decocms 4.262.0 → 4.262.2

package/dist/server/cli.js

@@ -1396,7 +1396,7 @@ Usage: deco services <up|down|status>`),process.exit(1)}}var Pp1=L(()=>{vf()});f
       `.execute($);if(Number(W.rows[0]?.cnt)===0){console.warn(`Failed to migrate ${J}/${K}, keeping in old table`);continue}}await Ky`
       DELETE FROM kysely_migration WHERE name = ${X}
     `.execute($)}}async function dr1($){await $r6($),await Zr6($);let Z=new cr1({db:$,provider:{getMigrations:()=>Promise.resolve(Ep0)}}),{error:X,results:Q}=await Z.migrateToLatest(),Y=0;if(Q?.forEach((G)=>{if(G.status==="Success")Y++;else if(G.status==="Error")console.error(`Failed to execute migration "${G.migrationName}"`)}),X)throw console.error("Failed to migrate"),console.error(X),X;return Y}async function Xr6($){let{keepOpen:Z=!1,database:X,skipBetterAuth:Q=!1}=$??{},Y="skipped";if(!Q&&!X)Y=await bl0();let G=X??W6(),J=async()=>{if(!Z&&!X)await mB(G).catch((K)=>{console.warn("Warning: Error closing database:",K)})};try{let K=await dr1(G.db);return await J(),{betterAuth:Y,kysely:K}}catch(K){throw await J(),K}}async function Qr6(){let $=W6(),Z=new cr1({db:$.db,provider:{getMigrations:()=>Promise.resolve(Ep0)}}),{error:X,results:Q}=await Z.migrateDown();if(Q?.forEach((Y)=>{if(Y.status==="Success")console.log(`\u2705 Migration "${Y.migrationName}" rolled back successfully`);else if(Y.status==="Error")console.error(`\u274C Failed to rollback migration "${Y.migrationName}"`)}),X)throw console.error("Failed to rollback migration"),console.error(X),X}var ir1=L(()=>{ur1();yl0();JX()});async function K70($){let Z={...process.env},X=s80($,Z);console.log(ZD1(X.settings.encryptionKey));let Q=X.settings.betterAuthSecret||(X.settings.localMode?an1(X.settings.dataDir):""),{ensureServices:Y}=await Promise.resolve().then(() => (LZ0(),OZ0)),{outputs:G,services:J}=await Y({home:X.settings.dataDir,externalDatabaseUrl:X.externalDatabaseUrl,externalNatsUrl:X.externalNatsUrl});if(!X.skipMigrations){let{migrateBetterAuth:W}=await Promise.resolve().then(() => (yl0(),en1));await W(G.databaseUrl);let{createDatabase:H}=await Promise.resolve().then(() => (JX(),wn1)),{migrateToLatest:F}=await Promise.resolve().then(() => (ir1(),mr1)),U=H(G.databaseUrl);await F({keepOpen:!0,database:U,skipBetterAuth:!0})}let K={...X.settings,betterAuthSecret:Q,databaseUrl:G.databaseUrl,natsUrls:G.natsUrls,...G.s3?{s3Endpoint:G.s3.endpoint,s3Bucket:G.s3.bucket,s3AccessKeyId:G.s3.accessKeyId,s3SecretAccessKey:G.s3.secretAccessKey,s3ForcePathStyle:G.s3.forcePathStyle}:{},...G.natsTunnel?{natsPublicUrl:G.natsTunnel.publicUrl,natsAccountJwt:G.natsTunnel.accountJwt,natsAccountSigningKey:G.natsTunnel.accountSigningKey,natsOperatorJwt:G.natsTunnel.operatorJwt,natsTunnelPublicEnabled:!0,natsCredsPath:G.natsTunnel.credsPath}:{}};return Ap1(K),{settings:K,services:J.map((W)=>({name:W.name==="PostgreSQL"?"Postgres":W.name,port:W.port})),managedServiceNames:J.filter((W)=>W.owner==="managed").map((W)=>W.name)}}var jp0=L(()=>{vf();sn1();_8()});var tr1={};U0(tr1,{updateService:()=>kE,subscribeCliState:()=>Ap0,setTuiConsoleIntercepted:()=>W70,setServerUrl:()=>Qp,setMigrationsDone:()=>Xp,setDevMode:()=>Jr6,resetCliStateForTests:()=>Yr6,isTuiConsoleIntercepted:()=>H70,getCliState:()=>Pp0,addLogEntry:()=>oB});function pr1(){return{services:[{name:"Postgres",status:"pending",port:0},{name:"NATS",status:"pending",port:0}],migrationsStatus:"pending",serverUrl:null,logs:[]}}function Yr6(){nQ=pr1()}function Gr6(){return[{name:"Postgres",status:"pending",port:0},{name:"NATS",status:"pending",port:0}]}function Zp(){for(let $ of zp0)$()}function Pp0(){return nQ}function Ap0($){return zp0.add($),()=>zp0.delete($)}function kE($){nQ={...nQ,services:nQ.services.map((Z)=>Z.name===$.name?$:Z)},Zp()}function Xp(){nQ={...nQ,migrationsStatus:"done"},Zp()}function Qp($){nQ={...nQ,serverUrl:$},Zp()}function oB($){let Z=[...nQ.logs,$];nQ={...nQ,logs:Z.length>500?Z.slice(-500):Z},Zp()}function Jr6(){nQ={...nQ,services:[...Gr6(),{name:"API",status:"pending",port:0},{name:"Vite",status:"pending",port:0}]},Zp()}function W70($){nr1=$}function H70(){return nr1}var nQ,zp0,nr1=!1;var SE=L(()=>{nQ=pr1();zp0=new Set});import{createServer as or1}from"net";function Kr6($){return new Promise((Z)=>{let X=or1();X.once("error",()=>Z(!1)),X.listen($,"0.0.0.0",()=>{X.close(()=>Z(!0))})})}async function Yp($){if(await Kr6($))return $;let Z=await new Promise((X,Q)=>{let Y=or1();Y.once("error",Q),Y.listen(0,"0.0.0.0",()=>{let G=Y.address(),J=typeof G==="object"&&G?G.port:0;Y.close(()=>X(J))})});return console.warn(`Port ${$} is in use, using port ${Z} instead.`),Z}var Tp0=()=>{};function Gp($){return $.replace(/\x1b\[[0-9;]*m/g,"")}var Rp0={};U0(Rp0,{startDevServer:()=>Hr6});import{join as Wr6}from"path";function rr1($){let Z=$.getReader(),X=new TextDecoder,Q="";function Y(){let G=Q.split(`
-`);Q=G.pop()??"";for(let J of G){let K=Gp(J).replace(/^\[\d+\]\s*/,"").trim();if(!K)continue;oB({method:"",path:"",status:0,duration:0,timestamp:new Date,rawLine:K})}}(async()=>{for(;;){let{done:G,value:J}=await Z.read();if(G)break;Q+=X.decode(J,{stream:!0}),Y()}if(Q.trim()){let G=Gp(Q).replace(/^\[\d+\]\s*/,"").trim();if(G)oB({method:"",path:"",status:0,duration:0,timestamp:new Date,rawLine:G})}})()}async function Hr6($){let{baseUrl:Z,noTui:X}=$,Q=process.env.HOST==="0.0.0.0"&&Boolean(process.env.PORT),Y=Q?process.env.PORT:$.vitePort,G=Z||`http://localhost:${Y}`,J=Q?await Yp(Number(Y)+1):await Yp(Number($.port)),{settings:K,services:W,managedServiceNames:H}=await K70({port:String(J),home:$.home,baseUrl:$.baseUrl,localMode:$.localMode,skipMigrations:$.skipMigrations,noTui:$.noTui,vitePort:$.vitePort});for(let w of W)kE({name:w.name,status:"ready",port:w.port});Xp();let F=Wr6(import.meta.dir,"..","..","..","..",".."),U=X===!0,N=Bun.spawn(["bun","run","dev:servers"],{cwd:F,env:{...process.env,PORT:String(K.port),VITE_PORT:String(Y),DATABASE_URL:K.databaseUrl,NATS_URL:K.natsUrls.join(","),NODE_ENV:K.nodeEnv,BASE_URL:G,DECOCMS_LOCAL_MODE:String(K.localMode),DECOCMS_HOME:K.dataDir,DATA_DIR:K.dataDir,DECO_CLI:"1",...K.betterAuthSecret?{BETTER_AUTH_SECRET:K.betterAuthSecret}:{},...K.s3Endpoint?{S3_ENDPOINT:K.s3Endpoint,S3_BUCKET:K.s3Bucket??"",S3_ACCESS_KEY_ID:K.s3AccessKeyId??"",S3_SECRET_ACCESS_KEY:K.s3SecretAccessKey??"",S3_FORCE_PATH_STYLE:String(K.s3ForcePathStyle)}:{},...K.natsPublicUrl&&K.natsAccountJwt&&K.natsAccountSigningKey?{NATS_PUBLIC_URL:K.natsPublicUrl,NATS_ACCOUNT_JWT:K.natsAccountJwt,NATS_ACCOUNT_SIGNING_KEY:K.natsAccountSigningKey,NATS_OPERATOR_JWT:K.natsOperatorJwt??"",NATS_TUNNEL_PUBLIC_ENABLED:"true",...K.natsCredsPath?