decocms 4.213.2 → 4.213.3

package/dist/server/server.js

@@ -1035,7 +1035,7 @@ ${Y}`:Y}var X$$,o04;var Bl0=B(()=>{X$$=/[\r\n<>]/,o04=/^[^\s@<>]+@[^\s@<>]+\.[^\
 `);let Q=Z.pax;if(Q)for(let Y in Q)X+=Km0(" "+Y+"="+Q[Y]+`
 `);return v4.from(X)};E74.decodePax=function(Z){let X={};while(Z.length){let Q=0;while(Q<Z.length&&Z[Q]!==32)Q++;let Y=parseInt(v4.toString(Z.subarray(0,Q)),10);if(!Y)return X;let G=v4.toString(Z.subarray(Q+1,Y-1)),J=G.indexOf("=");if(J===-1)return X;X[G.slice(0,J)]=G.slice(J+1),Z=Z.subarray(Y)}return X};E74.encode=function(Z){let X=v4.alloc(512),Q=Z.name,Y="";if(Z.typeflag===5&&Q[Q.length-1]!=="/")Q+="/";if(v4.byteLength(Q)!==Q.length)return null;while(v4.byteLength(Q)>100){let G=Q.indexOf("/");if(G===-1)return null;Y+=Y?"/"+Q.slice(0,G):Q.slice(0,G),Q=Q.slice(G+1)}if(v4.byteLength(Q)>100||v4.byteLength(Y)>155)return null;if(Z.linkname&&v4.byteLength(Z.linkname)>100)return null;if(v4.write(X,Q),v4.write(X,uO(Z.mode&4095,6),100),v4.write(X,uO(Z.uid,6),108),v4.write(X,uO(Z.gid,6),116),D74(Z.size,X,124),v4.write(X,uO(Z.mtime.getTime()/1000|0,11),136),X[156]=48+w74(Z.type),Z.linkname)v4.write(X,Z.linkname,157);if(v4.copy(r9$,X,257),v4.copy(W74,X,263),Z.uname)v4.write(X,Z.uname,265);if(Z.gname)v4.write(X,Z.gname,297);if(v4.write(X,uO(Z.devmajor||0,6),329),v4.write(X,uO(Z.devminor||0,6),337),Y)v4.write(X,Y,345);return v4.write(X,uO(s9$(X),6),148),X};E74.decode=function(Z,X,Q){let Y=Z[156]===0?0:Z[156]-48,G=kx(Z,0,100,X),J=hO(Z,100,8),W=hO(Z,108,8),K=hO(Z,116,8),H=hO(Z,124,12),N=hO(Z,136,12),F=O74(Y),U=Z[157]===0?null:kx(Z,157,100,X),O=kx(Z,265,32),w=kx(Z,297,32),D=hO(Z,329,8),L=hO(Z,337,8),E=s9$(Z);if(E===256)return null;if(E!==hO(Z,148,8))throw Error("Invalid tar header. Maybe the tar is corrupted or it needs to be gunzipped?");if(N74(Z)){if(Z[345])G=kx(Z,345,155,X)+"/"+G}else if(F74(Z));else if(!Q)throw Error("Invalid tar header: unknown format.");if(Y===0&&G&&G[G.length-1]==="/")Y=5;return{name:G,mode:J,uid:W,gid:K,size:H,mtime:new Date(1000*N),type:F,linkname:U,uname:O,gname:w,devmajor:D,devminor:L,pax:null}};function N74($){return v4.equals(r9$,$.subarray(257,263))}function F74($){return v4.equals(K74,$.subarray(257,263))&&v4.equals(H74,$.subarray(263,265))}function U74($,Z,X){if(typeof $!=="number")return X;if($=~~$,$>=Z)return Z;if($>=0)return $;if($+=Z,$>=0)return $;return 0}function O74($){switch($){case 0:return"file";case 1:return"link";case 2:return"symlink";case 3:return"character-device";case 4:return"block-device";case 5:return"directory";case 6:return"fifo";case 7:return"contiguous-file";case 72:return"pax-header";case 55:return"pax-global-header";case 27:return"gnu-long-link-path";case 28:case 30:return"gnu-long-path"}return null}function w74($){switch($){case"file":return 0;case"link":return 1;case"symlink":return 2;case"character-device":return 3;case"block-device":return 4;case"directory":return 5;case"fifo":return 6;case"contiguous-file":return 7;case"pax-header":return 72}return 0}function a9$($,Z,X,Q){for(;X<Q;X++)if($[X]===Z)return X;return Q}function s9$($){let Z=256;for(let X=0;X<148;X++)Z+=$[X];for(let X=156;X<512;X++)Z+=$[X];return Z}function uO($,Z){if($=$.toString(8),$.length>Z)return"7777777777777777777".slice(0,Z)+" ";return"0000000000000000000".slice(0,Z-$.length)+$+" "}function B74($,Z,X){Z[X]=128;for(let Q=11;Q>0;Q--)Z[X+Q]=$&255,$=Math.floor($/256)}function D74($,Z,X){if($.toString(8).length>11)B74($,Z,X);else v4.write(Z,uO($,11),X)}function L74($){let Z;if($[0]===128)Z=!0;else if($[0]===255)Z=!1;else return null;let X=[],Q;for(Q=$.length-1;Q>0;Q--){let J=$[Q];if(Z)X.push(J);else X.push(255-J)}let Y=0,G=X.length;for(Q=0;Q<G;Q++)Y+=X[Q]*Math.pow(256,Q);return Z?Y:-1*Y}function hO($,Z,X){if($=$.subarray(Z,Z+X),Z=0,$[Z]&128)return L74($);else{while(Z<$.length&&$[Z]===32)Z++;let Q=U74(a9$($,32,Z,$.length),$.length,$.length);while(Z<Q&&$[Z]===0)Z++;if(Q===Z)return 0;return parseInt(v4.toString($.subarray(Z,Q)),8)}}function kx($,Z,X,Q){return v4.toString($.subarray(Z,a9$($,0,Z,Z+X)),Q)}function Km0($){let Z=v4.byteLength($),X=Math.floor(Math.log(Z)/Math.log(10))+1;if(Z+X>=Math.pow(10,X))X++;return Z+X+$}});var JZ$=C((tK9,GZ$)=>{var{Writable:R74,Readable:I74,getStreamError:e9$}=Wm0(),q74=Zm0(),$Z$=Mx(),Sx=Hm0(),M74=$Z$.alloc(0);class ZZ${constructor(){this.buffered=0,this.shifted=0,this.queue=new q74,this._offset=0}push($){this.buffered+=$.byteLength,this.queue.push($)}shiftFirst($){return this._buffered===0?null:this._next($)}shift($){if($>this.buffered)return null;if($===0)return M74;let Z=this._next($);if($===Z.byteLength)return Z;let X=[Z];while(($-=Z.byteLength)>0)Z=this._next($),X.push(Z);return $Z$.concat(X)}_next($){let Z=this.queue.peek(),X=Z.byteLength-this._offset;if($>=X){let Q=this._offset?Z.subarray(this._offset,Z.byteLength):Z;return this.queue.shift(),this._offset=0,this.buffered-=X,this.shifted+=X,Q}return this.buffered-=$,this.shifted+=$,Z.subarray(this._offset,this._offset+=$)}}class XZ$ extends I74{constructor($,Z,X){super();this.header=Z,this.offset=X,this._parent=$}_read($){if(this.header.size===0)this.push(null);if(this._parent._stream===this)this._parent._update();$(null)}_predestroy(){this._parent.destroy(e9$(this))}_detach(){if(this._parent._stream===this)this._parent._stream=null,this._parent._missing=YZ$(this.header.size),this._parent._update()}_destroy($){this._detach(),$(null)}}class QZ$ extends R74{constructor($){super($);if(!$)$={};this._buffer=new ZZ$,this._offset=0,this._header=null,this._stream=null,this._missing=0,this._longHeader=!1,this._callback=Nm0,this._locked=!1,this._finished=!1,this._pax=null,this._paxGlobal=null,this._gnuLongPath=null,this._gnuLongLinkPath=null,this._filenameEncoding=$.filenameEncoding||"utf-8",this._allowUnknownFormat=!!$.allowUnknownFormat,this._unlockBound=this._unlock.bind(this)}_unlock($){if(this._locked=!1,$){this.destroy($),this._continueWrite($);return}this._update()}_consumeHeader(){if(this._locked)return!1;this._offset=this._buffer.shifted;try{this._header=Sx.decode(this._buffer.shift(512),this._filenameEncoding,this._allowUnknownFormat)}catch($){return this._continueWrite($),!1}if(!this._header)return!0;switch(this._header.type){case"gnu-long-path":case"gnu-long-link-path":case"pax-global-header":case"pax-header":return this._longHeader=!0,this._missing=this._header.size,!0}if(this._locked=!0,this._applyLongHeaders(),this._header.size===0||this._header.type==="directory")return this.emit("entry",this._header,this._createStream(),this._unlockBound),!0;return this._stream=this._createStream(),this._missing=this._header.size,this.emit("entry",this._header,this._stream,this._unlockBound),!0}_applyLongHeaders(){if(this._gnuLongPath)this._header.name=this._gnuLongPath,this._gnuLongPath=null;if(this._gnuLongLinkPath)this._header.linkname=this._gnuLongLinkPath,this._gnuLongLinkPath=null;if(this._pax){if(this._pax.path)this._header.name=this._pax.path;if(this._pax.linkpath)this._header.linkname=this._pax.linkpath;if(this._pax.size)this._header.size=parseInt(this._pax.size,10);this._header.pax=this._pax,this._pax=null}}_decodeLongHeader($){switch(this._header.type){case"gnu-long-path":this._gnuLongPath=Sx.decodeLongPath($,this._filenameEncoding);break;case"gnu-long-link-path":this._gnuLongLinkPath=Sx.decodeLongPath($,this._filenameEncoding);break;case"pax-global-header":this._paxGlobal=Sx.decodePax($);break;case"pax-header":this._pax=this._paxGlobal===null?Sx.decodePax($):Object.assign({},this._paxGlobal,Sx.decodePax($));break}}_consumeLongHeader(){this._longHeader=!1,this._missing=YZ$(this._header.size);let $=this._buffer.shift(this._header.size);try{this._decodeLongHeader($)}catch(Z){return this._continueWrite(Z),!1}return!0}_consumeStream(){let $=this._buffer.shiftFirst(this._missing);if($===null)return!1;this._missing-=$.byteLength;let Z=this._stream.push($);if(this._missing===0){if(this._stream.push(null),Z)this._stream._detach();return Z&&this._locked===!1}return Z}_createStream(){return new XZ$(this,this._header,this._offset)}_update(){while(this._buffer.buffered>0&&!this.destroying){if(this._missing>0){if(this._stream!==null){if(this._consumeStream()===!1)return;continue}if(this._longHeader===!0){if(this._missing>this._buffer.buffered)break;if(this._consumeLongHeader()===!1)return!1;continue}let $=this._buffer.shiftFirst(this._missing);if($!==null)this._missing-=$.byteLength;continue}if(this._buffer.buffered<512)break;if(this._stream!==null||this._consumeHeader()===!1)return}this._continueWrite(null)}_continueWrite($){let Z=this._callback;this._callback=Nm0,Z($)}_write($,Z){this._callback=Z,this._buffer.push($),this._update()}_final($){this._finished=this._missing===0&&this._buffer.buffered===0,$(this._finished?null:Error("Unexpected end of data"))}_predestroy(){this._continueWrite(null)}_destroy($){if(this._stream)this._stream.destroy(e9$(this));$(null)}[Symbol.asyncIterator](){let $=null,Z=null,X=null,Q=null,Y=null,G=this;return this.on("entry",K),this.on("error",(F)=>{$=F}),this.on("close",H),{[Symbol.asyncIterator](){return this},next(){return new Promise(W)},return(){return N(null)},throw(F){return N(F)}};function J(F){if(!Y)return;let U=Y;Y=null,U(F)}function W(F,U){if($)return U($);if(Q){F({value:Q,done:!1}),Q=null;return}if(Z=F,X=U,J(null),G._finished&&Z)Z({value:void 0,done:!0}),Z=X=null}function K(F,U,O){if(Y=O,U.on("error",Nm0),Z)Z({value:U,done:!1}),Z=X=null;else Q=U}function H(){if(J($),!Z)return;if($)X($);else Z({value:void 0,done:!0});Z=X=null}function N(F){return G.destroy(F),J(F),new Promise((U,O)=>{if(G.destroyed)return U({value:void 0,done:!0});G.once("close",function(){if(F)O(F);else U({value:void 0,done:!0})})})}}}GZ$.exports=function(Z){return new QZ$(Z)};function Nm0(){}function YZ$($){return $&=511,$&&512-$}});var KZ$=C((oK9,Fm0)=>{var WZ$={S_IFMT:61440,S_IFDIR:16384,S_IFCHR:8192,S_IFBLK:24576,S_IFIFO:4096,S_IFLNK:40960};try{Fm0.exports=z0("fs").constants||WZ$}catch{Fm0.exports=WZ$}});var BZ$=C((rK9,wZ$)=>{var{Readable:k74,Writable:S74,getStreamError:HZ$}=Wm0(),OV=Mx(),Vx=KZ$(),wU0=Hm0(),NZ$=OV.alloc(1024);class FZ$ extends S74{constructor($,Z,X){super({mapWritable:C74,eagerOpen:!0});if(this.written=0,this.header=Z,this._callback=X,this._linkname=null,this._isLinkname=Z.type==="symlink"&&!Z.linkname,this._isVoid=Z.type!=="file"&&Z.type!=="contiguous-file",this._finished=!1,this._pack=$,this._openCallback=null,this._pack._stream===null)this._pack._stream=this;else this._pack._pending.push(this)}_open($){if(this._openCallback=$,this._pack._stream===this)this._continueOpen()}_continuePack($){if(this._callback===null)return;let Z=this._callback;this._callback=null,Z($)}_continueOpen(){if(this._pack._stream===null)this._pack._stream=this;let $=this._openCallback;if(this._openCallback=null,$===null)return;if(this._pack.destroying)return $(Error("pack stream destroyed"));if(this._pack._finalized)return $(Error("pack stream is already finalized"));if(this._pack._stream=this,!this._isLinkname)this._pack._encode(this.header);if(this._isVoid)this._finish(),this._continuePack(null);$(null)}_write($,Z){if(this._isLinkname)return this._linkname=this._linkname?OV.concat([this._linkname,$]):$,Z(null);if(this._isVoid){if($.byteLength>0)return Z(Error("No body allowed for this entry"));return Z()}if(this.written+=$.byteLength,this._pack.push($))return Z();this._pack._drain=Z}_finish(){if(this._finished)return;if(this._finished=!0,this._isLinkname)this.header.linkname=this._linkname?OV.toString(this._linkname,"utf-8"):"",this._pack._encode(this.header);OZ$(this._pack,this.header.size),this._pack._done(this)}_final($){if(this.written!==this.header.size)return $(Error("Size mismatch"));this._finish(),$(null)}_getError(){return HZ$(this)||Error("tar entry destroyed")}_predestroy(){this._pack.destroy(this._getError())}_destroy($){this._pack._done(this),this._continuePack(this._finished?null:this._getError()),$()}}class UZ$ extends k74{constructor($){super($);this._drain=Um0,this._finalized=!1,this._finalizing=!1,this._pending=[],this._stream=null}entry($,Z,X){if(this._finalized||this.destroying)throw Error("already finalized or destroyed");if(typeof Z==="function")X=Z,Z=null;if(!X)X=Um0;if(!$.size||$.type==="symlink")$.size=0;if(!$.type)$.type=V74($.mode);if(!$.mode)$.mode=$.type==="directory"?493:420;if(!$.uid)$.uid=0;if(!$.gid)$.gid=0;if(!$.mtime)$.mtime=new Date;if(typeof Z==="string")Z=OV.from(Z);let Q=new FZ$(this,$,X);if(OV.isBuffer(Z))return $.size=Z.byteLength,Q.write(Z),Q.end(),Q;if(Q._isVoid)return Q;return Q}finalize(){if(this._stream||this._pending.length>0){this._finalizing=!0;return}if(this._finalized)return;this._finalized=!0,this.push(NZ$),this.push(null)}_done($){if($!==this._stream)return;if(this._stream=null,this._finalizing)this.finalize();if(this._pending.length)this._pending.shift()._continueOpen()}_encode($){if(!$.pax){let Z=wU0.encode($);if(Z){this.push(Z);return}}this._encodePax($)}_encodePax($){let Z=wU0.encodePax({name:$.name,linkname:$.linkname,pax:$.pax}),X={name:"PaxHeader",mode:$.mode,uid:$.uid,gid:$.gid,size:Z.byteLength,mtime:$.mtime,type:"pax-header",linkname:$.linkname&&"PaxHeader",uname:$.uname,gname:$.gname,devmajor:$.devmajor,devminor:$.devminor};this.push(wU0.encode(X)),this.push(Z),OZ$(this,Z.byteLength),X.size=$.size,X.type=$.type,this.push(wU0.encode(X))}_doDrain(){let $=this._drain;this._drain=Um0,$()}_predestroy(){let $=HZ$(this);if(this._stream)this._stream.destroy($);while(this._pending.length){let Z=this._pending.shift();Z.destroy($),Z._continueOpen()}this._doDrain()}_read($){this._doDrain(),$()}}wZ$.exports=function(Z){return new UZ$(Z)};function V74($){switch($&Vx.S_IFMT){case Vx.S_IFBLK:return"block-device";case Vx.S_IFCHR:return"character-device";case Vx.S_IFDIR:return"directory";case Vx.S_IFIFO:return"fifo";case Vx.S_IFLNK:return"symlink"}return"file"}function Um0(){}function OZ$($,Z){if(Z&=511,Z)$.push(NZ$.subarray(0,512-Z))}function C74($){return OV.isBuffer($)?$:OV.from($)}});var DZ$=C((_74)=>{_74.extract=JZ$();_74.pack=BZ$()});var jZ$=C((sK9,EZ$)=>{EZ$.exports=LZ$;function LZ$($,Z){if($&&Z)return LZ$($)(Z);if(typeof $!=="function")throw TypeError("need wrapper function");return Object.keys($).forEach(function(Q){X[Q]=$[Q]}),X;function X(){var Q=Array(arguments.length);for(var Y=0;Y<Q.length;Y++)Q[Y]=arguments[Y];var G=$.apply(this,Q),J=Q[Q.length-1];if(typeof G==="function"&&G!==J)Object.keys(J).forEach(function(W){G[W]=J[W]});return G}}});var wm0=C((eK9,Om0)=>{var zZ$=jZ$();Om0.exports=zZ$(BU0);Om0.exports.strict=zZ$(PZ$);BU0.proto=BU0(function(){Object.defineProperty(Function.prototype,"once",{value:function(){return BU0(this)},configurable:!0}),Object.defineProperty(Function.prototype,"onceStrict",{value:function(){return PZ$(this)},configurable:!0})});function BU0($){var Z=function(){if(Z.called)return Z.value;return Z.called=!0,Z.value=$.apply(this,arguments)};return Z.called=!1,Z}function PZ$($){var Z=function(){if(Z.called)throw Error(Z.onceError);return Z.called=!0,Z.value=$.apply(this,arguments)},X=$.name||"Function wrapped with `once`";return Z.onceError=X+" shouldn't be called more than once",Z.called=!1,Z}});var RZ$=C(($H9,TZ$)=>{var b74=wm0(),x74=function(){},y74=global.Bare?queueMicrotask:process.nextTick.bind(process),g74=function($){return $.setHeader&&typeof $.abort==="function"},h74=function($){return $.stdio&&Array.isArray($.stdio)&&$.stdio.length===3},AZ$=function($,Z,X){if(typeof Z==="function")return AZ$($,null,Z);if(!Z)Z={};X=b74(X||x74);var{_writableState:Q,_readableState:Y}=$,G=Z.readable||Z.readable!==!1&&$.readable,J=Z.writable||Z.writable!==!1&&$.writable,W=!1,K=function(){if(!$.writable)H()},H=function(){if(J=!1,!G)X.call($)},N=function(){if(G=!1,!J)X.call($)},F=function(L){X.call($,L?Error("exited with error code: "+L):null)},U=function(L){X.call($,L)},O=function(){y74(w)},w=function(){if(W)return;if(G&&!(Y&&(Y.ended&&!Y.destroyed)))return X.call($,Error("premature close"));if(J&&!(Q&&(Q.ended&&!Q.destroyed)))return X.call($,Error("premature close"))},D=function(){$.req.on("finish",H)};if(g74($))if($.on("complete",H),$.on("abort",O),$.req)D();else $.on("request",D);else if(J&&!Q)$.on("end",K),$.on("close",K);if(h74($))$.on("exit",F);if($.on("end",N),$.on("finish",H),Z.error!==!1)$.on("error",U);return $.on("close",O),function(){if(W=!0,$.removeListener("complete",H),$.removeListener("abort",O),$.removeListener("request",D),$.req)$.req.removeListener("finish",H);$.removeListener("end",K),$.removeListener("close",K),$.removeListener("finish",H),$.removeListener("exit",F),$.removeListener("end",N),$.removeListener("error",U),$.removeListener("close",O)}};TZ$.exports=AZ$});var MZ$=C((ZH9,qZ$)=>{var u74=wm0(),c74=RZ$(),DU0;try{DU0=z0("fs")}catch($){}var li=function(){},l74=typeof process>"u"?!1:/^v?\.0/.test(process.version),LU0=function($){return typeof $==="function"},d74=function($){if(!l74)return!1;if(!DU0)return!1;return($ instanceof(DU0.ReadStream||li)||$ instanceof(DU0.WriteStream||li))&&LU0($.close)},m74=function($){return $.setHeader&&LU0($.abort)},i74=function($,Z,X,Q){Q=u74(Q);var Y=!1;$.on("close",function(){Y=!0}),c74($,{readable:Z,writable:X},function(J){if(J)return Q(J);Y=!0,Q()});var G=!1;return function(J){if(Y)return;if(G)return;if(G=!0,d74($))return $.close(li);if(m74($))return $.abort();if(LU0($.destroy))return $.destroy();Q(J||Error("stream was destroyed"))}},IZ$=function($){$()},n74=function($,Z){return $.pipe(Z)},p74=function(){var $=Array.prototype.slice.call(arguments),Z=LU0($[$.length-1]||li)&&$.pop()||li;if(Array.isArray($[0]))$=$[0];if($.length<2)throw Error("pump requires two streams per minimum");var X,Q=$.map(function(Y,G){var J=G<$.length-1,W=G>0;return i74(Y,J,W,function(K){if(!X)X=K;if(K)Q.forEach(IZ$);if(J)return;Q.forEach(IZ$),Z(X)})});return $.reduce(n74)};qZ$.exports=p74});var xZ$=C((a74)=>{var kZ$=DZ$(),SZ$=MZ$(),VZ$=z0("fs"),r5=z0("path"),di=(global.Bare?global.Bare.platform:process.platform)==="win32";a74.pack=function(Z,X){if(!Z)Z=".";if(!X)X={};let Q=X.fs||VZ$,Y=X.ignore||X.filter||mi,G=X.mapStream||fZ$,J=r74(Q,X.dereference?Q.stat:Q.lstat,Z,Y,X.entries,X.sort),W=X.strict!==!1,K=typeof X.umask==="number"?~X.umask:~CZ$(),H=X.pack||kZ$.pack(),N=X.finish||mi,F=X.map||mi,U=typeof X.dmode==="number"?X.dmode:0,O=typeof X.fmode==="number"?X.fmode:0;if(X.strip)F=bZ$(F,X.strip);if(X.readable)U|=parseInt(555,8),O|=parseInt(444,8);if(X.writable)U|=parseInt(333,8),O|=parseInt(222,8);L();function w(E,j){Q.readlink(r5.join(Z,E),function(z,A){if(z)return H.destroy(z);j.linkname=Bm0(A),H.entry(j,L)})}function D(E,j,z){if(H.destroyed)return;if(E)return H.destroy(E);if(!j){if(X.finalize!==!1)H.finalize();return N(H)}if(z.isSocket())return L();let A={name:Bm0(j),mode:(z.mode|(z.isDirectory()?U:O))&K,mtime:z.mtime,size:z.size,type:"file",uid:z.uid,gid:z.gid};if(z.isDirectory())return A.size=0,A.type="directory",A=F(A)||A,H.entry(A,L);if(z.isSymbolicLink())return A.size=0,A.type="symlink",A=F(A)||A,w(j,A);if(A=F(A)||A,!z.isFile()){if(W)return H.destroy(Error("unsupported type for "+j));return L()}let P=H.entry(A,L),q=G(Q.createReadStream(r5.join(Z,j),{start:0,end:A.size>0?A.size-1:A.size}),A);q.on("error",function(S){P.destroy(S)}),SZ$(q,P)}function L(E){if(E)return H.destroy(E);J(D)}return H};function t74($){return $.length?$[$.length-1]:null}function o74(){return!global.Bare&&process.getuid?process.getuid():-1}function CZ$(){return!global.Bare&&process.umask?process.umask():0}a74.extract=function(Z,X){if(!Z)Z=".";if(!X)X={};Z=r5.resolve(Z);let Q=X.fs||VZ$,Y=X.ignore||X.filter||mi,G=X.mapStream||fZ$,J=X.chown!==!1&&!di&&o74()===0,W=X.extract||kZ$.extract(),K=[],H=new Date,N=typeof X.umask==="number"?~X.umask:~CZ$(),F=X.strict!==!1,U=X.validateSymlinks!==!1,O=X.map||mi,w=typeof X.dmode==="number"?X.dmode:0,D=typeof X.fmode==="number"?X.fmode:0;if(X.strip)O=bZ$(O,X.strip);if(X.readable)w|=parseInt(555,8),D|=parseInt(444,8);if(X.writable)w|=parseInt(333,8),D|=parseInt(222,8);if(W.on("entry",L),X.finish)W.on("finish",X.finish);return W;function L(P,q,S){P=O(P)||P,P.name=Bm0(P.name);let M=r5.join(Z,r5.join("/",P.name));if(Y(M,P))return q.resume(),S();let _=r5.join(M,".")===r5.join(Z,".")?Z:r5.dirname(M);vZ$(Q,_,r5.join(Z,"."),function(r,O0){if(r)return S(r);if(!O0)return S(Error(_+" is not a valid path"));if(P.type==="directory")return K.push([M,P.mtime]),A(M,{fs:Q,own:J,uid:P.uid,gid:P.gid,mode:P.mode},l);A(_,{fs:Q,own:J,uid:P.uid,gid:P.gid,mode:493},function(B0){if(B0)return S(B0);switch(P.type){case"file":return h();case"link":return x();case"symlink":return f()}if(F)return S(Error("unsupported type for "+M+" ("+P.type+")"));q.resume(),S()})});function l(r){if(r)return S(r);j(M,P,function(O0){if(O0)return S(O0);if(di)return S();z(M,P,S)})}function f(){if(di)return S();Q.unlink(M,function(){let r=r5.resolve(r5.dirname(M),P.linkname);if(!p(r)&&U)return S(Error(M+" is not a valid symlink"));_Z$(Q,r,r5.join(Z,"."),function(O0,B0){if(O0)return S(O0);if(!B0&&U)return S(Error(M+" is not a valid symlink"));Q.symlink(P.linkname,M,l)})})}function x(){if(di)return S();Q.unlink(M,function(){let r=r5.join(Z,r5.join("/",P.linkname));Q.realpath(r,function(O0,B0){if(O0||!p(B0))return S(Error(M+" is not a valid hardlink"));Q.link(B0,M,function(s){if(s&&s.code==="EPERM"&&X.hardlinkAsFilesFallback)return q=Q.createReadStream(B0),h();l(s)})})})}function p(r){return r===Z||r.startsWith(Z+r5.sep)}function h(){let r=Q.createWriteStream(M),O0=G(q,P);r.on("error",function(B0){O0.destroy(B0)}),SZ$(O0,r,function(B0){if(B0)return S(B0);r.on("close",l)})}}function E(P,q){let S;while((S=t74(K))&&P.slice(0,S[0].length)!==S[0])K.pop();if(!S)return q();Q.utimes(S[0],H,S[1],q)}function j(P,q,S){if(X.utimes===!1)return S();if(q.type==="directory")return Q.utimes(P,H,q.mtime,S);if(q.type==="symlink")return E(P,S);Q.utimes(P,H,q.mtime,function(M){if(M)return S(M);E(P,S)})}function z(P,q,S){let M=q.type==="symlink",_=M?Q.lchmod:Q.chmod,l=M?Q.lchown:Q.chown;if(!_)return S();let f=(q.mode|(q.type==="directory"?w:D))&N;if(l&&J)l.call(Q,P,q.uid,q.gid,x);else x(null);function x(p){if(p)return S(p);if(!_)return S();_.call(Q,P,f,S)}}function A(P,q,S){Q.stat(P,function(M){if(!M)return S(null);if(M.code!=="ENOENT")return S(M);Q.mkdir(P,{mode:q.mode,recursive:!0},function(_,l){if(_)return S(_);z(P,q,S)})})}};function _Z$($,Z,X,Q){if(Z===X)return Q(null,!0);if(!Z.startsWith(X+r5.sep))return Q(null,!1);$.lstat(Z,function(Y,G){if(Y&&Y.code!=="ENOENT"&&Y.code!=="EPERM")return Q(Y);if(Y||!G.isSymbolicLink())return _Z$($,r5.join(Z,".."),X,Q);Q(null,!1)})}function vZ$($,Z,X,Q){if(Z===X)return Q(null,!0);$.lstat(Z,function(Y,G){if(Y&&Y.code!=="ENOENT"&&Y.code!=="EPERM")return Q(Y);if(Y||G.isDirectory())return vZ$($,r5.join(Z,".."),X,Q);Q(null,!1)})}function mi(){}function fZ$($){return $}function Bm0($){return di?$.replace(/\\/g,"/").replace(/[:?<>|]/g,"_"):$}function r74($,Z,X,Q,Y,G){if(!Y)Y=["."];let J=Y.slice(0);return function(K){if(!J.length)return K(null);let H=J.shift(),N=r5.join(X,H);Z.call($,N,function(F,U){if(F)return K(Y.indexOf(H)===-1&&F.code==="ENOENT"?null:F);if(!U.isDirectory())return K(null,H,U);$.readdir(N,function(O,w){if(O)return K(O);if(G)w.sort();for(let D=0;D<w.length;D++)if(!Q(r5.join(X,H,w[D])))J.push(r5.join(H,w[D]));K(null,H,U)})})}}function bZ$($,Z){return function(X){X.name=X.name.split("/").slice(Z).join("/");let Q=X.linkname;if(Q&&(X.type==="link"||r5.isAbsolute(Q)))X.linkname=Q.split("/").slice(Z).join("/");return $(X)}}});var $X4,ZX4;var yZ$=B(()=>{ed0();$X4=k(R9$(),1),ZX4=k(xZ$(),1)});var EU0=()=>{};var gZ$=B(()=>{_F0()});var hZ$=B(()=>{GU0();YU0();EU0()});var uZ$=()=>{};var cZ$=()=>{};var Dm0=B(()=>{G9$();ad0();GU0();N9$();od0();ed0();F9$();U9$();O9$();w9$();rd0();B9$();yZ$();EU0();gZ$();hZ$();uZ$();cZ$();EU0()});var B9,_9,wV,ii;var ni=B(()=>{B9={CLAIM_API_GROUP:"extensions.agents.x-k8s.io",CLAIM_API_VERSION:"v1alpha1",CLAIM_PLURAL:"sandboxclaims",SANDBOX_API_GROUP:"agents.x-k8s.io",SANDBOX_API_VERSION:"v1alpha1",SANDBOX_PLURAL:"sandboxes",POD_NAME_ANNOTATION:"agents.x-k8s.io/pod-name"};_9=class _9 extends Error{cause;constructor($,Z){super($);if(this.name="SandboxError",this.cause=Z,Z instanceof Error&&Z.stack)this.stack=`${this.stack}
 Caused by: ${Z.stack}`}};wV=class wV extends _9{constructor($,Z){super($,Z);this.name="SandboxTimeoutError"}};ii=class ii extends _9{constructor($,Z){super($,Z);this.name="SandboxAlreadyExistsError"}}});async function XX4($){let Z=$.getCurrentCluster();if(!Z)throw new _9("No active cluster in kubeconfig");let X={};await $.applyToHTTPSOptions(X);let Q={},Y=X.headers??{};for(let[G,J]of Object.entries(Y))if(Array.isArray(J))Q[G]=J.join(", ");else if(J!==void 0)Q[G]=String(J);if(typeof X.auth==="string"&&!Q.Authorization)Q.Authorization=`Basic ${Buffer.from(X.auth).toString("base64")}`;return{server:Z.server.replace(/\/+$/,""),headers:Q,tls:{cert:Lm0(X.cert),key:Lm0(X.key),ca:Lm0(X.ca),rejectUnauthorized:Z.skipTLSVerify?!1:void 0}}}function Lm0($){if($==null)return;if(typeof $==="string")return $;if(Buffer.isBuffer($))return $.toString("utf8");return String($)}async function j3($,Z){let X=await XX4($),Q={...X.headers,...Z.headers};if(Z.method==="PATCH")Q["content-type"]=Z.patchType==="apply"?"application/apply-patch+yaml":Z.patchType==="strategic-merge"?"application/strategic-merge-patch+json":"application/merge-patch+json";else if(Z.body!==void 0&&!("content-type"in Q))Q["content-type"]="application/json";let Y={method:Z.method,headers:Q,body:Z.body===void 0?void 0:JSON.stringify(Z.body),signal:Z.signal,tls:X.tls,...Z.stream?{timeout:!1}:{}};return fetch(`${X.server}${Z.path}`,Y)}async function Em0($){try{return await $.json()}catch{return null}}async function jU0($,Z){if($.ok)return;let X=await Em0($),Q=X?.message??`${Z} failed: ${$.status} ${$.statusText}`;throw new lZ$($.status,X,Q)}async function Cx($,Z,X,Q,Y="none"){try{let G=await j3($,Z);if(G.status===404)return null;if(await jU0(G,X),Y==="json")return await G.json();return null}catch(G){throw new _9(Q,G)}}async function pi($,Z,X){let Q=`${jm0}/${encodeURIComponent(Z)}/${B9.CLAIM_PLURAL}`,Y;try{Y=await j3($,{method:"POST",path:Q,body:X})}catch(H){let N=H instanceof Error?H.message:String(H);throw console.warn(`[agent-sandbox/client] createSandboxClaim ${X.metadata.name} transport error: ${N}`),new _9(`Failed to create SandboxClaim: ${X.metadata.name} (transport error: ${N})`,H)}if(Y.ok)return;let G=await Em0(Y),J=G?.reason?` ${G.reason}`:"",W=G?.message??Y.statusText,K=`Failed to create SandboxClaim: ${X.metadata.name} (${Y.status}${J}: ${W})`;if(console.warn(`[agent-sandbox/client] createSandboxClaim ${X.metadata.name} rejected: status=${Y.status} reason=${G?.reason??"<none>"} message=${W}`),Y.status===409)throw new ii(K);throw new _9(K)}async function zU0($,Z,X,Q=60000){let Y=Date.now()+Q,G=500,J;while(!0){let W=await z3($,Z,X).catch(()=>{return});if(!W)return;if(J=W,Date.now()>=Y){let K=J.metadata?.finalizers??[],H=J.metadata?.deletionTimestamp??"<unknown>";throw new wV(`SandboxClaim ${X} still terminating after ${Q}ms (deletionTimestamp=${H}, finalizers=[${K.join(", ")}])`)}await C$(500)}}function zm0($,Z){return`${jm0}/${encodeURIComponent($)}/${B9.CLAIM_PLURAL}/${encodeURIComponent(Z)}`}async function PU0($,Z,X,Q){await Cx($,{method:"PATCH",path:zm0(Z,X),patchType:"merge",body:{spec:{lifecycle:{shutdownPolicy:"Delete",shutdownTime:Q}}}},"patchSandboxClaimShutdown",`Failed to patch SandboxClaim shutdownTime: ${X}`)}async function cO($,Z,X){await Cx($,{method:"DELETE",path:zm0(Z,X)},"deleteSandboxClaim",`Failed to delete SandboxClaim: ${X}`)}async function z3($,Z,X){return await Cx($,{method:"GET",path:zm0(Z,X)},"getSandboxClaim",`Failed to get SandboxClaim: ${X}`,"json")??void 0}async function dZ$($,Z,X,Q=60){let Y=Date.now()+Q*1000,G=200;while(Date.now()<Y){let W=(await z3($,Z,X).catch(()=>{return}))?.status?.sandbox?.name;if(W)return W;await C$(200)}throw new wV(`SandboxClaim ${X} did not record an adopted Sandbox (status.sandbox.name) within ${Q}s`)}async function mZ$($,Z,X){let Y=(await Cx($,{method:"GET",path:`${jm0}/${encodeURIComponent(Z)}/sandboxwarmpools/${encodeURIComponent(X)}`},"getSandboxWarmPool",`Failed to get SandboxWarmPool: ${X}`,"json"))?.status?.selector;if(!Y)return null;let G=await j3($,{method:"GET",path:`/api/v1/namespaces/${encodeURIComponent(Z)}/pods?labelSelector=${encodeURIComponent(Y)}`});return await jU0(G,"listWarmPoolPods"),((await G.json()).items??[]).filter((W)=>W.status?.phase==="Running").flatMap((W)=>W.metadata?.name&&W.metadata.uid?[{name:W.metadata.name,uid:W.metadata.uid,labels:W.metadata.labels??{}}]:[])}async function iZ$($,Z,X,Q){try{let Y=await j3($,{method:"GET",path:`/api/v1/namespaces/${encodeURIComponent(Z)}/pods/${encodeURIComponent(X)}`});if(!Y.ok)return!1;return!(await Y.json()).metadata?.labels?.[Q]}catch{return!1}}function Pm0($,Z){return`${QX4}/${encodeURIComponent($)}/${tZ$}/${encodeURIComponent(Z)}`}async function AU0($,Z,X){let Q=new URLSearchParams({fieldManager:rZ$,force:"true"}),Y=`${Pm0(Z,X.metadata.name)}?${Q}`;try{let G=await j3($,{method:"PATCH",path:Y,patchType:"apply",body:X});await jU0(G,"applyHttpRoute")}catch(G){throw new _9(`Failed to apply HTTPRoute: ${X.metadata.name}`,G)}}async function TU0($,Z,X){await Cx($,{method:"DELETE",path:Pm0(Z,X)},"deleteHttpRoute",`Failed to delete HTTPRoute: ${X}`)}async function oZ$($,Z,X){return await Cx($,{method:"GET",path:Pm0(Z,X)},"getHttpRoute",`Failed to get HTTPRoute: ${X}`,"json")??void 0}async function aZ$($,Z,X,Q){let Y={apiVersion:"v1",kind:"Service",metadata:{name:X},spec:{ports:[{name:Q.name,port:Q.port,targetPort:Q.targetPort,protocol:Q.protocol??"TCP"}]}},G=new URLSearchParams({fieldManager:rZ$,force:"true"}),J=`/api/v1/namespaces/${encodeURIComponent(Z)}/services/${encodeURIComponent(X)}?${G}`;try{let W=await j3($,{method:"PATCH",path:J,patchType:"apply",body:Y});await jU0(W,"ensureServicePort")}catch(W){throw new _9(`Failed to apply Service ports: ${X}`,W)}}function RU0($,Z,X,Q=180){let Y=`/apis/${B9.SANDBOX_API_GROUP}/${B9.SANDBOX_API_VERSION}/namespaces/${encodeURIComponent(Z)}/${B9.SANDBOX_PLURAL}?watch=true&fieldSelector=${encodeURIComponent(`metadata.name=${X}`)}`,{resolve:G,reject:J,promise:W}=Promise.withResolvers(),K=new AbortController,H=!1,N=setTimeout(()=>{if(H)return;H=!0,K.abort(),J(new wV(`Sandbox did not become ready within ${Q} seconds`))},Q*1000),F=(U)=>{if(H)return;H=!0,clearTimeout(N),K.abort(),U()};return(async()=>{let U;try{U=await j3($,{method:"GET",path:Y,signal:K.signal,headers:{accept:"application/json"},stream:!0})}catch(O){F(()=>J(new _9("Failed to start watch for sandbox readiness",O)));return}if(!U.ok||!U.body){let O=await Em0(U).catch(()=>null);F(()=>J(new _9(`Watch handshake failed (${U.status}): ${O?.message??U.statusText}`)));return}try{for await(let O of Am0(U.body)){if(H)return;if(O.type==="ERROR"){let j=O.object;F(()=>J(new _9(`Watch stream error while waiting for sandbox: ${j.message??"unknown"}`)));return}if(O.type!=="ADDED"&&O.type!=="MODIFIED")continue;let w=O.object;if(!w.status?.conditions?.find((j)=>j.type==="Ready"&&j.status==="True"))continue;let L=w.metadata?.name;if(!L){F(()=>J(new _9("Sandbox metadata or name is missing")));return}let E=w.metadata?.annotations?.[B9.POD_NAME_ANNOTATION]??L;F(()=>G({sandboxName:L,podName:E}));return}F(()=>J(new _9("Watch stream closed before sandbox became ready")))}catch(O){if(H)return;if(O instanceof Error&&(O.name==="AbortError"||K.signal.aborted))return;F(()=>J(new _9("Watch stream error while waiting for sandbox",O)))}})(),W}async function*Am0($){let Z=$.getReader(),X=new TextDecoder,Q="";try{while(!0){let{value:G,done:J}=await Z.read();if(J)break;Q+=X.decode(G,{stream:!0});let W;while((W=Q.indexOf(`
-`))>=0){let K=Q.slice(0,W).trim();if(Q=Q.slice(W+1),!K)continue;yield JSON.parse(K)}}let Y=Q.trim();if(Y)yield JSON.parse(Y)}finally{Z.releaseLock()}}var lZ$,jm0,nZ$="gateway.networking.k8s.io",pZ$="v1",tZ$="httproutes",QX4,ti,rZ$="mesh-sandbox-runner";var oi=B(()=>{$6();ni();lZ$=class lZ$ extends Error{status;body;constructor($,Z,X){super(X);this.status=$;this.body=Z;this.name="KubeHttpError"}};jm0=`/apis/${B9.CLAIM_API_GROUP}/${B9.CLAIM_API_VERSION}/namespaces`;QX4=`/apis/${nZ$}/${pZ$}/namespaces`;ti={API_GROUP:nZ$,API_VERSION:pZ$,PLURAL:tZ$}});function GX4($){return($.items??[]).some((Z)=>{if(Z.status?.phase!=="Pending")return!1;return(Z.status?.conditions??[]).some((X)=>X.type==="PodScheduled"&&X.status==="False"&&X.reason==="Unschedulable")})}function eZ$($,Z){let X=0,Q=!0,Y=null,G=async()=>{try{let J=await j3($,{method:"GET",path:`/api/v1/namespaces/${encodeURIComponent(Z)}/pods?fieldSelector=status.phase%3DPending`});if(!J.ok)return sZ$;let W=await J.json();return!GX4(W)}catch{return sZ$}};return async()=>{if(Date.now()-X<YX4)return Q;return Y??=G().finally(()=>{Y=null}),Q=await Y,X=Date.now(),Q}}var YX4=3000,sZ$=!0;var $7$=B(()=>{oi()});var IU0=B(()=>{$6();Bl0()});async function MU0($){try{let Z=await fetch(`${$}/health`,{signal:AbortSignal.timeout(JX4)});if(!Z.ok)return null;let X=await Z.json();if(typeof X==="object"&&X!==null&&typeof X.bootId==="string"&&typeof X.ready==="boolean"&&X.setup&&typeof X.setup.running==="boolean"&&typeof X.setup.done==="boolean")return X;return null}catch{return null}}async function Rm0($){for(let Z=0;Z<Z7$;Z++){if(await MU0($)!==null)return;let X=(Math.random()*2-1)*WX4;await C$(X7$+X)}throw Error(`sandbox daemon at ${$} did not respond on /health within ${Z7$*X7$/1000}s`)}async function BV($,Z,X,Q,Y){return KX4($,Z,"POST",X,Q,Y)}async function KX4($,Z,X,Q,Y,G){let J={...Q};if(Y&&Y.rotateToken!==void 0)J.auth=Y;let W=await fetch(`${$}/_sandbox/config`,{method:X,headers:{"Content-Type":"application/json",Authorization:`Bearer ${Z}`},body:JSON.stringify(J),signal:AbortSignal.timeout(G?.timeoutMs??Tm0)}),K=await W.text();if(!W.ok)throw new qU0(W.status,K);return JSON.parse(K)}async function Q7$($,Z,X){let Q=await fetch(`${$}/_sandbox/setup/${X}`,{method:"POST",headers:{Authorization:`Bearer ${Z}`},signal:AbortSignal.timeout(Tm0)});if(!Q.ok)throw Error(`sandbox daemon /_sandbox/setup/${X} returned ${Q.status}: ${await Q.text()}`)}async function Y7$($,Z,X){let Q=await fetch(`${$}/_sandbox/orgfs-config`,{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${Z}`},body:X,signal:AbortSignal.timeout(Tm0)}),Y=await Q.text();if(!Q.ok)throw Error(`sandbox daemon /_sandbox/orgfs-config returned ${Q.status}: ${Y}`);return JSON.parse(Y)}async function ri($,Z,X,Q){let Y=new Headers(Q.headers);for(let W of HX4)Y.delete(W);Y.set("authorization",`Bearer ${Z}`);let G=Q.method!=="GET"&&Q.method!=="HEAD",J=`${$}${X.startsWith("/")?X:`/${X}`}`;return fetch(J,{method:Q.method,headers:Y,body:G?Q.body:void 0,redirect:"manual",signal:Q.signal,duplex:G?"half":void 0})}var qU0,JX4=500,Tm0=30000,Z7$=25,X7$=200,WX4=50,HX4;var G7$=B(()=>{IU0();qU0=class qU0 extends Error{status;constructor($,Z){super(`sandbox daemon /_sandbox/config returned ${$}: ${Z}`);this.status=$;this.name="ConfigRequestError"}};HX4=["cookie","host","connection","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","accept-encoding","content-length"]});async function*K7$($){let Z=$.now??(()=>Date.now()),X=Z(),Q=$.schedulingTimeoutMs??UX4,Y={pod:{},sandbox:{},events:{hasPulling:!1,hasPulled:!1},startedAt:X},G=[],J=null,W=!1,K=(j)=>{if(W)return;if(J){let z=J;J=null,z(j)}else G.push(j)},H=()=>{if(G.length>0)return Promise.resolve(G.shift());if(W)return Promise.resolve(null);return new Promise((j)=>{J=j})},N=()=>{if(W)return;if(W=!0,J){let j=J;J=null,j(null)}},F=new AbortController,U=()=>{F.abort(),N()};if($.signal)if($.signal.aborted)F.abort(),N();else $.signal.addEventListener("abort",U,{once:!0});let O=Math.max(0,Q-(Z()-X)),w=setTimeout(()=>K("tick"),O+100),D,L=new Promise((j)=>{D=j}),E=Promise.allSettled([OX4($.kc,$.namespace,$.claimName,F.signal,Y,K,Z,D),BX4($.kc,$.namespace,$.claimName,F.signal,Y,K),DX4($.kc,$.namespace,$.claimName,L,F.signal,Y,K,Z)]);try{let j=null,z=-1,A=J7$(Y,Q,Z);if(j=qm0(A),!Im0(A))z=W7$(A);if(yield A,Im0(A))return;while(!W){if(await H()===null)break;let q=J7$(Y,Q,Z);if(Im0(q)){let _=qm0(q);if(_!==j)j=_,yield q;return}let S=W7$(q);if(S<z)continue;let M=qm0(q);if(M!==j)j=M,z=S,yield q}}finally{if(clearTimeout(w),F.abort(),$.signal)$.signal.removeEventListener("abort",U);N(),await E.catch(()=>{})}}function J7$($,Z,X){let{pod:Q,sandbox:Y,events:G,startedAt:J}=$;if(Y.ready)return{kind:"ready"};let W=Q.containerWaitingReason;if(W==="ImagePullBackOff"||W==="ErrImagePull")return{kind:"failed",reason:"image-pull-backoff",message:"Sandbox image failed to download. The cluster may be missing pull credentials or the image tag may not exist."};if(W==="CrashLoopBackOff")return{kind:"failed",reason:"crash-loop-backoff",message:"Sandbox crashed during startup and is now in CrashLoopBackOff. Check pod logs."};if(!Q.scheduled&&G.lastFailedSchedulingAt!==void 0&&X()-J>Z)return{kind:"failed",reason:"scheduling-timeout",message:G.failedSchedulingMessage??`Pod could not be scheduled within ${Math.round(Z/1000)}s.`};if(Q.containerRunning&&!Q.containerReady)return{kind:"warming-daemon",since:J};if(G.hasPulling&&!G.hasPulled)return{kind:"pulling-image",since:J};if(W==="ContainerCreating"||W==="PodInitializing"||Q.scheduled&&!Q.containerRunning)return{kind:"starting-container",since:J};if(Q.scheduledFalseReason==="Unschedulable"||G.lastFailedSchedulingAt!==void 0&&!Q.scheduled)return{kind:"waiting-for-capacity",since:J,message:G.failedSchedulingMessage??Q.scheduledFalseMessage,nodeClaim:G.nominatedNodeClaim};return{kind:"claiming",since:J}}function Im0($){return $.kind==="ready"||$.kind==="failed"}function W7$($){switch($.kind){case"claiming":return 0;case"waiting-for-capacity":return 1;case"pulling-image":return 2;case"starting-container":return 3;case"warming-daemon":return 4;case"ready":case"failed":return 99}}function qm0($){switch($.kind){case"claiming":case"pulling-image":case"starting-container":case"warming-daemon":return $.kind;case"waiting-for-capacity":return`waiting-for-capacity:${$.message??""}:${$.nodeClaim??""}`;case"ready":return"ready";case"failed":return`failed:${$.reason}:${$.message}`}}async function OX4($,Z,X,Q,Y,G,J,W){let K=`/api/v1/namespaces/${encodeURIComponent(Z)}/pods?watch=true&labelSelector=${encodeURIComponent(`${NX4}=${X}`)}`;return kU0({kc:$,path:K,signal:Q,label:`pod/${X}`,onEvent:(H)=>{if(H.type!=="ADDED"&&H.type!=="MODIFIED")return;let N=H.object;if(N.metadata?.name)W(N.metadata.name);wX4(N,Y,J),G("pod")}})}function wX4($,Z,X){let Y=($.status?.conditions??[]).find((J)=>J.type==="PodScheduled");if(Y?.status==="True")Z.pod.scheduled=!0,Z.pod.scheduledFalseReason=void 0,Z.pod.scheduledFalseMessage=void 0;else if(Y?.status==="False")Z.pod.scheduled=!1,Z.pod.scheduledFalseReason=Y.reason,Z.pod.scheduledFalseMessage=Y.message;let G=($.status?.containerStatuses??[]).find((J)=>J.name===FX4);if(G)Z.pod.containerWaitingReason=G.state?.waiting?.reason,Z.pod.containerRunning=!!G.state?.running,Z.pod.containerReady=G.ready===!0}async function BX4($,Z,X,Q,Y,G){let J=`/apis/${B9.CLAIM_API_GROUP}/${B9.CLAIM_API_VERSION}/namespaces/${encodeURIComponent(Z)}/${B9.CLAIM_PLURAL}?watch=true&fieldSelector=${encodeURIComponent(`metadata.name=${X}`)}`;return kU0({kc:$,path:J,signal:Q,label:`sandboxclaim/${X}`,onEvent:(W)=>{if(W.type!=="ADDED"&&W.type!=="MODIFIED")return;let H=W.object.status?.conditions?.find((N)=>N.type==="Ready");if(!H)return;if(H.status==="True")Y.sandbox.ready=!0,Y.sandbox.notReadyReason=void 0,Y.sandbox.notReadyMessage=void 0;else Y.sandbox.ready=!1,Y.sandbox.notReadyReason=H.reason,Y.sandbox.notReadyMessage=H.message;G("sandbox")}})}async function DX4($,Z,X,Q,Y,G,J,W){let K=await Promise.race([Q,new Promise((N)=>{if(Y.aborted){N(X);return}Y.addEventListener("abort",()=>N(X),{once:!0})})]);if(Y.aborted)return;let H=`/api/v1/namespaces/${encodeURIComponent(Z)}/events?watch=true&fieldSelector=${encodeURIComponent(`involvedObject.name=${K},involvedObject.kind=Pod`)}`;return kU0({kc:$,path:H,signal:Y,label:`events/${X}`,onEvent:(N)=>{if(N.type!=="ADDED"&&N.type!=="MODIFIED")return;let F=N.object,U=F.reason;if(!U)return;switch(U){case"Pulling":G.events.hasPulling=!0;break;case"Pulled":G.events.hasPulling=!0,G.events.hasPulled=!0;break;case"FailedScheduling":G.events.lastFailedSchedulingAt=W(),G.events.failedSchedulingMessage=F.message;break;case"Nominated":{let O=F.message?.match(/nodeclaim\/([\w-]+)/);if(O)G.events.nominatedNodeClaim=O[1];break}default:return}J("event")}})}async function H7$($){let{kc:Z,namespace:X,labelSelector:Q,signal:Y,onDelete:G}=$,J=`/apis/${B9.CLAIM_API_GROUP}/${B9.CLAIM_API_VERSION}/namespaces/${encodeURIComponent(X)}/${B9.CLAIM_PLURAL}?watch=true&labelSelector=${encodeURIComponent(Q)}`;return kU0({kc:Z,path:J,signal:Y,label:"sandboxclaim-reaper",onEvent:(W)=>{if(W.type!