npm - decocms - Versions diffs - 4.204.9 → 4.204.11 - Mend

decocms 4.204.9 → 4.204.11

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (226) hide show

package/dist/server/server.js CHANGED Viewed

@@ -992,7 +992,7 @@ ${H}`:H;return{...J,description:N,inputExamples:X?void 0:J.inputExamples}});retu
 `)},flush($){$.enqueue(`data: [DONE]
-`)}})}},nu0={"content-type":"text/event-stream","cache-control":"no-cache",connection:"keep-alive","x-vercel-ai-ui-message-stream":"v1","x-accel-buffering":"no"};lm=e0.record(e0.string(),AL.optional()),pu0=U0(()=>$0(e0.union([e0.strictObject({type:e0.literal("text-start"),id:e0.string(),providerMetadata:K$.optional()}),e0.strictObject({type:e0.literal("text-delta"),id:e0.string(),delta:e0.string(),providerMetadata:K$.optional()}),e0.strictObject({type:e0.literal("text-end"),id:e0.string(),providerMetadata:K$.optional()}),e0.strictObject({type:e0.literal("error"),errorText:e0.string()}),e0.strictObject({type:e0.literal("tool-input-start"),toolCallId:e0.string(),toolName:e0.string(),providerExecuted:e0.boolean().optional(),providerMetadata:K$.optional(),toolMetadata:lm.optional(),dynamic:e0.boolean().optional(),title:e0.string().optional()}),e0.strictObject({type:e0.literal("tool-input-delta"),toolCallId:e0.string(),inputTextDelta:e0.string()}),e0.strictObject({type:e0.literal("tool-input-available"),toolCallId:e0.string(),toolName:e0.string(),input:e0.unknown(),providerExecuted:e0.boolean().optional(),providerMetadata:K$.optional(),toolMetadata:lm.optional(),dynamic:e0.boolean().optional(),title:e0.string().optional()}),e0.strictObject({type:e0.literal("tool-input-error"),toolCallId:e0.string(),toolName:e0.string(),input:e0.unknown(),providerExecuted:e0.boolean().optional(),providerMetadata:K$.optional(),toolMetadata:lm.optional(),dynamic:e0.boolean().optional(),errorText:e0.string(),title:e0.string().optional()}),e0.strictObject({type:e0.literal("tool-approval-request"),approvalId:e0.string(),toolCallId:e0.string(),signature:e0.string().optional()}),e0.strictObject({type:e0.literal("tool-output-available"),toolCallId:e0.string(),output:e0.unknown(),providerExecuted:e0.boolean().optional(),providerMetadata:K$.optional(),toolMetadata:lm.optional(),dynamic:e0.boolean().optional(),preliminary:e0.boolean().optional()}),e0.strictObject({type:e0.literal("tool-output-error"),toolCallId:e0.string(),errorText:e0.string(),providerExecuted:e0.boolean().optional(),providerMetadata:K$.optional(),toolMetadata:lm.optional(),dynamic:e0.boolean().optional()}),e0.strictObject({type:e0.literal("tool-output-denied"),toolCallId:e0.string()}),e0.strictObject({type:e0.literal("reasoning-start"),id:e0.string(),providerMetadata:K$.optional()}),e0.strictObject({type:e0.literal("reasoning-delta"),id:e0.string(),delta:e0.string(),providerMetadata:K$.optional()}),e0.strictObject({type:e0.literal("reasoning-end"),id:e0.string(),providerMetadata:K$.optional()}),e0.strictObject({type:e0.literal("source-url"),sourceId:e0.string(),url:e0.string(),title:e0.string().optional(),providerMetadata:K$.optional()}),e0.strictObject({type:e0.literal("source-document"),sourceId:e0.string(),mediaType:e0.string(),title:e0.string(),filename:e0.string().optional(),providerMetadata:K$.optional()}),e0.strictObject({type:e0.literal("file"),url:e0.string(),mediaType:e0.string(),providerMetadata:K$.optional()}),e0.strictObject({type:e0.custom(($)=>typeof $==="string"&&$.startsWith("data-"),{message:'Type must start with "data-"'}),id:e0.string().optional(),data:e0.unknown(),transient:e0.boolean().optional()}),e0.strictObject({type:e0.literal("start-step")}),e0.strictObject({type:e0.literal("finish-step")}),e0.strictObject({type:e0.literal("start"),messageId:e0.string().optional(),messageMetadata:e0.unknown().optional()}),e0.strictObject({type:e0.literal("finish"),finishReason:e0.enum(["stop","length","content-filter","tool-calls","error","other"]).optional(),messageMetadata:e0.unknown().optional()}),e0.strictObject({type:e0.literal("abort"),reason:e0.string().optional()}),e0.strictObject({type:e0.literal("message-metadata"),messageMetadata:e0.unknown()})])));gr8=MY;hr8=im;cr8=W3({prefix:"aitxt",size:24}),lr8={file:!0,source:!0,"text-start":!0,"text-end":!0,"text-delta":!0,"reasoning-start":!0,"reasoning-end":!0,"reasoning-delta":!0,"tool-input-start":!0,"tool-input-end":!0,"tool-input-delta":!0,"tool-approval-request":!0,"tool-call":!0,"tool-result":!0,"tool-error":!0,"stream-start":!1,"response-metadata":!1,finish:!1,error:!1,raw:!1};TQ=J0.record(J0.string(),AL.optional()),pr8=U0(()=>$0(J0.array(J0.object({id:J0.string(),role:J0.enum(["system","user","assistant"]),metadata:J0.unknown().optional(),parts:J0.array(J0.union([J0.object({type:J0.literal("text"),text:J0.string(),state:J0.enum(["streaming","done"]).optional(),providerMetadata:K$.optional()}),J0.object({type:J0.literal("reasoning"),text:J0.string(),state:J0.enum(["streaming","done"]).optional(),providerMetadata:K$.optional()}),J0.object({type:J0.literal("source-url"),sourceId:J0.string(),url:J0.string(),title:J0.string().optional(),providerMetadata:K$.optional()}),J0.object({type:J0.literal("source-document"),sourceId:J0.string(),mediaType:J0.string(),title:J0.string(),filename:J0.string().optional(),providerMetadata:K$.optional()}),J0.object({type:J0.literal("file"),mediaType:J0.string(),filename:J0.string().optional(),url:J0.string(),providerMetadata:K$.optional()}),J0.object({type:J0.literal("step-start")}),J0.object({type:J0.string().startsWith("data-"),id:J0.string().optional(),data:J0.unknown()}),J0.object({type:J0.literal("dynamic-tool"),toolName:J0.string(),toolCallId:J0.string(),toolMetadata:TQ.optional(),state:J0.literal("input-streaming"),input:J0.unknown().optional(),providerExecuted:J0.boolean().optional(),callProviderMetadata:K$.optional(),output:J0.never().optional(),errorText:J0.never().optional(),approval:J0.never().optional()}),J0.object({type:J0.literal("dynamic-tool"),toolName:J0.string(),toolCallId:J0.string(),toolMetadata:TQ.optional(),state:J0.literal("input-available"),input:J0.unknown(),providerExecuted:J0.boolean().optional(),output:J0.never().optional(),errorText:J0.never().optional(),callProviderMetadata:K$.optional(),approval:J0.never().optional()}),J0.object({type:J0.literal("dynamic-tool"),toolName:J0.string(),toolCallId:J0.string(),toolMetadata:TQ.optional(),state:J0.literal("approval-requested"),input:J0.unknown(),providerExecuted:J0.boolean().optional(),output:J0.never().optional(),errorText:J0.never().optional(),callProviderMetadata:K$.optional(),approval:J0.object({id:J0.string(),approved:J0.never().optional(),reason:J0.never().optional(),signature:J0.string().optional()})}),J0.object({type:J0.literal("dynamic-tool"),toolName:J0.string(),toolCallId:J0.string(),toolMetadata:TQ.optional(),state:J0.literal("approval-responded"),input:J0.unknown(),providerExecuted:J0.boolean().optional(),output:J0.never().optional(),errorText:J0.never().optional(),callProviderMetadata:K$.optional(),approval:J0.object({id:J0.string(),approved:J0.boolean(),reason:J0.string().optional(),signature:J0.string().optional()})}),J0.object({type:J0.literal("dynamic-tool"),toolName:J0.string(),toolCallId:J0.string(),toolMetadata:TQ.optional(),state:J0.literal("output-available"),input:J0.unknown(),providerExecuted:J0.boolean().optional(),output:J0.unknown(),errorText:J0.never().optional(),callProviderMetadata:K$.optional(),resultProviderMetadata:K$.optional(),preliminary:J0.boolean().optional(),approval:J0.object({id:J0.string(),approved:J0.literal(!0),reason:J0.string().optional(),signature:J0.string().optional()}).optional()}),J0.object({type:J0.literal("dynamic-tool"),toolName:J0.string(),toolCallId:J0.string(),toolMetadata:TQ.optional(),state:J0.literal("output-error"),input:J0.unknown().optional(),rawInput:J0.unknown().optional(),providerExecuted:J0.boolean().optional(),output:J0.never().optional(),errorText:J0.string(),callProviderMetadata:K$.optional(),resultProviderMetadata:K$.optional(),approval:J0.object({id:J0.string(),approved:J0.literal(!0),reason:J0.string().optional(),signature:J0.string().optional()}).optional()}),J0.object({type:J0.literal("dynamic-tool"),toolName:J0.string(),toolCallId:J0.string(),toolMetadata:TQ.optional(),state:J0.literal("output-denied"),input:J0.unknown(),providerExecuted:J0.boolean().optional(),output:J0.never().optional(),errorText:J0.never().optional(),callProviderMetadata:K$.optional(),approval:J0.object({id:J0.string(),approved:J0.literal(!1),reason:J0.string().optional(),signature:J0.string().optional()})}),J0.object({type:J0.string().startsWith("tool-"),toolCallId:J0.string(),toolMetadata:TQ.optional(),state:J0.literal("input-streaming"),providerExecuted:J0.boolean().optional(),callProviderMetadata:K$.optional(),input:J0.unknown().optional(),output:J0.never().optional(),errorText:J0.never().optional(),approval:J0.never().optional()}),J0.object({type:J0.string().startsWith("tool-"),toolCallId:J0.string(),toolMetadata:TQ.optional(),state:J0.literal("input-available"),providerExecuted:J0.boolean().optional(),input:J0.unknown(),output:J0.never().optional(),errorText:J0.never().optional(),callProviderMetadata:K$.optional(),approval:J0.never().optional()}),J0.object({type:J0.string().startsWith("tool-"),toolCallId:J0.string(),toolMetadata:TQ.optional(),state:J0.literal("approval-requested"),input:J0.unknown(),providerExecuted:J0.boolean().optional(),output:J0.never().optional(),errorText:J0.never().optional(),callProviderMetadata:K$.optional(),approval:J0.object({id:J0.string(),approved:J0.never().optional(),reason:J0.never().optional(),signature:J0.string().optional()})}),J0.object({type:J0.string().startsWith("tool-"),toolCallId:J0.string(),toolMetadata:TQ.optional(),state:J0.literal("approval-responded"),input:J0.unknown(),providerExecuted:J0.boolean().optional(),output:J0.never().optional(),errorText:J0.never().optional(),callProviderMetadata:K$.optional(),approval:J0.object({id:J0.string(),approved:J0.boolean(),reason:J0.string().optional(),signature:J0.string().optional()})}),J0.object({type:J0.string().startsWith("tool-"),toolCallId:J0.string(),toolMetadata:TQ.optional(),state:J0.literal("output-available"),providerExecuted:J0.boolean().optional(),input:J0.unknown(),output:J0.unknown(),errorText:J0.never().optional(),callProviderMetadata:K$.optional(),resultProviderMetadata:K$.optional(),preliminary:J0.boolean().optional(),approval:J0.object({id:J0.string(),approved:J0.literal(!0),reason:J0.string().optional(),signature:J0.string().optional()}).optional()}),J0.object({type:J0.string().startsWith("tool-"),toolCallId:J0.string(),toolMetadata:TQ.optional(),state:J0.literal("output-error"),providerExecuted:J0.boolean().optional(),input:J0.unknown().optional(),rawInput:J0.unknown().optional(),output:J0.never().optional(),errorText:J0.string(),callProviderMetadata:K$.optional(),resultProviderMetadata:K$.optional(),approval:J0.object({id:J0.string(),approved:J0.literal(!0),reason:J0.string().optional(),signature:J0.string().optional()}).optional()}),J0.object({type:J0.string().startsWith("tool-"),toolCallId:J0.string(),toolMetadata:TQ.optional(),state:J0.literal("output-denied"),providerExecuted:J0.boolean().optional(),input:J0.unknown(),output:J0.never().optional(),errorText:J0.never().optional(),callProviderMetadata:K$.optional(),approval:J0.object({id:J0.string(),approved:J0.literal(!1),reason:J0.string().optional(),signature:J0.string().optional()})})])).nonempty("Message must contain at least one part")})).nonempty("Messages array must not be empty")));Xa8=B50,Qa8={type:"no-schema",jsonSchema:async()=>{return},async validatePartialResult({value:$,textDelta:Z}){return{success:!0,value:{partial:$,textDelta:Z}}},async validateFinalResult($,Z){return $===void 0?{success:!1,error:new IQ({message:"No object generated: response did not match schema.",text:Z.text,response:Z.response,usage:Z.usage,finishReason:Z.finishReason})}:{success:!0,value:$}},createElementStream(){throw new I4({functionality:"element streams in no-schema mode"})}};Wa8=W3({prefix:"aiobj",size:24});Ua8=W3({prefix:"aiobj",size:24});Ba8=class extends Lw{constructor({data:$,mediaType:Z}){super({data:$,mediaType:Z});let X="mp3";if(Z){let Q=Z.split("/");if(Q.length===2){if(Z!=="audio/mpeg")X=Q[1]}}if(!X)throw Error("Audio format must be provided or determinable from media type");this.format=X}};Ea8={word:/\S+\s+/m,line:/\n+/m};za8=eu0();ga8=L0$,j0$=`vercel.ai.error.${E0$}`,ha8=Symbol.for(j0$),P0$=class extends V5{constructor({modelId:$,modelType:Z,providerId:X,availableProviders:Q,message:G=`No such provider: ${X} (available providers: ${Q.join()})`}){super({errorName:E0$,modelId:$,modelType:Z,message:G});this[z0$]=!0,this.providerId=X,this.availableProviders=Q}static isInstance($){return Y1.hasMarker($,j0$)}};z0$=ha8;ua8=A0$;da8=eu0();R0$=class extends Xc0{constructor($={}){super($)}processResponseStream($){return ZN({stream:$,schema:pu0}).pipeThrough(new TransformStream({async transform(Z,X){if(!Z.success)throw Z.error;X.enqueue(Z.value)}}))}};$s8=class extends Xc0{constructor($={}){super($)}processResponseStream($){return ea8({stream:$.pipeThrough(new TextDecoderStream)})}}});import{z as Zs8}from"zod";function kL($){return $==="cluster"?"agent-sandbox":$}function Gc0($){return`${$.userId}:${$.projectRef}`}var Xs8;var D50=B(()=>{Xs8=Zs8.enum(["agent-sandbox","user-desktop"])});class L50{map=new Map;async run($,Z){let X=this.map.get($);if(X)return X;let Q=Z();this.map.set($,Q);try{return await Q}finally{this.map.delete($)}}}function E50($,Z,X,Q){if(!$)return Q(null);if(!$.withLock)return Q($);return $.withLock(Z,X,Q)}function em($){if("threadId"in $){if(!$.threadId)throw Error("composeSandboxRef: threadId required");return`thread:${$.threadId}`}if(!$.orgId||!$.virtualMcpId||!$.branch)throw Error("composeSandboxRef: orgId, virtualMcpId and branch are all required for agent refs");return`agent:${$.orgId}:${$.virtualMcpId}:${$.branch}`}function I0$($){if($.startsWith("thread:"))return $.slice(7);if(!$.startsWith("agent:"))return"";let Z=$.split(":");return Z.length>=4?Z.slice(3).join(":"):""}import{createHash as Qs8}from"crypto";function Ys8($,Z=16){return Qs8("sha256").update(Gc0($)).digest("hex").slice(0,Z)}function SL($){let Z=Ys8($),X=Js8(I0$($.projectRef));return X?`${X}-${Z}`:`s-${Z}`}function Js8($){if(!$)return"";return($.split("/").pop()??"").toLowerCase().replace(/[^a-z0-9]+/g,"-").replace(/^-+|-+$/g,"").slice(0,Gs8).replace(/-+$/g,"")}var Gs8=24;var q0$=B(()=>{D50()});function j50($,Z){let X=$.replace(/\/+$/,"");if(X.includes("{handle}"))return`${X.replace("{handle}",Z)}/`;try{let Q=new URL(X);return Q.hostname=`${Z}.${Q.hostname}`,`${Q.toString()}/`}catch{return`${X}/${Z}/`}}function $i($){let Z=$?.userName?.trim();if(!Z||M0$.test(Z))return null;let X=$?.userEmail?.trim();if(!X||M0$.test(X))return{userName:Z};if(!Ws8.test(X))return{userName:Z};return{userName:Z,userEmail:X}}var M0$,Ws8;var Yc0=B(()=>{M0$=/[\r\n<>]/,Ws8=/^[^\s@<>]+@[^\s@<>]+\.[^\s@<>]+$/});function z50($){let Z=$.repo,X=Z?{repository:{cloneUrl:Z.cloneUrl,repoName:Z.displayName??Ks8(Z.cloneUrl),...Z.branch?{branch:Z.branch}:{},...Z.submoduleCredentials&&Z.submoduleCredentials.length>0?{submoduleCredentials:Z.submoduleCredentials}:{}},...Z.userName.trim()||Z.userEmail.trim()?{identity:{userName:Z.userName,userEmail:Z.userEmail}}:{}}:void 0,Q=$.tenant,G=$i({userName:Q?.userName,userEmail:Q?.userEmail})??void 0,Y=$.packageManager?{name:$.packageManager.name,...$.packageManager.path?{path:$.packageManager.path}:{}}:void 0,J=Y?{packageManager:Y,runtime:$.runtime,...$.port!==void 0?{port:$.port}:{}}:void 0,W=Q?.orgId;if(!X&&!J&&!G&&!$.cloneOnly&&!W)return null;return{...X?{git:X}:{},...G?{operator:G}:{},...W?{orgId:W}:{},...$.cloneOnly!==void 0?{cloneOnly:$.cloneOnly}:{},...J?{application:J}:{}}}function Ks8($){try{let Z=new URL($);return Z.pathname.replace(/^\/+/,"").replace(/\.git$/,"")||Z.hostname}catch{return $}}var k0$=B(()=>{Yc0()});function Hs8($){try{return new URL($).username.length>0}catch{return!1}}function Jc0($){let Z=$.repo?.cloneUrl;if(!Z||!Hs8(Z))return null;return{git:{repository:{cloneUrl:Z}}}}var Wc0=B(()=>{q0$();k0$()});function Ns8($){return(typeof $.timeout==="number"&&$.timeout>0?Math.min($.timeout,120000):30000)+15000}function Fs8($,Z){if($.aborted)return Z.catch(()=>{}),Promise.reject($.reason??Error("aborted"));return new Promise((X,Q)=>{let G=()=>{Z.catch(()=>{}),Q($.reason??Error("aborted"))};$.addEventListener("abort",G,{once:!0}),Z.then(X,Q).finally(()=>{$.removeEventListener("abort",G)})})}async function Us8($,Z,X,Q,G="POST",Y){let J=Y?.timeoutMs??Ns8(Q??{}),W=AbortSignal.timeout(J),K=Y?.signal?AbortSignal.any([Y.signal,W]):W,H,N;try{let U=new Headers({"content-type":"application/json"});if(Y?.threadId)U.set("x-thread-id",Y.threadId);let w={method:G,headers:U,body:null,signal:K};if(G!=="GET"&&Q!==null)w.body=JSON.stringify(Q);({res:H,rawText:N}=await Fs8(K,(async()=>{let O=await $.proxyDaemonRequest(Z,X,w);return{res:O,rawText:await O.text()}})()))}catch(U){if(Y?.signal?.aborted)throw U;if(W.aborted)throw Error(`Sandbox ${G} ${X} timed out after ${Math.round(J/1000)}s \u2014 the sandbox may be overloaded or its filesystem stalled. Retry, or use a smaller operation.`);throw new Zi(U)}let F;try{F=JSON.parse(N)}catch{console.error("[sandbox-fs-hooks] Failed to parse JSON response runner=%s path=%s status=%d rawText=%s",$.kind,X,H.status,N.slice(0,2000));let U=H.status>=500?" (server error)":H.status===0?" (no response)":"";throw Error(`Daemon ${X} returned invalid JSON (HTTP ${H.status}${U}): ${N.slice(0,800)}`)}if(!H.ok){console.error("[sandbox-fs-hooks] Non-OK response runner=%s path=%s status=%d body=%s",$.kind,X,H.status,N.slice(0,2000));let U=F.error??`Daemon ${X} failed (${H.status})`;if(H.status===404&&U==="sandbox not found")throw new Zi(Error(U),!0);throw Error(U)}return F}function ws8($){let Z=[];for(let X of $.split(`
+`)}})}},nu0={"content-type":"text/event-stream","cache-control":"no-cache",connection:"keep-alive","x-vercel-ai-ui-message-stream":"v1","x-accel-buffering":"no"};lm=e0.record(e0.string(),AL.optional()),pu0=U0(()=>$0(e0.union([e0.strictObject({type:e0.literal("text-start"),id:e0.string(),providerMetadata:K$.optional()}),e0.strictObject({type:e0.literal("text-delta"),id:e0.string(),delta:e0.string(),providerMetadata:K$.optional()}),e0.strictObject({type:e0.literal("text-end"),id:e0.string(),providerMetadata:K$.optional()}),e0.strictObject({type:e0.literal("error"),errorText:e0.string()}),e0.strictObject({type:e0.literal("tool-input-start"),toolCallId:e0.string(),toolName:e0.string(),providerExecuted:e0.boolean().optional(),providerMetadata:K$.optional(),toolMetadata:lm.optional(),dynamic:e0.boolean().optional(),title:e0.string().optional()}),e0.strictObject({type:e0.literal("tool-input-delta"),toolCallId:e0.string(),inputTextDelta:e0.string()}),e0.strictObject({type:e0.literal("tool-input-available"),toolCallId:e0.string(),toolName:e0.string(),input:e0.unknown(),providerExecuted:e0.boolean().optional(),providerMetadata:K$.optional(),toolMetadata:lm.optional(),dynamic:e0.boolean().optional(),title:e0.string().optional()}),e0.strictObject({type:e0.literal("tool-input-error"),toolCallId:e0.string(),toolName:e0.string(),input:e0.unknown(),providerExecuted:e0.boolean().optional(),providerMetadata:K$.optional(),toolMetadata:lm.optional(),dynamic:e0.boolean().optional(),errorText:e0.string(),title:e0.string().optional()}),e0.strictObject({type:e0.literal("tool-approval-request"),approvalId:e0.string(),toolCallId:e0.string(),signature:e0.string().optional()}),e0.strictObject({type:e0.literal("tool-output-available"),toolCallId:e0.string(),output:e0.unknown(),providerExecuted:e0.boolean().optional(),providerMetadata:K$.optional(),toolMetadata:lm.optional(),dynamic:e0.boolean().optional(),preliminary:e0.boolean().optional()}),e0.strictObject({type:e0.literal("tool-output-error"),toolCallId:e0.string(),errorText:e0.string(),providerExecuted:e0.boolean().optional(),providerMetadata:K$.optional(),toolMetadata:lm.optional(),dynamic:e0.boolean().optional()}),e0.strictObject({type:e0.literal("tool-output-denied"),toolCallId:e0.string()}),e0.strictObject({type:e0.literal("reasoning-start"),id:e0.string(),providerMetadata:K$.optional()}),e0.strictObject({type:e0.literal("reasoning-delta"),id:e0.string(),delta:e0.string(),providerMetadata:K$.optional()}),e0.strictObject({type:e0.literal("reasoning-end"),id:e0.string(),providerMetadata:K$.optional()}),e0.strictObject({type:e0.literal("source-url"),sourceId:e0.string(),url:e0.string(),title:e0.string().optional(),providerMetadata:K$.optional()}),e0.strictObject({type:e0.literal("source-document"),sourceId:e0.string(),mediaType:e0.string(),title:e0.string(),filename:e0.string().optional(),providerMetadata:K$.optional()}),e0.strictObject({type:e0.literal("file"),url:e0.string(),mediaType:e0.string(),providerMetadata:K$.optional()}),e0.strictObject({type:e0.custom(($)=>typeof $==="string"&&$.startsWith("data-"),{message:'Type must start with "data-"'}),id:e0.string().optional(),data:e0.unknown(),transient:e0.boolean().optional()}),e0.strictObject({type:e0.literal("start-step")}),e0.strictObject({type:e0.literal("finish-step")}),e0.strictObject({type:e0.literal("start"),messageId:e0.string().optional(),messageMetadata:e0.unknown().optional()}),e0.strictObject({type:e0.literal("finish"),finishReason:e0.enum(["stop","length","content-filter","tool-calls","error","other"]).optional(),messageMetadata:e0.unknown().optional()}),e0.strictObject({type:e0.literal("abort"),reason:e0.string().optional()}),e0.strictObject({type:e0.literal("message-metadata"),messageMetadata:e0.unknown()})])));gr8=MY;hr8=im;cr8=W3({prefix:"aitxt",size:24}),lr8={file:!0,source:!0,"text-start":!0,"text-end":!0,"text-delta":!0,"reasoning-start":!0,"reasoning-end":!0,"reasoning-delta":!0,"tool-input-start":!0,"tool-input-end":!0,"tool-input-delta":!0,"tool-approval-request":!0,"tool-call":!0,"tool-result":!0,"tool-error":!0,"stream-start":!1,"response-metadata":!1,finish:!1,error:!1,raw:!1};TQ=J0.record(J0.string(),AL.optional()),pr8=U0(()=>$0(J0.array(J0.object({id:J0.string(),role:J0.enum(["system","user","assistant"]),metadata:J0.unknown().optional(),parts:J0.array(J0.union([J0.object({type:J0.literal("text"),text:J0.string(),state:J0.enum(["streaming","done"]).optional(),providerMetadata:K$.optional()}),J0.object({type:J0.literal("reasoning"),text:J0.string(),state:J0.enum(["streaming","done"]).optional(),providerMetadata:K$.optional()}),J0.object({type:J0.literal("source-url"),sourceId:J0.string(),url:J0.string(),title:J0.string().optional(),providerMetadata:K$.optional()}),J0.object({type:J0.literal("source-document"),sourceId:J0.string(),mediaType:J0.string(),title:J0.string(),filename:J0.string().optional(),providerMetadata:K$.optional()}),J0.object({type:J0.literal("file"),mediaType:J0.string(),filename:J0.string().optional(),url:J0.string(),providerMetadata:K$.optional()}),J0.object({type:J0.literal("step-start")}),J0.object({type:J0.string().startsWith("data-"),id:J0.string().optional(),data:J0.unknown()}),J0.object({type:J0.literal("dynamic-tool"),toolName:J0.string(),toolCallId:J0.string(),toolMetadata:TQ.optional(),state:J0.literal("input-streaming"),input:J0.unknown().optional(),providerExecuted:J0.boolean().optional(),callProviderMetadata:K$.optional(),output:J0.never().optional(),errorText:J0.never().optional(),approval:J0.never().optional()}),J0.object({type:J0.literal("dynamic-tool"),toolName:J0.string(),toolCallId:J0.string(),toolMetadata:TQ.optional(),state:J0.literal("input-available"),input:J0.unknown(),providerExecuted:J0.boolean().optional(),output:J0.never().optional(),errorText:J0.never().optional(),callProviderMetadata:K$.optional(),approval:J0.never().optional()}),J0.object({type:J0.literal("dynamic-tool"),toolName:J0.string(),toolCallId:J0.string(),toolMetadata:TQ.optional(),state:J0.literal("approval-requested"),input:J0.unknown(),providerExecuted:J0.boolean().optional(),output:J0.never().optional(),errorText:J0.never().optional(),callProviderMetadata:K$.optional(),approval:J0.object({id:J0.string(),approved:J0.never().optional(),reason:J0.never().optional(),signature:J0.string().optional()})}),J0.object({type:J0.literal("dynamic-tool"),toolName:J0.string(),toolCallId:J0.string(),toolMetadata:TQ.optional(),state:J0.literal("approval-responded"),input:J0.unknown(),providerExecuted:J0.boolean().optional(),output:J0.never().optional(),errorText:J0.never().optional(),callProviderMetadata:K$.optional(),approval:J0.object({id:J0.string(),approved:J0.boolean(),reason:J0.string().optional(),signature:J0.string().optional()})}),J0.object({type:J0.literal("dynamic-tool"),toolName:J0.string(),toolCallId:J0.string(),toolMetadata:TQ.optional(),state:J0.literal("output-available"),input:J0.unknown(),providerExecuted:J0.boolean().optional(),output:J0.unknown(),errorText:J0.never().optional(),callProviderMetadata:K$.optional(),resultProviderMetadata:K$.optional(),preliminary:J0.boolean().optional(),approval:J0.object({id:J0.string(),approved:J0.literal(!0),reason:J0.string().optional(),signature:J0.string().optional()}).optional()}),J0.object({type:J0.literal("dynamic-tool"),toolName:J0.string(),toolCallId:J0.string(),toolMetadata:TQ.optional(),state:J0.literal("output-error"),input:J0.unknown().optional(),rawInput:J0.unknown().optional(),providerExecuted:J0.boolean().optional(),output:J0.never().optional(),errorText:J0.string(),callProviderMetadata:K$.optional(),resultProviderMetadata:K$.optional(),approval:J0.object({id:J0.string(),approved:J0.literal(!0),reason:J0.string().optional(),signature:J0.string().optional()}).optional()}),J0.object({type:J0.literal("dynamic-tool"),toolName:J0.string(),toolCallId:J0.string(),toolMetadata:TQ.optional(),state:J0.literal("output-denied"),input:J0.unknown(),providerExecuted:J0.boolean().optional(),output:J0.never().optional(),errorText:J0.never().optional(),callProviderMetadata:K$.optional(),approval:J0.object({id:J0.string(),approved:J0.literal(!1),reason:J0.string().optional(),signature:J0.string().optional()})}),J0.object({type:J0.string().startsWith("tool-"),toolCallId:J0.string(),toolMetadata:TQ.optional(),state:J0.literal("input-streaming"),providerExecuted:J0.boolean().optional(),callProviderMetadata:K$.optional(),input:J0.unknown().optional(),output:J0.never().optional(),errorText:J0.never().optional(),approval:J0.never().optional()}),J0.object({type:J0.string().startsWith("tool-"),toolCallId:J0.string(),toolMetadata:TQ.optional(),state:J0.literal("input-available"),providerExecuted:J0.boolean().optional(),input:J0.unknown(),output:J0.never().optional(),errorText:J0.never().optional(),callProviderMetadata:K$.optional(),approval:J0.never().optional()}),J0.object({type:J0.string().startsWith("tool-"),toolCallId:J0.string(),toolMetadata:TQ.optional(),state:J0.literal("approval-requested"),input:J0.unknown(),providerExecuted:J0.boolean().optional(),output:J0.never().optional(),errorText:J0.never().optional(),callProviderMetadata:K$.optional(),approval:J0.object({id:J0.string(),approved:J0.never().optional(),reason:J0.never().optional(),signature:J0.string().optional()})}),J0.object({type:J0.string().startsWith("tool-"),toolCallId:J0.string(),toolMetadata:TQ.optional(),state:J0.literal("approval-responded"),input:J0.unknown(),providerExecuted:J0.boolean().optional(),output:J0.never().optional(),errorText:J0.never().optional(),callProviderMetadata:K$.optional(),approval:J0.object({id:J0.string(),approved:J0.boolean(),reason:J0.string().optional(),signature:J0.string().optional()})}),J0.object({type:J0.string().startsWith("tool-"),toolCallId:J0.string(),toolMetadata:TQ.optional(),state:J0.literal("output-available"),providerExecuted:J0.boolean().optional(),input:J0.unknown(),output:J0.unknown(),errorText:J0.never().optional(),callProviderMetadata:K$.optional(),resultProviderMetadata:K$.optional(),preliminary:J0.boolean().optional(),approval:J0.object({id:J0.string(),approved:J0.literal(!0),reason:J0.string().optional(),signature:J0.string().optional()}).optional()}),J0.object({type:J0.string().startsWith("tool-"),toolCallId:J0.string(),toolMetadata:TQ.optional(),state:J0.literal("output-error"),providerExecuted:J0.boolean().optional(),input:J0.unknown().optional(),rawInput:J0.unknown().optional(),output:J0.never().optional(),errorText:J0.string(),callProviderMetadata:K$.optional(),resultProviderMetadata:K$.optional(),approval:J0.object({id:J0.string(),approved:J0.literal(!0),reason:J0.string().optional(),signature:J0.string().optional()}).optional()}),J0.object({type:J0.string().startsWith("tool-"),toolCallId:J0.string(),toolMetadata:TQ.optional(),state:J0.literal("output-denied"),providerExecuted:J0.boolean().optional(),input:J0.unknown(),output:J0.never().optional(),errorText:J0.never().optional(),callProviderMetadata:K$.optional(),approval:J0.object({id:J0.string(),approved:J0.literal(!1),reason:J0.string().optional(),signature:J0.string().optional()})})])).nonempty("Message must contain at least one part")})).nonempty("Messages array must not be empty")));Xa8=B50,Qa8={type:"no-schema",jsonSchema:async()=>{return},async validatePartialResult({value:$,textDelta:Z}){return{success:!0,value:{partial:$,textDelta:Z}}},async validateFinalResult($,Z){return $===void 0?{success:!1,error:new IQ({message:"No object generated: response did not match schema.",text:Z.text,response:Z.response,usage:Z.usage,finishReason:Z.finishReason})}:{success:!0,value:$}},createElementStream(){throw new I4({functionality:"element streams in no-schema mode"})}};Wa8=W3({prefix:"aiobj",size:24});Ua8=W3({prefix:"aiobj",size:24});Ba8=class extends Lw{constructor({data:$,mediaType:Z}){super({data:$,mediaType:Z});let X="mp3";if(Z){let Q=Z.split("/");if(Q.length===2){if(Z!=="audio/mpeg")X=Q[1]}}if(!X)throw Error("Audio format must be provided or determinable from media type");this.format=X}};Ea8={word:/\S+\s+/m,line:/\n+/m};za8=eu0();ga8=L0$,j0$=`vercel.ai.error.${E0$}`,ha8=Symbol.for(j0$),P0$=class extends V5{constructor({modelId:$,modelType:Z,providerId:X,availableProviders:Q,message:G=`No such provider: ${X} (available providers: ${Q.join()})`}){super({errorName:E0$,modelId:$,modelType:Z,message:G});this[z0$]=!0,this.providerId=X,this.availableProviders=Q}static isInstance($){return Y1.hasMarker($,j0$)}};z0$=ha8;ua8=A0$;da8=eu0();R0$=class extends Xc0{constructor($={}){super($)}processResponseStream($){return ZN({stream:$,schema:pu0}).pipeThrough(new TransformStream({async transform(Z,X){if(!Z.success)throw Z.error;X.enqueue(Z.value)}}))}};$s8=class extends Xc0{constructor($={}){super($)}processResponseStream($){return ea8({stream:$.pipeThrough(new TextDecoderStream)})}}});import{z as Zs8}from"zod";function kL($){return $==="cluster"?"agent-sandbox":$}function Gc0($){return`${$.userId}:${$.projectRef}`}var Xs8;var D50=B(()=>{Xs8=Zs8.enum(["agent-sandbox","user-desktop"])});class L50{map=new Map;async run($,Z){let X=this.map.get($);if(X)return X;let Q=Z();this.map.set($,Q);try{return await Q}finally{this.map.delete($)}}}function E50($,Z,X,Q){if(!$)return Q(null);if(!$.withLock)return Q($);return $.withLock(Z,X,Q)}function em($){if("threadId"in $){if(!$.threadId)throw Error("composeSandboxRef: threadId required");return`thread:${$.threadId}`}if(!$.orgId||!$.virtualMcpId||!$.branch)throw Error("composeSandboxRef: orgId, virtualMcpId and branch are all required for agent refs");return`agent:${$.orgId}:${$.virtualMcpId}:${$.branch}`}function I0$($){if($.startsWith("thread:"))return $.slice(7);if(!$.startsWith("agent:"))return"";let Z=$.split(":");return Z.length>=4?Z.slice(3).join(":"):""}import{createHash as Qs8}from"crypto";function Ys8($,Z=16){return Qs8("sha256").update(Gc0($)).digest("hex").slice(0,Z)}function SL($){let Z=Ys8($),X=Js8(I0$($.projectRef));return X?`${X}-${Z}`:`s-${Z}`}function Js8($){if(!$)return"";return($.split("/").pop()??"").toLowerCase().replace(/[^a-z0-9]+/g,"-").replace(/^-+|-+$/g,"").slice(0,Gs8).replace(/-+$/g,"")}var Gs8=24;var q0$=B(()=>{D50()});function j50($,Z){let X=$.replace(/\/+$/,"");if(X.includes("{handle}"))return`${X.replace("{handle}",Z)}/`;try{let Q=new URL(X);return Q.hostname=`${Z}.${Q.hostname}`,`${Q.toString()}/`}catch{return`${X}/${Z}/`}}function $i($){let Z=$?.userName?.trim();if(!Z||M0$.test(Z))return null;let X=$?.userEmail?.trim();if(!X||M0$.test(X))return{userName:Z};if(!Ws8.test(X))return{userName:Z};return{userName:Z,userEmail:X}}var M0$,Ws8;var Yc0=B(()=>{M0$=/[\r\n<>]/,Ws8=/^[^\s@<>]+@[^\s@<>]+\.[^\s@<>]+$/});function z50($){let Z=$.repo,X=Z?{repository:{cloneUrl:Z.cloneUrl,repoName:Z.displayName??Ks8(Z.cloneUrl),...Z.branch?{branch:Z.branch}:{},submoduleCredentials:Z.submoduleCredentials??[]},...Z.userName.trim()||Z.userEmail.trim()?{identity:{userName:Z.userName,userEmail:Z.userEmail}}:{}}:void 0,Q=$.tenant,G=$i({userName:Q?.userName,userEmail:Q?.userEmail})??void 0,Y=$.packageManager?{name:$.packageManager.name,...$.packageManager.path?{path:$.packageManager.path}:{}}:void 0,J=Y?{packageManager:Y,runtime:$.runtime,...$.port!==void 0?{port:$.port}:{}}:void 0,W=Q?.orgId;if(!X&&!J&&!G&&!$.cloneOnly&&!W)return null;return{...X?{git:X}:{},...G?{operator:G}:{},...W?{orgId:W}:{},...$.cloneOnly!==void 0?{cloneOnly:$.cloneOnly}:{},...J?{application:J}:{}}}function Ks8($){try{let Z=new URL($);return Z.pathname.replace(/^\/+/,"").replace(/\.git$/,"")||Z.hostname}catch{return $}}var k0$=B(()=>{Yc0()});function Hs8($){try{return new URL($).username.length>0}catch{return!1}}function Jc0($){let Z=$.repo?.cloneUrl;if(!Z||!Hs8(Z))return null;return{git:{repository:{cloneUrl:Z}}}}var Wc0=B(()=>{q0$();k0$()});function Ns8($){return(typeof $.timeout==="number"&&$.timeout>0?Math.min($.timeout,120000):30000)+15000}function Fs8($,Z){if($.aborted)return Z.catch(()=>{}),Promise.reject($.reason??Error("aborted"));return new Promise((X,Q)=>{let G=()=>{Z.catch(()=>{}),Q($.reason??Error("aborted"))};$.addEventListener("abort",G,{once:!0}),Z.then(X,Q).finally(()=>{$.removeEventListener("abort",G)})})}async function Us8($,Z,X,Q,G="POST",Y){let J=Y?.timeoutMs??Ns8(Q??{}),W=AbortSignal.timeout(J),K=Y?.signal?AbortSignal.any([Y.signal,W]):W,H,N;try{let U=new Headers({"content-type":"application/json"});if(Y?.threadId)U.set("x-thread-id",Y.threadId);let w={method:G,headers:U,body:null,signal:K};if(G!=="GET"&&Q!==null)w.body=JSON.stringify(Q);({res:H,rawText:N}=await Fs8(K,(async()=>{let O=await $.proxyDaemonRequest(Z,X,w);return{res:O,rawText:await O.text()}})()))}catch(U){if(Y?.signal?.aborted)throw U;if(W.aborted)throw Error(`Sandbox ${G} ${X} timed out after ${Math.round(J/1000)}s \u2014 the sandbox may be overloaded or its filesystem stalled. Retry, or use a smaller operation.`);throw new Zi(U)}let F;try{F=JSON.parse(N)}catch{console.error("[sandbox-fs-hooks] Failed to parse JSON response runner=%s path=%s status=%d rawText=%s",$.kind,X,H.status,N.slice(0,2000));let U=H.status>=500?" (server error)":H.status===0?" (no response)":"";throw Error(`Daemon ${X} returned invalid JSON (HTTP ${H.status}${U}): ${N.slice(0,800)}`)}if(!H.ok){console.error("[sandbox-fs-hooks] Non-OK response runner=%s path=%s status=%d body=%s",$.kind,X,H.status,N.slice(0,2000));let U=F.error??`Daemon ${X} failed (${H.status})`;if(H.status===404&&U==="sandbox not found")throw new Zi(Error(U),!0);throw Error(U)}return F}function ws8($){let Z=[];for(let X of $.split(`
 `)){if(!X)continue;let Q=X.indexOf(":");if(Q<0)continue;let G=X.indexOf(":",Q+1);if(G<0)continue;let Y=X.slice(0,Q),J=Number.parseInt(X.slice(Q+1,G),10);if(!Number.isFinite(J))continue;Z.push({file:Y,line:J,text:X.slice(G+1)})}return Z}function Kc0($,Z){let{ensureHandle:X,invalidateHandle:Q,canAutoRestart:G}=Z,Y=(W)=>{let K=W instanceof Error?W.message:String(W);return G?`Sandbox is unreachable and auto-restart did not recover it: ${K}`:"The sandbox is not running. Ask the user to start it by clicking the server button (left side of the header bar)."},J=async(W,K,H="POST",N)=>{let F=async(w)=>Us8($,w,W,K,H,{signal:N,timeoutMs:Z.opTimeoutMs,threadId:Z.threadId}),U=await X();try{return await F(U)}catch(w){if(!(w instanceof Zi))throw w;if(!G&&!w.gone)throw Error(Y(w.cause??w));console.warn(`[sandbox-fs-hooks] daemon ${W} unreachable \u2014 reaping sandbox and retrying once`,w.cause??w);try{await Q({force:w.gone})}catch(D){console.warn("[sandbox-fs-hooks] invalidateHandle failed",D)}let O;try{O=await X()}catch(D){throw Error(`Failed to restart sandbox: ${D instanceof Error?D.message:String(D)}`)}try{return await F(O)}catch(D){if(D instanceof Zi)throw Error(Y(D.cause??D));throw D}}};return{onProxy:(W,K,H,N)=>J(W,K,H,N),onRead:async(W)=>{return(await J("/_sandbox/read",{path:W})).content},onWrite:async(W,K)=>{await J("/_sandbox/write",{path:W,content:K})},onEdit:async(W,K)=>{for(let H of K)await J("/_sandbox/edit",{path:W,old_string:H.oldText,new_string:H.newText,replace_all:H.replaceAll===!0})},onBash:async(W,K)=>{return await J("/_sandbox/bash",{command:W,...K?.cwd!==void 0?{cwd:K.cwd}:{},...K?.timeoutMs!==void 0?{timeout:K.timeoutMs}:{}})},onGlob:async(W)=>{return(await J("/_sandbox/glob",{pattern:W})).files},onGrep:async(W,K)=>{let H=await J("/_sandbox/grep",{pattern:W,output_mode:"content",...K?.path!==void 0?{path:K.path}:{},...K?.glob!==void 0?{glob:K.glob}:{},...K?.caseInsensitive?{ignore_case:!0}:{}});return ws8(H.results)}}}var Zi;var S0$=B(()=>{Zi=class Zi extends Error{code="DAEMON_UNREACHABLE";gone;constructor($,Z=!1){super($ instanceof Error?$.message:"Daemon proxy failed");if(this.gone=Z,$ instanceof Error)this.cause=$}}});function Os8($){return $==="agent-sandbox"||$==="cluster"||$==="user-desktop"}function VL(){let $=process.env.STUDIO_SANDBOX_PROVIDER,Z=$&&$.length>0?$:"user-desktop";if(!Os8(Z))throw Error(`Unknown STUDIO_SANDBOX_PROVIDER="${$}" \u2014 expected "agent-sandbox", "cluster", or "user-desktop".`);return kL(Z)}var GN=B(()=>{D50();D50();Wc0();S0$()});function C5($){if(!$||typeof $!=="object")return{};let Z=$.sandboxMap;if(!Z||typeof Z!=="object")return{};return Z}function rW($,Z,X,Q){let G=$[Z]?.[X];if(!G)return null;return VJ(G)[Q]??null}function Xi($,Z,X,Q,G){let J={...VJ($[Z]?.[X]),[Q]:G};return{...$,[Z]:{...$[Z]??{},[X]:J}}}async function V0$($,Z,X,Q,G,Y,J){let W=await $.findById(Z);if(!W)return;let K=W.metadata??{},H=Xi(C5(K),Q,G,Y,J);await $.update(Z,X,{metadata:{...K,sandboxMap:H}})}function Hc0($,Z,X,Q){let G=VJ($[Z]?.[X]);if(!G[Q])return null;let Y={...G};delete Y[Q];let J={...$[Z]??{}};if(Object.keys(Y).length===0)delete J[X];else J[X]=Y;let W={...$};if(Object.keys(J).length===0)delete W[Z];else W[Z]=J;return W}async function Tw($,Z,X,Q,G,Y){let J=await $.findById(Z);if(!J)return;let W=J.metadata??{},K=Hc0(C5(W),Q,G,Y);if(!K)return;await $.update(Z,X,{metadata:{...W,sandboxMap:K}})}var qQ=B(()=>{L8()});import{createHash as Bs8}from"crypto";import{sql as P50}from"kysely";function Ds8($,Z){return Bs8("sha256").update($.userId).update("\x00").update($.projectRef).update("\x00").update(Z).digest().readBigInt64BE(0)}async function _0$($,Z,X){let Q=await $.selectFrom("sandbox_runner_state").select(["handle","state","updated_at"]).where("user_id","=",Z.userId).where("project_ref","=",Z.projectRef).where("sandbox_provider_kind","=",X).executeTakeFirst();if(!Q)return null;return{handle:Q.handle,state:Q.state,updatedAt:Q.updated_at}}async function v0$($,Z,X){let Q=await $.selectFrom("sandbox_runner_state").select(["user_id","project_ref","handle","state","updated_at"]).where("sandbox_provider_kind","=",Z).where("handle","=",X).executeTakeFirst();if(!Q)return null;return{id:{userId:Q.user_id,projectRef:Q.project_ref},handle:Q.handle,state:Q.state,updatedAt:Q.updated_at}}async function b0$($,Z,X,Q){let G=JSON.stringify(Q.state),Y=new Date().toISOString();await $.insertInto("sandbox_runner_state").values({user_id:Z.userId,project_ref:Z.projectRef,sandbox_provider_kind:X,handle:Q.handle,state:G,updated_at:Y}).onConflict((J)=>J.columns(["user_id","project_ref","sandbox_provider_kind"]).doUpdateSet({handle:Q.handle,state:G,updated_at:Y})).execute()}async function f0$($,Z,X){await $.deleteFrom("sandbox_runner_state").where("user_id","=",Z.userId).where("project_ref","=",Z.projectRef).where("sandbox_provider_kind","=",X).execute()}async function x0$($,Z,X){await $.deleteFrom("sandbox_runner_state").where("sandbox_provider_kind","=",Z).where("handle","=",X).execute()}function Ls8($){return{get:(Z,X)=>_0$($,Z,X),getByHandle:(Z,X)=>v0$($,Z,X),put:(Z,X,Q)=>b0$($,Z,X,Q),delete:(Z,X)=>f0$($,Z,X),deleteByHandle:(Z,X)=>x0$($,Z,X)}}class Qi{db;constructor($){this.db=$}get($,Z){return _0$(this.db,$,Z)}getByHandle($,Z){return v0$(this.db,$,Z)}put($,Z,X){return b0$(this.db,$,Z,X)}delete($,Z){return f0$(this.db,$,Z)}deleteByHandle($,Z){return x0$(this.db,$,Z)}async withLock($,Z,X){let Q=Ds8($,Z);return this.db.transaction().execute(async(G)=>{try{await P50`set local statement_timeout = ${P50.lit(C0$)}`.execute(G),await P50`select pg_advisory_xact_lock(${Q}::bigint)`.execute(G)}catch(Y){if(Es8(Y))throw Error(`sandbox advisory lock busy >${C0$}ms for user=${$.userId} projectRef=${$.projectRef} kind=${Z} \u2014 provisioner is slow or stuck; retry shortly`);throw Y}return await P50`set local statement_timeout = 0`.execute(G),X(Ls8(G))})}}function Es8($){if(!($ instanceof Error))return!1;return $.code==="57014"||/statement timeout/i.test($.message)}var C0$=90000;var Nc0=()=>{};async function js8($,Z){let X=$.organization?.id;if(!X)throw Error(d7);if(!Z.sourceConnectionId)throw Error(d7);let Q=await $.storage.connections.findById(Z.sourceConnectionId,X);if(!Q)throw Error(d7);let{clientFromConnection:G}=await Promise.resolve().then(() => ($m(),g0$)),Y=await G(Q,$,!0);try{let{result:J}=await fp1((H)=>Y.callTool({name:"MINT_REPO_TOKEN",arguments:{installationId:Z.installationId,owner:Z.owner,repo:Z.repo,permissions:H}}),Z.permissions),W=J.structuredContent?.token;if(J.isError||!W)throw Error(d7);let K=J.structuredContent?.expiresAt;return{accessToken:W,expiresAt:K?new Date(K):null}}finally{await Y.close().catch(()=>{})}}function zs8($,Z){return($?.getTime()??0)>Z?$:new Date(Z+y0$)}async function Ps8($,Z,X,Q){let G=Date.now(),Y=await js8($,X),J=zs8(Y.expiresAt,G);return await Q.upsert({connectionId:Z,accessToken:Y.accessToken,refreshToken:null,scope:null,expiresAt:J,clientId:null,clientSecret:null,tokenEndpoint:null}),Y.accessToken}async function A50($,Z,X){let Q=M9(Z);if(!Q)throw Error("Connection is not repo-scoped");if(!Q.sourceConnectionId)throw Error(d7);let G=new r6($.db,$.vault),Y=await G.get(Z.id);if(!X?.forceRefresh&&Y&&!G.isExpired(Y,Gi))return Y.accessToken;let J=Fc0.get(Z.id);if(J)return J;let W=Ps8($,Z.id,Q,G).finally(()=>{Fc0.delete(Z.id)});return Fc0.set(Z.id,W),W}var Fc0;var Uc0=B(()=>{YN();AY();PY();Fc0=new Map});function u0$($,Z){return`${$}::${Z}`}var h0$;var c0$=B(()=>{h0$={githubNotAuthenticated:"GITHUB_NOT_AUTHENTICATED"}});function l0$($,Z){return{cloneUrl:`https://github.com/${$}/${Z}.git`,gitUserName:T50.name,gitUserEmail:T50.email}}async function Rw($){let Z=await $.ctx.storage.connections.findById($.connectionId,$.organizationId),X=Z?M9(Z):null;if(!Z||!X?.sourceConnectionId)return;try{await A50($.ctx,Z,{forceRefresh:$.forceRefresh})}catch(Q){$.onLegacyMintError?.(Q)}}async function Iw($,Z,X,Q,G,Y){let J=new r6(Q,G),W=await F3({connectionId:$,tokenStorage:J,bufferMs:Y?.bufferMs});if(!W.accessToken)throw Error(u0$(h0$.githubNotAuthenticated,W.state==="refresh_failed"?d7:"No GitHub token found. Ensure the mcp-github connection is authenticated."));let K=W.accessToken,H=`https://x-access-token:${K}@github.com/${Z}/${X}.git`,N=T50.name,F=T50.email;if(!K.startsWith("ghs_"))try{let U=await fetch("https://api.github.com/user",{headers:{Authorization:`token ${K}`,Accept:"application/vnd.github+json"}});if(U.ok){let w=await U.json();N=w.name||w.login,F=w.email||`${w.login}@users.noreply.github.com`}}catch{}return{cloneUrl:H,gitUserName:N,gitUserEmail:F}}var T50;var rf=B(()=>{Uc0();PY();YN();AY();c0$();T50={name:"Deco Bot",email:"114028756+decobot@users.noreply.github.com"}});function d0$($){try{let[Z,X]=new URL($).pathname.replace(/^\//,"").split("/"),Q=X?.replace(/\.git$/,"");return Z&&Q?{owner:Z,name:Q}:null}catch{return null}}function Y1$($){return typeof $>"u"||$===null}function As8($){return typeof $==="object"&&$!==null}function Ts8($){if(Array.isArray($))return $;else if(Y1$($))return[];return[$]}function Rs8($,Z){var X,Q,G,Y;if(Z){Y=Object.keys(Z);for(X=0,Q=Y.length;X<Q;X+=1)G=Y[X],$[G]=Z[G]}return $}function Is8($,Z){var X="",Q;for(Q=0;Q<Z;Q+=1)X+=$;return X}function qs8($){return $===0&&Number.NEGATIVE_INFINITY===1/$}function J1$($,Z){var X="",Q=$.reason||"(unknown reason)";if(!$.mark)return Q;if($.mark.name)X+='in "'+$.mark.name+'" ';if(X+="("+($.mark.line+1)+":"+($.mark.column+1)+")",!Z&&$.mark.snippet)X+=`