{NATS_CREDS:K.natsCredsPath}:{}}:{}},stdio:["inherit",U?"inherit":"pipe",U?"inherit":"pipe"]});if(!U)rr1(N.stdout),rr1(N.stderr);Qp(G),kE({name:"Vite",status:"ready",port:Number(Y)}),kE({name:"API",status:"ready",port:Number(K.port)});let O=async(w)=>{if(N.kill(w),await N.exited,H.length>0){let{stopServices:D}=await Promise.resolve().then(() => (LZ0(),OZ0));await D(K.dataDir)}};return process.on("SIGINT",()=>O("SIGINT")),process.on("SIGTERM",()=>O("SIGTERM")),{port:Number(Y),process:N}}var Ip0=L(()=>{jp0();SE();Tp0()});var F70;var qp0=L(()=>{F70={name:"decocms",version:"4.262.0",description:"Deco CMS \u2014 Self-hostable MCP Gateway for managing AI connections and tools",author:"Deco team",repository:{type:"git",url:"git+https://github.com/decocms/studio.git",directory:"apps/api"},bugs:{url:"https://github.com/decocms/studio/issues"},type:"module",bin:{deco:"./dist/server/cli.js"},files:["dist/**/*"],scripts:{dev:"bun run migrate && bun run dev:server","dev:server":"bun run --cwd=../../packages/sandbox build && NODE_ENV=development bun --env-file=.env --hot run src/index.ts",build:"bun run build:server","build:server":"bun run scripts/bundle-server-script.ts --dist ./dist/server","generate:tool-contracts":"bun run scripts/generate-tool-contracts.ts","db:migrate":"bun run ./dist/server/migrate.js","db:migrate:dbos":"bun run ./dist/server/migrate-dbos.js",check:"tsc --noEmit",start:"bun run ./dist/server/server.js",migrate:"bun run src/database/migrate.ts","migrate:dbos":"bun run src/database/migrate-dbos.ts",test:"bun test src","better-auth:migrate":"bunx --bun @better-auth/cli migrate -y --config src/auth/index.ts",prepublishOnly:"bun run --cwd=../.. build:studio"},optionalDependencies:{"@duckdb/node-api":"^1.5.0-r.1"},dependencies:{"@ai-sdk/anthropic":"^3.0.85","@ai-sdk/google":"^3.0.83","@ai-sdk/openai":"^3.0.73","@anthropic-ai/sdk":"^0.105.0","@aws-sdk/client-s3":"^3.1013.0","@aws-sdk/client-sts":"^3.1013.0","@aws-sdk/lib-storage":"^3.1013.0","@aws-sdk/s3-request-presigner":"^3.1013.0","@clickhouse/client":"^1.8.1","@dbos-inc/dbos-sdk":"^4.21.6","@inkjs/ui":"^2.0.0","@nats-io/jetstream":"3.4.0","@nats-io/kv":"3.4.0","@nats-io/nats-core":"3.4.0","@nats-io/transport-node":"3.4.0","@openrouter/ai-sdk-provider":"^2.9.1","@opentelemetry/core":"^2.6.0","embedded-postgres":"^18.3.0-beta.16",ink:"^6.8.0",kysely:"^0.28.12","posthog-node":"^5.0.0",react:"^19.2.6","react-dom":"^19.2.6"},devDependencies:{"@ai-sdk/provider":"^3.0.10","@better-auth/sso":"1.4.1","@decocms/better-auth":"1.5.17","@decocms/bindings":"workspace:*","@decocms/mcp-utils":"workspace:*","@decocms/runtime":"workspace:*","@decocms/sandbox":"workspace:*","@decocms/shared":"workspace:*","@jitl/quickjs-wasmfile-release-sync":"0.31.0","@modelcontextprotocol/sdk":"1.29.0","@nats-io/jwt":"0.0.10-5","@opentelemetry/api":"^1.9.0","@opentelemetry/api-logs":"^0.211.0","@opentelemetry/exporter-logs-otlp-proto":"^0.211.0","@opentelemetry/exporter-prometheus":"^0.208.0","@opentelemetry/exporter-trace-otlp-proto":"^0.207.0","@opentelemetry/instrumentation-runtime-node":"^0.24.0","@opentelemetry/resources":"^2.6.0","@opentelemetry/sdk-logs":"^0.211.0","@opentelemetry/sdk-metrics":"^2.2.0","@opentelemetry/sdk-node":"^0.207.0","@opentelemetry/sdk-trace-base":"^2.5.0","@types/bun":"^1.3.1","@types/google.maps":"^3.65.2","@types/pg":"^8.15.6","@types/react-syntax-highlighter":"^15.5.13","@vercel/nft":"^1.1.1",ai:"^6.0.208","better-auth":"1.4.22",croner:"^9.1.0",degit:"^2.8.4",hono:"^4.10.7",jose:"^6.0.11",nanoid:"^5.1.6",pg:"^8.16.3",typescript:"^7.0.2",typescript5:"npm:typescript@^5.9.3",zod:"4.3.6"},homepage:"https://github.com/decocms/studio",keywords:["mcp","model-context-protocol","ai","gateway","self-hosted","tools"],license:"MIT",publishConfig:{access:"public"}}});import{Box as Ur6,Text as ar1}from"ink";import{jsx as Nr6,jsxs as sr1}from"react/jsx-runtime";function er1({version:$}){return sr1(Ur6,{flexDirection:"column",marginTop:1,children:[gZ0.map((Z,X)=>Nr6(ar1,{color:hZ0[X],children:Z},X)),sr1(ar1,{dimColor:!0,children:[" v",$]})]})}var $a1=L(()=>{mi()});import{Box as CE,Text as rB}from"ink";import{Spinner as Br6}from"@inkjs/ui";import{jsx as YG,jsxs as Wy}from"react/jsx-runtime";function Za1({status:$}){if($==="pending")return YG(Br6,{label:""});return YG(rB,{color:"green",children:"\u2713"})}function Or6($){return`${$.name}: ${$.port||"...."}`}function Xa1({services:$,migrationsStatus:Z,home:X,serverUrl:Q}){return Wy(CE,{flexDirection:"column",paddingBottom:1,children:[YG(er1,{version:F70.version}),YG(CE,{marginBottom:1,children:YG(rB,{dimColor:!0,children:"\u2500".repeat(80)})}),YG(CE,{children:Wy(rB,{dimColor:!0,children:["Home: ",X]})}),Wy(CE,{gap:2,children:[$.map((Y)=>Wy(CE,{gap:1,children:[YG(rB,{children:Or6(Y)}),YG(Za1,{status:Y.status})]},Y.name)),Wy(CE,{gap:1,children:[YG(rB,{children:"Migrations"}),YG(Za1,{status:Z})]})]}),YG(CE,{children:Q?Wy(rB,{children:["Open in browser: ",YG(rB,{color:"cyan",children:Q})]}):YG(rB,{dimColor:!0,children:"Starting..."})})]})}var Qa1=L(()=>{qp0();$a1()});import{Box as Lr6,Text as Jp}from"ink";import{jsx as Mp0,jsxs as Vp0}from"react/jsx-runtime";function wr6($){if($>=500)return"red";if($>=400)return"yellow";if($>=300)return"cyan";return"green"}function Ya1({logs:$}){return Mp0(Lr6,{flexDirection:"column",children:$.map((Z,X)=>{if(Z.rawLine)return Mp0(Jp,{dimColor:!0,children:Z.rawLine},X);let Q=Z.duration<1000?`${Z.duration}ms`:`${(Z.duration/1000).toFixed(1)}s`;return Vp0(Jp,{children:[Vp0(Jp,{dimColor:!0,children:[Z.method.padEnd(6)," ",Z.path.padEnd(30)," "]}),Mp0(Jp,{color:wr6(Z.status),children:Z.status}),Vp0(Jp,{dimColor:!0,children:[" ",Q.padStart(8)]})]},X)})})}var Ga1=()=>{};var kp0={};U0(kp0,{App:()=>jr6});import{Box as Dr6}from"ink";import{useSyncExternalStore as Er6}from"react";import{jsx as Ja1,jsxs as zr6}from"react/jsx-runtime";function jr6({home:$}){let Z=Er6(Ap0,Pp0);return zr6(Dr6,{flexDirection:"column",children:[Ja1(Xa1,{services:Z.services,migrationsStatus:Z.migrationsStatus,home:$,serverUrl:Z.serverUrl}),Ja1(Ya1,{logs:Z.logs})]})}var Sp0=L(()=>{Qa1();Ga1();SE()});var lJ="thread-gate",YU="decopilot-hosted-harness",GU="decopilot-hosted-harness-sandboxed",L3="automations",aB="background-tools",_E="task-board-github-reads",vE="jira-push";var Ka1="8";function Wa1($){return{name:"decocms",systemDatabaseUrl:$.systemDatabaseUrl,systemDatabaseSchemaName:"dbos",systemDatabasePoolSize:$.poolSize,runAdminServer:!1,executorID:$.executorID,applicationVersion:Ka1,...