SandboxClaim: ${X.metadata.name} (transport error: ${N})`,H)}if(Y.ok)return;let G=await J51(Y),J=G?.reason?` ${G.reason}`:"",K=G?.message??Y.statusText,W=`Failed to create SandboxClaim: ${X.metadata.name} (${Y.status}${J}: ${K})`;if(console.warn(`[agent-sandbox/client] createSandboxClaim ${X.metadata.name} rejected: status=${Y.status} reason=${G?.reason??"<none>"} message=${K}`),Y.status===409)throw new Za(W);throw new p9(W)}async function Ej0($,Z,X,Q=60000){let Y=Date.now()+Q,G=500,J;while(!0){let K=await wK($,Z,X).catch(()=>{return});if(!K)return;if(J=K,Date.now()>=Y){let W=J.metadata?.finalizers??[],H=J.metadata?.deletionTimestamp??"<unknown>";throw new b_(`SandboxClaim ${X} still terminating after ${Q}ms (deletionTimestamp=${H}, finalizers=[${W.join(", ")}])`)}await _8(500)}}function W51($,Z){return`${K51}/${encodeURIComponent($)}/${v9.CLAIM_PLURAL}/${encodeURIComponent(Z)}`}async function zj0($,Z,X,Q){await nh($,{method:"PATCH",path:W51(Z,X),patchType:"merge",body:{spec:{lifecycle:{shutdownPolicy:"Delete",shutdownTime:Q}}}},"patchSandboxClaimShutdown",`Failed to patch SandboxClaim shutdownTime: ${X}`)}async function fO($,Z,X){await nh($,{method:"DELETE",path:W51(Z,X)},"deleteSandboxClaim",`Failed to delete SandboxClaim: ${X}`)}async function wK($,Z,X){return await nh($,{method:"GET",path:W51(Z,X)},"getSandboxClaim",`Failed to get SandboxClaim: ${X}`,"json")??void 0}async function gq8($,Z,X,Q=60){let Y=Date.now()+Q*1000,G=200;while(Date.now()<Y){let K=(await wK($,Z,X).catch(()=>{return}))?.status?.sandbox?.name;if(K)return K;await _8(200)}throw new b_(`SandboxClaim ${X} did not record an adopted Sandbox (status.sandbox.name) within ${Q}s`)}async function hq8($,Z,X){let Y=(await nh($,{method:"GET",path:`${K51}/${encodeURIComponent(Z)}/sandboxwarmpools/${encodeURIComponent(X)}`},"getSandboxWarmPool",`Failed to get SandboxWarmPool: ${X}`,"json"))?.status?.selector;if(!Y)return null;let G=await FK($,{method:"GET",path:`/api/v1/namespaces/${encodeURIComponent(Z)}/pods?labelSelector=${encodeURIComponent(Y)}`});return await Dj0(G,"listWarmPoolPods"),((await G.json()).items??[]).filter((K)=>K.status?.phase==="Running").flatMap((K)=>K.metadata?.name&&K.metadata.uid?[{name:K.metadata.name,uid:K.metadata.uid,labels:K.metadata.labels??{}}]:[])}async function uq8($,Z,X,Q){try{let Y=await FK($,{method:"GET",path:`/api/v1/namespaces/${encodeURIComponent(Z)}/pods/${encodeURIComponent(X)}`});if(!Y.ok)return!1;return!(await Y.json()).metadata?.labels?.[Q]}catch{return!1}}function H51($,Z){return`${Wg4}/${encodeURIComponent($)}/${dq8}/${encodeURIComponent(Z)}`}async function jj0($,Z,X){let Q=new URLSearchParams({fieldManager:iq8,force:"true"}),Y=`${H51(Z,X.metadata.name)}?${Q}`;try{let G=await FK($,{method:"PATCH",path:Y,patchType:"apply",body:X});await Dj0(G,"applyHttpRoute")}catch(G){throw new p9(`Failed to apply HTTPRoute: ${X.metadata.name}`,G)}}async function Pj0($,Z,X){await nh($,{method:"DELETE",path:H51(Z,X)},"deleteHttpRoute",`Failed to delete HTTPRoute: ${X}`)}async function mq8($,Z,X){return await nh($,{method:"GET",path:H51(Z,X)},"getHttpRoute",`Failed to get HTTPRoute: ${X}`,"json")??void 0}async function nq8($,Z,X,Q){let Y={apiVersion:"v1",kind:"Service",metadata:{name:X},spec:{ports:[{name:Q.name,port:Q.port,targetPort:Q.targetPort,protocol:Q.protocol??"TCP"}]}},G=new URLSearchParams({fieldManager:iq8,force:"true"}),J=`/api/v1/namespaces/${encodeURIComponent(Z)}/services/${encodeURIComponent(X)}?${G}`;try{let K=await FK($,{method:"PATCH",path:J,patchType:"apply",body:Y});await Dj0(K,"ensureServicePort")}catch(K){throw new p9(`Failed to apply Service ports: ${X}`,K)}}function Aj0($,Z,X,Q=180){let Y=`/apis/${v9.SANDBOX_API_GROUP}/${v9.SANDBOX_API_VERSION}/namespaces/${encodeURIComponent(Z)}/${v9.SANDBOX_PLURAL}?watch=true&fieldSelector=${encodeURIComponent(`metadata.name=${X}`)}`,{resolve:G,reject:J,promise:K}=Promise.withResolvers(),W=new AbortController,H=!1,N=setTimeout(()=>{if(H)return;H=!0,W.abort(),J(new b_(`Sandbox did not become ready within ${Q} seconds`))},Q*1000),U=(F)=>{if(H)return;H=!0,clearTimeout(N),W.abort(),F()};return(async()=>{let F;try{F=await FK($,{method:"GET",path:Y,signal:W.signal,headers:{accept:"application/json"},stream:!0})}catch(w){U(()=>J(new p9("Failed to start watch for sandbox readiness",w)));return}if(!F.ok||!F.body){let w=await J51(F).catch(()=>null);U(()=>J(new p9(`Watch handshake failed (${F.status}): ${w?.message??F.statusText}`)));return}try{for await(let w of N51(F.body)){if(H)return;if(w.type==="ERROR"){let z=w.object;U(()=>J(new p9(`Watch stream error while waiting for sandbox: ${z.message??"unknown"}`)));return}if(w.type!=="ADDED"&&w.type!=="MODIFIED")continue;let B=w.object;if(!B.status?.conditions?.find((z)=>z.type==="Ready"&&z.status==="True"))continue;let D=B.metadata?.name;if(!D){U(()=>J(new p9("Sandbox metadata or name is missing")));return}let E=B.metadata?.annotations?.[v9.POD_NAME_ANNOTATION]??D;U(()=>G({sandboxName:D,podName:E}));return}U(()=>J(new p9("Watch stream closed before sandbox became ready")))}catch(w){if(H)return;if(w instanceof Error&&(w.name==="AbortError"||W.signal.aborted))return;U(()=>J(new p9("Watch stream error while waiting for sandbox",w)))}})(),K}async function*N51($){let Z=$.getReader(),X=new TextDecoder,Q="";try{while(!0){let{value:G,done:J}=await Z.read();if(J)break;Q+=X.decode(G,{stream:!0});let K;while((K=Q.indexOf(`
-`))>=0){let W=Q.slice(0,K).trim();if(Q=Q.slice(K+1),!W)continue;yield JSON.parse(W)}}let Y=Q.trim();if(Y)yield JSON.parse(Y)}finally{Z.releaseLock()}}var yq8,K51,cq8="gateway.networking.k8s.io",lq8="v1",dq8="httproutes",Wg4,Ya,iq8="mesh-sandbox-runner";var Ga=O(()=>{H$();Xa();yq8=class yq8 extends Error{status;body;constructor($,Z,X){super(X);this.status=$;this.body=Z;this.name="KubeHttpError"}};K51=`/apis/${v9.CLAIM_API_GROUP}/${v9.CLAIM_API_VERSION}/namespaces`;Wg4=`/apis/${cq8}/${lq8}/namespaces`;Ya={API_GROUP:cq8,API_VERSION:lq8,PLURAL:dq8}});function Ng4($){return($.items??[]).some((Z)=>{if(Z.status?.phase!=="Pending")return!1;return(Z.status?.conditions??[]).some((X)=>X.type==="PodScheduled"&&X.status==="False"&&X.reason==="Unschedulable")})}function tq8($,Z){let X=0,Q=!0,Y=null,G=async()=>{try{let J=await FK($,{method:"GET",path:`/api/v1/namespaces/${encodeURIComponent(Z)}/pods?fieldSelector=status.phase%3DPending`});if(!J.ok)return pq8;let K=await J.json();return!Ng4(K)}catch{return pq8}};return async()=>{if(Date.now()-X<Hg4)return Q;return Y??=G().finally(()=>{Y=null}),Q=await Y,X=Date.now(),Q}}var Hg4=3000,pq8=!0;var oq8=O(()=>{Ga()});var U51=O(()=>{H$();J41()});async function Rj0($){try{let Z=await fetch(`${$}/health`,{signal:AbortSignal.timeout(Ug4)});if(!Z.ok)return null;let X=await Z.json();if(typeof X==="object"&&X!==null&&typeof X.bootId==="string"&&typeof X.ready==="boolean"&&X.setup&&typeof X.setup.running==="boolean"&&typeof X.setup.done==="boolean")return X;return null}catch{return null}}async function w51($){for(let Z=0;Z<rq8;Z++){if(await Rj0($)!==null)return;let X=(Math.random()*2-1)*Fg4;await _8(aq8+X)}throw Error(`sandbox daemon at ${$} did not respond on /health within ${rq8*aq8/1000}s`)}async function y_($,Z,X,Q,Y){return wg4($,Z,"POST",X,Q,Y)}async function wg4($,Z,X,Q,Y,G){let J={...Q};if(Y&&Y.rotateToken!==void 0)J.auth=Y;let K=await fetch(`${$}/_sandbox/config`,{method:X,headers:{"Content-Type":"application/json",Authorization:`Bearer ${Z}`},body:JSON.stringify(J),signal:AbortSignal.timeout(G?.timeoutMs??F51)}),W=await K.text();if(!K.ok)throw new Tj0(K.status,W);return JSON.parse(W)}async function sq8($,Z,X){let Q=await fetch(`${$}/_sandbox/setup/${X}`,{method:"POST",headers:{Authorization:`Bearer ${Z}`},signal:AbortSignal.timeout(F51)});if(!Q.ok)throw Error(`sandbox daemon /_sandbox/setup/${X} returned ${Q.status}: ${await Q.text()}`)}async function eq8($,Z,X){let Q=await fetch(`${$}/_sandbox/orgfs-config`,{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${Z}`},body:X,signal:AbortSignal.timeout(F51)}),Y=await Q.text();if(!Q.ok)throw Error(`sandbox daemon /_sandbox/orgfs-config returned ${Q.status}: ${Y}`);return JSON.parse(Y)}async function Ja($,Z,X,Q){let Y=new Headers(Q.headers);for(let K of Bg4)Y.delete(K);Y.set("authorization",`Bearer ${Z}`);let G=Q.method!=="GET"&&Q.method!=="HEAD",J=`${$}${X.startsWith("/")?X:`/${X}`}`;return fetch(J,{method:Q.method,headers:Y,body:G?Q.body:void 0,redirect:"manual",signal:Q.signal,duplex:G?"half":void 0})}var Tj0,Ug4=500,F51=30000,rq8=25,aq8=200,Fg4=50,Bg4;var $M8=O(()=>{U51();Tj0=class Tj0 extends Error{status;constructor($,Z){super(`sandbox daemon /_sandbox/config returned ${$}: ${Z}`);this.status=$;this.name="ConfigRequestError"}};Bg4=["cookie","host","connection","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","accept-encoding","content-length"]});async function*QM8($){let Z=$.now??(()=>Date.now()),X=Z(),Q=$.schedulingTimeoutMs??Dg4,Y={pod:{},sandbox:{},events:{hasPulling:!1,hasPulled:!1},startedAt:X},G=[],J=null,K=!1,W=(z)=>{if(K)return;if(J){let j=J;J=null,j(z)}else G.push(z)},H=()=>{if(G.length>0)return Promise.resolve(G.shift());if(K)return Promise.resolve(null);return new Promise((z)=>{J=z})},N=()=>{if(K)return;if(K=!0,J){let z=J;J=null,z(null)}},U=new AbortController,F=()=>{U.abort(),N()};if($.signal)if($.signal.aborted)U.abort(),N();else $.signal.addEventListener("abort",F,{once:!0});let w=Math.max(0,Q-(Z()-X)),B=setTimeout(()=>W("tick"),w+100),L,D=new Promise((z)=>{L=z}),E=Promise.allSettled([Eg4($.kc,$.namespace,$.claimName,U.signal,Y,W,Z,L),jg4($.kc,$.namespace,$.claimName,U.signal,Y,W),Pg4($.kc,$.namespace,$.claimName,D,U.signal,Y,W,Z)]);try{let z=null,j=-1,A=ZM8(Y,Q,Z);if(z=O51(A),!B51(A))j=XM8(A);if(yield A,B51(A))return;while(!K){if(await H()===null)break;let q=ZM8(Y,Q,Z);if(B51(q)){let C=O51(q);if(C!==z)z=C,yield q;return}let k=XM8(q);if(k<j)continue;let M=O51(q);if(M!==z)z=M,j=k,yield q}}finally{if(clearTimeout(B),U.abort(),$.signal)$.signal.removeEventListener("abort",F);N(),await E.catch(()=>{})}}function ZM8($,Z,X){let{pod:Q,sandbox:Y,events:G,startedAt:J}=$;if(Y.ready)return{kind:"ready"};let K=Q.containerWaitingReason;if(K==="ImagePullBackOff"||K==="ErrImagePull")return{kind:"failed",reason:"image-pull-backoff",message:"Sandbox image failed to download. The cluster may be missing pull credentials or the image tag may not exist."};if(K==="CrashLoopBackOff")return{kind:"failed",reason:"crash-loop-backoff",message:"Sandbox crashed during startup and is now in CrashLoopBackOff. Check pod logs."};if(!Q.scheduled&&G.lastFailedSchedulingAt!==void 0&&X()-J>Z)return{kind:"failed",reason:"scheduling-timeout",message:G.failedSchedulingMessage??`Pod could not be scheduled within ${Math.round(Z/1000)}s.`};if(Q.containerRunning&&!Q.containerReady)return{kind:"warming-daemon",since:J};if(G.hasPulling&&!G.hasPulled)return{kind:"pulling-image",since:J};if(K==="ContainerCreating"||K==="PodInitializing"||Q.scheduled&&!Q.containerRunning)return{kind:"starting-container",since:J};if(Q.scheduledFalseReason==="Unschedulable"||G.lastFailedSchedulingAt!==void 0&&!Q.scheduled)return{kind:"waiting-for-capacity",since:J,message:G.failedSchedulingMessage??Q.scheduledFalseMessage,nodeClaim:G.nominatedNodeClaim};return{kind:"claiming",since:J}}function B51($){return $.kind==="ready"||$.kind==="failed"}function XM8($){switch($.kind){case"claiming":return 0;case"waiting-for-capacity":return 1;case"pulling-image":return 2;case"starting-container":return 3;case"warming-daemon":return 4;case"ready":case"failed":return 99}}function O51($){switch($.kind){case"claiming":case"pulling-image":case"starting-container":case"warming-daemon":return $.kind;case"waiting-for-capacity":return`waiting-for-capacity:${$.message??""}:${$.nodeClaim??""}`;case"ready":return"ready";case"failed":return`failed:${$.reason}:${$.message}`}}async function Eg4($,Z,X,Q,Y,G,J,K){let W=`/api/v1/namespaces/${encodeURIComponent(Z)}/pods?watch=true&labelSelector=${encodeURIComponent(`${Og4}=${X}`)}`;return Ij0({kc:$,path:W,signal:Q,label:`pod/${X}`,onEvent:(H)=>{if(H.type!=="ADDED"&&H.type!=="MODIFIED")return;let N=H.object;if(N.metadata?.name)K(N.metadata.name);zg4(N,Y,J),G("pod")}})}function zg4($,Z,X){let Y=($.status?.conditions??[]).find((J)=>J.type==="PodScheduled");if(Y?.status==="True")Z.pod.scheduled=!0,Z.pod.scheduledFalseReason=void 0,Z.pod.scheduledFalseMessage=void 0;else if(Y?.status==="False")Z.pod.scheduled=!1,Z.pod.scheduledFalseReason=Y.reason,Z.pod.scheduledFalseMessage=Y.message;let G=($.status?.containerStatuses??[]).find((J)=>J.name===Lg4);if(G)Z.pod.containerWaitingReason=G.state?.waiting?.reason,Z.pod.containerRunning=!!G.state?.running,Z.pod.containerReady=G.ready===!0}async function jg4($,Z,X,Q,Y,G){let J=`/apis/${v9.CLAIM_API_GROUP}/${v9.CLAIM_API_VERSION}/namespaces/${encodeURIComponent(Z)}/${v9.CLAIM_PLURAL}?watch=true&fieldSelector=${encodeURIComponent(`metadata.name=${X}`)}`;return Ij0({kc:$,path:J,signal:Q,label:`sandboxclaim/${X}`,onEvent:(K)=>{if(K.type!=="ADDED"&&K.type!=="MODIFIED")return;let H=K.object.status?.conditions?.find((N)=>N.type==="Ready");if(!H)return;if(H.status==="True")Y.sandbox.ready=!0,Y.sandbox.notReadyReason=void 0,Y.sandbox.notReadyMessage=void 0;else Y.sandbox.ready=!1,Y.sandbox.notReadyReason=H.reason,Y.sandbox.notReadyMessage=H.message;G("sandbox")}})}async function Pg4($,Z,X,Q,Y,G,J,K){let W=await Promise.race([Q,new Promise((N)=>{if(Y.aborted){N(X);return}Y.addEventListener("abort",()=>N(X),{once:!0})})]);if(Y.aborted)return;let H=`/api/v1/namespaces/${encodeURIComponent(Z)}/events?watch=true&fieldSelector=${encodeURIComponent(`involvedObject.name=${W},involvedObject.kind=Pod`)}`;return Ij0({kc:$,path:H,signal:Y,label:`events/${X}`,onEvent:(N)=>{if(N.type!=="ADDED"&&N.type!=="MODIFIED")return;let U=N.object,F=U.reason;if(!F)return;switch(F){case"Pulling":G.events.hasPulling=!0;break;case"Pulled":G.events.hasPulling=!0,G.events.hasPulled=!0;break;case"FailedScheduling":G.events.lastFailedSchedulingAt=K(),G.events.failedSchedulingMessage=U.message;break;case"Nominated":{let w=U.message?.match(/nodeclaim\/([\w-]+)/);if(w)G.events.nominatedNodeClaim=w[1];break}default:return}J("event")}})}async function YM8($){let{kc:Z,namespace:X,labelSelector:Q,signal:Y,onDelete:G}=$,J=`/apis/${v9.CLAIM_API_GROUP}/${v9.CLAIM_API_VERSION}/namespaces/${encodeURIComponent(X)}/${v9.CLAIM_PLURAL}?watch=true&labelSelector=${encodeURIComponent(Q)}`;return Ij0({kc:Z,path:J,signal:Y,label:"sandboxclaim-reaper",onEvent:(K)=>{if(K.type!=="DELETED")return;let W=K.object.metadata?.name;if(W)G(W)}})}async function Ij0($){let{kc:Z,path:X,signal:Q,label:Y,onEvent:G}=$,J=0;while(!Q.aborted){try{let W=await FK(Z,{method:"GET",path:X,signal:Q,headers:{accept:"application/json"},stream:!0});if(!W.ok||!W.body){try{await W.body?.cancel()}catch{}if(W.status===401||W.status===403){console.warn(`[lifecycle-watcher] ${Y} stopped: watch denied (${W.status} ${W.statusText}). `+"The kubeconfig in use cannot watch SandboxClaims \u2014 if you are running locally, "+"this provider should not be active (check STUDIO_SANDBOX_PROVIDER / your sandbox preference).");return}throw Error(`watch handshake failed: ${W.status} ${W.statusText}`)}J=0;for await(let H of N51(W.body)){if(Q.aborted)return;try{G(H)}catch(N){console.warn(`[lifecycle-watcher] ${Y} onEvent threw: ${N instanceof Error?N.message:String(N)}`)}}}catch(W){if(Q.aborted)return;let H=W instanceof Error?W.message:String(W);console.warn(`[lifecycle-watcher] ${Y} watch ended: ${H}`)}if(Q.aborted)return;let K=CX(5000,250,J,2,0);J+=1,await _8(K,{signal:Q}).catch(()=>{})}}var Og4="studio.decocms.com/sandbox-handle",Lg4="sandbox",Dg4=300000;var GM8=O(()=>{H$();Xa();Ga()});import{z as I3}from"zod";function JM8($){if(!$||$.trim()==="")return[];let Z=I3.array(Ag4).parse(JSON.parse($)),X=new Set;for(let Q of Z){if(X.has(Q.name))throw Error(`STUDIO_SANDBOX_TENANT_POOLS: duplicate pool name ${Q.name}`);X.add(Q.name)}return Z}function Tg4($){try{let[Z,X]=new URL($).pathname.replace(/^\/+/,"").split("/"),Q=X?.replace(/\.git$/,"");return Z&&Q?`${Z}/${Q}`.toLowerCase():null}catch{return null}}function KM8($,Z){let{orgId:X,cloneUrl:Q}=Z;if(Z.cloneOnly===!0)return null;if(!X||!Q)return null;let Y=Tg4(Q);if(!Y)return null;return $.find((G)=>G.orgId===X&&G.repo.toLowerCase()===Y)??null}function WM8($,Z,X){return $?.name??(Z?X:"none")}function HM8($,Z,X){let Q=X.replace(/^refs\/heads\//,"");return $.filter((Y)=>Y.repo.toLowerCase()===Z.toLowerCase()&&Y.branch===Q)}function NM8($){return`https://github.com/${$.repo}.git`}var Ag4;var L51=O(()=>{Ag4=I3.object({name:I3.string().regex(/^[a-z0-9]([-a-z0-9]*[a-z0-9])?$/,"pool name must be a DNS label (lowercase alphanumeric and '-')"),orgId:I3.string().min(1),repo:I3.string().regex(/^[^/\s]+\/[^/\s]+$/,"repo must be `owner/name`"),connectionId:I3.string().min(1).optional(),branch:I3.string().min(1).default("main"),workload:I3.object({runtime:I3.enum(["node","bun","deno"]).default("node"),packageManager:I3.enum(["npm","pnpm","yarn","bun","deno"]).optional(),packageManagerPath:I3.string().optional(),devPort:I3.number().int().positive().optional()}).default({runtime:"node"})})});async function UM8($,Z,X){let Q=new Map;for(let Y of $){let G=Z(Y);if(!G)continue;let J=Q.get(G);if(J)J.push(Y);else Q.set(G,[Y])}await Promise.allSettled([...Q.values()].map(async(Y)=>{for(let G of Y)await X(G).catch(()=>{})}))}import{createHash as Rg4,randomBytes as Ig4,randomUUID as qg4}from"crypto";import*as DM8 from"net";import{PassThrough as Mg4}from"stream";function kg4($){if($ instanceof Error)return $.message;if($&&typeof $==="object"){let Z=$;if(Z.error instanceof Error)return Z.error.message;if(typeof Z.message==="string"&&Z.message)return Z.message}return String($)}class A51{kind=wY;records=new Map;inflight=new r30;stateStore;previewUrlPattern;kubeConfig;capacityProbe;portForward;namespace;sandboxTemplateName;envName;tokenGenerator;idleTtlMs;metrics;previewGateway;sentinelToken;mintCloneUrl;tenantPools;tenantPoolRefreshMs;poolPods=new Map;dirtyPools=new Set;closed=!1;claimWatchAbort=new AbortController;constructor($={}){this.stateStore=$.stateStore??null,this.previewUrlPattern=$.previewUrlPattern??null,this.kubeConfig=$.kubeConfig??cg4(),this.portForward=new l$1(this.kubeConfig),this.namespace=$.namespace??Vg4,this.sandboxTemplateName=$.sandboxTemplateName??Sg4,this.envName=pg4($.envName),this.tokenGenerator=$.tokenGenerator??(()=>Ig4(Cg4).toString("hex")),this.idleTtlMs=$.idleTtlMs??vg4,this.metrics=$.meter?ug4($.meter):null,this.previewGateway=$.previewGateway&&$.previewUrlPattern?{...$.previewGateway}:null;let Z=$.sentinelToken?.trim()??"";if(this.sentinelToken=Z.length>0?Z:null,this.mintCloneUrl=$.mintCloneUrl,this.tenantPools=this.sentinelToken!==null?$.tenantPools??[]:[],this.sentinelToken===null&&($.tenantPools?.length??0)>0)console.warn(`[${r$}] tenant pools configured without a sentinel token \u2014 ignoring them (warm-pool mode is off)`);this.tenantPoolRefreshMs=$.tenantPoolRefreshMs??fg4,this.startClaimReaper(),this.startCredentialRefresher(),this.startTenantPoolReconciler()}startClaimReaper(){let $=["app.kubernetes.io/managed-by=studio","app.kubernetes.io/name=studio-sandbox",...this.envName?[`${BY.env}=${this.envName}`]:[]].join(",");YM8({kc:this.kubeConfig,namespace:this.namespace,labelSelector:$,signal:this.claimWatchAbort.signal,onDelete:(Z)=>this.invalidateRecord(Z)})}async ensure($,Z={}){let X=Wj($);if(X.startsWith("s-"))throw Error(`ensure: projectRef has no slug source: ${$.projectRef}`);return this.inflight.run(X,()=>a30(this.stateStore,$,wY,(Q)=>this.ensureLocked($,X,Z,Q)))}async delete($){let Z=await this.getRecord($);if(this.records.delete($),Z)this.closeForwarder(Z.daemonForward),this.metrics?.active.add(-1,j51(Z.tenant));if(await this.deleteHttpRouteIfManaged($).catch((X)=>{console.warn(`[${r$}] HTTPRoute delete failed for ${$}: ${X instanceof Error?X.message:String(X)}`)}),await fO(this.kubeConfig,this.namespace,$),this.stateStore)if(Z)await this.stateStore.delete(Z.id,wY);else await this.stateStore.deleteByHandle(wY,$)}async alive($){return await wK(this.kubeConfig,this.namespace,$)!==void 0}watchClaimLifecycle($,Z){return QM8({kc:this.kubeConfig,namespace:this.namespace,claimName:$,signal:Z})}hasSchedulableCapacity(){return this.capacityProbe??=tq8(this.kubeConfig,this.namespace),this.capacityProbe()}async getPreviewUrl($){let Z=await this.getRecord($);if(!Z)return null;return this.composePreviewUrl(Z)}async proxyDaemonRequest($,Z,X){let Q=await this.getRecord($);if(!Q&&this.previewUrlPattern&&this.stateStore){let W=await this.stateStore.getByHandle(wY,$),H=W?.state,N=H?.token;if(W&&N){let F=`http://${H?.adoptedSandboxName??$}.${this.namespace}.svc.cluster.local:${yU}`;try{let w=await Ja(F,N,Z,X);if(w.status!==404)return w;try{await w.body?.cancel()}catch{}}catch{}}}if(!Q)Q=await this.resurrectByHandle($);if(!Q)return new Response(JSON.stringify({error:"sandbox not found"}),{status:404,headers:{"content-type":"application/json"}});let Y=Q,G=performance.now(),J=0,K=!(X.body instanceof ReadableStream);try{let W=await Ja(Q.daemonUrl,Q.token,Z,X);if(W.status===401&&K){this.invalidateRecord($);let H=await this.getRecord($).catch(()=>null)??await this.resurrectByHandle($).catch(()=>null);if(H)Y=H,W=await Ja(H.daemonUrl,H.token,Z,X)}return J=W.status,W}catch(W){if(!K)throw W;this.invalidateRecord($);let H=await this.resurrectByHandle($)??await this.getRecord($).catch(()=>null);if(!H)throw W;Y=H;let N=await Ja(H.daemonUrl,H.token,Z,X);return J=N.status,N}finally{this.recordProxyDuration("daemon",J,Y,performance.now()-G)}}async adoptLiveClaim($,Z){if(this.records.has(Z))return!0;let X=await wK(this.kubeConfig,this.namespace,Z).catch(()=>{return});if(!X||X.metadata?.deletionTimestamp)return!1;return await this.inflight.run(Z,async()=>{let Y=this.records.get(Z);if(Y)return this.toSandbox(Y);let G=await this.adopt($,Z,X);if(!G)throw Error(`cannot adopt live claim ${Z}`);return a30(this.stateStore,$,wY,(J)=>this.finish(G,J,!0,!0,"adopt"))}).catch(()=>null)!=null}async resolvePreviewUpstreamUrl($){if(this.previewUrlPattern)return`http://${await this.resolveServiceNameForHandle($)}.${this.namespace}.svc.cluster.local:${yU}`;let Z=await this.getRecord($);if(Z)return Z.daemonUrl;let X=await this.resurrectByHandle($);return X?X.daemonUrl:null}async resolveServiceNameForHandle($){let Z=this.records.get($);if(Z)return Z.adoptedSandboxName;if(this.stateStore){let Q=(await this.stateStore.getByHandle(wY,$).catch(()=>null))?.state?.adoptedSandboxName;if(Q)return Q}return $}async proxyPreviewRequest($,Z){let X=performance.now(),Q=this.records.get($)??null,Y=0;try{let G=await this.resolvePreviewUpstreamUrl($);if(!G){Y=404;let B=E51(404,{error:"sandbox not found"});return B.headers.set(h_,"1"),B}let J=new URL(Z.url);if((J.pathname==="/_sandbox"||J.pathname.startsWith("/_sandbox/")||J.pathname==="/_decopilot_vm"||J.pathname.startsWith("/_decopilot_vm/"))&&Z.method!=="GET")return Y=404,E51(404,{error:"not found"});let W=(B)=>`${B}${J.pathname}${J.search}`,H=new Headers(Z.headers);for(let B of gg4)H.delete(B);let N=Z.method!=="GET"&&Z.method!