=="DELETED")return;let K=W.object.metadata?.name;if(K)G(K)}})}async function kU0($){let{kc:Z,path:X,signal:Q,label:Y,onEvent:G}=$,J=0;while(!Q.aborted){try{let K=await j3(Z,{method:"GET",path:X,signal:Q,headers:{accept:"application/json"},stream:!0});if(!K.ok||!K.body){try{await K.body?.cancel()}catch{}if(K.status===401||K.status===403){console.warn(`[lifecycle-watcher] ${Y} stopped: watch denied (${K.status} ${K.statusText}). `+"The kubeconfig in use cannot watch SandboxClaims \u2014 if you are running locally, "+"this provider should not be active (check STUDIO_SANDBOX_PROVIDER / your sandbox preference).");return}throw Error(`watch handshake failed: ${K.status} ${K.statusText}`)}J=0;for await(let H of Am0(K.body)){if(Q.aborted)return;try{G(H)}catch(N){console.warn(`[lifecycle-watcher] ${Y} onEvent threw: ${N instanceof Error?N.message:String(N)}`)}}}catch(K){if(Q.aborted)return;let H=K instanceof Error?K.message:String(K);console.warn(`[lifecycle-watcher] ${Y} watch ended: ${H}`)}if(Q.aborted)return;let W=cZ(5000,250,J,2,0);J+=1,await C$(W,{signal:Q}).catch(()=>{})}}var NX4="studio.decocms.com/sandbox-handle",FX4="sandbox",UX4=300000;var N7$=B(()=>{$6();ni();oi()});import{z as fG}from"zod";function F7$($){if(!$||$.trim()==="")return[];let Z=fG.array(LX4).parse(JSON.parse($)),X=new Set;for(let Q of Z){if(X.has(Q.name))throw Error(`STUDIO_SANDBOX_TENANT_POOLS: duplicate pool name ${Q.name}`);X.add(Q.name)}return Z}function EX4($){try{let[Z,X]=new URL($).pathname.replace(/^\/+/,"").split("/"),Q=X?.replace(/\.git$/,"");return Z&&Q?`${Z}/${Q}`.toLowerCase():null}catch{return null}}function U7$($,Z){let{orgId:X,cloneUrl:Q}=Z;if(Z.cloneOnly===!0)return null;if(!X||!Q)return null;let Y=EX4(Q);if(!Y)return null;return $.find((G)=>G.orgId===X&&G.repo.toLowerCase()===Y)??null}function O7$($,Z,X){return $?.name??(Z?X:"none")}function w7$($,Z,X){let Q=X.replace(/^refs\/heads\//,"");return $.filter((Y)=>Y.repo.toLowerCase()===Z.toLowerCase()&&Y.branch===Q)}function B7$($){return`https://github.com/${$.repo}.git`}var LX4;var Mm0=B(()=>{LX4=fG.object({name:fG.string().regex(/^[a-z0-9]([-a-z0-9]*[a-z0-9])?$/,"pool name must be a DNS label (lowercase alphanumeric and '-')"),orgId:fG.string().min(1),repo:fG.string().regex(/^[^/\s]+\/[^/\s]+$/,"repo must be `owner/name`"),connectionId:fG.string().min(1).optional(),branch:fG.string().min(1).default("main"),workload:fG.object({runtime:fG.enum(["node","bun","deno"]).default("node"),packageManager:fG.enum(["npm","pnpm","yarn","bun","deno"]).optional(),packageManagerPath:fG.string().optional(),devPort:fG.number().int().positive().optional()}).default({runtime:"node"})})});async function D7$($,Z,X){let Q=new Map;for(let Y of $){let G=Z(Y);if(!G)continue;let J=Q.get(G);if(J)J.push(Y);else Q.set(G,[Y])}await Promise.allSettled([...Q.values()].map(async(Y)=>{for(let G of Y)await X(G).catch(()=>{})}))}import{createHash as jX4,randomBytes as zX4,randomUUID as PX4}from"crypto";import*as T7$ from"net";import{PassThrough as AX4}from"stream";function L7$($){if($ instanceof Error)return $.message;if($&&typeof $==="object"){let Z=$;if(Z.error instanceof Error)return Z.error.message;if(typeof Z.message==="string"&&Z.message)return Z.message}return String($)}class fm0{kind=xQ;records=new Map;inflight=new a50;stateStore;previewUrlPattern;kubeConfig;capacityProbe;portForward;namespace;sandboxTemplateName;envName;tokenGenerator;idleTtlMs;metrics;previewGateway;sentinelToken;mintCloneUrl;tenantPools;tenantPoolRefreshMs;poolPods=new Map;dirtyPools=new Set;closed=!1;claimWatchAbort=new AbortController;constructor($={}){this.stateStore=$.stateStore??null,this.previewUrlPattern=$.previewUrlPattern??null,this.kubeConfig=$.kubeConfig??bX4(),this.portForward=new $m0(this.kubeConfig),this.namespace=$.namespace??TX4,this.sandboxTemplateName=$.sandboxTemplateName??RX4,this.envName=cX4($.envName),this.tokenGenerator=$.tokenGenerator??(()=>zX4(IX4).toString("hex")),this.idleTtlMs=$.idleTtlMs??MX4,this.metrics=$.meter?fX4($.meter):null,this.previewGateway=$.previewGateway&&$.previewUrlPattern?{...$.previewGateway}:null;let Z=$.sentinelToken?.trim()??"";if(this.sentinelToken=Z.length>0?Z:null,this.mintCloneUrl=$.mintCloneUrl,this.tenantPools=this.sentinelToken!==null?$.tenantPools??[]:[],this.sentinelToken===null&&($.tenantPools?.length??0)>0)console.warn(`[${q6}] tenant pools configured without a sentinel token \u2014 ignoring them (warm-pool mode is off)`);this.tenantPoolRefreshMs=$.tenantPoolRefreshMs??SX4,this.startClaimReaper(),this.startCredentialRefresher(),this.startTenantPoolReconciler()}startClaimReaper(){let $=["app.kubernetes.io/managed-by=studio","app.kubernetes.io/name=studio-sandbox",...this.envName?[`${yQ.env}=${this.envName}`]:[]].join(",");H7$({kc:this.kubeConfig,namespace:this.namespace,labelSelector:$,signal:this.claimWatchAbort.signal,onDelete:(Z)=>this.invalidateRecord(Z)})}async ensure($,Z={}){let X=uL($);if(X.startsWith("s-"))throw Error(`ensure: projectRef has no slug source: ${$.projectRef}`);return this.inflight.run(X,()=>s50(this.stateStore,$,xQ,(Q)=>this.ensureLocked($,X,Z,Q)))}async delete($){let Z=await this.getRecord($);if(this.records.delete($),Z)this.closeForwarder(Z.daemonForward),this.metrics?.active.add(-1,Cm0(Z.tenant));if(await this.deleteHttpRouteIfManaged($).catch((X)=>{console.warn(`[${q6}] HTTPRoute delete failed for ${$}: ${X instanceof Error?X.message:String(X)}`)}),await cO(this.kubeConfig,this.namespace,$),this.stateStore)if(Z)await this.stateStore.delete(Z.id,xQ);else await this.stateStore.deleteByHandle(xQ,$)}async alive($){return await z3(this.kubeConfig,this.namespace,$)!==void 0}watchClaimLifecycle($,Z){return K7$({kc:this.kubeConfig,namespace:this.namespace,claimName:$,signal:Z})}hasSchedulableCapacity(){return this.capacityProbe??=eZ$(this.kubeConfig,this.namespace),this.capacityProbe()}async getPreviewUrl($){let Z=await this.getRecord($);if(!Z)return null;return this.composePreviewUrl(Z)}async proxyDaemonRequest($,Z,X){let Q=await this.getRecord($);if(!Q&&this.previewUrlPattern&&this.stateStore){let K=await this.stateStore.getByHandle(xQ,$),H=K?.state,N=H?.token;if(K&&N){let U=`http://${H?.adoptedSandboxName??$}.${this.namespace}.svc.cluster.local:${wN}`;try{let O=await ri(U,N,Z,X);if(O.status!==404)return O;try{await O.body?.cancel()}catch{}}catch{}}}if(!Q)Q=await this.resurrectByHandle($);if(!Q)return new Response(JSON.stringify({error:"sandbox not found"}),{status:404,headers:{"content-type":"application/json"}});let Y=Q,G=performance.now(),J=0,W=!(X.body instanceof ReadableStream);try{let K=await ri(Q.daemonUrl,Q.token,Z,X);if(K.status===401&&W){this.invalidateRecord($);let H=await this.getRecord($).catch(()=>null)??await this.resurrectByHandle($).catch(()=>null);if(H)Y=H,K=await ri(H.daemonUrl,H.token,Z,X)}return J=K.status,K}catch(K){if(!W)throw K;this.invalidateRecord($);let H=await this.resurrectByHandle($)??await this.getRecord($).catch(()=>null);if(!H)throw K;Y=H;let N=await ri(H.daemonUrl,H.token,Z,X);return J=N.status,N}finally{this.recordProxyDuration("daemon",J,Y,performance.now()-G)}}async adoptLiveClaim($,Z){if(this.records.has(Z))return!0;let X=await z3(this.kubeConfig,this.namespace,Z).catch(()=>{return});if(!X||X.metadata?.deletionTimestamp)return!1;return await this.inflight.run(Z,async()=>{let Y=this.records.get(Z);if(Y)return this.toSandbox(Y);let G=await this.adopt($,Z,X);if(!G)throw Error(`cannot adopt live claim ${Z}`);return s50(this.stateStore,$,xQ,(J)=>this.finish(G,J,!0,!0,"adopt"))}).catch(()=>null)!=null}async resolvePreviewUpstreamUrl($){if(this.previewUrlPattern)return`http://${await this.resolveServiceNameForHandle($)}.${this.namespace}.svc.cluster.local:${wN}`;let Z=await this.getRecord($);if(Z)return Z.daemonUrl;let X=await this.resurrectByHandle($);return X?X.daemonUrl:null}async resolveServiceNameForHandle($){let Z=this.records.get($);if(Z)return Z.adoptedSandboxName;if(this.stateStore){let Q=(await this.stateStore.getByHandle(xQ,$).catch(()=>null))?.state?.adoptedSandboxName;if(Q)return Q}return $}async proxyPreviewRequest($,Z){let X=performance.now(),Q=this.records.get($)??null,Y=0;try{let G=await this.resolvePreviewUpstreamUrl($);if(!G){Y=404;let w=Sm0(404,{error:"sandbox not found"});return w.headers.set(LV,"1"),w}let J=new URL(Z.url);if((J.pathname==="/_sandbox"||J.pathname.startsWith("/_sandbox/")||J.pathname==="/_decopilot_vm"||J.pathname.startsWith("/_decopilot_vm/"))&&Z.method!=="GET")return Y=404,Sm0(404,{error:"not found"});let K=(w)=>`${w}${J.pathname}${J.search}`,H=new Headers(Z.headers);for(let w of _X4)H.delete(w);let N=Z.method!=="GET"&&Z.method!=="HEAD",F={method:Z.method,headers:H,body:N?Z.body:void 0,redirect:"manual",signal:Z.signal,duplex:N?"half":void 0},U;try{U=await fetch(K(G),F)}catch(w){let D=`${G}${J.pathname}`;if(console.warn(`[${q6}] preview fetch to ${D} failed: ${w instanceof Error?w.message:String(w)}`),Z.method==="GET"||Z.method==="HEAD"){if(this.invalidateRecord($),await this.resurrectByHandle($).catch(()=>null)){let j=await this.resolvePreviewUpstreamUrl($);if(j)try{U=await fetch(K(j),F);let z=new Headers;for(let[A,P]of U.headers.entries())if(!z7$.includes(A.toLowerCase()))z.set(A,P);return Y=U.status,new Response(U.body,{status:U.status,statusText:U.statusText,headers:z})}catch(z){console.warn(`[${q6}] preview fetch retry to ${D} failed: ${z instanceof Error?z.message:String(z)}`)}}}else this.invalidateRecord($);Y=502;let L=Sm0(502,{error:"sandbox daemon unreachable"});return L.headers.set(LV,"1"),L}let O=new Headers;for(let[w,D]of U.headers.entries())if(!z7$.includes(w.toLowerCase()))O.set(w,D);return Y=U.status,new Response(U.body,{status:U.status,statusText:U.statusText,headers:O})}finally{this.recordProxyDuration("preview",Y,Q,performance.now()-X,$)}}async ensureLocked($,Z,X,Q){if(X.image)console.warn(`[${q6}] opts.image ignored (template ${this.sandboxTemplateName} pins image): got ${X.image}`);if(Q){let J=await Q.get($,xQ);if(J){let W=await this.rehydrate($,Z,J);if(W)return await this.refreshDaemonGitCredential(W,X),this.finish(W,Q,!1,!0,"resume");await Q.delete($,xQ)}}let Y=await z3(this.kubeConfig,this.namespace,Z).catch(()=>{return});if(Y)if(Y.metadata?.deletionTimestamp)await zU0(this.kubeConfig,this.namespace,Z).catch((J)=>{console.warn(`[${q6}] wait for terminating claim ${Z} failed: ${J instanceof Error?J.message:String(J)}`)});else{let J=await this.adopt($,Z,Y).catch((W)=>{return console.warn(`[${q6}] adopt ${Z} failed, recreating: ${W instanceof Error?W.message:String(W)}`),null});if(J)return await this.refreshDaemonGitCredential(J,X),this.finish(J,Q,!0,!0,"adopt");await cO(this.kubeConfig,this.namespace,Z).catch(()=>{}),await zU0(this.kubeConfig,this.namespace,Z).catch((W)=>{console.warn(`[${q6}] wait for deleted claim ${Z} failed: ${W instanceof Error?W.message:String(W)}`)})}let G=await this.provision($,Z,X);return this.finish(G,Q,!0,!1,"fresh")}async finish($,Z,X,Q,Y){let G=this.records.get($.handle),J=G!==void 0;if(G&&G.daemonForward!==$.daemonForward)this.closeForwarder(G.daemonForward);if(this.records.set($.handle,$),X)await this.persist(Z,$);if(Q)await PU0(this.kubeConfig,this.namespace,$.handle,this.computeShutdownTime()).catch((W)=>console.warn(`[${q6}] TTL refresh failed for ${$.handle}: ${W instanceof Error?W.message:String(W)}`));if(this.metrics){let W=Cm0($.tenant);if(this.metrics.ensureOutcome.add(1,{...W,outcome:Y}),!J)this.metrics.active.add(1,W)}return this.toSandbox($)}buildEnvMap($,Z){let X={},Q=[];for(let[Y,G]of Object.entries($.env??{}))if(qX4.has(Y))Q.push(Y);else X[Y]=G;if(Q.length>0)console.warn(`[${q6}] opts.env keys overlap reserved bootstrap names and were dropped: ${Q.join(",")}`);return{...X,DAEMON_TOKEN:Z.token,DAEMON_BOOT_ID:Z.daemonBootId,APP_ROOT:Z.workdir,PROXY_PORT:String(wN)}}buildClaim($,Z,X){let Q=this.sentinelToken!==null,Y=U7$(this.tenantPools,{orgId:Z.tenant?.orgId,cloneUrl:Z.repo?.cloneUrl,cloneOnly:Z.cloneOnly}),G=Q?[]:Object.entries(this.buildEnvMap(Z,X)).sort(([K],[H])=>K<H?-1:K>H?1:0).map(([K,H])=>({name:K,value:H})),J=mX4(Z),W=Object.keys(J).length>0;return{apiVersion:`${B9.CLAIM_API_GROUP}/${B9.CLAIM_API_VERSION}`,kind:"SandboxClaim",metadata:{name:$,namespace:this.namespace,labels:{"app.kubernetes.io/name":"studio-sandbox","app.kubernetes.io/managed-by":"studio",...this.envName?{[yQ.env]:this.envName}:{},...Vm0(Z.tenant)},...W?{annotations:J}:{}},spec:{sandboxTemplateRef:{name:this.sandboxTemplateName},additionalPodMetadata:{labels:Vm0(Z.tenant,{[yQ.role]:"claimed",[yQ.sandboxHandle]:$,...this.envName?{[yQ.env]:this.envName}:{}}),...W?{annotations:J}:{}},env:G,warmpool:O7$(Y,Q,this.sandboxTemplateName),lifecycle:{shutdownPolicy:"Delete",shutdownTime:this.computeShutdownTime()}}}}async provision($,Z,X){let Q=this.tokenGenerator(),Y=PX4(),G=km0,J=this.buildClaim(Z,X,{token:Q,daemonBootId:Y,workdir:G});try{await pi(this.kubeConfig,this.namespace,J)}catch(U){if(U instanceof ii)await zU0(this.kubeConfig,this.namespace,Z),await pi(this.kubeConfig,this.namespace,J);else throw U}let W;try{W=await dZ$(this.kubeConfig,this.namespace,Z),await RU0(this.kubeConfig,this.namespace,W)}catch(U){throw await cO(this.kubeConfig,this.namespace,Z).catch(()=>{}),U}try{await this.ensureServicePortForAdoptedSandbox(W),await this.ensureHttpRouteForHandle(Z,W,X.tenant??null)}catch(U){throw await cO(this.kubeConfig,this.namespace,Z).catch(()=>{}),U}let K=await this.openForwarder(W,wN,Z),H=`http://127.0.0.1:${K.localPort}`,N=this.workloadConfigPayload(X),F=Y;try{if(await Rm0(H),this.sentinelToken!==null){let U=await MU0(H);if(U)F=U.bootId;await BV(H,this.sentinelToken,N??{},{rotateToken:Q})}else if(N)await BV(H,Q,N);await this.relayOrgFsConfig(H,Q,X.orgFsConfigJson)}catch(U){throw this.closeForwarder(K),await this.deleteHttpRouteIfManaged(Z).catch(()=>{}),await cO(this.kubeConfig,this.namespace,Z).catch(()=>{}),U}return{id:$,handle:Z,adoptedSandboxName:W,token:Q,workdir:G,daemonUrl:H,daemonForward:K,workload:X.workload??null,daemonBootId:F,tenant:X.tenant??null,ensureOpts:tX4(X)}}workloadConfigPayload($){return $90({runtime:$?.workload?.runtime??"node",packageManager:$?.workload?.packageManager?{name:$.workload.packageManager,...$.workload.packageManagerPath?{path:$.workload.packageManagerPath}:{}}:null,repo:$?.repo??null,port:$?.workload?.devPort??E7$,tenant:$?.tenant??void 0,...$?{cloneOnly:$.cloneOnly===!0}:{}})}async relayOrgFsConfig($,Z,X){if(!X)return;await Y7$($,Z,X).catch((Q)=>console.warn("[org-fs] sidecar config relay failed",Q))}async refreshDaemonGitCredential($,Z){let X=Dl0(Z);if(!X)return;try{await BV($.daemonUrl,$.token,X)}catch(Q){console.warn(`[${q6}] git credential refresh failed for ${$.handle}: ${Q instanceof Error?Q.message:String(Q)}`)}}async withFreshCloneUrl($,Z){if(!this.mintCloneUrl)return $;try{let X=await this.mintCloneUrl($,Z!==void 0?{bufferMs:Z}:void 0);return X?{...$,cloneUrl:X}:$}catch(X){return console.warn(`[${q6}] clone credential re-mint failed: ${X instanceof Error?X.message:String(X)}`),$}}startCredentialRefresher(){if(!this.mintCloneUrl)return;let{signal:$}=this.claimWatchAbort;(async()=>{while(!$.aborted){if(await C$(VX4,{signal:$}).catch(()=>{}),$.aborted)break;try{await this.refreshAllGitCredentials()}catch(Z){console.warn(`[${q6}] periodic credential refresh failed: ${Z instanceof Error?Z.message:String(Z)}`)}}})()}startTenantPoolReconciler(){if(this.tenantPools.length===0)return;let{signal:$}=this.claimWatchAbort;(async()=>{while(!$.aborted){try{await this.reconcileTenantPools()}catch(Z){console.warn(`[${q6}] tenant pool reconcile failed: ${Z instanceof Error?Z.message:String(Z)}`)}await C$(kX4,{signal:$}).catch(()=>{})}})()}markTenantPoolsDirty($,Z){let X=w7$(this.tenantPools,$,Z);for(let Q of X)this.dirtyPools.add(Q.name);return X.map((Q)=>Q.name)}async reconcileTenantPools(){for(let $ of this.tenantPools){let Z=await mZ$(this.kubeConfig,this.namespace,$.name);if(Z===null){console.warn(`[${q6}] tenant pool ${$.name}: no SandboxWarmPool (or no selector yet) in ${this.namespace}`);continue}let X=this.dirtyPools.delete($.name),Q=Z.filter((Y)=>!Y.labels[yQ.sandboxHandle]);for(let[Y]of this.poolPods)if(!Z.some((G)=>G.uid===Y))this.poolPods.delete(Y);for(let Y of Q){if(this.claimWatchAbort.signal.aborted)return;await this.warmPoolPod($,Y,X)}this.recordPoolDepth($,Z,Q)}}recordPoolDepth($,Z,X){let Q=this.metrics?.poolPods;if(!Q)return;let Y=0,G=0;for(let W of X){let K=this.poolPods.get(W.uid);if(!K)continue;if(K.failures>=SU0)G++;else if(K.lastConfigAt>0)Y++}let J={pool:$.name,org:$.orgId};Q.record(Y,{...J,state:"ready"}),Q.record(Z.length-X.length,{...J,state:"bound"}),Q.record(X.length-Y-G,{...J,state:"pending"}),Q.record(G,{...J,state:"failed"})}async warmPoolPod($,Z,X){let Q=this.poolPods.get(Z.uid);if(Q&&Q.failures>=SU0){if(Date.now()-Q.lastFailureAt<j7$)return;this.poolPods.set(Z.uid,{...Q,failures:0})}let Y=X||Q!==void 0&&Date.now()-Q.lastConfigAt>=this.tenantPoolRefreshMs;if(Q&&!Y)return;let G={cloneUrl:B7$($),connectionId:$.connectionId,branch:$.branch,userName:"",userEmail:""},J=await this.withFreshCloneUrl(G);if($.connectionId&&J.cloneUrl===G.cloneUrl){this.recordPoolFailure(Z,$,"clone credential mint failed");return}let W=await this.openForwarder(Z.name,wN,Z.name).catch(()=>null);if(!W){this.recordPoolFailure(Z,$,"port-forward failed");return}let K=`http://127.0.0.1:${W.localPort}`;try{await Rm0(K);let H=this.sentinelToken;if(!H)return;if(!await this.isPoolPodUnbound(Z))return;let N=$90({runtime:$.workload.runtime,packageManager:$.workload.packageManager?{name:$.workload.packageManager,...$.workload.packageManagerPath?{path:$.workload.packageManagerPath}:{}}:null,repo:J,port:$.workload.devPort??E7$})??{},{transition:F}=await BV(K,H,N);if(Y&&F!=="bootstrap"&&await this.isPoolPodUnbound(Z))await Q7$(K,H,"clone");this.poolPods.set(Z.uid,{lastConfigAt:Date.now(),lastFailureAt:0,failures:0}),console.log(`[${q6}] tenant pool ${$.name}: warmed ${Z.name} (${F})`)}catch(H){this.recordPoolFailure(Z,$,H instanceof Error?H.message:String(H))}finally{this.closeForwarder(W)}}isPoolPodUnbound($){return iZ$(this.kubeConfig,this.namespace,$.name,yQ.sandboxHandle)}recordPoolFailure($,Z,X){let Q=this.poolPods.get($.uid),Y=(Q?.failures??0)+1;this.poolPods.set($.uid,{lastConfigAt:Q?.lastConfigAt??0,lastFailureAt:Date.now(),failures:Y});let G=Y>=SU0?` \u2014 backing off ${j7$/60000}min`:"";console.warn(`[${q6}] tenant pool ${Z.name}: warming ${$.name} failed (${Y}/${SU0})${G}: ${X}`)}async refreshAllGitCredentials(){await D7$(this.records.values(),($)=>$.ensureOpts?.repo?.connectionId,async($)=>{if(this.claimWatchAbort.signal.aborted)return;let Z=$.ensureOpts?.repo;if(!Z)return;let X=await this.withFreshCloneUrl(Z,CX4);await this.refreshDaemonGitCredential($,{...$.ensureOpts,repo:X}),$.ensureOpts={...$.ensureOpts,repo:X}})}async rebootstrapDaemon($,Z,X){if(this.sentinelToken===null)return!1;let Q=this.workloadConfigPayload(X)??{};try{return await BV($,this.sentinelToken,Q,{rotateToken:Z}),await this.relayOrgFsConfig($,Z,X?.orgFsConfigJson),!0}catch(Y){if(Y instanceof qU0&&Y.status===401)try{return await BV($,Z,Q,{rotateToken:Z}),await this.relayOrgFsConfig($,Z,X?.orgFsConfigJson),!0}catch(G){return console.warn(`[${q6}] re-bootstrap retry with claim token failed: ${G instanceof Error?G.message:String(G)}`),!1}return console.warn(`[${q6}] re-bootstrap failed: ${Y instanceof Error?Y.message:String(Y)}`),!1}}async ensureServicePortForAdoptedSandbox($){if(!this.previewGateway||!this.previewUrlPattern)return;await aZ$(this.kubeConfig,this.namespace,$,{name:"daemon",port:wN,targetPort:wN})}async ensureHttpRouteForHandle($,Z,X){if(!this.previewGateway||!this.previewUrlPattern)return;let Q=oX4(this.previewUrlPattern,$);if(!Q)throw new _9(`Unable to derive preview hostname for ${$} from pattern: ${this.previewUrlPattern}`);let Y={apiVersion:`${ti.API_GROUP}/${ti.API_VERSION}`,kind:"HTTPRoute",metadata:{name:$,namespace:this.namespace,labels:Vm0(X??void 0,{[yQ.role]:"claimed",[yQ.sandboxHandle]:$,"app.kubernetes.io/name":"studio-sandbox","app.kubernetes.io/managed-by":"studio",...this.envName?{[yQ.env]:this.envName}:{}})},spec:{parentRefs:[{kind:"Gateway",group:"gateway.networking.k8s.io",name:this.previewGateway.name,namespace:this.previewGateway.namespace}],hostnames:[Q],rules:[{backendRefs:[{group:"",kind:"Service",name:Z,port:wN}]}]}};await AU0(this.kubeConfig,this.namespace,Y)}async deleteHttpRouteIfManaged($){if(!this.previewGateway)return;await TU0(this.kubeConfig,this.namespace,$)}async rehydrate($,Z,X){let Q=X.state;if(!Q.adoptedSandboxName&&!Q.podName||!Q.token)return null;let Y=await z3(this.kubeConfig,this.namespace,Z).catch(()=>{return});if(!Y||!P7$(Y))return null;let G=Y.status?.sandbox?.name??Q.adoptedSandboxName??Q.podName??Z,J=await this.openAndProbeDaemon(G,Z);if(!J)return null;if(Q.daemonBootId&&Q.daemonBootId!==J.bootId){if(this.sentinelToken!==null){let W=Q.ensureOpts?.repo?{...Q.ensureOpts,repo:await this.withFreshCloneUrl(Q.ensureOpts.repo)}:Q.ensureOpts??null;if(!await this.rebootstrapDaemon(J.daemonUrl,Q.token,W))return this.closeForwarder(J.daemonForward),null}else console.warn(`[${q6}] daemon restart detected (handle=${Z}): stored bootId=${Q.daemonBootId} live bootId=${J.bootId}`);await this.stateStore?.put($,xQ,{handle:Z,state:{...Q,daemonBootId:J.bootId}}).catch((W)=>console.warn(`[${q6}] bootId persist failed for ${Z}: ${W instanceof Error?W.message:String(W)}`))}return{id:$,handle:Z,adoptedSandboxName:G,token:Q.token,workdir:Q.workdir??km0,daemonUrl:J.daemonUrl,daemonForward:J.daemonForward,workload:Q.workload??null,daemonBootId:J.bootId,tenant:Q.tenant??null,ensureOpts:Q.ensureOpts??null}}async adopt($,Z,X){if(!P7$(X))return null;let Q=X.status?.sandbox?.name??Z;if(this.sentinelToken!==null)return null;let Y=xX4(X);if(!Y)return null;let G=await this.openAndProbeDaemon(Q,Z);if(!G)return null;let J=iX4(X);if(this.previewGateway)await this.ensureServicePortForAdoptedSandbox(Q).catch((W)=>{console.warn(`[${q6}] Service port backfill failed for ${Z}: ${W instanceof Error?W.message:String(W)}`)}),await this.ensureHttpRouteForHandle(Z,Q,J).catch((W)=>{console.warn(`[${q6}] HTTPRoute backfill failed for ${Z}: ${W instanceof Error?W.message:String(W)}`)});return{id:$,handle:Z,adoptedSandboxName:Q,token:Y,workdir:km0,daemonUrl:G.daemonUrl,daemonForward:G.daemonForward,workload:null,daemonBootId:G.bootId,tenant:J,ensureOpts:null}}async openAndProbeDaemon($,Z){let X=await this.openForwarder($,wN,Z).catch(()=>null);if(!X)return null;let Q=`http://127.0.0.1:${X.localPort}`,Y=await MU0(Q);if(!Y)return this.closeForwarder(X),null;return{daemonForward:X,daemonUrl:Q,bootId:Y.bootId}}async getRecord($){let Z=this.records.get($);if(Z)return Z;if(!this.stateStore)return null;let X=await this.stateStore.getByHandle(xQ,$);if(!X)return null;let Q=await this.rehydrate(X.id,$,X);if(Q)this.records.set($,Q);return Q}async resurrectByHandle($){if(!this.stateStore)return null;let Z=await this.stateStore.getByHandle(xQ,$);if(!Z)return null;let X=Z.state.ensureOpts;if(!X)return null;let Q=X.repo?{...X,repo:await this.withFreshCloneUrl(X.repo)}:X;if(uL(Z.id)!==$)return null;return await this.ensure(Z.id,Q),this.records.get($)??null}invalidateRecord($){let Z=this.records.get($);if(!Z)return;this.records.delete($),this.closeForwarder(Z.daemonForward)}recordProxyDuration($,Z,X,Q,Y){if(!this.metrics)return;this.metrics.proxyDurationMs.record(Q,{...Cm0(X?.tenant??null),source:$,sandbox_handle:X?.handle??Y??"",status_code:Z||0})}composePreviewUrl($){if(this.previewUrlPattern)return e50(this.previewUrlPattern,$.handle);return`http://127.0.0.1:${$.daemonForward.localPort}/`}toSandbox($){return{handle:$.handle,workdir:$.workdir,previewUrl:this.composePreviewUrl($)}}async persist($,Z){if(!$)return;let X={adoptedSandboxName:Z.adoptedSandboxName,token:Z.token,workdir:Z.workdir,workload:Z.workload,daemonBootId:Z.daemonBootId,tenant:Z.tenant,...Z.ensureOpts?{ensureOpts:Z.ensureOpts}:{}};await $.put(Z.id,xQ,{handle:Z.handle,state:X})}computeShutdownTime(){return new Date(Date.now()+this.idleTtlMs).toISOString()}async releaseAfter($,Z){let X=await z3(this.kubeConfig,this.namespace,$);if(!X)return;let Q=nX4(X.spec?.lifecycle?.shutdownTime,new Date(Date.now()+Z));if(!Q)return;await PU0(this.kubeConfig,this.namespace,$,Q).catch((Y)=>console.warn(`[${q6}] release failed for ${$}: ${Y instanceof Error?Y.message:String(Y)}`))}async renewTtl($){let Z=await z3(this.kubeConfig,this.namespace,$);if(!Z)return;let X=pX4(Z.spec?.lifecycle?.shutdownTime,new Date(Date.now()+this.idleTtlMs));if(!X)return;await PU0(this.kubeConfig,this.namespace,$,X).catch((Q)=>console.warn(`[${q6}] TTL renew failed for ${$}: ${Q instanceof Error?Q.message:String(Q)}`))}openForwarder($,Z,X=$){let Q=yX4(X,Z);return new Promise((Y,G)=>{let J=(W,K)=>{let H=T7$.createServer((N)=>this.handleForwardedConnection(N,$,Z,X));H.once("error",(N)=>{if(N.code==="EADDRINUSE"&&K<vX4){try{H.close()}catch{}let F=_m0+(W-_m0+1)%R7$;J(F,K+1);return}G(N)}),H.listen(W,"127.0.0.1",()=>{let N=H.address();if(!N||typeof N==="string"){H.close(),G(Error("port-forward listener failed to bind"));return}Y({server:H,localPort:N.port})})};J(Q,0)})}handleForwardedConnection($,Z,X,Q){let Y=new AX4,G=null,J=!1,W=()=>{if(J)return;if(J=!0,Y.destroy(),G)try{G.close()}catch{}if(!$.destroyed)$.destroy()};$.pipe(Y),$.on("error",W),$.on("close",W),this.portForward.portForward(this.namespace,Z,[X],$,null,Y).then((K)=>{let H=typeof K==="function"?K():K;if(!H){W();return}if(G=H,G.on("close",W),G.on("error",(N)=>{console.warn(`[${q6}] port-forward to ${Z}:${X} dropped mid-connection: ${L7$(N)}`,JSON.stringify(vm0(N))),this.invalidateRecord(Q),W()}),J)try{G.close()}catch{}}).catch((K)=>{console.warn(`[${q6}] port-forward to ${Z}:${X} failed: ${L7$(K)}`,JSON.stringify(vm0(K))),this.invalidateRecord(Q),W()})}closeForwarder($){$.server.close((Z)=>{if(Z)console.warn(`[${q6}] port-forward close on :${$.localPort} errored: ${Z instanceof Error?Z.message:String(Z)}`)})}close(){if(this.closed)return;this.closed=!0,this.claimWatchAbort.abort();for(let $ of this.records.values())this.closeForwarder($.daemonForward);this.records.clear()}}function fX4($){return{active:$.createUpDownCounter("studio.sandbox.active",{description:"Active sandbox count, by runner kind, owning org, and daemon impl. Cross-checks the cAdvisor-derived count from the cluster \u2014 divergence between the two indicates orphaned claims (studio deleted but K8s didn't reap) or unattributed pods.",unit:"{sandbox}"}),ensureOutcome:$.createCounter("studio.sandbox.ensure.outcome",{description:"Outcome of each ensure() call: fresh provision, resume from state-store after restart, or adopt of a cluster-side claim studio didn't know about. Cold-start ratio is the primary input for warm-pool sizing.",unit:"{call}"}),proxyDurationMs:$.createHistogram("studio.sandbox.proxy.duration_ms",{description:"Wall-clock latency of studio-mediated requests to the sandbox daemon: tool exec proxies (source=daemon) and preview iframe traffic (source=preview).",unit:"ms"}),poolPods:$.createGauge("studio.sandbox.pool.pods",{description:"Tenant warm pool depth by pool and state: ready (warmed and unbound \u2014 what a claim can actually bind instantly), bound (serving a user), pending (unbound, not yet warmed), failed (gave up after repeated bootstrap failures). Alert on sustained ready=0: a pool that is always empty is doing nothing while costing N pods.",unit:"{pod}"})}}function vm0($){let Z=[],X=$;for(let Q=0;Q<5&&X instanceof Error;Q++){let Y=X;if(Z.push({name:Y.name,message:Y.message,...Y.code!==void 0?{code:Y.code}:{},...Y.errno!==void 0?{errno:Y.errno}:{}}),Y.cause===X)break;X=Y.cause}if(X!==void 0&&!(X instanceof Error)&&X!==null){let Q=X,Y=Q.error instanceof Error?vm0(Q.error).chain:void 0;Z.push({nonError:String(X),...typeof Q.type==="string"?{type:Q.type}:{},...typeof Q.message==="string"?{message:Q.message}:{},...Q.code!==void 0?{code:Q.code}:{},...typeof Q.reason==="string"?{reason:Q.reason}:{},...Y?{error:Y}:{},...Y===void 0&&Q.error!==void 0?{rawError:String(Q.error)}:{},keys:Object.keys(Q)})}return{chain:Z}}function bX4(){let $=new qx;return $.loadFromDefault(),$}function P7$($){return Boolean($.status?.conditions?.some((Z)=>Z.type==="Ready"&&Z.status==="True"))}function xX4($){let Z=$.spec?.env;if(!Z)return null;for(let X of Z)if(X.name==="DAEMON_TOKEN"&&X.value)return X.value;return null}function yX4($,Z){let X=jX4("sha256").update(`${$}:${Z}`).digest();return _m0+X.readUInt32BE(0)%R7$}function Sm0($,Z){return new Response(JSON.stringify(Z),{status:$,headers:{"content-type":"application/json","access-control-allow-origin":"*"}})}function A7$($){let Z=$.slice(0,hX4);return gX4.test(Z)?Z:""}function cX4($){if($===void 0)return null;let Z=$.trim();if(Z==="")return null;if(!uX4.test(Z))throw Error(`AgentSandboxProvider: envName=${JSON.stringify(Z)} is not a valid DNS-label-safe environment name (lowercase alphanumeric or '-', starts with a letter, ends alphanumeric, \u226432 chars). Studio sets this from STUDIO_ENV; check the studio chart's configMap.`);return Z}function Vm0($,Z={}){let X={...Z};if($){let Q=A7$($.orgId),Y=A7$($.userId);if(Q)X[yQ.orgId]=Q;if(Y)X[yQ.userId]=Y}return X}function DV($){let Z="";for(let X of $){let Q=X.codePointAt(0)??0;Z+=Q<32||Q===127?" ":X}return Z.slice(0,lX4)}function dX4($){try{let Z=new URL($);return Z.username="",Z.password="",Z.toString()}catch{return""}}function mX4($){let Z={},X=$.tenant;if(X?.orgSlug)Z[P3.orgSlug]=DV(X.orgSlug);if(X?.orgName)Z[P3.orgName]=DV(X.orgName);if(X?.userEmail)Z[P3.userEmail]=DV(X.userEmail);if(X?.userName)Z[P3.userName]=DV(X.userName);let Q=$.repo;if(Q){if(Q.displayName)Z[P3.gitRepo]=DV(Q.displayName);let Y=dX4(Q.cloneUrl);if(Y)Z[P3.gitRepoUrl]=DV(Y);let G=$.branch??Q.branch;if(G)Z[P3.gitBranch]=DV(G)}return Z}function iX4($){let Z=$.metadata?.labels;if(!Z)return null;let X=Z[yQ.orgId],Q=Z[yQ.userId];if(!X||!Q)return null;let Y=$.metadata?.annotations??{};return{orgId:X,userId:Q,orgSlug:Y[P3.orgSlug],orgName:Y[P3.orgName],userEmail:Y[P3.userEmail],userName:Y[P3.userName]}}function nX4($,Z){if($){let X=new Date($).getTime();if(Number.isFinite(X)&&X<=Z.getTime())return null}return Z.toISOString()}function pX4($,Z){if($){let X=new Date($).getTime();if(Number.isFinite(X)&&X>=Z.getTime())return null}return Z.toISOString()}function Cm0($){return{org_id:$?.orgId??"",user_id:$?.userId??"",runner_kind:xQ}}function tX4($){let Z={};if($.branch)Z.branch=$.branch;if($.repo)Z.repo=$.repo;if($.workload)Z.workload=$.workload;if($.env&&Object.keys($.env).length>0)Z.env=$.env;if($.tenant)Z.tenant=$.tenant;if($.orgFsConfigJson)Z.orgFsConfigJson=$.orgFsConfigJson;return Object.keys(Z).length>0?Z:null}function oX4($,Z){try{return new URL(e50($,Z)).hostname||null}catch{return null}}var xQ="agent-sandbox",q6="AgentSandboxProvider",LV="x-sandbox-preview-not-ready",TX4="agent-sandbox-system",RX4="studio-sandbox",wN=9000,E7$=3000,km0="/app",IX4=32,qX4,MX4=900000,kX4=60000,SX4=1800000,SU0=3,j7$=1800000,VX4=900000,CX4=1800000,_X4,z7$,_m0=40000,R7$=1e4,vX4=256,yQ,P3,gX4,hX4=63,uX4,lX4=253;var I7$=B(()=>{$6();$7$();Dm0();G7$();Ll0();oi();ni();N7$();Mm0();qX4=new Set(["DAEMON_TOKEN","DAEMON_BOOT_ID","APP_ROOT","PROXY_PORT"]),_X4=["cookie","host","connection","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","accept-encoding","content-length","upgrade"],z7$=["connection","keep-alive","transfer-encoding","content-encoding","content-length"];yQ={role:"studio.decocms.com/role",sandboxHandle:"studio.decocms.com/sandbox-handle",orgId:"studio.decocms.com/org-id",userId:"studio.decocms.com/user-id",env:"studio.decocms.com/env"},P3={orgSlug:"studio.decocms.com/org-slug",orgName:"studio.decocms.com/org-name",userEmail:"studio.decocms.com/user-email",userName:"studio.decocms.com/user-name",gitRepo:"studio.decocms.com/git-repo",gitRepoUrl:"studio.decocms.com/git-repo-url",gitBranch:"studio.decocms.com/git-branch"},gX4=/^([A-Za-z0-9]([-A-Za-z0-9_.]*[A-Za-z0-9])?)?$/;uX4=/^[a-z]([a-z0-9-]{0,30}[a-z0-9])?$/});var q7$={};N4(q7$,{waitForSandboxReady:()=>RU0,parseTenantPools:()=>F7$,getSandboxClaim:()=>z3,getHttpRoute:()=>oZ$,deleteSandboxClaim:()=>cO,deleteHttpRoute:()=>TU0,createSandboxClaim:()=>pi,applyHttpRoute:()=>AU0,SandboxTimeoutError:()=>wV,SandboxError:()=>_9,PREVIEW_NOT_READY_HEADER:()=>LV,KubeConfig:()=>qx,K8S_CONSTANTS:()=>B9,HTTPROUTE_CONSTANTS:()=>ti,AgentSandboxProvider:()=>fm0});var bm0=B(()=>{Dm0();ni();oi();I7$();Mm0()});var _7$={};N4(_7$,{subscribeLifecycle:()=>hm0,getSandboxProviderByKind:()=>ym0,getOrInitSharedRunner:()=>gm0,__resetSharedLifecyclesForTesting:()=>WQ4});function V7$($,Z){let X=M7$[$];if(X)return Promise.resolve(X);let Q=xm0[$];if(Q)return Q;let Y=Z().then((G)=>{return M7$[$]=G,G}).finally(()=>{delete xm0[$]});return xm0[$]=Y,Y}function sX4(){let $=process.env.STUDIO_SANDBOX_PREVIEW_URL_PATTERN;return $&&$.trim()!==""?$:void 0}function eX4(){let $=process.env.STUDIO_SANDBOX_TEMPLATE_NAME;return $&&$.trim()!==""?$:void 0}function $Q4(){let $=process.env.STUDIO_ENV;return $&&$.trim()!==""?$:void 0}function ZQ4(){let $=process.env.STUDIO_SANDBOX_SENTINEL_TOKEN;return $&&$.trim()!==""?$:void 0}function XQ4(){let $=process.env.STUDIO_SANDBOX_PREVIEW_GATEWAY_NAME?.trim(),Z=process.env.STUDIO_SANDBOX_PREVIEW_GATEWAY_NAMESPACE?.trim();if(!$&&!Z)return;if(!$||!Z)throw Error("STUDIO_SANDBOX_PREVIEW_GATEWAY_NAME and STUDIO_SANDBOX_PREVIEW_GATEWAY_NAMESPACE must both be set, or both unset. Half-configured per-claim HTTPRoute routing would silently fail to attach.");return{name:$,namespace:Z}}async function C7$($,Z){let X=new Ii(Z),Q=sX4();switch($){case"agent-sandbox":{let{AgentSandboxProvider:Y,parseTenantPools:G}=await Promise.resolve().then(() => (bm0(),q7$)),J=new qH(y0().encryptionKey);return new Y({stateStore:X,previewUrlPattern:Q,sandboxTemplateName:eX4(),envName:$Q4(),previewGateway:XQ4(),sentinelToken:ZQ4(),tenantPools:G(process.env.STUDIO_SANDBOX_TENANT_POOLS),meter:k$,mintCloneUrl:async(W,K)=>{if(!W.connectionId)return null;let H=L$$(W.cloneUrl);if(!H)return null;let{cloneUrl:N}=await VO(W.connectionId,H.owner,H.name,Z,J,{bufferMs:K?.bufferMs});return N}})}case"user-desktop":throw Error("user-desktop provider cannot be instantiated without a per-run link claim \u2014 call resolveSandboxProvider, which binds the link before constructing the provider.");default:throw Error(`Unknown sandbox provider kind: ${String($)}`)}}function ym0($,Z){return V7$(Z,()=>C7$(Z,$.db))}async function gm0(){let $;try{$=cL()}catch(X){return console.warn("[lifecycle] cannot resolve sandbox runner:",X instanceof Error?X.message:String(X)),null}return await V7$($,()=>C7$($,m8().db))}function hm0($,Z,X){let Q=lO.get(Z);if(Q){if(Q.terminated){if(Q.lastPhase)try{X(Q.lastPhase)}catch{}return{unsubscribe:GQ4}}if(Q.listeners.add(X),Q.lastPhase)try{X(Q.lastPhase)}catch{}return k7$(Z,Q,X)}let Y=new AbortController,G={lastPhase:null,terminated:!1,listeners:new Set([X]),abort:Y};return lO.set(Z,G),JQ4($,Z,G),k7$(Z,G,X)}function GQ4(){}function k7$($,Z,X){return{unsubscribe(){if(lO.get($)!==Z)return;if(Z.listeners.delete(X),Z.listeners.size===0)lO.delete($),Z.abort.abort()}}}async function JQ4($,Z,X){let Q=null;try{for await(let Y of $.watchClaimLifecycle(Z,X.abort.signal)){if(X.abort.signal.aborted)break;X.lastPhase=Y;let G=Y.kind==="ready"||Y.kind==="failed";if(G)X.terminated=!0;let J=Array.from(X.listeners);for(let W of J)try{W(Y)}catch{}if(G)break}}catch(Y){Q=Y}finally{if(!X.terminated&&!X.abort.signal.aborted&&X.listeners.size>0){let Y={kind:"failed",reason:"unknown",message:Q instanceof Error?Q.message:"Lifecycle watcher ended unexpectedly"};X.lastPhase=Y,X.terminated=!0;for(let G of Array.from(X.listeners))try{G(Y)}catch{}}if(lO.get(Z)===X)lO.delete(Z)}}function WQ4(){for(let $ of lO.values())$.abort.abort();lO.clear()}var rX4,aX4,S7$,M7$,xm0,QQ4,YQ4,lO;var ai=B(()=>{WN();RG();v6();zl0();Bx();qc();R$();rX4=Symbol.for("decocms.sandbox.lifecycle.runners"),aX4=Symbol.for("decocms.sandbox.lifecycle.inflight"),S7$=globalThis,M7$=S7$[rX4]??={},xm0=S7$[aX4]??={};QQ4=Symbol.for("decocms.sandbox.lifecycle.shared-lifecycles"),YQ4=globalThis,lO=YQ4[QQ4]??=new Map});async function dX($,Z){let{userId:X,branch:Q,virtualMcpMetadata:Y,explicitKind:G}=Z;if(G)return si($,G);if($.sandboxPreference==="agent-sandbox")return si($,"agent-sandbox");if($.sandboxPreference==="cluster-default")return si($,cL());let[J,...W]=KQ4(Y,X,Q);if(J)return si($,W.length===0?J:HQ4(J,W));return si($,v7$())}function KQ4($,Z,X){let Q=f5($)[Z]?.[X];if(!Q)return[];let Y=yJ(Q);return Object.keys(Y)}function HQ4($,Z){let X=v7$();if(X===$||Z.includes(X))return X;return $}function v7$(){return cL()}async function si($,Z){let X=Z==="user-desktop"?"agent-sandbox":Z;return{provider:await ym0($,X),kind:X}}var dO=B(()=>{L8();WN();VQ();ai()});var ei;var um0=B(()=>{ei={npm:{install:"npm install",run:($)=>`npm run ${$}`,runtime:"node"},pnpm:{install:"pnpm install",run:($)=>`pnpm run ${$}`,runtime:"node"},yarn:{install:"yarn install",run:($)=>`yarn run ${$}`,runtime:"node"},bun:{install:"bun install",run:($)=>`bun run ${$}`,runtime:"bun"},deno:{install:"deno install",run:($)=>`deno task ${$}`,runtime:"deno"}}});function A3($,Z){return Z?`thread:${$}/${Z}`:`thread:${$}`}function BN($){return`sandbox/thread-${$.replace(/^thread:/,"").replace(/\//g,"-")}`}function mO($){if(!$||!$.startsWith("thread:"))return null;return $.slice(7).split("/")[0]||null}async function DN($,Z,X){let Q=mO(Z);if(!Q)return X;return(await $.storage.threads.get(Q).catch(()=>null))?.created_by??X}async function EV($,Z){if(!Z)return null;let X=await $.storage.threads.get(Z).catch(()=>null);if(!X)return null;return X.metadata??{}}async function f7$($,Z){let Q=(await EV($,Z))?.headRef;return typeof Q==="string"&&Q.length>0?Q:null}async function b7$($,Z,X){let Q=await EV($,Z);if(!Q)return;if(Q.headRef===X)return;await $.storage.threads.update(Z,{metadata:{...Q,headRef:X}}).catch((Y)=>console.warn("[thread-repo] setThreadHeadRef failed",Y))}function NQ4($,Z){let X=F50(Z,$.owner,$.name);if(!X||X.id===$.connectionId)return null;let Q=z5(X);return{...$,connectionId:X.id,...Q?.installationId?{installationId:Q.installationId}:{}}}async function iO($,Z){let X=await EV($,Z),Q=X?.githubRepo??null;if(!Z||!X||!Q?.connectionId)return Q;try{let Y=$.storage.threads.getOrganizationId();if(!Y)return Q;if(await $.storage.connections.findById(Q.connectionId,Y))return Q;let{items:G}=await $.storage.connections.list(Y),J=NQ4(Q,G);if(!J)return Q;return await $.storage.threads.update(Z,{metadata:{...X,githubRepo:J}}),console.warn("[thread-repo] re-pointed thread at a live repo connection",{threadId:Z,from:Q.connectionId,to:J.connectionId}),J}catch(Y){return console.warn("[thread-repo] repoint check failed",Y),Q}}function cm0($){if($.pinnedRef)return $.pinnedRef;if($.runBranch&&$.runBranch===A3($.threadId))return $.runBranch;if($.threadRepo)return A3($.threadId,$.threadRepo.connectionId);if(!$.agentRepo)return"ephemeral";return $.runBranch??`thread:${$.threadId}`}async function lm0($,Z){let Q=(await EV($,Z))?.pinnedRef;return typeof Q==="string"&&Q.length>0?Q:null}async function x7$($,Z){let[X,Q]=await Promise.all([iO($,Z.threadId),lm0($,Z.threadId)]);return cm0({...Z,threadRepo:X,pinnedRef:Q})}async function y7$($,Z,X,Q,Y,G){let J=await EV($,Z);if(!J)return;let W=Ri(f5(J),X,Q,Y,G);await $.storage.threads.update(Z,{metadata:{...J,sandboxMap:W}}).catch((K)=>console.warn("[thread-repo] setThreadSandboxMapEntry failed",K))}async function VU0($,Z){return f5(await EV($,Z))}async function g7$($,Z,X,Q,Y){let G=await EV($,Z);if(!G)return;let J=jl0(f5(G),X,Q,Y);if(!J)return;await $.storage.threads.update(Z,{metadata:{...G,sandboxMap:J}}).catch((W)=>console.warn("[thread-repo] removeThreadSandboxMapEntry failed",W))}var T3=B(()=>{DQ();VQ()});function _x($){if(!$)return null;let Z=$.runtime;if(!Z||typeof Z!=="object")return null;let X=Z.env;if(!Array.isArray(X))return null;let Q=[];for(let Y of X){if(!Y||typeof Y!=="object")continue;let G=Y;if(typeof G.key!=="string"||!q10.test(G.key))continue;if(G.kind==="literal"&&typeof G.value==="string"){Q.push({key:G.key,kind:"literal",value:G.value});continue}if(G.kind==="secret"&&typeof G.secretId==="string"&&G.secretId.length>0)Q.push({key:G.key,kind:"secret",secretId:G.secretId})}return Q.length===0?null:Q}function h7$($){if(!$)return null;let Z=$.runtime;if(!Z||typeof Z!=="object")return null;let X=Z.submoduleCredentials;if(!Array.isArray(X))return null;let Q=[];for(let Y of X){if(!Y||typeof Y!