 `+$.mark.snippet;return Q+" "+X}function Ji($,Z){if(Error.call(this),this.name="YAMLException",this.reason=$,this.mark=Z,this.message=J1$(this,!1),Error.captureStackTrace)Error.captureStackTrace(this,this.constructor);else this.stack=Error().stack||""}function wc0($,Z,X,Q,G){var Y="",J="",W=Math.floor(G/2)-1;if(Q-Z>W)Y=" ... ",Z=Q-W+Y.length;if(X-Q>W)J=" ...",X=Q+W-J.length;return{str:Y+$.slice(Z,X).replace(/\t/g,"\u2192")+J,pos:Q-Z+Y.length}}function Oc0($,Z){return a9.repeat(" ",Z-$.length)+$}function vs8($,Z){if(Z=Object.create(Z||null),!$.buffer)return null;if(!Z.maxLength)Z.maxLength=79;if(typeof Z.indent!=="number")Z.indent=1;if(typeof Z.linesBefore!=="number")Z.linesBefore=3;if(typeof Z.linesAfter!=="number")Z.linesAfter=2;var X=/\r?\n|\r|\0/g,Q=[0],G=[],Y,J=-1;while(Y=X.exec($.buffer))if(G.push(Y.index),Q.push(Y.index+Y[0].length),$.position<=Y.index&&J<0)J=Q.length-2;if(J<0)J=Q.length-1;var W="",K,H,N=Math.min($.line+Z.linesAfter,G.length).toString().length,F=Z.maxLength-(Z.indent+N+3);for(K=1;K<=Z.linesBefore;K++){if(J-K<0)break;H=wc0($.buffer,Q[J-K],G[J-K],$.position-(Q[J]-Q[J-K]),F),W=a9.repeat(" ",Z.indent)+Oc0(($.line-K+1).toString(),N)+" | "+H.str+`
@@ -1031,7 +1031,7 @@ ${H}`:H;return{...J,description:N,inputExamples:X?void 0:J.inputExamples}});retu
 `);let Q=Z.pax;if(Q)for(let G in Q)X+=al0(" "+G+"="+Q[G]+`
 `);return V4.from(X)};S54.decodePax=function(Z){let X={};while(Z.length){let Q=0;while(Q<Z.length&&Z[Q]!==32)Q++;let G=parseInt(V4.toString(Z.subarray(0,Q)),10);if(!G)return X;let Y=V4.toString(Z.subarray(Q+1,G-1)),J=Y.indexOf("=");if(J===-1)return X;X[Y.slice(0,J)]=Y.slice(J+1),Z=Z.subarray(G)}return X};S54.encode=function(Z){let X=V4.alloc(512),Q=Z.name,G="";if(Z.typeflag===5&&Q[Q.length-1]!=="/")Q+="/";if(V4.byteLength(Q)!==Q.length)return null;while(V4.byteLength(Q)>100){let Y=Q.indexOf("/");if(Y===-1)return null;G+=G?"/"+Q.slice(0,Y):Q.slice(0,Y),Q=Q.slice(Y+1)}if(V4.byteLength(Q)>100||V4.byteLength(G)>155)return null;if(Z.linkname&&V4.byteLength(Z.linkname)>100)return null;if(V4.write(X,Q),V4.write(X,fw(Z.mode&4095,6),100),V4.write(X,fw(Z.uid,6),108),V4.write(X,fw(Z.gid,6),116),M54(Z.size,X,124),V4.write(X,fw(Z.mtime.getTime()/1000|0,11),136),X[156]=48+I54(Z.type),Z.linkname)V4.write(X,Z.linkname,157);if(V4.copy(A5$,X,257),V4.copy(E54,X,263),Z.uname)V4.write(X,Z.uname,265);if(Z.gname)V4.write(X,Z.gname,297);if(V4.write(X,fw(Z.devmajor||0,6),329),V4.write(X,fw(Z.devminor||0,6),337),G)V4.write(X,G,345);return V4.write(X,fw(R5$(X),6),148),X};S54.decode=function(Z,X,Q){let G=Z[156]===0?0:Z[156]-48,Y=Hx(Z,0,100,X),J=bw(Z,100,8),W=bw(Z,108,8),K=bw(Z,116,8),H=bw(Z,124,12),N=bw(Z,136,12),F=R54(G),U=Z[157]===0?null:Hx(Z,157,100,X),w=Hx(Z,265,32),O=Hx(Z,297,32),D=bw(Z,329,8),L=bw(Z,337,8),E=R5$(Z);if(E===256)return null;if(E!==bw(Z,148,8))throw Error("Invalid tar header. Maybe the tar is corrupted or it needs to be gunzipped?");if(P54(Z)){if(Z[345])Y=Hx(Z,345,155,X)+"/"+Y}else if(A54(Z));else if(!Q)throw Error("Invalid tar header: unknown format.");if(G===0&&Y&&Y[Y.length-1]==="/")G=5;return{name:Y,mode:J,uid:W,gid:K,size:H,mtime:new Date(1000*N),type:F,linkname:U,uname:w,gname:O,devmajor:D,devminor:L,pax:null}};function P54($){return V4.equals(A5$,$.subarray(257,263))}function A54($){return V4.equals(j54,$.subarray(257,263))&&V4.equals(z54,$.subarray(263,265))}function T54($,Z,X){if(typeof $!=="number")return X;if($=~~$,$>=Z)return Z;if($>=0)return $;if($+=Z,$>=0)return $;return 0}function R54($){switch($){case 0:return"file";case 1:return"link";case 2:return"symlink";case 3:return"character-device";case 4:return"block-device";case 5:return"directory";case 6:return"fifo";case 7:return"contiguous-file";case 72:return"pax-header";case 55:return"pax-global-header";case 27:return"gnu-long-link-path";case 28:case 30:return"gnu-long-path"}return null}function I54($){switch($){case"file":return 0;case"link":return 1;case"symlink":return 2;case"character-device":return 3;case"block-device":return 4;case"directory":return 5;case"fifo":return 6;case"contiguous-file":return 7;case"pax-header":return 72}return 0}function T5$($,Z,X,Q){for(;X<Q;X++)if($[X]===Z)return X;return Q}function R5$($){let Z=256;for(let X=0;X<148;X++)Z+=$[X];for(let X=156;X<512;X++)Z+=$[X];return Z}function fw($,Z){if($=$.toString(8),$.length>Z)return"7777777777777777777".slice(0,Z)+" ";return"0000000000000000000".slice(0,Z-$.length)+$+" "}function q54($,Z,X){Z[X]=128;for(let Q=11;Q>0;Q--)Z[X+Q]=$&255,$=Math.floor($/256)}function M54($,Z,X){if($.toString(8).length>11)q54($,Z,X);else V4.write(Z,fw($,11),X)}function k54($){let Z;if($[0]===128)Z=!0;else if($[0]===255)Z=!1;else return null;let X=[],Q;for(Q=$.length-1;Q>0;Q--){let J=$[Q];if(Z)X.push(J);else X.push(255-J)}let G=0,Y=X.length;for(Q=0;Q<Y;Q++)G+=X[Q]*Math.pow(256,Q);return Z?G:-1*G}function bw($,Z,X){if($=$.subarray(Z,Z+X),Z=0,$[Z]&128)return k54($);else{while(Z<$.length&&$[Z]===32)Z++;let Q=T54(T5$($,32,Z,$.length),$.length,$.length);while(Z<Q&&$[Z]===0)Z++;if(Q===Z)return 0;return parseInt(V4.toString($.subarray(Z,Q)),8)}}function Hx($,Z,X,Q){return V4.toString($.subarray(Z,T5$($,0,Z,Z+X)),Q)}function al0($){let Z=V4.byteLength($),X=Math.floor(Math.log(Z)/Math.log(10))+1;if(Z+X>=Math.pow(10,X))X++;return Z+X+$}});var _5$=C((NY9,C5$)=>{var{Writable:f54,Readable:x54,getStreamError:I5$}=rl0(),y54=ml0(),q5$=Kx(),Nx=sl0(),g54=q5$.alloc(0);class M5${constructor(){this.buffered=0,this.shifted=0,this.queue=new y54,this._offset=0}push($){this.buffered+=$.byteLength,this.queue.push($)}shiftFirst($){return this._buffered===0?null:this._next($)}shift($){if($>this.buffered)return null;if($===0)return g54;let Z=this._next($);if($===Z.byteLength)return Z;let X=[Z];while(($-=Z.byteLength)>0)Z=this._next($),X.push(Z);return q5$.concat(X)}_next($){let Z=this.queue.peek(),X=Z.byteLength-this._offset;if($>=X){let Q=this._offset?Z.subarray(this._offset,Z.byteLength):Z;return this.queue.shift(),this._offset=0,this.buffered-=X,this.shifted+=X,Q}return this.buffered-=$,this.shifted+=$,Z.subarray(this._offset,this._offset+=$)}}class k5$ extends x54{constructor($,Z,X){super();this.header=Z,this.offset=X,this._parent=$}_read($){if(this.header.size===0)this.push(null);if(this._parent._stream===this)this._parent._update();$(null)}_predestroy(){this._parent.destroy(I5$(this))}_detach(){if(this._parent._stream===this)this._parent._stream=null,this._parent._missing=V5$(this.header.size),this._parent._update()}_destroy($){this._detach(),$(null)}}class S5$ extends f54{constructor($){super($);if(!$)$={};this._buffer=new M5$,this._offset=0,this._header=null,this._stream=null,this._missing=0,this._longHeader=!1,this._callback=el0,this._locked=!1,this._finished=!1,this._pax=null,this._paxGlobal=null,this._gnuLongPath=null,this._gnuLongLinkPath=null,this._filenameEncoding=$.filenameEncoding||"utf-8",this._allowUnknownFormat=!!$.allowUnknownFormat,this._unlockBound=this._unlock.bind(this)}_unlock($){if(this._locked=!1,$){this.destroy($),this._continueWrite($);return}this._update()}_consumeHeader(){if(this._locked)return!1;this._offset=this._buffer.shifted;try{this._header=Nx.decode(this._buffer.shift(512),this._filenameEncoding,this._allowUnknownFormat)}catch($){return this._continueWrite($),!1}if(!this._header)return!0;switch(this._header.type){case"gnu-long-path":case"gnu-long-link-path":case"pax-global-header":case"pax-header":return this._longHeader=!0,this._missing=this._header.size,!0}if(this._locked=!0,this._applyLongHeaders(),this._header.size===0||this._header.type==="directory")return this.emit("entry",this._header,this._createStream(),this._unlockBound),!0;return this._stream=this._createStream(),this._missing=this._header.size,this.emit("entry",this._header,this._stream,this._unlockBound),!0}_applyLongHeaders(){if(this._gnuLongPath)this._header.name=this._gnuLongPath,this._gnuLongPath=null;if(this._gnuLongLinkPath)this._header.linkname=this._gnuLongLinkPath,this._gnuLongLinkPath=null;if(this._pax){if(this._pax.path)this._header.name=this._pax.path;if(this._pax.linkpath)this._header.linkname=this._pax.linkpath;if(this._pax.size)this._header.size=parseInt(this._pax.size,10);this._header.pax=this._pax,this._pax=null}}_decodeLongHeader($){switch(this._header.type){case"gnu-long-path":this._gnuLongPath=Nx.decodeLongPath($,this._filenameEncoding);break;case"gnu-long-link-path":this._gnuLongLinkPath=Nx.decodeLongPath($,this._filenameEncoding);break;case"pax-global-header":this._paxGlobal=Nx.decodePax($);break;case"pax-header":this._pax=this._paxGlobal===null?Nx.decodePax($):Object.assign({},this._paxGlobal,Nx.decodePax($));break}}_consumeLongHeader(){this._longHeader=!1,this._missing=V5$(this._header.size);let $=this._buffer.shift(this._header.size);try{this._decodeLongHeader($)}catch(Z){return this._continueWrite(Z),!1}return!0}_consumeStream(){let $=this._buffer.shiftFirst(this._missing);if($===null)return!1;this._missing-=$.byteLength;let Z=this._stream.push($);if(this._missing===0){if(this._stream.push(null),Z)this._stream._detach();return Z&&this._locked===!1}return Z}_createStream(){return new k5$(this,this._header,this._offset)}_update(){while(this._buffer.buffered>0&&!this.destroying){if(this._missing>0){if(this._stream!==null){if(this._consumeStream()===!1)return;continue}if(this._longHeader===!0){if(this._missing>this._buffer.buffered)break;if(this._consumeLongHeader()===!1)return!1;continue}let $=this._buffer.shiftFirst(this._missing);if($!==null)this._missing-=$.byteLength;continue}if(this._buffer.buffered<512)break;if(this._stream!==null||this._consumeHeader()===!1)return}this._continueWrite(null)}_continueWrite($){let Z=this._callback;this._callback=el0,Z($)}_write($,Z){this._callback=Z,this._buffer.push($),this._update()}_final($){this._finished=this._missing===0&&this._buffer.buffered===0,$(this._finished?null:Error("Unexpected end of data"))}_predestroy(){this._continueWrite(null)}_destroy($){if(this._stream)this._stream.destroy(I5$(this));$(null)}[Symbol.asyncIterator](){let $=null,Z=null,X=null,Q=null,G=null,Y=this;return this.on("entry",K),this.on("error",(F)=>{$=F}),this.on("close",H),{[Symbol.asyncIterator](){return this},next(){return new Promise(W)},return(){return N(null)},throw(F){return N(F)}};function J(F){if(!G)return;let U=G;G=null,U(F)}function W(F,U){if($)return U($);if(Q){F({value:Q,done:!1}),Q=null;return}if(Z=F,X=U,J(null),Y._finished&&Z)Z({value:void 0,done:!0}),Z=X=null}function K(F,U,w){if(G=w,U.on("error",el0),Z)Z({value:U,done:!1}),Z=X=null;else Q=U}function H(){if(J($),!Z)return;if($)X($);else Z({value:void 0,done:!0});Z=X=null}function N(F){return Y.destroy(F),J(F),new Promise((U,w)=>{if(Y.destroyed)return U({value:void 0,done:!0});Y.once("close",function(){if(F)w(F);else U({value:void 0,done:!0})})})}}}C5$.exports=function(Z){return new S5$(Z)};function el0(){}function V5$($){return $&=511,$&&512-$}});var b5$=C((FY9,$d0)=>{var v5$={S_IFMT:61440,S_IFDIR:16384,S_IFCHR:8192,S_IFBLK:24576,S_IFIFO:4096,S_IFLNK:40960};try{$d0.exports=z0("fs").constants||v5$}catch{$d0.exports=v5$}});var c5$=C((UY9,u5$)=>{var{Readable:h54,Writable:u54,getStreamError:f5$}=rl0(),XV=Kx(),Fx=b5$(),bF0=sl0(),x5$=XV.alloc(1024);class y5$ extends u54{constructor($,Z,X){super({mapWritable:l54,eagerOpen:!0});if(this.written=0,this.header=Z,this._callback=X,this._linkname=null,this._isLinkname=Z.type==="symlink"&&!Z.linkname,this._isVoid=Z.type!=="file"&&Z.type!=="contiguous-file",this._finished=!1,this._pack=$,this._openCallback=null,this._pack._stream===null)this._pack._stream=this;else this._pack._pending.push(this)}_open($){if(this._openCallback=$,this._pack._stream===this)this._continueOpen()}_continuePack($){if(this._callback===null)return;let Z=this._callback;this._callback=null,Z($)}_continueOpen(){if(this._pack._stream===null)this._pack._stream=this;let $=this._openCallback;if(this._openCallback=null,$===null)return;if(this._pack.destroying)return $(Error("pack stream destroyed"));if(this._pack._finalized)return $(Error("pack stream is already finalized"));if(this._pack._stream=this,!this._isLinkname)this._pack._encode(this.header);if(this._isVoid)this._finish(),this._continuePack(null);$(null)}_write($,Z){if(this._isLinkname)return this._linkname=this._linkname?XV.concat([this._linkname,$]):$,Z(null);if(this._isVoid){if($.byteLength>0)return Z(Error("No body allowed for this entry"));return Z()}if(this.written+=$.byteLength,this._pack.push($))return Z();this._pack._drain=Z}_finish(){if(this._finished)return;if(this._finished=!0,this._isLinkname)this.header.linkname=this._linkname?XV.toString(this._linkname,"utf-8"):"",this._pack._encode(this.header);h5$(this._pack,this.header.size),this._pack._done(this)}_final($){if(this.written!==this.header.size)return $(Error("Size mismatch"));this._finish(),$(null)}_getError(){return f5$(this)||Error("tar entry destroyed")}_predestroy(){this._pack.destroy(this._getError())}_destroy($){this._pack._done(this),this._continuePack(this._finished?null:this._getError()),$()}}class g5$ extends h54{constructor($){super($);this._drain=Zd0,this._finalized=!1,this._finalizing=!1,this._pending=[],this._stream=null}entry($,Z,X){if(this._finalized||this.destroying)throw Error("already finalized or destroyed");if(typeof Z==="function")X=Z,Z=null;if(!X)X=Zd0;if(!$.size||$.type==="symlink")$.size=0;if(!$.type)$.type=c54($.mode);if(!$.mode)$.mode=$.type==="directory"?493:420;if(!$.uid)$.uid=0;if(!$.gid)$.gid=0;if(!$.mtime)$.mtime=new Date;if(typeof Z==="string")Z=XV.from(Z);let Q=new y5$(this,$,X);if(XV.isBuffer(Z))return $.size=Z.byteLength,Q.write(Z),Q.end(),Q;if(Q._isVoid)return Q;return Q}finalize(){if(this._stream||this._pending.length>0){this._finalizing=!0;return}if(this._finalized)return;this._finalized=!0,this.push(x5$),this.push(null)}_done($){if($!==this._stream)return;if(this._stream=null,this._finalizing)this.finalize();if(this._pending.length)this._pending.shift()._continueOpen()}_encode($){if(!$.pax){let Z=bF0.encode($);if(Z){this.push(Z);return}}this._encodePax($)}_encodePax($){let Z=bF0.encodePax({name:$.name,linkname:$.linkname,pax:$.pax}),X={name:"PaxHeader",mode:$.mode,uid:$.uid,gid:$.gid,size:Z.byteLength,mtime:$.mtime,type:"pax-header",linkname:$.linkname&&"PaxHeader",uname:$.uname,gname:$.gname,devmajor:$.devmajor,devminor:$.devminor};this.push(bF0.encode(X)),this.push(Z),h5$(this,Z.byteLength),X.size=$.size,X.type=$.type,this.push(bF0.encode(X))}_doDrain(){let $=this._drain;this._drain=Zd0,$()}_predestroy(){let $=f5$(this);if(this._stream)this._stream.destroy($);while(this._pending.length){let Z=this._pending.shift();Z.destroy($),Z._continueOpen()}this._doDrain()}_read($){this._doDrain(),$()}}u5$.exports=function(Z){return new g5$(Z)};function c54($){switch($&Fx.S_IFMT){case Fx.S_IFBLK:return"block-device";case Fx.S_IFCHR:return"character-device";case Fx.S_IFDIR:return"directory";case Fx.S_IFIFO:return"fifo";case Fx.S_IFLNK:return"symlink"}return"file"}function Zd0(){}function h5$($,Z){if(Z&=511,Z)$.push(x5$.subarray(0,512-Z))}function l54($){return XV.isBuffer($)?$:XV.from($)}});var l5$=C((d54)=>{d54.extract=_5$();d54.pack=c5$()});var i5$=C((OY9,m5$)=>{m5$.exports=d5$;function d5$($,Z){if($&&Z)return d5$($)(Z);if(typeof $!=="function")throw TypeError("need wrapper function");return Object.keys($).forEach(function(Q){X[Q]=$[Q]}),X;function X(){var Q=Array(arguments.length);for(var G=0;G<Q.length;G++)Q[G]=arguments[G];var Y=$.apply(this,Q),J=Q[Q.length-1];if(typeof Y==="function"&&Y!==J)Object.keys(J).forEach(function(W){Y[W]=J[W]});return Y}}});var Qd0=C((BY9,Xd0)=>{var n5$=i5$();Xd0.exports=n5$(fF0);Xd0.exports.strict=n5$(p5$);fF0.proto=fF0(function(){Object.defineProperty(Function.prototype,"once",{value:function(){return fF0(this)},configurable:!0}),Object.defineProperty(Function.prototype,"onceStrict",{value:function(){return p5$(this)},configurable:!0})});function fF0($){var Z=function(){if(Z.called)return Z.value;return Z.called=!0,Z.value=$.apply(this,arguments)};return Z.called=!1,Z}function p5$($){var Z=function(){if(Z.called)throw Error(Z.onceError);return Z.called=!0,Z.value=$.apply(this,arguments)},X=$.name||"Function wrapped with `once`";return Z.onceError=X+" shouldn't be called more than once",Z.called=!1,Z}});var r5$=C((DY9,o5$)=>{var n54=Qd0(),p54=function(){},t54=global.Bare?queueMicrotask:process.nextTick.bind(process),o54=function($){return $.setHeader&&typeof $.abort==="function"},r54=function($){return $.stdio&&Array.isArray($.stdio)&&$.stdio.length===3},t5$=function($,Z,X){if(typeof Z==="function")return t5$($,null,Z);if(!Z)Z={};X=n54(X||p54);var{_writableState:Q,_readableState:G}=$,Y=Z.readable||Z.readable!==!1&&$.readable,J=Z.writable||Z.writable!==!1&&$.writable,W=!1,K=function(){if(!$.writable)H()},H=function(){if(J=!1,!Y)X.call($)},N=function(){if(Y=!1,!J)X.call($)},F=function(L){X.call($,L?Error("exited with error code: "+L):null)},U=function(L){X.call($,L)},w=function(){t54(O)},O=function(){if(W)return;if(Y&&!(G&&(G.ended&&!G.destroyed)))return X.call($,Error("premature close"));if(J&&!(Q&&(Q.ended&&!Q.destroyed)))return X.call($,Error("premature close"))},D=function(){$.req.on("finish",H)};if(o54($))if($.on("complete",H),$.on("abort",w),$.req)D();else $.on("request",D);else if(J&&!Q)$.on("end",K),$.on("close",K);if(r54($))$.on("exit",F);if($.on("end",N),$.on("finish",H),Z.error!==!1)$.on("error",U);return $.on("close",w),function(){if(W=!0,$.removeListener("complete",H),$.removeListener("abort",w),$.removeListener("request",D),$.req)$.req.removeListener("finish",H);$.removeListener("end",K),$.removeListener("close",K),$.removeListener("finish",H),$.removeListener("exit",F),$.removeListener("end",N),$.removeListener("error",U),$.removeListener("close",w)}};o5$.exports=t5$});var e5$=C((LY9,s5$)=>{var a54=Qd0(),s54=r5$(),xF0;try{xF0=z0("fs")}catch($){}var zi=function(){},e54=typeof process>"u"?!1:/^v?\.0/.test(process.version),yF0=function($){return typeof $==="function"},$94=function($){if(!e54)return!1;if(!xF0)return!1;return($ instanceof(xF0.ReadStream||zi)||$ instanceof(xF0.WriteStream||zi))&&yF0($.close)},Z94=function($){return $.setHeader&&yF0($.abort)},X94=function($,Z,X,Q){Q=a54(Q);var G=!1;$.on("close",function(){G=!0}),s54($,{readable:Z,writable:X},function(J){if(J)return Q(J);G=!0,Q()});var Y=!1;return function(J){if(G)return;if(Y)return;if(Y=!0,$94($))return $.close(zi);if(Z94($))return $.abort();if(yF0($.destroy))return $.destroy();Q(J||Error("stream was destroyed"))}},a5$=function($){$()},Q94=function($,Z){return $.pipe(Z)},G94=function(){var $=Array.prototype.slice.call(arguments),Z=yF0($[$.length-1]||zi)&&$.pop()||zi;if(Array.isArray($[0]))$=$[0];if($.length<2)throw Error("pump requires two streams per minimum");var X,Q=$.map(function(G,Y){var J=Y<$.length-1,W=Y>0;return X94(G,J,W,function(K){if(!X)X=K;if(K)Q.forEach(a5$);if(J)return;Q.forEach(a5$),Z(X)})});return $.reduce(Q94)};s5$.exports=G94});var K9$=C((K94)=>{var $9$=l5$(),Z9$=e5$(),X9$=z0("fs"),p5=z0("path"),Pi=(global.Bare?global.Bare.platform:process.platform)==="win32";K94.pack=function(Z,X){if(!Z)Z=".";if(!X)X={};let Q=X.fs||X9$,G=X.ignore||X.filter||Ai,Y=X.mapStream||J9$,J=W94(Q,X.dereference?Q.stat:Q.lstat,Z,G,X.entries,X.sort),W=X.strict!==!1,K=typeof X.umask==="number"?~X.umask:~Q9$(),H=X.pack||$9$.pack(),N=X.finish||Ai,F=X.map||Ai,U=typeof X.dmode==="number"?X.dmode:0,w=typeof X.fmode==="number"?X.fmode:0;if(X.strip)F=W9$(F,X.strip);if(X.readable)U|=parseInt(555,8),w|=parseInt(444,8);if(X.writable)U|=parseInt(333,8),w|=parseInt(222,8);L();function O(E,j){Q.readlink(p5.join(Z,E),function(z,A){if(z)return H.destroy(z);j.linkname=Gd0(A),H.entry(j,L)})}function D(E,j,z){if(H.destroyed)return;if(E)return H.destroy(E);if(!j){if(X.finalize!==!1)H.finalize();return N(H)}if(z.isSocket())return L();let A={name:Gd0(j),mode:(z.mode|(z.isDirectory()?U:w))&K,mtime:z.mtime,size:z.size,type:"file",uid:z.uid,gid:z.gid};if(z.isDirectory())return A.size=0,A.type="directory",A=F(A)||A,H.entry(A,L);if(z.isSymbolicLink())return A.size=0,A.type="symlink",A=F(A)||A,O(j,A);if(A=F(A)||A,!z.isFile()){if(W)return H.destroy(Error("unsupported type for "+j));return L()}let P=H.entry(A,L),M=Y(Q.createReadStream(p5.join(Z,j),{start:0,end:A.size>0?A.size-1:A.size}),A);M.on("error",function(k){P.destroy(k)}),Z9$(M,P)}function L(E){if(E)return H.destroy(E);J(D)}return H};function Y94($){return $.length?$[$.length-1]:null}function J94(){return!global.Bare&&process.getuid?process.getuid():-1}function Q9$(){return!global.Bare&&process.umask?process.umask():0}K94.extract=function(Z,X){if(!Z)Z=".";if(!X)X={};Z=p5.resolve(Z);let Q=X.fs||X9$,G=X.ignore||X.filter||Ai,Y=X.mapStream||J9$,J=X.chown!==!1&&!Pi&&J94()===0,W=X.extract||$9$.extract(),K=[],H=new Date,N=typeof X.umask==="number"?~X.umask:~Q9$(),F=X.strict!==!1,U=X.validateSymlinks!==!1,w=X.map||Ai,O=typeof X.dmode==="number"?X.dmode:0,D=typeof X.fmode==="number"?X.fmode:0;if(X.strip)w=W9$(w,X.strip);if(X.readable)O|=parseInt(555,8),D|=parseInt(444,8);if(X.writable)O|=parseInt(333,8),D|=parseInt(222,8);if(W.on("entry",L),X.finish)W.on("finish",X.finish);return W;function L(P,M,k){P=w(P)||P,P.name=Gd0(P.name);let q=p5.join(Z,p5.join("/",P.name));if(G(q,P))return M.resume(),k();let _=p5.join(q,".")===p5.join(Z,".")?Z:p5.dirname(q);Y9$(Q,_,p5.join(Z,"."),function(o,w0){if(o)return k(o);if(!w0)return k(Error(_+" is not a valid path"));if(P.type==="directory")return K.push([q,P.mtime]),A(q,{fs:Q,own:J,uid:P.uid,gid:P.gid,mode:P.mode},l);A(_,{fs:Q,own:J,uid:P.uid,gid:P.gid,mode:493},function(O0){if(O0)return k(O0);switch(P.type){case"file":return h();case"link":return x();case"symlink":return b()}if(F)return k(Error("unsupported type for "+q+" ("+P.type+")"));M.resume(),k()})});function l(o){if(o)return k(o);j(q,P,function(w0){if(w0)return k(w0);if(Pi)return k();z(q,P,k)})}function b(){if(Pi)return k();Q.unlink(q,function(){let o=p5.resolve(p5.dirname(q),P.linkname);if(!p(o)&&U)return k(Error(q+" is not a valid symlink"));G9$(Q,o,p5.join(Z,"."),function(w0,O0){if(w0)return k(w0);if(!O0&&U)return k(Error(q+" is not a valid symlink"));Q.symlink(P.linkname,q,l)})})}function x(){if(Pi)return k();Q.unlink(q,function(){let o=p5.join(Z,p5.join("/",P.linkname));Q.realpath(o,function(w0,O0){if(w0||!p(O0))return k(Error(q+" is not a valid hardlink"));Q.link(O0,q,function(s){if(s&&s.code==="EPERM"&&X.hardlinkAsFilesFallback)return M=Q.createReadStream(O0),h();l(s)})})})}function p(o){return o===Z||o.startsWith(Z+p5.sep)}function h(){let o=Q.createWriteStream(q),w0=Y(M,P);o.on("error",function(O0){w0.destroy(O0)}),Z9$(w0,o,function(O0){if(O0)return k(O0);o.on("close",l)})}}function E(P,M){let k;while((k=Y94(K))&&P.slice(0,k[0].length)!==k[0])K.pop();if(!k)return M();Q.utimes(k[0],H,k[1],M)}function j(P,M,k){if(X.utimes===!1)return k();if(M.type==="directory")return Q.utimes(P,H,M.mtime,k);if(M.type==="symlink")return E(P,k);Q.utimes(P,H,M.mtime,function(q){if(q)return k(q);E(P,k)})}function z(P,M,k){let q=M.type==="symlink",_=q?Q.lchmod:Q.chmod,l=q?Q.lchown:Q.chown;if(!_)return k();let b=(M.mode|(M.type==="directory"?O:D))&N;if(l&&J)l.call(Q,P,M.uid,M.gid,x);else x(null);function x(p){if(p)return k(p);if(!_)return k();_.call(Q,P,b,k)}}function A(P,M,k){Q.stat(P,function(q){if(!q)return k(null);if(q.code!=="ENOENT")return k(q);Q.mkdir(P,{mode:M.mode,recursive:!0},function(_,l){if(_)return k(_);z(P,M,k)})})}};function G9$($,Z,X,Q){if(Z===X)return Q(null,!0);if(!Z.startsWith(X+p5.sep))return Q(null,!1);$.lstat(Z,function(G,Y){if(G&&G.code!=="ENOENT"&&G.code!=="EPERM")return Q(G);if(G||!Y.isSymbolicLink())return G9$($,p5.join(Z,".."),X,Q);Q(null,!1)})}function Y9$($,Z,X,Q){if(Z===X)return Q(null,!0);$.lstat(Z,function(G,Y){if(G&&G.code!=="ENOENT"&&G.code!=="EPERM")return Q(G);if(G||Y.isDirectory())return Y9$($,p5.join(Z,".."),X,Q);Q(null,!1)})}function Ai(){}function J9$($){return $}function Gd0($){return Pi?$.replace(/\\/g,"/").replace(/[:?<>|]/g,"_"):$}function W94($,Z,X,Q,G,Y){if(!G)G=["."];let J=G.slice(0);return function(K){if(!J.length)return K(null);let H=J.shift(),N=p5.join(X,H);Z.call($,N,function(F,U){if(F)return K(G.indexOf(H)===-1&&F.code==="ENOENT"?null:F);if(!U.isDirectory())return K(null,H,U);$.readdir(N,function(w,O){if(w)return K(w);if(Y)O.sort();for(let D=0;D<O.length;D++)if(!Q(p5.join(X,H,O[D])))J.push(p5.join(H,O[D]));K(null,H,U)})})}}function W9$($,Z){return function(X){X.name=X.name.split("/").slice(Z).join("/");let Q=X.linkname;if(Q&&(X.type==="link"||p5.isAbsolute(Q)))X.linkname=Q.split("/").slice(Z).join("/");return $(X)}}});var F94,U94;var H9$=B(()=>{ll0();F94=S(r6$(),1),U94=S(K9$(),1)});var gF0=()=>{};var N9$=B(()=>{sN0()});var F9$=B(()=>{IF0();RF0();gF0()});var U9$=()=>{};var w9$=()=>{};var Yd0=B(()=>{C6$();ul0();IF0();x6$();gl0();ll0();y6$();g6$();h6$();u6$();hl0();c6$();H9$();gF0();N9$();F9$();U9$();w9$();gF0()});var U9,V9,QV,Ti;var Ri=B(()=>{U9={CLAIM_API_GROUP:"extensions.agents.x-k8s.io",CLAIM_API_VERSION:"v1alpha1",CLAIM_PLURAL:"sandboxclaims",SANDBOX_API_GROUP:"agents.x-k8s.io",SANDBOX_API_VERSION:"v1alpha1",SANDBOX_PLURAL:"sandboxes",POD_NAME_ANNOTATION:"agents.x-k8s.io/pod-name"};V9=class V9 extends Error{cause;constructor($,Z){super($);if(this.name="SandboxError",this.cause=Z,Z instanceof Error&&Z.stack)this.stack=`${this.stack}
 Caused by: ${Z.stack}`}};QV=class QV extends V9{constructor($,Z){super($,Z);this.name="SandboxTimeoutError"}};Ti=class Ti extends V9{constructor($,Z){super($,Z);this.name="SandboxAlreadyExistsError"}}});async function w94($){let Z=$.getCurrentCluster();if(!Z)throw new V9("No active cluster in kubeconfig");let X={};await $.applyToHTTPSOptions(X);let Q={},G=X.headers??{};for(let[Y,J]of Object.entries(G))if(Array.isArray(J))Q[Y]=J.join(", ");else if(J!==void 0)Q[Y]=String(J);if(typeof X.auth==="string"&&!Q.Authorization)Q.Authorization=`Basic ${Buffer.from(X.auth).toString("base64")}`;return{server:Z.server.replace(/\/+$/,""),headers:Q,tls:{cert:Jd0(X.cert),key:Jd0(X.key),ca:Jd0(X.ca),rejectUnauthorized:Z.skipTLSVerify?!1:void 0}}}function Jd0($){if($==null)return;if(typeof $==="string")return $;if(Buffer.isBuffer($))return $.toString("utf8");return String($)}async function B3($,Z){let X=await w94($),Q={...X.headers,...Z.headers};if(Z.method==="PATCH")Q["content-type"]=Z.patchType==="apply"?"application/apply-patch+yaml":Z.patchType==="strategic-merge"?"application/strategic-merge-patch+json":"application/merge-patch+json";else if(Z.body!==void 0&&!("content-type"in Q))Q["content-type"]="application/json";let G={method:Z.method,headers:Q,body:Z.body===void 0?void 0:JSON.stringify(Z.body),signal:Z.signal,tls:X.tls,...Z.stream?{timeout:!1}:{}};return fetch(`${X.server}${Z.path}`,G)}async function Wd0($){try{return await $.json()}catch{return null}}async function hF0($,Z){if($.ok)return;let X=await Wd0($),Q=X?.message??`${Z} failed: ${$.status} ${$.statusText}`;throw new O9$($.status,X,Q)}async function Ux($,Z,X,Q,G="none"){try{let Y=await B3($,Z);if(Y.status===404)return null;if(await hF0(Y,X),G==="json")return await Y.json();return null}catch(Y){throw new V9(Q,Y)}}async function Ii($,Z,X){let Q=`${Kd0}/${encodeURIComponent(Z)}/${U9.CLAIM_PLURAL}`,G;try{G=await B3($,{method:"POST",path:Q,body:X})}catch(H){let N=H instanceof Error?H.message:String(H);throw console.warn(`[agent-sandbox/client] createSandboxClaim ${X.metadata.name} transport error: ${N}`),new V9(`Failed to create SandboxClaim: ${X.metadata.name} (transport error: ${N})`,H)}if(G.ok)return;let Y=await Wd0(G),J=Y?.reason?` ${Y.reason}`:"",W=Y?.message??G.statusText,K=`Failed to create SandboxClaim: ${X.metadata.name} (${G.status}${J}: ${W})`;if(console.warn(`[agent-sandbox/client] createSandboxClaim ${X.metadata.name} rejected: status=${G.status} reason=${Y?.reason??"<none>"} message=${W}`),G.status===409)throw new Ti(K);throw new V9(K)}async function uF0($,Z,X,Q=60000){let G=Date.now()+Q,Y=500,J;while(!0){let W=await D3($,Z,X).catch(()=>{return});if(!W)return;if(J=W,Date.now()>=G){let K=J.metadata?.finalizers??[],H=J.metadata?.deletionTimestamp??"<unknown>";throw new QV(`SandboxClaim ${X} still terminating after ${Q}ms (deletionTimestamp=${H}, finalizers=[${K.join(", ")}])`)}await y$(500)}}function Hd0($,Z){return`${Kd0}/${encodeURIComponent($)}/${U9.CLAIM_PLURAL}/${encodeURIComponent(Z)}`}async function cF0($,Z,X,Q){await Ux($,{method:"PATCH",path:Hd0(Z,X),patchType:"merge",body:{spec:{lifecycle:{shutdownPolicy:"Delete",shutdownTime:Q}}}},"patchSandboxClaimShutdown",`Failed to patch SandboxClaim shutdownTime: ${X}`)}async function xw($,Z,X){await Ux($,{method:"DELETE",path:Hd0(Z,X)},"deleteSandboxClaim",`Failed to delete SandboxClaim: ${X}`)}async function D3($,Z,X){return await Ux($,{method:"GET",path:Hd0(Z,X)},"getSandboxClaim",`Failed to get SandboxClaim: ${X}`,"json")??void 0}async function B9$($,Z,X,Q=60){let G=Date.now()+Q*1000,Y=200;while(Date.now()<G){let W=(await D3($,Z,X).catch(()=>{return}))?.status?.sandbox?.name;if(W)return W;await y$(200)}throw new QV(`SandboxClaim ${X} did not record an adopted Sandbox (status.sandbox.name) within ${Q}s`)}async function D9$($,Z,X){let G=(await Ux($,{method:"GET",path:`${Kd0}/${encodeURIComponent(Z)}/sandboxwarmpools/${encodeURIComponent(X)}`},"getSandboxWarmPool",`Failed to get SandboxWarmPool: ${X}`,"json"))?.status?.selector;if(!G)return null;let Y=await B3($,{method:"GET",path:`/api/v1/namespaces/${encodeURIComponent(Z)}/pods?labelSelector=${encodeURIComponent(G)}`});return await hF0(Y,"listWarmPoolPods"),((await Y.json()).items??[]).filter((W)=>W.status?.phase==="Running").flatMap((W)=>W.metadata?.name&&W.metadata.uid?[{name:W.metadata.name,uid:W.metadata.uid,labels:W.metadata.labels??{}}]:[])}async function L9$($,Z,X,Q){try{let G=await B3($,{method:"GET",path:`/api/v1/namespaces/${encodeURIComponent(Z)}/pods/${encodeURIComponent(X)}`});if(!G.ok)return!1;return!(await G.json()).metadata?.labels?.[Q]}catch{return!1}}function Nd0($,Z){return`${O94}/${encodeURIComponent($)}/${z9$}/${encodeURIComponent(Z)}`}async function lF0($,Z,X){let Q=new URLSearchParams({fieldManager:A9$,force:"true"}),G=`${Nd0(Z,X.metadata.name)}?${Q}`;try{let Y=await B3($,{method:"PATCH",path:G,patchType:"apply",body:X});await hF0(Y,"applyHttpRoute")}catch(Y){throw new V9(`Failed to apply HTTPRoute: ${X.metadata.name}`,Y)}}async function dF0($,Z,X){await Ux($,{method:"DELETE",path:Nd0(Z,X)},"deleteHttpRoute",`Failed to delete HTTPRoute: ${X}`)}async function P9$($,Z,X){return await Ux($,{method:"GET",path:Nd0(Z,X)},"getHttpRoute",`Failed to get HTTPRoute: ${X}`,"json")??void 0}async function T9$($,Z,X,Q){let G={apiVersion:"v1",kind:"Service",metadata:{name:X},spec:{ports:[{name:Q.name,port:Q.port,targetPort:Q.targetPort,protocol:Q.protocol??"TCP"}]}},Y=new URLSearchParams({fieldManager:A9$,force:"true"}),J=`/api/v1/namespaces/${encodeURIComponent(Z)}/services/${encodeURIComponent(X)}?${Y}`;try{let W=await B3($,{method:"PATCH",path:J,patchType:"apply",body:G});await hF0(W,"ensureServicePort")}catch(W){throw new V9(`Failed to apply Service ports: ${X}`,W)}}function mF0($,Z,X,Q=180){let G=`/apis/${U9.SANDBOX_API_GROUP}/${U9.SANDBOX_API_VERSION}/namespaces/${encodeURIComponent(Z)}/${U9.SANDBOX_PLURAL}?watch=true&fieldSelector=${encodeURIComponent(`metadata.name=${X}`)}`,{resolve:Y,reject:J,promise:W}=Promise.withResolvers(),K=new AbortController,H=!1,N=setTimeout(()=>{if(H)return;H=!0,K.abort(),J(new QV(`Sandbox did not become ready within ${Q} seconds`))},Q*1000),F=(U)=>{if(H)return;H=!0,clearTimeout(N),K.abort(),U()};return(async()=>{let U;try{U=await B3($,{method:"GET",path:G,signal:K.signal,headers:{accept:"application/json"},stream:!0})}catch(w){F(()=>J(new V9("Failed to start watch for sandbox readiness",w)));return}if(!U.ok||!U.body){let w=await Wd0(U).catch(()=>null);F(()=>J(new V9(`Watch handshake failed (${U.status}): ${w?.message??U.statusText}`)));return}try{for await(let w of Fd0(U.body)){if(H)return;if(w.type==="ERROR"){let j=w.object;F(()=>J(new V9(`Watch stream error while waiting for sandbox: ${j.message??"unknown"}`)));return}if(w.type!=="ADDED"&&w.type!=="MODIFIED")continue;let O=w.object;if(!O.status?.conditions?.find((j)=>j.type==="Ready"&&j.status==="True"))continue;let L=O.metadata?.name;if(!L){F(()=>J(new V9("Sandbox metadata or name is missing")));return}let E=O.metadata?.annotations?.[U9.POD_NAME_ANNOTATION]??L;F(()=>Y({sandboxName:L,podName:E}));return}F(()=>J(new V9("Watch stream closed before sandbox became ready")))}catch(w){if(H)return;if(w instanceof Error&&(w.name==="AbortError"||K.signal.aborted))return;F(()=>J(new V9("Watch stream error while waiting for sandbox",w)))}})(),W}async function*Fd0($){let Z=$.getReader(),X=new TextDecoder,Q="";try{while(!0){let{value:Y,done:J}=await Z.read();if(J)break;Q+=X.decode(Y,{stream:!0});let W;while((W=Q.indexOf(`
-`))>=0){let K=Q.slice(0,W).trim();if(Q=Q.slice(W+1),!K)continue;yield JSON.parse(K)}}let G=Q.trim();if(G)yield JSON.parse(G)}finally{Z.releaseLock()}}var O9$,Kd0,E9$="gateway.networking.k8s.io",j9$="v1",z9$="httproutes",O94,qi,A9$="mesh-sandbox-runner";var Mi=B(()=>{E6();Ri();O9$=class O9$ extends Error{status;body;constructor($,Z,X){super(X);this.status=$;this.body=Z;this.name="KubeHttpError"}};Kd0=`/apis/${U9.CLAIM_API_GROUP}/${U9.CLAIM_API_VERSION}/namespaces`;O94=`/apis/${E9$}/${j9$}/namespaces`;qi={API_GROUP:E9$,API_VERSION:j9$,PLURAL:z9$}});function D94($){return($.items??[]).some((Z)=>{if(Z.status?.phase!=="Pending")return!1;return(Z.status?.conditions??[]).some((X)=>X.type==="PodScheduled"&&X.status==="False"&&X.reason==="Unschedulable")})}function I9$($,Z){let X=0,Q=!0,G=null,Y=async()=>{try{let J=await B3($,{method:"GET",path:`/api/v1/namespaces/${encodeURIComponent(Z)}/pods?fieldSelector=status.phase%3DPending`});if(!J.ok)return R9$;let W=await J.json();return!D94(W)}catch{return R9$}};return async()=>{if(Date.now()-X<B94)return Q;return G??=Y().finally(()=>{G=null}),Q=await G,X=Date.now(),Q}}var B94=3000,R9$=!0;var q9$=B(()=>{Mi()});var Ud0=B(()=>{E6();Yc0()});async function nF0($){try{let Z=await fetch(`${$}/health`,{signal:AbortSignal.timeout(L94)});if(!Z.ok)return null;let X=await Z.json();if(typeof X==="object"&&X!==null&&typeof X.bootId==="string"&&typeof X.ready==="boolean"&&X.setup&&typeof X.setup.running==="boolean"&&typeof X.setup.done==="boolean")return X;return null}catch{return null}}async function Od0($){for(let Z=0;Z<M9$;Z++){if(await nF0($)!==null)return;let X=(Math.random()*2-1)*E94;await y$(k9$+X)}throw Error(`sandbox daemon at ${$} did not respond on /health within ${M9$*k9$/1000}s`)}async function GV($,Z,X,Q,G){return j94($,Z,"POST",X,Q,G)}async function j94($,Z,X,Q,G,Y){let J={...Q};if(G&&G.rotateToken!==void 0)J.auth=G;let W=await fetch(`${$}/_sandbox/config`,{method:X,headers:{"Content-Type":"application/json",Authorization:`Bearer ${Z}`},body:JSON.stringify(J),signal:AbortSignal.timeout(Y?.timeoutMs??wd0)}),K=await W.text();if(!W.ok)throw new iF0(W.status,K);return JSON.parse(K)}async function S9$($,Z,X){let Q=await fetch(`${$}/_sandbox/setup/${X}`,{method:"POST",headers:{Authorization:`Bearer ${Z}`},signal:AbortSignal.timeout(wd0)});if(!Q.ok)throw Error(`sandbox daemon /_sandbox/setup/${X} returned ${Q.status}: ${await Q.text()}`)}async function V9$($,Z,X){let Q=await fetch(`${$}/_sandbox/orgfs-config`,{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${Z}`},body:X,signal:AbortSignal.timeout(wd0)}),G=await Q.text();if(!Q.ok)throw Error(`sandbox daemon /_sandbox/orgfs-config returned ${Q.status}: ${G}`);return JSON.parse(G)}async function ki($,Z,X,Q){let G=new Headers(Q.headers);for(let W of z94)G.delete(W);G.set("authorization",`Bearer ${Z}`);let Y=Q.method!=="GET"&&Q.method!=="HEAD",J=`${$}${X.startsWith("/")?X:`/${X}`}`;return fetch(J,{method:Q.method,headers:G,body:Y?Q.body:void 0,redirect:"manual",signal:Q.signal,duplex:Y?"half":void 0})}var iF0,L94=500,wd0=30000,M9$=25,k9$=200,E94=50,z94;var C9$=B(()=>{Ud0();iF0=class iF0 extends Error{status;constructor($,Z){super(`sandbox daemon /_sandbox/config returned ${$}: ${Z}`);this.status=$;this.name="ConfigRequestError"}};z94=["cookie","host","connection","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","accept-encoding","content-length"]});async function*b9$($){let Z=$.now??(()=>Date.now()),X=Z(),Q=$.schedulingTimeoutMs??T94,G={pod:{},sandbox:{},events:{hasPulling:!1,hasPulled:!1},startedAt:X},Y=[],J=null,W=!1,K=(j)=>{if(W)return;if(J){let z=J;J=null,z(j)}else Y.push(j)},H=()=>{if(Y.length>0)return Promise.resolve(Y.shift());if(W)return Promise.resolve(null);return new Promise((j)=>{J=j})},N=()=>{if(W)return;if(W=!0,J){let j=J;J=null,j(null)}},F=new AbortController,U=()=>{F.abort(),N()};if($.signal)if($.signal.aborted)F.abort(),N();else $.signal.addEventListener("abort",U,{once:!0});let w=Math.max(0,Q-(Z()-X)),O=setTimeout(()=>K("tick"),w+100),D,L=new Promise((j)=>{D=j}),E=Promise.allSettled([R94($.kc,$.namespace,$.claimName,F.signal,G,K,Z,D),q94($.kc,$.namespace,$.claimName,F.signal,G,K),M94($.kc,$.namespace,$.claimName,L,F.signal,G,K,Z)]);try{let j=null,z=-1,A=_9$(G,Q,Z);if(j=Dd0(A),!Bd0(A))z=v9$(A);if(yield A,Bd0(A))return;while(!W){if(await H()===null)break;let M=_9$(G,Q,Z);if(Bd0(M)){let _=Dd0(M);if(_!==j)j=_,yield M;return}let k=v9$(M);if(k<z)continue;let q=Dd0(M);if(q!==j)j=q,z=k,yield M}}finally{if(clearTimeout(O),F.abort(),$.signal)$.signal.removeEventListener("abort",U);N(),await E.catch(()=>{})}}function _9$($,Z,X){let{pod:Q,sandbox:G,events:Y,startedAt:J}=$;if(G.ready)return{kind:"ready"};let W=Q.containerWaitingReason;if(W==="ImagePullBackOff"||W==="ErrImagePull")return{kind:"failed",reason:"image-pull-backoff",message:"Sandbox image failed to download. The cluster may be missing pull credentials or the image tag may not exist."};if(W==="CrashLoopBackOff")return{kind:"failed",reason:"crash-loop-backoff",message:"Sandbox crashed during startup and is now in CrashLoopBackOff. Check pod logs."};if(!Q.scheduled&&Y.lastFailedSchedulingAt!==void 0&&X()-J>Z)return{kind:"failed",reason:"scheduling-timeout",message:Y.failedSchedulingMessage??`Pod could not be scheduled within ${Math.round(Z/1000)}s.`};if(Q.containerRunning&&!Q.containerReady)return{kind:"warming-daemon",since:J};if(Y.hasPulling&&!Y.hasPulled)return{kind:"pulling-image",since:J};if(W==="ContainerCreating"||W==="PodInitializing"||Q.scheduled&&!Q.containerRunning)return{kind:"starting-container",since:J};if(Q.scheduledFalseReason==="Unschedulable"||Y.lastFailedSchedulingAt!==void 0&&!Q.scheduled)return{kind:"waiting-for-capacity",since:J,message:Y.failedSchedulingMessage??Q.scheduledFalseMessage,nodeClaim:Y.nominatedNodeClaim};return{kind:"claiming",since:J}}function Bd0($){return $.kind==="ready"||$.kind==="failed"}function v9$($){switch($.kind){case"claiming":return 0;case"waiting-for-capacity":return 1;case"pulling-image":return 2;case"starting-container":return 3;case"warming-daemon":return 4;case"ready":case"failed":return 99}}function Dd0($){switch($.kind){case"claiming":case"pulling-image":case"starting-container":case"warming-daemon":return $.kind;case"waiting-for-capacity":return`waiting-for-capacity:${$.message??""}:${$.nodeClaim??""}`;case"ready":return"ready";case"failed":return`failed:${$.reason}:${$.message}`}}async function R94($,Z,X,Q,G,Y,J,W){let K=`/api/v1/namespaces/${encodeURIComponent(Z)}/pods?watch=true&labelSelector=${encodeURIComponent(`${P94}=${X}`)}`;return pF0({kc:$,path:K,signal:Q,label:`pod/${X}`,onEvent:(H)=>{if(H.type!=="ADDED"&&H.type!=="MODIFIED")return;let N=H.object;if(N.metadata?.name)W(N.metadata.name);I94(N,G,J),Y("pod")}})}function I94($,Z,X){let G=($.status?.conditions??[]).find((J)=>J.type==="PodScheduled");if(G?.status==="True")Z.pod.scheduled=!0,Z.pod.scheduledFalseReason=void 0,Z.pod.scheduledFalseMessage=void 0;else if(G?.status==="False")Z.pod.scheduled=!1,Z.pod.scheduledFalseReason=G.reason,Z.pod.scheduledFalseMessage=G.message;let Y=($.status?.containerStatuses??[]).find((J)=>J.name===A94);if(Y)Z.pod.containerWaitingReason=Y.state?.waiting?.reason,Z.pod.containerRunning=!!Y.state?.running,Z.pod.containerReady=Y.ready===!0}async function q94($,Z,X,Q,G,Y){let J=`/apis/${U9.CLAIM_API_GROUP}/${U9.CLAIM_API_VERSION}/namespaces/${encodeURIComponent(Z)}/${U9.CLAIM_PLURAL}?watch=true&fieldSelector=${encodeURIComponent(`metadata.name=${X}`)}`;return pF0({kc:$,path:J,signal:Q,label:`sandboxclaim/${X}`,onEvent:(W)=>{if(W.type!=="ADDED"&&W.type!=="MODIFIED")return;let H=W.object.status?.conditions?.find((N)=>N.type==="Ready");if(!H)return;if(H.status==="True")G.sandbox.ready=!0,G.sandbox.notReadyReason=void 0,G.sandbox.notReadyMessage=void 0;else G.sandbox.ready=!1,G.sandbox.notReadyReason=H.reason,G.sandbox.notReadyMessage=H.message;Y("sandbox")}})}async function M94($,Z,X,Q,G,Y,J,W){let K=await Promise.race([Q,new Promise((N)=>{if(G.aborted){N(X);return}G.addEventListener("abort",()=>N(X),{once:!0})})]);if(G.aborted)return;let H=`/api/v1/namespaces/${encodeURIComponent(Z)}/events?watch=true&fieldSelector=${encodeURIComponent(`involvedObject.name=${K},involvedObject.kind=Pod`)}`;return pF0({kc:$,path:H,signal:G,label:`events/${X}`,onEvent:(N)=>{if(N.type!=="ADDED"&&N.type!=="MODIFIED")return;let F=N.object,U=F.reason;if(!U)return;switch(U){case"Pulling":Y.events.hasPulling=!0;break;case"Pulled":Y.events.hasPulling=!0,Y.events.hasPulled=!0;break;case"FailedScheduling":Y.events.lastFailedSchedulingAt=W(),Y.events.failedSchedulingMessage=F.message;break;case"Nominated":{let w=F.message?.match(/nodeclaim\/([\w-]+)/);if(w)Y.events.nominatedNodeClaim=w[1];break}default:return}J("event")}})}async function f9$($){let{kc:Z,namespace:X,labelSelector:Q,signal:G,onDelete:Y}=$,J=`/apis/${U9.CLAIM_API_GROUP}/${U9.CLAIM_API_VERSION}/namespaces/${encodeURIComponent(X)}/${U9.CLAIM_PLURAL}?watch=true&labelSelector=${encodeURIComponent(Q)}`;return pF0({kc:Z,path:J,signal:G,label:"sandboxclaim-reaper",onEvent:(W)=>{if(W.type!=="DELETED")return;let K=W.object.metadata?.name;if(K)Y(K)}})}async function pF0($){let{kc:Z,path:X,signal:Q,label:G,onEvent:Y}=$,J=0;while(!Q.aborted){try{let K=await B3(Z,{method:"GET",path:X,signal:Q,headers:{accept:"application/json"},stream:!0});if(!K.ok||!K.body){try{await K.body?.cancel()}catch{}if(K.status===401||K.status===403){console.warn(`[lifecycle-watcher] ${G} stopped: watch denied (${K.status} ${K.statusText}). `+"The kubeconfig in use cannot watch SandboxClaims \u2014 if you are running locally, "+"this provider should not be active (check STUDIO_SANDBOX_PROVIDER / your sandbox preference).");return}throw Error(`watch handshake failed: ${K.status} ${K.statusText}`)}J=0;for await(let H of Fd0(K.body)){if(Q.aborted)return;try{Y(H)}catch(N){console.warn(`[lifecycle-watcher] ${G} onEvent threw: ${N instanceof Error?N.message:String(N)}`)}}}catch(K){if(Q.aborted)return;let H=K instanceof Error?K.message:String(K);console.warn(`[lifecycle-watcher] ${G} watch ended: ${H}`)}if(Q.aborted)return;let W=HX(5000,250,J,2,0);J+=1,await y$(W,{signal:Q}).catch(()=>{})}}var P94="studio.decocms.com/sandbox-handle",A94="sandbox",T94=300000;var x9$=B(()=>{E6();Ri();Mi()});import{z as SY}from"zod";function y9$($){if(!$||$.trim()==="")return[];let Z=SY.array(k94).parse(JSON.parse($)),X=new Set;for(let Q of Z){if(X.has(Q.name))throw Error(`STUDIO_SANDBOX_TENANT_POOLS: duplicate pool name ${Q.name}`);X.add(Q.name)}return Z}function S94($){try{let[Z,X]=new URL($).pathname.replace(/^\/+/,"").split("/"),Q=X?.replace(/\.git$/,"");return Z&&Q?`${Z}/${Q}`.toLowerCase():null}catch{return null}}function g9$($,Z){let{orgId:X,cloneUrl:Q}=Z;if(Z.cloneOnly===!0)return null;if(!X||!Q)return null;let G=S94(Q);if(!G)return null;return $.find((Y)=>Y.orgId===X&&Y.repo.toLowerCase()===G)??null}function h9$($,Z,X){return $?.name??