=="HEAD",U={method:Z.method,headers:H,body:N?Z.body:void 0,redirect:"manual",signal:Z.signal,duplex:N?"half":void 0},F;try{F=await fetch(W(G),U)}catch(B){let L=`${G}${J.pathname}`;if(console.warn(`[${r$}] preview fetch to ${L} failed: ${B instanceof Error?B.message:String(B)}`),Z.method==="GET"||Z.method==="HEAD"){if(this.invalidateRecord($),await this.resurrectByHandle($).catch(()=>null)){let z=await this.resolvePreviewUpstreamUrl($);if(z)try{F=await fetch(W(z),U);let j=new Headers;for(let[A,P]of F.headers.entries())if(!BM8.includes(A.toLowerCase()))j.set(A,P);return Y=F.status,new Response(F.body,{status:F.status,statusText:F.statusText,headers:j})}catch(j){console.warn(`[${r$}] preview fetch retry to ${L} failed: ${j instanceof Error?j.message:String(j)}`)}}}else this.invalidateRecord($);Y=502;let D=E51(502,{error:"sandbox daemon unreachable"});return D.headers.set(h_,"1"),D}let w=new Headers;for(let[B,L]of F.headers.entries())if(!BM8.includes(B.toLowerCase()))w.set(B,L);return Y=F.status,new Response(F.body,{status:F.status,statusText:F.statusText,headers:w})}finally{this.recordProxyDuration("preview",Y,Q,performance.now()-X,$)}}async ensureLocked($,Z,X,Q){if(X.image)console.warn(`[${r$}] opts.image ignored (template ${this.sandboxTemplateName} pins image): got ${X.image}`);if(Q){let J=await Q.get($,wY);if(J){let K=await this.rehydrate($,Z,J);if(K)return await this.refreshDaemonGitCredential(K,X),this.finish(K,Q,!1,!0,"resume");await Q.delete($,wY)}}let Y=await wK(this.kubeConfig,this.namespace,Z).catch(()=>{return});if(Y)if(Y.metadata?.deletionTimestamp)await Ej0(this.kubeConfig,this.namespace,Z).catch((J)=>{console.warn(`[${r$}] wait for terminating claim ${Z} failed: ${J instanceof Error?J.message:String(J)}`)});else{let J=await this.adopt($,Z,Y).catch((K)=>{return console.warn(`[${r$}] adopt ${Z} failed, recreating: ${K instanceof Error?K.message:String(K)}`),null});if(J)return await this.refreshDaemonGitCredential(J,X),this.finish(J,Q,!0,!0,"adopt");await fO(this.kubeConfig,this.namespace,Z).catch(()=>{}),await Ej0(this.kubeConfig,this.namespace,Z).catch((K)=>{console.warn(`[${r$}] wait for deleted claim ${Z} failed: ${K instanceof Error?K.message:String(K)}`)})}let G=await this.provision($,Z,X);return this.finish(G,Q,!0,!1,"fresh")}async finish($,Z,X,Q,Y){let G=this.records.get($.handle),J=G!==void 0;if(G&&G.daemonForward!==$.daemonForward)this.closeForwarder(G.daemonForward);if(this.records.set($.handle,$),X)await this.persist(Z,$);if(Q)await zj0(this.kubeConfig,this.namespace,$.handle,this.computeShutdownTime()).catch((K)=>console.warn(`[${r$}] TTL refresh failed for ${$.handle}: ${K instanceof Error?K.message:String(K)}`));if(this.metrics){let K=j51($.tenant);if(this.metrics.ensureOutcome.add(1,{...K,outcome:Y}),!J)this.metrics.active.add(1,K)}return this.toSandbox($)}buildEnvMap($,Z){let X={},Q=[];for(let[Y,G]of Object.entries($.env??{}))if(_g4.has(Y))Q.push(Y);else X[Y]=G;if(Q.length>0)console.warn(`[${r$}] opts.env keys overlap reserved bootstrap names and were dropped: ${Q.join(",")}`);return{...X,DAEMON_TOKEN:Z.token,DAEMON_BOOT_ID:Z.daemonBootId,APP_ROOT:Z.workdir,PROXY_PORT:String(yU)}}buildClaim($,Z,X){let Q=this.sentinelToken!==null,Y=KM8(this.tenantPools,{orgId:Z.tenant?.orgId,cloneUrl:Z.repo?.cloneUrl,cloneOnly:Z.cloneOnly}),G=Q?[]:Object.entries(this.buildEnvMap(Z,X)).sort(([W],[H])=>W<H?-1:W>H?1:0).map(([W,H])=>({name:W,value:H})),J=rg4(Z),K=Object.keys(J).length>0;return{apiVersion:`${v9.CLAIM_API_GROUP}/${v9.CLAIM_API_VERSION}`,kind:"SandboxClaim",metadata:{name:$,namespace:this.namespace,labels:{"app.kubernetes.io/name":"studio-sandbox","app.kubernetes.io/managed-by":"studio",...this.envName?{[BY.env]:this.envName}:{},...z51(Z.tenant)},...K?{annotations:J}:{}},spec:{sandboxTemplateRef:{name:this.sandboxTemplateName},additionalPodMetadata:{labels:z51(Z.tenant,{[BY.role]:"claimed",[BY.sandboxHandle]:$,...this.envName?{[BY.env]:this.envName}:{}}),...K?{annotations:J}:{}},env:G,warmpool:WM8(Y,Q,this.sandboxTemplateName),lifecycle:{shutdownPolicy:"Delete",shutdownTime:this.computeShutdownTime()}}}}async provision($,Z,X){let Q=this.tokenGenerator(),Y=qg4(),G=D51,J=this.buildClaim(Z,X,{token:Q,daemonBootId:Y,workdir:G});try{await Qa(this.kubeConfig,this.namespace,J)}catch(F){if(F instanceof Za)await Ej0(this.kubeConfig,this.namespace,Z),await Qa(this.kubeConfig,this.namespace,J);else throw F}let K;try{K=await gq8(this.kubeConfig,this.namespace,Z),await Aj0(this.kubeConfig,this.namespace,K)}catch(F){throw await fO(this.kubeConfig,this.namespace,Z).catch(()=>{}),F}try{await this.ensureServicePortForAdoptedSandbox(K),await this.ensureHttpRouteForHandle(Z,K,X.tenant??null)}catch(F){throw await fO(this.kubeConfig,this.namespace,Z).catch(()=>{}),F}let W=await this.openForwarder(K,yU,Z),H=`http://127.0.0.1:${W.localPort}`,N=this.workloadConfigPayload(X),U=Y;try{if(await w51(H),this.sentinelToken!==null){let F=await Rj0(H);if(F)U=F.bootId;await y_(H,this.sentinelToken,N??{},{rotateToken:Q})}else if(N)await y_(H,Q,N);await this.relayOrgFsConfig(H,Q,X.orgFsConfigJson)}catch(F){throw this.closeForwarder(W),await this.deleteHttpRouteIfManaged(Z).catch(()=>{}),await fO(this.kubeConfig,this.namespace,Z).catch(()=>{}),F}return{id:$,handle:Z,adoptedSandboxName:K,token:Q,workdir:G,daemonUrl:H,daemonForward:W,workload:X.workload??null,daemonBootId:U,tenant:X.tenant??null,ensureOpts:$h4(X)}}workloadConfigPayload($){return e30({runtime:$?.workload?.runtime??"node",packageManager:$?.workload?.packageManager?{name:$.workload.packageManager,...$.workload.packageManagerPath?{path:$.workload.packageManagerPath}:{}}:null,repo:$?.repo??null,port:$?.workload?.devPort??FM8,tenant:$?.tenant??void 0,...$?{cloneOnly:$.cloneOnly===!0}:{}})}async relayOrgFsConfig($,Z,X){if(!X)return;await eq8($,Z,X).catch((Q)=>console.warn("[org-fs] sidecar config relay failed",Q))}async refreshDaemonGitCredential($,Z){let X=K41(Z);if(!X)return;try{await y_($.daemonUrl,$.token,X)}catch(Q){console.warn(`[${r$}] git credential refresh failed for ${$.handle}: ${Q instanceof Error?Q.message:String(Q)}`)}}async withFreshCloneUrl($,Z){if(!this.mintCloneUrl)return $;try{let X=await this.mintCloneUrl($,Z!==void 0?{bufferMs:Z}:void 0);return X?{...$,cloneUrl:X}:$}catch(X){return console.warn(`[${r$}] clone credential re-mint failed: ${X instanceof Error?X.message:String(X)}`),$}}startCredentialRefresher(){if(!this.mintCloneUrl)return;let{signal:$}=this.claimWatchAbort;(async()=>{while(!$.aborted){if(await _8(bg4,{signal:$}).catch(()=>{}),$.aborted)break;try{await this.refreshAllGitCredentials()}catch(Z){console.warn(`[${r$}] periodic credential refresh failed: ${Z instanceof Error?Z.message:String(Z)}`)}}})()}startTenantPoolReconciler(){if(this.tenantPools.length===0)return;let{signal:$}=this.claimWatchAbort;(async()=>{while(!$.aborted){try{await this.reconcileTenantPools()}catch(Z){console.warn(`[${r$}] tenant pool reconcile failed: ${Z instanceof Error?Z.message:String(Z)}`)}await _8(xg4,{signal:$}).catch(()=>{})}})()}markTenantPoolsDirty($,Z){let X=HM8(this.tenantPools,$,Z);for(let Q of X)this.dirtyPools.add(Q.name);return X.map((Q)=>Q.name)}async reconcileTenantPools(){for(let $ of this.tenantPools){let Z=await hq8(this.kubeConfig,this.namespace,$.name);if(Z===null){console.warn(`[${r$}] tenant pool ${$.name}: no SandboxWarmPool (or no selector yet) in ${this.namespace}`);continue}let X=this.dirtyPools.delete($.name),Q=Z.filter((Y)=>!Y.labels[BY.sandboxHandle]);for(let[Y]of this.poolPods)if(!Z.some((G)=>G.uid===Y))this.poolPods.delete(Y);for(let Y of Q){if(this.claimWatchAbort.signal.aborted)return;await this.warmPoolPod($,Y,X)}this.recordPoolDepth($,Z,Q)}}recordPoolDepth($,Z,X){let Q=this.metrics?.poolPods;if(!Q)return;let Y=0,G=0;for(let K of X){let W=this.poolPods.get(K.uid);if(!W)continue;if(W.failures>=qj0)G++;else if(W.lastConfigAt>0)Y++}let J={pool:$.name,org:$.orgId};Q.record(Y,{...J,state:"ready"}),Q.record(Z.length-X.length,{...J,state:"bound"}),Q.record(X.length-Y-G,{...J,state:"pending"}),Q.record(G,{...J,state:"failed"})}async warmPoolPod($,Z,X){let Q=this.poolPods.get(Z.uid);if(Q&&Q.failures>=qj0){if(Date.now()-Q.lastFailureAt<wM8)return;this.poolPods.set(Z.uid,{...Q,failures:0})}let Y=X||Q!==void 0&&Date.now()-Q.lastConfigAt>=this.tenantPoolRefreshMs;if(Q&&!Y)return;let G={cloneUrl:NM8($),connectionId:$.connectionId,branch:$.branch,userName:"",userEmail:""},J=await this.withFreshCloneUrl(G);if($.connectionId&&J.cloneUrl===G.cloneUrl){this.recordPoolFailure(Z,$,"clone credential mint failed");return}let K=await this.openForwarder(Z.name,yU,Z.name).catch(()=>null);if(!K){this.recordPoolFailure(Z,$,"port-forward failed");return}let W=`http://127.0.0.1:${K.localPort}`;try{await w51(W);let H=this.sentinelToken;if(!H)return;if(!await this.isPoolPodUnbound(Z))return;let N=e30({runtime:$.workload.runtime,packageManager:$.workload.packageManager?{name:$.workload.packageManager,...$.workload.packageManagerPath?{path:$.workload.packageManagerPath}:{}}:null,repo:J,port:$.workload.devPort??FM8})??{},{transition:U}=await y_(W,H,N);if(Y&&U!=="bootstrap"&&await this.isPoolPodUnbound(Z))await sq8(W,H,"clone");this.poolPods.set(Z.uid,{lastConfigAt:Date.now(),lastFailureAt:0,failures:0}),console.log(`[${r$}] tenant pool ${$.name}: warmed ${Z.name} (${U})`)}catch(H){this.recordPoolFailure(Z,$,H instanceof Error?H.message:String(H))}finally{this.closeForwarder(K)}}isPoolPodUnbound($){return uq8(this.kubeConfig,this.namespace,$.name,BY.sandboxHandle)}recordPoolFailure($,Z,X){let Q=this.poolPods.get($.uid),Y=(Q?.failures??0)+1;this.poolPods.set($.uid,{lastConfigAt:Q?.lastConfigAt??0,lastFailureAt:Date.now(),failures:Y});let G=Y>=qj0?` \u2014 backing off ${wM8/60000}min`:"";console.warn(`[${r$}] tenant pool ${Z.name}: warming ${$.name} failed (${Y}/${qj0})${G}: ${X}`)}async refreshAllGitCredentials(){await UM8(this.records.values(),($)=>$.ensureOpts?.repo?.connectionId,async($)=>{if(this.claimWatchAbort.signal.aborted)return;let Z=$.ensureOpts?.repo;if(!Z)return;let X=await this.withFreshCloneUrl(Z,yg4);await this.refreshDaemonGitCredential($,{...$.ensureOpts,repo:X}),$.ensureOpts={...$.ensureOpts,repo:X}})}async rebootstrapDaemon($,Z,X){if(this.sentinelToken===null)return!1;let Q=this.workloadConfigPayload(X)??{};try{return await y_($,this.sentinelToken,Q,{rotateToken:Z}),await this.relayOrgFsConfig($,Z,X?.orgFsConfigJson),!0}catch(Y){if(Y instanceof Tj0&&Y.status===401)try{return await y_($,Z,Q,{rotateToken:Z}),await this.relayOrgFsConfig($,Z,X?.orgFsConfigJson),!0}catch(G){return console.warn(`[${r$}] re-bootstrap retry with claim token failed: ${G instanceof Error?G.message:String(G)}`),!1}return console.warn(`[${r$}] re-bootstrap failed: ${Y instanceof Error?Y.message:String(Y)}`),!1}}async ensureServicePortForAdoptedSandbox($){if(!this.previewGateway||!this.previewUrlPattern)return;await nq8(this.kubeConfig,this.namespace,$,{name:"daemon",port:yU,targetPort:yU})}async ensureHttpRouteForHandle($,Z,X){if(!this.previewGateway||!this.previewUrlPattern)return;let Q=Zh4(this.previewUrlPattern,$);if(!Q)throw new p9(`Unable to derive preview hostname for ${$} from pattern: ${this.previewUrlPattern}`);let Y={apiVersion:`${Ya.API_GROUP}/${Ya.API_VERSION}`,kind:"HTTPRoute",metadata:{name:$,namespace:this.namespace,labels:z51(X??void 0,{[BY.role]:"claimed",[BY.sandboxHandle]:$,"app.kubernetes.io/name":"studio-sandbox","app.kubernetes.io/managed-by":"studio",...this.envName?{[BY.env]:this.envName}:{}})},spec:{parentRefs:[{kind:"Gateway",group:"gateway.networking.k8s.io",name:this.previewGateway.name,namespace:this.previewGateway.namespace}],hostnames:[Q],rules:[{backendRefs:[{group:"",kind:"Service",name:Z,port:yU}]}]}};await jj0(this.kubeConfig,this.namespace,Y)}async deleteHttpRouteIfManaged($){if(!this.previewGateway)return;await Pj0(this.kubeConfig,this.namespace,$)}async rehydrate($,Z,X){let Q=X.state;if(!Q.adoptedSandboxName&&!Q.podName||!Q.token)return null;let Y=await wK(this.kubeConfig,this.namespace,Z).catch(()=>{return});if(!Y||!OM8(Y))return null;let G=Y.status?.sandbox?.name??Q.adoptedSandboxName??Q.podName??Z,J=await this.openAndProbeDaemon(G,Z);if(!J)return null;if(Q.daemonBootId&&Q.daemonBootId!==J.bootId){if(this.sentinelToken!==null){let K=Q.ensureOpts?.repo?{...Q.ensureOpts,repo:await this.withFreshCloneUrl(Q.ensureOpts.repo)}:Q.ensureOpts??null;if(!await this.rebootstrapDaemon(J.daemonUrl,Q.token,K))return this.closeForwarder(J.daemonForward),null}else console.warn(`[${r$}] daemon restart detected (handle=${Z}): stored bootId=${Q.daemonBootId} live bootId=${J.bootId}`);await this.stateStore?.put($,wY,{handle:Z,state:{...Q,daemonBootId:J.bootId}}).catch((K)=>console.warn(`[${r$}] bootId persist failed for ${Z}: ${K instanceof Error?K.message:String(K)}`))}return{id:$,handle:Z,adoptedSandboxName:G,token:Q.token,workdir:Q.workdir??D51,daemonUrl:J.daemonUrl,daemonForward:J.daemonForward,workload:Q.workload??null,daemonBootId:J.bootId,tenant:Q.tenant??null,ensureOpts:Q.ensureOpts??null}}async adopt($,Z,X){if(!OM8(X))return null;let Q=X.status?.sandbox?.name??Z;if(this.sentinelToken!==null)return null;let Y=lg4(X);if(!Y)return null;let G=await this.openAndProbeDaemon(Q,Z);if(!G)return null;let J=ag4(X);if(this.previewGateway)await this.ensureServicePortForAdoptedSandbox(Q).catch((K)=>{console.warn(`[${r$}] Service port backfill failed for ${Z}: ${K instanceof Error?K.message:String(K)}`)}),await this.ensureHttpRouteForHandle(Z,Q,J).catch((K)=>{console.warn(`[${r$}] HTTPRoute backfill failed for ${Z}: ${K instanceof Error?K.message:String(K)}`)});return{id:$,handle:Z,adoptedSandboxName:Q,token:Y,workdir:D51,daemonUrl:G.daemonUrl,daemonForward:G.daemonForward,workload:null,daemonBootId:G.bootId,tenant:J,ensureOpts:null}}async openAndProbeDaemon($,Z){let X=await this.openForwarder($,yU,Z).catch(()=>null);if(!X)return null;let Q=`http://127.0.0.1:${X.localPort}`,Y=await Rj0(Q);if(!Y)return this.closeForwarder(X),null;return{daemonForward:X,daemonUrl:Q,bootId:Y.bootId}}async getRecord($){let Z=this.records.get($);if(Z)return Z;if(!this.stateStore)return null;let X=await this.stateStore.getByHandle(wY,$);if(!X)return null;let Q=await this.rehydrate(X.id,$,X);if(Q)this.records.set($,Q);return Q}async resurrectByHandle($){if(!this.stateStore)return null;let Z=await this.stateStore.getByHandle(wY,$);if(!Z)return null;let X=Z.state.ensureOpts;if(!X)return null;let Q=X.repo?{...X,repo:await this.withFreshCloneUrl(X.repo)}:X;if(Wj(Z.id)!==$)return null;return await this.ensure(Z.id,Q),this.records.get($)??null}invalidateRecord($){let Z=this.records.get($);if(!Z)return;this.records.delete($),this.closeForwarder(Z.daemonForward)}recordProxyDuration($,Z,X,Q,Y){if(!this.metrics)return;this.metrics.proxyDurationMs.record(Q,{...j51(X?.tenant??null),source:$,sandbox_handle:X?.handle??Y??"",status_code:Z||0})}composePreviewUrl($){if(this.previewUrlPattern)return s30(this.previewUrlPattern,$.handle);return`http://127.0.0.1:${$.daemonForward.localPort}/`}toSandbox($){return{handle:$.handle,workdir:$.workdir,previewUrl:this.composePreviewUrl($)}}async persist($,Z){if(!$)return;let X={adoptedSandboxName:Z.adoptedSandboxName,token:Z.token,workdir:Z.workdir,workload:Z.workload,daemonBootId:Z.daemonBootId,tenant:Z.tenant,...Z.ensureOpts?{ensureOpts:Z.ensureOpts}:{}};await $.put(Z.id,wY,{handle:Z.handle,state:X})}computeShutdownTime(){return new Date(Date.now()+this.idleTtlMs).toISOString()}async releaseAfter($,Z){let X=await wK(this.kubeConfig,this.namespace,$);if(!X)return;let Q=sg4(X.spec?.lifecycle?.shutdownTime,new Date(Date.now()+Z));if(!Q)return;await zj0(this.kubeConfig,this.namespace,$,Q).catch((Y)=>console.warn(`[${r$}] release failed for ${$}: ${Y instanceof Error?Y.message:String(Y)}`))}async renewTtl($){let Z=await wK(this.kubeConfig,this.namespace,$);if(!Z)return;let X=eg4(Z.spec?.lifecycle?.shutdownTime,new Date(Date.now()+this.idleTtlMs));if(!X)return;await zj0(this.kubeConfig,this.namespace,$,X).catch((Q)=>console.warn(`[${r$}] TTL renew failed for ${$}: ${Q instanceof Error?Q.message:String(Q)}`))}openForwarder($,Z,X=$){let Q=dg4(X,Z);return new Promise((Y,G)=>{let J=(K,W)=>{let H=DM8.createServer((N)=>this.handleForwardedConnection(N,$,Z,X));H.once("error",(N)=>{if(N.code==="EADDRINUSE"&&W<hg4){try{H.close()}catch{}let U=P51+(K-P51+1)%EM8;J(U,W+1);return}G(N)}),H.listen(K,"127.0.0.1",()=>{let N=H.address();if(!N||typeof N==="string"){H.close(),G(Error("port-forward listener failed to bind"));return}Y({server:H,localPort:N.port})})};J(Q,0)})}handleForwardedConnection($,Z,X,Q){let Y=new Mg4,G=null,J=!1,K=()=>{if(J)return;if(J=!0,Y.destroy(),G)try{G.close()}catch{}if(!$.destroyed)$.destroy()};$.pipe(Y),$.on("error",K),$.on("close",K),this.portForward.portForward(this.namespace,Z,[X],$,null,Y).then((W)=>{let H=typeof W==="function"?W():W;if(!H){K();return}if(G=H,G.on("close",K),G.on("error",()=>{this.invalidateRecord(Q),K()}),J)try{G.close()}catch{}}).catch((W)=>{console.warn(`[${r$}] port-forward to ${Z}:${X} failed: ${kg4(W)}`,JSON.stringify(zM8(W))),this.invalidateRecord(Q),K()})}closeForwarder($){$.server.close((Z)=>{if(Z)console.warn(`[${r$}] port-forward close on :${$.localPort} errored: ${Z instanceof Error?Z.message:String(Z)}`)})}close(){if(this.closed)return;this.closed=!0,this.claimWatchAbort.abort();for(let $ of this.records.values())this.closeForwarder($.daemonForward);this.records.clear()}}function ug4($){return{active:$.createUpDownCounter("studio.sandbox.active",{description:"Active sandbox count, by runner kind, owning org, and daemon impl. Cross-checks the cAdvisor-derived count from the cluster \u2014 divergence between the two indicates orphaned claims (studio deleted but K8s didn't reap) or unattributed pods.",unit:"{sandbox}"}),ensureOutcome:$.createCounter("studio.sandbox.ensure.outcome",{description:"Outcome of each ensure() call: fresh provision, resume from state-store after restart, or adopt of a cluster-side claim studio didn't know about. Cold-start ratio is the primary input for warm-pool sizing.",unit:"{call}"}),proxyDurationMs:$.createHistogram("studio.sandbox.proxy.duration_ms",{description:"Wall-clock latency of studio-mediated requests to the sandbox daemon: tool exec proxies (source=daemon) and preview iframe traffic (source=preview).",unit:"ms"}),poolPods:$.createGauge("studio.sandbox.pool.pods",{description:"Tenant warm pool depth by pool and state: ready (warmed and unbound \u2014 what a claim can actually bind instantly), bound (serving a user), pending (unbound, not yet warmed), failed (gave up after repeated bootstrap failures). Alert on sustained ready=0: a pool that is always empty is doing nothing while costing N pods.",unit:"{pod}"})}}function zM8($){let Z=[],X=$;for(let Q=0;Q<5&&X instanceof Error;Q++){let Y=X;if(Z.push({name:Y.name,message:Y.message,...Y.code!==void 0?{code:Y.code}:{},...Y.errno!==void 0?{errno:Y.errno}:{}}),Y.cause===X)break;X=Y.cause}if(X!==void 0&&!(X instanceof Error)&&X!==null){let Q=X,Y=Q.error instanceof Error?zM8(Q.error).chain:void 0;Z.push({nonError:String(X),...typeof Q.type==="string"?{type:Q.type}:{},...typeof Q.message==="string"?{message:Q.message}:{},...Q.code!==void 0?{code:Q.code}:{},...typeof Q.reason==="string"?{reason:Q.reason}:{},...Y?{error:Y}:{},...Y===void 0&&Q.error!==void 0?{rawError:String(Q.error)}:{},keys:Object.keys(Q)})}return{chain:Z}}function cg4(){let $=new ch;return $.loadFromDefault(),$}function OM8($){return Boolean($.status?.conditions?.some((Z)=>Z.type==="Ready"&&Z.status==="True"))}function lg4($){let Z=$.spec?.env;if(!Z)return null;for(let X of Z)if(X.name==="DAEMON_TOKEN"&&X.value)return X.value;return null}function dg4($,Z){let X=Rg4("sha256").update(`${$}:${Z}`).digest();return P51+X.readUInt32BE(0)%EM8}function E51($,Z){return new Response(JSON.stringify(Z),{status:$,headers:{"content-type":"application/json","access-control-allow-origin":"*"}})}function LM8($){let Z=$.slice(0,ig4);return mg4.test(Z)?Z:""}function pg4($){if($===void 0)return null;let Z=$.trim();if(Z==="")return null;if(!ng4.test(Z))throw Error(`AgentSandboxProvider: envName=${JSON.stringify(Z)} is not a valid DNS-label-safe environment name (lowercase alphanumeric or '-', starts with a letter, ends alphanumeric, \u226432 chars). Studio sets this from STUDIO_ENV; check the studio chart's configMap.`);return Z}function z51($,Z={}){let X={...Z};if($){let Q=LM8($.orgId),Y=LM8($.userId);if(Q)X[BY.orgId]=Q;if(Y)X[BY.userId]=Y}return X}function g_($){let Z="";for(let X of $){let Q=X.codePointAt(0)??0;Z+=Q<32||Q===127?" ":X}return Z.slice(0,tg4)}function og4($){try{let Z=new URL($);return Z.username="",Z.password="",Z.toString()}catch{return""}}function rg4($){let Z={},X=$.tenant;if(X?.orgSlug)Z[BK.orgSlug]=g_(X.orgSlug);if(X?.orgName)Z[BK.orgName]=g_(X.orgName);if(X?.userEmail)Z[BK.userEmail]=g_(X.userEmail);if(X?.userName)Z[BK.userName]=g_(X.userName);let Q=$.repo;if(Q){if(Q.displayName)Z[BK.gitRepo]=g_(Q.displayName);let Y=og4(Q.cloneUrl);if(Y)Z[BK.gitRepoUrl]=g_(Y);let G=$.branch??Q.branch;if(G)Z[BK.gitBranch]=g_(G)}return Z}function ag4($){let Z=$.metadata?.labels;if(!Z)return null;let X=Z[BY.orgId],Q=Z[BY.userId];if(!X||!Q)return null;let Y=$.metadata?.annotations??{};return{orgId:X,userId:Q,orgSlug:Y[BK.orgSlug],orgName:Y[BK.orgName],userEmail:Y[BK.userEmail],userName:Y[BK.userName]}}function sg4($,Z){if($){let X=new Date($).getTime();if(Number.isFinite(X)&&X<=Z.getTime())return null}return Z.toISOString()}function eg4($,Z){if($){let X=new Date($).getTime();if(Number.isFinite(X)&&X>=Z.getTime())return null}return Z.toISOString()}function j51($){return{org_id:$?.orgId??"",user_id:$?.userId??"",runner_kind:wY}}function $h4($){let Z={};if($.branch)Z.branch=$.branch;if($.repo)Z.repo=$.repo;if($.workload)Z.workload=$.workload;if($.env&&Object.keys($.env).length>0)Z.env=$.env;if($.tenant)Z.tenant=$.tenant;if($.orgFsConfigJson)Z.orgFsConfigJson=$.orgFsConfigJson;return Object.keys(Z).length>0?Z:null}function Zh4($,Z){try{return new URL(s30($,Z)).hostname||null}catch{return null}}var wY="agent-sandbox",r$="AgentSandboxProvider",h_="x-sandbox-preview-not-ready",Vg4="agent-sandbox-system",Sg4="studio-sandbox",yU=9000,FM8=3000,D51="/app",Cg4=32,_g4,vg4=900000,xg4=60000,fg4=1800000,qj0=3,wM8=1800000,bg4=900000,yg4=1800000,gg4,BM8,P51=40000,EM8=1e4,hg4=256,BY,BK,mg4,ig4=63,ng4,tg4=253;var jM8=O(()=>{H$();oq8();Y51();$M8();W41();Ga();Xa();GM8();L51();_g4=new Set(["DAEMON_TOKEN","DAEMON_BOOT_ID","APP_ROOT","PROXY_PORT"]),gg4=["cookie","host","connection","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","accept-encoding","content-length","upgrade"],BM8=["connection","keep-alive","transfer-encoding","content-encoding","content-length"];BY={role:"studio.decocms.com/role",sandboxHandle:"studio.decocms.com/sandbox-handle",orgId:"studio.decocms.com/org-id",userId:"studio.decocms.com/user-id",env:"studio.decocms.com/env"},BK={orgSlug:"studio.decocms.com/org-slug",orgName:"studio.decocms.com/org-name",userEmail:"studio.decocms.com/user-email",userName:"studio.decocms.com/user-name",gitRepo:"studio.decocms.com/git-repo",gitRepoUrl:"studio.decocms.com/git-repo-url",gitBranch:"studio.decocms.com/git-branch"},mg4=/^([A-Za-z0-9]([-A-Za-z0-9_.]*[A-Za-z0-9])?)?$/;ng4=/^[a-z]([a-z0-9-]{0,30}[a-z0-9])?$/});var PM8={};w0(PM8,{waitForSandboxReady:()=>Aj0,parseTenantPools:()=>JM8,getSandboxClaim:()=>wK,getHttpRoute:()=>mq8,deleteSandboxClaim:()=>fO,deleteHttpRoute:()=>Pj0,createSandboxClaim:()=>Qa,applyHttpRoute:()=>jj0,SandboxTimeoutError:()=>b_,SandboxError:()=>p9,PREVIEW_NOT_READY_HEADER:()=>h_,KubeConfig:()=>ch,K8S_CONSTANTS:()=>v9,HTTPROUTE_CONSTANTS:()=>Ya,AgentSandboxProvider:()=>A51});var T51=O(()=>{Y51();Xa();Ga();jM8();L51()});var MM8={};w0(MM8,{subscribeLifecycle:()=>M51,getSandboxProviderByKind:()=>I51,getOrInitSharedRunner:()=>q51,__resetSharedLifecyclesForTesting:()=>wh4});function IM8($,Z){let X=AM8[$];if(X)return Promise.resolve(X);let Q=R51[$];if(Q)return Q;let Y=Z().then((G)=>{return AM8[$]=G,G}).finally(()=>{delete R51[$]});return R51[$]=Y,Y}function Yh4(){let $=process.env.STUDIO_SANDBOX_PREVIEW_URL_PATTERN;return $&&$.trim()!==""?$:void 0}function Gh4(){let $=process.env.STUDIO_SANDBOX_TEMPLATE_NAME;return $&&$.trim()!==""?$:void 0}function Jh4(){let $=process.env.STUDIO_ENV;return $&&$.trim()!==""?$:void 0}function Kh4(){let $=process.env.STUDIO_SANDBOX_SENTINEL_TOKEN;return $&&$.trim()!==""?$:void 0}function Wh4(){let $=process.env.STUDIO_SANDBOX_PREVIEW_GATEWAY_NAME?.trim(),Z=process.env.STUDIO_SANDBOX_PREVIEW_GATEWAY_NAMESPACE?.trim();if(!$&&!Z)return;if(!