=="object")continue;let G=Y;if(typeof G.host==="string"&&G.host.length>0&&typeof G.secretId==="string"&&G.secretId.length>0)Q.push({host:G.host,secretId:G.secretId})}return Q}async function u7$($,Z){Z0(Z);let X=o(Z);await Z.access.check();let Q=W1(Z);if(!Q)throw Error("User ID required");let Y=await Z.storage.virtualMcps.findById($.virtualMcpId);if(!Y||Y.organization_id!==X.id)throw Error("Virtual MCP not found");let G=Y.metadata??{},J=f5(G),W=await DN(Z,$.branch,Q),K=sW(J,W,$.branch,$.sandboxProviderKind);return{virtualMcp:Y,metadata:G,userId:Q,sandboxUserId:W,entry:K,organization:X}}function FQ4($){if($===null||!/^\d+$/.test($))return null;let Z=Number($);return Z>=1&&Z<=65535?$:null}function c7$($){let Z=$.runtime??null,Q=Z?.selected??null,Y=FQ4(Z?.port??null),G=Z?.path??null;if(!Q||!(Q in ei))return{packageManager:null,runtime:null,port:Y,packageManagerPath:G,runtimeBinPath:null};let J=ei[Q].runtime;return{packageManager:Q,runtime:J,port:Y,packageManagerPath:G,runtimeBinPath:J==="deno"?"/opt/deno/bin":J==="bun"?"/opt/bun/bin":null}}var $n=B(()=>{L8();um0();VQ();T3()});import{sql as UQ4}from"kysely";function l7$($){return $ instanceof Date?$.toISOString():String($)}class dm0{db;vault;constructor($,Z){this.db=$;this.vault=Z}rowToInfo($){return{id:$.id,organizationId:$.organization_id,scope:$.scope,userId:$.user_id,name:$.name,description:$.description,createdBy:$.created_by,createdAt:l7$($.created_at),updatedBy:$.updated_by,updatedAt:l7$($.updated_at)}}assertVisible($,Z){if($.scope==="user"&&$.user_id!==Z)throw new nO($.id)}async create($){let Z=l8("sec"),X=await this.vault.encrypt($.value),Q=new Date,Y=await this.db.insertInto("secrets").values({id:Z,organization_id:$.organizationId,scope:$.scope.kind,user_id:$.scope.kind==="user"?$.scope.userId:null,name:$.name,encrypted_value:X,description:$.description??null,created_by:$.createdBy,created_at:Q,updated_by:$.createdBy,updated_at:Q}).returning(CU0).executeTakeFirstOrThrow();return this.rowToInfo(Y)}async update($){let Z=await this.db.selectFrom("secrets").where("id","=",$.id).where("organization_id","=",$.organizationId).select(["id","scope","user_id"]).executeTakeFirst();if(!Z)throw new bG($.id);this.assertVisible(Z,$.callerUserId);let X={updated_by:$.updatedBy,updated_at:new Date};if($.value!==void 0)X.encrypted_value=await this.vault.encrypt($.value);if($.description!==void 0)X.description=$.description;let Q=await this.db.updateTable("secrets").set(X).where("id","=",$.id).where("organization_id","=",$.organizationId).returning(CU0).executeTakeFirstOrThrow();return this.rowToInfo(Q)}async delete($,Z,X){let Q=await this.db.selectFrom("secrets").where("id","=",$).where("organization_id","=",Z).select(["id","scope","user_id"]).executeTakeFirst();if(!Q)throw new bG($);this.assertVisible(Q,X),await this.db.deleteFrom("secrets").where("id","=",$).where("organization_id","=",Z).execute()}async list($){let Z=this.db.selectFrom("secrets").where("organization_id","=",$.organizationId).select(CU0);if($.scope?.kind==="user")Z=Z.where("scope","=","user").where("user_id","=",$.scope.userId);else if($.scope?.kind==="organization")Z=Z.where("scope","=","organization");else Z=Z.where((Q)=>Q.or([Q("scope","=","organization"),Q.and([Q("scope","=","user"),Q("user_id","=",$.callerUserId)])]));return(await Z.orderBy("created_at","desc").execute()).map((Q)=>this.rowToInfo(Q))}async findById($,Z,X){let Q=await this.db.selectFrom("secrets").where("id","=",$).where("organization_id","=",Z).select(CU0).executeTakeFirst();if(!Q)throw new bG($);return this.assertVisible(Q,X),this.rowToInfo(Q)}async resolveById($,Z,X){let Q=await this.db.selectFrom("secrets").where("id","=",$).where("organization_id","=",Z).selectAll().executeTakeFirst();if(!Q)throw new bG($);this.assertVisible(Q,X);let Y=await this.vault.decrypt(Q.encrypted_value);return{info:this.rowToInfo(Q),value:Y}}async resolveByName($){let Z=this.db.selectFrom("secrets").where("organization_id","=",$.organizationId).where("scope","=",$.scope.kind).where(UQ4`lower(name) = lower(${$.name})`).selectAll();if($.scope.kind==="user")Z=Z.where("user_id","=",$.scope.userId);let X=await Z.executeTakeFirst();if(!X)throw new bG(`${$.scope.kind}:${$.name}`);let Q=await this.vault.decrypt(X.encrypted_value);return{info:this.rowToInfo(X),value:Q}}}var CU0,bG,nO;var Zn=B(()=>{kX();CU0=["id","organization_id","scope","user_id","name","description","created_by","created_at","updated_by","updated_at"];bG=class bG extends Error{constructor($){super(`Secret ${$} not found`);this.name="SecretNotFoundError"}};nO=class nO extends Error{constructor($){super(`Access denied for secret ${$}`);this.name="SecretAccessDeniedError"}}});async function pO($,Z){let X=$.body?.getReader();if(!X)return $.text();let Q=new TextDecoder,Y="",G=0;for(;;){let{done:J,value:W}=await X.read();if(J)break;if(G+=W.byteLength,G>Z)throw await X.cancel().catch(()=>{}),new d7$(`Upstream response exceeded ${Z} bytes`);Y+=Q.decode(W,{stream:!0})}return Y+=Q.decode(),Y}var d7$;var Xn=B(()=>{d7$=class d7$ extends Error{}});async function _U0({ctx:$,runner:Z,handle:X,orgId:Q,userId:Y,entries:G}){if(!G||G.length===0)return;let J={};for(let K of G){if(K.kind==="literal"){J[K.key]=K.value;continue}try{let{value:H}=await $.storage.secrets.resolveById(K.secretId,Q,Y);J[K.key]=H}catch(H){if(H instanceof bG||H instanceof nO){console.warn(`[SANDBOX_START] skipping env ${K.key}: ${H.message}. Re-link or recreate the secret to restore.`);continue}throw H}}if(Object.keys(J).length===0)return;let W=await Z.proxyDaemonRequest(X,"/_sandbox/config",{method:"PUT",headers:new Headers({"content-type":"application/json"}),body:JSON.stringify({env:J})});if(!W.ok){let K=await pO(W,OQ4).catch(()=>W.statusText);console.warn(`[SANDBOX_START] daemon rejected env patch (${W.status}): ${K}`)}}var OQ4=10485760;var mm0=B(()=>{Zn();Xn()});async function m7$({ctx:$,orgId:Z,userId:X,entries:Q}){if(!Q||Q.length===0)return[];let Y=[];for(let G of Q)try{let{value:J}=await $.storage.secrets.resolveById(G.secretId,Z,X);Y.push({host:G.host,token:J})}catch(J){if(J instanceof bG||J instanceof nO){console.warn(`[SANDBOX_START] skipping submodule credential for ${G.host}: ${J.message}. Re-link or recreate the secret to restore.`);continue}throw J}return Y}var i7$=B(()=>{Zn()});async function t7$($,Z,X,Q,Y){let G=await SY({connectionId:$,tokenStorage:new R6(Q,Y)});if(!G.accessToken)return null;return r7$(Z,X,G.accessToken)}function o7$($,Z){return r7$($,Z,null)}async function r7$($,Z,X){let Q=new Map,Y=new Set(n7$.map((K)=>K.path));for(let K of Object.values(p7$))for(let H of K??[])Y.add(H);await Promise.all(Array.from(Y).map(async(K)=>{Q.set(K,await BQ4($,Z,K,X))}));let G=n7$.find(({path:K})=>Q.get(K)!==null);if(!G)return null;let J=p7$[G.pm]??[],W=null;for(let K of J)if(W=DQ4(Q.get(K)??null),W)break;return{packageManager:G.pm,devPort:W}}async function BQ4($,Z,X,Q){let Y=`https://api.github.com/repos/${$}/${Z}/contents/${encodeURIComponent(X)}`;try{let G={Accept:"application/vnd.github+json","User-Agent":"studio-runtime-detect"};if(Q)G.Authorization=`token ${Q}`;let J=await fetch(Y,{headers:G,signal:AbortSignal.timeout(5000)});if(!J.ok)return null;let W=await J.json();if(!W.content||W.encoding!=="base64")return null;return Buffer.from(W.content,"base64").toString("utf8")}catch{return null}}function DQ4($){if(!$)return null;try{let Z=JSON.parse($),X=Z.tasks??Z.scripts??{},Y=(X.dev??X.start??"").match(wQ4)?.[1]??null;if(!Y)return null;let G=Number(Y);return G>=1&&G<=65535?Y:null}catch{return null}}var n7$,p7$,wQ4;var a7$=B(()=>{eW();TY();n7$=[{path:"deno.json",pm:"deno"},{path:"deno.jsonc",pm:"deno"},{path:"bun.lock",pm:"bun"},{path:"bunfig.toml",pm:"bun"},{path:"pnpm-lock.yaml",pm:"pnpm"},{path:"yarn.lock",pm:"yarn"},{path:"package-lock.json",pm:"npm"},{path:"package.json",pm:"bun"}],p7$={deno:["deno.json","deno.jsonc"],bun:["package.json"],pnpm:["package.json"],yarn:["package.json"],npm:["package.json"]},wQ4=/(?:--port|PORT=|:)(\d{4,5})/});function LQ4($){return($??"").normalize("NFKD").replace(/[\u0300-\u036F]/g,"").toLowerCase().replace(/[^a-z0-9]+/g,"-").replace(/^-+|-+$/g,"")||"user"}function vU0($){return $?.name||$?.email?.split("@")[0]||void 0}function fU0($){let Z=LQ4($),X=Date.now().toString(36).split("").reverse().join("");return`${Z}-${X}`}function s7$($){let{current:Z,detached:X,base:Q}=$.status??{};if(typeof Z!=="string"||Z.length===0)return null;if(X===!0)return null;if(Z===$.requestedRef)return null;if(EQ4.has(Z))return null;if(typeof Q==="string"&&Q.length>0&&Z===Q)return null;return Z}function bU0($){if(!$.branch.startsWith("thread:"))return $.branch;if($.sticky&&$.recordedHeadRef)return $.recordedHeadRef;return $.derivedRef}var EQ4;var xU0=B(()=>{EQ4=new Set(["main","master","trunk","develop","HEAD"])});async function e7$($,Z){if(!$)return{hosts:[],allowSameHostDev:!1};let X;try{X=await $.presignedGetUrl("link-dispatch/_allowlist_probe",60,{requireFetchable:!0})}catch{return{hosts:[],allowSameHostDev:!1}}let Q;try{Q=new URL(X)}catch{return{hosts:[],allowSameHostDev:!1}}if(Q.protocol!=="https:"&&Q.protocol!=="http:")return{hosts:[],allowSameHostDev:!1};let Y=Q.hostname,G=jQ4.has(Y);return{hosts:[Y],allowSameHostDev:G&&!Z.isProduction}}var jQ4;var $X$=B(()=>{jQ4=new Set(["127.0.0.1","localhost","::1","[::1]","0.0.0.0"])});var jV="home";var yU0=()=>{};function gU0($){if(!tF($))return`Invalid volume name ${JSON.stringify($)} \u2014 use 1-128 chars of letters, digits, "_", "-" or "."`;if(zQ4.has($))return`Volume "${$}" is reserved`;if(UW($))return'Volume names starting with "public-" are reserved for shared skill sets';if($.startsWith("."))return'Volume names starting with "." are reserved';if(!/^[A-Za-z0-9]/.test($))return"Volume names must start with a letter or digit";return null}async function hU0($,Z){try{let X=await $.storage.connections.findById(Z.connectionId,Z.organizationId);if(!X)throw Error("sync connection not found in this organization");await SO({ctx:$,connectionId:X.id,organizationId:Z.organizationId,onLegacyMintError:(J)=>console.warn("[org-repo-sync] repo-scoped mint failed",{configId:Z.id,error:J instanceof Error?J.message:String(J)})});let Q=await SY({connectionId:X.id,tokenStorage:new R6($.db,$.vault)});if(!Q.accessToken)throw Error("No GitHub token for the sync connection \u2014 reconnect the mcp-github integration.");let Y=Q.accessToken,G=await J_0($.db,{orgId:Z.organizationId,baseUrl:$.baseUrl,volume:Z.volume,source:{repo:`${Z.repoOwner}/${Z.repoName}`,ref:Z.ref,paths:Z.paths},authToken:Y,skipVolumeQuota:!1});return await $.storage.orgRepoSyncs.recordSyncResult(Z.id,{error:null}),{id:Z.id,volume:Z.volume,...G}}catch(X){let Q=X instanceof Error?X.message:String(X);return await $.storage.orgRepoSyncs.recordSyncResult(Z.id,{error:Q}).catch(()=>{}),{id:Z.id,volume:Z.volume,error:Q}}}var zQ4,im0=10;var uU0=B(()=>{Bx();eW();TY();_v();HD();J10();zQ4=new Set(["home","outputs","uploads","public","output","upload"])});function tO($,Z){let X;if($==="home")X=`org/${jV}`;else if($==="outputs")X=`org/${ZX$}`;else if($==="uploads")X=`org/${XX$}`;else if(UW($))X=`org/public/${$.slice(7)}`;else X=`org/${$}`;return Z?`${X}/${Z}`:X}function AQ4($){return{baseUrl:$.baseUrl.replace(/\/+$/,""),orgSlug:$.orgSlug,token:$.token,mounts:[{volume:"home",path:jV},...PQ4.map((Z)=>({...Z})),...($.publicSets??[]).map((Z)=>({volume:rF(Z),path:`public/${Z}`,readonly:!0})),...($.syncedVolumes??[]).filter((Z)=>gU0(Z)===null).map((Z)=>({volume:Z,path:Z,readonly:!0}))]}}async function QX$($,Z){try{let X=await $.boundAuth.apiKey.create({name:`orgfs-${Z.orgSlug}`,permissions:{self:["ORG_FS_READ","ORG_FS_WRITE"]},expiresIn:TQ4,metadata:{organization:{id:Z.orgId,slug:Z.orgSlug}}}),Q=await $.storage.orgRepoSyncs.listEnabledVolumes(Z.orgId).catch(()=>[]);return JSON.stringify(AQ4({baseUrl:Z.baseUrl,orgSlug:Z.orgSlug,token:X.key,publicSets:HG().map((Y)=>Y.set),syncedVolumes:Q}))}catch(X){console.warn("[org-fs] token mint failed; mounts disabled for this sandbox",X);return}}var ZX$=".outputs",XX$=".uploads",PQ4,TQ4=604800;var Qn=B(()=>{yU0();uU0();HD();PQ4=[{volume:"outputs",path:ZX$},{volume:"uploads",path:XX$}]});import{z as GK}from"zod";async function vx($,Z){Z0(Z);let X=o(Z),Q=W1(Z);if(!Q)throw Error("User ID required");let Y=await Z.storage.virtualMcps.findById($.virtualMcpId);if(!Y||Y.organization_id!==X.id)throw Error("Virtual MCP not found");let G=Y.metadata??{},J=await DN(Z,$.branch,Q),W=sW(f5(G),J,$.branch,$.sandboxProviderKind),K=$.sandboxProviderKind,{provider:H}=await dX(Z,{userId:J,branch:$.branch,virtualMcpMetadata:G,explicitKind:K});if(W){if(K!=="user-desktop")return W;if(await H.alive(W.sandboxHandle).catch(()=>!1))return W;await kO(Z.storage.virtualMcps,$.virtualMcpId,Q,J,$.branch,K).catch((w)=>{console.warn("[ensureSandbox] failed to reap stale user-desktop entry",w)})}let F=await iO(Z,mO($.branch)??Z.metadata?.threadId)??G.githubRepo??null,{entry:U}=await GX$({ctx:Z,userId:Q,sandboxUserId:J,orgId:X.id,virtualMcpId:$.virtualMcpId,branch:$.branch,metadata:G,githubRepo:F,existing:null,providerKind:K,runner:H,...$.cloneOnly?{cloneOnly:!0}:{}});return U}async function GX$($){let{ctx:Z,userId:X,sandboxUserId:Q,orgId:Y,virtualMcpId:G,branch:J,metadata:W,existing:K,runner:H,cloneOnly:N}=$,F=$.githubRepo?await IQ4({ctx:Z,orgId:Y,virtualMcpId:G,userId:X,githubRepo:$.githubRepo}):null,{runtime:U,packageManager:O,port:w,packageManagerPath:D}=c7$(W),L;if(F){if(F.connectionId)await SO({ctx:Z,connectionId:F.connectionId,organizationId:Y,forceRefresh:!0,onLegacyMintError:(D0)=>{console.error("[provisionSandbox] repo-scoped legacy token mint failed",{connectionId:F.connectionId,error:D0.message})}});let{cloneUrl:O0,gitUserName:B0,gitUserEmail:s}=F.connectionId?await VO(F.connectionId,F.owner,F.name,Z.db,Z.vault):D$$(F.owner,F.name);if(!O){let D0=F.connectionId?await t7$(F.connectionId,F.owner,F.name,Z.db,Z.vault):await o7$(F.owner,F.name);if(D0)O=D0.packageManager,U=ei[D0.packageManager].runtime,w=D0.devPort??w,await qQ4(Z,G,X,D0.packageManager,D0.devPort)}let t=y0().sandboxStickyHeadRefEnabled,P0=bU0({branch:J,derivedRef:BN(J),recordedHeadRef:t?await f7$(Z,mO(J)):null,sticky:t}),Y0=await m7$({ctx:Z,orgId:Y,userId:X,entries:h7$(W)});L={cloneUrl:O0,...F.connectionId?{connectionId:F.connectionId}:{},userName:B0,userEmail:s,branch:P0,displayName:`${F.owner}/${F.name}`,submoduleCredentials:Y0}}let E=U&&O&&!N?{runtime:U,packageManager:O,...w!==null?{devPort:Number(w)}:{},...D?{packageManagerPath:D}:{}}:void 0,j=Ai({orgId:Y,virtualMcpId:G,branch:J}),z=H.kind==="user-desktop"?await e7$(Z.objectStorage,{isProduction:y0().nodeEnv==="production"}):null,A=(H.kind==="user-desktop"||H.kind==="agent-sandbox")&&!y0().orgFsMountsDisabled,P;if(A){let O0=Z.organization?.slug??(await Z.db.selectFrom("organization").select(["slug"]).where("id","=",Y).executeTakeFirst())?.slug;if(O0)P=await QX$(Z,{orgSlug:O0,orgId:Y,baseUrl:GQ()})}await kQ4(H);let q=await H.ensure({userId:Q,projectRef:j},{branch:J,repo:L,workload:E,cloneOnly:N===!0,tenant:{orgId:Y,userId:Q,...Z.organization?.slug?{orgSlug:Z.organization.slug}:{},...Z.organization?.name?{orgName:Z.organization.name}:{},...Z.auth.user?.email?{userEmail:Z.auth.user.email}:{},...Z.auth.user?.name?{userName:Z.auth.user.name}:{}},...z?{offloadAllowedHosts:z.hosts,offloadAllowSameHostDev:z.allowSameHostDev}:{},...P?{orgFsConfigJson:P}:{}}),S=_x(W);await _U0({ctx:Z,runner:H,handle:q.handle,orgId:Y,userId:X,entries:S});let _=!!K&&K.sandboxHandle===q.handle&&K?.createdAt?K.createdAt:Date.now(),l=W.runtime?.selected??null,f=W.runtime?.port??null,x=W.runtime?.path??null,p={sandboxHandle:q.handle,previewUrl:q.previewUrl,sandboxApiUrl:q.previewUrl,sandboxProviderKind:H.kind,createdAt:_,startedWith:{packageManager:l,port:f,path:x}};await J$$(Z.storage.virtualMcps,G,X,Q,J,$.providerKind,p);let h=mO(J)??Z.metadata?.threadId;if(h)await y7$(Z,h,Q,J,$.providerKind,p);let r=!K||K.sandboxHandle!==q.handle;return{entry:p,isNewVm:r}}async function IQ4($){let{ctx:Z,orgId:X,virtualMcpId:Q,userId:Y,githubRepo:G}=$;if(!G.connectionId)return G;if(await Z.storage.connections.findById(G.connectionId,X))return G;let{items:W}=await Z.storage.connections.list(X),K=F50(W,G.owner,G.name);if(!K)return console.warn("[provisionSandbox] recorded repo connection no longer exists and no live connection covers the repo",{virtualMcpId:Q,connectionId:G.connectionId}),G;console.warn("[provisionSandbox] healed dangling repo connection",{virtualMcpId:Q,staleConnectionId:G.connectionId,connectionId:K.id});try{let N=(await Z.storage.virtualMcps.findById(Q))?.metadata??{},F=N.githubRepo;if(F?.connectionId===G.connectionId){let U=z5(K);await Z.storage.virtualMcps.update(Q,Y,{metadata:{...N,githubRepo:{...F,connectionId:K.id,...U?{installationId:U.installationId}:{}}}})}}catch(H){console.warn("[provisionSandbox] failed to persist healed repo connection",{virtualMcpId:Q,error:H.message})}return{...G,connectionId:K.id}}async function qQ4($,Z,X,Q,Y){let G=await $.storage.virtualMcps.findById(Z);if(!G)return;let J=G.metadata??{};await $.storage.virtualMcps.update(Z,X,{metadata:{...J,runtime:{selected:Q,port:Y}}})}async function kQ4($){if(!$.hasSchedulableCapacity)return;let Z=Date.now()+YX$,X=!1;while(!await $.hasSchedulableCapacity()){if(Date.now()>=Z)throw Error(`sandbox provisioning failed: the cluster has had no room to schedule another sandbox for ${Math.round(YX$/1000)}s`);if(!X)X=!0,console.warn("[ensureSandbox] waiting for cluster capacity \u2014 a sandbox pod cannot be scheduled right now");await C$(MQ4)}}var RQ4,nm0,YX$=150000,MQ4=5000;var Yn=B(()=>{WN();$6();v0();$n();mm0();i7$();VQ();DQ();Bx();a7$();um0();dO();T3();xU0();$X$();R$();PZ();Qn();VQ();RQ4=GK.enum(["agent-sandbox","user-desktop","cluster"]),nm0=m({name:"SANDBOX_START",description:"Start a sandbox with the connected GitHub repo and dev server.",annotations:{title:"Start VM Preview",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!1,openWorldHint:!0},_meta:{ui:{visibility:"app"}},inputSchema:GK.object({virtualMcpId:GK.string().describe("Virtual MCP ID"),branch:GK.string().min(1).optional().describe("Git branch to check out. Pass the thread's branch whenever the caller has one: when omitted the handler mints a fresh `<user-slug>-<timestamp>` name, which becomes a SEPARATE sandbox from the one the thread's own branch resolves to. The resolved branch is returned in the response so callers can persist it."),sandboxProviderKind:RQ4.optional().describe("Explicit runtime choice. Hosted provider is `agent-sandbox`; legacy `cluster` input is accepted only for compatibility and normalized to `agent-sandbox`. When omitted, defaults to `user-desktop` if the acting user's link daemon is online, else the env kind.")}),outputSchema:GK.object({previewUrl:GK.string().nullable(),sandboxHandle:GK.string(),branch:GK.string(),isNewVm:GK.boolean(),sandboxProviderKind:GK.enum(["agent-sandbox","user-desktop"])}),handler:async($,Z)=>{Z0(Z);let X=o(Z);await Z.access.check();let Q=$.branch??fU0(vU0(Z.auth.user)),Y=W1(Z);if(!Y)throw Error("User ID required");let G=await DN(Z,Q,Y),J=await Z.storage.virtualMcps.findById($.virtualMcpId);if(!J||J.organization_id!==X.id)throw Error("Virtual MCP not found");let W=J.metadata??{},K=$.sandboxProviderKind?hL($.sandboxProviderKind):void 0,{provider:H,kind:N}=await dX(Z,{userId:G,branch:Q,virtualMcpMetadata:W,explicitKind:K}),F=sW(f5(W),G,Q,N),O=await iO(Z,mO(Q)??Z.metadata?.threadId)??W.githubRepo??null,{entry:w,isNewVm:D}=await GX$({ctx:Z,userId:Y,sandboxUserId:G,orgId:X.id,virtualMcpId:$.virtualMcpId,branch:Q,metadata:W,githubRepo:O,existing:F,providerKind:N,runner:H});return{...w,branch:Q,isNewVm:D,sandboxProviderKind:N}}})});function SQ4($){let{publicUrl:Z,agentId:X,organization:Q,target:Y,threadId:G}=$;if(Y==="agent-tools")return`${Z}/mcp/virtual-mcp/${X}`;if(!Q.slug)throw new WX$(Q.id);if(Y==="task-run"){if(!G)throw Error("a task-run MCP endpoint is scoped to a run: threadId is required");return`${Z}/api/${Q.slug}/mcp/task-run/${encodeURIComponent(G)}`}return`${Z}/api/${Q.slug}/mcp/self`}async function cU0($,Z,X,Q,Y="agent-tools",G){let J=SQ4({publicUrl:GQ(),agentId:Z,organization:X,target:Y,...G?{threadId:G}:{}}),W=await $.boundAuth.apiKey.create({name:Q,permissions:{"*":["*"]},expiresIn:JX$,metadata:{organization:{id:X.id,slug:X.slug,name:X.name}}});return{url:J,headers:{Authorization:`Bearer ${W.key}`,"x-org-id":X.id},expiresAt:Date.now()+JX$*1000}}var JX$=3600,WX$;var pm0=B(()=>{PZ();WX$=class WX$ extends Error{constructor($){super(`cannot mint a management MCP endpoint for organization "${$}": the org-scoped path /api/<slug>/mcp/self needs the org slug, which was not loaded.`);this.name="MissingOrganizationSlugError"}}});async function VQ4($,Z,X,Q){try{let Y=$.organization;if(!Y)return;let G=await cU0($,Q.virtualMcpId,Y,"tool-scripting"),J=await Z.proxyDaemonRequest(X,"/_sandbox/tools/sync",{method:"POST",headers:new Headers({"content-type":"application/json"}),body:JSON.stringify(G)});if(!J.ok)console.warn("[cluster-sandbox-fs] tools/sync failed",J.status,await J.text().catch(()=>""))}catch(Y){console.warn("[cluster-sandbox-fs] tools/sync failed",Y)}}async function fx($,Z){let{provider:X,kind:Q}=await dX($,{userId:Z.userId,branch:Z.branch,virtualMcpMetadata:null}),Y=null,G=()=>{if(!Y){if(Y=vx({virtualMcpId:Z.virtualMcpId,branch:Z.branch,sandboxProviderKind:Q},$).then((K)=>K.sandboxHandle),Y.catch(()=>{Y=null}),Z.syncTools)Y.then((K)=>VQ4($,X,K,{virtualMcpId:Z.virtualMcpId,providerKind:Q})).catch(()=>{})}return Y},J=Z.branch==="ephemeral"||Q==="user-desktop";return El0(X,{ensureHandle:G,invalidateHandle:async(K)=>{let H=Y;if(Y=null,!J&&!K?.force)return;try{await kO($.storage.virtualMcps,Z.virtualMcpId,Z.userId,Z.userId,Z.branch,Q)}catch(N){console.warn("[cluster-sandbox-fs] failed to reap vmMap entry",N)}if(H&&typeof X.forgetHandle==="function")try{let N=await H;await X.forgetHandle(N)}catch(N){console.warn("[cluster-sandbox-fs] forgetHandle failed",N)}},canAutoRestart:J,threadId:Z.threadId})}async function KX$($,Z){try{let X=await fx($,Z),{stdout:Q}=await X.onBash("test -d .deco && echo __DECO_SITE__");return Q.includes("__DECO_SITE__")}catch(X){return console.warn("[cluster-sandbox-fs] .deco probe failed; assuming deco site",X),!0}}var lU0=B(()=>{WN();pm0();dO();Yn();VQ()});import{z as HX$}from"zod";function bx($){let Z=[];for(let X of $){if(X.status!=="active")continue;let Q=z5(X);if(!Q)continue;Z.push({connectionId:X.id,owner:Q.owner,repo:Q.repo,installationId:Q.installationId})}return Z}async function _Q4($,Z){let{items:X}=await $.storage.connections.list(Z,{slug:"mcp-github"});return bx(X)}function vQ4($){let Z=$.split(`
+`))>=0){let K=Q.slice(0,W).trim();if(Q=Q.slice(W+1),!K)continue;yield JSON.parse(K)}}let Y=Q.trim();if(Y)yield JSON.parse(Y)}finally{Z.releaseLock()}}var lZ$,jm0,nZ$="gateway.networking.k8s.io",pZ$="v1",tZ$="httproutes",QX4,ti,rZ$="mesh-sandbox-runner";var oi=B(()=>{$6();ni();lZ$=class lZ$ extends Error{status;body;constructor($,Z,X){super(X);this.status=$;this.body=Z;this.name="KubeHttpError"}};jm0=`/apis/${B9.CLAIM_API_GROUP}/${B9.CLAIM_API_VERSION}/namespaces`;QX4=`/apis/${nZ$}/${pZ$}/namespaces`;ti={API_GROUP:nZ$,API_VERSION:pZ$,PLURAL:tZ$}});function GX4($){return($.items??[]).some((Z)=>{if(Z.status?.phase!=="Pending")return!1;return(Z.status?.conditions??[]).some((X)=>X.type==="PodScheduled"&&X.status==="False"&&X.reason==="Unschedulable")})}function eZ$($,Z){let X=0,Q=!0,Y=null,G=async()=>{try{let J=await j3($,{method:"GET",path:`/api/v1/namespaces/${encodeURIComponent(Z)}/pods?fieldSelector=status.phase%3DPending`});if(!J.ok)return sZ$;let W=await J.json();return!GX4(W)}catch{return sZ$}};return async()=>{if(Date.now()-X<YX4)return Q;return Y??=G().finally(()=>{Y=null}),Q=await Y,X=Date.now(),Q}}var YX4=3000,sZ$=!0;var $7$=B(()=>{oi()});var IU0=B(()=>{$6();Bl0()});async function MU0($){try{let Z=await fetch(`${$}/health`,{signal:AbortSignal.timeout(JX4)});if(!Z.ok)return null;let X=await Z.json();if(typeof X==="object"&&X!==null&&typeof X.bootId==="string"&&typeof X.ready==="boolean"&&X.setup&&typeof X.setup.running==="boolean"&&typeof X.setup.done==="boolean")return X;return null}catch{return null}}async function Rm0($){for(let Z=0;Z<Z7$;Z++){if(await MU0($)!==null)return;let X=(Math.random()*2-1)*WX4;await C$(X7$+X)}throw Error(`sandbox daemon at ${$} did not respond on /health within ${Z7$*X7$/1000}s`)}async function BV($,Z,X,Q,Y){return KX4($,Z,"POST",X,Q,Y)}async function KX4($,Z,X,Q,Y,G){let J={...Q};if(Y&&Y.rotateToken!==void 0)J.auth=Y;let W=await fetch(`${$}/_sandbox/config`,{method:X,headers:{"Content-Type":"application/json",Authorization:`Bearer ${Z}`},body:JSON.stringify(J),signal:AbortSignal.timeout(G?.timeoutMs??Tm0)}),K=await W.text();if(!W.ok)throw new qU0(W.status,K);return JSON.parse(K)}async function Q7$($,Z,X){let Q=await fetch(`${$}/_sandbox/setup/${X}`,{method:"POST",headers:{Authorization:`Bearer ${Z}`},signal:AbortSignal.timeout(Tm0)});if(!Q.ok)throw Error(`sandbox daemon /_sandbox/setup/${X} returned ${Q.status}: ${await Q.text()}`)}async function Y7$($,Z,X){let Q=await fetch(`${$}/_sandbox/orgfs-config`,{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${Z}`},body:X,signal:AbortSignal.timeout(Tm0)}),Y=await Q.text();if(!Q.ok)throw Error(`sandbox daemon /_sandbox/orgfs-config returned ${Q.status}: ${Y}`);return JSON.parse(Y)}async function ri($,Z,X,Q){let Y=new Headers(Q.headers);for(let W of HX4)Y.delete(W);Y.set("authorization",`Bearer ${Z}`);let G=Q.method!=="GET"&&Q.method!=="HEAD",J=`${$}${X.startsWith("/")?X:`/${X}`}`;return fetch(J,{method:Q.method,headers:Y,body:G?Q.body:void 0,redirect:"manual",signal:Q.signal,duplex:G?"half":void 0})}var qU0,JX4=500,Tm0=30000,Z7$=25,X7$=200,WX4=50,HX4;var G7$=B(()=>{IU0();qU0=class qU0 extends Error{status;constructor($,Z){super(`sandbox daemon /_sandbox/config returned ${$}: ${Z}`);this.status=$;this.name="ConfigRequestError"}};HX4=["cookie","host","connection","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","accept-encoding","content-length"]});async function*K7$($){let Z=$.now??(()=>Date.now()),X=Z(),Q=$.schedulingTimeoutMs??UX4,Y={pod:{},sandbox:{},events:{hasPulling:!1,hasPulled:!1},startedAt:X},G=[],J=null,W=!1,K=(j)=>{if(W)return;if(J){let z=J;J=null,z(j)}else G.push(j)},H=()=>{if(G.length>0)return Promise.resolve(G.shift());if(W)return Promise.resolve(null);return new Promise((j)=>{J=j})},N=()=>{if(W)return;if(W=!0,J){let j=J;J=null,j(null)}},F=new AbortController,U=()=>{F.abort(),N()};if($.signal)if($.signal.aborted)F.abort(),N();else $.signal.addEventListener("abort",U,{once:!0});let O=Math.max(0,Q-(Z()-X)),w=setTimeout(()=>K("tick"),O+100),D,L=new Promise((j)=>{D=j}),E=Promise.allSettled([OX4($.kc,$.namespace,$.claimName,F.signal,Y,K,Z,D),BX4($.kc,$.namespace,$.claimName,F.signal,Y,K),DX4($.kc,$.namespace,$.claimName,L,F.signal,Y,K,Z)]);try{let j=null,z=-1,A=J7$(Y,Q,Z);if(j=qm0(A),!Im0(A))z=W7$(A);if(yield A,Im0(A))return;while(!W){if(await H()===null)break;let q=J7$(Y,Q,Z);if(Im0(q)){let _=qm0(q);if(_!==j)j=_,yield q;return}let S=W7$(q);if(S<z)continue;let M=qm0(q);if(M!==j)j=M,z=S,yield q}}finally{if(clearTimeout(w),F.abort(),$.signal)$.signal.removeEventListener("abort",U);N(),await E.catch(()=>{})}}function J7$($,Z,X){let{pod:Q,sandbox:Y,events:G,startedAt:J}=$;if(Y.ready)return{kind:"ready"};let W=Q.containerWaitingReason;if(W==="ImagePullBackOff"||W==="ErrImagePull")return{kind:"failed",reason:"image-pull-backoff",message:"Sandbox image failed to download. The cluster may be missing pull credentials or the image tag may not exist."};if(W==="CrashLoopBackOff")return{kind:"failed",reason:"crash-loop-backoff",message:"Sandbox crashed during startup and is now in CrashLoopBackOff. Check pod logs."};if(!Q.scheduled&&G.lastFailedSchedulingAt!==void 0&&X()-J>Z)return{kind:"failed",reason:"scheduling-timeout",message:G.failedSchedulingMessage??`Pod could not be scheduled within ${Math.round(Z/1000)}s.`};if(Q.containerRunning&&!Q.containerReady)return{kind:"warming-daemon",since:J};if(G.hasPulling&&!G.hasPulled)return{kind:"pulling-image",since:J};if(W==="ContainerCreating"||W==="PodInitializing"||Q.scheduled&&!Q.containerRunning)return{kind:"starting-container",since:J};if(Q.scheduledFalseReason==="Unschedulable"||G.lastFailedSchedulingAt!==void 0&&!Q.scheduled)return{kind:"waiting-for-capacity",since:J,message:G.failedSchedulingMessage??Q.scheduledFalseMessage,nodeClaim:G.nominatedNodeClaim};return{kind:"claiming",since:J}}function Im0($){return $.kind==="ready"||$.kind==="failed"}function W7$($){switch($.kind){case"claiming":return 0;case"waiting-for-capacity":return 1;case"pulling-image":return 2;case"starting-container":return 3;case"warming-daemon":return 4;case"ready":case"failed":return 99}}function qm0($){switch($.kind){case"claiming":case"pulling-image":case"starting-container":case"warming-daemon":return $.kind;case"waiting-for-capacity":return`waiting-for-capacity:${$.message??""}:${$.nodeClaim??""}`;case"ready":return"ready";case"failed":return`failed:${$.reason}:${$.message}`}}async function OX4($,Z,X,Q,Y,G,J,W){let K=`/api/v1/namespaces/${encodeURIComponent(Z)}/pods?watch=true&labelSelector=${encodeURIComponent(`${NX4}=${X}`)}`;return kU0({kc:$,path:K,signal:Q,label:`pod/${X}`,onEvent:(H)=>{if(H.type!=="ADDED"&&H.type!=="MODIFIED")return;let N=H.object;if(N.metadata?.name)W(N.metadata.name);wX4(N,Y,J),G("pod")}})}function wX4($,Z,X){let Y=($.status?.conditions??[]).find((J)=>J.type==="PodScheduled");if(Y?.status==="True")Z.pod.scheduled=!0,Z.pod.scheduledFalseReason=void 0,Z.pod.scheduledFalseMessage=void 0;else if(Y?.status==="False")Z.pod.scheduled=!1,Z.pod.scheduledFalseReason=Y.reason,Z.pod.scheduledFalseMessage=Y.message;let G=($.status?.containerStatuses??[]).find((J)=>J.name===FX4);if(G)Z.pod.containerWaitingReason=G.state?.waiting?.reason,Z.pod.containerRunning=!!G.state?.running,Z.pod.containerReady=G.ready===!0}async function BX4($,Z,X,Q,Y,G){let J=`/apis/${B9.CLAIM_API_GROUP}/${B9.CLAIM_API_VERSION}/namespaces/${encodeURIComponent(Z)}/${B9.CLAIM_PLURAL}?watch=true&fieldSelector=${encodeURIComponent(`metadata.name=${X}`)}`;return kU0({kc:$,path:J,signal:Q,label:`sandboxclaim/${X}`,onEvent:(W)=>{if(W.type!=="ADDED"&&W.type!=="MODIFIED")return;let H=W.object.status?.conditions?.find((N)=>N.type==="Ready");if(!H)return;if(H.status==="True")Y.sandbox.ready=!0,Y.sandbox.notReadyReason=void 0,Y.sandbox.notReadyMessage=void 0;else Y.sandbox.ready=!1,Y.sandbox.notReadyReason=H.reason,Y.sandbox.notReadyMessage=H.message;G("sandbox")}})}async function DX4($,Z,X,Q,Y,G,J,W){let K=await Promise.race([Q,new Promise((N)=>{if(Y.aborted){N(X);return}Y.addEventListener("abort",()=>N(X),{once:!0})})]);if(Y.aborted)return;let H=`/api/v1/namespaces/${encodeURIComponent(Z)}/events?watch=true&fieldSelector=${encodeURIComponent(`involvedObject.name=${K},involvedObject.kind=Pod`)}`;return kU0({kc:$,path:H,signal:Y,label:`events/${X}`,onEvent:(N)=>{if(N.type!=="ADDED"&&N.type!=="MODIFIED")return;let F=N.object,U=F.reason;if(!U)return;switch(U){case"Pulling":G.events.hasPulling=!0;break;case"Pulled":G.events.hasPulling=!0,G.events.hasPulled=!0;break;case"FailedScheduling":G.events.lastFailedSchedulingAt=W(),G.events.failedSchedulingMessage=F.message;break;case"Nominated":{let O=F.message?.match(/nodeclaim\/([\w-]+)/);if(O)G.events.nominatedNodeClaim=O[1];break}default:return}J("event")}})}async function H7$($){let{kc:Z,namespace:X,labelSelector:Q,signal:Y,onDelete:G}=$,J=`/apis/${B9.CLAIM_API_GROUP}/${B9.CLAIM_API_VERSION}/namespaces/${encodeURIComponent(X)}/${B9.CLAIM_PLURAL}?watch=true&labelSelector=${encodeURIComponent(Q)}`;return kU0({kc:Z,path:J,signal:Y,label:"sandboxclaim-reaper",onEvent:(W)=>{if(W.type!=="DELETED")return;let K=W.object.metadata?.name;if(K)G(K)}})}async function kU0($){let{kc:Z,path:X,signal:Q,label:Y,onEvent:G}=$,J=0;while(!Q.aborted){try{let K=await j3(Z,{method:"GET",path:X,signal:Q,headers:{accept:"application/json"},stream:!0});if(!K.ok||!K.body){try{await K.body?.cancel()}catch{}if(K.status===401||K.status===403){console.warn(`[lifecycle-watcher] ${Y} stopped: watch denied (${K.status} ${K.statusText}). `+"The kubeconfig in use cannot watch SandboxClaims \u2014 if you are running locally, "+"this provider should not be active (check STUDIO_SANDBOX_PROVIDER / your sandbox preference).");return}throw Error(`watch handshake failed: ${K.status} ${K.statusText}`)}J=0;for await(let H of Am0(K.body)){if(Q.aborted)return;try{G(H)}catch(N){console.warn(`[lifecycle-watcher] ${Y} onEvent threw: ${N instanceof Error?N.message:String(N)}`)}}}catch(K){if(Q.aborted)return;let H=K instanceof Error?K.message:String(K);console.warn(`[lifecycle-watcher] ${Y} watch ended: ${H}`)}if(Q.aborted)return;let W=cZ(5000,250,J,2,0);J+=1,await C$(W,{signal:Q}).catch(()=>{})}}var NX4="studio.decocms.com/sandbox-handle",FX4="sandbox",UX4=300000;var N7$=B(()=>{$6();ni();oi()});import{z as fG}from"zod";function F7$($){if(!$||$.trim()==="")return[];let Z=fG.array(LX4).parse(JSON.parse($)),X=new Set;for(let Q of Z){if(X.has(Q.name))throw Error(`STUDIO_SANDBOX_TENANT_POOLS: duplicate pool name ${Q.name}`);X.add(Q.name)}return Z}function EX4($){try{let[Z,X]=new URL($).pathname.replace(/^\/+/,"").split("/"),Q=X?.replace(/\.git$/,"");return Z&&Q?`${Z}/${Q}`.toLowerCase():null}catch{return null}}function U7$($,Z){let{orgId:X,cloneUrl:Q}=Z;if(Z.cloneOnly===!0)return null;if(!X||!Q)return null;let Y=EX4(Q);if(!Y)return null;return $.find((G)=>G.orgId===X&&G.repo.toLowerCase()===Y)??null}function O7$($,Z,X){return $?.name??(Z?X:"none")}function w7$($,Z,X){let Q=X.replace(/^refs\/heads\//,"");return $.filter((Y)=>Y.repo.toLowerCase()===Z.toLowerCase()&&Y.branch===Q)}function B7$($){return`https://github.com/${$.repo}.git`}var LX4;var Mm0=B(()=>{LX4=fG.object({name:fG.string().regex(/^[a-z0-9]([-a-z0-9]*[a-z0-9])?$/,"pool name must be a DNS label (lowercase alphanumeric and '-')"),orgId:fG.string().min(1),repo:fG.string().regex(/^[^/\s]+\/[^/\s]+$/,"repo must be `owner/name`"),connectionId:fG.string().min(1).optional(),branch:fG.string().min(1).default("main"),workload:fG.object({runtime:fG.enum(["node","bun","deno"]).default("node"),packageManager:fG.enum(["npm","pnpm","yarn","bun","deno"]).optional(),packageManagerPath:fG.string().optional(),devPort:fG.number().int().positive().optional()}).default({runtime:"node"})})});async function D7$($,Z,X){let Q=new Map;for(let Y of $){let G=Z(Y);if(!G)continue;let J=Q.get(G);if(J)J.push(Y);else Q.set(G,[Y])}await Promise.allSettled([...Q.values()].map(async(Y)=>{for(let G of Y)await X(G).catch(()=>{})}))}import{createHash as jX4,randomBytes as zX4,randomUUID as PX4}from"crypto";import*as T7$ from"net";import{PassThrough as AX4}from"stream";function L7$($){if($ instanceof Error)return $.message;if($&&typeof $==="object"){let Z=$;if(Z.error instanceof Error)return Z.error.message;if(typeof Z.message==="string"&&Z.message)return Z.message}return String($)}class fm0{kind=xQ;records=new Map;inflight=new a50;stateStore;previewUrlPattern;kubeConfig;capacityProbe;portForward;namespace;sandboxTemplateName;envName;tokenGenerator;idleTtlMs;metrics;previewGateway;sentinelToken;mintCloneUrl;tenantPools;tenantPoolRefreshMs;poolPods=new Map;dirtyPools=new Set;closed=!1;claimWatchAbort=new AbortController;constructor($={}){this.stateStore=$.stateStore??null,this.previewUrlPattern=$.previewUrlPattern??null,this.kubeConfig=$.kubeConfig??bX4(),this.portForward=new $m0(this.kubeConfig),this.namespace=$.namespace??TX4,this.sandboxTemplateName=$.sandboxTemplateName??RX4,this.envName=cX4($.envName),this.tokenGenerator=$.tokenGenerator??(()=>zX4(IX4).toString("hex")),this.idleTtlMs=$.idleTtlMs??MX4,this.metrics=$.meter?fX4($.meter):null,this.previewGateway=$.previewGateway&&$.previewUrlPattern?{...$.previewGateway}:null;let Z=$.sentinelToken?.trim()??"";if(this.sentinelToken=Z.length>0?Z:null,this.mintCloneUrl=$.mintCloneUrl,this.tenantPools=this.sentinelToken!==null?$.tenantPools??[]:[],this.sentinelToken===null&&($.tenantPools?.length??0)>0)console.warn(`[${q6}] tenant pools configured without a sentinel token \u2014 ignoring them (warm-pool mode is off)`);this.tenantPoolRefreshMs=$.tenantPoolRefreshMs??SX4,this.startClaimReaper(),this.startCredentialRefresher(),this.startTenantPoolReconciler()}startClaimReaper(){let $=["app.kubernetes.io/managed-by=studio","app.kubernetes.io/name=studio-sandbox",...this.envName?[`${yQ.env}=${this.envName}`]:[]].join(",");H7$({kc:this.kubeConfig,namespace:this.namespace,labelSelector:$,signal:this.claimWatchAbort.signal,onDelete:(Z)=>this.invalidateRecord(Z)})}async ensure($,Z={}){let X=uL($);if(X.startsWith("s-"))throw Error(`ensure: projectRef has no slug source: ${$.projectRef}`);return this.inflight.run(X,()=>s50(this.stateStore,$,xQ,(Q)=>this.ensureLocked($,X,Z,Q)))}async delete($){let Z=await this.getRecord($);if(this.records.delete($),Z)this.closeForwarder(Z.daemonForward),this.metrics?.active.add(-1,Cm0(Z.tenant));if(await this.deleteHttpRouteIfManaged($).catch((X)=>{console.warn(`[${q6}] HTTPRoute delete failed for ${$}: ${X instanceof Error?X.message:String(X)}`)}),await cO(this.kubeConfig,this.namespace,$),this.stateStore)if(Z)await this.stateStore.delete(Z.id,xQ);else await this.stateStore.deleteByHandle(xQ,$)}async alive($){return await z3(this.kubeConfig,this.namespace,$)!==void 0}watchClaimLifecycle($,Z){return K7$({kc:this.kubeConfig,namespace:this.namespace,claimName:$,signal:Z})}hasSchedulableCapacity(){return this.capacityProbe??=eZ$(this.kubeConfig,this.namespace),this.capacityProbe()}async getPreviewUrl($){let Z=await this.getRecord($);if(!Z)return null;return this.composePreviewUrl(Z)}async proxyDaemonRequest($,Z,X){let Q=await this.getRecord($);if(!Q&&this.previewUrlPattern&&this.stateStore){let K=await this.stateStore.getByHandle(xQ,$),H=K?.state,N=H?.token;if(K&&N){let U=`http://${H?.adoptedSandboxName??$}.${this.namespace}.svc.cluster.local:${wN}`;try{let O=await ri(U,N,Z,X);if(O.status!==404)return O;try{await O.body?.cancel()}catch{}}catch{}}}if(!Q)Q=await this.resurrectByHandle($);if(!Q)return new Response(JSON.stringify({error:"sandbox not found"}),{status:404,headers:{"content-type":"application/json"}});let Y=Q,G=performance.now(),J=0,W=!(X.body instanceof ReadableStream);try{let K=await ri(Q.daemonUrl,Q.token,Z,X);if(K.status===401&&W){this.invalidateRecord($);let H=await this.getRecord($).catch(()=>null)??await this.resurrectByHandle($).catch(()=>null);if(H)Y=H,K=await ri(H.daemonUrl,H.token,Z,X)}return J=K.status,K}catch(K){if(!W)throw K;this.invalidateRecord($);let H=await this.resurrectByHandle($)??await this.getRecord($).catch(()=>null);if(!H)throw K;Y=H;let N=await ri(H.daemonUrl,H.token,Z,X);return J=N.status,N}finally{this.recordProxyDuration("daemon",J,Y,performance.now()-G)}}async adoptLiveClaim($,Z){if(this.records.has(Z))return!0;let X=await z3(this.kubeConfig,this.namespace,Z).catch(()=>{return});if(!X||X.metadata?.deletionTimestamp)return!1;return await this.inflight.run(Z,async()=>{let Y=this.records.get(Z);if(Y)return this.toSandbox(Y);let G=await this.adopt($,Z,X);if(!G)throw Error(`cannot adopt live claim ${Z}`);return s50(this.stateStore,$,xQ,(J)=>this.finish(G,J,!0,!0,"adopt"))}).catch(()=>null)!=null}async resolvePreviewUpstreamUrl($){if(this.previewUrlPattern)return`http://${await this.resolveServiceNameForHandle($)}.${this.namespace}.svc.cluster.local:${wN}`;let Z=await this.getRecord($);if(Z)return Z.daemonUrl;let X=await this.resurrectByHandle($);return X?X.daemonUrl:null}async resolveServiceNameForHandle($){let Z=this.records.get($);if(Z)return Z.adoptedSandboxName;if(this.stateStore){let Q=(await this.stateStore.getByHandle(xQ,$).catch(()=>null))?.state?.adoptedSandboxName;if(Q)return Q}return $}async proxyPreviewRequest($,Z){let X=performance.now(),Q=this.records.get($)??null,Y=0;try{let G=await this.resolvePreviewUpstreamUrl($);if(!G){Y=404;let w=Sm0(404,{error:"sandbox not found"});return w.headers.set(LV,"1"),w}let J=new URL(Z.url);if((J.pathname==="/_sandbox"||J.pathname.startsWith("/_sandbox/")||J.pathname==="/_decopilot_vm"||J.pathname.startsWith("/_decopilot_vm/"))&&Z.method!=="GET")return Y=404,Sm0(404,{error:"not found"});let K=(w)=>`${w}${J.pathname}${J.search}`,H=new Headers(Z.headers);for(let w of _X4)H.delete(w);let N=Z.method!=="GET"&&Z.method!