(Z?X:"none")}function u9$($,Z,X){let Q=X.replace(/^refs\/heads\//,"");return $.filter((G)=>G.repo.toLowerCase()===Z.toLowerCase()&&G.branch===Q)}function c9$($){return`https://github.com/${$.repo}.git`}var k94;var Ld0=B(()=>{k94=SY.object({name:SY.string().regex(/^[a-z0-9]([-a-z0-9]*[a-z0-9])?$/,"pool name must be a DNS label (lowercase alphanumeric and '-')"),orgId:SY.string().min(1),repo:SY.string().regex(/^[^/\s]+\/[^/\s]+$/,"repo must be `owner/name`"),connectionId:SY.string().min(1).optional(),branch:SY.string().min(1).default("main"),workload:SY.object({runtime:SY.enum(["node","bun","deno"]).default("node"),packageManager:SY.enum(["npm","pnpm","yarn","bun","deno"]).optional(),packageManagerPath:SY.string().optional(),devPort:SY.number().int().positive().optional()}).default({runtime:"node"})})});async function l9$($,Z,X){let Q=new Map;for(let G of $){let Y=Z(G);if(!Y)continue;let J=Q.get(Y);if(J)J.push(G);else Q.set(Y,[G])}await Promise.allSettled([...Q.values()].map(async(G)=>{for(let Y of G)await X(Y).catch(()=>{})}))}import{createHash as V94,randomBytes as C94,randomUUID as _94}from"crypto";import*as t9$ from"net";import{PassThrough as v94}from"stream";function b94($){if($ instanceof Error)return $.message;if($&&typeof $==="object"){let Z=$;if(Z.error instanceof Error)return Z.error.message;if(typeof Z.message==="string"&&Z.message)return Z.message}return String($)}class Td0{kind=_Q;records=new Map;inflight=new L50;stateStore;previewUrlPattern;kubeConfig;capacityProbe;portForward;namespace;sandboxTemplateName;envName;tokenGenerator;idleTtlMs;metrics;previewGateway;sentinelToken;mintCloneUrl;tenantPools;tenantPoolRefreshMs;poolPods=new Map;dirtyPools=new Set;closed=!1;claimWatchAbort=new AbortController;constructor($={}){this.stateStore=$.stateStore??null,this.previewUrlPattern=$.previewUrlPattern??null,this.kubeConfig=$.kubeConfig??p94(),this.portForward=new dl0(this.kubeConfig),this.namespace=$.namespace??f94,this.sandboxTemplateName=$.sandboxTemplateName??x94,this.envName=e94($.envName),this.tokenGenerator=$.tokenGenerator??(()=>C94(y94).toString("hex")),this.idleTtlMs=$.idleTtlMs??h94,this.metrics=$.meter?n94($.meter):null,this.previewGateway=$.previewGateway&&$.previewUrlPattern?{...$.previewGateway}:null;let Z=$.sentinelToken?.trim()??"";if(this.sentinelToken=Z.length>0?Z:null,this.mintCloneUrl=$.mintCloneUrl,this.tenantPools=this.sentinelToken!==null?$.tenantPools??[]:[],this.sentinelToken===null&&($.tenantPools?.length??0)>0)console.warn(`[${y6}] tenant pools configured without a sentinel token \u2014 ignoring them (warm-pool mode is off)`);this.tenantPoolRefreshMs=$.tenantPoolRefreshMs??c94,this.startClaimReaper(),this.startCredentialRefresher(),this.startTenantPoolReconciler()}startClaimReaper(){let $=["app.kubernetes.io/managed-by=studio","app.kubernetes.io/name=studio-sandbox",...this.envName?[`${vQ.env}=${this.envName}`]:[]].join(",");f9$({kc:this.kubeConfig,namespace:this.namespace,labelSelector:$,signal:this.claimWatchAbort.signal,onDelete:(Z)=>this.invalidateRecord(Z)})}async ensure($,Z={}){let X=SL($);if(X.startsWith("s-"))throw Error(`ensure: projectRef has no slug source: ${$.projectRef}`);return this.inflight.run(X,()=>E50(this.stateStore,$,_Q,(Q)=>this.ensureLocked($,X,Z,Q)))}async delete($){let Z=await this.getRecord($);if(this.records.delete($),Z)this.closeForwarder(Z.daemonForward),this.metrics?.active.add(-1,Pd0(Z.tenant));if(await this.deleteHttpRouteIfManaged($).catch((X)=>{console.warn(`[${y6}] HTTPRoute delete failed for ${$}: ${X instanceof Error?X.message:String(X)}`)}),await xw(this.kubeConfig,this.namespace,$),this.stateStore)if(Z)await this.stateStore.delete(Z.id,_Q);else await this.stateStore.deleteByHandle(_Q,$)}async alive($){return await D3(this.kubeConfig,this.namespace,$)!==void 0}watchClaimLifecycle($,Z){return b9$({kc:this.kubeConfig,namespace:this.namespace,claimName:$,signal:Z})}hasSchedulableCapacity(){return this.capacityProbe??=I9$(this.kubeConfig,this.namespace),this.capacityProbe()}async getPreviewUrl($){let Z=await this.getRecord($);if(!Z)return null;return this.composePreviewUrl(Z)}async proxyDaemonRequest($,Z,X){let Q=await this.getRecord($);if(!Q&&this.previewUrlPattern&&this.stateStore){let K=await this.stateStore.getByHandle(_Q,$),H=K?.state,N=H?.token;if(K&&N){let U=`http://${H?.adoptedSandboxName??$}.${this.namespace}.svc.cluster.local:${UN}`;try{let w=await ki(U,N,Z,X);if(w.status!==404)return w;try{await w.body?.cancel()}catch{}}catch{}}}if(!Q)Q=await this.resurrectByHandle($);if(!Q)return new Response(JSON.stringify({error:"sandbox not found"}),{status:404,headers:{"content-type":"application/json"}});let G=Q,Y=performance.now(),J=0,W=!(X.body instanceof ReadableStream);try{let K=await ki(Q.daemonUrl,Q.token,Z,X);if(K.status===401&&W){this.invalidateRecord($);let H=await this.getRecord($).catch(()=>null)??await this.resurrectByHandle($).catch(()=>null);if(H)G=H,K=await ki(H.daemonUrl,H.token,Z,X)}return J=K.status,K}catch(K){if(!W)throw K;this.invalidateRecord($);let H=await this.resurrectByHandle($)??await this.getRecord($).catch(()=>null);if(!H)throw K;G=H;let N=await ki(H.daemonUrl,H.token,Z,X);return J=N.status,N}finally{this.recordProxyDuration("daemon",J,G,performance.now()-Y)}}async adoptLiveClaim($,Z){if(this.records.has(Z))return!0;let X=await D3(this.kubeConfig,this.namespace,Z).catch(()=>{return});if(!X||X.metadata?.deletionTimestamp)return!1;return await this.inflight.run(Z,async()=>{let G=this.records.get(Z);if(G)return this.toSandbox(G);let Y=await this.adopt($,Z,X);if(!Y)throw Error(`cannot adopt live claim ${Z}`);return E50(this.stateStore,$,_Q,(J)=>this.finish(Y,J,!0,!0,"adopt"))}).catch(()=>null)!=null}async resolvePreviewUpstreamUrl($){if(this.previewUrlPattern)return`http://${await this.resolveServiceNameForHandle($)}.${this.namespace}.svc.cluster.local:${UN}`;let Z=await this.getRecord($);if(Z)return Z.daemonUrl;let X=await this.resurrectByHandle($);return X?X.daemonUrl:null}async resolveServiceNameForHandle($){let Z=this.records.get($);if(Z)return Z.adoptedSandboxName;if(this.stateStore){let Q=(await this.stateStore.getByHandle(_Q,$).catch(()=>null))?.state?.adoptedSandboxName;if(Q)return Q}return $}async proxyPreviewRequest($,Z){let X=performance.now(),Q=this.records.get($)??null,G=0;try{let Y=await this.resolvePreviewUpstreamUrl($);if(!Y){G=404;let O=jd0(404,{error:"sandbox not found"});return O.headers.set(JV,"1"),O}let J=new URL(Z.url);if((J.pathname==="/_sandbox"||J.pathname.startsWith("/_sandbox/")||J.pathname==="/_decopilot_vm"||J.pathname.startsWith("/_decopilot_vm/"))&&Z.method!=="GET")return G=404,jd0(404,{error:"not found"});let K=(O)=>`${O}${J.pathname}${J.search}`,H=new Headers(Z.headers);for(let O of m94)H.delete(O);let N=Z.method!=="GET"&&Z.method!=="HEAD",F={method:Z.method,headers:H,body:N?Z.body:void 0,redirect:"manual",signal:Z.signal,duplex:N?"half":void 0},U;try{U=await fetch(K(Y),F)}catch(O){let D=`${Y}${J.pathname}`;if(console.warn(`[${y6}] preview fetch to ${D} failed: ${O instanceof Error?O.message:String(O)}`),Z.method==="GET"||Z.method==="HEAD"){if(this.invalidateRecord($),await this.resurrectByHandle($).catch(()=>null)){let j=await this.resolvePreviewUpstreamUrl($);if(j)try{U=await fetch(K(j),F);let z=new Headers;for(let[A,P]of U.headers.entries())if(!i9$.includes(A.toLowerCase()))z.set(A,P);return G=U.status,new Response(U.body,{status:U.status,statusText:U.statusText,headers:z})}catch(z){console.warn(`[${y6}] preview fetch retry to ${D} failed: ${z instanceof Error?z.message:String(z)}`)}}}else this.invalidateRecord($);G=502;let L=jd0(502,{error:"sandbox daemon unreachable"});return L.headers.set(JV,"1"),L}let w=new Headers;for(let[O,D]of U.headers.entries())if(!i9$.includes(O.toLowerCase()))w.set(O,D);return G=U.status,new Response(U.body,{status:U.status,statusText:U.statusText,headers:w})}finally{this.recordProxyDuration("preview",G,Q,performance.now()-X,$)}}async ensureLocked($,Z,X,Q){if(X.image)console.warn(`[${y6}] opts.image ignored (template ${this.sandboxTemplateName} pins image): got ${X.image}`);if(Q){let J=await Q.get($,_Q);if(J){let W=await this.rehydrate($,Z,J);if(W)return await this.refreshDaemonGitCredential(W,X),this.finish(W,Q,!1,!0,"resume");await Q.delete($,_Q)}}let G=await D3(this.kubeConfig,this.namespace,Z).catch(()=>{return});if(G)if(G.metadata?.deletionTimestamp)await uF0(this.kubeConfig,this.namespace,Z).catch((J)=>{console.warn(`[${y6}] wait for terminating claim ${Z} failed: ${J instanceof Error?J.message:String(J)}`)});else{let J=await this.adopt($,Z,G).catch((W)=>{return console.warn(`[${y6}] adopt ${Z} failed, recreating: ${W instanceof Error?W.message:String(W)}`),null});if(J)return await this.refreshDaemonGitCredential(J,X),this.finish(J,Q,!0,!0,"adopt");await xw(this.kubeConfig,this.namespace,Z).catch(()=>{}),await uF0(this.kubeConfig,this.namespace,Z).catch((W)=>{console.warn(`[${y6}] wait for deleted claim ${Z} failed: ${W instanceof Error?W.message:String(W)}`)})}let Y=await this.provision($,Z,X);return this.finish(Y,Q,!0,!1,"fresh")}async finish($,Z,X,Q,G){let Y=this.records.get($.handle),J=Y!==void 0;if(Y&&Y.daemonForward!==$.daemonForward)this.closeForwarder(Y.daemonForward);if(this.records.set($.handle,$),X)await this.persist(Z,$);if(Q)await cF0(this.kubeConfig,this.namespace,$.handle,this.computeShutdownTime()).catch((W)=>console.warn(`[${y6}] TTL refresh failed for ${$.handle}: ${W instanceof Error?W.message:String(W)}`));if(this.metrics){let W=Pd0($.tenant);if(this.metrics.ensureOutcome.add(1,{...W,outcome:G}),!J)this.metrics.active.add(1,W)}return this.toSandbox($)}buildEnvMap($,Z){let X={},Q=[];for(let[G,Y]of Object.entries($.env??{}))if(g94.has(G))Q.push(G);else X[G]=Y;if(Q.length>0)console.warn(`[${y6}] opts.env keys overlap reserved bootstrap names and were dropped: ${Q.join(",")}`);return{...X,DAEMON_TOKEN:Z.token,DAEMON_BOOT_ID:Z.daemonBootId,APP_ROOT:Z.workdir,PROXY_PORT:String(UN)}}buildClaim($,Z,X){let Q=this.sentinelToken!==null,G=g9$(this.tenantPools,{orgId:Z.tenant?.orgId,cloneUrl:Z.repo?.cloneUrl,cloneOnly:Z.cloneOnly}),Y=Q?[]:Object.entries(this.buildEnvMap(Z,X)).sort(([K],[H])=>K<H?-1:K>H?1:0).map(([K,H])=>({name:K,value:H})),J=XZ4(Z),W=Object.keys(J).length>0;return{apiVersion:`${U9.CLAIM_API_GROUP}/${U9.CLAIM_API_VERSION}`,kind:"SandboxClaim",metadata:{name:$,namespace:this.namespace,labels:{"app.kubernetes.io/name":"studio-sandbox","app.kubernetes.io/managed-by":"studio",...this.envName?{[vQ.env]:this.envName}:{},...zd0(Z.tenant)},...W?{annotations:J}:{}},spec:{sandboxTemplateRef:{name:this.sandboxTemplateName},additionalPodMetadata:{labels:zd0(Z.tenant,{[vQ.role]:"claimed",[vQ.sandboxHandle]:$,...this.envName?{[vQ.env]:this.envName}:{}}),...W?{annotations:J}:{}},env:Y,warmpool:h9$(G,Q,this.sandboxTemplateName),lifecycle:{shutdownPolicy:"Delete",shutdownTime:this.computeShutdownTime()}}}}async provision($,Z,X){let Q=this.tokenGenerator(),G=_94(),Y=Ed0,J=this.buildClaim(Z,X,{token:Q,daemonBootId:G,workdir:Y});try{await Ii(this.kubeConfig,this.namespace,J)}catch(U){if(U instanceof Ti)await uF0(this.kubeConfig,this.namespace,Z),await Ii(this.kubeConfig,this.namespace,J);else throw U}let W;try{W=await B9$(this.kubeConfig,this.namespace,Z),await mF0(this.kubeConfig,this.namespace,W)}catch(U){throw await xw(this.kubeConfig,this.namespace,Z).catch(()=>{}),U}try{await this.ensureServicePortForAdoptedSandbox(W),await this.ensureHttpRouteForHandle(Z,W,X.tenant??null)}catch(U){throw await xw(this.kubeConfig,this.namespace,Z).catch(()=>{}),U}let K=await this.openForwarder(W,UN,Z),H=`http://127.0.0.1:${K.localPort}`,N=this.workloadConfigPayload(X),F=G;try{if(await Od0(H),this.sentinelToken!==null){let U=await nF0(H);if(U)F=U.bootId;await GV(H,this.sentinelToken,N??{},{rotateToken:Q})}else if(N)await GV(H,Q,N);await this.relayOrgFsConfig(H,Q,X.orgFsConfigJson)}catch(U){throw this.closeForwarder(K),await this.deleteHttpRouteIfManaged(Z).catch(()=>{}),await xw(this.kubeConfig,this.namespace,Z).catch(()=>{}),U}return{id:$,handle:Z,adoptedSandboxName:W,token:Q,workdir:Y,daemonUrl:H,daemonForward:K,workload:X.workload??null,daemonBootId:F,tenant:X.tenant??null,ensureOpts:JZ4(X)}}workloadConfigPayload($){return z50({runtime:$?.workload?.runtime??"node",packageManager:$?.workload?.packageManager?{name:$.workload.packageManager,...$.workload.packageManagerPath?{path:$.workload.packageManagerPath}:{}}:null,repo:$?.repo??null,port:$?.workload?.devPort??d9$,tenant:$?.tenant??void 0,...$?{cloneOnly:$.cloneOnly===!0}:{}})}async relayOrgFsConfig($,Z,X){if(!X)return;await V9$($,Z,X).catch((Q)=>console.warn("[org-fs] sidecar config relay failed",Q))}async refreshDaemonGitCredential($,Z){let X=Jc0(Z);if(!X)return;try{await GV($.daemonUrl,$.token,X)}catch(Q){console.warn(`[${y6}] git credential refresh failed for ${$.handle}: ${Q instanceof Error?Q.message:String(Q)}`)}}async withFreshCloneUrl($,Z){if(!this.mintCloneUrl)return $;try{let X=await this.mintCloneUrl($,Z!==void 0?{bufferMs:Z}:void 0);return X?{...$,cloneUrl:X}:$}catch(X){return console.warn(`[${y6}] clone credential re-mint failed: ${X instanceof Error?X.message:String(X)}`),$}}startCredentialRefresher(){if(!this.mintCloneUrl)return;let{signal:$}=this.claimWatchAbort;(async()=>{while(!$.aborted){if(await y$(l94,{signal:$}).catch(()=>{}),$.aborted)break;try{await this.refreshAllGitCredentials()}catch(Z){console.warn(`[${y6}] periodic credential refresh failed: ${Z instanceof Error?Z.message:String(Z)}`)}}})()}startTenantPoolReconciler(){if(this.tenantPools.length===0)return;let{signal:$}=this.claimWatchAbort;(async()=>{while(!$.aborted){try{await this.reconcileTenantPools()}catch(Z){console.warn(`[${y6}] tenant pool reconcile failed: ${Z instanceof Error?Z.message:String(Z)}`)}await y$(u94,{signal:$}).catch(()=>{})}})()}markTenantPoolsDirty($,Z){let X=u9$(this.tenantPools,$,Z);for(let Q of X)this.dirtyPools.add(Q.name);return X.map((Q)=>Q.name)}async reconcileTenantPools(){for(let $ of this.tenantPools){let Z=await D9$(this.kubeConfig,this.namespace,$.name);if(Z===null){console.warn(`[${y6}] tenant pool ${$.name}: no SandboxWarmPool (or no selector yet) in ${this.namespace}`);continue}let X=this.dirtyPools.delete($.name),Q=Z.filter((G)=>!G.labels[vQ.sandboxHandle]);for(let[G]of this.poolPods)if(!Z.some((Y)=>Y.uid===G))this.poolPods.delete(G);for(let G of Q){if(this.claimWatchAbort.signal.aborted)return;await this.warmPoolPod($,G,X)}this.recordPoolDepth($,Z,Q)}}recordPoolDepth($,Z,X){let Q=this.metrics?.poolPods;if(!Q)return;let G=0,Y=0;for(let W of X){let K=this.poolPods.get(W.uid);if(!K)continue;if(K.failures>=tF0)Y++;else if(K.lastConfigAt>0)G++}let J={pool:$.name,org:$.orgId};Q.record(G,{...J,state:"ready"}),Q.record(Z.length-X.length,{...J,state:"bound"}),Q.record(X.length-G-Y,{...J,state:"pending"}),Q.record(Y,{...J,state:"failed"})}async warmPoolPod($,Z,X){let Q=this.poolPods.get(Z.uid);if(Q&&Q.failures>=tF0){if(Date.now()-Q.lastFailureAt<m9$)return;this.poolPods.set(Z.uid,{...Q,failures:0})}let G=X||Q!==void 0&&Date.now()-Q.lastConfigAt>=this.tenantPoolRefreshMs;if(Q&&!G)return;let Y={cloneUrl:c9$($),connectionId:$.connectionId,branch:$.branch,userName:"",userEmail:""},J=await this.withFreshCloneUrl(Y);if($.connectionId&&J.cloneUrl===Y.cloneUrl){this.recordPoolFailure(Z,$,"clone credential mint failed");return}let W=await this.openForwarder(Z.name,UN,Z.name).catch(()=>null);if(!W){this.recordPoolFailure(Z,$,"port-forward failed");return}let K=`http://127.0.0.1:${W.localPort}`;try{await Od0(K);let H=this.sentinelToken;if(!H)return;if(!await this.isPoolPodUnbound(Z))return;let N=z50({runtime:$.workload.runtime,packageManager:$.workload.packageManager?{name:$.workload.packageManager,...$.workload.packageManagerPath?{path:$.workload.packageManagerPath}:{}}:null,repo:J,port:$.workload.devPort??d9$})??{},{transition:F}=await GV(K,H,N);if(G&&F!=="bootstrap"&&await this.isPoolPodUnbound(Z))await S9$(K,H,"clone");this.poolPods.set(Z.uid,{lastConfigAt:Date.now(),lastFailureAt:0,failures:0}),console.log(`[${y6}] tenant pool ${$.name}: warmed ${Z.name} (${F})`)}catch(H){this.recordPoolFailure(Z,$,H instanceof Error?H.message:String(H))}finally{this.closeForwarder(W)}}isPoolPodUnbound($){return L9$(this.kubeConfig,this.namespace,$.name,vQ.sandboxHandle)}recordPoolFailure($,Z,X){let Q=this.poolPods.get($.uid),G=(Q?.failures??0)+1;this.poolPods.set($.uid,{lastConfigAt:Q?.lastConfigAt??0,lastFailureAt:Date.now(),failures:G});let Y=G>=tF0?` \u2014 backing off ${m9$/60000}min`:"";console.warn(`[${y6}] tenant pool ${Z.name}: warming ${$.name} failed (${G}/${tF0})${Y}: ${X}`)}async refreshAllGitCredentials(){await l9$(this.records.values(),($)=>$.ensureOpts?.repo?.connectionId,async($)=>{if(this.claimWatchAbort.signal.aborted)return;let Z=$.ensureOpts?.repo;if(!Z)return;let X=await this.withFreshCloneUrl(Z,d94);await this.refreshDaemonGitCredential($,{...$.ensureOpts,repo:X}),$.ensureOpts={...$.ensureOpts,repo:X}})}async rebootstrapDaemon($,Z,X){if(this.sentinelToken===null)return!1;let Q=this.workloadConfigPayload(X)??{};try{return await GV($,this.sentinelToken,Q,{rotateToken:Z}),await this.relayOrgFsConfig($,Z,X?.orgFsConfigJson),!0}catch(G){if(G instanceof iF0&&G.status===401)try{return await GV($,Z,Q,{rotateToken:Z}),await this.relayOrgFsConfig($,Z,X?.orgFsConfigJson),!0}catch(Y){return console.warn(`[${y6}] re-bootstrap retry with claim token failed: ${Y instanceof Error?Y.message:String(Y)}`),!1}return console.warn(`[${y6}] re-bootstrap failed: ${G instanceof Error?G.message:String(G)}`),!1}}async ensureServicePortForAdoptedSandbox($){if(!this.previewGateway||!this.previewUrlPattern)return;await T9$(this.kubeConfig,this.namespace,$,{name:"daemon",port:UN,targetPort:UN})}async ensureHttpRouteForHandle($,Z,X){if(!this.previewGateway||!this.previewUrlPattern)return;let Q=WZ4(this.previewUrlPattern,$);if(!Q)throw new V9(`Unable to derive preview hostname for ${$} from pattern: ${this.previewUrlPattern}`);let G={apiVersion:`${qi.API_GROUP}/${qi.API_VERSION}`,kind:"HTTPRoute",metadata:{name:$,namespace:this.namespace,labels:zd0(X??void 0,{[vQ.role]:"claimed",[vQ.sandboxHandle]:$,"app.kubernetes.io/name":"studio-sandbox","app.kubernetes.io/managed-by":"studio",...this.envName?{[vQ.env]:this.envName}:{}})},spec:{parentRefs:[{kind:"Gateway",group:"gateway.networking.k8s.io",name:this.previewGateway.name,namespace:this.previewGateway.namespace}],hostnames:[Q],rules:[{backendRefs:[{group:"",kind:"Service",name:Z,port:UN}]}]}};await lF0(this.kubeConfig,this.namespace,G)}async deleteHttpRouteIfManaged($){if(!this.previewGateway)return;await dF0(this.kubeConfig,this.namespace,$)}async rehydrate($,Z,X){let Q=X.state;if(!Q.adoptedSandboxName&&!Q.podName||!Q.token)return null;let G=await D3(this.kubeConfig,this.namespace,Z).catch(()=>{return});if(!G||!n9$(G))return null;let Y=G.status?.sandbox?.name??Q.adoptedSandboxName??Q.podName??Z,J=await this.openAndProbeDaemon(Y,Z);if(!J)return null;if(Q.daemonBootId&&Q.daemonBootId!==J.bootId){if(this.sentinelToken!==null){let W=Q.ensureOpts?.repo?{...Q.ensureOpts,repo:await this.withFreshCloneUrl(Q.ensureOpts.repo)}:Q.ensureOpts??null;if(!await this.rebootstrapDaemon(J.daemonUrl,Q.token,W))return this.closeForwarder(J.daemonForward),null}else console.warn(`[${y6}] daemon restart detected (handle=${Z}): stored bootId=${Q.daemonBootId} live bootId=${J.bootId}`);await this.stateStore?.put($,_Q,{handle:Z,state:{...Q,daemonBootId:J.bootId}}).catch((W)=>console.warn(`[${y6}] bootId persist failed for ${Z}: ${W instanceof Error?W.message:String(W)}`))}return{id:$,handle:Z,adoptedSandboxName:Y,token:Q.token,workdir:Q.workdir??Ed0,daemonUrl:J.daemonUrl,daemonForward:J.daemonForward,workload:Q.workload??null,daemonBootId:J.bootId,tenant:Q.tenant??null,ensureOpts:Q.ensureOpts??null}}async adopt($,Z,X){if(!n9$(X))return null;let Q=X.status?.sandbox?.name??Z;if(this.sentinelToken!==null)return null;let G=t94(X);if(!G)return null;let Y=await this.openAndProbeDaemon(Q,Z);if(!Y)return null;let J=QZ4(X);if(this.previewGateway)await this.ensureServicePortForAdoptedSandbox(Q).catch((W)=>{console.warn(`[${y6}] Service port backfill failed for ${Z}: ${W instanceof Error?W.message:String(W)}`)}),await this.ensureHttpRouteForHandle(Z,Q,J).catch((W)=>{console.warn(`[${y6}] HTTPRoute backfill failed for ${Z}: ${W instanceof Error?W.message:String(W)}`)});return{id:$,handle:Z,adoptedSandboxName:Q,token:G,workdir:Ed0,daemonUrl:Y.daemonUrl,daemonForward:Y.daemonForward,workload:null,daemonBootId:Y.bootId,tenant:J,ensureOpts:null}}async openAndProbeDaemon($,Z){let X=await this.openForwarder($,UN,Z).catch(()=>null);if(!X)return null;let Q=`http://127.0.0.1:${X.localPort}`,G=await nF0(Q);if(!G)return this.closeForwarder(X),null;return{daemonForward:X,daemonUrl:Q,bootId:G.bootId}}async getRecord($){let Z=this.records.get($);if(Z)return Z;if(!this.stateStore)return null;let X=await this.stateStore.getByHandle(_Q,$);if(!X)return null;let Q=await this.rehydrate(X.id,$,X);if(Q)this.records.set($,Q);return Q}async resurrectByHandle($){if(!this.stateStore)return null;let Z=await this.stateStore.getByHandle(_Q,$);if(!Z)return null;let X=Z.state.ensureOpts;if(!X)return null;let Q=X.repo?{...X,repo:await this.withFreshCloneUrl(X.repo)}:X;if(SL(Z.id)!==$)return null;return await this.ensure(Z.id,Q),this.records.get($)??null}invalidateRecord($){let Z=this.records.get($);if(!Z)return;this.records.delete($),this.closeForwarder(Z.daemonForward)}recordProxyDuration($,Z,X,Q,G){if(!this.metrics)return;this.metrics.proxyDurationMs.record(Q,{...Pd0(X?.tenant??null),source:$,sandbox_handle:X?.handle??G??"",status_code:Z||0})}composePreviewUrl($){if(this.previewUrlPattern)return j50(this.previewUrlPattern,$.handle);return`http://127.0.0.1:${$.daemonForward.localPort}/`}toSandbox($){return{handle:$.handle,workdir:$.workdir,previewUrl:this.composePreviewUrl($)}}async persist($,Z){if(!$)return;let X={adoptedSandboxName:Z.adoptedSandboxName,token:Z.token,workdir:Z.workdir,workload:Z.workload,daemonBootId:Z.daemonBootId,tenant:Z.tenant,...Z.ensureOpts?{ensureOpts:Z.ensureOpts}:{}};await $.put(Z.id,_Q,{handle:Z.handle,state:X})}computeShutdownTime(){return new Date(Date.now()+this.idleTtlMs).toISOString()}async releaseAfter($,Z){let X=await D3(this.kubeConfig,this.namespace,$);if(!X)return;let Q=GZ4(X.spec?.lifecycle?.shutdownTime,new Date(Date.now()+Z));if(!Q)return;await cF0(this.kubeConfig,this.namespace,$,Q).catch((G)=>console.warn(`[${y6}] release failed for ${$}: ${G instanceof Error?G.message:String(G)}`))}async renewTtl($){let Z=await D3(this.kubeConfig,this.namespace,$);if(!Z)return;let X=YZ4(Z.spec?.lifecycle?.shutdownTime,new Date(Date.now()+this.idleTtlMs));if(!X)return;await cF0(this.kubeConfig,this.namespace,$,X).catch((Q)=>console.warn(`[${y6}] TTL renew failed for ${$}: ${Q instanceof Error?Q.message:String(Q)}`))}openForwarder($,Z,X=$){let Q=o94(X,Z);return new Promise((G,Y)=>{let J=(W,K)=>{let H=t9$.createServer((N)=>this.handleForwardedConnection(N,$,Z,X));H.once("error",(N)=>{if(N.code==="EADDRINUSE"&&K<i94){try{H.close()}catch{}let F=Ad0+(W-Ad0+1)%o9$;J(F,K+1);return}Y(N)}),H.listen(W,"127.0.0.1",()=>{let N=H.address();if(!N||typeof N==="string"){H.close(),Y(Error("port-forward listener failed to bind"));return}G({server:H,localPort:N.port})})};J(Q,0)})}handleForwardedConnection($,Z,X,Q){let G=new v94,Y=null,J=!1,W=()=>{if(J)return;if(J=!0,G.destroy(),Y)try{Y.close()}catch{}if(!$.destroyed)$.destroy()};$.pipe(G),$.on("error",W),$.on("close",W),this.portForward.portForward(this.namespace,Z,[X],$,null,G).then((K)=>{let H=typeof K==="function"?K():K;if(!H){W();return}if(Y=H,Y.on("close",W),Y.on("error",()=>{this.invalidateRecord(Q),W()}),J)try{Y.close()}catch{}}).catch((K)=>{console.warn(`[${y6}] port-forward to ${Z}:${X} failed: ${b94(K)}`,JSON.stringify(r9$(K))),this.invalidateRecord(Q),W()})}closeForwarder($){$.server.close((Z)=>{if(Z)console.warn(`[${y6}] port-forward close on :${$.localPort} errored: ${Z instanceof Error?Z.message:String(Z)}`)})}close(){if(this.closed)return;this.closed=!0,this.claimWatchAbort.abort();for(let $ of this.records.values())this.closeForwarder($.daemonForward);this.records.clear()}}function n94($){return{active:$.createUpDownCounter("studio.sandbox.active",{description:"Active sandbox count, by runner kind, owning org, and daemon impl. Cross-checks the cAdvisor-derived count from the cluster \u2014 divergence between the two indicates orphaned claims (studio deleted but K8s didn't reap) or unattributed pods.",unit:"{sandbox}"}),ensureOutcome:$.createCounter("studio.sandbox.ensure.outcome",{description:"Outcome of each ensure() call: fresh provision, resume from state-store after restart, or adopt of a cluster-side claim studio didn't know about. Cold-start ratio is the primary input for warm-pool sizing.",unit:"{call}"}),proxyDurationMs:$.createHistogram("studio.sandbox.proxy.duration_ms",{description:"Wall-clock latency of studio-mediated requests to the sandbox daemon: tool exec proxies (source=daemon) and preview iframe traffic (source=preview).",unit:"ms"}),poolPods:$.createGauge("studio.sandbox.pool.pods",{description:"Tenant warm pool depth by pool and state: ready (warmed and unbound \u2014 what a claim can actually bind instantly), bound (serving a user), pending (unbound, not yet warmed), failed (gave up after repeated bootstrap failures). Alert on sustained ready=0: a pool that is always empty is doing nothing while costing N pods.",unit:"{pod}"})}}function r9$($){let Z=[],X=$;for(let Q=0;Q<5&&X instanceof Error;Q++){let G=X;if(Z.push({name:G.name,message:G.message,...G.code!==void 0?{code:G.code}:{},...G.errno!==void 0?{errno:G.errno}:{}}),G.cause===X)break;X=G.cause}if(X!==void 0&&!(X instanceof Error)&&X!==null){let Q=X,G=Q.error instanceof Error?r9$(Q.error).chain:void 0;Z.push({nonError:String(X),...typeof Q.type==="string"?{type:Q.type}:{},...typeof Q.message==="string"?{message:Q.message}:{},...Q.code!==void 0?{code:Q.code}:{},...typeof Q.reason==="string"?{reason:Q.reason}:{},...G?{error:G}:{},...G===void 0&&Q.error!==void 0?{rawError:String(Q.error)}:{},keys:Object.keys(Q)})}return{chain:Z}}function p94(){let $=new Wx;return $.loadFromDefault(),$}function n9$($){return Boolean($.status?.conditions?.some((Z)=>Z.type==="Ready"&&Z.status==="True"))}function t94($){let Z=$.spec?.env;if(!Z)return null;for(let X of Z)if(X.name==="DAEMON_TOKEN"&&X.value)return X.value;return null}function o94($,Z){let X=V94("sha256").update(`${$}:${Z}`).digest();return Ad0+X.readUInt32BE(0)%o9$}function jd0($,Z){return new Response(JSON.stringify(Z),{status:$,headers:{"content-type":"application/json","access-control-allow-origin":"*"}})}function p9$($){let Z=$.slice(0,a94);return r94.test(Z)?Z:""}function e94($){if($===void 0)return null;let Z=$.trim();if(Z==="")return null;if(!s94.test(Z))throw Error(`AgentSandboxProvider: envName=${JSON.stringify(Z)} is not a valid DNS-label-safe environment name (lowercase alphanumeric or '-', starts with a letter, ends alphanumeric, \u226432 chars). Studio sets this from STUDIO_ENV; check the studio chart's configMap.`);return Z}function zd0($,Z={}){let X={...Z};if($){let Q=p9$($.orgId),G=p9$($.userId);if(Q)X[vQ.orgId]=Q;if(G)X[vQ.userId]=G}return X}function YV($){let Z="";for(let X of $){let Q=X.codePointAt(0)??0;Z+=Q<32||Q===127?" ":X}return Z.slice(0,$Z4)}function ZZ4($){try{let Z=new URL($);return Z.username="",Z.password="",Z.toString()}catch{return""}}function XZ4($){let Z={},X=$.tenant;if(X?.orgSlug)Z[L3.orgSlug]=YV(X.orgSlug);if(X?.orgName)Z[L3.orgName]=YV(X.orgName);if(X?.userEmail)Z[L3.userEmail]=YV(X.userEmail);if(X?.userName)Z[L3.userName]=YV(X.userName);let Q=$.repo;if(Q){if(Q.displayName)Z[L3.gitRepo]=YV(Q.displayName);let G=ZZ4(Q.cloneUrl);if(G)Z[L3.gitRepoUrl]=YV(G);let Y=$.branch??Q.branch;if(Y)Z[L3.gitBranch]=YV(Y)}return Z}function QZ4($){let Z=$.metadata?.labels;if(!Z)return null;let X=Z[vQ.orgId],Q=Z[vQ.userId];if(!X||!Q)return null;let G=$.metadata?.annotations??{};return{orgId:X,userId:Q,orgSlug:G[L3.orgSlug],orgName:G[L3.orgName],userEmail:G[L3.userEmail],userName:G[L3.userName]}}function GZ4($,Z){if($){let X=new Date($).getTime();if(Number.isFinite(X)&&X<=Z.getTime())return null}return Z.toISOString()}function YZ4($,Z){if($){let X=new Date($).getTime();if(Number.isFinite(X)&&X>=Z.getTime())return null}return Z.toISOString()}function Pd0($){return{org_id:$?.orgId??"",user_id:$?.userId??"",runner_kind:_Q}}function JZ4($){let Z={};if($.branch)Z.branch=$.branch;if($.repo)Z.repo=$.repo;if($.workload)Z.workload=$.workload;if($.env&&Object.keys($.env).length>0)Z.env=$.env;if($.tenant)Z.tenant=$.tenant;if($.orgFsConfigJson)Z.orgFsConfigJson=$.orgFsConfigJson;return Object.keys(Z).length>0?Z:null}function WZ4($,Z){try{return new URL(j50($,Z)).hostname||null}catch{return null}}var _Q="agent-sandbox",y6="AgentSandboxProvider",JV="x-sandbox-preview-not-ready",f94="agent-sandbox-system",x94="studio-sandbox",UN=9000,d9$=3000,Ed0="/app",y94=32,g94,h94=900000,u94=60000,c94=1800000,tF0=3,m9$=1800000,l94=900000,d94=1800000,m94,i9$,Ad0=40000,o9$=1e4,i94=256,vQ,L3,r94,a94=63,s94,$Z4=253;var a9$=B(()=>{E6();q9$();Yd0();C9$();Wc0();Mi();Ri();x9$();Ld0();g94=new Set(["DAEMON_TOKEN","DAEMON_BOOT_ID","APP_ROOT","PROXY_PORT"]),m94=["cookie","host","connection","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","accept-encoding","content-length","upgrade"],i9$=["connection","keep-alive","transfer-encoding","content-encoding","content-length"];vQ={role:"studio.decocms.com/role",sandboxHandle:"studio.decocms.com/sandbox-handle",orgId:"studio.decocms.com/org-id",userId:"studio.decocms.com/user-id",env:"studio.decocms.com/env"},L3={orgSlug:"studio.decocms.com/org-slug",orgName:"studio.decocms.com/org-name",userEmail:"studio.decocms.com/user-email",userName:"studio.decocms.com/user-name",gitRepo:"studio.decocms.com/git-repo",gitRepoUrl:"studio.decocms.com/git-repo-url",gitBranch:"studio.decocms.com/git-branch"},r94=/^([A-Za-z0-9]([-A-Za-z0-9_.]*[A-Za-z0-9])?)?$/;s94=/^[a-z]([a-z0-9-]{0,30}[a-z0-9])?$/});var s9$={};N4(s9$,{waitForSandboxReady:()=>mF0,parseTenantPools:()=>y9$,getSandboxClaim:()=>D3,getHttpRoute:()=>P9$,deleteSandboxClaim:()=>xw,deleteHttpRoute:()=>dF0,createSandboxClaim:()=>Ii,applyHttpRoute:()=>lF0,SandboxTimeoutError:()=>QV,SandboxError:()=>V9,PREVIEW_NOT_READY_HEADER:()=>JV,KubeConfig:()=>Wx,K8S_CONSTANTS:()=>U9,HTTPROUTE_CONSTANTS:()=>qi,AgentSandboxProvider:()=>Td0});var Rd0=B(()=>{Yd0();Ri();Mi();a9$();Ld0()});var GZ$={};N4(GZ$,{subscribeLifecycle:()=>kd0,getSandboxProviderByKind:()=>qd0,getOrInitSharedRunner:()=>Md0,__resetSharedLifecyclesForTesting:()=>jZ4});function XZ$($,Z){let X=e9$[$];if(X)return Promise.resolve(X);let Q=Id0[$];if(Q)return Q;let G=Z().then((Y)=>{return e9$[$]=Y,Y}).finally(()=>{delete Id0[$]});return Id0[$]=G,G}function NZ4(){let $=process.env.STUDIO_SANDBOX_PREVIEW_URL_PATTERN;return $&&$.trim()!==""?$:void 0}function FZ4(){let $=process.env.STUDIO_SANDBOX_TEMPLATE_NAME;return $&&$.trim()!==""?$:void 0}function UZ4(){let $=process.env.STUDIO_ENV;return $&&$.trim()!==""?$:void 0}function wZ4(){let $=process.env.STUDIO_SANDBOX_SENTINEL_TOKEN;return $&&$.trim()!==""?$:void 0}function OZ4(){let $=process.env.STUDIO_SANDBOX_PREVIEW_GATEWAY_NAME?.trim(),Z=process.env.STUDIO_SANDBOX_PREVIEW_GATEWAY_NAMESPACE?.trim();if(!$&&!Z)return;if(!$||!Z)throw Error("STUDIO_SANDBOX_PREVIEW_GATEWAY_NAME and STUDIO_SANDBOX_PREVIEW_GATEWAY_NAMESPACE must both be set, or both unset. Half-configured per-claim HTTPRoute routing would silently fail to attach.");return{name:$,namespace:Z}}async function QZ$($,Z){let X=new Qi(Z),Q=NZ4();switch($){case"agent-sandbox":{let{AgentSandboxProvider:G,parseTenantPools:Y}=await Promise.resolve().then(() => (Rd0(),s9$)),J=new RH(c0().encryptionKey);return new G({stateStore:X,previewUrlPattern:Q,sandboxTemplateName:FZ4(),envName:UZ4(),previewGateway:OZ4(),sentinelToken:wZ4(),tenantPools:Y(process.env.STUDIO_SANDBOX_TENANT_POOLS),meter:K8,mintCloneUrl:async(W,K)=>{if(!W.connectionId)return null;let H=d0$(W.cloneUrl);if(!H)return null;let{cloneUrl:N}=await Iw(W.connectionId,H.owner,H.name,Z,J,{bufferMs:K?.bufferMs});return N}})}case"user-desktop":throw Error("user-desktop provider cannot be instantiated without a per-run link claim \u2014 call resolveSandboxProvider, which binds the link before constructing the provider.");default:throw Error(`Unknown sandbox provider kind: ${String($)}`)}}function qd0($,Z){return XZ$(Z,()=>QZ$(Z,$.db))}async function Md0(){let $;try{$=VL()}catch(X){return console.warn("[lifecycle] cannot resolve sandbox runner:",X instanceof Error?X.message:String(X)),null}return await XZ$($,()=>QZ$($,m8().db))}function kd0($,Z,X){let Q=yw.get(Z);if(Q){if(Q.terminated){if(Q.lastPhase)try{X(Q.lastPhase)}catch{}return{unsubscribe:LZ4}}if(Q.listeners.add(X),Q.lastPhase)try{X(Q.lastPhase)}catch{}return $Z$(Z,Q,X)}let G=new AbortController,Y={lastPhase:null,terminated:!1,listeners:new Set([X]),abort:G};return yw.set(Z,Y),EZ4($,Z,Y),$Z$(Z,Y,X)}function LZ4(){}function $Z$($,Z,X){return{unsubscribe(){if(yw.get($)!==Z)return;if(Z.listeners.delete(X),Z.listeners.size===0)yw.delete($),Z.abort.abort()}}}async function EZ4($,Z,X){let Q=null;try{for await(let G of $.watchClaimLifecycle(Z,X.abort.signal)){if(X.abort.signal.aborted)break;X.lastPhase=G;let Y=G.kind==="ready"||G.kind==="failed";if(Y)X.terminated=!0;let J=Array.from(X.listeners);for(let W of J)try{W(G)}catch{}if(Y)break}}catch(G){Q=G}finally{if(!X.terminated&&!X.abort.signal.aborted&&X.listeners.size>0){let G={kind:"failed",reason:"unknown",message:Q instanceof Error?Q.message:"Lifecycle watcher ended unexpectedly"};X.lastPhase=G,X.terminated=!0;for(let Y of Array.from(X.listeners))try{Y(G)}catch{}}if(yw.get(Z)===X)yw.delete(Z)}}function jZ4(){for(let $ of yw.values())$.abort.abort();yw.clear()}var KZ4,HZ4,ZZ$,e9$,Id0,BZ4,DZ4,yw;var Si=B(()=>{GN();LY();Z5();Nc0();rf();Xc();S$();KZ4=Symbol.for("decocms.sandbox.lifecycle.runners"),HZ4=Symbol.for("decocms.sandbox.lifecycle.inflight"),ZZ$=globalThis,e9$=ZZ$[KZ4]??={},Id0=ZZ$[HZ4]??={};BZ4=Symbol.for("decocms.sandbox.lifecycle.shared-lifecycles"),DZ4=globalThis,yw=DZ4[BZ4]??=new Map});async function uX($,Z){let{userId:X,branch:Q,virtualMcpMetadata:G,explicitKind:Y}=Z;if(Y)return Vi($,Y);if($.sandboxPreference==="agent-sandbox")return Vi($,"agent-sandbox");if($.sandboxPreference==="cluster-default")return Vi($,VL());let[J,...W]=zZ4(G,X,Q);if(J)return Vi($,W.length===0?J:PZ4(J,W));return Vi($,YZ$())}function zZ4($,Z,X){let Q=C5($)[Z]?.[X];if(!Q)return[];let G=VJ(Q);return Object.keys(G)}function PZ4($,Z){let X=YZ$();if(X===$||Z.includes(X))return X;return $}function YZ$(){return VL()}async function Vi($,Z){let X=Z==="user-desktop"?"agent-sandbox":Z;return{provider:await qd0($,X),kind:X}}var gw=B(()=>{L8();GN();qQ();Si()});var Ci;var Sd0=B(()=>{Ci={npm:{install:"npm install",run:($)=>`npm run ${$}`,runtime:"node"},pnpm:{install:"pnpm install",run:($)=>`pnpm run ${$}`,runtime:"node"},yarn:{install:"yarn install",run:($)=>`yarn run ${$}`,runtime:"node"},bun:{install:"bun install",run:($)=>`bun run ${$}`,runtime:"bun"},deno:{install:"deno install",run:($)=>`deno task ${$}`,runtime:"deno"}}});function E3($,Z){return Z?`thread:${$}/${Z}`:`thread:${$}`}function wN($){return`sandbox/thread-${$.replace(/^thread:/,"").replace(/\//g,"-")}`}function hw($){if(!$||!$.startsWith("thread:"))return null;return $.slice(7).split("/")[0]||null}async function ON($,Z,X){let Q=hw(Z);if(!Q)return X;return(await $.storage.threads.get(Q).catch(()=>null))?.created_by??X}async function WV($,Z){if(!Z)return null;let X=await $.storage.threads.get(Z).catch(()=>null);if(!X)return null;return X.metadata??{}}async function JZ$($,Z){let Q=(await WV($,Z))?.headRef;return typeof Q==="string"&&Q.length>0?Q:null}async function WZ$($,Z,X){let Q=await WV($,Z);if(!Q)return;if(Q.headRef===X)return;await $.storage.threads.update(Z,{metadata:{...Q,headRef:X}}).catch((G)=>console.warn("[thread-repo] setThreadHeadRef failed",G))}async function uw($,Z){return(await WV($,Z))?.githubRepo??null}function Vd0($){if($.pinnedRef)return $.pinnedRef;if($.runBranch&&$.runBranch===E3($.threadId))return $.runBranch;if($.threadRepo)return E3($.threadId,$.threadRepo.connectionId);if(!$.agentRepo)return"ephemeral";return $.runBranch??`thread:${$.threadId}`}async function Cd0($,Z){let Q=(await WV($,Z))?.pinnedRef;return typeof Q==="string"&&Q.length>0?Q:null}async function KZ$($,Z){let[X,Q]=await Promise.all([uw($,Z.threadId),Cd0($,Z.threadId)]);return Vd0({...Z,threadRepo:X,pinnedRef:Q})}async function HZ$($,Z,X,Q,G,Y){let J=await WV($,Z);if(!J)return;let W=Xi(C5(J),X,Q,G,Y);await $.storage.threads.update(Z,{metadata:{...J,sandboxMap:W}}).catch((K)=>console.warn("[thread-repo] setThreadSandboxMapEntry failed",K))}async function oF0($,Z){return C5(await WV($,Z))}async function NZ$($,Z,X,Q,G){let Y=await WV($,Z);if(!Y)return;let J=Hc0(C5(Y),X,Q,G);if(!J)return;await $.storage.threads.update(Z,{metadata:{...Y,sandboxMap:J}}).catch((W)=>console.warn("[thread-repo] removeThreadSandboxMapEntry failed",W))}var j3=B(()=>{qQ()});function rF0($){if(!$)return null;let Z=$.runtime;if(!Z||typeof Z!=="object")return null;let X=Z.env;if(!Array.isArray(X))return null;let Q=[];for(let G of X){if(!G||typeof G!=="object")continue;let Y=G;if(typeof Y.key!=="string"||!n00.test(Y.key))continue;if(Y.kind==="literal"&&typeof Y.value==="string"){Q.push({key:Y.key,kind:"literal",value:Y.value});continue}if(Y.kind==="secret"&&typeof Y.secretId==="string"&&Y.secretId.length>0)Q.push({key:Y.key,kind:"secret",secretId:Y.secretId})}return Q.length===0?null:Q}function FZ$($){if(!$)return null;let Z=$.runtime;if(!Z||typeof Z!=="object")return null;let X=Z.submoduleCredentials;if(!Array.isArray(X))return null;let Q=[];for(let G of X){if(!G||typeof G!=="object")continue;let Y=G;if(typeof Y.host==="string"&&Y.host.length>0&&typeof Y.secretId==="string"&&Y.secretId.length>0)Q.push({host:Y.host,secretId:Y.secretId})}return Q.length===0?null:Q}async function UZ$($,Z){Z0(Z);let X=r(Z);await Z.access.check();let Q=W1(Z);if(!Q)throw Error("User ID required");let G=await Z.storage.virtualMcps.findById($.virtualMcpId);if(!G||G.organization_id!==X.id)throw Error("Virtual MCP not found");let Y=G.metadata??{},J=C5(Y),W=await ON(Z,$.branch,Q),K=rW(J,W,$.branch,$.sandboxProviderKind);return{virtualMcp:G,metadata:Y,userId:Q,sandboxUserId:W,entry:K,organization:X}}function AZ4($){if($===null||!/^\d+$/.test($))return null;let Z=Number($);return Z>=1&&Z<=65535?$:null}function wZ$($){let Z=$.runtime??null,Q=Z?.selected??null,G=AZ4(Z?.port??null),Y=Z?.path??null;if(!Q||!(Q in Ci))return{packageManager:null,runtime:null,port:G,packageManagerPath:Y,runtimeBinPath:null};let J=Ci[Q].runtime;return{packageManager:Q,runtime:J,port:G,packageManagerPath:Y,runtimeBinPath:J==="deno"?"/opt/deno/bin":J==="bun"?"/opt/bun/bin":null}}var _i=B(()=>{L8();Sd0();qQ();j3()});import{sql as TZ4}from"kysely";function OZ$($){return $ instanceof Date?$.toISOString():String($)}class _d0{db;vault;constructor($,Z){this.db=$;this.vault=Z}rowToInfo($){return{id:$.id,organizationId:$.organization_id,scope:$.scope,userId:$.user_id,name:$.name,description:$.description,createdBy:$.created_by,createdAt:OZ$($.created_at),updatedBy:$.updated_by,updatedAt:OZ$($.updated_at)}}assertVisible($,Z){if($.scope==="user"&&$.user_id!==Z)throw new cw($.id)}async create($){let Z=l8("sec"),X=await this.vault.encrypt($.value),Q=new Date,G=await this.db.insertInto("secrets").values({id:Z,organization_id:$.organizationId,scope:$.scope.kind,user_id:$.scope.kind==="user"?$.scope.userId:null,name:$.name,encrypted_value:X,description:$.description??null,created_by:$.createdBy,created_at:Q,updated_by:$.createdBy,updated_at:Q}).returning(aF0).executeTakeFirstOrThrow();return this.rowToInfo(G)}async update($){let Z=await this.db.selectFrom("secrets").where("id","=",$.id).where("organization_id","=",$.organizationId).select(["id","scope","user_id"]).executeTakeFirst();if(!Z)throw new VY($.id);this.assertVisible(Z,$.callerUserId);let X={updated_by:$.updatedBy,updated_at:new Date};if($.value!==void 0)X.encrypted_value=await this.vault.encrypt($.value);if($.description!==void 0)X.description=$.description;let Q=await this.db.updateTable("secrets").set(X).where("id","=",$.id).where("organization_id","=",$.organizationId).returning(aF0).executeTakeFirstOrThrow();return this.rowToInfo(Q)}async delete($,Z,X){let Q=await this.db.selectFrom("secrets").where("id","=",$).where("organization_id","=",Z).select(["id","scope","user_id"]).executeTakeFirst();if(!Q)throw new VY($);this.assertVisible(Q,X),await this.db.deleteFrom("secrets").where("id","=",$).where("organization_id","=",Z).execute()}async list($){let Z=this.db.selectFrom("secrets").where("organization_id","=",$.organizationId).select(aF0);if($.scope?.kind==="user")Z=Z.where("scope","=","user").where("user_id","=",$.scope.userId);else if($.scope?.kind==="organization")Z=Z.where("scope","=","organization");else Z=Z.where((Q)=>Q.or([Q("scope","=","organization"),Q.and([Q("scope","=","user"),Q("user_id","=",$.callerUserId)])]));return(await Z.orderBy("created_at","desc").execute()).map((Q)=>this.rowToInfo(Q))}async findById($,Z,X){let Q=await this.db.selectFrom("secrets").where("id","=",$).where("organization_id","=",Z).select(aF0).executeTakeFirst();if(!Q)throw new VY($);return this.assertVisible(Q,X),this.rowToInfo(Q)}async resolveById($,Z,X){let Q=await this.db.selectFrom("secrets").where("id","=",$).where("organization_id","=",Z).selectAll().executeTakeFirst();if(!Q)throw new VY($);this.assertVisible(Q,X);let G=await this.vault.decrypt(Q.encrypted_value);return{info:this.rowToInfo(Q),value:G}}async resolveByName($){let Z=this.db.selectFrom("secrets").where("organization_id","=",$.organizationId).where("scope","=",$.scope.kind).where(TZ4`lower(name) = lower(${$.name})`).selectAll();if($.scope.kind==="user")Z=Z.where("user_id","=",$.scope.userId);let X=await Z.executeTakeFirst();if(!X)throw new VY(`${$.scope.kind}:${$.name}`);let Q=await this.vault.decrypt(X.encrypted_value);return{info:this.rowToInfo(X),value:Q}}}var aF0,VY,cw;var vi=B(()=>{IX();aF0=["id","organization_id","scope","user_id","name","description","created_by","created_at","updated_by","updated_at"];VY=class VY extends Error{constructor($){super(`Secret ${$} not found`);this.name="SecretNotFoundError"}};cw=class cw extends Error{constructor($){super(`Access denied for secret ${$}`);this.name="SecretAccessDeniedError"}}});async function lw($,Z){let X=$.body?.getReader();if(!X)return $.text();let Q=new TextDecoder,G="",Y=0;for(;;){let{done:J,value:W}=await X.read();if(J)break;if(Y+=W.byteLength,Y>Z)throw await X.cancel().catch(()=>{}),new BZ$(`Upstream response exceeded ${Z} bytes`);G+=Q.decode(W,{stream:!0})}return G+=Q.decode(),G}var BZ$;var bi=B(()=>{BZ$=class BZ$ extends Error{}});async function sF0({ctx:$,runner:Z,handle:X,orgId:Q,userId:G,entries:Y}){if(!Y||Y.length===0)return;let J={};for(let K of Y){if(K.kind==="literal"){J[K.key]=K.value;continue}try{let{value:H}=await $.storage.secrets.resolveById(K.secretId,Q,G);J[K.key]=H}catch(H){if(H instanceof VY||H instanceof cw){console.warn(`[SANDBOX_START] skipping env ${K.key}: ${H.message}. Re-link or recreate the secret to restore.`);continue}throw H}}if(Object.keys(J).length===0)return;let W=await Z.proxyDaemonRequest(X,"/_sandbox/config",{method:"PUT",headers:new Headers({"content-type":"application/json"}),body:JSON.stringify({env:J})});if(!W.ok){let K=await lw(W,RZ4).catch(()=>W.statusText);console.warn(`[SANDBOX_START] daemon rejected env patch (${W.status}): ${K}`)}}var RZ4=10485760;var vd0=B(()=>{vi();bi()});async function DZ$({ctx:$,orgId:Z,userId:X,entries:Q}){if(!Q||Q.length===0)return[];let G=[];for(let Y of Q)try{let{value:J}=await $.storage.secrets.resolveById(Y.secretId,Z,X);G.push({host:Y.host,token:J})}catch(J){if(J instanceof VY||J instanceof cw){console.warn(`[SANDBOX_START] skipping submodule credential for ${Y.host}: ${J.message}. Re-link or recreate the secret to restore.`);continue}throw J}return G}var LZ$=B(()=>{vi()});async function zZ$($,Z,X,Q,G){let Y=await F3({connectionId:$,tokenStorage:new r6(Q,G)});if(!Y.accessToken)return null;return AZ$(Z,X,Y.accessToken)}function PZ$($,Z){return AZ$($,Z,null)}async function AZ$($,Z,X){let Q=new Map,G=new Set(EZ$.map((K)=>K.path));for(let K of Object.values(jZ$))for(let H of K??