$||!Z)throw Error("STUDIO_SANDBOX_PREVIEW_GATEWAY_NAME and STUDIO_SANDBOX_PREVIEW_GATEWAY_NAMESPACE must both be set, or both unset. Half-configured per-claim HTTPRoute routing would silently fail to attach.");return{name:$,namespace:Z}}async function qM8($,Z){let X=new fr(Z),Q=Yh4();switch($){case"agent-sandbox":{let{AgentSandboxProvider:Y,parseTenantPools:G}=await Promise.resolve().then(() => (T51(),PM8)),J=new iN(Z1().encryptionKey);return new Y({stateStore:X,previewUrlPattern:Q,sandboxTemplateName:Gh4(),envName:Jh4(),previewGateway:Wh4(),sentinelToken:Kh4(),tenantPools:G(process.env.STUDIO_SANDBOX_TENANT_POOLS),meter:D6,mintCloneUrl:async(K,W)=>{if(!K.connectionId)return null;let H=FP8(K.cloneUrl);if(!H)return null;let{cloneUrl:N}=await RO(K.connectionId,H.owner,H.name,Z,J,{bufferMs:W?.bufferMs});return N}})}case"user-desktop":throw Error("user-desktop provider cannot be instantiated without a per-run link claim \u2014 call resolveSandboxProvider, which binds the link before constructing the provider.");default:throw Error(`Unknown sandbox provider kind: ${String($)}`)}}function I51($,Z){return IM8(Z,()=>qM8(Z,$.db))}async function q51(){let $;try{$=Hj()}catch(X){return console.warn("[lifecycle] cannot resolve sandbox runner:",X instanceof Error?X.message:String(X)),null}return await IM8($,()=>qM8($,H6().db))}function M51($,Z,X){let Q=bO.get(Z);if(Q){if(Q.terminated){if(Q.lastPhase)try{X(Q.lastPhase)}catch{}return{unsubscribe:Uh4}}if(Q.listeners.add(X),Q.lastPhase)try{X(Q.lastPhase)}catch{}return TM8(Z,Q,X)}let Y=new AbortController,G={lastPhase:null,terminated:!1,listeners:new Set([X]),abort:Y};return bO.set(Z,G),Fh4($,Z,G),TM8(Z,G,X)}function Uh4(){}function TM8($,Z,X){return{unsubscribe(){if(bO.get($)!==Z)return;if(Z.listeners.delete(X),Z.listeners.size===0)bO.delete($),Z.abort.abort()}}}async function Fh4($,Z,X){let Q=null;try{for await(let Y of $.watchClaimLifecycle(Z,X.abort.signal)){if(X.abort.signal.aborted)break;X.lastPhase=Y;let G=Y.kind==="ready"||Y.kind==="failed";if(G)X.terminated=!0;let J=Array.from(X.listeners);for(let K of J)try{K(Y)}catch{}if(G)break}}catch(Y){Q=Y}finally{if(!X.terminated&&!X.abort.signal.aborted&&X.listeners.size>0){let Y={kind:"failed",reason:"unknown",message:Q instanceof Error?Q.message:"Lifecycle watcher ended unexpectedly"};X.lastPhase=Y,X.terminated=!0;for(let G of Array.from(X.listeners))try{G(Y)}catch{}}if(bO.get(Z)===X)bO.delete(Z)}}function wh4(){for(let $ of bO.values())$.abort.abort();bO.clear()}var Xh4,Qh4,RM8,AM8,R51,Hh4,Nh4,bO;var Ka=O(()=>{SU();n7();q5();U41();br();hi();b8();Xh4=Symbol.for("decocms.sandbox.lifecycle.runners"),Qh4=Symbol.for("decocms.sandbox.lifecycle.inflight"),RM8=globalThis,AM8=RM8[Xh4]??={},R51=RM8[Qh4]??={};Hh4=Symbol.for("decocms.sandbox.lifecycle.shared-lifecycles"),Nh4=globalThis,bO=Nh4[Hh4]??=new Map});async function UQ($,Z){let{userId:X,branch:Q,virtualMcpMetadata:Y,explicitKind:G}=Z;if(G)return Wa($,G);if($.sandboxPreference==="agent-sandbox")return Wa($,"agent-sandbox");if($.sandboxPreference==="cluster-default")return Wa($,Hj());let[J,...K]=Bh4(Y,X,Q);if(J)return Wa($,K.length===0?J:Oh4(J,K));return Wa($,kM8())}function Bh4($,Z,X){let Q=n5($)[Z]?.[X];if(!Q)return[];let Y=zJ(Q);return Object.keys(Y)}function Oh4($,Z){let X=kM8();if(X===$||Z.includes(X))return X;return $}function kM8(){return Hj()}async function Wa($,Z){let X=Z==="user-desktop"?"agent-sandbox":Z;return{provider:await I51($,X),kind:X}}var yO=O(()=>{R6();SU();KY();Ka()});var Ha;var k51=O(()=>{Ha={npm:{install:"npm install",run:($)=>`npm run ${$}`,runtime:"node"},pnpm:{install:"pnpm install",run:($)=>`pnpm run ${$}`,runtime:"node"},yarn:{install:"yarn install",run:($)=>`yarn run ${$}`,runtime:"node"},bun:{install:"bun install",run:($)=>`bun run ${$}`,runtime:"bun"},deno:{install:"deno install",run:($)=>`deno task ${$}`,runtime:"deno"}}});function OK($,Z){return Z?`thread:${$}/${Z}`:`thread:${$}`}function gU($){return`sandbox/thread-${$.replace(/^thread:/,"").replace(/\//g,"-")}`}function gO($){if(!$||!$.startsWith("thread:"))return null;return $.slice(7).split("/")[0]||null}async function hU($,Z,X){let Q=gO(Z);if(!Q)return X;return(await $.storage.threads.get(Q).catch(()=>null))?.created_by??X}async function u_($,Z){if(!Z)return null;let X=await $.storage.threads.get(Z).catch(()=>null);if(!X)return null;return X.metadata??{}}async function VM8($,Z){let Q=(await u_($,Z))?.headRef;return typeof Q==="string"&&Q.length>0?Q:null}async function SM8($,Z,X){let Q=await u_($,Z);if(!Q)return;if(Q.headRef===X)return;await $.storage.threads.update(Z,{metadata:{...Q,headRef:X}}).catch((Y)=>console.warn("[thread-repo] setThreadHeadRef failed",Y))}async function hO($,Z){return(await u_($,Z))?.githubRepo??null}function V51($){if($.pinnedRef)return $.pinnedRef;if($.runBranch&&$.runBranch===OK($.threadId))return $.runBranch;if($.threadRepo)return OK($.threadId,$.threadRepo.connectionId);if(!$.agentRepo)return"ephemeral";return $.runBranch??`thread:${$.threadId}`}async function S51($,Z){let Q=(await u_($,Z))?.pinnedRef;return typeof Q==="string"&&Q.length>0?Q:null}async function CM8($,Z){let[X,Q]=await Promise.all([hO($,Z.threadId),S51($,Z.threadId)]);return V51({...Z,threadRepo:X,pinnedRef:Q})}async function _M8($,Z,X,Q,Y,G){let J=await u_($,Z);if(!J)return;let K=xr(n5(J),X,Q,Y,G);await $.storage.threads.update(Z,{metadata:{...J,sandboxMap:K}}).catch((W)=>console.warn("[thread-repo] setThreadSandboxMapEntry failed",W))}async function Mj0($,Z){return n5(await u_($,Z))}async function vM8($,Z,X,Q,Y){let G=await u_($,Z);if(!G)return;let J=N41(n5(G),X,Q,Y);if(!J)return;await $.storage.threads.update(Z,{metadata:{...G,sandboxMap:J}}).catch((K)=>console.warn("[thread-repo] removeThreadSandboxMapEntry failed",K))}var LK=O(()=>{KY()});function kj0($){if(!$)return null;let Z=$.runtime;if(!Z||typeof Z!=="object")return null;let X=Z.env;if(!Array.isArray(X))return null;let Q=[];for(let Y of X){if(!Y||typeof Y!=="object")continue;let G=Y;if(typeof G.key!=="string"||!QZ0.test(G.key))continue;if(G.kind==="literal"&&typeof G.value==="string"){Q.push({key:G.key,kind:"literal",value:G.value});continue}if(G.kind==="secret"&&typeof G.secretId==="string"&&G.secretId.length>0)Q.push({key:G.key,kind:"secret",secretId:G.secretId})}return Q.length===0?null:Q}function xM8($){if(!$)return null;let Z=$.runtime;if(!Z||typeof Z!=="object")return null;let X=Z.submoduleCredentials;if(!Array.isArray(X))return null;let Q=[];for(let Y of X){if(!Y||typeof Y!=="object")continue;let G=Y;if(typeof G.host==="string"&&G.host.length>0&&typeof G.secretId==="string"&&G.secretId.length>0)Q.push({host:G.host,secretId:G.secretId})}return Q.length===0?null:Q}async function fM8($,Z){N0(Z);let X=J0(Z);await Z.access.check();let Q=z1(Z);if(!Q)throw Error("User ID required");let Y=await Z.storage.virtualMcps.findById($.virtualMcpId);if(!Y||Y.organization_id!==X.id)throw Error("Virtual MCP not found");let G=Y.metadata??{},J=n5(G),K=await hU(Z,$.branch,Q),W=WH(J,K,$.branch,$.sandboxProviderKind);return{virtualMcp:Y,metadata:G,userId:Q,sandboxUserId:K,entry:W,organization:X}}function Lh4($){if($===null||!/^\d+$/.test($))return null;let Z=Number($);return Z>=1&&Z<=65535?$:null}function bM8($){let Z=$.runtime??null,Q=Z?.selected??null,Y=Lh4(Z?.port??null),G=Z?.path??null;if(!Q||!(Q in Ha))return{packageManager:null,runtime:null,port:Y,packageManagerPath:G,runtimeBinPath:null};let J=Ha[Q].runtime;return{packageManager:Q,runtime:J,port:Y,packageManagerPath:G,runtimeBinPath:J==="deno"?"/opt/deno/bin":J==="bun"?"/opt/bun/bin":null}}var Na=O(()=>{R6();k51();KY();LK()});async function uO($,Z){let X=$.body?.getReader();if(!X)return $.text();let Q=new TextDecoder,Y="",G=0;for(;;){let{done:J,value:K}=await X.read();if(J)break;if(G+=K.byteLength,G>Z)throw await X.cancel().catch(()=>{}),new yM8(`Upstream response exceeded ${Z} bytes`);Y+=Q.decode(K,{stream:!0})}return Y+=Q.decode(),Y}var yM8;var Ua=O(()=>{yM8=class yM8 extends Error{}});async function Vj0({ctx:$,runner:Z,handle:X,orgId:Q,userId:Y,entries:G}){if(!G||G.length===0)return;let J={};for(let W of G){if(W.kind==="literal"){J[W.key]=W.value;continue}try{let{value:H}=await $.storage.secrets.resolveById(W.secretId,Q,Y);J[W.key]=H}catch(H){if(H instanceof K3||H instanceof uB){console.warn(`[SANDBOX_START] skipping env ${W.key}: ${H.message}. Re-link or recreate the secret to restore.`);continue}throw H}}if(Object.keys(J).length===0)return;let K=await Z.proxyDaemonRequest(X,"/_sandbox/config",{method:"PUT",headers:new Headers({"content-type":"application/json"}),body:JSON.stringify({env:J})});if(!K.ok){let W=await uO(K,Dh4).catch(()=>K.statusText);console.warn(`[SANDBOX_START] daemon rejected env patch (${K.status}): ${W}`)}}var Dh4=10485760;var C51=O(()=>{Kt();Ua()});async function gM8({ctx:$,orgId:Z,userId:X,entries:Q}){if(!Q||Q.length===0)return[];let Y=[];for(let G of Q)try{let{value:J}=await $.storage.secrets.resolveById(G.secretId,Z,X);Y.push({host:G.host,token:J})}catch(J){if(J instanceof K3||J instanceof uB){console.warn(`[SANDBOX_START] skipping submodule credential for ${G.host}: ${J.message}. Re-link or recreate the secret to restore.`);continue}throw J}return Y}var hM8=O(()=>{Kt()});async function lM8($,Z,X,Q,Y){let G=await EU({connectionId:$,tokenStorage:new _5(Q,Y)});if(!G.accessToken)return null;return mM8(Z,X,G.accessToken)}function dM8($,Z){return mM8($,Z,null)}async function mM8($,Z,X){let Q=new Map,Y=new Set(uM8.map((W)=>W.path));for(let W of Object.values(cM8))for(let H of W??[])Y.add(H);await Promise.all(Array.from(Y).map(async(W)=>{Q.set(W,await zh4($,Z,W,X))}));let G=uM8.find(({path:W})=>Q.get(W)!==null);if(!G)return null;let J=cM8[G.pm]??[],K=null;for(let W of J)if(K=jh4(Q.get(W)??null),K)break;return{packageManager:G.pm,devPort:K}}async function zh4($,Z,X,Q){let Y=`https://api.github.com/repos/${$}/${Z}/contents/${encodeURIComponent(X)}`;try{let G={Accept:"application/vnd.github+json","User-Agent":"studio-runtime-detect"};if(Q)G.Authorization=`token ${Q}`;let J=await fetch(Y,{headers:G,signal:AbortSignal.timeout(5000)});if(!J.ok)return null;let K=await J.json();if(!K.content||K.encoding!=="base64")return null;return Buffer.from(K.content,"base64").toString("utf8")}catch{return null}}function jh4($){if(!$)return null;try{let Z=JSON.parse($),X=Z.tasks??Z.scripts??{};return(X.dev??X.start??"").match(Eh4)?.[1]??null}catch{return null}}var uM8,cM8,Eh4;var iM8=O(()=>{KO();eJ();uM8=[{path:"deno.json",pm:"deno"},{path:"deno.jsonc",pm:"deno"},{path:"bun.lock",pm:"bun"},{path:"bunfig.toml",pm:"bun"},{path:"pnpm-lock.yaml",pm:"pnpm"},{path:"yarn.lock",pm:"yarn"},{path:"package-lock.json",pm:"npm"},{path:"package.json",pm:"bun"}],cM8={deno:["deno.json","deno.jsonc"],bun:["package.json"],pnpm:["package.json"],yarn:["package.json"],npm:["package.json"]},Eh4=/(?:--port|PORT=|:)(\d{4,5})/});function Ph4($){return($??"").normalize("NFKD").replace(/[\u0300-\u036F]/g,"").toLowerCase().replace(/[^a-z0-9]+/g,"-").replace(/^-+|-+$/g,"")||"user"}function Sj0($){return $?.name||$?.email?.split("@")[0]||void 0}function Cj0($){let Z=Ph4($),X=Date.now().toString(36).split("").reverse().join("");return`${Z}-${X}`}function nM8($){let{current:Z,detached:X,base:Q}=$.status??{};if(typeof Z!=="string"||Z.length===0)return null;if(X===!0)return null;if(Z===$.requestedRef)return null;if(Ah4.has(Z))return null;if(typeof Q==="string"&&Q.length>0&&Z===Q)return null;return Z}function pM8($){if(!$.branch.startsWith("thread:"))return $.branch;if($.sticky&&$.recordedHeadRef)return $.recordedHeadRef;return $.derivedRef}var Ah4;var _51=O(()=>{Ah4=new Set(["main","master","trunk","develop","HEAD"])});async function tM8($,Z){if(!$)return{hosts:[],allowSameHostDev:!1};let X;try{X=await $.presignedGetUrl("link-dispatch/_allowlist_probe",60,{requireFetchable:!0})}catch{return{hosts:[],allowSameHostDev:!1}}let Q;try{Q=new URL(X)}catch{return{hosts:[],allowSameHostDev:!1}}if(Q.protocol!=="https:"&&Q.protocol!=="http:")return{hosts:[],allowSameHostDev:!1};let Y=Q.hostname,G=Th4.has(Y);return{hosts:[Y],allowSameHostDev:G&&!Z.isProduction}}var Th4;var oM8=O(()=>{Th4=new Set(["127.0.0.1","localhost","::1","[::1]","0.0.0.0"])});import{z as BH}from"zod";async function ph($,Z){N0(Z);let X=J0(Z),Q=z1(Z);if(!Q)throw Error("User ID required");let Y=await Z.storage.virtualMcps.findById($.virtualMcpId);if(!Y||Y.organization_id!==X.id)throw Error("Virtual MCP not found");let G=Y.metadata??{},J=await hU(Z,$.branch,Q),K=WH(n5(G),J,$.branch,$.sandboxProviderKind),W=$.sandboxProviderKind,{provider:H}=await UQ(Z,{userId:J,branch:$.branch,virtualMcpMetadata:G,explicitKind:W});if(K){if(W!=="user-desktop")return K;if(await H.alive(K.sandboxHandle).catch(()=>!1))return K;await TO(Z.storage.virtualMcps,$.virtualMcpId,Q,J,$.branch,W).catch((B)=>{console.warn("[ensureSandbox] failed to reap stale user-desktop entry",B)})}let U=await hO(Z,gO($.branch)??Z.metadata?.threadId)??G.githubRepo??null,{entry:F}=await aM8({ctx:Z,userId:Q,sandboxUserId:J,orgId:X.id,virtualMcpId:$.virtualMcpId,branch:$.branch,metadata:G,githubRepo:U,existing:null,providerKind:W,runner:H,...$.cloneOnly?{cloneOnly:!0}:{}});return F}async function aM8($){let{ctx:Z,userId:X,sandboxUserId:Q,orgId:Y,virtualMcpId:G,branch:J,metadata:K,githubRepo:W,existing:H,runner:N,cloneOnly:U}=$,{runtime:F,packageManager:w,port:B,packageManagerPath:L}=bM8(K),D;if(W){if(W.connectionId)await Sh({ctx:Z,connectionId:W.connectionId,organizationId:Y,forceRefresh:!0,onLegacyMintError:(p0)=>{console.error("[provisionSandbox] repo-scoped legacy token mint failed",{connectionId:W.connectionId,error:p0.message})}});let{cloneUrl:R0,gitUserName:$0,gitUserEmail:s}=W.connectionId?await RO(W.connectionId,W.owner,W.name,Z.db,Z.vault):UP8(W.owner,W.name);if(!w){let p0=W.connectionId?await lM8(W.connectionId,W.owner,W.name,Z.db,Z.vault):await dM8(W.owner,W.name);if(p0)w=p0.packageManager,F=Ha[p0.packageManager].runtime,B=p0.devPort??B,await Ih4(Z,G,X,p0.packageManager,p0.devPort)}let A0=Z1().sandboxStickyHeadRefEnabled,Q0=pM8({branch:J,derivedRef:gU(J),recordedHeadRef:A0?await VM8(Z,gO(J)):null,sticky:A0}),I0=await gM8({ctx:Z,orgId:Y,userId:X,entries:xM8(K)});D={cloneUrl:R0,...W.connectionId?{connectionId:W.connectionId}:{},userName:$0,userEmail:s,branch:Q0,displayName:`${W.owner}/${W.name}`,...I0.length>0?{submoduleCredentials:I0}:{}}}let E=typeof K.productionUrl==="string"&&K.productionUrl.trim()?K.productionUrl.trim():void 0,z=F&&w&&!U?{runtime:F,packageManager:w,...B!==null?{devPort:Number(B)}:{},...L?{packageManagerPath:L}:{},...E?{productionUrl:E}:{}}:void 0,j=Cr({orgId:Y,virtualMcpId:G,branch:J}),A=N.kind==="user-desktop"?await tM8(Z.objectStorage,{isProduction:Z1().nodeEnv==="production"}):null,P=(N.kind==="user-desktop"||N.kind==="agent-sandbox")&&!Z1().orgFsMountsDisabled,q;if(P){let R0=Z.organization?.slug??(await Z.db.selectFrom("organization").select(["slug"]).where("id","=",Y).executeTakeFirst())?.slug;if(R0)q=await jB8(Z,{orgSlug:R0,orgId:Y,baseUrl:kQ()})}await Mh4(N);let k=await N.ensure({userId:Q,projectRef:j},{branch:J,repo:D,workload:z,cloneOnly:U===!0,tenant:{orgId:Y,userId:Q,...Z.organization?.slug?{orgSlug:Z.organization.slug}:{},...Z.organization?.name?{orgName:Z.organization.name}:{},...Z.auth.user?.email?{userEmail:Z.auth.user.email}:{},...Z.auth.user?.name?{userName:Z.auth.user.name}:{}},...A?{offloadAllowedHosts:A.hosts,offloadAllowSameHostDev:A.allowSameHostDev}:{},...q?{orgFsConfigJson:q}:{}}),M=K.runtime?.env??null;await Vj0({ctx:Z,runner:N,handle:k.handle,orgId:Y,userId:X,entries:M});let d=!!H&&H.sandboxHandle===k.handle&&H?.createdAt?H.createdAt:Date.now(),v=K.runtime?.selected??null,b=K.runtime?.port??null,t=K.runtime?.path??null,y={sandboxHandle:k.handle,previewUrl:k.previewUrl,sandboxApiUrl:k.previewUrl,sandboxProviderKind:N.kind,createdAt:d,startedWith:{packageManager:v,port:b,path:t}};await ZP8(Z.storage.virtualMcps,G,X,Q,J,$.providerKind,y);let Z0=gO(J);if(Z0)await _M8(Z,Z0,Q,J,$.providerKind,y);let D0=!H||H.sandboxHandle!==k.handle;return{entry:y,isNewVm:D0}}async function Ih4($,Z,X,Q,Y){let G=await $.storage.virtualMcps.findById(Z);if(!G)return;let J=G.metadata??{};await $.storage.virtualMcps.update(Z,X,{metadata:{...J,runtime:{selected:Q,port:Y}}})}async function Mh4($){if(!$.hasSchedulableCapacity)return;let Z=Date.now()+rM8,X=!1;while(!await $.hasSchedulableCapacity()){if(Date.now()>=Z)throw Error(`sandbox provisioning failed: the cluster has had no room to schedule another sandbox for ${Math.round(rM8/1000)}s`);if(!X)X=!0,console.warn("[ensureSandbox] waiting for cluster capacity \u2014 a sandbox pod cannot be scheduled right now");await _8(qh4)}}var Rh4,v51,rM8=150000,qh4=5000;var Fa=O(()=>{SU();H$();t0();Na();C51();hM8();KY();br();iM8();k51();yO();LK();_51();oM8();b8();YZ();no();KY();Rh4=BH.enum(["agent-sandbox","user-desktop","cluster"]),v51=o({name:"SANDBOX_START",description:"Start a sandbox with the connected GitHub repo and dev server.",annotations:{title:"Start VM Preview",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!1,openWorldHint:!0},_meta:{ui:{visibility:"app"}},inputSchema:BH.object({virtualMcpId:BH.string().describe("Virtual MCP ID"),branch:BH.string().min(1).optional().describe("Git branch to check out. Pass the thread's branch whenever the caller has one: when omitted the handler mints a fresh `<user-slug>-<timestamp>` name, which becomes a SEPARATE sandbox from the one the thread's own branch resolves to. The resolved branch is returned in the response so callers can persist it."),sandboxProviderKind:Rh4.optional().describe("Explicit runtime choice. Hosted provider is `agent-sandbox`; legacy `cluster` input is accepted only for compatibility and normalized to `agent-sandbox`. When omitted, defaults to `user-desktop` if the acting user's link daemon is online, else the env kind.")}),outputSchema:BH.object({previewUrl:BH.string().nullable(),sandboxHandle:BH.string(),branch:BH.string(),isNewVm:BH.boolean(),sandboxProviderKind:BH.enum(["agent-sandbox","user-desktop"])}),handler:async($,Z)=>{N0(Z);let X=J0(Z);await Z.access.check();let Q=$.branch??Cj0(Sj0(Z.auth.user)),Y=z1(Z);if(!Y)throw Error("User ID required");let G=await hU(Z,Q,Y),J=await Z.storage.virtualMcps.findById($.virtualMcpId);if(!J||J.organization_id!==X.id)throw Error("Virtual MCP not found");let K=J.metadata??{},W=$.sandboxProviderKind?Kj($.sandboxProviderKind):void 0,{provider:H,kind:N}=await UQ(Z,{userId:G,branch:Q,virtualMcpMetadata:K,explicitKind:W}),U=WH(n5(K),G,Q,N),w=await hO(Z,gO(Q)??Z.metadata?.threadId)??K.githubRepo??null,{entry:B,isNewVm:L}=await aM8({ctx:Z,userId:Y,sandboxUserId:G,orgId:X.id,virtualMcpId:$.virtualMcpId,branch:Q,metadata:K,githubRepo:w,existing:U,providerKind:N,runner:H});return{...B,branch:Q,isNewVm:L,sandboxProviderKind:N}}})});function kh4($){let{publicUrl:Z,agentId:X,organization:Q,target:Y,threadId:G}=$;if(Y==="agent-tools")return`${Z}/mcp/virtual-mcp/${X}`;if(!Q.slug)throw new eM8(Q.id);if(Y==="task-run"){if(!G)throw Error("a task-run MCP endpoint is scoped to a run: threadId is required");return`${Z}/api/${Q.slug}/mcp/task-run/${encodeURIComponent(G)}`}return`${Z}/api/${Q.slug}/mcp/self`}async function _j0($,Z,X,Q,Y="agent-tools",G){let J=kh4({publicUrl:kQ(),agentId:Z,organization:X,target:Y,...G?{threadId:G}:{}}),K=await $.boundAuth.apiKey.create({name:Q,permissions:{"*":["*"]},expiresIn:sM8,metadata:{organization:{id:X.id,slug:X.slug,name:X.name}}});return{url:J,headers:{Authorization:`Bearer ${K.key}`,"x-org-id":X.id},expiresAt:Date.now()+sM8*1000}}var sM8=3600,eM8;var x51=O(()=>{YZ();eM8=class eM8 extends Error{constructor($){super(`cannot mint a management MCP endpoint for organization "${$}": the org-scoped path /api/<slug>/mcp/self needs the org slug, which was not loaded.`);this.name="MissingOrganizationSlugError"}}});async function Vh4($,Z,X,Q){try{let Y=$.organization;if(!Y)return;let G=await _j0($,Q.virtualMcpId,Y,"tool-scripting"),J=await Z.proxyDaemonRequest(X,"/_sandbox/tools/sync",{method:"POST",headers:new Headers({"content-type":"application/json"}),body:JSON.stringify(G)});if(!J.ok)console.warn("[cluster-sandbox-fs] tools/sync failed",J.status,await J.text().catch(()=>""))}catch(Y){console.warn("[cluster-sandbox-fs] tools/sync failed",Y)}}async function th($,Z){let{provider:X,kind:Q}=await UQ($,{userId:Z.userId,branch:Z.branch,virtualMcpMetadata:null}),Y=null,G=()=>{if(!Y){if(Y=ph({virtualMcpId:Z.virtualMcpId,branch:Z.branch,sandboxProviderKind:Q},$).then((W)=>W.sandboxHandle),Y.catch(()=>{Y=null}),Z.syncTools)Y.then((W)=>Vh4($,X,W,{virtualMcpId:Z.virtualMcpId,providerKind:Q})).catch(()=>{})}return Y},J=Z.branch==="ephemeral"||Q==="user-desktop";return H41(X,{ensureHandle:G,invalidateHandle:async(W)=>{let H=Y;if(Y=null,!J&&!W?.force)return;try{await TO($.storage.virtualMcps,Z.virtualMcpId,Z.userId,Z.userId,Z.branch,Q)}catch(N){console.warn("[cluster-sandbox-fs] failed to reap vmMap entry",N)}if(H&&typeof X.forgetHandle==="function")try{let N=await H;await X.forgetHandle(N)}catch(N){console.warn("[cluster-sandbox-fs] forgetHandle failed",N)}},canAutoRestart:J})}async function $k8($,Z){try{let X=await th($,Z),{stdout:Q}=await X.onBash("test -d .deco && echo __DECO_SITE__");return Q.includes("__DECO_SITE__")}catch(X){return console.warn("[cluster-sandbox-fs] .deco probe failed; assuming deco site",X),!0}}var vj0=O(()=>{SU();x51();yO();Fa();KY()});import{z as Zk8}from"zod";function oh($){let Z=[];for(let X of $){if(X.status!=="active")continue;let Q=YQ(X);if(!Q)continue;Z.push({connectionId:X.id,owner:Q.owner,repo:Q.repo,installationId:Q.installationId})}return Z}async function Ch4($,Z){let{items:X}=await $.storage.connections.list(Z,{slug:"mcp-github"});return oh(X)}function _h4($){let Z=$.split(`