$.listenQueues!==void 0?{listenQueues:$.listenQueues}:{}}}var Ha1=()=>{};import Pr6 from"pg";async function Ua1($,Z){let{databaseUrl:X,lockTimeoutMs:Q=Ar6}=$,Y=$.log??((W)=>console.log(W)),G=new Pr6.Client({connectionString:X});await G.connect();let J=Date.now(),K=!1;try{while(!K){if(K=(await G.query("SELECT pg_try_advisory_lock($1) AS locked",[Fa1.toString()])).rows[0]?.locked===!0,K)break;if(Date.now()-J>=Q)throw Error(`Timed out after ${Q}ms waiting for the DBOS migration lock. Another process is still migrating the dbos schema; this pod will restart and retry.`);await N8(Tr6)}let W=Date.now()-J;if(W>1000)Y(`[dbos] waited ${W}ms for the migration lock; another process migrated first`);return await Z()}finally{if(K)try{await G.query("SELECT pg_advisory_unlock($1)",[Fa1.toString()])}catch{}await G.end().catch(()=>{})}}var Fa1=8314027461559302n,Ar6=600000,Tr6=500;var Na1=L(()=>{B4()});function Rr6(){let $=(process.env.BUN_OPTIONS??"").split(/\s+/).filter(Boolean);return[...process.argv.slice(1),...$]}function Cp0($,Z){for(let X=0;X<$.length;X++){let Q=$[X];if(Q===void 0)continue;if(Q===Z)return $[X+1];if(Q.startsWith(`${Z}=`))return Q.slice(Z.length+1)}return}function Ba1(){let $=Rr6();if($.includes("--cpu-prof")){console.log(JSON.stringify({msg:"cpu-profiling-active",dir:Cp0($,"--cpu-prof-dir")??process.cwd(),name:Cp0($,"--cpu-prof-name"),markdown:$.includes("--cpu-prof-md"),intervalUs:Number(Cp0($,"--cpu-prof-interval")??1000),note:"profile is written on process exit"}));return}if(process.env.CPU_PROFILE)console.warn(JSON.stringify({msg:"cpu-profiling-requested-but-inactive",hint:'CPU profiling is a Bun launch flag. Set BUN_OPTIONS="--cpu-prof --cpu-prof-md --cpu-prof-dir=/tmp" before starting the process.'}))}function Oa1(){if(process.env.HEAP_WATCH!=="1")return()=>{};let $=Number(process.env.HEAP_WATCH_INTERVAL_MS??60000),Z=async()=>{let X=IE();if(!X)return;let Q={};try{let{heapStats:Y}=await import("bun:jsc"),G=Y(),J=Object.entries(G.objectTypeCounts).sort((K,W)=>W[1]-K[1]).slice(0,20);Q={objectCount:G.objectCount,heapSize:G.heapSize,top:Object.fromEntries(J)}}catch{}console.log(JSON.stringify({msg:"heap-watch",ts:new Date().toISOString(),uptimeS:Math.round(process.uptime()),rss:X.rss,heapUsed:X.heapUsed,heapTotal:X.heapTotal,external:X.external,arrayBuffers:X.arrayBuffers,...Q}))};return Z().catch(()=>{}),U70=setInterval(()=>void Z().catch(()=>{}),$),U70.unref?.(),process.on("SIGUSR2",()=>{try{let X=Bun.generateHeapSnapshot("v8"),Q=typeof X==="string"?X:JSON.stringify(X),Y=`/tmp/heap-${process.pid}-${Date.now()}.heapsnapshot`;Bun.write(Y,Q),console.log(JSON.stringify({msg:"heap-snapshot-written",path:Y}))}catch(X){console.error("[heap-watch] snapshot failed:",X)}}),()=>{if(U70)clearInterval(U70)}}var U70;var La1=()=>{};import*as Ir6 from"bun:jsc";function wa1(){if(process.env.STALL_WATCHDOG!=="1")return()=>{};let $=Number(process.env.STALL_WATCHDOG_MS??100),Z=Number(process.env.STALL_WATCHDOG_TICK_MS??50);try{qr6()}catch(G){return console.error("[stall-watchdog] failed to start sampling profiler:",G),()=>{}}let X,Q=performance.now()+Z,Y=()=>{let G=performance.now(),J=G-Q;Q=G+Z;let K=[];try{K=Mr6()?.traces??[]}catch{}if(J>$&&K.length>0){let W=new Map;for(let F of K){let U=F.frames.find((O)=>O.sourceURL&&!/Unknown Executable/.test(O.category??""))??F.frames[0];if(!U)continue;let N=(U.sourceURL??"?").replace(/^.*\/node_modules\//,"node_modules/"),B=`${U.name??"?"} @ ${N}:${U.line??"?"}`;W.set(B,(W.get(B)??0)+1)}let H=[...W.entries()].sort((F,U)=>U[1]-F[1]).slice(0,8).map(([F,U])=>({frame:F,count:U}));console.warn(JSON.stringify({msg:"stall-stack",ts:new Date().toISOString(),lagMs:Math.round(J),samplesInWindow:K.length,top:H}))}X=setTimeout(Y,Z),X.unref?.()};return X=setTimeout(Y,Z),X.unref?.(),()=>{if(X)clearTimeout(X)}}var qr6,Mr6;var Da1=L(()=>{({startSamplingProfiler:qr6,samplingProfilerStackTraces:Mr6}=Ir6)});function Ea1(){Ba1();let $=[Oa1(),Wn1(),wa1()];return()=>{for(let Z of $)Z()}}var ja1=L(()=>{ql0();La1();Da1()});var xE=v((za1)=>{Object.defineProperty(za1,"__esModule",{value:!0});za1.RepublishHeaders=za1.DirectMsgHeaders=za1.JsHeaders=za1.AdvisoryKind=void 0;za1.isOrderedPushConsumerOptions=Vr6;za1.isPullConsumer=kr6;za1.isPushConsumer=Sr6;za1.isBoundPushConsumerOptions=Cr6;function Vr6($){if($&&typeof $==="object")return"name_prefix"in $||"deliver_subject_prefix"in $||"filter_subjects"in $||"filter_subject"in $||"deliver_policy"in $||"opt_start_seq"in $||"opt_start_time"in $||"replay_policy"in $||"inactive_threshold"in $||"headers_only"in $||"deliver_prefix"in $;return!1}function kr6($){return $.isPullConsumer()}function Sr6($){return $.isPushConsumer()}function Cr6($){if($&&typeof $==="object")return"deliver_subject"in $||"deliver_group"in $||"idle_heartbeat"in $;return!1}za1.AdvisoryKind={API:"api_audit",StreamAction:"stream_action",ConsumerAction:"consumer_action",SnapshotCreate:"snapshot_create",SnapshotComplete:"snapshot_complete",RestoreCreate:"restore_create",RestoreComplete:"restore_complete",MaxDeliver:"max_deliver",Terminated:"terminated",Ack:"consumer_ack",StreamLeaderElected:"stream_leader_elected",StreamQuorumLost:"stream_quorum_lost",ConsumerLeaderElected:"consumer_leader_elected",ConsumerQuorumLost:"consumer_quorum_lost"};za1.JsHeaders={StreamSourceHdr:"Nats-Stream-Source",LastConsumerSeqHdr:"Nats-Last-Consumer",LastStreamSeqHdr:"Nats-Last-Stream",ConsumerStalledHdr:"Nats-Consumer-Stalled",MessageSizeHdr:"Nats-Msg-Size",RollupHdr:"Nats-Rollup",RollupValueSubject:"sub",RollupValueAll:"all",PendingMessagesHdr:"Nats-Pending-Messages",PendingBytesHdr:"Nats-Pending-Bytes",RequiredApiLevel:"Nats-Required-Api-Level"};za1.DirectMsgHeaders={Stream:"Nats-Stream",Sequence:"Nats-Sequence",TimeStamp:"Nats-Time-Stamp",Subject:"Nats-Subject",LastSequence:"Nats-Last-Sequence",NumPending:"Nats-Num-Pending"};za1.RepublishHeaders={Stream:"Nats-Stream",Subject:"Nats-Subject",Sequence:"Nats-Sequence",LastSequence:"Nats-Last-Sequence",Size:"Nats-Msg-Size"}});var GG=v((Aa1)=>{Object.defineProperty(Aa1,"__esModule",{value:!0});Aa1.TD=Aa1.TE=Aa1.Empty=void 0;Aa1.encode=ur6;Aa1.decode=cr6;Aa1.Empty=new Uint8Array(0);Aa1.TE=new TextEncoder;Aa1.TD=new TextDecoder;function hr6(...$){let Z=0;for(let Y=0;Y<$.length;Y++)Z+=$[Y].length;let X=new Uint8Array(Z),Q=0;for(let Y=0;Y<$.length;Y++)X.set($[Y],Q),Q+=$[Y].length;return X}function ur6(...$){let Z=[];for(let X=0;X<$.length;X++)Z.push(Aa1.TE.encode($[X]));if(Z.length===0)return Aa1.Empty;if(Z.length===1)return Z[0];return hr6(...Z)}function cr6($){if(!