[])G.add(H);await Promise.all(Array.from(G).map(async(K)=>{Q.set(K,await qZ4($,Z,K,X))}));let Y=EZ$.find(({path:K})=>Q.get(K)!==null);if(!Y)return null;let J=jZ$[Y.pm]??[],W=null;for(let K of J)if(W=MZ4(Q.get(K)??null),W)break;return{packageManager:Y.pm,devPort:W}}async function qZ4($,Z,X,Q){let G=`https://api.github.com/repos/${$}/${Z}/contents/${encodeURIComponent(X)}`;try{let Y={Accept:"application/vnd.github+json","User-Agent":"studio-runtime-detect"};if(Q)Y.Authorization=`token ${Q}`;let J=await fetch(G,{headers:Y,signal:AbortSignal.timeout(5000)});if(!J.ok)return null;let W=await J.json();if(!W.content||W.encoding!=="base64")return null;return Buffer.from(W.content,"base64").toString("utf8")}catch{return null}}function MZ4($){if(!$)return null;try{let Z=JSON.parse($),X=Z.tasks??Z.scripts??{};return(X.dev??X.start??"").match(IZ4)?.[1]??null}catch{return null}}var EZ$,jZ$,IZ4;var TZ$=B(()=>{YN();PY();EZ$=[{path:"deno.json",pm:"deno"},{path:"deno.jsonc",pm:"deno"},{path:"bun.lock",pm:"bun"},{path:"bunfig.toml",pm:"bun"},{path:"pnpm-lock.yaml",pm:"pnpm"},{path:"yarn.lock",pm:"yarn"},{path:"package-lock.json",pm:"npm"},{path:"package.json",pm:"bun"}],jZ$={deno:["deno.json","deno.jsonc"],bun:["package.json"],pnpm:["package.json"],yarn:["package.json"],npm:["package.json"]},IZ4=/(?:--port|PORT=|:)(\d{4,5})/});function kZ4($){return($??"").normalize("NFKD").replace(/[\u0300-\u036F]/g,"").toLowerCase().replace(/[^a-z0-9]+/g,"-").replace(/^-+|-+$/g,"")||"user"}function eF0($){return $?.name||$?.email?.split("@")[0]||void 0}function $U0($){let Z=kZ4($),X=Date.now().toString(36).split("").reverse().join("");return`${Z}-${X}`}function RZ$($){let{current:Z,detached:X,base:Q}=$.status??{};if(typeof Z!=="string"||Z.length===0)return null;if(X===!0)return null;if(Z===$.requestedRef)return null;if(SZ4.has(Z))return null;if(typeof Q==="string"&&Q.length>0&&Z===Q)return null;return Z}function IZ$($){if(!$.branch.startsWith("thread:"))return $.branch;if($.sticky&&$.recordedHeadRef)return $.recordedHeadRef;return $.derivedRef}var SZ4;var bd0=B(()=>{SZ4=new Set(["main","master","trunk","develop","HEAD"])});async function qZ$($,Z){if(!$)return{hosts:[],allowSameHostDev:!1};let X;try{X=await $.presignedGetUrl("link-dispatch/_allowlist_probe",60,{requireFetchable:!0})}catch{return{hosts:[],allowSameHostDev:!1}}let Q;try{Q=new URL(X)}catch{return{hosts:[],allowSameHostDev:!1}}if(Q.protocol!=="https:"&&Q.protocol!=="http:")return{hosts:[],allowSameHostDev:!1};let G=Q.hostname,Y=VZ4.has(G);return{hosts:[G],allowSameHostDev:Y&&!Z.isProduction}}var VZ4;var MZ$=B(()=>{VZ4=new Set(["127.0.0.1","localhost","::1","[::1]","0.0.0.0"])});var KV="home";var ZU0=()=>{};function XU0($){if(!dF($))return`Invalid volume name ${JSON.stringify($)} \u2014 use 1-128 chars of letters, digits, "_", "-" or "."`;if(CZ4.has($))return`Volume "${$}" is reserved`;if(NW($))return'Volume names starting with "public-" are reserved for shared skill sets';if($.startsWith("."))return'Volume names starting with "." are reserved';if(!/^[A-Za-z0-9]/.test($))return"Volume names must start with a letter or digit";return null}async function QU0($,Z){try{let X=await $.storage.connections.findById(Z.connectionId,Z.organizationId);if(!X)throw Error("sync connection not found in this organization");await Rw({ctx:$,connectionId:X.id,organizationId:Z.organizationId,onLegacyMintError:(J)=>console.warn("[org-repo-sync] repo-scoped mint failed",{configId:Z.id,error:J instanceof Error?J.message:String(J)})});let Q=await F3({connectionId:X.id,tokenStorage:new r6($.db,$.vault)});if(!Q.accessToken)throw Error("No GitHub token for the sync connection \u2014 reconnect the mcp-github integration.");let G=Q.accessToken,Y=await aV0($.db,{orgId:Z.organizationId,baseUrl:$.baseUrl,volume:Z.volume,source:{repo:`${Z.repoOwner}/${Z.repoName}`,ref:Z.ref,paths:Z.paths},authToken:G,skipVolumeQuota:!1});return await $.storage.orgRepoSyncs.recordSyncResult(Z.id,{error:null}),{id:Z.id,volume:Z.volume,...Y}}catch(X){let Q=X instanceof Error?X.message:String(X);return await $.storage.orgRepoSyncs.recordSyncResult(Z.id,{error:Q}).catch(()=>{}),{id:Z.id,volume:Z.volume,error:Q}}}var CZ4,fd0=10;var GU0=B(()=>{rf();YN();PY();Dv();$D();q00();CZ4=new Set(["home","outputs","uploads","public","output","upload"])});function dw($,Z){let X;if($==="home")X=`org/${KV}`;else if($==="outputs")X=`org/${kZ$}`;else if($==="uploads")X=`org/${SZ$}`;else if(NW($))X=`org/public/${$.slice(7)}`;else X=`org/${$}`;return Z?`${X}/${Z}`:X}function vZ4($){return{baseUrl:$.baseUrl.replace(/\/+$/,""),orgSlug:$.orgSlug,token:$.token,mounts:[{volume:"home",path:KV},..._Z4.map((Z)=>({...Z})),...($.publicSets??[]).map((Z)=>({volume:iF(Z),path:`public/${Z}`,readonly:!0})),...($.syncedVolumes??[]).filter((Z)=>XU0(Z)===null).map((Z)=>({volume:Z,path:Z,readonly:!0}))]}}async function VZ$($,Z){try{let X=await $.boundAuth.apiKey.create({name:`orgfs-${Z.orgSlug}`,permissions:{self:["ORG_FS_READ","ORG_FS_WRITE"]},expiresIn:bZ4,metadata:{organization:{id:Z.orgId,slug:Z.orgSlug}}}),Q=await $.storage.orgRepoSyncs.listEnabledVolumes(Z.orgId).catch(()=>[]);return JSON.stringify(vZ4({baseUrl:Z.baseUrl,orgSlug:Z.orgSlug,token:X.key,publicSets:XY().map((G)=>G.set),syncedVolumes:Q}))}catch(X){console.warn("[org-fs] token mint failed; mounts disabled for this sandbox",X);return}}var kZ$=".outputs",SZ$=".uploads",_Z4,bZ4=604800;var fi=B(()=>{ZU0();GU0();$D();_Z4=[{volume:"outputs",path:kZ$},{volume:"uploads",path:SZ$}]});import{z as XK}from"zod";async function wx($,Z){Z0(Z);let X=r(Z),Q=W1(Z);if(!Q)throw Error("User ID required");let G=await Z.storage.virtualMcps.findById($.virtualMcpId);if(!G||G.organization_id!==X.id)throw Error("Virtual MCP not found");let Y=G.metadata??{},J=await ON(Z,$.branch,Q),W=rW(C5(Y),J,$.branch,$.sandboxProviderKind),K=$.sandboxProviderKind,{provider:H}=await uX(Z,{userId:J,branch:$.branch,virtualMcpMetadata:Y,explicitKind:K});if(W){if(K!=="user-desktop")return W;if(await H.alive(W.sandboxHandle).catch(()=>!1))return W;await Tw(Z.storage.virtualMcps,$.virtualMcpId,Q,J,$.branch,K).catch((O)=>{console.warn("[ensureSandbox] failed to reap stale user-desktop entry",O)})}let F=await uw(Z,hw($.branch)??Z.metadata?.threadId)??Y.githubRepo??null,{entry:U}=await _Z$({ctx:Z,userId:Q,sandboxUserId:J,orgId:X.id,virtualMcpId:$.virtualMcpId,branch:$.branch,metadata:Y,githubRepo:F,existing:null,providerKind:K,runner:H,...$.cloneOnly?{cloneOnly:!0}:{}});return U}async function _Z$($){let{ctx:Z,userId:X,sandboxUserId:Q,orgId:G,virtualMcpId:Y,branch:J,metadata:W,existing:K,runner:H,cloneOnly:N}=$,F=$.githubRepo?await xZ4({ctx:Z,orgId:G,virtualMcpId:Y,userId:X,githubRepo:$.githubRepo}):null,{runtime:U,packageManager:w,port:O,packageManagerPath:D}=wZ$(W),L;if(F){if(F.connectionId)await Rw({ctx:Z,connectionId:F.connectionId,organizationId:G,forceRefresh:!0,onLegacyMintError:(f0)=>{console.error("[provisionSandbox] repo-scoped legacy token mint failed",{connectionId:F.connectionId,error:f0.message})}});let{cloneUrl:O0,gitUserName:s,gitUserEmail:t}=F.connectionId?await Iw(F.connectionId,F.owner,F.name,Z.db,Z.vault):l0$(F.owner,F.name);if(!w){let f0=F.connectionId?await zZ$(F.connectionId,F.owner,F.name,Z.db,Z.vault):await PZ$(F.owner,F.name);if(f0)w=f0.packageManager,U=Ci[f0.packageManager].runtime,O=f0.devPort??O,await yZ4(Z,Y,X,f0.packageManager,f0.devPort)}let P0=c0().sandboxStickyHeadRefEnabled,G0=IZ$({branch:J,derivedRef:wN(J),recordedHeadRef:P0?await JZ$(Z,hw(J)):null,sticky:P0}),j0=await DZ$({ctx:Z,orgId:G,userId:X,entries:FZ$(W)});L={cloneUrl:O0,...F.connectionId?{connectionId:F.connectionId}:{},userName:s,userEmail:t,branch:G0,displayName:`${F.owner}/${F.name}`,...j0.length>0?{submoduleCredentials:j0}:{}}}let E=typeof W.productionUrl==="string"&&W.productionUrl.trim()?W.productionUrl.trim():void 0,j=U&&w&&!N?{runtime:U,packageManager:w,...O!==null?{devPort:Number(O)}:{},...D?{packageManagerPath:D}:{},...E?{productionUrl:E}:{}}:void 0,z=em({orgId:G,virtualMcpId:Y,branch:J}),A=H.kind==="user-desktop"?await qZ$(Z.objectStorage,{isProduction:c0().nodeEnv==="production"}):null,P=(H.kind==="user-desktop"||H.kind==="agent-sandbox")&&!c0().orgFsMountsDisabled,M;if(P){let O0=Z.organization?.slug??(await Z.db.selectFrom("organization").select(["slug"]).where("id","=",G).executeTakeFirst())?.slug;if(O0)M=await VZ$(Z,{orgSlug:O0,orgId:G,baseUrl:XQ()})}await hZ4(H);let k=await H.ensure({userId:Q,projectRef:z},{branch:J,repo:L,workload:j,cloneOnly:N===!0,tenant:{orgId:G,userId:Q,...Z.organization?.slug?{orgSlug:Z.organization.slug}:{},...Z.organization?.name?{orgName:Z.organization.name}:{},...Z.auth.user?.email?{userEmail:Z.auth.user.email}:{},...Z.auth.user?.name?{userName:Z.auth.user.name}:{}},...A?{offloadAllowedHosts:A.hosts,offloadAllowSameHostDev:A.allowSameHostDev}:{},...M?{orgFsConfigJson:M}:{}}),q=W.runtime?.env??null;await sF0({ctx:Z,runner:H,handle:k.handle,orgId:G,userId:X,entries:q});let l=!!K&&K.sandboxHandle===k.handle&&K?.createdAt?K.createdAt:Date.now(),b=W.runtime?.selected??null,x=W.runtime?.port??null,p=W.runtime?.path??null,h={sandboxHandle:k.handle,previewUrl:k.previewUrl,sandboxApiUrl:k.previewUrl,sandboxProviderKind:H.kind,createdAt:l,startedWith:{packageManager:b,port:x,path:p}};await V0$(Z.storage.virtualMcps,Y,X,Q,J,$.providerKind,h);let o=hw(J);if(o)await HZ$(Z,o,Q,J,$.providerKind,h);let w0=!K||K.sandboxHandle!==k.handle;return{entry:h,isNewVm:w0}}async function xZ4($){let{ctx:Z,orgId:X,virtualMcpId:Q,userId:G,githubRepo:Y}=$;if(!Y.connectionId)return Y;if(await Z.storage.connections.findById(Y.connectionId,X))return Y;let{items:W}=await Z.storage.connections.list(X),K=xp1(W,Y.owner,Y.name);if(!K)return console.warn("[provisionSandbox] recorded repo connection no longer exists and no live connection covers the repo",{virtualMcpId:Q,connectionId:Y.connectionId}),Y;console.warn("[provisionSandbox] healed dangling repo connection",{virtualMcpId:Q,staleConnectionId:Y.connectionId,connectionId:K.id});try{let N=(await Z.storage.virtualMcps.findById(Q))?.metadata??{},F=N.githubRepo;if(F?.connectionId===Y.connectionId){let U=M9(K);await Z.storage.virtualMcps.update(Q,G,{metadata:{...N,githubRepo:{...F,connectionId:K.id,...U?{installationId:U.installationId}:{}}}})}}catch(H){console.warn("[provisionSandbox] failed to persist healed repo connection",{virtualMcpId:Q,error:H.message})}return{...Y,connectionId:K.id}}async function yZ4($,Z,X,Q,G){let Y=await $.storage.virtualMcps.findById(Z);if(!Y)return;let J=Y.metadata??{};await $.storage.virtualMcps.update(Z,X,{metadata:{...J,runtime:{selected:Q,port:G}}})}async function hZ4($){if(!$.hasSchedulableCapacity)return;let Z=Date.now()+CZ$,X=!1;while(!await $.hasSchedulableCapacity()){if(Date.now()>=Z)throw Error(`sandbox provisioning failed: the cluster has had no room to schedule another sandbox for ${Math.round(CZ$/1000)}s`);if(!X)X=!0,console.warn("[ensureSandbox] waiting for cluster capacity \u2014 a sandbox pod cannot be scheduled right now");await y$(gZ4)}}var fZ4,xd0,CZ$=150000,gZ4=5000;var xi=B(()=>{GN();E6();v0();_i();vd0();LZ$();qQ();AY();rf();TZ$();Sd0();gw();j3();bd0();MZ$();S$();jZ();fi();qQ();fZ4=XK.enum(["agent-sandbox","user-desktop","cluster"]),xd0=m({name:"SANDBOX_START",description:"Start a sandbox with the connected GitHub repo and dev server.",annotations:{title:"Start VM Preview",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!1,openWorldHint:!0},_meta:{ui:{visibility:"app"}},inputSchema:XK.object({virtualMcpId:XK.string().describe("Virtual MCP ID"),branch:XK.string().min(1).optional().describe("Git branch to check out. Pass the thread's branch whenever the caller has one: when omitted the handler mints a fresh `<user-slug>-<timestamp>` name, which becomes a SEPARATE sandbox from the one the thread's own branch resolves to. The resolved branch is returned in the response so callers can persist it."),sandboxProviderKind:fZ4.optional().describe("Explicit runtime choice. Hosted provider is `agent-sandbox`; legacy `cluster` input is accepted only for compatibility and normalized to `agent-sandbox`. When omitted, defaults to `user-desktop` if the acting user's link daemon is online, else the env kind.")}),outputSchema:XK.object({previewUrl:XK.string().nullable(),sandboxHandle:XK.string(),branch:XK.string(),isNewVm:XK.boolean(),sandboxProviderKind:XK.enum(["agent-sandbox","user-desktop"])}),handler:async($,Z)=>{Z0(Z);let X=r(Z);await Z.access.check();let Q=$.branch??$U0(eF0(Z.auth.user)),G=W1(Z);if(!G)throw Error("User ID required");let Y=await ON(Z,Q,G),J=await Z.storage.virtualMcps.findById($.virtualMcpId);if(!J||J.organization_id!==X.id)throw Error("Virtual MCP not found");let W=J.metadata??{},K=$.sandboxProviderKind?kL($.sandboxProviderKind):void 0,{provider:H,kind:N}=await uX(Z,{userId:Y,branch:Q,virtualMcpMetadata:W,explicitKind:K}),F=rW(C5(W),Y,Q,N),w=await uw(Z,hw(Q)??Z.metadata?.threadId)??W.githubRepo??null,{entry:O,isNewVm:D}=await _Z$({ctx:Z,userId:G,sandboxUserId:Y,orgId:X.id,virtualMcpId:$.virtualMcpId,branch:Q,metadata:W,githubRepo:w,existing:F,providerKind:N,runner:H});return{...O,branch:Q,isNewVm:D,sandboxProviderKind:N}}})});function uZ4($){let{publicUrl:Z,agentId:X,organization:Q,target:G,threadId:Y}=$;if(G==="agent-tools")return`${Z}/mcp/virtual-mcp/${X}`;if(!Q.slug)throw new bZ$(Q.id);if(G==="task-run"){if(!Y)throw Error("a task-run MCP endpoint is scoped to a run: threadId is required");return`${Z}/api/${Q.slug}/mcp/task-run/${encodeURIComponent(Y)}`}return`${Z}/api/${Q.slug}/mcp/self`}async function YU0($,Z,X,Q,G="agent-tools",Y){let J=uZ4({publicUrl:XQ(),agentId:Z,organization:X,target:G,...Y?{threadId:Y}:{}}),W=await $.boundAuth.apiKey.create({name:Q,permissions:{"*":["*"]},expiresIn:vZ$,metadata:{organization:{id:X.id,slug:X.slug,name:X.name}}});return{url:J,headers:{Authorization:`Bearer ${W.key}`,"x-org-id":X.id},expiresAt:Date.now()+vZ$*1000}}var vZ$=3600,bZ$;var yd0=B(()=>{jZ();bZ$=class bZ$ extends Error{constructor($){super(`cannot mint a management MCP endpoint for organization "${$}": the org-scoped path /api/<slug>/mcp/self needs the org slug, which was not loaded.`);this.name="MissingOrganizationSlugError"}}});async function cZ4($,Z,X,Q){try{let G=$.organization;if(!G)return;let Y=await YU0($,Q.virtualMcpId,G,"tool-scripting"),J=await Z.proxyDaemonRequest(X,"/_sandbox/tools/sync",{method:"POST",headers:new Headers({"content-type":"application/json"}),body:JSON.stringify(Y)});if(!J.ok)console.warn("[cluster-sandbox-fs] tools/sync failed",J.status,await J.text().catch(()=>""))}catch(G){console.warn("[cluster-sandbox-fs] tools/sync failed",G)}}async function Ox($,Z){let{provider:X,kind:Q}=await uX($,{userId:Z.userId,branch:Z.branch,virtualMcpMetadata:null}),G=null,Y=()=>{if(!G){if(G=wx({virtualMcpId:Z.virtualMcpId,branch:Z.branch,sandboxProviderKind:Q},$).then((K)=>K.sandboxHandle),G.catch(()=>{G=null}),Z.syncTools)G.then((K)=>cZ4($,X,K,{virtualMcpId:Z.virtualMcpId,providerKind:Q})).catch(()=>{})}return G},J=Z.branch==="ephemeral"||Q==="user-desktop";return Kc0(X,{ensureHandle:Y,invalidateHandle:async(K)=>{let H=G;if(G=null,!J&&!K?.force)return;try{await Tw($.storage.virtualMcps,Z.virtualMcpId,Z.userId,Z.userId,Z.branch,Q)}catch(N){console.warn("[cluster-sandbox-fs] failed to reap vmMap entry",N)}if(H&&typeof X.forgetHandle==="function")try{let N=await H;await X.forgetHandle(N)}catch(N){console.warn("[cluster-sandbox-fs] forgetHandle failed",N)}},canAutoRestart:J,threadId:Z.threadId})}async function fZ$($,Z){try{let X=await Ox($,Z),{stdout:Q}=await X.onBash("test -d .deco && echo __DECO_SITE__");return Q.includes("__DECO_SITE__")}catch(X){return console.warn("[cluster-sandbox-fs] .deco probe failed; assuming deco site",X),!0}}var JU0=B(()=>{GN();yd0();gw();xi();qQ()});import{z as xZ$}from"zod";function Bx($){let Z=[];for(let X of $){if(X.status!=="active")continue;let Q=M9(X);if(!Q)continue;Z.push({connectionId:X.id,owner:Q.owner,repo:Q.repo,installationId:Q.installationId})}return Z}async function dZ4($,Z){let{items:X}=await $.storage.connections.list(Z,{slug:"mcp-github"});return Bx(X)}function mZ4($){let Z=$.split(`
+`))>=0){let K=Q.slice(0,W).trim();if(Q=Q.slice(W+1),!K)continue;yield JSON.parse(K)}}let G=Q.trim();if(G)yield JSON.parse(G)}finally{Z.releaseLock()}}var O9$,Kd0,E9$="gateway.networking.k8s.io",j9$="v1",z9$="httproutes",O94,qi,A9$="mesh-sandbox-runner";var Mi=B(()=>{E6();Ri();O9$=class O9$ extends Error{status;body;constructor($,Z,X){super(X);this.status=$;this.body=Z;this.name="KubeHttpError"}};Kd0=`/apis/${U9.CLAIM_API_GROUP}/${U9.CLAIM_API_VERSION}/namespaces`;O94=`/apis/${E9$}/${j9$}/namespaces`;qi={API_GROUP:E9$,API_VERSION:j9$,PLURAL:z9$}});function D94($){return($.items??[]).some((Z)=>{if(Z.status?.phase!=="Pending")return!1;return(Z.status?.conditions??[]).some((X)=>X.type==="PodScheduled"&&X.status==="False"&&X.reason==="Unschedulable")})}function I9$($,Z){let X=0,Q=!0,G=null,Y=async()=>{try{let J=await B3($,{method:"GET",path:`/api/v1/namespaces/${encodeURIComponent(Z)}/pods?fieldSelector=status.phase%3DPending`});if(!J.ok)return R9$;let W=await J.json();return!D94(W)}catch{return R9$}};return async()=>{if(Date.now()-X<B94)return Q;return G??=Y().finally(()=>{G=null}),Q=await G,X=Date.now(),Q}}var B94=3000,R9$=!0;var q9$=B(()=>{Mi()});var Ud0=B(()=>{E6();Yc0()});async function nF0($){try{let Z=await fetch(`${$}/health`,{signal:AbortSignal.timeout(L94)});if(!Z.ok)return null;let X=await Z.json();if(typeof X==="object"&&X!==null&&typeof X.bootId==="string"&&typeof X.ready==="boolean"&&X.setup&&typeof X.setup.running==="boolean"&&typeof X.setup.done==="boolean")return X;return null}catch{return null}}async function Od0($){for(let Z=0;Z<M9$;Z++){if(await nF0($)!==null)return;let X=(Math.random()*2-1)*E94;await y$(k9$+X)}throw Error(`sandbox daemon at ${$} did not respond on /health within ${M9$*k9$/1000}s`)}async function GV($,Z,X,Q,G){return j94($,Z,"POST",X,Q,G)}async function j94($,Z,X,Q,G,Y){let J={...Q};if(G&&G.rotateToken!==void 0)J.auth=G;let W=await fetch(`${$}/_sandbox/config`,{method:X,headers:{"Content-Type":"application/json",Authorization:`Bearer ${Z}`},body:JSON.stringify(J),signal:AbortSignal.timeout(Y?.timeoutMs??wd0)}),K=await W.text();if(!W.ok)throw new iF0(W.status,K);return JSON.parse(K)}async function S9$($,Z,X){let Q=await fetch(`${$}/_sandbox/setup/${X}`,{method:"POST",headers:{Authorization:`Bearer ${Z}`},signal:AbortSignal.timeout(wd0)});if(!Q.ok)throw Error(`sandbox daemon /_sandbox/setup/${X} returned ${Q.status}: ${await Q.text()}`)}async function V9$($,Z,X){let Q=await fetch(`${$}/_sandbox/orgfs-config`,{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${Z}`},body:X,signal:AbortSignal.timeout(wd0)}),G=await Q.text();if(!Q.ok)throw Error(`sandbox daemon /_sandbox/orgfs-config returned ${Q.status}: ${G}`);return JSON.parse(G)}async function ki($,Z,X,Q){let G=new Headers(Q.headers);for(let W of z94)G.delete(W);G.set("authorization",`Bearer ${Z}`);let Y=Q.method!=="GET"&&Q.method!=="HEAD",J=`${$}${X.startsWith("/")?X:`/${X}`}`;return fetch(J,{method:Q.method,headers:G,body:Y?Q.body:void 0,redirect:"manual",signal:Q.signal,duplex:Y?"half":void 0})}var iF0,L94=500,wd0=30000,M9$=25,k9$=200,E94=50,z94;var C9$=B(()=>{Ud0();iF0=class iF0 extends Error{status;constructor($,Z){super(`sandbox daemon /_sandbox/config returned ${$}: ${Z}`);this.status=$;this.name="ConfigRequestError"}};z94=["cookie","host","connection","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","accept-encoding","content-length"]});async function*b9$($){let Z=$.now??(()=>Date.now()),X=Z(),Q=$.schedulingTimeoutMs??T94,G={pod:{},sandbox:{},events:{hasPulling:!1,hasPulled:!1},startedAt:X},Y=[],J=null,W=!1,K=(j)=>{if(W)return;if(J){let z=J;J=null,z(j)}else Y.push(j)},H=()=>{if(Y.length>0)return Promise.resolve(Y.shift());if(W)return Promise.resolve(null);return new Promise((j)=>{J=j})},N=()=>{if(W)return;if(W=!0,J){let j=J;J=null,j(null)}},F=new AbortController,U=()=>{F.abort(),N()};if($.signal)if($.signal.aborted)F.abort(),N();else $.signal.addEventListener("abort",U,{once:!0});let w=Math.max(0,Q-(Z()-X)),O=setTimeout(()=>K("tick"),w+100),D,L=new Promise((j)=>{D=j}),E=Promise.allSettled([R94($.kc,$.namespace,$.claimName,F.signal,G,K,Z,D),q94($.kc,$.namespace,$.claimName,F.signal,G,K),M94($.kc,$.namespace,$.claimName,L,F.signal,G,K,Z)]);try{let j=null,z=-1,A=_9$(G,Q,Z);if(j=Dd0(A),!Bd0(A))z=v9$(A);if(yield A,Bd0(A))return;while(!W){if(await H()===null)break;let M=_9$(G,Q,Z);if(Bd0(M)){let _=Dd0(M);if(_!==j)j=_,yield M;return}let k=v9$(M);if(k<z)continue;let q=Dd0(M);if(q!==j)j=q,z=k,yield M}}finally{if(clearTimeout(O),F.abort(),$.signal)$.signal.removeEventListener("abort",U);N(),await E.catch(()=>{})}}function _9$($,Z,X){let{pod:Q,sandbox:G,events:Y,startedAt:J}=$;if(G.ready)return{kind:"ready"};let W=Q.containerWaitingReason;if(W==="ImagePullBackOff"||W==="ErrImagePull")return{kind:"failed",reason:"image-pull-backoff",message:"Sandbox image failed to download. The cluster may be missing pull credentials or the image tag may not exist."};if(W==="CrashLoopBackOff")return{kind:"failed",reason:"crash-loop-backoff",message:"Sandbox crashed during startup and is now in CrashLoopBackOff. Check pod logs."};if(!Q.scheduled&&Y.lastFailedSchedulingAt!==void 0&&X()-J>Z)return{kind:"failed",reason:"scheduling-timeout",message:Y.failedSchedulingMessage??`Pod could not be scheduled within ${Math.round(Z/1000)}s.`};if(Q.containerRunning&&!Q.containerReady)return{kind:"warming-daemon",since:J};if(Y.hasPulling&&!Y.hasPulled)return{kind:"pulling-image",since:J};if(W==="ContainerCreating"||W==="PodInitializing"||Q.scheduled&&!Q.containerRunning)return{kind:"starting-container",since:J};if(Q.scheduledFalseReason==="Unschedulable"||Y.lastFailedSchedulingAt!==void 0&&!Q.scheduled)return{kind:"waiting-for-capacity",since:J,message:Y.failedSchedulingMessage??Q.scheduledFalseMessage,nodeClaim:Y.nominatedNodeClaim};return{kind:"claiming",since:J}}function Bd0($){return $.kind==="ready"||$.kind==="failed"}function v9$($){switch($.kind){case"claiming":return 0;case"waiting-for-capacity":return 1;case"pulling-image":return 2;case"starting-container":return 3;case"warming-daemon":return 4;case"ready":case"failed":return 99}}function Dd0($){switch($.kind){case"claiming":case"pulling-image":case"starting-container":case"warming-daemon":return $.kind;case"waiting-for-capacity":return`waiting-for-capacity:${$.message??""}:${$.nodeClaim??""}`;case"ready":return"ready";case"failed":return`failed:${$.reason}:${$.message}`}}async function R94($,Z,X,Q,G,Y,J,W){let K=`/api/v1/namespaces/${encodeURIComponent(Z)}/pods?watch=true&labelSelector=${encodeURIComponent(`${P94}=${X}`)}`;return pF0({kc:$,path:K,signal:Q,label:`pod/${X}`,onEvent:(H)=>{if(H.type!=="ADDED"&&H.type!=="MODIFIED")return;let N=H.object;if(N.metadata?.name)W(N.metadata.name);I94(N,G,J),Y("pod")}})}function I94($,Z,X){let G=($.status?.conditions??[]).find((J)=>J.type==="PodScheduled");if(G?.status==="True")Z.pod.scheduled=!0,Z.pod.scheduledFalseReason=void 0,Z.pod.scheduledFalseMessage=void 0;else if(G?.status==="False")Z.pod.scheduled=!1,Z.pod.scheduledFalseReason=G.reason,Z.pod.scheduledFalseMessage=G.message;let Y=($.status?.containerStatuses??[]).find((J)=>J.name===A94);if(Y)Z.pod.containerWaitingReason=Y.state?.waiting?.reason,Z.pod.containerRunning=!!Y.state?.running,Z.pod.containerReady=Y.ready===!0}async function q94($,Z,X,Q,G,Y){let J=`/apis/${U9.CLAIM_API_GROUP}/${U9.CLAIM_API_VERSION}/namespaces/${encodeURIComponent(Z)}/${U9.CLAIM_PLURAL}?watch=true&fieldSelector=${encodeURIComponent(`metadata.name=${X}`)}`;return pF0({kc:$,path:J,signal:Q,label:`sandboxclaim/${X}`,onEvent:(W)=>{if(W.type!=="ADDED"&&W.type!=="MODIFIED")return;let H=W.object.status?.conditions?.find((N)=>N.type==="Ready");if(!H)return;if(H.status==="True")G.sandbox.ready=!0,G.sandbox.notReadyReason=void 0,G.sandbox.notReadyMessage=void 0;else G.sandbox.ready=!1,G.sandbox.notReadyReason=H.reason,G.sandbox.notReadyMessage=H.message;Y("sandbox")}})}async function M94($,Z,X,Q,G,Y,J,W){let K=await Promise.race([Q,new Promise((N)=>{if(G.aborted){N(X);return}G.addEventListener("abort",()=>N(X),{once:!0})})]);if(G.aborted)return;let H=`/api/v1/namespaces/${encodeURIComponent(Z)}/events?watch=true&fieldSelector=${encodeURIComponent(`involvedObject.name=${K},involvedObject.kind=Pod`)}`;return pF0({kc:$,path:H,signal:G,label:`events/${X}`,onEvent:(N)=>{if(N.type!=="ADDED"&&N.type!=="MODIFIED")return;let F=N.object,U=F.reason;if(!U)return;switch(U){case"Pulling":Y.events.hasPulling=!0;break;case"Pulled":Y.events.hasPulling=!0,Y.events.hasPulled=!0;break;case"FailedScheduling":Y.events.lastFailedSchedulingAt=W(),Y.events.failedSchedulingMessage=F.message;break;case"Nominated":{let w=F.message?.match(/nodeclaim\/([\w-]+)/);if(w)Y.events.nominatedNodeClaim=w[1];break}default:return}J("event")}})}async function f9$($){let{kc:Z,namespace:X,labelSelector:Q,signal:G,onDelete:Y}=$,J=`/apis/${U9.CLAIM_API_GROUP}/${U9.CLAIM_API_VERSION}/namespaces/${encodeURIComponent(X)}/${U9.CLAIM_PLURAL}?watch=true&labelSelector=${encodeURIComponent(Q)}`;return pF0({kc:Z,path:J,signal:G,label:"sandboxclaim-reaper",onEvent:(W)=>{if(W.type!=="DELETED")return;let K=W.object.metadata?.name;if(K)Y(K)}})}async function pF0($){let{kc:Z,path:X,signal:Q,label:G,onEvent:Y}=$,J=0;while(!Q.aborted){try{let K=await B3(Z,{method:"GET",path:X,signal:Q,headers:{accept:"application/json"},stream:!0});if(!K.ok||!K.body){try{await K.body?.cancel()}catch{}if(K.status===401||K.status===403){console.warn(`[lifecycle-watcher] ${G} stopped: watch denied (${K.status} ${K.statusText}). `+"The kubeconfig in use cannot watch SandboxClaims \u2014 if you are running locally, "+"this provider should not be active (check STUDIO_SANDBOX_PROVIDER / your sandbox preference).");return}throw Error(`watch handshake failed: ${K.status} ${K.statusText}`)}J=0;for await(let H of Fd0(K.body)){if(Q.aborted)return;try{Y(H)}catch(N){console.warn(`[lifecycle-watcher] ${G} onEvent threw: ${N instanceof Error?N.message:String(N)}`)}}}catch(K){if(Q.aborted)return;let H=K instanceof Error?K.message:String(K);console.warn(`[lifecycle-watcher] ${G} watch ended: ${H}`)}if(Q.aborted)return;let W=HX(5000,250,J,2,0);J+=1,await y$(W,{signal:Q}).catch(()=>{})}}var P94="studio.decocms.com/sandbox-handle",A94="sandbox",T94=300000;var x9$=B(()=>{E6();Ri();Mi()});import{z as SY}from"zod";function y9$($){if(!$||$.trim()==="")return[];let Z=SY.array(k94).parse(JSON.parse($)),X=new Set;for(let Q of Z){if(X.has(Q.name))throw Error(`STUDIO_SANDBOX_TENANT_POOLS: duplicate pool name ${Q.name}`);X.add(Q.name)}return Z}function S94($){try{let[Z,X]=new URL($).pathname.replace(/^\/+/,"").split("/"),Q=X?.replace(/\.git$/,"");return Z&&Q?`${Z}/${Q}`.toLowerCase():null}catch{return null}}function g9$($,Z){let{orgId:X,cloneUrl:Q}=Z;if(Z.cloneOnly===!0)return null;if(!X||!Q)return null;let G=S94(Q);if(!G)return null;return $.find((Y)=>Y.orgId===X&&Y.repo.toLowerCase()===G)??null}function h9$($,Z,X){return $?.name??(Z?X:"none")}function u9$($,Z,X){let Q=X.replace(/^refs\/heads\//,"");return $.filter((G)=>G.repo.toLowerCase()===Z.toLowerCase()&&G.branch===Q)}function c9$($){return`https://github.com/${$.repo}.git`}var k94;var Ld0=B(()=>{k94=SY.object({name:SY.string().regex(/^[a-z0-9]([-a-z0-9]*[a-z0-9])?$/,"pool name must be a DNS label (lowercase alphanumeric and '-')"),orgId:SY.string().min(1),repo:SY.string().regex(/^[^/\s]+\/[^/\s]+$/,"repo must be `owner/name`"),connectionId:SY.string().min(1).optional(),branch:SY.string().min(1).default("main"),workload:SY.object({runtime:SY.enum(["node","bun","deno"]).default("node"),packageManager:SY.enum(["npm","pnpm","yarn","bun","deno"]).optional(),packageManagerPath:SY.string().optional(),devPort:SY.number().int().positive().optional()}).default({runtime:"node"})})});async function l9$($,Z,X){let Q=new Map;for(let G of $){let Y=Z(G);if(!Y)continue;let J=Q.get(Y);if(J)J.push(G);else Q.set(Y,[G])}await Promise.allSettled([...Q.values()].map(async(G)=>{for(let Y of G)await X(Y).catch(()=>{})}))}import{createHash as V94,randomBytes as C94,randomUUID as _94}from"crypto";import*as t9$ from"net";import{PassThrough as v94}from"stream";function b94($){if($ instanceof Error)return $.message;if($&&typeof $==="object"){let Z=$;if(Z.error instanceof Error)return Z.error.message;if(typeof Z.message==="string"&&Z.message)return Z.message}return String($)}class Td0{kind=_Q;records=new Map;inflight=new L50;stateStore;previewUrlPattern;kubeConfig;capacityProbe;portForward;namespace;sandboxTemplateName;envName;tokenGenerator;idleTtlMs;metrics;previewGateway;sentinelToken;mintCloneUrl;tenantPools;tenantPoolRefreshMs;poolPods=new Map;dirtyPools=new Set;closed=!1;claimWatchAbort=new AbortController;constructor($={}){this.stateStore=$.stateStore??null,this.previewUrlPattern=$.previewUrlPattern??null,this.kubeConfig=$.kubeConfig??p94(),this.portForward=new dl0(this.kubeConfig),this.namespace=$.namespace??f94,this.sandboxTemplateName=$.sandboxTemplateName??x94,this.envName=e94($.envName),this.tokenGenerator=$.tokenGenerator??(()=>C94(y94).toString("hex")),this.idleTtlMs=$.idleTtlMs??h94,this.metrics=$.meter?n94($.meter):null,this.previewGateway=$.previewGateway&&$.previewUrlPattern?{...$.previewGateway}:null;let Z=$.sentinelToken?.trim()??"";if(this.sentinelToken=Z.length>0?Z:null,this.mintCloneUrl=$.mintCloneUrl,this.tenantPools=this.sentinelToken!==null?$.tenantPools??[]:[],this.sentinelToken===null&&($.tenantPools?.length??0)>0)console.warn(`[${y6}] tenant pools configured without a sentinel token \u2014 ignoring them (warm-pool mode is off)`);this.tenantPoolRefreshMs=$.tenantPoolRefreshMs??c94,this.startClaimReaper(),this.startCredentialRefresher(),this.startTenantPoolReconciler()}startClaimReaper(){let $=["app.kubernetes.io/managed-by=studio","app.kubernetes.io/name=studio-sandbox",...this.envName?[`${vQ.env}=${this.envName}`]:[]].join(",");f9$({kc:this.kubeConfig,namespace:this.namespace,labelSelector:$,signal:this.claimWatchAbort.signal,onDelete:(Z)=>this.invalidateRecord(Z)})}async ensure($,Z={}){let X=SL($);if(X.startsWith("s-"))throw Error(`ensure: projectRef has no slug source: ${$.projectRef}`);return this.inflight.run(X,()=>E50(this.stateStore,$,_Q,(Q)=>this.ensureLocked($,X,Z,Q)))}async delete($){let Z=await this.getRecord($);if(this.records.delete($),Z)this.closeForwarder(Z.daemonForward),this.metrics?.active.add(-1,Pd0(Z.tenant));if(await this.deleteHttpRouteIfManaged($).catch((X)=>{console.warn(`[${y6}] HTTPRoute delete failed for ${$}: ${X instanceof Error?X.message:String(X)}`)}),await xw(this.kubeConfig,this.namespace,$),this.stateStore)if(Z)await this.stateStore.delete(Z.id,_Q);else await this.stateStore.deleteByHandle(_Q,$)}async alive($){return await D3(this.kubeConfig,this.namespace,$)!==void 0}watchClaimLifecycle($,Z){return b9$({kc:this.kubeConfig,namespace:this.namespace,claimName:$,signal:Z})}hasSchedulableCapacity(){return this.capacityProbe??=I9$(this.kubeConfig,this.namespace),this.capacityProbe()}async getPreviewUrl($){let Z=await this.getRecord($);if(!Z)return null;return this.composePreviewUrl(Z)}async proxyDaemonRequest($,Z,X){let Q=await this.getRecord($);if(!Q&&this.previewUrlPattern&&this.stateStore){let K=await this.stateStore.getByHandle(_Q,$),H=K?.state,N=H?.token;if(K&&N){let U=`http://${H?.adoptedSandboxName??$}.${this.namespace}.svc.cluster.local:${UN}`;try{let w=await ki(U,N,Z,X);if(w.status!==404)return w;try{await w.body?.cancel()}catch{}}catch{}}}if(!Q)Q=await this.resurrectByHandle($);if(!Q)return new Response(JSON.stringify({error:"sandbox not found"}),{status:404,headers:{"content-type":"application/json"}});let G=Q,Y=performance.now(),J=0,W=!(X.body instanceof ReadableStream);try{let K=await ki(Q.daemonUrl,Q.token,Z,X);if(K.status===401&&W){this.invalidateRecord($);let H=await this.getRecord($).catch(()=>null)??await this.resurrectByHandle($).catch(()=>null);if(H)G=H,K=await ki(H.daemonUrl,H.token,Z,X)}return J=K.status,K}catch(K){if(!W)throw K;this.invalidateRecord($);let H=await this.resurrectByHandle($)??await this.getRecord($).catch(()=>null);if(!H)throw K;G=H;let N=await ki(H.daemonUrl,H.token,Z,X);return J=N.status,N}finally{this.recordProxyDuration("daemon",J,G,performance.now()-Y)}}async adoptLiveClaim($,Z){if(this.records.has(Z))return!0;let X=await D3(this.kubeConfig,this.namespace,Z).catch(()=>{return});if(!X||X.metadata?.deletionTimestamp)return!1;return await this.inflight.run(Z,async()=>{let G=this.records.get(Z);if(G)return this.toSandbox(G);let Y=await this.adopt($,Z,X);if(!Y)throw Error(`cannot adopt live claim ${Z}`);return E50(this.stateStore,$,_Q,(J)=>this.finish(Y,J,!0,!0,"adopt"))}).catch(()=>null)!=null}async resolvePreviewUpstreamUrl($){if(this.previewUrlPattern)return`http://${await this.resolveServiceNameForHandle($)}.${this.namespace}.svc.cluster.local:${UN}`;let Z=await this.getRecord($);if(Z)return Z.daemonUrl;let X=await this.resurrectByHandle($);return X?X.daemonUrl:null}async resolveServiceNameForHandle($){let Z=this.records.get($);if(Z)return Z.adoptedSandboxName;if(this.stateStore){let Q=(await this.stateStore.getByHandle(_Q,$).catch(()=>null))?.state?.adoptedSandboxName;if(Q)return Q}return $}async proxyPreviewRequest($,Z){let X=performance.now(),Q=this.records.get($)??null,G=0;try{let Y=await this.resolvePreviewUpstreamUrl($);if(!Y){G=404;let O=jd0(404,{error:"sandbox not found"});return O.headers.set(JV,"1"),O}let J=new URL(Z.url);if((J.pathname==="/_sandbox"||J.pathname.startsWith("/_sandbox/")||J.pathname==="/_decopilot_vm"||J.pathname.startsWith("/_decopilot_vm/"))&&Z.method!=="GET")return G=404,jd0(404,{error:"not found"});let K=(O)=>`${O}${J.pathname}${J.search}`,H=new Headers(Z.headers);for(let O of m94)H.delete(O);let N=Z.method!=="GET"&&Z.method!=="HEAD",F={method:Z.method,headers:H,body:N?Z.body:void 0,redirect:"manual",signal:Z.signal,duplex:N?"half":void 0},U;try{U=await fetch(K(Y),F)}catch(O){let D=`${Y}${J.pathname}`;if(console.warn(`[${y6}] preview fetch to ${D} failed: ${O instanceof Error?O.message:String(O)}`),Z.method==="GET"||Z.method==="HEAD"){if(this.invalidateRecord($),await this.resurrectByHandle($).catch(()=>null)){let j=await this.resolvePreviewUpstreamUrl($);if(j)try{U=await fetch(K(j),F);let z=new Headers;for(let[A,P]of U.headers.entries())if(!i9$.includes(A.toLowerCase()))z.set(A,P);return G=U.status,new Response(U.body,{status:U.status,statusText:U.statusText,headers:z})}catch(z){console.warn(`[${y6}] preview fetch retry to ${D} failed: ${z instanceof Error?z.message:String(z)}`)}}}else this.invalidateRecord($);G=502;let L=jd0(502,{error:"sandbox daemon unreachable"});return L.headers.set(JV,"1"),L}let w=new Headers;for(let[O,D]of U.headers.entries())if(!i9$.includes(O.toLowerCase()))w.set(O,D);return G=U.status,new Response(U.body,{status:U.status,statusText:U.statusText,headers:w})}finally{this.recordProxyDuration("preview",G,Q,performance.now()-X,$)}}async ensureLocked($,Z,X,Q){if(X.image)console.warn(`[${y6}] opts.image ignored (template ${this.sandboxTemplateName} pins image): got ${X.image}`);if(Q){let J=await Q.get($,_Q);if(J){let W=await this.rehydrate($,Z,J);if(W)return await this.refreshDaemonGitCredential(W,X),this.finish(W,Q,!1,!0,"resume");await Q.delete($,_Q)}}let G=await D3(this.kubeConfig,this.namespace,Z).catch(()=>{return});if(G)if(G.metadata?.deletionTimestamp)await uF0(this.kubeConfig,this.namespace,Z).catch((J)=>{console.warn(`[${y6}] wait for terminating claim ${Z} failed: ${J instanceof Error?J.message:String(J)}`)});else{let J=await this.adopt($,Z,G).catch((W)=>{return console.warn(`[${y6}] adopt ${Z} failed, recreating: ${W instanceof Error?W.message:String(W)}`),null});if(J)return await this.refreshDaemonGitCredential(J,X),this.finish(J,Q,!0,!0,"adopt");await xw(this.kubeConfig,this.namespace,Z).catch(()=>{}),await uF0(this.kubeConfig,this.namespace,Z).catch((W)=>{console.warn(`[${y6}] wait for deleted claim ${Z} failed: ${W instanceof Error?W.message:String(W)}`)})}let Y=await this.provision($,Z,X);return this.finish(Y,Q,!0,!1,"fresh")}async finish($,Z,X,Q,G){let Y=this.records.get($.handle),J=Y!==void 0;if(Y&&Y.daemonForward!==$.daemonForward)this.closeForwarder(Y.daemonForward);if(this.records.set($.handle,$),X)await this.persist(Z,$);if(Q)await cF0(this.kubeConfig,this.namespace,$.handle,this.computeShutdownTime()).catch((W)=>console.warn(`[${y6}] TTL refresh failed for ${$.handle}: ${W instanceof Error?W.message:String(W)}`));if(this.metrics){let W=Pd0($.tenant);if(this.metrics.ensureOutcome.add(1,{...W,outcome:G}),!J)this.metrics.active.add(1,W)}return this.toSandbox($)}buildEnvMap($,Z){let X={},Q=[];for(let[G,Y]of Object.entries($.env??{}))if(g94.has(G))Q.push(G);else X[G]=Y;if(Q.length>0)console.warn(`[${y6}] opts.env keys overlap reserved bootstrap names and were dropped: ${Q.join(",")}`);return{...X,DAEMON_TOKEN:Z.token,DAEMON_BOOT_ID:Z.daemonBootId,APP_ROOT:Z.workdir,PROXY_PORT:String(UN)}}buildClaim($,Z,X){let Q=this.sentinelToken!==null,G=g9$(this.tenantPools,{orgId:Z.tenant?.orgId,cloneUrl:Z.repo?.cloneUrl,cloneOnly:Z.cloneOnly}),Y=Q?[]:Object.entries(this.buildEnvMap(Z,X)).sort(([K],[H])=>K<H?-1:K>H?1:0).map(([K,H])=>({name:K,value:H})),J=XZ4(Z),W=Object.keys(J).length>0;return{apiVersion:`${U9.CLAIM_API_GROUP}/${U9.CLAIM_API_VERSION}`,kind:"SandboxClaim",metadata:{name:$,namespace:this.namespace,labels:{"app.kubernetes.io/name":"studio-sandbox","app.kubernetes.io/managed-by":"studio",...this.envName?{[vQ.env]:this.envName}:{},...zd0(Z.tenant)},...W?{annotations:J}:{}},spec:{sandboxTemplateRef:{name:this.sandboxTemplateName},additionalPodMetadata:{labels:zd0(Z.tenant,{[vQ.role]:"claimed",[vQ.sandboxHandle]:$,...this.envName?{[vQ.env]:this.envName}:{}}),...W?{annotations:J}:{}},env:Y,warmpool:h9$(G,Q,this.sandboxTemplateName),lifecycle:{shutdownPolicy:"Delete",shutdownTime:this.computeShutdownTime()}}}}async provision($,Z,X){let Q=this.tokenGenerator(),G=_94(),Y=Ed0,J=this.buildClaim(Z,X,{token:Q,daemonBootId:G,workdir:Y});try{await Ii(this.kubeConfig,this.namespace,J)}catch(U){if(U instanceof Ti)await uF0(this.kubeConfig,this.namespace,Z),await Ii(this.kubeConfig,this.namespace,J);else throw U}let W;try{W=await B9$(this.kubeConfig,this.namespace,Z),await mF0(this.kubeConfig,this.namespace,W)}catch(U){throw await xw(this.kubeConfig,this.namespace,Z).catch(()=>{}),U}try{await this.ensureServicePortForAdoptedSandbox(W),await this.ensureHttpRouteForHandle(Z,W,X.tenant??null)}catch(U){throw await xw(this.kubeConfig,this.namespace,Z).catch(()=>{}),U}let K=await this.openForwarder(W,UN,Z),H=`http://127.0.0.1:${K.localPort}`,N=this.workloadConfigPayload(X),F=G;try{if(await Od0(H),this.sentinelToken!==null){let U=await nF0(H);if(U)F=U.bootId;await GV(H,this.sentinelToken,N??{},{rotateToken:Q})}else if(N)await GV(H,Q,N);await this.relayOrgFsConfig(H,Q,X.orgFsConfigJson)}catch(U){throw this.closeForwarder(K),await this.deleteHttpRouteIfManaged(Z).catch(()=>{}),await xw(this.kubeConfig,this.namespace,Z).catch(()=>{}),U}return{id:$,handle:Z,adoptedSandboxName:W,token:Q,workdir:Y,daemonUrl:H,daemonForward:K,workload:X.workload??null,daemonBootId:F,tenant:X.tenant??null,ensureOpts:JZ4(X)}}workloadConfigPayload($){return z50({runtime:$?.workload?.runtime??"node",packageManager:$?.workload?.packageManager?{name:$.workload.packageManager,...$.workload.packageManagerPath?{path:$.workload.packageManagerPath}:{}}:null,repo:$?.repo??null,port:$?.workload?.devPort??d9$,tenant:$?.tenant??void 0,...$?{cloneOnly:$.cloneOnly===!0}:{}})}async relayOrgFsConfig($,Z,X){if(!X)return;await V9$($,Z,X).catch((Q)=>console.warn("[org-fs] sidecar config relay failed",Q))}async refreshDaemonGitCredential($,Z){let X=Jc0(Z);if(!X)return;try{await GV($.daemonUrl,$.token,X)}catch(Q){console.warn(`[${y6}] git credential refresh failed for ${$.handle}: ${Q instanceof Error?Q.message:String(Q)}`)}}async withFreshCloneUrl($,Z){if(!this.mintCloneUrl)return $;try{let X=await this.mintCloneUrl($,Z!==void 0?{bufferMs:Z}:void 0);return X?{...$,cloneUrl:X}:$}catch(X){return console.warn(`[${y6}] clone credential re-mint failed: ${X instanceof Error?X.message:String(X)}`),$}}startCredentialRefresher(){if(!this.mintCloneUrl)return;let{signal:$}=this.claimWatchAbort;(async()=>{while(!$.aborted){if(await y$(l94,{signal:$}).catch(()=>{}),$.aborted)break;try{await this.refreshAllGitCredentials()}catch(Z){console.warn(`[${y6}] periodic credential refresh failed: ${Z instanceof Error?Z.message:String(Z)}`)}}})()}startTenantPoolReconciler(){if(this.tenantPools.length===0)return;let{signal:$}=this.claimWatchAbort;(async()=>{while(!$.aborted){try{await this.reconcileTenantPools()}catch(Z){console.warn(`[${y6}] tenant pool reconcile failed: ${Z instanceof Error?Z.message:String(Z)}`)}await y$(u94,{signal:$}).catch(()=>{})}})()}markTenantPoolsDirty($,Z){let X=u9$(this.tenantPools,$,Z);for(let Q of X)this.dirtyPools.add(Q.name);return X.map((Q)=>Q.name)}async reconcileTenantPools(){for(let $ of this.tenantPools){let Z=await D9$(this.kubeConfig,this.namespace,$.name);if(Z===null){console.warn(`[${y6}] tenant pool ${$.name}: no SandboxWarmPool (or no selector yet) in ${this.namespace}`);continue}let X=this.dirtyPools.delete($.name),Q=Z.filter((G)=>!G.labels[vQ.sandboxHandle]);for(let[G]of this.poolPods)if(!Z.some((Y)=>Y.uid===G))this.poolPods.delete(G);for(let G of Q){if(this.claimWatchAbort.signal.aborted)return;await this.warmPoolPod($,G,X)}this.recordPoolDepth($,Z,Q)}}recordPoolDepth($,Z,X){let Q=this.metrics?.poolPods;if(!Q)return;let G=0,Y=0;for(let W of X){let K=this.poolPods.get(W.uid);if(!K)continue;if(K.failures>=tF0)Y++;else if(K.lastConfigAt>0)G++}let J={pool:$.name,org:$.orgId};Q.record(G,{...J,state:"ready"}),Q.record(Z.length-X.length,{...J,state:"bound"}),Q.record(X.length-G-Y,{...J,state:"pending"}),Q.record(Y,{...J,state:"failed"})}async warmPoolPod($,Z,X){let Q=this.poolPods.get(Z.uid);if(Q&&Q.failures>=tF0){if(Date.now()-Q.lastFailureAt<m9$)return;this.poolPods.set(Z.uid,{...Q,failures:0})}let G=X||Q!==void 0&&Date.now()-Q.lastConfigAt>=this.tenantPoolRefreshMs;if(Q&&!G)return;let Y={cloneUrl:c9$($),connectionId:$.connectionId,branch:$.branch,userName:"",userEmail:""},J=await this.withFreshCloneUrl(Y);if($.connectionId&&J.cloneUrl===Y.cloneUrl){this.recordPoolFailure(Z,$,"clone credential mint failed");return}let W=await this.openForwarder(Z.name,UN,Z.name).catch(()=>null);if(!W){this.recordPoolFailure(Z,$,"port-forward failed");return}let K=`http://127.0.0.1:${W.localPort}`;try{await Od0(K);let H=this.sentinelToken;if(!H)return;if(!await this.isPoolPodUnbound(Z))return;let N=z50({runtime:$.workload.runtime,packageManager:$.workload.packageManager?{name:$.workload.packageManager,...$.workload.packageManagerPath?{path:$.workload.packageManagerPath}:{}}:null,repo:J,port:$.workload.devPort??d9$})??{},{transition:F}=await GV(K,H,N);if(G&&F!=="bootstrap"&&await this.isPoolPodUnbound(Z))await S9$(K,H,"clone");this.poolPods.set(Z.uid,{lastConfigAt:Date.now(),lastFailureAt:0,failures:0}),console.log(`[${y6}] tenant pool ${$.name}: warmed ${Z.name} (${F})`)}catch(H){this.recordPoolFailure(Z,$,H instanceof Error?H.message:String(H))}finally{this.closeForwarder(W)}}isPoolPodUnbound($){return L9$(this.kubeConfig,this.namespace,$.name,vQ.sandboxHandle)}recordPoolFailure($,Z,X){let Q=this.poolPods.get($.uid),G=(Q?.failures??0)+1;this.poolPods.set($.uid,{lastConfigAt:Q?.lastConfigAt??0,lastFailureAt:Date.now(),failures:G});let Y=G>=tF0?` \u2014 backing off ${m9$/60000}min`:"";console.warn(`[${y6}] tenant pool ${Z.name}: warming ${$.name} failed (${G}/${tF0})${Y}: ${X}`)}async refreshAllGitCredentials(){await l9$(this.records.values(),($)=>$.ensureOpts?.repo?.connectionId,async($)=>{if(this.claimWatchAbort.signal.aborted)return;let Z=$.ensureOpts?.repo;if(!Z)return;let X=await this.withFreshCloneUrl(Z,d94);await this.refreshDaemonGitCredential($,{...$.ensureOpts,repo:X}),$.ensureOpts={...$.ensureOpts,repo:X}})}async rebootstrapDaemon($,Z,X){if(this.sentinelToken===null)return!1;let Q=this.workloadConfigPayload(X)??