+`))>=0){let W=Q.slice(0,K).trim();if(Q=Q.slice(K+1),!W)continue;yield JSON.parse(W)}}let Y=Q.trim();if(Y)yield JSON.parse(Y)}finally{Z.releaseLock()}}var yq8,K51,cq8="gateway.networking.k8s.io",lq8="v1",dq8="httproutes",Wg4,Ya,iq8="mesh-sandbox-runner";var Ga=O(()=>{H$();Xa();yq8=class yq8 extends Error{status;body;constructor($,Z,X){super(X);this.status=$;this.body=Z;this.name="KubeHttpError"}};K51=`/apis/${v9.CLAIM_API_GROUP}/${v9.CLAIM_API_VERSION}/namespaces`;Wg4=`/apis/${cq8}/${lq8}/namespaces`;Ya={API_GROUP:cq8,API_VERSION:lq8,PLURAL:dq8}});function Ng4($){return($.items??[]).some((Z)=>{if(Z.status?.phase!=="Pending")return!1;return(Z.status?.conditions??[]).some((X)=>X.type==="PodScheduled"&&X.status==="False"&&X.reason==="Unschedulable")})}function tq8($,Z){let X=0,Q=!0,Y=null,G=async()=>{try{let J=await FK($,{method:"GET",path:`/api/v1/namespaces/${encodeURIComponent(Z)}/pods?fieldSelector=status.phase%3DPending`});if(!J.ok)return pq8;let K=await J.json();return!Ng4(K)}catch{return pq8}};return async()=>{if(Date.now()-X<Hg4)return Q;return Y??=G().finally(()=>{Y=null}),Q=await Y,X=Date.now(),Q}}var Hg4=3000,pq8=!0;var oq8=O(()=>{Ga()});var U51=O(()=>{H$();J41()});async function Rj0($){try{let Z=await fetch(`${$}/health`,{signal:AbortSignal.timeout(Ug4)});if(!Z.ok)return null;let X=await Z.json();if(typeof X==="object"&&X!==null&&typeof X.bootId==="string"&&typeof X.ready==="boolean"&&X.setup&&typeof X.setup.running==="boolean"&&typeof X.setup.done==="boolean")return X;return null}catch{return null}}async function w51($){for(let Z=0;Z<rq8;Z++){if(await Rj0($)!==null)return;let X=(Math.random()*2-1)*Fg4;await _8(aq8+X)}throw Error(`sandbox daemon at ${$} did not respond on /health within ${rq8*aq8/1000}s`)}async function y_($,Z,X,Q,Y){return wg4($,Z,"POST",X,Q,Y)}async function wg4($,Z,X,Q,Y,G){let J={...Q};if(Y&&Y.rotateToken!==void 0)J.auth=Y;let K=await fetch(`${$}/_sandbox/config`,{method:X,headers:{"Content-Type":"application/json",Authorization:`Bearer ${Z}`},body:JSON.stringify(J),signal:AbortSignal.timeout(G?.timeoutMs??F51)}),W=await K.text();if(!K.ok)throw new Tj0(K.status,W);return JSON.parse(W)}async function sq8($,Z,X){let Q=await fetch(`${$}/_sandbox/setup/${X}`,{method:"POST",headers:{Authorization:`Bearer ${Z}`},signal:AbortSignal.timeout(F51)});if(!Q.ok)throw Error(`sandbox daemon /_sandbox/setup/${X} returned ${Q.status}: ${await Q.text()}`)}async function eq8($,Z,X){let Q=await fetch(`${$}/_sandbox/orgfs-config`,{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${Z}`},body:X,signal:AbortSignal.timeout(F51)}),Y=await Q.text();if(!Q.ok)throw Error(`sandbox daemon /_sandbox/orgfs-config returned ${Q.status}: ${Y}`);return JSON.parse(Y)}async function Ja($,Z,X,Q){let Y=new Headers(Q.headers);for(let K of Bg4)Y.delete(K);Y.set("authorization",`Bearer ${Z}`);let G=Q.method!=="GET"&&Q.method!=="HEAD",J=`${$}${X.startsWith("/")?X:`/${X}`}`;return fetch(J,{method:Q.method,headers:Y,body:G?Q.body:void 0,redirect:"manual",signal:Q.signal,duplex:G?"half":void 0})}var Tj0,Ug4=500,F51=30000,rq8=25,aq8=200,Fg4=50,Bg4;var $M8=O(()=>{U51();Tj0=class Tj0 extends Error{status;constructor($,Z){super(`sandbox daemon /_sandbox/config returned ${$}: ${Z}`);this.status=$;this.name="ConfigRequestError"}};Bg4=["cookie","host","connection","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","accept-encoding","content-length"]});async function*QM8($){let Z=$.now??(()=>Date.now()),X=Z(),Q=$.schedulingTimeoutMs??Dg4,Y={pod:{},sandbox:{},events:{hasPulling:!1,hasPulled:!1},startedAt:X},G=[],J=null,K=!1,W=(z)=>{if(K)return;if(J){let j=J;J=null,j(z)}else G.push(z)},H=()=>{if(G.length>0)return Promise.resolve(G.shift());if(K)return Promise.resolve(null);return new Promise((z)=>{J=z})},N=()=>{if(K)return;if(K=!0,J){let z=J;J=null,z(null)}},U=new AbortController,F=()=>{U.abort(),N()};if($.signal)if($.signal.aborted)U.abort(),N();else $.signal.addEventListener("abort",F,{once:!0});let w=Math.max(0,Q-(Z()-X)),B=setTimeout(()=>W("tick"),w+100),L,D=new Promise((z)=>{L=z}),E=Promise.allSettled([Eg4($.kc,$.namespace,$.claimName,U.signal,Y,W,Z,L),jg4($.kc,$.namespace,$.claimName,U.signal,Y,W),Pg4($.kc,$.namespace,$.claimName,D,U.signal,Y,W,Z)]);try{let z=null,j=-1,A=ZM8(Y,Q,Z);if(z=O51(A),!B51(A))j=XM8(A);if(yield A,B51(A))return;while(!K){if(await H()===null)break;let q=ZM8(Y,Q,Z);if(B51(q)){let C=O51(q);if(C!==z)z=C,yield q;return}let k=XM8(q);if(k<j)continue;let M=O51(q);if(M!==z)z=M,j=k,yield q}}finally{if(clearTimeout(B),U.abort(),$.signal)$.signal.removeEventListener("abort",F);N(),await E.catch(()=>{})}}function ZM8($,Z,X){let{pod:Q,sandbox:Y,events:G,startedAt:J}=$;if(Y.ready)return{kind:"ready"};let K=Q.containerWaitingReason;if(K==="ImagePullBackOff"||K==="ErrImagePull")return{kind:"failed",reason:"image-pull-backoff",message:"Sandbox image failed to download. The cluster may be missing pull credentials or the image tag may not exist."};if(K==="CrashLoopBackOff")return{kind:"failed",reason:"crash-loop-backoff",message:"Sandbox crashed during startup and is now in CrashLoopBackOff. Check pod logs."};if(!Q.scheduled&&G.lastFailedSchedulingAt!==void 0&&X()-J>Z)return{kind:"failed",reason:"scheduling-timeout",message:G.failedSchedulingMessage??`Pod could not be scheduled within ${Math.round(Z/1000)}s.`};if(Q.containerRunning&&!Q.containerReady)return{kind:"warming-daemon",since:J};if(G.hasPulling&&!G.hasPulled)return{kind:"pulling-image",since:J};if(K==="ContainerCreating"||K==="PodInitializing"||Q.scheduled&&!Q.containerRunning)return{kind:"starting-container",since:J};if(Q.scheduledFalseReason==="Unschedulable"||G.lastFailedSchedulingAt!==void 0&&!Q.scheduled)return{kind:"waiting-for-capacity",since:J,message:G.failedSchedulingMessage??Q.scheduledFalseMessage,nodeClaim:G.nominatedNodeClaim};return{kind:"claiming",since:J}}function B51($){return $.kind==="ready"||$.kind==="failed"}function XM8($){switch($.kind){case"claiming":return 0;case"waiting-for-capacity":return 1;case"pulling-image":return 2;case"starting-container":return 3;case"warming-daemon":return 4;case"ready":case"failed":return 99}}function O51($){switch($.kind){case"claiming":case"pulling-image":case"starting-container":case"warming-daemon":return $.kind;case"waiting-for-capacity":return`waiting-for-capacity:${$.message??""}:${$.nodeClaim??""}`;case"ready":return"ready";case"failed":return`failed:${$.reason}:${$.message}`}}async function Eg4($,Z,X,Q,Y,G,J,K){let W=`/api/v1/namespaces/${encodeURIComponent(Z)}/pods?watch=true&labelSelector=${encodeURIComponent(`${Og4}=${X}`)}`;return Ij0({kc:$,path:W,signal:Q,label:`pod/${X}`,onEvent:(H)=>{if(H.type!=="ADDED"&&H.type!=="MODIFIED")return;let N=H.object;if(N.metadata?.name)K(N.metadata.name);zg4(N,Y,J),G("pod")}})}function zg4($,Z,X){let Y=($.status?.conditions??[]).find((J)=>J.type==="PodScheduled");if(Y?.status==="True")Z.pod.scheduled=!0,Z.pod.scheduledFalseReason=void 0,Z.pod.scheduledFalseMessage=void 0;else if(Y?.status==="False")Z.pod.scheduled=!1,Z.pod.scheduledFalseReason=Y.reason,Z.pod.scheduledFalseMessage=Y.message;let G=($.status?.containerStatuses??[]).find((J)=>J.name===Lg4);if(G)Z.pod.containerWaitingReason=G.state?.waiting?.reason,Z.pod.containerRunning=!!G.state?.running,Z.pod.containerReady=G.ready===!0}async function jg4($,Z,X,Q,Y,G){let J=`/apis/${v9.CLAIM_API_GROUP}/${v9.CLAIM_API_VERSION}/namespaces/${encodeURIComponent(Z)}/${v9.CLAIM_PLURAL}?watch=true&fieldSelector=${encodeURIComponent(`metadata.name=${X}`)}`;return Ij0({kc:$,path:J,signal:Q,label:`sandboxclaim/${X}`,onEvent:(K)=>{if(K.type!=="ADDED"&&K.type!=="MODIFIED")return;let H=K.object.status?.conditions?.find((N)=>N.type==="Ready");if(!H)return;if(H.status==="True")Y.sandbox.ready=!0,Y.sandbox.notReadyReason=void 0,Y.sandbox.notReadyMessage=void 0;else Y.sandbox.ready=!1,Y.sandbox.notReadyReason=H.reason,Y.sandbox.notReadyMessage=H.message;G("sandbox")}})}async function Pg4($,Z,X,Q,Y,G,J,K){let W=await Promise.race([Q,new Promise((N)=>{if(Y.aborted){N(X);return}Y.addEventListener("abort",()=>N(X),{once:!0})})]);if(Y.aborted)return;let H=`/api/v1/namespaces/${encodeURIComponent(Z)}/events?watch=true&fieldSelector=${encodeURIComponent(`involvedObject.name=${W},involvedObject.kind=Pod`)}`;return Ij0({kc:$,path:H,signal:Y,label:`events/${X}`,onEvent:(N)=>{if(N.type!=="ADDED"&&N.type!=="MODIFIED")return;let U=N.object,F=U.reason;if(!F)return;switch(F){case"Pulling":G.events.hasPulling=!0;break;case"Pulled":G.events.hasPulling=!0,G.events.hasPulled=!0;break;case"FailedScheduling":G.events.lastFailedSchedulingAt=K(),G.events.failedSchedulingMessage=U.message;break;case"Nominated":{let w=U.message?.match(/nodeclaim\/([\w-]+)/);if(w)G.events.nominatedNodeClaim=w[1];break}default:return}J("event")}})}async function YM8($){let{kc:Z,namespace:X,labelSelector:Q,signal:Y,onDelete:G}=$,J=`/apis/${v9.CLAIM_API_GROUP}/${v9.CLAIM_API_VERSION}/namespaces/${encodeURIComponent(X)}/${v9.CLAIM_PLURAL}?watch=true&labelSelector=${encodeURIComponent(Q)}`;return Ij0({kc:Z,path:J,signal:Y,label:"sandboxclaim-reaper",onEvent:(K)=>{if(K.type!=="DELETED")return;let W=K.object.metadata?.name;if(W)G(W)}})}async function Ij0($){let{kc:Z,path:X,signal:Q,label:Y,onEvent:G}=$,J=0;while(!Q.aborted){try{let W=await FK(Z,{method:"GET",path:X,signal:Q,headers:{accept:"application/json"},stream:!0});if(!W.ok||!W.body){try{await W.body?.cancel()}catch{}if(W.status===401||W.status===403){console.warn(`[lifecycle-watcher] ${Y} stopped: watch denied (${W.status} ${W.statusText}). `+"The kubeconfig in use cannot watch SandboxClaims \u2014 if you are running locally, "+"this provider should not be active (check STUDIO_SANDBOX_PROVIDER / your sandbox preference).");return}throw Error(`watch handshake failed: ${W.status} ${W.statusText}`)}J=0;for await(let H of N51(W.body)){if(Q.aborted)return;try{G(H)}catch(N){console.warn(`[lifecycle-watcher] ${Y} onEvent threw: ${N instanceof Error?N.message:String(N)}`)}}}catch(W){if(Q.aborted)return;let H=W instanceof Error?W.message:String(W);console.warn(`[lifecycle-watcher] ${Y} watch ended: ${H}`)}if(Q.aborted)return;let K=CX(5000,250,J,2,0);J+=1,await _8(K,{signal:Q}).catch(()=>{})}}var Og4="studio.decocms.com/sandbox-handle",Lg4="sandbox",Dg4=300000;var GM8=O(()=>{H$();Xa();Ga()});import{z as I3}from"zod";function JM8($){if(!$||$.trim()==="")return[];let Z=I3.array(Ag4).parse(JSON.parse($)),X=new Set;for(let Q of Z){if(X.has(Q.name))throw Error(`STUDIO_SANDBOX_TENANT_POOLS: duplicate pool name ${Q.name}`);X.add(Q.name)}return Z}function Tg4($){try{let[Z,X]=new URL($).pathname.replace(/^\/+/,"").split("/"),Q=X?.replace(/\.git$/,"");return Z&&Q?`${Z}/${Q}`.toLowerCase():null}catch{return null}}function KM8($,Z){let{orgId:X,cloneUrl:Q}=Z;if(Z.cloneOnly===!0)return null;if(!X||!Q)return null;let Y=Tg4(Q);if(!Y)return null;return $.find((G)=>G.orgId===X&&G.repo.toLowerCase()===Y)??null}function WM8($,Z,X){return $?.name??(Z?X:"none")}function HM8($,Z,X){let Q=X.replace(/^refs\/heads\//,"");return $.filter((Y)=>Y.repo.toLowerCase()===Z.toLowerCase()&&Y.branch===Q)}function NM8($){return`https://github.com/${$.repo}.git`}var Ag4;var L51=O(()=>{Ag4=I3.object({name:I3.string().regex(/^[a-z0-9]([-a-z0-9]*[a-z0-9])?$/,"pool name must be a DNS label (lowercase alphanumeric and '-')"),orgId:I3.string().min(1),repo:I3.string().regex(/^[^/\s]+\/[^/\s]+$/,"repo must be `owner/name`"),connectionId:I3.string().min(1).optional(),branch:I3.string().min(1).default("main"),workload:I3.object({runtime:I3.enum(["node","bun","deno"]).default("node"),packageManager:I3.enum(["npm","pnpm","yarn","bun","deno"]).optional(),packageManagerPath:I3.string().optional(),devPort:I3.number().int().positive().optional()}).default({runtime:"node"})})});async function UM8($,Z,X){let Q=new Map;for(let Y of $){let G=Z(Y);if(!G)continue;let J=Q.get(G);if(J)J.push(Y);else Q.set(G,[Y])}await Promise.allSettled([...Q.values()].map(async(Y)=>{for(let G of Y)await X(G).catch(()=>{})}))}import{createHash as Rg4,randomBytes as Ig4,randomUUID as qg4}from"crypto";import*as DM8 from"net";import{PassThrough as Mg4}from"stream";function kg4($){if($ instanceof Error)return $.message;if($&&typeof $==="object"){let Z=$;if(Z.error instanceof Error)return Z.error.message;if(typeof Z.message==="string"&&Z.message)return Z.message}return String($)}class A51{kind=wY;records=new Map;inflight=new r30;stateStore;previewUrlPattern;kubeConfig;capacityProbe;portForward;namespace;sandboxTemplateName;envName;tokenGenerator;idleTtlMs;metrics;previewGateway;sentinelToken;mintCloneUrl;tenantPools;tenantPoolRefreshMs;poolPods=new Map;dirtyPools=new Set;closed=!1;claimWatchAbort=new AbortController;constructor($={}){this.stateStore=$.stateStore??null,this.previewUrlPattern=$.previewUrlPattern??null,this.kubeConfig=$.kubeConfig??cg4(),this.portForward=new l$1(this.kubeConfig),this.namespace=$.namespace??Vg4,this.sandboxTemplateName=$.sandboxTemplateName??Sg4,this.envName=pg4($.envName),this.tokenGenerator=$.tokenGenerator??(()=>Ig4(Cg4).toString("hex")),this.idleTtlMs=$.idleTtlMs??vg4,this.metrics=$.meter?ug4($.meter):null,this.previewGateway=$.previewGateway&&$.previewUrlPattern?{...$.previewGateway}:null;let Z=$.sentinelToken?.trim()??"";if(this.sentinelToken=Z.length>0?Z:null,this.mintCloneUrl=$.mintCloneUrl,this.tenantPools=this.sentinelToken!==null?$.tenantPools??[]:[],this.sentinelToken===null&&($.tenantPools?.length??0)>0)console.warn(`[${r$}] tenant pools configured without a sentinel token \u2014 ignoring them (warm-pool mode is off)`);this.tenantPoolRefreshMs=$.tenantPoolRefreshMs??fg4,this.startClaimReaper(),this.startCredentialRefresher(),this.startTenantPoolReconciler()}startClaimReaper(){let $=["app.kubernetes.io/managed-by=studio","app.kubernetes.io/name=studio-sandbox",...this.envName?[`${BY.env}=${this.envName}`]:[]].join(",");YM8({kc:this.kubeConfig,namespace:this.namespace,labelSelector:$,signal:this.claimWatchAbort.signal,onDelete:(Z)=>this.invalidateRecord(Z)})}async ensure($,Z={}){let X=Wj($);if(X.startsWith("s-"))throw Error(`ensure: projectRef has no slug source: ${$.projectRef}`);return this.inflight.run(X,()=>a30(this.stateStore,$,wY,(Q)=>this.ensureLocked($,X,Z,Q)))}async delete($){let Z=await this.getRecord($);if(this.records.delete($),Z)this.closeForwarder(Z.daemonForward),this.metrics?.active.add(-1,j51(Z.tenant));if(await this.deleteHttpRouteIfManaged($).catch((X)=>{console.warn(`[${r$}] HTTPRoute delete failed for ${$}: ${X instanceof Error?X.message:String(X)}`)}),await fO(this.kubeConfig,this.namespace,$),this.stateStore)if(Z)await this.stateStore.delete(Z.id,wY);else await this.stateStore.deleteByHandle(wY,$)}async alive($){return await wK(this.kubeConfig,this.namespace,$)!==void 0}watchClaimLifecycle($,Z){return QM8({kc:this.kubeConfig,namespace:this.namespace,claimName:$,signal:Z})}hasSchedulableCapacity(){return this.capacityProbe??=tq8(this.kubeConfig,this.namespace),this.capacityProbe()}async getPreviewUrl($){let Z=await this.getRecord($);if(!Z)return null;return this.composePreviewUrl(Z)}async proxyDaemonRequest($,Z,X){let Q=await this.getRecord($);if(!Q&&this.previewUrlPattern&&this.stateStore){let W=await this.stateStore.getByHandle(wY,$),H=W?.state,N=H?.token;if(W&&N){let F=`http://${H?.adoptedSandboxName??$}.${this.namespace}.svc.cluster.local:${yU}`;try{let w=await Ja(F,N,Z,X);if(w.status!==404)return w;try{await w.body?.cancel()}catch{}}catch{}}}if(!Q)Q=await this.resurrectByHandle($);if(!Q)return new Response(JSON.stringify({error:"sandbox not found"}),{status:404,headers:{"content-type":"application/json"}});let Y=Q,G=performance.now(),J=0,K=!(X.body instanceof ReadableStream);try{let W=await Ja(Q.daemonUrl,Q.token,Z,X);if(W.status===401&&K){this.invalidateRecord($);let H=await this.getRecord($).catch(()=>null)??await this.resurrectByHandle($).catch(()=>null);if(H)Y=H,W=await Ja(H.daemonUrl,H.token,Z,X)}return J=W.status,W}catch(W){if(!K)throw W;this.invalidateRecord($);let H=await this.resurrectByHandle($)??await this.getRecord($).catch(()=>null);if(!H)throw W;Y=H;let N=await Ja(H.daemonUrl,H.token,Z,X);return J=N.status,N}finally{this.recordProxyDuration("daemon",J,Y,performance.now()-G)}}async adoptLiveClaim($,Z){if(this.records.has(Z))return!0;let X=await wK(this.kubeConfig,this.namespace,Z).catch(()=>{return});if(!X||X.metadata?.deletionTimestamp)return!1;return await this.inflight.run(Z,async()=>{let Y=this.records.get(Z);if(Y)return this.toSandbox(Y);let G=await this.adopt($,Z,X);if(!G)throw Error(`cannot adopt live claim ${Z}`);return a30(this.stateStore,$,wY,(J)=>this.finish(G,J,!0,!0,"adopt"))}).catch(()=>null)!=null}async resolvePreviewUpstreamUrl($){if(this.previewUrlPattern)return`http://${await this.resolveServiceNameForHandle($)}.${this.namespace}.svc.cluster.local:${yU}`;let Z=await this.getRecord($);if(Z)return Z.daemonUrl;let X=await this.resurrectByHandle($);return X?X.daemonUrl:null}async resolveServiceNameForHandle($){let Z=this.records.get($);if(Z)return Z.adoptedSandboxName;if(this.stateStore){let Q=(await this.stateStore.getByHandle(wY,$).catch(()=>null))?.state?.adoptedSandboxName;if(Q)return Q}return $}async proxyPreviewRequest($,Z){let X=performance.now(),Q=this.records.get($)??null,Y=0;try{let G=await this.resolvePreviewUpstreamUrl($);if(!G){Y=404;let B=E51(404,{error:"sandbox not found"});return B.headers.set(h_,"1"),B}let J=new URL(Z.url);if((J.pathname==="/_sandbox"||J.pathname.startsWith("/_sandbox/")||J.pathname==="/_decopilot_vm"||J.pathname.startsWith("/_decopilot_vm/"))&&Z.method!=="GET")return Y=404,E51(404,{error:"not found"});let W=(B)=>`${B}${J.pathname}${J.search}`,H=new Headers(Z.headers);for(let B of gg4)H.delete(B);let N=Z.method!=="GET"&&Z.method!=="HEAD",U={method:Z.method,headers:H,body:N?Z.body:void 0,redirect:"manual",signal:Z.signal,duplex:N?"half":void 0},F;try{F=await fetch(W(G),U)}catch(B){let L=`${G}${J.pathname}`;if(console.warn(`[${r$}] preview fetch to ${L} failed: ${B instanceof Error?B.message:String(B)}`),Z.method==="GET"||Z.method==="HEAD"){if(this.invalidateRecord($),await this.resurrectByHandle($).catch(()=>null)){let z=await this.resolvePreviewUpstreamUrl($);if(z)try{F=await fetch(W(z),U);let j=new Headers;for(let[A,P]of F.headers.entries())if(!BM8.includes(A.toLowerCase()))j.set(A,P);return Y=F.status,new Response(F.body,{status:F.status,statusText:F.statusText,headers:j})}catch(j){console.warn(`[${r$}] preview fetch retry to ${L} failed: ${j instanceof Error?j.message:String(j)}`)}}}else this.invalidateRecord($);Y=502;let D=E51(502,{error:"sandbox daemon unreachable"});return D.headers.set(h_,"1"),D}let w=new Headers;for(let[B,L]of F.headers.entries())if(!BM8.includes(B.toLowerCase()))w.set(B,L);return Y=F.status,new Response(F.body,{status:F.status,statusText:F.statusText,headers:w})}finally{this.recordProxyDuration("preview",Y,Q,performance.now()-X,$)}}async ensureLocked($,Z,X,Q){if(X.image)console.warn(`[${r$}] opts.image ignored (template ${this.sandboxTemplateName} pins image): got ${X.image}`);if(Q){let J=await Q.get($,wY);if(J){let K=await this.rehydrate($,Z,J);if(K)return await this.refreshDaemonGitCredential(K,X),this.finish(K,Q,!1,!0,"resume");await Q.delete($,wY)}}let Y=await wK(this.kubeConfig,this.namespace,Z).catch(()=>{return});if(Y)if(Y.metadata?.deletionTimestamp)await Ej0(this.kubeConfig,this.namespace,Z).catch((J)=>{console.warn(`[${r$}] wait for terminating claim ${Z} failed: ${J instanceof Error?J.message:String(J)}`)});else{let J=await this.adopt($,Z,Y).catch((K)=>{return console.warn(`[${r$}] adopt ${Z} failed, recreating: ${K instanceof Error?K.message:String(K)}`),null});if(J)return await this.refreshDaemonGitCredential(J,X),this.finish(J,Q,!0,!0,"adopt");await fO(this.kubeConfig,this.namespace,Z).catch(()=>{}),await Ej0(this.kubeConfig,this.namespace,Z).catch((K)=>{console.warn(`[${r$}] wait for deleted claim ${Z} failed: ${K instanceof Error?K.message:String(K)}`)})}let G=await this.provision($,Z,X);return this.finish(G,Q,!0,!1,"fresh")}async finish($,Z,X,Q,Y){let G=this.records.get($.handle),J=G!==void 0;if(G&&G.daemonForward!==$.daemonForward)this.closeForwarder(G.daemonForward);if(this.records.set($.handle,$),X)await this.persist(Z,$);if(Q)await zj0(this.kubeConfig,this.namespace,$.handle,this.computeShutdownTime()).catch((K)=>console.warn(`[${r$}] TTL refresh failed for ${$.handle}: ${K instanceof Error?K.message:String(K)}`));if(this.metrics){let K=j51($.tenant);if(this.metrics.ensureOutcome.add(1,{...K,outcome:Y}),!J)this.metrics.active.add(1,K)}return this.toSandbox($)}buildEnvMap($,Z){let X={},Q=[];for(let[Y,G]of Object.entries($.env??{}))if(_g4.has(Y))Q.push(Y);else X[Y]=G;if(Q.length>0)console.warn(`[${r$}] opts.env keys overlap reserved bootstrap names and were dropped: ${Q.join(",")}`);return{...X,DAEMON_TOKEN:Z.token,DAEMON_BOOT_ID:Z.daemonBootId,APP_ROOT:Z.workdir,PROXY_PORT:String(yU)}}buildClaim($,Z,X){let Q=this.sentinelToken!==null,Y=KM8(this.tenantPools,{orgId:Z.tenant?.orgId,cloneUrl:Z.repo?.cloneUrl,cloneOnly:Z.cloneOnly}),G=Q?[]:Object.entries(this.buildEnvMap(Z,X)).sort(([W],[H])=>W<H?-1:W>H?1:0).map(([W,H])=>({name:W,value:H})),J=rg4(Z),K=Object.keys(J).length>0;return{apiVersion:`${v9.CLAIM_API_GROUP}/${v9.CLAIM_API_VERSION}`,kind:"SandboxClaim",metadata:{name:$,namespace:this.namespace,labels:{"app.kubernetes.io/name":"studio-sandbox","app.kubernetes.io/managed-by":"studio",...this.envName?{[BY.env]:this.envName}:{},...z51(Z.tenant)},...K?{annotations:J}:{}},spec:{sandboxTemplateRef:{name:this.sandboxTemplateName},additionalPodMetadata:{labels:z51(Z.tenant,{[BY.role]:"claimed",[BY.sandboxHandle]:$,...this.envName?{[BY.env]:this.envName}:{}}),...K?{annotations:J}:{}},env:G,warmpool:WM8(Y,Q,this.sandboxTemplateName),lifecycle:{shutdownPolicy:"Delete",shutdownTime:this.computeShutdownTime()}}}}async provision($,Z,X){let Q=this.tokenGenerator(),Y=qg4(),G=D51,J=this.buildClaim(Z,X,{token:Q,daemonBootId:Y,workdir:G});try{await Qa(this.kubeConfig,this.namespace,J)}catch(F){if(F instanceof Za)await Ej0(this.kubeConfig,this.namespace,Z),await Qa(this.kubeConfig,this.namespace,J);else throw F}let K;try{K=await gq8(this.kubeConfig,this.namespace,Z),await Aj0(this.kubeConfig,this.namespace,K)}catch(F){throw await fO(this.kubeConfig,this.namespace,Z).catch(()=>{}),F}try{await this.ensureServicePortForAdoptedSandbox(K),await this.ensureHttpRouteForHandle(Z,K,X.tenant??null)}catch(F){throw await fO(this.kubeConfig,this.namespace,Z).catch(()=>{}),F}let W=await this.openForwarder(K,yU,Z),H=`http://127.0.0.1:${W.localPort}`,N=this.workloadConfigPayload(X),U=Y;try{if(await w51(H),this.sentinelToken!==null){let F=await Rj0(H);if(F)U=F.bootId;await y_(H,this.sentinelToken,N??{},{rotateToken:Q})}else if(N)await y_(H,Q,N);await this.relayOrgFsConfig(H,Q,X.orgFsConfigJson)}catch(F){throw this.closeForwarder(W),await this.deleteHttpRouteIfManaged(Z).catch(()=>{}),await fO(this.kubeConfig,this.namespace,Z).catch(()=>{}),F}return{id:$,handle:Z,adoptedSandboxName:K,token:Q,workdir:G,daemonUrl:H,daemonForward:W,workload:X.workload??null,daemonBootId:U,tenant:X.tenant??null,ensureOpts:$h4(X)}}workloadConfigPayload($){return e30({runtime:$?.workload?.runtime??"node",packageManager:$?.workload?.packageManager?{name:$.workload.packageManager,...$.workload.packageManagerPath?{path:$.workload.packageManagerPath}:{}}:null,repo:$?.repo??null,port:$?.workload?.devPort??FM8,tenant:$?.tenant??void 0,...$?{cloneOnly:$.cloneOnly===!0}:{}})}async relayOrgFsConfig($,Z,X){if(!X)return;await eq8($,Z,X).catch((Q)=>console.warn("[org-fs] sidecar config relay failed",Q))}async refreshDaemonGitCredential($,Z){let X=K41(Z);if(!X)return;try{await y_($.daemonUrl,$.token,X)}catch(Q){console.warn(`[${r$}] git credential refresh failed for ${$.handle}: ${Q instanceof Error?Q.message:String(Q)}`)}}async withFreshCloneUrl($,Z){if(!this.mintCloneUrl)return $;try{let X=await this.mintCloneUrl($,Z!==void 0?{bufferMs:Z}:void 0);return X?{...$,cloneUrl:X}:$}catch(X){return console.warn(`[${r$}] clone credential re-mint failed: ${X instanceof Error?X.message:String(X)}`),$}}startCredentialRefresher(){if(!this.mintCloneUrl)return;let{signal:$}=this.claimWatchAbort;(async()=>{while(!$.aborted){if(await _8(bg4,{signal:$}).catch(()=>{}),$.aborted)break;try{await this.refreshAllGitCredentials()}catch(Z){console.warn(`[${r$}] periodic credential refresh failed: ${Z instanceof Error?Z.message:String(Z)}`)}}})()}startTenantPoolReconciler(){if(this.tenantPools.length===0)return;let{signal:$}=this.claimWatchAbort;(async()=>{while(!$.aborted){try{await this.reconcileTenantPools()}catch(Z){console.warn(`[${r$}] tenant pool reconcile failed: ${Z instanceof Error?Z.message:String(Z)}`)}await _8(xg4,{signal:$}).catch(()=>{})}})()}markTenantPoolsDirty($,Z){let X=HM8(this.tenantPools,$,Z);for(let Q of X)this.dirtyPools.add(Q.name);return X.map((Q)=>Q.name)}async reconcileTenantPools(){for(let $ of this.tenantPools){let Z=await hq8(this.kubeConfig,this.namespace,$.name);if(Z===null){console.warn(`[${r$}] tenant pool ${$.name}: no SandboxWarmPool (or no selector yet) in ${this.namespace}`);continue}let X=this.dirtyPools.delete($.name),Q=Z.filter((Y)=>!Y.labels[BY.sandboxHandle]);for(let[Y]of this.poolPods)if(!Z.some((G)=>G.uid===Y))this.poolPods.delete(Y);for(let Y of Q){if(this.claimWatchAbort.signal.aborted)return;await this.warmPoolPod($,Y,X)}this.recordPoolDepth($,Z,Q)}}recordPoolDepth($,Z,X){let Q=this.metrics?.poolPods;if(!Q)return;let Y=0,G=0;for(let K of X){let W=this.poolPods.get(K.uid);if(!W)continue;if(W.failures>=qj0)G++;else if(W.lastConfigAt>0)Y++}let J={pool:$.name,org:$.orgId};Q.record(Y,{...J,state:"ready"}),Q.record(Z.length-X.length,{...J,state:"bound"}),Q.record(X.length-Y-G,{...J,state:"pending"}),Q.record(G,{...J,state:"failed"})}async warmPoolPod($,Z,X){let Q=this.poolPods.get(Z.uid);if(Q&&Q.failures>=qj0){if(Date.now()-Q.lastFailureAt<wM8)return;this.poolPods.set(Z.uid,{...Q,failures:0})}let Y=X||Q!==void 0&&Date.now()-Q.lastConfigAt>=this.tenantPoolRefreshMs;if(Q&&!Y)return;let G={cloneUrl:NM8($),connectionId:$.connectionId,branch:$.branch,userName:"",userEmail:""},J=await this.withFreshCloneUrl(G);if($.connectionId&&J.cloneUrl===G.cloneUrl){this.recordPoolFailure(Z,$,"clone credential mint failed");return}let K=await this.openForwarder(Z.name,yU,Z.name).catch(()=>null);if(!K){this.recordPoolFailure(Z,$,"port-forward failed");return}let W=`http://127.0.0.1:${K.localPort}`;try{await w51(W);let H=this.sentinelToken;if(!H)return;if(!await this.isPoolPodUnbound(Z))return;let N=e30({runtime:$.workload.runtime,packageManager:$.workload.packageManager?{name:$.workload.packageManager,...$.workload.packageManagerPath?{path:$.workload.packageManagerPath}:{}}:null,repo:J,port:$.workload.devPort??FM8})??{},{transition:U}=await y_(W,H,N);if(Y&&U!=="bootstrap"&&await this.isPoolPodUnbound(Z))await sq8(W,H,"clone");this.poolPods.set(Z.uid,{lastConfigAt:Date.now(),lastFailureAt:0,failures:0}),console.log(`[${r$}] tenant pool ${$.name}: warmed ${Z.name} (${U})`)}catch(H){this.recordPoolFailure(Z,$,H instanceof Error?H.message:String(H))}finally{this.closeForwarder(K)}}isPoolPodUnbound($){return uq8(this.kubeConfig,this.namespace,$.name,BY.sandboxHandle)}recordPoolFailure($,Z,X){let Q=this.poolPods.get($.uid),Y=(Q?.failures??0)+1;this.poolPods.set($.uid,{lastConfigAt:Q?.lastConfigAt??0,lastFailureAt:Date.now(),failures:Y});let G=Y>=qj0?