decocms 4.193.0 → 4.193.2

package/dist/server/server.js

@@ -1193,8 +1193,8 @@ ${H}`:H;return{...J,description:N,inputExamples:X?void 0:J.inputExamples}});retu
 
 `)},flush($){$.enqueue(`data: [DONE]
 
-`)}})}},$m0={"content-type":"text/event-stream","cache-control":"no-cache",connection:"keep-alive","x-vercel-ai-ui-message-stream":"v1","x-accel-buffering":"no"};On=e0.record(e0.string(),iL.optional()),Zm0=U0(()=>s(e0.union([e0.strictObject({type:e0.literal("text-start"),id:e0.string(),providerMetadata:H$.optional()}),e0.strictObject({type:e0.literal("text-delta"),id:e0.string(),delta:e0.string(),providerMetadata:H$.optional()}),e0.strictObject({type:e0.literal("text-end"),id:e0.string(),providerMetadata:H$.optional()}),e0.strictObject({type:e0.literal("error"),errorText:e0.string()}),e0.strictObject({type:e0.literal("tool-input-start"),toolCallId:e0.string(),toolName:e0.string(),providerExecuted:e0.boolean().optional(),providerMetadata:H$.optional(),toolMetadata:On.optional(),dynamic:e0.boolean().optional(),title:e0.string().optional()}),e0.strictObject({type:e0.literal("tool-input-delta"),toolCallId:e0.string(),inputTextDelta:e0.string()}),e0.strictObject({type:e0.literal("tool-input-available"),toolCallId:e0.string(),toolName:e0.string(),input:e0.unknown(),providerExecuted:e0.boolean().optional(),providerMetadata:H$.optional(),toolMetadata:On.optional(),dynamic:e0.boolean().optional(),title:e0.string().optional()}),e0.strictObject({type:e0.literal("tool-input-error"),toolCallId:e0.string(),toolName:e0.string(),input:e0.unknown(),providerExecuted:e0.boolean().optional(),providerMetadata:H$.optional(),toolMetadata:On.optional(),dynamic:e0.boolean().optional(),errorText:e0.string(),title:e0.string().optional()}),e0.strictObject({type:e0.literal("tool-approval-request"),approvalId:e0.string(),toolCallId:e0.string(),signature:e0.string().optional()}),e0.strictObject({type:e0.literal("tool-output-available"),toolCallId:e0.string(),output:e0.unknown(),providerExecuted:e0.boolean().optional(),providerMetadata:H$.optional(),toolMetadata:On.optional(),dynamic:e0.boolean().optional(),preliminary:e0.boolean().optional()}),e0.strictObject({type:e0.literal("tool-output-error"),toolCallId:e0.string(),errorText:e0.string(),providerExecuted:e0.boolean().optional(),providerMetadata:H$.optional(),toolMetadata:On.optional(),dynamic:e0.boolean().optional()}),e0.strictObject({type:e0.literal("tool-output-denied"),toolCallId:e0.string()}),e0.strictObject({type:e0.literal("reasoning-start"),id:e0.string(),providerMetadata:H$.optional()}),e0.strictObject({type:e0.literal("reasoning-delta"),id:e0.string(),delta:e0.string(),providerMetadata:H$.optional()}),e0.strictObject({type:e0.literal("reasoning-end"),id:e0.string(),providerMetadata:H$.optional()}),e0.strictObject({type:e0.literal("source-url"),sourceId:e0.string(),url:e0.string(),title:e0.string().optional(),providerMetadata:H$.optional()}),e0.strictObject({type:e0.literal("source-document"),sourceId:e0.string(),mediaType:e0.string(),title:e0.string(),filename:e0.string().optional(),providerMetadata:H$.optional()}),e0.strictObject({type:e0.literal("file"),url:e0.string(),mediaType:e0.string(),providerMetadata:H$.optional()}),e0.strictObject({type:e0.custom(($)=>typeof $==="string"&&$.startsWith("data-"),{message:'Type must start with "data-"'}),id:e0.string().optional(),data:e0.unknown(),transient:e0.boolean().optional()}),e0.strictObject({type:e0.literal("start-step")}),e0.strictObject({type:e0.literal("finish-step")}),e0.strictObject({type:e0.literal("start"),messageId:e0.string().optional(),messageMetadata:e0.unknown().optional()}),e0.strictObject({type:e0.literal("finish"),finishReason:e0.enum(["stop","length","content-filter","tool-calls","error","other"]).optional(),messageMetadata:e0.unknown().optional()}),e0.strictObject({type:e0.literal("abort"),reason:e0.string().optional()}),e0.strictObject({type:e0.literal("message-metadata"),messageMetadata:e0.unknown()})])));p84=CG;t84=Ln;r84=pJ({prefix:"aitxt",size:24}),a84={file:!0,source:!0,"text-start":!0,"text-end":!0,"text-delta":!0,"reasoning-start":!0,"reasoning-end":!0,"reasoning-delta":!0,"tool-input-start":!0,"tool-input-end":!0,"tool-input-delta":!0,"tool-approval-request":!0,"tool-call":!0,"tool-result":!0,"tool-error":!0,"stream-start":!1,"response-metadata":!1,finish:!1,error:!1,raw:!1};IQ=J0.record(J0.string(),iL.optional()),X44=U0(()=>s(J0.array(J0.object({id:J0.string(),role:J0.enum(["system","user","assistant"]),metadata:J0.unknown().optional(),parts:J0.array(J0.union([J0.object({type:J0.literal("text"),text:J0.string(),state:J0.enum(["streaming","done"]).optional(),providerMetadata:H$.optional()}),J0.object({type:J0.literal("reasoning"),text:J0.string(),state:J0.enum(["streaming","done"]).optional(),providerMetadata:H$.optional()}),J0.object({type:J0.literal("source-url"),sourceId:J0.string(),url:J0.string(),title:J0.string().optional(),providerMetadata:H$.optional()}),J0.object({type:J0.literal("source-document"),sourceId:J0.string(),mediaType:J0.string(),title:J0.string(),filename:J0.string().optional(),providerMetadata:H$.optional()}),J0.object({type:J0.literal("file"),mediaType:J0.string(),filename:J0.string().optional(),url:J0.string(),providerMetadata:H$.optional()}),J0.object({type:J0.literal("step-start")}),J0.object({type:J0.string().startsWith("data-"),id:J0.string().optional(),data:J0.unknown()}),J0.object({type:J0.literal("dynamic-tool"),toolName:J0.string(),toolCallId:J0.string(),toolMetadata:IQ.optional(),state:J0.literal("input-streaming"),input:J0.unknown().optional(),providerExecuted:J0.boolean().optional(),callProviderMetadata:H$.optional(),output:J0.never().optional(),errorText:J0.never().optional(),approval:J0.never().optional()}),J0.object({type:J0.literal("dynamic-tool"),toolName:J0.string(),toolCallId:J0.string(),toolMetadata:IQ.optional(),state:J0.literal("input-available"),input:J0.unknown(),providerExecuted:J0.boolean().optional(),output:J0.never().optional(),errorText:J0.never().optional(),callProviderMetadata:H$.optional(),approval:J0.never().optional()}),J0.object({type:J0.literal("dynamic-tool"),toolName:J0.string(),toolCallId:J0.string(),toolMetadata:IQ.optional(),state:J0.literal("approval-requested"),input:J0.unknown(),providerExecuted:J0.boolean().optional(),output:J0.never().optional(),errorText:J0.never().optional(),callProviderMetadata:H$.optional(),approval:J0.object({id:J0.string(),approved:J0.never().optional(),reason:J0.never().optional(),signature:J0.string().optional()})}),J0.object({type:J0.literal("dynamic-tool"),toolName:J0.string(),toolCallId:J0.string(),toolMetadata:IQ.optional(),state:J0.literal("approval-responded"),input:J0.unknown(),providerExecuted:J0.boolean().optional(),output:J0.never().optional(),errorText:J0.never().optional(),callProviderMetadata:H$.optional(),approval:J0.object({id:J0.string(),approved:J0.boolean(),reason:J0.string().optional(),signature:J0.string().optional()})}),J0.object({type:J0.literal("dynamic-tool"),toolName:J0.string(),toolCallId:J0.string(),toolMetadata:IQ.optional(),state:J0.literal("output-available"),input:J0.unknown(),providerExecuted:J0.boolean().optional(),output:J0.unknown(),errorText:J0.never().optional(),callProviderMetadata:H$.optional(),resultProviderMetadata:H$.optional(),preliminary:J0.boolean().optional(),approval:J0.object({id:J0.string(),approved:J0.literal(!0),reason:J0.string().optional(),signature:J0.string().optional()}).optional()}),J0.object({type:J0.literal("dynamic-tool"),toolName:J0.string(),toolCallId:J0.string(),toolMetadata:IQ.optional(),state:J0.literal("output-error"),input:J0.unknown().optional(),rawInput:J0.unknown().optional(),providerExecuted:J0.boolean().optional(),output:J0.never().optional(),errorText:J0.string(),callProviderMetadata:H$.optional(),resultProviderMetadata:H$.optional(),approval:J0.object({id:J0.string(),approved:J0.literal(!0),reason:J0.string().optional(),signature:J0.string().optional()}).optional()}),J0.object({type:J0.literal("dynamic-tool"),toolName:J0.string(),toolCallId:J0.string(),toolMetadata:IQ.optional(),state:J0.literal("output-denied"),input:J0.unknown(),providerExecuted:J0.boolean().optional(),output:J0.never().optional(),errorText:J0.never().optional(),callProviderMetadata:H$.optional(),approval:J0.object({id:J0.string(),approved:J0.literal(!1),reason:J0.string().optional(),signature:J0.string().optional()})}),J0.object({type:J0.string().startsWith("tool-"),toolCallId:J0.string(),toolMetadata:IQ.optional(),state:J0.literal("input-streaming"),providerExecuted:J0.boolean().optional(),callProviderMetadata:H$.optional(),input:J0.unknown().optional(),output:J0.never().optional(),errorText:J0.never().optional(),approval:J0.never().optional()}),J0.object({type:J0.string().startsWith("tool-"),toolCallId:J0.string(),toolMetadata:IQ.optional(),state:J0.literal("input-available"),providerExecuted:J0.boolean().optional(),input:J0.unknown(),output:J0.never().optional(),errorText:J0.never().optional(),callProviderMetadata:H$.optional(),approval:J0.never().optional()}),J0.object({type:J0.string().startsWith("tool-"),toolCallId:J0.string(),toolMetadata:IQ.optional(),state:J0.literal("approval-requested"),input:J0.unknown(),providerExecuted:J0.boolean().optional(),output:J0.never().optional(),errorText:J0.never().optional(),callProviderMetadata:H$.optional(),approval:J0.object({id:J0.string(),approved:J0.never().optional(),reason:J0.never().optional(),signature:J0.string().optional()})}),J0.object({type:J0.string().startsWith("tool-"),toolCallId:J0.string(),toolMetadata:IQ.optional(),state:J0.literal("approval-responded"),input:J0.unknown(),providerExecuted:J0.boolean().optional(),output:J0.never().optional(),errorText:J0.never().optional(),callProviderMetadata:H$.optional(),approval:J0.object({id:J0.string(),approved:J0.boolean(),reason:J0.string().optional(),signature:J0.string().optional()})}),J0.object({type:J0.string().startsWith("tool-"),toolCallId:J0.string(),toolMetadata:IQ.optional(),state:J0.literal("output-available"),providerExecuted:J0.boolean().optional(),input:J0.unknown(),output:J0.unknown(),errorText:J0.never().optional(),callProviderMetadata:H$.optional(),resultProviderMetadata:H$.optional(),preliminary:J0.boolean().optional(),approval:J0.object({id:J0.string(),approved:J0.literal(!0),reason:J0.string().optional(),signature:J0.string().optional()}).optional()}),J0.object({type:J0.string().startsWith("tool-"),toolCallId:J0.string(),toolMetadata:IQ.optional(),state:J0.literal("output-error"),providerExecuted:J0.boolean().optional(),input:J0.unknown().optional(),rawInput:J0.unknown().optional(),output:J0.never().optional(),errorText:J0.string(),callProviderMetadata:H$.optional(),resultProviderMetadata:H$.optional(),approval:J0.object({id:J0.string(),approved:J0.literal(!0),reason:J0.string().optional(),signature:J0.string().optional()}).optional()}),J0.object({type:J0.string().startsWith("tool-"),toolCallId:J0.string(),toolMetadata:IQ.optional(),state:J0.literal("output-denied"),providerExecuted:J0.boolean().optional(),input:J0.unknown(),output:J0.never().optional(),errorText:J0.never().optional(),callProviderMetadata:H$.optional(),approval:J0.object({id:J0.string(),approved:J0.literal(!1),reason:J0.string().optional(),signature:J0.string().optional()})})])).nonempty("Message must contain at least one part")})).nonempty("Messages array must not be empty")));F44=k90,U44={type:"no-schema",jsonSchema:async()=>{return},async validatePartialResult({value:$,textDelta:Z}){return{success:!0,value:{partial:$,textDelta:Z}}},async validateFinalResult($,Z){return $===void 0?{success:!1,error:new MQ({message:"No object generated: response did not match schema.",text:Z.text,response:Z.response,usage:Z.usage,finishReason:Z.finishReason})}:{success:!0,value:$}},createElementStream(){throw new T4({functionality:"element streams in no-schema mode"})}};D44=pJ({prefix:"aiobj",size:24});P44=pJ({prefix:"aiobj",size:24});R44=class extends Cw{constructor({data:$,mediaType:Z}){super({data:$,mediaType:Z});let X="mp3";if(Z){let Q=Z.split("/");if(Q.length===2){if(Z!=="audio/mpeg")X=Q[1]}}if(!X)throw Error("Audio format must be provided or determinable from media type");this.format=X}};M44={word:/\S+\s+/m,line:/\n+/m};S44=Wm0();p44=c6$,d6$=`vercel.ai.error.${l6$}`,t44=Symbol.for(d6$),i6$=class extends q5{constructor({modelId:$,modelType:Z,providerId:X,availableProviders:Q,message:Y=`No such provider: ${X} (available providers: ${Q.join()})`}){super({errorName:l6$,modelId:$,modelType:Z,message:Y});this[m6$]=!0,this.providerId=X,this.availableProviders=Q}static isInstance($){return G1.hasMarker($,d6$)}};m6$=t44;o44=n6$;s44=Wm0();t6$=class extends Nm0{constructor($={}){super($)}processResponseStream($){return mH({stream:$,schema:Zm0}).pipeThrough(new TransformStream({async transform(Z,X){if(!Z.success)throw Z.error;X.enqueue(Z.value)}}))}};H64=class extends Nm0{constructor($={}){super($)}processResponseStream($){return K64({stream:$.pipeThrough(new TextDecoderStream)})}}});import{z as N64}from"zod";function aL($){return $==="cluster"?"agent-sandbox":$}function Um0($){return`${$.userId}:${$.projectRef}`}var F64;var S90=B(()=>{F64=N64.enum(["agent-sandbox","user-desktop"])});class V90{map=new Map;async run($,Z){let X=this.map.get($);if(X)return X;let Q=Z();this.map.set($,Q);try{return await Q}finally{this.map.delete($)}}}function C90($,Z,X,Q){if(!$)return Q(null);if(!$.withLock)return Q($);return $.withLock(Z,X,Q)}function In($){if("threadId"in $){if(!$.threadId)throw Error("composeSandboxRef: threadId required");return`thread:${$.threadId}`}if(!$.orgId||!$.virtualMcpId||!$.branch)throw Error("composeSandboxRef: orgId, virtualMcpId and branch are all required for agent refs");return`agent:${$.orgId}:${$.virtualMcpId}:${$.branch}`}function o6$($){if($.startsWith("thread:"))return $.slice(7);if(!$.startsWith("agent:"))return"";let Z=$.split(":");return Z.length>=4?Z.slice(3).join(":"):""}import{createHash as U64}from"crypto";function O64($,Z=16){return U64("sha256").update(Um0($)).digest("hex").slice(0,Z)}function sL($){let Z=O64($),X=B64(o6$($.projectRef));return X?`${X}-${Z}`:`s-${Z}`}function B64($){if(!$)return"";return($.split("/").pop()??"").toLowerCase().replace(/[^a-z0-9]+/g,"-").replace(/^-+|-+$/g,"").slice(0,w64).replace(/-+$/g,"")}var w64=24;var r6$=B(()=>{S90()});function _90($,Z){let X=$.replace(/\/+$/,"");if(X.includes("{handle}"))return`${X.replace("{handle}",Z)}/`;try{let Q=new URL(X);return Q.hostname=`${Z}.${Q.hostname}`,`${Q.toString()}/`}catch{return`${X}/${Z}/`}}function qn($){let Z=$?.userName?.trim();if(!Z||a6$.test(Z))return null;let X=$?.userEmail?.trim();if(!X||a6$.test(X))return{userName:Z};if(!D64.test(X))return{userName:Z};return{userName:Z,userEmail:X}}var a6$,D64;var wm0=B(()=>{a6$=/[\r\n<>]/,D64=/^[^\s@<>]+@[^\s@<>]+\.[^\s@<>]+$/});function v90($){let Z=$.repo,X=Z?{repository:{cloneUrl:Z.cloneUrl,repoName:Z.displayName??L64(Z.cloneUrl),...Z.branch?{branch:Z.branch}:{},...Z.submoduleCredentials&&Z.submoduleCredentials.length>0?{submoduleCredentials:Z.submoduleCredentials}:{}},...Z.userName.trim()||Z.userEmail.trim()?{identity:{userName:Z.userName,userEmail:Z.userEmail}}:{}}:void 0,Q=$.tenant,Y=qn({userName:Q?.userName,userEmail:Q?.userEmail})??void 0,G=$.packageManager?{name:$.packageManager.name,...$.packageManager.path?{path:$.packageManager.path}:{}}:void 0,J=G?{packageManager:G,runtime:$.runtime,...$.port!==void 0?{port:$.port}:{}}:void 0;if(!X&&!J&&!Y&&!$.cloneOnly)return null;return{...X?{git:X}:{},...Y?{operator:Y}:{},...$.cloneOnly!==void 0?{cloneOnly:$.cloneOnly}:{},...J?{application:J}:{}}}function L64($){try{let Z=new URL($);return Z.pathname.replace(/^\/+/,"").replace(/\.git$/,"")||Z.hostname}catch{return $}}var s6$=B(()=>{wm0()});function E64($){try{return new URL($).username.length>0}catch{return!1}}function Om0($){let Z=$.repo?.cloneUrl;if(!Z||!E64(Z))return null;return{git:{repository:{cloneUrl:Z}}}}var Bm0=B(()=>{r6$();s6$()});function j64($){return(typeof $.timeout==="number"&&$.timeout>0?Math.min($.timeout,120000):30000)+15000}function z64($,Z){if($.aborted)return Z.catch(()=>{}),Promise.reject($.reason??Error("aborted"));return new Promise((X,Q)=>{let Y=()=>{Z.catch(()=>{}),Q($.reason??Error("aborted"))};$.addEventListener("abort",Y,{once:!0}),Z.then(X,Q).finally(()=>{$.removeEventListener("abort",Y)})})}async function P64($,Z,X,Q,Y="POST",G){let J=G?.timeoutMs??j64(Q??{}),W=AbortSignal.timeout(J),K=G?.signal?AbortSignal.any([G.signal,W]):W,H,N;try{let U={method:Y,headers:new Headers({"content-type":"application/json"}),body:null,signal:K};if(Y!=="GET"&&Q!==null)U.body=JSON.stringify(Q);({res:H,rawText:N}=await z64(K,(async()=>{let w=await $.proxyDaemonRequest(Z,X,U);return{res:w,rawText:await w.text()}})()))}catch(U){if(G?.signal?.aborted)throw U;if(W.aborted)throw Error(`Sandbox ${Y} ${X} timed out after ${Math.round(J/1000)}s \u2014 the sandbox may be overloaded or its filesystem stalled. Retry, or use a smaller operation.`);throw new Mn(U)}let F;try{F=JSON.parse(N)}catch{console.error("[sandbox-fs-hooks] Failed to parse JSON response runner=%s path=%s status=%d rawText=%s",$.kind,X,H.status,N.slice(0,2000));let U=H.status>=500?" (server error)":H.status===0?" (no response)":"";throw Error(`Daemon ${X} returned invalid JSON (HTTP ${H.status}${U}): ${N.slice(0,800)}`)}if(!H.ok){console.error("[sandbox-fs-hooks] Non-OK response runner=%s path=%s status=%d body=%s",$.kind,X,H.status,N.slice(0,2000));let U=F.error??`Daemon ${X} failed (${H.status})`;if(H.status===404&&U==="sandbox not found")throw new Mn(Error(U),!0);throw Error(U)}return F}function A64($){let Z=[];for(let X of $.split(`
-`)){if(!X)continue;let Q=X.indexOf(":");if(Q<0)continue;let Y=X.indexOf(":",Q+1);if(Y<0)continue;let G=X.slice(0,Q),J=Number.parseInt(X.slice(Q+1,Y),10);if(!Number.isFinite(J))continue;Z.push({file:G,line:J,text:X.slice(Y+1)})}return Z}function Dm0($,Z){let{ensureHandle:X,invalidateHandle:Q,canAutoRestart:Y}=Z,G=(W)=>{let K=W instanceof Error?W.message:String(W);return Y?`Sandbox is unreachable and auto-restart did not recover it: ${K}`:"The sandbox is not running. Ask the user to start it by clicking the server button (left side of the header bar)."},J=async(W,K,H="POST",N)=>{let F=async(w)=>P64($,w,W,K,H,{signal:N,timeoutMs:Z.opTimeoutMs}),U=await X();try{return await F(U)}catch(w){if(!(w instanceof Mn))throw w;if(!Y&&!w.gone)throw Error(G(w.cause??w));console.warn(`[sandbox-fs-hooks] daemon ${W} unreachable \u2014 reaping sandbox and retrying once`,w.cause??w);try{await Q({force:w.gone})}catch(D){console.warn("[sandbox-fs-hooks] invalidateHandle failed",D)}let O;try{O=await X()}catch(D){throw Error(`Failed to restart sandbox: ${D instanceof Error?D.message:String(D)}`)}try{return await F(O)}catch(D){if(D instanceof Mn)throw Error(G(D.cause??D));throw D}}};return{onProxy:(W,K,H,N)=>J(W,K,H,N),onRead:async(W)=>{return(await J("/_sandbox/read",{path:W})).content},onWrite:async(W,K)=>{await J("/_sandbox/write",{path:W,content:K})},onEdit:async(W,K)=>{for(let H of K)await J("/_sandbox/edit",{path:W,old_string:H.oldText,new_string:H.newText,replace_all:H.replaceAll===!0})},onBash:async(W,K)=>{return await J("/_sandbox/bash",{command:W,...K?.cwd!==void 0?{cwd:K.cwd}:{},...K?.timeoutMs!==void 0?{timeout:K.timeoutMs}:{}})},onGlob:async(W)=>{return(await J("/_sandbox/glob",{pattern:W})).files},onGrep:async(W,K)=>{let H=await J("/_sandbox/grep",{pattern:W,output_mode:"content",...K?.path!==void 0?{path:K.path}:{},...K?.glob!==void 0?{glob:K.glob}:{},...K?.caseInsensitive?{ignore_case:!0}:{}});return A64(H.results)}}}var Mn;var e6$=B(()=>{Mn=class Mn extends Error{code="DAEMON_UNREACHABLE";gone;constructor($,Z=!1){super($ instanceof Error?$.message:"Daemon proxy failed");if(this.gone=Z,$ instanceof Error)this.cause=$}}});function T64($){return $==="agent-sandbox"||$==="cluster"||$==="user-desktop"}function eL(){let $=process.env.STUDIO_SANDBOX_PROVIDER,Z=$&&$.length>0?$:"user-desktop";if(!T64(Z))throw Error(`Unknown STUDIO_SANDBOX_PROVIDER="${$}" \u2014 expected "agent-sandbox", "cluster", or "user-desktop".`);return aL(Z)}var FN=B(()=>{S90();S90();Bm0();e6$()});function C5($){if(!$||typeof $!=="object")return{};let Z=$.sandboxMap;if(!Z||typeof Z!=="object")return{};return Z}function eW($,Z,X,Q){let Y=$[Z]?.[X];if(!Y)return null;return AJ(Y)[Q]??null}function kn($,Z,X,Q,Y){let J={...AJ($[Z]?.[X]),[Q]:Y};return{...$,[Z]:{...$[Z]??{},[X]:J}}}async function $5$($,Z,X,Q,Y,G,J){let W=await $.findById(Z);if(!W)return;let K=W.metadata??{},H=kn(C5(K),Q,Y,G,J);await $.update(Z,X,{metadata:{...K,sandboxMap:H}})}function Lm0($,Z,X,Q){let Y=AJ($[Z]?.[X]);if(!Y[Q])return null;let G={...Y};delete G[Q];let J={...$[Z]??{}};if(Object.keys(G).length===0)delete J[X];else J[X]=G;let W={...$};if(Object.keys(J).length===0)delete W[Z];else W[Z]=J;return W}async function yw($,Z,X,Q,Y,G){let J=await $.findById(Z);if(!J)return;let W=J.metadata??{},K=Lm0(C5(W),Q,Y,G);if(!K)return;await $.update(Z,X,{metadata:{...W,sandboxMap:K}})}var kQ=B(()=>{B8()});import{createHash as R64}from"crypto";import{sql as b90}from"kysely";function I64($,Z){return R64("sha256").update($.userId).update("\x00").update($.projectRef).update("\x00").update(Z).digest().readBigInt64BE(0)}async function X5$($,Z,X){let Q=await $.selectFrom("sandbox_runner_state").select(["handle","state","updated_at"]).where("user_id","=",Z.userId).where("project_ref","=",Z.projectRef).where("sandbox_provider_kind","=",X).executeTakeFirst();if(!Q)return null;return{handle:Q.handle,state:Q.state,updatedAt:Q.updated_at}}async function Q5$($,Z,X){let Q=await $.selectFrom("sandbox_runner_state").select(["user_id","project_ref","handle","state","updated_at"]).where("sandbox_provider_kind","=",Z).where("handle","=",X).executeTakeFirst();if(!Q)return null;return{id:{userId:Q.user_id,projectRef:Q.project_ref},handle:Q.handle,state:Q.state,updatedAt:Q.updated_at}}async function Y5$($,Z,X,Q){let Y=JSON.stringify(Q.state),G=new Date().toISOString();await $.insertInto("sandbox_runner_state").values({user_id:Z.userId,project_ref:Z.projectRef,sandbox_provider_kind:X,handle:Q.handle,state:Y,updated_at:G}).onConflict((J)=>J.columns(["user_id","project_ref","sandbox_provider_kind"]).doUpdateSet({handle:Q.handle,state:Y,updated_at:G})).execute()}async function G5$($,Z,X){await $.deleteFrom("sandbox_runner_state").where("user_id","=",Z.userId).where("project_ref","=",Z.projectRef).where("sandbox_provider_kind","=",X).execute()}async function J5$($,Z,X){await $.deleteFrom("sandbox_runner_state").where("sandbox_provider_kind","=",Z).where("handle","=",X).execute()}function q64($){return{get:(Z,X)=>X5$($,Z,X),getByHandle:(Z,X)=>Q5$($,Z,X),put:(Z,X,Q)=>Y5$($,Z,X,Q),delete:(Z,X)=>G5$($,Z,X),deleteByHandle:(Z,X)=>J5$($,Z,X)}}class Sn{db;constructor($){this.db=$}get($,Z){return X5$(this.db,$,Z)}getByHandle($,Z){return Q5$(this.db,$,Z)}put($,Z,X){return Y5$(this.db,$,Z,X)}delete($,Z){return G5$(this.db,$,Z)}deleteByHandle($,Z){return J5$(this.db,$,Z)}async withLock($,Z,X){let Q=I64($,Z);return this.db.transaction().execute(async(Y)=>{try{await b90`set local statement_timeout = ${b90.lit(Z5$)}`.execute(Y),await b90`select pg_advisory_xact_lock(${Q}::bigint)`.execute(Y)}catch(G){if(M64(G))throw Error(`sandbox advisory lock busy >${Z5$}ms for user=${$.userId} projectRef=${$.projectRef} kind=${Z} \u2014 provisioner is slow or stuck; retry shortly`);throw G}return await b90`set local statement_timeout = 0`.execute(Y),X(q64(Y))})}}function M64($){if(!($ instanceof Error))return!1;return $.code==="57014"||/statement timeout/i.test($.message)}var Z5$=90000;var Em0=()=>{};function K5$($,Z){return`${$}::${Z}`}var W5$;var H5$=B(()=>{W5$={githubNotAuthenticated:"GITHUB_NOT_AUTHENTICATED"}});function N5$($,Z){return{cloneUrl:`https://github.com/${$}/${Z}.git`,gitUserName:f90.name,gitUserEmail:f90.email}}async function Vx($){let Z=await $.ctx.storage.connections.findById($.connectionId,$.organizationId),X=Z?_X(Z):null;if(!Z||!X?.sourceConnectionId)return;try{await P50($.ctx,Z,{forceRefresh:$.forceRefresh})}catch(Q){$.onLegacyMintError?.(Q)}}async function gw($,Z,X,Q,Y,G){let J=new E5(Q,Y),W=await eH({connectionId:$,tokenStorage:J,bufferMs:G?.bufferMs});if(!W.accessToken)throw Error(K5$(W5$.githubNotAuthenticated,W.state==="refresh_failed"?m7:"No GitHub token found. Ensure the mcp-github connection is authenticated."));let K=W.accessToken,H=`https://x-access-token:${K}@github.com/${Z}/${X}.git`,N=f90.name,F=f90.email;if(!K.startsWith("ghs_"))try{let U=await fetch("https://api.github.com/user",{headers:{Authorization:`token ${K}`,Accept:"application/vnd.github+json"}});if(U.ok){let w=await U.json();N=w.name||w.login,F=w.email||`${w.login}@users.noreply.github.com`}}catch{}return{cloneUrl:H,gitUserName:N,gitUserEmail:F}}var f90;var Vn=B(()=>{lc0();X3();Pw();dW();H5$();f90={name:"Deco Bot",email:"114028756+decobot@users.noreply.github.com"}});function F5$($){try{let[Z,X]=new URL($).pathname.replace(/^\//,"").split("/"),Q=X?.replace(/\.git$/,"");return Z&&Q?{owner:Z,name:Q}:null}catch{return null}}function M5$($){return typeof $>"u"||$===null}function k64($){return typeof $==="object"&&$!==null}function S64($){if(Array.isArray($))return $;else if(M5$($))return[];return[$]}function V64($,Z){var X,Q,Y,G;if(Z){G=Object.keys(Z);for(X=0,Q=G.length;X<Q;X+=1)Y=G[X],$[Y]=Z[Y]}return $}function C64($,Z){var X="",Q;for(Q=0;Q<Z;Q+=1)X+=$;return X}function _64($){return $===0&&Number.NEGATIVE_INFINITY===1/$}function k5$($,Z){var X="",Q=$.reason||"(unknown reason)";if(!$.mark)return Q;if($.mark.name)X+='in "'+$.mark.name+'" ';if(X+="("+($.mark.line+1)+":"+($.mark.column+1)+")",!Z&&$.mark.snippet)X+=`
+`)}})}},$m0={"content-type":"text/event-stream","cache-control":"no-cache",connection:"keep-alive","x-vercel-ai-ui-message-stream":"v1","x-accel-buffering":"no"};On=e0.record(e0.string(),iL.optional()),Zm0=U0(()=>s(e0.union([e0.strictObject({type:e0.literal("text-start"),id:e0.string(),providerMetadata:H$.optional()}),e0.strictObject({type:e0.literal("text-delta"),id:e0.string(),delta:e0.string(),providerMetadata:H$.optional()}),e0.strictObject({type:e0.literal("text-end"),id:e0.string(),providerMetadata:H$.optional()}),e0.strictObject({type:e0.literal("error"),errorText:e0.string()}),e0.strictObject({type:e0.literal("tool-input-start"),toolCallId:e0.string(),toolName:e0.string(),providerExecuted:e0.boolean().optional(),providerMetadata:H$.optional(),toolMetadata:On.optional(),dynamic:e0.boolean().optional(),title:e0.string().optional()}),e0.strictObject({type:e0.literal("tool-input-delta"),toolCallId:e0.string(),inputTextDelta:e0.string()}),e0.strictObject({type:e0.literal("tool-input-available"),toolCallId:e0.string(),toolName:e0.string(),input:e0.unknown(),providerExecuted:e0.boolean().optional(),providerMetadata:H$.optional(),toolMetadata:On.optional(),dynamic:e0.boolean().optional(),title:e0.string().optional()}),e0.strictObject({type:e0.literal("tool-input-error"),toolCallId:e0.string(),toolName:e0.string(),input:e0.unknown(),providerExecuted:e0.boolean().optional(),providerMetadata:H$.optional(),toolMetadata:On.optional(),dynamic:e0.boolean().optional(),errorText:e0.string(),title:e0.string().optional()}),e0.strictObject({type:e0.literal("tool-approval-request"),approvalId:e0.string(),toolCallId:e0.string(),signature:e0.string().optional()}),e0.strictObject({type:e0.literal("tool-output-available"),toolCallId:e0.string(),output:e0.unknown(),providerExecuted:e0.boolean().optional(),providerMetadata:H$.optional(),toolMetadata:On.optional(),dynamic:e0.boolean().optional(),preliminary:e0.boolean().optional()}),e0.strictObject({type:e0.literal("tool-output-error"),toolCallId:e0.string(),errorText:e0.string(),providerExecuted:e0.boolean().optional(),providerMetadata:H$.optional(),toolMetadata:On.optional(),dynamic:e0.boolean().optional()}),e0.strictObject({type:e0.literal("tool-output-denied"),toolCallId:e0.string()}),e0.strictObject({type:e0.literal("reasoning-start"),id:e0.string(),providerMetadata:H$.optional()}),e0.strictObject({type:e0.literal("reasoning-delta"),id:e0.string(),delta:e0.string(),providerMetadata:H$.optional()}),e0.strictObject({type:e0.literal("reasoning-end"),id:e0.string(),providerMetadata:H$.optional()}),e0.strictObject({type:e0.literal("source-url"),sourceId:e0.string(),url:e0.string(),title:e0.string().optional(),providerMetadata:H$.optional()}),e0.strictObject({type:e0.literal("source-document"),sourceId:e0.string(),mediaType:e0.string(),title:e0.string(),filename:e0.string().optional(),providerMetadata:H$.optional()}),e0.strictObject({type:e0.literal("file"),url:e0.string(),mediaType:e0.string(),providerMetadata:H$.optional()}),e0.strictObject({type:e0.custom(($)=>typeof $==="string"&&$.startsWith("data-"),{message:'Type must start with "data-"'}),id:e0.string().optional(),data:e0.unknown(),transient:e0.boolean().optional()}),e0.strictObject({type:e0.literal("start-step")}),e0.strictObject({type:e0.literal("finish-step")}),e0.strictObject({type:e0.literal("start"),messageId:e0.string().optional(),messageMetadata:e0.unknown().optional()}),e0.strictObject({type:e0.literal("finish"),finishReason:e0.enum(["stop","length","content-filter","tool-calls","error","other"]).optional(),messageMetadata:e0.unknown().optional()}),e0.strictObject({type:e0.literal("abort"),reason:e0.string().optional()}),e0.strictObject({type:e0.literal("message-metadata"),messageMetadata:e0.unknown()})])));p84=CG;t84=Ln;r84=pJ({prefix:"aitxt",size:24}),a84={file:!0,source:!0,"text-start":!0,"text-end":!0,"text-delta":!0,"reasoning-start":!0,"reasoning-end":!0,"reasoning-delta":!0,"tool-input-start":!0,"tool-input-end":!0,"tool-input-delta":!0,"tool-approval-request":!0,"tool-call":!0,"tool-result":!0,"tool-error":!0,"stream-start":!1,"response-metadata":!1,finish:!1,error:!1,raw:!1};IQ=J0.record(J0.string(),iL.optional()),X44=U0(()=>s(J0.array(J0.object({id:J0.string(),role:J0.enum(["system","user","assistant"]),metadata:J0.unknown().optional(),parts:J0.array(J0.union([J0.object({type:J0.literal("text"),text:J0.string(),state:J0.enum(["streaming","done"]).optional(),providerMetadata:H$.optional()}),J0.object({type:J0.literal("reasoning"),text:J0.string(),state:J0.enum(["streaming","done"]).optional(),providerMetadata:H$.optional()}),J0.object({type:J0.literal("source-url"),sourceId:J0.string(),url:J0.string(),title:J0.string().optional(),providerMetadata:H$.optional()}),J0.object({type:J0.literal("source-document"),sourceId:J0.string(),mediaType:J0.string(),title:J0.string(),filename:J0.string().optional(),providerMetadata:H$.optional()}),J0.object({type:J0.literal("file"),mediaType:J0.string(),filename:J0.string().optional(),url:J0.string(),providerMetadata:H$.optional()}),J0.object({type:J0.literal("step-start")}),J0.object({type:J0.string().startsWith("data-"),id:J0.string().optional(),data:J0.unknown()}),J0.object({type:J0.literal("dynamic-tool"),toolName:J0.string(),toolCallId:J0.string(),toolMetadata:IQ.optional(),state:J0.literal("input-streaming"),input:J0.unknown().optional(),providerExecuted:J0.boolean().optional(),callProviderMetadata:H$.optional(),output:J0.never().optional(),errorText:J0.never().optional(),approval:J0.never().optional()}),J0.object({type:J0.literal("dynamic-tool"),toolName:J0.string(),toolCallId:J0.string(),toolMetadata:IQ.optional(),state:J0.literal("input-available"),input:J0.unknown(),providerExecuted:J0.boolean().optional(),output:J0.never().optional(),errorText:J0.never().optional(),callProviderMetadata:H$.optional(),approval:J0.never().optional()}),J0.object({type:J0.literal("dynamic-tool"),toolName:J0.string(),toolCallId:J0.string(),toolMetadata:IQ.optional(),state:J0.literal("approval-requested"),input:J0.unknown(),providerExecuted:J0.boolean().optional(),output:J0.never().optional(),errorText:J0.never().optional(),callProviderMetadata:H$.optional(),approval:J0.object({id:J0.string(),approved:J0.never().optional(),reason:J0.never().optional(),signature:J0.string().optional()})}),J0.object({type:J0.literal("dynamic-tool"),toolName:J0.string(),toolCallId:J0.string(),toolMetadata:IQ.optional(),state:J0.literal("approval-responded"),input:J0.unknown(),providerExecuted:J0.boolean().optional(),output:J0.never().optional(),errorText:J0.never().optional(),callProviderMetadata:H$.optional(),approval:J0.object({id:J0.string(),approved:J0.boolean(),reason:J0.string().optional(),signature:J0.string().optional()})}),J0.object({type:J0.literal("dynamic-tool"),toolName:J0.string(),toolCallId:J0.string(),toolMetadata:IQ.optional(),state:J0.literal("output-available"),input:J0.unknown(),providerExecuted:J0.boolean().optional(),output:J0.unknown(),errorText:J0.never().optional(),callProviderMetadata:H$.optional(),resultProviderMetadata:H$.optional(),preliminary:J0.boolean().optional(),approval:J0.object({id:J0.string(),approved:J0.literal(!0),reason:J0.string().optional(),signature:J0.string().optional()}).optional()}),J0.object({type:J0.literal("dynamic-tool"),toolName:J0.string(),toolCallId:J0.string(),toolMetadata:IQ.optional(),state:J0.literal("output-error"),input:J0.unknown().optional(),rawInput:J0.unknown().optional(),providerExecuted:J0.boolean().optional(),output:J0.never().optional(),errorText:J0.string(),callProviderMetadata:H$.optional(),resultProviderMetadata:H$.optional(),approval:J0.object({id:J0.string(),approved:J0.literal(!0),reason:J0.string().optional(),signature:J0.string().optional()}).optional()}),J0.object({type:J0.literal("dynamic-tool"),toolName:J0.string(),toolCallId:J0.string(),toolMetadata:IQ.optional(),state:J0.literal("output-denied"),input:J0.unknown(),providerExecuted:J0.boolean().optional(),output:J0.never().optional(),errorText:J0.never().optional(),callProviderMetadata:H$.optional(),approval:J0.object({id:J0.string(),approved:J0.literal(!1),reason:J0.string().optional(),signature:J0.string().optional()})}),J0.object({type:J0.string().startsWith("tool-"),toolCallId:J0.string(),toolMetadata:IQ.optional(),state:J0.literal("input-streaming"),providerExecuted:J0.boolean().optional(),callProviderMetadata:H$.optional(),input:J0.unknown().optional(),output:J0.never().optional(),errorText:J0.never().optional(),approval:J0.never().optional()}),J0.object({type:J0.string().startsWith("tool-"),toolCallId:J0.string(),toolMetadata:IQ.optional(),state:J0.literal("input-available"),providerExecuted:J0.boolean().optional(),input:J0.unknown(),output:J0.never().optional(),errorText:J0.never().optional(),callProviderMetadata:H$.optional(),approval:J0.never().optional()}),J0.object({type:J0.string().startsWith("tool-"),toolCallId:J0.string(),toolMetadata:IQ.optional(),state:J0.literal("approval-requested"),input:J0.unknown(),providerExecuted:J0.boolean().optional(),output:J0.never().optional(),errorText:J0.never().optional(),callProviderMetadata:H$.optional(),approval:J0.object({id:J0.string(),approved:J0.never().optional(),reason:J0.never().optional(),signature:J0.string().optional()})}),J0.object({type:J0.string().startsWith("tool-"),toolCallId:J0.string(),toolMetadata:IQ.optional(),state:J0.literal("approval-responded"),input:J0.unknown(),providerExecuted:J0.boolean().optional(),output:J0.never().optional(),errorText:J0.never().optional(),callProviderMetadata:H$.optional(),approval:J0.object({id:J0.string(),approved:J0.boolean(),reason:J0.string().optional(),signature:J0.string().optional()})}),J0.object({type:J0.string().startsWith("tool-"),toolCallId:J0.string(),toolMetadata:IQ.optional(),state:J0.literal("output-available"),providerExecuted:J0.boolean().optional(),input:J0.unknown(),output:J0.unknown(),errorText:J0.never().optional(),callProviderMetadata:H$.optional(),resultProviderMetadata:H$.optional(),preliminary:J0.boolean().optional(),approval:J0.object({id:J0.string(),approved:J0.literal(!0),reason:J0.string().optional(),signature:J0.string().optional()}).optional()}),J0.object({type:J0.string().startsWith("tool-"),toolCallId:J0.string(),toolMetadata:IQ.optional(),state:J0.literal("output-error"),providerExecuted:J0.boolean().optional(),input:J0.unknown().optional(),rawInput:J0.unknown().optional(),output:J0.never().optional(),errorText:J0.string(),callProviderMetadata:H$.optional(),resultProviderMetadata:H$.optional(),approval:J0.object({id:J0.string(),approved:J0.literal(!0),reason:J0.string().optional(),signature:J0.string().optional()}).optional()}),J0.object({type:J0.string().startsWith("tool-"),toolCallId:J0.string(),toolMetadata:IQ.optional(),state:J0.literal("output-denied"),providerExecuted:J0.boolean().optional(),input:J0.unknown(),output:J0.never().optional(),errorText:J0.never().optional(),callProviderMetadata:H$.optional(),approval:J0.object({id:J0.string(),approved:J0.literal(!1),reason:J0.string().optional(),signature:J0.string().optional()})})])).nonempty("Message must contain at least one part")})).nonempty("Messages array must not be empty")));F44=k90,U44={type:"no-schema",jsonSchema:async()=>{return},async validatePartialResult({value:$,textDelta:Z}){return{success:!0,value:{partial:$,textDelta:Z}}},async validateFinalResult($,Z){return $===void 0?{success:!1,error:new MQ({message:"No object generated: response did not match schema.",text:Z.text,response:Z.response,usage:Z.usage,finishReason:Z.finishReason})}:{success:!0,value:$}},createElementStream(){throw new T4({functionality:"element streams in no-schema mode"})}};D44=pJ({prefix:"aiobj",size:24});P44=pJ({prefix:"aiobj",size:24});R44=class extends Cw{constructor({data:$,mediaType:Z}){super({data:$,mediaType:Z});let X="mp3";if(Z){let Q=Z.split("/");if(Q.length===2){if(Z!=="audio/mpeg")X=Q[1]}}if(!X)throw Error("Audio format must be provided or determinable from media type");this.format=X}};M44={word:/\S+\s+/m,line:/\n+/m};S44=Wm0();p44=c6$,d6$=`vercel.ai.error.${l6$}`,t44=Symbol.for(d6$),i6$=class extends q5{constructor({modelId:$,modelType:Z,providerId:X,availableProviders:Q,message:Y=`No such provider: ${X} (available providers: ${Q.join()})`}){super({errorName:l6$,modelId:$,modelType:Z,message:Y});this[m6$]=!0,this.providerId=X,this.availableProviders=Q}static isInstance($){return G1.hasMarker($,d6$)}};m6$=t44;o44=n6$;s44=Wm0();t6$=class extends Nm0{constructor($={}){super($)}processResponseStream($){return mH({stream:$,schema:Zm0}).pipeThrough(new TransformStream({async transform(Z,X){if(!Z.success)throw Z.error;X.enqueue(Z.value)}}))}};H64=class extends Nm0{constructor($={}){super($)}processResponseStream($){return K64({stream:$.pipeThrough(new TextDecoderStream)})}}});import{z as N64}from"zod";function aL($){return $==="cluster"?"agent-sandbox":$}function Um0($){return`${$.userId}:${$.projectRef}`}var F64;var S90=B(()=>{F64=N64.enum(["agent-sandbox","user-desktop"])});class V90{map=new Map;async run($,Z){let X=this.map.get($);if(X)return X;let Q=Z();this.map.set($,Q);try{return await Q}finally{this.map.delete($)}}}function C90($,Z,X,Q){if(!$)return Q(null);if(!$.withLock)return Q($);return $.withLock(Z,X,Q)}function In($){if("threadId"in $){if(!$.threadId)throw Error("composeSandboxRef: threadId required");return`thread:${$.threadId}`}if(!$.orgId||!$.virtualMcpId||!$.branch)throw Error("composeSandboxRef: orgId, virtualMcpId and branch are all required for agent refs");return`agent:${$.orgId}:${$.virtualMcpId}:${$.branch}`}function o6$($){if($.startsWith("thread:"))return $.slice(7);if(!$.startsWith("agent:"))return"";let Z=$.split(":");return Z.length>=4?Z.slice(3).join(":"):""}import{createHash as U64}from"crypto";function O64($,Z=16){return U64("sha256").update(Um0($)).digest("hex").slice(0,Z)}function sL($){let Z=O64($),X=B64(o6$($.projectRef));return X?`${X}-${Z}`:`s-${Z}`}function B64($){if(!$)return"";return($.split("/").pop()??"").toLowerCase().replace(/[^a-z0-9]+/g,"-").replace(/^-+|-+$/g,"").slice(0,w64).replace(/-+$/g,"")}var w64=24;var r6$=B(()=>{S90()});function _90($,Z){let X=$.replace(/\/+$/,"");if(X.includes("{handle}"))return`${X.replace("{handle}",Z)}/`;try{let Q=new URL(X);return Q.hostname=`${Z}.${Q.hostname}`,`${Q.toString()}/`}catch{return`${X}/${Z}/`}}function qn($){let Z=$?.userName?.trim();if(!Z||a6$.test(Z))return null;let X=$?.userEmail?.trim();if(!X||a6$.test(X))return{userName:Z};if(!D64.test(X))return{userName:Z};return{userName:Z,userEmail:X}}var a6$,D64;var wm0=B(()=>{a6$=/[\r\n<>]/,D64=/^[^\s@<>]+@[^\s@<>]+\.[^\s@<>]+$/});function v90($){let Z=$.repo,X=Z?{repository:{cloneUrl:Z.cloneUrl,repoName:Z.displayName??L64(Z.cloneUrl),...Z.branch?{branch:Z.branch}:{},...Z.submoduleCredentials&&Z.submoduleCredentials.length>0?{submoduleCredentials:Z.submoduleCredentials}:{}},...Z.userName.trim()||Z.userEmail.trim()?{identity:{userName:Z.userName,userEmail:Z.userEmail}}:{}}:void 0,Q=$.tenant,Y=qn({userName:Q?.userName,userEmail:Q?.userEmail})??void 0,G=$.packageManager?{name:$.packageManager.name,...$.packageManager.path?{path:$.packageManager.path}:{}}:void 0,J=G?{packageManager:G,runtime:$.runtime,...$.port!==void 0?{port:$.port}:{}}:void 0;if(!X&&!J&&!Y&&!$.cloneOnly)return null;return{...X?{git:X}:{},...Y?{operator:Y}:{},...$.cloneOnly!==void 0?{cloneOnly:$.cloneOnly}:{},...J?{application:J}:{}}}function L64($){try{let Z=new URL($);return Z.pathname.replace(/^\/+/,"").replace(/\.git$/,"")||Z.hostname}catch{return $}}var s6$=B(()=>{wm0()});function E64($){try{return new URL($).username.length>0}catch{return!1}}function Om0($){let Z=$.repo?.cloneUrl;if(!Z||!E64(Z))return null;return{git:{repository:{cloneUrl:Z}}}}var Bm0=B(()=>{r6$();s6$()});function j64($){return(typeof $.timeout==="number"&&$.timeout>0?Math.min($.timeout,120000):30000)+15000}function z64($,Z){if($.aborted)return Z.catch(()=>{}),Promise.reject($.reason??Error("aborted"));return new Promise((X,Q)=>{let Y=()=>{Z.catch(()=>{}),Q($.reason??Error("aborted"))};$.addEventListener("abort",Y,{once:!0}),Z.then(X,Q).finally(()=>{$.removeEventListener("abort",Y)})})}async function P64($,Z,X,Q,Y="POST",G){let J=G?.timeoutMs??j64(Q??{}),W=AbortSignal.timeout(J),K=G?.signal?AbortSignal.any([G.signal,W]):W,H,N;try{let U=new Headers({"content-type":"application/json"});if(G?.threadId)U.set("x-thread-id",G.threadId);let w={method:Y,headers:U,body:null,signal:K};if(Y!=="GET"&&Q!==null)w.body=JSON.stringify(Q);({res:H,rawText:N}=await z64(K,(async()=>{let O=await $.proxyDaemonRequest(Z,X,w);return{res:O,rawText:await O.text()}})()))}catch(U){if(G?.signal?.aborted)throw U;if(W.aborted)throw Error(`Sandbox ${Y} ${X} timed out after ${Math.round(J/1000)}s \u2014 the sandbox may be overloaded or its filesystem stalled. Retry, or use a smaller operation.`);throw new Mn(U)}let F;try{F=JSON.parse(N)}catch{console.error("[sandbox-fs-hooks] Failed to parse JSON response runner=%s path=%s status=%d rawText=%s",$.kind,X,H.status,N.slice(0,2000));let U=H.status>=500?" (server error)":H.status===0?" (no response)":"";throw Error(`Daemon ${X} returned invalid JSON (HTTP ${H.status}${U}): ${N.slice(0,800)}`)}if(!H.ok){console.error("[sandbox-fs-hooks] Non-OK response runner=%s path=%s status=%d body=%s",$.kind,X,H.status,N.slice(0,2000));let U=F.error??`Daemon ${X} failed (${H.status})`;if(H.status===404&&U==="sandbox not found")throw new Mn(Error(U),!0);throw Error(U)}return F}function A64($){let Z=[];for(let X of $.split(`