{};try{return await GV($,this.sentinelToken,Q,{rotateToken:Z}),await this.relayOrgFsConfig($,Z,X?.orgFsConfigJson),!0}catch(G){if(G instanceof iF0&&G.status===401)try{return await GV($,Z,Q,{rotateToken:Z}),await this.relayOrgFsConfig($,Z,X?.orgFsConfigJson),!0}catch(Y){return console.warn(`[${y6}] re-bootstrap retry with claim token failed: ${Y instanceof Error?Y.message:String(Y)}`),!1}return console.warn(`[${y6}] re-bootstrap failed: ${G instanceof Error?G.message:String(G)}`),!1}}async ensureServicePortForAdoptedSandbox($){if(!this.previewGateway||!this.previewUrlPattern)return;await T9$(this.kubeConfig,this.namespace,$,{name:"daemon",port:UN,targetPort:UN})}async ensureHttpRouteForHandle($,Z,X){if(!this.previewGateway||!this.previewUrlPattern)return;let Q=WZ4(this.previewUrlPattern,$);if(!Q)throw new V9(`Unable to derive preview hostname for ${$} from pattern: ${this.previewUrlPattern}`);let G={apiVersion:`${qi.API_GROUP}/${qi.API_VERSION}`,kind:"HTTPRoute",metadata:{name:$,namespace:this.namespace,labels:zd0(X??void 0,{[vQ.role]:"claimed",[vQ.sandboxHandle]:$,"app.kubernetes.io/name":"studio-sandbox","app.kubernetes.io/managed-by":"studio",...this.envName?{[vQ.env]:this.envName}:{}})},spec:{parentRefs:[{kind:"Gateway",group:"gateway.networking.k8s.io",name:this.previewGateway.name,namespace:this.previewGateway.namespace}],hostnames:[Q],rules:[{backendRefs:[{group:"",kind:"Service",name:Z,port:UN}]}]}};await lF0(this.kubeConfig,this.namespace,G)}async deleteHttpRouteIfManaged($){if(!this.previewGateway)return;await dF0(this.kubeConfig,this.namespace,$)}async rehydrate($,Z,X){let Q=X.state;if(!Q.adoptedSandboxName&&!Q.podName||!Q.token)return null;let G=await D3(this.kubeConfig,this.namespace,Z).catch(()=>{return});if(!G||!n9$(G))return null;let Y=G.status?.sandbox?.name??Q.adoptedSandboxName??Q.podName??Z,J=await this.openAndProbeDaemon(Y,Z);if(!J)return null;if(Q.daemonBootId&&Q.daemonBootId!==J.bootId){if(this.sentinelToken!==null){let W=Q.ensureOpts?.repo?{...Q.ensureOpts,repo:await this.withFreshCloneUrl(Q.ensureOpts.repo)}:Q.ensureOpts??null;if(!await this.rebootstrapDaemon(J.daemonUrl,Q.token,W))return this.closeForwarder(J.daemonForward),null}else console.warn(`[${y6}] daemon restart detected (handle=${Z}): stored bootId=${Q.daemonBootId} live bootId=${J.bootId}`);await this.stateStore?.put($,_Q,{handle:Z,state:{...Q,daemonBootId:J.bootId}}).catch((W)=>console.warn(`[${y6}] bootId persist failed for ${Z}: ${W instanceof Error?W.message:String(W)}`))}return{id:$,handle:Z,adoptedSandboxName:Y,token:Q.token,workdir:Q.workdir??Ed0,daemonUrl:J.daemonUrl,daemonForward:J.daemonForward,workload:Q.workload??null,daemonBootId:J.bootId,tenant:Q.tenant??null,ensureOpts:Q.ensureOpts??null}}async adopt($,Z,X){if(!n9$(X))return null;let Q=X.status?.sandbox?.name??Z;if(this.sentinelToken!==null)return null;let G=t94(X);if(!G)return null;let Y=await this.openAndProbeDaemon(Q,Z);if(!Y)return null;let J=QZ4(X);if(this.previewGateway)await this.ensureServicePortForAdoptedSandbox(Q).catch((W)=>{console.warn(`[${y6}] Service port backfill failed for ${Z}: ${W instanceof Error?W.message:String(W)}`)}),await this.ensureHttpRouteForHandle(Z,Q,J).catch((W)=>{console.warn(`[${y6}] HTTPRoute backfill failed for ${Z}: ${W instanceof Error?W.message:String(W)}`)});return{id:$,handle:Z,adoptedSandboxName:Q,token:G,workdir:Ed0,daemonUrl:Y.daemonUrl,daemonForward:Y.daemonForward,workload:null,daemonBootId:Y.bootId,tenant:J,ensureOpts:null}}async openAndProbeDaemon($,Z){let X=await this.openForwarder($,UN,Z).catch(()=>null);if(!X)return null;let Q=`http://127.0.0.1:${X.localPort}`,G=await nF0(Q);if(!G)return this.closeForwarder(X),null;return{daemonForward:X,daemonUrl:Q,bootId:G.bootId}}async getRecord($){let Z=this.records.get($);if(Z)return Z;if(!this.stateStore)return null;let X=await this.stateStore.getByHandle(_Q,$);if(!X)return null;let Q=await this.rehydrate(X.id,$,X);if(Q)this.records.set($,Q);return Q}async resurrectByHandle($){if(!this.stateStore)return null;let Z=await this.stateStore.getByHandle(_Q,$);if(!Z)return null;let X=Z.state.ensureOpts;if(!X)return null;let Q=X.repo?{...X,repo:await this.withFreshCloneUrl(X.repo)}:X;if(SL(Z.id)!==$)return null;return await this.ensure(Z.id,Q),this.records.get($)??null}invalidateRecord($){let Z=this.records.get($);if(!Z)return;this.records.delete($),this.closeForwarder(Z.daemonForward)}recordProxyDuration($,Z,X,Q,G){if(!this.metrics)return;this.metrics.proxyDurationMs.record(Q,{...Pd0(X?.tenant??null),source:$,sandbox_handle:X?.handle??G??"",status_code:Z||0})}composePreviewUrl($){if(this.previewUrlPattern)return j50(this.previewUrlPattern,$.handle);return`http://127.0.0.1:${$.daemonForward.localPort}/`}toSandbox($){return{handle:$.handle,workdir:$.workdir,previewUrl:this.composePreviewUrl($)}}async persist($,Z){if(!$)return;let X={adoptedSandboxName:Z.adoptedSandboxName,token:Z.token,workdir:Z.workdir,workload:Z.workload,daemonBootId:Z.daemonBootId,tenant:Z.tenant,...Z.ensureOpts?{ensureOpts:Z.ensureOpts}:{}};await $.put(Z.id,_Q,{handle:Z.handle,state:X})}computeShutdownTime(){return new Date(Date.now()+this.idleTtlMs).toISOString()}async releaseAfter($,Z){let X=await D3(this.kubeConfig,this.namespace,$);if(!X)return;let Q=GZ4(X.spec?.lifecycle?.shutdownTime,new Date(Date.now()+Z));if(!Q)return;await cF0(this.kubeConfig,this.namespace,$,Q).catch((G)=>console.warn(`[${y6}] release failed for ${$}: ${G instanceof Error?G.message:String(G)}`))}async renewTtl($){let Z=await D3(this.kubeConfig,this.namespace,$);if(!Z)return;let X=YZ4(Z.spec?.lifecycle?.shutdownTime,new Date(Date.now()+this.idleTtlMs));if(!X)return;await cF0(this.kubeConfig,this.namespace,$,X).catch((Q)=>console.warn(`[${y6}] TTL renew failed for ${$}: ${Q instanceof Error?Q.message:String(Q)}`))}openForwarder($,Z,X=$){let Q=o94(X,Z);return new Promise((G,Y)=>{let J=(W,K)=>{let H=t9$.createServer((N)=>this.handleForwardedConnection(N,$,Z,X));H.once("error",(N)=>{if(N.code==="EADDRINUSE"&&K<i94){try{H.close()}catch{}let F=Ad0+(W-Ad0+1)%o9$;J(F,K+1);return}Y(N)}),H.listen(W,"127.0.0.1",()=>{let N=H.address();if(!N||typeof N==="string"){H.close(),Y(Error("port-forward listener failed to bind"));return}G({server:H,localPort:N.port})})};J(Q,0)})}handleForwardedConnection($,Z,X,Q){let G=new v94,Y=null,J=!1,W=()=>{if(J)return;if(J=!0,G.destroy(),Y)try{Y.close()}catch{}if(!$.destroyed)$.destroy()};$.pipe(G),$.on("error",W),$.on("close",W),this.portForward.portForward(this.namespace,Z,[X],$,null,G).then((K)=>{let H=typeof K==="function"?K():K;if(!H){W();return}if(Y=H,Y.on("close",W),Y.on("error",()=>{this.invalidateRecord(Q),W()}),J)try{Y.close()}catch{}}).catch((K)=>{console.warn(`[${y6}] port-forward to ${Z}:${X} failed: ${b94(K)}`,JSON.stringify(r9$(K))),this.invalidateRecord(Q),W()})}closeForwarder($){$.server.close((Z)=>{if(Z)console.warn(`[${y6}] port-forward close on :${$.localPort} errored: ${Z instanceof Error?Z.message:String(Z)}`)})}close(){if(this.closed)return;this.closed=!0,this.claimWatchAbort.abort();for(let $ of this.records.values())this.closeForwarder($.daemonForward);this.records.clear()}}function n94($){return{active:$.createUpDownCounter("studio.sandbox.active",{description:"Active sandbox count, by runner kind, owning org, and daemon impl. Cross-checks the cAdvisor-derived count from the cluster \u2014 divergence between the two indicates orphaned claims (studio deleted but K8s didn't reap) or unattributed pods.",unit:"{sandbox}"}),ensureOutcome:$.createCounter("studio.sandbox.ensure.outcome",{description:"Outcome of each ensure() call: fresh provision, resume from state-store after restart, or adopt of a cluster-side claim studio didn't know about. Cold-start ratio is the primary input for warm-pool sizing.",unit:"{call}"}),proxyDurationMs:$.createHistogram("studio.sandbox.proxy.duration_ms",{description:"Wall-clock latency of studio-mediated requests to the sandbox daemon: tool exec proxies (source=daemon) and preview iframe traffic (source=preview).",unit:"ms"}),poolPods:$.createGauge("studio.sandbox.pool.pods",{description:"Tenant warm pool depth by pool and state: ready (warmed and unbound \u2014 what a claim can actually bind instantly), bound (serving a user), pending (unbound, not yet warmed), failed (gave up after repeated bootstrap failures). Alert on sustained ready=0: a pool that is always empty is doing nothing while costing N pods.",unit:"{pod}"})}}function r9$($){let Z=[],X=$;for(let Q=0;Q<5&&X instanceof Error;Q++){let G=X;if(Z.push({name:G.name,message:G.message,...G.code!==void 0?{code:G.code}:{},...G.errno!==void 0?{errno:G.errno}:{}}),G.cause===X)break;X=G.cause}if(X!==void 0&&!(X instanceof Error)&&X!==null){let Q=X,G=Q.error instanceof Error?r9$(Q.error).chain:void 0;Z.push({nonError:String(X),...typeof Q.type==="string"?{type:Q.type}:{},...typeof Q.message==="string"?{message:Q.message}:{},...Q.code!==void 0?{code:Q.code}:{},...typeof Q.reason==="string"?{reason:Q.reason}:{},...G?{error:G}:{},...G===void 0&&Q.error!==void 0?{rawError:String(Q.error)}:{},keys:Object.keys(Q)})}return{chain:Z}}function p94(){let $=new Wx;return $.loadFromDefault(),$}function n9$($){return Boolean($.status?.conditions?.some((Z)=>Z.type==="Ready"&&Z.status==="True"))}function t94($){let Z=$.spec?.env;if(!Z)return null;for(let X of Z)if(X.name==="DAEMON_TOKEN"&&X.value)return X.value;return null}function o94($,Z){let X=V94("sha256").update(`${$}:${Z}`).digest();return Ad0+X.readUInt32BE(0)%o9$}function jd0($,Z){return new Response(JSON.stringify(Z),{status:$,headers:{"content-type":"application/json","access-control-allow-origin":"*"}})}function p9$($){let Z=$.slice(0,a94);return r94.test(Z)?Z:""}function e94($){if($===void 0)return null;let Z=$.trim();if(Z==="")return null;if(!s94.test(Z))throw Error(`AgentSandboxProvider: envName=${JSON.stringify(Z)} is not a valid DNS-label-safe environment name (lowercase alphanumeric or '-', starts with a letter, ends alphanumeric, \u226432 chars). Studio sets this from STUDIO_ENV; check the studio chart's configMap.`);return Z}function zd0($,Z={}){let X={...Z};if($){let Q=p9$($.orgId),G=p9$($.userId);if(Q)X[vQ.orgId]=Q;if(G)X[vQ.userId]=G}return X}function YV($){let Z="";for(let X of $){let Q=X.codePointAt(0)??0;Z+=Q<32||Q===127?" ":X}return Z.slice(0,$Z4)}function ZZ4($){try{let Z=new URL($);return Z.username="",Z.password="",Z.toString()}catch{return""}}function XZ4($){let Z={},X=$.tenant;if(X?.orgSlug)Z[L3.orgSlug]=YV(X.orgSlug);if(X?.orgName)Z[L3.orgName]=YV(X.orgName);if(X?.userEmail)Z[L3.userEmail]=YV(X.userEmail);if(X?.userName)Z[L3.userName]=YV(X.userName);let Q=$.repo;if(Q){if(Q.displayName)Z[L3.gitRepo]=YV(Q.displayName);let G=ZZ4(Q.cloneUrl);if(G)Z[L3.gitRepoUrl]=YV(G);let Y=$.branch??Q.branch;if(Y)Z[L3.gitBranch]=YV(Y)}return Z}function QZ4($){let Z=$.metadata?.labels;if(!Z)return null;let X=Z[vQ.orgId],Q=Z[vQ.userId];if(!X||!Q)return null;let G=$.metadata?.annotations??{};return{orgId:X,userId:Q,orgSlug:G[L3.orgSlug],orgName:G[L3.orgName],userEmail:G[L3.userEmail],userName:G[L3.userName]}}function GZ4($,Z){if($){let X=new Date($).getTime();if(Number.isFinite(X)&&X<=Z.getTime())return null}return Z.toISOString()}function YZ4($,Z){if($){let X=new Date($).getTime();if(Number.isFinite(X)&&X>=Z.getTime())return null}return Z.toISOString()}function Pd0($){return{org_id:$?.orgId??"",user_id:$?.userId??"",runner_kind:_Q}}function JZ4($){let Z={};if($.branch)Z.branch=$.branch;if($.repo)Z.repo=$.repo;if($.workload)Z.workload=$.workload;if($.env&&Object.keys($.env).length>0)Z.env=$.env;if($.tenant)Z.tenant=$.tenant;if($.orgFsConfigJson)Z.orgFsConfigJson=$.orgFsConfigJson;return Object.keys(Z).length>0?Z:null}function WZ4($,Z){try{return new URL(j50($,Z)).hostname||null}catch{return null}}var _Q="agent-sandbox",y6="AgentSandboxProvider",JV="x-sandbox-preview-not-ready",f94="agent-sandbox-system",x94="studio-sandbox",UN=9000,d9$=3000,Ed0="/app",y94=32,g94,h94=900000,u94=60000,c94=1800000,tF0=3,m9$=1800000,l94=900000,d94=1800000,m94,i9$,Ad0=40000,o9$=1e4,i94=256,vQ,L3,r94,a94=63,s94,$Z4=253;var a9$=B(()=>{E6();q9$();Yd0();C9$();Wc0();Mi();Ri();x9$();Ld0();g94=new Set(["DAEMON_TOKEN","DAEMON_BOOT_ID","APP_ROOT","PROXY_PORT"]),m94=["cookie","host","connection","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","accept-encoding","content-length","upgrade"],i9$=["connection","keep-alive","transfer-encoding","content-encoding","content-length"];vQ={role:"studio.decocms.com/role",sandboxHandle:"studio.decocms.com/sandbox-handle",orgId:"studio.decocms.com/org-id",userId:"studio.decocms.com/user-id",env:"studio.decocms.com/env"},L3={orgSlug:"studio.decocms.com/org-slug",orgName:"studio.decocms.com/org-name",userEmail:"studio.decocms.com/user-email",userName:"studio.decocms.com/user-name",gitRepo:"studio.decocms.com/git-repo",gitRepoUrl:"studio.decocms.com/git-repo-url",gitBranch:"studio.decocms.com/git-branch"},r94=/^([A-Za-z0-9]([-A-Za-z0-9_.]*[A-Za-z0-9])?)?$/;s94=/^[a-z]([a-z0-9-]{0,30}[a-z0-9])?$/});var s9$={};N4(s9$,{waitForSandboxReady:()=>mF0,parseTenantPools:()=>y9$,getSandboxClaim:()=>D3,getHttpRoute:()=>P9$,deleteSandboxClaim:()=>xw,deleteHttpRoute:()=>dF0,createSandboxClaim:()=>Ii,applyHttpRoute:()=>lF0,SandboxTimeoutError:()=>QV,SandboxError:()=>V9,PREVIEW_NOT_READY_HEADER:()=>JV,KubeConfig:()=>Wx,K8S_CONSTANTS:()=>U9,HTTPROUTE_CONSTANTS:()=>qi,AgentSandboxProvider:()=>Td0});var Rd0=B(()=>{Yd0();Ri();Mi();a9$();Ld0()});var GZ$={};N4(GZ$,{subscribeLifecycle:()=>kd0,getSandboxProviderByKind:()=>qd0,getOrInitSharedRunner:()=>Md0,__resetSharedLifecyclesForTesting:()=>jZ4});function XZ$($,Z){let X=e9$[$];if(X)return Promise.resolve(X);let Q=Id0[$];if(Q)return Q;let G=Z().then((Y)=>{return e9$[$]=Y,Y}).finally(()=>{delete Id0[$]});return Id0[$]=G,G}function NZ4(){let $=process.env.STUDIO_SANDBOX_PREVIEW_URL_PATTERN;return $&&$.trim()!==""?$:void 0}function FZ4(){let $=process.env.STUDIO_SANDBOX_TEMPLATE_NAME;return $&&$.trim()!==""?$:void 0}function UZ4(){let $=process.env.STUDIO_ENV;return $&&$.trim()!==""?$:void 0}function wZ4(){let $=process.env.STUDIO_SANDBOX_SENTINEL_TOKEN;return $&&$.trim()!==""?$:void 0}function OZ4(){let $=process.env.STUDIO_SANDBOX_PREVIEW_GATEWAY_NAME?.trim(),Z=process.env.STUDIO_SANDBOX_PREVIEW_GATEWAY_NAMESPACE?.trim();if(!$&&!Z)return;if(!$||!Z)throw Error("STUDIO_SANDBOX_PREVIEW_GATEWAY_NAME and STUDIO_SANDBOX_PREVIEW_GATEWAY_NAMESPACE must both be set, or both unset. Half-configured per-claim HTTPRoute routing would silently fail to attach.");return{name:$,namespace:Z}}async function QZ$($,Z){let X=new Qi(Z),Q=NZ4();switch($){case"agent-sandbox":{let{AgentSandboxProvider:G,parseTenantPools:Y}=await Promise.resolve().then(() => (Rd0(),s9$)),J=new RH(c0().encryptionKey);return new G({stateStore:X,previewUrlPattern:Q,sandboxTemplateName:FZ4(),envName:UZ4(),previewGateway:OZ4(),sentinelToken:wZ4(),tenantPools:Y(process.env.STUDIO_SANDBOX_TENANT_POOLS),meter:K8,mintCloneUrl:async(W,K)=>{if(!W.connectionId)return null;let H=d0$(W.cloneUrl);if(!H)return null;let{cloneUrl:N}=await Iw(W.connectionId,H.owner,H.name,Z,J,{bufferMs:K?.bufferMs});return N}})}case"user-desktop":throw Error("user-desktop provider cannot be instantiated without a per-run link claim \u2014 call resolveSandboxProvider, which binds the link before constructing the provider.");default:throw Error(`Unknown sandbox provider kind: ${String($)}`)}}function qd0($,Z){return XZ$(Z,()=>QZ$(Z,$.db))}async function Md0(){let $;try{$=VL()}catch(X){return console.warn("[lifecycle] cannot resolve sandbox runner:",X instanceof Error?X.message:String(X)),null}return await XZ$($,()=>QZ$($,m8().db))}function kd0($,Z,X){let Q=yw.get(Z);if(Q){if(Q.terminated){if(Q.lastPhase)try{X(Q.lastPhase)}catch{}return{unsubscribe:LZ4}}if(Q.listeners.add(X),Q.lastPhase)try{X(Q.lastPhase)}catch{}return $Z$(Z,Q,X)}let G=new AbortController,Y={lastPhase:null,terminated:!1,listeners:new Set([X]),abort:G};return yw.set(Z,Y),EZ4($,Z,Y),$Z$(Z,Y,X)}function LZ4(){}function $Z$($,Z,X){return{unsubscribe(){if(yw.get($)!==Z)return;if(Z.listeners.delete(X),Z.listeners.size===0)yw.delete($),Z.abort.abort()}}}async function EZ4($,Z,X){let Q=null;try{for await(let G of $.watchClaimLifecycle(Z,X.abort.signal)){if(X.abort.signal.aborted)break;X.lastPhase=G;let Y=G.kind==="ready"||G.kind==="failed";if(Y)X.terminated=!0;let J=Array.from(X.listeners);for(let W of J)try{W(G)}catch{}if(Y)break}}catch(G){Q=G}finally{if(!X.terminated&&!X.abort.signal.aborted&&X.listeners.size>0){let G={kind:"failed",reason:"unknown",message:Q instanceof Error?Q.message:"Lifecycle watcher ended unexpectedly"};X.lastPhase=G,X.terminated=!0;for(let Y of Array.from(X.listeners))try{Y(G)}catch{}}if(yw.get(Z)===X)yw.delete(Z)}}function jZ4(){for(let $ of yw.values())$.abort.abort();yw.clear()}var KZ4,HZ4,ZZ$,e9$,Id0,BZ4,DZ4,yw;var Si=B(()=>{GN();LY();Z5();Nc0();rf();Xc();S$();KZ4=Symbol.for("decocms.sandbox.lifecycle.runners"),HZ4=Symbol.for("decocms.sandbox.lifecycle.inflight"),ZZ$=globalThis,e9$=ZZ$[KZ4]??={},Id0=ZZ$[HZ4]??={};BZ4=Symbol.for("decocms.sandbox.lifecycle.shared-lifecycles"),DZ4=globalThis,yw=DZ4[BZ4]??=new Map});async function uX($,Z){let{userId:X,branch:Q,virtualMcpMetadata:G,explicitKind:Y}=Z;if(Y)return Vi($,Y);if($.sandboxPreference==="agent-sandbox")return Vi($,"agent-sandbox");if($.sandboxPreference==="cluster-default")return Vi($,VL());let[J,...W]=zZ4(G,X,Q);if(J)return Vi($,W.length===0?J:PZ4(J,W));return Vi($,YZ$())}function zZ4($,Z,X){let Q=C5($)[Z]?.[X];if(!Q)return[];let G=VJ(Q);return Object.keys(G)}function PZ4($,Z){let X=YZ$();if(X===$||Z.includes(X))return X;return $}function YZ$(){return VL()}async function Vi($,Z){let X=Z==="user-desktop"?"agent-sandbox":Z;return{provider:await qd0($,X),kind:X}}var gw=B(()=>{L8();GN();qQ();Si()});var Ci;var Sd0=B(()=>{Ci={npm:{install:"npm install",run:($)=>`npm run ${$}`,runtime:"node"},pnpm:{install:"pnpm install",run:($)=>`pnpm run ${$}`,runtime:"node"},yarn:{install:"yarn install",run:($)=>`yarn run ${$}`,runtime:"node"},bun:{install:"bun install",run:($)=>`bun run ${$}`,runtime:"bun"},deno:{install:"deno install",run:($)=>`deno task ${$}`,runtime:"deno"}}});function E3($,Z){return Z?`thread:${$}/${Z}`:`thread:${$}`}function wN($){return`sandbox/thread-${$.replace(/^thread:/,"").replace(/\//g,"-")}`}function hw($){if(!$||!$.startsWith("thread:"))return null;return $.slice(7).split("/")[0]||null}async function ON($,Z,X){let Q=hw(Z);if(!Q)return X;return(await $.storage.threads.get(Q).catch(()=>null))?.created_by??X}async function WV($,Z){if(!Z)return null;let X=await $.storage.threads.get(Z).catch(()=>null);if(!X)return null;return X.metadata??{}}async function JZ$($,Z){let Q=(await WV($,Z))?.headRef;return typeof Q==="string"&&Q.length>0?Q:null}async function WZ$($,Z,X){let Q=await WV($,Z);if(!Q)return;if(Q.headRef===X)return;await $.storage.threads.update(Z,{metadata:{...Q,headRef:X}}).catch((G)=>console.warn("[thread-repo] setThreadHeadRef failed",G))}async function uw($,Z){return(await WV($,Z))?.githubRepo??null}function Vd0($){if($.pinnedRef)return $.pinnedRef;if($.runBranch&&$.runBranch===E3($.threadId))return $.runBranch;if($.threadRepo)return E3($.threadId,$.threadRepo.connectionId);if(!$.agentRepo)return"ephemeral";return $.runBranch??`thread:${$.threadId}`}async function Cd0($,Z){let Q=(await WV($,Z))?.pinnedRef;return typeof Q==="string"&&Q.length>0?Q:null}async function KZ$($,Z){let[X,Q]=await Promise.all([uw($,Z.threadId),Cd0($,Z.threadId)]);return Vd0({...Z,threadRepo:X,pinnedRef:Q})}async function HZ$($,Z,X,Q,G,Y){let J=await WV($,Z);if(!J)return;let W=Xi(C5(J),X,Q,G,Y);await $.storage.threads.update(Z,{metadata:{...J,sandboxMap:W}}).catch((K)=>console.warn("[thread-repo] setThreadSandboxMapEntry failed",K))}async function oF0($,Z){return C5(await WV($,Z))}async function NZ$($,Z,X,Q,G){let Y=await WV($,Z);if(!Y)return;let J=Hc0(C5(Y),X,Q,G);if(!J)return;await $.storage.threads.update(Z,{metadata:{...Y,sandboxMap:J}}).catch((W)=>console.warn("[thread-repo] removeThreadSandboxMapEntry failed",W))}var j3=B(()=>{qQ()});function rF0($){if(!$)return null;let Z=$.runtime;if(!Z||typeof Z!=="object")return null;let X=Z.env;if(!Array.isArray(X))return null;let Q=[];for(let G of X){if(!G||typeof G!=="object")continue;let Y=G;if(typeof Y.key!=="string"||!n00.test(Y.key))continue;if(Y.kind==="literal"&&typeof Y.value==="string"){Q.push({key:Y.key,kind:"literal",value:Y.value});continue}if(Y.kind==="secret"&&typeof Y.secretId==="string"&&Y.secretId.length>0)Q.push({key:Y.key,kind:"secret",secretId:Y.secretId})}return Q.length===0?null:Q}function FZ$($){if(!$)return null;let Z=$.runtime;if(!Z||typeof Z!=="object")return null;let X=Z.submoduleCredentials;if(!Array.isArray(X))return null;let Q=[];for(let G of X){if(!G||typeof G!=="object")continue;let Y=G;if(typeof Y.host==="string"&&Y.host.length>0&&typeof Y.secretId==="string"&&Y.secretId.length>0)Q.push({host:Y.host,secretId:Y.secretId})}return Q}async function UZ$($,Z){Z0(Z);let X=r(Z);await Z.access.check();let Q=W1(Z);if(!Q)throw Error("User ID required");let G=await Z.storage.virtualMcps.findById($.virtualMcpId);if(!G||G.organization_id!==X.id)throw Error("Virtual MCP not found");let Y=G.metadata??{},J=C5(Y),W=await ON(Z,$.branch,Q),K=rW(J,W,$.branch,$.sandboxProviderKind);return{virtualMcp:G,metadata:Y,userId:Q,sandboxUserId:W,entry:K,organization:X}}function AZ4($){if($===null||!/^\d+$/.test($))return null;let Z=Number($);return Z>=1&&Z<=65535?$:null}function wZ$($){let Z=$.runtime??null,Q=Z?.selected??null,G=AZ4(Z?.port??null),Y=Z?.path??null;if(!Q||!(Q in Ci))return{packageManager:null,runtime:null,port:G,packageManagerPath:Y,runtimeBinPath:null};let J=Ci[Q].runtime;return{packageManager:Q,runtime:J,port:G,packageManagerPath:Y,runtimeBinPath:J==="deno"?"/opt/deno/bin":J==="bun"?"/opt/bun/bin":null}}var _i=B(()=>{L8();Sd0();qQ();j3()});import{sql as TZ4}from"kysely";function OZ$($){return $ instanceof Date?$.toISOString():String($)}class _d0{db;vault;constructor($,Z){this.db=$;this.vault=Z}rowToInfo($){return{id:$.id,organizationId:$.organization_id,scope:$.scope,userId:$.user_id,name:$.name,description:$.description,createdBy:$.created_by,createdAt:OZ$($.created_at),updatedBy:$.updated_by,updatedAt:OZ$($.updated_at)}}assertVisible($,Z){if($.scope==="user"&&$.user_id!==Z)throw new cw($.id)}async create($){let Z=l8("sec"),X=await this.vault.encrypt($.value),Q=new Date,G=await this.db.insertInto("secrets").values({id:Z,organization_id:$.organizationId,scope:$.scope.kind,user_id:$.scope.kind==="user"?$.scope.userId:null,name:$.name,encrypted_value:X,description:$.description??null,created_by:$.createdBy,created_at:Q,updated_by:$.createdBy,updated_at:Q}).returning(aF0).executeTakeFirstOrThrow();return this.rowToInfo(G)}async update($){let Z=await this.db.selectFrom("secrets").where("id","=",$.id).where("organization_id","=",$.organizationId).select(["id","scope","user_id"]).executeTakeFirst();if(!Z)throw new VY($.id);this.assertVisible(Z,$.callerUserId);let X={updated_by:$.updatedBy,updated_at:new Date};if($.value!==void 0)X.encrypted_value=await this.vault.encrypt($.value);if($.description!==void 0)X.description=$.description;let Q=await this.db.updateTable("secrets").set(X).where("id","=",$.id).where("organization_id","=",$.organizationId).returning(aF0).executeTakeFirstOrThrow();return this.rowToInfo(Q)}async delete($,Z,X){let Q=await this.db.selectFrom("secrets").where("id","=",$).where("organization_id","=",Z).select(["id","scope","user_id"]).executeTakeFirst();if(!Q)throw new VY($);this.assertVisible(Q,X),await this.db.deleteFrom("secrets").where("id","=",$).where("organization_id","=",Z).execute()}async list($){let Z=this.db.selectFrom("secrets").where("organization_id","=",$.organizationId).select(aF0);if($.scope?.kind==="user")Z=Z.where("scope","=","user").where("user_id","=",$.scope.userId);else if($.scope?.kind==="organization")Z=Z.where("scope","=","organization");else Z=Z.where((Q)=>Q.or([Q("scope","=","organization"),Q.and([Q("scope","=","user"),Q("user_id","=",$.callerUserId)])]));return(await Z.orderBy("created_at","desc").execute()).map((Q)=>this.rowToInfo(Q))}async findById($,Z,X){let Q=await this.db.selectFrom("secrets").where("id","=",$).where("organization_id","=",Z).select(aF0).executeTakeFirst();if(!Q)throw new VY($);return this.assertVisible(Q,X),this.rowToInfo(Q)}async resolveById($,Z,X){let Q=await this.db.selectFrom("secrets").where("id","=",$).where("organization_id","=",Z).selectAll().executeTakeFirst();if(!Q)throw new VY($);this.assertVisible(Q,X);let G=await this.vault.decrypt(Q.encrypted_value);return{info:this.rowToInfo(Q),value:G}}async resolveByName($){let Z=this.db.selectFrom("secrets").where("organization_id","=",$.organizationId).where("scope","=",$.scope.kind).where(TZ4`lower(name) = lower(${$.name})`).selectAll();if($.scope.kind==="user")Z=Z.where("user_id","=",$.scope.userId);let X=await Z.executeTakeFirst();if(!X)throw new VY(`${$.scope.kind}:${$.name}`);let Q=await this.vault.decrypt(X.encrypted_value);return{info:this.rowToInfo(X),value:Q}}}var aF0,VY,cw;var vi=B(()=>{IX();aF0=["id","organization_id","scope","user_id","name","description","created_by","created_at","updated_by","updated_at"];VY=class VY extends Error{constructor($){super(`Secret ${$} not found`);this.name="SecretNotFoundError"}};cw=class cw extends Error{constructor($){super(`Access denied for secret ${$}`);this.name="SecretAccessDeniedError"}}});async function lw($,Z){let X=$.body?.getReader();if(!X)return $.text();let Q=new TextDecoder,G="",Y=0;for(;;){let{done:J,value:W}=await X.read();if(J)break;if(Y+=W.byteLength,Y>Z)throw await X.cancel().catch(()=>{}),new BZ$(`Upstream response exceeded ${Z} bytes`);G+=Q.decode(W,{stream:!0})}return G+=Q.decode(),G}var BZ$;var bi=B(()=>{BZ$=class BZ$ extends Error{}});async function sF0({ctx:$,runner:Z,handle:X,orgId:Q,userId:G,entries:Y}){if(!Y||Y.length===0)return;let J={};for(let K of Y){if(K.kind==="literal"){J[K.key]=K.value;continue}try{let{value:H}=await $.storage.secrets.resolveById(K.secretId,Q,G);J[K.key]=H}catch(H){if(H instanceof VY||H instanceof cw){console.warn(`[SANDBOX_START] skipping env ${K.key}: ${H.message}. Re-link or recreate the secret to restore.`);continue}throw H}}if(Object.keys(J).length===0)return;let W=await Z.proxyDaemonRequest(X,"/_sandbox/config",{method:"PUT",headers:new Headers({"content-type":"application/json"}),body:JSON.stringify({env:J})});if(!W.ok){let K=await lw(W,RZ4).catch(()=>W.statusText);console.warn(`[SANDBOX_START] daemon rejected env patch (${W.status}): ${K}`)}}var RZ4=10485760;var vd0=B(()=>{vi();bi()});async function DZ$({ctx:$,orgId:Z,userId:X,entries:Q}){if(!Q||Q.length===0)return[];let G=[];for(let Y of Q)try{let{value:J}=await $.storage.secrets.resolveById(Y.secretId,Z,X);G.push({host:Y.host,token:J})}catch(J){if(J instanceof VY||J instanceof cw){console.warn(`[SANDBOX_START] skipping submodule credential for ${Y.host}: ${J.message}. Re-link or recreate the secret to restore.`);continue}throw J}return G}var LZ$=B(()=>{vi()});async function zZ$($,Z,X,Q,G){let Y=await F3({connectionId:$,tokenStorage:new r6(Q,G)});if(!Y.accessToken)return null;return AZ$(Z,X,Y.accessToken)}function PZ$($,Z){return AZ$($,Z,null)}async function AZ$($,Z,X){let Q=new Map,G=new Set(EZ$.map((K)=>K.path));for(let K of Object.values(jZ$))for(let H of K??[])G.add(H);await Promise.all(Array.from(G).map(async(K)=>{Q.set(K,await qZ4($,Z,K,X))}));let Y=EZ$.find(({path:K})=>Q.get(K)!==null);if(!Y)return null;let J=jZ$[Y.pm]??[],W=null;for(let K of J)if(W=MZ4(Q.get(K)??null),W)break;return{packageManager:Y.pm,devPort:W}}async function qZ4($,Z,X,Q){let G=`https://api.github.com/repos/${$}/${Z}/contents/${encodeURIComponent(X)}`;try{let Y={Accept:"application/vnd.github+json","User-Agent":"studio-runtime-detect"};if(Q)Y.Authorization=`token ${Q}`;let J=await fetch(G,{headers:Y,signal:AbortSignal.timeout(5000)});if(!J.ok)return null;let W=await J.json();if(!W.content||W.encoding!=="base64")return null;return Buffer.from(W.content,"base64").toString("utf8")}catch{return null}}function MZ4($){if(!$)return null;try{let Z=JSON.parse($),X=Z.tasks??Z.scripts??{};return(X.dev??X.start??"").match(IZ4)?.[1]??null}catch{return null}}var EZ$,jZ$,IZ4;var TZ$=B(()=>{YN();PY();EZ$=[{path:"deno.json",pm:"deno"},{path:"deno.jsonc",pm:"deno"},{path:"bun.lock",pm:"bun"},{path:"bunfig.toml",pm:"bun"},{path:"pnpm-lock.yaml",pm:"pnpm"},{path:"yarn.lock",pm:"yarn"},{path:"package-lock.json",pm:"npm"},{path:"package.json",pm:"bun"}],jZ$={deno:["deno.json","deno.jsonc"],bun:["package.json"],pnpm:["package.json"],yarn:["package.json"],npm:["package.json"]},IZ4=/(?:--port|PORT=|:)(\d{4,5})/});function kZ4($){return($??"").normalize("NFKD").replace(/[\u0300-\u036F]/g,"").toLowerCase().replace(/[^a-z0-9]+/g,"-").replace(/^-+|-+$/g,"")||"user"}function eF0($){return $?.name||$?.email?.split("@")[0]||void 0}function $U0($){let Z=kZ4($),X=Date.now().toString(36).split("").reverse().join("");return`${Z}-${X}`}function RZ$($){let{current:Z,detached:X,base:Q}=$.status??{};if(typeof Z!=="string"||Z.length===0)return null;if(X===!0)return null;if(Z===$.requestedRef)return null;if(SZ4.has(Z))return null;if(typeof Q==="string"&&Q.length>0&&Z===Q)return null;return Z}function IZ$($){if(!$.branch.startsWith("thread:"))return $.branch;if($.sticky&&$.recordedHeadRef)return $.recordedHeadRef;return $.derivedRef}var SZ4;var bd0=B(()=>{SZ4=new Set(["main","master","trunk","develop","HEAD"])});async function qZ$($,Z){if(!$)return{hosts:[],allowSameHostDev:!1};let X;try{X=await $.presignedGetUrl("link-dispatch/_allowlist_probe",60,{requireFetchable:!0})}catch{return{hosts:[],allowSameHostDev:!1}}let Q;try{Q=new URL(X)}catch{return{hosts:[],allowSameHostDev:!1}}if(Q.protocol!=="https:"&&Q.protocol!=="http:")return{hosts:[],allowSameHostDev:!1};let G=Q.hostname,Y=VZ4.has(G);return{hosts:[G],allowSameHostDev:Y&&!Z.isProduction}}var VZ4;var MZ$=B(()=>{VZ4=new Set(["127.0.0.1","localhost","::1","[::1]","0.0.0.0"])});var KV="home";var ZU0=()=>{};function XU0($){if(!dF($))return`Invalid volume name ${JSON.stringify($)} \u2014 use 1-128 chars of letters, digits, "_", "-" or "."`;if(CZ4.has($))return`Volume "${$}" is reserved`;if(NW($))return'Volume names starting with "public-" are reserved for shared skill sets';if($.startsWith("."))return'Volume names starting with "." are reserved';if(!/^[A-Za-z0-9]/.test($))return"Volume names must start with a letter or digit";return null}async function QU0($,Z){try{let X=await $.storage.connections.findById(Z.connectionId,Z.organizationId);if(!X)throw Error("sync connection not found in this organization");await Rw({ctx:$,connectionId:X.id,organizationId:Z.organizationId,onLegacyMintError:(J)=>console.warn("[org-repo-sync] repo-scoped mint failed",{configId:Z.id,error:J instanceof Error?J.message:String(J)})});let Q=await F3({connectionId:X.id,tokenStorage:new r6($.db,$.vault)});if(!Q.accessToken)throw Error("No GitHub token for the sync connection \u2014 reconnect the mcp-github integration.");let G=Q.accessToken,Y=await aV0($.db,{orgId:Z.organizationId,baseUrl:$.baseUrl,volume:Z.volume,source:{repo:`${Z.repoOwner}/${Z.repoName}`,ref:Z.ref,paths:Z.paths},authToken:G,skipVolumeQuota:!1});return await $.storage.orgRepoSyncs.recordSyncResult(Z.id,{error:null}),{id:Z.id,volume:Z.volume,...Y}}catch(X){let Q=X instanceof Error?X.message:String(X);return await $.storage.orgRepoSyncs.recordSyncResult(Z.id,{error:Q}).catch(()=>{}),{id:Z.id,volume:Z.volume,error:Q}}}var CZ4,fd0=10;var GU0=B(()=>{rf();YN();PY();Dv();$D();q00();CZ4=new Set(["home","outputs","uploads","public","output","upload"])});function dw($,Z){let X;if($==="home")X=`org/${KV}`;else if($==="outputs")X=`org/${kZ$}`;else if($==="uploads")X=`org/${SZ$}`;else if(NW($))X=`org/public/${$.slice(7)}`;else X=`org/${$}`;return Z?`${X}/${Z}`:X}function vZ4($){return{baseUrl:$.baseUrl.replace(/\/+$/,""),orgSlug:$.orgSlug,token:$.token,mounts:[{volume:"home",path:KV},..._Z4.map((Z)=>({...Z})),...($.publicSets??[]).map((Z)=>({volume:iF(Z),path:`public/${Z}`,readonly:!0})),...($.syncedVolumes??[]).filter((Z)=>XU0(Z)===null).map((Z)=>({volume:Z,path:Z,readonly:!0}))]}}async function VZ$($,Z){try{let X=await $.boundAuth.apiKey.create({name:`orgfs-${Z.orgSlug}`,permissions:{self:["ORG_FS_READ","ORG_FS_WRITE"]},expiresIn:bZ4,metadata:{organization:{id:Z.orgId,slug:Z.orgSlug}}}),Q=await $.storage.orgRepoSyncs.listEnabledVolumes(Z.orgId).catch(()=>[]);return JSON.stringify(vZ4({baseUrl:Z.baseUrl,orgSlug:Z.orgSlug,token:X.key,publicSets:XY().map((G)=>G.set),syncedVolumes:Q}))}catch(X){console.warn("[org-fs] token mint failed; mounts disabled for this sandbox",X);return}}var kZ$=".outputs",SZ$=".uploads",_Z4,bZ4=604800;var fi=B(()=>{ZU0();GU0();$D();_Z4=[{volume:"outputs",path:kZ$},{volume:"uploads",path:SZ$}]});import{z as XK}from"zod";async function wx($,Z){Z0(Z);let X=r(Z),Q=W1(Z);if(!Q)throw Error("User ID required");let G=await Z.storage.virtualMcps.findById($.virtualMcpId);if(!G||G.organization_id!==X.id)throw Error("Virtual MCP not found");let Y=G.metadata??{},J=await ON(Z,$.branch,Q),W=rW(C5(Y),J,$.branch,$.sandboxProviderKind),K=$.sandboxProviderKind,{provider:H}=await uX(Z,{userId:J,branch:$.branch,virtualMcpMetadata:Y,explicitKind:K});if(W){if(K!=="user-desktop")return W;if(await H.alive(W.sandboxHandle).catch(()=>!1))return W;await Tw(Z.storage.virtualMcps,$.virtualMcpId,Q,J,$.branch,K).catch((O)=>{console.warn("[ensureSandbox] failed to reap stale user-desktop entry",O)})}let F=await uw(Z,hw($.branch)??Z.metadata?.threadId)??Y.githubRepo??null,{entry:U}=await _Z$({ctx:Z,userId:Q,sandboxUserId:J,orgId:X.id,virtualMcpId:$.virtualMcpId,branch:$.branch,metadata:Y,githubRepo:F,existing:null,providerKind:K,runner:H,...$.cloneOnly?{cloneOnly:!0}:{}});return U}async function _Z$($){let{ctx:Z,userId:X,sandboxUserId:Q,orgId:G,virtualMcpId:Y,branch:J,metadata:W,existing:K,runner:H,cloneOnly:N}=$,F=$.githubRepo?await xZ4({ctx:Z,orgId:G,virtualMcpId:Y,userId:X,githubRepo:$.githubRepo}):null,{runtime:U,packageManager:w,port:O,packageManagerPath:D}=wZ$(W),L;if(F){if(F.connectionId)await Rw({ctx:Z,connectionId:F.connectionId,organizationId:G,forceRefresh:!0,onLegacyMintError:(f0)=>{console.error("[provisionSandbox] repo-scoped legacy token mint failed",{connectionId:F.connectionId,error:f0.message})}});let{cloneUrl:O0,gitUserName:s,gitUserEmail:t}=F.connectionId?await Iw(F.connectionId,F.owner,F.name,Z.db,Z.vault):l0$(F.owner,F.name);if(!w){let f0=F.connectionId?await zZ$(F.connectionId,F.owner,F.name,Z.db,Z.vault):await PZ$(F.owner,F.name);if(f0)w=f0.packageManager,U=Ci[f0.packageManager].runtime,O=f0.devPort??O,await yZ4(Z,Y,X,f0.packageManager,f0.devPort)}let P0=c0().sandboxStickyHeadRefEnabled,G0=IZ$({branch:J,derivedRef:wN(J),recordedHeadRef:P0?await JZ$(Z,hw(J)):null,sticky:P0}),j0=await DZ$({ctx:Z,orgId:G,userId:X,entries:FZ$(W)});L={cloneUrl:O0,...F.connectionId?{connectionId:F.connectionId}:{},userName:s,userEmail:t,branch:G0,displayName:`${F.owner}/${F.name}`,submoduleCredentials:j0}}let E=typeof W.productionUrl==="string"&&W.productionUrl.trim()?W.productionUrl.trim():void 0,j=U&&w&&!N?{runtime:U,packageManager:w,...O!==null?{devPort:Number(O)}:{},...D?{packageManagerPath:D}:{},...E?{productionUrl:E}:{}}:void 0,z=em({orgId:G,virtualMcpId:Y,branch:J}),A=H.kind==="user-desktop"?await qZ$(Z.objectStorage,{isProduction:c0().nodeEnv==="production"}):null,P=(H.kind==="user-desktop"||H.kind==="agent-sandbox")&&!c0().orgFsMountsDisabled,M;if(P){let O0=Z.organization?.slug??(await Z.db.selectFrom("organization").select(["slug"]).where("id","=",G).executeTakeFirst())?.slug;if(O0)M=await VZ$(Z,{orgSlug:O0,orgId:G,baseUrl:XQ()})}await hZ4(H);let k=await H.ensure({userId:Q,projectRef:z},{branch:J,repo:L,workload:j,cloneOnly:N===!0,tenant:{orgId:G,userId:Q,...Z.organization?.slug?{orgSlug:Z.organization.slug}:{},...Z.organization?.name?{orgName:Z.organization.name}:{},...Z.auth.user?.email?{userEmail:Z.auth.user.email}:{},...Z.auth.user?.name?{userName:Z.auth.user.name}:{}},...A?{offloadAllowedHosts:A.hosts,offloadAllowSameHostDev:A.allowSameHostDev}:{},...M?{orgFsConfigJson:M}:{}}),q=W.runtime?.env??null;await sF0({ctx:Z,runner:H,handle:k.handle,orgId:G,userId:X,entries:q});let l=!!K&&K.sandboxHandle===k.handle&&K?.createdAt?K.createdAt:Date.now(),b=W.runtime?.selected??null,x=W.runtime?.port??null,p=W.runtime?.path??null,h={sandboxHandle:k.handle,previewUrl:k.previewUrl,sandboxApiUrl:k.previewUrl,sandboxProviderKind:H.kind,createdAt:l,startedWith:{packageManager:b,port:x,path:p}};await V0$(Z.storage.virtualMcps,Y,X,Q,J,$.providerKind,h);let o=hw(J);if(o)await HZ$(Z,o,Q,J,$.providerKind,h);let w0=!K||K.sandboxHandle!==k.handle;return{entry:h,isNewVm:w0}}async function xZ4($){let{ctx:Z,orgId:X,virtualMcpId:Q,userId:G,githubRepo:Y}=$;if(!Y.connectionId)return Y;if(await Z.storage.connections.findById(Y.connectionId,X))return Y;let{items:W}=await Z.storage.connections.list(X),K=xp1(W,Y.owner,Y.name);if(!K)return console.warn("[provisionSandbox] recorded repo connection no longer exists and no live connection covers the repo",{virtualMcpId:Q,connectionId:Y.connectionId}),Y;console.warn("[provisionSandbox] healed dangling repo connection",{virtualMcpId:Q,staleConnectionId:Y.connectionId,connectionId:K.id});try{let N=(await Z.storage.virtualMcps.findById(Q))?.metadata??{},F=N.githubRepo;if(F?.connectionId===Y.connectionId){let U=M9(K);await Z.storage.virtualMcps.update(Q,G,{metadata:{...N,githubRepo:{...F,connectionId:K.id,...U?{installationId:U.installationId}:{}}}})}}catch(H){console.warn("[provisionSandbox] failed to persist healed repo connection",{virtualMcpId:Q,error:H.message})}return{...Y,connectionId:K.id}}async function yZ4($,Z,X,Q,G){let Y=await $.storage.virtualMcps.findById(Z);if(!Y)return;let J=Y.metadata??{};await $.storage.virtualMcps.update(Z,X,{metadata:{...J,runtime:{selected:Q,port:G}}})}async function hZ4($){if(!$.hasSchedulableCapacity)return;let Z=Date.now()+CZ$,X=!1;while(!await $.hasSchedulableCapacity()){if(Date.now()>=Z)throw Error(`sandbox provisioning failed: the cluster has had no room to schedule another sandbox for ${Math.round(CZ$/1000)}s`);if(!X)X=!0,console.warn("[ensureSandbox] waiting for cluster capacity \u2014 a sandbox pod cannot be scheduled right now");await y$(gZ4)}}var fZ4,xd0,CZ$=150000,gZ4=5000;var xi=B(()=>{GN();E6();v0();_i();vd0();LZ$();qQ();AY();rf();TZ$();Sd0();gw();j3();bd0();MZ$();S$();jZ();fi();qQ();fZ4=XK.enum(["agent-sandbox","user-desktop","cluster"]),xd0=m({name:"SANDBOX_START",description:"Start a sandbox with the connected GitHub repo and dev server.",annotations:{title:"Start VM Preview",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!1,openWorldHint:!0},_meta:{ui:{visibility:"app"}},inputSchema:XK.object({virtualMcpId:XK.string().describe("Virtual MCP ID"),branch:XK.string().min(1).optional().describe("Git branch to check out. Pass the thread's branch whenever the caller has one: when omitted the handler mints a fresh `<user-slug>-<timestamp>` name, which becomes a SEPARATE sandbox from the one the thread's own branch resolves to. The resolved branch is returned in the response so callers can persist it."),sandboxProviderKind:fZ4.optional().describe("Explicit runtime choice. Hosted provider is `agent-sandbox`; legacy `cluster` input is accepted only for compatibility and normalized to `agent-sandbox`. When omitted, defaults to `user-desktop` if the acting user's link daemon is online, else the env kind.")}),outputSchema:XK.object({previewUrl:XK.string().nullable(),sandboxHandle:XK.string(),branch:XK.string(),isNewVm:XK.boolean(),sandboxProviderKind:XK.enum(["agent-sandbox","user-desktop"])}),handler:async($,Z)=>{Z0(Z);let X=r(Z);await Z.access.check();let Q=$.branch??$U0(eF0(Z.auth.user)),G=W1(Z);if(!G)throw Error("User ID required");let Y=await ON(Z,Q,G),J=await Z.storage.virtualMcps.findById($.virtualMcpId);if(!J||J.organization_id!==X.id)throw Error("Virtual MCP not found");let W=J.metadata??{},K=$.sandboxProviderKind?kL($.sandboxProviderKind):void 0,{provider:H,kind:N}=await uX(Z,{userId:Y,branch:Q,virtualMcpMetadata:W,explicitKind:K}),F=rW(C5(W),Y,Q,N),w=await uw(Z,hw(Q)??Z.metadata?.threadId)??W.githubRepo??null,{entry:O,isNewVm:D}=await _Z$({ctx:Z,userId:G,sandboxUserId:Y,orgId:X.id,virtualMcpId:$.virtualMcpId,branch:Q,metadata:W,githubRepo:w,existing:F,providerKind:N,runner:H});return{...O,branch:Q,isNewVm:D,sandboxProviderKind:N}}})});function uZ4($){let{publicUrl:Z,agentId:X,organization:Q,target:G,threadId:Y}=$;if(G==="agent-tools")return`${Z}/mcp/virtual-mcp/${X}`;if(!Q.slug)throw new bZ$(Q.id);if(G==="task-run"){if(!Y)throw Error("a task-run MCP endpoint is scoped to a run: threadId is required");return`${Z}/api/${Q.slug}/mcp/task-run/${encodeURIComponent(Y)}`}return`${Z}/api/${Q.slug}/mcp/self`}async function YU0($,Z,X,Q,G="agent-tools",Y){let J=uZ4({publicUrl:XQ(),agentId:Z,organization:X,target:G,...Y?{threadId:Y}:{}}),W=await $.boundAuth.apiKey.create({name:Q,permissions:{"*":["*"]},expiresIn:vZ$,metadata:{organization:{id:X.id,slug:X.slug,name:X.name}}});return{url:J,headers:{Authorization:`Bearer ${W.key}`,"x-org-id":X.id},expiresAt:Date.now()+vZ$*1000}}var vZ$=3600,bZ$;var yd0=B(()=>{jZ();bZ$=class bZ$ extends Error{constructor($){super(`cannot mint a management MCP endpoint for organization "${$}": the org-scoped path /api/<slug>/mcp/self needs the org slug, which was not loaded.`);this.name="MissingOrganizationSlugError"}}});async function cZ4($,Z,X,Q){try{let G=$.organization;if(!G)return;let Y=await YU0($,Q.virtualMcpId,G,"tool-scripting"),J=await Z.proxyDaemonRequest(X,"/_sandbox/tools/sync",{method:"POST",headers:new Headers({"content-type":"application/json"}),body:JSON.stringify(Y)});if(!J.ok)console.warn("[cluster-sandbox-fs] tools/sync failed",J.status,await J.text().catch(()=>""))}catch(G){console.warn("[cluster-sandbox-fs] tools/sync failed",G)}}async function Ox($,Z){let{provider:X,kind:Q}=await uX($,{userId:Z.userId,branch:Z.branch,virtualMcpMetadata:null}),G=null,Y=()=>{if(!G){if(G=wx({virtualMcpId:Z.virtualMcpId,branch:Z.branch,sandboxProviderKind:Q},$).then((K)=>K.sandboxHandle),G.catch(()=>{G=null}),Z.syncTools)G.then((K)=>cZ4($,X,K,{virtualMcpId:Z.virtualMcpId,providerKind:Q})).catch(()=>{})}return G},J=Z.branch==="ephemeral"||Q==="user-desktop";return Kc0(X,{ensureHandle:Y,invalidateHandle:async(K)=>{let H=G;if(G=null,!J&&!K?.force)return;try{await Tw($.storage.virtualMcps,Z.virtualMcpId,Z.userId,Z.userId,Z.branch,Q)}catch(N){console.warn("[cluster-sandbox-fs] failed to reap vmMap entry",N)}if(H&&typeof X.forgetHandle==="function")try{let N=await H;await X.forgetHandle(N)}catch(N){console.warn("[cluster-sandbox-fs] forgetHandle failed",N)}},canAutoRestart:J,threadId:Z.threadId})}async function fZ$($,Z){try{let X=await Ox($,Z),{stdout:Q}=await X.onBash("test -d .deco && echo __DECO_SITE__");return Q.includes("__DECO_SITE__")}catch(X){return console.warn("[cluster-sandbox-fs] .deco probe failed; assuming deco site",X),!0}}var JU0=B(()=>{GN();yd0();gw();xi();qQ()});import{z as xZ$}from"zod";function Bx($){let Z=[];for(let X of $){if(X.status!=="active")continue;let Q=M9(X);if(!Q)continue;Z.push({connectionId:X.id,owner:Q.owner,repo:Q.repo,installationId:Q.installationId})}return Z}async function dZ4($,Z){let{items:X}=await $.storage.connections.list(Z,{slug:"mcp-github"});return Bx(X)}function mZ4($){let Z=$.split(`
 `).map((Q)=>Q.trim()).filter((Q)=>Q&&Q!==".git"&&Q!=="__CLONED__"),X=Z.length>0;return{cloned:X,listing:X?Z.join(`
 `):""}}function iZ4($){let Z="Load a GitHub repository into this conversation's sandbox so the file tools (read/write/edit/bash/grep/glob) and dev server operate on that repo, and open its live Preview. Waits until the repo is cloned before returning. Calling it again switches the repo. File tools operate on the loaded repo from your NEXT message (this turn's tools are still bound to the previous workspace), so after loading, prefer the file listing this tool returns over re-running bash in the same turn.",X=$.map((Q)=>`- ${Q.owner}/${Q.repo} (connectionId: ${Q.connectionId})`).join(`
 `);return`${Z}
@@ -2726,7 +2726,7 @@ Do NOT require review (requiresReview = false) when the changes are low-risk, su
 When unsure between the two, lean toward NOT requiring review for small frontend-only diffs, and toward requiring it for anything backend or large.