` \u2014 backing off ${wM8/60000}min`:"";console.warn(`[${r$}] tenant pool ${Z.name}: warming ${$.name} failed (${Y}/${qj0})${G}: ${X}`)}async refreshAllGitCredentials(){await UM8(this.records.values(),($)=>$.ensureOpts?.repo?.connectionId,async($)=>{if(this.claimWatchAbort.signal.aborted)return;let Z=$.ensureOpts?.repo;if(!Z)return;let X=await this.withFreshCloneUrl(Z,yg4);await this.refreshDaemonGitCredential($,{...$.ensureOpts,repo:X}),$.ensureOpts={...$.ensureOpts,repo:X}})}async rebootstrapDaemon($,Z,X){if(this.sentinelToken===null)return!1;let Q=this.workloadConfigPayload(X)??{};try{return await y_($,this.sentinelToken,Q,{rotateToken:Z}),await this.relayOrgFsConfig($,Z,X?.orgFsConfigJson),!0}catch(Y){if(Y instanceof Tj0&&Y.status===401)try{return await y_($,Z,Q,{rotateToken:Z}),await this.relayOrgFsConfig($,Z,X?.orgFsConfigJson),!0}catch(G){return console.warn(`[${r$}] re-bootstrap retry with claim token failed: ${G instanceof Error?G.message:String(G)}`),!1}return console.warn(`[${r$}] re-bootstrap failed: ${Y instanceof Error?Y.message:String(Y)}`),!1}}async ensureServicePortForAdoptedSandbox($){if(!this.previewGateway||!this.previewUrlPattern)return;await nq8(this.kubeConfig,this.namespace,$,{name:"daemon",port:yU,targetPort:yU})}async ensureHttpRouteForHandle($,Z,X){if(!this.previewGateway||!this.previewUrlPattern)return;let Q=Zh4(this.previewUrlPattern,$);if(!Q)throw new p9(`Unable to derive preview hostname for ${$} from pattern: ${this.previewUrlPattern}`);let Y={apiVersion:`${Ya.API_GROUP}/${Ya.API_VERSION}`,kind:"HTTPRoute",metadata:{name:$,namespace:this.namespace,labels:z51(X??void 0,{[BY.role]:"claimed",[BY.sandboxHandle]:$,"app.kubernetes.io/name":"studio-sandbox","app.kubernetes.io/managed-by":"studio",...this.envName?{[BY.env]:this.envName}:{}})},spec:{parentRefs:[{kind:"Gateway",group:"gateway.networking.k8s.io",name:this.previewGateway.name,namespace:this.previewGateway.namespace}],hostnames:[Q],rules:[{backendRefs:[{group:"",kind:"Service",name:Z,port:yU}]}]}};await jj0(this.kubeConfig,this.namespace,Y)}async deleteHttpRouteIfManaged($){if(!this.previewGateway)return;await Pj0(this.kubeConfig,this.namespace,$)}async rehydrate($,Z,X){let Q=X.state;if(!Q.adoptedSandboxName&&!Q.podName||!Q.token)return null;let Y=await wK(this.kubeConfig,this.namespace,Z).catch(()=>{return});if(!Y||!OM8(Y))return null;let G=Y.status?.sandbox?.name??Q.adoptedSandboxName??Q.podName??Z,J=await this.openAndProbeDaemon(G,Z);if(!J)return null;if(Q.daemonBootId&&Q.daemonBootId!==J.bootId){if(this.sentinelToken!==null){let K=Q.ensureOpts?.repo?{...Q.ensureOpts,repo:await this.withFreshCloneUrl(Q.ensureOpts.repo)}:Q.ensureOpts??null;if(!await this.rebootstrapDaemon(J.daemonUrl,Q.token,K))return this.closeForwarder(J.daemonForward),null}else console.warn(`[${r$}] daemon restart detected (handle=${Z}): stored bootId=${Q.daemonBootId} live bootId=${J.bootId}`);await this.stateStore?.put($,wY,{handle:Z,state:{...Q,daemonBootId:J.bootId}}).catch((K)=>console.warn(`[${r$}] bootId persist failed for ${Z}: ${K instanceof Error?K.message:String(K)}`))}return{id:$,handle:Z,adoptedSandboxName:G,token:Q.token,workdir:Q.workdir??D51,daemonUrl:J.daemonUrl,daemonForward:J.daemonForward,workload:Q.workload??null,daemonBootId:J.bootId,tenant:Q.tenant??null,ensureOpts:Q.ensureOpts??null}}async adopt($,Z,X){if(!OM8(X))return null;let Q=X.status?.sandbox?.name??Z;if(this.sentinelToken!==null)return null;let Y=lg4(X);if(!Y)return null;let G=await this.openAndProbeDaemon(Q,Z);if(!G)return null;let J=ag4(X);if(this.previewGateway)await this.ensureServicePortForAdoptedSandbox(Q).catch((K)=>{console.warn(`[${r$}] Service port backfill failed for ${Z}: ${K instanceof Error?K.message:String(K)}`)}),await this.ensureHttpRouteForHandle(Z,Q,J).catch((K)=>{console.warn(`[${r$}] HTTPRoute backfill failed for ${Z}: ${K instanceof Error?K.message:String(K)}`)});return{id:$,handle:Z,adoptedSandboxName:Q,token:Y,workdir:D51,daemonUrl:G.daemonUrl,daemonForward:G.daemonForward,workload:null,daemonBootId:G.bootId,tenant:J,ensureOpts:null}}async openAndProbeDaemon($,Z){let X=await this.openForwarder($,yU,Z).catch(()=>null);if(!X)return null;let Q=`http://127.0.0.1:${X.localPort}`,Y=await Rj0(Q);if(!Y)return this.closeForwarder(X),null;return{daemonForward:X,daemonUrl:Q,bootId:Y.bootId}}async getRecord($){let Z=this.records.get($);if(Z)return Z;if(!this.stateStore)return null;let X=await this.stateStore.getByHandle(wY,$);if(!X)return null;let Q=await this.rehydrate(X.id,$,X);if(Q)this.records.set($,Q);return Q}async resurrectByHandle($){if(!this.stateStore)return null;let Z=await this.stateStore.getByHandle(wY,$);if(!Z)return null;let X=Z.state.ensureOpts;if(!X)return null;let Q=X.repo?{...X,repo:await this.withFreshCloneUrl(X.repo)}:X;if(Wj(Z.id)!==$)return null;return await this.ensure(Z.id,Q),this.records.get($)??null}invalidateRecord($){let Z=this.records.get($);if(!Z)return;this.records.delete($),this.closeForwarder(Z.daemonForward)}recordProxyDuration($,Z,X,Q,Y){if(!this.metrics)return;this.metrics.proxyDurationMs.record(Q,{...j51(X?.tenant??null),source:$,sandbox_handle:X?.handle??Y??"",status_code:Z||0})}composePreviewUrl($){if(this.previewUrlPattern)return s30(this.previewUrlPattern,$.handle);return`http://127.0.0.1:${$.daemonForward.localPort}/`}toSandbox($){return{handle:$.handle,workdir:$.workdir,previewUrl:this.composePreviewUrl($)}}async persist($,Z){if(!$)return;let X={adoptedSandboxName:Z.adoptedSandboxName,token:Z.token,workdir:Z.workdir,workload:Z.workload,daemonBootId:Z.daemonBootId,tenant:Z.tenant,...Z.ensureOpts?{ensureOpts:Z.ensureOpts}:{}};await $.put(Z.id,wY,{handle:Z.handle,state:X})}computeShutdownTime(){return new Date(Date.now()+this.idleTtlMs).toISOString()}async releaseAfter($,Z){let X=await wK(this.kubeConfig,this.namespace,$);if(!X)return;let Q=sg4(X.spec?.lifecycle?.shutdownTime,new Date(Date.now()+Z));if(!Q)return;await zj0(this.kubeConfig,this.namespace,$,Q).catch((Y)=>console.warn(`[${r$}] release failed for ${$}: ${Y instanceof Error?Y.message:String(Y)}`))}async renewTtl($){let Z=await wK(this.kubeConfig,this.namespace,$);if(!Z)return;let X=eg4(Z.spec?.lifecycle?.shutdownTime,new Date(Date.now()+this.idleTtlMs));if(!X)return;await zj0(this.kubeConfig,this.namespace,$,X).catch((Q)=>console.warn(`[${r$}] TTL renew failed for ${$}: ${Q instanceof Error?Q.message:String(Q)}`))}openForwarder($,Z,X=$){let Q=dg4(X,Z);return new Promise((Y,G)=>{let J=(K,W)=>{let H=DM8.createServer((N)=>this.handleForwardedConnection(N,$,Z,X));H.once("error",(N)=>{if(N.code==="EADDRINUSE"&&W<hg4){try{H.close()}catch{}let U=P51+(K-P51+1)%EM8;J(U,W+1);return}G(N)}),H.listen(K,"127.0.0.1",()=>{let N=H.address();if(!N||typeof N==="string"){H.close(),G(Error("port-forward listener failed to bind"));return}Y({server:H,localPort:N.port})})};J(Q,0)})}handleForwardedConnection($,Z,X,Q){let Y=new Mg4,G=null,J=!1,K=()=>{if(J)return;if(J=!0,Y.destroy(),G)try{G.close()}catch{}if(!$.destroyed)$.destroy()};$.pipe(Y),$.on("error",K),$.on("close",K),this.portForward.portForward(this.namespace,Z,[X],$,null,Y).then((W)=>{let H=typeof W==="function"?W():W;if(!H){K();return}if(G=H,G.on("close",K),G.on("error",()=>{this.invalidateRecord(Q),K()}),J)try{G.close()}catch{}}).catch((W)=>{console.warn(`[${r$}] port-forward to ${Z}:${X} failed: ${kg4(W)}`,JSON.stringify(zM8(W))),this.invalidateRecord(Q),K()})}closeForwarder($){$.server.close((Z)=>{if(Z)console.warn(`[${r$}] port-forward close on :${$.localPort} errored: ${Z instanceof Error?Z.message:String(Z)}`)})}close(){if(this.closed)return;this.closed=!0,this.claimWatchAbort.abort();for(let $ of this.records.values())this.closeForwarder($.daemonForward);this.records.clear()}}function ug4($){return{active:$.createUpDownCounter("studio.sandbox.active",{description:"Active sandbox count, by runner kind, owning org, and daemon impl. Cross-checks the cAdvisor-derived count from the cluster \u2014 divergence between the two indicates orphaned claims (studio deleted but K8s didn't reap) or unattributed pods.",unit:"{sandbox}"}),ensureOutcome:$.createCounter("studio.sandbox.ensure.outcome",{description:"Outcome of each ensure() call: fresh provision, resume from state-store after restart, or adopt of a cluster-side claim studio didn't know about. Cold-start ratio is the primary input for warm-pool sizing.",unit:"{call}"}),proxyDurationMs:$.createHistogram("studio.sandbox.proxy.duration_ms",{description:"Wall-clock latency of studio-mediated requests to the sandbox daemon: tool exec proxies (source=daemon) and preview iframe traffic (source=preview).",unit:"ms"}),poolPods:$.createGauge("studio.sandbox.pool.pods",{description:"Tenant warm pool depth by pool and state: ready (warmed and unbound \u2014 what a claim can actually bind instantly), bound (serving a user), pending (unbound, not yet warmed), failed (gave up after repeated bootstrap failures). Alert on sustained ready=0: a pool that is always empty is doing nothing while costing N pods.",unit:"{pod}"})}}function zM8($){let Z=[],X=$;for(let Q=0;Q<5&&X instanceof Error;Q++){let Y=X;if(Z.push({name:Y.name,message:Y.message,...Y.code!==void 0?{code:Y.code}:{},...Y.errno!==void 0?{errno:Y.errno}:{}}),Y.cause===X)break;X=Y.cause}if(X!==void 0&&!(X instanceof Error)&&X!==null){let Q=X,Y=Q.error instanceof Error?zM8(Q.error).chain:void 0;Z.push({nonError:String(X),...typeof Q.type==="string"?{type:Q.type}:{},...typeof Q.message==="string"?{message:Q.message}:{},...Q.code!==void 0?{code:Q.code}:{},...typeof Q.reason==="string"?{reason:Q.reason}:{},...Y?{error:Y}:{},...Y===void 0&&Q.error!==void 0?{rawError:String(Q.error)}:{},keys:Object.keys(Q)})}return{chain:Z}}function cg4(){let $=new ch;return $.loadFromDefault(),$}function OM8($){return Boolean($.status?.conditions?.some((Z)=>Z.type==="Ready"&&Z.status==="True"))}function lg4($){let Z=$.spec?.env;if(!Z)return null;for(let X of Z)if(X.name==="DAEMON_TOKEN"&&X.value)return X.value;return null}function dg4($,Z){let X=Rg4("sha256").update(`${$}:${Z}`).digest();return P51+X.readUInt32BE(0)%EM8}function E51($,Z){return new Response(JSON.stringify(Z),{status:$,headers:{"content-type":"application/json","access-control-allow-origin":"*"}})}function LM8($){let Z=$.slice(0,ig4);return mg4.test(Z)?Z:""}function pg4($){if($===void 0)return null;let Z=$.trim();if(Z==="")return null;if(!ng4.test(Z))throw Error(`AgentSandboxProvider: envName=${JSON.stringify(Z)} is not a valid DNS-label-safe environment name (lowercase alphanumeric or '-', starts with a letter, ends alphanumeric, \u226432 chars). Studio sets this from STUDIO_ENV; check the studio chart's configMap.`);return Z}function z51($,Z={}){let X={...Z};if($){let Q=LM8($.orgId),Y=LM8($.userId);if(Q)X[BY.orgId]=Q;if(Y)X[BY.userId]=Y}return X}function g_($){let Z="";for(let X of $){let Q=X.codePointAt(0)??0;Z+=Q<32||Q===127?" ":X}return Z.slice(0,tg4)}function og4($){try{let Z=new URL($);return Z.username="",Z.password="",Z.toString()}catch{return""}}function rg4($){let Z={},X=$.tenant;if(X?.orgSlug)Z[BK.orgSlug]=g_(X.orgSlug);if(X?.orgName)Z[BK.orgName]=g_(X.orgName);if(X?.userEmail)Z[BK.userEmail]=g_(X.userEmail);if(X?.userName)Z[BK.userName]=g_(X.userName);let Q=$.repo;if(Q){if(Q.displayName)Z[BK.gitRepo]=g_(Q.displayName);let Y=og4(Q.cloneUrl);if(Y)Z[BK.gitRepoUrl]=g_(Y);let G=$.branch??Q.branch;if(G)Z[BK.gitBranch]=g_(G)}return Z}function ag4($){let Z=$.metadata?.labels;if(!Z)return null;let X=Z[BY.orgId],Q=Z[BY.userId];if(!X||!Q)return null;let Y=$.metadata?.annotations??{};return{orgId:X,userId:Q,orgSlug:Y[BK.orgSlug],orgName:Y[BK.orgName],userEmail:Y[BK.userEmail],userName:Y[BK.userName]}}function sg4($,Z){if($){let X=new Date($).getTime();if(Number.isFinite(X)&&X<=Z.getTime())return null}return Z.toISOString()}function eg4($,Z){if($){let X=new Date($).getTime();if(Number.isFinite(X)&&X>=Z.getTime())return null}return Z.toISOString()}function j51($){return{org_id:$?.orgId??"",user_id:$?.userId??"",runner_kind:wY}}function $h4($){let Z={};if($.branch)Z.branch=$.branch;if($.repo)Z.repo=$.repo;if($.workload)Z.workload=$.workload;if($.env&&Object.keys($.env).length>0)Z.env=$.env;if($.tenant)Z.tenant=$.tenant;if($.orgFsConfigJson)Z.orgFsConfigJson=$.orgFsConfigJson;return Object.keys(Z).length>0?Z:null}function Zh4($,Z){try{return new URL(s30($,Z)).hostname||null}catch{return null}}var wY="agent-sandbox",r$="AgentSandboxProvider",h_="x-sandbox-preview-not-ready",Vg4="agent-sandbox-system",Sg4="studio-sandbox",yU=9000,FM8=3000,D51="/app",Cg4=32,_g4,vg4=900000,xg4=60000,fg4=1800000,qj0=3,wM8=1800000,bg4=900000,yg4=1800000,gg4,BM8,P51=40000,EM8=1e4,hg4=256,BY,BK,mg4,ig4=63,ng4,tg4=253;var jM8=O(()=>{H$();oq8();Y51();$M8();W41();Ga();Xa();GM8();L51();_g4=new Set(["DAEMON_TOKEN","DAEMON_BOOT_ID","APP_ROOT","PROXY_PORT"]),gg4=["cookie","host","connection","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","accept-encoding","content-length","upgrade"],BM8=["connection","keep-alive","transfer-encoding","content-encoding","content-length"];BY={role:"studio.decocms.com/role",sandboxHandle:"studio.decocms.com/sandbox-handle",orgId:"studio.decocms.com/org-id",userId:"studio.decocms.com/user-id",env:"studio.decocms.com/env"},BK={orgSlug:"studio.decocms.com/org-slug",orgName:"studio.decocms.com/org-name",userEmail:"studio.decocms.com/user-email",userName:"studio.decocms.com/user-name",gitRepo:"studio.decocms.com/git-repo",gitRepoUrl:"studio.decocms.com/git-repo-url",gitBranch:"studio.decocms.com/git-branch"},mg4=/^([A-Za-z0-9]([-A-Za-z0-9_.]*[A-Za-z0-9])?)?$/;ng4=/^[a-z]([a-z0-9-]{0,30}[a-z0-9])?$/});var PM8={};w0(PM8,{waitForSandboxReady:()=>Aj0,parseTenantPools:()=>JM8,getSandboxClaim:()=>wK,getHttpRoute:()=>mq8,deleteSandboxClaim:()=>fO,deleteHttpRoute:()=>Pj0,createSandboxClaim:()=>Qa,applyHttpRoute:()=>jj0,SandboxTimeoutError:()=>b_,SandboxError:()=>p9,PREVIEW_NOT_READY_HEADER:()=>h_,KubeConfig:()=>ch,K8S_CONSTANTS:()=>v9,HTTPROUTE_CONSTANTS:()=>Ya,AgentSandboxProvider:()=>A51});var T51=O(()=>{Y51();Xa();Ga();jM8();L51()});var MM8={};w0(MM8,{subscribeLifecycle:()=>M51,getSandboxProviderByKind:()=>I51,getOrInitSharedRunner:()=>q51,__resetSharedLifecyclesForTesting:()=>wh4});function IM8($,Z){let X=AM8[$];if(X)return Promise.resolve(X);let Q=R51[$];if(Q)return Q;let Y=Z().then((G)=>{return AM8[$]=G,G}).finally(()=>{delete R51[$]});return R51[$]=Y,Y}function Yh4(){let $=process.env.STUDIO_SANDBOX_PREVIEW_URL_PATTERN;return $&&$.trim()!==""?$:void 0}function Gh4(){let $=process.env.STUDIO_SANDBOX_TEMPLATE_NAME;return $&&$.trim()!==""?$:void 0}function Jh4(){let $=process.env.STUDIO_ENV;return $&&$.trim()!==""?$:void 0}function Kh4(){let $=process.env.STUDIO_SANDBOX_SENTINEL_TOKEN;return $&&$.trim()!==""?$:void 0}function Wh4(){let $=process.env.STUDIO_SANDBOX_PREVIEW_GATEWAY_NAME?.trim(),Z=process.env.STUDIO_SANDBOX_PREVIEW_GATEWAY_NAMESPACE?.trim();if(!$&&!Z)return;if(!$||!Z)throw Error("STUDIO_SANDBOX_PREVIEW_GATEWAY_NAME and STUDIO_SANDBOX_PREVIEW_GATEWAY_NAMESPACE must both be set, or both unset. Half-configured per-claim HTTPRoute routing would silently fail to attach.");return{name:$,namespace:Z}}async function qM8($,Z){let X=new fr(Z),Q=Yh4();switch($){case"agent-sandbox":{let{AgentSandboxProvider:Y,parseTenantPools:G}=await Promise.resolve().then(() => (T51(),PM8)),J=new iN(Z1().encryptionKey);return new Y({stateStore:X,previewUrlPattern:Q,sandboxTemplateName:Gh4(),envName:Jh4(),previewGateway:Wh4(),sentinelToken:Kh4(),tenantPools:G(process.env.STUDIO_SANDBOX_TENANT_POOLS),meter:D6,mintCloneUrl:async(K,W)=>{if(!K.connectionId)return null;let H=FP8(K.cloneUrl);if(!H)return null;let{cloneUrl:N}=await RO(K.connectionId,H.owner,H.name,Z,J,{bufferMs:W?.bufferMs});return N}})}case"user-desktop":throw Error("user-desktop provider cannot be instantiated without a per-run link claim \u2014 call resolveSandboxProvider, which binds the link before constructing the provider.");default:throw Error(`Unknown sandbox provider kind: ${String($)}`)}}function I51($,Z){return IM8(Z,()=>qM8(Z,$.db))}async function q51(){let $;try{$=Hj()}catch(X){return console.warn("[lifecycle] cannot resolve sandbox runner:",X instanceof Error?X.message:String(X)),null}return await IM8($,()=>qM8($,H6().db))}function M51($,Z,X){let Q=bO.get(Z);if(Q){if(Q.terminated){if(Q.lastPhase)try{X(Q.lastPhase)}catch{}return{unsubscribe:Uh4}}if(Q.listeners.add(X),Q.lastPhase)try{X(Q.lastPhase)}catch{}return TM8(Z,Q,X)}let Y=new AbortController,G={lastPhase:null,terminated:!1,listeners:new Set([X]),abort:Y};return bO.set(Z,G),Fh4($,Z,G),TM8(Z,G,X)}function Uh4(){}function TM8($,Z,X){return{unsubscribe(){if(bO.get($)!==Z)return;if(Z.listeners.delete(X),Z.listeners.size===0)bO.delete($),Z.abort.abort()}}}async function Fh4($,Z,X){let Q=null;try{for await(let Y of $.watchClaimLifecycle(Z,X.abort.signal)){if(X.abort.signal.aborted)break;X.lastPhase=Y;let G=Y.kind==="ready"||Y.kind==="failed";if(G)X.terminated=!0;let J=Array.from(X.listeners);for(let K of J)try{K(Y)}catch{}if(G)break}}catch(Y){Q=Y}finally{if(!X.terminated&&!X.abort.signal.aborted&&X.listeners.size>0){let Y={kind:"failed",reason:"unknown",message:Q instanceof Error?Q.message:"Lifecycle watcher ended unexpectedly"};X.lastPhase=Y,X.terminated=!0;for(let G of Array.from(X.listeners))try{G(Y)}catch{}}if(bO.get(Z)===X)bO.delete(Z)}}function wh4(){for(let $ of bO.values())$.abort.abort();bO.clear()}var Xh4,Qh4,RM8,AM8,R51,Hh4,Nh4,bO;var Ka=O(()=>{SU();n7();q5();U41();br();hi();b8();Xh4=Symbol.for("decocms.sandbox.lifecycle.runners"),Qh4=Symbol.for("decocms.sandbox.lifecycle.inflight"),RM8=globalThis,AM8=RM8[Xh4]??={},R51=RM8[Qh4]??={};Hh4=Symbol.for("decocms.sandbox.lifecycle.shared-lifecycles"),Nh4=globalThis,bO=Nh4[Hh4]??=new Map});async function UQ($,Z){let{userId:X,branch:Q,virtualMcpMetadata:Y,explicitKind:G}=Z;if(G)return Wa($,G);if($.sandboxPreference==="agent-sandbox")return Wa($,"agent-sandbox");if($.sandboxPreference==="cluster-default")return Wa($,Hj());let[J,...K]=Bh4(Y,X,Q);if(J)return Wa($,K.length===0?J:Oh4(J,K));return Wa($,kM8())}function Bh4($,Z,X){let Q=n5($)[Z]?.[X];if(!Q)return[];let Y=zJ(Q);return Object.keys(Y)}function Oh4($,Z){let X=kM8();if(X===$||Z.includes(X))return X;return $}function kM8(){return Hj()}async function Wa($,Z){let X=Z==="user-desktop"?"agent-sandbox":Z;return{provider:await I51($,X),kind:X}}var yO=O(()=>{R6();SU();KY();Ka()});var Ha;var k51=O(()=>{Ha={npm:{install:"npm install",run:($)=>`npm run ${$}`,runtime:"node"},pnpm:{install:"pnpm install",run:($)=>`pnpm run ${$}`,runtime:"node"},yarn:{install:"yarn install",run:($)=>`yarn run ${$}`,runtime:"node"},bun:{install:"bun install",run:($)=>`bun run ${$}`,runtime:"bun"},deno:{install:"deno install",run:($)=>`deno task ${$}`,runtime:"deno"}}});function OK($,Z){return Z?`thread:${$}/${Z}`:`thread:${$}`}function gU($){return`sandbox/thread-${$.replace(/^thread:/,"").replace(/\//g,"-")}`}function gO($){if(!$||!$.startsWith("thread:"))return null;return $.slice(7).split("/")[0]||null}async function hU($,Z,X){let Q=gO(Z);if(!Q)return X;return(await $.storage.threads.get(Q).catch(()=>null))?.created_by??X}async function u_($,Z){if(!Z)return null;let X=await $.storage.threads.get(Z).catch(()=>null);if(!X)return null;return X.metadata??{}}async function VM8($,Z){let Q=(await u_($,Z))?.headRef;return typeof Q==="string"&&Q.length>0?Q:null}async function SM8($,Z,X){let Q=await u_($,Z);if(!Q)return;if(Q.headRef===X)return;await $.storage.threads.update(Z,{metadata:{...Q,headRef:X}}).catch((Y)=>console.warn("[thread-repo] setThreadHeadRef failed",Y))}async function hO($,Z){return(await u_($,Z))?.githubRepo??null}function V51($){if($.pinnedRef)return $.pinnedRef;if($.runBranch&&$.runBranch===OK($.threadId))return $.runBranch;if($.threadRepo)return OK($.threadId,$.threadRepo.connectionId);if(!$.agentRepo)return"ephemeral";return $.runBranch??`thread:${$.threadId}`}async function S51($,Z){let Q=(await u_($,Z))?.pinnedRef;return typeof Q==="string"&&Q.length>0?Q:null}async function CM8($,Z){let[X,Q]=await Promise.all([hO($,Z.threadId),S51($,Z.threadId)]);return V51({...Z,threadRepo:X,pinnedRef:Q})}async function _M8($,Z,X,Q,Y,G){let J=await u_($,Z);if(!J)return;let K=xr(n5(J),X,Q,Y,G);await $.storage.threads.update(Z,{metadata:{...J,sandboxMap:K}}).catch((W)=>console.warn("[thread-repo] setThreadSandboxMapEntry failed",W))}async function Mj0($,Z){return n5(await u_($,Z))}async function vM8($,Z,X,Q,Y){let G=await u_($,Z);if(!G)return;let J=N41(n5(G),X,Q,Y);if(!J)return;await $.storage.threads.update(Z,{metadata:{...G,sandboxMap:J}}).catch((K)=>console.warn("[thread-repo] removeThreadSandboxMapEntry failed",K))}var LK=O(()=>{KY()});function kj0($){if(!$)return null;let Z=$.runtime;if(!Z||typeof Z!=="object")return null;let X=Z.env;if(!Array.isArray(X))return null;let Q=[];for(let Y of X){if(!Y||typeof Y!=="object")continue;let G=Y;if(typeof G.key!=="string"||!QZ0.test(G.key))continue;if(G.kind==="literal"&&typeof G.value==="string"){Q.push({key:G.key,kind:"literal",value:G.value});continue}if(G.kind==="secret"&&typeof G.secretId==="string"&&G.secretId.length>0)Q.push({key:G.key,kind:"secret",secretId:G.secretId})}return Q.length===0?null:Q}function xM8($){if(!$)return null;let Z=$.runtime;if(!Z||typeof Z!=="object")return null;let X=Z.submoduleCredentials;if(!Array.isArray(X))return null;let Q=[];for(let Y of X){if(!Y||typeof Y!=="object")continue;let G=Y;if(typeof G.host==="string"&&G.host.length>0&&typeof G.secretId==="string"&&G.secretId.length>0)Q.push({host:G.host,secretId:G.secretId})}return Q.length===0?null:Q}async function fM8($,Z){N0(Z);let X=J0(Z);await Z.access.check();let Q=z1(Z);if(!Q)throw Error("User ID required");let Y=await Z.storage.virtualMcps.findById($.virtualMcpId);if(!Y||Y.organization_id!==X.id)throw Error("Virtual MCP not found");let G=Y.metadata??{},J=n5(G),K=await hU(Z,$.branch,Q),W=WH(J,K,$.branch,$.sandboxProviderKind);return{virtualMcp:Y,metadata:G,userId:Q,sandboxUserId:K,entry:W,organization:X}}function Lh4($){if($===null||!/^\d+$/.test($))return null;let Z=Number($);return Z>=1&&Z<=65535?$:null}function bM8($){let Z=$.runtime??null,Q=Z?.selected??null,Y=Lh4(Z?.port??null),G=Z?.path??null;if(!Q||!(Q in Ha))return{packageManager:null,runtime:null,port:Y,packageManagerPath:G,runtimeBinPath:null};let J=Ha[Q].runtime;return{packageManager:Q,runtime:J,port:Y,packageManagerPath:G,runtimeBinPath:J==="deno"?"/opt/deno/bin":J==="bun"?"/opt/bun/bin":null}}var Na=O(()=>{R6();k51();KY();LK()});async function uO($,Z){let X=$.body?.getReader();if(!X)return $.text();let Q=new TextDecoder,Y="",G=0;for(;;){let{done:J,value:K}=await X.read();if(J)break;if(G+=K.byteLength,G>Z)throw await X.cancel().catch(()=>{}),new yM8(`Upstream response exceeded ${Z} bytes`);Y+=Q.decode(K,{stream:!0})}return Y+=Q.decode(),Y}var yM8;var Ua=O(()=>{yM8=class yM8 extends Error{}});async function Vj0({ctx:$,runner:Z,handle:X,orgId:Q,userId:Y,entries:G}){if(!G||G.length===0)return;let J={};for(let W of G){if(W.kind==="literal"){J[W.key]=W.value;continue}try{let{value:H}=await $.storage.secrets.resolveById(W.secretId,Q,Y);J[W.key]=H}catch(H){if(H instanceof K3||H instanceof uB){console.warn(`[SANDBOX_START] skipping env ${W.key}: ${H.message}. Re-link or recreate the secret to restore.`);continue}throw H}}if(Object.keys(J).length===0)return;let K=await Z.proxyDaemonRequest(X,"/_sandbox/config",{method:"PUT",headers:new Headers({"content-type":"application/json"}),body:JSON.stringify({env:J})});if(!K.ok){let W=await uO(K,Dh4).catch(()=>K.statusText);console.warn(`[SANDBOX_START] daemon rejected env patch (${K.status}): ${W}`)}}var Dh4=10485760;var C51=O(()=>{Kt();Ua()});async function gM8({ctx:$,orgId:Z,userId:X,entries:Q}){if(!Q||Q.length===0)return[];let Y=[];for(let G of Q)try{let{value:J}=await $.storage.secrets.resolveById(G.secretId,Z,X);Y.push({host:G.host,token:J})}catch(J){if(J instanceof K3||J instanceof uB){console.warn(`[SANDBOX_START] skipping submodule credential for ${G.host}: ${J.message}. Re-link or recreate the secret to restore.`);continue}throw J}return Y}var hM8=O(()=>{Kt()});async function lM8($,Z,X,Q,Y){let G=await EU({connectionId:$,tokenStorage:new _5(Q,Y)});if(!G.accessToken)return null;return mM8(Z,X,G.accessToken)}function dM8($,Z){return mM8($,Z,null)}async function mM8($,Z,X){let Q=new Map,Y=new Set(uM8.map((W)=>W.path));for(let W of Object.values(cM8))for(let H of W??