+`)){if(!X)continue;let Q=X.indexOf(":");if(Q<0)continue;let Y=X.indexOf(":",Q+1);if(Y<0)continue;let G=X.slice(0,Q),J=Number.parseInt(X.slice(Q+1,Y),10);if(!Number.isFinite(J))continue;Z.push({file:G,line:J,text:X.slice(Y+1)})}return Z}function Dm0($,Z){let{ensureHandle:X,invalidateHandle:Q,canAutoRestart:Y}=Z,G=(W)=>{let K=W instanceof Error?W.message:String(W);return Y?`Sandbox is unreachable and auto-restart did not recover it: ${K}`:"The sandbox is not running. Ask the user to start it by clicking the server button (left side of the header bar)."},J=async(W,K,H="POST",N)=>{let F=async(w)=>P64($,w,W,K,H,{signal:N,timeoutMs:Z.opTimeoutMs,threadId:Z.threadId}),U=await X();try{return await F(U)}catch(w){if(!(w instanceof Mn))throw w;if(!Y&&!w.gone)throw Error(G(w.cause??w));console.warn(`[sandbox-fs-hooks] daemon ${W} unreachable \u2014 reaping sandbox and retrying once`,w.cause??w);try{await Q({force:w.gone})}catch(D){console.warn("[sandbox-fs-hooks] invalidateHandle failed",D)}let O;try{O=await X()}catch(D){throw Error(`Failed to restart sandbox: ${D instanceof Error?D.message:String(D)}`)}try{return await F(O)}catch(D){if(D instanceof Mn)throw Error(G(D.cause??D));throw D}}};return{onProxy:(W,K,H,N)=>J(W,K,H,N),onRead:async(W)=>{return(await J("/_sandbox/read",{path:W})).content},onWrite:async(W,K)=>{await J("/_sandbox/write",{path:W,content:K})},onEdit:async(W,K)=>{for(let H of K)await J("/_sandbox/edit",{path:W,old_string:H.oldText,new_string:H.newText,replace_all:H.replaceAll===!0})},onBash:async(W,K)=>{return await J("/_sandbox/bash",{command:W,...K?.cwd!==void 0?{cwd:K.cwd}:{},...K?.timeoutMs!==void 0?{timeout:K.timeoutMs}:{}})},onGlob:async(W)=>{return(await J("/_sandbox/glob",{pattern:W})).files},onGrep:async(W,K)=>{let H=await J("/_sandbox/grep",{pattern:W,output_mode:"content",...K?.path!==void 0?{path:K.path}:{},...K?.glob!==void 0?{glob:K.glob}:{},...K?.caseInsensitive?{ignore_case:!0}:{}});return A64(H.results)}}}var Mn;var e6$=B(()=>{Mn=class Mn extends Error{code="DAEMON_UNREACHABLE";gone;constructor($,Z=!1){super($ instanceof Error?$.message:"Daemon proxy failed");if(this.gone=Z,$ instanceof Error)this.cause=$}}});function T64($){return $==="agent-sandbox"||$==="cluster"||$==="user-desktop"}function eL(){let $=process.env.STUDIO_SANDBOX_PROVIDER,Z=$&&$.length>0?$:"user-desktop";if(!T64(Z))throw Error(`Unknown STUDIO_SANDBOX_PROVIDER="${$}" \u2014 expected "agent-sandbox", "cluster", or "user-desktop".`);return aL(Z)}var FN=B(()=>{S90();S90();Bm0();e6$()});function C5($){if(!$||typeof $!=="object")return{};let Z=$.sandboxMap;if(!Z||typeof Z!=="object")return{};return Z}function eW($,Z,X,Q){let Y=$[Z]?.[X];if(!Y)return null;return AJ(Y)[Q]??null}function kn($,Z,X,Q,Y){let J={...AJ($[Z]?.[X]),[Q]:Y};return{...$,[Z]:{...$[Z]??{},[X]:J}}}async function $5$($,Z,X,Q,Y,G,J){let W=await $.findById(Z);if(!W)return;let K=W.metadata??{},H=kn(C5(K),Q,Y,G,J);await $.update(Z,X,{metadata:{...K,sandboxMap:H}})}function Lm0($,Z,X,Q){let Y=AJ($[Z]?.[X]);if(!Y[Q])return null;let G={...Y};delete G[Q];let J={...$[Z]??{}};if(Object.keys(G).length===0)delete J[X];else J[X]=G;let W={...$};if(Object.keys(J).length===0)delete W[Z];else W[Z]=J;return W}async function yw($,Z,X,Q,Y,G){let J=await $.findById(Z);if(!J)return;let W=J.metadata??{},K=Lm0(C5(W),Q,Y,G);if(!K)return;await $.update(Z,X,{metadata:{...W,sandboxMap:K}})}var kQ=B(()=>{B8()});import{createHash as R64}from"crypto";import{sql as b90}from"kysely";function I64($,Z){return R64("sha256").update($.userId).update("\x00").update($.projectRef).update("\x00").update(Z).digest().readBigInt64BE(0)}async function X5$($,Z,X){let Q=await $.selectFrom("sandbox_runner_state").select(["handle","state","updated_at"]).where("user_id","=",Z.userId).where("project_ref","=",Z.projectRef).where("sandbox_provider_kind","=",X).executeTakeFirst();if(!Q)return null;return{handle:Q.handle,state:Q.state,updatedAt:Q.updated_at}}async function Q5$($,Z,X){let Q=await $.selectFrom("sandbox_runner_state").select(["user_id","project_ref","handle","state","updated_at"]).where("sandbox_provider_kind","=",Z).where("handle","=",X).executeTakeFirst();if(!Q)return null;return{id:{userId:Q.user_id,projectRef:Q.project_ref},handle:Q.handle,state:Q.state,updatedAt:Q.updated_at}}async function Y5$($,Z,X,Q){let Y=JSON.stringify(Q.state),G=new Date().toISOString();await $.insertInto("sandbox_runner_state").values({user_id:Z.userId,project_ref:Z.projectRef,sandbox_provider_kind:X,handle:Q.handle,state:Y,updated_at:G}).onConflict((J)=>J.columns(["user_id","project_ref","sandbox_provider_kind"]).doUpdateSet({handle:Q.handle,state:Y,updated_at:G})).execute()}async function G5$($,Z,X){await $.deleteFrom("sandbox_runner_state").where("user_id","=",Z.userId).where("project_ref","=",Z.projectRef).where("sandbox_provider_kind","=",X).execute()}async function J5$($,Z,X){await $.deleteFrom("sandbox_runner_state").where("sandbox_provider_kind","=",Z).where("handle","=",X).execute()}function q64($){return{get:(Z,X)=>X5$($,Z,X),getByHandle:(Z,X)=>Q5$($,Z,X),put:(Z,X,Q)=>Y5$($,Z,X,Q),delete:(Z,X)=>G5$($,Z,X),deleteByHandle:(Z,X)=>J5$($,Z,X)}}class Sn{db;constructor($){this.db=$}get($,Z){return X5$(this.db,$,Z)}getByHandle($,Z){return Q5$(this.db,$,Z)}put($,Z,X){return Y5$(this.db,$,Z,X)}delete($,Z){return G5$(this.db,$,Z)}deleteByHandle($,Z){return J5$(this.db,$,Z)}async withLock($,Z,X){let Q=I64($,Z);return this.db.transaction().execute(async(Y)=>{try{await b90`set local statement_timeout = ${b90.lit(Z5$)}`.execute(Y),await b90`select pg_advisory_xact_lock(${Q}::bigint)`.execute(Y)}catch(G){if(M64(G))throw Error(`sandbox advisory lock busy >${Z5$}ms for user=${$.userId} projectRef=${$.projectRef} kind=${Z} \u2014 provisioner is slow or stuck; retry shortly`);throw G}return await b90`set local statement_timeout = 0`.execute(Y),X(q64(Y))})}}function M64($){if(!($ instanceof Error))return!1;return $.code==="57014"||/statement timeout/i.test($.message)}var Z5$=90000;var Em0=()=>{};function K5$($,Z){return`${$}::${Z}`}var W5$;var H5$=B(()=>{W5$={githubNotAuthenticated:"GITHUB_NOT_AUTHENTICATED"}});function N5$($,Z){return{cloneUrl:`https://github.com/${$}/${Z}.git`,gitUserName:f90.name,gitUserEmail:f90.email}}async function Vx($){let Z=await $.ctx.storage.connections.findById($.connectionId,$.organizationId),X=Z?_X(Z):null;if(!Z||!X?.sourceConnectionId)return;try{await P50($.ctx,Z,{forceRefresh:$.forceRefresh})}catch(Q){$.onLegacyMintError?.(Q)}}async function gw($,Z,X,Q,Y,G){let J=new E5(Q,Y),W=await eH({connectionId:$,tokenStorage:J,bufferMs:G?.bufferMs});if(!W.accessToken)throw Error(K5$(W5$.githubNotAuthenticated,W.state==="refresh_failed"?m7:"No GitHub token found. Ensure the mcp-github connection is authenticated."));let K=W.accessToken,H=`https://x-access-token:${K}@github.com/${Z}/${X}.git`,N=f90.name,F=f90.email;if(!K.startsWith("ghs_"))try{let U=await fetch("https://api.github.com/user",{headers:{Authorization:`token ${K}`,Accept:"application/vnd.github+json"}});if(U.ok){let w=await U.json();N=w.name||w.login,F=w.email||`${w.login}@users.noreply.github.com`}}catch{}return{cloneUrl:H,gitUserName:N,gitUserEmail:F}}var f90;var Vn=B(()=>{lc0();X3();Pw();dW();H5$();f90={name:"Deco Bot",email:"114028756+decobot@users.noreply.github.com"}});function F5$($){try{let[Z,X]=new URL($).pathname.replace(/^\//,"").split("/"),Q=X?.replace(/\.git$/,"");return Z&&Q?{owner:Z,name:Q}:null}catch{return null}}function M5$($){return typeof $>"u"||$===null}function k64($){return typeof $==="object"&&$!==null}function S64($){if(Array.isArray($))return $;else if(M5$($))return[];return[$]}function V64($,Z){var X,Q,Y,G;if(Z){G=Object.keys(Z);for(X=0,Q=G.length;X<Q;X+=1)Y=G[X],$[Y]=Z[Y]}return $}function C64($,Z){var X="",Q;for(Q=0;Q<Z;Q+=1)X+=$;return X}function _64($){return $===0&&Number.NEGATIVE_INFINITY===1/$}function k5$($,Z){var X="",Q=$.reason||"(unknown reason)";if(!$.mark)return Q;if($.mark.name)X+='in "'+$.mark.name+'" ';if(X+="("+($.mark.line+1)+":"+($.mark.column+1)+")",!Z&&$.mark.snippet)X+=`
 
 `+$.mark.snippet;return Q+" "+X}function _n($,Z){if(Error.call(this),this.name="YAMLException",this.reason=$,this.mark=Z,this.message=k5$(this,!1),Error.captureStackTrace)Error.captureStackTrace(this,this.constructor);else this.stack=Error().stack||""}function jm0($,Z,X,Q,Y){var G="",J="",W=Math.floor(Y/2)-1;if(Q-Z>W)G=" ... ",Z=Q-W+G.length;if(X-Q>W)J=" ...",X=Q+W-J.length;return{str:G+$.slice(Z,X).replace(/\t/g,"\u2192")+J,pos:Q-Z+G.length}}function zm0($,Z){return $Z.repeat(" ",Z-$.length)+$}function h64($,Z){if(Z=Object.create(Z||null),!$.buffer)return null;if(!Z.maxLength)Z.maxLength=79;if(typeof Z.indent!=="number")Z.indent=1;if(typeof Z.linesBefore!=="number")Z.linesBefore=3;if(typeof Z.linesAfter!=="number")Z.linesAfter=2;var X=/\r?\n|\r|\0/g,Q=[0],Y=[],G,J=-1;while(G=X.exec($.buffer))if(Y.push(G.index),Q.push(G.index+G[0].length),$.position<=G.index&&J<0)J=Q.length-2;if(J<0)J=Q.length-1;var W="",K,H,N=Math.min($.line+Z.linesAfter,Y.length).toString().length,F=Z.maxLength-(Z.indent+N+3);for(K=1;K<=Z.linesBefore;K++){if(J-K<0)break;H=jm0($.buffer,Q[J-K],Y[J-K],$.position-(Q[J]-Q[J-K]),F),W=$Z.repeat(" ",Z.indent)+zm0(($.line-K+1).toString(),N)+" | "+H.str+`
 `+W}H=jm0($.buffer,Q[J],Y[J],$.position,F),W+=$Z.repeat(" ",Z.indent)+zm0(($.line+1).toString(),N)+" | "+H.str+`
@@ -1232,7 +1232,7 @@ ${H}`:H;return{...J,description:N,inputExamples:X?void 0:J.inputExamples}});retu
 `);let Q=Z.pax;if(Q)for(let Y in Q)X+=Qn0(" "+Y+"="+Q[Y]+`
 `);return C4.from(X)};fG4.decodePax=function(Z){let X={};while(Z.length){let Q=0;while(Q<Z.length&&Z[Q]!==32)Q++;let Y=parseInt(C4.toString(Z.subarray(0,Q)),10);if(!Y)return X;let G=C4.toString(Z.subarray(Q+1,Y-1)),J=G.indexOf("=");if(J===-1)return X;X[G.slice(0,J)]=G.slice(J+1),Z=Z.subarray(Y)}return X};fG4.encode=function(Z){let X=C4.alloc(512),Q=Z.name,Y="";if(Z.typeflag===5&&Q[Q.length-1]!=="/")Q+="/";if(C4.byteLength(Q)!==Q.length)return null;while(C4.byteLength(Q)>100){let G=Q.indexOf("/");if(G===-1)return null;Y+=Y?"/"+Q.slice(0,G):Q.slice(0,G),Q=Q.slice(G+1)}if(C4.byteLength(Q)>100||C4.byteLength(Y)>155)return null;if(Z.linkname&&C4.byteLength(Z.linkname)>100)return null;if(C4.write(X,Q),C4.write(X,tw(Z.mode&4095,6),100),C4.write(X,tw(Z.uid,6),108),C4.write(X,tw(Z.gid,6),116),vG4(Z.size,X,124),C4.write(X,tw(Z.mtime.getTime()/1000|0,11),136),X[156]=48+CG4(Z.type),Z.linkname)C4.write(X,Z.linkname,157);if(C4.copy(mQ$,X,257),C4.copy(RG4,X,263),Z.uname)C4.write(X,Z.uname,265);if(Z.gname)C4.write(X,Z.gname,297);if(C4.write(X,tw(Z.devmajor||0,6),329),C4.write(X,tw(Z.devminor||0,6),337),Y)C4.write(X,Y,345);return C4.write(X,tw(nQ$(X),6),148),X};fG4.decode=function(Z,X,Q){let Y=Z[156]===0?0:Z[156]-48,G=dx(Z,0,100,X),J=pw(Z,100,8),W=pw(Z,108,8),K=pw(Z,116,8),H=pw(Z,124,12),N=pw(Z,136,12),F=VG4(Y),U=Z[157]===0?null:dx(Z,157,100,X),w=dx(Z,265,32),O=dx(Z,297,32),D=pw(Z,329,8),L=pw(Z,337,8),E=nQ$(Z);if(E===256)return null;if(E!==pw(Z,148,8))throw Error("Invalid tar header. Maybe the tar is corrupted or it needs to be gunzipped?");if(MG4(Z)){if(Z[345])G=dx(Z,345,155,X)+"/"+G}else if(kG4(Z));else if(!Q)throw Error("Invalid tar header: unknown format.");if(Y===0&&G&&G[G.length-1]==="/")Y=5;return{name:G,mode:J,uid:W,gid:K,size:H,mtime:new Date(1000*N),type:F,linkname:U,uname:w,gname:O,devmajor:D,devminor:L,pax:null}};function MG4($){return C4.equals(mQ$,$.subarray(257,263))}function kG4($){return C4.equals(IG4,$.subarray(257,263))&&C4.equals(qG4,$.subarray(263,265))}function SG4($,Z,X){if(typeof $!=="number")return X;if($=~~$,$>=Z)return Z;if($>=0)return $;if($+=Z,$>=0)return $;return 0}function VG4($){switch($){case 0:return"file";case 1:return"link";case 2:return"symlink";case 3:return"character-device";case 4:return"block-device";case 5:return"directory";case 6:return"fifo";case 7:return"contiguous-file";case 72:return"pax-header";case 55:return"pax-global-header";case 27:return"gnu-long-link-path";case 28:case 30:return"gnu-long-path"}return null}function CG4($){switch($){case"file":return 0;case"link":return 1;case"symlink":return 2;case"character-device":return 3;case"block-device":return 4;case"directory":return 5;case"fifo":return 6;case"contiguous-file":return 7;case"pax-header":return 72}return 0}function iQ$($,Z,X,Q){for(;X<Q;X++)if($[X]===Z)return X;return Q}function nQ$($){let Z=256;for(let X=0;X<148;X++)Z+=$[X];for(let X=156;X<512;X++)Z+=$[X];return Z}function tw($,Z){if($=$.toString(8),$.length>Z)return"7777777777777777777".slice(0,Z)+" ";return"0000000000000000000".slice(0,Z-$.length)+$+" "}function _G4($,Z,X){Z[X]=128;for(let Q=11;Q>0;Q--)Z[X+Q]=$&255,$=Math.floor($/256)}function vG4($,Z,X){if($.toString(8).length>11)_G4($,Z,X);else C4.write(Z,tw($,11),X)}function bG4($){let Z;if($[0]===128)Z=!0;else if($[0]===255)Z=!1;else return null;let X=[],Q;for(Q=$.length-1;Q>0;Q--){let J=$[Q];if(Z)X.push(J);else X.push(255-J)}let Y=0,G=X.length;for(Q=0;Q<G;Q++)Y+=X[Q]*Math.pow(256,Q);return Z?Y:-1*Y}function pw($,Z,X){if($=$.subarray(Z,Z+X),Z=0,$[Z]&128)return bG4($);else{while(Z<$.length&&$[Z]===32)Z++;let Q=SG4(iQ$($,32,Z,$.length),$.length,$.length);while(Z<Q&&$[Z]===0)Z++;if(Q===Z)return 0;return parseInt(C4.toString($.subarray(Z,Q)),8)}}function dx($,Z,X,Q){return C4.toString($.subarray(Z,iQ$($,0,Z,Z+X)),Q)}function Qn0($){let Z=C4.byteLength($),X=Math.floor(Math.log(Z)/Math.log(10))+1;if(Z+X>=Math.pow(10,X))X++;return Z+X+$}});var $Y$=C((uE9,eQ$)=>{var{Writable:cG4,Readable:lG4,getStreamError:pQ$}=Xn0(),dG4=ri0(),tQ$=lx(),mx=Yn0(),mG4=tQ$.alloc(0);class oQ${constructor(){this.buffered=0,this.shifted=0,this.queue=new dG4,this._offset=0}push($){this.buffered+=$.byteLength,this.queue.push($)}shiftFirst($){return this._buffered===0?null:this._next($)}shift($){if($>this.buffered)return null;if($===0)return mG4;let Z=this._next($);if($===Z.byteLength)return Z;let X=[Z];while(($-=Z.byteLength)>0)Z=this._next($),X.push(Z);return tQ$.concat(X)}_next($){let Z=this.queue.peek(),X=Z.byteLength-this._offset;if($>=X){let Q=this._offset?Z.subarray(this._offset,Z.byteLength):Z;return this.queue.shift(),this._offset=0,this.buffered-=X,this.shifted+=X,Q}return this.buffered-=$,this.shifted+=$,Z.subarray(this._offset,this._offset+=$)}}class rQ$ extends lG4{constructor($,Z,X){super();this.header=Z,this.offset=X,this._parent=$}_read($){if(this.header.size===0)this.push(null);if(this._parent._stream===this)this._parent._update();$(null)}_predestroy(){this._parent.destroy(pQ$(this))}_detach(){if(this._parent._stream===this)this._parent._stream=null,this._parent._missing=sQ$(this.header.size),this._parent._update()}_destroy($){this._detach(),$(null)}}class aQ$ extends cG4{constructor($){super($);if(!$)$={};this._buffer=new oQ$,this._offset=0,this._header=null,this._stream=null,this._missing=0,this._longHeader=!1,this._callback=Gn0,this._locked=!1,this._finished=!1,this._pax=null,this._paxGlobal=null,this._gnuLongPath=null,this._gnuLongLinkPath=null,this._filenameEncoding=$.filenameEncoding||"utf-8",this._allowUnknownFormat=!!$.allowUnknownFormat,this._unlockBound=this._unlock.bind(this)}_unlock($){if(this._locked=!1,$){this.destroy($),this._continueWrite($);return}this._update()}_consumeHeader(){if(this._locked)return!1;this._offset=this._buffer.shifted;try{this._header=mx.decode(this._buffer.shift(512),this._filenameEncoding,this._allowUnknownFormat)}catch($){return this._continueWrite($),!1}if(!this._header)return!0;switch(this._header.type){case"gnu-long-path":case"gnu-long-link-path":case"pax-global-header":case"pax-header":return this._longHeader=!0,this._missing=this._header.size,!0}if(this._locked=!0,this._applyLongHeaders(),this._header.size===0||this._header.type==="directory")return this.emit("entry",this._header,this._createStream(),this._unlockBound),!0;return this._stream=this._createStream(),this._missing=this._header.size,this.emit("entry",this._header,this._stream,this._unlockBound),!0}_applyLongHeaders(){if(this._gnuLongPath)this._header.name=this._gnuLongPath,this._gnuLongPath=null;if(this._gnuLongLinkPath)this._header.linkname=this._gnuLongLinkPath,this._gnuLongLinkPath=null;if(this._pax){if(this._pax.path)this._header.name=this._pax.path;if(this._pax.linkpath)this._header.linkname=this._pax.linkpath;if(this._pax.size)this._header.size=parseInt(this._pax.size,10);this._header.pax=this._pax,this._pax=null}}_decodeLongHeader($){switch(this._header.type){case"gnu-long-path":this._gnuLongPath=mx.decodeLongPath($,this._filenameEncoding);break;case"gnu-long-link-path":this._gnuLongLinkPath=mx.decodeLongPath($,this._filenameEncoding);break;case"pax-global-header":this._paxGlobal=mx.decodePax($);break;case"pax-header":this._pax=this._paxGlobal===null?mx.decodePax($):Object.assign({},this._paxGlobal,mx.decodePax($));break}}_consumeLongHeader(){this._longHeader=!1,this._missing=sQ$(this._header.size);let $=this._buffer.shift(this._header.size);try{this._decodeLongHeader($)}catch(Z){return this._continueWrite(Z),!1}return!0}_consumeStream(){let $=this._buffer.shiftFirst(this._missing);if($===null)return!1;this._missing-=$.byteLength;let Z=this._stream.push($);if(this._missing===0){if(this._stream.push(null),Z)this._stream._detach();return Z&&this._locked===!1}return Z}_createStream(){return new rQ$(this,this._header,this._offset)}_update(){while(this._buffer.buffered>0&&!this.destroying){if(this._missing>0){if(this._stream!==null){if(this._consumeStream()===!1)return;continue}if(this._longHeader===!0){if(this._missing>this._buffer.buffered)break;if(this._consumeLongHeader()===!1)return!1;continue}let $=this._buffer.shiftFirst(this._missing);if($!==null)this._missing-=$.byteLength;continue}if(this._buffer.buffered<512)break;if(this._stream!==null||this._consumeHeader()===!1)return}this._continueWrite(null)}_continueWrite($){let Z=this._callback;this._callback=Gn0,Z($)}_write($,Z){this._callback=Z,this._buffer.push($),this._update()}_final($){this._finished=this._missing===0&&this._buffer.buffered===0,$(this._finished?null:Error("Unexpected end of data"))}_predestroy(){this._continueWrite(null)}_destroy($){if(this._stream)this._stream.destroy(pQ$(this));$(null)}[Symbol.asyncIterator](){let $=null,Z=null,X=null,Q=null,Y=null,G=this;return this.on("entry",K),this.on("error",(F)=>{$=F}),this.on("close",H),{[Symbol.asyncIterator](){return this},next(){return new Promise(W)},return(){return N(null)},throw(F){return N(F)}};function J(F){if(!Y)return;let U=Y;Y=null,U(F)}function W(F,U){if($)return U($);if(Q){F({value:Q,done:!1}),Q=null;return}if(Z=F,X=U,J(null),G._finished&&Z)Z({value:void 0,done:!0}),Z=X=null}function K(F,U,w){if(Y=w,U.on("error",Gn0),Z)Z({value:U,done:!1}),Z=X=null;else Q=U}function H(){if(J($),!Z)return;if($)X($);else Z({value:void 0,done:!0});Z=X=null}function N(F){return G.destroy(F),J(F),new Promise((U,w)=>{if(G.destroyed)return U({value:void 0,done:!0});G.once("close",function(){if(F)w(F);else U({value:void 0,done:!0})})})}}}eQ$.exports=function(Z){return new aQ$(Z)};function Gn0(){}function sQ$($){return $&=511,$&&512-$}});var XY$=C((cE9,Jn0)=>{var ZY$={S_IFMT:61440,S_IFDIR:16384,S_IFCHR:8192,S_IFBLK:24576,S_IFIFO:4096,S_IFLNK:40960};try{Jn0.exports=z0("fs").constants||ZY$}catch{Jn0.exports=ZY$}});var HY$=C((lE9,KY$)=>{var{Readable:iG4,Writable:nG4,getStreamError:QY$}=Xn0(),IV=lx(),ix=XY$(),nU0=Yn0(),YY$=IV.alloc(1024);class GY$ extends nG4{constructor($,Z,X){super({mapWritable:tG4,eagerOpen:!0});if(this.written=0,this.header=Z,this._callback=X,this._linkname=null,this._isLinkname=Z.type==="symlink"&&!Z.linkname,this._isVoid=Z.type!=="file"&&Z.type!=="contiguous-file",this._finished=!1,this._pack=$,this._openCallback=null,this._pack._stream===null)this._pack._stream=this;else this._pack._pending.push(this)}_open($){if(this._openCallback=$,this._pack._stream===this)this._continueOpen()}_continuePack($){if(this._callback===null)return;let Z=this._callback;this._callback=null,Z($)}_continueOpen(){if(this._pack._stream===null)this._pack._stream=this;let $=this._openCallback;if(this._openCallback=null,$===null)return;if(this._pack.destroying)return $(Error("pack stream destroyed"));if(this._pack._finalized)return $(Error("pack stream is already finalized"));if(this._pack._stream=this,!this._isLinkname)this._pack._encode(this.header);if(this._isVoid)this._finish(),this._continuePack(null);$(null)}_write($,Z){if(this._isLinkname)return this._linkname=this._linkname?IV.concat([this._linkname,$]):$,Z(null);if(this._isVoid){if($.byteLength>0)return Z(Error("No body allowed for this entry"));return Z()}if(this.written+=$.byteLength,this._pack.push($))return Z();this._pack._drain=Z}_finish(){if(this._finished)return;if(this._finished=!0,this._isLinkname)this.header.linkname=this._linkname?IV.toString(this._linkname,"utf-8"):"",this._pack._encode(this.header);WY$(this._pack,this.header.size),this._pack._done(this)}_final($){if(this.written!==this.header.size)return $(Error("Size mismatch"));this._finish(),$(null)}_getError(){return QY$(this)||Error("tar entry destroyed")}_predestroy(){this._pack.destroy(this._getError())}_destroy($){this._pack._done(this),this._continuePack(this._finished?null:this._getError()),$()}}class JY$ extends iG4{constructor($){super($);this._drain=Wn0,this._finalized=!1,this._finalizing=!1,this._pending=[],this._stream=null}entry($,Z,X){if(this._finalized||this.destroying)throw Error("already finalized or destroyed");if(typeof Z==="function")X=Z,Z=null;if(!X)X=Wn0;if(!$.size||$.type==="symlink")$.size=0;if(!$.type)$.type=pG4($.mode);if(!$.mode)$.mode=$.type==="directory"?493:420;if(!$.uid)$.uid=0;if(!$.gid)$.gid=0;if(!$.mtime)$.mtime=new Date;if(typeof Z==="string")Z=IV.from(Z);let Q=new GY$(this,$,X);if(IV.isBuffer(Z))return $.size=Z.byteLength,Q.write(Z),Q.end(),Q;if(Q._isVoid)return Q;return Q}finalize(){if(this._stream||this._pending.length>0){this._finalizing=!0;return}if(this._finalized)return;this._finalized=!0,this.push(YY$),this.push(null)}_done($){if($!==this._stream)return;if(this._stream=null,this._finalizing)this.finalize();if(this._pending.length)this._pending.shift()._continueOpen()}_encode($){if(!$.pax){let Z=nU0.encode($);if(Z){this.push(Z);return}}this._encodePax($)}_encodePax($){let Z=nU0.encodePax({name:$.name,linkname:$.linkname,pax:$.pax}),X={name:"PaxHeader",mode:$.mode,uid:$.uid,gid:$.gid,size:Z.byteLength,mtime:$.mtime,type:"pax-header",linkname:$.linkname&&"PaxHeader",uname:$.uname,gname:$.gname,devmajor:$.devmajor,devminor:$.devminor};this.push(nU0.encode(X)),this.push(Z),WY$(this,Z.byteLength),X.size=$.size,X.type=$.type,this.push(nU0.encode(X))}_doDrain(){let $=this._drain;this._drain=Wn0,$()}_predestroy(){let $=QY$(this);if(this._stream)this._stream.destroy($);while(this._pending.length){let Z=this._pending.shift();Z.destroy($),Z._continueOpen()}this._doDrain()}_read($){this._doDrain(),$()}}KY$.exports=function(Z){return new JY$(Z)};function pG4($){switch($&ix.S_IFMT){case ix.S_IFBLK:return"block-device";case ix.S_IFCHR:return"character-device";case ix.S_IFDIR:return"directory";case ix.S_IFIFO:return"fifo";case ix.S_IFLNK:return"symlink"}return"file"}function Wn0(){}function WY$($,Z){if(Z&=511,Z)$.push(YY$.subarray(0,512-Z))}function tG4($){return IV.isBuffer($)?$:IV.from($)}});var NY$=C((oG4)=>{oG4.extract=$Y$();oG4.pack=HY$()});var wY$=C((mE9,UY$)=>{UY$.exports=FY$;function FY$($,Z){if($&&Z)return FY$($)(Z);if(typeof $!=="function")throw TypeError("need wrapper function");return Object.keys($).forEach(function(Q){X[Q]=$[Q]}),X;function X(){var Q=Array(arguments.length);for(var Y=0;Y<Q.length;Y++)Q[Y]=arguments[Y];var G=$.apply(this,Q),J=Q[Q.length-1];if(typeof G==="function"&&G!==J)Object.keys(J).forEach(function(W){G[W]=J[W]});return G}}});var Hn0=C((iE9,Kn0)=>{var OY$=wY$();Kn0.exports=OY$(pU0);Kn0.exports.strict=OY$(BY$);pU0.proto=pU0(function(){Object.defineProperty(Function.prototype,"once",{value:function(){return pU0(this)},configurable:!0}),Object.defineProperty(Function.prototype,"onceStrict",{value:function(){return BY$(this)},configurable:!0})});function pU0($){var Z=function(){if(Z.called)return Z.value;return Z.called=!0,Z.value=$.apply(this,arguments)};return Z.called=!1,Z}function BY$($){var Z=function(){if(Z.called)throw Error(Z.onceError);return Z.called=!0,Z.value=$.apply(this,arguments)},X=$.name||"Function wrapped with `once`";return Z.onceError=X+" shouldn't be called more than once",Z.called=!1,Z}});var EY$=C((nE9,LY$)=>{var sG4=Hn0(),eG4=function(){},$J4=global.Bare?queueMicrotask:process.nextTick.bind(process),ZJ4=function($){return $.setHeader&&typeof $.abort==="function"},XJ4=function($){return $.stdio&&Array.isArray($.stdio)&&$.stdio.length===3},DY$=function($,Z,X){if(typeof Z==="function")return DY$($,null,Z);if(!Z)Z={};X=sG4(X||eG4);var{_writableState:Q,_readableState:Y}=$,G=Z.readable||Z.readable!==!1&&$.readable,J=Z.writable||Z.writable!==!1&&$.writable,W=!1,K=function(){if(!$.writable)H()},H=function(){if(J=!1,!G)X.call($)},N=function(){if(G=!1,!J)X.call($)},F=function(L){X.call($,L?Error("exited with error code: "+L):null)},U=function(L){X.call($,L)},w=function(){$J4(O)},O=function(){if(W)return;if(G&&!(Y&&(Y.ended&&!Y.destroyed)))return X.call($,Error("premature close"));if(J&&!(Q&&(Q.ended&&!Q.destroyed)))return X.call($,Error("premature close"))},D=function(){$.req.on("finish",H)};if(ZJ4($))if($.on("complete",H),$.on("abort",w),$.req)D();else $.on("request",D);else if(J&&!Q)$.on("end",K),$.on("close",K);if(XJ4($))$.on("exit",F);if($.on("end",N),$.on("finish",H),Z.error!==!1)$.on("error",U);return $.on("close",w),function(){if(W=!0,$.removeListener("complete",H),$.removeListener("abort",w),$.removeListener("request",D),$.req)$.req.removeListener("finish",H);$.removeListener("end",K),$.removeListener("close",K),$.removeListener("finish",H),$.removeListener("exit",F),$.removeListener("end",N),$.removeListener("error",U),$.removeListener("close",w)}};LY$.exports=DY$});var PY$=C((pE9,zY$)=>{var QJ4=Hn0(),YJ4=EY$(),tU0;try{tU0=z0("fs")}catch($){}var pn=function(){},GJ4=typeof process>"u"?!1:/^v?\.0/.test(process.version),oU0=function($){return typeof $==="function"},JJ4=function($){if(!GJ4)return!1;if(!tU0)return!1;return($ instanceof(tU0.ReadStream||pn)||$ instanceof(tU0.WriteStream||pn))&&oU0($.close)},WJ4=function($){return $.setHeader&&oU0($.abort)},KJ4=function($,Z,X,Q){Q=QJ4(Q);var Y=!1;$.on("close",function(){Y=!0}),YJ4($,{readable:Z,writable:X},function(J){if(J)return Q(J);Y=!0,Q()});var G=!1;return function(J){if(Y)return;if(G)return;if(G=!0,JJ4($))return $.close(pn);if(WJ4($))return $.abort();if(oU0($.destroy))return $.destroy();Q(J||Error("stream was destroyed"))}},jY$=function($){$()},HJ4=function($,Z){return $.pipe(Z)},NJ4=function(){var $=Array.prototype.slice.call(arguments),Z=oU0($[$.length-1]||pn)&&$.pop()||pn;if(Array.isArray($[0]))$=$[0];if($.length<2)throw Error("pump requires two streams per minimum");var X,Q=$.map(function(Y,G){var J=G<$.length-1,W=G>0;return KJ4(Y,J,W,function(K){if(!X)X=K;if(K)Q.forEach(jY$);if(J)return;Q.forEach(jY$),Z(X)})});return $.reduce(HJ4)};zY$.exports=NJ4});var VY$=C((OJ4)=>{var AY$=NY$(),TY$=PY$(),RY$=z0("fs"),r5=z0("path"),tn=(global.Bare?global.Bare.platform:process.platform)==="win32";OJ4.pack=function(Z,X){if(!Z)Z=".";if(!X)X={};let Q=X.fs||RY$,Y=X.ignore||X.filter||on,G=X.mapStream||kY$,J=wJ4(Q,X.dereference?Q.stat:Q.lstat,Z,Y,X.entries,X.sort),W=X.strict!==!1,K=typeof X.umask==="number"?~X.umask:~IY$(),H=X.pack||AY$.pack(),N=X.finish||on,F=X.map||on,U=typeof X.dmode==="number"?X.dmode:0,w=typeof X.fmode==="number"?X.fmode:0;if(X.strip)F=SY$(F,X.strip);if(X.readable)U|=parseInt(555,8),w|=parseInt(444,8);if(X.writable)U|=parseInt(333,8),w|=parseInt(222,8);L();function O(E,j){Q.readlink(r5.join(Z,E),function(z,A){if(z)return H.destroy(z);j.linkname=Nn0(A),H.entry(j,L)})}function D(E,j,z){if(H.destroyed)return;if(E)return H.destroy(E);if(!j){if(X.finalize!==!1)H.finalize();return N(H)}if(z.isSocket())return L();let A={name:Nn0(j),mode:(z.mode|(z.isDirectory()?U:w))&K,mtime:z.mtime,size:z.size,type:"file",uid:z.uid,gid:z.gid};if(z.isDirectory())return A.size=0,A.type="directory",A=F(A)||A,H.entry(A,L);if(z.isSymbolicLink())return A.size=0,A.type="symlink",A=F(A)||A,O(j,A);if(A=F(A)||A,!z.isFile()){if(W)return H.destroy(Error("unsupported type for "+j));return L()}let P=H.entry(A,L),M=G(Q.createReadStream(r5.join(Z,j),{start:0,end:A.size>0?A.size-1:A.size}),A);M.on("error",function(k){P.destroy(k)}),TY$(M,P)}function L(E){if(E)return H.destroy(E);J(D)}return H};function FJ4($){return $.length?$[$.length-1]:null}function UJ4(){return!global.Bare&&process.getuid?process.getuid():-1}function IY$(){return!global.Bare&&process.umask?process.umask():0}OJ4.extract=function(Z,X){if(!Z)Z=".";if(!X)X={};Z=r5.resolve(Z);let Q=X.fs||RY$,Y=X.ignore||X.filter||on,G=X.mapStream||kY$,J=X.chown!==!1&&!tn&&UJ4()===0,W=X.extract||AY$.extract(),K=[],H=new Date,N=typeof X.umask==="number"?~X.umask:~IY$(),F=X.strict!==!1,U=X.validateSymlinks!==!1,w=X.map||on,O=typeof X.dmode==="number"?X.dmode:0,D=typeof X.fmode==="number"?X.fmode:0;if(X.strip)w=SY$(w,X.strip);if(X.readable)O|=parseInt(555,8),D|=parseInt(444,8);if(X.writable)O|=parseInt(333,8),D|=parseInt(222,8);if(W.on("entry",L),X.finish)W.on("finish",X.finish);return W;function L(P,M,k){P=w(P)||P,P.name=Nn0(P.name);let q=r5.join(Z,r5.join("/",P.name));if(Y(q,P))return M.resume(),k();let _=r5.join(q,".")===r5.join(Z,".")?Z:r5.dirname(q);MY$(Q,_,r5.join(Z,"."),function(Y0,L0){if(Y0)return k(Y0);if(!L0)return k(Error(_+" is not a valid path"));if(P.type==="directory")return K.push([q,P.mtime]),A(q,{fs:Q,own:J,uid:P.uid,gid:P.gid,mode:P.mode},h);A(_,{fs:Q,own:J,uid:P.uid,gid:P.gid,mode:493},function(E0){if(E0)return k(E0);switch(P.type){case"file":return m();case"link":return x();case"symlink":return b()}if(F)return k(Error("unsupported type for "+q+" ("+P.type+")"));M.resume(),k()})});function h(Y0){if(Y0)return k(Y0);j(q,P,function(L0){if(L0)return k(L0);if(tn)return k();z(q,P,k)})}function b(){if(tn)return k();Q.unlink(q,function(){let Y0=r5.resolve(r5.dirname(q),P.linkname);if(!p(Y0)&&U)return k(Error(q+" is not a valid symlink"));qY$(Q,Y0,r5.join(Z,"."),function(L0,E0){if(L0)return k(L0);if(!E0&&U)return k(Error(q+" is not a valid symlink"));Q.symlink(P.linkname,q,h)})})}function x(){if(tn)return k();Q.unlink(q,function(){let Y0=r5.join(Z,r5.join("/",P.linkname));Q.realpath(Y0,function(L0,E0){if(L0||!p(E0))return k(Error(q+" is not a valid hardlink"));Q.link(E0,q,function(e){if(e&&e.code==="EPERM"&&X.hardlinkAsFilesFallback)return M=Q.createReadStream(E0),m();h(e)})})})}function p(Y0){return Y0===Z||Y0.startsWith(Z+r5.sep)}function m(){let Y0=Q.createWriteStream(q),L0=G(M,P);Y0.on("error",function(E0){L0.destroy(E0)}),TY$(L0,Y0,function(E0){if(E0)return k(E0);Y0.on("close",h)})}}function E(P,M){let k;while((k=FJ4(K))&&P.slice(0,k[0].length)!==k[0])K.pop();if(!k)return M();Q.utimes(k[0],H,k[1],M)}function j(P,M,k){if(X.utimes===!1)return k();if(M.type==="directory")return Q.utimes(P,H,M.mtime,k);if(M.type==="symlink")return E(P,k);Q.utimes(P,H,M.mtime,function(q){if(q)return k(q);E(P,k)})}function z(P,M,k){let q=M.type==="symlink",_=q?Q.lchmod:Q.chmod,h=q?Q.lchown:Q.chown;if(!_)return k();let b=(M.mode|(M.type==="directory"?O:D))&N;if(h&&J)h.call(Q,P,M.uid,M.gid,x);else x(null);function x(p){if(p)return k(p);if(!_)return k();_.call(Q,P,b,k)}}function A(P,M,k){Q.stat(P,function(q){if(!q)return k(null);if(q.code!=="ENOENT")return k(q);Q.mkdir(P,{mode:M.mode,recursive:!0},function(_,h){if(_)return k(_);z(P,M,k)})})}};function qY$($,Z,X,Q){if(Z===X)return Q(null,!0);if(!Z.startsWith(X+r5.sep))return Q(null,!1);$.lstat(Z,function(Y,G){if(Y&&Y.code!=="ENOENT"&&Y.code!=="EPERM")return Q(Y);if(Y||!G.isSymbolicLink())return qY$($,r5.join(Z,".."),X,Q);Q(null,!1)})}function MY$($,Z,X,Q){if(Z===X)return Q(null,!0);$.lstat(Z,function(Y,G){if(Y&&Y.code!=="ENOENT"&&Y.code!=="EPERM")return Q(Y);if(Y||G.isDirectory())return MY$($,r5.join(Z,".."),X,Q);Q(null,!1)})}function on(){}function kY$($){return $}function Nn0($){return tn?$.replace(/\\/g,"/").replace(/[:?<>|]/g,"_"):$}function wJ4($,Z,X,Q,Y,G){if(!Y)Y=["."];let J=Y.slice(0);return function(K){if(!J.length)return K(null);let H=J.shift(),N=r5.join(X,H);Z.call($,N,function(F,U){if(F)return K(Y.indexOf(H)===-1&&F.code==="ENOENT"?null:F);if(!U.isDirectory())return K(null,H,U);$.readdir(N,function(w,O){if(w)return K(w);if(G)O.sort();for(let D=0;D<O.length;D++)if(!Q(r5.join(X,H,O[D])))J.push(r5.join(H,O[D]));K(null,H,U)})})}}function SY$($,Z){return function(X){X.name=X.name.split("/").slice(Z).join("/");let Q=X.linkname;if(Q&&(X.type==="link"||r5.isAbsolute(Q)))X.linkname=Q.split("/").slice(Z).join("/");return $(X)}}});var LJ4,EJ4;var CY$=B(()=>{ti0();LJ4=S(EQ$(),1),EJ4=S(VY$(),1)});var rU0=()=>{};var _Y$=B(()=>{NU0()});var vY$=B(()=>{yU0();xU0();rU0()});var bY$=()=>{};var fY$=()=>{};var Fn0=B(()=>{eX$();ni0();yU0();YQ$();mi0();ti0();GQ$();JQ$();WQ$();KQ$();ii0();HQ$();CY$();rU0();_Y$();vY$();bY$();fY$();rU0()});var O9,k9,qV,rn;var an=B(()=>{O9={CLAIM_API_GROUP:"extensions.agents.x-k8s.io",CLAIM_API_VERSION:"v1alpha1",CLAIM_PLURAL:"sandboxclaims",SANDBOX_API_GROUP:"agents.x-k8s.io",SANDBOX_API_VERSION:"v1alpha1",SANDBOX_PLURAL:"sandboxes",POD_NAME_ANNOTATION:"agents.x-k8s.io/pod-name"};k9=class k9 extends Error{cause;constructor($,Z){super($);if(this.name="SandboxError",this.cause=Z,Z instanceof Error&&Z.stack)this.stack=`${this.stack}
 Caused by: ${Z.stack}`}};qV=class qV extends k9{constructor($,Z){super($,Z);this.name="SandboxTimeoutError"}};rn=class rn extends k9{constructor($,Z){super($,Z);this.name="SandboxAlreadyExistsError"}}});async function jJ4($){let Z=$.getCurrentCluster();if(!Z)throw new k9("No active cluster in kubeconfig");let X={};await $.applyToHTTPSOptions(X);let Q={},Y=X.headers??{};for(let[G,J]of Object.entries(Y))if(Array.isArray(J))Q[G]=J.join(", ");else if(J!==void 0)Q[G]=String(J);if(typeof X.auth==="string"&&!Q.Authorization)Q.Authorization=`Basic ${Buffer.from(X.auth).toString("base64")}`;return{server:Z.server.replace(/\/+$/,""),headers:Q,tls:{cert:Un0(X.cert),key:Un0(X.key),ca:Un0(X.ca),rejectUnauthorized:Z.skipTLSVerify?!1:void 0}}}function Un0($){if($==null)return;if(typeof $==="string")return $;if(Buffer.isBuffer($))return $.toString("utf8");return String($)}async function B3($,Z){let X=await jJ4($),Q={...X.headers,...Z.headers};if(Z.method==="PATCH")Q["content-type"]=Z.patchType==="apply"?"application/apply-patch+yaml":Z.patchType==="strategic-merge"?"application/strategic-merge-patch+json":"application/merge-patch+json";else if(Z.body!==void 0&&!("content-type"in Q))Q["content-type"]="application/json";let Y={method:Z.method,headers:Q,body:Z.body===void 0?void 0:JSON.stringify(Z.body),signal:Z.signal,tls:X.tls,...Z.stream?{timeout:!1}:{}};return fetch(`${X.server}${Z.path}`,Y)}async function wn0($){try{return await $.json()}catch{return null}}async function aU0($,Z){if($.ok)return;let X=await wn0($),Q=X?.message??`${Z} failed: ${$.status} ${$.statusText}`;throw new xY$($.status,X,Q)}async function nx($,Z,X,Q,Y="none"){try{let G=await B3($,Z);if(G.status===404)return null;if(await aU0(G,X),Y==="json")return await G.json();return null}catch(G){throw new k9(Q,G)}}async function sn($,Z,X){let Q=`${On0}/${encodeURIComponent(Z)}/${O9.CLAIM_PLURAL}`,Y;try{Y=await B3($,{method:"POST",path:Q,body:X})}catch(H){let N=H instanceof Error?H.message:String(H);throw console.warn(`[agent-sandbox/client] createSandboxClaim ${X.metadata.name} transport error: ${N}`),new k9(`Failed to create SandboxClaim: ${X.metadata.name} (transport error: ${N})`,H)}if(Y.ok)return;let G=await wn0(Y),J=G?.reason?` ${G.reason}`:"",W=G?.message??Y.statusText,K=`Failed to create SandboxClaim: ${X.metadata.name} (${Y.status}${J}: ${W})`;if(console.warn(`[agent-sandbox/client] createSandboxClaim ${X.metadata.name} rejected: status=${Y.status} reason=${G?.reason??"<none>"} message=${W}`),Y.status===409)throw new rn(K);throw new k9(K)}async function sU0($,Z,X,Q=60000){let Y=Date.now()+Q,G=500,J;while(!0){let W=await D3($,Z,X).catch(()=>{return});if(!W)return;if(J=W,Date.now()>=Y){let K=J.metadata?.finalizers??[],H=J.metadata?.deletionTimestamp??"<unknown>";throw new qV(`SandboxClaim ${X} still terminating after ${Q}ms (deletionTimestamp=${H}, finalizers=[${K.join(", ")}])`)}await y$(500)}}function Bn0($,Z){return`${On0}/${encodeURIComponent($)}/${O9.CLAIM_PLURAL}/${encodeURIComponent(Z)}`}async function eU0($,Z,X,Q){await nx($,{method:"PATCH",path:Bn0(Z,X),patchType:"merge",body:{spec:{lifecycle:{shutdownPolicy:"Delete",shutdownTime:Q}}}},"patchSandboxClaimShutdown",`Failed to patch SandboxClaim shutdownTime: ${X}`)}async function ow($,Z,X){await nx($,{method:"DELETE",path:Bn0(Z,X)},"deleteSandboxClaim",`Failed to delete SandboxClaim: ${X}`)}async function D3($,Z,X){return await nx($,{method:"GET",path:Bn0(Z,X)},"getSandboxClaim",`Failed to get SandboxClaim: ${X}`,"json")??void 0}async function yY$($,Z,X,Q=60){let Y=Date.now()+Q*1000,G=200;while(Date.now()<Y){let W=(await D3($,Z,X).catch(()=>{return}))?.status?.sandbox?.name;if(W)return W;await y$(200)}throw new qV(`SandboxClaim ${X} did not record an adopted Sandbox (status.sandbox.name) within ${Q}s`)}async function gY$($,Z,X){let Y=(await nx($,{method:"GET",path:`${On0}/${encodeURIComponent(Z)}/sandboxwarmpools/${encodeURIComponent(X)}`},"getSandboxWarmPool",`Failed to get SandboxWarmPool: ${X}`,"json"))?.status?.selector;if(!Y)return null;let G=await B3($,{method:"GET",path:`/api/v1/namespaces/${encodeURIComponent(Z)}/pods?labelSelector=${encodeURIComponent(Y)}`});return await aU0(G,"listWarmPoolPods"),((await G.json()).items??[]).filter((W)=>W.status?.phase==="Running").flatMap((W)=>W.metadata?.name&&W.metadata.uid?[{name:W.metadata.name,uid:W.metadata.uid,labels:W.metadata.labels??{}}]:[])}async function hY$($,Z,X,Q){try{let Y=await B3($,{method:"GET",path:`/api/v1/namespaces/${encodeURIComponent(Z)}/pods/${encodeURIComponent(X)}`});if(!Y.ok)return!1;return!(await Y.json()).metadata?.labels?.[Q]}catch{return!1}}function Dn0($,Z){return`${zJ4}/${encodeURIComponent($)}/${lY$}/${encodeURIComponent(Z)}`}async function $w0($,Z,X){let Q=new URLSearchParams({fieldManager:mY$,force:"true"}),Y=`${Dn0(Z,X.metadata.name)}?${Q}`;try{let G=await B3($,{method:"PATCH",path:Y,patchType:"apply",body:X});await aU0(G,"applyHttpRoute")}catch(G){throw new k9(`Failed to apply HTTPRoute: ${X.metadata.name}`,G)}}async function Zw0($,Z,X){await nx($,{method:"DELETE",path:Dn0(Z,X)},"deleteHttpRoute",`Failed to delete HTTPRoute: ${X}`)}async function dY$($,Z,X){return await nx($,{method:"GET",path:Dn0(Z,X)},"getHttpRoute",`Failed to get HTTPRoute: ${X}`,"json")??void 0}async function iY$($,Z,X,Q){let Y={apiVersion:"v1",kind:"Service",metadata:{name:X},spec:{ports:[{name:Q.name,port:Q.port,targetPort:Q.targetPort,protocol:Q.protocol??"TCP"}]}},G=new URLSearchParams({fieldManager:mY$,force:"true"}),J=`/api/v1/namespaces/${encodeURIComponent(Z)}/services/${encodeURIComponent(X)}?${G}`;try{let W=await B3($,{method:"PATCH",path:J,patchType:"apply",body:Y});await aU0(W,"ensureServicePort")}catch(W){throw new k9(`Failed to apply Service ports: ${X}`,W)}}function Xw0($,Z,X,Q=180){let Y=`/apis/${O9.SANDBOX_API_GROUP}/${O9.SANDBOX_API_VERSION}/namespaces/${encodeURIComponent(Z)}/${O9.SANDBOX_PLURAL}?watch=true&fieldSelector=${encodeURIComponent(`metadata.name=${X}`)}`,{resolve:G,reject:J,promise:W}=Promise.withResolvers(),K=new AbortController,H=!1,N=setTimeout(()=>{if(H)return;H=!0,K.abort(),J(new qV(`Sandbox did not become ready within ${Q} seconds`))},Q*1000),F=(U)=>{if(H)return;H=!0,clearTimeout(N),K.abort(),U()};return(async()=>{let U;try{U=await B3($,{method:"GET",path:Y,signal:K.signal,headers:{accept:"application/json"},stream:!0})}catch(w){F(()=>J(new k9("Failed to start watch for sandbox readiness",w)));return}if(!U.ok||!U.body){let w=await wn0(U).catch(()=>null);F(()=>J(new k9(`Watch handshake failed (${U.status}): ${w?.message??U.statusText}`)));return}try{for await(let w of Ln0(U.body)){if(H)return;if(w.type==="ERROR"){let j=w.object;F(()=>J(new k9(`Watch stream error while waiting for sandbox: ${j.message??"unknown"}`)));return}if(w.type!=="ADDED"&&w.type!=="MODIFIED")continue;let O=w.object;if(!O.status?.conditions?.find((j)=>j.type==="Ready"&&j.status==="True"))continue;let L=O.metadata?.name;if(!L){F(()=>J(new k9("Sandbox metadata or name is missing")));return}let E=O.metadata?.annotations?.[O9.POD_NAME_ANNOTATION]??L;F(()=>G({sandboxName:L,podName:E}));return}F(()=>J(new k9("Watch stream closed before sandbox became ready")))}catch(w){if(H)return;if(w instanceof Error&&(w.name==="AbortError"||K.signal.aborted))return;F(()=>J(new k9("Watch stream error while waiting for sandbox",w)))}})(),W}async function*Ln0($){let Z=$.getReader(),X=new TextDecoder,Q="";try{while(!0){let{value:G,done:J}=await Z.read();if(J)break;Q+=X.decode(G,{stream:!0});let W;while((W=Q.indexOf(`
-`))>=0){let K=Q.slice(0,W).trim();if(Q=Q.slice(W+1),!K)continue;yield JSON.parse(K)}}let Y=Q.trim();if(Y)yield JSON.parse(Y)}finally{Z.releaseLock()}}var xY$,On0,uY$="gateway.networking.k8s.io",cY$="v1",lY$="httproutes",zJ4,en,mY$="mesh-sandbox-runner";var $p=B(()=>{B6();an();xY$=class xY$ extends Error{status;body;constructor($,Z,X){super(X);this.status=$;this.body=Z;this.name="KubeHttpError"}};On0=`/apis/${O9.CLAIM_API_GROUP}/${O9.CLAIM_API_VERSION}/namespaces`;zJ4=`/apis/${uY$}/${cY$}/namespaces`;en={API_GROUP:uY$,API_VERSION:cY$,PLURAL:lY$}});function AJ4($){return($.items??[]).some((Z)=>{if(Z.status?.phase!=="Pending")return!1;return(Z.status?.conditions??[]).some((X)=>X.type==="PodScheduled"&&X.status==="False"&&X.reason==="Unschedulable")})}function pY$($,Z){let X=0,Q=!0,Y=null,G=async()=>{try{let J=await B3($,{method:"GET",path:`/api/v1/namespaces/${encodeURIComponent(Z)}/pods?fieldSelector=status.phase%3DPending`});if(!J.ok)return nY$;let W=await J.json();return!AJ4(W)}catch{return nY$}};return async()=>{if(Date.now()-X<PJ4)return Q;return Y??=G().finally(()=>{Y=null}),Q=await Y,X=Date.now(),Q}}var PJ4=3000,nY$=!0;var tY$=B(()=>{$p()});var En0=B(()=>{B6();wm0()});async function Yw0($){try{let Z=await fetch(`${$}/health`,{signal:AbortSignal.timeout(TJ4)});if(!Z.ok)return null;let X=await Z.json();if(typeof X==="object"&&X!==null&&typeof X.bootId==="string"&&typeof X.ready==="boolean"&&X.setup&&typeof X.setup.running==="boolean"&&typeof X.setup.done==="boolean")return X;return null}catch{return null}}async function zn0($){for(let Z=0;Z<oY$;Z++){if(await Yw0($)!==null)return;let X=(Math.random()*2-1)*RJ4;await y$(rY$+X)}throw Error(`sandbox daemon at ${$} did not respond on /health within ${oY$*rY$/1000}s`)}async function MV($,Z,X,Q,Y){return IJ4($,Z,"POST",X,Q,Y)}async function IJ4($,Z,X,Q,Y,G){let J={...Q};if(Y&&Y.rotateToken!==void 0)J.auth=Y;let W=await fetch(`${$}/_sandbox/config`,{method:X,headers:{"Content-Type":"application/json",Authorization:`Bearer ${Z}`},body:JSON.stringify(J),signal:AbortSignal.timeout(G?.timeoutMs??jn0)}),K=await W.text();if(!W.ok)throw new Qw0(W.status,K);return JSON.parse(K)}async function aY$($,Z,X){let Q=await fetch(`${$}/_sandbox/setup/${X}`,{method:"POST",headers:{Authorization:`Bearer ${Z}`},signal:AbortSignal.timeout(jn0)});if(!Q.ok)throw Error(`sandbox daemon /_sandbox/setup/${X} returned ${Q.status}: ${await Q.text()}`)}async function sY$($,Z,X){let Q=await fetch(`${$}/_sandbox/orgfs-config`,{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${Z}`},body:X,signal:AbortSignal.timeout(jn0)}),Y=await Q.text();if(!Q.ok)throw Error(`sandbox daemon /_sandbox/orgfs-config returned ${Q.status}: ${Y}`);return JSON.parse(Y)}async function Zp($,Z,X,Q){let Y=new Headers(Q.headers);for(let W of qJ4)Y.delete(W);Y.set("authorization",`Bearer ${Z}`);let G=Q.method!=="GET"&&Q.method!=="HEAD",J=`${$}${X.startsWith("/")?X:`/${X}`}`;return fetch(J,{method:Q.method,headers:Y,body:G?Q.body:void 0,redirect:"manual",signal:Q.signal,duplex:G?"half":void 0})}var Qw0,TJ4=500,jn0=30000,oY$=25,rY$=200,RJ4=50,qJ4;var eY$=B(()=>{En0();Qw0=class Qw0 extends Error{status;constructor($,Z){super(`sandbox daemon /_sandbox/config returned ${$}: ${Z}`);this.status=$;this.name="ConfigRequestError"}};qJ4=["cookie","host","connection","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","accept-encoding","content-length"]});async function*XG$($){let Z=$.now??(()=>Date.now()),X=Z(),Q=$.schedulingTimeoutMs??SJ4,Y={pod:{},sandbox:{},events:{hasPulling:!1,hasPulled:!1},startedAt:X},G=[],J=null,W=!1,K=(j)=>{if(W)return;if(J){let z=J;J=null,z(j)}else G.push(j)},H=()=>{if(G.length>0)return Promise.resolve(G.shift());if(W)return Promise.resolve(null);return new Promise((j)=>{J=j})},N=()=>{if(W)return;if(W=!0,J){let j=J;J=null,j(null)}},F=new AbortController,U=()=>{F.abort(),N()};if($.signal)if($.signal.aborted)F.abort(),N();else $.signal.addEventListener("abort",U,{once:!0});let w=Math.max(0,Q-(Z()-X)),O=setTimeout(()=>K("tick"),w+100),D,L=new Promise((j)=>{D=j}),E=Promise.allSettled([VJ4($.kc,$.namespace,$.claimName,F.signal,Y,K,Z,D),_J4($.kc,$.namespace,$.claimName,F.signal,Y,K),vJ4($.kc,$.namespace,$.claimName,L,F.signal,Y,K,Z)]);try{let j=null,z=-1,A=$G$(Y,Q,Z);if(j=An0(A),!Pn0(A))z=ZG$(A);if(yield A,Pn0(A))return;while(!W){if(await H()===null)break;let M=$G$(Y,Q,Z);if(Pn0(M)){let _=An0(M);if(_!==j)j=_,yield M;return}let k=ZG$(M);if(k<z)continue;let q=An0(M);if(q!==j)j=q,z=k,yield M}}finally{if(clearTimeout(O),F.abort(),$.signal)$.signal.removeEventListener("abort",U);N(),await E.catch(()=>{})}}function $G$($,Z,X){let{pod:Q,sandbox:Y,events:G,startedAt:J}=$;if(Y.ready)return{kind:"ready"};let W=Q.containerWaitingReason;if(W==="ImagePullBackOff"||W==="ErrImagePull")return{kind:"failed",reason:"image-pull-backoff",message:"Sandbox image failed to download. The cluster may be missing pull credentials or the image tag may not exist."};if(W==="CrashLoopBackOff")return{kind:"failed",reason:"crash-loop-backoff",message:"Sandbox crashed during startup and is now in CrashLoopBackOff. Check pod logs."};if(!Q.scheduled&&G.lastFailedSchedulingAt!==void 0&&X()-J>Z)return{kind:"failed",reason:"scheduling-timeout",message:G.failedSchedulingMessage??`Pod could not be scheduled within ${Math.round(Z/1000)}s.`};if(Q.containerRunning&&!Q.containerReady)return{kind:"warming-daemon",since:J};if(G.hasPulling&&!G.hasPulled)return{kind:"pulling-image",since:J};if(W==="ContainerCreating"||W==="PodInitializing"||Q.scheduled&&!Q.containerRunning)return{kind:"starting-container",since:J};if(Q.scheduledFalseReason==="Unschedulable"||G.lastFailedSchedulingAt!==void 0&&!Q.scheduled)return{kind:"waiting-for-capacity",since:J,message:G.failedSchedulingMessage??Q.scheduledFalseMessage,nodeClaim:G.nominatedNodeClaim};return{kind:"claiming",since:J}}function Pn0($){return $.kind==="ready"||$.kind==="failed"}function ZG$($){switch($.kind){case"claiming":return 0;case"waiting-for-capacity":return 1;case"pulling-image":return 2;case"starting-container":return 3;case"warming-daemon":return 4;case"ready":case"failed":return 99}}function An0($){switch($.kind){case"claiming":case"pulling-image":case"starting-container":case"warming-daemon":return $.kind;case"waiting-for-capacity":return`waiting-for-capacity:${$.message??""}:${$.nodeClaim??""}`;case"ready":return"ready";case"failed":return`failed:${$.reason}:${$.message}`}}async function VJ4($,Z,X,Q,Y,G,J,W){let K=`/api/v1/namespaces/${encodeURIComponent(Z)}/pods?watch=true&labelSelector=${encodeURIComponent(`${MJ4}=${X}`)}`;return Gw0({kc:$,path:K,signal:Q,label:`pod/${X}`,onEvent:(H)=>{if(H.type!=="ADDED"&&H.type!=="MODIFIED")return;let N=H.object;if(N.metadata?.name)W(N.metadata.name);CJ4(N,Y,J),G("pod")}})}function CJ4($,Z,X){let Y=($.status?.conditions??[]).find((J)=>J.type==="PodScheduled");if(Y?.status==="True")Z.pod.scheduled=!0,Z.pod.scheduledFalseReason=void 0,Z.pod.scheduledFalseMessage=void 0;else if(Y?.status==="False")Z.pod.scheduled=!1,Z.pod.scheduledFalseReason=Y.reason,Z.pod.scheduledFalseMessage=Y.message;let G=($.status?.containerStatuses??[]).find((J)=>J.name===kJ4);if(G)Z.pod.containerWaitingReason=G.state?.waiting?.reason,Z.pod.containerRunning=!!G.state?.running,Z.pod.containerReady=G.ready===!0}async function _J4($,Z,X,Q,Y,G){let J=`/apis/${O9.CLAIM_API_GROUP}/${O9.CLAIM_API_VERSION}/namespaces/${encodeURIComponent(Z)}/${O9.CLAIM_PLURAL}?watch=true&fieldSelector=${encodeURIComponent(`metadata.name=${X}`)}`;return Gw0({kc:$,path:J,signal:Q,label:`sandboxclaim/${X}`,onEvent:(W)=>{if(W.type!=="ADDED"&&W.type!=="MODIFIED")return;let H=W.object.status?.conditions?.find((N)=>N.type==="Ready");if(!H)return;if(H.status==="True")Y.sandbox.ready=!0,Y.sandbox.notReadyReason=void 0,Y.sandbox.notReadyMessage=void 0;else Y.sandbox.ready=!1,Y.sandbox.notReadyReason=H.reason,Y.sandbox.notReadyMessage=H.message;G("sandbox")}})}async function vJ4($,Z,X,Q,Y,G,J,W){let K=await Promise.race([Q,new Promise((N)=>{if(Y.aborted){N(X);return}Y.addEventListener("abort",()=>N(X),{once:!0})})]);if(Y.aborted)return;let H=`/api/v1/namespaces/${encodeURIComponent(Z)}/events?watch=true&fieldSelector=${encodeURIComponent(`involvedObject.name=${K},involvedObject.kind=Pod`)}`;return Gw0({kc:$,path:H,signal:Y,label:`events/${X}`,onEvent:(N)=>{if(N.type!=="ADDED"&&N.type!=="MODIFIED")return;let F=N.object,U=F.reason;if(!U)return;switch(U){case"Pulling":G.events.hasPulling=!0;break;case"Pulled":G.events.hasPulling=!0,G.events.hasPulled=!0;break;case"FailedScheduling":G.events.lastFailedSchedulingAt=W(),G.events.failedSchedulingMessage=F.message;break;case"Nominated":{let w=F.message?.match(/nodeclaim\/([\w-]+)/);if(w)G.events.nominatedNodeClaim=w[1];break}default:return}J("event")}})}async function QG$($){let{kc:Z,namespace:X,labelSelector:Q,signal:Y,onDelete:G}=$,J=`/apis/${O9.CLAIM_API_GROUP}/${O9.CLAIM_API_VERSION}/namespaces/${encodeURIComponent(X)}/${O9.CLAIM_PLURAL}?watch=true&labelSelector=${encodeURIComponent(Q)}`;return Gw0({kc:Z,path:J,signal:Y,label:"sandboxclaim-reaper",onEvent:(W)=>{if(W.type!