$||$.length===0)return"";return Aa1.TD.decode($)}});var JG=v((Ia1)=>{Object.defineProperty(Ia1,"__esModule",{value:!0});Ia1.errors=Ia1.PermissionViolationError=Ia1.NoRespondersError=Ia1.TimeoutError=Ia1.RequestError=Ia1.ProtocolError=Ia1.ConnectionError=Ia1.DrainingConnectionError=Ia1.ClosedConnectionError=Ia1.AuthorizationError=Ia1.UserAuthenticationExpiredError=Ia1.InvalidOperationError=Ia1.InvalidArgumentError=Ia1.InvalidSubjectError=void 0;class vp0 extends Error{constructor($,Z){super(`illegal subject: '${$}'`,Z);this.name="InvalidSubjectError"}}Ia1.InvalidSubjectError=vp0;class N70 extends Error{constructor($,Z){super($,Z);this.name="InvalidArgumentError"}static format($,Z,X){if(Array.isArray(Z)&&Z.length>1)Z=Z[0];if(Array.isArray($))$=$.map((Q)=>`'${Q}'`),$=$.join(",");else $=`'${$}'`;return new N70(`${$} ${Z}`,X)}}Ia1.InvalidArgumentError=N70;class xp0 extends Error{constructor($,Z){super($,Z);this.name="InvalidOperationError"}}Ia1.InvalidOperationError=xp0;class B70 extends Error{constructor($,Z){super($,Z);this.name="UserAuthenticationExpiredError"}static parse($){if($.toLowerCase().indexOf("user authentication expired")!==-1)return new B70($);return null}}Ia1.UserAuthenticationExpiredError=B70;class O70 extends Error{constructor($,Z){super($,Z);this.name="AuthorizationError"}static parse($){let Z=["authorization violation","account authentication expired","authentication timeout"],X=$.toLowerCase();for(let Q=0;Q<Z.length;Q++)if(X.indexOf(Z[Q])!==-1)return new O70($);return null}}Ia1.AuthorizationError=O70;class fp0 extends Error{constructor(){super("closed connection");this.name="ClosedConnectionError"}}Ia1.ClosedConnectionError=fp0;class bp0 extends Error{constructor(){super("connection draining");this.name="DrainingConnectionError"}}Ia1.DrainingConnectionError=bp0;class yp0 extends Error{constructor($,Z){super($,Z);this.name="ConnectionError"}}Ia1.ConnectionError=yp0;class gp0 extends Error{constructor($,Z){super($,Z);this.name="ProtocolError"}}Ia1.ProtocolError=gp0;class hp0 extends Error{constructor($="",Z){super($,Z);this.name="RequestError"}isNoResponders(){return this.cause instanceof L70}}Ia1.RequestError=hp0;class up0 extends Error{constructor($){super("timeout",$);this.name="TimeoutError"}}Ia1.TimeoutError=up0;class L70 extends Error{subject;constructor($,Z){super(`no responders: '${$}'`,Z);this.subject=$,this.name="NoResponders"}}Ia1.NoRespondersError=L70;class w70 extends Error{operation;subject;queue;constructor($,Z,X,Q,Y){super($,Y);this.name="PermissionViolationError",this.operation=Z,this.subject=X,this.queue=Q}static parse($){if(($?$.toLowerCase():"").indexOf("permissions violation")===-1)return null;let X="publish",Q="",Y=void 0,G=$.match(/(Publish|Subscription) to "(\S+)"/);if(G){if(X=G[1].toLowerCase(),Q=G[2],X==="subscription"){let J=$.match(/using queue "(\S+)"/);if(J)Y=J[1]}}return new w70($,X,Q,Y)}}Ia1.PermissionViolationError=w70;Ia1.errors={AuthorizationError:O70,ClosedConnectionError:fp0,ConnectionError:yp0,DrainingConnectionError:bp0,InvalidArgumentError:N70,InvalidOperationError:xp0,InvalidSubjectError:vp0,NoRespondersError:L70,PermissionViolationError:w70,ProtocolError:gp0,RequestError:hp0,TimeoutError:up0,UserAuthenticationExpiredError:B70}});var dJ=v((Sa1)=>{Object.defineProperty(Sa1,"__esModule",{value:!0});Sa1.SimpleMutex=Sa1.Perf=void 0;Sa1.extend=Ya6;Sa1.render=Ga6;Sa1.timeout=Ja6;Sa1.delay=Ka6;Sa1.deadline=Wa6;Sa1.deferred=lp0;Sa1.debugDeferred=Ha6;Sa1.shuffle=Fa6;Sa1.collect=Ua6;Sa1.jitter=ka1;Sa1.backoff=Na6;Sa1.nanos=Ba6;Sa1.millis=Oa6;Sa1.randomToken=Da6;var Qa6=GG(),cp0=JG();function Ya6($,...Z){for(let X=0;X<Z.length;X++){let Q=Z[X];Object.keys(Q).forEach(function(Y){$[Y]=Q[Y]})}return $}function Ga6($){return Qa6.TD.decode($).replace(/\n/g,"\u240A").replace(/\r/g,"\u240D")}function Ja6($,Z=!0){let X=Z?new cp0.TimeoutError:null,Q,Y,G=new Promise((J,K)=>{Q={cancel:()=>{if(Y)clearTimeout(Y)}},Y=setTimeout(()=>{if(X===null)K(new cp0.TimeoutError);else K(X)},$)});return Object.assign(G,Q)}function Ka6($=0){let Z,X=new Promise((Q)=>{let Y=setTimeout(()=>{Q()},$);Z={cancel:()=>{if(Y)clearTimeout(Y),Q()}}});return Object.assign(X,Z)}async function Wa6($,Z=1000){let X=lp0(),Q=setTimeout(()=>{X.reject(new cp0.TimeoutError)},Z);try{return await Promise.race([$,X])}finally{clearTimeout(Q)}}function lp0(){let $={},Z=new Promise((X,Q)=>{$={resolve:X,reject:Q}});return Object.assign(Z,$)}function Ha6(){let $={},Z=new Promise((X,Q)=>{$={resolve:(Y)=>{console.trace("resolve",Y),X(Y)},reject:(Y)=>{console.trace("reject"),Q(Y)}}});return Object.assign(Z,$)}function Fa6($){for(let Z=$.length-1;Z>0;Z--){let X=Math.floor(Math.random()*(Z+1));[$[Z],$[X]]=[$[X],$[Z]]}return $}async function Ua6($){let Z=[];for await(let X of $)Z.push(X);return Z}class Ma1{timers;measures;constructor(){this.timers=new Map,this.measures=new Map}mark($){this.timers.set($,performance.now())}measure($,Z,X){let Q=this.timers.get(Z);if(Q===void 0)throw Error(`${Z} is not defined`);let Y=this.timers.get(X);if(Y===void 0)throw Error(`${X} is not defined`);this.measures.set($,Y-Q)}getEntries(){let $=[];return this.measures.forEach((Z,X)=>{$.push({name:X,duration:Z})}),$}}Sa1.Perf=Ma1;class Va1{max;current;waiting;constructor($=1){this.max=$,this.current=0,this.waiting=[]}lock(){if(this.current++,this.current<=this.max)return Promise.resolve();let $=lp0();return this.waiting.push($),$}unlock(){this.current--,this.waiting.pop()?.resolve()}}Sa1.SimpleMutex=Va1;function ka1($){if($===0)return 0;return Math.floor($/2+Math.random()*$)}function Na6($=[0,250,250,500,500,3000,5000]){if(!Array.isArray($))$=[0,250,250,500,500,3000,5000];let Z=$.length-1;return{backoff(X){return ka1(X>Z?