[])Y.add(H);await Promise.all(Array.from(Y).map(async(W)=>{Q.set(W,await zh4($,Z,W,X))}));let G=uM8.find(({path:W})=>Q.get(W)!==null);if(!G)return null;let J=cM8[G.pm]??[],K=null;for(let W of J)if(K=jh4(Q.get(W)??null),K)break;return{packageManager:G.pm,devPort:K}}async function zh4($,Z,X,Q){let Y=`https://api.github.com/repos/${$}/${Z}/contents/${encodeURIComponent(X)}`;try{let G={Accept:"application/vnd.github+json","User-Agent":"studio-runtime-detect"};if(Q)G.Authorization=`token ${Q}`;let J=await fetch(Y,{headers:G,signal:AbortSignal.timeout(5000)});if(!J.ok)return null;let K=await J.json();if(!K.content||K.encoding!=="base64")return null;return Buffer.from(K.content,"base64").toString("utf8")}catch{return null}}function jh4($){if(!$)return null;try{let Z=JSON.parse($),X=Z.tasks??Z.scripts??{};return(X.dev??X.start??"").match(Eh4)?.[1]??null}catch{return null}}var uM8,cM8,Eh4;var iM8=O(()=>{KO();eJ();uM8=[{path:"deno.json",pm:"deno"},{path:"deno.jsonc",pm:"deno"},{path:"bun.lock",pm:"bun"},{path:"bunfig.toml",pm:"bun"},{path:"pnpm-lock.yaml",pm:"pnpm"},{path:"yarn.lock",pm:"yarn"},{path:"package-lock.json",pm:"npm"},{path:"package.json",pm:"bun"}],cM8={deno:["deno.json","deno.jsonc"],bun:["package.json"],pnpm:["package.json"],yarn:["package.json"],npm:["package.json"]},Eh4=/(?:--port|PORT=|:)(\d{4,5})/});function Ph4($){return($??"").normalize("NFKD").replace(/[\u0300-\u036F]/g,"").toLowerCase().replace(/[^a-z0-9]+/g,"-").replace(/^-+|-+$/g,"")||"user"}function Sj0($){return $?.name||$?.email?.split("@")[0]||void 0}function Cj0($){let Z=Ph4($),X=Date.now().toString(36).split("").reverse().join("");return`${Z}-${X}`}function nM8($){let{current:Z,detached:X,base:Q}=$.status??{};if(typeof Z!=="string"||Z.length===0)return null;if(X===!0)return null;if(Z===$.requestedRef)return null;if(Ah4.has(Z))return null;if(typeof Q==="string"&&Q.length>0&&Z===Q)return null;return Z}function pM8($){if(!$.branch.startsWith("thread:"))return $.branch;if($.sticky&&$.recordedHeadRef)return $.recordedHeadRef;return $.derivedRef}var Ah4;var _51=O(()=>{Ah4=new Set(["main","master","trunk","develop","HEAD"])});async function tM8($,Z){if(!$)return{hosts:[],allowSameHostDev:!1};let X;try{X=await $.presignedGetUrl("link-dispatch/_allowlist_probe",60,{requireFetchable:!0})}catch{return{hosts:[],allowSameHostDev:!1}}let Q;try{Q=new URL(X)}catch{return{hosts:[],allowSameHostDev:!1}}if(Q.protocol!=="https:"&&Q.protocol!=="http:")return{hosts:[],allowSameHostDev:!1};let Y=Q.hostname,G=Th4.has(Y);return{hosts:[Y],allowSameHostDev:G&&!Z.isProduction}}var Th4;var oM8=O(()=>{Th4=new Set(["127.0.0.1","localhost","::1","[::1]","0.0.0.0"])});import{z as BH}from"zod";async function ph($,Z){N0(Z);let X=J0(Z),Q=z1(Z);if(!Q)throw Error("User ID required");let Y=await Z.storage.virtualMcps.findById($.virtualMcpId);if(!Y||Y.organization_id!==X.id)throw Error("Virtual MCP not found");let G=Y.metadata??{},J=await hU(Z,$.branch,Q),K=WH(n5(G),J,$.branch,$.sandboxProviderKind),W=$.sandboxProviderKind,{provider:H}=await UQ(Z,{userId:J,branch:$.branch,virtualMcpMetadata:G,explicitKind:W});if(K){if(W!=="user-desktop")return K;if(await H.alive(K.sandboxHandle).catch(()=>!1))return K;await TO(Z.storage.virtualMcps,$.virtualMcpId,Q,J,$.branch,W).catch((B)=>{console.warn("[ensureSandbox] failed to reap stale user-desktop entry",B)})}let U=await hO(Z,gO($.branch)??Z.metadata?.threadId)??G.githubRepo??null,{entry:F}=await aM8({ctx:Z,userId:Q,sandboxUserId:J,orgId:X.id,virtualMcpId:$.virtualMcpId,branch:$.branch,metadata:G,githubRepo:U,existing:null,providerKind:W,runner:H,...$.cloneOnly?{cloneOnly:!0}:{}});return F}async function aM8($){let{ctx:Z,userId:X,sandboxUserId:Q,orgId:Y,virtualMcpId:G,branch:J,metadata:K,githubRepo:W,existing:H,runner:N,cloneOnly:U}=$,{runtime:F,packageManager:w,port:B,packageManagerPath:L}=bM8(K),D;if(W){if(W.connectionId)await Sh({ctx:Z,connectionId:W.connectionId,organizationId:Y,forceRefresh:!0,onLegacyMintError:(p0)=>{console.error("[provisionSandbox] repo-scoped legacy token mint failed",{connectionId:W.connectionId,error:p0.message})}});let{cloneUrl:R0,gitUserName:$0,gitUserEmail:s}=W.connectionId?await RO(W.connectionId,W.owner,W.name,Z.db,Z.vault):UP8(W.owner,W.name);if(!w){let p0=W.connectionId?await lM8(W.connectionId,W.owner,W.name,Z.db,Z.vault):await dM8(W.owner,W.name);if(p0)w=p0.packageManager,F=Ha[p0.packageManager].runtime,B=p0.devPort??B,await Ih4(Z,G,X,p0.packageManager,p0.devPort)}let A0=Z1().sandboxStickyHeadRefEnabled,Q0=pM8({branch:J,derivedRef:gU(J),recordedHeadRef:A0?await VM8(Z,gO(J)):null,sticky:A0}),I0=await gM8({ctx:Z,orgId:Y,userId:X,entries:xM8(K)});D={cloneUrl:R0,...W.connectionId?{connectionId:W.connectionId}:{},userName:$0,userEmail:s,branch:Q0,displayName:`${W.owner}/${W.name}`,...I0.length>0?{submoduleCredentials:I0}:{}}}let E=typeof K.productionUrl==="string"&&K.productionUrl.trim()?K.productionUrl.trim():void 0,z=F&&w&&!U?{runtime:F,packageManager:w,...B!==null?{devPort:Number(B)}:{},...L?{packageManagerPath:L}:{},...E?{productionUrl:E}:{}}:void 0,j=Cr({orgId:Y,virtualMcpId:G,branch:J}),A=N.kind==="user-desktop"?await tM8(Z.objectStorage,{isProduction:Z1().nodeEnv==="production"}):null,P=(N.kind==="user-desktop"||N.kind==="agent-sandbox")&&!Z1().orgFsMountsDisabled,q;if(P){let R0=Z.organization?.slug??(await Z.db.selectFrom("organization").select(["slug"]).where("id","=",Y).executeTakeFirst())?.slug;if(R0)q=await jB8(Z,{orgSlug:R0,orgId:Y,baseUrl:kQ()})}await Mh4(N);let k=await N.ensure({userId:Q,projectRef:j},{branch:J,repo:D,workload:z,cloneOnly:U===!0,tenant:{orgId:Y,userId:Q,...Z.organization?.slug?{orgSlug:Z.organization.slug}:{},...Z.organization?.name?{orgName:Z.organization.name}:{},...Z.auth.user?.email?{userEmail:Z.auth.user.email}:{},...Z.auth.user?.name?{userName:Z.auth.user.name}:{}},...A?{offloadAllowedHosts:A.hosts,offloadAllowSameHostDev:A.allowSameHostDev}:{},...q?{orgFsConfigJson:q}:{}}),M=K.runtime?.env??null;await Vj0({ctx:Z,runner:N,handle:k.handle,orgId:Y,userId:X,entries:M});let d=!!H&&H.sandboxHandle===k.handle&&H?.createdAt?H.createdAt:Date.now(),v=K.runtime?.selected??null,b=K.runtime?.port??null,t=K.runtime?.path??null,y={sandboxHandle:k.handle,previewUrl:k.previewUrl,sandboxApiUrl:k.previewUrl,sandboxProviderKind:N.kind,createdAt:d,startedWith:{packageManager:v,port:b,path:t}};await ZP8(Z.storage.virtualMcps,G,X,Q,J,$.providerKind,y);let Z0=gO(J);if(Z0)await _M8(Z,Z0,Q,J,$.providerKind,y);let D0=!H||H.sandboxHandle!==k.handle;return{entry:y,isNewVm:D0}}async function Ih4($,Z,X,Q,Y){let G=await $.storage.virtualMcps.findById(Z);if(!G)return;let J=G.metadata??{};await $.storage.virtualMcps.update(Z,X,{metadata:{...J,runtime:{selected:Q,port:Y}}})}async function Mh4($){if(!$.hasSchedulableCapacity)return;let Z=Date.now()+rM8,X=!1;while(!await $.hasSchedulableCapacity()){if(Date.now()>=Z)throw Error(`sandbox provisioning failed: the cluster has had no room to schedule another sandbox for ${Math.round(rM8/1000)}s`);if(!X)X=!0,console.warn("[ensureSandbox] waiting for cluster capacity \u2014 a sandbox pod cannot be scheduled right now");await _8(qh4)}}var Rh4,v51,rM8=150000,qh4=5000;var Fa=O(()=>{SU();H$();t0();Na();C51();hM8();KY();br();iM8();k51();yO();LK();_51();oM8();b8();YZ();no();KY();Rh4=BH.enum(["agent-sandbox","user-desktop","cluster"]),v51=o({name:"SANDBOX_START",description:"Start a sandbox with the connected GitHub repo and dev server.",annotations:{title:"Start VM Preview",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!1,openWorldHint:!0},_meta:{ui:{visibility:"app"}},inputSchema:BH.object({virtualMcpId:BH.string().describe("Virtual MCP ID"),branch:BH.string().min(1).optional().describe("Git branch to check out. Pass the thread's branch whenever the caller has one: when omitted the handler mints a fresh `<user-slug>-<timestamp>` name, which becomes a SEPARATE sandbox from the one the thread's own branch resolves to. The resolved branch is returned in the response so callers can persist it."),sandboxProviderKind:Rh4.optional().describe("Explicit runtime choice. Hosted provider is `agent-sandbox`; legacy `cluster` input is accepted only for compatibility and normalized to `agent-sandbox`. When omitted, defaults to `user-desktop` if the acting user's link daemon is online, else the env kind.")}),outputSchema:BH.object({previewUrl:BH.string().nullable(),sandboxHandle:BH.string(),branch:BH.string(),isNewVm:BH.boolean(),sandboxProviderKind:BH.enum(["agent-sandbox","user-desktop"])}),handler:async($,Z)=>{N0(Z);let X=J0(Z);await Z.access.check();let Q=$.branch??Cj0(Sj0(Z.auth.user)),Y=z1(Z);if(!Y)throw Error("User ID required");let G=await hU(Z,Q,Y),J=await Z.storage.virtualMcps.findById($.virtualMcpId);if(!J||J.organization_id!==X.id)throw Error("Virtual MCP not found");let K=J.metadata??{},W=$.sandboxProviderKind?Kj($.sandboxProviderKind):void 0,{provider:H,kind:N}=await UQ(Z,{userId:G,branch:Q,virtualMcpMetadata:K,explicitKind:W}),U=WH(n5(K),G,Q,N),w=await hO(Z,gO(Q)??Z.metadata?.threadId)??K.githubRepo??null,{entry:B,isNewVm:L}=await aM8({ctx:Z,userId:Y,sandboxUserId:G,orgId:X.id,virtualMcpId:$.virtualMcpId,branch:Q,metadata:K,githubRepo:w,existing:U,providerKind:N,runner:H});return{...B,branch:Q,isNewVm:L,sandboxProviderKind:N}}})});function kh4($){let{publicUrl:Z,agentId:X,organization:Q,target:Y,threadId:G}=$;if(Y==="agent-tools")return`${Z}/mcp/virtual-mcp/${X}`;if(!Q.slug)throw new eM8(Q.id);if(Y==="task-run"){if(!G)throw Error("a task-run MCP endpoint is scoped to a run: threadId is required");return`${Z}/api/${Q.slug}/mcp/task-run/${encodeURIComponent(G)}`}return`${Z}/api/${Q.slug}/mcp/self`}async function _j0($,Z,X,Q,Y="agent-tools",G){let J=kh4({publicUrl:kQ(),agentId:Z,organization:X,target:Y,...G?{threadId:G}:{}}),K=await $.boundAuth.apiKey.create({name:Q,permissions:{"*":["*"]},expiresIn:sM8,metadata:{organization:{id:X.id,slug:X.slug,name:X.name}}});return{url:J,headers:{Authorization:`Bearer ${K.key}`,"x-org-id":X.id},expiresAt:Date.now()+sM8*1000}}var sM8=3600,eM8;var x51=O(()=>{YZ();eM8=class eM8 extends Error{constructor($){super(`cannot mint a management MCP endpoint for organization "${$}": the org-scoped path /api/<slug>/mcp/self needs the org slug, which was not loaded.`);this.name="MissingOrganizationSlugError"}}});async function Vh4($,Z,X,Q){try{let Y=$.organization;if(!Y)return;let G=await _j0($,Q.virtualMcpId,Y,"tool-scripting"),J=await Z.proxyDaemonRequest(X,"/_sandbox/tools/sync",{method:"POST",headers:new Headers({"content-type":"application/json"}),body:JSON.stringify(G)});if(!J.ok)console.warn("[cluster-sandbox-fs] tools/sync failed",J.status,await J.text().catch(()=>""))}catch(Y){console.warn("[cluster-sandbox-fs] tools/sync failed",Y)}}async function th($,Z){let{provider:X,kind:Q}=await UQ($,{userId:Z.userId,branch:Z.branch,virtualMcpMetadata:null}),Y=null,G=()=>{if(!Y){if(Y=ph({virtualMcpId:Z.virtualMcpId,branch:Z.branch,sandboxProviderKind:Q},$).then((W)=>W.sandboxHandle),Y.catch(()=>{Y=null}),Z.syncTools)Y.then((W)=>Vh4($,X,W,{virtualMcpId:Z.virtualMcpId,providerKind:Q})).catch(()=>{})}return Y},J=Z.branch==="ephemeral"||Q==="user-desktop";return H41(X,{ensureHandle:G,invalidateHandle:async(W)=>{let H=Y;if(Y=null,!J&&!W?.force)return;try{await TO($.storage.virtualMcps,Z.virtualMcpId,Z.userId,Z.userId,Z.branch,Q)}catch(N){console.warn("[cluster-sandbox-fs] failed to reap vmMap entry",N)}if(H&&typeof X.forgetHandle==="function")try{let N=await H;await X.forgetHandle(N)}catch(N){console.warn("[cluster-sandbox-fs] forgetHandle failed",N)}},canAutoRestart:J,threadId:Z.threadId})}async function $k8($,Z){try{let X=await th($,Z),{stdout:Q}=await X.onBash("test -d .deco && echo __DECO_SITE__");return Q.includes("__DECO_SITE__")}catch(X){return console.warn("[cluster-sandbox-fs] .deco probe failed; assuming deco site",X),!0}}var vj0=O(()=>{SU();x51();yO();Fa();KY()});import{z as Zk8}from"zod";function oh($){let Z=[];for(let X of $){if(X.status!=="active")continue;let Q=YQ(X);if(!Q)continue;Z.push({connectionId:X.id,owner:Q.owner,repo:Q.repo,installationId:Q.installationId})}return Z}async function Ch4($,Z){let{items:X}=await $.storage.connections.list(Z,{slug:"mcp-github"});return oh(X)}function _h4($){let Z=$.split(`
 `).map((Q)=>Q.trim()).filter((Q)=>Q&&Q!==".git"&&Q!=="__CLONED__"),X=Z.length>0;return{cloned:X,listing:X?Z.join(`
 `):""}}function vh4($){let Z="Load a GitHub repository into this conversation's sandbox so the file tools (read/write/edit/bash/grep/glob) and dev server operate on that repo, and open its live Preview. Waits until the repo is cloned before returning. Calling it again switches the repo. File tools operate on the loaded repo from your NEXT message (this turn's tools are still bound to the previous workspace), so after loading, prefer the file listing this tool returns over re-running bash in the same turn.",X=$.map((Q)=>`- ${Q.owner}/${Q.repo} (connectionId: ${Q.connectionId})`).join(`
 `);return`${Z}
@@ -2498,7 +2498,7 @@ Caused by: ${Z.stack}`}};b_=class b_ extends p9{constructor($,Z){super($,Z);this
 Repositories imported into this organization:
 ${X}
 
-Pass the connectionId of the repo to load.`}async function Yk8($){let{ctx:Z,orgId:X,virtualMcpId:Q,userId:Y,threadId:G,writer:J,rebindFs:K}=$;if(!tG(Q))return null;let W=await Ch4(Z,X);if(W.length===0)return null;let H=new Map(W.map((N)=>[N.connectionId,N]));return l8({description:vh4(W),inputSchema:K0(Zk8.object({connectionId:Zk8.string().describe("connectionId of the imported repository to load (see the list in this tool's description).")})),execute:async({connectionId:N})=>{let U=H.get(N);if(!U)return{success:!1,error:`No imported repository found for connectionId "${N}". Available: ${W.map((C)=>C.connectionId).join(", ")||"none"}.`};let F=OK(G,U.connectionId),w={url:`https://github.com/${U.owner}/${U.repo}`,owner:U.owner,name:U.repo,installationId:U.installationId,connectionId:U.connectionId},B=await Z.storage.threads.get(G);await Z.storage.threads.update(G,{metadata:{...B?.metadata??{},githubRepo:w},branch:F,updated_by:Y});let{kind:L}=await UQ(Z,{userId:Y,branch:F,virtualMcpMetadata:null}),D=await ph({virtualMcpId:Q,branch:F,sandboxProviderKind:L},Z),E=xr(n5(B?.metadata),Y,F,L,D);J.write({type:"data-open-preview",id:G,data:{previewUrl:D.previewUrl??null,branch:F,githubRepo:w,sandboxMap:E,sandboxProviderKind:L}});let z=await th(Z,{virtualMcpId:Q,branch:F,userId:Y}),j=Date.now()+Xk8,A="",P=!1,q=0,k=null;while(Date.now()<j){let C=await z.onBash("if git -C /app/repo rev-parse HEAD >/dev/null 2>&1; then echo __CLONED__; fi; ls -A /app/repo 2>/dev/null").then((v)=>({ok:!0,stdout:v.stdout})).catch(()=>({ok:!1,stdout:""}));if(!C.ok){if(++q>=Sh4)break;await _8(Qk8);continue}q=0;let d=_h4(C.stdout);if(d.cloned&&d.listing===k){P=!0,A=d.listing;break}k=d.cloned?d.listing:null,await _8(Qk8)}let M=!1;if(P&&K)try{await K(F),M=!0}catch(C){console.warn("[load_repo] live fs rebind failed",C)}return{success:!0,repo:`${U.owner}/${U.repo}`,previewUrl:D.previewUrl??null,cloned:P,files:A,message:!P?`Loaded ${U.owner}/${U.repo} and opened the Preview, but the clone did not finish within ${Math.round(Xk8/1000)}s. It may still be in progress \u2014 your file tools will use it next message.`:M?`Loaded ${U.owner}/${U.repo} and opened the Preview. The repo is cloned and its dev server is booting. Your file tools (read/write/edit/bash/grep/glob) now operate on it \u2014 you can use it right away.`:`Loaded ${U.owner}/${U.repo} and opened the Preview. The repo is cloned and its dev server is booting. Your file tools operate on it from your next message.`}}})}var Xk8=120000,Qk8=1500,Sh4=5;var xj0=O(()=>{H$();u4();yO();sW();R6();KY();Fa();LK();vj0()});import{AsyncLocalStorage as xh4}from"async_hooks";function fj0(){let $=wa.getStore();if(!$)throw Error("This tool is only available on a task run's MCP endpoint (/api/<org>/mcp/task-run/<threadId>).");return $}function Jk8($){return cJ.some((X)=>Ht($,X))?fh4:Gk8}var wa,Gk8,fh4;var Ba=O(()=>{YX();wa=new xh4;Gk8=["TASK_ADD_REPO","TASK_BOARD_ITEM_LIST","TASK_BOARD_ITEM_UPDATE","TASK_BOARD_ITEM_PRS_GET","TASK_BOARD_ITEM_PR_LINK","TASK_BOARD_ACTIVITY_LIST","TASK_BOARD_COMMENT_LIST","TASK_BOARD_COMMENT_CREATE","TASK_BOARD_COMMENT_UPDATE"],fh4=[...Gk8,"TASK_BOARD_REVIEW_DECISION"]});import{z as q3}from"zod";async function Hk8($,Z,X,Q){let Y=await $.proxyDaemonRequest(Z,"/_sandbox/bash",{method:"POST",headers:new Headers({"content-type":"application/json","x-thread-id":X}),body:JSON.stringify({command:Q})});if(!Y.ok)throw Error(`sandbox bash failed (${Y.status} ${Y.statusText})`);let G=await Y.json();return{stdout:G.stdout??"",exitCode:G.exitCode??0}}function gh4($){let Z=$.split(`
+Pass the connectionId of the repo to load.`}async function Yk8($){let{ctx:Z,orgId:X,virtualMcpId:Q,userId:Y,threadId:G,writer:J,rebindFs:K}=$;if(!tG(Q))return null;let W=await Ch4(Z,X);if(W.length===0)return null;let H=new Map(W.map((N)=>[N.connectionId,N]));return l8({description:vh4(W),inputSchema:K0(Zk8.object({connectionId:Zk8.string().describe("connectionId of the imported repository to load (see the list in this tool's description).")})),execute:async({connectionId:N})=>{let U=H.get(N);if(!U)return{success:!1,error:`No imported repository found for connectionId "${N}". Available: ${W.map((C)=>C.connectionId).join(", ")||"none"}.`};let F=OK(G,U.connectionId),w={url:`https://github.com/${U.owner}/${U.repo}`,owner:U.owner,name:U.repo,installationId:U.installationId,connectionId:U.connectionId},B=await Z.storage.threads.get(G);await Z.storage.threads.update(G,{metadata:{...B?.metadata??{},githubRepo:w},branch:F,updated_by:Y});let{kind:L}=await UQ(Z,{userId:Y,branch:F,virtualMcpMetadata:null}),D=await ph({virtualMcpId:Q,branch:F,sandboxProviderKind:L},Z),E=xr(n5(B?.metadata),Y,F,L,D);J.write({type:"data-open-preview",id:G,data:{previewUrl:D.previewUrl??null,branch:F,githubRepo:w,sandboxMap:E,sandboxProviderKind:L}});let z=await th(Z,{virtualMcpId:Q,branch:F,userId:Y,threadId:G}),j=Date.now()+Xk8,A="",P=!1,q=0,k=null;while(Date.now()<j){let C=await z.onBash("if git -C /app/repo rev-parse HEAD >/dev/null 2>&1; then echo __CLONED__; fi; ls -A /app/repo 2>/dev/null").then((v)=>({ok:!0,stdout:v.stdout})).catch(()=>({ok:!1,stdout:""}));if(!C.ok){if(++q>=Sh4)break;await _8(Qk8);continue}q=0;let d=_h4(C.stdout);if(d.cloned&&d.listing===k){P=!0,A=d.listing;break}k=d.cloned?d.listing:null,await _8(Qk8)}let M=!1;if(P&&K)try{await K(F),M=!0}catch(C){console.warn("[load_repo] live fs rebind failed",C)}return{success:!0,repo:`${U.owner}/${U.repo}`,previewUrl:D.previewUrl??null,cloned:P,files:A,message:!P?`Loaded ${U.owner}/${U.repo} and opened the Preview, but the clone did not finish within ${Math.round(Xk8/1000)}s. It may still be in progress \u2014 your file tools will use it next message.`:M?`Loaded ${U.owner}/${U.repo} and opened the Preview. The repo is cloned and its dev server is booting. Your file tools (read/write/edit/bash/grep/glob) now operate on it \u2014 you can use it right away.`:`Loaded ${U.owner}/${U.repo} and opened the Preview. The repo is cloned and its dev server is booting. Your file tools operate on it from your next message.`}}})}var Xk8=120000,Qk8=1500,Sh4=5;var xj0=O(()=>{H$();u4();yO();sW();R6();KY();Fa();LK();vj0()});import{AsyncLocalStorage as xh4}from"async_hooks";function fj0(){let $=wa.getStore();if(!$)throw Error("This tool is only available on a task run's MCP endpoint (/api/<org>/mcp/task-run/<threadId>).");return $}function Jk8($){return cJ.some((X)=>Ht($,X))?fh4:Gk8}var wa,Gk8,fh4;var Ba=O(()=>{YX();wa=new xh4;Gk8=["TASK_ADD_REPO","TASK_BOARD_ITEM_LIST","TASK_BOARD_ITEM_UPDATE","TASK_BOARD_ITEM_PRS_GET","TASK_BOARD_ITEM_PR_LINK","TASK_BOARD_ACTIVITY_LIST","TASK_BOARD_COMMENT_LIST","TASK_BOARD_COMMENT_CREATE","TASK_BOARD_COMMENT_UPDATE"],fh4=[...Gk8,"TASK_BOARD_REVIEW_DECISION"]});import{z as q3}from"zod";async function Hk8($,Z,X,Q){let Y=await $.proxyDaemonRequest(Z,"/_sandbox/bash",{method:"POST",headers:new Headers({"content-type":"application/json","x-thread-id":X}),body:JSON.stringify({command:Q})});if(!Y.ok)throw Error(`sandbox bash failed (${Y.status} ${Y.statusText})`);let G=await Y.json();return{stdout:G.stdout??"",exitCode:G.exitCode??0}}function gh4($){let Z=$.split(`
 `).map((X)=>X.trim()).filter((X)=>X&&X!==".git"&&X!=="__CLONED__");return{cloned:Z.length>0,listing:Z.join(`
 `)}}async function uh4($,Z){let{items:X}=await $.storage.connections.list(Z,{slug:"mcp-github"});return oh(X)}var bh4=3300000,Kk8=180000,Wk8=1500,yh4=5,hh4,f51;var Nk8=O(()=>{t0();xj0();yO();br();KY();LK();H$();Ba();hh4=['token=$(git remote get-url origin | sed -n "s|.*x-access-token:\\([^@]*\\)@.*|\\1|p")','[ -n "$token" ] || exit 0','mkdir -p "${HOME:-/root}/.config/gh"',"umask 077",'printf "github.com:\\n  oauth_token: %s\\n  git_protocol: https\\n" "$token" > "${HOME:-/root}/.config/gh/hosts.yml"'].join(`