=="HEAD",F={method:Z.method,headers:H,body:N?Z.body:void 0,redirect:"manual",signal:Z.signal,duplex:N?"half":void 0},U;try{U=await fetch(K(G),F)}catch(w){let D=`${G}${J.pathname}`;if(console.warn(`[${q6}] preview fetch to ${D} failed: ${w instanceof Error?w.message:String(w)}`),Z.method==="GET"||Z.method==="HEAD"){if(this.invalidateRecord($),await this.resurrectByHandle($).catch(()=>null)){let j=await this.resolvePreviewUpstreamUrl($);if(j)try{U=await fetch(K(j),F);let z=new Headers;for(let[A,P]of U.headers.entries())if(!z7$.includes(A.toLowerCase()))z.set(A,P);return Y=U.status,new Response(U.body,{status:U.status,statusText:U.statusText,headers:z})}catch(z){console.warn(`[${q6}] preview fetch retry to ${D} failed: ${z instanceof Error?z.message:String(z)}`)}}}else this.invalidateRecord($);Y=502;let L=Sm0(502,{error:"sandbox daemon unreachable"});return L.headers.set(LV,"1"),L}let O=new Headers;for(let[w,D]of U.headers.entries())if(!z7$.includes(w.toLowerCase()))O.set(w,D);return Y=U.status,new Response(U.body,{status:U.status,statusText:U.statusText,headers:O})}finally{this.recordProxyDuration("preview",Y,Q,performance.now()-X,$)}}async ensureLocked($,Z,X,Q){if(X.image)console.warn(`[${q6}] opts.image ignored (template ${this.sandboxTemplateName} pins image): got ${X.image}`);if(Q){let J=await Q.get($,xQ);if(J){let W=await this.rehydrate($,Z,J);if(W)return await this.refreshDaemonGitCredential(W,X),this.finish(W,Q,!1,!0,"resume");await Q.delete($,xQ)}}let Y=await z3(this.kubeConfig,this.namespace,Z).catch(()=>{return});if(Y)if(Y.metadata?.deletionTimestamp)await zU0(this.kubeConfig,this.namespace,Z).catch((J)=>{console.warn(`[${q6}] wait for terminating claim ${Z} failed: ${J instanceof Error?J.message:String(J)}`)});else{let J=await this.adopt($,Z,Y).catch((W)=>{return console.warn(`[${q6}] adopt ${Z} failed, recreating: ${W instanceof Error?W.message:String(W)}`),null});if(J)return await this.refreshDaemonGitCredential(J,X),this.finish(J,Q,!0,!0,"adopt");await cO(this.kubeConfig,this.namespace,Z).catch(()=>{}),await zU0(this.kubeConfig,this.namespace,Z).catch((W)=>{console.warn(`[${q6}] wait for deleted claim ${Z} failed: ${W instanceof Error?W.message:String(W)}`)})}let G=await this.provision($,Z,X);return this.finish(G,Q,!0,!1,"fresh")}async finish($,Z,X,Q,Y){let G=this.records.get($.handle),J=G!==void 0;if(G&&G.daemonForward!==$.daemonForward)this.closeForwarder(G.daemonForward);if(this.records.set($.handle,$),X)await this.persist(Z,$);if(Q)await PU0(this.kubeConfig,this.namespace,$.handle,this.computeShutdownTime()).catch((W)=>console.warn(`[${q6}] TTL refresh failed for ${$.handle}: ${W instanceof Error?W.message:String(W)}`));if(this.metrics){let W=Cm0($.tenant);if(this.metrics.ensureOutcome.add(1,{...W,outcome:Y}),!J)this.metrics.active.add(1,W)}return this.toSandbox($)}buildEnvMap($,Z){let X={},Q=[];for(let[Y,G]of Object.entries($.env??{}))if(qX4.has(Y))Q.push(Y);else X[Y]=G;if(Q.length>0)console.warn(`[${q6}] opts.env keys overlap reserved bootstrap names and were dropped: ${Q.join(",")}`);return{...X,DAEMON_TOKEN:Z.token,DAEMON_BOOT_ID:Z.daemonBootId,APP_ROOT:Z.workdir,PROXY_PORT:String(wN)}}buildClaim($,Z,X){let Q=this.sentinelToken!==null,Y=U7$(this.tenantPools,{orgId:Z.tenant?.orgId,cloneUrl:Z.repo?.cloneUrl,cloneOnly:Z.cloneOnly}),G=Q?[]:Object.entries(this.buildEnvMap(Z,X)).sort(([K],[H])=>K<H?-1:K>H?1:0).map(([K,H])=>({name:K,value:H})),J=mX4(Z),W=Object.keys(J).length>0;return{apiVersion:`${B9.CLAIM_API_GROUP}/${B9.CLAIM_API_VERSION}`,kind:"SandboxClaim",metadata:{name:$,namespace:this.namespace,labels:{"app.kubernetes.io/name":"studio-sandbox","app.kubernetes.io/managed-by":"studio",...this.envName?{[yQ.env]:this.envName}:{},...Vm0(Z.tenant)},...W?{annotations:J}:{}},spec:{sandboxTemplateRef:{name:this.sandboxTemplateName},additionalPodMetadata:{labels:Vm0(Z.tenant,{[yQ.role]:"claimed",[yQ.sandboxHandle]:$,...this.envName?{[yQ.env]:this.envName}:{}}),...W?{annotations:J}:{}},env:G,warmpool:O7$(Y,Q,this.sandboxTemplateName),lifecycle:{shutdownPolicy:"Delete",shutdownTime:this.computeShutdownTime()}}}}async provision($,Z,X){let Q=this.tokenGenerator(),Y=PX4(),G=km0,J=this.buildClaim(Z,X,{token:Q,daemonBootId:Y,workdir:G});try{await pi(this.kubeConfig,this.namespace,J)}catch(U){if(U instanceof ii)await zU0(this.kubeConfig,this.namespace,Z),await pi(this.kubeConfig,this.namespace,J);else throw U}let W;try{W=await dZ$(this.kubeConfig,this.namespace,Z),await RU0(this.kubeConfig,this.namespace,W)}catch(U){throw await cO(this.kubeConfig,this.namespace,Z).catch(()=>{}),U}try{await this.ensureServicePortForAdoptedSandbox(W),await this.ensureHttpRouteForHandle(Z,W,X.tenant??null)}catch(U){throw await cO(this.kubeConfig,this.namespace,Z).catch(()=>{}),U}let K=await this.openForwarder(W,wN,Z),H=`http://127.0.0.1:${K.localPort}`,N=this.workloadConfigPayload(X),F=Y;try{if(await Rm0(H),this.sentinelToken!==null){let U=await MU0(H);if(U)F=U.bootId;await BV(H,this.sentinelToken,N??{},{rotateToken:Q})}else if(N)await BV(H,Q,N);await this.relayOrgFsConfig(H,Q,X.orgFsConfigJson)}catch(U){throw this.closeForwarder(K),await this.deleteHttpRouteIfManaged(Z).catch(()=>{}),await cO(this.kubeConfig,this.namespace,Z).catch(()=>{}),U}return{id:$,handle:Z,adoptedSandboxName:W,token:Q,workdir:G,daemonUrl:H,daemonForward:K,workload:X.workload??null,daemonBootId:F,tenant:X.tenant??null,ensureOpts:tX4(X)}}workloadConfigPayload($){return $90({runtime:$?.workload?.runtime??"node",packageManager:$?.workload?.packageManager?{name:$.workload.packageManager,...$.workload.packageManagerPath?{path:$.workload.packageManagerPath}:{}}:null,repo:$?.repo??null,port:$?.workload?.devPort??E7$,tenant:$?.tenant??void 0,...$?{cloneOnly:$.cloneOnly===!0}:{}})}async relayOrgFsConfig($,Z,X){if(!X)return;await Y7$($,Z,X).catch((Q)=>console.warn("[org-fs] sidecar config relay failed",Q))}async refreshDaemonGitCredential($,Z){let X=Dl0(Z);if(!X)return;try{await BV($.daemonUrl,$.token,X)}catch(Q){console.warn(`[${q6}] git credential refresh failed for ${$.handle}: ${Q instanceof Error?Q.message:String(Q)}`)}}async withFreshCloneUrl($,Z){if(!this.mintCloneUrl)return $;try{let X=await this.mintCloneUrl($,Z!==void 0?{bufferMs:Z}:void 0);return X?{...$,cloneUrl:X}:$}catch(X){return console.warn(`[${q6}] clone credential re-mint failed: ${X instanceof Error?X.message:String(X)}`),$}}startCredentialRefresher(){if(!this.mintCloneUrl)return;let{signal:$}=this.claimWatchAbort;(async()=>{while(!$.aborted){if(await C$(VX4,{signal:$}).catch(()=>{}),$.aborted)break;try{await this.refreshAllGitCredentials()}catch(Z){console.warn(`[${q6}] periodic credential refresh failed: ${Z instanceof Error?Z.message:String(Z)}`)}}})()}startTenantPoolReconciler(){if(this.tenantPools.length===0)return;let{signal:$}=this.claimWatchAbort;(async()=>{while(!$.aborted){try{await this.reconcileTenantPools()}catch(Z){console.warn(`[${q6}] tenant pool reconcile failed: ${Z instanceof Error?Z.message:String(Z)}`)}await C$(kX4,{signal:$}).catch(()=>{})}})()}markTenantPoolsDirty($,Z){let X=w7$(this.tenantPools,$,Z);for(let Q of X)this.dirtyPools.add(Q.name);return X.map((Q)=>Q.name)}async reconcileTenantPools(){for(let $ of this.tenantPools){let Z=await mZ$(this.kubeConfig,this.namespace,$.name);if(Z===null){console.warn(`[${q6}] tenant pool ${$.name}: no SandboxWarmPool (or no selector yet) in ${this.namespace}`);continue}let X=this.dirtyPools.delete($.name),Q=Z.filter((Y)=>!Y.labels[yQ.sandboxHandle]);for(let[Y]of this.poolPods)if(!Z.some((G)=>G.uid===Y))this.poolPods.delete(Y);for(let Y of Q){if(this.claimWatchAbort.signal.aborted)return;await this.warmPoolPod($,Y,X)}this.recordPoolDepth($,Z,Q)}}recordPoolDepth($,Z,X){let Q=this.metrics?.poolPods;if(!Q)return;let Y=0,G=0;for(let W of X){let K=this.poolPods.get(W.uid);if(!K)continue;if(K.failures>=SU0)G++;else if(K.lastConfigAt>0)Y++}let J={pool:$.name,org:$.orgId};Q.record(Y,{...J,state:"ready"}),Q.record(Z.length-X.length,{...J,state:"bound"}),Q.record(X.length-Y-G,{...J,state:"pending"}),Q.record(G,{...J,state:"failed"})}async warmPoolPod($,Z,X){let Q=this.poolPods.get(Z.uid);if(Q&&Q.failures>=SU0){if(Date.now()-Q.lastFailureAt<j7$)return;this.poolPods.set(Z.uid,{...Q,failures:0})}let Y=X||Q!==void 0&&Date.now()-Q.lastConfigAt>=this.tenantPoolRefreshMs;if(Q&&!Y)return;let G={cloneUrl:B7$($),connectionId:$.connectionId,branch:$.branch,userName:"",userEmail:""},J=await this.withFreshCloneUrl(G);if($.connectionId&&J.cloneUrl===G.cloneUrl){this.recordPoolFailure(Z,$,"clone credential mint failed");return}let W=await this.openForwarder(Z.name,wN,Z.name).catch(()=>null);if(!W){this.recordPoolFailure(Z,$,"port-forward failed");return}let K=`http://127.0.0.1:${W.localPort}`;try{await Rm0(K);let H=this.sentinelToken;if(!H)return;if(!await this.isPoolPodUnbound(Z))return;let N=$90({runtime:$.workload.runtime,packageManager:$.workload.packageManager?{name:$.workload.packageManager,...$.workload.packageManagerPath?{path:$.workload.packageManagerPath}:{}}:null,repo:J,port:$.workload.devPort??E7$})??{},{transition:F}=await BV(K,H,N);if(Y&&F!=="bootstrap"&&await this.isPoolPodUnbound(Z))await Q7$(K,H,"clone");this.poolPods.set(Z.uid,{lastConfigAt:Date.now(),lastFailureAt:0,failures:0}),console.log(`[${q6}] tenant pool ${$.name}: warmed ${Z.name} (${F})`)}catch(H){this.recordPoolFailure(Z,$,H instanceof Error?H.message:String(H))}finally{this.closeForwarder(W)}}isPoolPodUnbound($){return iZ$(this.kubeConfig,this.namespace,$.name,yQ.sandboxHandle)}recordPoolFailure($,Z,X){let Q=this.poolPods.get($.uid),Y=(Q?.failures??0)+1;this.poolPods.set($.uid,{lastConfigAt:Q?.lastConfigAt??0,lastFailureAt:Date.now(),failures:Y});let G=Y>=SU0?` \u2014 backing off ${j7$/60000}min`:"";console.warn(`[${q6}] tenant pool ${Z.name}: warming ${$.name} failed (${Y}/${SU0})${G}: ${X}`)}async refreshAllGitCredentials(){await D7$(this.records.values(),($)=>$.ensureOpts?.repo?.connectionId,async($)=>{if(this.claimWatchAbort.signal.aborted)return;let Z=$.ensureOpts?.repo;if(!Z)return;let X=await this.withFreshCloneUrl(Z,CX4);await this.refreshDaemonGitCredential($,{...$.ensureOpts,repo:X}),$.ensureOpts={...$.ensureOpts,repo:X}})}async rebootstrapDaemon($,Z,X){if(this.sentinelToken===null)return!1;let Q=this.workloadConfigPayload(X)??{};try{return await BV($,this.sentinelToken,Q,{rotateToken:Z}),await this.relayOrgFsConfig($,Z,X?.orgFsConfigJson),!0}catch(Y){if(Y instanceof qU0&&Y.status===401)try{return await BV($,Z,Q,{rotateToken:Z}),await this.relayOrgFsConfig($,Z,X?.orgFsConfigJson),!0}catch(G){return console.warn(`[${q6}] re-bootstrap retry with claim token failed: ${G instanceof Error?G.message:String(G)}`),!1}return console.warn(`[${q6}] re-bootstrap failed: ${Y instanceof Error?Y.message:String(Y)}`),!1}}async ensureServicePortForAdoptedSandbox($){if(!this.previewGateway||!this.previewUrlPattern)return;await aZ$(this.kubeConfig,this.namespace,$,{name:"daemon",port:wN,targetPort:wN})}async ensureHttpRouteForHandle($,Z,X){if(!this.previewGateway||!this.previewUrlPattern)return;let Q=oX4(this.previewUrlPattern,$);if(!Q)throw new _9(`Unable to derive preview hostname for ${$} from pattern: ${this.previewUrlPattern}`);let Y={apiVersion:`${ti.API_GROUP}/${ti.API_VERSION}`,kind:"HTTPRoute",metadata:{name:$,namespace:this.namespace,labels:Vm0(X??void 0,{[yQ.role]:"claimed",[yQ.sandboxHandle]:$,"app.kubernetes.io/name":"studio-sandbox","app.kubernetes.io/managed-by":"studio",...this.envName?{[yQ.env]:this.envName}:{}})},spec:{parentRefs:[{kind:"Gateway",group:"gateway.networking.k8s.io",name:this.previewGateway.name,namespace:this.previewGateway.namespace}],hostnames:[Q],rules:[{backendRefs:[{group:"",kind:"Service",name:Z,port:wN}]}]}};await AU0(this.kubeConfig,this.namespace,Y)}async deleteHttpRouteIfManaged($){if(!this.previewGateway)return;await TU0(this.kubeConfig,this.namespace,$)}async rehydrate($,Z,X){let Q=X.state;if(!Q.adoptedSandboxName&&!Q.podName||!Q.token)return null;let Y=await z3(this.kubeConfig,this.namespace,Z).catch(()=>{return});if(!Y||!P7$(Y))return null;let G=Y.status?.sandbox?.name??Q.adoptedSandboxName??Q.podName??Z,J=await this.openAndProbeDaemon(G,Z);if(!J)return null;if(Q.daemonBootId&&Q.daemonBootId!==J.bootId){if(this.sentinelToken!==null){let W=Q.ensureOpts?.repo?{...Q.ensureOpts,repo:await this.withFreshCloneUrl(Q.ensureOpts.repo)}:Q.ensureOpts??null;if(!await this.rebootstrapDaemon(J.daemonUrl,Q.token,W))return this.closeForwarder(J.daemonForward),null}else console.warn(`[${q6}] daemon restart detected (handle=${Z}): stored bootId=${Q.daemonBootId} live bootId=${J.bootId}`);await this.stateStore?.put($,xQ,{handle:Z,state:{...Q,daemonBootId:J.bootId}}).catch((W)=>console.warn(`[${q6}] bootId persist failed for ${Z}: ${W instanceof Error?W.message:String(W)}`))}return{id:$,handle:Z,adoptedSandboxName:G,token:Q.token,workdir:Q.workdir??km0,daemonUrl:J.daemonUrl,daemonForward:J.daemonForward,workload:Q.workload??null,daemonBootId:J.bootId,tenant:Q.tenant??null,ensureOpts:Q.ensureOpts??null}}async adopt($,Z,X){if(!P7$(X))return null;let Q=X.status?.sandbox?.name??Z;if(this.sentinelToken!==null)return null;let Y=xX4(X);if(!Y)return null;let G=await this.openAndProbeDaemon(Q,Z);if(!G)return null;let J=iX4(X);if(this.previewGateway)await this.ensureServicePortForAdoptedSandbox(Q).catch((W)=>{console.warn(`[${q6}] Service port backfill failed for ${Z}: ${W instanceof Error?W.message:String(W)}`)}),await this.ensureHttpRouteForHandle(Z,Q,J).catch((W)=>{console.warn(`[${q6}] HTTPRoute backfill failed for ${Z}: ${W instanceof Error?W.message:String(W)}`)});return{id:$,handle:Z,adoptedSandboxName:Q,token:Y,workdir:km0,daemonUrl:G.daemonUrl,daemonForward:G.daemonForward,workload:null,daemonBootId:G.bootId,tenant:J,ensureOpts:null}}async openAndProbeDaemon($,Z){let X=await this.openForwarder($,wN,Z).catch(()=>null);if(!X)return null;let Q=`http://127.0.0.1:${X.localPort}`,Y=await MU0(Q);if(!Y)return this.closeForwarder(X),null;return{daemonForward:X,daemonUrl:Q,bootId:Y.bootId}}async getRecord($){let Z=this.records.get($);if(Z)return Z;if(!this.stateStore)return null;let X=await this.stateStore.getByHandle(xQ,$);if(!X)return null;let Q=await this.rehydrate(X.id,$,X);if(Q)this.records.set($,Q);return Q}async resurrectByHandle($){if(!this.stateStore)return null;let Z=await this.stateStore.getByHandle(xQ,$);if(!Z)return null;let X=Z.state.ensureOpts;if(!X)return null;let Q=X.repo?{...X,repo:await this.withFreshCloneUrl(X.repo)}:X;if(uL(Z.id)!==$)return null;return await this.ensure(Z.id,Q),this.records.get($)??null}invalidateRecord($){let Z=this.records.get($);if(!Z)return;this.records.delete($),this.closeForwarder(Z.daemonForward)}recordProxyDuration($,Z,X,Q,Y){if(!this.metrics)return;this.metrics.proxyDurationMs.record(Q,{...Cm0(X?.tenant??null),source:$,sandbox_handle:X?.handle??Y??"",status_code:Z||0})}composePreviewUrl($){if(this.previewUrlPattern)return e50(this.previewUrlPattern,$.handle);return`http://127.0.0.1:${$.daemonForward.localPort}/`}toSandbox($){return{handle:$.handle,workdir:$.workdir,previewUrl:this.composePreviewUrl($)}}async persist($,Z){if(!$)return;let X={adoptedSandboxName:Z.adoptedSandboxName,token:Z.token,workdir:Z.workdir,workload:Z.workload,daemonBootId:Z.daemonBootId,tenant:Z.tenant,...Z.ensureOpts?{ensureOpts:Z.ensureOpts}:{}};await $.put(Z.id,xQ,{handle:Z.handle,state:X})}computeShutdownTime(){return new Date(Date.now()+this.idleTtlMs).toISOString()}async releaseAfter($,Z){let X=await z3(this.kubeConfig,this.namespace,$);if(!X)return;let Q=nX4(X.spec?.lifecycle?.shutdownTime,new Date(Date.now()+Z));if(!Q)return;await PU0(this.kubeConfig,this.namespace,$,Q).catch((Y)=>console.warn(`[${q6}] release failed for ${$}: ${Y instanceof Error?Y.message:String(Y)}`))}async renewTtl($){let Z=await z3(this.kubeConfig,this.namespace,$);if(!Z)return;let X=pX4(Z.spec?.lifecycle?.shutdownTime,new Date(Date.now()+this.idleTtlMs));if(!X)return;await PU0(this.kubeConfig,this.namespace,$,X).catch((Q)=>console.warn(`[${q6}] TTL renew failed for ${$}: ${Q instanceof Error?Q.message:String(Q)}`))}openForwarder($,Z,X=$){let Q=yX4(X,Z);return new Promise((Y,G)=>{let J=(W,K)=>{let H=T7$.createServer((N)=>this.handleForwardedConnection(N,$,Z,X));H.once("error",(N)=>{if(N.code==="EADDRINUSE"&&K<vX4){try{H.close()}catch{}let F=_m0+(W-_m0+1)%R7$;J(F,K+1);return}G(N)}),H.listen(W,"127.0.0.1",()=>{let N=H.address();if(!N||typeof N==="string"){H.close(),G(Error("port-forward listener failed to bind"));return}Y({server:H,localPort:N.port})})};J(Q,0)})}handleForwardedConnection($,Z,X,Q){let Y=new AX4,G=null,J=!1,W=()=>{if(J)return;if(J=!0,Y.destroy(),G)try{G.close()}catch{}if(!$.destroyed)$.destroy()};$.pipe(Y),$.on("error",W),$.on("close",W),this.portForward.portForward(this.namespace,Z,[X],$,null,Y).then((K)=>{let H=typeof K==="function"?K():K;if(!H){W();return}if(G=H,G.on("close",W),G.on("error",(N)=>{console.warn(`[${q6}] port-forward to ${Z}:${X} dropped mid-connection: ${L7$(N)}`,JSON.stringify(vm0(N))),this.invalidateRecord(Q),W()}),J)try{G.close()}catch{}}).catch((K)=>{console.warn(`[${q6}] port-forward to ${Z}:${X} failed: ${L7$(K)}`,JSON.stringify(vm0(K))),this.invalidateRecord(Q),W()})}closeForwarder($){$.server.close((Z)=>{if(Z)console.warn(`[${q6}] port-forward close on :${$.localPort} errored: ${Z instanceof Error?Z.message:String(Z)}`)})}close(){if(this.closed)return;this.closed=!0,this.claimWatchAbort.abort();for(let $ of this.records.values())this.closeForwarder($.daemonForward);this.records.clear()}}function fX4($){return{active:$.createUpDownCounter("studio.sandbox.active",{description:"Active sandbox count, by runner kind, owning org, and daemon impl. Cross-checks the cAdvisor-derived count from the cluster \u2014 divergence between the two indicates orphaned claims (studio deleted but K8s didn't reap) or unattributed pods.",unit:"{sandbox}"}),ensureOutcome:$.createCounter("studio.sandbox.ensure.outcome",{description:"Outcome of each ensure() call: fresh provision, resume from state-store after restart, or adopt of a cluster-side claim studio didn't know about. Cold-start ratio is the primary input for warm-pool sizing.",unit:"{call}"}),proxyDurationMs:$.createHistogram("studio.sandbox.proxy.duration_ms",{description:"Wall-clock latency of studio-mediated requests to the sandbox daemon: tool exec proxies (source=daemon) and preview iframe traffic (source=preview).",unit:"ms"}),poolPods:$.createGauge("studio.sandbox.pool.pods",{description:"Tenant warm pool depth by pool and state: ready (warmed and unbound \u2014 what a claim can actually bind instantly), bound (serving a user), pending (unbound, not yet warmed), failed (gave up after repeated bootstrap failures). Alert on sustained ready=0: a pool that is always empty is doing nothing while costing N pods.",unit:"{pod}"})}}function vm0($){let Z=[],X=$;for(let Q=0;Q<5&&X instanceof Error;Q++){let Y=X;if(Z.push({name:Y.name,message:Y.message,...Y.code!==void 0?{code:Y.code}:{},...Y.errno!==void 0?{errno:Y.errno}:{}}),Y.cause===X)break;X=Y.cause}if(X!==void 0&&!(X instanceof Error)&&X!==null){let Q=X,Y=Q.error instanceof Error?vm0(Q.error).chain:void 0;Z.push({nonError:String(X),...typeof Q.type==="string"?{type:Q.type}:{},...typeof Q.message==="string"?{message:Q.message}:{},...Q.code!==void 0?{code:Q.code}:{},...typeof Q.reason==="string"?{reason:Q.reason}:{},...Y?{error:Y}:{},...Y===void 0&&Q.error!==void 0?{rawError:String(Q.error)}:{},keys:Object.keys(Q)})}return{chain:Z}}function bX4(){let $=new qx;return $.loadFromDefault(),$}function P7$($){return Boolean($.status?.conditions?.some((Z)=>Z.type==="Ready"&&Z.status==="True"))}function xX4($){let Z=$.spec?.env;if(!Z)return null;for(let X of Z)if(X.name==="DAEMON_TOKEN"&&X.value)return X.value;return null}function yX4($,Z){let X=jX4("sha256").update(`${$}:${Z}`).digest();return _m0+X.readUInt32BE(0)%R7$}function Sm0($,Z){return new Response(JSON.stringify(Z),{status:$,headers:{"content-type":"application/json","access-control-allow-origin":"*"}})}function A7$($){let Z=$.slice(0,hX4);return gX4.test(Z)?Z:""}function cX4($){if($===void 0)return null;let Z=$.trim();if(Z==="")return null;if(!uX4.test(Z))throw Error(`AgentSandboxProvider: envName=${JSON.stringify(Z)} is not a valid DNS-label-safe environment name (lowercase alphanumeric or '-', starts with a letter, ends alphanumeric, \u226432 chars). Studio sets this from STUDIO_ENV; check the studio chart's configMap.`);return Z}function Vm0($,Z={}){let X={...Z};if($){let Q=A7$($.orgId),Y=A7$($.userId);if(Q)X[yQ.orgId]=Q;if(Y)X[yQ.userId]=Y}return X}function DV($){let Z="";for(let X of $){let Q=X.codePointAt(0)??0;Z+=Q<32||Q===127?" ":X}return Z.slice(0,lX4)}function dX4($){try{let Z=new URL($);return Z.username="",Z.password="",Z.toString()}catch{return""}}function mX4($){let Z={},X=$.tenant;if(X?.orgSlug)Z[P3.orgSlug]=DV(X.orgSlug);if(X?.orgName)Z[P3.orgName]=DV(X.orgName);if(X?.userEmail)Z[P3.userEmail]=DV(X.userEmail);if(X?.userName)Z[P3.userName]=DV(X.userName);let Q=$.repo;if(Q){if(Q.displayName)Z[P3.gitRepo]=DV(Q.displayName);let Y=dX4(Q.cloneUrl);if(Y)Z[P3.gitRepoUrl]=DV(Y);let G=$.branch??Q.branch;if(G)Z[P3.gitBranch]=DV(G)}return Z}function iX4($){let Z=$.metadata?.labels;if(!Z)return null;let X=Z[yQ.orgId],Q=Z[yQ.userId];if(!X||!Q)return null;let Y=$.metadata?.annotations??{};return{orgId:X,userId:Q,orgSlug:Y[P3.orgSlug],orgName:Y[P3.orgName],userEmail:Y[P3.userEmail],userName:Y[P3.userName]}}function nX4($,Z){if($){let X=new Date($).getTime();if(Number.isFinite(X)&&X<=Z.getTime())return null}return Z.toISOString()}function pX4($,Z){if($){let X=new Date($).getTime();if(Number.isFinite(X)&&X>=Z.getTime())return null}return Z.toISOString()}function Cm0($){return{org_id:$?.orgId??"",user_id:$?.userId??"",runner_kind:xQ}}function tX4($){let Z={};if($.branch)Z.branch=$.branch;if($.repo)Z.repo=$.repo;if($.workload)Z.workload=$.workload;if($.env&&Object.keys($.env).length>0)Z.env=$.env;if($.tenant)Z.tenant=$.tenant;if($.cloneOnly)Z.cloneOnly=!0;if($.orgFsConfigJson)Z.orgFsConfigJson=$.orgFsConfigJson;return Object.keys(Z).length>0?Z:null}function oX4($,Z){try{return new URL(e50($,Z)).hostname||null}catch{return null}}var xQ="agent-sandbox",q6="AgentSandboxProvider",LV="x-sandbox-preview-not-ready",TX4="agent-sandbox-system",RX4="studio-sandbox",wN=9000,E7$=3000,km0="/app",IX4=32,qX4,MX4=900000,kX4=60000,SX4=1800000,SU0=3,j7$=1800000,VX4=900000,CX4=1800000,_X4,z7$,_m0=40000,R7$=1e4,vX4=256,yQ,P3,gX4,hX4=63,uX4,lX4=253;var I7$=B(()=>{$6();$7$();Dm0();G7$();Ll0();oi();ni();N7$();Mm0();qX4=new Set(["DAEMON_TOKEN","DAEMON_BOOT_ID","APP_ROOT","PROXY_PORT"]),_X4=["cookie","host","connection","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","accept-encoding","content-length","upgrade"],z7$=["connection","keep-alive","transfer-encoding","content-encoding","content-length"];yQ={role:"studio.decocms.com/role",sandboxHandle:"studio.decocms.com/sandbox-handle",orgId:"studio.decocms.com/org-id",userId:"studio.decocms.com/user-id",env:"studio.decocms.com/env"},P3={orgSlug:"studio.decocms.com/org-slug",orgName:"studio.decocms.com/org-name",userEmail:"studio.decocms.com/user-email",userName:"studio.decocms.com/user-name",gitRepo:"studio.decocms.com/git-repo",gitRepoUrl:"studio.decocms.com/git-repo-url",gitBranch:"studio.decocms.com/git-branch"},gX4=/^([A-Za-z0-9]([-A-Za-z0-9_.]*[A-Za-z0-9])?)?$/;uX4=/^[a-z]([a-z0-9-]{0,30}[a-z0-9])?$/});var q7$={};N4(q7$,{waitForSandboxReady:()=>RU0,parseTenantPools:()=>F7$,getSandboxClaim:()=>z3,getHttpRoute:()=>oZ$,deleteSandboxClaim:()=>cO,deleteHttpRoute:()=>TU0,createSandboxClaim:()=>pi,applyHttpRoute:()=>AU0,SandboxTimeoutError:()=>wV,SandboxError:()=>_9,PREVIEW_NOT_READY_HEADER:()=>LV,KubeConfig:()=>qx,K8S_CONSTANTS:()=>B9,HTTPROUTE_CONSTANTS:()=>ti,AgentSandboxProvider:()=>fm0});var bm0=B(()=>{Dm0();ni();oi();I7$();Mm0()});var _7$={};N4(_7$,{subscribeLifecycle:()=>hm0,getSandboxProviderByKind:()=>ym0,getOrInitSharedRunner:()=>gm0,__resetSharedLifecyclesForTesting:()=>WQ4});function V7$($,Z){let X=M7$[$];if(X)return Promise.resolve(X);let Q=xm0[$];if(Q)return Q;let Y=Z().then((G)=>{return M7$[$]=G,G}).finally(()=>{delete xm0[$]});return xm0[$]=Y,Y}function sX4(){let $=process.env.STUDIO_SANDBOX_PREVIEW_URL_PATTERN;return $&&$.trim()!==""?$:void 0}function eX4(){let $=process.env.STUDIO_SANDBOX_TEMPLATE_NAME;return $&&$.trim()!==""?$:void 0}function $Q4(){let $=process.env.STUDIO_ENV;return $&&$.trim()!==""?$:void 0}function ZQ4(){let $=process.env.STUDIO_SANDBOX_SENTINEL_TOKEN;return $&&$.trim()!==""?$:void 0}function XQ4(){let $=process.env.STUDIO_SANDBOX_PREVIEW_GATEWAY_NAME?.trim(),Z=process.env.STUDIO_SANDBOX_PREVIEW_GATEWAY_NAMESPACE?.trim();if(!$&&!Z)return;if(!$||!Z)throw Error("STUDIO_SANDBOX_PREVIEW_GATEWAY_NAME and STUDIO_SANDBOX_PREVIEW_GATEWAY_NAMESPACE must both be set, or both unset. Half-configured per-claim HTTPRoute routing would silently fail to attach.");return{name:$,namespace:Z}}async function C7$($,Z){let X=new Ii(Z),Q=sX4();switch($){case"agent-sandbox":{let{AgentSandboxProvider:Y,parseTenantPools:G}=await Promise.resolve().then(() => (bm0(),q7$)),J=new qH(y0().encryptionKey);return new Y({stateStore:X,previewUrlPattern:Q,sandboxTemplateName:eX4(),envName:$Q4(),previewGateway:XQ4(),sentinelToken:ZQ4(),tenantPools:G(process.env.STUDIO_SANDBOX_TENANT_POOLS),meter:k$,mintCloneUrl:async(W,K)=>{if(!W.connectionId)return null;let H=L$$(W.cloneUrl);if(!H)return null;let{cloneUrl:N}=await VO(W.connectionId,H.owner,H.name,Z,J,{bufferMs:K?.bufferMs});return N}})}case"user-desktop":throw Error("user-desktop provider cannot be instantiated without a per-run link claim \u2014 call resolveSandboxProvider, which binds the link before constructing the provider.");default:throw Error(`Unknown sandbox provider kind: ${String($)}`)}}function ym0($,Z){return V7$(Z,()=>C7$(Z,$.db))}async function gm0(){let $;try{$=cL()}catch(X){return console.warn("[lifecycle] cannot resolve sandbox runner:",X instanceof Error?X.message:String(X)),null}return await V7$($,()=>C7$($,m8().db))}function hm0($,Z,X){let Q=lO.get(Z);if(Q){if(Q.terminated){if(Q.lastPhase)try{X(Q.lastPhase)}catch{}return{unsubscribe:GQ4}}if(Q.listeners.add(X),Q.lastPhase)try{X(Q.lastPhase)}catch{}return k7$(Z,Q,X)}let Y=new AbortController,G={lastPhase:null,terminated:!1,listeners:new Set([X]),abort:Y};return lO.set(Z,G),JQ4($,Z,G),k7$(Z,G,X)}function GQ4(){}function k7$($,Z,X){return{unsubscribe(){if(lO.get($)!==Z)return;if(Z.listeners.delete(X),Z.listeners.size===0)lO.delete($),Z.abort.abort()}}}async function JQ4($,Z,X){let Q=null;try{for await(let Y of $.watchClaimLifecycle(Z,X.abort.signal)){if(X.abort.signal.aborted)break;X.lastPhase=Y;let G=Y.kind==="ready"||Y.kind==="failed";if(G)X.terminated=!0;let J=Array.from(X.listeners);for(let W of J)try{W(Y)}catch{}if(G)break}}catch(Y){Q=Y}finally{if(!X.terminated&&!X.abort.signal.aborted&&X.listeners.size>0){let Y={kind:"failed",reason:"unknown",message:Q instanceof Error?Q.message:"Lifecycle watcher ended unexpectedly"};X.lastPhase=Y,X.terminated=!0;for(let G of Array.from(X.listeners))try{G(Y)}catch{}}if(lO.get(Z)===X)lO.delete(Z)}}function WQ4(){for(let $ of lO.values())$.abort.abort();lO.clear()}var rX4,aX4,S7$,M7$,xm0,QQ4,YQ4,lO;var ai=B(()=>{WN();RG();v6();zl0();Bx();qc();R$();rX4=Symbol.for("decocms.sandbox.lifecycle.runners"),aX4=Symbol.for("decocms.sandbox.lifecycle.inflight"),S7$=globalThis,M7$=S7$[rX4]??={},xm0=S7$[aX4]??={};QQ4=Symbol.for("decocms.sandbox.lifecycle.shared-lifecycles"),YQ4=globalThis,lO=YQ4[QQ4]??=new Map});async function dX($,Z){let{userId:X,branch:Q,virtualMcpMetadata:Y,explicitKind:G}=Z;if(G)return si($,G);if($.sandboxPreference==="agent-sandbox")return si($,"agent-sandbox");if($.sandboxPreference==="cluster-default")return si($,cL());let[J,...W]=KQ4(Y,X,Q);if(J)return si($,W.length===0?J:HQ4(J,W));return si($,v7$())}function KQ4($,Z,X){let Q=f5($)[Z]?.[X];if(!Q)return[];let Y=yJ(Q);return Object.keys(Y)}function HQ4($,Z){let X=v7$();if(X===$||Z.includes(X))return X;return $}function v7$(){return cL()}async function si($,Z){let X=Z==="user-desktop"?"agent-sandbox":Z;return{provider:await ym0($,X),kind:X}}var dO=B(()=>{L8();WN();VQ();ai()});var ei;var um0=B(()=>{ei={npm:{install:"npm install",run:($)=>`npm run ${$}`,runtime:"node"},pnpm:{install:"pnpm install",run:($)=>`pnpm run ${$}`,runtime:"node"},yarn:{install:"yarn install",run:($)=>`yarn run ${$}`,runtime:"node"},bun:{install:"bun install",run:($)=>`bun run ${$}`,runtime:"bun"},deno:{install:"deno install",run:($)=>`deno task ${$}`,runtime:"deno"}}});function A3($,Z){return Z?`thread:${$}/${Z}`:`thread:${$}`}function BN($){return`sandbox/thread-${$.replace(/^thread:/,"").replace(/\//g,"-")}`}function mO($){if(!$||!$.startsWith("thread:"))return null;return $.slice(7).split("/")[0]||null}async function DN($,Z,X){let Q=mO(Z);if(!Q)return X;return(await $.storage.threads.get(Q).catch(()=>null))?.created_by??X}async function EV($,Z){if(!Z)return null;let X=await $.storage.threads.get(Z).catch(()=>null);if(!X)return null;return X.metadata??{}}async function f7$($,Z){let Q=(await EV($,Z))?.headRef;return typeof Q==="string"&&Q.length>0?Q:null}async function b7$($,Z,X){let Q=await EV($,Z);if(!Q)return;if(Q.headRef===X)return;await $.storage.threads.update(Z,{metadata:{...Q,headRef:X}}).catch((Y)=>console.warn("[thread-repo] setThreadHeadRef failed",Y))}function NQ4($,Z){let X=F50(Z,$.owner,$.name);if(!X||X.id===$.connectionId)return null;let Q=z5(X);return{...$,connectionId:X.id,...Q?.installationId?{installationId:Q.installationId}:{}}}async function iO($,Z){let X=await EV($,Z),Q=X?.githubRepo??null;if(!Z||!X||!Q?.connectionId)return Q;try{let Y=$.storage.threads.getOrganizationId();if(!Y)return Q;if(await $.storage.connections.findById(Q.connectionId,Y))return Q;let{items:G}=await $.storage.connections.list(Y),J=NQ4(Q,G);if(!J)return Q;return await $.storage.threads.update(Z,{metadata:{...X,githubRepo:J}}),console.warn("[thread-repo] re-pointed thread at a live repo connection",{threadId:Z,from:Q.connectionId,to:J.connectionId}),J}catch(Y){return console.warn("[thread-repo] repoint check failed",Y),Q}}function cm0($){if($.pinnedRef)return $.pinnedRef;if($.runBranch&&$.runBranch===A3($.threadId))return $.runBranch;if($.threadRepo)return A3($.threadId,$.threadRepo.connectionId);if(!$.agentRepo)return"ephemeral";return $.runBranch??`thread:${$.threadId}`}async function lm0($,Z){let Q=(await EV($,Z))?.pinnedRef;return typeof Q==="string"&&Q.length>0?Q:null}async function x7$($,Z){let[X,Q]=await Promise.all([iO($,Z.threadId),lm0($,Z.threadId)]);return cm0({...Z,threadRepo:X,pinnedRef:Q})}async function y7$($,Z,X,Q,Y,G){let J=await EV($,Z);if(!J)return;let W=Ri(f5(J),X,Q,Y,G);await $.storage.threads.update(Z,{metadata:{...J,sandboxMap:W}}).catch((K)=>console.warn("[thread-repo] setThreadSandboxMapEntry failed",K))}async function VU0($,Z){return f5(await EV($,Z))}async function g7$($,Z,X,Q,Y){let G=await EV($,Z);if(!G)return;let J=jl0(f5(G),X,Q,Y);if(!J)return;await $.storage.threads.update(Z,{metadata:{...G,sandboxMap:J}}).catch((W)=>console.warn("[thread-repo] removeThreadSandboxMapEntry failed",W))}var T3=B(()=>{DQ();VQ()});function _x($){if(!$)return null;let Z=$.runtime;if(!Z||typeof Z!=="object")return null;let X=Z.env;if(!Array.isArray(X))return null;let Q=[];for(let Y of X){if(!Y||typeof Y!=="object")continue;let G=Y;if(typeof G.key!=="string"||!q10.test(G.key))continue;if(G.kind==="literal"&&typeof G.value==="string"){Q.push({key:G.key,kind:"literal",value:G.value});continue}if(G.kind==="secret"&&typeof G.secretId==="string"&&G.secretId.length>0)Q.push({key:G.key,kind:"secret",secretId:G.secretId})}return Q.length===0?null:Q}function h7$($){if(!$)return null;let Z=$.runtime;if(!Z||typeof Z!=="object")return null;let X=Z.submoduleCredentials;if(!Array.isArray(X))return null;let Q=[];for(let Y of X){if(!Y||typeof Y!=="object")continue;let G=Y;if(typeof G.host==="string"&&G.host.length>0&&typeof G.secretId==="string"&&G.secretId.length>0)Q.push({host:G.host,secretId:G.secretId})}return Q}async function u7$($,Z){Z0(Z);let X=o(Z);await Z.access.check();let Q=W1(Z);if(!Q)throw Error("User ID required");let Y=await Z.storage.virtualMcps.findById($.virtualMcpId);if(!Y||Y.organization_id!==X.id)throw Error("Virtual MCP not found");let G=Y.metadata??{},J=f5(G),W=await DN(Z,$.branch,Q),K=sW(J,W,$.branch,$.sandboxProviderKind);return{virtualMcp:Y,metadata:G,userId:Q,sandboxUserId:W,entry:K,organization:X}}function FQ4($){if($===null||!/^\d+$/.test($))return null;let Z=Number($);return Z>=1&&Z<=65535?$:null}function c7$($){let Z=$.runtime??null,Q=Z?.selected??null,Y=FQ4(Z?.port??null),G=Z?.path??null;if(!Q||!(Q in ei))return{packageManager:null,runtime:null,port:Y,packageManagerPath:G,runtimeBinPath:null};let J=ei[Q].runtime;return{packageManager:Q,runtime:J,port:Y,packageManagerPath:G,runtimeBinPath:J==="deno"?"/opt/deno/bin":J==="bun"?"/opt/bun/bin":null}}var $n=B(()=>{L8();um0();VQ();T3()});import{sql as UQ4}from"kysely";function l7$($){return $ instanceof Date?$.toISOString():String($)}class dm0{db;vault;constructor($,Z){this.db=$;this.vault=Z}rowToInfo($){return{id:$.id,organizationId:$.organization_id,scope:$.scope,userId:$.user_id,name:$.name,description:$.description,createdBy:$.created_by,createdAt:l7$($.created_at),updatedBy:$.updated_by,updatedAt:l7$($.updated_at)}}assertVisible($,Z){if($.scope==="user"&&$.user_id!==Z)throw new nO($.id)}async create($){let Z=l8("sec"),X=await this.vault.encrypt($.value),Q=new Date,Y=await this.db.insertInto("secrets").values({id:Z,organization_id:$.organizationId,scope:$.scope.kind,user_id:$.scope.kind==="user"?$.scope.userId:null,name:$.name,encrypted_value:X,description:$.description??null,created_by:$.createdBy,created_at:Q,updated_by:$.createdBy,updated_at:Q}).returning(CU0).executeTakeFirstOrThrow();return this.rowToInfo(Y)}async update($){let Z=await this.db.selectFrom("secrets").where("id","=",$.id).where("organization_id","=",$.organizationId).select(["id","scope","user_id"]).executeTakeFirst();if(!Z)throw new bG($.id);this.assertVisible(Z,$.callerUserId);let X={updated_by:$.updatedBy,updated_at:new Date};if($.value!==void 0)X.encrypted_value=await this.vault.encrypt($.value);if($.description!==void 0)X.description=$.description;let Q=await this.db.updateTable("secrets").set(X).where("id","=",$.id).where("organization_id","=",$.organizationId).returning(CU0).executeTakeFirstOrThrow();return this.rowToInfo(Q)}async delete($,Z,X){let Q=await this.db.selectFrom("secrets").where("id","=",$).where("organization_id","=",Z).select(["id","scope","user_id"]).executeTakeFirst();if(!Q)throw new bG($);this.assertVisible(Q,X),await this.db.deleteFrom("secrets").where("id","=",$).where("organization_id","=",Z).execute()}async list($){let Z=this.db.selectFrom("secrets").where("organization_id","=",$.organizationId).select(CU0);if($.scope?.kind==="user")Z=Z.where("scope","=","user").where("user_id","=",$.scope.userId);else if($.scope?.kind==="organization")Z=Z.where("scope","=","organization");else Z=Z.where((Q)=>Q.or([Q("scope","=","organization"),Q.and([Q("scope","=","user"),Q("user_id","=",$.callerUserId)])]));return(await Z.orderBy("created_at","desc").execute()).map((Q)=>this.rowToInfo(Q))}async findById($,Z,X){let Q=await this.db.selectFrom("secrets").where("id","=",$).where("organization_id","=",Z).select(CU0).executeTakeFirst();if(!Q)throw new bG($);return this.assertVisible(Q,X),this.rowToInfo(Q)}async resolveById($,Z,X){let Q=await this.db.selectFrom("secrets").where("id","=",$).where("organization_id","=",Z).selectAll().executeTakeFirst();if(!Q)throw new bG($);this.assertVisible(Q,X);let Y=await this.vault.decrypt(Q.encrypted_value);return{info:this.rowToInfo(Q),value:Y}}async resolveByName($){let Z=this.db.selectFrom("secrets").where("organization_id","=",$.organizationId).where("scope","=",$.scope.kind).where(UQ4`lower(name) = lower(${$.name})`).selectAll();if($.scope.kind==="user")Z=Z.where("user_id","=",$.scope.userId);let X=await Z.executeTakeFirst();if(!X)throw new bG(`${$.scope.kind}:${$.name}`);let Q=await this.vault.decrypt(X.encrypted_value);return{info:this.rowToInfo(X),value:Q}}}var CU0,bG,nO;var Zn=B(()=>{kX();CU0=["id","organization_id","scope","user_id","name","description","created_by","created_at","updated_by","updated_at"];bG=class bG extends Error{constructor($){super(`Secret ${$} not found`);this.name="SecretNotFoundError"}};nO=class nO extends Error{constructor($){super(`Access denied for secret ${$}`);this.name="SecretAccessDeniedError"}}});async function pO($,Z){let X=$.body?.getReader();if(!X)return $.text();let Q=new TextDecoder,Y="",G=0;for(;;){let{done:J,value:W}=await X.read();if(J)break;if(G+=W.byteLength,G>Z)throw await X.cancel().catch(()=>{}),new d7$(`Upstream response exceeded ${Z} bytes`);Y+=Q.decode(W,{stream:!0})}return Y+=Q.decode(),Y}var d7$;var Xn=B(()=>{d7$=class d7$ extends Error{}});async function _U0({ctx:$,runner:Z,handle:X,orgId:Q,userId:Y,entries:G}){if(!G||G.length===0)return;let J={};for(let K of G){if(K.kind==="literal"){J[K.key]=K.value;continue}try{let{value:H}=await $.storage.secrets.resolveById(K.secretId,Q,Y);J[K.key]=H}catch(H){if(H instanceof bG||H instanceof nO){console.warn(`[SANDBOX_START] skipping env ${K.key}: ${H.message}. Re-link or recreate the secret to restore.`);continue}throw H}}if(Object.keys(J).length===0)return;let W=await Z.proxyDaemonRequest(X,"/_sandbox/config",{method:"PUT",headers:new Headers({"content-type":"application/json"}),body:JSON.stringify({env:J})});if(!W.ok){let K=await pO(W,OQ4).catch(()=>W.statusText);console.warn(`[SANDBOX_START] daemon rejected env patch (${W.status}): ${K}`)}}var OQ4=10485760;var mm0=B(()=>{Zn();Xn()});async function m7$({ctx:$,orgId:Z,userId:X,entries:Q}){if(!Q||Q.length===0)return[];let Y=[];for(let G of Q)try{let{value:J}=await $.storage.secrets.resolveById(G.secretId,Z,X);Y.push({host:G.host,token:J})}catch(J){if(J instanceof bG||J instanceof nO){console.warn(`[SANDBOX_START] skipping submodule credential for ${G.host}: ${J.message}. Re-link or recreate the secret to restore.`);continue}throw J}return Y}var i7$=B(()=>{Zn()});async function t7$($,Z,X,Q,Y){let G=await SY({connectionId:$,tokenStorage:new R6(Q,Y)});if(!G.accessToken)return null;return r7$(Z,X,G.accessToken)}function o7$($,Z){return r7$($,Z,null)}async function r7$($,Z,X){let Q=new Map,Y=new Set(n7$.map((K)=>K.path));for(let K of Object.values(p7$))for(let H of K??[])Y.add(H);await Promise.all(Array.from(Y).map(async(K)=>{Q.set(K,await BQ4($,Z,K,X))}));let G=n7$.find(({path:K})=>Q.get(K)!==null);if(!G)return null;let J=p7$[G.pm]??[],W=null;for(let K of J)if(W=DQ4(Q.get(K)??null),W)break;return{packageManager:G.pm,devPort:W}}async function BQ4($,Z,X,Q){let Y=`https://api.github.com/repos/${$}/${Z}/contents/${encodeURIComponent(X)}`;try{let G={Accept:"application/vnd.github+json","User-Agent":"studio-runtime-detect"};if(Q)G.Authorization=`token ${Q}`;let J=await fetch(Y,{headers:G,signal:AbortSignal.timeout(5000)});if(!J.ok)return null;let W=await J.json();if(!W.content||W.encoding!=="base64")return null;return Buffer.from(W.content,"base64").toString("utf8")}catch{return null}}function DQ4($){if(!$)return null;try{let Z=JSON.parse($),X=Z.tasks??Z.scripts??{},Y=(X.dev??X.start??"").match(wQ4)?.[1]??null;if(!Y)return null;let G=Number(Y);return G>=1&&G<=65535?Y:null}catch{return null}}var n7$,p7$,wQ4;var a7$=B(()=>{eW();TY();n7$=[{path:"deno.json",pm:"deno"},{path:"deno.jsonc",pm:"deno"},{path:"bun.lock",pm:"bun"},{path:"bunfig.toml",pm:"bun"},{path:"pnpm-lock.yaml",pm:"pnpm"},{path:"yarn.lock",pm:"yarn"},{path:"package-lock.json",pm:"npm"},{path:"package.json",pm:"bun"}],p7$={deno:["deno.json","deno.jsonc"],bun:["package.json"],pnpm:["package.json"],yarn:["package.json"],npm:["package.json"]},wQ4=/(?:--port|PORT=|:)(\d{4,5})/});function LQ4($){return($??"").normalize("NFKD").replace(/[\u0300-\u036F]/g,"").toLowerCase().replace(/[^a-z0-9]+/g,"-").replace(/^-+|-+$/g,"")||"user"}function vU0($){return $?.name||$?.email?.split("@")[0]||void 0}function fU0($){let Z=LQ4($),X=Date.now().toString(36).split("").reverse().join("");return`${Z}-${X}`}function s7$($){let{current:Z,detached:X,base:Q}=$.status??{};if(typeof Z!=="string"||Z.length===0)return null;if(X===!0)return null;if(Z===$.requestedRef)return null;if(EQ4.has(Z))return null;if(typeof Q==="string"&&Q.length>0&&Z===Q)return null;return Z}function bU0($){if(!$.branch.startsWith("thread:"))return $.branch;if($.sticky&&$.recordedHeadRef)return $.recordedHeadRef;return $.derivedRef}var EQ4;var xU0=B(()=>{EQ4=new Set(["main","master","trunk","develop","HEAD"])});async function e7$($,Z){if(!$)return{hosts:[],allowSameHostDev:!1};let X;try{X=await $.presignedGetUrl("link-dispatch/_allowlist_probe",60,{requireFetchable:!0})}catch{return{hosts:[],allowSameHostDev:!1}}let Q;try{Q=new URL(X)}catch{return{hosts:[],allowSameHostDev:!1}}if(Q.protocol!=="https:"&&Q.protocol!=="http:")return{hosts:[],allowSameHostDev:!1};let Y=Q.hostname,G=jQ4.has(Y);return{hosts:[Y],allowSameHostDev:G&&!Z.isProduction}}var jQ4;var $X$=B(()=>{jQ4=new Set(["127.0.0.1","localhost","::1","[::1]","0.0.0.0"])});var jV="home";var yU0=()=>{};function gU0($){if(!tF($))return`Invalid volume name ${JSON.stringify($)} \u2014 use 1-128 chars of letters, digits, "_", "-" or "."