=="DELETED")return;let K=W.object.metadata?.name;if(K)G(K)}})}async function Gw0($){let{kc:Z,path:X,signal:Q,label:Y,onEvent:G}=$,J=0;while(!Q.aborted){try{let K=await B3(Z,{method:"GET",path:X,signal:Q,headers:{accept:"application/json"},stream:!0});if(!K.ok||!K.body){try{await K.body?.cancel()}catch{}if(K.status===401||K.status===403){console.warn(`[lifecycle-watcher] ${Y} stopped: watch denied (${K.status} ${K.statusText}). `+"The kubeconfig in use cannot watch SandboxClaims \u2014 if you are running locally, "+"this provider should not be active (check STUDIO_SANDBOX_PROVIDER / your sandbox preference).");return}throw Error(`watch handshake failed: ${K.status} ${K.statusText}`)}J=0;for await(let H of Ln0(K.body)){if(Q.aborted)return;try{G(H)}catch(N){console.warn(`[lifecycle-watcher] ${Y} onEvent threw: ${N instanceof Error?N.message:String(N)}`)}}}catch(K){if(Q.aborted)return;let H=K instanceof Error?K.message:String(K);console.warn(`[lifecycle-watcher] ${Y} watch ended: ${H}`)}if(Q.aborted)return;let W=JX(5000,250,J,2,0);J+=1,await y$(W,{signal:Q}).catch(()=>{})}}var MJ4="studio.decocms.com/sandbox-handle",kJ4="sandbox",SJ4=300000;var YG$=B(()=>{B6();an();$p()});import{z as vG}from"zod";function GG$($){if(!$||$.trim()==="")return[];let Z=vG.array(bJ4).parse(JSON.parse($)),X=new Set;for(let Q of Z){if(X.has(Q.name))throw Error(`STUDIO_SANDBOX_TENANT_POOLS: duplicate pool name ${Q.name}`);X.add(Q.name)}return Z}function fJ4($){try{let[Z,X]=new URL($).pathname.replace(/^\/+/,"").split("/"),Q=X?.replace(/\.git$/,"");return Z&&Q?`${Z}/${Q}`.toLowerCase():null}catch{return null}}function JG$($,Z){let{orgId:X,cloneUrl:Q}=Z;if(Z.cloneOnly===!0)return null;if(!X||!Q)return null;let Y=fJ4(Q);if(!Y)return null;return $.find((G)=>G.orgId===X&&G.repo.toLowerCase()===Y)??null}function WG$($,Z,X){return $?.name??(Z?X:"none")}function KG$($,Z,X){let Q=X.replace(/^refs\/heads\//,"");return $.filter((Y)=>Y.repo.toLowerCase()===Z.toLowerCase()&&Y.branch===Q)}function HG$($){return`https://github.com/${$.repo}.git`}var bJ4;var Tn0=B(()=>{bJ4=vG.object({name:vG.string().regex(/^[a-z0-9]([-a-z0-9]*[a-z0-9])?$/,"pool name must be a DNS label (lowercase alphanumeric and '-')"),orgId:vG.string().min(1),repo:vG.string().regex(/^[^/\s]+\/[^/\s]+$/,"repo must be `owner/name`"),connectionId:vG.string().min(1).optional(),branch:vG.string().min(1).default("main"),workload:vG.object({runtime:vG.enum(["node","bun","deno"]).default("node"),packageManager:vG.enum(["npm","pnpm","yarn","bun","deno"]).optional(),packageManagerPath:vG.string().optional(),devPort:vG.number().int().positive().optional()}).default({runtime:"node"})})});async function NG$($,Z,X){let Q=new Map;for(let Y of $){let G=Z(Y);if(!G)continue;let J=Q.get(G);if(J)J.push(Y);else Q.set(G,[Y])}await Promise.allSettled([...Q.values()].map(async(Y)=>{for(let G of Y)await X(G).catch(()=>{})}))}import{createHash as xJ4,randomBytes as yJ4,randomUUID as gJ4}from"crypto";import*as DG$ from"net";import{PassThrough as hJ4}from"stream";function uJ4($){if($ instanceof Error)return $.message;if($&&typeof $==="object"){let Z=$;if(Z.error instanceof Error)return Z.error.message;if(typeof Z.message==="string"&&Z.message)return Z.message}return String($)}class Sn0{kind=bQ;records=new Map;inflight=new V90;stateStore;previewUrlPattern;kubeConfig;capacityProbe;portForward;namespace;sandboxTemplateName;envName;tokenGenerator;idleTtlMs;metrics;previewGateway;sentinelToken;mintCloneUrl;tenantPools;tenantPoolRefreshMs;poolPods=new Map;dirtyPools=new Set;closed=!1;claimWatchAbort=new AbortController;constructor($={}){this.stateStore=$.stateStore??null,this.previewUrlPattern=$.previewUrlPattern??null,this.kubeConfig=$.kubeConfig??eJ4(),this.portForward=new oi0(this.kubeConfig),this.namespace=$.namespace??cJ4,this.sandboxTemplateName=$.sandboxTemplateName??lJ4,this.envName=G34($.envName),this.tokenGenerator=$.tokenGenerator??(()=>yJ4(dJ4).toString("hex")),this.idleTtlMs=$.idleTtlMs??iJ4,this.metrics=$.meter?sJ4($.meter):null,this.previewGateway=$.previewGateway&&$.previewUrlPattern?{...$.previewGateway}:null;let Z=$.sentinelToken?.trim()??"";if(this.sentinelToken=Z.length>0?Z:null,this.mintCloneUrl=$.mintCloneUrl,this.tenantPools=this.sentinelToken!==null?$.tenantPools??[]:[],this.sentinelToken===null&&($.tenantPools?.length??0)>0)console.warn(`[${y6}] tenant pools configured without a sentinel token \u2014 ignoring them (warm-pool mode is off)`);this.tenantPoolRefreshMs=$.tenantPoolRefreshMs??pJ4,this.startClaimReaper(),this.startCredentialRefresher(),this.startTenantPoolReconciler()}startClaimReaper(){let $=["app.kubernetes.io/managed-by=studio","app.kubernetes.io/name=studio-sandbox",...this.envName?[`${fQ.env}=${this.envName}`]:[]].join(",");QG$({kc:this.kubeConfig,namespace:this.namespace,labelSelector:$,signal:this.claimWatchAbort.signal,onDelete:(Z)=>this.invalidateRecord(Z)})}async ensure($,Z={}){let X=sL($);if(X.startsWith("s-"))throw Error(`ensure: projectRef has no slug source: ${$.projectRef}`);return this.inflight.run(X,()=>C90(this.stateStore,$,bQ,(Q)=>this.ensureLocked($,X,Z,Q)))}async delete($){let Z=await this.getRecord($);if(this.records.delete($),Z)this.closeForwarder(Z.daemonForward),this.metrics?.active.add(-1,Mn0(Z.tenant));if(await this.deleteHttpRouteIfManaged($).catch((X)=>{console.warn(`[${y6}] HTTPRoute delete failed for ${$}: ${X instanceof Error?X.message:String(X)}`)}),await ow(this.kubeConfig,this.namespace,$),this.stateStore)if(Z)await this.stateStore.delete(Z.id,bQ);else await this.stateStore.deleteByHandle(bQ,$)}async alive($){return await D3(this.kubeConfig,this.namespace,$)!==void 0}watchClaimLifecycle($,Z){return XG$({kc:this.kubeConfig,namespace:this.namespace,claimName:$,signal:Z})}hasSchedulableCapacity(){return this.capacityProbe??=pY$(this.kubeConfig,this.namespace),this.capacityProbe()}async getPreviewUrl($){let Z=await this.getRecord($);if(!Z)return null;return this.composePreviewUrl(Z)}async proxyDaemonRequest($,Z,X){let Q=await this.getRecord($);if(!Q&&this.previewUrlPattern&&this.stateStore){let K=await this.stateStore.getByHandle(bQ,$),H=K?.state,N=H?.token;if(K&&N){let U=`http://${H?.adoptedSandboxName??$}.${this.namespace}.svc.cluster.local:${EN}`;try{let w=await Zp(U,N,Z,X);if(w.status!==404)return w;try{await w.body?.cancel()}catch{}}catch{}}}if(!Q)Q=await this.resurrectByHandle($);if(!Q)return new Response(JSON.stringify({error:"sandbox not found"}),{status:404,headers:{"content-type":"application/json"}});let Y=Q,G=performance.now(),J=0,W=!(X.body instanceof ReadableStream);try{let K=await Zp(Q.daemonUrl,Q.token,Z,X);if(K.status===401&&W){this.invalidateRecord($);let H=await this.getRecord($).catch(()=>null)??await this.resurrectByHandle($).catch(()=>null);if(H)Y=H,K=await Zp(H.daemonUrl,H.token,Z,X)}return J=K.status,K}catch(K){if(!W)throw K;this.invalidateRecord($);let H=await this.resurrectByHandle($)??await this.getRecord($).catch(()=>null);if(!H)throw K;Y=H;let N=await Zp(H.daemonUrl,H.token,Z,X);return J=N.status,N}finally{this.recordProxyDuration("daemon",J,Y,performance.now()-G)}}async adoptLiveClaim($,Z){if(this.records.has(Z))return!0;let X=await D3(this.kubeConfig,this.namespace,Z).catch(()=>{return});if(!X||X.metadata?.deletionTimestamp)return!1;return await this.inflight.run(Z,async()=>{let Y=this.records.get(Z);if(Y)return this.toSandbox(Y);let G=await this.adopt($,Z,X);if(!G)throw Error(`cannot adopt live claim ${Z}`);return C90(this.stateStore,$,bQ,(J)=>this.finish(G,J,!0,!0,"adopt"))}).catch(()=>null)!=null}async resolvePreviewUpstreamUrl($){if(this.previewUrlPattern)return`http://${await this.resolveServiceNameForHandle($)}.${this.namespace}.svc.cluster.local:${EN}`;let Z=await this.getRecord($);if(Z)return Z.daemonUrl;let X=await this.resurrectByHandle($);return X?X.daemonUrl:null}async resolveServiceNameForHandle($){let Z=this.records.get($);if(Z)return Z.adoptedSandboxName;if(this.stateStore){let Q=(await this.stateStore.getByHandle(bQ,$).catch(()=>null))?.state?.adoptedSandboxName;if(Q)return Q}return $}async proxyPreviewRequest($,Z){let X=performance.now(),Q=this.records.get($)??null,Y=0;try{let G=await this.resolvePreviewUpstreamUrl($);if(!G){Y=404;let O=In0(404,{error:"sandbox not found"});return O.headers.set(SV,"1"),O}let J=new URL(Z.url);if((J.pathname==="/_sandbox"||J.pathname.startsWith("/_sandbox/")||J.pathname==="/_decopilot_vm"||J.pathname.startsWith("/_decopilot_vm/"))&&Z.method!=="GET")return Y=404,In0(404,{error:"not found"});let K=(O)=>`${O}${J.pathname}${J.search}`,H=new Headers(Z.headers);for(let O of rJ4)H.delete(O);let N=Z.method!=="GET"&&Z.method!=="HEAD",F={method:Z.method,headers:H,body:N?Z.body:void 0,redirect:"manual",signal:Z.signal,duplex:N?"half":void 0},U;try{U=await fetch(K(G),F)}catch(O){let D=`${G}${J.pathname}`;if(console.warn(`[${y6}] preview fetch to ${D} failed: ${O instanceof Error?O.message:String(O)}`),Z.method==="GET"||Z.method==="HEAD"){if(this.invalidateRecord($),await this.resurrectByHandle($).catch(()=>null)){let j=await this.resolvePreviewUpstreamUrl($);if(j)try{U=await fetch(K(j),F);let z=new Headers;for(let[A,P]of U.headers.entries())if(!wG$.includes(A.toLowerCase()))z.set(A,P);return Y=U.status,new Response(U.body,{status:U.status,statusText:U.statusText,headers:z})}catch(z){console.warn(`[${y6}] preview fetch retry to ${D} failed: ${z instanceof Error?z.message:String(z)}`)}}}else this.invalidateRecord($);Y=502;let L=In0(502,{error:"sandbox daemon unreachable"});return L.headers.set(SV,"1"),L}let w=new Headers;for(let[O,D]of U.headers.entries())if(!wG$.includes(O.toLowerCase()))w.set(O,D);return Y=U.status,new Response(U.body,{status:U.status,statusText:U.statusText,headers:w})}finally{this.recordProxyDuration("preview",Y,Q,performance.now()-X,$)}}async ensureLocked($,Z,X,Q){if(X.image)console.warn(`[${y6}] opts.image ignored (template ${this.sandboxTemplateName} pins image): got ${X.image}`);if(Q){let J=await Q.get($,bQ);if(J){let W=await this.rehydrate($,Z,J);if(W)return await this.refreshDaemonGitCredential(W,X),this.finish(W,Q,!1,!0,"resume");await Q.delete($,bQ)}}let Y=await D3(this.kubeConfig,this.namespace,Z).catch(()=>{return});if(Y)if(Y.metadata?.deletionTimestamp)await sU0(this.kubeConfig,this.namespace,Z).catch((J)=>{console.warn(`[${y6}] wait for terminating claim ${Z} failed: ${J instanceof Error?J.message:String(J)}`)});else{let J=await this.adopt($,Z,Y).catch((W)=>{return console.warn(`[${y6}] adopt ${Z} failed, recreating: ${W instanceof Error?W.message:String(W)}`),null});if(J)return await this.refreshDaemonGitCredential(J,X),this.finish(J,Q,!0,!0,"adopt");await ow(this.kubeConfig,this.namespace,Z).catch(()=>{}),await sU0(this.kubeConfig,this.namespace,Z).catch((W)=>{console.warn(`[${y6}] wait for deleted claim ${Z} failed: ${W instanceof Error?W.message:String(W)}`)})}let G=await this.provision($,Z,X);return this.finish(G,Q,!0,!1,"fresh")}async finish($,Z,X,Q,Y){let G=this.records.get($.handle),J=G!==void 0;if(G&&G.daemonForward!==$.daemonForward)this.closeForwarder(G.daemonForward);if(this.records.set($.handle,$),X)await this.persist(Z,$);if(Q)await eU0(this.kubeConfig,this.namespace,$.handle,this.computeShutdownTime()).catch((W)=>console.warn(`[${y6}] TTL refresh failed for ${$.handle}: ${W instanceof Error?W.message:String(W)}`));if(this.metrics){let W=Mn0($.tenant);if(this.metrics.ensureOutcome.add(1,{...W,outcome:Y}),!J)this.metrics.active.add(1,W)}return this.toSandbox($)}buildEnvMap($,Z){let X={},Q=[];for(let[Y,G]of Object.entries($.env??{}))if(mJ4.has(Y))Q.push(Y);else X[Y]=G;if(Q.length>0)console.warn(`[${y6}] opts.env keys overlap reserved bootstrap names and were dropped: ${Q.join(",")}`);return{...X,DAEMON_TOKEN:Z.token,DAEMON_BOOT_ID:Z.daemonBootId,APP_ROOT:Z.workdir,PROXY_PORT:String(EN)}}buildClaim($,Z,X){let Q=this.sentinelToken!==null,Y=JG$(this.tenantPools,{orgId:Z.tenant?.orgId,cloneUrl:Z.repo?.cloneUrl,cloneOnly:Z.cloneOnly}),G=Q?[]:Object.entries(this.buildEnvMap(Z,X)).sort(([K],[H])=>K<H?-1:K>H?1:0).map(([K,H])=>({name:K,value:H})),J=K34(Z),W=Object.keys(J).length>0;return{apiVersion:`${O9.CLAIM_API_GROUP}/${O9.CLAIM_API_VERSION}`,kind:"SandboxClaim",metadata:{name:$,namespace:this.namespace,labels:{"app.kubernetes.io/name":"studio-sandbox","app.kubernetes.io/managed-by":"studio",...this.envName?{[fQ.env]:this.envName}:{},...qn0(Z.tenant)},...W?{annotations:J}:{}},spec:{sandboxTemplateRef:{name:this.sandboxTemplateName},additionalPodMetadata:{labels:qn0(Z.tenant,{[fQ.role]:"claimed",[fQ.sandboxHandle]:$,...this.envName?{[fQ.env]:this.envName}:{}}),...W?{annotations:J}:{}},env:G,warmpool:WG$(Y,Q,this.sandboxTemplateName),lifecycle:{shutdownPolicy:"Delete",shutdownTime:this.computeShutdownTime()}}}}async provision($,Z,X){let Q=this.tokenGenerator(),Y=gJ4(),G=Rn0,J=this.buildClaim(Z,X,{token:Q,daemonBootId:Y,workdir:G});try{await sn(this.kubeConfig,this.namespace,J)}catch(U){if(U instanceof rn)await sU0(this.kubeConfig,this.namespace,Z),await sn(this.kubeConfig,this.namespace,J);else throw U}let W;try{W=await yY$(this.kubeConfig,this.namespace,Z),await Xw0(this.kubeConfig,this.namespace,W)}catch(U){throw await ow(this.kubeConfig,this.namespace,Z).catch(()=>{}),U}try{await this.ensureServicePortForAdoptedSandbox(W),await this.ensureHttpRouteForHandle(Z,W,X.tenant??null)}catch(U){throw await ow(this.kubeConfig,this.namespace,Z).catch(()=>{}),U}let K=await this.openForwarder(W,EN,Z),H=`http://127.0.0.1:${K.localPort}`,N=this.workloadConfigPayload(X),F=Y;try{if(await zn0(H),this.sentinelToken!==null){let U=await Yw0(H);if(U)F=U.bootId;await MV(H,this.sentinelToken,N??{},{rotateToken:Q})}else if(N)await MV(H,Q,N);await this.relayOrgFsConfig(H,Q,X.orgFsConfigJson)}catch(U){throw this.closeForwarder(K),await this.deleteHttpRouteIfManaged(Z).catch(()=>{}),await ow(this.kubeConfig,this.namespace,Z).catch(()=>{}),U}return{id:$,handle:Z,adoptedSandboxName:W,token:Q,workdir:G,daemonUrl:H,daemonForward:K,workload:X.workload??null,daemonBootId:F,tenant:X.tenant??null,ensureOpts:U34(X)}}workloadConfigPayload($){return v90({runtime:$?.workload?.runtime??"node",packageManager:$?.workload?.packageManager?{name:$.workload.packageManager,...$.workload.packageManagerPath?{path:$.workload.packageManagerPath}:{}}:null,repo:$?.repo??null,port:$?.workload?.devPort??FG$,tenant:$?.tenant??void 0,...$?{cloneOnly:$.cloneOnly===!0}:{}})}async relayOrgFsConfig($,Z,X){if(!X)return;await sY$($,Z,X).catch((Q)=>console.warn("[org-fs] sidecar config relay failed",Q))}async refreshDaemonGitCredential($,Z){let X=Om0(Z);if(!X)return;try{await MV($.daemonUrl,$.token,X)}catch(Q){console.warn(`[${y6}] git credential refresh failed for ${$.handle}: ${Q instanceof Error?Q.message:String(Q)}`)}}async withFreshCloneUrl($,Z){if(!this.mintCloneUrl)return $;try{let X=await this.mintCloneUrl($,Z!==void 0?{bufferMs:Z}:void 0);return X?{...$,cloneUrl:X}:$}catch(X){return console.warn(`[${y6}] clone credential re-mint failed: ${X instanceof Error?X.message:String(X)}`),$}}startCredentialRefresher(){if(!this.mintCloneUrl)return;let{signal:$}=this.claimWatchAbort;(async()=>{while(!$.aborted){if(await y$(tJ4,{signal:$}).catch(()=>{}),$.aborted)break;try{await this.refreshAllGitCredentials()}catch(Z){console.warn(`[${y6}] periodic credential refresh failed: ${Z instanceof Error?Z.message:String(Z)}`)}}})()}startTenantPoolReconciler(){if(this.tenantPools.length===0)return;let{signal:$}=this.claimWatchAbort;(async()=>{while(!$.aborted){try{await this.reconcileTenantPools()}catch(Z){console.warn(`[${y6}] tenant pool reconcile failed: ${Z instanceof Error?Z.message:String(Z)}`)}await y$(nJ4,{signal:$}).catch(()=>{})}})()}markTenantPoolsDirty($,Z){let X=KG$(this.tenantPools,$,Z);for(let Q of X)this.dirtyPools.add(Q.name);return X.map((Q)=>Q.name)}async reconcileTenantPools(){for(let $ of this.tenantPools){let Z=await gY$(this.kubeConfig,this.namespace,$.name);if(Z===null){console.warn(`[${y6}] tenant pool ${$.name}: no SandboxWarmPool (or no selector yet) in ${this.namespace}`);continue}let X=this.dirtyPools.delete($.name),Q=Z.filter((Y)=>!Y.labels[fQ.sandboxHandle]);for(let[Y]of this.poolPods)if(!Z.some((G)=>G.uid===Y))this.poolPods.delete(Y);for(let Y of Q){if(this.claimWatchAbort.signal.aborted)return;await this.warmPoolPod($,Y,X)}this.recordPoolDepth($,Z,Q)}}recordPoolDepth($,Z,X){let Q=this.metrics?.poolPods;if(!Q)return;let Y=0,G=0;for(let W of X){let K=this.poolPods.get(W.uid);if(!K)continue;if(K.failures>=Jw0)G++;else if(K.lastConfigAt>0)Y++}let J={pool:$.name,org:$.orgId};Q.record(Y,{...J,state:"ready"}),Q.record(Z.length-X.length,{...J,state:"bound"}),Q.record(X.length-Y-G,{...J,state:"pending"}),Q.record(G,{...J,state:"failed"})}async warmPoolPod($,Z,X){let Q=this.poolPods.get(Z.uid);if(Q&&Q.failures>=Jw0){if(Date.now()-Q.lastFailureAt<UG$)return;this.poolPods.set(Z.uid,{...Q,failures:0})}let Y=X||Q!==void 0&&Date.now()-Q.lastConfigAt>=this.tenantPoolRefreshMs;if(Q&&!Y)return;let G={cloneUrl:HG$($),connectionId:$.connectionId,branch:$.branch,userName:"",userEmail:""},J=await this.withFreshCloneUrl(G);if($.connectionId&&J.cloneUrl===G.cloneUrl){this.recordPoolFailure(Z,$,"clone credential mint failed");return}let W=await this.openForwarder(Z.name,EN,Z.name).catch(()=>null);if(!W){this.recordPoolFailure(Z,$,"port-forward failed");return}let K=`http://127.0.0.1:${W.localPort}`;try{await zn0(K);let H=this.sentinelToken;if(!H)return;if(!await this.isPoolPodUnbound(Z))return;let N=v90({runtime:$.workload.runtime,packageManager:$.workload.packageManager?{name:$.workload.packageManager,...$.workload.packageManagerPath?{path:$.workload.packageManagerPath}:{}}:null,repo:J,port:$.workload.devPort??FG$})??{},{transition:F}=await MV(K,H,N);if(Y&&F!=="bootstrap"&&await this.isPoolPodUnbound(Z))await aY$(K,H,"clone");this.poolPods.set(Z.uid,{lastConfigAt:Date.now(),lastFailureAt:0,failures:0}),console.log(`[${y6}] tenant pool ${$.name}: warmed ${Z.name} (${F})`)}catch(H){this.recordPoolFailure(Z,$,H instanceof Error?H.message:String(H))}finally{this.closeForwarder(W)}}isPoolPodUnbound($){return hY$(this.kubeConfig,this.namespace,$.name,fQ.sandboxHandle)}recordPoolFailure($,Z,X){let Q=this.poolPods.get($.uid),Y=(Q?.failures??0)+1;this.poolPods.set($.uid,{lastConfigAt:Q?.lastConfigAt??0,lastFailureAt:Date.now(),failures:Y});let G=Y>=Jw0?` \u2014 backing off ${UG$/60000}min`:"";console.warn(`[${y6}] tenant pool ${Z.name}: warming ${$.name} failed (${Y}/${Jw0})${G}: ${X}`)}async refreshAllGitCredentials(){await NG$(this.records.values(),($)=>$.ensureOpts?.repo?.connectionId,async($)=>{if(this.claimWatchAbort.signal.aborted)return;let Z=$.ensureOpts?.repo;if(!Z)return;let X=await this.withFreshCloneUrl(Z,oJ4);await this.refreshDaemonGitCredential($,{...$.ensureOpts,repo:X}),$.ensureOpts={...$.ensureOpts,repo:X}})}async rebootstrapDaemon($,Z,X){if(this.sentinelToken===null)return!1;let Q=this.workloadConfigPayload(X)??{};try{return await MV($,this.sentinelToken,Q,{rotateToken:Z}),await this.relayOrgFsConfig($,Z,X?.orgFsConfigJson),!0}catch(Y){if(Y instanceof Qw0&&Y.status===401)try{return await MV($,Z,Q,{rotateToken:Z}),await this.relayOrgFsConfig($,Z,X?.orgFsConfigJson),!0}catch(G){return console.warn(`[${y6}] re-bootstrap retry with claim token failed: ${G instanceof Error?G.message:String(G)}`),!1}return console.warn(`[${y6}] re-bootstrap failed: ${Y instanceof Error?Y.message:String(Y)}`),!1}}async ensureServicePortForAdoptedSandbox($){if(!this.previewGateway||!this.previewUrlPattern)return;await iY$(this.kubeConfig,this.namespace,$,{name:"daemon",port:EN,targetPort:EN})}async ensureHttpRouteForHandle($,Z,X){if(!this.previewGateway||!this.previewUrlPattern)return;let Q=w34(this.previewUrlPattern,$);if(!Q)throw new k9(`Unable to derive preview hostname for ${$} from pattern: ${this.previewUrlPattern}`);let Y={apiVersion:`${en.API_GROUP}/${en.API_VERSION}`,kind:"HTTPRoute",metadata:{name:$,namespace:this.namespace,labels:qn0(X??void 0,{[fQ.role]:"claimed",[fQ.sandboxHandle]:$,"app.kubernetes.io/name":"studio-sandbox","app.kubernetes.io/managed-by":"studio",...this.envName?{[fQ.env]:this.envName}:{}})},spec:{parentRefs:[{kind:"Gateway",group:"gateway.networking.k8s.io",name:this.previewGateway.name,namespace:this.previewGateway.namespace}],hostnames:[Q],rules:[{backendRefs:[{group:"",kind:"Service",name:Z,port:EN}]}]}};await $w0(this.kubeConfig,this.namespace,Y)}async deleteHttpRouteIfManaged($){if(!this.previewGateway)return;await Zw0(this.kubeConfig,this.namespace,$)}async rehydrate($,Z,X){let Q=X.state;if(!Q.adoptedSandboxName&&!Q.podName||!Q.token)return null;let Y=await D3(this.kubeConfig,this.namespace,Z).catch(()=>{return});if(!Y||!OG$(Y))return null;let G=Y.status?.sandbox?.name??Q.adoptedSandboxName??Q.podName??Z,J=await this.openAndProbeDaemon(G,Z);if(!J)return null;if(Q.daemonBootId&&Q.daemonBootId!==J.bootId){if(this.sentinelToken!==null){let W=Q.ensureOpts?.repo?{...Q.ensureOpts,repo:await this.withFreshCloneUrl(Q.ensureOpts.repo)}:Q.ensureOpts??null;if(!await this.rebootstrapDaemon(J.daemonUrl,Q.token,W))return this.closeForwarder(J.daemonForward),null}else console.warn(`[${y6}] daemon restart detected (handle=${Z}): stored bootId=${Q.daemonBootId} live bootId=${J.bootId}`);await this.stateStore?.put($,bQ,{handle:Z,state:{...Q,daemonBootId:J.bootId}}).catch((W)=>console.warn(`[${y6}] bootId persist failed for ${Z}: ${W instanceof Error?W.message:String(W)}`))}return{id:$,handle:Z,adoptedSandboxName:G,token:Q.token,workdir:Q.workdir??Rn0,daemonUrl:J.daemonUrl,daemonForward:J.daemonForward,workload:Q.workload??null,daemonBootId:J.bootId,tenant:Q.tenant??null,ensureOpts:Q.ensureOpts??null}}async adopt($,Z,X){if(!OG$(X))return null;let Q=X.status?.sandbox?.name??Z;if(this.sentinelToken!==null)return null;let Y=$34(X);if(!Y)return null;let G=await this.openAndProbeDaemon(Q,Z);if(!G)return null;let J=H34(X);if(this.previewGateway)await this.ensureServicePortForAdoptedSandbox(Q).catch((W)=>{console.warn(`[${y6}] Service port backfill failed for ${Z}: ${W instanceof Error?W.message:String(W)}`)}),await this.ensureHttpRouteForHandle(Z,Q,J).catch((W)=>{console.warn(`[${y6}] HTTPRoute backfill failed for ${Z}: ${W instanceof Error?W.message:String(W)}`)});return{id:$,handle:Z,adoptedSandboxName:Q,token:Y,workdir:Rn0,daemonUrl:G.daemonUrl,daemonForward:G.daemonForward,workload:null,daemonBootId:G.bootId,tenant:J,ensureOpts:null}}async openAndProbeDaemon($,Z){let X=await this.openForwarder($,EN,Z).catch(()=>null);if(!X)return null;let Q=`http://127.0.0.1:${X.localPort}`,Y=await Yw0(Q);if(!Y)return this.closeForwarder(X),null;return{daemonForward:X,daemonUrl:Q,bootId:Y.bootId}}async getRecord($){let Z=this.records.get($);if(Z)return Z;if(!this.stateStore)return null;let X=await this.stateStore.getByHandle(bQ,$);if(!X)return null;let Q=await this.rehydrate(X.id,$,X);if(Q)this.records.set($,Q);return Q}async resurrectByHandle($){if(!this.stateStore)return null;let Z=await this.stateStore.getByHandle(bQ,$);if(!Z)return null;let X=Z.state.ensureOpts;if(!X)return null;let Q=X.repo?{...X,repo:await this.withFreshCloneUrl(X.repo)}:X;if(sL(Z.id)!==$)return null;return await this.ensure(Z.id,Q),this.records.get($)??null}invalidateRecord($){let Z=this.records.get($);if(!Z)return;this.records.delete($),this.closeForwarder(Z.daemonForward)}recordProxyDuration($,Z,X,Q,Y){if(!this.metrics)return;this.metrics.proxyDurationMs.record(Q,{...Mn0(X?.tenant??null),source:$,sandbox_handle:X?.handle??Y??"",status_code:Z||0})}composePreviewUrl($){if(this.previewUrlPattern)return _90(this.previewUrlPattern,$.handle);return`http://127.0.0.1:${$.daemonForward.localPort}/`}toSandbox($){return{handle:$.handle,workdir:$.workdir,previewUrl:this.composePreviewUrl($)}}async persist($,Z){if(!$)return;let X={adoptedSandboxName:Z.adoptedSandboxName,token:Z.token,workdir:Z.workdir,workload:Z.workload,daemonBootId:Z.daemonBootId,tenant:Z.tenant,...Z.ensureOpts?{ensureOpts:Z.ensureOpts}:{}};await $.put(Z.id,bQ,{handle:Z.handle,state:X})}computeShutdownTime(){return new Date(Date.now()+this.idleTtlMs).toISOString()}async releaseAfter($,Z){let X=await D3(this.kubeConfig,this.namespace,$);if(!X)return;let Q=N34(X.spec?.lifecycle?.shutdownTime,new Date(Date.now()+Z));if(!Q)return;await eU0(this.kubeConfig,this.namespace,$,Q).catch((Y)=>console.warn(`[${y6}] release failed for ${$}: ${Y instanceof Error?Y.message:String(Y)}`))}async renewTtl($){let Z=await D3(this.kubeConfig,this.namespace,$);if(!Z)return;let X=F34(Z.spec?.lifecycle?.shutdownTime,new Date(Date.now()+this.idleTtlMs));if(!X)return;await eU0(this.kubeConfig,this.namespace,$,X).catch((Q)=>console.warn(`[${y6}] TTL renew failed for ${$}: ${Q instanceof Error?Q.message:String(Q)}`))}openForwarder($,Z,X=$){let Q=Z34(X,Z);return new Promise((Y,G)=>{let J=(W,K)=>{let H=DG$.createServer((N)=>this.handleForwardedConnection(N,$,Z,X));H.once("error",(N)=>{if(N.code==="EADDRINUSE"&&K<aJ4){try{H.close()}catch{}let F=kn0+(W-kn0+1)%LG$;J(F,K+1);return}G(N)}),H.listen(W,"127.0.0.1",()=>{let N=H.address();if(!N||typeof N==="string"){H.close(),G(Error("port-forward listener failed to bind"));return}Y({server:H,localPort:N.port})})};J(Q,0)})}handleForwardedConnection($,Z,X,Q){let Y=new hJ4,G=null,J=!1,W=()=>{if(J)return;if(J=!0,Y.destroy(),G)try{G.close()}catch{}if(!$.destroyed)$.destroy()};$.pipe(Y),$.on("error",W),$.on("close",W),this.portForward.portForward(this.namespace,Z,[X],$,null,Y).then((K)=>{let H=typeof K==="function"?K():K;if(!H){W();return}if(G=H,G.on("close",W),G.on("error",()=>{this.invalidateRecord(Q),W()}),J)try{G.close()}catch{}}).catch((K)=>{console.warn(`[${y6}] port-forward to ${Z}:${X} failed: ${uJ4(K)}`,JSON.stringify(EG$(K))),this.invalidateRecord(Q),W()})}closeForwarder($){$.server.close((Z)=>{if(Z)console.warn(`[${y6}] port-forward close on :${$.localPort} errored: ${Z instanceof Error?Z.message:String(Z)}`)})}close(){if(this.closed)return;this.closed=!0,this.claimWatchAbort.abort();for(let $ of this.records.values())this.closeForwarder($.daemonForward);this.records.clear()}}function sJ4($){return{active:$.createUpDownCounter("studio.sandbox.active",{description:"Active sandbox count, by runner kind, owning org, and daemon impl. Cross-checks the cAdvisor-derived count from the cluster \u2014 divergence between the two indicates orphaned claims (studio deleted but K8s didn't reap) or unattributed pods.",unit:"{sandbox}"}),ensureOutcome:$.createCounter("studio.sandbox.ensure.outcome",{description:"Outcome of each ensure() call: fresh provision, resume from state-store after restart, or adopt of a cluster-side claim studio didn't know about. Cold-start ratio is the primary input for warm-pool sizing.",unit:"{call}"}),proxyDurationMs:$.createHistogram("studio.sandbox.proxy.duration_ms",{description:"Wall-clock latency of studio-mediated requests to the sandbox daemon: tool exec proxies (source=daemon) and preview iframe traffic (source=preview).",unit:"ms"}),poolPods:$.createGauge("studio.sandbox.pool.pods",{description:"Tenant warm pool depth by pool and state: ready (warmed and unbound \u2014 what a claim can actually bind instantly), bound (serving a user), pending (unbound, not yet warmed), failed (gave up after repeated bootstrap failures). Alert on sustained ready=0: a pool that is always empty is doing nothing while costing N pods.",unit:"{pod}"})}}function EG$($){let Z=[],X=$;for(let Q=0;Q<5&&X instanceof Error;Q++){let Y=X;if(Z.push({name:Y.name,message:Y.message,...Y.code!==void 0?{code:Y.code}:{},...Y.errno!==void 0?{errno:Y.errno}:{}}),Y.cause===X)break;X=Y.cause}if(X!==void 0&&!(X instanceof Error)&&X!==null){let Q=X,Y=Q.error instanceof Error?EG$(Q.error).chain:void 0;Z.push({nonError:String(X),...typeof Q.type==="string"?{type:Q.type}:{},...typeof Q.message==="string"?{message:Q.message}:{},...Q.code!==void 0?{code:Q.code}:{},...typeof Q.reason==="string"?{reason:Q.reason}:{},...Y?{error:Y}:{},...Y===void 0&&Q.error!==void 0?{rawError:String(Q.error)}:{},keys:Object.keys(Q)})}return{chain:Z}}function eJ4(){let $=new cx;return $.loadFromDefault(),$}function OG$($){return Boolean($.status?.conditions?.some((Z)=>Z.type==="Ready"&&Z.status==="True"))}function $34($){let Z=$.spec?.env;if(!Z)return null;for(let X of Z)if(X.name==="DAEMON_TOKEN"&&X.value)return X.value;return null}function Z34($,Z){let X=xJ4("sha256").update(`${$}:${Z}`).digest();return kn0+X.readUInt32BE(0)%LG$}function In0($,Z){return new Response(JSON.stringify(Z),{status:$,headers:{"content-type":"application/json","access-control-allow-origin":"*"}})}function BG$($){let Z=$.slice(0,Q34);return X34.test(Z)?Z:""}function G34($){if($===void 0)return null;let Z=$.trim();if(Z==="")return null;if(!Y34.test(Z))throw Error(`AgentSandboxProvider: envName=${JSON.stringify(Z)} is not a valid DNS-label-safe environment name (lowercase alphanumeric or '-', starts with a letter, ends alphanumeric, \u226432 chars). Studio sets this from STUDIO_ENV; check the studio chart's configMap.`);return Z}function qn0($,Z={}){let X={...Z};if($){let Q=BG$($.orgId),Y=BG$($.userId);if(Q)X[fQ.orgId]=Q;if(Y)X[fQ.userId]=Y}return X}function kV($){let Z="";for(let X of $){let Q=X.codePointAt(0)??0;Z+=Q<32||Q===127?" ":X}return Z.slice(0,J34)}function W34($){try{let Z=new URL($);return Z.username="",Z.password="",Z.toString()}catch{return""}}function K34($){let Z={},X=$.tenant;if(X?.orgSlug)Z[L3.orgSlug]=kV(X.orgSlug);if(X?.orgName)Z[L3.orgName]=kV(X.orgName);if(X?.userEmail)Z[L3.userEmail]=kV(X.userEmail);if(X?.userName)Z[L3.userName]=kV(X.userName);let Q=$.repo;if(Q){if(Q.displayName)Z[L3.gitRepo]=kV(Q.displayName);let Y=W34(Q.cloneUrl);if(Y)Z[L3.gitRepoUrl]=kV(Y);let G=$.branch??Q.branch;if(G)Z[L3.gitBranch]=kV(G)}return Z}function H34($){let Z=$.metadata?.labels;if(!Z)return null;let X=Z[fQ.orgId],Q=Z[fQ.userId];if(!X||!Q)return null;let Y=$.metadata?.annotations??{};return{orgId:X,userId:Q,orgSlug:Y[L3.orgSlug],orgName:Y[L3.orgName],userEmail:Y[L3.userEmail],userName:Y[L3.userName]}}function N34($,Z){if($){let X=new Date($).getTime();if(Number.isFinite(X)&&X<=Z.getTime())return null}return Z.toISOString()}function F34($,Z){if($){let X=new Date($).getTime();if(Number.isFinite(X)&&X>=Z.getTime())return null}return Z.toISOString()}function Mn0($){return{org_id:$?.orgId??"",user_id:$?.userId??"",runner_kind:bQ}}function U34($){let Z={};if($.branch)Z.branch=$.branch;if($.repo)Z.repo=$.repo;if($.workload)Z.workload=$.workload;if($.env&&Object.keys($.env).length>0)Z.env=$.env;if($.tenant)Z.tenant=$.tenant;if($.orgFsConfigJson)Z.orgFsConfigJson=$.orgFsConfigJson;return Object.keys(Z).length>0?Z:null}function w34($,Z){try{return new URL(_90($,Z)).hostname||null}catch{return null}}var bQ="agent-sandbox",y6="AgentSandboxProvider",SV="x-sandbox-preview-not-ready",cJ4="agent-sandbox-system",lJ4="studio-sandbox",EN=9000,FG$=3000,Rn0="/app",dJ4=32,mJ4,iJ4=900000,nJ4=60000,pJ4=1800000,Jw0=3,UG$=1800000,tJ4=900000,oJ4=1800000,rJ4,wG$,kn0=40000,LG$=1e4,aJ4=256,fQ,L3,X34,Q34=63,Y34,J34=253;var jG$=B(()=>{B6();tY$();Fn0();eY$();Bm0();$p();an();YG$();Tn0();mJ4=new Set(["DAEMON_TOKEN","DAEMON_BOOT_ID","APP_ROOT","PROXY_PORT"]),rJ4=["cookie","host","connection","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","accept-encoding","content-length","upgrade"],wG$=["connection","keep-alive","transfer-encoding","content-encoding","content-length"];fQ={role:"studio.decocms.com/role",sandboxHandle:"studio.decocms.com/sandbox-handle",orgId:"studio.decocms.com/org-id",userId:"studio.decocms.com/user-id",env:"studio.decocms.com/env"},L3={orgSlug:"studio.decocms.com/org-slug",orgName:"studio.decocms.com/org-name",userEmail:"studio.decocms.com/user-email",userName:"studio.decocms.com/user-name",gitRepo:"studio.decocms.com/git-repo",gitRepoUrl:"studio.decocms.com/git-repo-url",gitBranch:"studio.decocms.com/git-branch"},X34=/^([A-Za-z0-9]([-A-Za-z0-9_.]*[A-Za-z0-9])?)?$/;Y34=/^[a-z]([a-z0-9-]{0,30}[a-z0-9])?$/});var zG$={};H4(zG$,{waitForSandboxReady:()=>Xw0,parseTenantPools:()=>GG$,getSandboxClaim:()=>D3,getHttpRoute:()=>dY$,deleteSandboxClaim:()=>ow,deleteHttpRoute:()=>Zw0,createSandboxClaim:()=>sn,applyHttpRoute:()=>$w0,SandboxTimeoutError:()=>qV,SandboxError:()=>k9,PREVIEW_NOT_READY_HEADER:()=>SV,KubeConfig:()=>cx,K8S_CONSTANTS:()=>O9,HTTPROUTE_CONSTANTS:()=>en,AgentSandboxProvider:()=>Sn0});var Vn0=B(()=>{Fn0();an();$p();jG$();Tn0()});var qG$={};H4(qG$,{subscribeLifecycle:()=>bn0,getSandboxProviderByKind:()=>_n0,getOrInitSharedRunner:()=>vn0,__resetSharedLifecyclesForTesting:()=>I34});function RG$($,Z){let X=PG$[$];if(X)return Promise.resolve(X);let Q=Cn0[$];if(Q)return Q;let Y=Z().then((G)=>{return PG$[$]=G,G}).finally(()=>{delete Cn0[$]});return Cn0[$]=Y,Y}function D34(){let $=process.env.STUDIO_SANDBOX_PREVIEW_URL_PATTERN;return $&&$.trim()!==""?$:void 0}function L34(){let $=process.env.STUDIO_SANDBOX_TEMPLATE_NAME;return $&&$.trim()!==""?$:void 0}function E34(){let $=process.env.STUDIO_ENV;return $&&$.trim()!==""?$:void 0}function j34(){let $=process.env.STUDIO_SANDBOX_SENTINEL_TOKEN;return $&&$.trim()!==""?$:void 0}function z34(){let $=process.env.STUDIO_SANDBOX_PREVIEW_GATEWAY_NAME?.trim(),Z=process.env.STUDIO_SANDBOX_PREVIEW_GATEWAY_NAMESPACE?.trim();if(!$&&!Z)return;if(!$||!Z)throw Error("STUDIO_SANDBOX_PREVIEW_GATEWAY_NAME and STUDIO_SANDBOX_PREVIEW_GATEWAY_NAMESPACE must both be set, or both unset. Half-configured per-claim HTTPRoute routing would silently fail to attach.");return{name:$,namespace:Z}}async function IG$($,Z){let X=new Sn(Z),Q=D34();switch($){case"agent-sandbox":{let{AgentSandboxProvider:Y,parseTenantPools:G}=await Promise.resolve().then(() => (Vn0(),zG$)),J=new qH(c0().encryptionKey);return new Y({stateStore:X,previewUrlPattern:Q,sandboxTemplateName:L34(),envName:E34(),previewGateway:z34(),sentinelToken:j34(),tenantPools:G(process.env.STUDIO_SANDBOX_TENANT_POOLS),meter:W8,mintCloneUrl:async(W,K)=>{if(!W.connectionId)return null;let H=F5$(W.cloneUrl);if(!H)return null;let{cloneUrl:N}=await gw(W.connectionId,H.owner,H.name,Z,J,{bufferMs:K?.bufferMs});return N}})}case"user-desktop":throw Error("user-desktop provider cannot be instantiated without a per-run link claim \u2014 call resolveSandboxProvider, which binds the link before constructing the provider.");default:throw Error(`Unknown sandbox provider kind: ${String($)}`)}}function _n0($,Z){return RG$(Z,()=>IG$(Z,$.db))}async function vn0(){let $;try{$=eL()}catch(X){return console.warn("[lifecycle] cannot resolve sandbox runner:",X instanceof Error?X.message:String(X)),null}return await RG$($,()=>IG$($,c8().db))}function bn0($,Z,X){let Q=rw.get(Z);if(Q){if(Q.terminated){if(Q.lastPhase)try{X(Q.lastPhase)}catch{}return{unsubscribe:T34}}if(Q.listeners.add(X),Q.lastPhase)try{X(Q.lastPhase)}catch{}return AG$(Z,Q,X)}let Y=new AbortController,G={lastPhase:null,terminated:!1,listeners:new Set([X]),abort:Y};return rw.set(Z,G),R34($,Z,G),AG$(Z,G,X)}function T34(){}function AG$($,Z,X){return{unsubscribe(){if(rw.get($)!==Z)return;if(Z.listeners.delete(X),Z.listeners.size===0)rw.delete($),Z.abort.abort()}}}async function R34($,Z,X){let Q=null;try{for await(let Y of $.watchClaimLifecycle(Z,X.abort.signal)){if(X.abort.signal.aborted)break;X.lastPhase=Y;let G=Y.kind==="ready"||Y.kind==="failed";if(G)X.terminated=!0;let J=Array.from(X.listeners);for(let W of J)try{W(Y)}catch{}if(G)break}}catch(Y){Q=Y}finally{if(!X.terminated&&!X.abort.signal.aborted&&X.listeners.size>0){let Y={kind:"failed",reason:"unknown",message:Q instanceof Error?Q.message:"Lifecycle watcher ended unexpectedly"};X.lastPhase=Y,X.terminated=!0;for(let G of Array.from(X.listeners))try{G(Y)}catch{}}if(rw.get(Z)===X)rw.delete(Z)}}function I34(){for(let $ of rw.values())$.abort.abort();rw.clear()}var O34,B34,TG$,PG$,Cn0,P34,A34,rw;var Xp=B(()=>{FN();GG();N5();Em0();Vn();bc();S$();O34=Symbol.for("decocms.sandbox.lifecycle.runners"),B34=Symbol.for("decocms.sandbox.lifecycle.inflight"),TG$=globalThis,PG$=TG$[O34]??={},Cn0=TG$[B34]??={};P34=Symbol.for("decocms.sandbox.lifecycle.shared-lifecycles"),A34=globalThis,rw=A34[P34]??=new Map});async function hX($,Z){let{userId:X,branch:Q,virtualMcpMetadata:Y,explicitKind:G}=Z;if(G)return Qp($,G);if($.sandboxPreference==="agent-sandbox")return Qp($,"agent-sandbox");if($.sandboxPreference==="cluster-default")return Qp($,eL());let[J,...W]=q34(Y,X,Q);if(J)return Qp($,W.length===0?J:M34(J,W));return Qp($,MG$())}function q34($,Z,X){let Q=C5($)[Z]?.[X];if(!Q)return[];let Y=AJ(Q);return Object.keys(Y)}function M34($,Z){let X=MG$();if(X===$||Z.includes(X))return X;return $}function MG$(){return eL()}async function Qp($,Z){let X=Z==="user-desktop"?"agent-sandbox":Z;return{provider:await _n0($,X),kind:X}}var aw=B(()=>{B8();FN();kQ();Xp()});var Yp;var fn0=B(()=>{Yp={npm:{install:"npm install",run:($)=>`npm run ${$}`,runtime:"node"},pnpm:{install:"pnpm install",run:($)=>`pnpm run ${$}`,runtime:"node"},yarn:{install:"yarn install",run:($)=>`yarn run ${$}`,runtime:"node"},bun:{install:"bun install",run:($)=>`bun run ${$}`,runtime:"bun"},deno:{install:"deno install",run:($)=>`deno task ${$}`,runtime:"deno"}}});function E3($,Z){return Z?`thread:${$}/${Z}`:`thread:${$}`}function jN($){return`sandbox/thread-${$.replace(/^thread:/,"").replace(/\//g,"-")}`}function sw($){if(!$||!$.startsWith("thread:"))return null;return $.slice(7).split("/")[0]||null}async function zN($,Z,X){let Q=sw(Z);if(!Q)return X;return(await $.storage.threads.get(Q).catch(()=>null))?.created_by??X}async function VV($,Z){if(!Z)return null;let X=await $.storage.threads.get(Z).catch(()=>null);if(!X)return null;return X.metadata??{}}async function kG$($,Z){let Q=(await VV($,Z))?.headRef;return typeof Q==="string"&&Q.length>0?Q:null}async function SG$($,Z,X){let Q=await VV($,Z);if(!Q)return;if(Q.headRef===X)return;await $.storage.threads.update(Z,{metadata:{...Q,headRef:X}}).catch((Y)=>console.warn("[thread-repo] setThreadHeadRef failed",Y))}async function ew($,Z){return(await VV($,Z))?.githubRepo??null}function xn0($){if($.pinnedRef)return $.pinnedRef;if($.runBranch&&$.runBranch===E3($.threadId))return $.runBranch;if($.threadRepo)return E3($.threadId,$.threadRepo.connectionId);if(!$.agentRepo)return"ephemeral";return $.runBranch??`thread:${$.threadId}`}async function yn0($,Z){let Q=(await VV($,Z))?.pinnedRef;return typeof Q==="string"&&Q.length>0?Q:null}async function VG$($,Z){let[X,Q]=await Promise.all([ew($,Z.threadId),yn0($,Z.threadId)]);return xn0({...Z,threadRepo:X,pinnedRef:Q})}async function CG$($,Z,X,Q,Y,G){let J=await VV($,Z);if(!J)return;let W=kn(C5(J),X,Q,Y,G);await $.storage.threads.update(Z,{metadata:{...J,sandboxMap:W}}).catch((K)=>console.warn("[thread-repo] setThreadSandboxMapEntry failed",K))}async function Ww0($,Z){return C5(await VV($,Z))}async function _G$($,Z,X,Q,Y){let G=await VV($,Z);if(!G)return;let J=Lm0(C5(G),X,Q,Y);if(!J)return;await $.storage.threads.update(Z,{metadata:{...G,sandboxMap:J}}).catch((W)=>console.warn("[thread-repo] removeThreadSandboxMapEntry failed",W))}var j3=B(()=>{kQ()});function Kw0($){if(!$)return null;let Z=$.runtime;if(!Z||typeof Z!=="object")return null;let X=Z.env;if(!Array.isArray(X))return null;let Q=[];for(let Y of X){if(!Y||typeof Y!=="object")continue;let G=Y;if(typeof G.key!=="string"||!b00.test(G.key))continue;if(G.kind==="literal"&&typeof G.value==="string"){Q.push({key:G.key,kind:"literal",value:G.value});continue}if(G.kind==="secret"&&typeof G.secretId==="string"&&G.secretId.length>0)Q.push({key:G.key,kind:"secret",secretId:G.secretId})}return Q.length===0?null:Q}function vG$($){if(!$)return null;let Z=$.runtime;if(!Z||typeof Z!=="object")return null;let X=Z.submoduleCredentials;if(!Array.isArray(X))return null;let Q=[];for(let Y of X){if(!Y||typeof Y!=="object")continue;let G=Y;if(typeof G.host==="string"&&G.host.length>0&&typeof G.secretId==="string"&&G.secretId.length>0)Q.push({host:G.host,secretId:G.secretId})}return Q.length===0?null:Q}async function bG$($,Z){$0(Z);let X=r(Z);await Z.access.check();let Q=W1(Z);if(!Q)throw Error("User ID required");let Y=await Z.storage.virtualMcps.findById($.virtualMcpId);if(!Y||Y.organization_id!==X.id)throw Error("Virtual MCP not found");let G=Y.metadata??{},J=C5(G),W=await zN(Z,$.branch,Q),K=eW(J,W,$.branch,$.sandboxProviderKind);return{virtualMcp:Y,metadata:G,userId:Q,sandboxUserId:W,entry:K,organization:X}}function k34($){if($===null||!/^\d+$/.test($))return null;let Z=Number($);return Z>=1&&Z<=65535?$:null}function fG$($){let Z=$.runtime??null,Q=Z?.selected??null,Y=k34(Z?.port??null),G=Z?.path??null;if(!Q||!(Q in Yp))return{packageManager:null,runtime:null,port:Y,packageManagerPath:G,runtimeBinPath:null};let J=Yp[Q].runtime;return{packageManager:Q,runtime:J,port:Y,packageManagerPath:G,runtimeBinPath:J==="deno"?"/opt/deno/bin":J==="bun"?"/opt/bun/bin":null}}var Gp=B(()=>{B8();fn0();kQ();j3()});async function $O($,Z){let X=$.body?.getReader();if(!X)return $.text();let Q=new TextDecoder,Y="",G=0;for(;;){let{done:J,value:W}=await X.read();if(J)break;if(G+=W.byteLength,G>Z)throw await X.cancel().catch(()=>{}),new xG$(`Upstream response exceeded ${Z} bytes`);Y+=Q.decode(W,{stream:!0})}return Y+=Q.decode(),Y}var xG$;var Jp=B(()=>{xG$=class xG$ extends Error{}});async function Hw0({ctx:$,runner:Z,handle:X,orgId:Q,userId:Y,entries:G}){if(!G||G.length===0)return;let J={};for(let K of G){if(K.kind==="literal"){J[K.key]=K.value;continue}try{let{value:H}=await $.storage.secrets.resolveById(K.secretId,Q,Y);J[K.key]=H}catch(H){if(H instanceof BG||H instanceof $w){console.warn(`[SANDBOX_START] skipping env ${K.key}: ${H.message}. Re-link or recreate the secret to restore.`);continue}throw H}}if(Object.keys(J).length===0)return;let W=await Z.proxyDaemonRequest(X,"/_sandbox/config",{method:"PUT",headers:new Headers({"content-type":"application/json"}),body:JSON.stringify({env:J})});if(!W.ok){let K=await $O(W,S34).catch(()=>W.statusText);console.warn(`[SANDBOX_START] daemon rejected env patch (${W.status}): ${K}`)}}var S34=10485760;var gn0=B(()=>{Zm();Jp()});async function yG$({ctx:$,orgId:Z,userId:X,entries:Q}){if(!Q||Q.length===0)return[];let Y=[];for(let G of Q)try{let{value:J}=await $.storage.secrets.resolveById(G.secretId,Z,X);Y.push({host:G.host,token:J})}catch(J){if(J instanceof BG||J instanceof $w){console.warn(`[SANDBOX_START] skipping submodule credential for ${G.host}: ${J.message}. Re-link or recreate the secret to restore.`);continue}throw J}return Y}var gG$=B(()=>{Zm()});async function cG$($,Z,X,Q,Y){let G=await eH({connectionId:$,tokenStorage:new E5(Q,Y)});if(!G.accessToken)return null;return dG$(Z,X,G.accessToken)}function lG$($,Z){return dG$($,Z,null)}async function dG$($,Z,X){let Q=new Map,Y=new Set(hG$.map((K)=>K.path));for(let K of Object.values(uG$))for(let H of K??[])Y.add(H);await Promise.all(Array.from(Y).map(async(K)=>{Q.set(K,await C34($,Z,K,X))}));let G=hG$.find(({path:K})=>Q.get(K)!==null);if(!G)return null;let J=uG$[G.pm]??[],W=null;for(let K of J)if(W=_34(Q.get(K)??null),W)break;return{packageManager:G.pm,devPort:W}}async function C34($,Z,X,Q){let Y=`https://api.github.com/repos/${$}/${Z}/contents/${encodeURIComponent(X)}`;try{let G={Accept:"application/vnd.github+json","User-Agent":"studio-runtime-detect"};if(Q)G.Authorization=`token ${Q}`;let J=await fetch(Y,{headers:G,signal:AbortSignal.timeout(5000)});if(!J.ok)return null;let W=await J.json();if(!W.content||W.encoding!=="base64")return null;return Buffer.from(W.content,"base64").toString("utf8")}catch{return null}}function _34($){if(!$)return null;try{let Z=JSON.parse($),X=Z.tasks??Z.scripts??{};return(X.dev??X.start??"").match(V34)?.[1]??null}catch{return null}}var hG$,uG$,V34;var mG$=B(()=>{Pw();X3();hG$=[{path:"deno.json",pm:"deno"},{path:"deno.jsonc",pm:"deno"},{path:"bun.lock",pm:"bun"},{path:"bunfig.toml",pm:"bun"},{path:"pnpm-lock.yaml",pm:"pnpm"},{path:"yarn.lock",pm:"yarn"},{path:"package-lock.json",pm:"npm"},{path:"package.json",pm:"bun"}],uG$={deno:["deno.json","deno.jsonc"],bun:["package.json"],pnpm:["package.json"],yarn:["package.json"],npm:["package.json"]},V34=/(?:--port|PORT=|:)(\d{4,5})/});function v34($){return($??"").normalize("NFKD").replace(/[\u0300-\u036F]/g,"").toLowerCase().replace(/[^a-z0-9]+/g,"-").replace(/^-+|-+$/g,"")||"user"}function Nw0($){return $?.name||$?.email?.split("@")[0]||void 0}function Fw0($){let Z=v34($),X=Date.now().toString(36).split("").reverse().join("");return`${Z}-${X}`}function iG$($){let{current:Z,detached:X,base:Q}=$.status??{};if(typeof Z!=="string"||Z.length===0)return null;if(X===!0)return null;if(Z===$.requestedRef)return null;if(b34.has(Z))return null;if(typeof Q==="string"&&Q.length>0&&Z===Q)return null;return Z}function nG$($){if(!$.branch.startsWith("thread:"))return $.branch;if($.sticky&&$.recordedHeadRef)return $.recordedHeadRef;return $.derivedRef}var b34;var hn0=B(()=>{b34=new Set(["main","master","trunk","develop","HEAD"])});async function pG$($,Z){if(!$)return{hosts:[],allowSameHostDev:!1};let X;try{X=await $.presignedGetUrl("link-dispatch/_allowlist_probe",60,{requireFetchable:!0})}catch{return{hosts:[],allowSameHostDev:!1}}let Q;try{Q=new URL(X)}catch{return{hosts:[],allowSameHostDev:!1}}if(Q.protocol!=="https:"&&Q.protocol!=="http:")return{hosts:[],allowSameHostDev:!1};let Y=Q.hostname,G=f34.has(Y);return{hosts:[Y],allowSameHostDev:G&&!Z.isProduction}}var f34;var tG$=B(()=>{f34=new Set(["127.0.0.1","localhost","::1","[::1]","0.0.0.0"])});import{z as GK}from"zod";async function px($,Z){$0(Z);let X=r(Z),Q=W1(Z);if(!Q)throw Error("User ID required");let Y=await Z.storage.virtualMcps.findById($.virtualMcpId);if(!Y||Y.organization_id!==X.id)throw Error("Virtual MCP not found");let G=Y.metadata??{},J=await zN(Z,$.branch,Q),W=eW(C5(G),J,$.branch,$.sandboxProviderKind),K=$.sandboxProviderKind,{provider:H}=await hX(Z,{userId:J,branch:$.branch,virtualMcpMetadata:G,explicitKind:K});if(W){if(K!=="user-desktop")return W;if(await H.alive(W.sandboxHandle).catch(()=>!1))return W;await yw(Z.storage.virtualMcps,$.virtualMcpId,Q,J,$.branch,K).catch((O)=>{console.warn("[ensureSandbox] failed to reap stale user-desktop entry",O)})}let F=await ew(Z,sw($.branch)??Z.metadata?.threadId)??G.githubRepo??null,{entry:U}=await rG$({ctx:Z,userId:Q,sandboxUserId:J,orgId:X.id,virtualMcpId:$.virtualMcpId,branch:$.branch,metadata:G,githubRepo:F,existing:null,providerKind:K,runner:H,...$.cloneOnly?{cloneOnly:!0}:{}});return U}async function rG$($){let{ctx:Z,userId:X,sandboxUserId:Q,orgId:Y,virtualMcpId:G,branch:J,metadata:W,githubRepo:K,existing:H,runner:N,cloneOnly:F}=$,{runtime:U,packageManager:w,port:O,packageManagerPath:D}=fG$(W),L;if(K){if(K.connectionId)await Vx({ctx:Z,connectionId:K.connectionId,organizationId:Y,forceRefresh:!0,onLegacyMintError:(f0)=>{console.error("[provisionSandbox] repo-scoped legacy token mint failed",{connectionId:K.connectionId,error:f0.message})}});let{cloneUrl:E0,gitUserName:e,gitUserEmail:t}=K.connectionId?await gw(K.connectionId,K.owner,K.name,Z.db,Z.vault):N5$(K.owner,K.name);if(!w){let f0=K.connectionId?await cG$(K.connectionId,K.owner,K.name,Z.db,Z.vault):await lG$(K.owner,K.name);if(f0)w=f0.packageManager,U=Yp[f0.packageManager].runtime,O=f0.devPort??O,await y34(Z,G,X,f0.packageManager,f0.devPort)}let P0=c0().sandboxStickyHeadRefEnabled,Q0=nG$({branch:J,derivedRef:jN(J),recordedHeadRef:P0?await kG$(Z,sw(J)):null,sticky:P0}),j0=await yG$({ctx:Z,orgId:Y,userId:X,entries:vG$(W)});L={cloneUrl:E0,...K.connectionId?