$[Z]:$[X])}}}function Ba6($){return $*1e6}function Oa6($){return Math.floor($/1e6)}var La6="0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz",JU=new Uint8Array(62);for(let $=0;$<62;$++)JU[$]=La6.charCodeAt($);var wa6=218340105584896;function Da6(){let $=Math.floor(Math.random()*wa6),Z=$%62,X=JU[Z];$=($-Z)/62,Z=$%62;let Q=JU[Z];$=($-Z)/62,Z=$%62;let Y=JU[Z];$=($-Z)/62,Z=$%62;let G=JU[Z];$=($-Z)/62,Z=$%62;let J=JU[Z];$=($-Z)/62,Z=$%62;let K=JU[Z];$=($-Z)/62,Z=$%62;let W=JU[Z];$=($-Z)/62;let H=JU[$];return String.fromCharCode(X,Q,Y,G,J,K,W,H)}});var ga1=v((ba1)=>{Object.defineProperty(ba1,"__esModule",{value:!0});ba1.nuid=ba1.NuidImpl=void 0;var va6="0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz",sB=62,E70=12,xa1=10,_a1=33,xa6=333,va1=E70+xa1,mp0=new Uint8Array(sB);for(let $=0;$<sB;$++)mp0[$]=va6.charCodeAt($);var D70=4294967296,fa1=BigInt(sB)**BigInt(xa1),Kp=Number(fa1/(1n<<32n)),dp0=Number(fa1%(1n<<32n));function fa6($){for(let Z=0;Z<$.length;Z++)$[Z]=Math.floor(Math.random()*256)}function ba6($){if(globalThis?.crypto?.getRandomValues)globalThis.crypto.getRandomValues($);else fa6($)}class ip0{buf;cbuf;seqHi;seqLo;inc;inited;constructor(){this.buf=new Uint8Array(va1),this.cbuf=new Uint8Array(E70),this.inited=!1}init(){this.inited=!0,this.setPre(),this.initSeqAndInc(),this.fillSeq()}initSeqAndInc(){let $=0;do this.seqHi=Math.floor(Math.random()*(Kp+1)),this.seqLo=Math.floor(Math.random()*D70);while($++<8&&this.seqHi===Kp&&this.seqLo>=dp0);if(this.seqHi===Kp&&this.seqLo>=dp0)this.seqLo=0;this.inc=Math.random()*(xa6-_a1)+_a1|0}setPre(){ba6(this.cbuf);for(let $=0;$<E70;$++)this.buf[$]=mp0[this.cbuf[$]%sB]}fillSeq(){let $=this.seqHi,Z=this.seqLo;for(let X=va1-1;X>=E70;X--){let Q=Math.floor($/sB),G=($-Q*sB)*D70+Z,J=Math.floor(G/sB),K=G-J*sB;this.buf[X]=mp0[K],$=Q,Z=J}}next(){if(!this.inited)this.init();if(this.seqLo+=this.inc,this.seqLo>=D70)this.seqLo-=D70,this.seqHi+=1;if(this.seqHi>Kp||this.seqHi===Kp&&this.seqLo>=dp0)this.setPre(),this.initSeqAndInc();this.fillSeq();let $=this.buf;return String.fromCharCode($[0],$[1],$[2],$[3],$[4],$[5],$[6],$[7],$[8],$[9],$[10],$[11],$[12],$[13],$[14],$[15],$[16],$[17],$[18],$[19],$[20],$[21])}reset(){this.init()}}ba1.NuidImpl=ip0;ba1.nuid=new ip0});var la1=v((ua1)=>{Object.defineProperty(ua1,"__esModule",{value:!0});ua1.nuid=ua1.Nuid=void 0;var ha1=ga1();ua1.Nuid=ha1.NuidImpl;ua1.nuid=ha1.nuid});var z70=v((j70)=>{Object.defineProperty(j70,"__esModule",{value:!0});j70.nuid=j70.Nuid=void 0;var da1=la1();Object.defineProperty(j70,"Nuid",{enumerable:!0,get:function(){return da1.Nuid}});Object.defineProperty(j70,"nuid",{enumerable:!0,get:function(){return da1.nuid}})});var eB=v((ma1)=>{Object.defineProperty(ma1,"__esModule",{value:!0});ma1.DEFAULT_HOST=ma1.DEFAULT_PORT=ma1.Match=void 0;ma1.syncIterator=la6;ma1.createInbox=da6;var ua6=z70(),ca6=JG();ma1.Match={Exact:"exact",CanonicalMIME:"canonical",IgnoreCase:"insensitive"};function la6($){let Z=$[Symbol.asyncIterator]();return{async next(){let X=await Z.next();if(X.done)return Promise.resolve(null);return Promise.resolve(X.value)}}}function da6($=""){if($=$||"_INBOX",typeof $!=="string")throw TypeError("prefix must be a string");return $.split(".").forEach((Z)=>{if(Z==="*"||Z===">")throw ca6.InvalidArgumentError.format("prefix",`cannot have wildcards ('${$}')`)}),`${$}.${ua6.nuid.next()}`}ma1.DEFAULT_PORT=4222;ma1.DEFAULT_HOST="127.0.0.1"});var Wp=v((ta1)=>{Object.defineProperty(ta1,"__esModule",{value:!0});ta1.DataBuffer=void 0;var pa1=GG();class na1{buffers;byteLength;constructor(){this.buffers=[],this.byteLength=0}static concat(...$){let Z=0;for(let Y=0;Y<$.length;Y++)Z+=$[Y].length;let X=new Uint8Array(Z),Q=0;for(let Y=0;Y<$.length;Y++)X.set($[Y],Q),Q+=$[Y].length;return X}static fromAscii($){if(!$)$="";return pa1.TE.encode($)}static toAscii($){return pa1.TD.decode($)}reset(){this.buffers.length=0,this.byteLength=0}pack(){if(this.buffers.length>1){let $=new Uint8Array(this.byteLength),Z=0;for(let X=0;X<this.buffers.length;X++)$.set(this.buffers[X],Z),Z+=this.buffers[X].length;this.buffers.length=0,this.buffers.push($)}}shift(){if(this.buffers.length){let $=this.buffers.shift();if($)return this.byteLength-=$.length,$}return new Uint8Array(0)}drain($){if(this.buffers.length){this.pack();let Z=this.buffers.pop();if(Z){let X=this.byteLength;if($===void 0||$>X)$=X;let Q=Z.subarray(0,$);if(X>$)this.buffers.push(Z.subarray($));return this.byteLength=X-$,Q}}return new Uint8Array(0)}fill($,...Z){if($)this.buffers.push($),this.byteLength+=$.length;for(let X=0;X<Z.length;X++)if(Z[X]&&Z[X].length)this.buffers.push(Z[X]),this.byteLength+=Z[X].length}peek(){if(this.buffers.length)return this.pack(),this.buffers[0];return new Uint8Array(0)}size(){return this.byteLength}length(){return this.buffers.length}}ta1.DataBuffer=na1});var fE=v((aa1)=>{Object.defineProperty(aa1,"__esModule",{value:!0});aa1.LF=aa1.CR=aa1.CRLF=aa1.CR_LF_LEN=aa1.CR_LF=void 0;aa1.setTransportFactory=aa6;aa1.defaultPort=sa6;aa1.getUrlParseFn=ea6;aa1.newTransport=$s6;aa1.getResolveFn=Zs6;aa1.protoLen=ra1;aa1.extractProtocolMessage=Xs6;var ta6=GG(),oa6=eB(),ra6=Wp(),KG;function aa6($){KG=$}function sa6(){return KG!==void 0&&KG.defaultPort!==void 0?KG.defaultPort:oa6.DEFAULT_PORT}function ea6(){return KG!==void 0&&KG.urlParseFn?KG.urlParseFn:void 0}function $s6(){if(!KG||typeof KG.factory!=="function")throw Error("transport fn is not set");return KG.factory()}function Zs6(){return KG!==void 0&&KG.dnsResolveFn?KG.dnsResolveFn:void 0}aa1.CR_LF=`\r
+`);Q=G.pop()??"";for(let J of G){let K=Gp(J).replace(/^\[\d+\]\s*/,"").trim();if(!K)continue;oB({method:"",path:"",status:0,duration:0,timestamp:new Date,rawLine:K})}}(async()=>{for(;;){let{done:G,value:J}=await Z.read();if(G)break;Q+=X.decode(J,{stream:!0}),Y()}if(Q.trim()){let G=Gp(Q).replace(/^\[\d+\]\s*/,"").trim();if(G)oB({method:"",path:"",status:0,duration:0,timestamp:new Date,rawLine:G})}})()}async function Hr6($){let{baseUrl:Z,noTui:X}=$,Q=process.env.HOST==="0.0.0.0"&&Boolean(process.env.PORT),Y=Q?process.env.PORT:$.vitePort,G=Z||`http://localhost:${Y}`,J=Q?await Yp(Number(Y)+1):await Yp(Number($.port)),{settings:K,services:W,managedServiceNames:H}=await K70({port:String(J),home:$.home,baseUrl:$.baseUrl,localMode:$.localMode,skipMigrations:$.skipMigrations,noTui:$.noTui,vitePort:$.vitePort});for(let w of W)kE({name:w.name,status:"ready",port:w.port});Xp();let F=Wr6(import.meta.dir,"..","..","..","..",".."),U=X===!0,N=Bun.spawn(["bun","run","dev:servers"],{cwd:F,env:{...process.env,PORT:String(K.port),VITE_PORT:String(Y),DATABASE_URL:K.databaseUrl,NATS_URL:K.natsUrls.join(","),NODE_ENV:K.nodeEnv,BASE_URL:G,DECOCMS_LOCAL_MODE:String(K.localMode),DECOCMS_HOME:K.dataDir,DATA_DIR:K.dataDir,DECO_CLI:"1",...K.betterAuthSecret?{BETTER_AUTH_SECRET:K.betterAuthSecret}:{},...K.s3Endpoint?{S3_ENDPOINT:K.s3Endpoint,S3_BUCKET:K.s3Bucket??"",S3_ACCESS_KEY_ID:K.s3AccessKeyId??"",S3_SECRET_ACCESS_KEY:K.s3SecretAccessKey??"",S3_FORCE_PATH_STYLE:String(K.s3ForcePathStyle)}:{},...K.natsPublicUrl&&K.natsAccountJwt&&K.natsAccountSigningKey?{NATS_PUBLIC_URL:K.natsPublicUrl,NATS_ACCOUNT_JWT:K.natsAccountJwt,NATS_ACCOUNT_SIGNING_KEY:K.natsAccountSigningKey,NATS_OPERATOR_JWT:K.natsOperatorJwt??"",NATS_TUNNEL_PUBLIC_ENABLED:"true",...K.natsCredsPath?