-Respond with the structured verdict and a short reason.`,a_$;var e_$=B(()=>{k4();mw();Q41();g86=G41.object({requiresReview:G41.boolean().describe("true if the changes should go through pull-request review"),reason:G41.string().describe("One short sentence explaining the decision (max ~120 chars)")});a_$={requiresReview:!1,reason:""}});function l86($){if(!$||$.includes(".."))return!1;return c86.test($)}function $v$($){let Z=typeof $.__resolveType==="string"?$.__resolveType:null;if(!Z||!l86(Z))return null;let{__resolveType:X,...Q}=$;return{resolveType:Z,payload:Q}}function Zv$($,Z){return`${$.replace(/\/+$/,"")}/deco/invoke/${Z}`}var c86;var Xv$=B(()=>{c86=/^[\w./@-]+$/});function Y41($){let Z;try{Z=new URL($)}catch{return null}if(!Z.hostname.endsWith(".localhost"))return null;let X=Z.host;return Z.hostname="127.0.0.1",{url:Z.toString(),hostHeader:X}}function Qv$($,Z){let X=$?.githubRepo;if(!X?.owner||!X?.name)return null;if(!X.connectionId)return X;if(!Z.includes(X.connectionId))return null;return X}async function Gv$($,Z,X,Q){if(!Q.connectionId)throw new ig("Push requires a connected GitHub account. Connect mcp-github for this project and restart the sandbox.");let G=$.organization?.id;if(!G)throw new ig(d7);await Rw({ctx:$,connectionId:Q.connectionId,organizationId:G,forceRefresh:!0,onLegacyMintError:(N)=>{let F=N instanceof Error?N.message:d7;throw new ig(F)}});let{cloneUrl:Y,gitUserName:J,gitUserEmail:W}=await Iw(Q.connectionId,Q.owner,Q.name,$.db,$.vault),K=zj0($),H=await Z.proxyDaemonRequest(X,"/_sandbox/config",{method:"PUT",headers:new Headers({"content-type":"application/json"}),body:JSON.stringify({git:{repository:{cloneUrl:Y},identity:{userName:J,userEmail:W}},...K?{operator:K}:{}})});if(!H.ok){let N=await lw(H,d86).catch(()=>H.statusText);throw Error(`Failed to refresh sandbox git credentials (${H.status}): ${N}`)}}var d86=10485760,ig;var Yv$=B(()=>{YN();r81();bi();rf();ig=class ig extends Error{constructor($){super($);this.name="GitPushAuthError"}}});function i86($){let Z=$.startsWith("thread:")?$.slice(7):$;if(!Z||Z.length>255||Z.includes("..")||Z.startsWith("/")||Z.endsWith("/")||Z.endsWith(".lock")||!m86.test(Z))throw Error(`Invalid branch name: ${$}`)}function lC($){return AbortSignal.any([$.req.raw.signal,AbortSignal.timeout(p86)])}function dC($){let{runner:Z}=$.get("vmClaim");if(!Z)return $.json({error:"No sandbox runner configured"},503);return Z}function J41($,Z){let Q=(Pj0.get($)??Promise.resolve()).catch(()=>{}).then(Z),G=Q.catch(()=>{});return Pj0.set($,G),G.finally(()=>{if(Pj0.get($)===G)Pj0.delete($)}),Q}async function fZ($,Z,X){let Q=dC($);if(Q instanceof Response)return Q;let{claimName:G,userId:Y,projectRef:J}=$.get("vmClaim"),W=X?.method??"POST",K=null,H=new Headers;if(X?.jsonBody!==void 0)K=X.jsonBody,H.set("content-type","application/json");else if(X?.forwardJsonBody)K=await $.req.text(),H.set("content-type","application/json");let N=X?.signal,F={method:W,headers:H,body:K,...N?{signal:N}:{}},U=async()=>{let w=await Q.proxyDaemonRequest(G,Z,F);if(X?.map404to410&&w.status===404){try{await w.body?.cancel()}catch{}if(await Q.adoptLiveClaim?.({userId:Y,projectRef:J},G))w=await Q.proxyDaemonRequest(G,Z,F);if(w.status===404){try{await w.body?.cancel()}catch{}return new Response(JSON.stringify({error:"Sandbox handle is gone. The sandbox needs to be re-provisioned."}),{status:410,headers:{"content-type":"application/json",...cG}})}}let O=await w.text(),D=X?.redactRepoDirUnlessDesktop&&Q.kind!=="user-desktop"?o86(O):O,L=w.headers.get("content-type")??"application/json";return new Response(D,{status:w.status,headers:{"content-type":L,...cG}})};try{if(N){let w=U();return w.catch(()=>{}),await Promise.race([w,new Promise((D,L)=>{if(N.aborted)return L(N.reason);N.addEventListener("abort",()=>L(N.reason),{once:!0})})])}return await U()}catch(w){let O=w instanceof Error?w.message:String(w);return $.json({error:`Daemon unreachable: ${O}`},502)}}function o86($){try{let Z=JSON.parse($);if(Z&&typeof Z==="object"&&!Array.isArray(Z)&&"repoDir"in Z)return JSON.stringify({...Z,repoDir:null})}catch{}return $}async function Aj0($,Z,X,Q="GET",G){let Y=await $.proxyDaemonRequest(Z,X,{method:Q,headers:new Headers,body:null});if(Y.status===404&&G){try{await Y.body?.cancel()}catch{}if(await $.adoptLiveClaim?.(G,Z))Y=await $.proxyDaemonRequest(Z,X,{method:Q,headers:new Headers,body:null})}if(Y.status===404){try{await Y.body?.cancel()}catch{}throw Error("SANDBOX_GONE")}let J=await Y.text();if(!Y.ok){let W=`Daemon error (${Y.status})`;try{W=JSON.parse(J).error??W}catch{}throw Error(W)}return JSON.parse(J)}function r86($){return Kv$.includes($)}var m86,Jv$=524288,n86=65536,p86=1e4,Wv$=2000,t86,Pj0,cG,Kv$,Hv$=()=>{let $=new B1;return $.use("/:virtualMcpId/:branch/*",t86),$.post("/:virtualMcpId/:branch/write",(Z)=>fZ(Z,"/_sandbox/write",{forwardJsonBody:!0,signal:lC(Z)})),$.post("/:virtualMcpId/:branch/unlink",(Z)=>fZ(Z,"/_sandbox/unlink",{forwardJsonBody:!0,signal:lC(Z)})),$.post("/:virtualMcpId/:branch/mkdir",(Z)=>fZ(Z,"/_sandbox/mkdir",{forwardJsonBody:!0,signal:lC(Z)})),$.post("/:virtualMcpId/:branch/rename",(Z)=>fZ(Z,"/_sandbox/rename",{forwardJsonBody:!0,signal:lC(Z)})),$.post("/:virtualMcpId/:branch/read",(Z)=>fZ(Z,"/_sandbox/read",{forwardJsonBody:!0,signal:lC(Z)})),$.post("/:virtualMcpId/:branch/glob",(Z)=>fZ(Z,"/_sandbox/glob",{forwardJsonBody:!0,signal:lC(Z)})),$.post("/:virtualMcpId/:branch/grep",(Z)=>fZ(Z,"/_sandbox/grep",{forwardJsonBody:!0,signal:lC(Z)})),$.post("/:virtualMcpId/:branch/exec/:script",async(Z)=>{let X=Z.req.param("script");if(!X)return Z.json({error:"missing script name"},400);return fZ(Z,`/_sandbox/exec/${encodeURIComponent(X)}`)}),$.post("/:virtualMcpId/:branch/exec/:script/kill",async(Z)=>{let X=Z.req.param("script");if(!X)return Z.json({error:"missing script name"},400);return fZ(Z,`/_sandbox/exec/${encodeURIComponent(X)}/kill`)}),$.get("/:virtualMcpId/:branch/config",(Z)=>fZ(Z,"/_sandbox/config",{method:"GET",map404to410:!0,redactRepoDirUnlessDesktop:!0})),$.put("/:virtualMcpId/:branch/config",(Z)=>fZ(Z,"/_sandbox/config",{method:"PUT",forwardJsonBody:!0,map404to410:!0})),$.post("/:virtualMcpId/:branch/setup/:step",async(Z)=>{let X=Z.req.param("step");if(!X||!r86(X))return Z.json({error:`step must be one of: ${Kv$.join(", ")}`},400);if(X==="start"){let Q=Z.get("vmClaim");if(Q.runner){let G=r(Z.var.studioContext),Y=rF0(Q.virtualMcpMetadata);try{await sF0({ctx:Z.var.studioContext,runner:Q.runner,handle:Q.claimName,orgId:G.id,userId:Q.callerUserId,entries:Y})}catch(J){let W=J instanceof Error?J.message:String(J);return Z.json({error:`Failed to push env to daemon: ${W}`},502)}}}return fZ(Z,`/_sandbox/setup/${X}`,{signal:Z.req.raw.signal,map404to410:!0})}),$.get("/:virtualMcpId/:branch/events",(Z)=>{let X=Z.get("vmClaim");if(!X.runner)return QF(Z,async(Q)=>{await Q.writeSSE({event:"phase",data:JSON.stringify({kind:"failed",reason:"unknown",message:"No sandbox runner configured on this studio instance."})})});return i_$(Z,{ctx:Z.var.studioContext,claimName:X.claimName,runner:X.runner,virtualMcpId:X.virtualMcpId,branch:X.branch,userId:X.userId,projectRef:X.projectRef,virtualMcpMetadata:X.virtualMcpMetadata})}),$.get("/:virtualMcpId/:branch/git/status",(Z)=>fZ(Z,"/_sandbox/git/status",{method:"GET",map404to410:!0,signal:AbortSignal.any([Z.req.raw.signal,AbortSignal.timeout(Wv$)])})),$.post("/:virtualMcpId/:branch/git/status",(Z)=>fZ(Z,"/_sandbox/git/status",{map404to410:!0,signal:AbortSignal.any([Z.req.raw.signal,AbortSignal.timeout(Wv$)])})),$.post("/:virtualMcpId/:branch/git/diff",(Z)=>fZ(Z,"/_sandbox/git/diff",{forwardJsonBody:!0,map404to410:!0})),$.post("/:virtualMcpId/:branch/git/publish",async(Z)=>{let X=dC(Z);if(X instanceof Response)return X;let{claimName:Q,virtualMcpMetadata:G,connectionIds:Y}=Z.get("vmClaim"),J=Z.var.studioContext;return J41(Q,async()=>{try{await a81(J,X,Q);let W=Qv$(G,Y);if(W)await Gv$(J,X,Q,W)}catch(W){if(W instanceof ig)return Z.json({error:W.message},403,cG);let K=W instanceof Error?W.message:String(W);return Z.json({error:K},502,cG)}return fZ(Z,"/_sandbox/git/publish",{forwardJsonBody:!0,map404to410:!0})})}),$.post("/:virtualMcpId/:branch/git/discard",(Z)=>{let{claimName:X}=Z.get("vmClaim");return J41(X,()=>fZ(Z,"/_sandbox/git/discard",{forwardJsonBody:!0,map404to410:!0}))}),$.post("/:virtualMcpId/:branch/git/rebase",async(Z)=>{let X=dC(Z);if(X instanceof Response)return X;let{claimName:Q}=Z.get("vmClaim"),G=Z.var.studioContext;return J41(Q,async()=>{try{await a81(G,X,Q)}catch(Y){let J=Y instanceof Error?Y.message:String(Y);return Z.json({error:J},502,cG)}return fZ(Z,"/_sandbox/git/rebase",{forwardJsonBody:!0,map404to410:!0})})}),$.post("/:virtualMcpId/:branch/git/suggest-commit",HZ({maxSize:Jv$,onError:(Z)=>Z.json({error:"Payload too large"},413,cG)}),async(Z)=>{let X=dC(Z);if(X instanceof Response)return X;let{claimName:Q,userId:G,projectRef:Y}=Z.get("vmClaim"),J=Z.var.studioContext;try{let W=await Z.req.json().catch(()=>({})),K=W.status,H=W.diff,N=H!=null&&typeof H.diffs==="object"&&H.diffs!==null,[F,U]=$41(K)&&N?[K,H]:await Promise.all([Aj0(X,Q,"/_sandbox/git/status","GET",{userId:G,projectRef:Y}),Aj0(X,Q,"/_sandbox/git/diff","GET",{userId:G,projectRef:Y})]),w=await r_$(J,F,U);return Z.json(w,200,cG)}catch(W){let K=W instanceof Error?W.message:String(W);if(K==="SANDBOX_GONE")return Z.json({error:"Sandbox handle is gone. The sandbox needs to be re-provisioned."},410,cG);return Z.json({error:K},502,cG)}}),$.post("/:virtualMcpId/:branch/git/judge-review",HZ({maxSize:Jv$,onError:(Z)=>Z.json({error:"Payload too large"},413,cG)}),async(Z)=>{let X=dC(Z);if(X instanceof Response)return X;let{claimName:Q,userId:G,projectRef:Y}=Z.get("vmClaim"),J=Z.var.studioContext;try{let W=await Z.req.json().catch(()=>({})),K=W.status,H=W.diff,N=H!=null&&typeof H.diffs==="object"&&H.diffs!==null,[F,U]=$41(K)&&N?[K,H]:await Promise.all([Aj0(X,Q,"/_sandbox/git/status","GET",{userId:G,projectRef:Y}),Aj0(X,Q,"/_sandbox/git/diff","GET",{userId:G,projectRef:Y})]),w=await s_$(J,F,U,typeof W.language==="string"?W.language:void 0);return Z.json(w,200,cG)}catch(W){let K=W instanceof Error?W.message:String(W);if(K==="SANDBOX_GONE")return Z.json({error:"Sandbox handle is gone. The sandbox needs to be re-provisioned."},410,cG);return Z.json({error:K},502,cG)}}),$.get("/:virtualMcpId/:branch/preview-fetch",async(Z)=>{let X=dC(Z);if(X instanceof Response)return X;let{claimName:Q}=Z.get("vmClaim"),G=Z.req.query("path");if(!G||!G.startsWith("/")||G.startsWith("//")||G.includes("..")||G.includes("\\"))return Z.json({error:"Path not allowed"},403);let Y;try{Y=await X.getPreviewUrl(Q)}catch{return Z.json({error:"Preview not available"},502)}if(!Y)return Z.json({error:"Preview not available"},502);let J=Y.replace(/\/+$/,""),W=Y41(`${J}${G}`),K;try{K=await fetch(W?.url??`${J}${G}`,{...W?{headers:{host:W.hostHeader}}:{}})}catch{return Z.json({error:"Preview unreachable"},502)}let H;try{H=await K.text()}catch{return Z.json({error:"Preview unreachable"},502)}return new Response(H,{status:K.status,headers:{"content-type":K.headers.get("content-type")??"application/json"}})}),$.post("/:virtualMcpId/:branch/preview-invoke",HZ({maxSize:n86,onError:(Z)=>Z.json({error:"Payload too large"},413)}),async(Z)=>{let X=dC(Z);if(X instanceof Response)return X;let{claimName:Q}=Z.get("vmClaim"),G;try{G=await X.getPreviewUrl(Q)}catch{return Z.json({error:"Preview not available"},502)}if(!G)return Z.json({error:"Preview not available"},502);let Y;try{Y=await Z.req.json()}catch{return Z.json({error:"Invalid JSON body"},400)}if(!Y||typeof Y!=="object"||Array.isArray(Y))return Z.json({error:"Invalid JSON body"},400);let J=$v$(Y);if(!J)return Z.json({error:"Invalid or missing __resolveType"},400);let W=Zv$(G,J.resolveType),K=Y41(W),H;try{H=await fetch(K?.url??W,{method:"POST",headers:{"content-type":"application/json",...K?{host:K.hostHeader}:{}},body:JSON.stringify(J.payload),signal:AbortSignal.timeout(30000)})}catch{return Z.json({error:"Preview unreachable"},502)}let N;try{N=await H.text()}catch{return Z.json({error:"Preview unreachable"},502)}return new Response(N,{status:H.status,headers:{"content-type":H.headers.get("content-type")??"application/json"}})}),$};var Nv$=B(()=>{y8();mO();mg();c_$();GN();d_$();j3();gw();m_$();n_$();vd0();_i();Q41();e_$();Xv$();Yv$();m86=/^[a-zA-Z0-9][a-zA-Z0-9/._-]*$/;t86=u_$(async($,Z)=>{let X=$.var.studioContext;try{Z0(X)}catch{return $.json({error:"Unauthorized"},401)}let Q=W1(X);if(!Q)return $.json({error:"Unauthorized"},401);let G;try{G=r(X)}catch{return $.json({error:"Organization scope required"},403)}let Y=$.req.param("virtualMcpId"),J=$.req.param("branch");if(!Y||!J)return $.json({error:"virtualMcpId and branch are required"},400);try{i86(J)}catch(w){let O=w instanceof Error?w.message:String(w);return $.json({error:O},400)}let W=await X.storage.virtualMcps.findById(Y);if(!W||W.organization_id!==G.id)return $.json({error:"Virtual MCP not found"},404);let K=em({orgId:G.id,virtualMcpId:Y,branch:J}),H=await ON(X,J,Q),N=l_$({userId:H,projectRef:K}),F=W.metadata??null,U;try{U=(await uX(X,{userId:H,branch:J,virtualMcpMetadata:F})).provider}catch{U=null}if(!U)return $.json({error:"No sandbox runner found"},404);return $.set("vmClaim",{claimName:N,callerUserId:Q,runner:U,virtualMcpId:Y,branch:J,userId:H,projectRef:K,virtualMcpMetadata:F,connectionIds:W.connections?.map((w)=>w.connection_id)??[]}),Z()});Pj0=new Map;cG={"Cache-Control":"no-store, no-cache, must-revalidate",Pragma:"no-cache"};Kv$=["clone","install","start"]});var Fv$=($)=>{let Z=new B1;if(Z.use("*",vC),Z.route("/",yE0()),Z.route("/",RS$()),Z.route("/",M_$()),Z.route("/",R_$()),Z.route("/",Lj0()),Z.route("/tools",b_$()),Z.route("/",C_$()),Z.route("/",J_$({kvStorage:$.kvStorage})),Z.route("/",G_$()),Z.route("/fs",L_$({getConnection:$.getNatsConnection})),Z.route("/sandbox",Hv$()),Z.route("/",P_$()),Z.route("/deco-sites",hE0()),Z.route("/sso",CE0()),Z.route("/",Ej0({tokenStorage:$.tokenStorage,automationEventDispatcher:$.automationEventDispatcher})),Z.route("/webhooks",DS$()),$.mountDevAssets)Z.route("/dev-assets",uE0({orgFromPath:!0}));return Z.use("/mcp/:connectionId?",$.mcpAuth),Z.use("/mcp/:connectionId/ui-resource",$.mcpAuth),Z.use("/mcp/gateway/:virtualMcpId?",$.mcpAuth),Z.use("/mcp/virtual-mcp/:virtualMcpId?",$.mcpAuth),Z.use("/mcp/self",$.mcpAuth),Z.use("/mcp/task-run/:threadId",$.mcpAuth),Z.route("/",OM$()),Z.get("/mcp/:gateway?/:connectionId/.well-known/oauth-protected-resource/*",$.betterAuthProtectedResourceHandler),Z.get("/mcp/.well-known/oauth-protected-resource",$.betterAuthProtectedResourceHandler),Z.route("/mcp/task-run",j_$()),Z.route("/mcp",$O0()),Z.route("/mcp/self",Dj0()),Z.route("/mcp",QO0()),Z.all("/oauth-proxy/:connectionId/*",$.oauthProxyHandler),Z.get("/watch",$.watchHandler),Z};var Uv$=B(()=>{y8();L$1();LS$();A$1();cE0();Ho();B$1();Y_$();W_$();E_$();Pn();W$1();GO0();d81();z_$();A_$();I_$();k_$();__$();i81();f_$();n81();ZO0();Nv$()});function s86($){return $.filter((Z)=>Z.vendors?.alias).map((Z)=>({name:Z.name,title:Z.title,description:Z.description,logo:Z.logo,category:Z.category,vendor:{alias:Z.vendors.alias,url:Z.vendors.url}}))}async function e86($,Z){let X=await fetch(`${$}/rest/v1/apps?select=name,title,description,logo,category,vendors(alias,url)`,{headers:{apikey:Z,Authorization:`Bearer ${Z}`,Accept:"application/json"},signal:AbortSignal.timeout(a86)});if(!X.ok){let Q=await X.text().catch(()=>X.statusText);throw console.error(`[deco-apps] Supabase error (${X.status}): ${Q.slice(0,200)}`),Error(`External service error (${X.status})`)}return await X.json()}var a86=1e4,$46=async($,Z)=>{if(!$.get("studioContext").auth.user?.id)return $.json({error:"Unauthorized"},401);return Z()},wv$=()=>{let $=new B1;return $.use("*",$46),$.get("/",async(Z)=>{let X=c0(),Q=X.decoSupabaseUrl,G=X.decoSupabaseServiceKey;if(!Q||!G)return Z.json({apps:[]});try{let Y=await e86(Q,G);return Z.json({apps:s86(Y)})}catch(Y){return console.error("[deco-apps] GET error:",Y),Z.json({error:"Failed to fetch apps"},502)}}),$};var Ov$=B(()=>{y8();S$()});import{z as M1}from"zod";function cK($,Z="invalid_request_error",X=null,Q=null){return{error:{message:$,type:Z,param:X,code:Q}}}function N46($){if(!$)return null;let Z=$.indexOf(":");if(Z===-1)return{credentialId:null,modelId:$};let X=$.substring(0,Z),Q=$.substring(Z+1);if(!X||!Q)return null;return{credentialId:X,modelId:Q}}function F46($,Z,X){try{return JSON.parse($)}catch{throw new Lv$(`Invalid JSON in tool call arguments for function '${X}' (tool_call_id: ${Z}): ${$}`)}}function U46($){let Z={};for(let X of $)if(X.role==="assistant"&&X.tool_calls)for(let Q of X.tool_calls)Z[Q.id]=Q.function.name;return $.map((X)=>{switch(X.role){case"system":return{role:"system",content:X.content};case"user":if(typeof X.content==="string")return{role:"user",content:X.content};return{role:"user",content:X.content.map((G)=>{if(G.type==="text")return{type:"text",text:G.text};return{type:"image",image:G.image_url.url}})};case"assistant":if(X.tool_calls&&X.tool_calls.length>0)return{role:"assistant",content:X.tool_calls.map((G)=>({type:"tool-call",toolCallId:G.id,toolName:G.function.name,input:F46(G.function.arguments,G.id,G.function.name)}))};return{role:"assistant",content:X.content??""};case"tool":let Q=Z[X.tool_call_id]??"unknown";return{role:"tool",content:[{type:"tool-result",toolCallId:X.tool_call_id,toolName:Q,output:{type:"text",value:X.content}}]}}})}function w46($){let Z=$.map((X)=>{let Q=X.function.parameters?PG(X.function.parameters):PG({type:"object",properties:{}});return[X.function.name,_$({description:X.function.description,inputSchema:Q})]});return Object.fromEntries(Z)}function O46($){if(!$)return;return{openai:{response_format:$}}}function B46(){return`chatcmpl-${crypto.randomUUID().replace(/-/g,"").substring(0,29)}`}function Bv$($,Z,X,Q,G,Y){let J={model:$,messages:Z,tools:X,temperature:Q.temperature,maxTokens:Q.max_tokens,topP:Q.top_p,frequencyPenalty:Q.frequency_penalty,presencePenalty:Q.presence_penalty,stopSequences:Q.stop?Array.isArray(Q.stop)?Q.stop:[Q.stop]:void 0,abortSignal:Y};return G?{...J,providerOptions:G}:J}function Dv$($){if($==="tool-calls")return"tool_calls";if($==="length")return"length";return"stop"}var Z46=256,X46,Q46,G46,Y46,J46,W46,K46,H46,Lv$,Ev$,jv$;var zv$=B(()=>{k4();y8();mg();xN();X46=M1.object({type:M1.literal("function"),function:M1.object({name:M1.string(),description:M1.string().optional(),parameters:M1.record(M1.string(),M1.unknown()).optional()})}),Q46=M1.object({id:M1.string(),type:M1.literal("function"),function:M1.object({name:M1.string(),arguments:M1.string()})}),G46=M1.discriminatedUnion("role",[M1.object({role:M1.literal("system"),content:M1.string(),name:M1.string().optional()}),M1.object({role:M1.literal("user"),content:M1.union([M1.string(),M1.array(M1.union([M1.object({type:M1.literal("text"),text:M1.string()}),M1.object({type:M1.literal("image_url"),image_url:M1.object({url:M1.string(),detail:M1.string().optional()})})]))]),name:M1.string().optional()}),M1.object({role:M1.literal("assistant"),content:M1.string().nullable().optional(),name:M1.string().optional(),tool_calls:M1.array(Q46).optional()}),M1.object({role:M1.literal("tool"),content:M1.string(),tool_call_id:M1.string()})]),Y46=M1.object({type:M1.literal("text")}),J46=M1.object({type:M1.literal("json_object")}),W46=M1.object({type:M1.literal("json_schema"),json_schema:M1.object({name:M1.string(),description:M1.string().optional(),schema:M1.record(M1.string(),M1.unknown()),strict:M1.boolean().optional()})}),K46=M1.union([Y46,J46,W46]),H46=M1.object({model:M1.string().describe("Format: 'model_id' or 'credential_id:model_id'"),messages:M1.array(G46),stream:M1.boolean().optional().default(!1),temperature:M1.number().min(0).max(2).optional(),max_tokens:M1.number().positive().optional(),top_p:M1.number().min(0).max(1).optional(),frequency_penalty:M1.number().min(-2).max(2).optional(),presence_penalty:M1.number().min(-2).max(2).optional(),stop:M1.union([M1.string(),M1.array(M1.string())]).optional(),tools:M1.array(X46).optional(),tool_choice:M1.union([M1.literal("auto"),M1.literal("none"),M1.literal("required"),M1.object({type:M1.literal("function"),function:M1.object({name:M1.string()})})]).optional(),response_format:K46.optional(),user:M1.string().optional()});Lv$=class Lv$ extends Error{constructor($){super($);this.name="MessageConversionError"}};Ev$=new B1;Ev$.post("/:org/v1/chat/completions",async($)=>{let Z=$.get("studioContext"),X=$.req.param("org");try{if(!Z.auth.apiKey?.id)return $.json(cK("API key authentication required. Provide a valid API key via Authorization header.","authentication_error"),401);if(!Z.organization)return $.json(cK("Organization context is required. Ensure your API key has organization metadata.","invalid_request_error","organization"),400);if((Z.organization.slug??Z.organization.id)!==X)return $.json(cK("Organization mismatch. The API key's organization does not match the requested organization.","invalid_request_error","organization"),403);let Q=await $.req.json(),G=H46.safeParse(Q);if(!G.success){let L=G.error.issues[0]??{message:"Invalid request",path:[]};return $.json(cK(`Invalid request: ${L.message}`,"invalid_request_error",L.path.length>0?L.path.join("."):null),400)}let Y=G.data,J=N46(Y.model);if(!J)return $.json(cK("Invalid model format. Expected 'model_id' or 'credential_id:model_id' (e.g., 'claude-sonnet-4-6' or 'key_abc123:claude-sonnet-4-6')","invalid_request_error","model"),400);let{credentialId:W}=J,{modelId:K}=J;if(!W){let E=(await Z.storage.aiProviderKeys.list({organizationId:Z.organization.id})).find((j)=>QD(j.providerId));if(!E)return $.json(cK("No AI provider credentials configured for this organization. Add a credential in settings or specify one explicitly via 'credential_id:model_id'.","invalid_request_error","model"),400);W=E.id}let H;try{H=await Z.aiProviders.activate(W,Z.organization.id)}catch{return $.json(cK(`AI provider credential not found or inaccessible: ${W}`,"invalid_request_error","model"),404)}let N=H.aiSdk.languageModel(K),F=U46(Y.messages),U=Y.tools?w46(Y.tools):void 0,w=O46(Y.response_format),O=B46(),D=Math.floor(Date.now()/1000);if(Y.stream)return QF($,async(L)=>{let E=Bv$(N,F,U,Y,w,$.req.raw.signal);try{let j=Aw(E),z=!1,A=0,P="",M=async()=>{if(P.length===0)return;let k=P;P="",await L.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:D,model:Y.model,choices:[{index:0,delta:{content:k},finish_reason:null}]})})};for await(let k of j.fullStream){if(!z&&(k.type==="text-delta"||k.type==="tool-call"))await L.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:D,model:Y.model,choices:[{index:0,delta:{role:"assistant",content:""},finish_reason:null}]})}),z=!0;if(k.type==="text-delta"){if(P+=k.text,P.length>=Z46)await M()}else if(k.type==="tool-call"){await M();let q=A++;await L.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:D,model:Y.model,choices:[{index:0,delta:{tool_calls:[{index:q,id:k.toolCallId,type:"function",function:{name:k.toolName,arguments:JSON.stringify(k.input)}}]},finish_reason:null}]})})}else if(k.type==="finish")await M(),await L.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:D,model:Y.model,choices:[{index:0,delta:{},finish_reason:Dv$(k.finishReason)}],usage:k.totalUsage?{prompt_tokens:k.totalUsage.inputTokens??0,completion_tokens:k.totalUsage.outputTokens??0,total_tokens:k.totalUsage.totalTokens??0}:void 0})})}await M(),await L.writeSSE({data:"[DONE]"})}catch(j){let z=j;console.error("[openai-compat:stream] Error:",z.message),await L.writeSSE({data:JSON.stringify({error:{message:z.message,type:"server_error"}})})}});else{let L=Bv$(N,F,U,Y,w,$.req.raw.signal),E=await zw(L),j={role:"assistant",content:E.text||null};if(E.toolCalls&&E.toolCalls.length>0)j.tool_calls=E.toolCalls.map((z)=>({id:z.toolCallId,type:"function",function:{name:z.toolName,arguments:JSON.stringify("input"in z?z.input:{})}})),j.content=null;return $.json({id:O,object:"chat.completion",created:D,model:Y.model,choices:[{index:0,message:j,finish_reason:Dv$(E.finishReason)}],usage:{prompt_tokens:E.usage?.inputTokens??0,completion_tokens:E.usage?.outputTokens??0,total_tokens:E.usage?.totalTokens??0}})}}catch(Q){let G=Q;if(G.name==="AbortError")return $.json(cK("Request aborted","invalid_request_error"),400);if(G.name==="MessageConversionError")return $.json(cK(G.message,"invalid_request_error","messages"),400);return console.error("[openai-compat] Error:",G.message,G.stack),$.json(cK(G.message,"server_error"),500)}});jv$=Ev$});var Av$;var Pv$=B(()=>{Av$={name:"decocms",version:"4.204.9",description:"Deco CMS \u2014 Self-hostable MCP Gateway for managing AI connections and tools",author:"Deco team",repository:{type:"git",url:"git+https://github.com/decocms/studio.git",directory:"apps/api"},bugs:{url:"https://github.com/decocms/studio/issues"},type:"module",bin:{deco:"./dist/server/cli.js"},files:["dist/**/*"],scripts:{dev:"bun run migrate && bun run dev:server","dev:server":"bun run --cwd=../../packages/sandbox build && NODE_ENV=development bun --env-file=.env --hot run src/index.ts",build:"bun run build:server","build:server":"bun run scripts/bundle-server-script.ts --dist ./dist/server","generate:tool-contracts":"bun run scripts/generate-tool-contracts.ts","db:migrate":"bun run ./dist/server/migrate.js",check:"tsc --noEmit",start:"bun run ./dist/server/server.js",migrate:"bun run src/database/migrate.ts",test:"bun test src","better-auth:migrate":"bunx --bun @better-auth/cli migrate -y --config src/auth/index.ts",prepublishOnly:"bun run --cwd=../.. build:studio"},optionalDependencies:{"@duckdb/node-api":"^1.5.0-r.1"},dependencies:{"@ai-sdk/anthropic":"^3.0.85","@ai-sdk/google":"^3.0.83","@ai-sdk/openai":"^3.0.73","@anthropic-ai/sdk":"^0.105.0","@aws-sdk/client-s3":"^3.1013.0","@aws-sdk/client-sts":"^3.1013.0","@aws-sdk/lib-storage":"^3.1013.0","@aws-sdk/s3-request-presigner":"^3.1013.0","@clickhouse/client":"^1.8.1","@dbos-inc/dbos-sdk":"^4.21.6","@inkjs/ui":"^2.0.0","@nats-io/jetstream":"3.4.0","@nats-io/kv":"3.4.0","@nats-io/nats-core":"3.4.0","@nats-io/transport-node":"3.4.0","@openrouter/ai-sdk-provider":"^2.9.1","@opentelemetry/core":"^2.6.0","embedded-postgres":"^18.3.0-beta.16",ink:"^6.8.0",kysely:"^0.28.12","posthog-node":"^5.0.0",react:"^19.2.6","react-dom":"^19.2.6"},devDependencies:{"@ai-sdk/provider":"^3.0.10","@better-auth/sso":"1.4.1","@decocms/better-auth":"1.5.17","@decocms/bindings":"workspace:*","@decocms/mcp-utils":"workspace:*","@decocms/runtime":"workspace:*","@decocms/sandbox":"workspace:*","@decocms/shared":"workspace:*","@jitl/quickjs-wasmfile-release-sync":"0.31.0","@modelcontextprotocol/sdk":"1.29.0","@nats-io/jwt":"0.0.10-5","@opentelemetry/api":"^1.9.0","@opentelemetry/api-logs":"^0.211.0","@opentelemetry/exporter-logs-otlp-proto":"^0.211.0","@opentelemetry/exporter-prometheus":"^0.208.0","@opentelemetry/exporter-trace-otlp-proto":"^0.207.0","@opentelemetry/instrumentation-runtime-node":"^0.24.0","@opentelemetry/resources":"^2.6.0","@opentelemetry/sdk-logs":"^0.211.0","@opentelemetry/sdk-metrics":"^2.2.0","@opentelemetry/sdk-node":"^0.207.0","@opentelemetry/sdk-trace-base":"^2.5.0","@types/bun":"^1.3.1","@types/google.maps":"^3.65.2","@types/pg":"^8.15.6","@types/react-syntax-highlighter":"^15.5.13","@vercel/nft":"^1.1.1",ai:"^6.0.208","better-auth":"1.4.22",croner:"^9.1.0",degit:"^2.8.4",hono:"^4.10.7",jose:"^6.0.11",nanoid:"^5.1.6",pg:"^8.16.3",typescript:"^7.0.2",typescript5:"npm:typescript@^5.9.3",zod:"4.3.6"},homepage:"https://github.com/decocms/studio",keywords:["mcp","model-context-protocol","ai","gateway","self-hosted","tools"],license:"MIT",publishConfig:{access:"public"}}});function E46(){let $=process.env.POSTHOG_KEY;if(!$)return null;return{key:$,host:process.env.POSTHOG_HOST??L46}}var Tv$,L46="https://ph.studio.decocms.com",Rv$;var Iv$=B(()=>{y8();hx0();MV();jZ();S$();X$1();Pv$();Tv$=new B1;Tv$.get("/",($)=>{let Z={version:Av$.version,theme:Gu1(),...pD().logo&&{logo:pD().logo},...UK()&&{internalUrl:vq1()},...c0().enableDecoImport&&{enableDecoImport:!0},brandExtractEnabled:!!c0().firecrawlApiKey,auth:bk$(),posthog:E46(),googleMapsApiKey:process.env.GOOGLE_MAPS_API_KEY?.trim()||null,runtime:{agentSandbox:!UK()&&c0().sandboxProviderKind==="agent-sandbox"}};return $.header("Cache-Control","no-store"),$.json({success:!0,config:Z})});Rv$=Tv$});function ng($){let Z=($??"").trim().toLowerCase();return Z=Z.replace(/^https?:\/\//,""),Z=Z.replace(/^www\./,""),Z=Z.split(/[/?#]/)[0]??"",Z.replace(/\/+$/,"")}function W41($){return(ng($).split(".")[0]||$).replace(/[-_]/g," ").split(" ").filter(Boolean).map((X)=>X.charAt(0).toUpperCase()+X.slice(1)).join(" ")}function Mv$($,Z=64){return`https://www.google.com/s2/favicons?domain=${encodeURIComponent(ng($))}&sz=${Z}`}function qv$($,Z){let X=$.trim();if(X.length<=Z)return X;let Q=X.slice(0,Z-1),G=Q.lastIndexOf(" ");return`${(G>Z*0.6?Q.slice(0,G):Q).trimEnd()}\u2026`}function kv$($){let{brand:Z,domain:X,score:Q,verdict:G}=$,Y=typeof Q==="number"?`${Z} commerce report \u2014 ${Math.round(Q)}/100 \xB7 decocms`:`${Z} commerce report \xB7 decocms`,J=`See the full ${Z} scorecard \u2014 SEO, performance, conversion & AEO signals scored by decocms.`,W=G?.trim()?qv$(`${G.trim().replace(/\s+/g," ")} \u2014 ${J}`,200):qv$(`How does ${X} really perform? ${J}`,200);return{title:Y,description:W}}import{z as l0}from"zod";var mC,j46,z46,P46,A46,Sv$;var Vv$=B(()=>{mC=l0.enum(["good","bad","neutral"]),j46=l0.preprocess(($)=>{if(Array.isArray($))return{kind:"text",value:$.find((X)=>X!==null&&typeof X!=="object")??""};return $!==null&&typeof $==="object"?$:{kind:"text",value:$}},l0.object({kind:l0.enum(["text","number","sparkline","badge","score"]).catch("text"),value:l0.coerce.string().optional(),tone:mC.optional(),muted:l0.boolean().optional(),delta:l0.coerce.string().optional(),deltaDir:l0.enum(["up","down","neutral"]).optional(),points:l0.array(l0.coerce.number()).optional(),label:l0.coerce.string().optional()}).transform(($)=>{if($.kind==="badge"&&$.label==null)$.label=$.value??"";if($.kind==="score"){let Z=Number($.value);if(Number.isNaN(Z))return{...$,kind:"text"}}return $})),z46=l0.preprocess(($)=>{let Z=$;if(Z&&typeof Z==="object"&&!Array.isArray(Z)&&Array.isArray(Z.cells))Z=Z.cells;if(Array.isArray(Z)&&Z.length===1&&Array.isArray(Z[0]))Z=Z[0];if(Array.isArray(Z))return Z;if(Z&&typeof Z==="object")return Object.values(Z);return Z},l0.array(j46)),P46={key:l0.coerce.string(),title:l0.coerce.string(),eyebrow:l0.coerce.string().optional(),headline:l0.coerce.string(),annotation:l0.coerce.string().optional(),methodology:l0.coerce.string().optional(),sources:l0.array(l0.object({name:l0.coerce.string(),logoUrl:l0.coerce.string()})).optional()},A46=l0.discriminatedUnion("template",[l0.object({template:l0.literal("cover"),score:l0.object({value:l0.coerce.number(),max:l0.coerce.number().optional(),grade:l0.coerce.string().optional(),label:l0.coerce.string().optional()}).optional(),brandImage:l0.coerce.string().optional(),screenshot:l0.coerce.string().optional(),mobileScreenshot:l0.coerce.string().optional()}),l0.object({template:l0.literal("cta"),ctaUrl:l0.coerce.string().optional(),ctaLabel:l0.coerce.string().optional(),bullets:l0.array(l0.coerce.string()).optional()}),l0.object({template:l0.literal("series"),points:l0.array(l0.coerce.number()).min(2),xLabels:l0.array(l0.coerce.string()).min(1),unit:l0.coerce.string().optional(),callout:l0.object({index:l0.coerce.number(),value:l0.coerce.string(),tone:mC.optional()})}),l0.object({template:l0.literal("threshold"),value:l0.coerce.string().default(""),metricLabel:l0.coerce.string().optional(),ratio:l0.coerce.number(),thresholdRatio:l0.coerce.number().optional(),thresholdLabel:l0.coerce.string().default(""),tone:mC.optional()}),l0.object({template:l0.literal("stats"),stats:l0.array(l0.object({value:l0.coerce.string(),label:l0.coerce.string(),tone:mC.optional()})).min(1)}),l0.object({template:l0.literal("bars"),items:l0.array(l0.object({value:l0.coerce.string(),label:l0.coerce.string(),ratio:l0.coerce.number(),tone:mC.optional()})).min(1)}),l0.object({template:l0.literal("gauges"),gauges:l0.array(l0.object({label:l0.coerce.string(),value:l0.coerce.string(),status:l0.enum(["good","warn","bad"]).catch("warn"),caption:l0.coerce.string().optional(),ratio:l0.coerce.number().optional()})).min(1)}),l0.object({template:l0.literal("checklist"),checks:l0.array(l0.object({label:l0.coerce.string(),status:l0.enum(["pass","fail","warn"]).catch("fail"),value:l0.coerce.string().optional()})).min(1)}),l0.object({template:l0.literal("table"),columns:l0.array(l0.object({label:l0.coerce.string(),align:l0.enum(["left","right"]).optional()})).min(1),rows:l0.array(z46).min(1),highlightRow:l0.coerce.number().optional()}),l0.object({template:l0.literal("products"),products:l0.array(l0.object({name:l0.coerce.string(),price:l0.coerce.string().optional(),image:l0.coerce.string().optional(),url:l0.coerce.string().optional()})).min(1)}),l0.object({template:l0.literal("list"),entries:l0.array(l0.object({label:l0.coerce.string(),severity:l0.enum(["error","warning","notice"]).catch("notice")})).min(1),moreCount:l0.coerce.number().optional()}),l0.object({template:l0.literal("keywords"),volumeLabel:l0.coerce.string().optional(),keywords:l0.array(l0.object({term:l0.coerce.string(),volume:l0.coerce.string(),position:l0.coerce.number().catch(0)})).min(1)}),l0.object({template:l0.literal("competitor"),metricLabel:l0.coerce.string().optional(),competitors:l0.array(l0.object({name:l0.coerce.string(),value:l0.coerce.string(),tone:mC.optional(),isYou:l0.boolean().optional()})).min(1)}),l0.object({template:l0.literal("scorecard"),rivalLabel:l0.coerce.string().optional(),dimensions:l0.array(l0.object({label:l0.coerce.string(),you:l0.coerce.string(),rival:l0.coerce.string().optional(),rivalName:l0.coerce.string().optional(),tone:mC.optional()})).min(1)})]),Sv$=l0.object({...P46,template:A46})});function Tj0($){let Z=[],X=[...$.sections].sort((G,Y)=>G.position-Y.position).map((G)=>{let Y=Sv$.safeParse(G.props);if(Y.success)return Y.data;let J=Y.error.issues[0];return Z.push({section_type:G.section_type,position:G.position,reason:J?`${J.path.join(".")||"(root)"}: ${J.message}`:"contract violation"}),null}).filter((G)=>G!==null),Q=X.filter((G)=>G.template.template!=="cover"&&G.template.template!=="cta").map((G)=>({key:G.key,title:G.title}));return{deck:{meta:{...$.meta,scores:$.summary?.scores,scannedAt:$.scanned_at,toc:Q},slides:X},drops:Z}}var K41=B(()=>{Vv$()});import{join as Cv$}from"path";async function R46($){try{let Z=await fetch(`${xW({})}/api/v2/public/diagnostics/${encodeURIComponent($)}`,{headers:{Accept:"application/json"},signal:AbortSignal.timeout(T46)});if(!Z.ok)return null;let X=await Z.json(),{deck:Q}=Tj0(X);if(!Q.slides.length)return null;let G=Q.slides.find((W)=>W.template.template==="cover"),Y=G?.template,J=Y&&Y.template==="cover"?Y:void 0;return{brand:Q.meta.brand?.trim()||W41($),score:Q.meta.scores?.cover??J?.score?.value,verdict:G?.annotation?.trim()||G?.headline?.trim()||void 0}}catch{return null}}function lG($){return $.replaceAll("&","&amp;").replaceAll("<","&lt;").replaceAll(">","&gt;").replaceAll('"',"&quot;")}function I46($,Z){let X=ng($),Q=Z?.brand?.trim()||W41(X),G=Mv$(X,128),J=`${(c0().baseUrl??"https://studio.decocms.com").replace(/\/+$/,"")}/report/${encodeURIComponent(X)}`,{title:W,description:K}=kv$({brand:Q,domain:X,score:Z?.score,verdict:Z?.verdict}),H=`${J}/og.png`,N=`${Q} commerce report by decocms`;return[`<title>${lG(W)}</title>`,`<meta name="description" content="${lG(K)}" />`,'<meta name="robots" content="noindex, follow" />','<meta property="og:type" content="website" />','<meta property="og:site_name" content="decocms" />',`<meta property="og:title" content="${lG(W)}" />`,`<meta property="og:description" content="${lG(K)}" />`,`<meta property="og:url" content="${lG(J)}" />`,`<meta property="og:image" content="${lG(H)}" />`,'<meta property="og:image:width" content="1200" />','<meta property="og:image:height" content="630" />',`<meta property="og:image:alt" content="${lG(N)}" />`,'<meta name="twitter:card" content="summary_large_image" />',`<meta name="twitter:title" content="${lG(W)}" />`,`<meta name="twitter:description" content="${lG(K)}" />`,`<meta name="twitter:image" content="${lG(H)}" />`,`<meta name="twitter:image:alt" content="${lG(N)}" />`,`<link rel="canonical" href="${lG(J)}" />`,`<link rel="icon" href="${lG(G)}" sizes="any" />`].join(`