{connectionId:K.connectionId}:{},userName:e,userEmail:t,branch:Q0,displayName:`${K.owner}/${K.name}`,...j0.length>0?{submoduleCredentials:j0}:{}}}let E=typeof W.productionUrl==="string"&&W.productionUrl.trim()?W.productionUrl.trim():void 0,j=U&&w&&!F?{runtime:U,packageManager:w,...O!==null?{devPort:Number(O)}:{},...D?{packageManagerPath:D}:{},...E?{productionUrl:E}:{}}:void 0,z=In({orgId:Y,virtualMcpId:G,branch:J}),A=N.kind==="user-desktop"?await pG$(Z.objectStorage,{isProduction:c0().nodeEnv==="production"}):null,P=(N.kind==="user-desktop"||N.kind==="agent-sandbox")&&!c0().orgFsMountsDisabled,M;if(P){let E0=Z.organization?.slug??(await Z.db.selectFrom("organization").select(["slug"]).where("id","=",Y).executeTakeFirst())?.slug;if(E0)M=await je1(Z,{orgSlug:E0,orgId:Y,baseUrl:eX()})}await h34(N);let k=await N.ensure({userId:Q,projectRef:z},{branch:J,repo:L,workload:j,cloneOnly:F===!0,tenant:{orgId:Y,userId:Q,...Z.organization?.slug?{orgSlug:Z.organization.slug}:{},...Z.organization?.name?{orgName:Z.organization.name}:{},...Z.auth.user?.email?{userEmail:Z.auth.user.email}:{},...Z.auth.user?.name?{userName:Z.auth.user.name}:{}},...A?{offloadAllowedHosts:A.hosts,offloadAllowSameHostDev:A.allowSameHostDev}:{},...M?{orgFsConfigJson:M}:{}}),q=W.runtime?.env??null;await Hw0({ctx:Z,runner:N,handle:k.handle,orgId:Y,userId:X,entries:q});let h=!!H&&H.sandboxHandle===k.handle&&H?.createdAt?H.createdAt:Date.now(),b=W.runtime?.selected??null,x=W.runtime?.port??null,p=W.runtime?.path??null,m={sandboxHandle:k.handle,previewUrl:k.previewUrl,sandboxApiUrl:k.previewUrl,sandboxProviderKind:N.kind,createdAt:h,startedWith:{packageManager:b,port:x,path:p}};await $5$(Z.storage.virtualMcps,G,X,Q,J,$.providerKind,m);let Y0=sw(J);if(Y0)await CG$(Z,Y0,Q,J,$.providerKind,m);let L0=!H||H.sandboxHandle!==k.handle;return{entry:m,isNewVm:L0}}async function y34($,Z,X,Q,Y){let G=await $.storage.virtualMcps.findById(Z);if(!G)return;let J=G.metadata??{};await $.storage.virtualMcps.update(Z,X,{metadata:{...J,runtime:{selected:Q,port:Y}}})}async function h34($){if(!$.hasSchedulableCapacity)return;let Z=Date.now()+oG$,X=!1;while(!await $.hasSchedulableCapacity()){if(Date.now()>=Z)throw Error(`sandbox provisioning failed: the cluster has had no room to schedule another sandbox for ${Math.round(oG$/1000)}s`);if(!X)X=!0,console.warn("[ensureSandbox] waiting for cluster capacity \u2014 a sandbox pod cannot be scheduled right now");await y$(g34)}}var x34,un0,oG$=150000,g34=5000;var Wp=B(()=>{FN();B6();b0();Gp();gn0();gG$();kQ();Vn();mG$();fn0();aw();j3();hn0();tG$();S$();BZ();ui();kQ();x34=GK.enum(["agent-sandbox","user-desktop","cluster"]),un0=d({name:"SANDBOX_START",description:"Start a sandbox with the connected GitHub repo and dev server.",annotations:{title:"Start VM Preview",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!1,openWorldHint:!0},_meta:{ui:{visibility:"app"}},inputSchema:GK.object({virtualMcpId:GK.string().describe("Virtual MCP ID"),branch:GK.string().min(1).optional().describe("Git branch to check out. Pass the thread's branch whenever the caller has one: when omitted the handler mints a fresh `<user-slug>-<timestamp>` name, which becomes a SEPARATE sandbox from the one the thread's own branch resolves to. The resolved branch is returned in the response so callers can persist it."),sandboxProviderKind:x34.optional().describe("Explicit runtime choice. Hosted provider is `agent-sandbox`; legacy `cluster` input is accepted only for compatibility and normalized to `agent-sandbox`. When omitted, defaults to `user-desktop` if the acting user's link daemon is online, else the env kind.")}),outputSchema:GK.object({previewUrl:GK.string().nullable(),sandboxHandle:GK.string(),branch:GK.string(),isNewVm:GK.boolean(),sandboxProviderKind:GK.enum(["agent-sandbox","user-desktop"])}),handler:async($,Z)=>{$0(Z);let X=r(Z);await Z.access.check();let Q=$.branch??Fw0(Nw0(Z.auth.user)),Y=W1(Z);if(!Y)throw Error("User ID required");let G=await zN(Z,Q,Y),J=await Z.storage.virtualMcps.findById($.virtualMcpId);if(!J||J.organization_id!==X.id)throw Error("Virtual MCP not found");let W=J.metadata??{},K=$.sandboxProviderKind?aL($.sandboxProviderKind):void 0,{provider:H,kind:N}=await hX(Z,{userId:G,branch:Q,virtualMcpMetadata:W,explicitKind:K}),F=eW(C5(W),G,Q,N),w=await ew(Z,sw(Q)??Z.metadata?.threadId)??W.githubRepo??null,{entry:O,isNewVm:D}=await rG$({ctx:Z,userId:Y,sandboxUserId:G,orgId:X.id,virtualMcpId:$.virtualMcpId,branch:Q,metadata:W,githubRepo:w,existing:F,providerKind:N,runner:H});return{...O,branch:Q,isNewVm:D,sandboxProviderKind:N}}})});function u34($){let{publicUrl:Z,agentId:X,organization:Q,target:Y,threadId:G}=$;if(Y==="agent-tools")return`${Z}/mcp/virtual-mcp/${X}`;if(!Q.slug)throw new sG$(Q.id);if(Y==="task-run"){if(!G)throw Error("a task-run MCP endpoint is scoped to a run: threadId is required");return`${Z}/api/${Q.slug}/mcp/task-run/${encodeURIComponent(G)}`}return`${Z}/api/${Q.slug}/mcp/self`}async function Uw0($,Z,X,Q,Y="agent-tools",G){let J=u34({publicUrl:eX(),agentId:Z,organization:X,target:Y,...G?{threadId:G}:{}}),W=await $.boundAuth.apiKey.create({name:Q,permissions:{"*":["*"]},expiresIn:aG$,metadata:{organization:{id:X.id,slug:X.slug,name:X.name}}});return{url:J,headers:{Authorization:`Bearer ${W.key}`,"x-org-id":X.id},expiresAt:Date.now()+aG$*1000}}var aG$=3600,sG$;var cn0=B(()=>{BZ();sG$=class sG$ extends Error{constructor($){super(`cannot mint a management MCP endpoint for organization "${$}": the org-scoped path /api/<slug>/mcp/self needs the org slug, which was not loaded.`);this.name="MissingOrganizationSlugError"}}});async function c34($,Z,X,Q){try{let Y=$.organization;if(!Y)return;let G=await Uw0($,Q.virtualMcpId,Y,"tool-scripting"),J=await Z.proxyDaemonRequest(X,"/_sandbox/tools/sync",{method:"POST",headers:new Headers({"content-type":"application/json"}),body:JSON.stringify(G)});if(!J.ok)console.warn("[cluster-sandbox-fs] tools/sync failed",J.status,await J.text().catch(()=>""))}catch(Y){console.warn("[cluster-sandbox-fs] tools/sync failed",Y)}}async function tx($,Z){let{provider:X,kind:Q}=await hX($,{userId:Z.userId,branch:Z.branch,virtualMcpMetadata:null}),Y=null,G=()=>{if(!Y){if(Y=px({virtualMcpId:Z.virtualMcpId,branch:Z.branch,sandboxProviderKind:Q},$).then((K)=>K.sandboxHandle),Y.catch(()=>{Y=null}),Z.syncTools)Y.then((K)=>c34($,X,K,{virtualMcpId:Z.virtualMcpId,providerKind:Q})).catch(()=>{})}return Y},J=Z.branch==="ephemeral"||Q==="user-desktop";return Dm0(X,{ensureHandle:G,invalidateHandle:async(K)=>{let H=Y;if(Y=null,!J&&!K?.force)return;try{await yw($.storage.virtualMcps,Z.virtualMcpId,Z.userId,Z.userId,Z.branch,Q)}catch(N){console.warn("[cluster-sandbox-fs] failed to reap vmMap entry",N)}if(H&&typeof X.forgetHandle==="function")try{let N=await H;await X.forgetHandle(N)}catch(N){console.warn("[cluster-sandbox-fs] forgetHandle failed",N)}},canAutoRestart:J})}async function eG$($,Z){try{let X=await tx($,Z),{stdout:Q}=await X.onBash("test -d .deco && echo __DECO_SITE__");return Q.includes("__DECO_SITE__")}catch(X){return console.warn("[cluster-sandbox-fs] .deco probe failed; assuming deco site",X),!0}}var ww0=B(()=>{FN();cn0();aw();Wp();kQ()});import{z as $J$}from"zod";function ox($){let Z=[];for(let X of $){if(X.status!=="active")continue;let Q=_X(X);if(!Q)continue;Z.push({connectionId:X.id,owner:Q.owner,repo:Q.repo,installationId:Q.installationId})}return Z}async function d34($,Z){let{items:X}=await $.storage.connections.list(Z,{slug:"mcp-github"});return ox(X)}function m34($){let Z=$.split(`
+`))>=0){let K=Q.slice(0,W).trim();if(Q=Q.slice(W+1),!K)continue;yield JSON.parse(K)}}let Y=Q.trim();if(Y)yield JSON.parse(Y)}finally{Z.releaseLock()}}var xY$,On0,uY$="gateway.networking.k8s.io",cY$="v1",lY$="httproutes",zJ4,en,mY$="mesh-sandbox-runner";var $p=B(()=>{B6();an();xY$=class xY$ extends Error{status;body;constructor($,Z,X){super(X);this.status=$;this.body=Z;this.name="KubeHttpError"}};On0=`/apis/${O9.CLAIM_API_GROUP}/${O9.CLAIM_API_VERSION}/namespaces`;zJ4=`/apis/${uY$}/${cY$}/namespaces`;en={API_GROUP:uY$,API_VERSION:cY$,PLURAL:lY$}});function AJ4($){return($.items??[]).some((Z)=>{if(Z.status?.phase!=="Pending")return!1;return(Z.status?.conditions??[]).some((X)=>X.type==="PodScheduled"&&X.status==="False"&&X.reason==="Unschedulable")})}function pY$($,Z){let X=0,Q=!0,Y=null,G=async()=>{try{let J=await B3($,{method:"GET",path:`/api/v1/namespaces/${encodeURIComponent(Z)}/pods?fieldSelector=status.phase%3DPending`});if(!J.ok)return nY$;let W=await J.json();return!AJ4(W)}catch{return nY$}};return async()=>{if(Date.now()-X<PJ4)return Q;return Y??=G().finally(()=>{Y=null}),Q=await Y,X=Date.now(),Q}}var PJ4=3000,nY$=!0;var tY$=B(()=>{$p()});var En0=B(()=>{B6();wm0()});async function Yw0($){try{let Z=await fetch(`${$}/health`,{signal:AbortSignal.timeout(TJ4)});if(!Z.ok)return null;let X=await Z.json();if(typeof X==="object"&&X!==null&&typeof X.bootId==="string"&&typeof X.ready==="boolean"&&X.setup&&typeof X.setup.running==="boolean"&&typeof X.setup.done==="boolean")return X;return null}catch{return null}}async function zn0($){for(let Z=0;Z<oY$;Z++){if(await Yw0($)!==null)return;let X=(Math.random()*2-1)*RJ4;await y$(rY$+X)}throw Error(`sandbox daemon at ${$} did not respond on /health within ${oY$*rY$/1000}s`)}async function MV($,Z,X,Q,Y){return IJ4($,Z,"POST",X,Q,Y)}async function IJ4($,Z,X,Q,Y,G){let J={...Q};if(Y&&Y.rotateToken!==void 0)J.auth=Y;let W=await fetch(`${$}/_sandbox/config`,{method:X,headers:{"Content-Type":"application/json",Authorization:`Bearer ${Z}`},body:JSON.stringify(J),signal:AbortSignal.timeout(G?.timeoutMs??jn0)}),K=await W.text();if(!W.ok)throw new Qw0(W.status,K);return JSON.parse(K)}async function aY$($,Z,X){let Q=await fetch(`${$}/_sandbox/setup/${X}`,{method:"POST",headers:{Authorization:`Bearer ${Z}`},signal:AbortSignal.timeout(jn0)});if(!Q.ok)throw Error(`sandbox daemon /_sandbox/setup/${X} returned ${Q.status}: ${await Q.text()}`)}async function sY$($,Z,X){let Q=await fetch(`${$}/_sandbox/orgfs-config`,{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${Z}`},body:X,signal:AbortSignal.timeout(jn0)}),Y=await Q.text();if(!Q.ok)throw Error(`sandbox daemon /_sandbox/orgfs-config returned ${Q.status}: ${Y}`);return JSON.parse(Y)}async function Zp($,Z,X,Q){let Y=new Headers(Q.headers);for(let W of qJ4)Y.delete(W);Y.set("authorization",`Bearer ${Z}`);let G=Q.method!=="GET"&&Q.method!=="HEAD",J=`${$}${X.startsWith("/")?X:`/${X}`}`;return fetch(J,{method:Q.method,headers:Y,body:G?Q.body:void 0,redirect:"manual",signal:Q.signal,duplex:G?"half":void 0})}var Qw0,TJ4=500,jn0=30000,oY$=25,rY$=200,RJ4=50,qJ4;var eY$=B(()=>{En0();Qw0=class Qw0 extends Error{status;constructor($,Z){super(`sandbox daemon /_sandbox/config returned ${$}: ${Z}`);this.status=$;this.name="ConfigRequestError"}};qJ4=["cookie","host","connection","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","accept-encoding","content-length"]});async function*XG$($){let Z=$.now??(()=>Date.now()),X=Z(),Q=$.schedulingTimeoutMs??SJ4,Y={pod:{},sandbox:{},events:{hasPulling:!1,hasPulled:!1},startedAt:X},G=[],J=null,W=!1,K=(j)=>{if(W)return;if(J){let z=J;J=null,z(j)}else G.push(j)},H=()=>{if(G.length>0)return Promise.resolve(G.shift());if(W)return Promise.resolve(null);return new Promise((j)=>{J=j})},N=()=>{if(W)return;if(W=!0,J){let j=J;J=null,j(null)}},F=new AbortController,U=()=>{F.abort(),N()};if($.signal)if($.signal.aborted)F.abort(),N();else $.signal.addEventListener("abort",U,{once:!0});let w=Math.max(0,Q-(Z()-X)),O=setTimeout(()=>K("tick"),w+100),D,L=new Promise((j)=>{D=j}),E=Promise.allSettled([VJ4($.kc,$.namespace,$.claimName,F.signal,Y,K,Z,D),_J4($.kc,$.namespace,$.claimName,F.signal,Y,K),vJ4($.kc,$.namespace,$.claimName,L,F.signal,Y,K,Z)]);try{let j=null,z=-1,A=$G$(Y,Q,Z);if(j=An0(A),!Pn0(A))z=ZG$(A);if(yield A,Pn0(A))return;while(!W){if(await H()===null)break;let M=$G$(Y,Q,Z);if(Pn0(M)){let _=An0(M);if(_!==j)j=_,yield M;return}let k=ZG$(M);if(k<z)continue;let q=An0(M);if(q!==j)j=q,z=k,yield M}}finally{if(clearTimeout(O),F.abort(),$.signal)$.signal.removeEventListener("abort",U);N(),await E.catch(()=>{})}}function $G$($,Z,X){let{pod:Q,sandbox:Y,events:G,startedAt:J}=$;if(Y.ready)return{kind:"ready"};let W=Q.containerWaitingReason;if(W==="ImagePullBackOff"||W==="ErrImagePull")return{kind:"failed",reason:"image-pull-backoff",message:"Sandbox image failed to download. The cluster may be missing pull credentials or the image tag may not exist."};if(W==="CrashLoopBackOff")return{kind:"failed",reason:"crash-loop-backoff",message:"Sandbox crashed during startup and is now in CrashLoopBackOff. Check pod logs."};if(!Q.scheduled&&G.lastFailedSchedulingAt!==void 0&&X()-J>Z)return{kind:"failed",reason:"scheduling-timeout",message:G.failedSchedulingMessage??`Pod could not be scheduled within ${Math.round(Z/1000)}s.`};if(Q.containerRunning&&!Q.containerReady)return{kind:"warming-daemon",since:J};if(G.hasPulling&&!G.hasPulled)return{kind:"pulling-image",since:J};if(W==="ContainerCreating"||W==="PodInitializing"||Q.scheduled&&!Q.containerRunning)return{kind:"starting-container",since:J};if(Q.scheduledFalseReason==="Unschedulable"||G.lastFailedSchedulingAt!==void 0&&!Q.scheduled)return{kind:"waiting-for-capacity",since:J,message:G.failedSchedulingMessage??Q.scheduledFalseMessage,nodeClaim:G.nominatedNodeClaim};return{kind:"claiming",since:J}}function Pn0($){return $.kind==="ready"||$.kind==="failed"}function ZG$($){switch($.kind){case"claiming":return 0;case"waiting-for-capacity":return 1;case"pulling-image":return 2;case"starting-container":return 3;case"warming-daemon":return 4;case"ready":case"failed":return 99}}function An0($){switch($.kind){case"claiming":case"pulling-image":case"starting-container":case"warming-daemon":return $.kind;case"waiting-for-capacity":return`waiting-for-capacity:${$.message??""}:${$.nodeClaim??""}`;case"ready":return"ready";case"failed":return`failed:${$.reason}:${$.message}`}}async function VJ4($,Z,X,Q,Y,G,J,W){let K=`/api/v1/namespaces/${encodeURIComponent(Z)}/pods?watch=true&labelSelector=${encodeURIComponent(`${MJ4}=${X}`)}`;return Gw0({kc:$,path:K,signal:Q,label:`pod/${X}`,onEvent:(H)=>{if(H.type!=="ADDED"&&H.type!=="MODIFIED")return;let N=H.object;if(N.metadata?.name)W(N.metadata.name);CJ4(N,Y,J),G("pod")}})}function CJ4($,Z,X){let Y=($.status?.conditions??[]).find((J)=>J.type==="PodScheduled");if(Y?.status==="True")Z.pod.scheduled=!0,Z.pod.scheduledFalseReason=void 0,Z.pod.scheduledFalseMessage=void 0;else if(Y?.status==="False")Z.pod.scheduled=!1,Z.pod.scheduledFalseReason=Y.reason,Z.pod.scheduledFalseMessage=Y.message;let G=($.status?.containerStatuses??[]).find((J)=>J.name===kJ4);if(G)Z.pod.containerWaitingReason=G.state?.waiting?.reason,Z.pod.containerRunning=!!G.state?.running,Z.pod.containerReady=G.ready===!0}async function _J4($,Z,X,Q,Y,G){let J=`/apis/${O9.CLAIM_API_GROUP}/${O9.CLAIM_API_VERSION}/namespaces/${encodeURIComponent(Z)}/${O9.CLAIM_PLURAL}?watch=true&fieldSelector=${encodeURIComponent(`metadata.name=${X}`)}`;return Gw0({kc:$,path:J,signal:Q,label:`sandboxclaim/${X}`,onEvent:(W)=>{if(W.type!=="ADDED"&&W.type!=="MODIFIED")return;let H=W.object.status?.conditions?.find((N)=>N.type==="Ready");if(!H)return;if(H.status==="True")Y.sandbox.ready=!0,Y.sandbox.notReadyReason=void 0,Y.sandbox.notReadyMessage=void 0;else Y.sandbox.ready=!1,Y.sandbox.notReadyReason=H.reason,Y.sandbox.notReadyMessage=H.message;G("sandbox")}})}async function vJ4($,Z,X,Q,Y,G,J,W){let K=await Promise.race([Q,new Promise((N)=>{if(Y.aborted){N(X);return}Y.addEventListener("abort",()=>N(X),{once:!0})})]);if(Y.aborted)return;let H=`/api/v1/namespaces/${encodeURIComponent(Z)}/events?watch=true&fieldSelector=${encodeURIComponent(`involvedObject.name=${K},involvedObject.kind=Pod`)}`;return Gw0({kc:$,path:H,signal:Y,label:`events/${X}`,onEvent:(N)=>{if(N.type!=="ADDED"&&N.type!=="MODIFIED")return;let F=N.object,U=F.reason;if(!U)return;switch(U){case"Pulling":G.events.hasPulling=!0;break;case"Pulled":G.events.hasPulling=!0,G.events.hasPulled=!0;break;case"FailedScheduling":G.events.lastFailedSchedulingAt=W(),G.events.failedSchedulingMessage=F.message;break;case"Nominated":{let w=F.message?.match(/nodeclaim\/([\w-]+)/);if(w)G.events.nominatedNodeClaim=w[1];break}default:return}J("event")}})}async function QG$($){let{kc:Z,namespace:X,labelSelector:Q,signal:Y,onDelete:G}=$,J=`/apis/${O9.CLAIM_API_GROUP}/${O9.CLAIM_API_VERSION}/namespaces/${encodeURIComponent(X)}/${O9.CLAIM_PLURAL}?watch=true&labelSelector=${encodeURIComponent(Q)}`;return Gw0({kc:Z,path:J,signal:Y,label:"sandboxclaim-reaper",onEvent:(W)=>{if(W.type!=="DELETED")return;let K=W.object.metadata?.name;if(K)G(K)}})}async function Gw0($){let{kc:Z,path:X,signal:Q,label:Y,onEvent:G}=$,J=0;while(!Q.aborted){try{let K=await B3(Z,{method:"GET",path:X,signal:Q,headers:{accept:"application/json"},stream:!0});if(!K.ok||!K.body){try{await K.body?.cancel()}catch{}if(K.status===401||K.status===403){console.warn(`[lifecycle-watcher] ${Y} stopped: watch denied (${K.status} ${K.statusText}). `+"The kubeconfig in use cannot watch SandboxClaims \u2014 if you are running locally, "+"this provider should not be active (check STUDIO_SANDBOX_PROVIDER / your sandbox preference).");return}throw Error(`watch handshake failed: ${K.status} ${K.statusText}`)}J=0;for await(let H of Ln0(K.body)){if(Q.aborted)return;try{G(H)}catch(N){console.warn(`[lifecycle-watcher] ${Y} onEvent threw: ${N instanceof Error?N.message:String(N)}`)}}}catch(K){if(Q.aborted)return;let H=K instanceof Error?K.message:String(K);console.warn(`[lifecycle-watcher] ${Y} watch ended: ${H}`)}if(Q.aborted)return;let W=JX(5000,250,J,2,0);J+=1,await y$(W,{signal:Q}).catch(()=>{})}}var MJ4="studio.decocms.com/sandbox-handle",kJ4="sandbox",SJ4=300000;var YG$=B(()=>{B6();an();$p()});import{z as vG}from"zod";function GG$($){if(!$||$.trim()==="")return[];let Z=vG.array(bJ4).parse(JSON.parse($)),X=new Set;for(let Q of Z){if(X.has(Q.name))throw Error(`STUDIO_SANDBOX_TENANT_POOLS: duplicate pool name ${Q.name}`);X.add(Q.name)}return Z}function fJ4($){try{let[Z,X]=new URL($).pathname.replace(/^\/+/,"").split("/"),Q=X?.replace(/\.git$/,"");return Z&&Q?`${Z}/${Q}`.toLowerCase():null}catch{return null}}function JG$($,Z){let{orgId:X,cloneUrl:Q}=Z;if(Z.cloneOnly===!0)return null;if(!X||!Q)return null;let Y=fJ4(Q);if(!Y)return null;return $.find((G)=>G.orgId===X&&G.repo.toLowerCase()===Y)??null}function WG$($,Z,X){return $?.name??(Z?X:"none")}function KG$($,Z,X){let Q=X.replace(/^refs\/heads\//,"");return $.filter((Y)=>Y.repo.toLowerCase()===Z.toLowerCase()&&Y.branch===Q)}function HG$($){return`https://github.com/${$.repo}.git`}var bJ4;var Tn0=B(()=>{bJ4=vG.object({name:vG.string().regex(/^[a-z0-9]([-a-z0-9]*[a-z0-9])?$/,"pool name must be a DNS label (lowercase alphanumeric and '-')"),orgId:vG.string().min(1),repo:vG.string().regex(/^[^/\s]+\/[^/\s]+$/,"repo must be `owner/name`"),connectionId:vG.string().min(1).optional(),branch:vG.string().min(1).default("main"),workload:vG.object({runtime:vG.enum(["node","bun","deno"]).default("node"),packageManager:vG.enum(["npm","pnpm","yarn","bun","deno"]).optional(),packageManagerPath:vG.string().optional(),devPort:vG.number().int().positive().optional()}).default({runtime:"node"})})});async function NG$($,Z,X){let Q=new Map;for(let Y of $){let G=Z(Y);if(!G)continue;let J=Q.get(G);if(J)J.push(Y);else Q.set(G,[Y])}await Promise.allSettled([...Q.values()].map(async(Y)=>{for(let G of Y)await X(G).catch(()=>{})}))}import{createHash as xJ4,randomBytes as yJ4,randomUUID as gJ4}from"crypto";import*as DG$ from"net";import{PassThrough as hJ4}from"stream";function uJ4($){if($ instanceof Error)return $.message;if($&&typeof $==="object"){let Z=$;if(Z.error instanceof Error)return Z.error.message;if(typeof Z.message==="string"&&Z.message)return Z.message}return String($)}class Sn0{kind=bQ;records=new Map;inflight=new V90;stateStore;previewUrlPattern;kubeConfig;capacityProbe;portForward;namespace;sandboxTemplateName;envName;tokenGenerator;idleTtlMs;metrics;previewGateway;sentinelToken;mintCloneUrl;tenantPools;tenantPoolRefreshMs;poolPods=new Map;dirtyPools=new Set;closed=!1;claimWatchAbort=new AbortController;constructor($={}){this.stateStore=$.stateStore??null,this.previewUrlPattern=$.previewUrlPattern??null,this.kubeConfig=$.kubeConfig??eJ4(),this.portForward=new oi0(this.kubeConfig),this.namespace=$.namespace??cJ4,this.sandboxTemplateName=$.sandboxTemplateName??lJ4,this.envName=G34($.envName),this.tokenGenerator=$.tokenGenerator??(()=>yJ4(dJ4).toString("hex")),this.idleTtlMs=$.idleTtlMs??iJ4,this.metrics=$.meter?sJ4($.meter):null,this.previewGateway=$.previewGateway&&$.previewUrlPattern?{...$.previewGateway}:null;let Z=$.sentinelToken?.trim()??"";if(this.sentinelToken=Z.length>0?Z:null,this.mintCloneUrl=$.mintCloneUrl,this.tenantPools=this.sentinelToken!==null?$.tenantPools??[]:[],this.sentinelToken===null&&($.tenantPools?.length??0)>0)console.warn(`[${y6}] tenant pools configured without a sentinel token \u2014 ignoring them (warm-pool mode is off)`);this.tenantPoolRefreshMs=$.tenantPoolRefreshMs??pJ4,this.startClaimReaper(),this.startCredentialRefresher(),this.startTenantPoolReconciler()}startClaimReaper(){let $=["app.kubernetes.io/managed-by=studio","app.kubernetes.io/name=studio-sandbox",...this.envName?[`${fQ.env}=${this.envName}`]:[]].join(",");QG$({kc:this.kubeConfig,namespace:this.namespace,labelSelector:$,signal:this.claimWatchAbort.signal,onDelete:(Z)=>this.invalidateRecord(Z)})}async ensure($,Z={}){let X=sL($);if(X.startsWith("s-"))throw Error(`ensure: projectRef has no slug source: ${$.projectRef}`);return this.inflight.run(X,()=>C90(this.stateStore,$,bQ,(Q)=>this.ensureLocked($,X,Z,Q)))}async delete($){let Z=await this.getRecord($);if(this.records.delete($),Z)this.closeForwarder(Z.daemonForward),this.metrics?.active.add(-1,Mn0(Z.tenant));if(await this.deleteHttpRouteIfManaged($).catch((X)=>{console.warn(`[${y6}] HTTPRoute delete failed for ${$}: ${X instanceof Error?X.message:String(X)}`)}),await ow(this.kubeConfig,this.namespace,$),this.stateStore)if(Z)await this.stateStore.delete(Z.id,bQ);else await this.stateStore.deleteByHandle(bQ,$)}async alive($){return await D3(this.kubeConfig,this.namespace,$)!==void 0}watchClaimLifecycle($,Z){return XG$({kc:this.kubeConfig,namespace:this.namespace,claimName:$,signal:Z})}hasSchedulableCapacity(){return this.capacityProbe??=pY$(this.kubeConfig,this.namespace),this.capacityProbe()}async getPreviewUrl($){let Z=await this.getRecord($);if(!Z)return null;return this.composePreviewUrl(Z)}async proxyDaemonRequest($,Z,X){let Q=await this.getRecord($);if(!Q&&this.previewUrlPattern&&this.stateStore){let K=await this.stateStore.getByHandle(bQ,$),H=K?.state,N=H?.token;if(K&&N){let U=`http://${H?.adoptedSandboxName??$}.${this.namespace}.svc.cluster.local:${EN}`;try{let w=await Zp(U,N,Z,X);if(w.status!==404)return w;try{await w.body?.cancel()}catch{}}catch{}}}if(!Q)Q=await this.resurrectByHandle($);if(!Q)return new Response(JSON.stringify({error:"sandbox not found"}),{status:404,headers:{"content-type":"application/json"}});let Y=Q,G=performance.now(),J=0,W=!(X.body instanceof ReadableStream);try{let K=await Zp(Q.daemonUrl,Q.token,Z,X);if(K.status===401&&W){this.invalidateRecord($);let H=await this.getRecord($).catch(()=>null)??await this.resurrectByHandle($).catch(()=>null);if(H)Y=H,K=await Zp(H.daemonUrl,H.token,Z,X)}return J=K.status,K}catch(K){if(!W)throw K;this.invalidateRecord($);let H=await this.resurrectByHandle($)??await this.getRecord($).catch(()=>null);if(!H)throw K;Y=H;let N=await Zp(H.daemonUrl,H.token,Z,X);return J=N.status,N}finally{this.recordProxyDuration("daemon",J,Y,performance.now()-G)}}async adoptLiveClaim($,Z){if(this.records.has(Z))return!0;let X=await D3(this.kubeConfig,this.namespace,Z).catch(()=>{return});if(!X||X.metadata?.deletionTimestamp)return!1;return await this.inflight.run(Z,async()=>{let Y=this.records.get(Z);if(Y)return this.toSandbox(Y);let G=await this.adopt($,Z,X);if(!G)throw Error(`cannot adopt live claim ${Z}`);return C90(this.stateStore,$,bQ,(J)=>this.finish(G,J,!0,!0,"adopt"))}).catch(()=>null)!=null}async resolvePreviewUpstreamUrl($){if(this.previewUrlPattern)return`http://${await this.resolveServiceNameForHandle($)}.${this.namespace}.svc.cluster.local:${EN}`;let Z=await this.getRecord($);if(Z)return Z.daemonUrl;let X=await this.resurrectByHandle($);return X?X.daemonUrl:null}async resolveServiceNameForHandle($){let Z=this.records.get($);if(Z)return Z.adoptedSandboxName;if(this.stateStore){let Q=(await this.stateStore.getByHandle(bQ,$).catch(()=>null))?.state?.adoptedSandboxName;if(Q)return Q}return $}async proxyPreviewRequest($,Z){let X=performance.now(),Q=this.records.get($)??null,Y=0;try{let G=await this.resolvePreviewUpstreamUrl($);if(!G){Y=404;let O=In0(404,{error:"sandbox not found"});return O.headers.set(SV,"1"),O}let J=new URL(Z.url);if((J.pathname==="/_sandbox"||J.pathname.startsWith("/_sandbox/")||J.pathname==="/_decopilot_vm"||J.pathname.startsWith("/_decopilot_vm/"))&&Z.method!=="GET")return Y=404,In0(404,{error:"not found"});let K=(O)=>`${O}${J.pathname}${J.search}`,H=new Headers(Z.headers);for(let O of rJ4)H.delete(O);let N=Z.method!=="GET"&&Z.method!=="HEAD",F={method:Z.method,headers:H,body:N?Z.body:void 0,redirect:"manual",signal:Z.signal,duplex:N?"half":void 0},U;try{U=await fetch(K(G),F)}catch(O){let D=`${G}${J.pathname}`;if(console.warn(`[${y6}] preview fetch to ${D} failed: ${O instanceof Error?O.message:String(O)}`),Z.method==="GET"||Z.method==="HEAD"){if(this.invalidateRecord($),await this.resurrectByHandle($).catch(()=>null)){let j=await this.resolvePreviewUpstreamUrl($);if(j)try{U=await fetch(K(j),F);let z=new Headers;for(let[A,P]of U.headers.entries())if(!wG$.includes(A.toLowerCase()))z.set(A,P);return Y=U.status,new Response(U.body,{status:U.status,statusText:U.statusText,headers:z})}catch(z){console.warn(`[${y6}] preview fetch retry to ${D} failed: ${z instanceof Error?z.message:String(z)}`)}}}else this.invalidateRecord($);Y=502;let L=In0(502,{error:"sandbox daemon unreachable"});return L.headers.set(SV,"1"),L}let w=new Headers;for(let[O,D]of U.headers.entries())if(!wG$.includes(O.toLowerCase()))w.set(O,D);return Y=U.status,new Response(U.body,{status:U.status,statusText:U.statusText,headers:w})}finally{this.recordProxyDuration("preview",Y,Q,performance.now()-X,$)}}async ensureLocked($,Z,X,Q){if(X.image)console.warn(`[${y6}] opts.image ignored (template ${this.sandboxTemplateName} pins image): got ${X.image}`);if(Q){let J=await Q.get($,bQ);if(J){let W=await this.rehydrate($,Z,J);if(W)return await this.refreshDaemonGitCredential(W,X),this.finish(W,Q,!1,!0,"resume");await Q.delete($,bQ)}}let Y=await D3(this.kubeConfig,this.namespace,Z).catch(()=>{return});if(Y)if(Y.metadata?.deletionTimestamp)await sU0(this.kubeConfig,this.namespace,Z).catch((J)=>{console.warn(`[${y6}] wait for terminating claim ${Z} failed: ${J instanceof Error?J.message:String(J)}`)});else{let J=await this.adopt($,Z,Y).catch((W)=>{return console.warn(`[${y6}] adopt ${Z} failed, recreating: ${W instanceof Error?W.message:String(W)}`),null});if(J)return await this.refreshDaemonGitCredential(J,X),this.finish(J,Q,!0,!0,"adopt");await ow(this.kubeConfig,this.namespace,Z).catch(()=>{}),await sU0(this.kubeConfig,this.namespace,Z).catch((W)=>{console.warn(`[${y6}] wait for deleted claim ${Z} failed: ${W instanceof Error?W.message:String(W)}`)})}let G=await this.provision($,Z,X);return this.finish(G,Q,!0,!1,"fresh")}async finish($,Z,X,Q,Y){let G=this.records.get($.handle),J=G!==void 0;if(G&&G.daemonForward!==$.daemonForward)this.closeForwarder(G.daemonForward);if(this.records.set($.handle,$),X)await this.persist(Z,$);if(Q)await eU0(this.kubeConfig,this.namespace,$.handle,this.computeShutdownTime()).catch((W)=>console.warn(`[${y6}] TTL refresh failed for ${$.handle}: ${W instanceof Error?W.message:String(W)}`));if(this.metrics){let W=Mn0($.tenant);if(this.metrics.ensureOutcome.add(1,{...W,outcome:Y}),!J)this.metrics.active.add(1,W)}return this.toSandbox($)}buildEnvMap($,Z){let X={},Q=[];for(let[Y,G]of Object.entries($.env??{}))if(mJ4.has(Y))Q.push(Y);else X[Y]=G;if(Q.length>0)console.warn(`[${y6}] opts.env keys overlap reserved bootstrap names and were dropped: ${Q.join(",")}`);return{...X,DAEMON_TOKEN:Z.token,DAEMON_BOOT_ID:Z.daemonBootId,APP_ROOT:Z.workdir,PROXY_PORT:String(EN)}}buildClaim($,Z,X){let Q=this.sentinelToken!==null,Y=JG$(this.tenantPools,{orgId:Z.tenant?.orgId,cloneUrl:Z.repo?.cloneUrl,cloneOnly:Z.cloneOnly}),G=Q?[]:Object.entries(this.buildEnvMap(Z,X)).sort(([K],[H])=>K<H?-1:K>H?1:0).map(([K,H])=>({name:K,value:H})),J=K34(Z),W=Object.keys(J).length>0;return{apiVersion:`${O9.CLAIM_API_GROUP}/${O9.CLAIM_API_VERSION}`,kind:"SandboxClaim",metadata:{name:$,namespace:this.namespace,labels:{"app.kubernetes.io/name":"studio-sandbox","app.kubernetes.io/managed-by":"studio",...this.envName?{[fQ.env]:this.envName}:{},...qn0(Z.tenant)},...W?{annotations:J}:{}},spec:{sandboxTemplateRef:{name:this.sandboxTemplateName},additionalPodMetadata:{labels:qn0(Z.tenant,{[fQ.role]:"claimed",[fQ.sandboxHandle]:$,...this.envName?{[fQ.env]:this.envName}:{}}),...W?{annotations:J}:{}},env:G,warmpool:WG$(Y,Q,this.sandboxTemplateName),lifecycle:{shutdownPolicy:"Delete",shutdownTime:this.computeShutdownTime()}}}}async provision($,Z,X){let Q=this.tokenGenerator(),Y=gJ4(),G=Rn0,J=this.buildClaim(Z,X,{token:Q,daemonBootId:Y,workdir:G});try{await sn(this.kubeConfig,this.namespace,J)}catch(U){if(U instanceof rn)await sU0(this.kubeConfig,this.namespace,Z),await sn(this.kubeConfig,this.namespace,J);else throw U}let W;try{W=await yY$(this.kubeConfig,this.namespace,Z),await Xw0(this.kubeConfig,this.namespace,W)}catch(U){throw await ow(this.kubeConfig,this.namespace,Z).catch(()=>{}),U}try{await this.ensureServicePortForAdoptedSandbox(W),await this.ensureHttpRouteForHandle(Z,W,X.tenant??null)}catch(U){throw await ow(this.kubeConfig,this.namespace,Z).catch(()=>{}),U}let K=await this.openForwarder(W,EN,Z),H=`http://127.0.0.1:${K.localPort}`,N=this.workloadConfigPayload(X),F=Y;try{if(await zn0(H),this.sentinelToken!==null){let U=await Yw0(H);if(U)F=U.bootId;await MV(H,this.sentinelToken,N??{},{rotateToken:Q})}else if(N)await MV(H,Q,N);await this.relayOrgFsConfig(H,Q,X.orgFsConfigJson)}catch(U){throw this.closeForwarder(K),await this.deleteHttpRouteIfManaged(Z).catch(()=>{}),await ow(this.kubeConfig,this.namespace,Z).catch(()=>{}),U}return{id:$,handle:Z,adoptedSandboxName:W,token:Q,workdir:G,daemonUrl:H,daemonForward:K,workload:X.workload??null,daemonBootId:F,tenant:X.tenant??null,ensureOpts:U34(X)}}workloadConfigPayload($){return v90({runtime:$?.workload?.runtime??"node",packageManager:$?.workload?.packageManager?{name:$.workload.packageManager,...$.workload.packageManagerPath?{path:$.workload.packageManagerPath}:{}}:null,repo:$?.repo??null,port:$?.workload?.devPort??FG$,tenant:$?.tenant??void 0,...$?{cloneOnly:$.cloneOnly===!0}:{}})}async relayOrgFsConfig($,Z,X){if(!X)return;await sY$($,Z,X).catch((Q)=>console.warn("[org-fs] sidecar config relay failed",Q))}async refreshDaemonGitCredential($,Z){let X=Om0(Z);if(!X)return;try{await MV($.daemonUrl,$.token,X)}catch(Q){console.warn(`[${y6}] git credential refresh failed for ${$.handle}: ${Q instanceof Error?Q.message:String(Q)}`)}}async withFreshCloneUrl($,Z){if(!this.mintCloneUrl)return $;try{let X=await this.mintCloneUrl($,Z!==void 0?{bufferMs:Z}:void 0);return X?{...$,cloneUrl:X}:$}catch(X){return console.warn(`[${y6}] clone credential re-mint failed: ${X instanceof Error?X.message:String(X)}`),$}}startCredentialRefresher(){if(!this.mintCloneUrl)return;let{signal:$}=this.claimWatchAbort;(async()=>{while(!$.aborted){if(await y$(tJ4,{signal:$}).catch(()=>{}),$.aborted)break;try{await this.refreshAllGitCredentials()}catch(Z){console.warn(`[${y6}] periodic credential refresh failed: ${Z instanceof Error?Z.message:String(Z)}`)}}})()}startTenantPoolReconciler(){if(this.tenantPools.length===0)return;let{signal:$}=this.claimWatchAbort;(async()=>{while(!$.aborted){try{await this.reconcileTenantPools()}catch(Z){console.warn(`[${y6}] tenant pool reconcile failed: ${Z instanceof Error?Z.message:String(Z)}`)}await y$(nJ4,{signal:$}).catch(()=>{})}})()}markTenantPoolsDirty($,Z){let X=KG$(this.tenantPools,$,Z);for(let Q of X)this.dirtyPools.add(Q.name);return X.map((Q)=>Q.name)}async reconcileTenantPools(){for(let $ of this.tenantPools){let Z=await gY$(this.kubeConfig,this.namespace,$.name);if(Z===null){console.warn(`[${y6}] tenant pool ${$.name}: no SandboxWarmPool (or no selector yet) in ${this.namespace}`);continue}let X=this.dirtyPools.delete($.name),Q=Z.filter((Y)=>!Y.labels[fQ.sandboxHandle]);for(let[Y]of this.poolPods)if(!Z.some((G)=>G.uid===Y))this.poolPods.delete(Y);for(let Y of Q){if(this.claimWatchAbort.signal.aborted)return;await this.warmPoolPod($,Y,X)}this.recordPoolDepth($,Z,Q)}}recordPoolDepth($,Z,X){let Q=this.metrics?.poolPods;if(!Q)return;let Y=0,G=0;for(let W of X){let K=this.poolPods.get(W.uid);if(!K)continue;if(K.failures>=Jw0)G++;else if(K.lastConfigAt>0)Y++}let J={pool:$.name,org:$.orgId};Q.record(Y,{...J,state:"ready"}),Q.record(Z.length-X.length,{...J,state:"bound"}),Q.record(X.length-Y-G,{...J,state:"pending"}),Q.record(G,{...J,state:"failed"})}async warmPoolPod($,Z,X){let Q=this.poolPods.get(Z.uid);if(Q&&Q.failures>=Jw0){if(Date.now()-Q.lastFailureAt<UG$)return;this.poolPods.set(Z.uid,{...Q,failures:0})}let Y=X||Q!==void 0&&Date.now()-Q.lastConfigAt>=this.tenantPoolRefreshMs;if(Q&&!Y)return;let G={cloneUrl:HG$($),connectionId:$.connectionId,branch:$.branch,userName:"",userEmail:""},J=await this.withFreshCloneUrl(G);if($.connectionId&&J.cloneUrl===G.cloneUrl){this.recordPoolFailure(Z,$,"clone credential mint failed");return}let W=await this.openForwarder(Z.name,EN,Z.name).catch(()=>null);if(!W){this.recordPoolFailure(Z,$,"port-forward failed");return}let K=`http://127.0.0.1:${W.localPort}`;try{await zn0(K);let H=this.sentinelToken;if(!H)return;if(!await this.isPoolPodUnbound(Z))return;let N=v90({runtime:$.workload.runtime,packageManager:$.workload.packageManager?{name:$.workload.packageManager,...$.workload.packageManagerPath?{path:$.workload.packageManagerPath}:{}}:null,repo:J,port:$.workload.devPort??FG$})??{},{transition:F}=await MV(K,H,N);if(Y&&F!=="bootstrap"&&await this.isPoolPodUnbound(Z))await aY$(K,H,"clone");this.poolPods.set(Z.uid,{lastConfigAt:Date.now(),lastFailureAt:0,failures:0}),console.log(`[${y6}] tenant pool ${$.name}: warmed ${Z.name} (${F})`)}catch(H){this.recordPoolFailure(Z,$,H instanceof Error?H.message:String(H))}finally{this.closeForwarder(W)}}isPoolPodUnbound($){return hY$(this.kubeConfig,this.namespace,$.name,fQ.sandboxHandle)}recordPoolFailure($,Z,X){let Q=this.poolPods.get($.uid),Y=(Q?.failures??0)+1;this.poolPods.set($.uid,{lastConfigAt:Q?.lastConfigAt??0,lastFailureAt:Date.now(),failures:Y});let G=Y>=Jw0?` \u2014 backing off ${UG$/60000}min`:"";console.warn(`[${y6}] tenant pool ${Z.name}: warming ${$.name} failed (${Y}/${Jw0})${G}: ${X}`)}async refreshAllGitCredentials(){await NG$(this.records.values(),($)=>$.ensureOpts?.repo?.connectionId,async($)=>{if(this.claimWatchAbort.signal.aborted)return;let Z=$.ensureOpts?.repo;if(!Z)return;let X=await this.withFreshCloneUrl(Z,oJ4);await this.refreshDaemonGitCredential($,{...$.ensureOpts,repo:X}),$.ensureOpts={...$.ensureOpts,repo:X}})}async rebootstrapDaemon($,Z,X){if(this.sentinelToken===null)return!1;let Q=this.workloadConfigPayload(X)??{};try{return await MV($,this.sentinelToken,Q,{rotateToken:Z}),await this.relayOrgFsConfig($,Z,X?.orgFsConfigJson),!0}catch(Y){if(Y instanceof Qw0&&Y.status===401)try{return await MV($,Z,Q,{rotateToken:Z}),await this.relayOrgFsConfig($,Z,X?.orgFsConfigJson),!0}catch(G){return console.warn(`[${y6}] re-bootstrap retry with claim token failed: ${G instanceof Error?G.message:String(G)}`),!1}return console.warn(`[${y6}] re-bootstrap failed: ${Y instanceof Error?Y.message:String(Y)}`),!1}}async ensureServicePortForAdoptedSandbox($){if(!this.previewGateway||!this.previewUrlPattern)return;await iY$(this.kubeConfig,this.namespace,$,{name:"daemon",port:EN,targetPort:EN})}async ensureHttpRouteForHandle($,Z,X){if(!this.previewGateway||!this.previewUrlPattern)return;let Q=w34(this.previewUrlPattern,$);if(!Q)throw new k9(`Unable to derive preview hostname for ${$} from pattern: ${this.previewUrlPattern}`);let Y={apiVersion:`${en.API_GROUP}/${en.API_VERSION}`,kind:"HTTPRoute",metadata:{name:$,namespace:this.namespace,labels:qn0(X??void 0,{[fQ.role]:"claimed",[fQ.sandboxHandle]:$,"app.kubernetes.io/name":"studio-sandbox","app.kubernetes.io/managed-by":"studio",...this.envName?{[fQ.env]:this.envName}:{}})},spec:{parentRefs:[{kind:"Gateway",group:"gateway.networking.k8s.io",name:this.previewGateway.name,namespace:this.previewGateway.namespace}],hostnames:[Q],rules:[{backendRefs:[{group:"",kind:"Service",name:Z,port:EN}]}]}};await $w0(this.kubeConfig,this.namespace,Y)}async deleteHttpRouteIfManaged($){if(!this.previewGateway)return;await Zw0(this.kubeConfig,this.namespace,$)}async rehydrate($,Z,X){let Q=X.state;if(!Q.adoptedSandboxName&&!Q.podName||!Q.token)return null;let Y=await D3(this.kubeConfig,this.namespace,Z).catch(()=>{return});if(!Y||!OG$(Y))return null;let G=Y.status?.sandbox?.name??Q.adoptedSandboxName??Q.podName??Z,J=await this.openAndProbeDaemon(G,Z);if(!J)return null;if(Q.daemonBootId&&Q.daemonBootId!==J.bootId){if(this.sentinelToken!==null){let W=Q.ensureOpts?.repo?{...Q.ensureOpts,repo:await this.withFreshCloneUrl(Q.ensureOpts.repo)}:Q.ensureOpts??null;if(!await this.rebootstrapDaemon(J.daemonUrl,Q.token,W))return this.closeForwarder(J.daemonForward),null}else console.warn(`[${y6}] daemon restart detected (handle=${Z}): stored bootId=${Q.daemonBootId} live bootId=${J.bootId}`);await this.stateStore?.put($,bQ,{handle:Z,state:{...Q,daemonBootId:J.bootId}}).catch((W)=>console.warn(`[${y6}] bootId persist failed for ${Z}: ${W instanceof Error?W.message:String(W)}`))}return{id:$,handle:Z,adoptedSandboxName:G,token:Q.token,workdir:Q.workdir??Rn0,daemonUrl:J.daemonUrl,daemonForward:J.daemonForward,workload:Q.workload??null,daemonBootId:J.bootId,tenant:Q.tenant??null,ensureOpts:Q.ensureOpts??null}}async adopt($,Z,X){if(!OG$(X))return null;let Q=X.status?.sandbox?.name??Z;if(this.sentinelToken!==null)return null;let Y=$34(X);if(!Y)return null;let G=await this.openAndProbeDaemon(Q,Z);if(!G)return null;let J=H34(X);if(this.previewGateway)await this.ensureServicePortForAdoptedSandbox(Q).catch((W)=>{console.warn(`[${y6}] Service port backfill failed for ${Z}: ${W instanceof Error?W.message:String(W)}`)}),await this.ensureHttpRouteForHandle(Z,Q,J).catch((W)=>{console.warn(`[${y6}] HTTPRoute backfill failed for ${Z}: ${W instanceof Error?W.message:String(W)}`)});return{id:$,handle:Z,adoptedSandboxName:Q,token:Y,workdir:Rn0,daemonUrl:G.daemonUrl,daemonForward:G.daemonForward,workload:null,daemonBootId:G.bootId,tenant:J,ensureOpts:null}}async openAndProbeDaemon($,Z){let X=await this.openForwarder($,EN,Z).catch(()=>null);if(!X)return null;let Q=`http://127.0.0.1:${X.localPort}`,Y=await Yw0(Q);if(!Y)return this.closeForwarder(X),null;return{daemonForward:X,daemonUrl:Q,bootId:Y.bootId}}async getRecord($){let Z=this.records.get($);if(Z)return Z;if(!this.stateStore)return null;let X=await this.stateStore.getByHandle(bQ,$);if(!X)return null;let Q=await this.rehydrate(X.id,$,X);if(Q)this.records.set($,Q);return Q}async resurrectByHandle($){if(!this.stateStore)return null;let Z=await this.stateStore.getByHandle(bQ,$);if(!Z)return null;let X=Z.state.ensureOpts;if(!X)return null;let Q=X.repo?{...X,repo:await this.withFreshCloneUrl(X.repo)}:X;if(sL(Z.id)!==$)return null;return await this.ensure(Z.id,Q),this.records.get($)??null}invalidateRecord($){let Z=this.records.get($);if(!Z)return;this.records.delete($),this.closeForwarder(Z.daemonForward)}recordProxyDuration($,Z,X,Q,Y){if(!this.metrics)return;this.metrics.proxyDurationMs.record(Q,{...Mn0(X?.tenant??null),source:$,sandbox_handle:X?.handle??Y??"",status_code:Z||0})}composePreviewUrl($){if(this.previewUrlPattern)return _90(this.previewUrlPattern,$.handle);return`http://127.0.0.1:${$.daemonForward.localPort}/`}toSandbox($){return{handle:$.handle,workdir:$.workdir,previewUrl:this.composePreviewUrl($)}}async persist($,Z){if(!$)return;let X={adoptedSandboxName:Z.adoptedSandboxName,token:Z.token,workdir:Z.workdir,workload:Z.workload,daemonBootId:Z.daemonBootId,tenant:Z.tenant,...Z.ensureOpts?{ensureOpts:Z.ensureOpts}:{}};await $.put(Z.id,bQ,{handle:Z.handle,state:X})}computeShutdownTime(){return new Date(Date.now()+this.idleTtlMs).toISOString()}async releaseAfter($,Z){let X=await D3(this.kubeConfig,this.namespace,$);if(!X)return;let Q=N34(X.spec?.lifecycle?.shutdownTime,new Date(Date.now()+Z));if(!Q)return;await eU0(this.kubeConfig,this.namespace,$,Q).catch((Y)=>console.warn(`[${y6}] release failed for ${$}: ${Y instanceof Error?Y.message:String(Y)}`))}async renewTtl($){let Z=await D3(this.kubeConfig,this.namespace,$);if(!Z)return;let X=F34(Z.spec?.lifecycle?.shutdownTime,new Date(Date.now()+this.idleTtlMs));if(!X)return;await eU0(this.kubeConfig,this.namespace,$,X).catch((Q)=>console.warn(`[${y6}] TTL renew failed for ${$}: ${Q instanceof Error?Q.message:String(Q)}`))}openForwarder($,Z,X=$){let Q=Z34(X,Z);return new Promise((Y,G)=>{let J=(W,K)=>{let H=DG$.createServer((N)=>this.handleForwardedConnection(N,$,Z,X));H.once("error",(N)=>{if(N.code==="EADDRINUSE"&&K<aJ4){try{H.close()}catch{}let F=kn0+(W-kn0+1)%LG$;J(F,K+1);return}G(N)}),H.listen(W,"127.0.0.1",()=>{let N=H.address();if(!N||typeof N==="string"){H.close(),G(Error("port-forward listener failed to bind"));return}Y({server:H,localPort:N.port})})};J(Q,0)})}handleForwardedConnection($,Z,X,Q){let Y=new hJ4,G=null,J=!1,W=()=>{if(J)return;if(J=!0,Y.destroy(),G)try{G.close()}catch{}if(!$.destroyed)$.destroy()};$.pipe(Y),$.on("error",W),$.on("close",W),this.portForward.portForward(this.namespace,Z,[X],$,null,Y).then((K)=>{let H=typeof K==="function"?K():K;if(!H){W();return}if(G=H,G.on("close",W),G.on("error",()=>{this.invalidateRecord(Q),W()}),J)try{G.close()}catch{}}).catch((K)=>{console.warn(`[${y6}] port-forward to ${Z}:${X} failed: ${uJ4(K)}`,JSON.stringify(EG$(K))),this.invalidateRecord(Q),W()})}closeForwarder($){$.server.close((Z)=>{if(Z)console.warn(`[${y6}] port-forward close on :${$.localPort} errored: ${Z instanceof Error?Z.message:String(Z)}`)})}close(){if(this.closed)return;this.closed=!0,this.claimWatchAbort.abort();for(let $ of this.records.values())this.closeForwarder($.daemonForward);this.records.clear()}}function sJ4($){return{active:$.createUpDownCounter("studio.sandbox.active",{description:"Active sandbox count, by runner kind, owning org, and daemon impl. Cross-checks the cAdvisor-derived count from the cluster \u2014 divergence between the two indicates orphaned claims (studio deleted but K8s didn't reap) or unattributed pods.",unit:"{sandbox}"}),ensureOutcome:$.createCounter("studio.sandbox.ensure.outcome",{description:"Outcome of each ensure() call: fresh provision, resume from state-store after restart, or adopt of a cluster-side claim studio didn't know about. Cold-start ratio is the primary input for warm-pool sizing.",unit:"{call}"}),proxyDurationMs:$.createHistogram("studio.sandbox.proxy.duration_ms",{description:"Wall-clock latency of studio-mediated requests to the sandbox daemon: tool exec proxies (source=daemon) and preview iframe traffic (source=preview).",unit:"ms"}),poolPods:$.createGauge("studio.sandbox.pool.pods",{description:"Tenant warm pool depth by pool and state: ready (warmed and unbound \u2014 what a claim can actually bind instantly), bound (serving a user), pending (unbound, not yet warmed), failed (gave up after repeated bootstrap failures). Alert on sustained ready=0: a pool that is always empty is doing nothing while costing N pods.",unit:"{pod}"})}}function EG$($){let Z=[],X=$;for(let Q=0;Q<5&&X instanceof Error;Q++){let Y=X;if(Z.push({name:Y.name,message:Y.message,...Y.code!==void 0?{code:Y.code}:{},...Y.errno!==void 0?{errno:Y.errno}:{}}),Y.cause===X)break;X=Y.cause}if(X!==void 0&&!(X instanceof Error)&&X!==null){let Q=X,Y=Q.error instanceof Error?EG$(Q.error).chain:void 0;Z.push({nonError:String(X),...typeof Q.type==="string"?{type:Q.type}:{},...typeof Q.message==="string"?{message:Q.message}:{},...Q.code!==void 0?{code:Q.code}:{},...typeof Q.reason==="string"?{reason:Q.reason}:{},...Y?{error:Y}:{},...Y===void 0&&Q.error!==void 0?{rawError:String(Q.error)}:{},keys:Object.keys(Q)})}return{chain:Z}}function eJ4(){let $=new cx;return $.loadFromDefault(),$}function OG$($){return Boolean($.status?.conditions?.some((Z)=>Z.type==="Ready"&&Z.status==="True"))}function $34($){let Z=$.spec?.env;if(!Z)return null;for(let X of Z)if(X.name==="DAEMON_TOKEN"&&X.value)return X.value;return null}function Z34($,Z){let X=xJ4("sha256").update(`${$}:${Z}`).digest();return kn0+X.readUInt32BE(0)%LG$}function In0($,Z){return new Response(JSON.stringify(Z),{status:$,headers:{"content-type":"application/json","access-control-allow-origin":"*"}})}function BG$($){let Z=$.slice(0,Q34);return X34.test(Z)?Z:""}function G34($){if($===void 0)return null;let Z=$.trim();if(Z==="")return null;if(!Y34.test(Z))throw Error(`AgentSandboxProvider: envName=${JSON.stringify(Z)} is not a valid DNS-label-safe environment name (lowercase alphanumeric or '-', starts with a letter, ends alphanumeric, \u226432 chars). Studio sets this from STUDIO_ENV; check the studio chart's configMap.`);return Z}function qn0($,Z={}){let X={...Z};if($){let Q=BG$($.orgId),Y=BG$($.userId);if(Q)X[fQ.orgId]=Q;if(Y)X[fQ.userId]=Y}return X}function kV($){let Z="";for(let X of $){let Q=X.codePointAt(0)??0;Z+=Q<32||Q===127?" ":X}return Z.slice(0,J34)}function W34($){try{let Z=new URL($);return Z.username="",Z.password="",Z.toString()}catch{return""}}function K34($){let Z={},X=$.tenant;if(X?.orgSlug)Z[L3.orgSlug]=kV(X.orgSlug);if(X?.orgName)Z[L3.orgName]=kV(X.orgName);if(X?.userEmail)Z[L3.userEmail]=kV(X.userEmail);if(X?.userName)Z[L3.userName]=kV(X.userName);let Q=$.repo;if(Q){if(Q.displayName)Z[L3.gitRepo]=kV(Q.displayName);let Y=W34(Q.cloneUrl);if(Y)Z[L3.gitRepoUrl]=kV(Y);let G=$.branch??Q.branch;if(G)Z[L3.gitBranch]=kV(G)}return Z}function H34($){let Z=$.metadata?.labels;if(!Z)return null;let X=Z[fQ.orgId],Q=Z[fQ.userId];if(!X||!Q)return null;let Y=$.metadata?.annotations??