{NATS_CREDS:K.natsCredsPath}:{}}:{}},stdio:["inherit",U?"inherit":"pipe",U?"inherit":"pipe"]});if(!U)rr1(N.stdout),rr1(N.stderr);Qp(G),kE({name:"Vite",status:"ready",port:Number(Y)}),kE({name:"API",status:"ready",port:Number(K.port)});let O=async(w)=>{if(N.kill(w),await N.exited,H.length>0){let{stopServices:D}=await Promise.resolve().then(() => (LZ0(),OZ0));await D(K.dataDir)}};return process.on("SIGINT",()=>O("SIGINT")),process.on("SIGTERM",()=>O("SIGTERM")),{port:Number(Y),process:N}}var Ip0=L(()=>{jp0();SE();Tp0()});var F70;var qp0=L(()=>{F70={name:"decocms",version:"4.262.2",description:"Deco CMS \u2014 Self-hostable MCP Gateway for managing AI connections and tools",author:"Deco team",repository:{type:"git",url:"git+https://github.com/decocms/studio.git",directory:"apps/api"},bugs:{url:"https://github.com/decocms/studio/issues"},type:"module",bin:{deco:"./dist/server/cli.js"},files:["dist/**/*"],scripts:{dev:"bun run migrate && bun run dev:server","dev:server":"bun run --cwd=../../packages/sandbox build && NODE_ENV=development bun --env-file=.env --hot run src/index.ts",build:"bun run build:server","build:server":"bun run scripts/bundle-server-script.ts --dist ./dist/server","generate:tool-contracts":"bun run scripts/generate-tool-contracts.ts","db:migrate":"bun run ./dist/server/migrate.js","db:migrate:dbos":"bun run ./dist/server/migrate-dbos.js",check:"tsc --noEmit",start:"bun run ./dist/server/server.js",migrate:"bun run src/database/migrate.ts","migrate:dbos":"bun run src/database/migrate-dbos.ts",test:"bun test src","better-auth:migrate":"bunx --bun @better-auth/cli migrate -y --config src/auth/index.ts",prepublishOnly:"bun run --cwd=../.. build:studio"},optionalDependencies:{"@duckdb/node-api":"^1.5.0-r.1"},dependencies:{"@ai-sdk/anthropic":"^3.0.85","@ai-sdk/google":"^3.0.83","@ai-sdk/openai":"^3.0.73","@anthropic-ai/sdk":"^0.105.0","@aws-sdk/client-s3":"^3.1013.0","@aws-sdk/client-sts":"^3.1013.0","@aws-sdk/lib-storage":"^3.1013.0","@aws-sdk/s3-request-presigner":"^3.1013.0","@clickhouse/client":"^1.8.1","@dbos-inc/dbos-sdk":"^4.21.6","@inkjs/ui":"^2.0.0","@nats-io/jetstream":"3.4.0","@nats-io/kv":"3.4.0","@nats-io/nats-core":"3.4.0","@nats-io/transport-node":"3.4.0","@openrouter/ai-sdk-provider":"^2.9.1","@opentelemetry/core":"^2.6.0","embedded-postgres":"^18.3.0-beta.16",ink:"^6.8.0",kysely:"^0.28.12","posthog-node":"^5.0.0",react:"^19.2.6","react-dom":"^19.2.6"},devDependencies:{"@ai-sdk/provider":"^3.0.10","@better-auth/sso":"1.4.1","@decocms/better-auth":"1.5.17","@decocms/bindings":"workspace:*","@decocms/mcp-utils":"workspace:*","@decocms/runtime":"workspace:*","@decocms/sandbox":"workspace:*","@decocms/shared":"workspace:*","@jitl/quickjs-wasmfile-release-sync":"0.31.0","@modelcontextprotocol/sdk":"1.29.0","@nats-io/jwt":"0.0.10-5","@opentelemetry/api":"^1.9.0","@opentelemetry/api-logs":"^0.211.0","@opentelemetry/exporter-logs-otlp-proto":"^0.211.0","@opentelemetry/exporter-prometheus":"^0.208.0","@opentelemetry/exporter-trace-otlp-proto":"^0.207.0","@opentelemetry/instrumentation-runtime-node":"^0.24.0","@opentelemetry/resources":"^2.6.0","@opentelemetry/sdk-logs":"^0.211.0","@opentelemetry/sdk-metrics":"^2.2.0","@opentelemetry/sdk-node":"^0.207.0","@opentelemetry/sdk-trace-base":"^2.5.0","@types/bun":"^1.3.1","@types/google.maps":"^3.65.2","@types/pg":"^8.15.6","@types/react-syntax-highlighter":"^15.5.13","@vercel/nft":"^1.1.1",ai:"^6.0.208","better-auth":"1.4.22",croner:"^9.1.0",degit:"^2.8.4",hono:"^4.10.7",jose:"^6.0.11",nanoid:"^5.1.6",pg:"^8.16.3",typescript:"^7.0.2",typescript5:"npm:typescript@^5.9.3",zod:"4.3.6"},homepage:"https://github.com/decocms/studio",keywords:["mcp","model-context-protocol","ai","gateway","self-hosted","tools"],license:"MIT",publishConfig:{access:"public"}}});import{Box as Ur6,Text as ar1}from"ink";import{jsx as Nr6,jsxs as sr1}from"react/jsx-runtime";function er1({version:$}){return sr1(Ur6,{flexDirection:"column",marginTop:1,children:[gZ0.map((Z,X)=>Nr6(ar1,{color:hZ0[X],children:Z},X)),sr1(ar1,{dimColor:!0,children:[" v",$]})]})}var $a1=L(()=>{mi()});import{Box as CE,Text as rB}from"ink";import{Spinner as Br6}from"@inkjs/ui";import{jsx as YG,jsxs as Wy}from"react/jsx-runtime";function Za1({status:$}){if($==="pending")return YG(Br6,{label:""});return YG(rB,{color:"green",children:"\u2713"})}function Or6($){return`${$.name}: ${$.port||"...."}`}function Xa1({services:$,migrationsStatus:Z,home:X,serverUrl:Q}){return Wy(CE,{flexDirection:"column",paddingBottom:1,children:[YG(er1,{version:F70.version}),YG(CE,{marginBottom:1,children:YG(rB,{dimColor:!0,children:"\u2500".repeat(80)})}),YG(CE,{children:Wy(rB,{dimColor:!0,children:["Home: ",X]})}),Wy(CE,{gap:2,children:[$.map((Y)=>Wy(CE,{gap:1,children:[YG(rB,{children:Or6(Y)}),YG(Za1,{status:Y.status})]},Y.name)),Wy(CE,{gap:1,children:[YG(rB,{children:"Migrations"}),YG(Za1,{status:Z})]})]}),YG(CE,{children:Q?Wy(rB,{children:["Open in browser: ",YG(rB,{color:"cyan",children:Q})]}):YG(rB,{dimColor:!0,children:"Starting..."})})]})}var Qa1=L(()=>{qp0();$a1()});import{Box as Lr6,Text as Jp}from"ink";import{jsx as Mp0,jsxs as Vp0}from"react/jsx-runtime";function wr6($){if($>=500)return"red";if($>=400)return"yellow";if($>=300)return"cyan";return"green"}function Ya1({logs:$}){return Mp0(Lr6,{flexDirection:"column",children:$.map((Z,X)=>{if(Z.rawLine)return Mp0(Jp,{dimColor:!0,children:Z.rawLine},X);let Q=Z.duration<1000?`${Z.duration}ms`:`${(Z.duration/1000).toFixed(1)}s`;return Vp0(Jp,{children:[Vp0(Jp,{dimColor:!0,children:[Z.method.padEnd(6)," ",Z.path.padEnd(30)," "]}),Mp0(Jp,{color:wr6(Z.status),children:Z.status}),Vp0(Jp,{dimColor:!0,children:[" ",Q.padStart(8)]})]},X)})})}var Ga1=()=>{};var kp0={};U0(kp0,{App:()=>jr6});import{Box as Dr6}from"ink";import{useSyncExternalStore as Er6}from"react";import{jsx as Ja1,jsxs as zr6}from"react/jsx-runtime";function jr6({home:$}){let Z=Er6(Ap0,Pp0);return zr6(Dr6,{flexDirection:"column",children:[Ja1(Xa1,{services:Z.services,migrationsStatus:Z.migrationsStatus,home:$,serverUrl:Z.serverUrl}),Ja1(Ya1,{logs:Z.logs})]})}var Sp0=L(()=>{Qa1();Ga1();SE()});var lJ="thread-gate",YU="decopilot-hosted-harness",GU="decopilot-hosted-harness-sandboxed",L3="automations",aB="background-tools",_E="task-board-github-reads",vE="jira-push";var Ka1="8";function Wa1($){return{name:"decocms",systemDatabaseUrl:$.systemDatabaseUrl,systemDatabaseSchemaName:"dbos",systemDatabasePoolSize:$.poolSize,runAdminServer:!1,executorID:$.executorID,applicationVersion:Ka1,...$.listenQueues!==void 0?