`;if(zQ4.has($))return`Volume "${$}" is reserved`;if(UW($))return'Volume names starting with "public-" are reserved for shared skill sets';if($.startsWith("."))return'Volume names starting with "." are reserved';if(!/^[A-Za-z0-9]/.test($))return"Volume names must start with a letter or digit";return null}async function hU0($,Z){try{let X=await $.storage.connections.findById(Z.connectionId,Z.organizationId);if(!X)throw Error("sync connection not found in this organization");await SO({ctx:$,connectionId:X.id,organizationId:Z.organizationId,onLegacyMintError:(J)=>console.warn("[org-repo-sync] repo-scoped mint failed",{configId:Z.id,error:J instanceof Error?J.message:String(J)})});let Q=await SY({connectionId:X.id,tokenStorage:new R6($.db,$.vault)});if(!Q.accessToken)throw Error("No GitHub token for the sync connection \u2014 reconnect the mcp-github integration.");let Y=Q.accessToken,G=await J_0($.db,{orgId:Z.organizationId,baseUrl:$.baseUrl,volume:Z.volume,source:{repo:`${Z.repoOwner}/${Z.repoName}`,ref:Z.ref,paths:Z.paths},authToken:Y,skipVolumeQuota:!1});return await $.storage.orgRepoSyncs.recordSyncResult(Z.id,{error:null}),{id:Z.id,volume:Z.volume,...G}}catch(X){let Q=X instanceof Error?X.message:String(X);return await $.storage.orgRepoSyncs.recordSyncResult(Z.id,{error:Q}).catch(()=>{}),{id:Z.id,volume:Z.volume,error:Q}}}var zQ4,im0=10;var uU0=B(()=>{Bx();eW();TY();_v();HD();J10();zQ4=new Set(["home","outputs","uploads","public","output","upload"])});function tO($,Z){let X;if($==="home")X=`org/${jV}`;else if($==="outputs")X=`org/${ZX$}`;else if($==="uploads")X=`org/${XX$}`;else if(UW($))X=`org/public/${$.slice(7)}`;else X=`org/${$}`;return Z?`${X}/${Z}`:X}function AQ4($){return{baseUrl:$.baseUrl.replace(/\/+$/,""),orgSlug:$.orgSlug,token:$.token,mounts:[{volume:"home",path:jV},...PQ4.map((Z)=>({...Z})),...($.publicSets??[]).map((Z)=>({volume:rF(Z),path:`public/${Z}`,readonly:!0})),...($.syncedVolumes??[]).filter((Z)=>gU0(Z)===null).map((Z)=>({volume:Z,path:Z,readonly:!0}))]}}async function QX$($,Z){try{let X=await $.boundAuth.apiKey.create({name:`orgfs-${Z.orgSlug}`,permissions:{self:["ORG_FS_READ","ORG_FS_WRITE"]},expiresIn:TQ4,metadata:{organization:{id:Z.orgId,slug:Z.orgSlug}}}),Q=await $.storage.orgRepoSyncs.listEnabledVolumes(Z.orgId).catch(()=>[]);return JSON.stringify(AQ4({baseUrl:Z.baseUrl,orgSlug:Z.orgSlug,token:X.key,publicSets:HG().map((Y)=>Y.set),syncedVolumes:Q}))}catch(X){console.warn("[org-fs] token mint failed; mounts disabled for this sandbox",X);return}}var ZX$=".outputs",XX$=".uploads",PQ4,TQ4=604800;var Qn=B(()=>{yU0();uU0();HD();PQ4=[{volume:"outputs",path:ZX$},{volume:"uploads",path:XX$}]});import{z as GK}from"zod";async function vx($,Z){Z0(Z);let X=o(Z),Q=W1(Z);if(!Q)throw Error("User ID required");let Y=await Z.storage.virtualMcps.findById($.virtualMcpId);if(!Y||Y.organization_id!==X.id)throw Error("Virtual MCP not found");let G=Y.metadata??{},J=await DN(Z,$.branch,Q),W=sW(f5(G),J,$.branch,$.sandboxProviderKind),K=$.sandboxProviderKind,{provider:H}=await dX(Z,{userId:J,branch:$.branch,virtualMcpMetadata:G,explicitKind:K});if(W){if(K!=="user-desktop")return W;if(await H.alive(W.sandboxHandle).catch(()=>!1))return W;await kO(Z.storage.virtualMcps,$.virtualMcpId,Q,J,$.branch,K).catch((w)=>{console.warn("[ensureSandbox] failed to reap stale user-desktop entry",w)})}let F=await iO(Z,mO($.branch)??Z.metadata?.threadId)??G.githubRepo??null,{entry:U}=await GX$({ctx:Z,userId:Q,sandboxUserId:J,orgId:X.id,virtualMcpId:$.virtualMcpId,branch:$.branch,metadata:G,githubRepo:F,existing:null,providerKind:K,runner:H,...$.cloneOnly?{cloneOnly:!0}:{}});return U}async function GX$($){let{ctx:Z,userId:X,sandboxUserId:Q,orgId:Y,virtualMcpId:G,branch:J,metadata:W,existing:K,runner:H,cloneOnly:N}=$,F=$.githubRepo?await IQ4({ctx:Z,orgId:Y,virtualMcpId:G,userId:X,githubRepo:$.githubRepo}):null,{runtime:U,packageManager:O,port:w,packageManagerPath:D}=c7$(W),L;if(F){if(F.connectionId)await SO({ctx:Z,connectionId:F.connectionId,organizationId:Y,forceRefresh:!0,onLegacyMintError:(D0)=>{console.error("[provisionSandbox] repo-scoped legacy token mint failed",{connectionId:F.connectionId,error:D0.message})}});let{cloneUrl:O0,gitUserName:B0,gitUserEmail:s}=F.connectionId?await VO(F.connectionId,F.owner,F.name,Z.db,Z.vault):D$$(F.owner,F.name);if(!O){let D0=F.connectionId?await t7$(F.connectionId,F.owner,F.name,Z.db,Z.vault):await o7$(F.owner,F.name);if(D0)O=D0.packageManager,U=ei[D0.packageManager].runtime,w=D0.devPort??w,await qQ4(Z,G,X,D0.packageManager,D0.devPort)}let t=y0().sandboxStickyHeadRefEnabled,P0=bU0({branch:J,derivedRef:BN(J),recordedHeadRef:t?await f7$(Z,mO(J)):null,sticky:t}),Y0=await m7$({ctx:Z,orgId:Y,userId:X,entries:h7$(W)});L={cloneUrl:O0,...F.connectionId?{connectionId:F.connectionId}:{},userName:B0,userEmail:s,branch:P0,displayName:`${F.owner}/${F.name}`,submoduleCredentials:Y0}}let E=U&&O&&!N?{runtime:U,packageManager:O,...w!==null?{devPort:Number(w)}:{},...D?{packageManagerPath:D}:{}}:void 0,j=Ai({orgId:Y,virtualMcpId:G,branch:J}),z=H.kind==="user-desktop"?await e7$(Z.objectStorage,{isProduction:y0().nodeEnv==="production"}):null,A=(H.kind==="user-desktop"||H.kind==="agent-sandbox")&&!y0().orgFsMountsDisabled,P;if(A){let O0=Z.organization?.slug??(await Z.db.selectFrom("organization").select(["slug"]).where("id","=",Y).executeTakeFirst())?.slug;if(O0)P=await QX$(Z,{orgSlug:O0,orgId:Y,baseUrl:GQ()})}await kQ4(H);let q=await H.ensure({userId:Q,projectRef:j},{branch:J,repo:L,workload:E,cloneOnly:N===!0,tenant:{orgId:Y,userId:Q,...Z.organization?.slug?{orgSlug:Z.organization.slug}:{},...Z.organization?.name?{orgName:Z.organization.name}:{},...Z.auth.user?.email?{userEmail:Z.auth.user.email}:{},...Z.auth.user?.name?{userName:Z.auth.user.name}:{}},...z?{offloadAllowedHosts:z.hosts,offloadAllowSameHostDev:z.allowSameHostDev}:{},...P?{orgFsConfigJson:P}:{}}),S=_x(W);await _U0({ctx:Z,runner:H,handle:q.handle,orgId:Y,userId:X,entries:S});let _=!!K&&K.sandboxHandle===q.handle&&K?.createdAt?K.createdAt:Date.now(),l=W.runtime?.selected??null,f=W.runtime?.port??null,x=W.runtime?.path??null,p={sandboxHandle:q.handle,previewUrl:q.previewUrl,sandboxApiUrl:q.previewUrl,sandboxProviderKind:H.kind,createdAt:_,startedWith:{packageManager:l,port:f,path:x}};await J$$(Z.storage.virtualMcps,G,X,Q,J,$.providerKind,p);let h=mO(J)??Z.metadata?.threadId;if(h)await y7$(Z,h,Q,J,$.providerKind,p);let r=!K||K.sandboxHandle!==q.handle;return{entry:p,isNewVm:r}}async function IQ4($){let{ctx:Z,orgId:X,virtualMcpId:Q,userId:Y,githubRepo:G}=$;if(!G.connectionId)return G;if(await Z.storage.connections.findById(G.connectionId,X))return G;let{items:W}=await Z.storage.connections.list(X),K=F50(W,G.owner,G.name);if(!K)return console.warn("[provisionSandbox] recorded repo connection no longer exists and no live connection covers the repo",{virtualMcpId:Q,connectionId:G.connectionId}),G;console.warn("[provisionSandbox] healed dangling repo connection",{virtualMcpId:Q,staleConnectionId:G.connectionId,connectionId:K.id});try{let N=(await Z.storage.virtualMcps.findById(Q))?.metadata??{},F=N.githubRepo;if(F?.connectionId===G.connectionId){let U=z5(K);await Z.storage.virtualMcps.update(Q,Y,{metadata:{...N,githubRepo:{...F,connectionId:K.id,...U?{installationId:U.installationId}:{}}}})}}catch(H){console.warn("[provisionSandbox] failed to persist healed repo connection",{virtualMcpId:Q,error:H.message})}return{...G,connectionId:K.id}}async function qQ4($,Z,X,Q,Y){let G=await $.storage.virtualMcps.findById(Z);if(!G)return;let J=G.metadata??{};await $.storage.virtualMcps.update(Z,X,{metadata:{...J,runtime:{selected:Q,port:Y}}})}async function kQ4($){if(!$.hasSchedulableCapacity)return;let Z=Date.now()+YX$,X=!1;while(!await $.hasSchedulableCapacity()){if(Date.now()>=Z)throw Error(`sandbox provisioning failed: the cluster has had no room to schedule another sandbox for ${Math.round(YX$/1000)}s`);if(!X)X=!0,console.warn("[ensureSandbox] waiting for cluster capacity \u2014 a sandbox pod cannot be scheduled right now");await C$(MQ4)}}var RQ4,nm0,YX$=150000,MQ4=5000;var Yn=B(()=>{WN();$6();v0();$n();mm0();i7$();VQ();DQ();Bx();a7$();um0();dO();T3();xU0();$X$();R$();PZ();Qn();VQ();RQ4=GK.enum(["agent-sandbox","user-desktop","cluster"]),nm0=m({name:"SANDBOX_START",description:"Start a sandbox with the connected GitHub repo and dev server.",annotations:{title:"Start VM Preview",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!1,openWorldHint:!0},_meta:{ui:{visibility:"app"}},inputSchema:GK.object({virtualMcpId:GK.string().describe("Virtual MCP ID"),branch:GK.string().min(1).optional().describe("Git branch to check out. Pass the thread's branch whenever the caller has one: when omitted the handler mints a fresh `<user-slug>-<timestamp>` name, which becomes a SEPARATE sandbox from the one the thread's own branch resolves to. The resolved branch is returned in the response so callers can persist it."),sandboxProviderKind:RQ4.optional().describe("Explicit runtime choice. Hosted provider is `agent-sandbox`; legacy `cluster` input is accepted only for compatibility and normalized to `agent-sandbox`. When omitted, defaults to `user-desktop` if the acting user's link daemon is online, else the env kind.")}),outputSchema:GK.object({previewUrl:GK.string().nullable(),sandboxHandle:GK.string(),branch:GK.string(),isNewVm:GK.boolean(),sandboxProviderKind:GK.enum(["agent-sandbox","user-desktop"])}),handler:async($,Z)=>{Z0(Z);let X=o(Z);await Z.access.check();let Q=$.branch??fU0(vU0(Z.auth.user)),Y=W1(Z);if(!Y)throw Error("User ID required");let G=await DN(Z,Q,Y),J=await Z.storage.virtualMcps.findById($.virtualMcpId);if(!J||J.organization_id!==X.id)throw Error("Virtual MCP not found");let W=J.metadata??{},K=$.sandboxProviderKind?hL($.sandboxProviderKind):void 0,{provider:H,kind:N}=await dX(Z,{userId:G,branch:Q,virtualMcpMetadata:W,explicitKind:K}),F=sW(f5(W),G,Q,N),O=await iO(Z,mO(Q)??Z.metadata?.threadId)??W.githubRepo??null,{entry:w,isNewVm:D}=await GX$({ctx:Z,userId:Y,sandboxUserId:G,orgId:X.id,virtualMcpId:$.virtualMcpId,branch:Q,metadata:W,githubRepo:O,existing:F,providerKind:N,runner:H});return{...w,branch:Q,isNewVm:D,sandboxProviderKind:N}}})});function SQ4($){let{publicUrl:Z,agentId:X,organization:Q,target:Y,threadId:G}=$;if(Y==="agent-tools")return`${Z}/mcp/virtual-mcp/${X}`;if(!Q.slug)throw new WX$(Q.id);if(Y==="task-run"){if(!G)throw Error("a task-run MCP endpoint is scoped to a run: threadId is required");return`${Z}/api/${Q.slug}/mcp/task-run/${encodeURIComponent(G)}`}return`${Z}/api/${Q.slug}/mcp/self`}async function cU0($,Z,X,Q,Y="agent-tools",G){let J=SQ4({publicUrl:GQ(),agentId:Z,organization:X,target:Y,...G?{threadId:G}:{}}),W=await $.boundAuth.apiKey.create({name:Q,permissions:{"*":["*"]},expiresIn:JX$,metadata:{organization:{id:X.id,slug:X.slug,name:X.name}}});return{url:J,headers:{Authorization:`Bearer ${W.key}`,"x-org-id":X.id},expiresAt:Date.now()+JX$*1000}}var JX$=3600,WX$;var pm0=B(()=>{PZ();WX$=class WX$ extends Error{constructor($){super(`cannot mint a management MCP endpoint for organization "${$}": the org-scoped path /api/<slug>/mcp/self needs the org slug, which was not loaded.`);this.name="MissingOrganizationSlugError"}}});async function VQ4($,Z,X,Q){try{let Y=$.organization;if(!Y)return;let G=await cU0($,Q.virtualMcpId,Y,"tool-scripting"),J=await Z.proxyDaemonRequest(X,"/_sandbox/tools/sync",{method:"POST",headers:new Headers({"content-type":"application/json"}),body:JSON.stringify(G)});if(!J.ok)console.warn("[cluster-sandbox-fs] tools/sync failed",J.status,await J.text().catch(()=>""))}catch(Y){console.warn("[cluster-sandbox-fs] tools/sync failed",Y)}}async function fx($,Z){let{provider:X,kind:Q}=await dX($,{userId:Z.userId,branch:Z.branch,virtualMcpMetadata:null}),Y=null,G=()=>{if(!Y){if(Y=vx({virtualMcpId:Z.virtualMcpId,branch:Z.branch,sandboxProviderKind:Q},$).then((K)=>K.sandboxHandle),Y.catch(()=>{Y=null}),Z.syncTools)Y.then((K)=>VQ4($,X,K,{virtualMcpId:Z.virtualMcpId,providerKind:Q})).catch(()=>{})}return Y},J=Z.branch==="ephemeral"||Q==="user-desktop";return El0(X,{ensureHandle:G,invalidateHandle:async(K)=>{let H=Y;if(Y=null,!J&&!K?.force)return;try{await kO($.storage.virtualMcps,Z.virtualMcpId,Z.userId,Z.userId,Z.branch,Q)}catch(N){console.warn("[cluster-sandbox-fs] failed to reap vmMap entry",N)}if(H&&typeof X.forgetHandle==="function")try{let N=await H;await X.forgetHandle(N)}catch(N){console.warn("[cluster-sandbox-fs] forgetHandle failed",N)}},canAutoRestart:J,threadId:Z.threadId})}async function KX$($,Z){try{let X=await fx($,Z),{stdout:Q}=await X.onBash("test -d .deco && echo __DECO_SITE__");return Q.includes("__DECO_SITE__")}catch(X){return console.warn("[cluster-sandbox-fs] .deco probe failed; assuming deco site",X),!0}}var lU0=B(()=>{WN();pm0();dO();Yn();VQ()});import{z as HX$}from"zod";function bx($){let Z=[];for(let X of $){if(X.status!=="active")continue;let Q=z5(X);if(!Q)continue;Z.push({connectionId:X.id,owner:Q.owner,repo:Q.repo,installationId:Q.installationId})}return Z}async function _Q4($,Z){let{items:X}=await $.storage.connections.list(Z,{slug:"mcp-github"});return bx(X)}function vQ4($){let Z=$.split(`
 `).map((Q)=>Q.trim()).filter((Q)=>Q&&Q!==".git"&&Q!=="__CLONED__"),X=Z.length>0;return{cloned:X,listing:X?Z.join(`
 `):""}}function fQ4($){let Z="Load a GitHub repository into this conversation's sandbox so the file tools (read/write/edit/bash/grep/glob) and dev server operate on that repo, and open its live Preview. Waits until the repo is cloned before returning. Calling it again switches the repo. File tools operate on the loaded repo from your NEXT message (this turn's tools are still bound to the previous workspace), so after loading, prefer the file listing this tool returns over re-running bash in the same turn.",X=$.map((Q)=>`- ${Q.owner}/${Q.repo} (connectionId: ${Q.connectionId})`).join(`
 `);return`${Z}
@@ -2735,7 +2735,7 @@ Do NOT require review (requiresReview = false) when the changes are low-risk, su
 When unsure between the two, lean toward NOT requiring review for small frontend-only diffs, and toward requiring it for anything backend or large.
 
 Respond with the structured verdict and a short reason.`,uf$;var lf$=B(()=>{C4();oO();P61();E96=A61.object({requiresReview:A61.boolean().describe("true if the changes should go through pull-request review"),reason:A61.string().describe("One short sentence explaining the decision (max ~120 chars)")});uf$={requiresReview:!1,reason:""}});function df$($){let Z=$?.trim();if(!Z)return null;try{let X=new URL(Z);if(X.protocol!=="http:"&&X.protocol!=="https:")return null;return X.href}catch{return null}}function Uz0($){return df$($?.previewServerUrl)??df$($?.productionUrl)}function mf$(){return process.env.GITHUB_API_BASE_URL??"https://api.github.com"}function if$($,Z){return $==="GET"&&!Z.includes("/git/blobs/")&&!Z.includes("/git/trees/")&&!Z.includes("/tarball/")}function nf$($){let Z=Fh.get($);if(!Z)return;Fh.delete($),T61-=Z.bytes}function R96($,Z,X){let Q;try{Q=JSON.stringify(X)?.length??0}catch{return}if(nf$($),Q>T96)return;Fh.set($,{etag:Z,body:X,bytes:Q}),T61+=Q;while(T61>A96||Fh.size>P96){let Y=Fh.keys().next().value;if(Y===void 0)break;nf$(Y)}}function pf$($){let{owner:Z,repo:X,accessToken:Q}=$,Y=`/repos/${Z}/${X}`,G=null;async function J(W,K,H,N){let F=`${mf$()}${K}`,U=if$(W,K)?Fh.get(F):void 0,O=await fetch(F,{method:W,headers:{Accept:"application/vnd.github+json","User-Agent":"studio-decofile",Authorization:`token ${Q}`,...U?{"If-None-Match":U.etag}:{},...H!==void 0?{"content-type":"application/json"}:{}},body:H!==void 0?JSON.stringify(H):void 0,signal:AbortSignal.timeout(15000)});if(U&&O.status===304)return{status:200,json:U.body};if(!O.ok&&!N?.allow?.includes(O.status)){let D=await O.text().catch(()=>""),L=D;try{L=JSON.parse(D).message??D}catch{}throw new V6(O.status,W,K,L)}let w=O.status===204?void 0:await O.json();if(O.status===200&&if$(W,K)){let D=O.headers.get("etag");if(D)R96(F,D,w)}return{status:O.status,json:w}}return{owner:Z,repo:X,async getDefaultBranch(){if(G)return G;let{json:W}=await J("GET",Y);return G=W.default_branch,G},async getHeadSha(W){let{json:K}=await J("GET",`${Y}/git/ref/heads/${$_(W)}`);return K.object.sha},async getTarballStream(W){let K=`${Y}/tarball/${$_(W)}`,H=await fetch(`${mf$()}${K}`,{headers:{"User-Agent":"studio-decofile",Authorization:`token ${Q}`},signal:AbortSignal.timeout(60000)});if(!H.ok){let N=await H.text().catch(()=>"");throw new V6(H.status,"GET",K,N.slice(0,300))}if(!H.body)throw new V6(502,"GET",K,"tarball had no body");return H.body},async getCommitTreeSha(W){let{json:K}=await J("GET",`${Y}/git/commits/${W}`);return K.tree.sha},async getTreeRecursive(W){let{json:K}=await J("GET",`${Y}/git/trees/${W}?recursive=1`);if(K.truncated)throw new V6(502,"GET",`${Y}/git/trees/${W}`,"tree listing truncated by GitHub; repo too large for recursive read");return K.tree},async getBlobText(W){let{json:K}=await J("GET",`${Y}/git/blobs/${W}`);if(K.encoding!=="base64")throw new V6(502,"GET",`${Y}/git/blobs/${W}`,`unexpected blob encoding ${K.encoding}`);return Buffer.from(K.content,"base64").toString("utf-8")},async createBlob(W){let{json:K}=await J("POST",`${Y}/git/blobs`,{content:W,encoding:"utf-8"});return K.sha},async createTree(W,K){let{json:H}=await J("POST",`${Y}/git/trees`,{base_tree:W,tree:K});return H.sha},async createCommit({message:W,treeSha:K,parentShas:H}){let{json:N}=await J("POST",`${Y}/git/commits`,{message:W,tree:K,parents:H});return N.sha},async updateRef(W,K){await J("PATCH",`${Y}/git/refs/heads/${$_(W)}`,{sha:K,force:!1})},async createRef(W,K){await J("POST",`${Y}/git/refs`,{ref:`refs/heads/${W}`,sha:K})},async mergeBranch(W,K,H){let{status:N,json:F}=await J("POST",`${Y}/merges`,{base:W,head:K,commit_message:H},{allow:[204]});return N===204?null:F?.sha??null},async createPullRequest({base:W,head:K,title:H}){let{json:N}=await J("POST",`${Y}/pulls`,{base:W,head:K,title:H});return{number:N.number,html_url:N.html_url}},async findOpenPullRequest(W,K){let{json:H}=await J("GET",`${Y}/pulls?state=open&base=${encodeURIComponent(W)}&head=${encodeURIComponent(`${Z}:${K}`)}`),N=H[0];return N?{number:N.number,html_url:N.html_url}:null},async compare(W,K){let{json:H}=await J("GET",`${Y}/compare/${$_(W)}...${$_(K)}`);return{aheadBy:H.ahead_by,behindBy:H.behind_by}},async compareDetailed(W,K){let{json:H}=await J("GET",`${Y}/compare/${$_(W)}...${$_(K)}`);return{aheadBy:H.ahead_by,behindBy:H.behind_by,mergeBaseSha:H.merge_base_commit.sha,files:(H.files??[]).map((N)=>({filename:N.filename,status:N.status,sha:N.sha,...N.previous_filename?{previousFilename:N.previous_filename}:{}}))}}}}function $_($){return $.split("/").map(encodeURIComponent).join("/")}var P96=512,A96=8388608,T96=262144,Fh,T61=0,V6;var Z_=B(()=>{Fh=new Map;V6=class V6 extends Error{status;method;path;constructor($,Z,X,Q){super(`GitHub ${Z} ${X} failed (${$}): ${Q}`);this.status=$;this.method=Z;this.path=X;this.name="GitHubApiError"}}});async function Oz0($,Z,X){if(!X.connectionId)throw new V6(401,"AUTH","connection","Project's GitHub connection is missing \u2014 reconnect GitHub");let Q=await $.storage.connections.findById(X.connectionId,Z);if(!Q)throw new V6(401,"AUTH","connection","Project's GitHub connection is missing \u2014 reconnect GitHub");let Y=await I96($,Q);if(!Y)throw new V6(401,"AUTH","connection",VZ);return pf$({owner:X.owner,repo:X.name,accessToken:Y})}async function I96($,Z){if(z5(Z)?.sourceConnectionId)return wx($,Z);return(await SY({connectionId:Z.id,connectionUrl:Z.connection_url,tokenStorage:new R6($.db,$.vault)})).accessToken}var R61=B(()=>{DQ();X90();eW();TY();Z_()});function q96($){if(!$||$.includes("\\")||$.includes("..")||$.includes("\x00"))return!0;try{let Z=decodeURIComponent($);if(Z.includes("\\")||Z.includes("..")||Z.includes("\x00"))return!0;if(Z!==$&&Z.includes("/")){let X=($.match(/\//g)??[]).length;if((Z.match(/\//g)??[]).length>X)return!0}return!1}catch{return!0}}function wz0($){if(q96($))throw Error(`Invalid block key: ${$||"(empty)"}`)}function Hr($){let Z=$;for(;;){let X;try{X=decodeURIComponent(Z)}catch{return Z}if(X===Z)return Z;Z=X}}function I61($){return wz0($),encodeURIComponent($)}function Nr($){let Z=[...$].sort((Y,G)=>{let J=`${Y.stem}.json`,W=`${G.stem}.json`;return J<W?-1:J>W?1:0}),X="{",Q=!0;for(let Y of Z){let G=Y.content.trim();if(G.length===0)continue;if(!Q)X+=",";Q=!1,X+=`${JSON.stringify(Hr(Y.stem))}:${G}`}return`${X}}`}var tf$=()=>{};var Bz0=B(()=>{tf$()});function M96($){return $.startsWith("merged/")?"merged":"blobs"}function q61($,Z){let X=new Map;for(let G of $){let J=X.get(G.path);if(!J||G.mtimeMs>=J.mtimeMs)X.set(G.path,{bytes:G.bytes,mtimeMs:G.mtimeMs})}let Q=[...X.entries()].sort((G,J)=>G[1].mtimeMs-J[1].mtimeMs),Y={config:Z,entries:new Map,totalBytes:0,areaBytes:{blobs:0,merged:0}};for(let[G,{bytes:J}]of Q){let W=M96(G);Y.entries.set(G,{bytes:J,area:W}),Y.totalBytes+=J,Y.areaBytes[W]+=J}return Y}function of$($,Z){let X=$.entries.get(Z);if(!X)return;$.entries.delete(Z),$.entries.set(Z,X)}function Uh($,Z){let X=$.entries.get(Z);if(!X)return;$.entries.delete(Z),$.totalBytes-=X.bytes,$.areaBytes[X.area]-=X.bytes}function rf$($,Z){let{path:X,bytes:Q,area:Y}=Z,{config:G}=$;if(!Number.isFinite(Q)||Q<0||Q>G.maxEntryBytes[Y]||Q>G.maxTotalBytes||Y==="merged"&&Q>G.maxMergedBytes)return{admitted:!1,evict:[]};let W=$.entries.get(X),K=$.totalBytes-(W?.bytes??0),H=$.areaBytes.merged-(W?.area==="merged"?W.bytes:0),N=[],F=new Set;if(Y==="merged")for(let[U,O]of $.entries){if(H+Q<=G.maxMergedBytes)break;if(U===X||O.area!=="merged")continue;N.push(U),F.add(U),H-=O.bytes,K-=O.bytes}for(let[U,O]of $.entries){if(K+Q<=G.maxTotalBytes)break;if(U===X||F.has(U))continue;N.push(U),F.add(U),K-=O.bytes}for(let U of N)Uh($,U);return Uh($,X),$.entries.set(X,{bytes:Q,area:Y}),$.totalBytes+=Q,$.areaBytes[Y]+=Q,{admitted:!0,evict:N}}function Fr($){if($==="")throw TypeError("cache path segment must not be empty");let Z=$.toLowerCase(),X="";for(let Q of new TextEncoder().encode(Z)){let Y=String.fromCharCode(Q);X+=/[a-z0-9._-]/.test(Y)?Y:`%${Q.toString(16).padStart(2,"0")}`}if(X==="."||X==="..")X=X.replaceAll(".","%2e");return X}function M61($){return/^[0-9a-f]{40}$/.test($)}import{randomUUID as Xb$}from"crypto";import{mkdir as Ur,readdir as k96,readFile as S96,rename as V96,rm as Qb$,stat as Yb$,statfs as C96,unlink as _96,writeFile as v96}from"fs/promises";import{tmpdir as f96}from"os";import{dirname as b96,join as T7}from"path";function Oh($,Z){let X=Bun.env[$];if(X===void 0||X==="")return Z;let Q=Number(X);return Number.isFinite(Q)&&Q>=0?Math.floor(Q):Z}function g96(){if(Dz0)return Dz0;let $=Bun.env.FAST_PREVIEW_CACHE_DIR,Z=$===void 0?T7(f96(),"studio-fast-preview-cache"):$;return Dz0={enabled:Z!=="",root:Z,index:{maxTotalBytes:Oh("FAST_PREVIEW_CACHE_MAX_BYTES",2*af$),maxMergedBytes:Oh("FAST_PREVIEW_CACHE_MERGED_MAX_BYTES",512*Lz0),maxEntryBytes:{blobs:Oh("FAST_PREVIEW_CACHE_MAX_BLOB_BYTES",Lz0),merged:Oh("FAST_PREVIEW_CACHE_MAX_MERGED_BYTES",32*Lz0)}},freeFloorBytes:Oh("FAST_PREVIEW_CACHE_FREE_FLOOR_BYTES",af$),sweepIntervalMs:Oh("FAST_PREVIEW_CACHE_SWEEP_INTERVAL_MS",600000)},Dz0}function h96(){return{hits:{blobs:0,merged:0},misses:{blobs:0,merged:0},evictions:0,errors:0,floorSkips:0,invalidKeySkips:0,admissionRefusals:0}}function u96(){if(XB)return;XB={hits:k$.createCounter("fast_preview_cache_hits",{description:"Decofile disk cache hits by area",unit:"{reads}"}),misses:k$.createCounter("fast_preview_cache_misses",{description:"Decofile disk cache misses by area",unit:"{reads}"}),evictions:k$.createCounter("fast_preview_cache_evictions",{description:"Decofile disk cache entries evicted",unit:"{entries}"}),errors:k$.createCounter("fast_preview_cache_errors",{description:"Decofile disk cache swallowed errors by operation",unit:"{errors}"}),floorSkips:k$.createCounter("fast_preview_cache_floor_skips",{description:"Decofile disk cache writes skipped by the free-space floor",unit:"{writes}"})},k$.createObservableGauge("fast_preview_cache_bytes",{description:"Decofile disk cache bytes by area",unit:"By"}).addCallback(($)=>{if(!wh)return;$.observe(wh.index.areaBytes.blobs,{area:"blobs"}),$.observe(wh.index.areaBytes.merged,{area:"merged"})}),k$.createObservableGauge("fast_preview_cache_entries",{description:"Decofile disk cache entry count by area",unit:"{entries}"}).addCallback(($)=>{if(!wh)return;let Z={blobs:0,merged:0};for(let X of wh.index.entries.values())Z[X.area]+=1;$.observe(Z.blobs,{area:"blobs"}),$.observe(Z.merged,{area:"merged"})})}function c96($){X_.hits[$]+=1,XB?.hits.add(1,{area:$})}function sf$($){X_.misses[$]+=1,XB?.misses.add(1,{area:$})}function k61(){X_.evictions+=1,XB?.evictions.add(1)}function WF($){X_.errors+=1,XB?.errors.add(1,{op:$})}function l96($){X_.invalidKeySkips+=1,XB?.errors.add(1,{op:`${$}_invalid_key`})}function S61(){return ef$??=m96(),ef$}async function m96(){let $=g96();if(!$.enabled)return null;u96();try{await Ur(T7($.root,"blobs"),{recursive:!0}),await Ur(T7($.root,"merged"),{recursive:!0}),await Ur(T7($.root,"tmp"),{recursive:!0})}catch{return WF("init"),null}let Z=[];try{Z=await Gb$($.root)}catch{WF("scan"),Z=[]}let X={root:$.root,index:q61(Z,$.index),cfg:$};return wh=X,p96(X),X}async function Ez0($){try{return await k96($)}catch{return[]}}async function Gb$($){let Z=[];for(let X of["blobs","merged"]){let Q=T7($,X);for(let Y of await Ez0(Q)){let G=T7(Q,Y);for(let J of await Ez0(G)){let W=T7(G,J);for(let K of await Ez0(W))try{let H=await Yb$(T7(W,K));if(!H.isFile())continue;Z.push({path:`${X}/${Y}/${J}/${K}`,bytes:H.size,mtimeMs:H.mtimeMs})}catch{}}}}return Z}function Jb$($,Z,X){if(!M61(X))return null;try{return`blobs/${Fr($)}/${Fr(Z)}/${X}`}catch{return null}}function Wb$($,Z,X){if(!M61(X))return null;try{return`merged/${Fr($)}/${Fr(Z)}/${X}.json`}catch{return null}}async function Kb$($,Z){try{let X=await S61();if(!X)return null;if(Z===null)return sf$($),null;try{let Q=await S96(T7(X.root,Z),"utf8");return of$(X.index,Z),c96($),Q}catch{return sf$($),null}}catch{return WF(`get_${$}`),null}}function Hb$($,Z,X){return Kb$("blobs",Jb$($,Z,X))}function Nb$($,Z,X){return Kb$("merged",Wb$($,Z,X))}async function i96($){if($.cfg.freeFloorBytes<=0)return!0;try{let Z=await C96($.root);return Z.bavail*Z.bsize>=$.cfg.freeFloorBytes}catch{return!0}}async function jz0($){try{await _96($)}catch{}}async function n96($){try{let Z=$.cfg.index.maxTotalBytes/2;while($.index.totalBytes>Z){let X=$.index.entries.keys().next();if(X.done)break;Uh($.index,X.value),await jz0(T7($.root,X.value)),k61()}}catch{WF("emergency_evict")}}async function Fb$($,Z,X,Q){try{let Y=await S61();if(!Y)return;if(X===null){l96(Z);return}if(!await i96(Y)){X_.floorSkips+=1,XB?.floorSkips.add(1);return}let G=Buffer.byteLength(Q,"utf8"),J=rf$(Y.index,{path:X,bytes:G,area:$});if(!J.admitted){X_.admissionRefusals+=1;return}for(let K of J.evict)await jz0(T7(Y.root,K)),k61();let W=T7(Y.root,"tmp",`stage-${Xb$()}`);try{await v96(W,Q,"utf8");let K=T7(Y.root,X);await Ur(b96(K),{recursive:!0}),await V96(W,K)}catch(K){if(Uh(Y.index,X),await jz0(W),WF(Z),K?.code==="ENOSPC")await n96(Y)}}catch{WF(Z)}}function zz0($,Z,X,Q){return Fb$("blobs","put_blob",Jb$($,Z,X),Q)}function Ub$($,Z,X,Q){return Fb$("merged","put_merged",Wb$($,Z,X),Q)}async function Ob$(){try{let $=await S61();if(!$)return null;let Z=T7($.root,"tmp",Xb$());return await Ur(Z,{recursive:!0}),Z}catch{return WF("make_scratch"),null}}async function wb$($){try{await Qb$($,{recursive:!0,force:!0})}catch{WF("remove_scratch")}}function p96($){let Z=$.cfg.sweepIntervalMs;if(Z<=0)return;$b$=new AbortController,C$(Math.random()*Z,{signal:$b$.signal}).then(()=>{Zb$($);let X=setInterval(()=>void Zb$($),Z);X.unref?.(),d96=X}).catch(()=>{})}async function Zb$($){try{let Z=q61(await Gb$($.root),$.cfg.index),X=$.cfg.index;for(let[G,J]of Z.entries){let W=Z.totalBytes>X.maxTotalBytes,K=Z.areaBytes.merged>X.maxMergedBytes;if(!W&&!K)break;if(!W&&K&&J.area!=="merged")continue;Uh(Z,G),await jz0(T7($.root,G)),k61()}$.index=Z;let Q=T7($.root,"tmp"),Y=Date.now();for(let G of await Ez0(Q)){let J=T7(Q,G);try{let W=await Yb$(J);if(Y-W.mtimeMs>y96)await Qb$(J,{recursive:!0,force:!0})}catch{}}}catch{WF("sweep")}}var x96=1024,Lz0,af$,y96=3600000,Dz0=null,XB=null,X_,ef$=null,wh=null,d96=null,$b$=null;var Bb$=B(()=>{$6();v6();Lz0=1024*x96,af$=1024*Lz0;X_=h96()});function Db$(){let $=new Map;return{run(Z,X){let Q=$.get(Z);if(Q)return Q;let Y=Promise.resolve().then(X).finally(()=>{$.delete(Z)});return $.set(Z,Y),Y}}}import{readdir as t96,stat as o96}from"fs/promises";import{join as Lb$}from"path";function r96($,Z,X){let Q=["-xz","--strip-components=1","-C",Z];return $==="gnu"?[...Q,"--wildcards",X]:[...Q,X]}function a96(){return Eb$??=(async()=>{try{let $=Bun.spawn(["tar","--version"],{stdin:"ignore",stdout:"pipe",stderr:"ignore"}),Z=await new Response($.stdout).text();return await $.exited,Z.includes("GNU")?"gnu":"bsd"}catch{return"bsd"}})(),Eb$}async function jb$($,Z,X){let Q=X.replace(/^\.\//,"").replace(/^\/+/,"").replace(/\/+$/,"");if(Q===""||Q.split("/").includes(".."))throw new Or(`invalid blocks path prefix: ${X}`);let Y=await a96(),G=`*/${Q}/*.json`,J=()=>Bun.spawn(["tar",...r96(Y,Z,G)],{stdin:$,stdout:"ignore",stderr:"pipe"}),W;try{W=J()}catch(F){throw new Or("failed to spawn tar",{cause:F})}let K=new Response(W.stderr).text().catch(()=>""),H=await W.exited;if(H!==0){let F=(await K).trim().slice(0,500);throw new Or(`tar exited with code ${H}${F?`: ${F}`:""}`)}let N=await s96(Z,Q);if(N.length===0)throw new Or(`tar extracted no ${G} members into ${Z}`);return N}async function s96($,Z){let X=Lb$($,...Z.split("/")),Q;try{Q=await t96(X)}catch{return[]}let Y=[];for(let G of Q){if(!G.endsWith(".json"))continue;let J=Lb$(X,G);try{if(!(await o96(J)).isFile())continue}catch{continue}Y.push({path:`${Z}/${G}`,diskPath:J})}return Y.sort((G,J)=>G.path.localeCompare(J.path))}var Or,Eb$=null;var zb$=B(()=>{Or=class Or extends Error{constructor($,Z){super($,Z);this.name="TarExtractError"}}});import{createHash as e96}from"crypto";import{readFile as $Z6}from"fs/promises";async function wr($,Z){try{return await $.getHeadSha(Z)}catch(Q){if(!(Q instanceof V6)||Q.status!==404)throw Q}let X=await $.getHeadSha(await $.getDefaultBranch());try{return await $.createRef(Z,X),X}catch(Q){if(Q instanceof V6&&Q.status===422)return $.getHeadSha(Z);throw Q}}function XZ6(){let $=Bun.env.FAST_PREVIEW_COLD_TARBALL_MAX_BYTES;if($===void 0||$==="")return Ab$;let Z=Number($);return Number.isFinite(Z)&&Z>=0?Math.floor(Z):Ab$}function QZ6($){Tb$??=k$.createCounter("decofile_cold_reads",{description:"Decofile cold snapshot reads by resolution path",unit:"{reads}"}),Tb$.add(1,{path:$})}async function Pz0($,Z,X){let Q=Array($.length),Y=0,G=Array.from({length:Math.min(Z,$.length)},async()=>{for(;;){let J=Y++;if(J>=$.length)return;Q[J]=await X($[J])}});return await Promise.all(G),Q}function Az0($){return $?`${$}/.deco/blocks`:".deco/blocks"}function V61($,Z){let X=`${Az0(Z)}/`,Q=[];for(let Y of $){if(Y.type!=="blob"||!Y.path.startsWith(X))continue;let G=Y.path.slice(X.length);if(G.includes("/"))continue;if(!G.toLowerCase().endsWith(".json"))continue;Q.push({stem:G.slice(0,-5),sha:Y.sha,path:Y.path,size:Y.size})}return Q}function C61($,Z){return $.filter((X)=>Hr(X.stem)===Z).map((X)=>X.path).sort()}function Rb$($,Z,X,Q){return zz0($,Z,X,Q)}function YZ6($,Z){if(!Z)return $;return e96("sha1").update(`${$}:${Z}`).digest("hex")}async function Ib$($,Z,X,Q){let Y=Q?.createBranchIfMissing?await wr($,Z):await $.getHeadSha(Z);return GZ6.run(`${$.owner}/${$.repo}@${Y}:${X??""}`,()=>JZ6($,Y,X))}async function JZ6($,Z,X){let{owner:Q,repo:Y}=$,G=YZ6(Z,X),J=await Nb$(Q,Y,G);if(J!==null)return{sha:Z,decofile:J};let W=await $.getCommitTreeSha(Z),K=await $.getTreeRecursive(W),H=V61(K,X),N=new Map;if(await Pz0(H,Pb$,async(w)=>{let D=await Hb$(Q,Y,w.sha);if(D!==null)N.set(w.path,D)}),H.length-N.size>ZZ6){let w=await WZ6($,Z,X,H);if(QZ6(w!==null?"tarball":"blobs"),w!==null)for(let[D,L]of w)N.set(D,L)}let U=await Pz0(H,Pb$,async(w)=>{let D=N.get(w.path);if(D!==void 0)return{stem:w.stem,content:D};let L=await $.getBlobText(w.sha);return await zz0(Q,Y,w.sha,L),{stem:w.stem,content:L}}),O=Nr(U);return await Ub$(Q,Y,G,O),{sha:Z,decofile:O}}async function WZ6($,Z,X,Q){let Y=`${$.owner}/${$.repo}`,G=XZ6(),J=0;for(let K of Q){if(K.size===void 0)return console.warn("decofile cold read: tarball skipped (tree entry missing size; cannot pre-validate)",{repo:Y,sha:Z,path:K.path}),null;J+=K.size}if(J>G)return console.warn("decofile cold read: tarball skipped (blocks over FAST_PREVIEW_COLD_TARBALL_MAX_BYTES)",{repo:Y,sha:Z,aggregateBytes:J,maxBytes:G}),null;let W=await Ob$();if(W===null)return null;try{let K=await $.getTarballStream(Z),H=await jb$(K,W,Az0(X)),N=new Map(Q.map((U)=>[U.path,U.sha])),F=new Map;for(let U of H){let O=N.get(U.path);if(O===void 0)continue;let w=await $Z6(U.diskPath,"utf8");await zz0($.owner,$.repo,O,w),F.set(U.path,w)}return F}catch(K){return console.warn("decofile cold read: tarball path failed; falling back to blob fetches",{repo:Y,sha:Z,error:K instanceof Error?K.message:String(K)}),null}finally{await wb$(W)}}var Pb$=12,ZZ6=50,Ab$=134217728,Tb$=null,GZ6;var Tz0=B(()=>{Bz0();v6();Bb$();Z_();zb$();GZ6=Db$()});async function Rz0($,Z){let X=await $.getDefaultBranch(),Q=await wr($,Z),Y=X===Z?{aheadBy:0,behindBy:0}:await $.compare(X,Z);return{not_added:[],conflicted:[],created:[],deleted:[],modified:[],renamed:[],files:[],staged:[],ahead:0,behind:0,current:Z,tracking:`origin/${Z}`,detached:!1,base:X,aheadOfBase:Y.aheadBy,behindBase:Y.behindBy,headSha:Q,unpushed:0}}async function Iz0($,Z,X){let Q=X??await $.getDefaultBranch(),Y=await $.compareDetailed(Q,Z),G=Y.files.slice(0,KZ6),J=await $.getCommitTreeSha(Y.mergeBaseSha),W=await $.getTreeRecursive(J),K=new Map(W.filter((N)=>N.type==="blob").map((N)=>[N.path,N.sha])),H=await Pz0(G,HZ6,async(N)=>{let F=N.previousFilename??N.filename,U=N.status==="added"?void 0:K.get(F),O=U?await $.getBlobText(U):null,w=N.status==="removed"?null:await $.getBlobText(N.sha);return[N.filename,{from:O,to:w}]});return{diffs:Object.fromEntries(H),mergeBaseSha:Y.mergeBaseSha}}async function qb$($,Z,X,Q="fail"){try{await $.mergeBranch(Z,X,`chore(decofile): merge ${X} into ${Z}`);return}catch(Y){if(!(Y instanceof V6&&Y.status===409))throw Y;if(Q!=="branch-wins")throw new V6(409,"POST","merges",`Merge conflict updating ${Z} from ${X} \u2014 resolve on GitHub`)}await UZ6($,Z,X)}async function UZ6($,Z,X){for(let Q=1;;Q++){let Y=await $.getHeadSha(Z),G=await $.getHeadSha(X),{files:J}=await $.compareDetailed(X,Z);if(J.length>=NZ6)throw new V6(409,"POST","merges",`Too many changed files on ${Z} to auto-merge (${J.length}); resolve on GitHub`);let W=await $.getTreeRecursive(await $.getCommitTreeSha(Y)),K=new Map(W.filter((U)=>U.type==="blob").map((U)=>[U.path,U])),H=[];for(let U of J){let O=K.get(U.filename);if(U.status==="removed"||!O)H.push({path:U.filename,mode:"100644",type:"blob",sha:null});else H.push({path:U.filename,mode:"100644",type:"blob",sha:O.sha});if(U.previousFilename&&U.previousFilename!==U.filename)H.push({path:U.previousFilename,mode:"100644",type:"blob",sha:null})}let N=await $.createTree(await $.getCommitTreeSha(G),H),F=await $.createCommit({message:`chore(decofile): merge ${X} into ${Z} (branch content wins)`,treeSha:N,parentShas:[Y,G]});try{await $.updateRef(Z,F);return}catch(U){if(U instanceof V6&&U.status===422&&Q<FZ6)continue;throw U}}}var KZ6=200,HZ6=12,NZ6=300,FZ6=3;var Mb$=B(()=>{Z_();Tz0()});function wZ6($){if(!$||$.includes(".."))return!1;return OZ6.test($)}function kb$($){let Z=typeof $.__resolveType==="string"?$.__resolveType:null;if(!Z||!wZ6(Z))return null;let{__resolveType:X,...Q}=$;return{resolveType:Z,payload:Q}}function Sb$($,Z){return`${$.replace(/\/+$/,"")}/deco/invoke/${Z}`}var OZ6;var Vb$=B(()=>{OZ6=/^[\w./@-]+$/});function _61($){let Z;try{Z=new URL($)}catch{return null}if(!Z.hostname.endsWith(".localhost"))return null;let X=Z.host;return Z.hostname="127.0.0.1",{url:Z.toString(),hostHeader:X}}function Br($,Z){let X=$?.githubRepo;if(!X?.owner||!X?.name)return null;if(!X.connectionId)return X;if(!Z.includes(X.connectionId))return null;return X}async function Cb$($,Z,X,Q){if(!Q.connectionId)throw new Bh("Push requires a connected GitHub account. Connect mcp-github for this project and restart the sandbox.");let Y=$.organization?.id;if(!Y)throw new Bh(VZ);await SO({ctx:$,connectionId:Q.connectionId,organizationId:Y,forceRefresh:!0,onLegacyMintError:(N)=>{let F=N instanceof Error?N.message:VZ;throw new Bh(F)}});let{cloneUrl:G,gitUserName:J,gitUserEmail:W}=await VO(Q.connectionId,Q.owner,Q.name,$.db,$.vault),K=Nh($),H=await Z.proxyDaemonRequest(X,"/_sandbox/config",{method:"PUT",headers:new Headers({"content-type":"application/json"}),body:JSON.stringify({git:{repository:{cloneUrl:G},identity:{userName:J,userEmail:W}},...K?{operator:K}:{}})});if(!H.ok){let N=await pO(H,BZ6).catch(()=>H.statusText);throw Error(`Failed to refresh sandbox git credentials (${H.status}): ${N}`)}}var BZ6=10485760,Bh;var v61=B(()=>{eW();Fz0();Xn();Bx();Bh=class Bh extends Error{constructor($){super($);this.name="GitPushAuthError"}}});function LZ6($){let Z=$.startsWith("thread:")?$.slice(7):$;if(!Z||Z.length>255||Z.includes("..")||Z.startsWith("/")||Z.endsWith("/")||Z.endsWith(".lock")||!DZ6.test(Z))throw Error(`Invalid branch name: ${$}`)}function Q_($){return AbortSignal.any([$.req.raw.signal,AbortSignal.timeout(jZ6)])}function Y_($){let{runner:Z}=$.get("vmClaim");if(!Z)return $.json({error:"No sandbox runner configured"},503);return Z}async function Dr($){let{virtualMcpMetadata:Z,connectionIds:X}=$.get("vmClaim"),Q=$.var.studioContext,Y=Br(Z,X);if(!Y)throw new V6(404,"AUTH","repo","Project has no GitHub repository");let G=o(Q);return Oz0(Q,G.id,Y)}function f61($,Z){if(Z instanceof V6){let Q=Z.status===404?404:Z.status===409||Z.status===422?409:502;return $.json({error:Z.message},Q,j9)}let X=Z instanceof Error?Z.message:String(Z);return $.json({error:X},502,j9)}async function fb$($){try{let Z=await Dr($),X=await Rz0(Z,$.get("vmClaim").branch);return $.json(X,200,j9)}catch(Z){return f61($,Z)}}function Mz0($,Z){let Q=(qz0.get($)??Promise.resolve()).catch(()=>{}).then(Z),Y=Q.catch(()=>{});return qz0.set($,Y),Y.finally(()=>{if(qz0.get($)===Y)qz0.delete($)}),Q}async function gZ($,Z,X){if($.get("vmClaim").fastPreview)return $.json({error:"sandbox not found: Fast Preview projects are sandbox-less"},404,j9);let Q=Y_($);if(Q instanceof Response)return Q;let{claimName:Y,userId:G,projectRef:J}=$.get("vmClaim"),W=X?.method??"POST",K=null,H=new Headers;if(X?.jsonBody!==void 0)K=X.jsonBody,H.set("content-type","application/json");else if(X?.forwardJsonBody)K=await $.req.text(),H.set("content-type","application/json");let N=X?.signal,F={method:W,headers:H,body:K,...N?{signal:N}:{}},U=async()=>{let O=await Q.proxyDaemonRequest(Y,Z,F);if(X?.map404to410&&O.status===404){try{await O.body?.cancel()}catch{}if(await Q.adoptLiveClaim?.({userId:G,projectRef:J},Y))O=await Q.proxyDaemonRequest(Y,Z,F);if(O.status===404){try{await O.body?.cancel()}catch{}return new Response(JSON.stringify({error:"Sandbox handle is gone. The sandbox needs to be re-provisioned."}),{status:410,headers:{"content-type":"application/json",...j9}})}}let w=await O.text(),D=X?.redactRepoDirUnlessDesktop&&Q.kind!=="user-desktop"?PZ6(w):w,L=O.headers.get("content-type")??"application/json";return new Response(D,{status:O.status,headers:{"content-type":L,...j9}})};try{if(N){let O=U();return O.catch(()=>{}),await Promise.race([O,new Promise((D,L)=>{if(N.aborted)return L(N.reason);N.addEventListener("abort",()=>L(N.reason),{once:!0})})])}return await U()}catch(O){let w=O instanceof Error?O.message:String(O);return $.json({error:`Daemon unreachable: ${w}`},502)}}function PZ6($){try{let Z=JSON.parse($);if(Z&&typeof Z==="object"&&!Array.isArray(Z)&&"repoDir"in Z)return JSON.stringify({...Z,repoDir:null})}catch{}return $}async function kz0($,Z,X,Q="GET",Y){let G=await $.proxyDaemonRequest(Z,X,{method:Q,headers:new Headers,body:null});if(G.status===404&&Y){try{await G.body?.cancel()}catch{}if(await $.adoptLiveClaim?.