{};return{orgId:X,userId:Q,orgSlug:Y[L3.orgSlug],orgName:Y[L3.orgName],userEmail:Y[L3.userEmail],userName:Y[L3.userName]}}function N34($,Z){if($){let X=new Date($).getTime();if(Number.isFinite(X)&&X<=Z.getTime())return null}return Z.toISOString()}function F34($,Z){if($){let X=new Date($).getTime();if(Number.isFinite(X)&&X>=Z.getTime())return null}return Z.toISOString()}function Mn0($){return{org_id:$?.orgId??"",user_id:$?.userId??"",runner_kind:bQ}}function U34($){let Z={};if($.branch)Z.branch=$.branch;if($.repo)Z.repo=$.repo;if($.workload)Z.workload=$.workload;if($.env&&Object.keys($.env).length>0)Z.env=$.env;if($.tenant)Z.tenant=$.tenant;if($.orgFsConfigJson)Z.orgFsConfigJson=$.orgFsConfigJson;return Object.keys(Z).length>0?Z:null}function w34($,Z){try{return new URL(_90($,Z)).hostname||null}catch{return null}}var bQ="agent-sandbox",y6="AgentSandboxProvider",SV="x-sandbox-preview-not-ready",cJ4="agent-sandbox-system",lJ4="studio-sandbox",EN=9000,FG$=3000,Rn0="/app",dJ4=32,mJ4,iJ4=900000,nJ4=60000,pJ4=1800000,Jw0=3,UG$=1800000,tJ4=900000,oJ4=1800000,rJ4,wG$,kn0=40000,LG$=1e4,aJ4=256,fQ,L3,X34,Q34=63,Y34,J34=253;var jG$=B(()=>{B6();tY$();Fn0();eY$();Bm0();$p();an();YG$();Tn0();mJ4=new Set(["DAEMON_TOKEN","DAEMON_BOOT_ID","APP_ROOT","PROXY_PORT"]),rJ4=["cookie","host","connection","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","accept-encoding","content-length","upgrade"],wG$=["connection","keep-alive","transfer-encoding","content-encoding","content-length"];fQ={role:"studio.decocms.com/role",sandboxHandle:"studio.decocms.com/sandbox-handle",orgId:"studio.decocms.com/org-id",userId:"studio.decocms.com/user-id",env:"studio.decocms.com/env"},L3={orgSlug:"studio.decocms.com/org-slug",orgName:"studio.decocms.com/org-name",userEmail:"studio.decocms.com/user-email",userName:"studio.decocms.com/user-name",gitRepo:"studio.decocms.com/git-repo",gitRepoUrl:"studio.decocms.com/git-repo-url",gitBranch:"studio.decocms.com/git-branch"},X34=/^([A-Za-z0-9]([-A-Za-z0-9_.]*[A-Za-z0-9])?)?$/;Y34=/^[a-z]([a-z0-9-]{0,30}[a-z0-9])?$/});var zG$={};H4(zG$,{waitForSandboxReady:()=>Xw0,parseTenantPools:()=>GG$,getSandboxClaim:()=>D3,getHttpRoute:()=>dY$,deleteSandboxClaim:()=>ow,deleteHttpRoute:()=>Zw0,createSandboxClaim:()=>sn,applyHttpRoute:()=>$w0,SandboxTimeoutError:()=>qV,SandboxError:()=>k9,PREVIEW_NOT_READY_HEADER:()=>SV,KubeConfig:()=>cx,K8S_CONSTANTS:()=>O9,HTTPROUTE_CONSTANTS:()=>en,AgentSandboxProvider:()=>Sn0});var Vn0=B(()=>{Fn0();an();$p();jG$();Tn0()});var qG$={};H4(qG$,{subscribeLifecycle:()=>bn0,getSandboxProviderByKind:()=>_n0,getOrInitSharedRunner:()=>vn0,__resetSharedLifecyclesForTesting:()=>I34});function RG$($,Z){let X=PG$[$];if(X)return Promise.resolve(X);let Q=Cn0[$];if(Q)return Q;let Y=Z().then((G)=>{return PG$[$]=G,G}).finally(()=>{delete Cn0[$]});return Cn0[$]=Y,Y}function D34(){let $=process.env.STUDIO_SANDBOX_PREVIEW_URL_PATTERN;return $&&$.trim()!==""?$:void 0}function L34(){let $=process.env.STUDIO_SANDBOX_TEMPLATE_NAME;return $&&$.trim()!==""?$:void 0}function E34(){let $=process.env.STUDIO_ENV;return $&&$.trim()!==""?$:void 0}function j34(){let $=process.env.STUDIO_SANDBOX_SENTINEL_TOKEN;return $&&$.trim()!==""?$:void 0}function z34(){let $=process.env.STUDIO_SANDBOX_PREVIEW_GATEWAY_NAME?.trim(),Z=process.env.STUDIO_SANDBOX_PREVIEW_GATEWAY_NAMESPACE?.trim();if(!$&&!Z)return;if(!$||!Z)throw Error("STUDIO_SANDBOX_PREVIEW_GATEWAY_NAME and STUDIO_SANDBOX_PREVIEW_GATEWAY_NAMESPACE must both be set, or both unset. Half-configured per-claim HTTPRoute routing would silently fail to attach.");return{name:$,namespace:Z}}async function IG$($,Z){let X=new Sn(Z),Q=D34();switch($){case"agent-sandbox":{let{AgentSandboxProvider:Y,parseTenantPools:G}=await Promise.resolve().then(() => (Vn0(),zG$)),J=new qH(c0().encryptionKey);return new Y({stateStore:X,previewUrlPattern:Q,sandboxTemplateName:L34(),envName:E34(),previewGateway:z34(),sentinelToken:j34(),tenantPools:G(process.env.STUDIO_SANDBOX_TENANT_POOLS),meter:W8,mintCloneUrl:async(W,K)=>{if(!W.connectionId)return null;let H=F5$(W.cloneUrl);if(!H)return null;let{cloneUrl:N}=await gw(W.connectionId,H.owner,H.name,Z,J,{bufferMs:K?.bufferMs});return N}})}case"user-desktop":throw Error("user-desktop provider cannot be instantiated without a per-run link claim \u2014 call resolveSandboxProvider, which binds the link before constructing the provider.");default:throw Error(`Unknown sandbox provider kind: ${String($)}`)}}function _n0($,Z){return RG$(Z,()=>IG$(Z,$.db))}async function vn0(){let $;try{$=eL()}catch(X){return console.warn("[lifecycle] cannot resolve sandbox runner:",X instanceof Error?X.message:String(X)),null}return await RG$($,()=>IG$($,c8().db))}function bn0($,Z,X){let Q=rw.get(Z);if(Q){if(Q.terminated){if(Q.lastPhase)try{X(Q.lastPhase)}catch{}return{unsubscribe:T34}}if(Q.listeners.add(X),Q.lastPhase)try{X(Q.lastPhase)}catch{}return AG$(Z,Q,X)}let Y=new AbortController,G={lastPhase:null,terminated:!1,listeners:new Set([X]),abort:Y};return rw.set(Z,G),R34($,Z,G),AG$(Z,G,X)}function T34(){}function AG$($,Z,X){return{unsubscribe(){if(rw.get($)!==Z)return;if(Z.listeners.delete(X),Z.listeners.size===0)rw.delete($),Z.abort.abort()}}}async function R34($,Z,X){let Q=null;try{for await(let Y of $.watchClaimLifecycle(Z,X.abort.signal)){if(X.abort.signal.aborted)break;X.lastPhase=Y;let G=Y.kind==="ready"||Y.kind==="failed";if(G)X.terminated=!0;let J=Array.from(X.listeners);for(let W of J)try{W(Y)}catch{}if(G)break}}catch(Y){Q=Y}finally{if(!X.terminated&&!X.abort.signal.aborted&&X.listeners.size>0){let Y={kind:"failed",reason:"unknown",message:Q instanceof Error?Q.message:"Lifecycle watcher ended unexpectedly"};X.lastPhase=Y,X.terminated=!0;for(let G of Array.from(X.listeners))try{G(Y)}catch{}}if(rw.get(Z)===X)rw.delete(Z)}}function I34(){for(let $ of rw.values())$.abort.abort();rw.clear()}var O34,B34,TG$,PG$,Cn0,P34,A34,rw;var Xp=B(()=>{FN();GG();N5();Em0();Vn();bc();S$();O34=Symbol.for("decocms.sandbox.lifecycle.runners"),B34=Symbol.for("decocms.sandbox.lifecycle.inflight"),TG$=globalThis,PG$=TG$[O34]??={},Cn0=TG$[B34]??={};P34=Symbol.for("decocms.sandbox.lifecycle.shared-lifecycles"),A34=globalThis,rw=A34[P34]??=new Map});async function hX($,Z){let{userId:X,branch:Q,virtualMcpMetadata:Y,explicitKind:G}=Z;if(G)return Qp($,G);if($.sandboxPreference==="agent-sandbox")return Qp($,"agent-sandbox");if($.sandboxPreference==="cluster-default")return Qp($,eL());let[J,...W]=q34(Y,X,Q);if(J)return Qp($,W.length===0?J:M34(J,W));return Qp($,MG$())}function q34($,Z,X){let Q=C5($)[Z]?.[X];if(!Q)return[];let Y=AJ(Q);return Object.keys(Y)}function M34($,Z){let X=MG$();if(X===$||Z.includes(X))return X;return $}function MG$(){return eL()}async function Qp($,Z){let X=Z==="user-desktop"?"agent-sandbox":Z;return{provider:await _n0($,X),kind:X}}var aw=B(()=>{B8();FN();kQ();Xp()});var Yp;var fn0=B(()=>{Yp={npm:{install:"npm install",run:($)=>`npm run ${$}`,runtime:"node"},pnpm:{install:"pnpm install",run:($)=>`pnpm run ${$}`,runtime:"node"},yarn:{install:"yarn install",run:($)=>`yarn run ${$}`,runtime:"node"},bun:{install:"bun install",run:($)=>`bun run ${$}`,runtime:"bun"},deno:{install:"deno install",run:($)=>`deno task ${$}`,runtime:"deno"}}});function E3($,Z){return Z?`thread:${$}/${Z}`:`thread:${$}`}function jN($){return`sandbox/thread-${$.replace(/^thread:/,"").replace(/\//g,"-")}`}function sw($){if(!$||!$.startsWith("thread:"))return null;return $.slice(7).split("/")[0]||null}async function zN($,Z,X){let Q=sw(Z);if(!Q)return X;return(await $.storage.threads.get(Q).catch(()=>null))?.created_by??X}async function VV($,Z){if(!Z)return null;let X=await $.storage.threads.get(Z).catch(()=>null);if(!X)return null;return X.metadata??{}}async function kG$($,Z){let Q=(await VV($,Z))?.headRef;return typeof Q==="string"&&Q.length>0?Q:null}async function SG$($,Z,X){let Q=await VV($,Z);if(!Q)return;if(Q.headRef===X)return;await $.storage.threads.update(Z,{metadata:{...Q,headRef:X}}).catch((Y)=>console.warn("[thread-repo] setThreadHeadRef failed",Y))}async function ew($,Z){return(await VV($,Z))?.githubRepo??null}function xn0($){if($.pinnedRef)return $.pinnedRef;if($.runBranch&&$.runBranch===E3($.threadId))return $.runBranch;if($.threadRepo)return E3($.threadId,$.threadRepo.connectionId);if(!$.agentRepo)return"ephemeral";return $.runBranch??`thread:${$.threadId}`}async function yn0($,Z){let Q=(await VV($,Z))?.pinnedRef;return typeof Q==="string"&&Q.length>0?Q:null}async function VG$($,Z){let[X,Q]=await Promise.all([ew($,Z.threadId),yn0($,Z.threadId)]);return xn0({...Z,threadRepo:X,pinnedRef:Q})}async function CG$($,Z,X,Q,Y,G){let J=await VV($,Z);if(!J)return;let W=kn(C5(J),X,Q,Y,G);await $.storage.threads.update(Z,{metadata:{...J,sandboxMap:W}}).catch((K)=>console.warn("[thread-repo] setThreadSandboxMapEntry failed",K))}async function Ww0($,Z){return C5(await VV($,Z))}async function _G$($,Z,X,Q,Y){let G=await VV($,Z);if(!G)return;let J=Lm0(C5(G),X,Q,Y);if(!J)return;await $.storage.threads.update(Z,{metadata:{...G,sandboxMap:J}}).catch((W)=>console.warn("[thread-repo] removeThreadSandboxMapEntry failed",W))}var j3=B(()=>{kQ()});function Kw0($){if(!$)return null;let Z=$.runtime;if(!Z||typeof Z!=="object")return null;let X=Z.env;if(!Array.isArray(X))return null;let Q=[];for(let Y of X){if(!Y||typeof Y!=="object")continue;let G=Y;if(typeof G.key!=="string"||!b00.test(G.key))continue;if(G.kind==="literal"&&typeof G.value==="string"){Q.push({key:G.key,kind:"literal",value:G.value});continue}if(G.kind==="secret"&&typeof G.secretId==="string"&&G.secretId.length>0)Q.push({key:G.key,kind:"secret",secretId:G.secretId})}return Q.length===0?null:Q}function vG$($){if(!$)return null;let Z=$.runtime;if(!Z||typeof Z!=="object")return null;let X=Z.submoduleCredentials;if(!Array.isArray(X))return null;let Q=[];for(let Y of X){if(!Y||typeof Y!=="object")continue;let G=Y;if(typeof G.host==="string"&&G.host.length>0&&typeof G.secretId==="string"&&G.secretId.length>0)Q.push({host:G.host,secretId:G.secretId})}return Q.length===0?null:Q}async function bG$($,Z){$0(Z);let X=r(Z);await Z.access.check();let Q=W1(Z);if(!Q)throw Error("User ID required");let Y=await Z.storage.virtualMcps.findById($.virtualMcpId);if(!Y||Y.organization_id!==X.id)throw Error("Virtual MCP not found");let G=Y.metadata??{},J=C5(G),W=await zN(Z,$.branch,Q),K=eW(J,W,$.branch,$.sandboxProviderKind);return{virtualMcp:Y,metadata:G,userId:Q,sandboxUserId:W,entry:K,organization:X}}function k34($){if($===null||!/^\d+$/.test($))return null;let Z=Number($);return Z>=1&&Z<=65535?$:null}function fG$($){let Z=$.runtime??null,Q=Z?.selected??null,Y=k34(Z?.port??null),G=Z?.path??null;if(!Q||!(Q in Yp))return{packageManager:null,runtime:null,port:Y,packageManagerPath:G,runtimeBinPath:null};let J=Yp[Q].runtime;return{packageManager:Q,runtime:J,port:Y,packageManagerPath:G,runtimeBinPath:J==="deno"?"/opt/deno/bin":J==="bun"?"/opt/bun/bin":null}}var Gp=B(()=>{B8();fn0();kQ();j3()});async function $O($,Z){let X=$.body?.getReader();if(!X)return $.text();let Q=new TextDecoder,Y="",G=0;for(;;){let{done:J,value:W}=await X.read();if(J)break;if(G+=W.byteLength,G>Z)throw await X.cancel().catch(()=>{}),new xG$(`Upstream response exceeded ${Z} bytes`);Y+=Q.decode(W,{stream:!0})}return Y+=Q.decode(),Y}var xG$;var Jp=B(()=>{xG$=class xG$ extends Error{}});async function Hw0({ctx:$,runner:Z,handle:X,orgId:Q,userId:Y,entries:G}){if(!G||G.length===0)return;let J={};for(let K of G){if(K.kind==="literal"){J[K.key]=K.value;continue}try{let{value:H}=await $.storage.secrets.resolveById(K.secretId,Q,Y);J[K.key]=H}catch(H){if(H instanceof BG||H instanceof $w){console.warn(`[SANDBOX_START] skipping env ${K.key}: ${H.message}. Re-link or recreate the secret to restore.`);continue}throw H}}if(Object.keys(J).length===0)return;let W=await Z.proxyDaemonRequest(X,"/_sandbox/config",{method:"PUT",headers:new Headers({"content-type":"application/json"}),body:JSON.stringify({env:J})});if(!W.ok){let K=await $O(W,S34).catch(()=>W.statusText);console.warn(`[SANDBOX_START] daemon rejected env patch (${W.status}): ${K}`)}}var S34=10485760;var gn0=B(()=>{Zm();Jp()});async function yG$({ctx:$,orgId:Z,userId:X,entries:Q}){if(!Q||Q.length===0)return[];let Y=[];for(let G of Q)try{let{value:J}=await $.storage.secrets.resolveById(G.secretId,Z,X);Y.push({host:G.host,token:J})}catch(J){if(J instanceof BG||J instanceof $w){console.warn(`[SANDBOX_START] skipping submodule credential for ${G.host}: ${J.message}. Re-link or recreate the secret to restore.`);continue}throw J}return Y}var gG$=B(()=>{Zm()});async function cG$($,Z,X,Q,Y){let G=await eH({connectionId:$,tokenStorage:new E5(Q,Y)});if(!G.accessToken)return null;return dG$(Z,X,G.accessToken)}function lG$($,Z){return dG$($,Z,null)}async function dG$($,Z,X){let Q=new Map,Y=new Set(hG$.map((K)=>K.path));for(let K of Object.values(uG$))for(let H of K??[])Y.add(H);await Promise.all(Array.from(Y).map(async(K)=>{Q.set(K,await C34($,Z,K,X))}));let G=hG$.find(({path:K})=>Q.get(K)!==null);if(!G)return null;let J=uG$[G.pm]??[],W=null;for(let K of J)if(W=_34(Q.get(K)??null),W)break;return{packageManager:G.pm,devPort:W}}async function C34($,Z,X,Q){let Y=`https://api.github.com/repos/${$}/${Z}/contents/${encodeURIComponent(X)}`;try{let G={Accept:"application/vnd.github+json","User-Agent":"studio-runtime-detect"};if(Q)G.Authorization=`token ${Q}`;let J=await fetch(Y,{headers:G,signal:AbortSignal.timeout(5000)});if(!J.ok)return null;let W=await J.json();if(!W.content||W.encoding!=="base64")return null;return Buffer.from(W.content,"base64").toString("utf8")}catch{return null}}function _34($){if(!$)return null;try{let Z=JSON.parse($),X=Z.tasks??Z.scripts??{};return(X.dev??X.start??"").match(V34)?.[1]??null}catch{return null}}var hG$,uG$,V34;var mG$=B(()=>{Pw();X3();hG$=[{path:"deno.json",pm:"deno"},{path:"deno.jsonc",pm:"deno"},{path:"bun.lock",pm:"bun"},{path:"bunfig.toml",pm:"bun"},{path:"pnpm-lock.yaml",pm:"pnpm"},{path:"yarn.lock",pm:"yarn"},{path:"package-lock.json",pm:"npm"},{path:"package.json",pm:"bun"}],uG$={deno:["deno.json","deno.jsonc"],bun:["package.json"],pnpm:["package.json"],yarn:["package.json"],npm:["package.json"]},V34=/(?:--port|PORT=|:)(\d{4,5})/});function v34($){return($??"").normalize("NFKD").replace(/[\u0300-\u036F]/g,"").toLowerCase().replace(/[^a-z0-9]+/g,"-").replace(/^-+|-+$/g,"")||"user"}function Nw0($){return $?.name||$?.email?.split("@")[0]||void 0}function Fw0($){let Z=v34($),X=Date.now().toString(36).split("").reverse().join("");return`${Z}-${X}`}function iG$($){let{current:Z,detached:X,base:Q}=$.status??{};if(typeof Z!=="string"||Z.length===0)return null;if(X===!0)return null;if(Z===$.requestedRef)return null;if(b34.has(Z))return null;if(typeof Q==="string"&&Q.length>0&&Z===Q)return null;return Z}function nG$($){if(!$.branch.startsWith("thread:"))return $.branch;if($.sticky&&$.recordedHeadRef)return $.recordedHeadRef;return $.derivedRef}var b34;var hn0=B(()=>{b34=new Set(["main","master","trunk","develop","HEAD"])});async function pG$($,Z){if(!$)return{hosts:[],allowSameHostDev:!1};let X;try{X=await $.presignedGetUrl("link-dispatch/_allowlist_probe",60,{requireFetchable:!0})}catch{return{hosts:[],allowSameHostDev:!1}}let Q;try{Q=new URL(X)}catch{return{hosts:[],allowSameHostDev:!1}}if(Q.protocol!=="https:"&&Q.protocol!=="http:")return{hosts:[],allowSameHostDev:!1};let Y=Q.hostname,G=f34.has(Y);return{hosts:[Y],allowSameHostDev:G&&!Z.isProduction}}var f34;var tG$=B(()=>{f34=new Set(["127.0.0.1","localhost","::1","[::1]","0.0.0.0"])});import{z as GK}from"zod";async function px($,Z){$0(Z);let X=r(Z),Q=W1(Z);if(!Q)throw Error("User ID required");let Y=await Z.storage.virtualMcps.findById($.virtualMcpId);if(!Y||Y.organization_id!==X.id)throw Error("Virtual MCP not found");let G=Y.metadata??{},J=await zN(Z,$.branch,Q),W=eW(C5(G),J,$.branch,$.sandboxProviderKind),K=$.sandboxProviderKind,{provider:H}=await hX(Z,{userId:J,branch:$.branch,virtualMcpMetadata:G,explicitKind:K});if(W){if(K!=="user-desktop")return W;if(await H.alive(W.sandboxHandle).catch(()=>!1))return W;await yw(Z.storage.virtualMcps,$.virtualMcpId,Q,J,$.branch,K).catch((O)=>{console.warn("[ensureSandbox] failed to reap stale user-desktop entry",O)})}let F=await ew(Z,sw($.branch)??Z.metadata?.threadId)??G.githubRepo??null,{entry:U}=await rG$({ctx:Z,userId:Q,sandboxUserId:J,orgId:X.id,virtualMcpId:$.virtualMcpId,branch:$.branch,metadata:G,githubRepo:F,existing:null,providerKind:K,runner:H,...$.cloneOnly?{cloneOnly:!0}:{}});return U}async function rG$($){let{ctx:Z,userId:X,sandboxUserId:Q,orgId:Y,virtualMcpId:G,branch:J,metadata:W,githubRepo:K,existing:H,runner:N,cloneOnly:F}=$,{runtime:U,packageManager:w,port:O,packageManagerPath:D}=fG$(W),L;if(K){if(K.connectionId)await Vx({ctx:Z,connectionId:K.connectionId,organizationId:Y,forceRefresh:!0,onLegacyMintError:(f0)=>{console.error("[provisionSandbox] repo-scoped legacy token mint failed",{connectionId:K.connectionId,error:f0.message})}});let{cloneUrl:E0,gitUserName:e,gitUserEmail:t}=K.connectionId?await gw(K.connectionId,K.owner,K.name,Z.db,Z.vault):N5$(K.owner,K.name);if(!w){let f0=K.connectionId?await cG$(K.connectionId,K.owner,K.name,Z.db,Z.vault):await lG$(K.owner,K.name);if(f0)w=f0.packageManager,U=Yp[f0.packageManager].runtime,O=f0.devPort??O,await y34(Z,G,X,f0.packageManager,f0.devPort)}let P0=c0().sandboxStickyHeadRefEnabled,Q0=nG$({branch:J,derivedRef:jN(J),recordedHeadRef:P0?await kG$(Z,sw(J)):null,sticky:P0}),j0=await yG$({ctx:Z,orgId:Y,userId:X,entries:vG$(W)});L={cloneUrl:E0,...K.connectionId?{connectionId:K.connectionId}:{},userName:e,userEmail:t,branch:Q0,displayName:`${K.owner}/${K.name}`,...j0.length>0?{submoduleCredentials:j0}:{}}}let E=typeof W.productionUrl==="string"&&W.productionUrl.trim()?W.productionUrl.trim():void 0,j=U&&w&&!F?{runtime:U,packageManager:w,...O!==null?{devPort:Number(O)}:{},...D?{packageManagerPath:D}:{},...E?{productionUrl:E}:{}}:void 0,z=In({orgId:Y,virtualMcpId:G,branch:J}),A=N.kind==="user-desktop"?await pG$(Z.objectStorage,{isProduction:c0().nodeEnv==="production"}):null,P=(N.kind==="user-desktop"||N.kind==="agent-sandbox")&&!c0().orgFsMountsDisabled,M;if(P){let E0=Z.organization?.slug??(await Z.db.selectFrom("organization").select(["slug"]).where("id","=",Y).executeTakeFirst())?.slug;if(E0)M=await je1(Z,{orgSlug:E0,orgId:Y,baseUrl:eX()})}await h34(N);let k=await N.ensure({userId:Q,projectRef:z},{branch:J,repo:L,workload:j,cloneOnly:F===!0,tenant:{orgId:Y,userId:Q,...Z.organization?.slug?{orgSlug:Z.organization.slug}:{},...Z.organization?.name?{orgName:Z.organization.name}:{},...Z.auth.user?.email?{userEmail:Z.auth.user.email}:{},...Z.auth.user?.name?{userName:Z.auth.user.name}:{}},...A?{offloadAllowedHosts:A.hosts,offloadAllowSameHostDev:A.allowSameHostDev}:{},...M?{orgFsConfigJson:M}:{}}),q=W.runtime?.env??null;await Hw0({ctx:Z,runner:N,handle:k.handle,orgId:Y,userId:X,entries:q});let h=!!H&&H.sandboxHandle===k.handle&&H?.createdAt?H.createdAt:Date.now(),b=W.runtime?.selected??null,x=W.runtime?.port??null,p=W.runtime?.path??null,m={sandboxHandle:k.handle,previewUrl:k.previewUrl,sandboxApiUrl:k.previewUrl,sandboxProviderKind:N.kind,createdAt:h,startedWith:{packageManager:b,port:x,path:p}};await $5$(Z.storage.virtualMcps,G,X,Q,J,$.providerKind,m);let Y0=sw(J);if(Y0)await CG$(Z,Y0,Q,J,$.providerKind,m);let L0=!H||H.sandboxHandle!==k.handle;return{entry:m,isNewVm:L0}}async function y34($,Z,X,Q,Y){let G=await $.storage.virtualMcps.findById(Z);if(!G)return;let J=G.metadata??{};await $.storage.virtualMcps.update(Z,X,{metadata:{...J,runtime:{selected:Q,port:Y}}})}async function h34($){if(!$.hasSchedulableCapacity)return;let Z=Date.now()+oG$,X=!1;while(!await $.hasSchedulableCapacity()){if(Date.now()>=Z)throw Error(`sandbox provisioning failed: the cluster has had no room to schedule another sandbox for ${Math.round(oG$/1000)}s`);if(!X)X=!0,console.warn("[ensureSandbox] waiting for cluster capacity \u2014 a sandbox pod cannot be scheduled right now");await y$(g34)}}var x34,un0,oG$=150000,g34=5000;var Wp=B(()=>{FN();B6();b0();Gp();gn0();gG$();kQ();Vn();mG$();fn0();aw();j3();hn0();tG$();S$();BZ();ui();kQ();x34=GK.enum(["agent-sandbox","user-desktop","cluster"]),un0=d({name:"SANDBOX_START",description:"Start a sandbox with the connected GitHub repo and dev server.",annotations:{title:"Start VM Preview",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!1,openWorldHint:!0},_meta:{ui:{visibility:"app"}},inputSchema:GK.object({virtualMcpId:GK.string().describe("Virtual MCP ID"),branch:GK.string().min(1).optional().describe("Git branch to check out. Pass the thread's branch whenever the caller has one: when omitted the handler mints a fresh `<user-slug>-<timestamp>` name, which becomes a SEPARATE sandbox from the one the thread's own branch resolves to. The resolved branch is returned in the response so callers can persist it."),sandboxProviderKind:x34.optional().describe("Explicit runtime choice. Hosted provider is `agent-sandbox`; legacy `cluster` input is accepted only for compatibility and normalized to `agent-sandbox`. When omitted, defaults to `user-desktop` if the acting user's link daemon is online, else the env kind.")}),outputSchema:GK.object({previewUrl:GK.string().nullable(),sandboxHandle:GK.string(),branch:GK.string(),isNewVm:GK.boolean(),sandboxProviderKind:GK.enum(["agent-sandbox","user-desktop"])}),handler:async($,Z)=>{$0(Z);let X=r(Z);await Z.access.check();let Q=$.branch??Fw0(Nw0(Z.auth.user)),Y=W1(Z);if(!Y)throw Error("User ID required");let G=await zN(Z,Q,Y),J=await Z.storage.virtualMcps.findById($.virtualMcpId);if(!J||J.organization_id!==X.id)throw Error("Virtual MCP not found");let W=J.metadata??{},K=$.sandboxProviderKind?aL($.sandboxProviderKind):void 0,{provider:H,kind:N}=await hX(Z,{userId:G,branch:Q,virtualMcpMetadata:W,explicitKind:K}),F=eW(C5(W),G,Q,N),w=await ew(Z,sw(Q)??Z.metadata?.threadId)??W.githubRepo??null,{entry:O,isNewVm:D}=await rG$({ctx:Z,userId:Y,sandboxUserId:G,orgId:X.id,virtualMcpId:$.virtualMcpId,branch:Q,metadata:W,githubRepo:w,existing:F,providerKind:N,runner:H});return{...O,branch:Q,isNewVm:D,sandboxProviderKind:N}}})});function u34($){let{publicUrl:Z,agentId:X,organization:Q,target:Y,threadId:G}=$;if(Y==="agent-tools")return`${Z}/mcp/virtual-mcp/${X}`;if(!Q.slug)throw new sG$(Q.id);if(Y==="task-run"){if(!G)throw Error("a task-run MCP endpoint is scoped to a run: threadId is required");return`${Z}/api/${Q.slug}/mcp/task-run/${encodeURIComponent(G)}`}return`${Z}/api/${Q.slug}/mcp/self`}async function Uw0($,Z,X,Q,Y="agent-tools",G){let J=u34({publicUrl:eX(),agentId:Z,organization:X,target:Y,...G?{threadId:G}:{}}),W=await $.boundAuth.apiKey.create({name:Q,permissions:{"*":["*"]},expiresIn:aG$,metadata:{organization:{id:X.id,slug:X.slug,name:X.name}}});return{url:J,headers:{Authorization:`Bearer ${W.key}`,"x-org-id":X.id},expiresAt:Date.now()+aG$*1000}}var aG$=3600,sG$;var cn0=B(()=>{BZ();sG$=class sG$ extends Error{constructor($){super(`cannot mint a management MCP endpoint for organization "${$}": the org-scoped path /api/<slug>/mcp/self needs the org slug, which was not loaded.`);this.name="MissingOrganizationSlugError"}}});async function c34($,Z,X,Q){try{let Y=$.organization;if(!Y)return;let G=await Uw0($,Q.virtualMcpId,Y,"tool-scripting"),J=await Z.proxyDaemonRequest(X,"/_sandbox/tools/sync",{method:"POST",headers:new Headers({"content-type":"application/json"}),body:JSON.stringify(G)});if(!J.ok)console.warn("[cluster-sandbox-fs] tools/sync failed",J.status,await J.text().catch(()=>""))}catch(Y){console.warn("[cluster-sandbox-fs] tools/sync failed",Y)}}async function tx($,Z){let{provider:X,kind:Q}=await hX($,{userId:Z.userId,branch:Z.branch,virtualMcpMetadata:null}),Y=null,G=()=>{if(!Y){if(Y=px({virtualMcpId:Z.virtualMcpId,branch:Z.branch,sandboxProviderKind:Q},$).then((K)=>K.sandboxHandle),Y.catch(()=>{Y=null}),Z.syncTools)Y.then((K)=>c34($,X,K,{virtualMcpId:Z.virtualMcpId,providerKind:Q})).catch(()=>{})}return Y},J=Z.branch==="ephemeral"||Q==="user-desktop";return Dm0(X,{ensureHandle:G,invalidateHandle:async(K)=>{let H=Y;if(Y=null,!J&&!K?.force)return;try{await yw($.storage.virtualMcps,Z.virtualMcpId,Z.userId,Z.userId,Z.branch,Q)}catch(N){console.warn("[cluster-sandbox-fs] failed to reap vmMap entry",N)}if(H&&typeof X.forgetHandle==="function")try{let N=await H;await X.forgetHandle(N)}catch(N){console.warn("[cluster-sandbox-fs] forgetHandle failed",N)}},canAutoRestart:J,threadId:Z.threadId})}async function eG$($,Z){try{let X=await tx($,Z),{stdout:Q}=await X.onBash("test -d .deco && echo __DECO_SITE__");return Q.includes("__DECO_SITE__")}catch(X){return console.warn("[cluster-sandbox-fs] .deco probe failed; assuming deco site",X),!0}}var ww0=B(()=>{FN();cn0();aw();Wp();kQ()});import{z as $J$}from"zod";function ox($){let Z=[];for(let X of $){if(X.status!=="active")continue;let Q=_X(X);if(!Q)continue;Z.push({connectionId:X.id,owner:Q.owner,repo:Q.repo,installationId:Q.installationId})}return Z}async function d34($,Z){let{items:X}=await $.storage.connections.list(Z,{slug:"mcp-github"});return ox(X)}function m34($){let Z=$.split(`
 `).map((Q)=>Q.trim()).filter((Q)=>Q&&Q!==".git"&&Q!=="__CLONED__"),X=Z.length>0;return{cloned:X,listing:X?Z.join(`
 `):""}}function i34($){let Z="Load a GitHub repository into this conversation's sandbox so the file tools (read/write/edit/bash/grep/glob) and dev server operate on that repo, and open its live Preview. Waits until the repo is cloned before returning. Calling it again switches the repo. File tools operate on the loaded repo from your NEXT message (this turn's tools are still bound to the previous workspace), so after loading, prefer the file listing this tool returns over re-running bash in the same turn.",X=$.map((Q)=>`- ${Q.owner}/${Q.repo} (connectionId: ${Q.connectionId})`).join(`
 `);return`${Z}
@@ -1240,7 +1240,7 @@ Caused by: ${Z.stack}`}};qV=class qV extends k9{constructor($,Z){super($,Z);this
 Repositories imported into this organization:
 ${X}
 
-Pass the connectionId of the repo to load.`}async function QJ$($){let{ctx:Z,orgId:X,virtualMcpId:Q,userId:Y,threadId:G,writer:J,rebindFs:W}=$;if(!ZG(Q))return null;let K=await d34(Z,X);if(K.length===0)return null;let H=new Map(K.map((N)=>[N.connectionId,N]));return _$({description:i34(K),inputSchema:s($J$.object({connectionId:$J$.string().describe("connectionId of the imported repository to load (see the list in this tool's description).")})),execute:async({connectionId:N})=>{let F=H.get(N);if(!F)return{success:!1,error:`No imported repository found for connectionId "${N}". Available: ${K.map((_)=>_.connectionId).join(", ")||"none"}.`};let U=E3(G,F.connectionId),w={url:`https://github.com/${F.owner}/${F.repo}`,owner:F.owner,name:F.repo,installationId:F.installationId,connectionId:F.connectionId},O=await Z.storage.threads.get(G);await Z.storage.threads.update(G,{metadata:{...O?.metadata??{},githubRepo:w},branch:U,updated_by:Y});let{kind:D}=await hX(Z,{userId:Y,branch:U,virtualMcpMetadata:null}),L=await px({virtualMcpId:Q,branch:U,sandboxProviderKind:D},Z),E=kn(C5(O?.metadata),Y,U,D,L);J.write({type:"data-open-preview",id:G,data:{previewUrl:L.previewUrl??null,branch:U,githubRepo:w,sandboxMap:E,sandboxProviderKind:D}});let j=await tx(Z,{virtualMcpId:Q,branch:U,userId:Y}),z=Date.now()+ZJ$,A="",P=!1,M=0,k=null;while(Date.now()<z){let _=await j.onBash("if git -C /app/repo rev-parse HEAD >/dev/null 2>&1; then echo __CLONED__; fi; ls -A /app/repo 2>/dev/null").then((b)=>({ok:!0,stdout:b.stdout})).catch(()=>({ok:!1,stdout:""}));if(!_.ok){if(++M>=l34)break;await y$(XJ$);continue}M=0;let h=m34(_.stdout);if(h.cloned&&h.listing===k){P=!0,A=h.listing;break}k=h.cloned?h.listing:null,await y$(XJ$)}let q=!1;if(P&&W)try{await W(U),q=!0}catch(_){console.warn("[load_repo] live fs rebind failed",_)}return{success:!0,repo:`${F.owner}/${F.repo}`,previewUrl:L.previewUrl??null,cloned:P,files:A,message:!P?`Loaded ${F.owner}/${F.repo} and opened the Preview, but the clone did not finish within ${Math.round(ZJ$/1000)}s. It may still be in progress \u2014 your file tools will use it next message.`:q?`Loaded ${F.owner}/${F.repo} and opened the Preview. The repo is cloned and its dev server is booting. Your file tools (read/write/edit/bash/grep/glob) now operate on it \u2014 you can use it right away.`:`Loaded ${F.owner}/${F.repo} and opened the Preview. The repo is cloned and its dev server is booting. Your file tools operate on it from your next message.`}}})}var ZJ$=120000,XJ$=1500,l34=5;var Ow0=B(()=>{B6();S4();aw();dW();B8();kQ();Wp();j3();ww0()});import{AsyncLocalStorage as n34}from"async_hooks";function Bw0(){let $=Kp.getStore();if(!$)throw Error("This tool is only available on a task run's MCP endpoint (/api/<org>/mcp/task-run/<threadId>).");return $}function GJ$($){return mJ.some((X)=>Qm($,X))?p34:YJ$}var Kp,YJ$,p34;var Hp=B(()=>{b7();Kp=new n34;YJ$=["TASK_ADD_REPO","TASK_BOARD_ITEM_LIST","TASK_BOARD_ITEM_UPDATE","TASK_BOARD_ITEM_PRS_GET","TASK_BOARD_ITEM_PR_LINK","TASK_BOARD_ACTIVITY_LIST","TASK_BOARD_COMMENT_LIST","TASK_BOARD_COMMENT_CREATE","TASK_BOARD_COMMENT_UPDATE"],p34=[...YJ$,"TASK_BOARD_REVIEW_DECISION"]});import{z as bG}from"zod";async function KJ$($,Z,X,Q){let Y=await $.proxyDaemonRequest(Z,"/_sandbox/bash",{method:"POST",headers:new Headers({"content-type":"application/json","x-thread-id":X}),body:JSON.stringify({command:Q})});if(!Y.ok)throw Error(`sandbox bash failed (${Y.status} ${Y.statusText})`);let G=await Y.json();return{stdout:G.stdout??"",exitCode:G.exitCode??0}}function r34($){let Z=$.split(`
+Pass the connectionId of the repo to load.`}async function QJ$($){let{ctx:Z,orgId:X,virtualMcpId:Q,userId:Y,threadId:G,writer:J,rebindFs:W}=$;if(!ZG(Q))return null;let K=await d34(Z,X);if(K.length===0)return null;let H=new Map(K.map((N)=>[N.connectionId,N]));return _$({description:i34(K),inputSchema:s($J$.object({connectionId:$J$.string().describe("connectionId of the imported repository to load (see the list in this tool's description).")})),execute:async({connectionId:N})=>{let F=H.get(N);if(!F)return{success:!1,error:`No imported repository found for connectionId "${N}". Available: ${K.map((_)=>_.connectionId).join(", ")||"none"}.`};let U=E3(G,F.connectionId),w={url:`https://github.com/${F.owner}/${F.repo}`,owner:F.owner,name:F.repo,installationId:F.installationId,connectionId:F.connectionId},O=await Z.storage.threads.get(G);await Z.storage.threads.update(G,{metadata:{...O?.metadata??{},githubRepo:w},branch:U,updated_by:Y});let{kind:D}=await hX(Z,{userId:Y,branch:U,virtualMcpMetadata:null}),L=await px({virtualMcpId:Q,branch:U,sandboxProviderKind:D},Z),E=kn(C5(O?.metadata),Y,U,D,L);J.write({type:"data-open-preview",id:G,data:{previewUrl:L.previewUrl??null,branch:U,githubRepo:w,sandboxMap:E,sandboxProviderKind:D}});let j=await tx(Z,{virtualMcpId:Q,branch:U,userId:Y,threadId:G}),z=Date.now()+ZJ$,A="",P=!1,M=0,k=null;while(Date.now()<z){let _=await j.onBash("if git -C /app/repo rev-parse HEAD >/dev/null 2>&1; then echo __CLONED__; fi; ls -A /app/repo 2>/dev/null").then((b)=>({ok:!0,stdout:b.stdout})).catch(()=>({ok:!1,stdout:""}));if(!_.ok){if(++M>=l34)break;await y$(XJ$);continue}M=0;let h=m34(_.stdout);if(h.cloned&&h.listing===k){P=!0,A=h.listing;break}k=h.cloned?h.listing:null,await y$(XJ$)}let q=!1;if(P&&W)try{await W(U),q=!0}catch(_){console.warn("[load_repo] live fs rebind failed",_)}return{success:!0,repo:`${F.owner}/${F.repo}`,previewUrl:L.previewUrl??null,cloned:P,files:A,message:!P?`Loaded ${F.owner}/${F.repo} and opened the Preview, but the clone did not finish within ${Math.round(ZJ$/1000)}s. It may still be in progress \u2014 your file tools will use it next message.`:q?`Loaded ${F.owner}/${F.repo} and opened the Preview. The repo is cloned and its dev server is booting. Your file tools (read/write/edit/bash/grep/glob) now operate on it \u2014 you can use it right away.`:`Loaded ${F.owner}/${F.repo} and opened the Preview. The repo is cloned and its dev server is booting. Your file tools operate on it from your next message.`}}})}var ZJ$=120000,XJ$=1500,l34=5;var Ow0=B(()=>{B6();S4();aw();dW();B8();kQ();Wp();j3();ww0()});import{AsyncLocalStorage as n34}from"async_hooks";function Bw0(){let $=Kp.getStore();if(!$)throw Error("This tool is only available on a task run's MCP endpoint (/api/<org>/mcp/task-run/<threadId>).");return $}function GJ$($){return mJ.some((X)=>Qm($,X))?p34:YJ$}var Kp,YJ$,p34;var Hp=B(()=>{b7();Kp=new n34;YJ$=["TASK_ADD_REPO","TASK_BOARD_ITEM_LIST","TASK_BOARD_ITEM_UPDATE","TASK_BOARD_ITEM_PRS_GET","TASK_BOARD_ITEM_PR_LINK","TASK_BOARD_ACTIVITY_LIST","TASK_BOARD_COMMENT_LIST","TASK_BOARD_COMMENT_CREATE","TASK_BOARD_COMMENT_UPDATE"],p34=[...YJ$,"TASK_BOARD_REVIEW_DECISION"]});import{z as bG}from"zod";async function KJ$($,Z,X,Q){let Y=await $.proxyDaemonRequest(Z,"/_sandbox/bash",{method:"POST",headers:new Headers({"content-type":"application/json","x-thread-id":X}),body:JSON.stringify({command:Q})});if(!Y.ok)throw Error(`sandbox bash failed (${Y.status} ${Y.statusText})`);let G=await Y.json();return{stdout:G.stdout??"",exitCode:G.exitCode??0}}function r34($){let Z=$.split(`
 `).map((X)=>X.trim()).filter((X)=>X&&X!==".git"&&X!=="__CLONED__");return{cloned:Z.length>0,listing:Z.join(`
 `)}}async function s34($,Z){let{items:X}=await $.storage.connections.list(Z,{slug:"mcp-github"});return ox(X)}var t34=3300000,JJ$=180000,WJ$=1500,o34=5,a34,ln0;var HJ$=B(()=>{b0();Ow0();aw();Vn();kQ();j3();B6();Hp();a34=['token=$(git remote get-url origin | sed -n "s|.*x-access-token:\\([^@]*\\)@.*|\\1|p")','[ -n "$token" ] || exit 0','mkdir -p "${HOME:-/root}/.config/gh"',"umask 077",'printf "github.com:\\n  oauth_token: %s\\n  git_protocol: https\\n" "$token" > "${HOME:-/root}/.config/gh/hosts.yml"'].join(`
 `);ln0=d({name:"TASK_ADD_REPO",description:"Clone one of this organization's repositories into your working directory. "+"Your working directory is EMPTY until you call this \u2014 do not look for "+"files, and do not run git, before it returns. Call it once, with the repository the task is about; it waits for the checkout and returns the repository root listing, so you can start reading files immediately after. `git` and `gh` are authenticated once it returns. Call TASK_ADD_REPO with no arguments to list the repositories available.",annotations:{title:"Add Repository",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!0},inputSchema:bG.object({connectionId:bG.string().optional().describe("connectionId of the repository to clone. Omit to list the available repositories.")}),outputSchema:bG.object({success:bG.boolean(),repositories:bG.array(bG.object({connectionId:bG.string(),repo:bG.string()})).optional(),repo:bG.string().optional(),cloned:bG.boolean().optional(),files:bG.string().optional(),message:bG.string()}),handler:async($,Z)=>{$0(Z),await Z.access.check();let X=r(Z),Q=W1(Z);if(!Q)throw Error("User ID required");let{threadId:Y}=Bw0(),G=await s34(Z,X.id),J=$.connectionId?G.find((k)=>k.connectionId===$.connectionId):void 0;if(!J){let k=G.map((q)=>({connectionId:q.connectionId,repo:`${q.owner}/${q.repo}`}));return{success:!1,repositories:k,message:$.connectionId?`No imported repository for connectionId "${$.connectionId}". Pick one of the repositories listed.`:k.length===0?"This organization has no repositories imported, so none can be cloned.":"Pick a repository and call TASK_ADD_REPO again with its connectionId."}}let W=await Z.storage.threads.get(Y);if(!W)throw Error(`Thread not found: ${Y}`);let K=E3(Y),H=await zN(Z,K,Q),{provider:N,kind:F}=await hX(Z,{userId:H,branch:K,virtualMcpMetadata:null}),U=eW(await Ww0(Z,Y),H,K,F);if(!U)throw Error(`No sandbox is registered for this run (thread ${Y}), so there is nowhere to clone into.`);await Vx({ctx:Z,connectionId:J.connectionId,organizationId:X.id,forceRefresh:!0,onLegacyMintError:(k)=>console.error("[TASK_ADD_REPO] legacy repo-scoped mint failed",{connectionId:J.connectionId,error:k.message})});let{cloneUrl:w,gitUserName:O,gitUserEmail:D}=await gw(J.connectionId,J.owner,J.repo,Z.db,Z.vault,{bufferMs:t34});await Z.storage.threads.update(Y,{metadata:{...W.metadata??{},githubRepo:{url:`https://github.com/${J.owner}/${J.repo}`,owner:J.owner,name:J.repo,installationId:J.installationId,connectionId:J.connectionId}},updated_by:Q});let L=jN(K),E=await N.proxyDaemonRequest(U.sandboxHandle,"/_sandbox/config",{method:"PUT",headers:new Headers({"content-type":"application/json"}),body:JSON.stringify({git:{repository:{cloneUrl:w,branch:L,repoName:`${J.owner}/${J.repo}`},identity:{userName:O,userEmail:D}}})});if(!E.ok)throw Error(`the sandbox rejected the repository (${E.status} ${E.statusText})`);await N.proxyDaemonRequest(U.sandboxHandle,"/_sandbox/setup/clone",{method:"POST",headers:new Headers({"content-type":"application/json"}),body:"{}"}).catch((k)=>{console.warn("[TASK_ADD_REPO] explicit clone kick failed",k)});let j=Date.now()+JJ$,z=!1,A="",P=0,M=null;while(Date.now()<j){let k=await KJ$(N,U.sandboxHandle,Y,"if git rev-parse HEAD >/dev/null 2>&1; then echo __CLONED__; fi; ls -A 2>/dev/null").catch(()=>null);if(!k){if(++P>=o34)break;await y$(WJ$);continue}P=0;let q=r34(k.stdout);if(q.cloned&&q.listing===M){z=!0,A=q.listing;break}M=q.cloned?q.listing:null,await y$(WJ$)}if(z)await KJ$(N,U.sandboxHandle,Y,a34).catch((k)=>console.warn("[TASK_ADD_REPO] gh auth setup failed",k));return{success:z,repo:`${J.owner}/${J.repo}`,cloned:z,files:A,message:z?`${J.owner}/${J.repo} is checked out at your working directory on branch ${L}. \`git\` and \`gh\` are authenticated. Start working.`:`The clone of ${J.owner}/${J.repo} did not finish within ${Math.round(JJ$/1000)}s. It may still be in progress \u2014 check your working directory before calling this again.`}}})});import{z as G$}from"zod";var PN,CV,e34,$W4,NJ$,rx,ZW4,XW4,FJ$;var JK=B(()=>{b7();PN=G$.enum(["triage","todo","in_progress","in_review","done"]),CV=G$.enum(["none","low","medium","high","urgent"]),e34=G$.object({threadId:G$.string(),virtualMcpId:G$.string().nullable(),status:G$.enum(["in_progress","requires_action","failed","completed","expired"]).nullable(),title:G$.string().nullable(),lastMessage:G$.string().nullable(),hasPreview:G$.boolean(),hasMessages:G$.boolean(),createdAt:G$.string()}),$W4=G$.object({id:G$.string(),name:G$.string(),color:G$.string().nullable().describe('Hex color, e.g. "#3b82f6"'),createdBy:G$.string(),createdAt:G$.string().datetime()}),NJ$=G$.object({url:G$.string(),number:G$.number(),repoOwner:G$.string(),repoName:G$.string(),createdAt:G$.string(),title:G$.string().nullable(),body:G$.string().nullable(),state:G$.enum(["open","closed"]).nullable(),draft:G$.boolean().nullable(),merged:G$.boolean().nullable(),mergeable:G$.boolean().nullable(),checksStatus:G$.enum(["pending","passing","failing"]).nullable(),checks:G$.array(G$.object({name:G$.string(),status:G$.string(),conclusion:G$.string().nullable(),detailsUrl:G$.string().nullable(),summary:G$.string().nullable()})),previewUrl:G$.string().nullable()}),rx=G$.object({id:G$.string(),organizationId:G$.string(),title:G$.string(),description:G$.string().nullable(),status:PN,priority:CV,assigneeId:G$.string().nullable(),assignedBy:G$.string().nullable(),dueDate:G$.string().datetime().nullable(),sortOrder:G$.number(),threads:G$.array(e34),tags:G$.array($W4),createdBy:G$.string(),createdAt:G$.string().datetime(),updatedBy:G$.string(),updatedAt:G$.string().datetime()}),ZW4=["created","status_changed","assignee_changed","priority_changed","due_date_changed","title_changed","description_changed","tags_changed","review_requested","review_approved","review_changes_requested","merge_conflict_resolution"],XW4=G$.enum(ZW4),FJ$=G$.object({id:G$.string(),taskBoardItemId:G$.string(),action:XW4,actorId:G$.string().nullable(),data:G$.record(G$.string(),G$.unknown()),occurredAt:G$.string().datetime()})});async function Dw0($,Z,X){if(X===p4)return;let{members:Q}=await $.boundAuth.organization.listMembers({organizationId:Z,filterField:"userId",filterValue:X});if(!Q.some((Y)=>Y.userId===X))throw Error("assigneeId is not a member of the organization")}var dn0=B(()=>{JK()});function OJ$($){let Z={};for(let[X,Q]of Object.entries($)){if(X.startsWith(QW4))continue;Z[X]=Q}return Z}function Lw0($){return{taskBoardItemId:$.id,...SW($)&&{[UJ$]:wJ$}}}function YW4($){return $?.[UJ$]===wJ$}function GW4($){if(/[:\s]/.test($))throw Error("organization id unsuitable for the subsidy key scheme");return`subsidy:${$}`}async function JW4($,Z){let X=c0();try{let Q=await $.storage.subsidizedGatewayKeys.get(Z);if(Q)return Q;let Y=$.auth?.user?.id;if(Y&&X.aiGatewayEnabled&&X.studioProvisionSecretKey&&YU.provisionKey){let G=await DW(Y,$.auth?.user?.email),J=await YU.provisionKey(G,GW4(Z));return await $.storage.subsidizedGatewayKeys.put(Z,J),J}}catch(Q){console.error("[subsidized-runs] subsidy key unavailable \u2014 run stays on the org's key:",Q)}return}async function BJ$($,Z,X){if(!c0().taskQuotaEnforced)return;if(!YW4(X))return;let Q=X?.taskBoardItemId;if(!Q)return;let Y=await $.storage.taskBoard.getById(Q,Z);if(!Y||!SW(Y))return;if(!await Mn1($,Q))return;return await JW4($,Z)}function DJ$($,Z){if(!Z)return $;if($.providerId!=="deco")return $;return{...$,apiKey:Z}}var QW4="srv.",UJ$="srv.billing",wJ$="subscription";var Np=B(()=>{d10();EU();S$();cH()});function Ew0($){let Z=$?.runClass;return Z&&Z in mn0?mn0[Z]:mn0.interactive}var mn0,LJ$="runClass";var jw0=B(()=>{mn0={interactive:10,reviewer:20,retry:30,new_task:40}});async function in0($,Z,X){let Q;try{return await Promise.race([$.aiProviders.listModels(Z,X),new Promise((G,J)=>{Q=setTimeout(()=>J(Error("listModels timeout")),WW4)})])}finally{if(Q)clearTimeout(Q)}}function KW4($,Z){switch($){case"fast":return Z.chat.fast;case"smart":return Z.chat.smart;case"thinking":return Z.chat.thinking;case"image":return Z.image;case"web_search":return Z.webSearch;case"deep_research":return Z.deepResearch}}function nn0($,Z,X){let Q=$.find((Y)=>Y.modelId===Z);return{title:Q?.title??X??Z,providerId:Q?.providerId,capabilities:Q?.capabilities,limits:Q?.limits??null}}async function a7($,Z,X){let Q=$.organization?.id;if(!Q)throw Error("resolveTier called without an organization");let G=(await $.storage.organizationSettings.get(Q))?.simple_mode?.tiers?.[Z]??null,J=$.auth?.user?.id,W=qw.safeParse(Z),K=X?.applyUserPrefs&&W.success&&J?(await $.storage.userModelPreferences.get(J,Q))?.tiers?.[W.data]??null:null,H=(await $.storage.aiProviderKeys.list({organizationId:Q})).filter((O)=>aB(O.providerId));for(let O of[K,G])if(O&&H.some((D)=>D.id===O.keyId)){let D=await in0($,O.keyId,Q).catch(()=>[]);return{credentialId:O.keyId,modelId:O.modelId,modelMeta:nn0(D,O.modelId,O.title)}}if(H.length===0)throw new ax(Z);let N={};await Promise.all(H.map(async(O)=>{N[O.id]=await in0($,O.id,Q).catch(()=>[])}));let F=H.map((O)=>({id:O.id,providerId:O.providerId,label:O.label,presetId:O.presetId,createdBy:O.createdBy,createdAt:O.createdAt})),U=rq1(F,N),w=KW4(Z,U);if(!w)throw new ax(Z);return{credentialId:w.keyId,modelId:w.modelId,modelMeta:nn0(N[w.keyId]??[],w.modelId,w.title)}}async function EJ$($,Z,X){let Q=$.organization?.id;if(!Q)throw Error("resolveSpecificModel called without an organization");let Y=await $.storage.aiProviderKeys.findById(Z,Q).catch((J)=>{if(J instanceof Error&&J.message==="Provider key not found")throw new Fp(`AI provider credential "${Z}" was not found`,{cause:J});throw J});if(!aB(Y.providerId))throw new Fp(`AI provider credential "${Z}" uses native-only provider "${Y.providerId}" and cannot run a hosted model`);let G=await in0($,Z,Q).catch(()=>[]);return{credentialId:Z,modelId:X,modelMeta:nn0(G,X)}}async function fG($,Z){try{return await a7($,Z)}catch(X){if(X instanceof ax)return null;return console.warn(`[resolveTier] tier "${Z}" resolution failed:`,X),null}}var ax,Fp,WW4=5000;var ZO=B(()=>{VG();B8();ax=class ax extends Error{tier;constructor($){super(`No model available for tier "${$}". Connect a provider or configure the tier in organization settings.`);this.tier=$;this.name="TierUnavailableError"}};Fp=class Fp extends Error{constructor($,Z){super($,Z);this.name="SpecificModelCredentialUnavailableError"}}});function jJ$($){return $ instanceof WK||typeof $==="object"&&$!==null&&$.permanent===!0}var WK;var pn0=B(()=>{WK=class WK extends Error{permanent=!0;code;constructor($,Z){super(Z);this.name="PermanentRunError",this.code=$}}});function zw0($,Z,X={}){return{info:{id:$.providerId,name:$.providerId,description:$.providerId},aiSdk:Z,...X,listModels:async()=>{throw Error(`Decopilot provider '${$.providerId}' was created from a resolved runtime secret and cannot list models.`)}}}function Pw0($){let{providerId:Z,apiKey:X,baseUrl:Q,extraHeaders:Y}=$;switch(Z){case"anthropic":return zw0($,Hm({apiKey:X,...Q?{baseURL:Q}:{},...Y?{headers:Y}:{}}));case"google":return zw0($,qi({apiKey:X,...Q?{baseURL:Q}:{},...Y?{headers:Y}:{}}),{asyncResearch:{canHandle:ki,start:async({modelId:G,query:J,abortSignal:W})=>{let{interactionId:K}=await U50({apiKey:X,agent:G,query:J,abortSignal:W});return{jobId:K}},resume:({jobId:G,abortSignal:J,onProgress:W,pollIntervalMs:K})=>w50({apiKey:X,interactionId:G,abortSignal:J,onProgress:W,pollIntervalMs:K})}});case"openrouter":case"deco":{let G=_c({apiKey:X,...Q?{baseURL:Q}:{},...Y?{headers:Y}:{}}),J=G.languageModel.bind(G);return zw0($,Object.assign(G,{languageModel:(...W)=>J(...W)}))}case"llmapi":case"openai-compatible":{let G=(Q??"").replace(/\/+$/,"");if(Z==="llmapi"&&!G)G="https://api.llmapi.ai/v1";if(G&&!G.endsWith("/v1"))G+="/v1";let J=bL({apiKey:X||"not-needed",name:Z,...G?{baseURL:G}:{},...Y?{headers:Y}:{}});return zw0($,Object.assign(J,{languageModel:(...W)=>J.chat(...W)}))}default:throw Error(`decopilot: unsupported modelSource.providerId '${Z}'. Supported: anthropic, google, openrouter, deco, openai-compatible, llmapi.`)}}var tn0=B(()=>{Gh0();Fc0();O50();h_0();Oc0()});function Aw0(){let $=[],Z=!1,X=null,Q=()=>{let J=X;X=null,J?.()},Y=(J)=>{if(Z)return;$.push(J),Q()},G=async function*(){try{while(!Z||$.length>0){let J=$.shift();if(J){yield J;continue}await new Promise((W)=>{X=W})}}finally{Z=!0,Q()}}();return{writer:{write:(J)=>Y(J),merge:async(J)=>{let W=J;if(typeof W[Symbol.asyncIterator]==="function"){for await(let H of W)Y(H);return}let K=J.getReader();try{while(!0){let{value:H,done:N}=await K.read();if(N)return;Y(H)}}finally{K.releaseLock()}},onError:()=>{}},stream:G,close:()=>{Z=!0,Q()}}}import{z as on0}from"zod";function zJ$($,Z,X){return _$({description:`Enable tools from the current agent's catalog so they can be called in subsequent steps. Pass tool names exactly as listed in <available-connections>.