{listenQueues:$.listenQueues}:{}}}var Ha1=()=>{};import Pr6 from"pg";async function Ua1($,Z){let{databaseUrl:X,lockTimeoutMs:Q=Ar6}=$,Y=$.log??((W)=>console.log(W)),G=new Pr6.Client({connectionString:X});await G.connect();let J=Date.now(),K=!1;try{while(!K){if(K=(await G.query("SELECT pg_try_advisory_lock($1) AS locked",[Fa1.toString()])).rows[0]?.locked===!0,K)break;if(Date.now()-J>=Q)throw Error(`Timed out after ${Q}ms waiting for the DBOS migration lock. Another process is still migrating the dbos schema; this pod will restart and retry.`);await N8(Tr6)}let W=Date.now()-J;if(W>1000)Y(`[dbos] waited ${W}ms for the migration lock; another process migrated first`);return await Z()}finally{if(K)try{await G.query("SELECT pg_advisory_unlock($1)",[Fa1.toString()])}catch{}await G.end().catch(()=>{})}}var Fa1=8314027461559302n,Ar6=600000,Tr6=500;var Na1=L(()=>{B4()});function Rr6(){let $=(process.env.BUN_OPTIONS??"").split(/\s+/).filter(Boolean);return[...process.argv.slice(1),...$]}function Cp0($,Z){for(let X=0;X<$.length;X++){let Q=$[X];if(Q===void 0)continue;if(Q===Z)return $[X+1];if(Q.startsWith(`${Z}=`))return Q.slice(Z.length+1)}return}function Ba1(){let $=Rr6();if($.includes("--cpu-prof")){console.log(JSON.stringify({msg:"cpu-profiling-active",dir:Cp0($,"--cpu-prof-dir")??process.cwd(),name:Cp0($,"--cpu-prof-name"),markdown:$.includes("--cpu-prof-md"),intervalUs:Number(Cp0($,"--cpu-prof-interval")??1000),note:"profile is written on process exit"}));return}if(process.env.CPU_PROFILE)console.warn(JSON.stringify({msg:"cpu-profiling-requested-but-inactive",hint:'CPU profiling is a Bun launch flag. Set BUN_OPTIONS="--cpu-prof --cpu-prof-md --cpu-prof-dir=/tmp" before starting the process.'}))}function Oa1(){if(process.env.HEAP_WATCH!=="1")return()=>{};let $=Number(process.env.HEAP_WATCH_INTERVAL_MS??60000),Z=async()=>{let X=IE();if(!X)return;let Q={};try{let{heapStats:Y}=await import("bun:jsc"),G=Y(),J=Object.entries(G.objectTypeCounts).sort((K,W)=>W[1]-K[1]).slice(0,20);Q={objectCount:G.objectCount,heapSize:G.heapSize,top:Object.fromEntries(J)}}catch{}console.log(JSON.stringify({msg:"heap-watch",ts:new Date().toISOString(),uptimeS:Math.round(process.uptime()),rss:X.rss,heapUsed:X.heapUsed,heapTotal:X.heapTotal,external:X.external,arrayBuffers:X.arrayBuffers,...Q}))};return Z().catch(()=>{}),U70=setInterval(()=>void Z().catch(()=>{}),$),U70.unref?.(),process.on("SIGUSR2",()=>{try{let X=Bun.generateHeapSnapshot("v8"),Q=typeof X==="string"?X:JSON.stringify(X),Y=`/tmp/heap-${process.pid}-${Date.now()}.heapsnapshot`;Bun.write(Y,Q),console.log(JSON.stringify({msg:"heap-snapshot-written",path:Y}))}catch(X){console.error("[heap-watch] snapshot failed:",X)}}),()=>{if(U70)clearInterval(U70)}}var U70;var La1=()=>{};import*as Ir6 from"bun:jsc";function wa1(){if(process.env.STALL_WATCHDOG!=="1")return()=>{};let $=Number(process.env.STALL_WATCHDOG_MS??100),Z=Number(process.env.STALL_WATCHDOG_TICK_MS??50);try{qr6()}catch(G){return console.error("[stall-watchdog] failed to start sampling profiler:",G),()=>{}}let X,Q=performance.now()+Z,Y=()=>{let G=performance.now(),J=G-Q;Q=G+Z;let K=[];try{K=Mr6()?.traces??[]}catch{}if(J>$&&K.length>0){let W=new Map;for(let F of K){let U=F.frames.find((O)=>O.sourceURL&&!/Unknown Executable/.test(O.category??""))??F.frames[0];if(!U)continue;let N=(U.sourceURL??"?").replace(/^.*\/node_modules\//,"node_modules/"),B=`${U.name??"?"} @ ${N}:${U.line??"?"}`;W.set(B,(W.get(B)??0)+1)}let H=[...W.entries()].sort((F,U)=>U[1]-F[1]).slice(0,8).map(([F,U])=>({frame:F,count:U}));console.warn(JSON.stringify({msg:"stall-stack",ts:new Date().toISOString(),lagMs:Math.round(J),samplesInWindow:K.length,top:H}))}X=setTimeout(Y,Z),X.unref?.()};return X=setTimeout(Y,Z),X.unref?.(),()=>{if(X)clearTimeout(X)}}var qr6,Mr6;var Da1=L(()=>{({startSamplingProfiler:qr6,samplingProfilerStackTraces:Mr6}=Ir6)});function Ea1(){Ba1();let $=[Oa1(),Wn1(),wa1()];return()=>{for(let Z of $)Z()}}var ja1=L(()=>{ql0();La1();Da1()});var xE=v((za1)=>{Object.defineProperty(za1,"__esModule",{value:!0});za1.RepublishHeaders=za1.DirectMsgHeaders=za1.JsHeaders=za1.AdvisoryKind=void 0;za1.isOrderedPushConsumerOptions=Vr6;za1.isPullConsumer=kr6;za1.isPushConsumer=Sr6;za1.isBoundPushConsumerOptions=Cr6;function Vr6($){if($&&typeof $==="object")return"name_prefix"in $||"deliver_subject_prefix"in $||"filter_subjects"in $||"filter_subject"in $||"deliver_policy"in $||"opt_start_seq"in $||"opt_start_time"in $||"replay_policy"in $||"inactive_threshold"in $||"headers_only"in $||"deliver_prefix"in $;return!1}function kr6($){return $.isPullConsumer()}function Sr6($){return $.isPushConsumer()}function Cr6($){if($&&typeof $==="object")return"deliver_subject"in $||"deliver_group"in $||"idle_heartbeat"in $;return!1}za1.AdvisoryKind={API:"api_audit",StreamAction:"stream_action",ConsumerAction:"consumer_action",SnapshotCreate:"snapshot_create",SnapshotComplete:"snapshot_complete",RestoreCreate:"restore_create",RestoreComplete:"restore_complete",MaxDeliver:"max_deliver",Terminated:"terminated",Ack:"consumer_ack",StreamLeaderElected:"stream_leader_elected",StreamQuorumLost:"stream_quorum_lost",ConsumerLeaderElected:"consumer_leader_elected",ConsumerQuorumLost:"consumer_quorum_lost"};za1.JsHeaders={StreamSourceHdr:"Nats-Stream-Source",LastConsumerSeqHdr:"Nats-Last-Consumer",LastStreamSeqHdr:"Nats-Last-Stream",ConsumerStalledHdr:"Nats-Consumer-Stalled",MessageSizeHdr:"Nats-Msg-Size",RollupHdr:"Nats-Rollup",RollupValueSubject:"sub",RollupValueAll:"all",PendingMessagesHdr:"Nats-Pending-Messages",PendingBytesHdr:"Nats-Pending-Bytes",RequiredApiLevel:"Nats-Required-Api-Level"};za1.DirectMsgHeaders={Stream:"Nats-Stream",Sequence:"Nats-Sequence",TimeStamp:"Nats-Time-Stamp",Subject:"Nats-Subject",LastSequence:"Nats-Last-Sequence",NumPending:"Nats-Num-Pending"};za1.RepublishHeaders={Stream:"Nats-Stream",Subject:"Nats-Subject",Sequence:"Nats-Sequence",LastSequence:"Nats-Last-Sequence",Size:"Nats-Msg-Size"}});var GG=v((Aa1)=>{Object.defineProperty(Aa1,"__esModule",{value:!0});Aa1.TD=Aa1.TE=Aa1.Empty=void 0;Aa1.encode=ur6;Aa1.decode=cr6;Aa1.Empty=new Uint8Array(0);Aa1.TE=new TextEncoder;Aa1.TD=new TextDecoder;function hr6(...$){let Z=0;for(let Y=0;Y<$.length;Y++)Z+=$[Y].length;let X=new Uint8Array(Z),Q=0;for(let Y=0;Y<$.length;Y++)X.set($[Y],Q),Q+=$[Y].length;return X}function ur6(...$){let Z=[];for(let X=0;X<$.length;X++)Z.push(Aa1.TE.encode($[X]));if(Z.length===0)return Aa1.Empty;if(Z.length===1)return Z[0];return hr6(...Z)}function cr6($){if(!