+Respond with the structured verdict and a short reason.`,a_$;var e_$=B(()=>{k4();mw();Q41();g86=G41.object({requiresReview:G41.boolean().describe("true if the changes should go through pull-request review"),reason:G41.string().describe("One short sentence explaining the decision (max ~120 chars)")});a_$={requiresReview:!1,reason:""}});function l86($){if(!$||$.includes(".."))return!1;return c86.test($)}function $v$($){let Z=typeof $.__resolveType==="string"?$.__resolveType:null;if(!Z||!l86(Z))return null;let{__resolveType:X,...Q}=$;return{resolveType:Z,payload:Q}}function Zv$($,Z){return`${$.replace(/\/+$/,"")}/deco/invoke/${Z}`}var c86;var Xv$=B(()=>{c86=/^[\w./@-]+$/});function Y41($){let Z;try{Z=new URL($)}catch{return null}if(!Z.hostname.endsWith(".localhost"))return null;let X=Z.host;return Z.hostname="127.0.0.1",{url:Z.toString(),hostHeader:X}}function Qv$($,Z){let X=$?.githubRepo;if(!X?.owner||!X?.name)return null;if(!X.connectionId)return X;if(!Z.includes(X.connectionId))return null;return X}async function Gv$($,Z,X,Q){if(!Q.connectionId)throw new ig("Push requires a connected GitHub account. Connect mcp-github for this project and restart the sandbox.");let G=$.organization?.id;if(!G)throw new ig(d7);await Rw({ctx:$,connectionId:Q.connectionId,organizationId:G,forceRefresh:!0,onLegacyMintError:(N)=>{let F=N instanceof Error?N.message:d7;throw new ig(F)}});let{cloneUrl:Y,gitUserName:J,gitUserEmail:W}=await Iw(Q.connectionId,Q.owner,Q.name,$.db,$.vault),K=zj0($),H=await Z.proxyDaemonRequest(X,"/_sandbox/config",{method:"PUT",headers:new Headers({"content-type":"application/json"}),body:JSON.stringify({git:{repository:{cloneUrl:Y},identity:{userName:J,userEmail:W}},...K?{operator:K}:{}})});if(!H.ok){let N=await lw(H,d86).catch(()=>H.statusText);throw Error(`Failed to refresh sandbox git credentials (${H.status}): ${N}`)}}var d86=10485760,ig;var Yv$=B(()=>{YN();r81();bi();rf();ig=class ig extends Error{constructor($){super($);this.name="GitPushAuthError"}}});function i86($){let Z=$.startsWith("thread:")?$.slice(7):$;if(!Z||Z.length>255||Z.includes("..")||Z.startsWith("/")||Z.endsWith("/")||Z.endsWith(".lock")||!m86.test(Z))throw Error(`Invalid branch name: ${$}`)}function lC($){return AbortSignal.any([$.req.raw.signal,AbortSignal.timeout(p86)])}function dC($){let{runner:Z}=$.get("vmClaim");if(!Z)return $.json({error:"No sandbox runner configured"},503);return Z}function J41($,Z){let Q=(Pj0.get($)??Promise.resolve()).catch(()=>{}).then(Z),G=Q.catch(()=>{});return Pj0.set($,G),G.finally(()=>{if(Pj0.get($)===G)Pj0.delete($)}),Q}async function fZ($,Z,X){let Q=dC($);if(Q instanceof Response)return Q;let{claimName:G,userId:Y,projectRef:J}=$.get("vmClaim"),W=X?.method??"POST",K=null,H=new Headers;if(X?.jsonBody!==void 0)K=X.jsonBody,H.set("content-type","application/json");else if(X?.forwardJsonBody)K=await $.req.text(),H.set("content-type","application/json");let N=X?.signal,F={method:W,headers:H,body:K,...N?{signal:N}:{}},U=async()=>{let w=await Q.proxyDaemonRequest(G,Z,F);if(X?.map404to410&&w.status===404){try{await w.body?.cancel()}catch{}if(await Q.adoptLiveClaim?.({userId:Y,projectRef:J},G))w=await Q.proxyDaemonRequest(G,Z,F);if(w.status===404){try{await w.body?.cancel()}catch{}return new Response(JSON.stringify({error:"Sandbox handle is gone. The sandbox needs to be re-provisioned."}),{status:410,headers:{"content-type":"application/json",...cG}})}}let O=await w.text(),D=X?.redactRepoDirUnlessDesktop&&Q.kind!=="user-desktop"?o86(O):O,L=w.headers.get("content-type")??"application/json";return new Response(D,{status:w.status,headers:{"content-type":L,...cG}})};try{if(N){let w=U();return w.catch(()=>{}),await Promise.race([w,new Promise((D,L)=>{if(N.aborted)return L(N.reason);N.addEventListener("abort",()=>L(N.reason),{once:!0})})])}return await U()}catch(w){let O=w instanceof Error?w.message:String(w);return $.json({error:`Daemon unreachable: ${O}`},502)}}function o86($){try{let Z=JSON.parse($);if(Z&&typeof Z==="object"&&!Array.isArray(Z)&&"repoDir"in Z)return JSON.stringify({...Z,repoDir:null})}catch{}return $}async function Aj0($,Z,X,Q="GET",G){let Y=await $.proxyDaemonRequest(Z,X,{method:Q,headers:new Headers,body:null});if(Y.status===404&&G){try{await Y.body?.cancel()}catch{}if(await $.adoptLiveClaim?.(G,Z))Y=await $.proxyDaemonRequest(Z,X,{method:Q,headers:new Headers,body:null})}if(Y.status===404){try{await Y.body?.cancel()}catch{}throw Error("SANDBOX_GONE")}let J=await Y.text();if(!Y.ok){let W=`Daemon error (${Y.status})`;try{W=JSON.parse(J).error??W}catch{}throw Error(W)}return JSON.parse(J)}function r86($){return Kv$.includes($)}var m86,Jv$=524288,n86=65536,p86=1e4,Wv$=2000,t86,Pj0,cG,Kv$,Hv$=()=>{let $=new B1;return $.use("/:virtualMcpId/:branch/*",t86),$.post("/:virtualMcpId/:branch/write",(Z)=>fZ(Z,"/_sandbox/write",{forwardJsonBody:!0,signal:lC(Z)})),$.post("/:virtualMcpId/:branch/unlink",(Z)=>fZ(Z,"/_sandbox/unlink",{forwardJsonBody:!0,signal:lC(Z)})),$.post("/:virtualMcpId/:branch/mkdir",(Z)=>fZ(Z,"/_sandbox/mkdir",{forwardJsonBody:!0,signal:lC(Z)})),$.post("/:virtualMcpId/:branch/rename",(Z)=>fZ(Z,"/_sandbox/rename",{forwardJsonBody:!0,signal:lC(Z)})),$.post("/:virtualMcpId/:branch/read",(Z)=>fZ(Z,"/_sandbox/read",{forwardJsonBody:!0,signal:lC(Z)})),$.post("/:virtualMcpId/:branch/glob",(Z)=>fZ(Z,"/_sandbox/glob",{forwardJsonBody:!0,signal:lC(Z)})),$.post("/:virtualMcpId/:branch/grep",(Z)=>fZ(Z,"/_sandbox/grep",{forwardJsonBody:!0,signal:lC(Z)})),$.post("/:virtualMcpId/:branch/exec/:script",async(Z)=>{let X=Z.req.param("script");if(!X)return Z.json({error:"missing script name"},400);return fZ(Z,`/_sandbox/exec/${encodeURIComponent(X)}`)}),$.post("/:virtualMcpId/:branch/exec/:script/kill",async(Z)=>{let X=Z.req.param("script");if(!X)return Z.json({error:"missing script name"},400);return fZ(Z,`/_sandbox/exec/${encodeURIComponent(X)}/kill`)}),$.get("/:virtualMcpId/:branch/config",(Z)=>fZ(Z,"/_sandbox/config",{method:"GET",map404to410:!0,redactRepoDirUnlessDesktop:!0})),$.put("/:virtualMcpId/:branch/config",(Z)=>fZ(Z,"/_sandbox/config",{method:"PUT",forwardJsonBody:!0,map404to410:!0})),$.post("/:virtualMcpId/:branch/setup/:step",async(Z)=>{let X=Z.req.param("step");if(!X||!r86(X))return Z.json({error:`step must be one of: ${Kv$.join(", ")}`},400);if(X==="start"){let Q=Z.get("vmClaim");if(Q.runner){let G=r(Z.var.studioContext),Y=rF0(Q.virtualMcpMetadata);try{await sF0({ctx:Z.var.studioContext,runner:Q.runner,handle:Q.claimName,orgId:G.id,userId:Q.callerUserId,entries:Y})}catch(J){let W=J instanceof Error?J.message:String(J);return Z.json({error:`Failed to push env to daemon: ${W}`},502)}}}return fZ(Z,`/_sandbox/setup/${X}`,{signal:Z.req.raw.signal,map404to410:!0})}),$.get("/:virtualMcpId/:branch/events",(Z)=>{let X=Z.get("vmClaim");if(!X.runner)return QF(Z,async(Q)=>{await Q.writeSSE({event:"phase",data:JSON.stringify({kind:"failed",reason:"unknown",message:"No sandbox runner configured on this studio instance."})})});return i_$(Z,{ctx:Z.var.studioContext,claimName:X.claimName,runner:X.runner,virtualMcpId:X.virtualMcpId,branch:X.branch,userId:X.userId,projectRef:X.projectRef,virtualMcpMetadata:X.virtualMcpMetadata})}),$.get("/:virtualMcpId/:branch/git/status",(Z)=>fZ(Z,"/_sandbox/git/status",{method:"GET",map404to410:!0,signal:AbortSignal.any([Z.req.raw.signal,AbortSignal.timeout(Wv$)])})),$.post("/:virtualMcpId/:branch/git/status",(Z)=>fZ(Z,"/_sandbox/git/status",{map404to410:!0,signal:AbortSignal.any([Z.req.raw.signal,AbortSignal.timeout(Wv$)])})),$.post("/:virtualMcpId/:branch/git/diff",(Z)=>fZ(Z,"/_sandbox/git/diff",{forwardJsonBody:!0,map404to410:!0})),$.post("/:virtualMcpId/:branch/git/publish",async(Z)=>{let X=dC(Z);if(X instanceof Response)return X;let{claimName:Q,virtualMcpMetadata:G,connectionIds:Y}=Z.get("vmClaim"),J=Z.var.studioContext;return J41(Q,async()=>{try{await a81(J,X,Q);let W=Qv$(G,Y);if(W)await Gv$(J,X,Q,W)}catch(W){if(W instanceof ig)return Z.json({error:W.message},403,cG);let K=W instanceof Error?W.message:String(W);return Z.json({error:K},502,cG)}return fZ(Z,"/_sandbox/git/publish",{forwardJsonBody:!0,map404to410:!0})})}),$.post("/:virtualMcpId/:branch/git/discard",(Z)=>{let{claimName:X}=Z.get("vmClaim");return J41(X,()=>fZ(Z,"/_sandbox/git/discard",{forwardJsonBody:!0,map404to410:!0}))}),$.post("/:virtualMcpId/:branch/git/rebase",async(Z)=>{let X=dC(Z);if(X instanceof Response)return X;let{claimName:Q}=Z.get("vmClaim"),G=Z.var.studioContext;return J41(Q,async()=>{try{await a81(G,X,Q)}catch(Y){let J=Y instanceof Error?Y.message:String(Y);return Z.json({error:J},502,cG)}return fZ(Z,"/_sandbox/git/rebase",{forwardJsonBody:!0,map404to410:!0})})}),$.post("/:virtualMcpId/:branch/git/suggest-commit",HZ({maxSize:Jv$,onError:(Z)=>Z.json({error:"Payload too large"},413,cG)}),async(Z)=>{let X=dC(Z);if(X instanceof Response)return X;let{claimName:Q,userId:G,projectRef:Y}=Z.get("vmClaim"),J=Z.var.studioContext;try{let W=await Z.req.json().catch(()=>({})),K=W.status,H=W.diff,N=H!=null&&typeof H.diffs==="object"&&H.diffs!==null,[F,U]=$41(K)&&N?[K,H]:await Promise.all([Aj0(X,Q,"/_sandbox/git/status","GET",{userId:G,projectRef:Y}),Aj0(X,Q,"/_sandbox/git/diff","GET",{userId:G,projectRef:Y})]),w=await r_$(J,F,U);return Z.json(w,200,cG)}catch(W){let K=W instanceof Error?W.message:String(W);if(K==="SANDBOX_GONE")return Z.json({error:"Sandbox handle is gone. The sandbox needs to be re-provisioned."},410,cG);return Z.json({error:K},502,cG)}}),$.post("/:virtualMcpId/:branch/git/judge-review",HZ({maxSize:Jv$,onError:(Z)=>Z.json({error:"Payload too large"},413,cG)}),async(Z)=>{let X=dC(Z);if(X instanceof Response)return X;let{claimName:Q,userId:G,projectRef:Y}=Z.get("vmClaim"),J=Z.var.studioContext;try{let W=await Z.req.json().catch(()=>({})),K=W.status,H=W.diff,N=H!=null&&typeof H.diffs==="object"&&H.diffs!==null,[F,U]=$41(K)&&N?[K,H]:await Promise.all([Aj0(X,Q,"/_sandbox/git/status","GET",{userId:G,projectRef:Y}),Aj0(X,Q,"/_sandbox/git/diff","GET",{userId:G,projectRef:Y})]),w=await s_$(J,F,U,typeof W.language==="string"?W.language:void 0);return Z.json(w,200,cG)}catch(W){let K=W instanceof Error?W.message:String(W);if(K==="SANDBOX_GONE")return Z.json({error:"Sandbox handle is gone. The sandbox needs to be re-provisioned."},410,cG);return Z.json({error:K},502,cG)}}),$.get("/:virtualMcpId/:branch/preview-fetch",async(Z)=>{let X=dC(Z);if(X instanceof Response)return X;let{claimName:Q}=Z.get("vmClaim"),G=Z.req.query("path");if(!G||!G.startsWith("/")||G.startsWith("//")||G.includes("..")||G.includes("\\"))return Z.json({error:"Path not allowed"},403);let Y;try{Y=await X.getPreviewUrl(Q)}catch{return Z.json({error:"Preview not available"},502)}if(!Y)return Z.json({error:"Preview not available"},502);let J=Y.replace(/\/+$/,""),W=Y41(`${J}${G}`),K;try{K=await fetch(W?.url??`${J}${G}`,{...W?{headers:{host:W.hostHeader}}:{}})}catch{return Z.json({error:"Preview unreachable"},502)}let H;try{H=await K.text()}catch{return Z.json({error:"Preview unreachable"},502)}return new Response(H,{status:K.status,headers:{"content-type":K.headers.get("content-type")??"application/json"}})}),$.post("/:virtualMcpId/:branch/preview-invoke",HZ({maxSize:n86,onError:(Z)=>Z.json({error:"Payload too large"},413)}),async(Z)=>{let X=dC(Z);if(X instanceof Response)return X;let{claimName:Q}=Z.get("vmClaim"),G;try{G=await X.getPreviewUrl(Q)}catch{return Z.json({error:"Preview not available"},502)}if(!G)return Z.json({error:"Preview not available"},502);let Y;try{Y=await Z.req.json()}catch{return Z.json({error:"Invalid JSON body"},400)}if(!Y||typeof Y!=="object"||Array.isArray(Y))return Z.json({error:"Invalid JSON body"},400);let J=$v$(Y);if(!J)return Z.json({error:"Invalid or missing __resolveType"},400);let W=Zv$(G,J.resolveType),K=Y41(W),H;try{H=await fetch(K?.url??W,{method:"POST",headers:{"content-type":"application/json",...K?{host:K.hostHeader}:{}},body:JSON.stringify(J.payload),signal:AbortSignal.timeout(30000)})}catch{return Z.json({error:"Preview unreachable"},502)}let N;try{N=await H.text()}catch{return Z.json({error:"Preview unreachable"},502)}return new Response(N,{status:H.status,headers:{"content-type":H.headers.get("content-type")??"application/json"}})}),$};var Nv$=B(()=>{y8();mO();mg();c_$();GN();d_$();j3();gw();m_$();n_$();vd0();_i();Q41();e_$();Xv$();Yv$();m86=/^[a-zA-Z0-9][a-zA-Z0-9/._-]*$/;t86=u_$(async($,Z)=>{let X=$.var.studioContext;try{Z0(X)}catch{return $.json({error:"Unauthorized"},401)}let Q=W1(X);if(!Q)return $.json({error:"Unauthorized"},401);let G;try{G=r(X)}catch{return $.json({error:"Organization scope required"},403)}let Y=$.req.param("virtualMcpId"),J=$.req.param("branch");if(!Y||!J)return $.json({error:"virtualMcpId and branch are required"},400);try{i86(J)}catch(w){let O=w instanceof Error?w.message:String(w);return $.json({error:O},400)}let W=await X.storage.virtualMcps.findById(Y);if(!W||W.organization_id!==G.id)return $.json({error:"Virtual MCP not found"},404);let K=em({orgId:G.id,virtualMcpId:Y,branch:J}),H=await ON(X,J,Q),N=l_$({userId:H,projectRef:K}),F=W.metadata??null,U;try{U=(await uX(X,{userId:H,branch:J,virtualMcpMetadata:F})).provider}catch{U=null}if(!U)return $.json({error:"No sandbox runner found"},404);return $.set("vmClaim",{claimName:N,callerUserId:Q,runner:U,virtualMcpId:Y,branch:J,userId:H,projectRef:K,virtualMcpMetadata:F,connectionIds:W.connections?.map((w)=>w.connection_id)??[]}),Z()});Pj0=new Map;cG={"Cache-Control":"no-store, no-cache, must-revalidate",Pragma:"no-cache"};Kv$=["clone","install","start"]});var Fv$=($)=>{let Z=new B1;if(Z.use("*",vC),Z.route("/",yE0()),Z.route("/",RS$()),Z.route("/",M_$()),Z.route("/",R_$()),Z.route("/",Lj0()),Z.route("/tools",b_$()),Z.route("/",C_$()),Z.route("/",J_$({kvStorage:$.kvStorage})),Z.route("/",G_$()),Z.route("/fs",L_$({getConnection:$.getNatsConnection})),Z.route("/sandbox",Hv$()),Z.route("/",P_$()),Z.route("/deco-sites",hE0()),Z.route("/sso",CE0()),Z.route("/",Ej0({tokenStorage:$.tokenStorage,automationEventDispatcher:$.automationEventDispatcher})),Z.route("/webhooks",DS$()),$.mountDevAssets)Z.route("/dev-assets",uE0({orgFromPath:!0}));return Z.use("/mcp/:connectionId?",$.mcpAuth),Z.use("/mcp/:connectionId/ui-resource",$.mcpAuth),Z.use("/mcp/gateway/:virtualMcpId?",$.mcpAuth),Z.use("/mcp/virtual-mcp/:virtualMcpId?",$.mcpAuth),Z.use("/mcp/self",$.mcpAuth),Z.use("/mcp/task-run/:threadId",$.mcpAuth),Z.route("/",OM$()),Z.get("/mcp/:gateway?/:connectionId/.well-known/oauth-protected-resource/*",$.betterAuthProtectedResourceHandler),Z.get("/mcp/.well-known/oauth-protected-resource",$.betterAuthProtectedResourceHandler),Z.route("/mcp/task-run",j_$()),Z.route("/mcp",$O0()),Z.route("/mcp/self",Dj0()),Z.route("/mcp",QO0()),Z.all("/oauth-proxy/:connectionId/*",$.oauthProxyHandler),Z.get("/watch",$.watchHandler),Z};var Uv$=B(()=>{y8();L$1();LS$();A$1();cE0();Ho();B$1();Y_$();W_$();E_$();Pn();W$1();GO0();d81();z_$();A_$();I_$();k_$();__$();i81();f_$();n81();ZO0();Nv$()});function s86($){return $.filter((Z)=>Z.vendors?.alias).map((Z)=>({name:Z.name,title:Z.title,description:Z.description,logo:Z.logo,category:Z.category,vendor:{alias:Z.vendors.alias,url:Z.vendors.url}}))}async function e86($,Z){let X=await fetch(`${$}/rest/v1/apps?select=name,title,description,logo,category,vendors(alias,url)`,{headers:{apikey:Z,Authorization:`Bearer ${Z}`,Accept:"application/json"},signal:AbortSignal.timeout(a86)});if(!X.ok){let Q=await X.text().catch(()=>X.statusText);throw console.error(`[deco-apps] Supabase error (${X.status}): ${Q.slice(0,200)}`),Error(`External service error (${X.status})`)}return await X.json()}var a86=1e4,$46=async($,Z)=>{if(!$.get("studioContext").auth.user?.id)return $.json({error:"Unauthorized"},401);return Z()},wv$=()=>{let $=new B1;return $.use("*",$46),$.get("/",async(Z)=>{let X=c0(),Q=X.decoSupabaseUrl,G=X.decoSupabaseServiceKey;if(!Q||!G)return Z.json({apps:[]});try{let Y=await e86(Q,G);return Z.json({apps:s86(Y)})}catch(Y){return console.error("[deco-apps] GET error:",Y),Z.json({error:"Failed to fetch apps"},502)}}),$};var Ov$=B(()=>{y8();S$()});import{z as M1}from"zod";function cK($,Z="invalid_request_error",X=null,Q=null){return{error:{message:$,type:Z,param:X,code:Q}}}function N46($){if(!$)return null;let Z=$.indexOf(":");if(Z===-1)return{credentialId:null,modelId:$};let X=$.substring(0,Z),Q=$.substring(Z+1);if(!X||!Q)return null;return{credentialId:X,modelId:Q}}function F46($,Z,X){try{return JSON.parse($)}catch{throw new Lv$(`Invalid JSON in tool call arguments for function '${X}' (tool_call_id: ${Z}): ${$}`)}}function U46($){let Z={};for(let X of $)if(X.role==="assistant"&&X.tool_calls)for(let Q of X.tool_calls)Z[Q.id]=Q.function.name;return $.map((X)=>{switch(X.role){case"system":return{role:"system",content:X.content};case"user":if(typeof X.content==="string")return{role:"user",content:X.content};return{role:"user",content:X.content.map((G)=>{if(G.type==="text")return{type:"text",text:G.text};return{type:"image",image:G.image_url.url}})};case"assistant":if(X.tool_calls&&X.tool_calls.length>0)return{role:"assistant",content:X.tool_calls.map((G)=>({type:"tool-call",toolCallId:G.id,toolName:G.function.name,input:F46(G.function.arguments,G.id,G.function.name)}))};return{role:"assistant",content:X.content??""};case"tool":let Q=Z[X.tool_call_id]??"unknown";return{role:"tool",content:[{type:"tool-result",toolCallId:X.tool_call_id,toolName:Q,output:{type:"text",value:X.content}}]}}})}function w46($){let Z=$.map((X)=>{let Q=X.function.parameters?PG(X.function.parameters):PG({type:"object",properties:{}});return[X.function.name,_$({description:X.function.description,inputSchema:Q})]});return Object.fromEntries(Z)}function O46($){if(!$)return;return{openai:{response_format:$}}}function B46(){return`chatcmpl-${crypto.randomUUID().replace(/-/g,"").substring(0,29)}`}function Bv$($,Z,X,Q,G,Y){let J={model:$,messages:Z,tools:X,temperature:Q.temperature,maxTokens:Q.max_tokens,topP:Q.top_p,frequencyPenalty:Q.frequency_penalty,presencePenalty:Q.presence_penalty,stopSequences:Q.stop?Array.isArray(Q.stop)?Q.stop:[Q.stop]:void 0,abortSignal:Y};return G?{...J,providerOptions:G}:J}function Dv$($){if($==="tool-calls")return"tool_calls";if($==="length")return"length";return"stop"}var Z46=256,X46,Q46,G46,Y46,J46,W46,K46,H46,Lv$,Ev$,jv$;var zv$=B(()=>{k4();y8();mg();xN();X46=M1.object({type:M1.literal("function"),function:M1.object({name:M1.string(),description:M1.string().optional(),parameters:M1.record(M1.string(),M1.unknown()).optional()})}),Q46=M1.object({id:M1.string(),type:M1.literal("function"),function:M1.object({name:M1.string(),arguments:M1.string()})}),G46=M1.discriminatedUnion("role",[M1.object({role:M1.literal("system"),content:M1.string(),name:M1.string().optional()}),M1.object({role:M1.literal("user"),content:M1.union([M1.string(),M1.array(M1.union([M1.object({type:M1.literal("text"),text:M1.string()}),M1.object({type:M1.literal("image_url"),image_url:M1.object({url:M1.string(),detail:M1.string().optional()})})]))]),name:M1.string().optional()}),M1.object({role:M1.literal("assistant"),content:M1.string().nullable().optional(),name:M1.string().optional(),tool_calls:M1.array(Q46).optional()}),M1.object({role:M1.literal("tool"),content:M1.string(),tool_call_id:M1.string()})]),Y46=M1.object({type:M1.literal("text")}),J46=M1.object({type:M1.literal("json_object")}),W46=M1.object({type:M1.literal("json_schema"),json_schema:M1.object({name:M1.string(),description:M1.string().optional(),schema:M1.record(M1.string(),M1.unknown()),strict:M1.boolean().optional()})}),K46=M1.union([Y46,J46,W46]),H46=M1.object({model:M1.string().describe("Format: 'model_id' or 'credential_id:model_id'"),messages:M1.array(G46),stream:M1.boolean().optional().default(!1),temperature:M1.number().min(0).max(2).optional(),max_tokens:M1.number().positive().optional(),top_p:M1.number().min(0).max(1).optional(),frequency_penalty:M1.number().min(-2).max(2).optional(),presence_penalty:M1.number().min(-2).max(2).optional(),stop:M1.union([M1.string(),M1.array(M1.string())]).optional(),tools:M1.array(X46).optional(),tool_choice:M1.union([M1.literal("auto"),M1.literal("none"),M1.literal("required"),M1.object({type:M1.literal("function"),function:M1.object({name:M1.string()})})]).optional(),response_format:K46.optional(),user:M1.string().optional()});Lv$=class Lv$ extends Error{constructor($){super($);this.name="MessageConversionError"}};Ev$=new B1;Ev$.post("/:org/v1/chat/completions",async($)=>{let Z=$.get("studioContext"),X=$.req.param("org");try{if(!Z.auth.apiKey?.id)return $.json(cK("API key authentication required. Provide a valid API key via Authorization header.","authentication_error"),401);if(!Z.organization)return $.json(cK("Organization context is required. Ensure your API key has organization metadata.","invalid_request_error","organization"),400);if((Z.organization.slug??Z.organization.id)!==X)return $.json(cK("Organization mismatch. The API key's organization does not match the requested organization.","invalid_request_error","organization"),403);let Q=await $.req.json(),G=H46.safeParse(Q);if(!G.success){let L=G.error.issues[0]??{message:"Invalid request",path:[]};return $.json(cK(`Invalid request: ${L.message}`,"invalid_request_error",L.path.length>0?L.path.join("."):null),400)}let Y=G.data,J=N46(Y.model);if(!J)return $.json(cK("Invalid model format. Expected 'model_id' or 'credential_id:model_id' (e.g., 'claude-sonnet-4-6' or 'key_abc123:claude-sonnet-4-6')","invalid_request_error","model"),400);let{credentialId:W}=J,{modelId:K}=J;if(!W){let E=(await Z.storage.aiProviderKeys.list({organizationId:Z.organization.id})).find((j)=>QD(j.providerId));if(!E)return $.json(cK("No AI provider credentials configured for this organization. Add a credential in settings or specify one explicitly via 'credential_id:model_id'.","invalid_request_error","model"),400);W=E.id}let H;try{H=await Z.aiProviders.activate(W,Z.organization.id)}catch{return $.json(cK(`AI provider credential not found or inaccessible: ${W}`,"invalid_request_error","model"),404)}let N=H.aiSdk.languageModel(K),F=U46(Y.messages),U=Y.tools?w46(Y.tools):void 0,w=O46(Y.response_format),O=B46(),D=Math.floor(Date.now()/1000);if(Y.stream)return QF($,async(L)=>{let E=Bv$(N,F,U,Y,w,$.req.raw.signal);try{let j=Aw(E),z=!1,A=0,P="",M=async()=>{if(P.length===0)return;let k=P;P="",await L.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:D,model:Y.model,choices:[{index:0,delta:{content:k},finish_reason:null}]})})};for await(let k of j.fullStream){if(!z&&(k.type==="text-delta"||k.type==="tool-call"))await L.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:D,model:Y.model,choices:[{index:0,delta:{role:"assistant",content:""},finish_reason:null}]})}),z=!0;if(k.type==="text-delta"){if(P+=k.text,P.length>=Z46)await M()}else if(k.type==="tool-call"){await M();let q=A++;await L.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:D,model:Y.model,choices:[{index:0,delta:{tool_calls:[{index:q,id:k.toolCallId,type:"function",function:{name:k.toolName,arguments:JSON.stringify(k.input)}}]},finish_reason:null}]})})}else if(k.type==="finish")await M(),await L.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:D,model:Y.model,choices:[{index:0,delta:{},finish_reason:Dv$(k.finishReason)}],usage:k.totalUsage?{prompt_tokens:k.totalUsage.inputTokens??0,completion_tokens:k.totalUsage.outputTokens??0,total_tokens:k.totalUsage.totalTokens??0}:void 0})})}await M(),await L.writeSSE({data:"[DONE]"})}catch(j){let z=j;console.error("[openai-compat:stream] Error:",z.message),await L.writeSSE({data:JSON.stringify({error:{message:z.message,type:"server_error"}})})}});else{let L=Bv$(N,F,U,Y,w,$.req.raw.signal),E=await zw(L),j={role:"assistant",content:E.text||null};if(E.toolCalls&&E.toolCalls.length>0)j.tool_calls=E.toolCalls.map((z)=>({id:z.toolCallId,type:"function",function:{name:z.toolName,arguments:JSON.stringify("input"in z?z.input:{})}})),j.content=null;return $.json({id:O,object:"chat.completion",created:D,model:Y.model,choices:[{index:0,message:j,finish_reason:Dv$(E.finishReason)}],usage:{prompt_tokens:E.usage?.inputTokens??0,completion_tokens:E.usage?.outputTokens??0,total_tokens:E.usage?.totalTokens??0}})}}catch(Q){let G=Q;if(G.name==="AbortError")return $.json(cK("Request aborted","invalid_request_error"),400);if(G.name==="MessageConversionError")return $.json(cK(G.message,"invalid_request_error","messages"),400);return console.error("[openai-compat] Error:",G.message,G.stack),$.json(cK(G.message,"server_error"),500)}});jv$=Ev$});var Av$;var Pv$=B(()=>{Av$={name:"decocms",version:"4.204.11",description:"Deco CMS \u2014 Self-hostable MCP Gateway for managing AI connections and tools",author:"Deco team",repository:{type:"git",url:"git+https://github.com/decocms/studio.git",directory:"apps/api"},bugs:{url:"https://github.com/decocms/studio/issues"},type:"module",bin:{deco:"./dist/server/cli.js"},files:["dist/**/*"],scripts:{dev:"bun run migrate && bun run dev:server","dev:server":"bun run --cwd=../../packages/sandbox build && NODE_ENV=development bun --env-file=.env --hot run src/index.ts",build:"bun run build:server","build:server":"bun run scripts/bundle-server-script.ts --dist ./dist/server","generate:tool-contracts":"bun run scripts/generate-tool-contracts.ts","db:migrate":"bun run ./dist/server/migrate.js",check:"tsc --noEmit",start:"bun run ./dist/server/server.js",migrate:"bun run src/database/migrate.ts",test:"bun test src","better-auth:migrate":"bunx --bun @better-auth/cli migrate -y --config src/auth/index.ts",prepublishOnly:"bun run --cwd=../.. build:studio"},optionalDependencies:{"@duckdb/node-api":"^1.5.0-r.1"},dependencies:{"@ai-sdk/anthropic":"^3.0.85","@ai-sdk/google":"^3.0.83","@ai-sdk/openai":"^3.0.73","@anthropic-ai/sdk":"^0.105.0","@aws-sdk/client-s3":"^3.1013.0","@aws-sdk/client-sts":"^3.1013.0","@aws-sdk/lib-storage":"^3.1013.0","@aws-sdk/s3-request-presigner":"^3.1013.0","@clickhouse/client":"^1.8.1","@dbos-inc/dbos-sdk":"^4.21.6","@inkjs/ui":"^2.0.0","@nats-io/jetstream":"3.4.0","@nats-io/kv":"3.4.0","@nats-io/nats-core":"3.4.0","@nats-io/transport-node":"3.4.0","@openrouter/ai-sdk-provider":"^2.9.1","@opentelemetry/core":"^2.6.0","embedded-postgres":"^18.3.0-beta.16",ink:"^6.8.0",kysely:"^0.28.12","posthog-node":"^5.0.0",react:"^19.2.6","react-dom":"^19.2.6"},devDependencies:{"@ai-sdk/provider":"^3.0.10","@better-auth/sso":"1.4.1","@decocms/better-auth":"1.5.17","@decocms/bindings":"workspace:*","@decocms/mcp-utils":"workspace:*","@decocms/runtime":"workspace:*","@decocms/sandbox":"workspace:*","@decocms/shared":"workspace:*","@jitl/quickjs-wasmfile-release-sync":"0.31.0","@modelcontextprotocol/sdk":"1.29.0","@nats-io/jwt":"0.0.10-5","@opentelemetry/api":"^1.9.0","@opentelemetry/api-logs":"^0.211.0","@opentelemetry/exporter-logs-otlp-proto":"^0.211.0","@opentelemetry/exporter-prometheus":"^0.208.0","@opentelemetry/exporter-trace-otlp-proto":"^0.207.0","@opentelemetry/instrumentation-runtime-node":"^0.24.0","@opentelemetry/resources":"^2.6.0","@opentelemetry/sdk-logs":"^0.211.0","@opentelemetry/sdk-metrics":"^2.2.0","@opentelemetry/sdk-node":"^0.207.0","@opentelemetry/sdk-trace-base":"^2.5.0","@types/bun":"^1.3.1","@types/google.maps":"^3.65.2","@types/pg":"^8.15.6","@types/react-syntax-highlighter":"^15.5.13","@vercel/nft":"^1.1.1",ai:"^6.0.208","better-auth":"1.4.22",croner:"^9.1.0",degit:"^2.8.4",hono:"^4.10.7",jose:"^6.0.11",nanoid:"^5.1.6",pg:"^8.16.3",typescript:"^7.0.2",typescript5:"npm:typescript@^5.9.3",zod:"4.3.6"},homepage:"https://github.com/decocms/studio",keywords:["mcp","model-context-protocol","ai","gateway","self-hosted","tools"],license:"MIT",publishConfig:{access:"public"}}});function E46(){let $=process.env.POSTHOG_KEY;if(!$)return null;return{key:$,host:process.env.POSTHOG_HOST??L46}}var Tv$,L46="https://ph.studio.decocms.com",Rv$;var Iv$=B(()=>{y8();hx0();MV();jZ();S$();X$1();Pv$();Tv$=new B1;Tv$.get("/",($)=>{let Z={version:Av$.version,theme:Gu1(),...pD().logo&&{logo:pD().logo},...UK()&&{internalUrl:vq1()},...c0().enableDecoImport&&{enableDecoImport:!0},brandExtractEnabled:!!c0().firecrawlApiKey,auth:bk$(),posthog:E46(),googleMapsApiKey:process.env.GOOGLE_MAPS_API_KEY?.trim()||null,runtime:{agentSandbox:!UK()&&c0().sandboxProviderKind==="agent-sandbox"}};return $.header("Cache-Control","no-store"),$.json({success:!0,config:Z})});Rv$=Tv$});function ng($){let Z=($??"").trim().toLowerCase();return Z=Z.replace(/^https?:\/\//,""),Z=Z.replace(/^www\./,""),Z=Z.split(/[/?#]/)[0]??"",Z.replace(/\/+$/,"")}function W41($){return(ng($).split(".")[0]||$).replace(/[-_]/g," ").split(" ").filter(Boolean).map((X)=>X.charAt(0).toUpperCase()+X.slice(1)).join(" ")}function Mv$($,Z=64){return`https://www.google.com/s2/favicons?domain=${encodeURIComponent(ng($))}&sz=${Z}`}function qv$($,Z){let X=$.trim();if(X.length<=Z)return X;let Q=X.slice(0,Z-1),G=Q.lastIndexOf(" ");return`${(G>Z*0.6?Q.slice(0,G):Q).trimEnd()}\u2026`}function kv$($){let{brand:Z,domain:X,score:Q,verdict:G}=$,Y=typeof Q==="number"?`${Z} commerce report \u2014 ${Math.round(Q)}/100 \xB7 decocms`:`${Z} commerce report \xB7 decocms`,J=`See the full ${Z} scorecard \u2014 SEO, performance, conversion & AEO signals scored by decocms.`,W=G?.trim()?qv$(`${G.trim().replace(/\s+/g," ")} \u2014 ${J}`,200):qv$(`How does ${X} really perform? ${J}`,200);return{title:Y,description:W}}import{z as l0}from"zod";var mC,j46,z46,P46,A46,Sv$;var Vv$=B(()=>{mC=l0.enum(["good","bad","neutral"]),j46=l0.preprocess(($)=>{if(Array.isArray($))return{kind:"text",value:$.find((X)=>X!==null&&typeof X!=="object")??""};return $!==null&&typeof $==="object"?$:{kind:"text",value:$}},l0.object({kind:l0.enum(["text","number","sparkline","badge","score"]).catch("text"),value:l0.coerce.string().optional(),tone:mC.optional(),muted:l0.boolean().optional(),delta:l0.coerce.string().optional(),deltaDir:l0.enum(["up","down","neutral"]).optional(),points:l0.array(l0.coerce.number()).optional(),label:l0.coerce.string().optional()}).transform(($)=>{if($.kind==="badge"&&$.label==null)$.label=$.value??"";if($.kind==="score"){let Z=Number($.value);if(Number.isNaN(Z))return{...$,kind:"text"}}return $})),z46=l0.preprocess(($)=>{let Z=$;if(Z&&typeof Z==="object"&&!Array.isArray(Z)&&Array.isArray(Z.cells))Z=Z.cells;if(Array.isArray(Z)&&Z.length===1&&Array.isArray(Z[0]))Z=Z[0];if(Array.isArray(Z))return Z;if(Z&&typeof Z==="object")return Object.values(Z);return Z},l0.array(j46)),P46={key:l0.coerce.string(),title:l0.coerce.string(),eyebrow:l0.coerce.string().optional(),headline:l0.coerce.string(),annotation:l0.coerce.string().optional(),methodology:l0.coerce.string().optional(),sources:l0.array(l0.object({name:l0.coerce.string(),logoUrl:l0.coerce.string()})).optional()},A46=l0.discriminatedUnion("template",[l0.object({template:l0.literal("cover"),score:l0.object({value:l0.coerce.number(),max:l0.coerce.number().optional(),grade:l0.coerce.string().optional(),label:l0.coerce.string().optional()}).optional(),brandImage:l0.coerce.string().optional(),screenshot:l0.coerce.string().optional(),mobileScreenshot:l0.coerce.string().optional()}),l0.object({template:l0.literal("cta"),ctaUrl:l0.coerce.string().optional(),ctaLabel:l0.coerce.string().optional(),bullets:l0.array(l0.coerce.string()).optional()}),l0.object({template:l0.literal("series"),points:l0.array(l0.coerce.number()).min(2),xLabels:l0.array(l0.coerce.string()).min(1),unit:l0.coerce.string().optional(),callout:l0.object({index:l0.coerce.number(),value:l0.coerce.string(),tone:mC.optional()})}),l0.object({template:l0.literal("threshold"),value:l0.coerce.string().default(""),metricLabel:l0.coerce.string().optional(),ratio:l0.coerce.number(),thresholdRatio:l0.coerce.number().optional(),thresholdLabel:l0.coerce.string().default(""),tone:mC.optional()}),l0.object({template:l0.literal("stats"),stats:l0.array(l0.object({value:l0.coerce.string(),label:l0.coerce.string(),tone:mC.optional()})).min(1)}),l0.object({template:l0.literal("bars"),items:l0.array(l0.object({value:l0.coerce.string(),label:l0.coerce.string(),ratio:l0.coerce.number(),tone:mC.optional()})).min(1)}),l0.object({template:l0.literal("gauges"),gauges:l0.array(l0.object({label:l0.coerce.string(),value:l0.coerce.string(),status:l0.enum(["good","warn","bad"]).catch("warn"),caption:l0.coerce.string().optional(),ratio:l0.coerce.number().optional()})).min(1)}),l0.object({template:l0.literal("checklist"),checks:l0.array(l0.object({label:l0.coerce.string(),status:l0.enum(["pass","fail","warn"]).catch("fail"),value:l0.coerce.string().optional()})).min(1)}),l0.object({template:l0.literal("table"),columns:l0.array(l0.object({label:l0.coerce.string(),align:l0.enum(["left","right"]).optional()})).min(1),rows:l0.array(z46).min(1),highlightRow:l0.coerce.number().optional()}),l0.object({template:l0.literal("products"),products:l0.array(l0.object({name:l0.coerce.string(),price:l0.coerce.string().optional(),image:l0.coerce.string().optional(),url:l0.coerce.string().optional()})).min(1)}),l0.object({template:l0.literal("list"),entries:l0.array(l0.object({label:l0.coerce.string(),severity:l0.enum(["error","warning","notice"]).catch("notice")})).min(1),moreCount:l0.coerce.number().optional()}),l0.object({template:l0.literal("keywords"),volumeLabel:l0.coerce.string().optional(),keywords:l0.array(l0.object({term:l0.coerce.string(),volume:l0.coerce.string(),position:l0.coerce.number().catch(0)})).min(1)}),l0.object({template:l0.literal("competitor"),metricLabel:l0.coerce.string().optional(),competitors:l0.array(l0.object({name:l0.coerce.string(),value:l0.coerce.string(),tone:mC.optional(),isYou:l0.boolean().optional()})).min(1)}),l0.object({template:l0.literal("scorecard"),rivalLabel:l0.coerce.string().optional(),dimensions:l0.array(l0.object({label:l0.coerce.string(),you:l0.coerce.string(),rival:l0.coerce.string().optional(),rivalName:l0.coerce.string().optional(),tone:mC.optional()})).min(1)})]),Sv$=l0.object({...P46,template:A46})});function Tj0($){let Z=[],X=[...$.sections].sort((G,Y)=>G.position-Y.position).map((G)=>{let Y=Sv$.safeParse(G.props);if(Y.success)return Y.data;let J=Y.error.issues[0];return Z.push({section_type:G.section_type,position:G.position,reason:J?`${J.path.join(".")||"(root)"}: ${J.message}`:"contract violation"}),null}).filter((G)=>G!==null),Q=X.filter((G)=>G.template.template!=="cover"&&G.template.template!=="cta").map((G)=>({key:G.key,title:G.title}));return{deck:{meta:{...$.meta,scores:$.summary?.scores,scannedAt:$.scanned_at,toc:Q},slides:X},drops:Z}}var K41=B(()=>{Vv$()});import{join as Cv$}from"path";async function R46($){try{let Z=await fetch(`${xW({})}/api/v2/public/diagnostics/${encodeURIComponent($)}`,{headers:{Accept:"application/json"},signal:AbortSignal.timeout(T46)});if(!Z.ok)return null;let X=await Z.json(),{deck:Q}=Tj0(X);if(!Q.slides.length)return null;let G=Q.slides.find((W)=>W.template.template==="cover"),Y=G?.template,J=Y&&Y.template==="cover"?Y:void 0;return{brand:Q.meta.brand?.trim()||W41($),score:Q.meta.scores?.cover??J?.score?.value,verdict:G?.annotation?.trim()||G?.headline?.trim()||void 0}}catch{return null}}function lG($){return $.replaceAll("&","&amp;").replaceAll("<","&lt;").replaceAll(">","&gt;").replaceAll('"',"&quot;")}function I46($,Z){let X=ng($),Q=Z?.brand?.trim()||W41(X),G=Mv$(X,128),J=`${(c0().baseUrl??"https://studio.decocms.com").replace(/\/+$/,"")}/report/${encodeURIComponent(X)}`,{title:W,description:K}=kv$({brand:Q,domain:X,score:Z?.score,verdict:Z?.verdict}),H=`${J}/og.png`,N=`${Q} commerce report by decocms`;return[`<title>${lG(W)}</title>`,`<meta name="description" content="${lG(K)}" />`,'<meta name="robots" content="noindex, follow" />','<meta property="og:type" content="website" />','<meta property="og:site_name" content="decocms" />',`<meta property="og:title" content="${lG(W)}" />`,`<meta property="og:description" content="${lG(K)}" />`,`<meta property="og:url" content="${lG(J)}" />`,`<meta property="og:image" content="${lG(H)}" />`,'<meta property="og:image:width" content="1200" />','<meta property="og:image:height" content="630" />',`<meta property="og:image:alt" content="${lG(N)}" />`,'<meta name="twitter:card" content="summary_large_image" />',`<meta name="twitter:title" content="${lG(W)}" />`,`<meta name="twitter:description" content="${lG(K)}" />`,`<meta name="twitter:image" content="${lG(H)}" />`,`<meta name="twitter:image:alt" content="${lG(N)}" />`,`<link rel="canonical" href="${lG(J)}" />`,`<link rel="icon" href="${lG(G)}" sizes="any" />`].join(`
     `)}function q46($,Z){return $.replace(/<title>[\s\S]*?<\/title>\s*/i,"").replace(/<meta\s+name="(?:description|twitter:[^"]*)"[^>]*>\s*/gi,"").replace(/<meta\s+property="og:[^"]*"[^>]*>\s*/gi,"").replace(/<link\s+rel="icon"[^>]*>\s*/gi,"").replace("</head>",`    ${Z}
   </head>`)}function _v$($){let Z=new B1;return Z.get("/:domain/og.png",async(X)=>{let Q=ng(X.req.param("domain")),G=async()=>{let Y=$?Bun.file(Cv$($,"report-og-fallback.png")):null;if(!Y||!await Y.exists())return X.notFound();return X.body(new Uint8Array(await Y.arrayBuffer()),200,{"Content-Type":"image/png","Cache-Control":"public, max-age=0, s-maxage=3600"})};try{let Y=await fetch(`${xW({})}/api/v2/public/diagnostics/${encodeURIComponent(Q)}/og.png`,{signal:AbortSignal.timeout(M46)}),J=Y.headers.get("content-type")??"";if(!Y.ok||!J.startsWith("image/")||!Y.body)return G();return X.body(Y.body,200,{"Content-Type":J,"Cache-Control":"public, max-age=0, s-maxage=604800"})}catch{return G()}}),Z.get("/:domain",async(X)=>{let Q=X.req.param("domain"),G=$?Cv$($,"index.html"):null,Y=G?Bun.file(G):null;if(!Y||!await Y.exists())return X.notFound();let J=await Y.text();try{let W=await R46(ng(Q)),K=I46(Q,W);return X.html(q46(J,K),200,{"Cache-Control":"public, max-age=0, s-maxage=300"})}catch{return X.html(J)}}),Z}var T46=2500,M46=1e4;var vv$=B(()=>{y8();K41();WL();S$()});function xo($,Z){return fetch(`${xW({})}${$}`,Z)}async function k46($,Z,X){let Q=new URLSearchParams;if(Z)Q.set("pw",Z);if(X)Q.set("lang",X);let G=Q.toString()?`?${Q.toString()}`:"",Y=await xo(`/api/v2/public/diagnostics/${encodeURIComponent($)}${G}`,{headers:{Accept:"application/json"}});if(Y.status===404)return{status:"not_found",deck:null,scanned_at:null,drops:[]};if(!Y.ok)throw Error(`report read HTTP ${Y.status}`);let J=await Y.json(),{deck:W,drops:K}=Tj0(J);return{status:W.slides.length?"ready":"empty",deck:W,scanned_at:J.scanned_at,drops:K}}var S46,i3,Rj0=async($,Z)=>{if(!$.get("reportUser"))return $.json({error:"Authentication required"},401);await Z();return},bv$;var fv$=B(()=>{y8();IY();WL();K41();S46=new Set(["complete","errored","terminated","unknown"]),i3=new B1;i3.use("*",async($,Z)=>{let X=await j8.api.getSession({headers:$.req.raw.headers});$.set("reportUser",X?.user?.id?{email:X.user.email}:void 0),await Z(),$.header("Cache-Control","private, no-store"),$.header("Vary","Cookie");return});i3.use("/run",Rj0);i3.use("/status",Rj0);i3.use("/link-token/*",Rj0);i3.use("/suggest",Rj0);i3.get("/site/:domain",async($)=>{let Z=$.req.param("domain").trim();if(!Z)return $.json({error:"domain is required"},400);let X=$.get("reportUser"),Q=$.req.query("key")?.trim()||void 0,G=$.req.query("lang")?.trim()||void 0;try{let Y=await k46(Z,Q,G);if($.header("Cache-Control","private, no-store"),X||!Y.deck)return $.json(Y);return $.json({...Y,deck:{...Y.deck,slides:Y.deck.slides.slice(0,1)},truncated:Y.status==="ready"})}catch{return $.json({error:"report read failed"},502)}});i3.post("/run",async($)=>{let Z=$.get("reportUser"),X;try{X=await $.req.json()}catch{return $.json({error:"invalid JSON"},400)}let Q=typeof X.domain==="string"?X.domain.trim():"";if(!Q)return $.json({error:"domain is required"},400);let G=Z.email,Y=typeof X.distinctId==="string"&&X.distinctId.trim()&&X.distinctId.length<=200?X.distinctId.trim():void 0;try{let J=await xo("/api/v2/diagnostics/run",{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${JL({})}`},body:JSON.stringify({url:Q,email:G,distinct_id:Y})});if(!J.ok)return $.json({error:`run HTTP ${J.status}`},502);let W=await J.json(),K=W.blocked?{state:"blocked"}:W.status==="fresh"?{state:"fresh"}:W.mode==="sync"?{state:"sync"}:{state:"running",id:W.id??null};return $.json(K)}catch{return $.json({error:"run failed"},502)}});i3.get("/status",async($)=>{let Z=$.req.query("id");if(!Z)return $.json({error:"id is required"},400);try{let X=await xo(`/api/v2/diagnostics/status?id=${encodeURIComponent(Z)}`,{headers:{Authorization:`Bearer ${JL({})}`}});if(!X.ok)return $.json({error:`status HTTP ${X.status}`},502);let G=(await X.json()).status??"unknown",Y={done:S46.has(G),status:G};return $.json(Y)}catch{return $.json({error:"status failed"},502)}});i3.get("/link-token/:id",async($)=>{let Z=$.req.param("id");try{let X=await xo(`/api/v2/public/link-tokens/${encodeURIComponent(Z)}`,{headers:{Accept:"application/json"}});if(X.status===404)return $.json(null);if(!X.ok)return $.json({error:`link token HTTP ${X.status}`},502);return $.json(await X.json())}catch{return $.json({error:"link token resolve failed"},502)}});i3.get("/suggest",async($)=>{let Z=($.req.query("q")??"").trim().slice(0,64);if(Z.length<2)return $.json({suggestions:[]});try{let X=await xo(`/api/v2/public/suggest?q=${encodeURIComponent(Z)}`,{headers:{Accept:"application/json"}});if(!X.ok)return $.json({suggestions:[]});let Q=await X.json();return $.json({suggestions:Array.isArray(Q.suggestions)?Q.suggestions:[]})}catch{return $.json({suggestions:[]})}});bv$=i3});import{createHmac as V46,timingSafeEqual as C46}from"crypto";function yv$($,Z,X,Q=Date.now()){if(!Z||!X)return!1;let G,Y=[];for(let H of Z.split(",")){let N=H.indexOf("=");if(N<=0)continue;let F=H.slice(0,N).trim(),U=H.slice(N+1).trim();if(F==="t")G=U;else if(F==="v1")Y.push(U)}if(!G||Y.length===0)return!1;let J=Number(G);if(!Number.isFinite(J)||Math.abs(Q/1000-J)>_46)return!1;let W=V46("sha256",X).update(`${G}.${$}`).digest("hex"),K=Buffer.from(W,"hex");return Y.some((H)=>{let N=Buffer.from(H,"hex");return K.length===N.length&&C46(K,N)})}function gv$($){let Z;try{Z=JSON.parse($)}catch{return null}let X=QJ(Z),Q=QJ(QJ(X?.data)?.object);if(!X||typeof X.type!=="string"||!Q)return null;return{id:lK(X.id),type:X.type,created:typeof X.created==="number"?X.created:void 0,livemode:typeof X.livemode==="boolean"?X.livemode:void 0,data:{object:Q}}}function hv$($){switch($){case"active":case"trialing":return"active";case"past_due":return"past_due";default:return"canceled"}}function lK($){return typeof $==="string"?$:void 0}function QJ($){return typeof $==="object"&&$!==null?$:void 0}function Ij0($){return typeof $==="number"?new Date($*1000):null}function F41($){return lK($)??lK(QJ($)?.id)}function v46($){return F41($.subscription)??lK(QJ(QJ($.parent)?.subscription_details)?.subscription)}function b46($){let Z=Ij0($.current_period_end);if(Z)return Z;let X=QJ($.items)?.data;if(!Array.isArray(X))return null;let Q=0;for(let G of X){let Y=QJ(G)?.current_period_end;if(typeof Y==="number"&&Y>Q)Q=Y}return Q>0?new Date(Q*1000):null}function H41($,Z){let X=Ij0($.created);return!!X&&!!Z.lastStripeEventAt&&X<Z.lastStripeEventAt}function N41($,Z){let X=Ij0($.created);if(!X)return;return Z.lastStripeEventAt&&Z.lastStripeEventAt>X?void 0:X}async function f46($,Z){let X=Z.data.object;switch(Z.type){case"checkout.session.completed":case"checkout.session.async_payment_succeeded":{let Q=lK(QJ(X.metadata)?.orgId);if(!Q)return{handled:!1,reason:"no orgId"};if(lK(QJ(X.metadata)?.kind)==="topup"){if(X.mode!=="payment")return{handled:!1,reason:"topup with wrong mode"};if(lK(X.payment_status)!=="paid")return{handled:!1,reason:"payment not confirmed"};let J=lK(X.id);if(!J)return console.error("stripe webhook: topup session without id",{eventId:Z.id,organizationId:Q}),{handled:!1,reason:"topup session without id"};let W=Number(QJ(X.metadata)?.creditCents);if(!Number.isInteger(W)||W<=0)return console.error("stripe webhook: paid topup with bad metadata \u2014 credit NOT applied",{eventId:Z.id,organizationId:Q,creditCents:QJ(X.metadata)?.creditCents}),{handled:!1,reason:"bad topup metadata"};return{handled:!0,organizationId:Q,topUp:{creditCents:W,referenceId:`stripe-topup:${J}`}}}if(X.mode!=="subscription")return{handled:!1,reason:"not a subscription checkout"};if(lK(X.payment_status)!=="paid")return{handled:!1,reason:"payment not confirmed"};let G=await $.getBilling(Q);if(!G)return{handled:!1,reason:"unknown org"};let Y=F41(X.subscription);if(G.stripeSubscriptionId&&Y&&G.stripeSubscriptionId!