(Y,Z))G=await $.proxyDaemonRequest(Z,X,{method:Q,headers:new Headers,body:null})}if(G.status===404){try{await G.body?.cancel()}catch{}throw Error("SANDBOX_GONE")}let J=await G.text();if(!G.ok){let W=`Daemon error (${G.status})`;try{W=JSON.parse(J).error??W}catch{}throw Error(W)}return JSON.parse(J)}function AZ6($){return bb$.includes($)}var DZ6,_b$=524288,EZ6=65536,jZ6=1e4,vb$=2000,zZ6,qz0,j9,bb$,xb$=()=>{let $=new U1;$.use("/:virtualMcpId/:branch/*",zZ6),$.post("/:virtualMcpId/:branch/write",(X)=>gZ(X,"/_sandbox/write",{forwardJsonBody:!0,signal:Q_(X)})),$.post("/:virtualMcpId/:branch/unlink",(X)=>gZ(X,"/_sandbox/unlink",{forwardJsonBody:!0,signal:Q_(X)})),$.post("/:virtualMcpId/:branch/mkdir",(X)=>gZ(X,"/_sandbox/mkdir",{forwardJsonBody:!0,signal:Q_(X)})),$.post("/:virtualMcpId/:branch/rename",(X)=>gZ(X,"/_sandbox/rename",{forwardJsonBody:!0,signal:Q_(X)})),$.post("/:virtualMcpId/:branch/read",(X)=>gZ(X,"/_sandbox/read",{forwardJsonBody:!0,signal:Q_(X)})),$.post("/:virtualMcpId/:branch/glob",(X)=>gZ(X,"/_sandbox/glob",{forwardJsonBody:!0,signal:Q_(X)})),$.post("/:virtualMcpId/:branch/grep",(X)=>gZ(X,"/_sandbox/grep",{forwardJsonBody:!0,signal:Q_(X)})),$.post("/:virtualMcpId/:branch/exec/:script",async(X)=>{let Q=X.req.param("script");if(!Q)return X.json({error:"missing script name"},400);return gZ(X,`/_sandbox/exec/${encodeURIComponent(Q)}`)}),$.post("/:virtualMcpId/:branch/exec/:script/kill",async(X)=>{let Q=X.req.param("script");if(!Q)return X.json({error:"missing script name"},400);return gZ(X,`/_sandbox/exec/${encodeURIComponent(Q)}/kill`)}),$.get("/:virtualMcpId/:branch/config",(X)=>gZ(X,"/_sandbox/config",{method:"GET",map404to410:!0,redactRepoDirUnlessDesktop:!0})),$.put("/:virtualMcpId/:branch/config",(X)=>gZ(X,"/_sandbox/config",{method:"PUT",forwardJsonBody:!0,map404to410:!0})),$.post("/:virtualMcpId/:branch/setup/:step",async(X)=>{let Q=X.req.param("step");if(!Q||!AZ6(Q))return X.json({error:`step must be one of: ${bb$.join(", ")}`},400);if(Q==="start"){let Y=X.get("vmClaim");if(Y.runner){let G=o(X.var.studioContext),J=_x(Y.virtualMcpMetadata);try{await _U0({ctx:X.var.studioContext,runner:Y.runner,handle:Y.claimName,orgId:G.id,userId:Y.callerUserId,entries:J})}catch(W){let K=W instanceof Error?W.message:String(W);return X.json({error:`Failed to push env to daemon: ${K}`},502)}}}return gZ(X,`/_sandbox/setup/${Q}`,{signal:X.req.raw.signal,map404to410:!0})}),$.get("/:virtualMcpId/:branch/events",(X)=>{let Q=X.get("vmClaim");if(!Q.runner)return JF(X,async(Y)=>{await Y.writeSSE({event:"phase",data:JSON.stringify({kind:"failed",reason:"unknown",message:"No sandbox runner configured on this studio instance."})})});return ff$(X,{ctx:X.var.studioContext,claimName:Q.claimName,runner:Q.runner,virtualMcpId:Q.virtualMcpId,branch:Q.branch,userId:Q.userId,projectRef:Q.projectRef,virtualMcpMetadata:Q.virtualMcpMetadata})}),$.get("/:virtualMcpId/:branch/git/status",(X)=>{if(X.get("vmClaim").fastPreview)return fb$(X);return Z(X)});let Z=(X)=>gZ(X,"/_sandbox/git/status",{method:"GET",map404to410:!0,signal:AbortSignal.any([X.req.raw.signal,AbortSignal.timeout(vb$)])});return $.post("/:virtualMcpId/:branch/git/status",(X)=>{if(X.get("vmClaim").fastPreview)return fb$(X);return gZ(X,"/_sandbox/git/status",{map404to410:!0,signal:AbortSignal.any([X.req.raw.signal,AbortSignal.timeout(vb$)])})}),$.post("/:virtualMcpId/:branch/git/diff",async(X)=>{let Q=X.get("vmClaim");if(Q.fastPreview)try{let Y=await X.req.json().catch(()=>({})),G=await Dr(X),J=await Iz0(G,Q.branch,Y.base);return X.json(J,200,j9)}catch(Y){return f61(X,Y)}return gZ(X,"/_sandbox/git/diff",{forwardJsonBody:!0,map404to410:!0})}),$.post("/:virtualMcpId/:branch/git/publish",async(X)=>{if(X.get("vmClaim").fastPreview)return X.json({ok:!0},200,j9);let Q=Y_(X);if(Q instanceof Response)return Q;let{claimName:Y,virtualMcpMetadata:G,connectionIds:J}=X.get("vmClaim"),W=X.var.studioContext;return Mz0(Y,async()=>{try{await B61(W,Q,Y);let K=Br(G,J);if(K)await Cb$(W,Q,Y,K)}catch(K){if(K instanceof Bh)return X.json({error:K.message},403,j9);let H=K instanceof Error?K.message:String(K);return X.json({error:H},502,j9)}return gZ(X,"/_sandbox/git/publish",{forwardJsonBody:!0,map404to410:!0})})}),$.post("/:virtualMcpId/:branch/git/discard",async(X)=>{let{claimName:Q,fastPreview:Y}=X.get("vmClaim");if(Y)return X.json({error:"Nothing to discard: Fast Preview projects have no working tree"},400,j9);return Mz0(Q,()=>gZ(X,"/_sandbox/git/discard",{forwardJsonBody:!0,map404to410:!0}))}),$.post("/:virtualMcpId/:branch/git/rebase",async(X)=>{let Q=X.get("vmClaim");if(Q.fastPreview)return Mz0(Q.claimName,async()=>{try{let W=await X.req.json().catch(()=>({})),K=await Dr(X),H=W.base??await K.getDefaultBranch();return await qb$(K,Q.branch,H,W.onConflict==="branch-wins"?"branch-wins":"fail"),X.json({ok:!0},200,j9)}catch(W){return f61(X,W)}});let Y=Y_(X);if(Y instanceof Response)return Y;let{claimName:G}=X.get("vmClaim"),J=X.var.studioContext;return Mz0(G,async()=>{try{await B61(J,Y,G)}catch(W){let K=W instanceof Error?W.message:String(W);return X.json({error:K},502,j9)}return gZ(X,"/_sandbox/git/rebase",{forwardJsonBody:!0,map404to410:!0})})}),$.post("/:virtualMcpId/:branch/git/suggest-commit",FZ({maxSize:_b$,onError:(X)=>X.json({error:"Payload too large"},413,j9)}),async(X)=>{let Q=X.get("vmClaim"),Y=null;if(!Q.fastPreview){let H=Y_(X);if(H instanceof Response)return H;Y=H}let{claimName:G,userId:J,projectRef:W}=Q,K=X.var.studioContext;try{let H=await X.req.json().catch(()=>({})),N=H.status,F=H.diff,U=F!=null&&typeof F.diffs==="object"&&F.diffs!==null,[O,w]=E61(N)&&U?[N,F]:Y?await Promise.all([kz0(Y,G,"/_sandbox/git/status","GET",{userId:J,projectRef:W}),kz0(Y,G,"/_sandbox/git/diff","GET",{userId:J,projectRef:W})]):await(async()=>{let L=await Dr(X);return Promise.all([Rz0(L,Q.branch),Iz0(L,Q.branch)])})(),D=await hf$(K,O,w);return X.json(D,200,j9)}catch(H){let N=H instanceof Error?H.message:String(H);if(N==="SANDBOX_GONE")return X.json({error:"Sandbox handle is gone. The sandbox needs to be re-provisioned."},410,j9);return X.json({error:N},502,j9)}}),$.post("/:virtualMcpId/:branch/git/judge-review",FZ({maxSize:_b$,onError:(X)=>X.json({error:"Payload too large"},413,j9)}),async(X)=>{let Q=X.get("vmClaim"),Y=null;if(!Q.fastPreview){let H=Y_(X);if(H instanceof Response)return H;Y=H}let{claimName:G,userId:J,projectRef:W}=Q,K=X.var.studioContext;try{let H=await X.req.json().catch(()=>({})),N=H.status,F=H.diff,U=F!=null&&typeof F.diffs==="object"&&F.diffs!==null,[O,w]=E61(N)&&U?[N,F]:Y?await Promise.all([kz0(Y,G,"/_sandbox/git/status","GET",{userId:J,projectRef:W}),kz0(Y,G,"/_sandbox/git/diff","GET",{userId:J,projectRef:W})]):await(async()=>{let L=await Dr(X);return Promise.all([Rz0(L,Q.branch),Iz0(L,Q.branch)])})(),D=await cf$(K,O,w,typeof H.language==="string"?H.language:void 0);return X.json(D,200,j9)}catch(H){let N=H instanceof Error?H.message:String(H);if(N==="SANDBOX_GONE")return X.json({error:"Sandbox handle is gone. The sandbox needs to be re-provisioned."},410,j9);return X.json({error:N},502,j9)}}),$.get("/:virtualMcpId/:branch/preview-fetch",async(X)=>{let Q=Y_(X);if(Q instanceof Response)return Q;let{claimName:Y}=X.get("vmClaim"),G=X.req.query("path");if(!G||!G.startsWith("/")||G.startsWith("//")||G.includes("..")||G.includes("\\"))return X.json({error:"Path not allowed"},403);let J;try{J=await Q.getPreviewUrl(Y)}catch{return X.json({error:"Preview not available"},502)}if(!J)return X.json({error:"Preview not available"},502);let W=J.replace(/\/+$/,""),K=_61(`${W}${G}`),H;try{H=await fetch(K?.url??`${W}${G}`,{...K?{headers:{host:K.hostHeader}}:{}})}catch{return X.json({error:"Preview unreachable"},502)}let N;try{N=await H.text()}catch{return X.json({error:"Preview unreachable"},502)}return new Response(N,{status:H.status,headers:{"content-type":H.headers.get("content-type")??"application/json"}})}),$.post("/:virtualMcpId/:branch/preview-invoke",FZ({maxSize:EZ6,onError:(X)=>X.json({error:"Payload too large"},413)}),async(X)=>{let Q=Y_(X);if(Q instanceof Response)return Q;let{claimName:Y}=X.get("vmClaim"),G;try{G=await Q.getPreviewUrl(Y)}catch{return X.json({error:"Preview not available"},502)}if(!G)return X.json({error:"Preview not available"},502);let J;try{J=await X.req.json()}catch{return X.json({error:"Invalid JSON body"},400)}if(!J||typeof J!=="object"||Array.isArray(J))return X.json({error:"Invalid JSON body"},400);let W=kb$(J);if(!W)return X.json({error:"Invalid or missing __resolveType"},400);let K=Sb$(G,W.resolveType),H=_61(K),N;try{N=await fetch(H?.url??K,{method:"POST",headers:{"content-type":"application/json",...H?{host:H.hostHeader}:{}},body:JSON.stringify(W.payload),signal:AbortSignal.timeout(30000)})}catch{return X.json({error:"Preview unreachable"},502)}let F;try{F=await N.text()}catch{return X.json({error:"Preview unreachable"},502)}return new Response(F,{status:N.status,headers:{"content-type":N.headers.get("content-type")??"application/json"}})}),$};var yb$=B(()=>{C8();aw();Hh();w61();WN();_f$();T3();dO();vf$();bf$();mm0();$n();P61();lf$();R61();Z_();Mb$();Vb$();v61();DZ6=/^[a-zA-Z0-9][a-zA-Z0-9/._-]*$/;zZ6=Nz0(async($,Z)=>{let X=$.var.studioContext;try{Z0(X)}catch{return $.json({error:"Unauthorized"},401)}let Q=W1(X);if(!Q)return $.json({error:"Unauthorized"},401);let Y;try{Y=o(X)}catch{return $.json({error:"Organization scope required"},403)}let G=$.req.param("virtualMcpId"),J=$.req.param("branch");if(!G||!J)return $.json({error:"virtualMcpId and branch are required"},400);try{LZ6(J)}catch(O){let w=O instanceof Error?O.message:String(O);return $.json({error:w},400)}let W=await X.storage.virtualMcps.findById(G);if(!W||W.organization_id!==Y.id)return $.json({error:"Virtual MCP not found"},404);let K=Ai({orgId:Y.id,virtualMcpId:G,branch:J}),H=await DN(X,J,Q),N=Cf$({userId:H,projectRef:K}),F=W.metadata??null;if(F?.fastPreview===!0&&Uz0(F))return $.set("vmClaim",{claimName:N,callerUserId:Q,runner:null,virtualMcpId:G,branch:J,userId:H,projectRef:K,virtualMcpMetadata:F,connectionIds:W.connections?.map((O)=>O.connection_id)??[],fastPreview:!0}),Z();let U;try{U=(await dX(X,{userId:H,branch:J,virtualMcpMetadata:F})).provider}catch{U=null}if(!U)return $.json({error:"No sandbox runner found"},404);return $.set("vmClaim",{claimName:N,callerUserId:Q,runner:U,virtualMcpId:G,branch:J,userId:H,projectRef:K,virtualMcpMetadata:F,connectionIds:W.connections?.map((O)=>O.connection_id)??[]}),Z()});qz0=new Map;j9={"Cache-Control":"no-store, no-cache, must-revalidate",Pragma:"no-cache"};bb$=["clone","install","start"]});function gb$($,Z,X){let Q=b61.get($);if(!Q)Q={pending:null,running:!1},b61.set($,Q);if(!Q.pending)Q.pending={set:new Map,del:new Set,deps:Z,resolvers:[],rejecters:[]};let Y=Q.pending;Y.deps=Z;for(let[J,W]of Object.entries(X.set??{}))Y.set.set(J,W),Y.del.delete(J);for(let J of X.delete??[])Y.del.add(J),Y.set.delete(J);let G=new Promise((J,W)=>{Y.resolvers.push(J),Y.rejecters.push(W)});if(!Q.running)RZ6($,Q);return G}async function RZ6($,Z){Z.running=!0;try{while(Z.pending){let X=Z.pending;Z.pending=null;try{let Q=await IZ6(X);for(let Y of X.resolvers)Y(Q)}catch(Q){for(let Y of X.rejecters)Y(Q)}}}finally{if(Z.running=!1,!Z.pending)b61.delete($)}}async function IZ6($){let{client:Z,branch:X,packagePath:Q}=$.deps;for(let Y=0;;Y++){let G=await wr(Z,X),J=await Z.getCommitTreeSha(G),W=await Z.getTreeRecursive(J),K=V61(W,Q),H=[],N=new Map(K.map((w)=>[w.path,{stem:w.stem,sha:w.sha}]));for(let[w,D]of $.set){let L=C61(K,w),E=`${JSON.stringify(D,null,2)}
-`,j=await Z.createBlob(E);await Rb$(Z.owner,Z.repo,j,E);let z=L[0]??`${Az0(Q)}/${I61(w)}.json`;H.push({path:z,mode:"100644",type:"blob",sha:j});let A=z.slice(z.lastIndexOf("/")+1,-5);N.set(z,{stem:A,sha:j,content:E});for(let P of L.slice(1))H.push({path:P,mode:"100644",type:"blob",sha:null}),N.delete(P)}for(let w of $.del)for(let D of C61(K,w))H.push({path:D,mode:"100644",type:"blob",sha:null}),N.delete(D);if(H.length===0)return G;let F=Q?`${Q}/.deco/blocks.gen.json`:".deco/blocks.gen.json";if(W.some((w)=>w.type==="blob"&&w.path===F)){let w=await Promise.all([...N.values()].map(async(L)=>({stem:L.stem,content:L.content??await Z.getBlobText(L.sha)}))),D=await Z.createBlob(Nr(w));H.push({path:F,mode:"100644",type:"blob",sha:D})}let U=await Z.createTree(J,H),O=await Z.createCommit({message:qZ6($),treeSha:U,parentShas:[G]});try{return await Z.updateRef(X,O),O}catch(w){if(!(w instanceof V6&&w.status===422)||Y>=TZ6-1)throw w;await C$(cZ(2000,200,Y,2,0.5))}}}function qZ6($){let Z=(Y)=>{let G=Y.slice(0,3).join(", ");return Y.length>3?`${G} (+${Y.length-3} more)`:G},X=[];if($.set.size>0)X.push(`update ${Z([...$.set.keys()])}`);if($.del.size>0)X.push(`delete ${Z([...$.del])}`);let Q=`chore(decofile): ${X.join("; ")}`;return wl0(Q,$.deps.coAuthor)}var TZ6=3,b61;var hb$=B(()=>{IU0();Bz0();$6();Z_();Tz0();b61=new Map});import{createHmac as ub$,randomBytes as MZ6,timingSafeEqual as kZ6}from"crypto";function cb$(){if(Sz0)return Sz0;let $;try{let Z=y0();$=Z.studioJwtSecret??Z.betterAuthSecret}catch{$=void 0}return Sz0=$?Buffer.from($):MZ6(32),Sz0}function x61($){let Z=$.nowMs??Date.now(),X={o:$.organizationId,m:$.virtualMcpId,b:$.branch,e:Math.floor((Z+SZ6)/1000)},Q=Buffer.from(JSON.stringify(X)).toString("base64url"),Y=ub$("sha256",cb$()).update(Q).digest("base64url");return`${Q}.${Y}`}function lb$($,Z){let X=$.indexOf(".");if(X<0)return!1;let Q=$.slice(0,X),Y=Buffer.from($.slice(X+1)),G=Buffer.from(ub$("sha256",cb$()).update(Q).digest("base64url"));if(Y.length!==G.length||!kZ6(Y,G))return!1;let J;try{J=JSON.parse(Buffer.from(Q,"base64url").toString())}catch{return!1}let W=Math.floor((Z.nowMs??Date.now())/1000);return J.o===Z.organizationId&&J.m===Z.virtualMcpId&&J.b===Z.branch&&typeof J.e==="number"&&J.e>=W}var SZ6=21600000,Sz0=null;var db$=B(()=>{R$()});import{z as Dh}from"zod";function CZ6($){return $.length>0&&$.length<=255&&!$.includes("..")&&!$.endsWith("/")&&!$.endsWith(".lock")&&VZ6.test($)}function ib$($){return $.req.header("x-forwarded-host")??new URL($.req.url).host}async function Vz0($){let Z=$.get("decofileScope");return Oz0($.var.studioContext,Z.organizationId,Z.githubRepo)}function Cz0($,Z){if(Z instanceof V6){let Q=Z.status===404?404:Z.status===409?409:Z.status===422?409:502;return $.json({error:Z.message},Q)}let X=Z instanceof Error?Z.message:String(Z);return $.json({error:X},500)}function nb$(){let $=new U1;return $.use("/:virtualMcpId/:branch",mb$),$.use("/:virtualMcpId/:branch/*",mb$),$.get("/:virtualMcpId/:branch",async(Z)=>{let X=Z.get("decofileScope");try{let Q=await Vz0(Z),Y=await Ib$(Q,X.branch,X.packagePath,{createBranchIfMissing:!!X.userId}),G={ETag:`"${Y.sha}"`,"Cache-Control":"no-store","Access-Control-Allow-Origin":"*"};if(Z.req.header("if-none-match")===`"${Y.sha}"`)return Z.body(null,304,G);if(!X.userId)return Z.body(Y.decofile,200,{...G,"content-type":"application/json"});let J=x61({organizationId:X.organizationId,virtualMcpId:X.virtualMcpId,branch:X.branch});return Z.body(`{"version":${JSON.stringify(Y.sha)},"token":${JSON.stringify(J)},"apiHost":${JSON.stringify(ib$(Z))},"decofile":${Y.decofile}}`,200,{...G,"content-type":"application/json"})}catch(Q){return Cz0(Z,Q)}}),$.patch("/:virtualMcpId/:branch",async(Z)=>{let X=Z.get("decofileScope"),Q=Z.var.studioContext,Y=_Z6.safeParse(await Z.req.json().catch(()=>null));if(!Y.success)return Z.json({error:"Invalid body",details:Y.error.issues},400);let G=Y.data;for(let J of[...Object.keys(G.set??{}),...G.delete??[]])try{wz0(J)}catch(W){let K=W instanceof Error?W.message:String(W);return Z.json({error:K},400)}for(let[J,W]of Object.entries(G.set??{}))if(typeof W!=="object"||W===null||Array.isArray(W))return Z.json({error:`Block "${J}" must be a JSON object`},400);try{let J=await Vz0(Z),W=await gb$(`${X.organizationId}/${X.virtualMcpId}/${X.branch}`,{client:J,branch:X.branch,packagePath:X.packagePath,coAuthor:Nh(Q)},G),K=x61({organizationId:X.organizationId,virtualMcpId:X.virtualMcpId,branch:X.branch});return Z.json({version:W,token:K,apiHost:ib$(Z)})}catch(J){return Cz0(Z,J)}}),$.post("/:virtualMcpId/:branch/publish",async(Z)=>{let X=Z.get("decofileScope");try{let Q=await Vz0(Z),Y=await Q.getDefaultBranch();if(Y===X.branch)return Z.json({error:"Branch is already the default branch"},400);try{let G=await Q.mergeBranch(Y,X.branch,`chore(decofile): publish ${X.branch}`);return G?Z.json({result:"merged",sha:G}):Z.json({result:"up-to-date"})}catch(G){if(G instanceof V6&&G.status===409)return Z.json({error:"merge-conflict"},409);if(G instanceof V6&&G.status===405){let W=await Q.findOpenPullRequest(Y,X.branch)??await Q.createPullRequest({base:Y,head:X.branch,title:`Publish ${X.branch}`});return Z.json({result:"pull-request",number:W.number,url:W.html_url})}throw G}}catch(Q){return Cz0(Z,Q)}}),$.get("/:virtualMcpId/:branch/status",async(Z)=>{let X=Z.get("decofileScope");try{let Q=await Vz0(Z),Y=await Q.getDefaultBranch();if(Y===X.branch)return Z.json({baseBranch:Y,aheadBy:0,behindBy:0});try{let{aheadBy:G,behindBy:J}=await Q.compare(Y,X.branch);return Z.json({baseBranch:Y,aheadBy:G,behindBy:J})}catch(G){if(G instanceof V6&&G.status===404)return Z.json({baseBranch:Y,aheadBy:0,behindBy:0});throw G}}catch(Q){return Cz0(Z,Q)}}),$}var VZ6,_Z6,mb$;var pb$=B(()=>{Bz0();C8();w61();Fz0();v61();R61();hb$();db$();Z_();Tz0();VZ6=/^[a-zA-Z0-9][a-zA-Z0-9/._-]*$/;_Z6=Dh.object({set:Dh.record(Dh.string(),Dh.unknown()).optional(),delete:Dh.array(Dh.string()).optional()}).refine(($)=>Object.keys($.set??{}).length>0||($.delete?.length??0)>0,{message:"Patch must set or delete at least one block"}),mb$=Nz0(async($,Z)=>{let X=$.var.studioContext,Q=X.organization;if(!Q)return $.json({error:"Organization scope required"},500);let Y=$.req.param("virtualMcpId"),G=$.req.param("branch");if(!Y||!G)return $.json({error:"virtualMcpId and branch are required"},400);if(!CZ6(G))return $.json({error:`Invalid branch name: ${G}`},400);let J=X.auth?.user?.id??null;if(!J){let O=$.req.query("token");if(!($.req.method==="GET"&&!$.req.path.match(/\/(publish|status)$/)))return $.json({error:"Unauthorized"},401);if(!O||!lb$(O,{organizationId:Q.id,virtualMcpId:Y,branch:G}))return $.json({error:"Unauthorized"},401)}let W=await X.storage.virtualMcps.findById(Y);if(!W||W.organization_id!==Q.id)return $.json({error:"Virtual MCP not found"},404);let K=W.metadata??null;if(!Uz0(K)||K?.fastPreview!==!0)return $.json({error:"Fast Preview is not enabled for this project"},404);let N=W.connections?.map((O)=>O.connection_id)??[],F=Br(K,N);if(!F)return $.json({error:"Project has no GitHub repository"},404);let U=K?.runtime;return $.set("decofileScope",{organizationId:Q.id,virtualMcpId:Y,branch:G,packagePath:U?.path?.replace(/^\/+|\/+$/g,"")||null,githubRepo:F,userId:J}),Z()})});var tb$=($)=>{let Z=new U1;if(Z.use("*",iC),Z.route("/",Mj0()),Z.route("/",BC$()),Z.route("/",Ef$()),Z.route("/",Bf$()),Z.route("/",Wz0()),Z.route("/tools",If$()),Z.route("/",Af$()),Z.route("/",av$({kvStorage:$.kvStorage})),Z.route("/",ov$()),Z.route("/fs",Kf$({getConnection:$.getNatsConnection})),Z.route("/sandbox",xb$()),Z.route("/decofile",nb$()),Z.route("/",Uf$()),Z.route("/deco-sites",Sj0()),Z.route("/sso",Pj0()),Z.route("/",Kz0({tokenStorage:$.tokenStorage,automationEventDispatcher:$.automationEventDispatcher})),Z.route("/webhooks",WC$()),$.mountDevAssets)Z.route("/dev-assets",Vj0({orgFromPath:!0}));return Z.use("/mcp/:connectionId?",$.mcpAuth),Z.use("/mcp/:connectionId/ui-resource",$.mcpAuth),Z.use("/mcp/gateway/:virtualMcpId?",$.mcpAuth),Z.use("/mcp/virtual-mcp/:virtualMcpId?",$.mcpAuth),Z.use("/mcp/self",$.mcpAuth),Z.use("/mcp/task-run/:threadId",$.mcpAuth),Z.route("/",sk$()),Z.get("/mcp/:gateway?/:connectionId/.well-known/oauth-protected-resource/*",$.betterAuthProtectedResourceHandler),Z.get("/mcp/.well-known/oauth-protected-resource",$.betterAuthProtectedResourceHandler),Z.route("/mcp/task-run",Nf$()),Z.route("/mcp",dw0()),Z.route("/mcp/self",Jz0()),Z.route("/mcp",nw0()),Z.all("/oauth-proxy/:connectionId/*",$.oauthProxyHandler),Z.get("/watch",$.watchHandler),Z};var ob$=B(()=>{C8();b81();KC$();u81();Cj0();bo();v81();rv$();sv$();Hf$();tn();I81();pw0();W61();Ff$();Of$();Df$();jf$();Tf$();H61();qf$();N61();mw0();yb$();pb$()});function fZ6($){return $.filter((Z)=>Z.vendors?.alias).map((Z)=>({name:Z.name,title:Z.title,description:Z.description,logo:Z.logo,category:Z.category,vendor:{alias:Z.vendors.alias,url:Z.vendors.url}}))}async function bZ6($,Z){let X=await fetch(`${$}/rest/v1/apps?select=name,title,description,logo,category,vendors(alias,url)`,{headers:{apikey:Z,Authorization:`Bearer ${Z}`,Accept:"application/json"},signal:AbortSignal.timeout(vZ6)});if(!X.ok){let Q=await X.text().catch(()=>X.statusText);throw console.error(`[deco-apps] Supabase error (${X.status}): ${Q.slice(0,200)}`),Error(`External service error (${X.status})`)}return await X.json()}var vZ6=1e4,xZ6=async($,Z)=>{if(!$.get("studioContext").auth.user?.id)return $.json({error:"Unauthorized"},401);return Z()},rb$=()=>{let $=new U1;return $.use("*",xZ6),$.get("/",async(Z)=>{let X=y0(),Q=X.decoSupabaseUrl,Y=X.decoSupabaseServiceKey;if(!Q||!Y)return Z.json({apps:[]});try{let G=await bZ6(Q,Y);return Z.json({apps:fZ6(G)})}catch(G){return console.error("[deco-apps] GET error:",G),Z.json({error:"Failed to fetch apps"},502)}}),$};var ab$=B(()=>{C8();R$()});import{z as M1}from"zod";function lK($,Z="invalid_request_error",X=null,Q=null){return{error:{message:$,type:Z,param:X,code:Q}}}function nZ6($){if(!$)return null;let Z=$.indexOf(":");if(Z===-1)return{credentialId:null,modelId:$};let X=$.substring(0,Z),Q=$.substring(Z+1);if(!X||!Q)return null;return{credentialId:X,modelId:Q}}function pZ6($,Z,X){try{return JSON.parse($)}catch{throw new $x$(`Invalid JSON in tool call arguments for function '${X}' (tool_call_id: ${Z}): ${$}`)}}function tZ6($){let Z={};for(let X of $)if(X.role==="assistant"&&X.tool_calls)for(let Q of X.tool_calls)Z[Q.id]=Q.function.name;return $.map((X)=>{switch(X.role){case"system":return{role:"system",content:X.content};case"user":if(typeof X.content==="string")return{role:"user",content:X.content};return{role:"user",content:X.content.map((Y)=>{if(Y.type==="text")return{type:"text",text:Y.text};return{type:"image",image:Y.image_url.url}})};case"assistant":if(X.tool_calls&&X.tool_calls.length>0)return{role:"assistant",content:X.tool_calls.map((Y)=>({type:"tool-call",toolCallId:Y.id,toolName:Y.function.name,input:pZ6(Y.function.arguments,Y.id,Y.function.name)}))};return{role:"assistant",content:X.content??""};case"tool":let Q=Z[X.tool_call_id]??"unknown";return{role:"tool",content:[{type:"tool-result",toolCallId:X.tool_call_id,toolName:Q,output:{type:"text",value:X.content}}]}}})}function oZ6($){let Z=$.map((X)=>{let Q=X.function.parameters?MY(X.function.parameters):MY({type:"object",properties:{}});return[X.function.name,f$({description:X.function.description,inputSchema:Q})]});return Object.fromEntries(Z)}function rZ6($){if(!$)return;return{openai:{response_format:$}}}function aZ6(){return`chatcmpl-${crypto.randomUUID().replace(/-/g,"").substring(0,29)}`}function sb$($,Z,X,Q,Y,G){let J={model:$,messages:Z,tools:X,temperature:Q.temperature,maxTokens:Q.max_tokens,topP:Q.top_p,frequencyPenalty:Q.frequency_penalty,presencePenalty:Q.presence_penalty,stopSequences:Q.stop?Array.isArray(Q.stop)?Q.stop:[Q.stop]:void 0,abortSignal:G};return Y?{...J,providerOptions:Y}:J}function eb$($){if($==="tool-calls")return"tool_calls";if($==="length")return"length";return"stop"}var yZ6=256,gZ6,hZ6,uZ6,cZ6,lZ6,dZ6,mZ6,iZ6,$x$,Zx$,Xx$;var Qx$=B(()=>{C4();C8();Hh();hN();gZ6=M1.object({type:M1.literal("function"),function:M1.object({name:M1.string(),description:M1.string().optional(),parameters:M1.record(M1.string(),M1.unknown()).optional()})}),hZ6=M1.object({id:M1.string(),type:M1.literal("function"),function:M1.object({name:M1.string(),arguments:M1.string()})}),uZ6=M1.discriminatedUnion("role",[M1.object({role:M1.literal("system"),content:M1.string(),name:M1.string().optional()}),M1.object({role:M1.literal("user"),content:M1.union([M1.string(),M1.array(M1.union([M1.object({type:M1.literal("text"),text:M1.string()}),M1.object({type:M1.literal("image_url"),image_url:M1.object({url:M1.string(),detail:M1.string().optional()})})]))]),name:M1.string().optional()}),M1.object({role:M1.literal("assistant"),content:M1.string().nullable().optional(),name:M1.string().optional(),tool_calls:M1.array(hZ6).optional()}),M1.object({role:M1.literal("tool"),content:M1.string(),tool_call_id:M1.string()})]),cZ6=M1.object({type:M1.literal("text")}),lZ6=M1.object({type:M1.literal("json_object")}),dZ6=M1.object({type:M1.literal("json_schema"),json_schema:M1.object({name:M1.string(),description:M1.string().optional(),schema:M1.record(M1.string(),M1.unknown()),strict:M1.boolean().optional()})}),mZ6=M1.union([cZ6,lZ6,dZ6]),iZ6=M1.object({model:M1.string().describe("Format: 'model_id' or 'credential_id:model_id'"),messages:M1.array(uZ6),stream:M1.boolean().optional().default(!1),temperature:M1.number().min(0).max(2).optional(),max_tokens:M1.number().positive().optional(),top_p:M1.number().min(0).max(1).optional(),frequency_penalty:M1.number().min(-2).max(2).optional(),presence_penalty:M1.number().min(-2).max(2).optional(),stop:M1.union([M1.string(),M1.array(M1.string())]).optional(),tools:M1.array(gZ6).optional(),tool_choice:M1.union([M1.literal("auto"),M1.literal("none"),M1.literal("required"),M1.object({type:M1.literal("function"),function:M1.object({name:M1.string()})})]).optional(),response_format:mZ6.optional(),user:M1.string().optional()});$x$=class $x$ extends Error{constructor($){super($);this.name="MessageConversionError"}};Zx$=new U1;Zx$.post("/:org/v1/chat/completions",async($)=>{let Z=$.get("studioContext"),X=$.req.param("org");try{if(!Z.auth.apiKey?.id)return $.json(lK("API key authentication required. Provide a valid API key via Authorization header.","authentication_error"),401);if(!Z.organization)return $.json(lK("Organization context is required. Ensure your API key has organization metadata.","invalid_request_error","organization"),400);if((Z.organization.slug??Z.organization.id)!==X)return $.json(lK("Organization mismatch. The API key's organization does not match the requested organization.","invalid_request_error","organization"),403);let Q=await $.req.json(),Y=iZ6.safeParse(Q);if(!Y.success){let L=Y.error.issues[0]??{message:"Invalid request",path:[]};return $.json(lK(`Invalid request: ${L.message}`,"invalid_request_error",L.path.length>0?L.path.join("."):null),400)}let G=Y.data,J=nZ6(G.model);if(!J)return $.json(lK("Invalid model format. Expected 'model_id' or 'credential_id:model_id' (e.g., 'claude-sonnet-4-6' or 'key_abc123:claude-sonnet-4-6')","invalid_request_error","model"),400);let{credentialId:W}=J,{modelId:K}=J;if(!W){let E=(await Z.storage.aiProviderKeys.list({organizationId:Z.organization.id})).find((j)=>UD(j.providerId));if(!E)return $.json(lK("No AI provider credentials configured for this organization. Add a credential in settings or specify one explicitly via 'credential_id:model_id'.","invalid_request_error","model"),400);W=E.id}let H;try{H=await Z.aiProviders.activate(W,Z.organization.id)}catch{return $.json(lK(`AI provider credential not found or inaccessible: ${W}`,"invalid_request_error","model"),404)}let N=H.aiSdk.languageModel(K),F=tZ6(G.messages),U=G.tools?oZ6(G.tools):void 0,O=rZ6(G.response_format),w=aZ6(),D=Math.floor(Date.now()/1000);if(G.stream)return JF($,async(L)=>{let E=sb$(N,F,U,G,O,$.req.raw.signal);try{let j=MO(E),z=!1,A=0,P="",q=async()=>{if(P.length===0)return;let S=P;P="",await L.writeSSE({data:JSON.stringify({id:w,object:"chat.completion.chunk",created:D,model:G.model,choices:[{index:0,delta:{content:S},finish_reason:null}]})})};for await(let S of j.fullStream){if(!z&&(S.type==="text-delta"||S.type==="tool-call"))await L.writeSSE({data:JSON.stringify({id:w,object:"chat.completion.chunk",created:D,model:G.model,choices:[{index:0,delta:{role:"assistant",content:""},finish_reason:null}]})}),z=!0;if(S.type==="text-delta"){if(P+=S.text,P.length>=yZ6)await q()}else if(S.type==="tool-call"){await q();let M=A++;await L.writeSSE({data:JSON.stringify({id:w,object:"chat.completion.chunk",created:D,model:G.model,choices:[{index:0,delta:{tool_calls:[{index:M,id:S.toolCallId,type:"function",function:{name:S.toolName,arguments:JSON.stringify(S.input)}}]},finish_reason:null}]})})}else if(S.type==="finish")await q(),await L.writeSSE({data:JSON.stringify({id:w,object:"chat.completion.chunk",created:D,model:G.model,choices:[{index:0,delta:{},finish_reason:eb$(S.finishReason)}],usage:S.totalUsage?{prompt_tokens:S.totalUsage.inputTokens??0,completion_tokens:S.totalUsage.outputTokens??0,total_tokens:S.totalUsage.totalTokens??0}:void 0})})}await q(),await L.writeSSE({data:"[DONE]"})}catch(j){let z=j;console.error("[openai-compat:stream] Error:",z.message),await L.writeSSE({data:JSON.stringify({error:{message:z.message,type:"server_error"}})})}});else{let L=sb$(N,F,U,G,O,$.req.raw.signal),E=await IO(L),j={role:"assistant",content:E.text||null};if(E.toolCalls&&E.toolCalls.length>0)j.tool_calls=E.toolCalls.map((z)=>({id:z.toolCallId,type:"function",function:{name:z.toolName,arguments:JSON.stringify("input"in z?z.input:{})}})),j.content=null;return $.json({id:w,object:"chat.completion",created:D,model:G.model,choices:[{index:0,message:j,finish_reason:eb$(E.finishReason)}],usage:{prompt_tokens:E.usage?.inputTokens??0,completion_tokens:E.usage?.outputTokens??0,total_tokens:E.usage?.totalTokens??0}})}}catch(Q){let Y=Q;if(Y.name==="AbortError")return $.json(lK("Request aborted","invalid_request_error"),400);if(Y.name==="MessageConversionError")return $.json(lK(Y.message,"invalid_request_error","messages"),400);return console.error("[openai-compat] Error:",Y.message,Y.stack),$.json(lK(Y.message,"server_error"),500)}});Xx$=Zx$});var Gx$;var Yx$=B(()=>{Gx$={name:"decocms",version:"4.213.2",description:"Deco CMS \u2014 Self-hostable MCP Gateway for managing AI connections and tools",author:"Deco team",repository:{type:"git",url:"git+https://github.com/decocms/studio.git",directory:"apps/api"},bugs:{url:"https://github.com/decocms/studio/issues"},type:"module",bin:{deco:"./dist/server/cli.js"},files:["dist/**/*"],scripts:{dev:"bun run migrate && bun run dev:server","dev:server":"bun run --cwd=../../packages/sandbox build && NODE_ENV=development bun --env-file=.env --hot run src/index.ts",build:"bun run build:server","build:server":"bun run scripts/bundle-server-script.ts --dist ./dist/server","generate:tool-contracts":"bun run scripts/generate-tool-contracts.ts","db:migrate":"bun run ./dist/server/migrate.js",check:"tsc --noEmit",start:"bun run ./dist/server/server.js",migrate:"bun run src/database/migrate.ts",test:"bun test src","better-auth:migrate":"bunx --bun @better-auth/cli migrate -y --config src/auth/index.ts",prepublishOnly:"bun run --cwd=../.. build:studio"},optionalDependencies:{"@duckdb/node-api":"^1.5.0-r.1"},dependencies:{"@ai-sdk/anthropic":"^3.0.85","@ai-sdk/google":"^3.0.83","@ai-sdk/openai":"^3.0.73","@anthropic-ai/sdk":"^0.105.0","@aws-sdk/client-s3":"^3.1013.0","@aws-sdk/client-sts":"^3.1013.0","@aws-sdk/lib-storage":"^3.1013.0","@aws-sdk/s3-request-presigner":"^3.1013.0","@clickhouse/client":"^1.8.1","@dbos-inc/dbos-sdk":"^4.21.6","@inkjs/ui":"^2.0.0","@nats-io/jetstream":"3.4.0","@nats-io/kv":"3.4.0","@nats-io/nats-core":"3.4.0","@nats-io/transport-node":"3.4.0","@openrouter/ai-sdk-provider":"^2.9.1","@opentelemetry/core":"^2.6.0","embedded-postgres":"^18.3.0-beta.16",ink:"^6.8.0",kysely:"^0.28.12","posthog-node":"^5.0.0",react:"^19.2.6","react-dom":"^19.2.6"},devDependencies:{"@ai-sdk/provider":"^3.0.10","@better-auth/sso":"1.4.1","@decocms/better-auth":"1.5.17","@decocms/bindings":"workspace:*","@decocms/mcp-utils":"workspace:*","@decocms/runtime":"workspace:*","@decocms/sandbox":"workspace:*","@decocms/shared":"workspace:*","@jitl/quickjs-wasmfile-release-sync":"0.31.0","@modelcontextprotocol/sdk":"1.29.0","@nats-io/jwt":"0.0.10-5","@opentelemetry/api":"^1.9.0","@opentelemetry/api-logs":"^0.211.0","@opentelemetry/exporter-logs-otlp-proto":"^0.211.0","@opentelemetry/exporter-prometheus":"^0.208.0","@opentelemetry/exporter-trace-otlp-proto":"^0.207.0","@opentelemetry/instrumentation-runtime-node":"^0.24.0","@opentelemetry/resources":"^2.6.0","@opentelemetry/sdk-logs":"^0.211.0","@opentelemetry/sdk-metrics":"^2.2.0","@opentelemetry/sdk-node":"^0.207.0","@opentelemetry/sdk-trace-base":"^2.5.0","@types/bun":"^1.3.1","@types/google.maps":"^3.65.2","@types/pg":"^8.15.6","@types/react-syntax-highlighter":"^15.5.13","@vercel/nft":"^1.1.1",ai:"^6.0.208","better-auth":"1.4.22",croner:"^9.1.0",degit:"^2.8.4",hono:"^4.10.7",jose:"^6.0.11",nanoid:"^5.1.6",pg:"^8.16.3",typescript:"^7.0.2",typescript5:"npm:typescript@^5.9.3",zod:"4.3.6"},homepage:"https://github.com/decocms/studio",keywords:["mcp","model-context-protocol","ai","gateway","self-hosted","tools"],license:"MIT",publishConfig:{access:"public"}}});function $76(){let $=process.env.POSTHOG_KEY;if(!$)return null;return{key:$,host:process.env.POSTHOG_HOST??eZ6}}var Jx$,eZ6="https://ph.studio.decocms.com",Wx$;var Kx$=B(()=>{C8();oy0();gV();PZ();R$();z81();Yx$();Jx$=new U1;Jx$.get("/",($)=>{let Z={version:Gx$.version,theme:vc1(),...XL().logo&&{logo:XL().logo},...wK()&&{internalUrl:Kk1()},...y0().enableDecoImport&&{enableDecoImport:!0},brandExtractEnabled:!!y0().firecrawlApiKey,auth:IV$(),posthog:$76(),googleMapsApiKey:process.env.GOOGLE_MAPS_API_KEY?.trim()||null,runtime:{agentSandbox:!wK()&&y0().sandboxProviderKind==="agent-sandbox"}};return $.header("Cache-Control","no-store"),$.json({success:!0,config:Z})});Wx$=Jx$});function Lh($){let Z=($??"").trim().toLowerCase();return Z=Z.replace(/^https?:\/\//,""),Z=Z.replace(/^www\./,""),Z=Z.split(/[/?#]/)[0]??"",Z.replace(/\/+$/,"")}function y61($){return(Lh($).split(".")[0]||$).replace(/[-_]/g," ").split(" ").filter(Boolean).map((X)=>X.charAt(0).toUpperCase()+X.slice(1)).join(" ")}function Nx$($,Z=64){return`https://www.google.com/s2/favicons?domain=${encodeURIComponent(Lh($))}&sz=${Z}`}function Hx$($,Z){let X=$.trim();if(X.length<=Z)return X;let Q=X.slice(0,Z-1),Y=Q.lastIndexOf(" ");return`${(Y>Z*0.6?Q.slice(0,Y):Q).trimEnd()}\u2026`}function Fx$($){let{brand:Z,domain:X,score:Q,verdict:Y}=$,G=typeof Q==="number"?`${Z} commerce report \u2014 ${Math.round(Q)}/100 \xB7 decocms`:`${Z} commerce report \xB7 decocms`,J=`See the full ${Z} scorecard \u2014 SEO, performance, conversion & AEO signals scored by decocms.`,W=Y?.trim()?Hx$(`${Y.trim().replace(/\s+/g," ")} \u2014 ${J}`,200):Hx$(`How does ${X} really perform? ${J}`,200);return{title:G,description:W}}import{z as c0}from"zod";var G_,Z76,X76,Q76,Y76,Ux$;var Ox$=B(()=>{G_=c0.enum(["good","bad","neutral"]),Z76=c0.preprocess(($)=>{if(Array.isArray($))return{kind:"text",value:$.find((X)=>X!==null&&typeof X!=="object")??""};return $!==null&&typeof $==="object"?$:{kind:"text",value:$}},c0.object({kind:c0.enum(["text","number","sparkline","badge","score"]).catch("text"),value:c0.coerce.string().optional(),tone:G_.optional(),muted:c0.boolean().optional(),delta:c0.coerce.string().optional(),deltaDir:c0.enum(["up","down","neutral"]).optional(),points:c0.array(c0.coerce.number()).optional(),label:c0.coerce.string().optional()}).transform(($)=>{if($.kind==="badge"&&$.label==null)$.label=$.value??"";if($.kind==="score"){let Z=Number($.value);if(Number.isNaN(Z))return{...$,kind:"text"}}return $})),X76=c0.preprocess(($)=>{let Z=$;if(Z&&typeof Z==="object"&&!Array.isArray(Z)&&Array.isArray(Z.cells))Z=Z.cells;if(Array.isArray(Z)&&Z.length===1&&Array.isArray(Z[0]))Z=Z[0];if(Array.isArray(Z))return Z;if(Z&&typeof Z==="object")return Object.values(Z);return Z},c0.array(Z76)),Q76={key:c0.coerce.string(),title:c0.coerce.string(),eyebrow:c0.coerce.string().optional(),headline:c0.coerce.string(),annotation:c0.coerce.string().optional(),methodology:c0.coerce.string().optional(),sources:c0.array(c0.object({name:c0.coerce.string(),logoUrl:c0.coerce.string()})).optional()},Y76=c0.discriminatedUnion("template",[c0.object({template:c0.literal("cover"),score:c0.object({value:c0.coerce.number(),max:c0.coerce.number().optional(),grade:c0.coerce.string().optional(),label:c0.coerce.string().optional()}).optional(),brandImage:c0.coerce.string().optional(),screenshot:c0.coerce.string().optional(),mobileScreenshot:c0.coerce.string().optional()}),c0.object({template:c0.literal("cta"),ctaUrl:c0.coerce.string().optional(),ctaLabel:c0.coerce.string().optional(),bullets:c0.array(c0.coerce.string()).optional()}),c0.object({template:c0.literal("series"),points:c0.array(c0.coerce.number()).min(2),xLabels:c0.array(c0.coerce.string()).min(1),unit:c0.coerce.string().optional(),callout:c0.object({index:c0.coerce.number(),value:c0.coerce.string(),tone:G_.optional()})}),c0.object({template:c0.literal("threshold"),value:c0.coerce.string().default(""),metricLabel:c0.coerce.string().optional(),ratio:c0.coerce.number(),thresholdRatio:c0.coerce.number().optional(),thresholdLabel:c0.coerce.string().default(""),tone:G_.optional()}),c0.object({template:c0.literal("stats"),stats:c0.array(c0.object({value:c0.coerce.string(),label:c0.coerce.string(),tone:G_.optional()})).min(1)}),c0.object({template:c0.literal("bars"),items:c0.array(c0.object({value:c0.coerce.string(),label:c0.coerce.string(),ratio:c0.coerce.number(),tone:G_.optional()})).min(1)}),c0.object({template:c0.literal("gauges"),gauges:c0.array(c0.object({label:c0.coerce.string(),value:c0.coerce.string(),status:c0.enum(["good","warn","bad"]).catch("warn"),caption:c0.coerce.string().optional(),ratio:c0.coerce.number().optional()})).min(1)}),c0.object({template:c0.literal("checklist"),checks:c0.array(c0.object({label:c0.coerce.string(),status:c0.enum(["pass","fail","warn"]).catch("fail"),value:c0.coerce.string().optional()})).min(1)}),c0.object({template:c0.literal("table"),columns:c0.array(c0.object({label:c0.coerce.string(),align:c0.enum(["left","right"]).optional()})).min(1),rows:c0.array(X76).min(1),highlightRow:c0.coerce.number().optional()}),c0.object({template:c0.literal("products"),products:c0.array(c0.object({name:c0.coerce.string(),price:c0.coerce.string().optional(),image:c0.coerce.string().optional(),url:c0.coerce.string().optional()})).min(1)}),c0.object({template:c0.literal("list"),entries:c0.array(c0.object({label:c0.coerce.string(),severity:c0.enum(["error","warning","notice"]).catch("notice")})).min(1),moreCount:c0.coerce.number().optional()}),c0.object({template:c0.literal("keywords"),volumeLabel:c0.coerce.string().optional(),keywords:c0.array(c0.object({term:c0.coerce.string(),volume:c0.coerce.string(),position:c0.coerce.number().catch(0)})).min(1)}),c0.object({template:c0.literal("competitor"),metricLabel:c0.coerce.string().optional(),competitors:c0.array(c0.object({name:c0.coerce.string(),value:c0.coerce.string(),tone:G_.optional(),isYou:c0.boolean().optional()})).min(1)}),c0.object({template:c0.literal("scorecard"),rivalLabel:c0.coerce.string().optional(),dimensions:c0.array(c0.object({label:c0.coerce.string(),you:c0.coerce.string(),rival:c0.coerce.string().optional(),rivalName:c0.coerce.string().optional(),tone:G_.optional()})).min(1)})]),Ux$=c0.object({...Q76,template:Y76})});function _z0($){let Z=[],X=[...$.sections].sort((Y,G)=>Y.position-G.position).map((Y)=>{let G=Ux$.safeParse(Y.props);if(G.success)return G.data;let J=G.error.issues[0];return Z.push({section_type:Y.section_type,position:Y.position,reason:J?`${J.path.join(".")||"(root)"}: ${J.message}`:"contract violation"}),null}).filter((Y)=>Y!==null),Q=X.filter((Y)=>Y.template.template!=="cover"&&Y.template.template!=="cta").map((Y)=>({key:Y.key,title:Y.title}));return{deck:{meta:{...$.meta,scores:$.summary?.scores,scannedAt:$.scanned_at,toc:Q},slides:X},drops:Z}}var g61=B(()=>{Ox$()});import{join as wx$}from"path";async function J76($){try{let Z=await fetch(`${gW({})}/api/v2/public/diagnostics/${encodeURIComponent($)}`,{headers:{Accept:"application/json"},signal:AbortSignal.timeout(G76)});if(!Z.ok)return null;let X=await Z.json(),{deck:Q}=_z0(X);if(!Q.slides.length)return null;let Y=Q.slides.find((W)=>W.template.template==="cover"),G=Y?.template,J=G&&G.template==="cover"?G:void 0;return{brand:Q.meta.brand?.trim()||y61($),score:Q.meta.scores?.cover??J?.score?.value,verdict:Y?.annotation?.trim()||Y?.headline?.trim()||void 0}}catch{return null}}function oY($){return $.replaceAll("&","&amp;").replaceAll("<","&lt;").replaceAll(">","&gt;").replaceAll('"',"&quot;")}function W76($,Z){let X=Lh($),Q=Z?.brand?.trim()||y61(X),Y=Nx$(X,128),J=`${(y0().baseUrl??"https://studio.decocms.com").replace(/\/+$/,"")}/report/${encodeURIComponent(X)}`,{title:W,description:K}=Fx$({brand:Q,domain:X,score:Z?.score,verdict:Z?.verdict}),H=`${J}/og.png`,N=`${Q} commerce report by decocms`;return[`<title>${oY(W)}</title>`,`<meta name="description" content="${oY(K)}" />`,'<meta name="robots" content="noindex, follow" />','<meta property="og:type" content="website" />','<meta property="og:site_name" content="decocms" />',`<meta property="og:title" content="${oY(W)}" />`,`<meta property="og:description" content="${oY(K)}" />`,`<meta property="og:url" content="${oY(J)}" />`,`<meta property="og:image" content="${oY(H)}" />`,'<meta property="og:image:width" content="1200" />','<meta property="og:image:height" content="630" />',`<meta property="og:image:alt" content="${oY(N)}" />`,'<meta name="twitter:card" content="summary_large_image" />',`<meta name="twitter:title" content="${oY(W)}" />`,`<meta name="twitter:description" content="${oY(K)}" />`,`<meta name="twitter:image" content="${oY(H)}" />`,`<meta name="twitter:image:alt" content="${oY(N)}" />`,`<link rel="canonical" href="${oY(J)}" />`,`<link rel="icon" href="${oY(Y)}" sizes="any" />`].join(`