 `);f51=o({name:"TASK_ADD_REPO",description:"Clone one of this organization's repositories into your working directory. "+"Your working directory is EMPTY until you call this \u2014 do not look for "+"files, and do not run git, before it returns. Call it once, with the repository the task is about; it waits for the checkout and returns the repository root listing, so you can start reading files immediately after. `git` and `gh` are authenticated once it returns. Call TASK_ADD_REPO with no arguments to list the repositories available.",annotations:{title:"Add Repository",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!0},inputSchema:q3.object({connectionId:q3.string().optional().describe("connectionId of the repository to clone. Omit to list the available repositories.")}),outputSchema:q3.object({success:q3.boolean(),repositories:q3.array(q3.object({connectionId:q3.string(),repo:q3.string()})).optional(),repo:q3.string().optional(),cloned:q3.boolean().optional(),files:q3.string().optional(),message:q3.string()}),handler:async($,Z)=>{N0(Z),await Z.access.check();let X=J0(Z),Q=z1(Z);if(!Q)throw Error("User ID required");let{threadId:Y}=fj0(),G=await uh4(Z,X.id),J=$.connectionId?G.find((k)=>k.connectionId===$.connectionId):void 0;if(!J){let k=G.map((M)=>({connectionId:M.connectionId,repo:`${M.owner}/${M.repo}`}));return{success:!1,repositories:k,message:$.connectionId?`No imported repository for connectionId "${$.connectionId}". Pick one of the repositories listed.`:k.length===0?"This organization has no repositories imported, so none can be cloned.":"Pick a repository and call TASK_ADD_REPO again with its connectionId."}}let K=await Z.storage.threads.get(Y);if(!K)throw Error(`Thread not found: ${Y}`);let W=OK(Y),H=await hU(Z,W,Q),{provider:N,kind:U}=await UQ(Z,{userId:H,branch:W,virtualMcpMetadata:null}),F=WH(await Mj0(Z,Y),H,W,U);if(!F)throw Error(`No sandbox is registered for this run (thread ${Y}), so there is nowhere to clone into.`);await Sh({ctx:Z,connectionId:J.connectionId,organizationId:X.id,forceRefresh:!0,onLegacyMintError:(k)=>console.error("[TASK_ADD_REPO] legacy repo-scoped mint failed",{connectionId:J.connectionId,error:k.message})});let{cloneUrl:w,gitUserName:B,gitUserEmail:L}=await RO(J.connectionId,J.owner,J.repo,Z.db,Z.vault,{bufferMs:bh4});await Z.storage.threads.update(Y,{metadata:{...K.metadata??{},githubRepo:{url:`https://github.com/${J.owner}/${J.repo}`,owner:J.owner,name:J.repo,installationId:J.installationId,connectionId:J.connectionId}},updated_by:Q});let D=gU(W),E=await N.proxyDaemonRequest(F.sandboxHandle,"/_sandbox/config",{method:"PUT",headers:new Headers({"content-type":"application/json"}),body:JSON.stringify({git:{repository:{cloneUrl:w,branch:D,repoName:`${J.owner}/${J.repo}`},identity:{userName:B,userEmail:L}}})});if(!E.ok)throw Error(`the sandbox rejected the repository (${E.status} ${E.statusText})`);await N.proxyDaemonRequest(F.sandboxHandle,"/_sandbox/setup/clone",{method:"POST",headers:new Headers({"content-type":"application/json"}),body:"{}"}).catch((k)=>{console.warn("[TASK_ADD_REPO] explicit clone kick failed",k)});let z=Date.now()+Kk8,j=!1,A="",P=0,q=null;while(Date.now()<z){let k=await Hk8(N,F.sandboxHandle,Y,"if git rev-parse HEAD >/dev/null 2>&1; then echo __CLONED__; fi; ls -A 2>/dev/null").catch(()=>null);if(!k){if(++P>=yh4)break;await _8(Wk8);continue}P=0;let M=gh4(k.stdout);if(M.cloned&&M.listing===q){j=!0,A=M.listing;break}q=M.cloned?M.listing:null,await _8(Wk8)}if(j)await Hk8(N,F.sandboxHandle,Y,hh4).catch((k)=>console.warn("[TASK_ADD_REPO] gh auth setup failed",k));return{success:j,repo:`${J.owner}/${J.repo}`,cloned:j,files:A,message:j?`${J.owner}/${J.repo} is checked out at your working directory on branch ${D}. \`git\` and \`gh\` are authenticated. Start working.`:`The clone of ${J.owner}/${J.repo} did not finish within ${Math.round(Kk8/1000)}s. It may still be in progress \u2014 check your working directory before calling this again.`}}})});import{z as U8}from"zod";var uU,c_,ch4,lh4,Uk8,rh,dh4,mh4,Fk8;var OH=O(()=>{YX();uU=U8.enum(["triage","todo","in_progress","in_review","done"]),c_=U8.enum(["none","low","medium","high","urgent"]),ch4=U8.object({threadId:U8.string(),virtualMcpId:U8.string().nullable(),status:U8.enum(["in_progress","requires_action","failed","completed","expired"]).nullable(),title:U8.string().nullable(),lastMessage:U8.string().nullable(),hasPreview:U8.boolean(),hasMessages:U8.boolean(),createdAt:U8.string()}),lh4=U8.object({id:U8.string(),name:U8.string(),color:U8.string().nullable().describe('Hex color, e.g. "#3b82f6"'),createdBy:U8.string(),createdAt:U8.string().datetime()}),Uk8=U8.object({url:U8.string(),number:U8.number(),repoOwner:U8.string(),repoName:U8.string(),createdAt:U8.string(),title:U8.string().nullable(),body:U8.string().nullable(),state:U8.enum(["open","closed"]).nullable(),draft:U8.boolean().nullable(),merged:U8.boolean().nullable(),mergeable:U8.boolean().nullable(),checksStatus:U8.enum(["pending","passing","failing"]).nullable(),checks:U8.array(U8.object({name:U8.string(),status:U8.string(),conclusion:U8.string().nullable(),detailsUrl:U8.string().nullable(),summary:U8.string().nullable()})),previewUrl:U8.string().nullable()}),rh=U8.object({id:U8.string(),organizationId:U8.string(),title:U8.string(),description:U8.string().nullable(),status:uU,priority:c_,assigneeId:U8.string().nullable(),assignedBy:U8.string().nullable(),dueDate:U8.string().datetime().nullable(),sortOrder:U8.number(),threads:U8.array(ch4),tags:U8.array(lh4),createdBy:U8.string(),createdAt:U8.string().datetime(),updatedBy:U8.string(),updatedAt:U8.string().datetime()}),dh4=["created","status_changed","assignee_changed","priority_changed","due_date_changed","title_changed","description_changed","tags_changed","review_requested","review_approved","review_changes_requested","merge_conflict_resolution"],mh4=U8.enum(dh4),Fk8=U8.object({id:U8.string(),taskBoardItemId:U8.string(),action:mh4,actorId:U8.string().nullable(),data:U8.record(U8.string(),U8.unknown()),occurredAt:U8.string().datetime()})});async function bj0($,Z,X){if(X===Y$)return;let{members:Q}=await $.boundAuth.organization.listMembers({organizationId:Z,filterField:"userId",filterValue:X});if(!Q.some((Y)=>Y.userId===X))throw Error("assigneeId is not a member of the organization")}var b51=O(()=>{OH()});function Ok8($){let Z={};for(let[X,Q]of Object.entries($)){if(X.startsWith(ih4))continue;Z[X]=Q}return Z}function yj0($){return{taskBoardItemId:$.id,...gW($)&&{[wk8]:Bk8}}}function nh4($){return $?.[wk8]===Bk8}function ph4($){if(/[:\s]/.test($))throw Error("organization id unsuitable for the subsidy key scheme");return`subsidy:${$}`}async function th4($,Z){let X=Z1();try{let Q=await $.storage.subsidizedGatewayKeys.get(Z);if(Q)return Q;let Y=$.auth?.user?.id;if(Y&&X.aiGatewayEnabled&&X.studioProvisionSecretKey&&mw.provisionKey){let G=await IW(Y,$.auth?.user?.email),J=await mw.provisionKey(G,ph4(Z));return await $.storage.subsidizedGatewayKeys.put(Z,J),J}}catch(Q){console.error("[subsidized-runs] subsidy key unavailable \u2014 run stays on the org's key:",Q)}return}async function Lk8($,Z,X){if(!Z1().taskQuotaEnforced)return;if(!nh4(X))return;let Q=X?.taskBoardItemId;if(!Q)return;let Y=await $.storage.taskBoard.getById(Q,Z);if(!Y||!gW(Y))return;if(!await SK8($,Q))return;return await th4($,Z)}function Dk8($,Z){if(!Z)return $;if($.providerId!=="deco")return $;return{...$,apiKey:Z}}var ih4="srv.",wk8="srv.billing",Bk8="subscription";var Oa=O(()=>{U70();YB();b8();JU()});function gj0($){let Z=$?.runClass;return Z&&Z in y51?y51[Z]:y51.interactive}var y51,Ek8="runClass";var hj0=O(()=>{y51={interactive:10,reviewer:20,retry:30,new_task:40}});async function g51($,Z,X){let Q;try{return await Promise.race([$.aiProviders.listModels(Z,X),new Promise((G,J)=>{Q=setTimeout(()=>J(Error("listModels timeout")),oh4)})])}finally{if(Q)clearTimeout(Q)}}function rh4($,Z){switch($){case"fast":return Z.chat.fast;case"smart":return Z.chat.smart;case"thinking":return Z.chat.thinking;case"image":return Z.image;case"web_search":return Z.webSearch;case"deep_research":return Z.deepResearch}}function h51($,Z,X){let Q=$.find((Y)=>Y.modelId===Z);return{title:Q?.title??X??Z,providerId:Q?.providerId,capabilities:Q?.capabilities,limits:Q?.limits??null}}async function PX($,Z,X){let Q=$.organization?.id;if(!Q)throw Error("resolveTier called without an organization");let G=(await $.storage.organizationSettings.get(Q))?.simple_mode?.tiers?.[Z]??null,J=$.auth?.user?.id,K=FO.safeParse(Z),W=X?.applyUserPrefs&&K.success&&J?(await $.storage.userModelPreferences.get(J,Q))?.tiers?.[K.data]??null:null,H=(await $.storage.aiProviderKeys.list({organizationId:Q})).filter((B)=>WE(B.providerId));for(let B of[W,G])if(B&&H.some((L)=>L.id===B.keyId)){let L=await g51($,B.keyId,Q).catch(()=>[]);return{credentialId:B.keyId,modelId:B.modelId,modelMeta:h51(L,B.modelId,B.title)}}if(H.length===0)throw new ah(Z);let N={};await Promise.all(H.map(async(B)=>{N[B.id]=await g51($,B.id,Q).catch(()=>[])}));let U=H.map((B)=>({id:B.id,providerId:B.providerId,label:B.label,presetId:B.presetId,createdBy:B.createdBy,createdAt:B.createdAt})),F=Na1(U,N),w=rh4(Z,F);if(!w)throw new ah(Z);return{credentialId:w.keyId,modelId:w.modelId,modelMeta:h51(N[w.keyId]??[],w.modelId,w.title)}}async function zk8($,Z,X){let Q=$.organization?.id;if(!Q)throw Error("resolveSpecificModel called without an organization");let Y=await $.storage.aiProviderKeys.findById(Z,Q).catch((J)=>{if(J instanceof Error&&J.message==="Provider key not found")throw new La(`AI provider credential "${Z}" was not found`,{cause:J});throw J});if(!WE(Y.providerId))throw new La(`AI provider credential "${Z}" uses native-only provider "${Y.providerId}" and cannot run a hosted model`);let G=await g51($,Z,Q).catch(()=>[]);return{credentialId:Z,modelId:X,modelMeta:h51(G,X)}}async function M3($,Z){try{return await PX($,Z)}catch(X){if(X instanceof ah)return null;return console.warn(`[resolveTier] tier "${Z}" resolution failed:`,X),null}}var ah,La,oh4=5000;var cO=O(()=>{A3();R6();ah=class ah extends Error{tier;constructor($){super(`No model available for tier "${$}". Connect a provider or configure the tier in organization settings.`);this.tier=$;this.name="TierUnavailableError"}};La=class La extends Error{constructor($,Z){super($,Z);this.name="SpecificModelCredentialUnavailableError"}}});function jk8($){return $ instanceof LH||typeof $==="object"&&$!==null&&$.permanent===!0}var LH;var u51=O(()=>{LH=class LH extends Error{permanent=!0;code;constructor($,Z){super(Z);this.name="PermanentRunError",this.code=$}}});function uj0($,Z,X={}){return{info:{id:$.providerId,name:$.providerId,description:$.providerId},aiSdk:Z,...X,listModels:async()=>{throw Error(`Decopilot provider '${$.providerId}' was created from a resolved runtime secret and cannot list models.`)}}}function cj0($){let{providerId:Z,apiKey:X,baseUrl:Q,extraHeaders:Y}=$;switch(Z){case"anthropic":return uj0($,Ot({apiKey:X,...Q?{baseURL:Q}:{},...Y?{headers:Y}:{}}));case"google":return uj0($,_o({apiKey:X,...Q?{baseURL:Q}:{},...Y?{headers:Y}:{}}),{asyncResearch:{canHandle:xo,start:async({modelId:G,query:J,abortSignal:K})=>{let{interactionId:W}=await vG0({apiKey:X,agent:G,query:J,abortSignal:K});return{jobId:W}},resume:({jobId:G,abortSignal:J,onProgress:K,pollIntervalMs:W})=>xG0({apiKey:X,interactionId:G,abortSignal:J,onProgress:K,pollIntervalMs:W})}});case"openrouter":case"deco":{let G=yi({apiKey:X,...Q?{baseURL:Q}:{},...Y?{headers:Y}:{}}),J=G.languageModel.bind(G);return uj0($,Object.assign(G,{languageModel:(...K)=>J(...K)}))}case"llmapi":case"openai-compatible":{let G=(Q??"").replace(/\/+$/,"");if(Z==="llmapi"&&!G)G="https://api.llmapi.ai/v1";if(G&&!G.endsWith("/v1"))G+="/v1";let J=mz({apiKey:X||"not-needed",name:Z,...G?{baseURL:G}:{},...Y?{headers:Y}:{}});return uj0($,Object.assign(J,{languageModel:(...K)=>J.chat(...K)}))}default:throw Error(`decopilot: unsupported modelSource.providerId '${Z}'. Supported: anthropic, google, openrouter, deco, openai-compatible, llmapi.`)}}var c51=O(()=>{Xe0();W11();fG0();yn0();U11()});function lj0(){let $=[],Z=!1,X=null,Q=()=>{let J=X;X=null,J?.()},Y=(J)=>{if(Z)return;$.push(J),Q()},G=async function*(){try{while(!Z||$.length>0){let J=$.shift();if(J){yield J;continue}await new Promise((K)=>{X=K})}}finally{Z=!0,Q()}}();return{writer:{write:(J)=>Y(J),merge:async(J)=>{let K=J;if(typeof K[Symbol.asyncIterator]==="function"){for await(let H of K)Y(H);return}let W=J.getReader();try{while(!0){let{value:H,done:N}=await W.read();if(N)return;Y(H)}}finally{W.releaseLock()}},onError:()=>{}},stream:G,close:()=>{Z=!0,Q()}}}import{z as l51}from"zod";function Pk8($,Z,X){return l8({description:`Enable tools from the current agent's catalog so they can be called in subsequent steps. Pass tool names exactly as listed in <available-connections>.
@@ -2766,7 +2766,7 @@ Guidelines:
             }
             return { consoleLogs, errors, evaluateResult };
           }
-        `,B=await fetch(`${d_}/function?token=${encodeURIComponent(H)}`,{method:"POST",headers:{"Content-Type":"application/javascript"},body:w});if(!B.ok){let z=await B.text().catch(()=>"Unknown error");return{success:!1,error:`Browserless function call failed (${B.status}): ${z}`,url:N.url}}let L=await B.json().catch(async()=>{return{error:`Browserless returned non-JSON response: ${(await B.text().catch(()=>"")).slice(0,200)}`}}),D=JSON.stringify(L,null,2);X.set(K.toolCallId,D);let E=AX(D);if(!("error"in L)&&E>lO&&Q){let z=`inspect-pages/${crypto.randomUUID()}.json`;return await Q.put(z,new TextEncoder().encode(D),{contentType:"application/json"}),{success:!0,uri:R7(z),preview:FQ(D),url:N.url,tokenCount:E,consoleLogCount:L.consoleLogs?.length??0,errorCount:L.errors?.length??0,hasEvaluateResult:L.evaluateResult!=null}}return{success:!("error"in L),...L,url:N.url,tokenCount:E}}finally{$.write({type:"data-tool-metadata",id:K.toolCallId,data:{latencyMs:performance.now()-W}})}}})}function TS8($){let{writer:Z,toolOutputMap:X,objectStorage:Q,pendingImages:Y,imageTool:G}=$,J={user_ask:aj0,todo_write:sj0,propose_plan:$P0,read_tool_output:tj0({toolOutputMap:X})};if(G)J.generate_image=Ta("generate_image",Aa,QP0(Z,{...G,objectStorage:Q}),null);if(process.env.BROWSERLESS_TOKEN){if(J.scrape_url=AS8(Z,{toolOutputMap:X,objectStorage:Q,kind:"scrape"}),J.inspect_page=AS8(Z,{toolOutputMap:X,objectStorage:Q,kind:"inspect"}),Y)J.take_screenshot=YP0(Z,{objectStorage:Q,toolOutputMap:X,pendingImages:Y})}return J}var RS8=O(()=>{u4();U91();F91();w91();lU();l_();Xu();L91()});function P91($,Z=Date.now()){let X=new Date($.updated_at).getTime(),Q=$.last_progress_at?new Date($.last_progress_at).getTime():Number.NaN,Y=Math.max(Number.isFinite(X)?X:Number.NEGATIVE_INFINITY,Number.isFinite(Q)?Q:Number.NEGATIVE_INFINITY);return!Number.isFinite(Y)||Z-Y>1800000}function k3($,Z=Date.now()){let X=$.status;if(X==="in_progress"&&P91($,Z))X="expired";return{id:$.id,organization_id:$.organization_id,title:$.title,description:$.description,created_at:$.created_at,updated_at:$.updated_at,created_by:$.created_by,updated_by:$.updated_by,hidden:$.hidden??!1,status:X,virtual_mcp_id:$.virtual_mcp_id||void 0,trigger_id:$.trigger_id,branch:$.branch,sandbox_provider_kind:$.sandbox_provider_kind,harness_id:$.harness_id,metadata:$.metadata&&Object.keys($.metadata).length>0?$.metadata:void 0,run_config:$.run_config}}var IS8=1800000;var A91;var qS8=O(()=>{A91=["in_progress","requires_action","failed","completed"]});import{z as S8}from"zod";var MS8,Tc4,kS8,EH,VS8,SS8;var i_=O(()=>{qS8();MS8=S8.object({id:S8.string().describe("Unique message ID"),thread_id:S8.string().describe("ID of the parent thread"),metadata:S8.unknown().optional().describe("Optional message metadata"),parts:S8.array(S8.record(S8.string(),S8.unknown())).describe("Message content parts (AI SDK UIMessagePart format)"),role:S8.enum(["user","assistant","system"]).describe("Message role"),created_at:S8.string().datetime().describe("Timestamp of creation"),updated_at:S8.string().datetime().describe("Timestamp of last update")}),Tc4=S8.object({toolName:S8.string().describe("Fully qualified tool name"),appId:S8.string().describe("App ID that owns the tool"),args:S8.record(S8.string(),S8.unknown()).describe("Arguments used when expanding the tool"),expandedAt:S8.string().datetime().describe("When the tool was expanded")}),kS8=S8.object({expanded_tools:S8.array(Tc4).optional(),read_only:S8.boolean().optional().describe("The thread takes no further input (an autonomous run the user cannot continue)")}).catchall(S8.unknown()),EH=S8.object({id:S8.string().describe("Unique thread ID"),organization_id:S8.string().describe("Organization this thread belongs to"),title:S8.string().describe("Thread title"),description:S8.string().nullable().describe("Thread description"),created_at:S8.string().datetime().describe("Timestamp of creation"),updated_at:S8.string().datetime().describe("Timestamp of last update"),hidden:S8.boolean().optional().describe("Whether the thread is hidden"),status:S8.enum([...A91,"expired"]).describe("Thread execution status. 'expired' is virtual -- computed at read time for stale in_progress threads"),created_by:S8.string().describe("User ID who created the thread"),updated_by:S8.string().optional().describe("User ID who last updated the thread"),virtual_mcp_id:S8.string().optional().describe("Virtual MCP (agent) this thread was initiated with"),trigger_id:S8.string().nullable().optional().describe("Automation trigger that created this thread; null/absent for human-initiated threads."),branch:S8.string().nullable().optional().describe("Git branch this thread is pinned to (GitHub-linked vms only)"),sandbox_provider_kind:S8.string().nullable().optional().describe("Pinned on first message; identifies which sandbox provider to dispatch to (e.g. 'agent-sandbox', 'user-desktop')."),harness_id:S8.string().nullable().optional().describe("Pinned on first message; selects which harness runs the thread (e.g. 'claude-code', 'codex', 'decopilot')."),metadata:kS8.optional().describe("Free-form per-thread UI state (e.g. expanded_tools)"),run_config:S8.record(S8.string(),S8.unknown()).nullable().optional().describe("Persisted run configuration (contains agent and model info)")}),VS8=S8.object({id:S8.string().optional().describe("Optional custom ID for the thread"),title:S8.string().optional().describe("Thread title"),description:S8.string().nullish().describe("Thread description"),virtual_mcp_id:S8.string().describe("Virtual MCP (agent) this thread is bound to"),branch:S8.string().min(1).optional().describe("Preferred branch. Used only when the vMCP has a githubRepo; ignored otherwise. When omitted, the server picks the most-recently-touched branch from the user's sandboxMap, falling back to a freshly generated name.")}),SS8=S8.object({title:S8.string().optional().describe("New thread title"),description:S8.string().nullish().describe("New thread description"),hidden:S8.boolean().optional().describe("Whether the thread is hidden"),status:S8.enum(A91).optional().describe("New thread status (user-set override). 'expired' is a computed virtual status and cannot be set directly."),metadata:kS8.optional().describe("Full replacement of the thread's metadata object"),branch:S8.string().min(1).nullish().describe("New git branch for this thread"),virtual_mcp_id:S8.string().optional().describe("Re-point the thread at a different agent. Only meaningful for an unsent thread (changing the recipient of a new chat); the UI restricts it accordingly.")})});import{z as BG}from"zod";var Rc4,Ic4,n_;var T91=O(()=>{j3();t0();i_();Rc4=$K.extend({where:BG.object({created_by:BG.string().optional(),trigger_ids:BG.array(BG.string()).optional(),virtual_mcp_id:BG.string().optional(),hidden:BG.boolean().optional(),has_trigger:BG.boolean().optional()}).optional(),startDate:BG.string().datetime().optional().describe("Filter threads updated at or after this ISO timestamp"),endDate:BG.string().datetime().optional().describe("Filter threads updated at or before this ISO timestamp"),search:BG.string().optional().describe("Full-text search on thread title (case-insensitive)"),status:BG.string().optional().describe("Filter by thread status (e.g. completed, failed, in_progress)"),userId:BG.string().optional().describe("Filter by the user who created the thread"),agentId:BG.string().optional().describe("Filter by agent (connection or virtual MCP) ID")}),Ic4=AU(EH),n_=o({name:"COLLECTION_THREADS_LIST",description:"List threads with filtering, sorting, and pagination.",annotations:{title:"List Threads",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:Rc4,outputSchema:Ic4,handler:async($,Z)=>{await Z.access.check();let X=Z.auth.user?.id;if(!X)throw Error("User ID required to list threads");J0(Z);let Q=$.offset??0,Y=$.limit??100,G=$.where?.trigger_ids,J=$.where?.virtual_mcp_id,K=$.userId??($.where?.created_by==="me"?X:$.where?.created_by),{threads:W,total:H}=G?.length?await Z.storage.threads.listByTriggerIds(G,{limit:Y,offset:Q}):await Z.storage.threads.list(K,{limit:Y,offset:Q,virtualMcpId:J,startDate:$.startDate,endDate:$.endDate,search:$.search,status:$.status,agentId:$.agentId,includeArchived:$.where?.hidden,hasTrigger:$.where?.has_trigger}),N=Q+Y<H,U=Date.now();return{items:W.map((F)=>k3(F,U)),totalCount:H,hasMore:N}}})});var qc4,p_;var R91=O(()=>{j3();t0();i_();qc4=eo(EH),p_=o({name:"COLLECTION_THREADS_GET",description:"Get a thread's details and metadata by ID.",annotations:{title:"Get Thread",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:so,outputSchema:qc4,handler:async($,Z)=>{N0(Z),J0(Z),await Z.access.check();let X=await Z.storage.threads.get($.id);if(!X)return{item:null};return{item:k3(X)}}})});import{z as Mc4}from"zod";function CS8($){if(!$)return null;if("field"in $&&$.field[0]==="thread_id"&&$.operator==="eq")return String($.value);if("conditions"in $&&($.operator==="and"||$.operator==="or"))for(let Z of $.conditions){let X=CS8(Z);if(X)return X}return null}var kc4,Vc4,t_;var I91=O(()=>{j3();t0();i_();kc4=$K.extend({thread_id:Mc4.string().optional().describe("ID of the thread to list messages for (required)")}),Vc4=AU(MS8),t_=o({name:"COLLECTION_THREAD_MESSAGES_LIST",description:"List messages in a thread with pagination. Requires thread_id. Returns messages in chronological order.",annotations:{title:"List Thread Messages",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:kc4,outputSchema:Vc4,handler:async($,Z)=>{J0(Z),await Z.access.check();let X=$.thread_id??CS8($.where);if(!X)throw Error("thread_id is required (provide as top-level param or in where clause)");let Q=$.offset??0,Y=$.limit??100,G=$.orderBy?.[0]?.direction??"asc",J=await Z.storage.threads.get(X);if(!J)return{items:[],totalCount:0,hasMore:!1};if(J.message_storage_version===2){let{messages:N,total:U}=await Z.storage.threads.messageParts().loadWindow(X,{limit:Y,offset:Q,includeInFlight:!0});return{items:N.map((F)=>({id:F.id,thread_id:X,role:F.role,parts:F.parts,metadata:F.metadata??null,created_at:F.created_at,updated_at:F.created_at})),totalCount:U,hasMore:Q+Y<U}}let{messages:K,total:W}=await Z.storage.threads.listMessages(X,{limit:Y,offset:Q,sort:G}),H=Q+Y<W;return{items:K,totalCount:W,hasMore:H}}})});function _S8($){return{search_threads:l8({description:n_.description,inputSchema:K0(n_.inputSchema),execute:(Z)=>n_.execute(Z,$)}),get_thread:l8({description:p_.description,inputSchema:K0(p_.inputSchema),execute:(Z)=>p_.execute(Z,$)}),list_thread_messages:l8({description:t_.description,inputSchema:K0(t_.inputSchema),execute:(Z)=>t_.execute(Z,$)})}}var vS8=O(()=>{u4();T91();R91();I91()});async function Cc4($,Z,X){let{provider:Q,imageProvider:Y,webSearchProvider:G,deepResearchProvider:J,organization:K,models:W,toolApprovalLevel:H="auto",isPlanMode:N=!1,toolOutputMap:U,pendingImages:F,passthroughClient:w,vmContext:B,htmlArtifactBuffer:L,taskId:D,agentId:E,onChildUsage:z,backgroundDispatcher:j}=Z,A={isPlanMode:N},P=X.auth?.user?.id,q=TS8({writer:$,toolOutputMap:U,passthroughClient:w,toolApprovalLevel:H,isPlanMode:N,objectStorage:X.objectStorage});if(P)q.update_interests=eV8({write:async(C)=>{await X.storage.interests.setForAgent(C.orgId,C.agentId,C.userId,{interests:C.interests})},orgId:K.id,agentId:E,userId:P});Object.assign(q,_S8(X));let k=Ea(H,!1,A)!==!1,M;if(B){let C=await th(X,{virtualMcpId:B.virtualMcpId,branch:B.branch,userId:B.userId,syncTools:B.syncTools}),d=aV8(C);M=oV8({fs:d.fs,htmlArtifactBuffer:L,toolOutputMap:U,needsApproval:k,pendingImages:F,ctx:X,threadId:B.threadId,virtualMcpId:B.virtualMcpId}),Object.assign(q,M);let v=await Yk8({ctx:X,orgId:K.id,virtualMcpId:B.virtualMcpId,userId:B.userId,threadId:B.threadId,writer:$,rebindFs:async(b)=>{d.swap(await th(X,{virtualMcpId:B.virtualMcpId,branch:b,userId:B.userId,syncTools:B.syncTools}))}});if(v)q.load_repo=v}if(Q)q.subtask=Ta("subtask",M91,k91($,{provider:Q,organization:K,models:W,self:{id:E},currentThreadId:D,needsApproval:Ea(H,!1,A)!==!1,onChildUsage:z,vmTools:M,parentBuiltInParams:Z},X),j,(C)=>WS8(D,C));if(Y&&W.image&&X.objectStorage)q.generate_image=Ta("generate_image",Aa,GS8($,{provider:Y,imageModelInfo:W.image,objectStorage:X.objectStorage,allowHttpExternalUrls:Z1().localMode}),j);if(G&&W.webSearch){let C=j91({provider:G,modelInfo:W.webSearch,ctx:X,mode:"quick",toolName:"web_search"});q.web_search=z91($,{researchJob:C,toolOutputMap:U,taskId:D})}if(J&&W.deepResearch){let C=j91({provider:J,modelInfo:W.deepResearch,ctx:X,mode:"deep",toolName:"deep_research"});q.deep_research=z91($,{researchJob:C,toolOutputMap:U,taskId:D,description:"Run in-depth, multi-source research and synthesize a comprehensive, cited report. Use this when the user needs thorough analysis, a literature/market review, or a question that warrants exploring many "+"sources \u2014 accuracy and depth matter more than latency. For quick "+"lookups or fact-checks, use `web_search` instead."})}if(process.env.BROWSERLESS_TOKEN){let C={baseUrl:d_,token:process.env.BROWSERLESS_TOKEN};if(q.take_screenshot=BS8($,{objectStorage:X.objectStorage,toolOutputMap:U,pendingImages:F}),X.objectStorage)q.scrape_url=DS8($,{browserless:C,objectStorage:X.objectStorage,toolOutputMap:U}),q.inspect_page=jS8($,{browserless:C,objectStorage:X.objectStorage,toolOutputMap:U})}return q}function _c4($,Z,X){let Q=Z.organization.id,Y=X.auth?.user?.id,G={};for(let[J,K]of Object.entries($)){let W=K,H=W.execute;if(typeof H!=="function"){G[J]=K;continue}let N=Sc4[J],U=H.constructor?.name==="AsyncGeneratorFunction",F=(B,L)=>{if(!Q||!Y)return;n1.capture({distinctId:Y,event:"tool_called",groups:{organization:Q},properties:{organization_id:Q,tool_source:"builtin",tool_name:J,tool_safe_name:J,read_only:N?.readOnly??null,destructive:N?.destructive??null,idempotent:null,open_world:null,latency_ms:Math.round(B),is_error:L}})},w=U?async function*(B,L){let D=performance.now(),E=!1;try{yield*H.call(W,B,L)}catch(z){throw E=!0,z}finally{F(performance.now()-D,E)}}:async(B,L)=>{let D=performance.now(),E=!1;try{return await H.call(W,B,L)}catch(z){throw E=!0,z}finally{F(performance.now()-D,E)}};G[J]={...W,execute:w}}return G}async function JP0($,Z,X){let Q=await Cc4($,Z,X),Y=_c4(Q,Z,X);if(!Z.isPlanMode){let{propose_plan:G,...J}=Y;return J}return Y}function xS8($){let{ctx:Z,writer:X,toolOutputMap:Q,subtaskParams:Y,planMode:G}=$,J={user_ask:aj0,todo_write:sj0,read_tool_output:tj0({toolOutputMap:Q})};if(G)J.propose_plan=$P0;if(Y.provider)J.subtask=k91(X,Y,Z);return J}var Sc4;var q91=O(()=>{_$();za();lU();rV8();vj0();xj0();V91();U91();F91();$S8();w91();JS8();L91();E91();Xu();NS8();wS8();OS8();ES8();PS8();RS8();vS8();b8();Sc4={read_tool_output:{readOnly:!0,destructive:!1},read_resource:{readOnly:!0,destructive:!1},read_prompt:{readOnly:!0,destructive:!1},web_search:{readOnly:!0,destructive:!1},deep_research:{readOnly:!0,destructive:!1},generate_image:{readOnly:!1,destructive:!1},open_in_agent:{readOnly:!1,destructive:!1},subtask:{readOnly:!1,destructive:!1},user_ask:{readOnly:!0,destructive:!1},propose_plan:{readOnly:!0,destructive:!1},enable_tool:{readOnly:!0,destructive:!1},todo_write:{readOnly:!1,destructive:!1},update_interests:{readOnly:!1,destructive:!1},load_repo:{readOnly:!1,destructive:!0},search_threads:{readOnly:!0,destructive:!1},get_thread:{readOnly:!0,destructive:!1},list_thread_messages:{readOnly:!0,destructive:!1}}});async function fS8($){let Z=$.toolOutputMap??new Map,{tools:X,nameMap:Q}=await rj0($.mcpClient,Z,$.writer,$.toolApprovalLevel,{disableOutputTruncation:!1,isPlanMode:$.planMode,timeoutMs:pj0,resolveArgs:$.resolveArgs,onToolCalled:$.onToolCalled,onPrOpened:$.onPrOpened}),Y=$.fullBuiltInParams?await JP0($.writer,{...$.fullBuiltInParams,toolOutputMap:Z},$.ctx):xS8({ctx:$.ctx,writer:$.writer,toolOutputMap:Z,subtaskParams:$.subtaskParams,planMode:$.planMode}),G=$.kind==="subagent"?Object.fromEntries(Object.entries(Y).filter(([K])=>!vc4.includes(K))):Y;return{tools:{...X,...G},toolOutputMap:Z,nameMap:Q}}var vc4;var bS8=O(()=>{za();q91();vc4=["subtask","user_ask","propose_plan"]});var WP0={};w0(WP0,{waitForSeed:()=>dc4,seedLocalMode:()=>uc4,pruneUndecryptableJwks:()=>hS8,markSeedComplete:()=>lc4,isLocalMode:()=>zH,healLocalJwks:()=>yc4,getLocalAdminUser:()=>S91,getLocalAdminPassword:()=>KP0});import{symmetricDecrypt as xc4}from"better-auth/crypto";import{sql as yS8}from"kysely";import{userInfo as fc4}from"os";async function yc4(){let $=Z1();if(!$.localMode)return 0;if(!$.betterAuthSecret)return 0;return hS8(H6().db,$.betterAuthSecret)}async function hS8($,Z){let X;try{X=(await yS8`