@@ -1508,7 +1508,7 @@ Guidelines:
             }
             return { consoleLogs, errors, evaluateResult };
           }
-        `,O=await fetch(`${vV}/function?token=${encodeURIComponent(H)}`,{method:"POST",headers:{"Content-Type":"application/javascript"},body:w});if(!O.ok){let j=await O.text().catch(()=>"Unknown error");return{success:!1,error:`Browserless function call failed (${O.status}): ${j}`,url:N.url}}let D=await O.json().catch(async()=>{return{error:`Browserless returned non-JSON response: ${(await O.text().catch(()=>"")).slice(0,200)}`}}),L=JSON.stringify(D,null,2);X.set(W.toolCallId,L);let E=s7(L);if(!("error"in D)&&E>XO&&Q){let j=`inspect-pages/${crypto.randomUUID()}.json`;return await Q.put(j,new TextEncoder().encode(L),{contentType:"application/json"}),{success:!0,uri:G7(j),preview:uX(L),url:N.url,tokenCount:E,consoleLogCount:D.consoleLogs?.length??0,errorCount:D.errors?.length??0,hasEvaluateResult:D.evaluateResult!=null}}return{success:!("error"in D),...D,url:N.url,tokenCount:E}}finally{$.write({type:"data-tool-metadata",id:W.toolCallId,data:{latencyMs:performance.now()-K}})}}})}function AW$($){let{writer:Z,toolOutputMap:X,objectStorage:Q,pendingImages:Y,imageTool:G}=$,J={user_ask:Cw0,todo_write:_w0,propose_plan:bw0,read_tool_output:kw0({toolOutputMap:X})};if(G)J.generate_image=Ep("generate_image",Lp,yw0(Z,{...G,objectStorage:Q}),null);if(process.env.BROWSERLESS_TOKEN){if(J.scrape_url=PW$(Z,{toolOutputMap:X,objectStorage:Q,kind:"scrape"}),J.inspect_page=PW$(Z,{toolOutputMap:X,objectStorage:Q,kind:"inspect"}),Y)J.take_screenshot=gw0(Z,{objectStorage:Q,toolOutputMap:X,pendingImages:Y})}return J}var TW$=B(()=>{S4();Ep0();jp0();zp0();TN();_V();Xy();Tp0()});function kp0($,Z=Date.now()){let X=new Date($.updated_at).getTime(),Q=$.last_progress_at?new Date($.last_progress_at).getTime():Number.NaN,Y=Math.max(Number.isFinite(X)?X:Number.NEGATIVE_INFINITY,Number.isFinite(Q)?Q:Number.NEGATIVE_INFINITY);return!Number.isFinite(Y)||Z-Y>1800000}function xG($,Z=Date.now()){let X=$.status;if(X==="in_progress"&&kp0($,Z))X="expired";return{id:$.id,organization_id:$.organization_id,title:$.title,description:$.description,created_at:$.created_at,updated_at:$.updated_at,created_by:$.created_by,updated_by:$.updated_by,hidden:$.hidden??!1,status:X,virtual_mcp_id:$.virtual_mcp_id||void 0,trigger_id:$.trigger_id,branch:$.branch,sandbox_provider_kind:$.sandbox_provider_kind,harness_id:$.harness_id,metadata:$.metadata&&Object.keys($.metadata).length>0?$.metadata:void 0,run_config:$.run_config}}var RW$=1800000;var Sp0;var IW$=B(()=>{Sp0=["in_progress","requires_action","failed","completed"]});import{z as T$}from"zod";var qW$,fK4,MW$,HK,kW$,SW$;var fV=B(()=>{IW$();qW$=T$.object({id:T$.string().describe("Unique message ID"),thread_id:T$.string().describe("ID of the parent thread"),metadata:T$.unknown().optional().describe("Optional message metadata"),parts:T$.array(T$.record(T$.string(),T$.unknown())).describe("Message content parts (AI SDK UIMessagePart format)"),role:T$.enum(["user","assistant","system"]).describe("Message role"),created_at:T$.string().datetime().describe("Timestamp of creation"),updated_at:T$.string().datetime().describe("Timestamp of last update")}),fK4=T$.object({toolName:T$.string().describe("Fully qualified tool name"),appId:T$.string().describe("App ID that owns the tool"),args:T$.record(T$.string(),T$.unknown()).describe("Arguments used when expanding the tool"),expandedAt:T$.string().datetime().describe("When the tool was expanded")}),MW$=T$.object({expanded_tools:T$.array(fK4).optional(),read_only:T$.boolean().optional().describe("The thread takes no further input (an autonomous run the user cannot continue)")}).catchall(T$.unknown()),HK=T$.object({id:T$.string().describe("Unique thread ID"),organization_id:T$.string().describe("Organization this thread belongs to"),title:T$.string().describe("Thread title"),description:T$.string().nullable().describe("Thread description"),created_at:T$.string().datetime().describe("Timestamp of creation"),updated_at:T$.string().datetime().describe("Timestamp of last update"),hidden:T$.boolean().optional().describe("Whether the thread is hidden"),status:T$.enum([...Sp0,"expired"]).describe("Thread execution status. 'expired' is virtual -- computed at read time for stale in_progress threads"),created_by:T$.string().describe("User ID who created the thread"),updated_by:T$.string().optional().describe("User ID who last updated the thread"),virtual_mcp_id:T$.string().optional().describe("Virtual MCP (agent) this thread was initiated with"),trigger_id:T$.string().nullable().optional().describe("Automation trigger that created this thread; null/absent for human-initiated threads."),branch:T$.string().nullable().optional().describe("Git branch this thread is pinned to (GitHub-linked vms only)"),sandbox_provider_kind:T$.string().nullable().optional().describe("Pinned on first message; identifies which sandbox provider to dispatch to (e.g. 'agent-sandbox', 'user-desktop')."),harness_id:T$.string().nullable().optional().describe("Pinned on first message; selects which harness runs the thread (e.g. 'claude-code', 'codex', 'decopilot')."),metadata:MW$.optional().describe("Free-form per-thread UI state (e.g. expanded_tools)"),run_config:T$.record(T$.string(),T$.unknown()).nullable().optional().describe("Persisted run configuration (contains agent and model info)")}),kW$=T$.object({id:T$.string().optional().describe("Optional custom ID for the thread"),title:T$.string().optional().describe("Thread title"),description:T$.string().nullish().describe("Thread description"),virtual_mcp_id:T$.string().describe("Virtual MCP (agent) this thread is bound to"),branch:T$.string().min(1).optional().describe("Preferred branch. Used only when the vMCP has a githubRepo; ignored otherwise. When omitted, the server picks the most-recently-touched branch from the user's sandboxMap, falling back to a freshly generated name.")}),SW$=T$.object({title:T$.string().optional().describe("New thread title"),description:T$.string().nullish().describe("New thread description"),hidden:T$.boolean().optional().describe("Whether the thread is hidden"),status:T$.enum(Sp0).optional().describe("New thread status (user-set override). 'expired' is a computed virtual status and cannot be set directly."),metadata:MW$.optional().describe("Full replacement of the thread's metadata object"),branch:T$.string().min(1).nullish().describe("New git branch for this thread"),virtual_mcp_id:T$.string().optional().describe("Re-point the thread at a different agent. Only meaningful for an unsent thread (changing the recipient of a new chat); the UI restricts it accordingly.")})});import{z as SY}from"zod";var xK4,yK4,xV;var Vp0=B(()=>{kG();b0();fV();xK4=Q3.extend({where:SY.object({created_by:SY.string().optional(),trigger_ids:SY.array(SY.string()).optional(),virtual_mcp_id:SY.string().optional(),hidden:SY.boolean().optional(),has_trigger:SY.boolean().optional()}).optional(),startDate:SY.string().datetime().optional().describe("Filter threads updated at or after this ISO timestamp"),endDate:SY.string().datetime().optional().describe("Filter threads updated at or before this ISO timestamp"),search:SY.string().optional().describe("Full-text search on thread title (case-insensitive)"),status:SY.string().optional().describe("Filter by thread status (e.g. completed, failed, in_progress)"),userId:SY.string().optional().describe("Filter by the user who created the thread"),agentId:SY.string().optional().describe("Filter by agent (connection or virtual MCP) ID")}),yK4=QN(HK),xV=d({name:"COLLECTION_THREADS_LIST",description:"List threads with filtering, sorting, and pagination.",annotations:{title:"List Threads",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:xK4,outputSchema:yK4,handler:async($,Z)=>{await Z.access.check();let X=Z.auth.user?.id;if(!X)throw Error("User ID required to list threads");r(Z);let Q=$.offset??0,Y=$.limit??100,G=$.where?.trigger_ids,J=$.where?.virtual_mcp_id,W=$.userId??($.where?.created_by==="me"?X:$.where?.created_by),{threads:K,total:H}=G?.length?await Z.storage.threads.listByTriggerIds(G,{limit:Y,offset:Q}):await Z.storage.threads.list(W,{limit:Y,offset:Q,virtualMcpId:J,startDate:$.startDate,endDate:$.endDate,search:$.search,status:$.status,agentId:$.agentId,includeArchived:$.where?.hidden,hasTrigger:$.where?.has_trigger}),N=Q+Y<H,F=Date.now();return{items:K.map((U)=>xG(U,F)),totalCount:H,hasMore:N}}})});var gK4,yV;var Cp0=B(()=>{kG();b0();fV();gK4=pi(HK),yV=d({name:"COLLECTION_THREADS_GET",description:"Get a thread's details and metadata by ID.",annotations:{title:"Get Thread",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:ni,outputSchema:gK4,handler:async($,Z)=>{$0(Z),r(Z),await Z.access.check();let X=await Z.storage.threads.get($.id);if(!X)return{item:null};return{item:xG(X)}}})});import{z as hK4}from"zod";function VW$($){if(!$)return null;if("field"in $&&$.field[0]==="thread_id"&&$.operator==="eq")return String($.value);if("conditions"in $&&($.operator==="and"||$.operator==="or"))for(let Z of $.conditions){let X=VW$(Z);if(X)return X}return null}var uK4,cK4,gV;var _p0=B(()=>{kG();b0();fV();uK4=Q3.extend({thread_id:hK4.string().optional().describe("ID of the thread to list messages for (required)")}),cK4=QN(qW$),gV=d({name:"COLLECTION_THREAD_MESSAGES_LIST",description:"List messages in a thread with pagination. Requires thread_id. Returns messages in chronological order.",annotations:{title:"List Thread Messages",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:uK4,outputSchema:cK4,handler:async($,Z)=>{r(Z),await Z.access.check();let X=$.thread_id??VW$($.where);if(!X)throw Error("thread_id is required (provide as top-level param or in where clause)");let Q=$.offset??0,Y=$.limit??100,G=$.orderBy?.[0]?.direction??"asc",J=await Z.storage.threads.get(X);if(!J)return{items:[],totalCount:0,hasMore:!1};if(J.message_storage_version===2){let{messages:N,total:F}=await Z.storage.threads.messageParts().loadWindow(X,{limit:Y,offset:Q,includeInFlight:!0});return{items:N.map((U)=>({id:U.id,thread_id:X,role:U.role,parts:U.parts,metadata:U.metadata??null,created_at:U.created_at,updated_at:U.created_at})),totalCount:F,hasMore:Q+Y<F}}let{messages:W,total:K}=await Z.storage.threads.listMessages(X,{limit:Y,offset:Q,sort:G}),H=Q+Y<K;return{items:W,totalCount:K,hasMore:H}}})});function CW$($){return{search_threads:_$({description:xV.description,inputSchema:s(xV.inputSchema),execute:(Z)=>xV.execute(Z,$)}),get_thread:_$({description:yV.description,inputSchema:s(yV.inputSchema),execute:(Z)=>yV.execute(Z,$)}),list_thread_messages:_$({description:gV.description,inputSchema:s(gV.inputSchema),execute:(Z)=>gV.execute(Z,$)})}}var _W$=B(()=>{S4();Vp0();Cp0();_p0()});async function dK4($,Z,X){let{provider:Q,imageProvider:Y,webSearchProvider:G,deepResearchProvider:J,organization:W,models:K,toolApprovalLevel:H="auto",isPlanMode:N=!1,toolOutputMap:F,pendingImages:U,passthroughClient:w,vmContext:O,htmlArtifactBuffer:D,taskId:L,agentId:E,onChildUsage:j,backgroundDispatcher:z}=Z,A={isPlanMode:N},P=X.auth?.user?.id,M=AW$({writer:$,toolOutputMap:F,passthroughClient:w,toolApprovalLevel:H,isPlanMode:N,objectStorage:X.objectStorage});if(P)M.update_interests=s3$({write:async(_)=>{await X.storage.interests.setForAgent(_.orgId,_.agentId,_.userId,{interests:_.interests})},orgId:W.id,agentId:E,userId:P});Object.assign(M,CW$(X));let k=wp(H,!1,A)!==!1,q;if(O){let _=await tx(X,{virtualMcpId:O.virtualMcpId,branch:O.branch,userId:O.userId,syncTools:O.syncTools}),h=r3$(_);q=t3$({fs:h.fs,htmlArtifactBuffer:D,toolOutputMap:F,needsApproval:k,pendingImages:U,ctx:X,threadId:O.threadId,virtualMcpId:O.virtualMcpId}),Object.assign(M,q);let b=await QJ$({ctx:X,orgId:W.id,virtualMcpId:O.virtualMcpId,userId:O.userId,threadId:O.threadId,writer:$,rebindFs:async(x)=>{h.swap(await tx(X,{virtualMcpId:O.virtualMcpId,branch:x,userId:O.userId,syncTools:O.syncTools}))}});if(b)M.load_repo=b}if(Q)M.subtask=Ep("subtask",bp0,fp0($,{provider:Q,organization:W,models:K,self:{id:E},currentThreadId:L,needsApproval:wp(H,!1,A)!==!1,onChildUsage:j,vmTools:q,parentBuiltInParams:Z},X),z,(_)=>WW$(L,_));if(Y&&K.image&&X.objectStorage)M.generate_image=Ep("generate_image",Lp,YW$($,{provider:Y,imageModelInfo:K.image,objectStorage:X.objectStorage,allowHttpExternalUrls:c0().localMode}),z);if(G&&K.webSearch){let _=Mp0({provider:G,modelInfo:K.webSearch,ctx:X,mode:"quick",toolName:"web_search"});M.web_search=qp0($,{researchJob:_,toolOutputMap:F,taskId:L})}if(J&&K.deepResearch){let _=Mp0({provider:J,modelInfo:K.deepResearch,ctx:X,mode:"deep",toolName:"deep_research"});M.deep_research=qp0($,{researchJob:_,toolOutputMap:F,taskId:L,description:"Run in-depth, multi-source research and synthesize a comprehensive, cited report. Use this when the user needs thorough analysis, a literature/market review, or a question that warrants exploring many "+"sources \u2014 accuracy and depth matter more than latency. For quick "+"lookups or fact-checks, use `web_search` instead."})}if(process.env.BROWSERLESS_TOKEN){let _={baseUrl:vV,token:process.env.BROWSERLESS_TOKEN};if(M.take_screenshot=wW$($,{objectStorage:X.objectStorage,toolOutputMap:F,pendingImages:U}),X.objectStorage)M.scrape_url=DW$($,{browserless:_,objectStorage:X.objectStorage,toolOutputMap:F}),M.inspect_page=jW$($,{browserless:_,objectStorage:X.objectStorage,toolOutputMap:F})}return M}function mK4($,Z,X){let Q=Z.organization.id,Y=X.auth?.user?.id,G={};for(let[J,W]of Object.entries($)){let K=W,H=K.execute;if(typeof H!=="function"){G[J]=W;continue}let N=lK4[J],F=H.constructor?.name==="AsyncGeneratorFunction",U=(O,D)=>{if(!Q||!Y)return;y1.capture({distinctId:Y,event:"tool_called",groups:{organization:Q},properties:{organization_id:Q,tool_source:"builtin",tool_name:J,tool_safe_name:J,read_only:N?.readOnly??null,destructive:N?.destructive??null,idempotent:null,open_world:null,latency_ms:Math.round(O),is_error:D}})},w=F?async function*(O,D){let L=performance.now(),E=!1;try{yield*H.call(K,O,D)}catch(j){throw E=!0,j}finally{U(performance.now()-L,E)}}:async(O,D)=>{let L=performance.now(),E=!1;try{return await H.call(K,O,D)}catch(j){throw E=!0,j}finally{U(performance.now()-L,E)}};G[J]={...K,execute:w}}return G}async function uw0($,Z,X){let Q=await dK4($,Z,X),Y=mK4(Q,Z,X);if(!Z.isPlanMode){let{propose_plan:G,...J}=Y;return J}return Y}function vW$($){let{ctx:Z,writer:X,toolOutputMap:Q,subtaskParams:Y,planMode:G}=$,J={user_ask:Cw0,todo_write:_w0,read_tool_output:kw0({toolOutputMap:Q})};if(G)J.propose_plan=bw0;if(Y.provider)J.subtask=fp0(X,Y,Z);return J}var lK4;var vp0=B(()=>{E6();Op();TN();o3$();ww0();Ow0();xp0();Ep0();jp0();e3$();zp0();GW$();Tp0();Ip0();Xy();HW$();UW$();OW$();LW$();zW$();TW$();_W$();S$();lK4={read_tool_output:{readOnly:!0,destructive:!1},read_resource:{readOnly:!0,destructive:!1},read_prompt:{readOnly:!0,destructive:!1},web_search:{readOnly:!0,destructive:!1},deep_research:{readOnly:!0,destructive:!1},generate_image:{readOnly:!1,destructive:!1},open_in_agent:{readOnly:!1,destructive:!1},subtask:{readOnly:!1,destructive:!1},user_ask:{readOnly:!0,destructive:!1},propose_plan:{readOnly:!0,destructive:!1},enable_tool:{readOnly:!0,destructive:!1},todo_write:{readOnly:!1,destructive:!1},update_interests:{readOnly:!1,destructive:!1},load_repo:{readOnly:!1,destructive:!0},search_threads:{readOnly:!0,destructive:!1},get_thread:{readOnly:!0,destructive:!1},list_thread_messages:{readOnly:!0,destructive:!1}}});async function bW$($){let Z=$.toolOutputMap??new Map,{tools:X,nameMap:Q}=await Vw0($.mcpClient,Z,$.writer,$.toolApprovalLevel,{disableOutputTruncation:!1,isPlanMode:$.planMode,timeoutMs:Mw0,resolveArgs:$.resolveArgs,onToolCalled:$.onToolCalled,onPrOpened:$.onPrOpened}),Y=$.fullBuiltInParams?await uw0($.writer,{...$.fullBuiltInParams,toolOutputMap:Z},$.ctx):vW$({ctx:$.ctx,writer:$.writer,toolOutputMap:Z,subtaskParams:$.subtaskParams,planMode:$.planMode}),G=$.kind==="subagent"?Object.fromEntries(Object.entries(Y).filter(([W])=>!iK4.includes(W))):Y;return{tools:{...X,...G},toolOutputMap:Z,nameMap:Q}}var iK4;var fW$=B(()=>{Op();vp0();iK4=["subtask","user_ask","propose_plan"]});var lw0={};H4(lw0,{waitForSeed:()=>ZH4,seedLocalMode:()=>sK4,pruneUndecryptableJwks:()=>gW$,markSeedComplete:()=>$H4,isLocalMode:()=>NK,healLocalJwks:()=>oK4,getLocalAdminUser:()=>yp0,getLocalAdminPassword:()=>cw0});import{symmetricDecrypt as nK4}from"better-auth/crypto";import{sql as xW$}from"kysely";import{userInfo as pK4}from"os";async function oK4(){let $=c0();if(!$.localMode)return 0;if(!$.betterAuthSecret)return 0;return gW$(c8().db,$.betterAuthSecret)}async function gW$($,Z){let X;try{X=(await xW$`
+        `,O=await fetch(`${vV}/function?token=${encodeURIComponent(H)}`,{method:"POST",headers:{"Content-Type":"application/javascript"},body:w});if(!O.ok){let j=await O.text().catch(()=>"Unknown error");return{success:!1,error:`Browserless function call failed (${O.status}): ${j}`,url:N.url}}let D=await O.json().catch(async()=>{return{error:`Browserless returned non-JSON response: ${(await O.text().catch(()=>"")).slice(0,200)}`}}),L=JSON.stringify(D,null,2);X.set(W.toolCallId,L);let E=s7(L);if(!("error"in D)&&E>XO&&Q){let j=`inspect-pages/${crypto.randomUUID()}.json`;return await Q.put(j,new TextEncoder().encode(L),{contentType:"application/json"}),{success:!0,uri:G7(j),preview:uX(L),url:N.url,tokenCount:E,consoleLogCount:D.consoleLogs?.length??0,errorCount:D.errors?.length??0,hasEvaluateResult:D.evaluateResult!=null}}return{success:!("error"in D),...D,url:N.url,tokenCount:E}}finally{$.write({type:"data-tool-metadata",id:W.toolCallId,data:{latencyMs:performance.now()-K}})}}})}function AW$($){let{writer:Z,toolOutputMap:X,objectStorage:Q,pendingImages:Y,imageTool:G}=$,J={user_ask:Cw0,todo_write:_w0,propose_plan:bw0,read_tool_output:kw0({toolOutputMap:X})};if(G)J.generate_image=Ep("generate_image",Lp,yw0(Z,{...G,objectStorage:Q}),null);if(process.env.BROWSERLESS_TOKEN){if(J.scrape_url=PW$(Z,{toolOutputMap:X,objectStorage:Q,kind:"scrape"}),J.inspect_page=PW$(Z,{toolOutputMap:X,objectStorage:Q,kind:"inspect"}),Y)J.take_screenshot=gw0(Z,{objectStorage:Q,toolOutputMap:X,pendingImages:Y})}return J}var TW$=B(()=>{S4();Ep0();jp0();zp0();TN();_V();Xy();Tp0()});function kp0($,Z=Date.now()){let X=new Date($.updated_at).getTime(),Q=$.last_progress_at?new Date($.last_progress_at).getTime():Number.NaN,Y=Math.max(Number.isFinite(X)?X:Number.NEGATIVE_INFINITY,Number.isFinite(Q)?Q:Number.NEGATIVE_INFINITY);return!Number.isFinite(Y)||Z-Y>1800000}function xG($,Z=Date.now()){let X=$.status;if(X==="in_progress"&&kp0($,Z))X="expired";return{id:$.id,organization_id:$.organization_id,title:$.title,description:$.description,created_at:$.created_at,updated_at:$.updated_at,created_by:$.created_by,updated_by:$.updated_by,hidden:$.hidden??!1,status:X,virtual_mcp_id:$.virtual_mcp_id||void 0,trigger_id:$.trigger_id,branch:$.branch,sandbox_provider_kind:$.sandbox_provider_kind,harness_id:$.harness_id,metadata:$.metadata&&Object.keys($.metadata).length>0?$.metadata:void 0,run_config:$.run_config}}var RW$=1800000;var Sp0;var IW$=B(()=>{Sp0=["in_progress","requires_action","failed","completed"]});import{z as T$}from"zod";var qW$,fK4,MW$,HK,kW$,SW$;var fV=B(()=>{IW$();qW$=T$.object({id:T$.string().describe("Unique message ID"),thread_id:T$.string().describe("ID of the parent thread"),metadata:T$.unknown().optional().describe("Optional message metadata"),parts:T$.array(T$.record(T$.string(),T$.unknown())).describe("Message content parts (AI SDK UIMessagePart format)"),role:T$.enum(["user","assistant","system"]).describe("Message role"),created_at:T$.string().datetime().describe("Timestamp of creation"),updated_at:T$.string().datetime().describe("Timestamp of last update")}),fK4=T$.object({toolName:T$.string().describe("Fully qualified tool name"),appId:T$.string().describe("App ID that owns the tool"),args:T$.record(T$.string(),T$.unknown()).describe("Arguments used when expanding the tool"),expandedAt:T$.string().datetime().describe("When the tool was expanded")}),MW$=T$.object({expanded_tools:T$.array(fK4).optional(),read_only:T$.boolean().optional().describe("The thread takes no further input (an autonomous run the user cannot continue)")}).catchall(T$.unknown()),HK=T$.object({id:T$.string().describe("Unique thread ID"),organization_id:T$.string().describe("Organization this thread belongs to"),title:T$.string().describe("Thread title"),description:T$.string().nullable().describe("Thread description"),created_at:T$.string().datetime().describe("Timestamp of creation"),updated_at:T$.string().datetime().describe("Timestamp of last update"),hidden:T$.boolean().optional().describe("Whether the thread is hidden"),status:T$.enum([...Sp0,"expired"]).describe("Thread execution status. 'expired' is virtual -- computed at read time for stale in_progress threads"),created_by:T$.string().describe("User ID who created the thread"),updated_by:T$.string().optional().describe("User ID who last updated the thread"),virtual_mcp_id:T$.string().optional().describe("Virtual MCP (agent) this thread was initiated with"),trigger_id:T$.string().nullable().optional().describe("Automation trigger that created this thread; null/absent for human-initiated threads."),branch:T$.string().nullable().optional().describe("Git branch this thread is pinned to (GitHub-linked vms only)"),sandbox_provider_kind:T$.string().nullable().optional().describe("Pinned on first message; identifies which sandbox provider to dispatch to (e.g. 'agent-sandbox', 'user-desktop')."),harness_id:T$.string().nullable().optional().describe("Pinned on first message; selects which harness runs the thread (e.g. 'claude-code', 'codex', 'decopilot')."),metadata:MW$.optional().describe("Free-form per-thread UI state (e.g. expanded_tools)"),run_config:T$.record(T$.string(),T$.unknown()).nullable().optional().describe("Persisted run configuration (contains agent and model info)")}),kW$=T$.object({id:T$.string().optional().describe("Optional custom ID for the thread"),title:T$.string().optional().describe("Thread title"),description:T$.string().nullish().describe("Thread description"),virtual_mcp_id:T$.string().describe("Virtual MCP (agent) this thread is bound to"),branch:T$.string().min(1).optional().describe("Preferred branch. Used only when the vMCP has a githubRepo; ignored otherwise. When omitted, the server picks the most-recently-touched branch from the user's sandboxMap, falling back to a freshly generated name.")}),SW$=T$.object({title:T$.string().optional().describe("New thread title"),description:T$.string().nullish().describe("New thread description"),hidden:T$.boolean().optional().describe("Whether the thread is hidden"),status:T$.enum(Sp0).optional().describe("New thread status (user-set override). 'expired' is a computed virtual status and cannot be set directly."),metadata:MW$.optional().describe("Full replacement of the thread's metadata object"),branch:T$.string().min(1).nullish().describe("New git branch for this thread"),virtual_mcp_id:T$.string().optional().describe("Re-point the thread at a different agent. Only meaningful for an unsent thread (changing the recipient of a new chat); the UI restricts it accordingly.")})});import{z as SY}from"zod";var xK4,yK4,xV;var Vp0=B(()=>{kG();b0();fV();xK4=Q3.extend({where:SY.object({created_by:SY.string().optional(),trigger_ids:SY.array(SY.string()).optional(),virtual_mcp_id:SY.string().optional(),hidden:SY.boolean().optional(),has_trigger:SY.boolean().optional()}).optional(),startDate:SY.string().datetime().optional().describe("Filter threads updated at or after this ISO timestamp"),endDate:SY.string().datetime().optional().describe("Filter threads updated at or before this ISO timestamp"),search:SY.string().optional().describe("Full-text search on thread title (case-insensitive)"),status:SY.string().optional().describe("Filter by thread status (e.g. completed, failed, in_progress)"),userId:SY.string().optional().describe("Filter by the user who created the thread"),agentId:SY.string().optional().describe("Filter by agent (connection or virtual MCP) ID")}),yK4=QN(HK),xV=d({name:"COLLECTION_THREADS_LIST",description:"List threads with filtering, sorting, and pagination.",annotations:{title:"List Threads",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:xK4,outputSchema:yK4,handler:async($,Z)=>{await Z.access.check();let X=Z.auth.user?.id;if(!X)throw Error("User ID required to list threads");r(Z);let Q=$.offset??0,Y=$.limit??100,G=$.where?.trigger_ids,J=$.where?.virtual_mcp_id,W=$.userId??($.where?.created_by==="me"?X:$.where?.created_by),{threads:K,total:H}=G?.length?await Z.storage.threads.listByTriggerIds(G,{limit:Y,offset:Q}):await Z.storage.threads.list(W,{limit:Y,offset:Q,virtualMcpId:J,startDate:$.startDate,endDate:$.endDate,search:$.search,status:$.status,agentId:$.agentId,includeArchived:$.where?.hidden,hasTrigger:$.where?.has_trigger}),N=Q+Y<H,F=Date.now();return{items:K.map((U)=>xG(U,F)),totalCount:H,hasMore:N}}})});var gK4,yV;var Cp0=B(()=>{kG();b0();fV();gK4=pi(HK),yV=d({name:"COLLECTION_THREADS_GET",description:"Get a thread's details and metadata by ID.",annotations:{title:"Get Thread",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:ni,outputSchema:gK4,handler:async($,Z)=>{$0(Z),r(Z),await Z.access.check();let X=await Z.storage.threads.get($.id);if(!X)return{item:null};return{item:xG(X)}}})});import{z as hK4}from"zod";function VW$($){if(!$)return null;if("field"in $&&$.field[0]==="thread_id"&&$.operator==="eq")return String($.value);if("conditions"in $&&($.operator==="and"||$.operator==="or"))for(let Z of $.conditions){let X=VW$(Z);if(X)return X}return null}var uK4,cK4,gV;var _p0=B(()=>{kG();b0();fV();uK4=Q3.extend({thread_id:hK4.string().optional().describe("ID of the thread to list messages for (required)")}),cK4=QN(qW$),gV=d({name:"COLLECTION_THREAD_MESSAGES_LIST",description:"List messages in a thread with pagination. Requires thread_id. Returns messages in chronological order.",annotations:{title:"List Thread Messages",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:uK4,outputSchema:cK4,handler:async($,Z)=>{r(Z),await Z.access.check();let X=$.thread_id??VW$($.where);if(!X)throw Error("thread_id is required (provide as top-level param or in where clause)");let Q=$.offset??0,Y=$.limit??100,G=$.orderBy?.[0]?.direction??"asc",J=await Z.storage.threads.get(X);if(!J)return{items:[],totalCount:0,hasMore:!1};if(J.message_storage_version===2){let{messages:N,total:F}=await Z.storage.threads.messageParts().loadWindow(X,{limit:Y,offset:Q,includeInFlight:!0});return{items:N.map((U)=>({id:U.id,thread_id:X,role:U.role,parts:U.parts,metadata:U.metadata??null,created_at:U.created_at,updated_at:U.created_at})),totalCount:F,hasMore:Q+Y<F}}let{messages:W,total:K}=await Z.storage.threads.listMessages(X,{limit:Y,offset:Q,sort:G}),H=Q+Y<K;return{items:W,totalCount:K,hasMore:H}}})});function CW$($){return{search_threads:_$({description:xV.description,inputSchema:s(xV.inputSchema),execute:(Z)=>xV.execute(Z,$)}),get_thread:_$({description:yV.description,inputSchema:s(yV.inputSchema),execute:(Z)=>yV.execute(Z,$)}),list_thread_messages:_$({description:gV.description,inputSchema:s(gV.inputSchema),execute:(Z)=>gV.execute(Z,$)})}}var _W$=B(()=>{S4();Vp0();Cp0();_p0()});async function dK4($,Z,X){let{provider:Q,imageProvider:Y,webSearchProvider:G,deepResearchProvider:J,organization:W,models:K,toolApprovalLevel:H="auto",isPlanMode:N=!1,toolOutputMap:F,pendingImages:U,passthroughClient:w,vmContext:O,htmlArtifactBuffer:D,taskId:L,agentId:E,onChildUsage:j,backgroundDispatcher:z}=Z,A={isPlanMode:N},P=X.auth?.user?.id,M=AW$({writer:$,toolOutputMap:F,passthroughClient:w,toolApprovalLevel:H,isPlanMode:N,objectStorage:X.objectStorage});if(P)M.update_interests=s3$({write:async(_)=>{await X.storage.interests.setForAgent(_.orgId,_.agentId,_.userId,{interests:_.interests})},orgId:W.id,agentId:E,userId:P});Object.assign(M,CW$(X));let k=wp(H,!1,A)!==!1,q;if(O){let _=await tx(X,{virtualMcpId:O.virtualMcpId,branch:O.branch,userId:O.userId,syncTools:O.syncTools,threadId:O.threadId}),h=r3$(_);q=t3$({fs:h.fs,htmlArtifactBuffer:D,toolOutputMap:F,needsApproval:k,pendingImages:U,ctx:X,threadId:O.threadId,virtualMcpId:O.virtualMcpId}),Object.assign(M,q);let b=await QJ$({ctx:X,orgId:W.id,virtualMcpId:O.virtualMcpId,userId:O.userId,threadId:O.threadId,writer:$,rebindFs:async(x)=>{h.swap(await tx(X,{virtualMcpId:O.virtualMcpId,branch:x,userId:O.userId,syncTools:O.syncTools,threadId:O.threadId}))}});if(b)M.load_repo=b}if(Q)M.subtask=Ep("subtask",bp0,fp0($,{provider:Q,organization:W,models:K,self:{id:E},currentThreadId:L,needsApproval:wp(H,!1,A)!==!1,onChildUsage:j,vmTools:q,parentBuiltInParams:Z},X),z,(_)=>WW$(L,_));if(Y&&K.image&&X.objectStorage)M.generate_image=Ep("generate_image",Lp,YW$($,{provider:Y,imageModelInfo:K.image,objectStorage:X.objectStorage,allowHttpExternalUrls:c0().localMode}),z);if(G&&K.webSearch){let _=Mp0({provider:G,modelInfo:K.webSearch,ctx:X,mode:"quick",toolName:"web_search"});M.web_search=qp0($,{researchJob:_,toolOutputMap:F,taskId:L})}if(J&&K.deepResearch){let _=Mp0({provider:J,modelInfo:K.deepResearch,ctx:X,mode:"deep",toolName:"deep_research"});M.deep_research=qp0($,{researchJob:_,toolOutputMap:F,taskId:L,description:"Run in-depth, multi-source research and synthesize a comprehensive, cited report. Use this when the user needs thorough analysis, a literature/market review, or a question that warrants exploring many "+"sources \u2014 accuracy and depth matter more than latency. For quick "+"lookups or fact-checks, use `web_search` instead."})}if(process.env.BROWSERLESS_TOKEN){let _={baseUrl:vV,token:process.env.BROWSERLESS_TOKEN};if(M.take_screenshot=wW$($,{objectStorage:X.objectStorage,toolOutputMap:F,pendingImages:U}),X.objectStorage)M.scrape_url=DW$($,{browserless:_,objectStorage:X.objectStorage,toolOutputMap:F}),M.inspect_page=jW$($,{browserless:_,objectStorage:X.objectStorage,toolOutputMap:F})}return M}function mK4($,Z,X){let Q=Z.organization.id,Y=X.auth?.user?.id,G={};for(let[J,W]of Object.entries($)){let K=W,H=K.execute;if(typeof H!=="function"){G[J]=W;continue}let N=lK4[J],F=H.constructor?.name==="AsyncGeneratorFunction",U=(O,D)=>{if(!Q||!Y)return;y1.capture({distinctId:Y,event:"tool_called",groups:{organization:Q},properties:{organization_id:Q,tool_source:"builtin",tool_name:J,tool_safe_name:J,read_only:N?.readOnly??null,destructive:N?.destructive??null,idempotent:null,open_world:null,latency_ms:Math.round(O),is_error:D}})},w=F?async function*(O,D){let L=performance.now(),E=!1;try{yield*H.call(K,O,D)}catch(j){throw E=!0,j}finally{U(performance.now()-L,E)}}:async(O,D)=>{let L=performance.now(),E=!1;try{return await H.call(K,O,D)}catch(j){throw E=!0,j}finally{U(performance.now()-L,E)}};G[J]={...K,execute:w}}return G}async function uw0($,Z,X){let Q=await dK4($,Z,X),Y=mK4(Q,Z,X);if(!Z.isPlanMode){let{propose_plan:G,...J}=Y;return J}return Y}function vW$($){let{ctx:Z,writer:X,toolOutputMap:Q,subtaskParams:Y,planMode:G}=$,J={user_ask:Cw0,todo_write:_w0,read_tool_output:kw0({toolOutputMap:Q})};if(G)J.propose_plan=bw0;if(Y.provider)J.subtask=fp0(X,Y,Z);return J}var lK4;var vp0=B(()=>{E6();Op();TN();o3$();ww0();Ow0();xp0();Ep0();jp0();e3$();zp0();GW$();Tp0();Ip0();Xy();HW$();UW$();OW$();LW$();zW$();TW$();_W$();S$();lK4={read_tool_output:{readOnly:!0,destructive:!1},read_resource:{readOnly:!0,destructive:!1},read_prompt:{readOnly:!0,destructive:!1},web_search:{readOnly:!0,destructive:!1},deep_research:{readOnly:!0,destructive:!1},generate_image:{readOnly:!1,destructive:!1},open_in_agent:{readOnly:!1,destructive:!1},subtask:{readOnly:!1,destructive:!1},user_ask:{readOnly:!0,destructive:!1},propose_plan:{readOnly:!0,destructive:!1},enable_tool:{readOnly:!0,destructive:!1},todo_write:{readOnly:!1,destructive:!1},update_interests:{readOnly:!1,destructive:!1},load_repo:{readOnly:!1,destructive:!0},search_threads:{readOnly:!0,destructive:!1},get_thread:{readOnly:!0,destructive:!1},list_thread_messages:{readOnly:!0,destructive:!1}}});async function bW$($){let Z=$.toolOutputMap??new Map,{tools:X,nameMap:Q}=await Vw0($.mcpClient,Z,$.writer,$.toolApprovalLevel,{disableOutputTruncation:!1,isPlanMode:$.planMode,timeoutMs:Mw0,resolveArgs:$.resolveArgs,onToolCalled:$.onToolCalled,onPrOpened:$.onPrOpened}),Y=$.fullBuiltInParams?await uw0($.writer,{...$.fullBuiltInParams,toolOutputMap:Z},$.ctx):vW$({ctx:$.ctx,writer:$.writer,toolOutputMap:Z,subtaskParams:$.subtaskParams,planMode:$.planMode}),G=$.kind==="subagent"?Object.fromEntries(Object.entries(Y).filter(([W])=>!iK4.includes(W))):Y;return{tools:{...X,...G},toolOutputMap:Z,nameMap:Q}}var iK4;var fW$=B(()=>{Op();vp0();iK4=["subtask","user_ask","propose_plan"]});var lw0={};H4(lw0,{waitForSeed:()=>ZH4,seedLocalMode:()=>sK4,pruneUndecryptableJwks:()=>gW$,markSeedComplete:()=>$H4,isLocalMode:()=>NK,healLocalJwks:()=>oK4,getLocalAdminUser:()=>yp0,getLocalAdminPassword:()=>cw0});import{symmetricDecrypt as nK4}from"better-auth/crypto";import{sql as xW$}from"kysely";import{userInfo as pK4}from"os";async function oK4(){let $=c0();if(!$.localMode)return 0;if(!$.betterAuthSecret)return 0;return gW$(c8().db,$.betterAuthSecret)}async function gW$($,Z){let X;try{X=(await xW$`
       select id, "privateKey" from jwks
     `.execute($)).rows}catch(Y){if(Y?.code==="42P01")return 0;return console.warn("[local-mode] JWKS heal skipped \u2014 could not read jwks:",Y),0}let Q=0;for(let Y of X){let G=!0;try{await nK4({key:Z,data:JSON.parse(Y.privateKey)})}catch{G=!1}if(G)continue;try{await xW$`delete from jwks where id = ${Y.id}`.execute($),Q++}catch(J){console.warn(`[local-mode] JWKS heal could not delete stale key ${Y.id}:`,J)}}return Q}async function cw0(){return"local-mode-default"}function hW$(){try{return pK4().username||"local"}catch{return"local"}}function rK4($){return $.charAt(0).toUpperCase()+$.slice(1)}async function aK4(){let $=c8(),Z=await $.db.selectFrom("user").select($.db.fn.countAll().as("count")).executeTakeFirst();return Number(Z?.count??0)===0}async function sK4(){if(!await aK4())return!1;let Z=hW$(),X=`${Z}@${yW$}`,Q=rK4(Z),Y=await cw0(),G=await E8.api.signUpEmail({body:{email:X,password:Y,name:Q}});if(!G?.user?.id)throw Error("Failed to create local admin user");let J=G.user.id,W=c8();await W.db.updateTable("user").set({role:"admin"}).where("id","=",J).execute();let K=`${Z}-local`.toLowerCase().replace(/[^a-z0-9-]/g,"-").replace(/-+/g,"-").replace(/^-|-$/g,""),H=`${Q} Local`;return await W.db.updateTable("organization").set({name:H,slug:K}).where("id","in",(N)=>N.selectFrom("member").select("organizationId").where("userId","=",J)).execute(),!0}async function yp0(){let $=c8(),Z=hW$(),X=await $.db.selectFrom("user").where("email","=",`${Z}@${yW$}`).selectAll().executeTakeFirst();if(X)return X;return $.db.selectFrom("user").where("email","=",`${Z}@${tK4}`).selectAll().executeTakeFirst()}function NK(){return c0().localMode}function $H4(){uW$()}function ZH4(){return eK4}var yW$="localhost.studio",tK4="localhost.mesh",uW$,eK4;var hV=B(()=>{GG();S$();qG();eK4=new Promise(($)=>{if(uW$=$,!NK())$()})});var cW$=B(()=>{_V()});function QH4($){return $.type==="file"&&"mediaType"in $&&typeof $.mediaType==="string"&&XH4.has($.mediaType)}function nW$($){let Z=$.match(/^data:([^;]+);base64,(.+)$/s);if(!Z)return null;let[,X,Q]=Z;try{let Y=atob(Q),G=new Uint8Array(Y.length);for(let J=0;J<Y.length;J++)G[J]=Y.charCodeAt(J);return{mimeType:X,bytes:G}}catch{return null}}function gp0($){return{"image/png":"png","image/jpeg":"jpg","image/gif":"gif","image/webp":"webp","image/svg+xml":"svg","application/pdf":"pdf","text/plain":"txt","text/html":"html","application/json":"json"}[$]??"bin"}async function YH4($,Z,X,Q){if(!Q.objectStorage)return null;try{return await Q.objectStorage.put(Z,$,{contentType:X}),Z}catch(Y){return console.error("[file-materializer] Failed to upload file:",Y),null}}async function zp($,Z){if(!Z.objectStorage)return null;try{return await Z.objectStorage.presignedGetUrl($,GH4)}catch(X){return console.error("[file-materializer] Failed to generate presigned URL:",X),null}}function pW$($){try{return decodeURIComponent($)}catch{return $}}function dW$($,Z){let X=typeof $.filename==="string"&&$.filename.trim()?$.filename:`attachment.${gp0(Z)}`,Q=X.match(JH4);if(Q?.[1])X=pW$(Q[1]);return[...X.split(/[\\/]/).pop()??X].filter((J)=>(J.codePointAt(0)??0)>=32).join("").trim()||`attachment.${gp0(Z)}`}function mW$($,Z){if(!Z.has($))return Z.add($),$;let X=$.lastIndexOf("."),Q=X>0?$.slice(0,X):$,Y=X>0?$.slice(X):"";for(let G=2;;G++){let J=`${Q} (${G})${Y}`;if(!Z.has(J))return Z.add(J),J}}async function iW$($,Z,X,Q,Y){if(!Y||!Q.orgFs)return console.warn("[file-materializer] uploads-volume write skipped",{hasThreadId:Boolean(Y),hasOrgFs:Boolean(Q.orgFs)}),null;try{let G=`${Y}/${X}`;return await Q.orgFs.write("uploads",G,$,{actor:Q.auth?.user?.id??"unknown",contentType:Z}),{key:s3("uploads",G),sandboxPath:`org/upload/${X}`}}catch(G){return console.error("[file-materializer] uploads-volume write failed:",G),null}}async function dw0($,Z,X){if(!Z.organization)return $;let Q=Z.organization.slug;if(!Q)return $;let Y=$.findLastIndex((A)=>A.role==="user");if(Y===-1)return $;let G=$[Y],J=G.parts.filter((A)=>A.type==="file"&&("url"in A)&&typeof A.url==="string"&&A.url.startsWith("data:")),K=Boolean(X?.threadId&&Z.orgFs)?G.parts.flatMap((A)=>{if(A.type!=="text"||!("text"in A)||typeof A.text!=="string")return[];let P=A.text.match(WH4);if(!P?.[1]||P[2]===void 0)return[];return[{name:pW$(P[1]),content:P[2]}]}):[];if(J.length===0&&K.length===0)return $;let H=new Set,N=J.flatMap((A)=>{if(A.type!=="file"||!("url"in A)||typeof A.url!=="string")return[];let P=nW$(A.url);if(!P)return[];let M=mW$(dW$(A,P.mimeType),H);return[{dataUrl:A.url,parsed:P,filename:M}]}),F=K.map(({name:A,content:P})=>({filename:mW$(dW$({filename:A},"text/plain"),H),content:P})),w=(await Promise.all([...N.map(async({dataUrl:A,parsed:P,filename:M})=>{let k=await iW$(P.bytes,P.mimeType,M,Z,X?.threadId);if(!k)return null;return{dataUrl:A,studioStorageUrl:G7(k.key),redirectUrl:Wv(Z.baseUrl,Q,k.key),filename:M,sandboxPath:k.sandboxPath}}),...F.map(async({filename:A,content:P})=>{let M=await iW$(new TextEncoder().encode(P),UZ(A),A,Z,X?.threadId);if(!M)return null;return{dataUrl:null,studioStorageUrl:G7(M.key),redirectUrl:Wv(Z.baseUrl,Q,M.key),filename:A,sandboxPath:M.sandboxPath}})])).filter((A)=>A!==null);if(w.length===0)return $;let O=w.map((A)=>A.sandboxPath?`- ${A.filename}: ${A.sandboxPath} (tool URL: ${A.studioStorageUrl})`:`- ${A.filename}: ${A.studioStorageUrl}`).join(`
 `),D=w.some((A)=>A.sandboxPath)?`[Attached files \u2014 already inside your sandbox; read them at the given path. The tool URL is only for tools that take a URL argument]
@@ -2726,7 +2726,7 @@ Do NOT require review (requiresReview = false) when the changes are low-risk, su
 
 When unsure between the two, lean toward NOT requiring review for small frontend-only diffs, and toward requiring it for anything backend or large.
 
-Respond with the structured verdict and a short reason.`,$_$;var X_$=B(()=>{S4();ZO();k81();D$6=S81.object({requiresReview:S81.boolean().describe("true if the changes should go through pull-request review"),reason:S81.string().describe("One short sentence explaining the decision (max ~120 chars)")});$_$={requiresReview:!1,reason:""}});function z$6($){if(!$||$.includes(".."))return!1;return j$6.test($)}function Q_$($){let Z=typeof $.__resolveType==="string"?$.__resolveType:null;if(!Z||!z$6(Z))return null;let{__resolveType:X,...Q}=$;return{resolveType:Z,payload:Q}}function Y_$($,Z){return`${$.replace(/\/+$/,"")}/deco/invoke/${Z}`}var j$6;var G_$=B(()=>{j$6=/^[\w./@-]+$/});function V81($){let Z;try{Z=new URL($)}catch{return null}if(!Z.hostname.endsWith(".localhost"))return null;let X=Z.host;return Z.hostname="127.0.0.1",{url:Z.toString(),hostHeader:X}}function J_$($,Z){let X=$?.githubRepo;if(!X?.owner||!X?.name)return null;if(!X.connectionId)return X;if(!Z.includes(X.connectionId))return null;return X}async function W_$($,Z,X,Q){if(!Q.connectionId)throw new gg("Push requires a connected GitHub account. Connect mcp-github for this project and restart the sandbox.");let Y=$.organization?.id;if(!Y)throw new gg(m7);await Vx({ctx:$,connectionId:Q.connectionId,organizationId:Y,forceRefresh:!0,onLegacyMintError:(N)=>{let F=N instanceof Error?N.message:m7;throw new gg(F)}});let{cloneUrl:G,gitUserName:J,gitUserEmail:W}=await gw(Q.connectionId,Q.owner,Q.name,$.db,$.vault),K=Xj0($),H=await Z.proxyDaemonRequest(X,"/_sandbox/config",{method:"PUT",headers:new Headers({"content-type":"application/json"}),body:JSON.stringify({git:{repository:{cloneUrl:G},identity:{userName:J,userEmail:W}},...K?{operator:K}:{}})});if(!H.ok){let N=await $O(H,P$6).catch(()=>H.statusText);throw Error(`Failed to refresh sandbox git credentials (${H.status}): ${N}`)}}var P$6=10485760,gg;var K_$=B(()=>{Pw();P81();Jp();Vn();gg=class gg extends Error{constructor($){super($);this.name="GitPushAuthError"}}});function T$6($){let Z=$.startsWith("thread:")?$.slice(7):$;if(!Z||Z.length>255||Z.includes("..")||Z.startsWith("/")||Z.endsWith("/")||Z.endsWith(".lock")||!A$6.test(Z))throw Error(`Invalid branch name: ${$}`)}function xC($){return AbortSignal.any([$.req.raw.signal,AbortSignal.timeout(I$6)])}function yC($){let{runner:Z}=$.get("vmClaim");if(!Z)return $.json({error:"No sandbox runner configured"},503);return Z}function C81($,Z){let Q=(Qj0.get($)??Promise.resolve()).catch(()=>{}).then(Z),Y=Q.catch(()=>{});return Qj0.set($,Y),Y.finally(()=>{if(Qj0.get($)===Y)Qj0.delete($)}),Q}async function _Z($,Z,X){let Q=yC($);if(Q instanceof Response)return Q;let{claimName:Y,userId:G,projectRef:J}=$.get("vmClaim"),W=X?.method??"POST",K=null,H=new Headers;if(X?.jsonBody!==void 0)K=X.jsonBody,H.set("content-type","application/json");else if(X?.forwardJsonBody)K=await $.req.text(),H.set("content-type","application/json");let N=X?.signal,F={method:W,headers:H,body:K,...N?{signal:N}:{}},U=async()=>{let w=await Q.proxyDaemonRequest(Y,Z,F);if(X?.map404to410&&w.status===404){try{await w.body?.cancel()}catch{}if(await Q.adoptLiveClaim?.({userId:G,projectRef:J},Y))w=await Q.proxyDaemonRequest(Y,Z,F);if(w.status===404){try{await w.body?.cancel()}catch{}return new Response(JSON.stringify({error:"Sandbox handle is gone. The sandbox needs to be re-provisioned."}),{status:410,headers:{"content-type":"application/json",...xY}})}}let O=await w.text(),D=X?.redactRepoDirUnlessDesktop&&Q.kind!=="user-desktop"?M$6(O):O,L=w.headers.get("content-type")??"application/json";return new Response(D,{status:w.status,headers:{"content-type":L,...xY}})};try{if(N){let w=U();return w.catch(()=>{}),await Promise.race([w,new Promise((D,L)=>{if(N.aborted)return L(N.reason);N.addEventListener("abort",()=>L(N.reason),{once:!0})})])}return await U()}catch(w){let O=w instanceof Error?w.message:String(w);return $.json({error:`Daemon unreachable: ${O}`},502)}}function M$6($){try{let Z=JSON.parse($);if(Z&&typeof Z==="object"&&!Array.isArray(Z)&&"repoDir"in Z)return JSON.stringify({...Z,repoDir:null})}catch{}return $}async function Yj0($,Z,X,Q="GET",Y){let G=await $.proxyDaemonRequest(Z,X,{method:Q,headers:new Headers,body:null});if(G.status===404&&Y){try{await G.body?.cancel()}catch{}if(await $.adoptLiveClaim?.(Y,Z))G=await $.proxyDaemonRequest(Z,X,{method:Q,headers:new Headers,body:null})}if(G.status===404){try{await G.body?.cancel()}catch{}throw Error("SANDBOX_GONE")}let J=await G.text();if(!G.ok)try{let W=JSON.parse(J);throw Error(W.error??`Daemon error (${G.status})`)}catch(W){if(W instanceof Error&&W.message!==J)throw W;throw Error(`Daemon error (${G.status})`)}return JSON.parse(J)}function k$6($){return F_$.includes($)}var A$6,H_$=524288,R$6=65536,I$6=1e4,N_$=2000,q$6,Qj0,xY,F_$,U_$=()=>{let $=new B1;return $.use("/:virtualMcpId/:branch/*",q$6),$.post("/:virtualMcpId/:branch/write",(Z)=>_Z(Z,"/_sandbox/write",{forwardJsonBody:!0,signal:xC(Z)})),$.post("/:virtualMcpId/:branch/unlink",(Z)=>_Z(Z,"/_sandbox/unlink",{forwardJsonBody:!0,signal:xC(Z)})),$.post("/:virtualMcpId/:branch/mkdir",(Z)=>_Z(Z,"/_sandbox/mkdir",{forwardJsonBody:!0,signal:xC(Z)})),$.post("/:virtualMcpId/:branch/rename",(Z)=>_Z(Z,"/_sandbox/rename",{forwardJsonBody:!0,signal:xC(Z)})),$.post("/:virtualMcpId/:branch/read",(Z)=>_Z(Z,"/_sandbox/read",{forwardJsonBody:!0,signal:xC(Z)})),$.post("/:virtualMcpId/:branch/glob",(Z)=>_Z(Z,"/_sandbox/glob",{forwardJsonBody:!0,signal:xC(Z)})),$.post("/:virtualMcpId/:branch/grep",(Z)=>_Z(Z,"/_sandbox/grep",{forwardJsonBody:!0,signal:xC(Z)})),$.post("/:virtualMcpId/:branch/exec/:script",async(Z)=>{let X=Z.req.param("script");if(!X)return Z.json({error:"missing script name"},400);return _Z(Z,`/_sandbox/exec/${encodeURIComponent(X)}`)}),$.post("/:virtualMcpId/:branch/exec/:script/kill",async(Z)=>{let X=Z.req.param("script");if(!X)return Z.json({error:"missing script name"},400);return _Z(Z,`/_sandbox/exec/${encodeURIComponent(X)}/kill`)}),$.get("/:virtualMcpId/:branch/config",(Z)=>_Z(Z,"/_sandbox/config",{method:"GET",map404to410:!0,redactRepoDirUnlessDesktop:!0})),$.put("/:virtualMcpId/:branch/config",(Z)=>_Z(Z,"/_sandbox/config",{method:"PUT",forwardJsonBody:!0,map404to410:!0})),$.post("/:virtualMcpId/:branch/setup/:step",async(Z)=>{let X=Z.req.param("step");if(!X||!k$6(X))return Z.json({error:`step must be one of: ${F_$.join(", ")}`},400);if(X==="start"){let Q=Z.get("vmClaim");if(Q.runner){let Y=r(Z.var.studioContext),G=Kw0(Q.virtualMcpMetadata);try{await Hw0({ctx:Z.var.studioContext,runner:Q.runner,handle:Q.claimName,orgId:Y.id,userId:Q.callerUserId,entries:G})}catch(J){let W=J instanceof Error?J.message:String(J);return Z.json({error:`Failed to push env to daemon: ${W}`},502)}}}return _Z(Z,`/_sandbox/setup/${X}`,{signal:Z.req.raw.signal,map404to410:!0})}),$.get("/:virtualMcpId/:branch/events",(Z)=>{let X=Z.get("vmClaim");if(!X.runner)return sN(Z,async(Q)=>{await Q.writeSSE({event:"phase",data:JSON.stringify({kind:"failed",reason:"unknown",message:"No sandbox runner configured on this studio instance."})})});return tC$(Z,{ctx:Z.var.studioContext,claimName:X.claimName,runner:X.runner,virtualMcpId:X.virtualMcpId,branch:X.branch,userId:X.userId,projectRef:X.projectRef,virtualMcpMetadata:X.virtualMcpMetadata})}),$.get("/:virtualMcpId/:branch/git/status",(Z)=>_Z(Z,"/_sandbox/git/status",{method:"GET",map404to410:!0,signal:AbortSignal.any([Z.req.raw.signal,AbortSignal.timeout(N_$)])})),$.post("/:virtualMcpId/:branch/git/status",(Z)=>_Z(Z,"/_sandbox/git/status",{map404to410:!0,signal:AbortSignal.any([Z.req.raw.signal,AbortSignal.timeout(N_$)])})),$.post("/:virtualMcpId/:branch/git/diff",(Z)=>_Z(Z,"/_sandbox/git/diff",{forwardJsonBody:!0,map404to410:!0})),$.post("/:virtualMcpId/:branch/git/publish",async(Z)=>{let X=yC(Z);if(X instanceof Response)return X;let{claimName:Q,virtualMcpMetadata:Y,connectionIds:G}=Z.get("vmClaim"),J=Z.var.studioContext;return C81(Q,async()=>{try{await A81(J,X,Q);let W=J_$(Y,G);if(W)await W_$(J,X,Q,W)}catch(W){if(W instanceof gg)return Z.json({error:W.message},403,xY);let K=W instanceof Error?W.message:String(W);return Z.json({error:K},502,xY)}return _Z(Z,"/_sandbox/git/publish",{forwardJsonBody:!0,map404to410:!0})})}),$.post("/:virtualMcpId/:branch/git/discard",(Z)=>{let{claimName:X}=Z.get("vmClaim");return C81(X,()=>_Z(Z,"/_sandbox/git/discard",{forwardJsonBody:!0,map404to410:!0}))}),$.post("/:virtualMcpId/:branch/git/rebase",async(Z)=>{let X=yC(Z);if(X instanceof Response)return X;let{claimName:Q}=Z.get("vmClaim"),Y=Z.var.studioContext;return C81(Q,async()=>{try{await A81(Y,X,Q)}catch(G){let J=G instanceof Error?G.message:String(G);return Z.json({error:J},502,xY)}return _Z(Z,"/_sandbox/git/rebase",{forwardJsonBody:!0,map404to410:!0})})}),$.post("/:virtualMcpId/:branch/git/suggest-commit",GZ({maxSize:H_$,onError:(Z)=>Z.json({error:"Payload too large"},413,xY)}),async(Z)=>{let X=yC(Z);if(X instanceof Response)return X;let{claimName:Q,userId:Y,projectRef:G}=Z.get("vmClaim"),J=Z.var.studioContext;try{let W=await Z.req.json().catch(()=>({})),K=W.status,H=W.diff,N=H!=null&&typeof H.diffs==="object"&&H.diffs!==null,[F,U]=I81(K)&&N?[K,H]:await Promise.all([Yj0(X,Q,"/_sandbox/git/status","GET",{userId:Y,projectRef:G}),Yj0(X,Q,"/_sandbox/git/diff","GET",{userId:Y,projectRef:G})]),w=await eC$(J,F,U);return Z.json(w,200,xY)}catch(W){let K=W instanceof Error?W.message:String(W);if(K==="SANDBOX_GONE")return Z.json({error:"Sandbox handle is gone. The sandbox needs to be re-provisioned."},410,xY);return Z.json({error:K},502,xY)}}),$.post("/:virtualMcpId/:branch/git/judge-review",GZ({maxSize:H_$,onError:(Z)=>Z.json({error:"Payload too large"},413,xY)}),async(Z)=>{let X=yC(Z);if(X instanceof Response)return X;let{claimName:Q,userId:Y,projectRef:G}=Z.get("vmClaim"),J=Z.var.studioContext;try{let W=await Z.req.json().catch(()=>({})),K=W.status,H=W.diff,N=H!=null&&typeof H.diffs==="object"&&H.diffs!==null,[F,U]=I81(K)&&N?[K,H]:await Promise.all([Yj0(X,Q,"/_sandbox/git/status","GET",{userId:Y,projectRef:G}),Yj0(X,Q,"/_sandbox/git/diff","GET",{userId:Y,projectRef:G})]),w=await Z_$(J,F,U,typeof W.language==="string"?W.language:void 0);return Z.json(w,200,xY)}catch(W){let K=W instanceof Error?W.message:String(W);if(K==="SANDBOX_GONE")return Z.json({error:"Sandbox handle is gone. The sandbox needs to be re-provisioned."},410,xY);return Z.json({error:K},502,xY)}}),$.get("/:virtualMcpId/:branch/preview-fetch",async(Z)=>{let X=yC(Z);if(X instanceof Response)return X;let{claimName:Q}=Z.get("vmClaim"),Y=Z.req.query("path");if(!Y||!Y.startsWith("/")||Y.startsWith("//")||Y.includes("..")||Y.includes("\\"))return Z.json({error:"Path not allowed"},403);let G;try{G=await X.getPreviewUrl(Q)}catch{return Z.json({error:"Preview not available"},502)}if(!G)return Z.json({error:"Preview not available"},502);let J=G.replace(/\/+$/,""),W=V81(`${J}${Y}`),K;try{K=await fetch(W?.url??`${J}${Y}`,{...W?{headers:{host:W.hostHeader}}:{}})}catch{return Z.json({error:"Preview unreachable"},502)}let H;try{H=await K.text()}catch{return Z.json({error:"Preview unreachable"},502)}return new Response(H,{status:K.status,headers:{"content-type":K.headers.get("content-type")??"application/json"}})}),$.post("/:virtualMcpId/:branch/preview-invoke",GZ({maxSize:R$6,onError:(Z)=>Z.json({error:"Payload too large"},413)}),async(Z)=>{let X=yC(Z);if(X instanceof Response)return X;let{claimName:Q}=Z.get("vmClaim"),Y;try{Y=await X.getPreviewUrl(Q)}catch{return Z.json({error:"Preview not available"},502)}if(!Y)return Z.json({error:"Preview not available"},502);let G;try{G=await Z.req.json()}catch{return Z.json({error:"Invalid JSON body"},400)}if(!G||typeof G!=="object"||Array.isArray(G))return Z.json({error:"Invalid JSON body"},400);let J=Q_$(G);if(!J)return Z.json({error:"Invalid or missing __resolveType"},400);let W=Y_$(Y,J.resolveType),K=V81(W),H;try{H=await fetch(K?.url??W,{method:"POST",headers:{"content-type":"application/json",...K?{host:K.hostHeader}:{}},body:JSON.stringify(J.payload),signal:AbortSignal.timeout(30000)})}catch{return Z.json({error:"Preview unreachable"},502)}let N;try{N=await H.text()}catch{return Z.json({error:"Preview unreachable"},502)}return new Response(N,{status:H.status,headers:{"content-type":H.headers.get("content-type")??"application/json"}})}),$};var w_$=B(()=>{v8();gO();yg();mC$();FN();nC$();j3();aw();pC$();oC$();gn0();Gp();k81();X_$();G_$();K_$();A$6=/^[a-zA-Z0-9][a-zA-Z0-9/._-]*$/;q$6=dC$(async($,Z)=>{let X=$.var.studioContext;try{$0(X)}catch{return $.json({error:"Unauthorized"},401)}let Q=W1(X);if(!Q)return $.json({error:"Unauthorized"},401);let Y;try{Y=r(X)}catch{return $.json({error:"Organization scope required"},403)}let G=$.req.param("virtualMcpId"),J=$.req.param("branch");if(!G||!J)return $.json({error:"virtualMcpId and branch are required"},400);try{T$6(J)}catch(w){let O=w instanceof Error?w.message:String(w);return $.json({error:O},400)}let W=await X.storage.virtualMcps.findById(G);if(!W||W.organization_id!==Y.id)return $.json({error:"Virtual MCP not found"},404);let K=In({orgId:Y.id,virtualMcpId:G,branch:J}),H=await zN(X,J,Q),N=iC$({userId:H,projectRef:K}),F=W.metadata??null,U;try{U=(await hX(X,{userId:H,branch:J,virtualMcpMetadata:F})).provider}catch{U=null}if(!U)return $.json({error:"No sandbox runner found"},404);return $.set("vmClaim",{claimName:N,callerUserId:Q,runner:U,virtualMcpId:G,branch:J,userId:H,projectRef:K,virtualMcpMetadata:F,connectionIds:W.connections?.map((w)=>w.connection_id)??[]}),Z()});Qj0=new Map;xY={"Cache-Control":"no-store, no-cache, must-revalidate",Pragma:"no-cache"};F_$=["clone","install","start"]});var O_$=($)=>{let Z=new B1;if(Z.use("*",MC),Z.route("/",jE0()),Z.route("/",Mk$()),Z.route("/",VC$()),Z.route("/",MC$()),Z.route("/",eE0()),Z.route("/tools",yC$()),Z.route("/",bC$()),Z.route("/",HC$({kvStorage:$.kvStorage})),Z.route("/",WC$()),Z.route("/fs",zC$({getConnection:$.getNatsConnection})),Z.route("/sandbox",U_$()),Z.route("/",RC$()),Z.route("/deco-sites",PE0()),Z.route("/sso",UE0()),Z.route("/",$j0({tokenStorage:$.tokenStorage,automationEventDispatcher:$.automationEventDispatcher})),Z.route("/webhooks",jk$()),$.mountDevAssets)Z.route("/dev-assets",AE0({orgFromPath:!0}));return Z.use("/mcp/:connectionId?",$.mcpAuth),Z.use("/mcp/:connectionId/ui-resource",$.mcpAuth),Z.use("/mcp/gateway/:virtualMcpId?",$.mcpAuth),Z.use("/mcp/virtual-mcp/:virtualMcpId?",$.mcpAuth),Z.use("/mcp/self",$.mcpAuth),Z.use("/mcp/task-run/:threadId",$.mcpAuth),Z.route("/",is1()),Z.get("/mcp/:gateway?