+`,j=await Z.createBlob(E);await Rb$(Z.owner,Z.repo,j,E);let z=L[0]??`${Az0(Q)}/${I61(w)}.json`;H.push({path:z,mode:"100644",type:"blob",sha:j});let A=z.slice(z.lastIndexOf("/")+1,-5);N.set(z,{stem:A,sha:j,content:E});for(let P of L.slice(1))H.push({path:P,mode:"100644",type:"blob",sha:null}),N.delete(P)}for(let w of $.del)for(let D of C61(K,w))H.push({path:D,mode:"100644",type:"blob",sha:null}),N.delete(D);if(H.length===0)return G;let F=Q?`${Q}/.deco/blocks.gen.json`:".deco/blocks.gen.json";if(W.some((w)=>w.type==="blob"&&w.path===F)){let w=await Promise.all([...N.values()].map(async(L)=>({stem:L.stem,content:L.content??await Z.getBlobText(L.sha)}))),D=await Z.createBlob(Nr(w));H.push({path:F,mode:"100644",type:"blob",sha:D})}let U=await Z.createTree(J,H),O=await Z.createCommit({message:qZ6($),treeSha:U,parentShas:[G]});try{return await Z.updateRef(X,O),O}catch(w){if(!(w instanceof V6&&w.status===422)||Y>=TZ6-1)throw w;await C$(cZ(2000,200,Y,2,0.5))}}}function qZ6($){let Z=(Y)=>{let G=Y.slice(0,3).join(", ");return Y.length>3?`${G} (+${Y.length-3} more)`:G},X=[];if($.set.size>0)X.push(`update ${Z([...$.set.keys()])}`);if($.del.size>0)X.push(`delete ${Z([...$.del])}`);let Q=`chore(decofile): ${X.join("; ")}`;return wl0(Q,$.deps.coAuthor)}var TZ6=3,b61;var hb$=B(()=>{IU0();Bz0();$6();Z_();Tz0();b61=new Map});import{createHmac as ub$,randomBytes as MZ6,timingSafeEqual as kZ6}from"crypto";function cb$(){if(Sz0)return Sz0;let $;try{let Z=y0();$=Z.studioJwtSecret??Z.betterAuthSecret}catch{$=void 0}return Sz0=$?Buffer.from($):MZ6(32),Sz0}function x61($){let Z=$.nowMs??Date.now(),X={o:$.organizationId,m:$.virtualMcpId,b:$.branch,e:Math.floor((Z+SZ6)/1000)},Q=Buffer.from(JSON.stringify(X)).toString("base64url"),Y=ub$("sha256",cb$()).update(Q).digest("base64url");return`${Q}.${Y}`}function lb$($,Z){let X=$.indexOf(".");if(X<0)return!1;let Q=$.slice(0,X),Y=Buffer.from($.slice(X+1)),G=Buffer.from(ub$("sha256",cb$()).update(Q).digest("base64url"));if(Y.length!==G.length||!kZ6(Y,G))return!1;let J;try{J=JSON.parse(Buffer.from(Q,"base64url").toString())}catch{return!1}let W=Math.floor((Z.nowMs??Date.now())/1000);return J.o===Z.organizationId&&J.m===Z.virtualMcpId&&J.b===Z.branch&&typeof J.e==="number"&&J.e>=W}var SZ6=21600000,Sz0=null;var db$=B(()=>{R$()});import{z as Dh}from"zod";function CZ6($){return $.length>0&&$.length<=255&&!$.includes("..")&&!$.endsWith("/")&&!$.endsWith(".lock")&&VZ6.test($)}function ib$($){return $.req.header("x-forwarded-host")??new URL($.req.url).host}async function Vz0($){let Z=$.get("decofileScope");return Oz0($.var.studioContext,Z.organizationId,Z.githubRepo)}function Cz0($,Z){if(Z instanceof V6){let Q=Z.status===404?404:Z.status===409?409:Z.status===422?409:502;return $.json({error:Z.message},Q)}let X=Z instanceof Error?Z.message:String(Z);return $.json({error:X},500)}function nb$(){let $=new U1;return $.use("/:virtualMcpId/:branch",mb$),$.use("/:virtualMcpId/:branch/*",mb$),$.get("/:virtualMcpId/:branch",async(Z)=>{let X=Z.get("decofileScope");try{let Q=await Vz0(Z),Y=await Ib$(Q,X.branch,X.packagePath,{createBranchIfMissing:!!X.userId}),G={ETag:`"${Y.sha}"`,"Cache-Control":"no-store","Access-Control-Allow-Origin":"*"};if(Z.req.header("if-none-match")===`"${Y.sha}"`)return Z.body(null,304,G);if(!X.userId)return Z.body(Y.decofile,200,{...G,"content-type":"application/json"});let J=x61({organizationId:X.organizationId,virtualMcpId:X.virtualMcpId,branch:X.branch});return Z.body(`{"version":${JSON.stringify(Y.sha)},"token":${JSON.stringify(J)},"apiHost":${JSON.stringify(ib$(Z))},"decofile":${Y.decofile}}`,200,{...G,"content-type":"application/json"})}catch(Q){return Cz0(Z,Q)}}),$.patch("/:virtualMcpId/:branch",async(Z)=>{let X=Z.get("decofileScope"),Q=Z.var.studioContext,Y=_Z6.safeParse(await Z.req.json().catch(()=>null));if(!Y.success)return Z.json({error:"Invalid body",details:Y.error.issues},400);let G=Y.data;for(let J of[...Object.keys(G.set??{}),...G.delete??[]])try{wz0(J)}catch(W){let K=W instanceof Error?W.message:String(W);return Z.json({error:K},400)}for(let[J,W]of Object.entries(G.set??{}))if(typeof W!=="object"||W===null||Array.isArray(W))return Z.json({error:`Block "${J}" must be a JSON object`},400);try{let J=await Vz0(Z),W=await gb$(`${X.organizationId}/${X.virtualMcpId}/${X.branch}`,{client:J,branch:X.branch,packagePath:X.packagePath,coAuthor:Nh(Q)},G),K=x61({organizationId:X.organizationId,virtualMcpId:X.virtualMcpId,branch:X.branch});return Z.json({version:W,token:K,apiHost:ib$(Z)})}catch(J){return Cz0(Z,J)}}),$.post("/:virtualMcpId/:branch/publish",async(Z)=>{let X=Z.get("decofileScope");try{let Q=await Vz0(Z),Y=await Q.getDefaultBranch();if(Y===X.branch)return Z.json({error:"Branch is already the default branch"},400);try{let G=await Q.mergeBranch(Y,X.branch,`chore(decofile): publish ${X.branch}`);return G?Z.json({result:"merged",sha:G}):Z.json({result:"up-to-date"})}catch(G){if(G instanceof V6&&G.status===409)return Z.json({error:"merge-conflict"},409);if(G instanceof V6&&G.status===405){let W=await Q.findOpenPullRequest(Y,X.branch)??await Q.createPullRequest({base:Y,head:X.branch,title:`Publish ${X.branch}`});return Z.json({result:"pull-request",number:W.number,url:W.html_url})}throw G}}catch(Q){return Cz0(Z,Q)}}),$.get("/:virtualMcpId/:branch/status",async(Z)=>{let X=Z.get("decofileScope");try{let Q=await Vz0(Z),Y=await Q.getDefaultBranch();if(Y===X.branch)return Z.json({baseBranch:Y,aheadBy:0,behindBy:0});try{let{aheadBy:G,behindBy:J}=await Q.compare(Y,X.branch);return Z.json({baseBranch:Y,aheadBy:G,behindBy:J})}catch(G){if(G instanceof V6&&G.status===404)return Z.json({baseBranch:Y,aheadBy:0,behindBy:0});throw G}}catch(Q){return Cz0(Z,Q)}}),$}var VZ6,_Z6,mb$;var pb$=B(()=>{Bz0();C8();w61();Fz0();v61();R61();hb$();db$();Z_();Tz0();VZ6=/^[a-zA-Z0-9][a-zA-Z0-9/._-]*$/;_Z6=Dh.object({set:Dh.record(Dh.string(),Dh.unknown()).optional(),delete:Dh.array(Dh.string()).optional()}).refine(($)=>Object.keys($.set??{}).length>0||($.delete?.length??0)>0,{message:"Patch must set or delete at least one block"}),mb$=Nz0(async($,Z)=>{let X=$.var.studioContext,Q=X.organization;if(!Q)return $.json({error:"Organization scope required"},500);let Y=$.req.param("virtualMcpId"),G=$.req.param("branch");if(!Y||!G)return $.json({error:"virtualMcpId and branch are required"},400);if(!CZ6(G))return $.json({error:`Invalid branch name: ${G}`},400);let J=X.auth?.user?.id??null;if(!J){let O=$.req.query("token");if(!($.req.method==="GET"&&!$.req.path.match(/\/(publish|status)$/)))return $.json({error:"Unauthorized"},401);if(!O||!lb$(O,{organizationId:Q.id,virtualMcpId:Y,branch:G}))return $.json({error:"Unauthorized"},401)}let W=await X.storage.virtualMcps.findById(Y);if(!W||W.organization_id!==Q.id)return $.json({error:"Virtual MCP not found"},404);let K=W.metadata??null;if(!Uz0(K)||K?.fastPreview!==!0)return $.json({error:"Fast Preview is not enabled for this project"},404);let N=W.connections?.map((O)=>O.connection_id)??[],F=Br(K,N);if(!F)return $.json({error:"Project has no GitHub repository"},404);let U=K?.runtime;return $.set("decofileScope",{organizationId:Q.id,virtualMcpId:Y,branch:G,packagePath:U?.path?.replace(/^\/+|\/+$/g,"")||null,githubRepo:F,userId:J}),Z()})});var tb$=($)=>{let Z=new U1;if(Z.use("*",iC),Z.route("/",Mj0()),Z.route("/",BC$()),Z.route("/",Ef$()),Z.route("/",Bf$()),Z.route("/",Wz0()),Z.route("/tools",If$()),Z.route("/",Af$()),Z.route("/",av$({kvStorage:$.kvStorage})),Z.route("/",ov$()),Z.route("/fs",Kf$({getConnection:$.getNatsConnection})),Z.route("/sandbox",xb$()),Z.route("/decofile",nb$()),Z.route("/",Uf$()),Z.route("/deco-sites",Sj0()),Z.route("/sso",Pj0()),Z.route("/",Kz0({tokenStorage:$.tokenStorage,automationEventDispatcher:$.automationEventDispatcher})),Z.route("/webhooks",WC$()),$.mountDevAssets)Z.route("/dev-assets",Vj0({orgFromPath:!0}));return Z.use("/mcp/:connectionId?",$.mcpAuth),Z.use("/mcp/:connectionId/ui-resource",$.mcpAuth),Z.use("/mcp/gateway/:virtualMcpId?",$.mcpAuth),Z.use("/mcp/virtual-mcp/:virtualMcpId?",$.mcpAuth),Z.use("/mcp/self",$.mcpAuth),Z.use("/mcp/task-run/:threadId",$.mcpAuth),Z.route("/",sk$()),Z.get("/mcp/:gateway?/:connectionId/.well-known/oauth-protected-resource/*",$.betterAuthProtectedResourceHandler),Z.get("/mcp/.well-known/oauth-protected-resource",$.betterAuthProtectedResourceHandler),Z.route("/mcp/task-run",Nf$()),Z.route("/mcp",dw0()),Z.route("/mcp/self",Jz0()),Z.route("/mcp",nw0()),Z.all("/oauth-proxy/:connectionId/*",$.oauthProxyHandler),Z.get("/watch",$.watchHandler),Z};var ob$=B(()=>{C8();b81();KC$();u81();Cj0();bo();v81();rv$();sv$();Hf$();tn();I81();pw0();W61();Ff$();Of$();Df$();jf$();Tf$();H61();qf$();N61();mw0();yb$();pb$()});function fZ6($){return $.filter((Z)=>Z.vendors?.alias).map((Z)=>({name:Z.name,title:Z.title,description:Z.description,logo:Z.logo,category:Z.category,vendor:{alias:Z.vendors.alias,url:Z.vendors.url}}))}async function bZ6($,Z){let X=await fetch(`${$}/rest/v1/apps?select=name,title,description,logo,category,vendors(alias,url)`,{headers:{apikey:Z,Authorization:`Bearer ${Z}`,Accept:"application/json"},signal:AbortSignal.timeout(vZ6)});if(!X.ok){let Q=await X.text().catch(()=>X.statusText);throw console.error(`[deco-apps] Supabase error (${X.status}): ${Q.slice(0,200)}`),Error(`External service error (${X.status})`)}return await X.json()}var vZ6=1e4,xZ6=async($,Z)=>{if(!$.get("studioContext").auth.user?.id)return $.json({error:"Unauthorized"},401);return Z()},rb$=()=>{let $=new U1;return $.use("*",xZ6),$.get("/",async(Z)=>{let X=y0(),Q=X.decoSupabaseUrl,Y=X.decoSupabaseServiceKey;if(!Q||!Y)return Z.json({apps:[]});try{let G=await bZ6(Q,Y);return Z.json({apps:fZ6(G)})}catch(G){return console.error("[deco-apps] GET error:",G),Z.json({error:"Failed to fetch apps"},502)}}),$};var ab$=B(()=>{C8();R$()});import{z as M1}from"zod";function lK($,Z="invalid_request_error",X=null,Q=null){return{error:{message:$,type:Z,param:X,code:Q}}}function nZ6($){if(!$)return null;let Z=$.indexOf(":");if(Z===-1)return{credentialId:null,modelId:$};let X=$.substring(0,Z),Q=$.substring(Z+1);if(!X||!Q)return null;return{credentialId:X,modelId:Q}}function pZ6($,Z,X){try{return JSON.parse($)}catch{throw new $x$(`Invalid JSON in tool call arguments for function '${X}' (tool_call_id: ${Z}): ${$}`)}}function tZ6($){let Z={};for(let X of $)if(X.role==="assistant"&&X.tool_calls)for(let Q of X.tool_calls)Z[Q.id]=Q.function.name;return $.map((X)=>{switch(X.role){case"system":return{role:"system",content:X.content};case"user":if(typeof X.content==="string")return{role:"user",content:X.content};return{role:"user",content:X.content.map((Y)=>{if(Y.type==="text")return{type:"text",text:Y.text};return{type:"image",image:Y.image_url.url}})};case"assistant":if(X.tool_calls&&X.tool_calls.length>0)return{role:"assistant",content:X.tool_calls.map((Y)=>({type:"tool-call",toolCallId:Y.id,toolName:Y.function.name,input:pZ6(Y.function.arguments,Y.id,Y.function.name)}))};return{role:"assistant",content:X.content??""};case"tool":let Q=Z[X.tool_call_id]??"unknown";return{role:"tool",content:[{type:"tool-result",toolCallId:X.tool_call_id,toolName:Q,output:{type:"text",value:X.content}}]}}})}function oZ6($){let Z=$.map((X)=>{let Q=X.function.parameters?MY(X.function.parameters):MY({type:"object",properties:{}});return[X.function.name,f$({description:X.function.description,inputSchema:Q})]});return Object.fromEntries(Z)}function rZ6($){if(!$)return;return{openai:{response_format:$}}}function aZ6(){return`chatcmpl-${crypto.randomUUID().replace(/-/g,"").substring(0,29)}`}function sb$($,Z,X,Q,Y,G){let J={model:$,messages:Z,tools:X,temperature:Q.temperature,maxTokens:Q.max_tokens,topP:Q.top_p,frequencyPenalty:Q.frequency_penalty,presencePenalty:Q.presence_penalty,stopSequences:Q.stop?Array.isArray(Q.stop)?Q.stop:[Q.stop]:void 0,abortSignal:G};return Y?{...J,providerOptions:Y}:J}function eb$($){if($==="tool-calls")return"tool_calls";if($==="length")return"length";return"stop"}var yZ6=256,gZ6,hZ6,uZ6,cZ6,lZ6,dZ6,mZ6,iZ6,$x$,Zx$,Xx$;var Qx$=B(()=>{C4();C8();Hh();hN();gZ6=M1.object({type:M1.literal("function"),function:M1.object({name:M1.string(),description:M1.string().optional(),parameters:M1.record(M1.string(),M1.unknown()).optional()})}),hZ6=M1.object({id:M1.string(),type:M1.literal("function"),function:M1.object({name:M1.string(),arguments:M1.string()})}),uZ6=M1.discriminatedUnion("role",[M1.object({role:M1.literal("system"),content:M1.string(),name:M1.string().optional()}),M1.object({role:M1.literal("user"),content:M1.union([M1.string(),M1.array(M1.union([M1.object({type:M1.literal("text"),text:M1.string()}),M1.object({type:M1.literal("image_url"),image_url:M1.object({url:M1.string(),detail:M1.string().optional()})})]))]),name:M1.string().optional()}),M1.object({role:M1.literal("assistant"),content:M1.string().nullable().optional(),name:M1.string().optional(),tool_calls:M1.array(hZ6).optional()}),M1.object({role:M1.literal("tool"),content:M1.string(),tool_call_id:M1.string()})]),cZ6=M1.object({type:M1.literal("text")}),lZ6=M1.object({type:M1.literal("json_object")}),dZ6=M1.object({type:M1.literal("json_schema"),json_schema:M1.object({name:M1.string(),description:M1.string().optional(),schema:M1.record(M1.string(),M1.unknown()),strict:M1.boolean().optional()})}),mZ6=M1.union([cZ6,lZ6,dZ6]),iZ6=M1.object({model:M1.string().describe("Format: 'model_id' or 'credential_id:model_id'"),messages:M1.array(uZ6),stream:M1.boolean().optional().default(!1),temperature:M1.number().min(0).max(2).optional(),max_tokens:M1.number().positive().optional(),top_p:M1.number().min(0).max(1).optional(),frequency_penalty:M1.number().min(-2).max(2).optional(),presence_penalty:M1.number().min(-2).max(2).optional(),stop:M1.union([M1.string(),M1.array(M1.string())]).optional(),tools:M1.array(gZ6).optional(),tool_choice:M1.union([M1.literal("auto"),M1.literal("none"),M1.literal("required"),M1.object({type:M1.literal("function"),function:M1.object({name:M1.string()})})]).optional(),response_format:mZ6.optional(),user:M1.string().optional()});$x$=class $x$ extends Error{constructor($){super($);this.name="MessageConversionError"}};Zx$=new U1;Zx$.post("/:org/v1/chat/completions",async($)=>{let Z=$.get("studioContext"),X=$.req.param("org");try{if(!Z.auth.apiKey?.id)return $.json(lK("API key authentication required. Provide a valid API key via Authorization header.","authentication_error"),401);if(!Z.organization)return $.json(lK("Organization context is required. Ensure your API key has organization metadata.","invalid_request_error","organization"),400);if((Z.organization.slug??Z.organization.id)!==X)return $.json(lK("Organization mismatch. The API key's organization does not match the requested organization.","invalid_request_error","organization"),403);let Q=await $.req.json(),Y=iZ6.safeParse(Q);if(!Y.success){let L=Y.error.issues[0]??{message:"Invalid request",path:[]};return $.json(lK(`Invalid request: ${L.message}`,"invalid_request_error",L.path.length>0?L.path.join("."):null),400)}let G=Y.data,J=nZ6(G.model);if(!J)return $.json(lK("Invalid model format. Expected 'model_id' or 'credential_id:model_id' (e.g., 'claude-sonnet-4-6' or 'key_abc123:claude-sonnet-4-6')","invalid_request_error","model"),400);let{credentialId:W}=J,{modelId:K}=J;if(!W){let E=(await Z.storage.aiProviderKeys.list({organizationId:Z.organization.id})).find((j)=>UD(j.providerId));if(!E)return $.json(lK("No AI provider credentials configured for this organization. Add a credential in settings or specify one explicitly via 'credential_id:model_id'.","invalid_request_error","model"),400);W=E.id}let H;try{H=await Z.aiProviders.activate(W,Z.organization.id)}catch{return $.json(lK(`AI provider credential not found or inaccessible: ${W}`,"invalid_request_error","model"),404)}let N=H.aiSdk.languageModel(K),F=tZ6(G.messages),U=G.tools?oZ6(G.tools):void 0,O=rZ6(G.response_format),w=aZ6(),D=Math.floor(Date.now()/1000);if(G.stream)return JF($,async(L)=>{let E=sb$(N,F,U,G,O,$.req.raw.signal);try{let j=MO(E),z=!1,A=0,P="",q=async()=>{if(P.length===0)return;let S=P;P="",await L.writeSSE({data:JSON.stringify({id:w,object:"chat.completion.chunk",created:D,model:G.model,choices:[{index:0,delta:{content:S},finish_reason:null}]})})};for await(let S of j.fullStream){if(!z&&(S.type==="text-delta"||S.type==="tool-call"))await L.writeSSE({data:JSON.stringify({id:w,object:"chat.completion.chunk",created:D,model:G.model,choices:[{index:0,delta:{role:"assistant",content:""},finish_reason:null}]})}),z=!0;if(S.type==="text-delta"){if(P+=S.text,P.length>=yZ6)await q()}else if(S.type==="tool-call"){await q();let M=A++;await L.writeSSE({data:JSON.stringify({id:w,object:"chat.completion.chunk",created:D,model:G.model,choices:[{index:0,delta:{tool_calls:[{index:M,id:S.toolCallId,type:"function",function:{name:S.toolName,arguments:JSON.stringify(S.input)}}]},finish_reason:null}]})})}else if(S.type==="finish")await q(),await L.writeSSE({data:JSON.stringify({id:w,object:"chat.completion.chunk",created:D,model:G.model,choices:[{index:0,delta:{},finish_reason:eb$(S.finishReason)}],usage:S.totalUsage?{prompt_tokens:S.totalUsage.inputTokens??0,completion_tokens:S.totalUsage.outputTokens??0,total_tokens:S.totalUsage.totalTokens??0}:void 0})})}await q(),await L.writeSSE({data:"[DONE]"})}catch(j){let z=j;console.error("[openai-compat:stream] Error:",z.message),await L.writeSSE({data:JSON.stringify({error:{message:z.message,type:"server_error"}})})}});else{let L=sb$(N,F,U,G,O,$.req.raw.signal),E=await IO(L),j={role:"assistant",content:E.text||null};if(E.toolCalls&&E.toolCalls.length>0)j.tool_calls=E.toolCalls.map((z)=>({id:z.toolCallId,type:"function",function:{name:z.toolName,arguments:JSON.stringify("input"in z?z.input:{})}})),j.content=null;return $.json({id:w,object:"chat.completion",created:D,model:G.model,choices:[{index:0,message:j,finish_reason:eb$(E.finishReason)}],usage:{prompt_tokens:E.usage?.inputTokens??0,completion_tokens:E.usage?.outputTokens??0,total_tokens:E.usage?.totalTokens??0}})}}catch(Q){let Y=Q;if(Y.name==="AbortError")return $.json(lK("Request aborted","invalid_request_error"),400);if(Y.name==="MessageConversionError")return $.json(lK(Y.message,"invalid_request_error","messages"),400);return console.error("[openai-compat] Error:",Y.message,Y.stack),$.json(lK(Y.message,"server_error"),500)}});Xx$=Zx$});var Gx$;var Yx$=B(()=>{Gx$={name:"decocms",version:"4.213.3",description:"Deco CMS \u2014 Self-hostable MCP Gateway for managing AI connections and tools",author:"Deco team",repository:{type:"git",url:"git+https://github.com/decocms/studio.git",directory:"apps/api"},bugs:{url:"https://github.com/decocms/studio/issues"},type:"module",bin:{deco:"./dist/server/cli.js"},files:["dist/**/*"],scripts:{dev:"bun run migrate && bun run dev:server","dev:server":"bun run --cwd=../../packages/sandbox build && NODE_ENV=development bun --env-file=.env --hot run src/index.ts",build:"bun run build:server","build:server":"bun run scripts/bundle-server-script.ts --dist ./dist/server","generate:tool-contracts":"bun run scripts/generate-tool-contracts.ts","db:migrate":"bun run ./dist/server/migrate.js",check:"tsc --noEmit",start:"bun run ./dist/server/server.js",migrate:"bun run src/database/migrate.ts",test:"bun test src","better-auth:migrate":"bunx --bun @better-auth/cli migrate -y --config src/auth/index.ts",prepublishOnly:"bun run --cwd=../.. build:studio"},optionalDependencies:{"@duckdb/node-api":"^1.5.0-r.1"},dependencies:{"@ai-sdk/anthropic":"^3.0.85","@ai-sdk/google":"^3.0.83","@ai-sdk/openai":"^3.0.73","@anthropic-ai/sdk":"^0.105.0","@aws-sdk/client-s3":"^3.1013.0","@aws-sdk/client-sts":"^3.1013.0","@aws-sdk/lib-storage":"^3.1013.0","@aws-sdk/s3-request-presigner":"^3.1013.0","@clickhouse/client":"^1.8.1","@dbos-inc/dbos-sdk":"^4.21.6","@inkjs/ui":"^2.0.0","@nats-io/jetstream":"3.4.0","@nats-io/kv":"3.4.0","@nats-io/nats-core":"3.4.0","@nats-io/transport-node":"3.4.0","@openrouter/ai-sdk-provider":"^2.9.1","@opentelemetry/core":"^2.6.0","embedded-postgres":"^18.3.0-beta.16",ink:"^6.8.0",kysely:"^0.28.12","posthog-node":"^5.0.0",react:"^19.2.6","react-dom":"^19.2.6"},devDependencies:{"@ai-sdk/provider":"^3.0.10","@better-auth/sso":"1.4.1","@decocms/better-auth":"1.5.17","@decocms/bindings":"workspace:*","@decocms/mcp-utils":"workspace:*","@decocms/runtime":"workspace:*","@decocms/sandbox":"workspace:*","@decocms/shared":"workspace:*","@jitl/quickjs-wasmfile-release-sync":"0.31.0","@modelcontextprotocol/sdk":"1.29.0","@nats-io/jwt":"0.0.10-5","@opentelemetry/api":"^1.9.0","@opentelemetry/api-logs":"^0.211.0","@opentelemetry/exporter-logs-otlp-proto":"^0.211.0","@opentelemetry/exporter-prometheus":"^0.208.0","@opentelemetry/exporter-trace-otlp-proto":"^0.207.0","@opentelemetry/instrumentation-runtime-node":"^0.24.0","@opentelemetry/resources":"^2.6.0","@opentelemetry/sdk-logs":"^0.211.0","@opentelemetry/sdk-metrics":"^2.2.0","@opentelemetry/sdk-node":"^0.207.0","@opentelemetry/sdk-trace-base":"^2.5.0","@types/bun":"^1.3.1","@types/google.maps":"^3.65.2","@types/pg":"^8.15.6","@types/react-syntax-highlighter":"^15.5.13","@vercel/nft":"^1.1.1",ai:"^6.0.208","better-auth":"1.4.22",croner:"^9.1.0",degit:"^2.8.4",hono:"^4.10.7",jose:"^6.0.11",nanoid:"^5.1.6",pg:"^8.16.3",typescript:"^7.0.2",typescript5:"npm:typescript@^5.9.3",zod:"4.3.6"},homepage:"https://github.com/decocms/studio",keywords:["mcp","model-context-protocol","ai","gateway","self-hosted","tools"],license:"MIT",publishConfig:{access:"public"}}});function $76(){let $=process.env.POSTHOG_KEY;if(!$)return null;return{key:$,host:process.env.POSTHOG_HOST??eZ6}}var Jx$,eZ6="https://ph.studio.decocms.com",Wx$;var Kx$=B(()=>{C8();oy0();gV();PZ();R$();z81();Yx$();Jx$=new U1;Jx$.get("/",($)=>{let Z={version:Gx$.version,theme:vc1(),...XL().logo&&{logo:XL().logo},...wK()&&{internalUrl:Kk1()},...y0().enableDecoImport&&{enableDecoImport:!0},brandExtractEnabled:!!y0().firecrawlApiKey,auth:IV$(),posthog:$76(),googleMapsApiKey:process.env.GOOGLE_MAPS_API_KEY?.trim()||null,runtime:{agentSandbox:!wK()&&y0().sandboxProviderKind==="agent-sandbox"}};return $.header("Cache-Control","no-store"),$.json({success:!0,config:Z})});Wx$=Jx$});function Lh($){let Z=($??"").trim().toLowerCase();return Z=Z.replace(/^https?:\/\//,""),Z=Z.replace(/^www\./,""),Z=Z.split(/[/?#]/)[0]??"",Z.replace(/\/+$/,"")}function y61($){return(Lh($).split(".")[0]||$).replace(/[-_]/g," ").split(" ").filter(Boolean).map((X)=>X.charAt(0).toUpperCase()+X.slice(1)).join(" ")}function Nx$($,Z=64){return`https://www.google.com/s2/favicons?domain=${encodeURIComponent(Lh($))}&sz=${Z}`}function Hx$($,Z){let X=$.trim();if(X.length<=Z)return X;let Q=X.slice(0,Z-1),Y=Q.lastIndexOf(" ");return`${(Y>Z*0.6?Q.slice(0,Y):Q).trimEnd()}\u2026`}function Fx$($){let{brand:Z,domain:X,score:Q,verdict:Y}=$,G=typeof Q==="number"?`${Z} commerce report \u2014 ${Math.round(Q)}/100 \xB7 decocms`:`${Z} commerce report \xB7 decocms`,J=`See the full ${Z} scorecard \u2014 SEO, performance, conversion & AEO signals scored by decocms.`,W=Y?.trim()?Hx$(`${Y.trim().replace(/\s+/g," ")} \u2014 ${J}`,200):Hx$(`How does ${X} really perform? ${J}`,200);return{title:G,description:W}}import{z as c0}from"zod";var G_,Z76,X76,Q76,Y76,Ux$;var Ox$=B(()=>{G_=c0.enum(["good","bad","neutral"]),Z76=c0.preprocess(($)=>{if(Array.isArray($))return{kind:"text",value:$.find((X)=>X!==null&&typeof X!=="object")??""};return $!==null&&typeof $==="object"?$:{kind:"text",value:$}},c0.object({kind:c0.enum(["text","number","sparkline","badge","score"]).catch("text"),value:c0.coerce.string().optional(),tone:G_.optional(),muted:c0.boolean().optional(),delta:c0.coerce.string().optional(),deltaDir:c0.enum(["up","down","neutral"]).optional(),points:c0.array(c0.coerce.number()).optional(),label:c0.coerce.string().optional()}).transform(($)=>{if($.kind==="badge"&&$.label==null)$.label=$.value??"";if($.kind==="score"){let Z=Number($.value);if(Number.isNaN(Z))return{...$,kind:"text"}}return $})),X76=c0.preprocess(($)=>{let Z=$;if(Z&&typeof Z==="object"&&!Array.isArray(Z)&&Array.isArray(Z.cells))Z=Z.cells;if(Array.isArray(Z)&&Z.length===1&&Array.isArray(Z[0]))Z=Z[0];if(Array.isArray(Z))return Z;if(Z&&typeof Z==="object")return Object.values(Z);return Z},c0.array(Z76)),Q76={key:c0.coerce.string(),title:c0.coerce.string(),eyebrow:c0.coerce.string().optional(),headline:c0.coerce.string(),annotation:c0.coerce.string().optional(),methodology:c0.coerce.string().optional(),sources:c0.array(c0.object({name:c0.coerce.string(),logoUrl:c0.coerce.string()})).optional()},Y76=c0.discriminatedUnion("template",[c0.object({template:c0.literal("cover"),score:c0.object({value:c0.coerce.number(),max:c0.coerce.number().optional(),grade:c0.coerce.string().optional(),label:c0.coerce.string().optional()}).optional(),brandImage:c0.coerce.string().optional(),screenshot:c0.coerce.string().optional(),mobileScreenshot:c0.coerce.string().optional()}),c0.object({template:c0.literal("cta"),ctaUrl:c0.coerce.string().optional(),ctaLabel:c0.coerce.string().optional(),bullets:c0.array(c0.coerce.string()).optional()}),c0.object({template:c0.literal("series"),points:c0.array(c0.coerce.number()).min(2),xLabels:c0.array(c0.coerce.string()).min(1),unit:c0.coerce.string().optional(),callout:c0.object({index:c0.coerce.number(),value:c0.coerce.string(),tone:G_.optional()})}),c0.object({template:c0.literal("threshold"),value:c0.coerce.string().default(""),metricLabel:c0.coerce.string().optional(),ratio:c0.coerce.number(),thresholdRatio:c0.coerce.number().optional(),thresholdLabel:c0.coerce.string().default(""),tone:G_.optional()}),c0.object({template:c0.literal("stats"),stats:c0.array(c0.object({value:c0.coerce.string(),label:c0.coerce.string(),tone:G_.optional()})).min(1)}),c0.object({template:c0.literal("bars"),items:c0.array(c0.object({value:c0.coerce.string(),label:c0.coerce.string(),ratio:c0.coerce.number(),tone:G_.optional()})).min(1)}),c0.object({template:c0.literal("gauges"),gauges:c0.array(c0.object({label:c0.coerce.string(),value:c0.coerce.string(),status:c0.enum(["good","warn","bad"]).catch("warn"),caption:c0.coerce.string().optional(),ratio:c0.coerce.number().optional()})).min(1)}),c0.object({template:c0.literal("checklist"),checks:c0.array(c0.object({label:c0.coerce.string(),status:c0.enum(["pass","fail","warn"]).catch("fail"),value:c0.coerce.string().optional()})).min(1)}),c0.object({template:c0.literal("table"),columns:c0.array(c0.object({label:c0.coerce.string(),align:c0.enum(["left","right"]).optional()})).min(1),rows:c0.array(X76).min(1),highlightRow:c0.coerce.number().optional()}),c0.object({template:c0.literal("products"),products:c0.array(c0.object({name:c0.coerce.string(),price:c0.coerce.string().optional(),image:c0.coerce.string().optional(),url:c0.coerce.string().optional()})).min(1)}),c0.object({template:c0.literal("list"),entries:c0.array(c0.object({label:c0.coerce.string(),severity:c0.enum(["error","warning","notice"]).catch("notice")})).min(1),moreCount:c0.coerce.number().optional()}),c0.object({template:c0.literal("keywords"),volumeLabel:c0.coerce.string().optional(),keywords:c0.array(c0.object({term:c0.coerce.string(),volume:c0.coerce.string(),position:c0.coerce.number().catch(0)})).min(1)}),c0.object({template:c0.literal("competitor"),metricLabel:c0.coerce.string().optional(),competitors:c0.array(c0.object({name:c0.coerce.string(),value:c0.coerce.string(),tone:G_.optional(),isYou:c0.boolean().optional()})).min(1)}),c0.object({template:c0.literal("scorecard"),rivalLabel:c0.coerce.string().optional(),dimensions:c0.array(c0.object({label:c0.coerce.string(),you:c0.coerce.string(),rival:c0.coerce.string().optional(),rivalName:c0.coerce.string().optional(),tone:G_.optional()})).min(1)})]),Ux$=c0.object({...Q76,template:Y76})});function _z0($){let Z=[],X=[...$.sections].sort((Y,G)=>Y.position-G.position).map((Y)=>{let G=Ux$.safeParse(Y.props);if(G.success)return G.data;let J=G.error.issues[0];return Z.push({section_type:Y.section_type,position:Y.position,reason:J?`${J.path.join(".")||"(root)"}: ${J.message}`:"contract violation"}),null}).filter((Y)=>Y!==null),Q=X.filter((Y)=>Y.template.template!=="cover"&&Y.template.template!=="cta").map((Y)=>({key:Y.key,title:Y.title}));return{deck:{meta:{...$.meta,scores:$.summary?.scores,scannedAt:$.scanned_at,toc:Q},slides:X},drops:Z}}var g61=B(()=>{Ox$()});import{join as wx$}from"path";async function J76($){try{let Z=await fetch(`${gW({})}/api/v2/public/diagnostics/${encodeURIComponent($)}`,{headers:{Accept:"application/json"},signal:AbortSignal.timeout(G76)});if(!Z.ok)return null;let X=await Z.json(),{deck:Q}=_z0(X);if(!Q.slides.length)return null;let Y=Q.slides.find((W)=>W.template.template==="cover"),G=Y?.template,J=G&&G.template==="cover"?G:void 0;return{brand:Q.meta.brand?.trim()||y61($),score:Q.meta.scores?.cover??J?.score?.value,verdict:Y?.annotation?.trim()||Y?.headline?.trim()||void 0}}catch{return null}}function oY($){return $.replaceAll("&","&amp;").replaceAll("<","&lt;").replaceAll(">","&gt;").replaceAll('"',"&quot;")}function W76($,Z){let X=Lh($),Q=Z?.brand?.trim()||y61(X),Y=Nx$(X,128),J=`${(y0().baseUrl??"https://studio.decocms.com").replace(/\/+$/,"")}/report/${encodeURIComponent(X)}`,{title:W,description:K}=Fx$({brand:Q,domain:X,score:Z?.score,verdict:Z?.verdict}),H=`${J}/og.png`,N=`${Q} commerce report by decocms`;return[`<title>${oY(W)}</title>`,`<meta name="description" content="${oY(K)}" />`,'<meta name="robots" content="noindex, follow" />','<meta property="og:type" content="website" />','<meta property="og:site_name" content="decocms" />',`<meta property="og:title" content="${oY(W)}" />`,`<meta property="og:description" content="${oY(K)}" />`,`<meta property="og:url" content="${oY(J)}" />`,`<meta property="og:image" content="${oY(H)}" />`,'<meta property="og:image:width" content="1200" />','<meta property="og:image:height" content="630" />',`<meta property="og:image:alt" content="${oY(N)}" />`,'<meta name="twitter:card" content="summary_large_image" />',`<meta name="twitter:title" content="${oY(W)}" />`,`<meta name="twitter:description" content="${oY(K)}" />`,`<meta name="twitter:image" content="${oY(H)}" />`,`<meta name="twitter:image:alt" content="${oY(N)}" />`,`<link rel="canonical" href="${oY(J)}" />`,`<link rel="icon" href="${oY(Y)}" sizes="any" />`].join(`
     `)}function K76($,Z){return $.replace(/<title>[\s\S]*?<\/title>\s*/i,"").replace(/<meta\s+name="(?:description|twitter:[^"]*)"[^>]*>\s*/gi,"").replace(/<meta\s+property="og:[^"]*"[^>]*>\s*/gi,"").replace(/<link\s+rel="icon"[^>]*>\s*/gi,"").replace("</head>",`    ${Z}
   </head>`)}function Bx$($){let Z=new U1;return Z.get("/:domain/og.png",async(X)=>{let Q=Lh(X.req.param("domain")),Y=async()=>{let G=$?Bun.file(wx$($,"report-og-fallback.png")):null;if(!G||!await G.exists())return X.notFound();return X.body(new Uint8Array(await G.arrayBuffer()),200,{"Content-Type":"image/png","Cache-Control":"public, max-age=0, s-maxage=3600"})};try{let G=await fetch(`${gW({})}/api/v2/public/diagnostics/${encodeURIComponent(Q)}/og.png`,{signal:AbortSignal.timeout(H76)}),J=G.headers.get("content-type")??"";if(!G.ok||!J.startsWith("image/")||!G.body)return Y();return X.body(G.body,200,{"Content-Type":J,"Cache-Control":"public, max-age=0, s-maxage=604800"})}catch{return Y()}}),Z.get("/:domain",async(X)=>{let Q=X.req.param("domain"),Y=$?wx$($,"index.html"):null,G=Y?Bun.file(Y):null;if(!G||!await G.exists())return X.notFound();let J=await G.text();try{let W=await J76(Lh(Q)),K=W76(Q,W);return X.html(K76(J,K),200,{"Cache-Control":"public, max-age=0, s-maxage=300"})}catch{return X.html(J)}}),Z}var G76=2500,H76=1e4;var Dx$=B(()=>{C8();g61();DL();R$()});function Lr($,Z){return fetch(`${gW({})}${$}`,Z)}async function N76($,Z,X){let Q=new URLSearchParams;if(Z)Q.set("pw",Z);if(X)Q.set("lang",X);let Y=Q.toString()?`?${Q.toString()}`:"",G=await Lr(`/api/v2/public/diagnostics/${encodeURIComponent($)}${Y}`,{headers:{Accept:"application/json"}});if(G.status===404)return{status:"not_found",deck:null,scanned_at:null,drops:[]};if(!G.ok)throw Error(`report read HTTP ${G.status}`);let J=await G.json(),{deck:W,drops:K}=_z0(J);return{status:W.slides.length?"ready":"empty",deck:W,scanned_at:J.scanned_at,drops:K}}var F76,KF,Lx$=async($,Z)=>{if(!$.get("reportUser"))return $.json({error:"Authentication required"},401);await Z();return},Ex$;var jx$=B(()=>{C8();VG();DL();g61();F76=new Set(["complete","errored","terminated","unknown"]),KF=new U1;KF.use("*",async($,Z)=>{let X=await j8.api.getSession({headers:$.req.raw.headers});$.set("reportUser",X?.user?.id?{email:X.user.email}:void 0),await Z(),$.header("Cache-Control","private, no-store"),$.header("Vary","Cookie");return});KF.use("/link-token/*",Lx$);KF.use("/suggest",Lx$);KF.get("/site/:domain",async($)=>{let Z=$.req.param("domain").trim();if(!Z)return $.json({error:"domain is required"},400);let X=$.get("reportUser"),Q=$.req.query("key")?.trim()||void 0,Y=$.req.query("lang")?.trim()||void 0;try{let G=await N76(Z,Q,Y);if($.header("Cache-Control","private, no-store"),X||!G.deck)return $.json(G);return $.json({...G,deck:{...G.deck,slides:G.deck.slides.slice(0,1)},truncated:G.status==="ready"})}catch{return $.json({error:"report read failed"},502)}});KF.post("/run",async($)=>{let Z=$.get("reportUser"),X;try{X=await $.req.json()}catch{return $.json({error:"invalid JSON"},400)}let Q=typeof X.domain==="string"?X.domain.trim():"";if(!Q)return $.json({error:"domain is required"},400);let Y=Z?.email,G=typeof X.distinctId==="string"&&X.distinctId.trim()&&X.distinctId.length<=200?X.distinctId.trim():void 0;try{let J=await Lr("/api/v2/diagnostics/run",{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${BL({})}`},body:JSON.stringify({url:Q,...Y?{email:Y}:{},distinct_id:G})});if(!J.ok)return $.json({error:`run HTTP ${J.status}`},502);let W=await J.json(),K=W.blocked?{state:"blocked"}:W.status==="fresh"?{state:"fresh"}:W.mode==="sync"?{state:"sync"}:{state:"running",id:W.id??null};return $.json(K)}catch{return $.json({error:"run failed"},502)}});KF.get("/status",async($)=>{let Z=$.req.query("id");if(!Z)return $.json({error:"id is required"},400);try{let X=await Lr(`/api/v2/diagnostics/status?id=${encodeURIComponent(Z)}`,{headers:{Authorization:`Bearer ${BL({})}`}});if(!X.ok)return $.json({error:`status HTTP ${X.status}`},502);let Y=(await X.json()).status??"unknown",G={done:F76.has(Y),status:Y};return $.json(G)}catch{return $.json({error:"status failed"},502)}});KF.get("/link-token/:id",async($)=>{let Z=$.req.param("id");try{let X=await Lr(`/api/v2/public/link-tokens/${encodeURIComponent(Z)}`,{headers:{Accept:"application/json"}});if(X.status===404)return $.json(null);if(!X.ok)return $.json({error:`link token HTTP ${X.status}`},502);return $.json(await X.json())}catch{return $.json({error:"link token resolve failed"},502)}});KF.get("/suggest",async($)=>{let Z=($.req.query("q")??"").trim().slice(0,64);if(Z.length<2)return $.json({suggestions:[]});try{let X=await Lr(`/api/v2/public/suggest?q=${encodeURIComponent(Z)}`,{headers:{Accept:"application/json"}});if(!X.ok)return $.json({suggestions:[]});let Q=await X.json();return $.json({suggestions:Array.isArray(Q.suggestions)?Q.suggestions:[]})}catch{return $.json({suggestions:[]})}});Ex$=KF});import{createHmac as U76,timingSafeEqual as O76}from"crypto";function Px$($,Z,X,Q=Date.now()){if(!Z||!X)return!1;let Y,G=[];for(let H of Z.split(",")){let N=H.indexOf("=");if(N<=0)continue;let F=H.slice(0,N).trim(),U=H.slice(N+1).trim();if(F==="t")Y=U;else if(F==="v1")G.push(U)}if(!Y||G.length===0)return!1;let J=Number(Y);if(!Number.isFinite(J)||Math.abs(Q/1000-J)>w76)return!1;let W=U76("sha256",X).update(`${Y}.${$}`).digest("hex"),K=Buffer.from(W,"hex");return G.some((H)=>{let N=Buffer.from(H,"hex");return K.length===N.length&&O76(K,N)})}function Ax$($){let Z;try{Z=JSON.parse($)}catch{return null}let X=NJ(Z),Q=NJ(NJ(X?.data)?.object);if(!X||typeof X.type!=="string"||!Q)return null;return{id:dK(X.id),type:X.type,created:typeof X.created==="number"?X.created:void 0,livemode:typeof X.livemode==="boolean"?X.livemode:void 0,data:{object:Q}}}function Tx$($){switch($){case"active":case"trialing":return"active";case"past_due":return"past_due";default:return"canceled"}}function dK($){return typeof $==="string"?$:void 0}function NJ($){return typeof $==="object"&&$!==null?$:void 0}function vz0($){return typeof $==="number"?new Date($*1000):null}function c61($){return dK($)??dK(NJ($)?.id)}function B76($){return c61($.subscription)??dK(NJ(NJ($.parent)?.subscription_details)?.subscription)}function D76($){let Z=vz0($.current_period_end);if(Z)return Z;let X=NJ($.items)?.data;if(!Array.isArray(X))return null;let Q=0;for(let Y of X){let G=NJ(Y)?.current_period_end;if(typeof G==="number"&&G>Q)Q=G}return Q>0?new Date(Q*1000):null}function h61($,Z){let X=vz0($.created);return!!X&&!!Z.lastStripeEventAt&&X<Z.lastStripeEventAt}function u61($,Z){let X=vz0($.created);if(!X)return;return Z.lastStripeEventAt&&Z.lastStripeEventAt>X?void 0:X}async function L76($,Z){let X=Z.data.object;switch(Z.type){case"checkout.session.completed":case"checkout.session.async_payment_succeeded":{let Q=dK(NJ(X.metadata)?.orgId);if(!Q)return{handled:!1,reason:"no orgId"};if(dK(NJ(X.metadata)?.kind)==="topup"){if(X.mode!=="payment")return{handled:!1,reason:"topup with wrong mode"};if(dK(X.payment_status)!=="paid")return{handled:!1,reason:"payment not confirmed"};let J=dK(X.id);if(!J)return console.error("stripe webhook: topup session without id",{eventId:Z.id,organizationId:Q}),{handled:!1,reason:"topup session without id"};let W=Number(NJ(X.metadata)?.creditCents);if(!Number.isInteger(W)||W<=0)return console.error("stripe webhook: paid topup with bad metadata \u2014 credit NOT applied",{eventId:Z.id,organizationId:Q,creditCents:NJ(X.metadata)?.creditCents}),{handled:!1,reason:"bad topup metadata"};return{handled:!0,organizationId:Q,topUp:{creditCents:W,referenceId:`stripe-topup:${J}`}}}if(X.mode!=="subscription")return{handled:!1,reason:"not a subscription checkout"};if(dK(X.payment_status)!=="paid")return{handled:!1,reason:"payment not confirmed"};let Y=await $.getBilling(Q);if(!Y)return{handled:!1,reason:"unknown org"};let G=c61(X.subscription);if(Y.stripeSubscriptionId&&G&&Y.stripeSubscriptionId!==G)return console.error("stripe webhook: refused checkout rebind",{organizationId:Q,eventId:Z.id}),{handled:!1,reason:"org already bound to another subscription",orphanSubscriptionId:G};if(h61(Z,Y))return{handled:!1,reason:"stale event"};return await $.updateStripeState(Q,{stripeCustomerId:c61(X.customer),stripeSubscriptionId:G,status:"active",lastStripeEventAt:u61(Z,Y)}),{handled:!0,organizationId:Q}}case"customer.subscription.updated":case"customer.subscription.deleted":{let Q=dK(X.id);if(!Q)return{handled:!1,reason:"no sub id"};let Y=await $.getBillingByStripeSubscriptionId(Q);if(!Y)return{handled:!1,reason:"unknown subscription"};let G=Z.type==="customer.subscription.deleted";if(!G&&h61(Z,Y))return{handled:!1,reason:"stale event"};let J=G?"canceled":Tx$(X.status);return await $.updateStripeState(Y.organizationId,{status:J,currentPeriodEnd:D76(X),...G&&{stripeSubscriptionId:null},lastStripeEventAt:u61(Z,Y)}),{handled:!0,organizationId:Y.organizationId}}case"invoice.paid":{let Q=B76(X);if(!Q)return{handled:!1,reason:"no sub id"};let Y=await $.getBillingByStripeSubscriptionId(Q);if(!Y)return{handled:!1,reason:"unknown subscription"};if(h61(Z,Y))return{handled:!1,reason:"stale event"};return await $.updateStripeState(Y.organizationId,{status:"active",currentPeriodEnd:vz0(X.period_end),lastStripeEventAt:u61(Z,Y)}),{handled:!0,organizationId:Y.organizationId}}default:return{handled:!1,reason:`unhandled event ${Z.type}`}}}function E76($,Z){if(!Z.handled||$.livemode===!1)return null;let X=$.data.object;if(Z.topUp)return{name:"credits_topup_succeeded",organizationId:Z.organizationId,properties:{credit_cents:Z.topUp.creditCents}};switch($.type){case"checkout.session.completed":case"checkout.session.async_payment_succeeded":return{name:"subscription_started",organizationId:Z.organizationId,properties:{}};case"customer.subscription.deleted":return{name:"subscription_canceled",organizationId:Z.organizationId,properties:{}};case"customer.subscription.updated":return{name:"subscription_updated",organizationId:Z.organizationId,properties:{status:Tx$(X.status),...typeof X.cancel_at_period_end==="boolean"?