==Y)return console.error("stripe webhook: refused checkout rebind",{organizationId:Q,eventId:Z.id}),{handled:!1,reason:"org already bound to another subscription",orphanSubscriptionId:Y};if(H41(Z,G))return{handled:!1,reason:"stale event"};return await $.updateStripeState(Q,{stripeCustomerId:F41(X.customer),stripeSubscriptionId:Y,status:"active",lastStripeEventAt:N41(Z,G)}),{handled:!0,organizationId:Q}}case"customer.subscription.updated":case"customer.subscription.deleted":{let Q=lK(X.id);if(!Q)return{handled:!1,reason:"no sub id"};let G=await $.getBillingByStripeSubscriptionId(Q);if(!G)return{handled:!1,reason:"unknown subscription"};let Y=Z.type==="customer.subscription.deleted";if(!Y&&H41(Z,G))return{handled:!1,reason:"stale event"};let J=Y?"canceled":hv$(X.status);return await $.updateStripeState(G.organizationId,{status:J,currentPeriodEnd:b46(X),...Y&&{stripeSubscriptionId:null},lastStripeEventAt:N41(Z,G)}),{handled:!0,organizationId:G.organizationId}}case"invoice.paid":{let Q=v46(X);if(!Q)return{handled:!1,reason:"no sub id"};let G=await $.getBillingByStripeSubscriptionId(Q);if(!G)return{handled:!1,reason:"unknown subscription"};if(H41(Z,G))return{handled:!1,reason:"stale event"};return await $.updateStripeState(G.organizationId,{status:"active",currentPeriodEnd:Ij0(X.period_end),lastStripeEventAt:N41(Z,G)}),{handled:!0,organizationId:G.organizationId}}default:return{handled:!1,reason:`unhandled event ${Z.type}`}}}function x46($,Z){if(!Z.handled||$.livemode===!1)return null;let X=$.data.object;if(Z.topUp)return{name:"credits_topup_succeeded",organizationId:Z.organizationId,properties:{credit_cents:Z.topUp.creditCents}};switch($.type){case"checkout.session.completed":case"checkout.session.async_payment_succeeded":return{name:"subscription_started",organizationId:Z.organizationId,properties:{}};case"customer.subscription.deleted":return{name:"subscription_canceled",organizationId:Z.organizationId,properties:{}};case"customer.subscription.updated":return{name:"subscription_updated",organizationId:Z.organizationId,properties:{status:hv$(X.status),...typeof X.cancel_at_period_end==="boolean"?{cancel_at_period_end:X.cancel_at_period_end}:{}}};case"invoice.paid":if(X.billing_reason==="subscription_create")return null;return{name:"subscription_renewed",organizationId:Z.organizationId,properties:{}};default:return null}}function xv$($,Z){let X=x46($,Z);if(!X)return;nJ({event:X.name,organizationId:X.organizationId,...$.id?{uuid:Ul1(`stripe:${$.id}:${X.name}`)}:{},...$.created?{timestamp:new Date($.created*1000)}:{},properties:X.properties})}async function uv$($){let Z=new _W(m8().db),X=await f46(Z,$);if(!(X.handled&&X.topUp))xv$($,X);if(X.handled&&X.topUp)await jF$({organizationId:X.organizationId,amountCents:X.topUp.creditCents,referenceId:X.topUp.referenceId}),xv$($,X);if(!X.handled&&X.orphanSubscriptionId)try{await Mt1(X.orphanSubscriptionId),console.error("stripe webhook: canceled orphan subscription",{subscriptionId:X.orphanSubscriptionId,eventId:$.id})}catch(Q){if(!(Q instanceof X3&&(Q.status===400||Q.status===404)))throw Q}return X}var _46=300;var cv$=B(()=>{LY();f4();h80();km();ao0()});var y46=1048576,U41;var lv$=B(()=>{y8();mO();S$();cv$();U41=new B1;U41.post("/webhook",HZ({maxSize:y46,onError:($)=>$.json({error:"payload too large"},413)}),async($)=>{let Z=c0().stripeWebhookSecret;if(!Z)return $.json({error:"stripe billing not configured"},503);let X=await $.req.text();if(!yv$(X,$.req.header("stripe-signature"),Z))return $.json({error:"invalid signature"},400);let G=gv$(X);if(!G)return $.json({error:"invalid payload"},400);let Y=await uv$(G);return console.log("stripe webhook",{eventId:G.id,type:G.type,livemode:G.livemode,...Y}),$.json({received:!0})})});import{timingSafeEqual as g46}from"crypto";function u46($,Z,X){if(!Z?.startsWith("sha256="))return!1;let Q=new Bun.CryptoHasher("sha256",X).update($).digest("hex"),G=Z.slice(7);if(G.length!==Q.length)return!1;return g46(Buffer.from(G),Buffer.from(Q))}var h46=5242880,w41;var dv$=B(()=>{y8();mO();Si();w41=new B1;w41.post("/webhook",HZ({maxSize:h46,onError:($)=>$.json({error:"payload too large"},413)}),async($)=>{let Z=process.env.GITHUB_WEBHOOK_SECRET;if(!Z)return $.json({error:"github webhook not configured"},503);let X=await $.req.text();if(!u46(X,$.req.header("x-hub-signature-256"),Z))return $.json({error:"invalid signature"},400);if($.req.header("x-github-event")!=="push")return $.json({ok:!0,ignored:"event"});let Q;try{Q=JSON.parse(X)}catch{return $.json({error:"invalid payload"},400)}let G=Q.ref,Y=Q.repository?.full_name;if(!G||!Y)return $.json({ok:!0,ignored:"shape"});let W=(await Md0())?.markTenantPoolsDirty(Y,G)??[];return $.json({ok:!0,pools:W})})});function mv$($,Z){if(Z.startsWith("text/html")||Z.startsWith("image/svg"))$.set("Content-Security-Policy","sandbox allow-scripts allow-modals allow-same-origin")}var iv$,c46,l46,nv$;var pv$=B(()=>{y8();iJ();qx();Sf();iv$=new B1,c46=["range","if-none-match","if-modified-since"],l46=["content-type","content-length","content-range","accept-ranges","etag","last-modified"];iv$.get("/:org/files/*",async($)=>{let Z=$.get("studioContext"),X=Z.organization?.id;if(!Z.auth?.user?.id){if(Ig($))return $.redirect(`/login?next=${encodeURIComponent($.req.path)}`,302);throw new Q$(401,{message:"Authentication required"})}if(!X)throw new Q$(401,{message:"Organization context required"});let Q=$.req.path.replace(/^.*\/files\//,"");if(!Q)throw new Q$(400,{message:"Missing file key"});let G=await Yn(Q,Z);if(!G)throw new Q$(503,{message:"Object storage not configured"});if(G.startsWith("data:")&&aJ()){let K=G.match(/^data:([^;]+);base64,(.+)$/s);if(!K)throw new Q$(500,{message:"Invalid data URL from storage"});let[,H,N]=K,F=Buffer.from(N,"base64"),U=new Headers({"Content-Type":H,"Cache-Control":"private, max-age=86400"});return mv$(U,H),new Response(F,{status:200,headers:U})}let Y=new Headers;for(let K of c46){let H=$.req.header(K);if(H)Y.set(K,H)}let J=await fetch(G,{headers:Y});if(J.status===403||J.status===404)throw new Q$(404,{message:"File not found"});if(!J.ok&&J.status!==304&&J.status!==416)throw console.error(`[files] upstream storage error ${J.status} for key:`,Q),new Q$(502,{message:"Upstream storage error"});let W=new Headers;for(let K of l46){let H=J.headers.get(K);if(H)W.set(K,H)}return W.set("Cache-Control","private, max-age=86400"),mv$(W,W.get("content-type")??""),new Response(J.body,{status:J.status,headers:W})});nv$=iv$});var yo=C((iC)=>{var d46=iC&&iC.__createBinding||(Object.create?function($,Z,X,Q){if(Q===void 0)Q=X;var G=Object.getOwnPropertyDescriptor(Z,X);if(!G||("get"in G?!Z.__esModule:G.writable||G.configurable))G={enumerable:!0,get:function(){return Z[X]}};Object.defineProperty($,Q,G)}:function($,Z,X,Q){if(Q===void 0)Q=X;$[Q]=Z[X]}),m46=iC&&iC.__exportStar||function($,Z){for(var X in $)if(X!=="default"&&!Object.prototype.hasOwnProperty.call(Z,X))d46(Z,$,X)};Object.defineProperty(iC,"__esModule",{value:!0});m46($G(),iC)});var rv$=C((tv$)=>{Object.defineProperty(tv$,"__esModule",{value:!0});tv$.version=void 0;tv$.version="3.4.0"});var ev$=C((dK)=>{var i46=dK&&dK.__importDefault||function($){return $&&$.__esModule?$:{default:$}};Object.defineProperty(dK,"__esModule",{value:!0});dK.NodeTransport=dK.VERSION=void 0;dK.nodeResolveHost=a46;var d6=yo(),n46=z0("net"),O41=z0("tls"),p46=z0("path"),av$=z0("fs"),t46=i46(z0("dns")),o46=rv$();dK.VERSION=o46.version;var r46="nats.js";class sv${socket;version;lang;yields=[];signal=(0,d6.deferred)();closedNotification=(0,d6.deferred)();options;connected=!1;tlsName="";done=!1;closeError;constructor(){this.lang=r46,this.version=dK.VERSION}async connect($,Z){this.tlsName=$.tlsName,this.options=Z;let{tls:X}=this.options,{handshakeFirst:Q}=X||{};try{if(Q===!0)this.socket=await this.tlsFirst($);else this.socket=await this.dial($);if(this.done)this.socket?.destroy();let G=await this.peekInfo();(0,d6.checkOptions)(G,Z);let{tls_required:Y,tls_available:J}=G,W=J===!0&&Z.tls!==null;if(!Q&&(Y||W))this.socket=await this.startTLS();if(this.done)this.socket?.destroy();if(Y&&this.socket.encrypted!==!0)throw d6.errors.InvalidArgumentError.format("tls","is not available on this server");return this.connected=!0,this.setupHandlers(),this.signal.resolve(),Promise.resolve()}catch(G){let Y=G;if(!Y)Y=new d6.errors.ConnectionError("error connecting - node provided an undefined error");let{code:J}=Y,W=J==="ECONNREFUSED"?new d6.errors.ConnectionError("connection refused",{cause:Y}):Y;throw this.socket?.destroy(),W}}dial($){let Z=(0,d6.deferred)(),X,Q=(0,n46.createConnection)($.port,$.hostname,()=>{Z.resolve(Q),Q.removeAllListeners()});return Q.on("error",(G)=>{X=G}),Q.on("close",()=>{Q.removeAllListeners(),Z.reject(X)}),Q.setNoDelay(!0),Z}get isClosed(){return this.done}close($){return this._closed($,!1)}peekInfo(){let $=(0,d6.deferred)(),Z;return this.socket.on("data",(X)=>{this.yields.push(X);let Q=d6.DataBuffer.concat(...this.yields),G=(0,d6.extractProtocolMessage)(Q);if(G!=="")try{let Y=d6.INFO.exec(G);if(!Y)throw Error("unexpected response from server");let J=JSON.parse(Y[1]);$.resolve(J)}catch(Y){$.reject(Y)}finally{this.socket.removeAllListeners()}}),this.socket.on("error",(X)=>{Z=X}),this.socket.on("close",()=>{this.socket.removeAllListeners(),$.reject(Z)}),$}loadFile($){if(!$)return Promise.resolve();let Z=(0,d6.deferred)();try{if($=(0,p46.resolve)($),!(0,av$.existsSync)($))Z.reject(Error(`${$} doesn't exist`));(0,av$.readFile)($,(X,Q)=>{if(X)return Z.reject(X);Z.resolve(Q)})}catch(X){Z.reject(X)}return Z}async loadClientCerts(){let $={},{certFile:Z,cert:X,caFile:Q,ca:G,keyFile:Y,key:J}=this.options.tls;try{if(Z){let W=await this.loadFile(Z);if(W)$.cert=W}else if(X)$.cert=X;if(Y){let W=await this.loadFile(Y);if(W)$.key=W}else if(J)$.key=J;if(Q){let W=await this.loadFile(Q);if(W)$.ca=[W]}else if(G)$.ca=G;return Promise.resolve($)}catch(W){return Promise.reject(W)}}async tlsFirst($){let Z,X={servername:this.tlsName,rejectUnauthorized:!0};if(this.socket)X.socket=this.socket;if(typeof this.options.tls==="object")try{let G=await this.loadClientCerts()||{};X=(0,d6.extend)(X,this.options.tls,G)}catch(G){return Promise.reject(new d6.errors.ConnectionError(G.message,{cause:G}))}let Q=(0,d6.deferred)();try{let G=(0,O41.connect)($.port,$.hostname,X,()=>{G.removeAllListeners(),Q.resolve(G)});G.on("error",(Y)=>{Z=Y}),G.on("secureConnect",()=>{if(X.rejectUnauthorized===!1)return;if(!G.authorized)throw G.authorizationError}),G.on("close",()=>{Q.reject(Z),G.removeAllListeners()}),G.setNoDelay(!0)}catch(G){Q.reject(new d6.errors.ConnectionError(G.message,{cause:G}))}return Q}async startTLS(){let $,Z={socket:this.socket,servername:this.tlsName,rejectUnauthorized:!0};if(typeof this.options.tls==="object")try{let Q=await this.loadClientCerts()||{};Z=(0,d6.extend)(Z,this.options.tls,Q)}catch(Q){return Promise.reject(new d6.errors.ConnectionError(Q.message,{cause:Q}))}let X=(0,d6.deferred)();try{let Q=(0,O41.connect)(Z,()=>{Q.removeAllListeners(),X.resolve(Q)});Q.on("error",(G)=>{$=G}),Q.on("secureConnect",()=>{if(Z.rejectUnauthorized===!1)return;if(!Q.authorized)throw Q.authorizationError}),Q.on("close",()=>{X.reject($),Q.removeAllListeners()})}catch(Q){X.reject(new d6.errors.ConnectionError(Q.message,{cause:Q}))}return X}setupHandlers(){let $;this.socket.on("data",(Z)=>{return this.yields.push(Z),this.signal.resolve()}),this.socket.on("error",(Z)=>{$=Z}),this.socket.on("end",()=>{if(this.socket?.destroyed)return;this.socket?.write(new Uint8Array(0),()=>{this.socket?.end()})}),this.socket.on("close",()=>{this._closed($,!1)})}[Symbol.asyncIterator](){return this.iterate()}async*iterate(){while(!0){if(this.yields.length===0)await this.signal;let $=this.yields;this.yields=[];for(let Z=0;Z<$.length;Z++){if(this.options.debug)console.info(`> ${(0,d6.render)($[Z])}`);yield $[Z]}if(this.done)break;else if(this.yields.length===0)$.length=0,this.yields=$,this.signal=(0,d6.deferred)()}}discard(){if(this.done=!0,this.socket)try{this.socket.removeAllListeners(),this.socket.destroy()}catch{}}disconnect(){this._closed(void 0,!0).then().catch()}isEncrypted(){return this.socket instanceof O41.TLSSocket}_send($){if(this.isClosed||this.socket===void 0)return Promise.resolve();if(this.options.debug)console.info(`< ${(0,d6.render)($)}`);let Z=(0,d6.deferred)();try{this.socket.write($,(X)=>{if(X){if(this.options.debug)console.error(`!!! ${(0,d6.render)($)}: ${X}`);return Z.reject(X)}return Z.resolve()})}catch(X){if(this.options.debug)console.error(`!!! ${(0,d6.render)($)}: ${X}`);Z.reject(X)}return Z}send($){this._send($).catch((X)=>{})}async _closed($,Z=!0){if(!this.connected)return;if(this.done){this.socket?.destroy();return}if(this.closeError=$,!$&&this.socket&&Z)try{await this._send(new TextEncoder().encode(""))}catch(X){if(this.options.debug)console.log("transport close terminated with an error",X)}try{if(this.socket)this.socket.removeAllListeners(),this.socket?.destroy(),this.socket=void 0}catch(X){console.log(X)}this.done=!0,this.closedNotification.resolve(this.closeError)}closed(){return this.closedNotification}}dK.NodeTransport=sv$;function a46($){let Z=(0,d6.deferred)();return t46.default.lookup($,{all:!0},(X,Q)=>{if(X){Z.reject(X);return}let G=[];for(let Y of Q)G.push(Y.address);if(G.length===0)G.push($);Z.resolve(G)}),Z}});var Gb$=C((Qb$)=>{Object.defineProperty(Qb$,"__esModule",{value:!0});Qb$.connect=s46;var $b$=ev$(),Zb$=yo(),Xb$=yo();function s46($={}){if((0,Xb$.hasWsProtocol)($))return Promise.reject(Xb$.errors.InvalidArgumentError.format("servers","node client doesn't support websockets, use the 'wsconnect' function instead"));return(0,Zb$.setTransportFactory)({factory:()=>{return new $b$.NodeTransport},dnsResolveFn:$b$.nodeResolveHost}),Zb$.NatsConnectionImpl.connect($)}});var Yb$=C((GF)=>{var $66=GF&&GF.__createBinding||(Object.create?function($,Z,X,Q){if(Q===void 0)Q=X;var G=Object.getOwnPropertyDescriptor(Z,X);if(!G||("get"in G?!Z.__esModule:G.writable||G.configurable))G={enumerable:!0,get:function(){return Z[X]}};Object.defineProperty($,Q,G)}:function($,Z,X,Q){if(Q===void 0)Q=X;$[Q]=Z[X]}),Z66=GF&&GF.__exportStar||function($,Z){for(var X in $)if(X!=="default"&&!Object.prototype.hasOwnProperty.call(Z,X))$66(Z,$,X)};Object.defineProperty(GF,"__esModule",{value:!0});GF.connect=void 0;var X66=Gb$();Object.defineProperty(GF,"connect",{enumerable:!0,get:function(){return X66.connect}});Z66(yo(),GF)});function Hb$($){let Z=$?.connectFn??J66,X=null,Q=null,G=!1,Y=!1,J=!1,W=[];function K(){return X!==null&&!X.isClosed()&&!X.isDraining()&&!J}function H(){console.log(`[NatsProvider] fireReady: ${W.length} callbacks`);for(let U of W)try{U()}catch{}}function N(U){(async()=>{for await(let w of U.status())if(w.type==="disconnect")console.log("[NatsProvider] Disconnected"),J=!0;else if(w.type==="reconnect")console.log("[NatsProvider] Reconnected, re-firing ready callbacks"),J=!1,Q=null,H()})().catch(()=>{})}async function F(U,w){let O=0;while(!Y)try{X=await Z({servers:U,timeout:Y66,reconnect:!0,maxReconnectAttempts:-1,...w?{authenticator:w}:{}}),console.log(`[NatsProvider] Connected to ${X.getServer()} after ${O} attempt(s)`),Q=null,J=!1,N(X),H();return}catch{O++;let D=HX(G66,Q66,O-1,2,0.5);await y$(D)}}return{init(U,w){if(G)return;G=!0,Y=!1;let O=w?.creds?Jb$.credsAuthenticator(new TextEncoder().encode(w.creds)):void 0;F(U,O).catch(()=>{})},isConnected(){return K()},getConnection(){return K()?X:null},getJetStream(){if(!K())return null;if(!Q)Q=Kb$.jetstream(X);return Q},onReady(U){if(W.push(U),K())try{U()}catch{}},async drain(){if(Y=!0,G=!1,Q=null,J=!1,X){let U=X;X=null,await U.drain().catch(()=>{})}}}}function J66($){return Wb$.connect($)}var Jb$,Wb$,Kb$,Q66=100,G66=3000,Y66=3000;var Nb$=B(()=>{E6();Jb$=S(Eh(),1),Wb$=S(Yb$(),1),Kb$=S(FB(),1)});function B41($,Z){return`${$}.${Z}`}class D41{cache;constructor($){this.cache=Fg({ttlMs:$?.ttlMs??W66,maxSize:$?.maxSize??K66})}async get($,Z){return this.cache.get(B41($,Z))??null}async set($,Z,X){this.cache.set(B41($,Z),X)}async invalidate($,Z){this.cache.delete(B41($,Z))}teardown(){this.cache.clear()}}var W66=600000,K66=5000;var Fb$=()=>{};function qj0($,Z){return`${$}:${Z}`}function L41($){let Z=Fg({ttlMs:$?.ttlMs??H66,maxSize:$?.maxSize??N66}),X=$?.getConnection,Q=crypto.randomUUID(),G=new TextEncoder,Y=new TextDecoder,J=null;function W(K,H){let N=X?.();if(!N)return;try{N.publish(Ub$,G.encode(JSON.stringify({organizationId:K,keyId:H,originId:Q})))}catch(F){console.warn("[ProviderKeyCache] Publish failed (non-critical):",F)}}return{get(K,H){return Z.get(qj0(K,H))},set(K,H,N){Z.set(qj0(K,H),N)},invalidate(K,H){Z.delete(qj0(K,H)),W(K,H)},start(){if(J)return;let K=X?.();if(!K)return;J=K.subscribe(Ub$),(async()=>{for await(let H of J)try{let N=JSON.parse(Y.decode(H.data));if(N.originId===Q)continue;Z.delete(qj0(N.organizationId,N.keyId))}catch{}})().catch(console.error)},teardown(){J?.unsubscribe(),J=null,Z.clear()}}}var Ub$="studio.ai-provider-keys.invalidate",H66=30000,N66=5000;var wb$=()=>{};class E41{options;subscriptions=[];onCancel=null;encoder=new TextEncoder;originId=crypto.randomUUID();seenMessageIds=new Set;constructor($){this.options=$}async start($){if($)this.onCancel=$;if(this.subscriptions.length>0)return;if(!this.onCancel)return;let Z=this.options.getConnection();if(!Z)return;let X=new TextDecoder;this.subscriptions=Ob$.map((Q)=>Z.subscribe(Q));for(let Q of this.subscriptions)(async()=>{for await(let G of Q)try{let Y=JSON.parse(X.decode(G.data));if(Y.originId===this.originId)continue;if(Y.messageId&&this.hasSeen(Y.messageId))continue;this.onCancel?.(Y.taskId)}catch{}})().catch(console.error)}broadcast($){if(/[.*>\s]/.test($)){console.warn("[NatsCancelBroadcast] Invalid threadId, skipping broadcast");return}this.onCancel?.($);try{let Z=this.options.getConnection();if(!Z)return;let X=this.encoder.encode(JSON.stringify({taskId:$,originId:this.originId,messageId:crypto.randomUUID()}));for(let Q of Ob$)Z.publish(Q,X)}catch(Z){console.warn("[NatsCancelBroadcast] Publish failed (non-critical):",Z)}}publishControlFrame($,Z){}async stop(){for(let $ of this.subscriptions)$.unsubscribe();this.subscriptions=[],this.seenMessageIds.clear(),this.onCancel=null}hasSeen($){if(this.seenMessageIds.has($))return!0;if(this.seenMessageIds.add($),this.seenMessageIds.size>1000){let Z=this.seenMessageIds.values().next().value;if(Z)this.seenMessageIds.delete(Z)}return!1}}var Ob$;var Bb$=B(()=>{Ob$=["studio.decopilot.cancel","mesh.decopilot.cancel"]});var Db$=($)=>{let Z;return()=>Z??=$()},j41,z41;var Lb$=B(()=>{Z5();j41=Db$(()=>K8.createHistogram("decopilot.stream.encode_ms",{description:"Per-chunk JSON.stringify+encode time for decopilot stream",unit:"ms"})),z41=Db$(()=>K8.createCounter("decopilot.stream.published_chunks",{description:"Logical decopilot stream chunks published to JetStream",unit:"{chunks}"}))});function L66(){return{name:IN,subjects:[`${Pw0}.>`],storage:n3.StorageType.File,max_age:w66,max_bytes:B66,max_msgs_per_subject:D66,discard:n3.DiscardPolicy.Old,retention:n3.RetentionPolicy.Limits,duplicate_window:O66,num_replicas:1}}class zb${chunks=0;encodeMs=0;maxMs=0;bytes=0;windowStart=performance.now();constructor(){setInterval(()=>this.flush(),1e4).unref?.()}record($,Z){if(this.chunks++,this.encodeMs+=$,$>this.maxMs)this.maxMs=$;this.bytes+=Z}flush(){let $=performance.now(),Z=$-this.windowStart;if(this.chunks>0&&Z>0)console.warn(JSON.stringify({msg:"stream-encode-trace",windowMs:Math.round(Z),chunks:this.chunks,encodeMs:Math.round(this.encodeMs),pctOfLoop:+(this.encodeMs/Z*100).toFixed(1),maxChunkMs:+this.maxMs.toFixed(2),mbEncoded:+(this.bytes/1048576).toFixed(2)}));this.chunks=0,this.encodeMs=0,this.maxMs=0,this.bytes=0,this.windowStart=$}}function Eb$($){let Z=jb$.headers();for(let[X,Q]of Object.entries($))Z.set(X,Q);return Z}function P66($,Z){let X=0;return{publish(Q,G,Y,J){Q.publish(G,Y,J?{headers:J}:void 0).catch((W)=>{if(X++,U66().add(1,{"org.id":Z??"unknown"}),X===1||X%100===0)console.warn(`[Decopilot] JetStream publish failed for thread ${$} (${X} total):`,W)})},get errorCount(){return X}}}function A66($){if(!($ instanceof Error))return!1;if($.name==="TimeoutError")return!0;return/timeout|no responders|503/i.test($.message)}class P41{options;js=null;jsm=null;constructor($){this.options=$}async init(){let $=this.options.getConnection();if(!$){console.log("[Decopilot] StreamBuffer.init skipped: NATS not connected yet");return}let Z=L66(),X=await gZ(async()=>{let Q=this.options.getJetStreamManager?await this.options.getJetStreamManager():await n3.jetstreamManager($);try{await Q.streams.info(IN),await Q.streams.update(IN,Z)}catch(G){if(G instanceof Error&&G.message.includes("stream not found"))await Q.streams.add(Z);else if(G instanceof Error&&/can ?not change.*storage|storage type/i.test(G.message))await Q.streams.delete(IN),await Q.streams.add(Z);else throw G}return Q},{maxAttempts:5,minTimeout:250,maxTimeout:4000,jitter:0.5,isRetriable:A66});this.js=this.options.getJetStream(),this.jsm=X,console.log(`[Decopilot] StreamBuffer.init ${this.js?"ready":"degraded (js=null)"}`)}pump($,Z,X,Q){let G=this.js;if(!G)return console.warn(`[Decopilot] pump: JetStream client unavailable for thread ${Z}; chunks NOT published to NATS`),Promise.resolve();let Y=P66(Z,Q),J=!1,W=()=>{if(J)return;J=!0;let H=G3$(Z);G.publish(H.subject,H.data).catch(()=>{})};X.addEventListener("abort",W,{once:!0});let K=(H)=>{let N=performance.now(),F=oi0(H,{runId:Z}),U=performance.now()-N;if(j41().record(U),z41().add(1,{"org.id":Q??"unknown"}),z66?.record(U,F.reduce((w,O)=>w+O.data.length,0)),F.length===0){console.warn(`[Decopilot] dropping oversized stream chunk for thread ${Z}`);return}for(let w of F)Y.publish(G,w.subject,w.data,w.headers?Eb$(w.headers):void 0)};return(async()=>{let H=$.getReader(),N=0,F=0,U;try{while(!0){let{done:w,value:O}=await H.read();if(w)break;if(K(O),F++,++N>=64)N=0,await new Promise((D)=>setImmediate(D))}}catch(w){U=w,console.warn(`[Decopilot] stream pump error for thread ${Z}:`,w?.message??w)}finally{if(H.releaseLock(),W(),j66)console.warn(JSON.stringify({msg:"decopilot-stream-diag",event:"pump-done",taskId:Z,publishedChunks:F,publishErrors:Y.errorCount}))}if(U!==void 0)throw U})()}async publishRawChunk($,Z,X){let Q=this.js;if(!Q)return!1;let G=performance.now(),Y=oi0(Z,{runId:$,dedup:X});if(j41().record(performance.now()-G),z41().add(1),Y.length===0)return console.warn(`[Decopilot] dropping oversized raw chunk for thread ${$} (> MAX_CHUNKED_BYTES)`),!0;for(let J of Y)await Q.publish(J.subject,J.data,{...J.headers?{headers:Eb$(J.headers)}:{},...J.msgId?{msgID:J.msgId}:{}});return!0}async publishDone($,Z,X){let Q=this.js;if(!Q)return!1;let G=Q3$({runId:$,fenceToken:Z,finalSeq:X});return await Q.publish(G.subject,G.data,{msgID:G.msgId}),!0}async createTailStream($,Z,X){let Q=this.js;if(!Q)return console.warn(`[Decopilot] createTailStream: JetStream client unavailable for thread ${$}; no live tail`),null;let G=X?.deliverPolicy==="new"?n3.DeliverPolicy.New:n3.DeliverPolicy.All,Y=X?.closeOnDone??!1,J=GO($),W;try{W=await(await Q.consumers.get(IN,{filter_subjects:J,deliver_policy:G})).consume()}catch(D){return console.warn("[Decopilot] JetStream tail unavailable (non-critical):",D?.message??D),null}let N=qw0({messages:async function*(){try{for await(let D of W)yield{subject:D.subject,data:D.data,headers:D.headers}}finally{W.stop()}}(),onCancel:()=>W.stop()}).pipeThrough(Aw0()).pipeThrough(Tw0()).getReader(),F=!1,U=()=>{if(F)return;F=!0;try{N.releaseLock()}catch{}},w=!1,O=()=>{if(w)return;w=!0,W.stop(),N.cancel().catch(()=>{}),U()};return Z?.addEventListener("abort",O,{once:!0}),new ReadableStream({async pull(D){for(;;){let{done:L,value:E}=await N.read();if(L){O(),D.close();return}let j=E;if(j.kind==="done"){if(Y){O(),D.close();return}continue}D.enqueue(j.chunk);return}},cancel(){O()}})}purge($){if(!this.jsm)return;this.jsm.streams.purge(IN,{filter:GO($)}).catch(()=>{})}teardown(){this.js=null,this.jsm=null}}var n3,jb$,F66=($)=>{let Z;return()=>Z??=$()},U66,w66=86400000000000,O66=120000000000,B66=4294967296,D66=500000,E66,j66,z66;var Pb$=B(()=>{E6();ri0();Mw0();Rw0();Z5();Lb$();n3=S(FB(),1),jb$=S(Eh(),1),U66=F66(()=>K8.createCounter("decopilot.stream.publish_errors",{description:"Number of JetStream publish failures for decopilot stream chunks",unit:"{errors}"}));E66=process.env.STREAM_ENCODE_TRACE==="1",j66=process.env.DECOPILOT_STREAM_TRACE==="1";z66=E66?new zb$:null});function Mj0($,Z,X,Q){if(!Q)return!1;return $.emit(Z,BW(X,Q.status,{title:Q.title??void 0,virtualMcpId:Q.virtual_mcp_id??void 0,createdBy:Q.created_by??void 0,triggerId:Q.trigger_id??null,branch:Q.branch??null,harnessId:Q.harness_id??void 0,createdAt:Q.created_at,updatedAt:Q.updated_at})),!0}var Ab$=B(()=>{L8()});class A41{storage;options;timer=null;constructor($,Z={}){this.storage=$;this.options=Z}start(){if(this.timer)return;let $=this.options.intervalMs??300000;this.timer=setInterval(()=>{this.runOnce()},$)}async runOnce(){let $=this.options.staleAfterMs??3600000;try{let Z=await this.storage.sweepAbandoned($);if(Z>0)console.log(`[async-research-sweeper] marked ${Z} stale jobs as abandoned`);return Z}catch(Z){return console.error("[async-research-sweeper] sweep failed",Z),0}}dispose(){if(this.timer)clearInterval(this.timer),this.timer=null}}function k66($){return $ instanceof LQ}class T41{taskBoard;contextFactory;options;timer=null;running=!1;cursor=null;constructor($,Z,X={}){this.taskBoard=$;this.contextFactory=Z;this.options=X}start(){if(this.timer)return;let $=this.options.intervalMs??T66;this.timer=setInterval(()=>{this.runOnce()},$),this.timer.unref()}async runOnce(){if(this.running)return 0;this.running=!0;let $=0;try{let Z=this.options.batchSize??I66,X=this.options.itemIntervalMs??R66,Q=await this.taskBoard.listItemsPendingReview(Z,this.cursor,new Date(Date.now()-X)),G=Q.at(-1);this.cursor=Q.length===Z&&G?{updatedAt:G.updatedAt,id:G.id}:null;for(let{id:Y,organizationId:J}of Q)try{if(await this.reconcileItem(Y,J))$++}catch(W){console.error(`[task-board-review-sweeper] ${Y} failed`,W)}await this.reapNeverStartedThreads(Z),$+=await this.dispatchDueRetries(Z),await this.reactToUnhandledFailures(Z)}catch(Z){console.error("[task-board-review-sweeper] sweep failed",Z)}finally{this.running=!1}return $}async reapNeverStartedThreads($){try{let Z=await this.taskBoard.failNeverStartedLinkedThreads($,new Date(Date.now()-$Y$),Vn0);for(let X of Z)console.warn(`[task-board-review-sweeper] failed never-started thread ${X.threadId} on ${X.itemId}`)}catch(Z){console.error("[task-board-review-sweeper] reaping failed",Z)}}async reactToUnhandledFailures($){let Z=await this.taskBoard.listItemsStuckAfterFailure($,new Date(Date.now()-M66));for(let{id:X,organizationId:Q,threadId:G}of Z)try{console.warn(`[task-board-review-sweeper] reacting to an unhandled failure on ${X}`),await ji0(this.taskBoard,G,Q)}catch(Y){console.error(`[task-board-review-sweeper] unhandled-failure reaction for ${X} failed`,Y)}}async dispatchDueRetries($){let Z=0,X=await this.taskBoard.listItemsDueForRetry($,new Date);for(let{id:Q,organizationId:G,attempts:Y}of X)try{if(!await this.taskBoard.claimDueRetry(Q,G,new Date))continue;let J=await this.taskBoard.getById(Q,G);if(!J||J.status!=="in_progress"||J.assigneeId!==d4)continue;let W=await this.contextFactory(G,J.assignedBy??J.createdBy);if(!W)continue;await qN(W,J,{runClass:"retry"}),Z++,console.warn(`[task-board-review-sweeper] re-dispatched ${Q} after a failure (attempt ${Y})`)}catch(J){if(console.error(`[task-board-review-sweeper] retry dispatch for ${Q} failed`,J),k66(J)){await this.returnToTodo(Q,G,J instanceof Error?J.message:String(J));continue}await this.taskBoard.scheduleRunRetry(Q,G,Y,new Date(Date.now()+q66)).catch((W)=>console.error(`[task-board-review-sweeper] re-arming ${Q} failed`,W))}return Z}async returnToTodo($,Z,X){try{let Q=await this.taskBoard.getById($,Z);if(!Q||Q.status!=="in_progress")return;let G=await this.taskBoard.returnToTodoAfterFailure($,Z,Q.updatedBy);if(!G)return;await this.taskBoard.recordActivity({taskBoardItemId:$,action:"status_changed",actorId:null,data:{from:"in_progress",to:"todo",reason:X}}).catch(()=>{}),x4(Z,G)}catch(Q){console.error(`[task-board-review-sweeper] returning ${$} to todo failed`,Q)}}async reconcileItem($,Z){let X=await this.taskBoard.getById($,Z);if(!X)return!1;if(X.status!=="in_review"||X.assigneeId!==d4)return!1;await this.taskBoard.markSwept($,Z);let Q=await this.taskBoard.listPrs($,Z);if(Q.length===0)return!1;let G=await this.contextFactory(Z,X.assignedBy??X.createdBy);if(!G)return!1;if(await FW$(G,X))return!0;let Y=await Promise.all(Q.map(async(J)=>({...J,...await Mn0(G,Z,J)})));if(Y.every((J)=>J.state===null))console.warn(`[task-board-review-sweeper] ${$}: no live PR state from GitHub (${Y.length} PR(s)) \u2014 proceeding on unknown`);if(!qn0(Y))return!1;return await vw0(G,X),!0}dispose(){if(this.timer)clearInterval(this.timer),this.timer=null}}var T66=60000,R66=300000,I66=50,q66=60000,M66=120000;var Tb$=B(()=>{qZ();jn0();YO();cw0();e9();G3();Cn0();yx()});import{readdir as S66,rm as kj0}from"fs/promises";import{join as Sj0}from"path";async function Vj0($){let Z=new Date;Z.setUTCDate(Z.getUTCDate()-V66),Z.setUTCHours(0,0,0,0);let X=0;try{let Q=await nC($);for(let G of Q)if(/^\d{4}$/.test(G))X+=await Rb$($,G,Z);else if(!G.startsWith(".")){let Y=Sj0($,G),J=await nC(Y);for(let K of J){if(!/^\d{4}$/.test(K))continue;X+=await Rb$(Y,K,Z)}if((await nC(Y)).length===0)await kj0(Y,{recursive:!0,force:!0})}}catch(Q){console.warn("monitoring retention cleanup failed:",Q)}return X}async function Rb$($,Z,X){let Q=0,G=Sj0($,Z),Y=await nC(G);for(let W of Y){if(!/^\d{2}$/.test(W))continue;let K=Sj0(G,W),H=await nC(K);for(let F of H){if(!/^\d{2}$/.test(F))continue;let U=new Date(`${Z}-${W}-${F}T00:00:00Z`);if(isNaN(U.getTime()))continue;if(U<X){let w=Sj0(K,F);await kj0(w,{recursive:!0,force:!0}),Q++}}if((await nC(K)).length===0)await kj0(K,{recursive:!0,force:!0})}if((await nC(G)).length===0)await kj0(G,{recursive:!0,force:!0});return Q}async function nC($){try{return(await S66($)).filter((X)=>!X.startsWith("."))}catch{return[]}}var V66=30;var R41=()=>{};import{DBOS as I41,SchedulerMode as C66}from"@dbos-inc/dbos-sdk";async function v66(){let $=[KJ(),pC(),iK()],Z=0;for(let X of $)try{Z+=await Vj0(X)}catch(Q){console.error("[monitoring-retention] cleanup failed:",Q)}return console.log(`[monitoring-retention] deleted ${Z} day-dir(s) across ${$.length} signal dir(s)`),{deleted:Z,dirs:$.length}}async function b66($,Z){await I41.runStep(()=>v66(),{name:"monitoringRetention"})}function qb$(){if(Ib$)return;Ib$=!0;let $=I41.registerWorkflow(b66,{name:"monitoringRetentionWorkflow"});I41.registerScheduled($,{name:"monitoringRetentionWorkflow",crontab:_66,mode:C66.ExactlyOncePerIntervalWhenActive})}var _66="23 4 * * *",Ib$=!1;var Mb$=B(()=>{rQ();R41()});function kb$($){return async(Z,X)=>{let Q=await $.db.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["member.role","organization.id as orgId","organization.slug as orgSlug","organization.name as orgName"]).where("member.userId","=",X).where("member.organizationId","=",Z).executeTakeFirst();if(!Q)return console.warn(`[automationContextFactory] User ${X} not found in org ${Z} \u2014 returning null`),null;let G=await xK.create();G.auth.user={id:X,role:Q.role},G.organization={id:Q.orgId,slug:Q.orgSlug,name:Q.orgName};let Y=await d11($.db,Z,Q.role);return G.boundAuth=l11({auth:G.authInstance,headers:new Headers,role:Q.role,permissions:Y,userId:X}),G.access=new dD(X,void 0,G.boundAuth,Q.role,"self"),Tg(G,{id:Q.orgId,slug:Q.orgSlug}),G}}var Sb$=B(()=>{mD();Dg()});function f66(){return{services:[{name:"Postgres",status:"pending",port:0},{name:"NATS",status:"pending",port:0}],migrationsStatus:"pending",serverUrl:null,logs:[]}}function y66(){for(let $ of x66)$()}function Vb$($){let Z=[...q41.logs,$];q41={...q41,logs:Z.length>500?Z.slice(-500):Z},y66()}function M41(){return g66}var q41,x66,g66=!1;var k41=B(()=>{q41=f66(),x66=new Set});import{EventEmitter as h66}from"events";var S41;var Cb$=B(()=>{k41();S41=new h66;S41.on("request",($)=>{Vb$($)})});function _b$(){return async($,Z)=>{let X=Date.now(),Q=$.req.method,G=$.req.path;if(G==="/api/auth/get-session"||G.includes("favicon")){await Z();return}let Y="",J=!1;if(G.startsWith("/mcp")&&Q==="POST"){J=!0;try{if($.req.header("Content-Type")?.includes("application/json")){let U=await $.req.raw.clone().json();if(U.method==="tools/call"&&U.params?.name){let w=pg(U.params.name),O=U.params.arguments||{},D=Object.keys(O).map((E)=>pg(E)),L=D.length>0?D.slice(0,3).join(",")+(D.length>3?"\u2026":""):"";Y=`${e6.tool}${w}${e6.dim}(${L})${e6.reset}`}else if(U.method)Y=`${e6.dim}${pg(U.method)}${e6.reset}`}}catch{}}let W=pg(G);if(G.startsWith("/mcp/conn_")){let N=G.split("/")[2]??"";W=`/mcp/${e6.mcp}${pg(N.slice(0,12))}\u2026${e6.reset}`}else if(G==="/mcp")W=`${e6.mcp}/mcp${e6.reset}`;else if(G==="/mcp/registry")W=`${e6.mcp}/mcp/registry${e6.reset}`;let K=c66(Q),H=J?"\u25C0":"\u2190";if(!M41())console.log(`${e6.dim}${H}${e6.reset} ${K}${Q}${e6.reset} ${W}${Y?` ${Y}`:""}`);try{await Z()}finally{let N=Date.now()-X,F=$.res.status,U=u66(F),w=N<1000?`${N}ms`:`${(N/1000).toFixed(1)}s`,O=J?"\u25B6":"\u2192";if(!M41())console.log(`${e6.dim}${O}${e6.reset} ${K}${Q}${e6.reset} ${W}${Y?` ${Y}`:""} ${U}${F}${e6.reset} ${e6.duration}${w}${e6.reset}`);S41.emit("request",{method:Q,path:pg(G),status:F,duration:N,timestamp:new Date})}}}var e6,u66=($)=>{if($>=500)return e6.serverError;if($>=400)return e6.clientError;if($>=300)return e6.redirect;return e6.ok},c66=($)=>{return e6[$]||e6.reset},pg=($)=>{return $.replace(/\r/g,"").replace(/\n/g,"").replace(/\x1b\[[0-9;]*m/g,"").replace(/[\x00-\x1f\x7f-\x9f]/g,"")};var vb$=B(()=>{k41();Cb$();e6={reset:"\x1B[0m",dim:"\x1B[2m",bold:"\x1B[1m",GET:"\x1B[36m",POST:"\x1B[33m",PUT:"\x1B[35m",DELETE:"\x1B[31m",ok:"\x1B[32m",redirect:"\x1B[36m",clientError:"\x1B[33m",serverError:"\x1B[31m",mcp:"\x1B[35m",tool:"\x1B[96m",duration:"\x1B[90m"}});import{createHmac as yb$}from"crypto";import{mkdir as l66,readdir as d66,rm as bb$,stat as gb$}from"fs/promises";import{join as C41,relative as m66}from"path";import{z as E$}from"zod";function ub$($){let Z=$.replace(/[^a-zA-Z0-9_-]/g,"_");return C41(i66,Z)}function cb$($){return $.replace(/^\/+/,"").replace(/\.\./g,"")}function V41($,Z){let X=ub$($),Q=cb$(Z);return C41(X,Q)}function n66($,Z,X,Q){let G=c0().encryptionKey||"dev-secret",Y=`${$}:${Z}:${X}:${Q}`;return yb$("sha256",G).update(Y).digest("hex")}function xb$($,Z,X,Q,G){let Y=Math.floor(Date.now()/1000)+Q,J=n66(Z,X,Y,G),W=new URL(`/api/dev-assets/${Z}/${cb$(X)}`,$);return W.searchParams.set("expires",Y.toString()),W.searchParams.set("signature",J),W.searchParams.set("method",G),W.toString()}function lb$($,Z,X){let Q=`${$}:${Z.getTime()}:${X}`;return`"${yb$("md5","etag").update(Q).digest("hex")}"`}async function db$($,Z,X,Q,G){try{let Y=await d66($,{withFileTypes:!0});for(let J of Y){let W=C41($,J.name),H=m66(Z,W).replace(/\\/g,"/");if(X&&!H.startsWith(X))continue;if(J.isDirectory())if(Q){let N=H+"/";if(!X||N.startsWith(X)){if(!(X?H.slice(X.length):H).includes("/"))G.commonPrefixes.add(N)}}else await db$(W,Z,X,Q,G);else if(J.isFile()){if(Q&&X){let N=H.slice(X.length);if(N.includes(Q)){let F=N.indexOf(Q),U=X+N.slice(0,F+1);G.commonPrefixes.add(U);continue}}try{let N=await gb$(W);G.objects.push({key:H,size:N.size,lastModified:N.mtime.toISOString(),etag:lb$(W,N.mtime,N.size)})}catch{}}}}catch{}}function mb$($,Z){let Q=r($).id;return[{name:"LIST_OBJECTS",description:"List objects in the local assets directory with pagination support",inputSchema:E$.object({prefix:E$.string().optional(),maxKeys:E$.number().optional().default(1000),continuationToken:E$.string().optional(),delimiter:E$.string().optional()}),outputSchema:E$.object({objects:E$.array(E$.object({key:E$.string(),size:E$.number(),lastModified:E$.string(),etag:E$.string()})),nextContinuationToken:E$.string().optional(),isTruncated:E$.boolean(),commonPrefixes:E$.array(E$.string()).optional()}),handler:async(G)=>{let Y=G,J=Y.prefix||"",W=Y.maxKeys??1000,K=Y.delimiter,H=Y.continuationToken,N=ub$(Q);await l66(N,{recursive:!0});let F={objects:[],commonPrefixes:new Set};await db$(N,N,J,K,F),F.objects.sort((L,E)=>L.key.localeCompare(E.key));let U=0;if(H){if(U=F.objects.findIndex((L)=>L.key>H),U===-1)U=F.objects.length}let w=F.objects.slice(U,U+W),O=U+W<F.objects.length,D=O?w[w.length-1]?.key:void 0;return{objects:w,isTruncated:O,nextContinuationToken:D,commonPrefixes:Array.from(F.commonPrefixes).sort()}}},{name:"GET_OBJECT_METADATA",description:"Get metadata for a file in the local assets directory",inputSchema:E$.object({key:E$.string()}),outputSchema:E$.object({contentType:E$.string().optional(),contentLength:E$.number(),lastModified:E$.string(),etag:E$.string(),metadata:E$.record(E$.string(),E$.string()).optional()}),handler:async(G)=>{let Y=G,J=V41(Q,Y.key),W=await gb$(J);return{contentType:R$1(Y.key),contentLength:W.size,lastModified:W.mtime.toISOString(),etag:lb$(J,W.mtime,W.size)}}},{name:"GET_PRESIGNED_URL",description:"Generate a presigned URL for downloading a file from local storage",inputSchema:E$.object({key:E$.string(),expiresIn:E$.number().optional()}),outputSchema:E$.object({url:E$.string(),expiresIn:E$.number()}),handler:async(G)=>{let Y=G,J=Y.expiresIn??fb$;return{url:xb$(Z,Q,Y.key,J,"GET"),expiresIn:J}}},{name:"PUT_PRESIGNED_URL",description:"Generate a presigned URL for uploading a file to local storage",inputSchema:E$.object({key:E$.string(),expiresIn:E$.number().optional(),contentType:E$.string().optional()}),outputSchema:E$.object({url:E$.string(),expiresIn:E$.number()}),handler:async(G)=>{let Y=G,J=Y.expiresIn??fb$;return{url:xb$(Z,Q,Y.key,J,"PUT"),expiresIn:J}}},{name:"DELETE_OBJECT",description:"Delete a single file from local storage",inputSchema:E$.object({key:E$.string()}),outputSchema:E$.object({success:E$.boolean(),key:E$.string()}),handler:async(G)=>{let Y=G,J=V41(Q,Y.key);try{return await bb$(J),{success:!0,key:Y.key}}catch{return{success:!1,key:Y.key}}}},{name:"DELETE_OBJECTS",description:"Delete multiple files from local storage",inputSchema:E$.object({keys:E$.array(E$.string()).max(1000)}),outputSchema:E$.object({deleted:E$.array(E$.string()),errors:E$.array(E$.object({key:E$.string(),message:E$.string()}))}),handler:async(G)=>{let Y=G,J=[],W=[];return await Promise.all(Y.keys.map(async(K)=>{let H=V41(Q,K);try{await bb$(H),J.push(K)}catch(N){W.push({key:K,message:N instanceof Error?N.message:"Unknown error"})}})),{deleted:J,errors:W}}}]}async function _41($,Z,X){let Q=mb$(Z,X),G=new AW({name:"dev-assets-mcp",version:"1.0.0"},{capabilities:{tools:{}},jsonSchemaValidator:Y5});for(let J of Q){let W="shape"in J.inputSchema?J.inputSchema.shape:E$.object({}).shape,K=J.outputSchema&&"shape"in J.outputSchema?J.outputSchema.shape:E$.object({}).shape;G.registerTool(J.name,{description:J.description??"",inputSchema:W,outputSchema:K,annotations:J.annotations,_meta:J._meta},async(H)=>{try{let N=await J.handler(H);return{content:[{type:"text",text:JSON.stringify(N)}],structuredContent:N}}catch(N){return{content:[{type:"text",text:`Error: ${N.message}`}],isError:!0}}})}let Y=new lX({enableJsonResponse:$.headers.get("Accept")?.includes("application/json")??!1});return await G.connect(Y),lY(G,Y,$,"mcp:dev-assets")}async function ib$($,Z,X,Q){let Y=mb$(X,Q).find((J)=>J.name===$);if(!Y)return{content:[{type:"text",text:`Tool not found: ${$}`}],isError:!0};try{let J=await Y.handler(Z);return{content:[{type:"text",text:JSON.stringify(J)}]}}catch(J){return{content:[{type:"text",text:J instanceof Error?J.message:String(J)}],isError:!0}}}var i66="./data/assets",fb$=3600,hb$,nb$;var pb$=B(()=>{S$();lx();y8();dc();bV();RX();cE0();hb$=new B1;hb$.all("/",async($)=>{let Z=$.get("studioContext"),X=new URL($.req.url),Q=`${X.protocol}//${X.host}`;return _41($.req.raw,Z,Q)});nb$=hb$});var tb$={};N4(tb$,{mountDevRoutes:()=>p66});function p66($,Z){$.all("/mcp/:connectionId{.*_dev-assets$}",Z,async(Q)=>{let G=Q.get("studioContext"),Y=new URL(Q.req.url),J=`${Y.protocol}//${Y.host}`;return _41(Q.req.raw,G,J)}),$.all("/mcp/:connectionId{.*_dev-assets$}/call-tool/:toolName",Z,async(Q)=>{let G=Q.get("studioContext"),Y=new URL(Q.req.url),J=`${Y.protocol}//${Y.host}`,W=Q.req.param("toolName");if(!W)return Q.json({error:"Missing tool name"},400);let K=await Q.req.json(),H=await ib$(W,K,G,J);if(H.isError)return Q.json(H.content,500);return Q.json(H.content)}),$.use("/mcp/dev-assets",Z),$.route("/mcp/dev-assets",nb$);let X=new B1;X.use("*",d3({mountPath:"/api/dev-assets"})),X.route("/",uE0({orgFromPath:!1})),$.route("/api/dev-assets",X)}var ob$=B(()=>{y8();D$1();cE0();pb$()});import{sql as t66}from"kysely";import{randomUUID as rb$}from"crypto";import{z as o66}from"zod";async function a66($){let Z=new Date().toISOString(),X=rb$(),Q=h4.SELF($.organizationId),G="registry.publish_request.created",Y={requestId:$.request.id,requestedId:$.request.requested_id,title:$.request.title,status:$.request.status,createdAt:$.request.created_at,requester:{name:$.request.requester_name,email:$.request.requester_email}};await $.db.insertInto("events").values({id:X,organization_id:$.organizationId,type:"registry.publish_request.created",source:Q,specversion:"1.0",subject:$.request.id,time:Z,datacontenttype:"application/json",dataschema:null,data:JSON.stringify(Y),cron:null,status:"pending",attempts:0,last_error:null,next_retry_at:null,created_at:Z,updated_at:Z}).execute();let J=await $.db.selectFrom("event_subscriptions").select(["id"]).where("organization_id","=",$.organizationId).where("enabled","=",1).where("event_type","=","registry.publish_request.created").where((W)=>W.or([W("publisher","is",null),W("publisher","=",Q)])).execute();if(J.length>0)await $.db.insertInto("event_deliveries").values(J.map((W)=>({id:rb$(),event_id:X,subscription_id:W.id,status:"pending",attempts:0,last_error:null,delivered_at:null,next_retry_at:null,created_at:Z}))).execute();try{await t66`SELECT
       pg_notify('studio_events', ${X}),