/:connectionId/.well-known/oauth-protected-resource/*",$.betterAuthProtectedResourceHandler),Z.get("/mcp/.well-known/oauth-protected-resource",$.betterAuthProtectedResourceHandler),Z.route("/mcp/task-run",AC$()),Z.route("/mcp",pO0()),Z.route("/mcp/self",sE0()),Z.route("/mcp",rO0()),Z.all("/oauth-proxy/:connectionId/*",$.oauthProxyHandler),Z.get("/watch",$.watchHandler),Z};var B_$=B(()=>{v8();l11();zk$();p11();TE0();st();u11();KC$();NC$();PC$();bi();C11();aO0();O81();TC$();IC$();kC$();CC$();fC$();D81();gC$();L81();tO0();w_$()});function V$6($){return $.filter((Z)=>Z.vendors?.alias).map((Z)=>({name:Z.name,title:Z.title,description:Z.description,logo:Z.logo,category:Z.category,vendor:{alias:Z.vendors.alias,url:Z.vendors.url}}))}async function C$6($,Z){let X=await fetch(`${$}/rest/v1/apps?select=name,title,description,logo,category,vendors(alias,url)`,{headers:{apikey:Z,Authorization:`Bearer ${Z}`,Accept:"application/json"},signal:AbortSignal.timeout(S$6)});if(!X.ok){let Q=await X.text().catch(()=>X.statusText);throw console.error(`[deco-apps] Supabase error (${X.status}): ${Q.slice(0,200)}`),Error(`External service error (${X.status})`)}return await X.json()}var S$6=1e4,_$6=async($,Z)=>{if(!$.get("studioContext").auth.user?.id)return $.json({error:"Unauthorized"},401);return Z()},D_$=()=>{let $=new B1;return $.use("*",_$6),$.get("/",async(Z)=>{let X=c0(),Q=X.decoSupabaseUrl,Y=X.decoSupabaseServiceKey;if(!Q||!Y)return Z.json({apps:[]});try{let G=await C$6(Q,Y);return Z.json({apps:V$6(G)})}catch(G){return console.error("[deco-apps] GET error:",G),Z.json({error:"Failed to fetch apps"},502)}}),$};var L_$=B(()=>{v8();S$()});import{z as M1}from"zod";function bK($,Z="invalid_request_error",X=null,Q=null){return{error:{message:$,type:Z,param:X,code:Q}}}function l$6($){if(!$)return null;let Z=$.indexOf(":");if(Z===-1)return{credentialId:null,modelId:$};let X=$.substring(0,Z),Q=$.substring(Z+1);if(!X||!Q)return null;return{credentialId:X,modelId:Q}}function d$6($,Z,X){try{return JSON.parse($)}catch{throw new z_$(`Invalid JSON in tool call arguments for function '${X}' (tool_call_id: ${Z}): ${$}`)}}function m$6($){let Z={};for(let X of $)if(X.role==="assistant"&&X.tool_calls)for(let Q of X.tool_calls)Z[Q.id]=Q.function.name;return $.map((X)=>{switch(X.role){case"system":return{role:"system",content:X.content};case"user":if(typeof X.content==="string")return{role:"user",content:X.content};return{role:"user",content:X.content.map((Y)=>{if(Y.type==="text")return{type:"text",text:Y.text};return{type:"image",image:Y.image_url.url}})};case"assistant":if(X.tool_calls&&X.tool_calls.length>0)return{role:"assistant",content:X.tool_calls.map((Y)=>({type:"tool-call",toolCallId:Y.id,toolName:Y.function.name,input:d$6(Y.function.arguments,Y.id,Y.function.name)}))};return{role:"assistant",content:X.content??""};case"tool":let Q=Z[X.tool_call_id]??"unknown";return{role:"tool",content:[{type:"tool-result",toolCallId:X.tool_call_id,toolName:Q,output:{type:"text",value:X.content}}]}}})}function i$6($){let Z=$.map((X)=>{let Q=X.function.parameters?DY(X.function.parameters):DY({type:"object",properties:{}});return[X.function.name,_$({description:X.function.description,inputSchema:Q})]});return Object.fromEntries(Z)}function n$6($){if(!$)return;return{openai:{response_format:$}}}function p$6(){return`chatcmpl-${crypto.randomUUID().replace(/-/g,"").substring(0,29)}`}function E_$($,Z,X,Q,Y,G){let J={model:$,messages:Z,tools:X,temperature:Q.temperature,maxTokens:Q.max_tokens,topP:Q.top_p,frequencyPenalty:Q.frequency_penalty,presencePenalty:Q.presence_penalty,stopSequences:Q.stop?Array.isArray(Q.stop)?Q.stop:[Q.stop]:void 0,abortSignal:G};return Y?{...J,providerOptions:Y}:J}function j_$($){if($==="tool-calls")return"tool_calls";if($==="length")return"length";return"stop"}var v$6=256,b$6,f$6,x$6,y$6,g$6,h$6,u$6,c$6,z_$,P_$,A_$;var T_$=B(()=>{S4();v8();yg();CN();b$6=M1.object({type:M1.literal("function"),function:M1.object({name:M1.string(),description:M1.string().optional(),parameters:M1.record(M1.string(),M1.unknown()).optional()})}),f$6=M1.object({id:M1.string(),type:M1.literal("function"),function:M1.object({name:M1.string(),arguments:M1.string()})}),x$6=M1.discriminatedUnion("role",[M1.object({role:M1.literal("system"),content:M1.string(),name:M1.string().optional()}),M1.object({role:M1.literal("user"),content:M1.union([M1.string(),M1.array(M1.union([M1.object({type:M1.literal("text"),text:M1.string()}),M1.object({type:M1.literal("image_url"),image_url:M1.object({url:M1.string(),detail:M1.string().optional()})})]))]),name:M1.string().optional()}),M1.object({role:M1.literal("assistant"),content:M1.string().nullable().optional(),name:M1.string().optional(),tool_calls:M1.array(f$6).optional()}),M1.object({role:M1.literal("tool"),content:M1.string(),tool_call_id:M1.string()})]),y$6=M1.object({type:M1.literal("text")}),g$6=M1.object({type:M1.literal("json_object")}),h$6=M1.object({type:M1.literal("json_schema"),json_schema:M1.object({name:M1.string(),description:M1.string().optional(),schema:M1.record(M1.string(),M1.unknown()),strict:M1.boolean().optional()})}),u$6=M1.union([y$6,g$6,h$6]),c$6=M1.object({model:M1.string().describe("Format: 'model_id' or 'credential_id:model_id'"),messages:M1.array(x$6),stream:M1.boolean().optional().default(!1),temperature:M1.number().min(0).max(2).optional(),max_tokens:M1.number().positive().optional(),top_p:M1.number().min(0).max(1).optional(),frequency_penalty:M1.number().min(-2).max(2).optional(),presence_penalty:M1.number().min(-2).max(2).optional(),stop:M1.union([M1.string(),M1.array(M1.string())]).optional(),tools:M1.array(b$6).optional(),tool_choice:M1.union([M1.literal("auto"),M1.literal("none"),M1.literal("required"),M1.object({type:M1.literal("function"),function:M1.object({name:M1.string()})})]).optional(),response_format:u$6.optional(),user:M1.string().optional()});z_$=class z_$ extends Error{constructor($){super($);this.name="MessageConversionError"}};P_$=new B1;P_$.post("/:org/v1/chat/completions",async($)=>{let Z=$.get("studioContext"),X=$.req.param("org");try{if(!Z.auth.apiKey?.id)return $.json(bK("API key authentication required. Provide a valid API key via Authorization header.","authentication_error"),401);if(!Z.organization)return $.json(bK("Organization context is required. Ensure your API key has organization metadata.","invalid_request_error","organization"),400);if((Z.organization.slug??Z.organization.id)!==X)return $.json(bK("Organization mismatch. The API key's organization does not match the requested organization.","invalid_request_error","organization"),403);let Q=await $.req.json(),Y=c$6.safeParse(Q);if(!Y.success){let L=Y.error.issues[0]??{message:"Invalid request",path:[]};return $.json(bK(`Invalid request: ${L.message}`,"invalid_request_error",L.path.length>0?L.path.join("."):null),400)}let G=Y.data,J=l$6(G.model);if(!J)return $.json(bK("Invalid model format. Expected 'model_id' or 'credential_id:model_id' (e.g., 'claude-sonnet-4-6' or 'key_abc123:claude-sonnet-4-6')","invalid_request_error","model"),400);let{credentialId:W}=J,{modelId:K}=J;if(!W){let E=(await Z.storage.aiProviderKeys.list({organizationId:Z.organization.id})).find((j)=>aB(j.providerId));if(!E)return $.json(bK("No AI provider credentials configured for this organization. Add a credential in settings or specify one explicitly via 'credential_id:model_id'.","invalid_request_error","model"),400);W=E.id}let H;try{H=await Z.aiProviders.activate(W,Z.organization.id)}catch{return $.json(bK(`AI provider credential not found or inaccessible: ${W}`,"invalid_request_error","model"),404)}let N=H.aiSdk.languageModel(K),F=m$6(G.messages),U=G.tools?i$6(G.tools):void 0,w=n$6(G.response_format),O=p$6(),D=Math.floor(Date.now()/1000);if(G.stream)return sN($,async(L)=>{let E=E_$(N,F,U,G,w,$.req.raw.signal);try{let j=xw(E),z=!1,A=0,P="",M=async()=>{if(P.length===0)return;let k=P;P="",await L.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:D,model:G.model,choices:[{index:0,delta:{content:k},finish_reason:null}]})})};for await(let k of j.fullStream){if(!z&&(k.type==="text-delta"||k.type==="tool-call"))await L.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:D,model:G.model,choices:[{index:0,delta:{role:"assistant",content:""},finish_reason:null}]})}),z=!0;if(k.type==="text-delta"){if(P+=k.text,P.length>=v$6)await M()}else if(k.type==="tool-call"){await M();let q=A++;await L.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:D,model:G.model,choices:[{index:0,delta:{tool_calls:[{index:q,id:k.toolCallId,type:"function",function:{name:k.toolName,arguments:JSON.stringify(k.input)}}]},finish_reason:null}]})})}else if(k.type==="finish")await M(),await L.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:D,model:G.model,choices:[{index:0,delta:{},finish_reason:j_$(k.finishReason)}],usage:k.totalUsage?{prompt_tokens:k.totalUsage.inputTokens??0,completion_tokens:k.totalUsage.outputTokens??0,total_tokens:k.totalUsage.totalTokens??0}:void 0})})}await M(),await L.writeSSE({data:"[DONE]"})}catch(j){let z=j;console.error("[openai-compat:stream] Error:",z.message),await L.writeSSE({data:JSON.stringify({error:{message:z.message,type:"server_error"}})})}});else{let L=E_$(N,F,U,G,w,$.req.raw.signal),E=await bw(L),j={role:"assistant",content:E.text||null};if(E.toolCalls&&E.toolCalls.length>0)j.tool_calls=E.toolCalls.map((z)=>({id:z.toolCallId,type:"function",function:{name:z.toolName,arguments:JSON.stringify("input"in z?z.input:{})}})),j.content=null;return $.json({id:O,object:"chat.completion",created:D,model:G.model,choices:[{index:0,message:j,finish_reason:j_$(E.finishReason)}],usage:{prompt_tokens:E.usage?.inputTokens??0,completion_tokens:E.usage?.outputTokens??0,total_tokens:E.usage?.totalTokens??0}})}}catch(Q){let Y=Q;if(Y.name==="AbortError")return $.json(bK("Request aborted","invalid_request_error"),400);if(Y.name==="MessageConversionError")return $.json(bK(Y.message,"invalid_request_error","messages"),400);return console.error("[openai-compat] Error:",Y.message,Y.stack),$.json(bK(Y.message,"server_error"),500)}});A_$=P_$});var I_$;var R_$=B(()=>{I_$={name:"decocms",version:"4.193.0",description:"Deco CMS \u2014 Self-hostable MCP Gateway for managing AI connections and tools",author:"Deco team",repository:{type:"git",url:"git+https://github.com/decocms/studio.git",directory:"apps/api"},bugs:{url:"https://github.com/decocms/studio/issues"},type:"module",bin:{deco:"./dist/server/cli.js"},files:["dist/**/*"],scripts:{dev:"bun run migrate && bun run dev:server","dev:server":"bun run --cwd=../../packages/sandbox build && NODE_ENV=development bun --env-file=.env --hot run src/index.ts",build:"bun run build:server","build:server":"bun run scripts/bundle-server-script.ts --dist ./dist/server","generate:tool-contracts":"bun run scripts/generate-tool-contracts.ts","db:migrate":"bun run ./dist/server/migrate.js",check:"tsc --noEmit",start:"bun run ./dist/server/server.js",migrate:"bun run src/database/migrate.ts",test:"bun test src","better-auth:migrate":"bunx --bun @better-auth/cli migrate -y --config src/auth/index.ts",prepublishOnly:"bun run --cwd=../.. build:studio"},optionalDependencies:{"@duckdb/node-api":"^1.5.0-r.1"},dependencies:{"@ai-sdk/anthropic":"^3.0.85","@ai-sdk/google":"^3.0.83","@ai-sdk/openai":"^3.0.73","@anthropic-ai/sdk":"^0.105.0","@aws-sdk/client-s3":"^3.1013.0","@aws-sdk/client-sts":"^3.1013.0","@aws-sdk/lib-storage":"^3.1013.0","@aws-sdk/s3-request-presigner":"^3.1013.0","@clickhouse/client":"^1.8.1","@dbos-inc/dbos-sdk":"^4.21.6","@inkjs/ui":"^2.0.0","@nats-io/jetstream":"3.4.0","@nats-io/kv":"3.4.0","@nats-io/nats-core":"3.4.0","@nats-io/transport-node":"3.4.0","@openrouter/ai-sdk-provider":"^2.9.1","@opentelemetry/core":"^2.6.0","embedded-postgres":"^18.3.0-beta.16",ink:"^6.8.0",kysely:"^0.28.12","posthog-node":"^5.0.0",react:"^19.2.6","react-dom":"^19.2.6"},devDependencies:{"@ai-sdk/provider":"^3.0.10","@better-auth/sso":"1.4.1","@decocms/better-auth":"1.5.17","@decocms/bindings":"workspace:*","@decocms/mcp-utils":"workspace:*","@decocms/runtime":"workspace:*","@decocms/sandbox":"workspace:*","@decocms/shared":"workspace:*","@jitl/quickjs-wasmfile-release-sync":"0.31.0","@modelcontextprotocol/sdk":"1.29.0","@nats-io/jwt":"0.0.10-5","@opentelemetry/api":"^1.9.0","@opentelemetry/api-logs":"^0.211.0","@opentelemetry/exporter-logs-otlp-proto":"^0.211.0","@opentelemetry/exporter-prometheus":"^0.208.0","@opentelemetry/exporter-trace-otlp-proto":"^0.207.0","@opentelemetry/instrumentation-runtime-node":"^0.24.0","@opentelemetry/resources":"^2.6.0","@opentelemetry/sdk-logs":"^0.211.0","@opentelemetry/sdk-metrics":"^2.2.0","@opentelemetry/sdk-node":"^0.207.0","@opentelemetry/sdk-trace-base":"^2.5.0","@types/bun":"^1.3.1","@types/google.maps":"^3.65.2","@types/pg":"^8.15.6","@types/react-syntax-highlighter":"^15.5.13","@vercel/nft":"^1.1.1",ai:"^6.0.208","better-auth":"1.4.22",croner:"^9.1.0",degit:"^2.8.4",hono:"^4.10.7",jose:"^6.0.11",nanoid:"^5.1.6",pg:"^8.16.3",typescript:"^7.0.2",typescript5:"npm:typescript@^5.9.3",zod:"4.3.6"},homepage:"https://github.com/decocms/studio",keywords:["mcp","model-context-protocol","ai","gateway","self-hosted","tools"],license:"MIT",publishConfig:{access:"public"}}});function r$6(){let $=process.env.POSTHOG_KEY;if(!$)return null;return{key:$,host:process.env.POSTHOG_HOST??o$6}}var q_$,o$6="https://ph.studio.decocms.com",M_$;var k_$=B(()=>{v8();lC0();hV();BZ();S$();q11();R_$();q_$=new B1;q_$.get("/",($)=>{let Z={version:I_$.version,theme:oM1(),...XD().logo&&{logo:XD().logo},...NK()&&{internalUrl:a21()},...c0().enableDecoImport&&{enableDecoImport:!0},brandExtractEnabled:!!c0().firecrawlApiKey,auth:bM$(),posthog:r$6(),googleMapsApiKey:process.env.GOOGLE_MAPS_API_KEY?.trim()||null,runtime:{agentSandbox:!NK()&&c0().sandboxProviderKind==="agent-sandbox"}};return $.header("Cache-Control","no-store"),$.json({success:!0,config:Z})});M_$=q_$});function hg($){let Z=($??"").trim().toLowerCase();return Z=Z.replace(/^https?:\/\//,""),Z=Z.replace(/^www\./,""),Z=Z.split(/[/?#]/)[0]??"",Z.replace(/\/+$/,"")}function _81($){return(hg($).split(".")[0]||$).replace(/[-_]/g," ").split(" ").filter(Boolean).map((X)=>X.charAt(0).toUpperCase()+X.slice(1)).join(" ")}function V_$($,Z=64){return`https://www.google.com/s2/favicons?domain=${encodeURIComponent(hg($))}&sz=${Z}`}function S_$($,Z){let X=$.trim();if(X.length<=Z)return X;let Q=X.slice(0,Z-1),Y=Q.lastIndexOf(" ");return`${(Y>Z*0.6?Q.slice(0,Y):Q).trimEnd()}\u2026`}function C_$($){let{brand:Z,domain:X,score:Q,verdict:Y}=$,G=typeof Q==="number"?`${Z} commerce report \u2014 ${Math.round(Q)}/100 \xB7 decocms`:`${Z} commerce report \xB7 decocms`,J=`See the full ${Z} scorecard \u2014 SEO, performance, conversion & AEO signals scored by decocms.`,W=Y?.trim()?S_$(`${Y.trim().replace(/\s+/g," ")} \u2014 ${J}`,200):S_$(`How does ${X} really perform? ${J}`,200);return{title:G,description:W}}import{z as l0}from"zod";var gC,a$6,s$6,e$6,$86,__$;var v_$=B(()=>{gC=l0.enum(["good","bad","neutral"]),a$6=l0.preprocess(($)=>{if(Array.isArray($))return{kind:"text",value:$.find((X)=>X!==null&&typeof X!=="object")??""};return $!==null&&typeof $==="object"?$:{kind:"text",value:$}},l0.object({kind:l0.enum(["text","number","sparkline","badge","score"]).catch("text"),value:l0.coerce.string().optional(),tone:gC.optional(),muted:l0.boolean().optional(),delta:l0.coerce.string().optional(),deltaDir:l0.enum(["up","down","neutral"]).optional(),points:l0.array(l0.coerce.number()).optional(),label:l0.coerce.string().optional()}).transform(($)=>{if($.kind==="badge"&&$.label==null)$.label=$.value??"";if($.kind==="score"){let Z=Number($.value);if(Number.isNaN(Z))return{...$,kind:"text"}}return $})),s$6=l0.preprocess(($)=>{let Z=$;if(Z&&typeof Z==="object"&&!Array.isArray(Z)&&Array.isArray(Z.cells))Z=Z.cells;if(Array.isArray(Z)&&Z.length===1&&Array.isArray(Z[0]))Z=Z[0];if(Array.isArray(Z))return Z;if(Z&&typeof Z==="object")return Object.values(Z);return Z},l0.array(a$6)),e$6={key:l0.coerce.string(),title:l0.coerce.string(),eyebrow:l0.coerce.string().optional(),headline:l0.coerce.string(),annotation:l0.coerce.string().optional(),methodology:l0.coerce.string().optional(),sources:l0.array(l0.object({name:l0.coerce.string(),logoUrl:l0.coerce.string()})).optional()},$86=l0.discriminatedUnion("template",[l0.object({template:l0.literal("cover"),score:l0.object({value:l0.coerce.number(),max:l0.coerce.number().optional(),grade:l0.coerce.string().optional(),label:l0.coerce.string().optional()}).optional(),brandImage:l0.coerce.string().optional(),screenshot:l0.coerce.string().optional(),mobileScreenshot:l0.coerce.string().optional()}),l0.object({template:l0.literal("cta"),ctaUrl:l0.coerce.string().optional(),ctaLabel:l0.coerce.string().optional(),bullets:l0.array(l0.coerce.string()).optional()}),l0.object({template:l0.literal("series"),points:l0.array(l0.coerce.number()).min(2),xLabels:l0.array(l0.coerce.string()).min(1),unit:l0.coerce.string().optional(),callout:l0.object({index:l0.coerce.number(),value:l0.coerce.string(),tone:gC.optional()})}),l0.object({template:l0.literal("threshold"),value:l0.coerce.string().default(""),metricLabel:l0.coerce.string().optional(),ratio:l0.coerce.number(),thresholdRatio:l0.coerce.number().optional(),thresholdLabel:l0.coerce.string().default(""),tone:gC.optional()}),l0.object({template:l0.literal("stats"),stats:l0.array(l0.object({value:l0.coerce.string(),label:l0.coerce.string(),tone:gC.optional()})).min(1)}),l0.object({template:l0.literal("bars"),items:l0.array(l0.object({value:l0.coerce.string(),label:l0.coerce.string(),ratio:l0.coerce.number(),tone:gC.optional()})).min(1)}),l0.object({template:l0.literal("gauges"),gauges:l0.array(l0.object({label:l0.coerce.string(),value:l0.coerce.string(),status:l0.enum(["good","warn","bad"]).catch("warn"),caption:l0.coerce.string().optional(),ratio:l0.coerce.number().optional()})).min(1)}),l0.object({template:l0.literal("checklist"),checks:l0.array(l0.object({label:l0.coerce.string(),status:l0.enum(["pass","fail","warn"]).catch("fail"),value:l0.coerce.string().optional()})).min(1)}),l0.object({template:l0.literal("table"),columns:l0.array(l0.object({label:l0.coerce.string(),align:l0.enum(["left","right"]).optional()})).min(1),rows:l0.array(s$6).min(1),highlightRow:l0.coerce.number().optional()}),l0.object({template:l0.literal("products"),products:l0.array(l0.object({name:l0.coerce.string(),price:l0.coerce.string().optional(),image:l0.coerce.string().optional(),url:l0.coerce.string().optional()})).min(1)}),l0.object({template:l0.literal("list"),entries:l0.array(l0.object({label:l0.coerce.string(),severity:l0.enum(["error","warning","notice"]).catch("notice")})).min(1),moreCount:l0.coerce.number().optional()}),l0.object({template:l0.literal("keywords"),volumeLabel:l0.coerce.string().optional(),keywords:l0.array(l0.object({term:l0.coerce.string(),volume:l0.coerce.string(),position:l0.coerce.number().catch(0)})).min(1)}),l0.object({template:l0.literal("competitor"),metricLabel:l0.coerce.string().optional(),competitors:l0.array(l0.object({name:l0.coerce.string(),value:l0.coerce.string(),tone:gC.optional(),isYou:l0.boolean().optional()})).min(1)}),l0.object({template:l0.literal("scorecard"),rivalLabel:l0.coerce.string().optional(),dimensions:l0.array(l0.object({label:l0.coerce.string(),you:l0.coerce.string(),rival:l0.coerce.string().optional(),rivalName:l0.coerce.string().optional(),tone:gC.optional()})).min(1)})]),__$=l0.object({...e$6,template:$86})});function Gj0($){let Z=[],X=[...$.sections].sort((Q,Y)=>Q.position-Y.position).map((Q)=>{let Y=__$.safeParse(Q.props);if(Y.success)return Y.data;let G=Y.error.issues[0];return Z.push({section_type:Q.section_type,position:Q.position,reason:G?`${G.path.join(".")||"(root)"}: ${G.message}`:"contract violation"}),null}).filter((Q)=>Q!==null);return{deck:{meta:{...$.meta,scores:$.summary?.scores},slides:X},drops:Z}}var v81=B(()=>{v_$()});import{join as b_$}from"path";async function X86($){try{let Z=await fetch(`${LW({})}/api/v2/public/diagnostics/${encodeURIComponent($)}`,{headers:{Accept:"application/json"},signal:AbortSignal.timeout(Z86)});if(!Z.ok)return null;let X=await Z.json(),{deck:Q}=Gj0(X);if(!Q.slides.length)return null;let Y=Q.slides.find((W)=>W.template.template==="cover"),G=Y?.template,J=G&&G.template==="cover"?G:void 0;return{brand:Q.meta.brand?.trim()||_81($),score:Q.meta.scores?.cover??J?.score?.value,verdict:Y?.annotation?.trim()||Y?.headline?.trim()||void 0}}catch{return null}}function yY($){return $.replaceAll("&","&amp;").replaceAll("<","&lt;").replaceAll(">","&gt;").replaceAll('"',"&quot;")}function Q86($,Z){let X=hg($),Q=Z?.brand?.trim()||_81(X),Y=V_$(X,128),J=`${(c0().baseUrl??"https://studio.decocms.com").replace(/\/+$/,"")}/report/${encodeURIComponent(X)}`,{title:W,description:K}=C_$({brand:Q,domain:X,score:Z?.score,verdict:Z?.verdict}),H=`${J}/og.png`,N=`${Q} commerce report by decocms`;return[`<title>${yY(W)}</title>`,`<meta name="description" content="${yY(K)}" />`,'<meta name="robots" content="noindex, follow" />','<meta property="og:type" content="website" />','<meta property="og:site_name" content="decocms" />',`<meta property="og:title" content="${yY(W)}" />`,`<meta property="og:description" content="${yY(K)}" />`,`<meta property="og:url" content="${yY(J)}" />`,`<meta property="og:image" content="${yY(H)}" />`,'<meta property="og:image:width" content="1200" />','<meta property="og:image:height" content="630" />',`<meta property="og:image:alt" content="${yY(N)}" />`,'<meta name="twitter:card" content="summary_large_image" />',`<meta name="twitter:title" content="${yY(W)}" />`,`<meta name="twitter:description" content="${yY(K)}" />`,`<meta name="twitter:image" content="${yY(H)}" />`,`<meta name="twitter:image:alt" content="${yY(N)}" />`,`<link rel="canonical" href="${yY(J)}" />`,`<link rel="icon" href="${yY(Y)}" sizes="any" />`].join(`
+Respond with the structured verdict and a short reason.`,$_$;var X_$=B(()=>{S4();ZO();k81();D$6=S81.object({requiresReview:S81.boolean().describe("true if the changes should go through pull-request review"),reason:S81.string().describe("One short sentence explaining the decision (max ~120 chars)")});$_$={requiresReview:!1,reason:""}});function z$6($){if(!$||$.includes(".."))return!1;return j$6.test($)}function Q_$($){let Z=typeof $.__resolveType==="string"?$.__resolveType:null;if(!Z||!z$6(Z))return null;let{__resolveType:X,...Q}=$;return{resolveType:Z,payload:Q}}function Y_$($,Z){return`${$.replace(/\/+$/,"")}/deco/invoke/${Z}`}var j$6;var G_$=B(()=>{j$6=/^[\w./@-]+$/});function V81($){let Z;try{Z=new URL($)}catch{return null}if(!Z.hostname.endsWith(".localhost"))return null;let X=Z.host;return Z.hostname="127.0.0.1",{url:Z.toString(),hostHeader:X}}function J_$($,Z){let X=$?.githubRepo;if(!X?.owner||!X?.name)return null;if(!X.connectionId)return X;if(!Z.includes(X.connectionId))return null;return X}async function W_$($,Z,X,Q){if(!Q.connectionId)throw new gg("Push requires a connected GitHub account. Connect mcp-github for this project and restart the sandbox.");let Y=$.organization?.id;if(!Y)throw new gg(m7);await Vx({ctx:$,connectionId:Q.connectionId,organizationId:Y,forceRefresh:!0,onLegacyMintError:(N)=>{let F=N instanceof Error?N.message:m7;throw new gg(F)}});let{cloneUrl:G,gitUserName:J,gitUserEmail:W}=await gw(Q.connectionId,Q.owner,Q.name,$.db,$.vault),K=Xj0($),H=await Z.proxyDaemonRequest(X,"/_sandbox/config",{method:"PUT",headers:new Headers({"content-type":"application/json"}),body:JSON.stringify({git:{repository:{cloneUrl:G},identity:{userName:J,userEmail:W}},...K?{operator:K}:{}})});if(!H.ok){let N=await $O(H,P$6).catch(()=>H.statusText);throw Error(`Failed to refresh sandbox git credentials (${H.status}): ${N}`)}}var P$6=10485760,gg;var K_$=B(()=>{Pw();P81();Jp();Vn();gg=class gg extends Error{constructor($){super($);this.name="GitPushAuthError"}}});function T$6($){let Z=$.startsWith("thread:")?$.slice(7):$;if(!Z||Z.length>255||Z.includes("..")||Z.startsWith("/")||Z.endsWith("/")||Z.endsWith(".lock")||!A$6.test(Z))throw Error(`Invalid branch name: ${$}`)}function xC($){return AbortSignal.any([$.req.raw.signal,AbortSignal.timeout(I$6)])}function yC($){let{runner:Z}=$.get("vmClaim");if(!Z)return $.json({error:"No sandbox runner configured"},503);return Z}function C81($,Z){let Q=(Qj0.get($)??Promise.resolve()).catch(()=>{}).then(Z),Y=Q.catch(()=>{});return Qj0.set($,Y),Y.finally(()=>{if(Qj0.get($)===Y)Qj0.delete($)}),Q}async function _Z($,Z,X){let Q=yC($);if(Q instanceof Response)return Q;let{claimName:Y,userId:G,projectRef:J}=$.get("vmClaim"),W=X?.method??"POST",K=null,H=new Headers;if(X?.jsonBody!==void 0)K=X.jsonBody,H.set("content-type","application/json");else if(X?.forwardJsonBody)K=await $.req.text(),H.set("content-type","application/json");let N=X?.signal,F={method:W,headers:H,body:K,...N?{signal:N}:{}},U=async()=>{let w=await Q.proxyDaemonRequest(Y,Z,F);if(X?.map404to410&&w.status===404){try{await w.body?.cancel()}catch{}if(await Q.adoptLiveClaim?.({userId:G,projectRef:J},Y))w=await Q.proxyDaemonRequest(Y,Z,F);if(w.status===404){try{await w.body?.cancel()}catch{}return new Response(JSON.stringify({error:"Sandbox handle is gone. The sandbox needs to be re-provisioned."}),{status:410,headers:{"content-type":"application/json",...xY}})}}let O=await w.text(),D=X?.redactRepoDirUnlessDesktop&&Q.kind!=="user-desktop"?M$6(O):O,L=w.headers.get("content-type")??"application/json";return new Response(D,{status:w.status,headers:{"content-type":L,...xY}})};try{if(N){let w=U();return w.catch(()=>{}),await Promise.race([w,new Promise((D,L)=>{if(N.aborted)return L(N.reason);N.addEventListener("abort",()=>L(N.reason),{once:!0})})])}return await U()}catch(w){let O=w instanceof Error?w.message:String(w);return $.json({error:`Daemon unreachable: ${O}`},502)}}function M$6($){try{let Z=JSON.parse($);if(Z&&typeof Z==="object"&&!Array.isArray(Z)&&"repoDir"in Z)return JSON.stringify({...Z,repoDir:null})}catch{}return $}async function Yj0($,Z,X,Q="GET",Y){let G=await $.proxyDaemonRequest(Z,X,{method:Q,headers:new Headers,body:null});if(G.status===404&&Y){try{await G.body?.cancel()}catch{}if(await $.adoptLiveClaim?.(Y,Z))G=await $.proxyDaemonRequest(Z,X,{method:Q,headers:new Headers,body:null})}if(G.status===404){try{await G.body?.cancel()}catch{}throw Error("SANDBOX_GONE")}let J=await G.text();if(!G.ok)try{let W=JSON.parse(J);throw Error(W.error??`Daemon error (${G.status})`)}catch(W){if(W instanceof Error&&W.message!==J)throw W;throw Error(`Daemon error (${G.status})`)}return JSON.parse(J)}function k$6($){return F_$.includes($)}var A$6,H_$=524288,R$6=65536,I$6=1e4,N_$=2000,q$6,Qj0,xY,F_$,U_$=()=>{let $=new B1;return $.use("/:virtualMcpId/:branch/*",q$6),$.post("/:virtualMcpId/:branch/write",(Z)=>_Z(Z,"/_sandbox/write",{forwardJsonBody:!0,signal:xC(Z)})),$.post("/:virtualMcpId/:branch/unlink",(Z)=>_Z(Z,"/_sandbox/unlink",{forwardJsonBody:!0,signal:xC(Z)})),$.post("/:virtualMcpId/:branch/mkdir",(Z)=>_Z(Z,"/_sandbox/mkdir",{forwardJsonBody:!0,signal:xC(Z)})),$.post("/:virtualMcpId/:branch/rename",(Z)=>_Z(Z,"/_sandbox/rename",{forwardJsonBody:!0,signal:xC(Z)})),$.post("/:virtualMcpId/:branch/read",(Z)=>_Z(Z,"/_sandbox/read",{forwardJsonBody:!0,signal:xC(Z)})),$.post("/:virtualMcpId/:branch/glob",(Z)=>_Z(Z,"/_sandbox/glob",{forwardJsonBody:!0,signal:xC(Z)})),$.post("/:virtualMcpId/:branch/grep",(Z)=>_Z(Z,"/_sandbox/grep",{forwardJsonBody:!0,signal:xC(Z)})),$.post("/:virtualMcpId/:branch/exec/:script",async(Z)=>{let X=Z.req.param("script");if(!X)return Z.json({error:"missing script name"},400);return _Z(Z,`/_sandbox/exec/${encodeURIComponent(X)}`)}),$.post("/:virtualMcpId/:branch/exec/:script/kill",async(Z)=>{let X=Z.req.param("script");if(!X)return Z.json({error:"missing script name"},400);return _Z(Z,`/_sandbox/exec/${encodeURIComponent(X)}/kill`)}),$.get("/:virtualMcpId/:branch/config",(Z)=>_Z(Z,"/_sandbox/config",{method:"GET",map404to410:!0,redactRepoDirUnlessDesktop:!0})),$.put("/:virtualMcpId/:branch/config",(Z)=>_Z(Z,"/_sandbox/config",{method:"PUT",forwardJsonBody:!0,map404to410:!0})),$.post("/:virtualMcpId/:branch/setup/:step",async(Z)=>{let X=Z.req.param("step");if(!X||!k$6(X))return Z.json({error:`step must be one of: ${F_$.join(", ")}`},400);if(X==="start"){let Q=Z.get("vmClaim");if(Q.runner){let Y=r(Z.var.studioContext),G=Kw0(Q.virtualMcpMetadata);try{await Hw0({ctx:Z.var.studioContext,runner:Q.runner,handle:Q.claimName,orgId:Y.id,userId:Q.callerUserId,entries:G})}catch(J){let W=J instanceof Error?J.message:String(J);return Z.json({error:`Failed to push env to daemon: ${W}`},502)}}}return _Z(Z,`/_sandbox/setup/${X}`,{signal:Z.req.raw.signal,map404to410:!0})}),$.get("/:virtualMcpId/:branch/events",(Z)=>{let X=Z.get("vmClaim");if(!X.runner)return sN(Z,async(Q)=>{await Q.writeSSE({event:"phase",data:JSON.stringify({kind:"failed",reason:"unknown",message:"No sandbox runner configured on this studio instance."})})});return tC$(Z,{ctx:Z.var.studioContext,claimName:X.claimName,runner:X.runner,virtualMcpId:X.virtualMcpId,branch:X.branch,userId:X.userId,projectRef:X.projectRef,virtualMcpMetadata:X.virtualMcpMetadata})}),$.get("/:virtualMcpId/:branch/git/status",(Z)=>_Z(Z,"/_sandbox/git/status",{method:"GET",map404to410:!0,signal:AbortSignal.any([Z.req.raw.signal,AbortSignal.timeout(N_$)])})),$.post("/:virtualMcpId/:branch/git/status",(Z)=>_Z(Z,"/_sandbox/git/status",{map404to410:!0,signal:AbortSignal.any([Z.req.raw.signal,AbortSignal.timeout(N_$)])})),$.post("/:virtualMcpId/:branch/git/diff",(Z)=>_Z(Z,"/_sandbox/git/diff",{forwardJsonBody:!0,map404to410:!0})),$.post("/:virtualMcpId/:branch/git/publish",async(Z)=>{let X=yC(Z);if(X instanceof Response)return X;let{claimName:Q,virtualMcpMetadata:Y,connectionIds:G}=Z.get("vmClaim"),J=Z.var.studioContext;return C81(Q,async()=>{try{await A81(J,X,Q);let W=J_$(Y,G);if(W)await W_$(J,X,Q,W)}catch(W){if(W instanceof gg)return Z.json({error:W.message},403,xY);let K=W instanceof Error?W.message:String(W);return Z.json({error:K},502,xY)}return _Z(Z,"/_sandbox/git/publish",{forwardJsonBody:!0,map404to410:!0})})}),$.post("/:virtualMcpId/:branch/git/discard",(Z)=>{let{claimName:X}=Z.get("vmClaim");return C81(X,()=>_Z(Z,"/_sandbox/git/discard",{forwardJsonBody:!0,map404to410:!0}))}),$.post("/:virtualMcpId/:branch/git/rebase",async(Z)=>{let X=yC(Z);if(X instanceof Response)return X;let{claimName:Q}=Z.get("vmClaim"),Y=Z.var.studioContext;return C81(Q,async()=>{try{await A81(Y,X,Q)}catch(G){let J=G instanceof Error?G.message:String(G);return Z.json({error:J},502,xY)}return _Z(Z,"/_sandbox/git/rebase",{forwardJsonBody:!0,map404to410:!0})})}),$.post("/:virtualMcpId/:branch/git/suggest-commit",GZ({maxSize:H_$,onError:(Z)=>Z.json({error:"Payload too large"},413,xY)}),async(Z)=>{let X=yC(Z);if(X instanceof Response)return X;let{claimName:Q,userId:Y,projectRef:G}=Z.get("vmClaim"),J=Z.var.studioContext;try{let W=await Z.req.json().catch(()=>({})),K=W.status,H=W.diff,N=H!=null&&typeof H.diffs==="object"&&H.diffs!==null,[F,U]=I81(K)&&N?[K,H]:await Promise.all([Yj0(X,Q,"/_sandbox/git/status","GET",{userId:Y,projectRef:G}),Yj0(X,Q,"/_sandbox/git/diff","GET",{userId:Y,projectRef:G})]),w=await eC$(J,F,U);return Z.json(w,200,xY)}catch(W){let K=W instanceof Error?W.message:String(W);if(K==="SANDBOX_GONE")return Z.json({error:"Sandbox handle is gone. The sandbox needs to be re-provisioned."},410,xY);return Z.json({error:K},502,xY)}}),$.post("/:virtualMcpId/:branch/git/judge-review",GZ({maxSize:H_$,onError:(Z)=>Z.json({error:"Payload too large"},413,xY)}),async(Z)=>{let X=yC(Z);if(X instanceof Response)return X;let{claimName:Q,userId:Y,projectRef:G}=Z.get("vmClaim"),J=Z.var.studioContext;try{let W=await Z.req.json().catch(()=>({})),K=W.status,H=W.diff,N=H!=null&&typeof H.diffs==="object"&&H.diffs!==null,[F,U]=I81(K)&&N?[K,H]:await Promise.all([Yj0(X,Q,"/_sandbox/git/status","GET",{userId:Y,projectRef:G}),Yj0(X,Q,"/_sandbox/git/diff","GET",{userId:Y,projectRef:G})]),w=await Z_$(J,F,U,typeof W.language==="string"?W.language:void 0);return Z.json(w,200,xY)}catch(W){let K=W instanceof Error?W.message:String(W);if(K==="SANDBOX_GONE")return Z.json({error:"Sandbox handle is gone. The sandbox needs to be re-provisioned."},410,xY);return Z.json({error:K},502,xY)}}),$.get("/:virtualMcpId/:branch/preview-fetch",async(Z)=>{let X=yC(Z);if(X instanceof Response)return X;let{claimName:Q}=Z.get("vmClaim"),Y=Z.req.query("path");if(!Y||!Y.startsWith("/")||Y.startsWith("//")||Y.includes("..")||Y.includes("\\"))return Z.json({error:"Path not allowed"},403);let G;try{G=await X.getPreviewUrl(Q)}catch{return Z.json({error:"Preview not available"},502)}if(!G)return Z.json({error:"Preview not available"},502);let J=G.replace(/\/+$/,""),W=V81(`${J}${Y}`),K;try{K=await fetch(W?.url??`${J}${Y}`,{...W?{headers:{host:W.hostHeader}}:{}})}catch{return Z.json({error:"Preview unreachable"},502)}let H;try{H=await K.text()}catch{return Z.json({error:"Preview unreachable"},502)}return new Response(H,{status:K.status,headers:{"content-type":K.headers.get("content-type")??"application/json"}})}),$.post("/:virtualMcpId/:branch/preview-invoke",GZ({maxSize:R$6,onError:(Z)=>Z.json({error:"Payload too large"},413)}),async(Z)=>{let X=yC(Z);if(X instanceof Response)return X;let{claimName:Q}=Z.get("vmClaim"),Y;try{Y=await X.getPreviewUrl(Q)}catch{return Z.json({error:"Preview not available"},502)}if(!Y)return Z.json({error:"Preview not available"},502);let G;try{G=await Z.req.json()}catch{return Z.json({error:"Invalid JSON body"},400)}if(!G||typeof G!=="object"||Array.isArray(G))return Z.json({error:"Invalid JSON body"},400);let J=Q_$(G);if(!J)return Z.json({error:"Invalid or missing __resolveType"},400);let W=Y_$(Y,J.resolveType),K=V81(W),H;try{H=await fetch(K?.url??W,{method:"POST",headers:{"content-type":"application/json",...K?{host:K.hostHeader}:{}},body:JSON.stringify(J.payload),signal:AbortSignal.timeout(30000)})}catch{return Z.json({error:"Preview unreachable"},502)}let N;try{N=await H.text()}catch{return Z.json({error:"Preview unreachable"},502)}return new Response(N,{status:H.status,headers:{"content-type":H.headers.get("content-type")??"application/json"}})}),$};var w_$=B(()=>{v8();gO();yg();mC$();FN();nC$();j3();aw();pC$();oC$();gn0();Gp();k81();X_$();G_$();K_$();A$6=/^[a-zA-Z0-9][a-zA-Z0-9/._-]*$/;q$6=dC$(async($,Z)=>{let X=$.var.studioContext;try{$0(X)}catch{return $.json({error:"Unauthorized"},401)}let Q=W1(X);if(!Q)return $.json({error:"Unauthorized"},401);let Y;try{Y=r(X)}catch{return $.json({error:"Organization scope required"},403)}let G=$.req.param("virtualMcpId"),J=$.req.param("branch");if(!G||!J)return $.json({error:"virtualMcpId and branch are required"},400);try{T$6(J)}catch(w){let O=w instanceof Error?w.message:String(w);return $.json({error:O},400)}let W=await X.storage.virtualMcps.findById(G);if(!W||W.organization_id!==Y.id)return $.json({error:"Virtual MCP not found"},404);let K=In({orgId:Y.id,virtualMcpId:G,branch:J}),H=await zN(X,J,Q),N=iC$({userId:H,projectRef:K}),F=W.metadata??null,U;try{U=(await hX(X,{userId:H,branch:J,virtualMcpMetadata:F})).provider}catch{U=null}if(!U)return $.json({error:"No sandbox runner found"},404);return $.set("vmClaim",{claimName:N,callerUserId:Q,runner:U,virtualMcpId:G,branch:J,userId:H,projectRef:K,virtualMcpMetadata:F,connectionIds:W.connections?.map((w)=>w.connection_id)??[]}),Z()});Qj0=new Map;xY={"Cache-Control":"no-store, no-cache, must-revalidate",Pragma:"no-cache"};F_$=["clone","install","start"]});var O_$=($)=>{let Z=new B1;if(Z.use("*",MC),Z.route("/",jE0()),Z.route("/",Mk$()),Z.route("/",VC$()),Z.route("/",MC$()),Z.route("/",eE0()),Z.route("/tools",yC$()),Z.route("/",bC$()),Z.route("/",HC$({kvStorage:$.kvStorage})),Z.route("/",WC$()),Z.route("/fs",zC$({getConnection:$.getNatsConnection})),Z.route("/sandbox",U_$()),Z.route("/",RC$()),Z.route("/deco-sites",PE0()),Z.route("/sso",UE0()),Z.route("/",$j0({tokenStorage:$.tokenStorage,automationEventDispatcher:$.automationEventDispatcher})),Z.route("/webhooks",jk$()),$.mountDevAssets)Z.route("/dev-assets",AE0({orgFromPath:!0}));return Z.use("/mcp/:connectionId?",$.mcpAuth),Z.use("/mcp/:connectionId/ui-resource",$.mcpAuth),Z.use("/mcp/gateway/:virtualMcpId?",$.mcpAuth),Z.use("/mcp/virtual-mcp/:virtualMcpId?",$.mcpAuth),Z.use("/mcp/self",$.mcpAuth),Z.use("/mcp/task-run/:threadId",$.mcpAuth),Z.route("/",is1()),Z.get("/mcp/:gateway?/:connectionId/.well-known/oauth-protected-resource/*",$.betterAuthProtectedResourceHandler),Z.get("/mcp/.well-known/oauth-protected-resource",$.betterAuthProtectedResourceHandler),Z.route("/mcp/task-run",AC$()),Z.route("/mcp",pO0()),Z.route("/mcp/self",sE0()),Z.route("/mcp",rO0()),Z.all("/oauth-proxy/:connectionId/*",$.oauthProxyHandler),Z.get("/watch",$.watchHandler),Z};var B_$=B(()=>{v8();l11();zk$();p11();TE0();st();u11();KC$();NC$();PC$();bi();C11();aO0();O81();TC$();IC$();kC$();CC$();fC$();D81();gC$();L81();tO0();w_$()});function V$6($){return $.filter((Z)=>Z.vendors?.alias).map((Z)=>({name:Z.name,title:Z.title,description:Z.description,logo:Z.logo,category:Z.category,vendor:{alias:Z.vendors.alias,url:Z.vendors.url}}))}async function C$6($,Z){let X=await fetch(`${$}/rest/v1/apps?select=name,title,description,logo,category,vendors(alias,url)`,{headers:{apikey:Z,Authorization:`Bearer ${Z}`,Accept:"application/json"},signal:AbortSignal.timeout(S$6)});if(!X.ok){let Q=await X.text().catch(()=>X.statusText);throw console.error(`[deco-apps] Supabase error (${X.status}): ${Q.slice(0,200)}`),Error(`External service error (${X.status})`)}return await X.json()}var S$6=1e4,_$6=async($,Z)=>{if(!$.get("studioContext").auth.user?.id)return $.json({error:"Unauthorized"},401);return Z()},D_$=()=>{let $=new B1;return $.use("*",_$6),$.get("/",async(Z)=>{let X=c0(),Q=X.decoSupabaseUrl,Y=X.decoSupabaseServiceKey;if(!Q||!Y)return Z.json({apps:[]});try{let G=await C$6(Q,Y);return Z.json({apps:V$6(G)})}catch(G){return console.error("[deco-apps] GET error:",G),Z.json({error:"Failed to fetch apps"},502)}}),$};var L_$=B(()=>{v8();S$()});import{z as M1}from"zod";function bK($,Z="invalid_request_error",X=null,Q=null){return{error:{message:$,type:Z,param:X,code:Q}}}function l$6($){if(!$)return null;let Z=$.indexOf(":");if(Z===-1)return{credentialId:null,modelId:$};let X=$.substring(0,Z),Q=$.substring(Z+1);if(!X||!Q)return null;return{credentialId:X,modelId:Q}}function d$6($,Z,X){try{return JSON.parse($)}catch{throw new z_$(`Invalid JSON in tool call arguments for function '${X}' (tool_call_id: ${Z}): ${$}`)}}function m$6($){let Z={};for(let X of $)if(X.role==="assistant"&&X.tool_calls)for(let Q of X.tool_calls)Z[Q.id]=Q.function.name;return $.map((X)=>{switch(X.role){case"system":return{role:"system",content:X.content};case"user":if(typeof X.content==="string")return{role:"user",content:X.content};return{role:"user",content:X.content.map((Y)=>{if(Y.type==="text")return{type:"text",text:Y.text};return{type:"image",image:Y.image_url.url}})};case"assistant":if(X.tool_calls&&X.tool_calls.length>0)return{role:"assistant",content:X.tool_calls.map((Y)=>({type:"tool-call",toolCallId:Y.id,toolName:Y.function.name,input:d$6(Y.function.arguments,Y.id,Y.function.name)}))};return{role:"assistant",content:X.content??""};case"tool":let Q=Z[X.tool_call_id]??"unknown";return{role:"tool",content:[{type:"tool-result",toolCallId:X.tool_call_id,toolName:Q,output:{type:"text",value:X.content}}]}}})}function i$6($){let Z=$.map((X)=>{let Q=X.function.parameters?DY(X.function.parameters):DY({type:"object",properties:{}});return[X.function.name,_$({description:X.function.description,inputSchema:Q})]});return Object.fromEntries(Z)}function n$6($){if(!$)return;return{openai:{response_format:$}}}function p$6(){return`chatcmpl-${crypto.randomUUID().replace(/-/g,"").substring(0,29)}`}function E_$($,Z,X,Q,Y,G){let J={model:$,messages:Z,tools:X,temperature:Q.temperature,maxTokens:Q.max_tokens,topP:Q.top_p,frequencyPenalty:Q.frequency_penalty,presencePenalty:Q.presence_penalty,stopSequences:Q.stop?Array.isArray(Q.stop)?Q.stop:[Q.stop]:void 0,abortSignal:G};return Y?{...J,providerOptions:Y}:J}function j_$($){if($==="tool-calls")return"tool_calls";if($==="length")return"length";return"stop"}var v$6=256,b$6,f$6,x$6,y$6,g$6,h$6,u$6,c$6,z_$,P_$,A_$;var T_$=B(()=>{S4();v8();yg();CN();b$6=M1.object({type:M1.literal("function"),function:M1.object({name:M1.string(),description:M1.string().optional(),parameters:M1.record(M1.string(),M1.unknown()).optional()})}),f$6=M1.object({id:M1.string(),type:M1.literal("function"),function:M1.object({name:M1.string(),arguments:M1.string()})}),x$6=M1.discriminatedUnion("role",[M1.object({role:M1.literal("system"),content:M1.string(),name:M1.string().optional()}),M1.object({role:M1.literal("user"),content:M1.union([M1.string(),M1.array(M1.union([M1.object({type:M1.literal("text"),text:M1.string()}),M1.object({type:M1.literal("image_url"),image_url:M1.object({url:M1.string(),detail:M1.string().optional()})})]))]),name:M1.string().optional()}),M1.object({role:M1.literal("assistant"),content:M1.string().nullable().optional(),name:M1.string().optional(),tool_calls:M1.array(f$6).optional()}),M1.object({role:M1.literal("tool"),content:M1.string(),tool_call_id:M1.string()})]),y$6=M1.object({type:M1.literal("text")}),g$6=M1.object({type:M1.literal("json_object")}),h$6=M1.object({type:M1.literal("json_schema"),json_schema:M1.object({name:M1.string(),description:M1.string().optional(),schema:M1.record(M1.string(),M1.unknown()),strict:M1.boolean().optional()})}),u$6=M1.union([y$6,g$6,h$6]),c$6=M1.object({model:M1.string().describe("Format: 'model_id' or 'credential_id:model_id'"),messages:M1.array(x$6),stream:M1.boolean().optional().default(!1),temperature:M1.number().min(0).max(2).optional(),max_tokens:M1.number().positive().optional(),top_p:M1.number().min(0).max(1).optional(),frequency_penalty:M1.number().min(-2).max(2).optional(),presence_penalty:M1.number().min(-2).max(2).optional(),stop:M1.union([M1.string(),M1.array(M1.string())]).optional(),tools:M1.array(b$6).optional(),tool_choice:M1.union([M1.literal("auto"),M1.literal("none"),M1.literal("required"),M1.object({type:M1.literal("function"),function:M1.object({name:M1.string()})})]).optional(),response_format:u$6.optional(),user:M1.string().optional()});z_$=class z_$ extends Error{constructor($){super($);this.name="MessageConversionError"}};P_$=new B1;P_$.post("/:org/v1/chat/completions",async($)=>{let Z=$.get("studioContext"),X=$.req.param("org");try{if(!Z.auth.apiKey?.id)return $.json(bK("API key authentication required. Provide a valid API key via Authorization header.","authentication_error"),401);if(!Z.organization)return $.json(bK("Organization context is required. Ensure your API key has organization metadata.","invalid_request_error","organization"),400);if((Z.organization.slug??Z.organization.id)!==X)return $.json(bK("Organization mismatch. The API key's organization does not match the requested organization.","invalid_request_error","organization"),403);let Q=await $.req.json(),Y=c$6.safeParse(Q);if(!Y.success){let L=Y.error.issues[0]??{message:"Invalid request",path:[]};return $.json(bK(`Invalid request: ${L.message}`,"invalid_request_error",L.path.length>0?L.path.join("."):null),400)}let G=Y.data,J=l$6(G.model);if(!J)return $.json(bK("Invalid model format. Expected 'model_id' or 'credential_id:model_id' (e.g., 'claude-sonnet-4-6' or 'key_abc123:claude-sonnet-4-6')","invalid_request_error","model"),400);let{credentialId:W}=J,{modelId:K}=J;if(!W){let E=(await Z.storage.aiProviderKeys.list({organizationId:Z.organization.id})).find((j)=>aB(j.providerId));if(!E)return $.json(bK("No AI provider credentials configured for this organization. Add a credential in settings or specify one explicitly via 'credential_id:model_id'.","invalid_request_error","model"),400);W=E.id}let H;try{H=await Z.aiProviders.activate(W,Z.organization.id)}catch{return $.json(bK(`AI provider credential not found or inaccessible: ${W}`,"invalid_request_error","model"),404)}let N=H.aiSdk.languageModel(K),F=m$6(G.messages),U=G.tools?i$6(G.tools):void 0,w=n$6(G.response_format),O=p$6(),D=Math.floor(Date.now()/1000);if(G.stream)return sN($,async(L)=>{let E=E_$(N,F,U,G,w,$.req.raw.signal);try{let j=xw(E),z=!1,A=0,P="",M=async()=>{if(P.length===0)return;let k=P;P="",await L.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:D,model:G.model,choices:[{index:0,delta:{content:k},finish_reason:null}]})})};for await(let k of j.fullStream){if(!z&&(k.type==="text-delta"||k.type==="tool-call"))await L.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:D,model:G.model,choices:[{index:0,delta:{role:"assistant",content:""},finish_reason:null}]})}),z=!0;if(k.type==="text-delta"){if(P+=k.text,P.length>=v$6)await M()}else if(k.type==="tool-call"){await M();let q=A++;await L.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:D,model:G.model,choices:[{index:0,delta:{tool_calls:[{index:q,id:k.toolCallId,type:"function",function:{name:k.toolName,arguments:JSON.stringify(k.input)}}]},finish_reason:null}]})})}else if(k.type==="finish")await M(),await L.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:D,model:G.model,choices:[{index:0,delta:{},finish_reason:j_$(k.finishReason)}],usage:k.totalUsage?{prompt_tokens:k.totalUsage.inputTokens??0,completion_tokens:k.totalUsage.outputTokens??0,total_tokens:k.totalUsage.totalTokens??0}:void 0})})}await M(),await L.writeSSE({data:"[DONE]"})}catch(j){let z=j;console.error("[openai-compat:stream] Error:",z.message),await L.writeSSE({data:JSON.stringify({error:{message:z.message,type:"server_error"}})})}});else{let L=E_$(N,F,U,G,w,$.req.raw.signal),E=await bw(L),j={role:"assistant",content:E.text||null};if(E.toolCalls&&E.toolCalls.length>0)j.tool_calls=E.toolCalls.map((z)=>({id:z.toolCallId,type:"function",function:{name:z.toolName,arguments:JSON.stringify("input"in z?z.input:{})}})),j.content=null;return $.json({id:O,object:"chat.completion",created:D,model:G.model,choices:[{index:0,message:j,finish_reason:j_$(E.finishReason)}],usage:{prompt_tokens:E.usage?.inputTokens??0,completion_tokens:E.usage?.outputTokens??0,total_tokens:E.usage?.totalTokens??0}})}}catch(Q){let Y=Q;if(Y.name==="AbortError")return $.json(bK("Request aborted","invalid_request_error"),400);if(Y.name==="MessageConversionError")return $.json(bK(Y.message,"invalid_request_error","messages"),400);return console.error("[openai-compat] Error:",Y.message,Y.stack),$.json(bK(Y.message,"server_error"),500)}});A_$=P_$});var I_$;var R_$=B(()=>{I_$={name:"decocms",version:"4.193.2",description:"Deco CMS \u2014 Self-hostable MCP Gateway for managing AI connections and tools",author:"Deco team",repository:{type:"git",url:"git+https://github.com/decocms/studio.git",directory:"apps/api"},bugs:{url:"https://github.com/decocms/studio/issues"},type:"module",bin:{deco:"./dist/server/cli.js"},files:["dist/**/*"],scripts:{dev:"bun run migrate && bun run dev:server","dev:server":"bun run --cwd=../../packages/sandbox build && NODE_ENV=development bun --env-file=.env --hot run src/index.ts",build:"bun run build:server","build:server":"bun run scripts/bundle-server-script.ts --dist ./dist/server","generate:tool-contracts":"bun run scripts/generate-tool-contracts.ts","db:migrate":"bun run ./dist/server/migrate.js",check:"tsc --noEmit",start:"bun run ./dist/server/server.js",migrate:"bun run src/database/migrate.ts",test:"bun test src","better-auth:migrate":"bunx --bun @better-auth/cli migrate -y --config src/auth/index.ts",prepublishOnly:"bun run --cwd=../.. build:studio"},optionalDependencies:{"@duckdb/node-api":"^1.5.0-r.1"},dependencies:{"@ai-sdk/anthropic":"^3.0.85","@ai-sdk/google":"^3.0.83","@ai-sdk/openai":"^3.0.73","@anthropic-ai/sdk":"^0.105.0","@aws-sdk/client-s3":"^3.1013.0","@aws-sdk/client-sts":"^3.1013.0","@aws-sdk/lib-storage":"^3.1013.0","@aws-sdk/s3-request-presigner":"^3.1013.0","@clickhouse/client":"^1.8.1","@dbos-inc/dbos-sdk":"^4.21.6","@inkjs/ui":"^2.0.0","@nats-io/jetstream":"3.4.0","@nats-io/kv":"3.4.0","@nats-io/nats-core":"3.4.0","@nats-io/transport-node":"3.4.0","@openrouter/ai-sdk-provider":"^2.9.1","@opentelemetry/core":"^2.6.0","embedded-postgres":"^18.3.0-beta.16",ink:"^6.8.0",kysely:"^0.28.12","posthog-node":"^5.0.0",react:"^19.2.6","react-dom":"^19.2.6"},devDependencies:{"@ai-sdk/provider":"^3.0.10","@better-auth/sso":"1.4.1","@decocms/better-auth":"1.5.17","@decocms/bindings":"workspace:*","@decocms/mcp-utils":"workspace:*","@decocms/runtime":"workspace:*","@decocms/sandbox":"workspace:*","@decocms/shared":"workspace:*","@jitl/quickjs-wasmfile-release-sync":"0.31.0","@modelcontextprotocol/sdk":"1.29.0","@nats-io/jwt":"0.0.10-5","@opentelemetry/api":"^1.9.0","@opentelemetry/api-logs":"^0.211.0","@opentelemetry/exporter-logs-otlp-proto":"^0.211.0","@opentelemetry/exporter-prometheus":"^0.208.0","@opentelemetry/exporter-trace-otlp-proto":"^0.207.0","@opentelemetry/instrumentation-runtime-node":"^0.24.0","@opentelemetry/resources":"^2.6.0","@opentelemetry/sdk-logs":"^0.211.0","@opentelemetry/sdk-metrics":"^2.2.0","@opentelemetry/sdk-node":"^0.207.0","@opentelemetry/sdk-trace-base":"^2.5.0","@types/bun":"^1.3.1","@types/google.maps":"^3.65.2","@types/pg":"^8.15.6","@types/react-syntax-highlighter":"^15.5.13","@vercel/nft":"^1.1.1",ai:"^6.0.208","better-auth":"1.4.22",croner:"^9.1.0",degit:"^2.8.4",hono:"^4.10.7",jose:"^6.0.11",nanoid:"^5.1.6",pg:"^8.16.3",typescript:"^7.0.2",typescript5:"npm:typescript@^5.9.3",zod:"4.3.6"},homepage:"https://github.com/decocms/studio",keywords:["mcp","model-context-protocol","ai","gateway","self-hosted","tools"],license:"MIT",publishConfig:{access:"public"}}});function r$6(){let $=process.env.POSTHOG_KEY;if(!$)return null;return{key:$,host:process.env.POSTHOG_HOST??o$6}}var q_$,o$6="https://ph.studio.decocms.com",M_$;var k_$=B(()=>{v8();lC0();hV();BZ();S$();q11();R_$();q_$=new B1;q_$.get("/",($)=>{let Z={version:I_$.version,theme:oM1(),...XD().logo&&{logo:XD().logo},...NK()&&{internalUrl:a21()},...c0().enableDecoImport&&{enableDecoImport:!0},brandExtractEnabled:!!c0().firecrawlApiKey,auth:bM$(),posthog:r$6(),googleMapsApiKey:process.env.GOOGLE_MAPS_API_KEY?.trim()||null,runtime:{agentSandbox:!NK()&&c0().sandboxProviderKind==="agent-sandbox"}};return $.header("Cache-Control","no-store"),$.json({success:!0,config:Z})});M_$=q_$});function hg($){let Z=($??"").trim().toLowerCase();return Z=Z.replace(/^https?:\/\//,""),Z=Z.replace(/^www\./,""),Z=Z.split(/[/?#]/)[0]??"",Z.replace(/\/+$/,"")}function _81($){return(hg($).split(".")[0]||$).replace(/[-_]/g," ").split(" ").filter(Boolean).map((X)=>X.charAt(0).toUpperCase()+X.slice(1)).join(" ")}function V_$($,Z=64){return`https://www.google.com/s2/favicons?domain=${encodeURIComponent(hg($))}&sz=${Z}`}function S_$($,Z){let X=$.trim();if(X.length<=Z)return X;let Q=X.slice(0,Z-1),Y=Q.lastIndexOf(" ");return`${(Y>Z*0.6?Q.slice(0,Y):Q).trimEnd()}\u2026`}function C_$($){let{brand:Z,domain:X,score:Q,verdict:Y}=$,G=typeof Q==="number"?`${Z} commerce report \u2014 ${Math.round(Q)}/100 \xB7 decocms`:`${Z} commerce report \xB7 decocms`,J=`See the full ${Z} scorecard \u2014 SEO, performance, conversion & AEO signals scored by decocms.`,W=Y?.trim()?S_$(`${Y.trim().replace(/\s+/g," ")} \u2014 ${J}`,200):S_$(`How does ${X} really perform? ${J}`,200);return{title:G,description:W}}import{z as l0}from"zod";var gC,a$6,s$6,e$6,$86,__$;var v_$=B(()=>{gC=l0.enum(["good","bad","neutral"]),a$6=l0.preprocess(($)=>{if(Array.isArray($))return{kind:"text",value:$.find((X)=>X!==null&&typeof X!=="object")??""};return $!==null&&typeof $==="object"?$:{kind:"text",value:$}},l0.object({kind:l0.enum(["text","number","sparkline","badge","score"]).catch("text"),value:l0.coerce.string().optional(),tone:gC.optional(),muted:l0.boolean().optional(),delta:l0.coerce.string().optional(),deltaDir:l0.enum(["up","down","neutral"]).optional(),points:l0.array(l0.coerce.number()).optional(),label:l0.coerce.string().optional()}).transform(($)=>{if($.kind==="badge"&&$.label==null)$.label=$.value??"";if($.kind==="score"){let Z=Number($.value);if(Number.isNaN(Z))return{...$,kind:"text"}}return $})),s$6=l0.preprocess(($)=>{let Z=$;if(Z&&typeof Z==="object"&&!Array.isArray(Z)&&Array.isArray(Z.cells))Z=Z.cells;if(Array.isArray(Z)&&Z.length===1&&Array.isArray(Z[0]))Z=Z[0];if(Array.isArray(Z))return Z;if(Z&&typeof Z==="object")return Object.values(Z);return Z},l0.array(a$6)),e$6={key:l0.coerce.string(),title:l0.coerce.string(),eyebrow:l0.coerce.string().optional(),headline:l0.coerce.string(),annotation:l0.coerce.string().optional(),methodology:l0.coerce.string().optional(),sources:l0.array(l0.object({name:l0.coerce.string(),logoUrl:l0.coerce.string()})).optional()},$86=l0.discriminatedUnion("template",[l0.object({template:l0.literal("cover"),score:l0.object({value:l0.coerce.number(),max:l0.coerce.number().optional(),grade:l0.coerce.string().optional(),label:l0.coerce.string().optional()}).optional(),brandImage:l0.coerce.string().optional(),screenshot:l0.coerce.string().optional(),mobileScreenshot:l0.coerce.string().optional()}),l0.object({template:l0.literal("cta"),ctaUrl:l0.coerce.string().optional(),ctaLabel:l0.coerce.string().optional(),bullets:l0.array(l0.coerce.string()).optional()}),l0.object({template:l0.literal("series"),points:l0.array(l0.coerce.number()).min(2),xLabels:l0.array(l0.coerce.string()).min(1),unit:l0.coerce.string().optional(),callout:l0.object({index:l0.coerce.number(),value:l0.coerce.string(),tone:gC.optional()})}),l0.object({template:l0.literal("threshold"),value:l0.coerce.string().default(""),metricLabel:l0.coerce.string().optional(),ratio:l0.coerce.number(),thresholdRatio:l0.coerce.number().optional(),thresholdLabel:l0.coerce.string().default(""),tone:gC.optional()}),l0.object({template:l0.literal("stats"),stats:l0.array(l0.object({value:l0.coerce.string(),label:l0.coerce.string(),tone:gC.optional()})).min(1)}),l0.object({template:l0.literal("bars"),items:l0.array(l0.object({value:l0.coerce.string(),label:l0.coerce.string(),ratio:l0.coerce.number(),tone:gC.optional()})).min(1)}),l0.object({template:l0.literal("gauges"),gauges:l0.array(l0.object({label:l0.coerce.string(),value:l0.coerce.string(),status:l0.enum(["good","warn","bad"]).catch("warn"),caption:l0.coerce.string().optional(),ratio:l0.coerce.number().optional()})).min(1)}),l0.object({template:l0.literal("checklist"),checks:l0.array(l0.object({label:l0.coerce.string(),status:l0.enum(["pass","fail","warn"]).catch("fail"),value:l0.coerce.string().optional()})).min(1)}),l0.object({template:l0.literal("table"),columns:l0.array(l0.object({label:l0.coerce.string(),align:l0.enum(["left","right"]).optional()})).min(1),rows:l0.array(s$6).min(1),highlightRow:l0.coerce.number().optional()}),l0.object({template:l0.literal("products"),products:l0.array(l0.object({name:l0.coerce.string(),price:l0.coerce.string().optional(),image:l0.coerce.string().optional(),url:l0.coerce.string().optional()})).min(1)}),l0.object({template:l0.literal("list"),entries:l0.array(l0.object({label:l0.coerce.string(),severity:l0.enum(["error","warning","notice"]).catch("notice")})).min(1),moreCount:l0.coerce.number().optional()}),l0.object({template:l0.literal("keywords"),volumeLabel:l0.coerce.string().optional(),keywords:l0.array(l0.object({term:l0.coerce.string(),volume:l0.coerce.string(),position:l0.coerce.number().catch(0)})).min(1)}),l0.object({template:l0.literal("competitor"),metricLabel:l0.coerce.string().optional(),competitors:l0.array(l0.object({name:l0.coerce.string(),value:l0.coerce.string(),tone:gC.optional(),isYou:l0.boolean().optional()})).min(1)}),l0.object({template:l0.literal("scorecard"),rivalLabel:l0.coerce.string().optional(),dimensions:l0.array(l0.object({label:l0.coerce.string(),you:l0.coerce.string(),rival:l0.coerce.string().optional(),rivalName:l0.coerce.string().optional(),tone:gC.optional()})).min(1)})]),__$=l0.object({...e$6,template:$86})});function Gj0($){let Z=[],X=[...$.sections].sort((Q,Y)=>Q.position-Y.position).map((Q)=>{let Y=__$.safeParse(Q.props);if(Y.success)return Y.data;let G=Y.error.issues[0];return Z.push({section_type:Q.section_type,position:Q.position,reason:G?`${G.path.join(".")||"(root)"}: ${G.message}`:"contract violation"}),null}).filter((Q)=>Q!==null);return{deck:{meta:{...$.meta,scores:$.summary?.scores},slides:X},drops:Z}}var v81=B(()=>{v_$()});import{join as b_$}from"path";async function X86($){try{let Z=await fetch(`${LW({})}/api/v2/public/diagnostics/${encodeURIComponent($)}`,{headers:{Accept:"application/json"},signal:AbortSignal.timeout(Z86)});if(!Z.ok)return null;let X=await Z.json(),{deck:Q}=Gj0(X);if(!Q.slides.length)return null;let Y=Q.slides.find((W)=>W.template.template==="cover"),G=Y?.template,J=G&&G.template==="cover"?G:void 0;return{brand:Q.meta.brand?.trim()||_81($),score:Q.meta.scores?.cover??J?.score?.value,verdict:Y?.annotation?.trim()||Y?.headline?.trim()||void 0}}catch{return null}}function yY($){return $.replaceAll("&","&amp;").replaceAll("<","&lt;").replaceAll(">","&gt;").replaceAll('"',"&quot;")}function Q86($,Z){let X=hg($),Q=Z?.brand?.trim()||_81(X),Y=V_$(X,128),J=`${(c0().baseUrl??"https://studio.decocms.com").replace(/\/+$/,"")}/report/${encodeURIComponent(X)}`,{title:W,description:K}=C_$({brand:Q,domain:X,score:Z?.score,verdict:Z?.verdict}),H=`${J}/og.png`,N=`${Q} commerce report by decocms`;return[`<title>${yY(W)}</title>`,`<meta name="description" content="${yY(K)}" />`,'<meta name="robots" content="noindex, follow" />','<meta property="og:type" content="website" />','<meta property="og:site_name" content="decocms" />',`<meta property="og:title" content="${yY(W)}" />`,`<meta property="og:description" content="${yY(K)}" />`,`<meta property="og:url" content="${yY(J)}" />`,`<meta property="og:image" content="${yY(H)}" />`,'<meta property="og:image:width" content="1200" />','<meta property="og:image:height" content="630" />',`<meta property="og:image:alt" content="${yY(N)}" />`,'<meta name="twitter:card" content="summary_large_image" />',`<meta name="twitter:title" content="${yY(W)}" />`,`<meta name="twitter:description" content="${yY(K)}" />`,`<meta name="twitter:image" content="${yY(H)}" />`,`<meta name="twitter:image:alt" content="${yY(N)}" />`,`<link rel="canonical" href="${yY(J)}" />`,`<link rel="icon" href="${yY(Y)}" sizes="any" />`].join(`