{cancel_at_period_end:X.cancel_at_period_end}:{}}};case"invoice.paid":if(X.billing_reason==="subscription_create")return null;return{name:"subscription_renewed",organizationId:Z.organizationId,properties:{}};default:return null}}function zx$($,Z){let X=E76($,Z);if(!X)return;jY({event:X.name,organizationId:X.organizationId,...$.id?{uuid:cd1(`stripe:${$.id}:${X.name}`)}:{},...$.created?{timestamp:new Date($.created*1000)}:{},properties:X.properties})}async function Rx$($){let Z=new fW(m8().db),X=await L76(Z,$);if(!(X.handled&&X.topUp))zx$($,X);if(X.handled&&X.topUp)await QO$({organizationId:X.organizationId,amountCents:X.topUp.creditCents,referenceId:X.topUp.referenceId}),zx$($,X);if(!X.handled&&X.orphanSubscriptionId)try{await Zr1(X.orphanSubscriptionId),console.error("stripe webhook: canceled orphan subscription",{subscriptionId:X.orphanSubscriptionId,eventId:$.id})}catch(Q){if(!(Q instanceof K3&&(Q.status===400||Q.status===404)))throw Q}return X}var w76=300;var Ix$=B(()=>{RG();I4();j40();sm();Oa0()});var j76=1048576,l61;var qx$=B(()=>{C8();aw();R$();Ix$();l61=new U1;l61.post("/webhook",FZ({maxSize:j76,onError:($)=>$.json({error:"payload too large"},413)}),async($)=>{let Z=y0().stripeWebhookSecret;if(!Z)return $.json({error:"stripe billing not configured"},503);let X=await $.req.text();if(!Px$(X,$.req.header("stripe-signature"),Z))return $.json({error:"invalid signature"},400);let Y=Ax$(X);if(!Y)return $.json({error:"invalid payload"},400);let G=await Rx$(Y);return console.log("stripe webhook",{eventId:Y.id,type:Y.type,livemode:Y.livemode,...G}),$.json({received:!0})})});import{timingSafeEqual as z76}from"crypto";function A76($,Z,X){if(!Z?.startsWith("sha256="))return!1;let Q=new Bun.CryptoHasher("sha256",X).update($).digest("hex"),Y=Z.slice(7);if(Y.length!==Q.length)return!1;return z76(Buffer.from(Y),Buffer.from(Q))}var P76=5242880,d61;var Mx$=B(()=>{C8();aw();ai();d61=new U1;d61.post("/webhook",FZ({maxSize:P76,onError:($)=>$.json({error:"payload too large"},413)}),async($)=>{let Z=process.env.GITHUB_WEBHOOK_SECRET;if(!Z)return $.json({error:"github webhook not configured"},503);let X=await $.req.text();if(!A76(X,$.req.header("x-hub-signature-256"),Z))return $.json({error:"invalid signature"},400);if($.req.header("x-github-event")!=="push")return $.json({ok:!0,ignored:"event"});let Q;try{Q=JSON.parse(X)}catch{return $.json({error:"invalid payload"},400)}let Y=Q.ref,G=Q.repository?.full_name;if(!Y||!G)return $.json({ok:!0,ignored:"shape"});let W=(await gm0())?.markTenantPoolsDirty(G,Y)??[];return $.json({ok:!0,pools:W})})});function kx$($,Z){if(Z.startsWith("text/html")||Z.startsWith("image/svg"))$.set("Content-Security-Policy","sandbox allow-scripts allow-modals allow-same-origin")}var Sx$,T76,R76,Vx$;var Cx$=B(()=>{C8();sJ();nx();nb();Sx$=new U1,T76=["range","if-none-match","if-modified-since"],R76=["content-type","content-length","content-range","accept-ranges","etag","last-modified"];Sx$.get("/:org/files/*",async($)=>{let Z=$.get("studioContext"),X=Z.organization?.id;if(!Z.auth?.user?.id){if(mg($))return $.redirect(`/login?next=${encodeURIComponent($.req.path)}`,302);throw new e1(401,{message:"Authentication required"})}if(!X)throw new e1(401,{message:"Organization context required"});let Q=$.req.path.replace(/^.*\/files\//,"");if(!Q)throw new e1(400,{message:"Missing file key"});let Y=await kn(Q,Z);if(!Y)throw new e1(503,{message:"Object storage not configured"});if(Y.startsWith("data:")&&Q3()){let K=Y.match(/^data:([^;]+);base64,(.+)$/s);if(!K)throw new e1(500,{message:"Invalid data URL from storage"});let[,H,N]=K,F=Buffer.from(N,"base64"),U=new Headers({"Content-Type":H,"Cache-Control":"private, max-age=86400"});return kx$(U,H),new Response(F,{status:200,headers:U})}let G=new Headers;for(let K of T76){let H=$.req.header(K);if(H)G.set(K,H)}let J=await fetch(Y,{headers:G});if(J.status===403||J.status===404)throw new e1(404,{message:"File not found"});if(!J.ok&&J.status!==304&&J.status!==416)throw console.error(`[files] upstream storage error ${J.status} for key:`,Q),new e1(502,{message:"Upstream storage error"});let W=new Headers;for(let K of R76){let H=J.headers.get(K);if(H)W.set(K,H)}return W.set("Cache-Control","private, max-age=86400"),kx$(W,W.get("content-type")??""),new Response(J.body,{status:J.status,headers:W})});Vx$=Sx$});var Er=C((J_)=>{var I76=J_&&J_.__createBinding||(Object.create?function($,Z,X,Q){if(Q===void 0)Q=X;var Y=Object.getOwnPropertyDescriptor(Z,X);if(!Y||("get"in Y?!Z.__esModule:Y.writable||Y.configurable))Y={enumerable:!0,get:function(){return Z[X]}};Object.defineProperty($,Q,Y)}:function($,Z,X,Q){if(Q===void 0)Q=X;$[Q]=Z[X]}),q76=J_&&J_.__exportStar||function($,Z){for(var X in $)if(X!=="default"&&!Object.prototype.hasOwnProperty.call(Z,X))I76(Z,$,X)};Object.defineProperty(J_,"__esModule",{value:!0});q76(YY(),J_)});var fx$=C((_x$)=>{Object.defineProperty(_x$,"__esModule",{value:!0});_x$.version=void 0;_x$.version="3.4.0"});var yx$=C((mK)=>{var M76=mK&&mK.__importDefault||function($){return $&&$.__esModule?$:{default:$}};Object.defineProperty(mK,"__esModule",{value:!0});mK.NodeTransport=mK.VERSION=void 0;mK.nodeResolveHost=v76;var n6=Er(),k76=z0("net"),m61=z0("tls"),S76=z0("path"),bx$=z0("fs"),V76=M76(z0("dns")),C76=fx$();mK.VERSION=C76.version;var _76="nats.js";class xx${socket;version;lang;yields=[];signal=(0,n6.deferred)();closedNotification=(0,n6.deferred)();options;connected=!1;tlsName="";done=!1;closeError;constructor(){this.lang=_76,this.version=mK.VERSION}async connect($,Z){this.tlsName=$.tlsName,this.options=Z;let{tls:X}=this.options,{handshakeFirst:Q}=X||{};try{if(Q===!0)this.socket=await this.tlsFirst($);else this.socket=await this.dial($);if(this.done)this.socket?.destroy();let Y=await this.peekInfo();(0,n6.checkOptions)(Y,Z);let{tls_required:G,tls_available:J}=Y,W=J===!0&&Z.tls!==null;if(!Q&&(G||W))this.socket=await this.startTLS();if(this.done)this.socket?.destroy();if(G&&this.socket.encrypted!==!0)throw n6.errors.InvalidArgumentError.format("tls","is not available on this server");return this.connected=!0,this.setupHandlers(),this.signal.resolve(),Promise.resolve()}catch(Y){let G=Y;if(!G)G=new n6.errors.ConnectionError("error connecting - node provided an undefined error");let{code:J}=G,W=J==="ECONNREFUSED"?new n6.errors.ConnectionError("connection refused",{cause:G}):G;throw this.socket?.destroy(),W}}dial($){let Z=(0,n6.deferred)(),X,Q=(0,k76.createConnection)($.port,$.hostname,()=>{Z.resolve(Q),Q.removeAllListeners()});return Q.on("error",(Y)=>{X=Y}),Q.on("close",()=>{Q.removeAllListeners(),Z.reject(X)}),Q.setNoDelay(!0),Z}get isClosed(){return this.done}close($){return this._closed($,!1)}peekInfo(){let $=(0,n6.deferred)(),Z;return this.socket.on("data",(X)=>{this.yields.push(X);let Q=n6.DataBuffer.concat(...this.yields),Y=(0,n6.extractProtocolMessage)(Q);if(Y!=="")try{let G=n6.INFO.exec(Y);if(!G)throw Error("unexpected response from server");let J=JSON.parse(G[1]);$.resolve(J)}catch(G){$.reject(G)}finally{this.socket.removeAllListeners()}}),this.socket.on("error",(X)=>{Z=X}),this.socket.on("close",()=>{this.socket.removeAllListeners(),$.reject(Z)}),$}loadFile($){if(!$)return Promise.resolve();let Z=(0,n6.deferred)();try{if($=(0,S76.resolve)($),!(0,bx$.existsSync)($))Z.reject(Error(`${$} doesn't exist`));(0,bx$.readFile)($,(X,Q)=>{if(X)return Z.reject(X);Z.resolve(Q)})}catch(X){Z.reject(X)}return Z}async loadClientCerts(){let $={},{certFile:Z,cert:X,caFile:Q,ca:Y,keyFile:G,key:J}=this.options.tls;try{if(Z){let W=await this.loadFile(Z);if(W)$.cert=W}else if(X)$.cert=X;if(G){let W=await this.loadFile(G);if(W)$.key=W}else if(J)$.key=J;if(Q){let W=await this.loadFile(Q);if(W)$.ca=[W]}else if(Y)$.ca=Y;return Promise.resolve($)}catch(W){return Promise.reject(W)}}async tlsFirst($){let Z,X={servername:this.tlsName,rejectUnauthorized:!0};if(this.socket)X.socket=this.socket;if(typeof this.options.tls==="object")try{let Y=await this.loadClientCerts()||{};X=(0,n6.extend)(X,this.options.tls,Y)}catch(Y){return Promise.reject(new n6.errors.ConnectionError(Y.message,{cause:Y}))}let Q=(0,n6.deferred)();try{let Y=(0,m61.connect)($.port,$.hostname,X,()=>{Y.removeAllListeners(),Q.resolve(Y)});Y.on("error",(G)=>{Z=G}),Y.on("secureConnect",()=>{if(X.rejectUnauthorized===!1)return;if(!Y.authorized)throw Y.authorizationError}),Y.on("close",()=>{Q.reject(Z),Y.removeAllListeners()}),Y.setNoDelay(!0)}catch(Y){Q.reject(new n6.errors.ConnectionError(Y.message,{cause:Y}))}return Q}async startTLS(){let $,Z={socket:this.socket,servername:this.tlsName,rejectUnauthorized:!0};if(typeof this.options.tls==="object")try{let Q=await this.loadClientCerts()||{};Z=(0,n6.extend)(Z,this.options.tls,Q)}catch(Q){return Promise.reject(new n6.errors.ConnectionError(Q.message,{cause:Q}))}let X=(0,n6.deferred)();try{let Q=(0,m61.connect)(Z,()=>{Q.removeAllListeners(),X.resolve(Q)});Q.on("error",(Y)=>{$=Y}),Q.on("secureConnect",()=>{if(Z.rejectUnauthorized===!1)return;if(!Q.authorized)throw Q.authorizationError}),Q.on("close",()=>{X.reject($),Q.removeAllListeners()})}catch(Q){X.reject(new n6.errors.ConnectionError(Q.message,{cause:Q}))}return X}setupHandlers(){let $;this.socket.on("data",(Z)=>{return this.yields.push(Z),this.signal.resolve()}),this.socket.on("error",(Z)=>{$=Z}),this.socket.on("end",()=>{if(this.socket?.destroyed)return;this.socket?.write(new Uint8Array(0),()=>{this.socket?.end()})}),this.socket.on("close",()=>{this._closed($,!1)})}[Symbol.asyncIterator](){return this.iterate()}async*iterate(){while(!0){if(this.yields.length===0)await this.signal;let $=this.yields;this.yields=[];for(let Z=0;Z<$.length;Z++){if(this.options.debug)console.info(`> ${(0,n6.render)($[Z])}`);yield $[Z]}if(this.done)break;else if(this.yields.length===0)$.length=0,this.yields=$,this.signal=(0,n6.deferred)()}}discard(){if(this.done=!0,this.socket)try{this.socket.removeAllListeners(),this.socket.destroy()}catch{}}disconnect(){this._closed(void 0,!0).then().catch()}isEncrypted(){return this.socket instanceof m61.TLSSocket}_send($){if(this.isClosed||this.socket===void 0)return Promise.resolve();if(this.options.debug)console.info(`< ${(0,n6.render)($)}`);let Z=(0,n6.deferred)();try{this.socket.write($,(X)=>{if(X){if(this.options.debug)console.error(`!!! ${(0,n6.render)($)}: ${X}`);return Z.reject(X)}return Z.resolve()})}catch(X){if(this.options.debug)console.error(`!!! ${(0,n6.render)($)}: ${X}`);Z.reject(X)}return Z}send($){this._send($).catch((X)=>{})}async _closed($,Z=!0){if(!this.connected)return;if(this.done){this.socket?.destroy();return}if(this.closeError=$,!$&&this.socket&&Z)try{await this._send(new TextEncoder().encode(""))}catch(X){if(this.options.debug)console.log("transport close terminated with an error",X)}try{if(this.socket)this.socket.removeAllListeners(),this.socket?.destroy(),this.socket=void 0}catch(X){console.log(X)}this.done=!0,this.closedNotification.resolve(this.closeError)}closed(){return this.closedNotification}}mK.NodeTransport=xx$;function v76($){let Z=(0,n6.deferred)();return V76.default.lookup($,{all:!0},(X,Q)=>{if(X){Z.reject(X);return}let Y=[];for(let G of Q)Y.push(G.address);if(Y.length===0)Y.push($);Z.resolve(Y)}),Z}});var lx$=C((cx$)=>{Object.defineProperty(cx$,"__esModule",{value:!0});cx$.connect=f76;var gx$=yx$(),hx$=Er(),ux$=Er();function f76($={}){if((0,ux$.hasWsProtocol)($))return Promise.reject(ux$.errors.InvalidArgumentError.format("servers","node client doesn't support websockets, use the 'wsconnect' function instead"));return(0,hx$.setTransportFactory)({factory:()=>{return new gx$.NodeTransport},dnsResolveFn:gx$.nodeResolveHost}),hx$.NatsConnectionImpl.connect($)}});var dx$=C((HF)=>{var x76=HF&&HF.__createBinding||(Object.create?function($,Z,X,Q){if(Q===void 0)Q=X;var Y=Object.getOwnPropertyDescriptor(Z,X);if(!Y||("get"in Y?!Z.__esModule:Y.writable||Y.configurable))Y={enumerable:!0,get:function(){return Z[X]}};Object.defineProperty($,Q,Y)}:function($,Z,X,Q){if(Q===void 0)Q=X;$[Q]=Z[X]}),y76=HF&&HF.__exportStar||function($,Z){for(var X in $)if(X!=="default"&&!Object.prototype.hasOwnProperty.call(Z,X))x76(Z,$,X)};Object.defineProperty(HF,"__esModule",{value:!0});HF.connect=void 0;var g76=lx$();Object.defineProperty(HF,"connect",{enumerable:!0,get:function(){return g76.connect}});y76(Er(),HF)});function px$($){let Z=$?.connectFn??l76,X=null,Q=null,Y=!1,G=!1,J=!1,W=[];function K(){return X!==null&&!X.isClosed()&&!X.isDraining()&&!J}function H(){console.log(`[NatsProvider] fireReady: ${W.length} callbacks`);for(let U of W)try{U()}catch{}}function N(U){(async()=>{for await(let O of U.status())if(O.type==="disconnect")console.log("[NatsProvider] Disconnected"),J=!0;else if(O.type==="reconnect")console.log("[NatsProvider] Reconnected, re-firing ready callbacks"),J=!1,Q=null,H()})().catch(()=>{})}async function F(U,O){let w=0;while(!G)try{X=await Z({servers:U,timeout:c76,reconnect:!0,maxReconnectAttempts:-1,...O?{authenticator:O}:{}}),console.log(`[NatsProvider] Connected to ${X.getServer()} after ${w} attempt(s)`),Q=null,J=!1,N(X),H();return}catch{w++;let D=cZ(u76,h76,w-1,2,0.5);await C$(D)}}return{init(U,O){if(Y)return;Y=!0,G=!1;let w=O?.creds?mx$.credsAuthenticator(new TextEncoder().encode(O.creds)):void 0;F(U,w).catch(()=>{})},isConnected(){return K()},getConnection(){return K()?X:null},getJetStream(){if(!K())return null;if(!Q)Q=nx$.jetstream(X);return Q},onReady(U){if(W.push(U),K())try{U()}catch{}},async drain(){if(G=!0,Y=!1,Q=null,J=!1,X){let U=X;X=null,await U.drain().catch(()=>{})}}}}function l76($){return ix$.connect($)}var mx$,ix$,nx$,h76=100,u76=3000,c76=3000;var tx$=B(()=>{$6();mx$=k(lh(),1),ix$=k(dx$(),1),nx$=k(zB(),1)});function i61($,Z){return`${$}.${Z}`}class n61{cache;constructor($){this.cache=_g({ttlMs:$?.ttlMs??d76,maxSize:$?.maxSize??m76})}async get($,Z){return this.cache.get(i61($,Z))??null}async set($,Z,X){this.cache.set(i61($,Z),X)}async invalidate($,Z){this.cache.delete(i61($,Z))}teardown(){this.cache.clear()}}var d76=600000,m76=5000;var ox$=()=>{};function fz0($,Z){return`${$}:${Z}`}function p61($){let Z=_g({ttlMs:$?.ttlMs??i76,maxSize:$?.maxSize??n76}),X=$?.getConnection,Q=crypto.randomUUID(),Y=new TextEncoder,G=new TextDecoder,J=null;function W(K,H){let N=X?.();if(!N)return;try{N.publish(rx$,Y.encode(JSON.stringify({organizationId:K,keyId:H,originId:Q})))}catch(F){console.warn("[ProviderKeyCache] Publish failed (non-critical):",F)}}return{get(K,H){return Z.get(fz0(K,H))},set(K,H,N){Z.set(fz0(K,H),N)},invalidate(K,H){Z.delete(fz0(K,H)),W(K,H)},start(){if(J)return;let K=X?.();if(!K)return;J=K.subscribe(rx$),(async()=>{for await(let H of J)try{let N=JSON.parse(G.decode(H.data));if(N.originId===Q)continue;Z.delete(fz0(N.organizationId,N.keyId))}catch{}})().catch(console.error)},teardown(){J?.unsubscribe(),J=null,Z.clear()}}}var rx$="studio.ai-provider-keys.invalidate",i76=30000,n76=5000;var ax$=()=>{};class t61{options;subscriptions=[];onCancel=null;encoder=new TextEncoder;originId=crypto.randomUUID();seenMessageIds=new Set;constructor($){this.options=$}async start($){if($)this.onCancel=$;if(this.subscriptions.length>0)return;if(!this.onCancel)return;let Z=this.options.getConnection();if(!Z)return;let X=new TextDecoder;this.subscriptions=sx$.map((Q)=>Z.subscribe(Q));for(let Q of this.subscriptions)(async()=>{for await(let Y of Q)try{let G=JSON.parse(X.decode(Y.data));if(G.originId===this.originId)continue;if(G.messageId&&this.hasSeen(G.messageId))continue;this.onCancel?.(G.taskId)}catch{}})().catch(console.error)}broadcast($){if(/[.*>\s]/.test($)){console.warn("[NatsCancelBroadcast] Invalid threadId, skipping broadcast");return}this.onCancel?.($);try{let Z=this.options.getConnection();if(!Z)return;let X=this.encoder.encode(JSON.stringify({taskId:$,originId:this.originId,messageId:crypto.randomUUID()}));for(let Q of sx$)Z.publish(Q,X)}catch(Z){console.warn("[NatsCancelBroadcast] Publish failed (non-critical):",Z)}}publishControlFrame($,Z){}async stop(){for(let $ of this.subscriptions)$.unsubscribe();this.subscriptions=[],this.seenMessageIds.clear(),this.onCancel=null}hasSeen($){if(this.seenMessageIds.has($))return!0;if(this.seenMessageIds.add($),this.seenMessageIds.size>1000){let Z=this.seenMessageIds.values().next().value;if(Z)this.seenMessageIds.delete(Z)}return!1}}var sx$;var ex$=B(()=>{sx$=["studio.decopilot.cancel","mesh.decopilot.cancel"]});var $y$=($)=>{let Z;return()=>Z??=$()},o61,r61;var Zy$=B(()=>{v6();o61=$y$(()=>k$.createHistogram("decopilot.stream.encode_ms",{description:"Per-chunk JSON.stringify+encode time for decopilot stream",unit:"ms"})),r61=$y$(()=>k$.createCounter("decopilot.stream.published_chunks",{description:"Logical decopilot stream chunks published to JetStream",unit:"{chunks}"}))});function e76(){return{name:MN,subjects:[`${Gw0}.>`],storage:o3.StorageType.File,max_age:o76,max_bytes:a76,max_msgs_per_subject:s76,discard:o3.DiscardPolicy.Old,retention:o3.RetentionPolicy.Limits,duplicate_window:r76,num_replicas:1}}class Yy${chunks=0;encodeMs=0;maxMs=0;bytes=0;windowStart=performance.now();constructor(){setInterval(()=>this.flush(),1e4).unref?.()}record($,Z){if(this.chunks++,this.encodeMs+=$,$>this.maxMs)this.maxMs=$;this.bytes+=Z}flush(){let $=performance.now(),Z=$-this.windowStart;if(this.chunks>0&&Z>0)console.warn(JSON.stringify({msg:"stream-encode-trace",windowMs:Math.round(Z),chunks:this.chunks,encodeMs:Math.round(this.encodeMs),pctOfLoop:+(this.encodeMs/Z*100).toFixed(1),maxChunkMs:+this.maxMs.toFixed(2),mbEncoded:+(this.bytes/1048576).toFixed(2)}));this.chunks=0,this.encodeMs=0,this.maxMs=0,this.bytes=0,this.windowStart=$}}function Xy$($){let Z=Qy$.headers();for(let[X,Q]of Object.entries($))Z.set(X,Q);return Z}function QX6($,Z){let X=0;return{publish(Q,Y,G,J){Q.publish(Y,G,J?{headers:J}:void 0).catch((W)=>{if(X++,t76().add(1,{"org.id":Z??"unknown"}),X===1||X%100===0)console.warn(`[Decopilot] JetStream publish failed for thread ${$} (${X} total):`,W)})},get errorCount(){return X}}}function YX6($){if(!($ instanceof Error))return!1;if($.name==="TimeoutError")return!0;return/timeout|no responders|503/i.test($.message)}class a61{options;js=null;jsm=null;constructor($){this.options=$}async init(){let $=this.options.getConnection();if(!$){console.log("[Decopilot] StreamBuffer.init skipped: NATS not connected yet");return}let Z=e76(),X=await lZ(async()=>{let Q=this.options.getJetStreamManager?await this.options.getJetStreamManager():await o3.jetstreamManager($);try{await Q.streams.info(MN),await Q.streams.update(MN,Z)}catch(Y){if(Y instanceof Error&&Y.message.includes("stream not found"))await Q.streams.add(Z);else if(Y instanceof Error&&/can ?not change.*storage|storage type/i.test(Y.message))await Q.streams.delete(MN),await Q.streams.add(Z);else throw Y}return Q},{maxAttempts:5,minTimeout:250,maxTimeout:4000,jitter:0.5,isRetriable:YX6});this.js=this.options.getJetStream(),this.jsm=X,console.log(`[Decopilot] StreamBuffer.init ${this.js?"ready":"degraded (js=null)"}`)}pump($,Z,X,Q){let Y=this.js;if(!Y)return console.warn(`[Decopilot] pump: JetStream client unavailable for thread ${Z}; chunks NOT published to NATS`),Promise.resolve();let G=QX6(Z,Q),J=!1,W=()=>{if(J)return;J=!0;let H=xW$(Z);Y.publish(H.subject,H.data).catch(()=>{})};X.addEventListener("abort",W,{once:!0});let K=(H)=>{let N=performance.now(),F=Kp0(H,{runId:Z}),U=performance.now()-N;if(o61().record(U),r61().add(1,{"org.id":Q??"unknown"}),XX6?.record(U,F.reduce((O,w)=>O+w.data.length,0)),F.length===0){console.warn(`[Decopilot] dropping oversized stream chunk for thread ${Z}`);return}for(let O of F)G.publish(Y,O.subject,O.data,O.headers?Xy$(O.headers):void 0)};return(async()=>{let H=$.getReader(),N=0,F=0,U;try{while(!0){let{done:O,value:w}=await H.read();if(O)break;if(K(w),F++,++N>=64)N=0,await new Promise((D)=>setImmediate(D))}}catch(O){U=O,console.warn(`[Decopilot] stream pump error for thread ${Z}:`,O?.message??O)}finally{if(H.releaseLock(),W(),ZX6)console.warn(JSON.stringify({msg:"decopilot-stream-diag",event:"pump-done",taskId:Z,publishedChunks:F,publishErrors:G.errorCount}))}if(U!==void 0)throw U})()}async publishRawChunk($,Z,X){let Q=this.js;if(!Q)return!1;let Y=performance.now(),G=Kp0(Z,{runId:$,dedup:X});if(o61().record(performance.now()-Y),r61().add(1),G.length===0)return console.warn(`[Decopilot] dropping oversized raw chunk for thread ${$} (> MAX_CHUNKED_BYTES)`),!0;for(let J of G)await Q.publish(J.subject,J.data,{...J.headers?{headers:Xy$(J.headers)}:{},...J.msgId?{msgID:J.msgId}:{}});return!0}async publishDone($,Z,X){let Q=this.js;if(!Q)return!1;let Y=bW$({runId:$,fenceToken:Z,finalSeq:X});return await Q.publish(Y.subject,Y.data,{msgID:Y.msgId}),!0}async createTailStream($,Z,X){let Q=this.js;if(!Q)return console.warn(`[Decopilot] createTailStream: JetStream client unavailable for thread ${$}; no live tail`),null;let Y=X?.deliverPolicy==="new"?o3.DeliverPolicy.New:o3.DeliverPolicy.All,G=X?.closeOnDone??!1,J=Nw($),W;try{W=await(await Q.consumers.get(MN,{filter_subjects:J,deliver_policy:Y})).consume()}catch(D){return console.warn("[Decopilot] JetStream tail unavailable (non-critical):",D?.message??D),null}let N=Nw0({messages:async function*(){try{for await(let D of W)yield{subject:D.subject,data:D.data,headers:D.headers}}finally{W.stop()}}(),onCancel:()=>W.stop()}).pipeThrough(Jw0()).pipeThrough(Ww0()).getReader(),F=!1,U=()=>{if(F)return;F=!0;try{N.releaseLock()}catch{}},O=!1,w=()=>{if(O)return;O=!0,W.stop(),N.cancel().catch(()=>{}),U()};return Z?.addEventListener("abort",w,{once:!0}),new ReadableStream({async pull(D){for(;;){let{done:L,value:E}=await N.read();if(L){w(),D.close();return}let j=E;if(j.kind==="done"){if(G){w(),D.close();return}continue}D.enqueue(j.chunk);return}},cancel(){w()}})}purge($){if(!this.jsm)return;this.jsm.streams.purge(MN,{filter:Nw($)}).catch(()=>{})}teardown(){this.js=null,this.jsm=null}}var o3,Qy$,p76=($)=>{let Z;return()=>Z??=$()},t76,o76=86400000000000,r76=120000000000,a76=4294967296,s76=500000,$X6,ZX6,XX6;var Gy$=B(()=>{$6();Hp0();Fw0();Kw0();v6();Zy$();o3=k(zB(),1),Qy$=k(lh(),1),t76=p76(()=>k$.createCounter("decopilot.stream.publish_errors",{description:"Number of JetStream publish failures for decopilot stream chunks",unit:"{errors}"}));$X6=process.env.STREAM_ENCODE_TRACE==="1",ZX6=process.env.DECOPILOT_STREAM_TRACE==="1";XX6=$X6?new Yy$:null});function bz0($,Z,X,Q){if(!Q)return!1;return $.emit(Z,LW(X,Q.status,{title:Q.title??void 0,virtualMcpId:Q.virtual_mcp_id??void 0,createdBy:Q.created_by??void 0,triggerId:Q.trigger_id??null,branch:Q.branch??null,harnessId:Q.harness_id??void 0,createdAt:Q.created_at,updatedAt:Q.updated_at})),!0}var Jy$=B(()=>{L8()});class s61{storage;options;timer=null;constructor($,Z={}){this.storage=$;this.options=Z}start(){if(this.timer)return;let $=this.options.intervalMs??300000;this.timer=setInterval(()=>{this.runOnce()},$)}async runOnce(){let $=this.options.staleAfterMs??3600000;try{let Z=await this.storage.sweepAbandoned($);if(Z>0)console.log(`[async-research-sweeper] marked ${Z} stale jobs as abandoned`);return Z}catch(Z){return console.error("[async-research-sweeper] sweep failed",Z),0}}dispose(){if(this.timer)clearInterval(this.timer),this.timer=null}}function FX6($){return $ instanceof PQ}function UX6($,Z){return Z-$>=HX6}class e61{taskBoard;contextFactory;billing;options;timer=null;running=!1;cursor=null;constructor($,Z,X,Q={}){this.taskBoard=$;this.contextFactory=Z;this.billing=X;this.options=Q}start(){if(this.timer)return;let $=this.options.intervalMs??GX6;this.timer=setInterval(()=>{this.runOnce()},$),this.timer.unref()}async runOnce(){if(this.running)return 0;this.running=!0;let $=0;try{let Z=this.options.batchSize??WX6,X=this.options.itemIntervalMs??JX6,Q=await this.taskBoard.listItemsPendingReview(Z,this.cursor,new Date(Date.now()-X)),Y=Q.at(-1);this.cursor=Q.length===Z&&Y?{updatedAt:Y.updatedAt,id:Y.id}:null;for(let{id:G,organizationId:J}of Q)try{if(await this.reconcileItem(G,J))$++}catch(W){console.error(`[task-board-review-sweeper] ${G} failed`,W)}await this.reapNeverStartedThreads(Z),$+=await this.dispatchDueRetries(Z),await this.reactToUnhandledFailures(Z)}catch(Z){console.error("[task-board-review-sweeper] sweep failed",Z)}finally{this.running=!1}return $}async reapNeverStartedThreads($){try{let Z=await this.taskBoard.failNeverStartedLinkedThreads($,new Date(Date.now()-CJ$),pp0);for(let X of Z)console.warn(`[task-board-review-sweeper] failed never-started thread ${X.threadId} on ${X.itemId}`)}catch(Z){console.error("[task-board-review-sweeper] reaping failed",Z)}}async reactToUnhandledFailures($){let Z=await this.taskBoard.listItemsStuckAfterFailure($,new Date(Date.now()-NX6));for(let{id:X,organizationId:Q,threadId:Y}of Z)try{console.warn(`[task-board-review-sweeper] reacting to an unhandled failure on ${X}`),await Cn0(this.taskBoard,Y,Q),await _n0(this.taskBoard,this.billing,Y,Q)}catch(G){console.error(`[task-board-review-sweeper] unhandled-failure reaction for ${X} failed`,G)}}async dispatchDueRetries($){let Z=0,X=await this.taskBoard.listItemsDueForRetry($,new Date);for(let{id:Q,organizationId:Y,attempts:G}of X)try{if(!await this.taskBoard.claimDueRetry(Q,Y,new Date))continue;let J=await this.taskBoard.getById(Q,Y);if(!J||J.status!=="in_progress"||J.assigneeId!==M4)continue;let W=await this.contextFactory(Y,J.assignedBy??J.createdBy);if(!W)continue;await kN(W,J,{runClass:"retry"}),Z++,console.warn(`[task-board-review-sweeper] re-dispatched ${Q} after a failure (attempt ${G})`)}catch(J){if(console.error(`[task-board-review-sweeper] retry dispatch for ${Q} failed`,J),FX6(J)){await this.returnToTodo(Q,Y,J instanceof Error?J.message:String(J));continue}await this.taskBoard.scheduleRunRetry(Q,Y,G,new Date(Date.now()+KX6)).catch((W)=>console.error(`[task-board-review-sweeper] re-arming ${Q} failed`,W))}return Z}async returnToTodo($,Z,X){try{let Q=await this.taskBoard.getById($,Z);if(!Q||Q.status!=="in_progress")return;let Y=await this.taskBoard.returnToTodoAfterFailure($,Z,Q.updatedBy);if(!Y)return;await this.taskBoard.recordActivity({taskBoardItemId:$,action:"status_changed",actorId:null,data:{from:"in_progress",to:"todo",reason:X}}).catch(()=>{}),j4(Z,Y)}catch(Q){console.error(`[task-board-review-sweeper] returning ${$} to todo failed`,Q)}}async handOffReviewWithoutPr($,Z){let X=await this.taskBoard.listActivity(Z.id,Z.organizationId);if(!UX6(IL(X),Date.now()))return;await Gw($,Z,"no pull request is linked to this task \u2014 there is nothing for a "+"reviewer to review")}async reconcileItem($,Z){let X=await this.taskBoard.getById($,Z);if(!X)return!1;if(X.status!=="in_review")return!1;let Q=X.assigneeId===M4;await this.taskBoard.markSwept($,Z);let Y=await this.taskBoard.listPrs($,Z),G=await this.contextFactory(Z,X.assignedBy??X.createdBy);if(!G)return!1;if(Y.length===0){if(Q)await this.handOffReviewWithoutPr(G,X);return!1}if(await tK$(G,X))return!0;if(!Q)return!1;let J=await Promise.all(Y.map(async(W)=>({...W,...await Qy(Z,W)})));if(J.every((W)=>W.state===null))console.warn(`[task-board-review-sweeper] ${$}: no live PR state from GitHub (${J.length} PR(s)) \u2014 proceeding on unknown`);if(!mp0(J))return!1;return await Lw0(G,X),!0}dispose(){if(this.timer)clearInterval(this.timer),this.timer=null}}var GX6=60000,JX6=300000,WX6=50,KX6=60000,HX6=900000,NX6=120000;var Wy$=B(()=>{kZ();xp0();Fw();ln();v9();H3();tp0();Ow();hn()});import{readdir as OX6,rm as xz0}from"fs/promises";import{join as yz0}from"path";async function gz0($){let Z=new Date;Z.setUTCDate(Z.getUTCDate()-wX6),Z.setUTCHours(0,0,0,0);let X=0;try{let Q=await W_($);for(let Y of Q)if(/^\d{4}$/.test(Y))X+=await Ky$($,Y,Z);else if(!Y.startsWith(".")){let G=yz0($,Y),J=await W_(G);for(let K of J){if(!/^\d{4}$/.test(K))continue;X+=await Ky$(G,K,Z)}if((await W_(G)).length===0)await xz0(G,{recursive:!0,force:!0})}}catch(Q){console.warn("monitoring retention cleanup failed:",Q)}return X}async function Ky$($,Z,X){let Q=0,Y=yz0($,Z),G=await W_(Y);for(let W of G){if(!/^\d{2}$/.test(W))continue;let K=yz0(Y,W),H=await W_(K);for(let F of H){if(!/^\d{2}$/.test(F))continue;let U=new Date(`${Z}-${W}-${F}T00:00:00Z`);if(isNaN(U.getTime()))continue;if(U<X){let O=yz0(K,F);await xz0(O,{recursive:!0,force:!0}),Q++}}if((await W_(K)).length===0)await xz0(K,{recursive:!0,force:!0})}if((await W_(Y)).length===0)await xz0(Y,{recursive:!0,force:!0});return Q}async function W_($){try{return(await OX6($)).filter((X)=>!X.startsWith("."))}catch{return[]}}var wX6=30;var $51=()=>{};import{DBOS as Z51,SchedulerMode as BX6}from"@dbos-inc/dbos-sdk";async function LX6(){let $=[BJ(),H_(),pK()],Z=0;for(let X of $)try{Z+=await gz0(X)}catch(Q){console.error("[monitoring-retention] cleanup failed:",Q)}return console.log(`[monitoring-retention] deleted ${Z} day-dir(s) across ${$.length} signal dir(s)`),{deleted:Z,dirs:$.length}}async function EX6($,Z){await Z51.runStep(()=>LX6(),{name:"monitoringRetention"})}function Ny$(){if(Hy$)return;Hy$=!0;let $=Z51.registerWorkflow(EX6,{name:"monitoringRetentionWorkflow"});Z51.registerScheduled($,{name:"monitoringRetentionWorkflow",crontab:DX6,mode:BX6.ExactlyOncePerIntervalWhenActive})}var DX6="23 4 * * *",Hy$=!1;var Fy$=B(()=>{$Y();$51()});function Uy$($){return async(Z,X)=>{let Q=await $.db.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["member.role","organization.id as orgId","organization.slug as orgSlug","organization.name as orgName"]).where("member.userId","=",X).where("member.organizationId","=",Z).executeTakeFirst();if(!Q)return console.warn(`[automationContextFactory] User ${X} not found in org ${Z} \u2014 returning null`),null;let Y=await dG.create();Y.auth.user={id:X,role:Q.role},Y.organization={id:Q.orgId,slug:Q.orgSlug,name:Q.orgName};let G=await G81($.db,Z,Q.role);return Y.boundAuth=Y81({auth:Y.authInstance,headers:new Headers,role:Q.role,permissions:G,userId:X}),Y.access=new sD(X,void 0,Y.boundAuth,Q.role,"self"),Uw(Y,{id:Q.orgId,slug:Q.orgSlug}),Y}}var Oy$=B(()=>{eD();cV()});function jX6(){return{services:[{name:"Postgres",status:"pending",port:0},{name:"NATS",status:"pending",port:0}],migrationsStatus:"pending",serverUrl:null,logs:[]}}function PX6(){for(let $ of zX6)$()}function wy$($){let Z=[...X51.logs,$];X51={...X51,logs:Z.length>500?Z.slice(-500):Z},PX6()}function Q51(){return AX6}var X51,zX6,AX6=!1;var Y51=B(()=>{X51=jX6(),zX6=new Set});import{EventEmitter as TX6}from"events";var G51;var By$=B(()=>{Y51();G51=new TX6;G51.on("request",($)=>{wy$($)})});function Dy$(){return async($,Z)=>{let X=Date.now(),Q=$.req.method,Y=$.req.path;if(Y==="/api/auth/get-session"||Y.includes("favicon")){await Z();return}let G="",J=!1;if(Y.startsWith("/mcp")&&Q==="POST"){J=!0;try{if($.req.header("Content-Type")?.includes("application/json")){let U=await $.req.raw.clone().json();if(U.method==="tools/call"&&U.params?.name){let O=Eh(U.params.name),w=U.params.arguments||{},D=Object.keys(w).map((E)=>Eh(E)),L=D.length>0?D.slice(0,3).join(",")+(D.length>3?"\u2026":""):"";G=`${Z5.tool}${O}${Z5.dim}(${L})${Z5.reset}`}else if(U.method)G=`${Z5.dim}${Eh(U.method)}${Z5.reset}`}}catch{}}let W=Eh(Y);if(Y.startsWith("/mcp/conn_")){let N=Y.split("/")[2]??"";W=`/mcp/${Z5.mcp}${Eh(N.slice(0,12))}\u2026${Z5.reset}`}else if(Y==="/mcp")W=`${Z5.mcp}/mcp${Z5.reset}`;else if(Y==="/mcp/registry")W=`${Z5.mcp}/mcp/registry${Z5.reset}`;let K=IX6(Q),H=J?"\u25C0":"\u2190";if(!Q51())console.log(`${Z5.dim}${H}${Z5.reset} ${K}${Q}${Z5.reset} ${W}${G?` ${G}`:""}`);try{await Z()}finally{let N=Date.now()-X,F=$.res.status,U=RX6(F),O=N<1000?`${N}ms`:`${(N/1000).toFixed(1)}s`,w=J?"\u25B6":"\u2192";if(!Q51())console.log(`${Z5.dim}${w}${Z5.reset} ${K}${Q}${Z5.reset} ${W}${G?` ${G}`:""} ${U}${F}${Z5.reset} ${Z5.duration}${O}${Z5.reset}`);G51.emit("request",{method:Q,path:Eh(Y),status:F,duration:N,timestamp:new Date})}}}var Z5,RX6=($)=>{if($>=500)return Z5.serverError;if($>=400)return Z5.clientError;if($>=300)return Z5.redirect;return Z5.ok},IX6=($)=>{return Z5[$]||Z5.reset},Eh=($)=>{return $.replace(/\r/g,"").replace(/\n/g,"").replace(/\x1b\[[0-9;]*m/g,"").replace(/[\x00-\x1f\x7f-\x9f]/g,"")};var Ly$=B(()=>{Y51();By$();Z5={reset:"\x1B[0m",dim:"\x1B[2m",bold:"\x1B[1m",GET:"\x1B[36m",POST:"\x1B[33m",PUT:"\x1B[35m",DELETE:"\x1B[31m",ok:"\x1B[32m",redirect:"\x1B[36m",clientError:"\x1B[33m",serverError:"\x1B[31m",mcp:"\x1B[35m",tool:"\x1B[96m",duration:"\x1B[90m"}});import{createHmac as Py$}from"crypto";import{mkdir as qX6,readdir as MX6,rm as Ey$,stat as Ay$}from"fs/promises";import{join as W51,relative as kX6}from"path";import{z as E$}from"zod";function Ry$($){let Z=$.replace(/[^a-zA-Z0-9_-]/g,"_");return W51(SX6,Z)}function Iy$($){return $.replace(/^\/+/,"").replace(/\.\./g,"")}function J51($,Z){let X=Ry$($),Q=Iy$(Z);return W51(X,Q)}function VX6($,Z,X,Q){let Y=y0().encryptionKey||"dev-secret",G=`${$}:${Z}:${X}:${Q}`;return Py$("sha256",Y).update(G).digest("hex")}function zy$($,Z,X,Q,Y){let G=Math.floor(Date.now()/1000)+Q,J=VX6(Z,X,G,Y),W=new URL(`/api/dev-assets/${Z}/${Iy$(X)}`,$);return W.searchParams.set("expires",G.toString()),W.searchParams.set("signature",J),W.searchParams.set("method",Y),W.toString()}function qy$($,Z,X){let Q=`${$}:${Z.getTime()}:${X}`;return`"${Py$("md5","etag").update(Q).digest("hex")}"`}async function My$($,Z,X,Q,Y){try{let G=await MX6($,{withFileTypes:!0});for(let J of G){let W=W51($,J.name),H=kX6(Z,W).replace(/\\/g,"/");if(X&&!H.startsWith(X))continue;if(J.isDirectory())if(Q){let N=H+"/";if(!X||N.startsWith(X)){if(!(X?H.slice(X.length):H).includes("/"))Y.commonPrefixes.add(N)}}else await My$(W,Z,X,Q,Y);else if(J.isFile()){if(Q&&X){let N=H.slice(X.length);if(N.includes(Q)){let F=N.indexOf(Q),U=X+N.slice(0,F+1);Y.commonPrefixes.add(U);continue}}try{let N=await Ay$(W);Y.objects.push({key:H,size:N.size,lastModified:N.mtime.toISOString(),etag:qy$(W,N.mtime,N.size)})}catch{}}}}catch{}}function ky$($,Z){let Q=o($).id;return[{name:"LIST_OBJECTS",description:"List objects in the local assets directory with pagination support",inputSchema:E$.object({prefix:E$.string().optional(),maxKeys:E$.number().optional().default(1000),continuationToken:E$.string().optional(),delimiter:E$.string().optional()}),outputSchema:E$.object({objects:E$.array(E$.object({key:E$.string(),size:E$.number(),lastModified:E$.string(),etag:E$.string()})),nextContinuationToken:E$.string().optional(),isTruncated:E$.boolean(),commonPrefixes:E$.array(E$.string()).optional()}),handler:async(Y)=>{let G=Y,J=G.prefix||"",W=G.maxKeys??1000,K=G.delimiter,H=G.continuationToken,N=Ry$(Q);await qX6(N,{recursive:!0});let F={objects:[],commonPrefixes:new Set};await My$(N,N,J,K,F),F.objects.sort((L,E)=>L.key.localeCompare(E.key));let U=0;if(H){if(U=F.objects.findIndex((L)=>L.key>H),U===-1)U=F.objects.length}let O=F.objects.slice(U,U+W),w=U+W<F.objects.length,D=w?O[O.length-1]?.key:void 0;return{objects:O,isTruncated:w,nextContinuationToken:D,commonPrefixes:Array.from(F.commonPrefixes).sort()}}},{name:"GET_OBJECT_METADATA",description:"Get metadata for a file in the local assets directory",inputSchema:E$.object({key:E$.string()}),outputSchema:E$.object({contentType:E$.string().optional(),contentLength:E$.number(),lastModified:E$.string(),etag:E$.string(),metadata:E$.record(E$.string(),E$.string()).optional()}),handler:async(Y)=>{let G=Y,J=J51(Q,G.key),W=await Ay$(J);return{contentType:l81(G.key),contentLength:W.size,lastModified:W.mtime.toISOString(),etag:qy$(J,W.mtime,W.size)}}},{name:"GET_PRESIGNED_URL",description:"Generate a presigned URL for downloading a file from local storage",inputSchema:E$.object({key:E$.string(),expiresIn:E$.number().optional()}),outputSchema:E$.object({url:E$.string(),expiresIn:E$.number()}),handler:async(Y)=>{let G=Y,J=G.expiresIn??jy$;return{url:zy$(Z,Q,G.key,J,"GET"),expiresIn:J}}},{name:"PUT_PRESIGNED_URL",description:"Generate a presigned URL for uploading a file to local storage",inputSchema:E$.object({key:E$.string(),expiresIn:E$.number().optional(),contentType:E$.string().optional()}),outputSchema:E$.object({url:E$.string(),expiresIn:E$.number()}),handler:async(Y)=>{let G=Y,J=G.expiresIn??jy$;return{url:zy$(Z,Q,G.key,J,"PUT"),expiresIn:J}}},{name:"DELETE_OBJECT",description:"Delete a single file from local storage",inputSchema:E$.object({key:E$.string()}),outputSchema:E$.object({success:E$.boolean(),key:E$.string()}),handler:async(Y)=>{let G=Y,J=J51(Q,G.key);try{return await Ey$(J),{success:!0,key:G.key}}catch{return{success:!1,key:G.key}}}},{name:"DELETE_OBJECTS",description:"Delete multiple files from local storage",inputSchema:E$.object({keys:E$.array(E$.string()).max(1000)}),outputSchema:E$.object({deleted:E$.array(E$.string()),errors:E$.array(E$.object({key:E$.string(),message:E$.string()}))}),handler:async(Y)=>{let G=Y,J=[],W=[];return await Promise.all(G.keys.map(async(K)=>{let H=J51(Q,K);try{await Ey$(H),J.push(K)}catch(N){W.push({key:K,message:N instanceof Error?N.message:"Unknown error"})}})),{deleted:J,errors:W}}}]}async function K51($,Z,X){let Q=ky$(Z,X),Y=new RW({name:"dev-assets-mcp",version:"1.0.0"},{capabilities:{tools:{}},jsonSchemaValidator:J5});for(let J of Q){let W="shape"in J.inputSchema?J.inputSchema.shape:E$.object({}).shape,K=J.outputSchema&&"shape"in J.outputSchema?J.outputSchema.shape:E$.object({}).shape;Y.registerTool(J.name,{description:J.description??"",inputSchema:W,outputSchema:K,annotations:J.annotations,_meta:J._meta},async(H)=>{try{let N=await J.handler(H);return{content:[{type:"text",text:JSON.stringify(N)}],structuredContent:N}}catch(N){return{content:[{type:"text",text:`Error: ${N.message}`}],isError:!0}}})}let G=new iX({enableJsonResponse:$.headers.get("Accept")?.includes("application/json")??!1});return await Y.connect(G),oG(Y,G,$,"mcp:dev-assets")}async function Sy$($,Z,X,Q){let G=ky$(X,Q).find((J)=>J.name===$);if(!G)return{content:[{type:"text",text:`Tool not found: ${$}`}],isError:!0};try{let J=await G.handler(Z);return{content:[{type:"text",text:JSON.stringify(J)}]}}catch(J){return{content:[{type:"text",text:J instanceof Error?J.message:String(J)}],isError:!0}}}var SX6="./data/assets",jy$=3600,Ty$,Vy$;var Cy$=B(()=>{R$();Hy();C8();Ol();nV();MX();Cj0();Ty$=new U1;Ty$.all("/",async($)=>{let Z=$.get("studioContext"),X=new URL($.req.url),Q=`${X.protocol}//${X.host}`;return K51($.req.raw,Z,Q)});Vy$=Ty$});var _y$={};N4(_y$,{mountDevRoutes:()=>CX6});function CX6($,Z){$.all("/mcp/:connectionId{.*_dev-assets$}",Z,async(Q)=>{let Y=Q.get("studioContext"),G=new URL(Q.req.url),J=`${G.protocol}//${G.host}`;return K51(Q.req.raw,Y,J)}),$.all("/mcp/:connectionId{.*_dev-assets$}/call-tool/:toolName",Z,async(Q)=>{let Y=Q.get("studioContext"),G=new URL(Q.req.url),J=`${G.protocol}//${G.host}`,W=Q.req.param("toolName");if(!W)return Q.json({error:"Missing tool name"},400);let K=await Q.req.json(),H=await Sy$(W,K,Y,J);if(H.isError)return Q.json(H.content,500);return Q.json(H.content)}),$.use("/mcp/dev-assets",Z),$.route("/mcp/dev-assets",Vy$);let X=new U1;X.use("*",p3({mountPath:"/api/dev-assets"})),X.route("/",Vj0({orgFromPath:!1})),$.route("/api/dev-assets",X)}var vy$=B(()=>{C8();f81();Cj0();Cy$()});import{sql as _X6}from"kysely";import{randomUUID as fy$}from"crypto";import{z as vX6}from"zod";async function bX6($){let Z=new Date().toISOString(),X=fy$(),Q=u4.SELF($.organizationId),Y="registry.publish_request.created",G={requestId:$.request.id,requestedId:$.request.requested_id,title:$.request.title,status:$.request.status,createdAt:$.request.created_at,requester:{name:$.request.requester_name,email:$.request.requester_email}};await $.db.insertInto("events").values({id:X,organization_id:$.organizationId,type:"registry.publish_request.created",source:Q,specversion:"1.0",subject:$.request.id,time:Z,datacontenttype:"application/json",dataschema:null,data:JSON.stringify(G),cron:null,status:"pending",attempts:0,last_error:null,next_retry_at:null,created_at:Z,updated_at:Z}).execute();let J=await $.db.selectFrom("event_subscriptions").select(["id"]).where("organization_id","=",$.organizationId).where("enabled","=",1).where("event_type","=","registry.publish_request.created").where((W)=>W.or([W("publisher","is",null),W("publisher","=",Q)])).execute();if(J.length>0)await $.db.insertInto("event_deliveries").values(J.map((W)=>({id:fy$(),event_id:X,subscription_id:W.id,status:"pending",attempts:0,last_error:null,delivered_at:null,next_retry_at:null,created_at:Z}))).execute();try{await _X6`SELECT
       pg_notify('studio_events', ${X}),