+        `,B=await fetch(`${d_}/function?token=${encodeURIComponent(H)}`,{method:"POST",headers:{"Content-Type":"application/javascript"},body:w});if(!B.ok){let z=await B.text().catch(()=>"Unknown error");return{success:!1,error:`Browserless function call failed (${B.status}): ${z}`,url:N.url}}let L=await B.json().catch(async()=>{return{error:`Browserless returned non-JSON response: ${(await B.text().catch(()=>"")).slice(0,200)}`}}),D=JSON.stringify(L,null,2);X.set(K.toolCallId,D);let E=AX(D);if(!("error"in L)&&E>lO&&Q){let z=`inspect-pages/${crypto.randomUUID()}.json`;return await Q.put(z,new TextEncoder().encode(D),{contentType:"application/json"}),{success:!0,uri:R7(z),preview:FQ(D),url:N.url,tokenCount:E,consoleLogCount:L.consoleLogs?.length??0,errorCount:L.errors?.length??0,hasEvaluateResult:L.evaluateResult!=null}}return{success:!("error"in L),...L,url:N.url,tokenCount:E}}finally{$.write({type:"data-tool-metadata",id:K.toolCallId,data:{latencyMs:performance.now()-W}})}}})}function TS8($){let{writer:Z,toolOutputMap:X,objectStorage:Q,pendingImages:Y,imageTool:G}=$,J={user_ask:aj0,todo_write:sj0,propose_plan:$P0,read_tool_output:tj0({toolOutputMap:X})};if(G)J.generate_image=Ta("generate_image",Aa,QP0(Z,{...G,objectStorage:Q}),null);if(process.env.BROWSERLESS_TOKEN){if(J.scrape_url=AS8(Z,{toolOutputMap:X,objectStorage:Q,kind:"scrape"}),J.inspect_page=AS8(Z,{toolOutputMap:X,objectStorage:Q,kind:"inspect"}),Y)J.take_screenshot=YP0(Z,{objectStorage:Q,toolOutputMap:X,pendingImages:Y})}return J}var RS8=O(()=>{u4();U91();F91();w91();lU();l_();Xu();L91()});function P91($,Z=Date.now()){let X=new Date($.updated_at).getTime(),Q=$.last_progress_at?new Date($.last_progress_at).getTime():Number.NaN,Y=Math.max(Number.isFinite(X)?X:Number.NEGATIVE_INFINITY,Number.isFinite(Q)?Q:Number.NEGATIVE_INFINITY);return!Number.isFinite(Y)||Z-Y>1800000}function k3($,Z=Date.now()){let X=$.status;if(X==="in_progress"&&P91($,Z))X="expired";return{id:$.id,organization_id:$.organization_id,title:$.title,description:$.description,created_at:$.created_at,updated_at:$.updated_at,created_by:$.created_by,updated_by:$.updated_by,hidden:$.hidden??!1,status:X,virtual_mcp_id:$.virtual_mcp_id||void 0,trigger_id:$.trigger_id,branch:$.branch,sandbox_provider_kind:$.sandbox_provider_kind,harness_id:$.harness_id,metadata:$.metadata&&Object.keys($.metadata).length>0?$.metadata:void 0,run_config:$.run_config}}var IS8=1800000;var A91;var qS8=O(()=>{A91=["in_progress","requires_action","failed","completed"]});import{z as S8}from"zod";var MS8,Tc4,kS8,EH,VS8,SS8;var i_=O(()=>{qS8();MS8=S8.object({id:S8.string().describe("Unique message ID"),thread_id:S8.string().describe("ID of the parent thread"),metadata:S8.unknown().optional().describe("Optional message metadata"),parts:S8.array(S8.record(S8.string(),S8.unknown())).describe("Message content parts (AI SDK UIMessagePart format)"),role:S8.enum(["user","assistant","system"]).describe("Message role"),created_at:S8.string().datetime().describe("Timestamp of creation"),updated_at:S8.string().datetime().describe("Timestamp of last update")}),Tc4=S8.object({toolName:S8.string().describe("Fully qualified tool name"),appId:S8.string().describe("App ID that owns the tool"),args:S8.record(S8.string(),S8.unknown()).describe("Arguments used when expanding the tool"),expandedAt:S8.string().datetime().describe("When the tool was expanded")}),kS8=S8.object({expanded_tools:S8.array(Tc4).optional(),read_only:S8.boolean().optional().describe("The thread takes no further input (an autonomous run the user cannot continue)")}).catchall(S8.unknown()),EH=S8.object({id:S8.string().describe("Unique thread ID"),organization_id:S8.string().describe("Organization this thread belongs to"),title:S8.string().describe("Thread title"),description:S8.string().nullable().describe("Thread description"),created_at:S8.string().datetime().describe("Timestamp of creation"),updated_at:S8.string().datetime().describe("Timestamp of last update"),hidden:S8.boolean().optional().describe("Whether the thread is hidden"),status:S8.enum([...A91,"expired"]).describe("Thread execution status. 'expired' is virtual -- computed at read time for stale in_progress threads"),created_by:S8.string().describe("User ID who created the thread"),updated_by:S8.string().optional().describe("User ID who last updated the thread"),virtual_mcp_id:S8.string().optional().describe("Virtual MCP (agent) this thread was initiated with"),trigger_id:S8.string().nullable().optional().describe("Automation trigger that created this thread; null/absent for human-initiated threads."),branch:S8.string().nullable().optional().describe("Git branch this thread is pinned to (GitHub-linked vms only)"),sandbox_provider_kind:S8.string().nullable().optional().describe("Pinned on first message; identifies which sandbox provider to dispatch to (e.g. 'agent-sandbox', 'user-desktop')."),harness_id:S8.string().nullable().optional().describe("Pinned on first message; selects which harness runs the thread (e.g. 'claude-code', 'codex', 'decopilot')."),metadata:kS8.optional().describe("Free-form per-thread UI state (e.g. expanded_tools)"),run_config:S8.record(S8.string(),S8.unknown()).nullable().optional().describe("Persisted run configuration (contains agent and model info)")}),VS8=S8.object({id:S8.string().optional().describe("Optional custom ID for the thread"),title:S8.string().optional().describe("Thread title"),description:S8.string().nullish().describe("Thread description"),virtual_mcp_id:S8.string().describe("Virtual MCP (agent) this thread is bound to"),branch:S8.string().min(1).optional().describe("Preferred branch. Used only when the vMCP has a githubRepo; ignored otherwise. When omitted, the server picks the most-recently-touched branch from the user's sandboxMap, falling back to a freshly generated name.")}),SS8=S8.object({title:S8.string().optional().describe("New thread title"),description:S8.string().nullish().describe("New thread description"),hidden:S8.boolean().optional().describe("Whether the thread is hidden"),status:S8.enum(A91).optional().describe("New thread status (user-set override). 'expired' is a computed virtual status and cannot be set directly."),metadata:kS8.optional().describe("Full replacement of the thread's metadata object"),branch:S8.string().min(1).nullish().describe("New git branch for this thread"),virtual_mcp_id:S8.string().optional().describe("Re-point the thread at a different agent. Only meaningful for an unsent thread (changing the recipient of a new chat); the UI restricts it accordingly.")})});import{z as BG}from"zod";var Rc4,Ic4,n_;var T91=O(()=>{j3();t0();i_();Rc4=$K.extend({where:BG.object({created_by:BG.string().optional(),trigger_ids:BG.array(BG.string()).optional(),virtual_mcp_id:BG.string().optional(),hidden:BG.boolean().optional(),has_trigger:BG.boolean().optional()}).optional(),startDate:BG.string().datetime().optional().describe("Filter threads updated at or after this ISO timestamp"),endDate:BG.string().datetime().optional().describe("Filter threads updated at or before this ISO timestamp"),search:BG.string().optional().describe("Full-text search on thread title (case-insensitive)"),status:BG.string().optional().describe("Filter by thread status (e.g. completed, failed, in_progress)"),userId:BG.string().optional().describe("Filter by the user who created the thread"),agentId:BG.string().optional().describe("Filter by agent (connection or virtual MCP) ID")}),Ic4=AU(EH),n_=o({name:"COLLECTION_THREADS_LIST",description:"List threads with filtering, sorting, and pagination.",annotations:{title:"List Threads",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:Rc4,outputSchema:Ic4,handler:async($,Z)=>{await Z.access.check();let X=Z.auth.user?.id;if(!X)throw Error("User ID required to list threads");J0(Z);let Q=$.offset??0,Y=$.limit??100,G=$.where?.trigger_ids,J=$.where?.virtual_mcp_id,K=$.userId??($.where?.created_by==="me"?X:$.where?.created_by),{threads:W,total:H}=G?.length?await Z.storage.threads.listByTriggerIds(G,{limit:Y,offset:Q}):await Z.storage.threads.list(K,{limit:Y,offset:Q,virtualMcpId:J,startDate:$.startDate,endDate:$.endDate,search:$.search,status:$.status,agentId:$.agentId,includeArchived:$.where?.hidden,hasTrigger:$.where?.has_trigger}),N=Q+Y<H,U=Date.now();return{items:W.map((F)=>k3(F,U)),totalCount:H,hasMore:N}}})});var qc4,p_;var R91=O(()=>{j3();t0();i_();qc4=eo(EH),p_=o({name:"COLLECTION_THREADS_GET",description:"Get a thread's details and metadata by ID.",annotations:{title:"Get Thread",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:so,outputSchema:qc4,handler:async($,Z)=>{N0(Z),J0(Z),await Z.access.check();let X=await Z.storage.threads.get($.id);if(!X)return{item:null};return{item:k3(X)}}})});import{z as Mc4}from"zod";function CS8($){if(!$)return null;if("field"in $&&$.field[0]==="thread_id"&&$.operator==="eq")return String($.value);if("conditions"in $&&($.operator==="and"||$.operator==="or"))for(let Z of $.conditions){let X=CS8(Z);if(X)return X}return null}var kc4,Vc4,t_;var I91=O(()=>{j3();t0();i_();kc4=$K.extend({thread_id:Mc4.string().optional().describe("ID of the thread to list messages for (required)")}),Vc4=AU(MS8),t_=o({name:"COLLECTION_THREAD_MESSAGES_LIST",description:"List messages in a thread with pagination. Requires thread_id. Returns messages in chronological order.",annotations:{title:"List Thread Messages",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:kc4,outputSchema:Vc4,handler:async($,Z)=>{J0(Z),await Z.access.check();let X=$.thread_id??CS8($.where);if(!X)throw Error("thread_id is required (provide as top-level param or in where clause)");let Q=$.offset??0,Y=$.limit??100,G=$.orderBy?.[0]?.direction??"asc",J=await Z.storage.threads.get(X);if(!J)return{items:[],totalCount:0,hasMore:!1};if(J.message_storage_version===2){let{messages:N,total:U}=await Z.storage.threads.messageParts().loadWindow(X,{limit:Y,offset:Q,includeInFlight:!0});return{items:N.map((F)=>({id:F.id,thread_id:X,role:F.role,parts:F.parts,metadata:F.metadata??null,created_at:F.created_at,updated_at:F.created_at})),totalCount:U,hasMore:Q+Y<U}}let{messages:K,total:W}=await Z.storage.threads.listMessages(X,{limit:Y,offset:Q,sort:G}),H=Q+Y<W;return{items:K,totalCount:W,hasMore:H}}})});function _S8($){return{search_threads:l8({description:n_.description,inputSchema:K0(n_.inputSchema),execute:(Z)=>n_.execute(Z,$)}),get_thread:l8({description:p_.description,inputSchema:K0(p_.inputSchema),execute:(Z)=>p_.execute(Z,$)}),list_thread_messages:l8({description:t_.description,inputSchema:K0(t_.inputSchema),execute:(Z)=>t_.execute(Z,$)})}}var vS8=O(()=>{u4();T91();R91();I91()});async function Cc4($,Z,X){let{provider:Q,imageProvider:Y,webSearchProvider:G,deepResearchProvider:J,organization:K,models:W,toolApprovalLevel:H="auto",isPlanMode:N=!1,toolOutputMap:U,pendingImages:F,passthroughClient:w,vmContext:B,htmlArtifactBuffer:L,taskId:D,agentId:E,onChildUsage:z,backgroundDispatcher:j}=Z,A={isPlanMode:N},P=X.auth?.user?.id,q=TS8({writer:$,toolOutputMap:U,passthroughClient:w,toolApprovalLevel:H,isPlanMode:N,objectStorage:X.objectStorage});if(P)q.update_interests=eV8({write:async(C)=>{await X.storage.interests.setForAgent(C.orgId,C.agentId,C.userId,{interests:C.interests})},orgId:K.id,agentId:E,userId:P});Object.assign(q,_S8(X));let k=Ea(H,!1,A)!==!1,M;if(B){let C=await th(X,{virtualMcpId:B.virtualMcpId,branch:B.branch,userId:B.userId,syncTools:B.syncTools,threadId:B.threadId}),d=aV8(C);M=oV8({fs:d.fs,htmlArtifactBuffer:L,toolOutputMap:U,needsApproval:k,pendingImages:F,ctx:X,threadId:B.threadId,virtualMcpId:B.virtualMcpId}),Object.assign(q,M);let v=await Yk8({ctx:X,orgId:K.id,virtualMcpId:B.virtualMcpId,userId:B.userId,threadId:B.threadId,writer:$,rebindFs:async(b)=>{d.swap(await th(X,{virtualMcpId:B.virtualMcpId,branch:b,userId:B.userId,syncTools:B.syncTools,threadId:B.threadId}))}});if(v)q.load_repo=v}if(Q)q.subtask=Ta("subtask",M91,k91($,{provider:Q,organization:K,models:W,self:{id:E},currentThreadId:D,needsApproval:Ea(H,!1,A)!==!1,onChildUsage:z,vmTools:M,parentBuiltInParams:Z},X),j,(C)=>WS8(D,C));if(Y&&W.image&&X.objectStorage)q.generate_image=Ta("generate_image",Aa,GS8($,{provider:Y,imageModelInfo:W.image,objectStorage:X.objectStorage,allowHttpExternalUrls:Z1().localMode}),j);if(G&&W.webSearch){let C=j91({provider:G,modelInfo:W.webSearch,ctx:X,mode:"quick",toolName:"web_search"});q.web_search=z91($,{researchJob:C,toolOutputMap:U,taskId:D})}if(J&&W.deepResearch){let C=j91({provider:J,modelInfo:W.deepResearch,ctx:X,mode:"deep",toolName:"deep_research"});q.deep_research=z91($,{researchJob:C,toolOutputMap:U,taskId:D,description:"Run in-depth, multi-source research and synthesize a comprehensive, cited report. Use this when the user needs thorough analysis, a literature/market review, or a question that warrants exploring many "+"sources \u2014 accuracy and depth matter more than latency. For quick "+"lookups or fact-checks, use `web_search` instead."})}if(process.env.BROWSERLESS_TOKEN){let C={baseUrl:d_,token:process.env.BROWSERLESS_TOKEN};if(q.take_screenshot=BS8($,{objectStorage:X.objectStorage,toolOutputMap:U,pendingImages:F}),X.objectStorage)q.scrape_url=DS8($,{browserless:C,objectStorage:X.objectStorage,toolOutputMap:U}),q.inspect_page=jS8($,{browserless:C,objectStorage:X.objectStorage,toolOutputMap:U})}return q}function _c4($,Z,X){let Q=Z.organization.id,Y=X.auth?.user?.id,G={};for(let[J,K]of Object.entries($)){let W=K,H=W.execute;if(typeof H!=="function"){G[J]=K;continue}let N=Sc4[J],U=H.constructor?.name==="AsyncGeneratorFunction",F=(B,L)=>{if(!Q||!Y)return;n1.capture({distinctId:Y,event:"tool_called",groups:{organization:Q},properties:{organization_id:Q,tool_source:"builtin",tool_name:J,tool_safe_name:J,read_only:N?.readOnly??null,destructive:N?.destructive??null,idempotent:null,open_world:null,latency_ms:Math.round(B),is_error:L}})},w=U?async function*(B,L){let D=performance.now(),E=!1;try{yield*H.call(W,B,L)}catch(z){throw E=!0,z}finally{F(performance.now()-D,E)}}:async(B,L)=>{let D=performance.now(),E=!1;try{return await H.call(W,B,L)}catch(z){throw E=!0,z}finally{F(performance.now()-D,E)}};G[J]={...W,execute:w}}return G}async function JP0($,Z,X){let Q=await Cc4($,Z,X),Y=_c4(Q,Z,X);if(!Z.isPlanMode){let{propose_plan:G,...J}=Y;return J}return Y}function xS8($){let{ctx:Z,writer:X,toolOutputMap:Q,subtaskParams:Y,planMode:G}=$,J={user_ask:aj0,todo_write:sj0,read_tool_output:tj0({toolOutputMap:Q})};if(G)J.propose_plan=$P0;if(Y.provider)J.subtask=k91(X,Y,Z);return J}var Sc4;var q91=O(()=>{_$();za();lU();rV8();vj0();xj0();V91();U91();F91();$S8();w91();JS8();L91();E91();Xu();NS8();wS8();OS8();ES8();PS8();RS8();vS8();b8();Sc4={read_tool_output:{readOnly:!0,destructive:!1},read_resource:{readOnly:!0,destructive:!1},read_prompt:{readOnly:!0,destructive:!1},web_search:{readOnly:!0,destructive:!1},deep_research:{readOnly:!0,destructive:!1},generate_image:{readOnly:!1,destructive:!1},open_in_agent:{readOnly:!1,destructive:!1},subtask:{readOnly:!1,destructive:!1},user_ask:{readOnly:!0,destructive:!1},propose_plan:{readOnly:!0,destructive:!1},enable_tool:{readOnly:!0,destructive:!1},todo_write:{readOnly:!1,destructive:!1},update_interests:{readOnly:!1,destructive:!1},load_repo:{readOnly:!1,destructive:!0},search_threads:{readOnly:!0,destructive:!1},get_thread:{readOnly:!0,destructive:!1},list_thread_messages:{readOnly:!0,destructive:!1}}});async function fS8($){let Z=$.toolOutputMap??new Map,{tools:X,nameMap:Q}=await rj0($.mcpClient,Z,$.writer,$.toolApprovalLevel,{disableOutputTruncation:!1,isPlanMode:$.planMode,timeoutMs:pj0,resolveArgs:$.resolveArgs,onToolCalled:$.onToolCalled,onPrOpened:$.onPrOpened}),Y=$.fullBuiltInParams?await JP0($.writer,{...$.fullBuiltInParams,toolOutputMap:Z},$.ctx):xS8({ctx:$.ctx,writer:$.writer,toolOutputMap:Z,subtaskParams:$.subtaskParams,planMode:$.planMode}),G=$.kind==="subagent"?Object.fromEntries(Object.entries(Y).filter(([K])=>!vc4.includes(K))):Y;return{tools:{...X,...G},toolOutputMap:Z,nameMap:Q}}var vc4;var bS8=O(()=>{za();q91();vc4=["subtask","user_ask","propose_plan"]});var WP0={};w0(WP0,{waitForSeed:()=>dc4,seedLocalMode:()=>uc4,pruneUndecryptableJwks:()=>hS8,markSeedComplete:()=>lc4,isLocalMode:()=>zH,healLocalJwks:()=>yc4,getLocalAdminUser:()=>S91,getLocalAdminPassword:()=>KP0});import{symmetricDecrypt as xc4}from"better-auth/crypto";import{sql as yS8}from"kysely";import{userInfo as fc4}from"os";async function yc4(){let $=Z1();if(!$.localMode)return 0;if(!$.betterAuthSecret)return 0;return hS8(H6().db,$.betterAuthSecret)}async function hS8($,Z){let X;try{X=(await yS8`
       select id, "privateKey" from jwks
     `.execute($)).rows}catch(Y){if(Y?.code==="42P01")return 0;return console.warn("[local-mode] JWKS heal skipped \u2014 could not read jwks:",Y),0}let Q=0;for(let Y of X){let G=!0;try{await xc4({key:Z,data:JSON.parse(Y.privateKey)})}catch{G=!1}if(G)continue;try{await yS8`delete from jwks where id = ${Y.id}`.execute($),Q++}catch(J){console.warn(`[local-mode] JWKS heal could not delete stale key ${Y.id}:`,J)}}return Q}async function KP0(){return"local-mode-default"}function uS8(){try{return fc4().username||"local"}catch{return"local"}}function gc4($){return $.charAt(0).toUpperCase()+$.slice(1)}async function hc4(){let $=H6(),Z=await $.db.selectFrom("user").select($.db.fn.countAll().as("count")).executeTakeFirst();return Number(Z?.count??0)===0}async function uc4(){if(!await hc4())return!1;let Z=uS8(),X=`${Z}@${gS8}`,Q=gc4(Z),Y=await KP0(),G=await M6.api.signUpEmail({body:{email:X,password:Y,name:Q}});if(!G?.user?.id)throw Error("Failed to create local admin user");let J=G.user.id,K=H6();await K.db.updateTable("user").set({role:"admin"}).where("id","=",J).execute();let W=`${Z}-local`.toLowerCase().replace(/[^a-z0-9-]/g,"-").replace(/-+/g,"-").replace(/^-|-$/g,""),H=`${Q} Local`;return await K.db.updateTable("organization").set({name:H,slug:W}).where("id","in",(N)=>N.selectFrom("member").select("organizationId").where("userId","=",J)).execute(),!0}async function S91(){let $=H6(),Z=uS8(),X=await $.db.selectFrom("user").where("email","=",`${Z}@${gS8}`).selectAll().executeTakeFirst();if(X)return X;return $.db.selectFrom("user").where("email","=",`${Z}@${bc4}`).selectAll().executeTakeFirst()}function zH(){return Z1().localMode}function lc4(){cS8()}function dc4(){return cc4}var gS8="localhost.studio",bc4="localhost.mesh",cS8,cc4;var o_=O(()=>{n7();b8();E3();cc4=new Promise(($)=>{if(cS8=$,!zH())$()})});var lS8=O(()=>{l_()});function ic4($){return $.type==="file"&&"mediaType"in $&&typeof $.mediaType==="string"&&mc4.has($.mediaType)}function pS8($){let Z=$.match(/^data:([^;]+);base64,(.+)$/s);if(!Z)return null;let[,X,Q]=Z;try{let Y=atob(Q),G=new Uint8Array(Y.length);for(let J=0;J<Y.length;J++)G[J]=Y.charCodeAt(J);return{mimeType:X,bytes:G}}catch{return null}}function C91($){return{"image/png":"png","image/jpeg":"jpg","image/gif":"gif","image/webp":"webp","image/svg+xml":"svg","application/pdf":"pdf","text/plain":"txt","text/html":"html","application/json":"json"}[$]??"bin"}async function nc4($,Z,X,Q){if(!Q.objectStorage)return null;try{return await Q.objectStorage.put(Z,$,{contentType:X}),Z}catch(Y){return console.error("[file-materializer] Failed to upload file:",Y),null}}async function Ia($,Z){if(!Z.objectStorage)return null;try{return await Z.objectStorage.presignedGetUrl($,pc4)}catch(X){return console.error("[file-materializer] Failed to generate presigned URL:",X),null}}function tS8($){try{return decodeURIComponent($)}catch{return $}}function mS8($,Z){let X=typeof $.filename==="string"&&$.filename.trim()?$.filename:`attachment.${C91(Z)}`,Q=X.match(tc4);if(Q?.[1])X=tS8(Q[1]);return[...X.split(/[\\/]/).pop()??X].filter((J)=>(J.codePointAt(0)??0)>=32).join("").trim()||`attachment.${C91(Z)}`}function iS8($,Z){if(!Z.has($))return Z.add($),$;let X=$.lastIndexOf("."),Q=X>0?$.slice(0,X):$,Y=X>0?$.slice(X):"";for(let G=2;;G++){let J=`${Q} (${G})${Y}`;if(!Z.has(J))return Z.add(J),J}}async function nS8($,Z,X,Q,Y){if(!Y||!Q.orgFs)return console.warn("[file-materializer] uploads-volume write skipped",{hasThreadId:Boolean(Y),hasOrgFs:Boolean(Q.orgFs)}),null;try{let G=`${Y}/${X}`;return await Q.orgFs.write("uploads",G,$,{actor:Q.auth?.user?.id??"unknown",contentType:Z}),{key:KW("uploads",G),sandboxPath:`org/upload/${X}`}}catch(G){return console.error("[file-materializer] uploads-volume write failed:",G),null}}async function HP0($,Z,X){if(!Z.organization)return $;let Q=Z.organization.slug;if(!Q)return $;let Y=$.findLastIndex((A)=>A.role==="user");if(Y===-1)return $;let G=$[Y],J=G.parts.filter((A)=>A.type==="file"&&("url"in A)&&typeof A.url==="string"&&A.url.startsWith("data:")),W=Boolean(X?.threadId&&Z.orgFs)?G.parts.flatMap((A)=>{if(A.type!=="text"||!("text"in A)||typeof A.text!=="string")return[];let P=A.text.match(oc4);if(!P?.[1]||P[2]===void 0)return[];return[{name:tS8(P[1]),content:P[2]}]}):[];if(J.length===0&&W.length===0)return $;let H=new Set,N=J.flatMap((A)=>{if(A.type!=="file"||!("url"in A)||typeof A.url!=="string")return[];let P=pS8(A.url);if(!P)return[];let q=iS8(mS8(A,P.mimeType),H);return[{dataUrl:A.url,parsed:P,filename:q}]}),U=W.map(({name:A,content:P})=>({filename:iS8(mS8({filename:A},"text/plain"),H),content:P})),w=(await Promise.all([...N.map(async({dataUrl:A,parsed:P,filename:q})=>{let k=await nS8(P.bytes,P.mimeType,q,Z,X?.threadId);if(!k)return null;return{dataUrl:A,studioStorageUrl:R7(k.key),redirectUrl:nf(Z.baseUrl,Q,k.key),filename:q,sandboxPath:k.sandboxPath}}),...U.map(async({filename:A,content:P})=>{let q=await nS8(new TextEncoder().encode(P),_Z(A),A,Z,X?.threadId);if(!q)return null;return{dataUrl:null,studioStorageUrl:R7(q.key),redirectUrl:nf(Z.baseUrl,Q,q.key),filename:A,sandboxPath:q.sandboxPath}})])).filter((A)=>A!==null);if(w.length===0)return $;let B=w.map((A)=>A.sandboxPath?`- ${A.filename}: ${A.sandboxPath} (tool URL: ${A.studioStorageUrl})`:`- ${A.filename}: ${A.studioStorageUrl}`).join(`
 `),L=w.some((A)=>A.sandboxPath)?`[Attached files \u2014 already inside your sandbox; read them at the given path. The tool URL is only for tools that take a URL argument]