     `)}function Y86($,Z){return $.replace(/<title>[\s\S]*?<\/title>\s*/i,"").replace(/<meta\s+name="(?:description|twitter:[^"]*)"[^>]*>\s*/gi,"").replace(/<meta\s+property="og:[^"]*"[^>]*>\s*/gi,"").replace(/<link\s+rel="icon"[^>]*>\s*/gi,"").replace("</head>",`    ${Z}
   </head>`)}function f_$($){let Z=new B1;return Z.get("/:domain/og.png",async(X)=>{let Q=hg(X.req.param("domain")),Y=async()=>{let G=$?Bun.file(b_$($,"report-og-fallback.png")):null;if(!G||!await G.exists())return X.notFound();return X.body(new Uint8Array(await G.arrayBuffer()),200,{"Content-Type":"image/png","Cache-Control":"public, max-age=0, s-maxage=3600"})};try{let G=await fetch(`${LW({})}/api/v2/public/diagnostics/${encodeURIComponent(Q)}/og.png`,{signal:AbortSignal.timeout(G86)}),J=G.headers.get("content-type")??"";if(!G.ok||!J.startsWith("image/")||!G.body)return Y();return X.body(G.body,200,{"Content-Type":J,"Cache-Control":"public, max-age=0, s-maxage=604800"})}catch{return Y()}}),Z.get("/:domain",async(X)=>{let Q=X.req.param("domain"),Y=$?b_$($,"index.html"):null,G=Y?Bun.file(Y):null;if(!G||!await G.exists())return X.notFound();let J=await G.text();try{let W=await X86(hg(Q)),K=Q86(Q,W);return X.html(Y86(J,K),200,{"Cache-Control":"public, max-age=0, s-maxage=300"})}catch{return X.html(J)}}),Z}var Z86=2500,G86=1e4;var x_$=B(()=>{v8();v81();SD();S$()});function Io($,Z){return fetch(`${LW({})}${$}`,Z)}async function J86($,Z,X){let Q=new URLSearchParams;if(Z)Q.set("pw",Z);if(X)Q.set("lang",X);let Y=Q.toString()?`?${Q.toString()}`:"",G=await Io(`/api/v2/public/diagnostics/${encodeURIComponent($)}${Y}`,{headers:{Accept:"application/json"}});if(G.status===404)return{status:"not_found",deck:null,scanned_at:null,drops:[]};if(!G.ok)throw Error(`report read HTTP ${G.status}`);let J=await G.json(),{deck:W,drops:K}=Gj0(J);return{status:W.slides.length?"ready":"empty",deck:W,scanned_at:J.scanned_at,drops:K}}var W86,x3,Jj0=async($,Z)=>{if(!$.get("reportUser"))return $.json({error:"Authentication required"},401);await Z();return},y_$;var g_$=B(()=>{v8();qG();SD();v81();W86=new Set(["complete","errored","terminated","unknown"]),x3=new B1;x3.use("*",async($,Z)=>{let X=await E8.api.getSession({headers:$.req.raw.headers});$.set("reportUser",X?.user?.id?{email:X.user.email}:void 0),await Z(),$.header("Cache-Control","private, no-store"),$.header("Vary","Cookie");return});x3.use("/run",Jj0);x3.use("/status",Jj0);x3.use("/link-token/*",Jj0);x3.use("/suggest",Jj0);x3.get("/site/:domain",async($)=>{let Z=$.req.param("domain").trim();if(!Z)return $.json({error:"domain is required"},400);let X=$.get("reportUser"),Q=$.req.query("key")?.trim()||void 0,Y=$.req.query("lang")?.trim()||void 0;try{let G=await J86(Z,Q,Y);if($.header("Cache-Control","private, no-store"),X||!G.deck)return $.json(G);return $.json({...G,deck:{...G.deck,slides:G.deck.slides.slice(0,1)},truncated:G.status==="ready"})}catch{return $.json({error:"report read failed"},502)}});x3.post("/run",async($)=>{let Z=$.get("reportUser"),X;try{X=await $.req.json()}catch{return $.json({error:"invalid JSON"},400)}let Q=typeof X.domain==="string"?X.domain.trim():"";if(!Q)return $.json({error:"domain is required"},400);let Y=Z.email,G=typeof X.distinctId==="string"&&X.distinctId.trim()&&X.distinctId.length<=200?X.distinctId.trim():void 0;try{let J=await Io("/api/v2/diagnostics/run",{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${kD({})}`},body:JSON.stringify({url:Q,email:Y,distinct_id:G})});if(!J.ok)return $.json({error:`run HTTP ${J.status}`},502);let W=await J.json(),K=W.blocked?{state:"blocked"}:W.status==="fresh"?{state:"fresh"}:W.mode==="sync"?{state:"sync"}:{state:"running",id:W.id??null};return $.json(K)}catch{return $.json({error:"run failed"},502)}});x3.get("/status",async($)=>{let Z=$.req.query("id");if(!Z)return $.json({error:"id is required"},400);try{let X=await Io(`/api/v2/diagnostics/status?id=${encodeURIComponent(Z)}`,{headers:{Authorization:`Bearer ${kD({})}`}});if(!X.ok)return $.json({error:`status HTTP ${X.status}`},502);let Y=(await X.json()).status??"unknown",G={done:W86.has(Y),status:Y};return $.json(G)}catch{return $.json({error:"status failed"},502)}});x3.get("/link-token/:id",async($)=>{let Z=$.req.param("id");try{let X=await Io(`/api/v2/public/link-tokens/${encodeURIComponent(Z)}`,{headers:{Accept:"application/json"}});if(X.status===404)return $.json(null);if(!X.ok)return $.json({error:`link token HTTP ${X.status}`},502);return $.json(await X.json())}catch{return $.json({error:"link token resolve failed"},502)}});x3.get("/suggest",async($)=>{let Z=($.req.query("q")??"").trim().slice(0,64);if(Z.length<2)return $.json({suggestions:[]});try{let X=await Io(`/api/v2/public/suggest?q=${encodeURIComponent(Z)}`,{headers:{Accept:"application/json"}});if(!X.ok)return $.json({suggestions:[]});let Q=await X.json();return $.json({suggestions:Array.isArray(Q.suggestions)?Q.suggestions:[]})}catch{return $.json({suggestions:[]})}});y_$=x3});import{createHmac as K86,timingSafeEqual as H86}from"crypto";function h_$($,Z,X,Q=Date.now()){if(!Z||!X)return!1;let Y,G=[];for(let H of Z.split(",")){let N=H.indexOf("=");if(N<=0)continue;let F=H.slice(0,N).trim(),U=H.slice(N+1).trim();if(F==="t")Y=U;else if(F==="v1")G.push(U)}if(!Y||G.length===0)return!1;let J=Number(Y);if(!Number.isFinite(J)||Math.abs(Q/1000-J)>N86)return!1;let W=K86("sha256",X).update(`${Y}.${$}`).digest("hex"),K=Buffer.from(W,"hex");return G.some((H)=>{let N=Buffer.from(H,"hex");return K.length===N.length&&H86(K,N)})}function u_$($){let Z;try{Z=JSON.parse($)}catch{return null}let X=oG(Z),Q=oG(oG(X?.data)?.object);if(!X||typeof X.type!=="string"||!Q)return null;return{id:fK(X.id),type:X.type,created:typeof X.created==="number"?X.created:void 0,livemode:typeof X.livemode==="boolean"?X.livemode:void 0,data:{object:Q}}}function F86($){switch($){case"active":case"trialing":return"active";case"past_due":return"past_due";default:return"canceled"}}function fK($){return typeof $==="string"?$:void 0}function oG($){return typeof $==="object"&&$!==null?$:void 0}function Wj0($){return typeof $==="number"?new Date($*1000):null}function x81($){return fK($)??fK(oG($)?.id)}function U86($){return x81($.subscription)??fK(oG(oG($.parent)?.subscription_details)?.subscription)}function w86($){let Z=Wj0($.current_period_end);if(Z)return Z;let X=oG($.items)?.data;if(!Array.isArray(X))return null;let Q=0;for(let Y of X){let G=oG(Y)?.current_period_end;if(typeof G==="number"&&G>Q)Q=G}return Q>0?new Date(Q*1000):null}function b81($,Z){let X=Wj0($.created);return!!X&&!!Z.lastStripeEventAt&&X<Z.lastStripeEventAt}function f81($,Z){let X=Wj0($.created);if(!X)return;return Z.lastStripeEventAt&&Z.lastStripeEventAt>X?void 0:X}async function O86($,Z){let X=Z.data.object;switch(Z.type){case"checkout.session.completed":case"checkout.session.async_payment_succeeded":{let Q=fK(oG(X.metadata)?.orgId);if(!Q)return{handled:!1,reason:"no orgId"};if(fK(oG(X.metadata)?.kind)==="topup"){if(X.mode!=="payment")return{handled:!1,reason:"topup with wrong mode"};if(fK(X.payment_status)!=="paid")return{handled:!1,reason:"payment not confirmed"};let J=fK(X.id);if(!J)return console.error("stripe webhook: topup session without id",{eventId:Z.id,organizationId:Q}),{handled:!1,reason:"topup session without id"};let W=Number(oG(X.metadata)?.creditCents);if(!Number.isInteger(W)||W<=0)return console.error("stripe webhook: paid topup with bad metadata \u2014 credit NOT applied",{eventId:Z.id,organizationId:Q,creditCents:oG(X.metadata)?.creditCents}),{handled:!1,reason:"bad topup metadata"};return{handled:!0,organizationId:Q,topUp:{creditCents:W,referenceId:`stripe-topup:${J}`}}}if(X.mode!=="subscription")return{handled:!1,reason:"not a subscription checkout"};if(fK(X.payment_status)!=="paid")return{handled:!1,reason:"payment not confirmed"};let Y=await $.getBilling(Q);if(!Y)return{handled:!1,reason:"unknown org"};let G=x81(X.subscription);if(Y.stripeSubscriptionId&&G&&Y.stripeSubscriptionId!==G)return console.error("stripe webhook: refused checkout rebind",{organizationId:Q,eventId:Z.id}),{handled:!1,reason:"org already bound to another subscription",orphanSubscriptionId:G};if(b81(Z,Y))return{handled:!1,reason:"stale event"};return await $.updateStripeState(Q,{stripeCustomerId:x81(X.customer),stripeSubscriptionId:G,status:"active",lastStripeEventAt:f81(Z,Y)}),{handled:!0,organizationId:Q}}case"customer.subscription.updated":case"customer.subscription.deleted":{let Q=fK(X.id);if(!Q)return{handled:!1,reason:"no sub id"};let Y=await $.getBillingByStripeSubscriptionId(Q);if(!Y)return{handled:!1,reason:"unknown subscription"};let G=Z.type==="customer.subscription.deleted";if(!G&&b81(Z,Y))return{handled:!1,reason:"stale event"};let J=G?"canceled":F86(X.status);return await $.updateStripeState(Y.organizationId,{status:J,currentPeriodEnd:w86(X),...G&&{stripeSubscriptionId:null},lastStripeEventAt:f81(Z,Y)}),{handled:!0,organizationId:Y.organizationId}}case"invoice.paid":{let Q=U86(X);if(!Q)return{handled:!1,reason:"no sub id"};let Y=await $.getBillingByStripeSubscriptionId(Q);if(!Y)return{handled:!1,reason:"unknown subscription"};if(b81(Z,Y))return{handled:!1,reason:"stale event"};return await $.updateStripeState(Y.organizationId,{status:"active",currentPeriodEnd:Wj0(X.period_end),lastStripeEventAt:f81(Z,Y)}),{handled:!0,organizationId:Y.organizationId}}default:return{handled:!1,reason:`unhandled event ${Z.type}`}}}async function c_$($){let Z=new kW(c8().db),X=await O86(Z,$);if(X.handled&&X.topUp)await mF$({organizationId:X.organizationId,amountCents:X.topUp.creditCents,referenceId:X.topUp.referenceId});if(!X.handled&&X.orphanSubscriptionId)try{await _1$(X.orphanSubscriptionId),console.error("stripe webhook: canceled orphan subscription",{subscriptionId:X.orphanSubscriptionId,eventId:$.id})}catch(Q){if(!(Q instanceof K3&&(Q.status===400||Q.status===404)))throw Q}return X}var N86=300;var l_$=B(()=>{GG();Jn();Ur0()});var B86=1048576,y81;var d_$=B(()=>{v8();gO();S$();l_$();y81=new B1;y81.post("/webhook",GZ({maxSize:B86,onError:($)=>$.json({error:"payload too large"},413)}),async($)=>{let Z=c0().stripeWebhookSecret;if(!Z)return $.json({error:"stripe billing not configured"},503);let X=await $.req.text();if(!h_$(X,$.req.header("stripe-signature"),Z))return $.json({error:"invalid signature"},400);let Y=u_$(X);if(!Y)return $.json({error:"invalid payload"},400);let G=await c_$(Y);return console.log("stripe webhook",{eventId:Y.id,type:Y.type,livemode:Y.livemode,...G}),$.json({received:!0})})});import{timingSafeEqual as D86}from"crypto";function E86($,Z,X){if(!Z?.startsWith("sha256="))return!1;let Q=new Bun.CryptoHasher("sha256",X).update($).digest("hex"),Y=Z.slice(7);if(Y.length!==Q.length)return!1;return D86(Buffer.from(Y),Buffer.from(Q))}var L86=5242880,g81;var m_$=B(()=>{v8();gO();Xp();g81=new B1;g81.post("/webhook",GZ({maxSize:L86,onError:($)=>$.json({error:"payload too large"},413)}),async($)=>{let Z=process.env.GITHUB_WEBHOOK_SECRET;if(!Z)return $.json({error:"github webhook not configured"},503);let X=await $.req.text();if(!E86(X,$.req.header("x-hub-signature-256"),Z))return $.json({error:"invalid signature"},400);if($.req.header("x-github-event")!=="push")return $.json({ok:!0,ignored:"event"});let Q;try{Q=JSON.parse(X)}catch{return $.json({error:"invalid payload"},400)}let Y=Q.ref,G=Q.repository?.full_name;if(!Y||!G)return $.json({ok:!0,ignored:"shape"});let W=(await vn0())?.markTenantPoolsDirty(G,Y)??[];return $.json({ok:!0,pools:W})})});function i_$($,Z){if(Z.startsWith("text/html")||Z.startsWith("image/svg"))$.set("Content-Security-Policy","sandbox allow-scripts allow-modals allow-same-origin")}var n_$,j86,z86,p_$;var t_$=B(()=>{v8();RJ();Yy();Av();n_$=new B1,j86=["range","if-none-match","if-modified-since"],z86=["content-type","content-length","content-range","accept-ranges","etag","last-modified"];n_$.get("/:org/files/*",async($)=>{let Z=$.get("studioContext"),X=Z.organization?.id;if(!Z.auth?.user?.id){if(Eg($))return $.redirect(`/login?next=${encodeURIComponent($.req.path)}`,302);throw new Q$(401,{message:"Authentication required"})}if(!X)throw new Q$(401,{message:"Organization context required"});let Q=$.req.path.replace(/^.*\/files\//,"");if(!Q)throw new Q$(400,{message:"Missing file key"});let Y=await zp(Q,Z);if(!Y)throw new Q$(503,{message:"Object storage not configured"});if(Y.startsWith("data:")&&TJ()){let K=Y.match(/^data:([^;]+);base64,(.+)$/s);if(!K)throw new Q$(500,{message:"Invalid data URL from storage"});let[,H,N]=K,F=Buffer.from(N,"base64"),U=new Headers({"Content-Type":H,"Cache-Control":"private, max-age=86400"});return i_$(U,H),new Response(F,{status:200,headers:U})}let G=new Headers;for(let K of j86){let H=$.req.header(K);if(H)G.set(K,H)}let J=await fetch(Y,{headers:G});if(J.status===403||J.status===404)throw new Q$(404,{message:"File not found"});if(!J.ok&&J.status!==304&&J.status!==416)throw console.error(`[files] upstream storage error ${J.status} for key:`,Q),new Q$(502,{message:"Upstream storage error"});let W=new Headers;for(let K of z86){let H=J.headers.get(K);if(H)W.set(K,H)}return W.set("Cache-Control","private, max-age=86400"),i_$(W,W.get("content-type")??""),new Response(J.body,{status:J.status,headers:W})});p_$=n_$});var qo=C((hC)=>{var P86=hC&&hC.__createBinding||(Object.create?function($,Z,X,Q){if(Q===void 0)Q=X;var Y=Object.getOwnPropertyDescriptor(Z,X);if(!Y||("get"in Y?!Z.__esModule:Y.writable||Y.configurable))Y={enumerable:!0,get:function(){return Z[X]}};Object.defineProperty($,Q,Y)}:function($,Z,X,Q){if(Q===void 0)Q=X;$[Q]=Z[X]}),A86=hC&&hC.__exportStar||function($,Z){for(var X in $)if(X!=="default"&&!Object.prototype.hasOwnProperty.call(Z,X))P86(Z,$,X)};Object.defineProperty(hC,"__esModule",{value:!0});A86(oQ(),hC)});var a_$=C((o_$)=>{Object.defineProperty(o_$,"__esModule",{value:!0});o_$.version=void 0;o_$.version="3.4.0"});var $v$=C((xK)=>{var T86=xK&&xK.__importDefault||function($){return $&&$.__esModule?$:{default:$}};Object.defineProperty(xK,"__esModule",{value:!0});xK.NodeTransport=xK.VERSION=void 0;xK.nodeResolveHost=S86;var l6=qo(),R86=z0("net"),h81=z0("tls"),I86=z0("path"),s_$=z0("fs"),q86=T86(z0("dns")),M86=a_$();xK.VERSION=M86.version;var k86="nats.js";class e_${socket;version;lang;yields=[];signal=(0,l6.deferred)();closedNotification=(0,l6.deferred)();options;connected=!1;tlsName="";done=!1;closeError;constructor(){this.lang=k86,this.version=xK.VERSION}async connect($,Z){this.tlsName=$.tlsName,this.options=Z;let{tls:X}=this.options,{handshakeFirst:Q}=X||{};try{if(Q===!0)this.socket=await this.tlsFirst($);else this.socket=await this.dial($);if(this.done)this.socket?.destroy();let Y=await this.peekInfo();(0,l6.checkOptions)(Y,Z);let{tls_required:G,tls_available:J}=Y,W=J===!0&&Z.tls!==null;if(!Q&&(G||W))this.socket=await this.startTLS();if(this.done)this.socket?.destroy();if(G&&this.socket.encrypted!==!0)throw l6.errors.InvalidArgumentError.format("tls","is not available on this server");return this.connected=!0,this.setupHandlers(),this.signal.resolve(),Promise.resolve()}catch(Y){let G=Y;if(!G)G=new l6.errors.ConnectionError("error connecting - node provided an undefined error");let{code:J}=G,W=J==="ECONNREFUSED"?new l6.errors.ConnectionError("connection refused",{cause:G}):G;throw this.socket?.destroy(),W}}dial($){let Z=(0,l6.deferred)(),X,Q=(0,R86.createConnection)($.port,$.hostname,()=>{Z.resolve(Q),Q.removeAllListeners()});return Q.on("error",(Y)=>{X=Y}),Q.on("close",()=>{Q.removeAllListeners(),Z.reject(X)}),Q.setNoDelay(!0),Z}get isClosed(){return this.done}close($){return this._closed($,!1)}peekInfo(){let $=(0,l6.deferred)(),Z;return this.socket.on("data",(X)=>{this.yields.push(X);let Q=l6.DataBuffer.concat(...this.yields),Y=(0,l6.extractProtocolMessage)(Q);if(Y!=="")try{let G=l6.INFO.exec(Y);if(!G)throw Error("unexpected response from server");let J=JSON.parse(G[1]);$.resolve(J)}catch(G){$.reject(G)}finally{this.socket.removeAllListeners()}}),this.socket.on("error",(X)=>{Z=X}),this.socket.on("close",()=>{this.socket.removeAllListeners(),$.reject(Z)}),$}loadFile($){if(!$)return Promise.resolve();let Z=(0,l6.deferred)();try{if($=(0,I86.resolve)($),!(0,s_$.existsSync)($))Z.reject(Error(`${$} doesn't exist`));(0,s_$.readFile)($,(X,Q)=>{if(X)return Z.reject(X);Z.resolve(Q)})}catch(X){Z.reject(X)}return Z}async loadClientCerts(){let $={},{certFile:Z,cert:X,caFile:Q,ca:Y,keyFile:G,key:J}=this.options.tls;try{if(Z){let W=await this.loadFile(Z);if(W)$.cert=W}else if(X)$.cert=X;if(G){let W=await this.loadFile(G);if(W)$.key=W}else if(J)$.key=J;if(Q){let W=await this.loadFile(Q);if(W)$.ca=[W]}else if(Y)$.ca=Y;return Promise.resolve($)}catch(W){return Promise.reject(W)}}async tlsFirst($){let Z,X={servername:this.tlsName,rejectUnauthorized:!0};if(this.socket)X.socket=this.socket;if(typeof this.options.tls==="object")try{let Y=await this.loadClientCerts()||{};X=(0,l6.extend)(X,this.options.tls,Y)}catch(Y){return Promise.reject(new l6.errors.ConnectionError(Y.message,{cause:Y}))}let Q=(0,l6.deferred)();try{let Y=(0,h81.connect)($.port,$.hostname,X,()=>{Y.removeAllListeners(),Q.resolve(Y)});Y.on("error",(G)=>{Z=G}),Y.on("secureConnect",()=>{if(X.rejectUnauthorized===!1)return;if(!Y.authorized)throw Y.authorizationError}),Y.on("close",()=>{Q.reject(Z),Y.removeAllListeners()}),Y.setNoDelay(!0)}catch(Y){Q.reject(new l6.errors.ConnectionError(Y.message,{cause:Y}))}return Q}async startTLS(){let $,Z={socket:this.socket,servername:this.tlsName,rejectUnauthorized:!0};if(typeof this.options.tls==="object")try{let Q=await this.loadClientCerts()||{};Z=(0,l6.extend)(Z,this.options.tls,Q)}catch(Q){return Promise.reject(new l6.errors.ConnectionError(Q.message,{cause:Q}))}let X=(0,l6.deferred)();try{let Q=(0,h81.connect)(Z,()=>{Q.removeAllListeners(),X.resolve(Q)});Q.on("error",(Y)=>{$=Y}),Q.on("secureConnect",()=>{if(Z.rejectUnauthorized===!1)return;if(!Q.authorized)throw Q.authorizationError}),Q.on("close",()=>{X.reject($),Q.removeAllListeners()})}catch(Q){X.reject(new l6.errors.ConnectionError(Q.message,{cause:Q}))}return X}setupHandlers(){let $;this.socket.on("data",(Z)=>{return this.yields.push(Z),this.signal.resolve()}),this.socket.on("error",(Z)=>{$=Z}),this.socket.on("end",()=>{if(this.socket?.destroyed)return;this.socket?.write(new Uint8Array(0),()=>{this.socket?.end()})}),this.socket.on("close",()=>{this._closed($,!1)})}[Symbol.asyncIterator](){return this.iterate()}async*iterate(){while(!0){if(this.yields.length===0)await this.signal;let $=this.yields;this.yields=[];for(let Z=0;Z<$.length;Z++){if(this.options.debug)console.info(`> ${(0,l6.render)($[Z])}`);yield $[Z]}if(this.done)break;else if(this.yields.length===0)$.length=0,this.yields=$,this.signal=(0,l6.deferred)()}}discard(){if(this.done=!0,this.socket)try{this.socket.removeAllListeners(),this.socket.destroy()}catch{}}disconnect(){this._closed(void 0,!0).then().catch()}isEncrypted(){return this.socket instanceof h81.TLSSocket}_send($){if(this.isClosed||this.socket===void 0)return Promise.resolve();if(this.options.debug)console.info(`< ${(0,l6.render)($)}`);let Z=(0,l6.deferred)();try{this.socket.write($,(X)=>{if(X){if(this.options.debug)console.error(`!!! ${(0,l6.render)($)}: ${X}`);return Z.reject(X)}return Z.resolve()})}catch(X){if(this.options.debug)console.error(`!!! ${(0,l6.render)($)}: ${X}`);Z.reject(X)}return Z}send($){this._send($).catch((X)=>{})}async _closed($,Z=!0){if(!this.connected)return;if(this.done){this.socket?.destroy();return}if(this.closeError=$,!$&&this.socket&&Z)try{await this._send(new TextEncoder().encode(""))}catch(X){if(this.options.debug)console.log("transport close terminated with an error",X)}try{if(this.socket)this.socket.removeAllListeners(),this.socket?.destroy(),this.socket=void 0}catch(X){console.log(X)}this.done=!0,this.closedNotification.resolve(this.closeError)}closed(){return this.closedNotification}}xK.NodeTransport=e_$;function S86($){let Z=(0,l6.deferred)();return q86.default.lookup($,{all:!0},(X,Q)=>{if(X){Z.reject(X);return}let Y=[];for(let G of Q)Y.push(G.address);if(Y.length===0)Y.push($);Z.resolve(Y)}),Z}});var Gv$=C((Yv$)=>{Object.defineProperty(Yv$,"__esModule",{value:!0});Yv$.connect=V86;var Zv$=$v$(),Xv$=qo(),Qv$=qo();function V86($={}){if((0,Qv$.hasWsProtocol)($))return Promise.reject(Qv$.errors.InvalidArgumentError.format("servers","node client doesn't support websockets, use the 'wsconnect' function instead"));return(0,Xv$.setTransportFactory)({factory:()=>{return new Zv$.NodeTransport},dnsResolveFn:Zv$.nodeResolveHost}),Xv$.NatsConnectionImpl.connect($)}});var Jv$=C((eN)=>{var _86=eN&&eN.__createBinding||(Object.create?function($,Z,X,Q){if(Q===void 0)Q=X;var Y=Object.getOwnPropertyDescriptor(Z,X);if(!Y||("get"in Y?!Z.__esModule:Y.writable||Y.configurable))Y={enumerable:!0,get:function(){return Z[X]}};Object.defineProperty($,Q,Y)}:function($,Z,X,Q){if(Q===void 0)Q=X;$[Q]=Z[X]}),v86=eN&&eN.__exportStar||function($,Z){for(var X in $)if(X!=="default"&&!Object.prototype.hasOwnProperty.call(Z,X))_86(Z,$,X)};Object.defineProperty(eN,"__esModule",{value:!0});eN.connect=void 0;var b86=Gv$();Object.defineProperty(eN,"connect",{enumerable:!0,get:function(){return b86.connect}});v86(qo(),eN)});function Nv$($){let Z=$?.connectFn??g86,X=null,Q=null,Y=!1,G=!1,J=!1,W=[];function K(){return X!==null&&!X.isClosed()&&!X.isDraining()&&!J}function H(){console.log(`[NatsProvider] fireReady: ${W.length} callbacks`);for(let U of W)try{U()}catch{}}function N(U){(async()=>{for await(let w of U.status())if(w.type==="disconnect")console.log("[NatsProvider] Disconnected"),J=!0;else if(w.type==="reconnect")console.log("[NatsProvider] Reconnected, re-firing ready callbacks"),J=!1,Q=null,H()})().catch(()=>{})}async function F(U,w){let O=0;while(!G)try{X=await Z({servers:U,timeout:y86,reconnect:!0,maxReconnectAttempts:-1,...w?{authenticator:w}:{}}),console.log(`[NatsProvider] Connected to ${X.getServer()} after ${O} attempt(s)`),Q=null,J=!1,N(X),H();return}catch{O++;let D=JX(x86,f86,O-1,2,0.5);await y$(D)}}return{init(U,w){if(Y)return;Y=!0,G=!1;let O=w?.creds?Wv$.credsAuthenticator(new TextEncoder().encode(w.creds)):void 0;F(U,O).catch(()=>{})},isConnected(){return K()},getConnection(){return K()?X:null},getJetStream(){if(!K())return null;if(!Q)Q=Hv$.jetstream(X);return Q},onReady(U){if(W.push(U),K())try{U()}catch{}},async drain(){if(G=!0,Y=!1,Q=null,J=!1,X){let U=X;X=null,await U.drain().catch(()=>{})}}}}function g86($){return Kv$.connect($)}var Wv$,Kv$,Hv$,f86=100,x86=3000,y86=3000;var Fv$=B(()=>{B6();Wv$=S(Fh(),1),Kv$=S(Jv$(),1),Hv$=S(GB(),1)});function u81($,Z){return`${$}.${Z}`}class c81{cache;constructor($){this.cache=Og({ttlMs:$?.ttlMs??h86,maxSize:$?.maxSize??u86})}async get($,Z){return this.cache.get(u81($,Z))??null}async set($,Z,X){this.cache.set(u81($,Z),X)}async invalidate($,Z){this.cache.delete(u81($,Z))}teardown(){this.cache.clear()}}var h86=600000,u86=5000;var Uv$=()=>{};function Kj0($,Z){return`${$}:${Z}`}function l81($){let Z=Og({ttlMs:$?.ttlMs??c86,maxSize:$?.maxSize??l86}),X=$?.getConnection,Q=crypto.randomUUID(),Y=new TextEncoder,G=new TextDecoder,J=null;function W(K,H){let N=X?.();if(!N)return;try{N.publish(wv$,Y.encode(JSON.stringify({organizationId:K,keyId:H,originId:Q})))}catch(F){console.warn("[ProviderKeyCache] Publish failed (non-critical):",F)}}return{get(K,H){return Z.get(Kj0(K,H))},set(K,H,N){Z.set(Kj0(K,H),N)},invalidate(K,H){Z.delete(Kj0(K,H)),W(K,H)},start(){if(J)return;let K=X?.();if(!K)return;J=K.subscribe(wv$),(async()=>{for await(let H of J)try{let N=JSON.parse(G.decode(H.data));if(N.originId===Q)continue;Z.delete(Kj0(N.organizationId,N.keyId))}catch{}})().catch(console.error)},teardown(){J?.unsubscribe(),J=null,Z.clear()}}}var wv$="studio.ai-provider-keys.invalidate",c86=30000,l86=5000;var Ov$=()=>{};class d81{options;subscriptions=[];onCancel=null;encoder=new TextEncoder;originId=crypto.randomUUID();seenMessageIds=new Set;constructor($){this.options=$}async start($){if($)this.onCancel=$;if(this.subscriptions.length>0)return;if(!this.onCancel)return;let Z=this.options.getConnection();if(!Z)return;let X=new TextDecoder;this.subscriptions=Bv$.map((Q)=>Z.subscribe(Q));for(let Q of this.subscriptions)(async()=>{for await(let Y of Q)try{let G=JSON.parse(X.decode(Y.data));if(G.originId===this.originId)continue;if(G.messageId&&this.hasSeen(G.messageId))continue;this.onCancel?.(G.taskId)}catch{}})().catch(console.error)}broadcast($){if(/[.*>\s]/.test($)){console.warn("[NatsCancelBroadcast] Invalid threadId, skipping broadcast");return}this.onCancel?.($);try{let Z=this.options.getConnection();if(!Z)return;let X=this.encoder.encode(JSON.stringify({taskId:$,originId:this.originId,messageId:crypto.randomUUID()}));for(let Q of Bv$)Z.publish(Q,X)}catch(Z){console.warn("[NatsCancelBroadcast] Publish failed (non-critical):",Z)}}publishControlFrame($,Z){}async stop(){for(let $ of this.subscriptions)$.unsubscribe();this.subscriptions=[],this.seenMessageIds.clear(),this.onCancel=null}hasSeen($){if(this.seenMessageIds.has($))return!0;if(this.seenMessageIds.add($),this.seenMessageIds.size>1000){let Z=this.seenMessageIds.values().next().value;if(Z)this.seenMessageIds.delete(Z)}return!1}}var Bv$;var Dv$=B(()=>{Bv$=["studio.decopilot.cancel","mesh.decopilot.cancel"]});var Lv$=($)=>{let Z;return()=>Z??=$()},m81,i81;var Ev$=B(()=>{N5();m81=Lv$(()=>W8.createHistogram("decopilot.stream.encode_ms",{description:"Per-chunk JSON.stringify+encode time for decopilot stream",unit:"ms"})),i81=Lv$(()=>W8.createCounter("decopilot.stream.published_chunks",{description:"Logical decopilot stream chunks published to JetStream",unit:"{chunks}"}))});function o86(){return{name:IN,subjects:[`${DO0}.>`],storage:y3.StorageType.File,max_age:i86,max_bytes:p86,max_msgs_per_subject:t86,discard:y3.DiscardPolicy.Old,retention:y3.RetentionPolicy.Limits,duplicate_window:n86,num_replicas:1}}class Pv${chunks=0;encodeMs=0;maxMs=0;bytes=0;windowStart=performance.now();constructor(){setInterval(()=>this.flush(),1e4).unref?.()}record($,Z){if(this.chunks++,this.encodeMs+=$,$>this.maxMs)this.maxMs=$;this.bytes+=Z}flush(){let $=performance.now(),Z=$-this.windowStart;if(this.chunks>0&&Z>0)console.warn(JSON.stringify({msg:"stream-encode-trace",windowMs:Math.round(Z),chunks:this.chunks,encodeMs:Math.round(this.encodeMs),pctOfLoop:+(this.encodeMs/Z*100).toFixed(1),maxChunkMs:+this.maxMs.toFixed(2),mbEncoded:+(this.bytes/1048576).toFixed(2)}));this.chunks=0,this.encodeMs=0,this.maxMs=0,this.bytes=0,this.windowStart=$}}function jv$($){let Z=zv$.headers();for(let[X,Q]of Object.entries($))Z.set(X,Q);return Z}function e86($,Z){let X=0;return{publish(Q,Y,G,J){Q.publish(Y,G,J?{headers:J}:void 0).catch((W)=>{if(X++,m86().add(1,{"org.id":Z??"unknown"}),X===1||X%100===0)console.warn(`[Decopilot] JetStream publish failed for thread ${$} (${X} total):`,W)})},get errorCount(){return X}}}function $46($){if(!($ instanceof Error))return!1;if($.name==="TimeoutError")return!0;return/timeout|no responders|503/i.test($.message)}class n81{options;js=null;jsm=null;constructor($){this.options=$}async init(){let $=this.options.getConnection();if(!$){console.log("[Decopilot] StreamBuffer.init skipped: NATS not connected yet");return}let Z=o86(),X=await fZ(async()=>{let Q=this.options.getJetStreamManager?await this.options.getJetStreamManager():await y3.jetstreamManager($);try{await Q.streams.info(IN),await Q.streams.update(IN,Z)}catch(Y){if(Y instanceof Error&&Y.message.includes("stream not found"))await Q.streams.add(Z);else if(Y instanceof Error&&/can ?not change.*storage|storage type/i.test(Y.message))await Q.streams.delete(IN),await Q.streams.add(Z);else throw Y}return Q},{maxAttempts:5,minTimeout:250,maxTimeout:4000,jitter:0.5,isRetriable:$46});this.js=this.options.getJetStream(),this.jsm=X,console.log(`[Decopilot] StreamBuffer.init ${this.js?"ready":"degraded (js=null)"}`)}pump($,Z,X,Q){let Y=this.js;if(!Y)return console.warn(`[Decopilot] pump: JetStream client unavailable for thread ${Z}; chunks NOT published to NATS`),Promise.resolve();let G=e86(Z,Q),J=!1,W=()=>{if(J)return;J=!0;let H=AH$(Z);Y.publish(H.subject,H.data).catch(()=>{})};X.addEventListener("abort",W,{once:!0});let K=(H)=>{let N=performance.now(),F=Ot0(H,{runId:Z}),U=performance.now()-N;if(m81().record(U),i81().add(1,{"org.id":Q??"unknown"}),s86?.record(U,F.reduce((w,O)=>w+O.data.length,0)),F.length===0){console.warn(`[Decopilot] dropping oversized stream chunk for thread ${Z}`);return}for(let w of F)G.publish(Y,w.subject,w.data,w.headers?jv$(w.headers):void 0)};return(async()=>{let H=$.getReader(),N=0,F=0,U;try{while(!0){let{done:w,value:O}=await H.read();if(w)break;if(K(O),F++,++N>=64)N=0,await new Promise((D)=>setImmediate(D))}}catch(w){U=w,console.warn(`[Decopilot] stream pump error for thread ${Z}:`,w?.message??w)}finally{if(H.releaseLock(),W(),a86)console.warn(JSON.stringify({msg:"decopilot-stream-diag",event:"pump-done",taskId:Z,publishedChunks:F,publishErrors:G.errorCount}))}if(U!==void 0)throw U})()}async publishRawChunk($,Z,X){let Q=this.js;if(!Q)return!1;let Y=performance.now(),G=Ot0(Z,{runId:$,dedup:X});if(m81().record(performance.now()-Y),i81().add(1),G.length===0)return console.warn(`[Decopilot] dropping oversized raw chunk for thread ${$} (> MAX_CHUNKED_BYTES)`),!0;for(let J of G)await Q.publish(J.subject,J.data,{...J.headers?{headers:jv$(J.headers)}:{},...J.msgId?{msgID:J.msgId}:{}});return!0}async publishDone($,Z,X){let Q=this.js;if(!Q)return!1;let Y=PH$({runId:$,fenceToken:Z,finalSeq:X});return await Q.publish(Y.subject,Y.data,{msgID:Y.msgId}),!0}async createTailStream($,Z,X){let Q=this.js;if(!Q)return console.warn(`[Decopilot] createTailStream: JetStream client unavailable for thread ${$}; no live tail`),null;let Y=X?.deliverPolicy==="new"?y3.DeliverPolicy.New:y3.DeliverPolicy.All,G=X?.closeOnDone??!1,J=HO($),W;try{W=await(await Q.consumers.get(IN,{filter_subjects:J,deliver_policy:Y})).consume()}catch(D){return console.warn("[Decopilot] JetStream tail unavailable (non-critical):",D?.message??D),null}let N=PO0({messages:async function*(){try{for await(let D of W)yield{subject:D.subject,data:D.data,headers:D.headers}}finally{W.stop()}}(),onCancel:()=>W.stop()}).pipeThrough(LO0()).pipeThrough(EO0()).getReader(),F=!1,U=()=>{if(F)return;F=!0;try{N.releaseLock()}catch{}},w=!1,O=()=>{if(w)return;w=!0,W.stop(),N.cancel().catch(()=>{}),U()};return Z?.addEventListener("abort",O,{once:!0}),new ReadableStream({async pull(D){for(;;){let{done:L,value:E}=await N.read();if(L){O(),D.close();return}let j=E;if(j.kind==="done"){if(G){O(),D.close();return}continue}D.enqueue(j.chunk);return}},cancel(){O()}})}purge($){if(!this.jsm)return;this.jsm.streams.purge(IN,{filter:HO($)}).catch(()=>{})}teardown(){this.js=null,this.jsm=null}}var y3,zv$,d86=($)=>{let Z;return()=>Z??=$()},m86,i86=86400000000000,n86=120000000000,p86=4294967296,t86=500000,r86,a86,s86;var Av$=B(()=>{B6();Bt0();AO0();jO0();N5();Ev$();y3=S(GB(),1),zv$=S(Fh(),1),m86=d86(()=>W8.createCounter("decopilot.stream.publish_errors",{description:"Number of JetStream publish failures for decopilot stream chunks",unit:"{errors}"}));r86=process.env.STREAM_ENCODE_TRACE==="1",a86=process.env.DECOPILOT_STREAM_TRACE==="1";s86=r86?new Pv$:null});function Hj0($,Z,X,Q){if(!Q)return!1;return $.emit(Z,YW(X,Q.status,{title:Q.title??void 0,virtualMcpId:Q.virtual_mcp_id??void 0,createdBy:Q.created_by??void 0,triggerId:Q.trigger_id??null,branch:Q.branch??null,harnessId:Q.harness_id??void 0,createdAt:Q.created_at,updatedAt:Q.updated_at})),!0}var Tv$=B(()=>{B8()});class p81{storage;options;timer=null;constructor($,Z={}){this.storage=$;this.options=Z}start(){if(this.timer)return;let $=this.options.intervalMs??300000;this.timer=setInterval(()=>{this.runOnce()},$)}async runOnce(){let $=this.options.staleAfterMs??3600000;try{let Z=await this.storage.sweepAbandoned($);if(Z>0)console.log(`[async-research-sweeper] marked ${Z} stale jobs as abandoned`);return Z}catch(Z){return console.error("[async-research-sweeper] sweep failed",Z),0}}dispose(){if(this.timer)clearInterval(this.timer),this.timer=null}}class t81{taskBoard;contextFactory;options;timer=null;running=!1;cursor=null;constructor($,Z,X={}){this.taskBoard=$;this.contextFactory=Z;this.options=X}start(){if(this.timer)return;let $=this.options.intervalMs??Z46;this.timer=setInterval(()=>{this.runOnce()},$),this.timer.unref()}async runOnce(){if(this.running)return 0;this.running=!0;let $=0;try{let Z=this.options.batchSize??Q46,X=this.options.itemIntervalMs??X46,Q=await this.taskBoard.listItemsPendingReview(Z,this.cursor,new Date(Date.now()-X)),Y=Q.at(-1);this.cursor=Q.length===Z&&Y?{updatedAt:Y.updatedAt,id:Y.id}:null;for(let{id:G,organizationId:J}of Q)try{if(await this.reconcileItem(G,J))$++}catch(W){console.error(`[task-board-review-sweeper] ${G} failed`,W)}await this.reapNeverStartedThreads(Z),$+=await this.dispatchDueRetries(Z),await this.reactToUnhandledFailures(Z)}catch(Z){console.error("[task-board-review-sweeper] sweep failed",Z)}finally{this.running=!1}return $}async reapNeverStartedThreads($){try{let Z=await this.taskBoard.failNeverStartedLinkedThreads($,new Date(Date.now()-RW$),rt0);for(let X of Z)console.warn(`[task-board-review-sweeper] failed never-started thread ${X.threadId} on ${X.itemId}`)}catch(Z){console.error("[task-board-review-sweeper] reaping failed",Z)}}async reactToUnhandledFailures($){let Z=await this.taskBoard.listItemsStuckAfterFailure($,new Date(Date.now()-G46));for(let{id:X,organizationId:Q,threadId:Y}of Z)try{console.warn(`[task-board-review-sweeper] reacting to an unhandled failure on ${X}`),await lp0(this.taskBoard,Y,Q)}catch(G){console.error(`[task-board-review-sweeper] unhandled-failure reaction for ${X} failed`,G)}}async dispatchDueRetries($){let Z=0,X=await this.taskBoard.listItemsDueForRetry($,new Date);for(let{id:Q,organizationId:Y,attempts:G}of X)try{if(!await this.taskBoard.claimDueRetry(Q,Y,new Date))continue;let J=await this.taskBoard.getById(Q,Y);if(!J||J.status!=="in_progress"||J.assigneeId!==p4)continue;let W=await this.contextFactory(Y,J.assignedBy??J.createdBy);if(!W)continue;await qN(W,J,{runClass:"retry"}),Z++,console.warn(`[task-board-review-sweeper] re-dispatched ${Q} after a failure (attempt ${G})`)}catch(J){console.error(`[task-board-review-sweeper] retry dispatch for ${Q} failed`,J),await this.taskBoard.scheduleRunRetry(Q,Y,G,new Date(Date.now()+Y46)).catch((W)=>console.error(`[task-board-review-sweeper] re-arming ${Q} failed`,W))}return Z}async reconcileItem($,Z){let X=await this.taskBoard.getById($,Z);if(!X)return!1;if(X.status!=="in_review"||X.assigneeId!==p4)return!1;await this.taskBoard.markSwept($,Z);let Q=await this.taskBoard.listPrs($,Z);if(Q.length===0)return!1;let Y=await this.contextFactory(Z,X.assignedBy??X.createdBy);if(!Y)return!1;let G=await Promise.all(Q.map(async(J)=>({...J,...await pt0(Y,Z,J)})));if(G.every((J)=>J.state===null))console.warn(`[task-board-review-sweeper] ${$}: no live PR state from GitHub (${G.length} PR(s)) \u2014 proceeding on unknown`);if(!nt0(G))return!1;return await kO0(Y,X),!0}dispose(){if(this.timer)clearInterval(this.timer),this.timer=null}}var Z46=60000,X46=300000,Q46=50,Y46=60000,G46=120000;var Rv$=B(()=>{b7();ht0();NO();MZ();at0();Oy()});import{readdir as J46,rm as Nj0}from"fs/promises";import{join as Fj0}from"path";async function Uj0($){let Z=new Date;Z.setUTCDate(Z.getUTCDate()-W46),Z.setUTCHours(0,0,0,0);let X=0;try{let Q=await uC($);for(let Y of Q)if(/^\d{4}$/.test(Y))X+=await Iv$($,Y,Z);else if(!Y.startsWith(".")){let G=Fj0($,Y),J=await uC(G);for(let K of J){if(!/^\d{4}$/.test(K))continue;X+=await Iv$(G,K,Z)}if((await uC(G)).length===0)await Nj0(G,{recursive:!0,force:!0})}}catch(Q){console.warn("monitoring retention cleanup failed:",Q)}return X}async function Iv$($,Z,X){let Q=0,Y=Fj0($,Z),G=await uC(Y);for(let W of G){if(!/^\d{2}$/.test(W))continue;let K=Fj0(Y,W),H=await uC(K);for(let F of H){if(!/^\d{2}$/.test(F))continue;let U=new Date(`${Z}-${W}-${F}T00:00:00Z`);if(isNaN(U.getTime()))continue;if(U<X){let w=Fj0(K,F);await Nj0(w,{recursive:!0,force:!0}),Q++}}if((await uC(K)).length===0)await Nj0(K,{recursive:!0,force:!0})}if((await uC(Y)).length===0)await Nj0(Y,{recursive:!0,force:!0});return Q}async function uC($){try{return(await J46($)).filter((X)=>!X.startsWith("."))}catch{return[]}}var W46=30;var o81=()=>{};import{DBOS as r81,SchedulerMode as K46}from"@dbos-inc/dbos-sdk";async function N46(){let $=[$J(),cC(),gK()],Z=0;for(let X of $)try{Z+=await Uj0(X)}catch(Q){console.error("[monitoring-retention] cleanup failed:",Q)}return console.log(`[monitoring-retention] deleted ${Z} day-dir(s) across ${$.length} signal dir(s)`),{deleted:Z,dirs:$.length}}async function F46($,Z){await r81.runStep(()=>N46(),{name:"monitoringRetention"})}function Mv$(){if(qv$)return;qv$=!0;let $=r81.registerWorkflow(F46,{name:"monitoringRetentionWorkflow"});r81.registerScheduled($,{name:"monitoringRetentionWorkflow",crontab:H46,mode:K46.ExactlyOncePerIntervalWhenActive})}var H46="23 4 * * *",qv$=!1;var kv$=B(()=>{iQ();o81()});function Sv$($){return async(Z,X)=>{let Q=await $.db.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["member.role","organization.id as orgId","organization.slug as orgSlug","organization.name as orgName"]).where("member.userId","=",X).where("member.organizationId","=",Z).executeTakeFirst();if(!Q)return console.warn(`[automationContextFactory] User ${X} not found in org ${Z} \u2014 returning null`),null;let Y=await zw.create();Y.auth.user={id:X,role:Q.role},Y.organization={id:Q.orgId,slug:Q.orgSlug,name:Q.orgName};let G=await vc0($.db,Z,Q.role);return Y.boundAuth=_c0({auth:Y.authInstance,headers:new Headers,role:Q.role,permissions:G,userId:X}),Y.access=new ZL(X,void 0,Y.boundAuth,Q.role,"self"),D50(Y,{id:Q.orgId,slug:Q.orgSlug}),Y}}var Vv$=B(()=>{XL();Ci()});function U46(){return{services:[{name:"Postgres",status:"pending",port:0},{name:"NATS",status:"pending",port:0}],migrationsStatus:"pending",serverUrl:null,logs:[]}}function O46(){for(let $ of w46)$()}function Cv$($){let Z=[...a81.logs,$];a81={...a81,logs:Z.length>500?Z.slice(-500):Z},O46()}function s81(){return B46}var a81,w46,B46=!1;var e81=B(()=>{a81=U46(),w46=new Set});import{EventEmitter as D46}from"events";var $41;var _v$=B(()=>{e81();$41=new D46;$41.on("request",($)=>{Cv$($)})});function vv$(){return async($,Z)=>{let X=Date.now(),Q=$.req.method,Y=$.req.path;if(Y==="/api/auth/get-session"||Y.includes("favicon")){await Z();return}let G="",J=!1;if(Y.startsWith("/mcp")&&Q==="POST"){J=!0;try{if($.req.header("Content-Type")?.includes("application/json")){let U=await $.req.raw.clone().json();if(U.method==="tools/call"&&U.params?.name){let w=ug(U.params.name),O=U.params.arguments||{},D=Object.keys(O).map((E)=>ug(E)),L=D.length>0?D.slice(0,3).join(",")+(D.length>3?"\u2026":""):"";G=`${a6.tool}${w}${a6.dim}(${L})${a6.reset}`}else if(U.method)G=`${a6.dim}${ug(U.method)}${a6.reset}`}}catch{}}let W=ug(Y);if(Y.startsWith("/mcp/conn_")){let N=Y.split("/")[2]??"";W=`/mcp/${a6.mcp}${ug(N.slice(0,12))}\u2026${a6.reset}`}else if(Y==="/mcp")W=`${a6.mcp}/mcp${a6.reset}`;else if(Y==="/mcp/registry")W=`${a6.mcp}/mcp/registry${a6.reset}`;let K=E46(Q),H=J?"\u25C0":"\u2190";if(!s81())console.log(`${a6.dim}${H}${a6.reset} ${K}${Q}${a6.reset} ${W}${G?` ${G}`:""}`);try{await Z()}finally{let N=Date.now()-X,F=$.res.status,U=L46(F),w=N<1000?`${N}ms`:`${(N/1000).toFixed(1)}s`,O=J?"\u25B6":"\u2192";if(!s81())console.log(`${a6.dim}${O}${a6.reset} ${K}${Q}${a6.reset} ${W}${G?` ${G}`:""} ${U}${F}${a6.reset} ${a6.duration}${w}${a6.reset}`);$41.emit("request",{method:Q,path:ug(Y),status:F,duration:N,timestamp:new Date})}}}var a6,L46=($)=>{if($>=500)return a6.serverError;if($>=400)return a6.clientError;if($>=300)return a6.redirect;return a6.ok},E46=($)=>{return a6[$]||a6.reset},ug=($)=>{return $.replace(/\r/g,"").replace(/\n/g,"").replace(/\x1b\[[0-9;]*m/g,"").replace(/[\x00-\x1f\x7f-\x9f]/g,"")};var bv$=B(()=>{e81();_v$();a6={reset:"\x1B[0m",dim:"\x1B[2m",bold:"\x1B[1m",GET:"\x1B[36m",POST:"\x1B[33m",PUT:"\x1B[35m",DELETE:"\x1B[31m",ok:"\x1B[32m",redirect:"\x1B[36m",clientError:"\x1B[33m",serverError:"\x1B[31m",mcp:"\x1B[35m",tool:"\x1B[96m",duration:"\x1B[90m"}});import{createHmac as gv$}from"crypto";import{mkdir as j46,readdir as z46,rm as fv$,stat as hv$}from"fs/promises";import{join as X41,relative as P46}from"path";import{z as L$}from"zod";function cv$($){let Z=$.replace(/[^a-zA-Z0-9_-]/g,"_");return X41(A46,Z)}function lv$($){return $.replace(/^\/+/,"").replace(/\.\./g,"")}function Z41($,Z){let X=cv$($),Q=lv$(Z);return X41(X,Q)}function T46($,Z,X,Q){let Y=c0().encryptionKey||"dev-secret",G=`${$}:${Z}:${X}:${Q}`;return gv$("sha256",Y).update(G).digest("hex")}function yv$($,Z,X,Q,Y){let G=Math.floor(Date.now()/1000)+Q,J=T46(Z,X,G,Y),W=new URL(`/api/dev-assets/${Z}/${lv$(X)}`,$);return W.searchParams.set("expires",G.toString()),W.searchParams.set("signature",J),W.searchParams.set("method",Y),W.toString()}function dv$($,Z,X){let Q=`${$}:${Z.getTime()}:${X}`;return`"${gv$("md5","etag").update(Q).digest("hex")}"`}async function mv$($,Z,X,Q,Y){try{let G=await z46($,{withFileTypes:!0});for(let J of G){let W=X41($,J.name),H=P46(Z,W).replace(/\\/g,"/");if(X&&!H.startsWith(X))continue;if(J.isDirectory())if(Q){let N=H+"/";if(!X||N.startsWith(X)){if(!(X?H.slice(X.length):H).includes("/"))Y.commonPrefixes.add(N)}}else await mv$(W,Z,X,Q,Y);else if(J.isFile()){if(Q&&X){let N=H.slice(X.length);if(N.includes(Q)){let F=N.indexOf(Q),U=X+N.slice(0,F+1);Y.commonPrefixes.add(U);continue}}try{let N=await hv$(W);Y.objects.push({key:H,size:N.size,lastModified:N.mtime.toISOString(),etag:dv$(W,N.mtime,N.size)})}catch{}}}}catch{}}function iv$($,Z){let Q=r($).id;return[{name:"LIST_OBJECTS",description:"List objects in the local assets directory with pagination support",inputSchema:L$.object({prefix:L$.string().optional(),maxKeys:L$.number().optional().default(1000),continuationToken:L$.string().optional(),delimiter:L$.string().optional()}),outputSchema:L$.object({objects:L$.array(L$.object({key:L$.string(),size:L$.number(),lastModified:L$.string(),etag:L$.string()})),nextContinuationToken:L$.string().optional(),isTruncated:L$.boolean(),commonPrefixes:L$.array(L$.string()).optional()}),handler:async(Y)=>{let G=Y,J=G.prefix||"",W=G.maxKeys??1000,K=G.delimiter,H=G.continuationToken,N=cv$(Q);await j46(N,{recursive:!0});let F={objects:[],commonPrefixes:new Set};await mv$(N,N,J,K,F),F.objects.sort((L,E)=>L.key.localeCompare(E.key));let U=0;if(H){if(U=F.objects.findIndex((L)=>L.key>H),U===-1)U=F.objects.length}let w=F.objects.slice(U,U+W),O=U+W<F.objects.length,D=O?w[w.length-1]?.key:void 0;return{objects:w,isTruncated:O,nextContinuationToken:D,commonPrefixes:Array.from(F.commonPrefixes).sort()}}},{name:"GET_OBJECT_METADATA",description:"Get metadata for a file in the local assets directory",inputSchema:L$.object({key:L$.string()}),outputSchema:L$.object({contentType:L$.string().optional(),contentLength:L$.number(),lastModified:L$.string(),etag:L$.string(),metadata:L$.record(L$.string(),L$.string()).optional()}),handler:async(Y)=>{let G=Y,J=Z41(Q,G.key),W=await hv$(J);return{contentType:o11(G.key),contentLength:W.size,lastModified:W.mtime.toISOString(),etag:dv$(J,W.mtime,W.size)}}},{name:"GET_PRESIGNED_URL",description:"Generate a presigned URL for downloading a file from local storage",inputSchema:L$.object({key:L$.string(),expiresIn:L$.number().optional()}),outputSchema:L$.object({url:L$.string(),expiresIn:L$.number()}),handler:async(Y)=>{let G=Y,J=G.expiresIn??xv$;return{url:yv$(Z,Q,G.key,J,"GET"),expiresIn:J}}},{name:"PUT_PRESIGNED_URL",description:"Generate a presigned URL for uploading a file to local storage",inputSchema:L$.object({key:L$.string(),expiresIn:L$.number().optional(),contentType:L$.string().optional()}),outputSchema:L$.object({url:L$.string(),expiresIn:L$.number()}),handler:async(Y)=>{let G=Y,J=G.expiresIn??xv$;return{url:yv$(Z,Q,G.key,J,"PUT"),expiresIn:J}}},{name:"DELETE_OBJECT",description:"Delete a single file from local storage",inputSchema:L$.object({key:L$.string()}),outputSchema:L$.object({success:L$.boolean(),key:L$.string()}),handler:async(Y)=>{let G=Y,J=Z41(Q,G.key);try{return await fv$(J),{success:!0,key:G.key}}catch{return{success:!1,key:G.key}}}},{name:"DELETE_OBJECTS",description:"Delete multiple files from local storage",inputSchema:L$.object({keys:L$.array(L$.string()).max(1000)}),outputSchema:L$.object({deleted:L$.array(L$.string()),errors:L$.array(L$.object({key:L$.string(),message:L$.string()}))}),handler:async(Y)=>{let G=Y,J=[],W=[];return await Promise.all(G.keys.map(async(K)=>{let H=Z41(Q,K);try{await fv$(H),J.push(K)}catch(N){W.push({key:K,message:N instanceof Error?N.message:"Unknown error"})}})),{deleted:J,errors:W}}}]}async function Q41($,Z,X){let Q=iv$(Z,X),Y=new OW({name:"dev-assets-mcp",version:"1.0.0"},{capabilities:{tools:{}},jsonSchemaValidator:X5});for(let J of Q){let W="shape"in J.inputSchema?J.inputSchema.shape:L$.object({}).shape,K=J.outputSchema&&"shape"in J.outputSchema?J.outputSchema.shape:L$.object({}).shape;Y.registerTool(J.name,{description:J.description??"",inputSchema:W,outputSchema:K,annotations:J.annotations,_meta:J._meta},async(H)=>{try{let N=await J.handler(H);return{content:[{type:"text",text:JSON.stringify(N)}],structuredContent:N}}catch(N){return{content:[{type:"text",text:`Error: ${N.message}`}],isError:!0}}})}let G=new cX({enableJsonResponse:$.headers.get("Accept")?.includes("application/json")??!1});return await Y.connect(G),uG(Y,G,$,"mcp:dev-assets")}async function nv$($,Z,X,Q){let G=iv$(X,Q).find((J)=>J.name===$);if(!G)return{content:[{type:"text",text:`Tool not found: ${$}`}],isError:!0};try{let J=await G.handler(Z);return{content:[{type:"text",text:JSON.stringify(J)}]}}catch(J){return{content:[{type:"text",text:J instanceof Error?J.message:String(J)}],isError:!0}}}var A46="./data/assets",xv$=3600,uv$,pv$;var tv$=B(()=>{S$();jy();v8();Nl();nV();qX();TE0();uv$=new B1;uv$.all("/",async($)=>{let Z=$.get("studioContext"),X=new URL($.req.url),Q=`${X.protocol}//${X.host}`;return Q41($.req.raw,Z,Q)});pv$=uv$});var ov$={};H4(ov$,{mountDevRoutes:()=>R46});function R46($,Z){$.all("/mcp/:connectionId{.*_dev-assets$}",Z,async(Q)=>{let Y=Q.get("studioContext"),G=new URL(Q.req.url),J=`${G.protocol}//${G.host}`;return Q41(Q.req.raw,Y,J)}),$.all("/mcp/:connectionId{.*_dev-assets$}/call-tool/:toolName",Z,async(Q)=>{let Y=Q.get("studioContext"),G=new URL(Q.req.url),J=`${G.protocol}//${G.host}`,W=Q.req.param("toolName");if(!W)return Q.json({error:"Missing tool name"},400);let K=await Q.req.json(),H=await nv$(W,K,Y,J);if(H.isError)return Q.json(H.content,500);return Q.json(H.content)}),$.use("/mcp/dev-assets",Z),$.route("/mcp/dev-assets",pv$);let X=new B1;X.use("*",b3({mountPath:"/api/dev-assets"})),X.route("/",AE0({orgFromPath:!1})),$.route("/api/dev-assets",X)}var rv$=B(()=>{v8();c11();TE0();tv$()});import{sql as I46}from"kysely";import{randomUUID as av$}from"crypto";import{z as q46}from"zod";async function k46($){let Z=new Date().toISOString(),X=av$(),Q=x4.SELF($.organizationId),Y="registry.publish_request.created",G={requestId:$.request.id,requestedId:$.request.requested_id,title:$.request.title,status:$.request.status,createdAt:$.request.created_at,requester:{name:$.request.requester_name,email:$.request.requester_email}};await $.db.insertInto("events").values({id:X,organization_id:$.organizationId,type:"registry.publish_request.created",source:Q,specversion:"1.0",subject:$.request.id,time:Z,datacontenttype:"application/json",dataschema:null,data:JSON.stringify(G),cron:null,status:"pending",attempts:0,last_error:null,next_retry_at:null,created_at:Z,updated_at:Z}).execute();let J=await $.db.selectFrom("event_subscriptions").select(["id"]).where("organization_id","=",$.organizationId).where("enabled","=",1).where("event_type","=","registry.publish_request.created").where((W)=>W.or([W("publisher","is",null),W("publisher","=",Q)])).execute();if(J.length>0)await $.db.insertInto("event_deliveries").values(J.map((W)=>({id:av$(),event_id:X,subscription_id:W.id,status:"pending",attempts:0,last_error:null,delivered_at:null,next_retry_at:null,created_at:Z}))).execute();try{await I46`SELECT
       pg_notify('studio_events', ${X}),