$||$.length===0)return"";return Aa1.TD.decode($)}});var JG=v((Ia1)=>{Object.defineProperty(Ia1,"__esModule",{value:!0});Ia1.errors=Ia1.PermissionViolationError=Ia1.NoRespondersError=Ia1.TimeoutError=Ia1.RequestError=Ia1.ProtocolError=Ia1.ConnectionError=Ia1.DrainingConnectionError=Ia1.ClosedConnectionError=Ia1.AuthorizationError=Ia1.UserAuthenticationExpiredError=Ia1.InvalidOperationError=Ia1.InvalidArgumentError=Ia1.InvalidSubjectError=void 0;class vp0 extends Error{constructor($,Z){super(`illegal subject: '${$}'`,Z);this.name="InvalidSubjectError"}}Ia1.InvalidSubjectError=vp0;class N70 extends Error{constructor($,Z){super($,Z);this.name="InvalidArgumentError"}static format($,Z,X){if(Array.isArray(Z)&&Z.length>1)Z=Z[0];if(Array.isArray($))$=$.map((Q)=>`'${Q}'`),$=$.join(",");else $=`'${$}'`;return new N70(`${$} ${Z}`,X)}}Ia1.InvalidArgumentError=N70;class xp0 extends Error{constructor($,Z){super($,Z);this.name="InvalidOperationError"}}Ia1.InvalidOperationError=xp0;class B70 extends Error{constructor($,Z){super($,Z);this.name="UserAuthenticationExpiredError"}static parse($){if($.toLowerCase().indexOf("user authentication expired")!==-1)return new B70($);return null}}Ia1.UserAuthenticationExpiredError=B70;class O70 extends Error{constructor($,Z){super($,Z);this.name="AuthorizationError"}static parse($){let Z=["authorization violation","account authentication expired","authentication timeout"],X=$.toLowerCase();for(let Q=0;Q<Z.length;Q++)if(X.indexOf(Z[Q])!==-1)return new O70($);return null}}Ia1.AuthorizationError=O70;class fp0 extends Error{constructor(){super("closed connection");this.name="ClosedConnectionError"}}Ia1.ClosedConnectionError=fp0;class bp0 extends Error{constructor(){super("connection draining");this.name="DrainingConnectionError"}}Ia1.DrainingConnectionError=bp0;class yp0 extends Error{constructor($,Z){super($,Z);this.name="ConnectionError"}}Ia1.ConnectionError=yp0;class gp0 extends Error{constructor($,Z){super($,Z);this.name="ProtocolError"}}Ia1.ProtocolError=gp0;class hp0 extends Error{constructor($="",Z){super($,Z);this.name="RequestError"}isNoResponders(){return this.cause instanceof L70}}Ia1.RequestError=hp0;class up0 extends Error{constructor($){super("timeout",$);this.name="TimeoutError"}}Ia1.TimeoutError=up0;class L70 extends Error{subject;constructor($,Z){super(`no responders: '${$}'`,Z);this.subject=$,this.name="NoResponders"}}Ia1.NoRespondersError=L70;class w70 extends Error{operation;subject;queue;constructor($,Z,X,Q,Y){super($,Y);this.name="PermissionViolationError",this.operation=Z,this.subject=X,this.queue=Q}static parse($){if(($?$.toLowerCase():"").indexOf("permissions violation")===-1)return null;let X="publish",Q="",Y=void 0,G=$.match(/(Publish|Subscription) to "(\S+)"/);if(G){if(X=G[1].toLowerCase(),Q=G[2],X==="subscription"){let J=$.match(/using queue "(\S+)"/);if(J)Y=J[1]}}return new w70($,X,Q,Y)}}Ia1.PermissionViolationError=w70;Ia1.errors={AuthorizationError:O70,ClosedConnectionError:fp0,ConnectionError:yp0,DrainingConnectionError:bp0,InvalidArgumentError:N70,InvalidOperationError:xp0,InvalidSubjectError:vp0,NoRespondersError:L70,PermissionViolationError:w70,ProtocolError:gp0,RequestError:hp0,TimeoutError:up0,UserAuthenticationExpiredError:B70}});var dJ=v((Sa1)=>{Object.defineProperty(Sa1,"__esModule",{value:!0});Sa1.SimpleMutex=Sa1.Perf=void 0;Sa1.extend=Ya6;Sa1.render=Ga6;Sa1.timeout=Ja6;Sa1.delay=Ka6;Sa1.deadline=Wa6;Sa1.deferred=lp0;Sa1.debugDeferred=Ha6;Sa1.shuffle=Fa6;Sa1.collect=Ua6;Sa1.jitter=ka1;Sa1.backoff=Na6;Sa1.nanos=Ba6;Sa1.millis=Oa6;Sa1.randomToken=Da6;var Qa6=GG(),cp0=JG();function Ya6($,...Z){for(let X=0;X<Z.length;X++){let Q=Z[X];Object.keys(Q).forEach(function(Y){$[Y]=Q[Y]})}return $}function Ga6($){return Qa6.TD.decode($).replace(/\n/g,"\u240A").replace(/\r/g,"\u240D")}function Ja6($,Z=!0){let X=Z?new cp0.TimeoutError:null,Q,Y,G=new Promise((J,K)=>{Q={cancel:()=>{if(Y)clearTimeout(Y)}},Y=setTimeout(()=>{if(X===null)K(new cp0.TimeoutError);else K(X)},$)});return Object.assign(G,Q)}function Ka6($=0){let Z,X=new Promise((Q)=>{let Y=setTimeout(()=>{Q()},$);Z={cancel:()=>{if(Y)clearTimeout(Y),Q()}}});return Object.assign(X,Z)}async function Wa6($,Z=1000){let X=lp0(),Q=setTimeout(()=>{X.reject(new cp0.TimeoutError)},Z);try{return await Promise.race([$,X])}finally{clearTimeout(Q)}}function lp0(){let $={},Z=new Promise((X,Q)=>{$={resolve:X,reject:Q}});return Object.assign(Z,$)}function Ha6(){let $={},Z=new Promise((X,Q)=>{$={resolve:(Y)=>{console.trace("resolve",Y),X(Y)},reject:(Y)=>{console.trace("reject"),Q(Y)}}});return Object.assign(Z,$)}function Fa6($){for(let Z=$.length-1;Z>0;Z--){let X=Math.floor(Math.random()*(Z+1));[$[Z],$[X]]=[$[X],$[Z]]}return $}async function Ua6($){let Z=[];for await(let X of $)Z.push(X);return Z}class Ma1{timers;measures;constructor(){this.timers=new Map,this.measures=new Map}mark($){this.timers.set($,performance.now())}measure($,Z,X){let Q=this.timers.get(Z);if(Q===void 0)throw Error(`${Z} is not defined`);let Y=this.timers.get(X);if(Y===void 0)throw Error(`${X} is not defined`);this.measures.set($,Y-Q)}getEntries(){let $=[];return this.measures.forEach((Z,X)=>{$.push({name:X,duration:Z})}),$}}Sa1.Perf=Ma1;class Va1{max;current;waiting;constructor($=1){this.max=$,this.current=0,this.waiting=[]}lock(){if(this.current++,this.current<=this.max)return Promise.resolve();let $=lp0();return this.waiting.push($),$}unlock(){this.current--,this.waiting.pop()?.resolve()}}Sa1.SimpleMutex=Va1;function ka1($){if($===0)return 0;return Math.floor($/2+Math.random()*$)}function Na6($=[0,250,250,500,500,3000,5000]){if(!Array.isArray($))$=[0,250,250,500,500,3000,5000];let Z=$.length-1;return{backoff(X){return ka1(X>Z?$[Z]:$[X])}}}function Ba6($){return $*1e6}function Oa6($){return Math.floor($/1e6)}var La6="0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz",JU=new Uint8Array(62);for(let $=0;$<62;$++)JU[$]=La6.charCodeAt($);var wa6=218340105584896;function Da6(){let $=Math.floor(Math.random()*wa6),Z=$%62,X=JU[Z];$=($-Z)/62,Z=$%62;let Q=JU[Z];$=($-Z)/62,Z=$%62;let Y=JU[Z];$=($-Z)/62,Z=$%62;let G=JU[Z];$=($-Z)/62,Z=$%62;let J=JU[Z];$=($-Z)/62,Z=$%62;let K=JU[Z];$=($-Z)/62,Z=$%62;let W=JU[Z];$=($-Z)/62;let H=JU[$];return String.fromCharCode(X,Q,Y,G,J,K,W,H)}});var ga1=v((ba1)=>{Object.defineProperty(ba1,"__esModule",{value:!0});ba1.nuid=ba1.NuidImpl=void 0;var va6="0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz",sB=62,E70=12,xa1=10,_a1=33,xa6=333,va1=E70+xa1,mp0=new Uint8Array(sB);for(let $=0;$<sB;$++)mp0[$]=va6.charCodeAt($);var D70=4294967296,fa1=BigInt(sB)**BigInt(xa1),Kp=Number(fa1/(1n<<32n)),dp0=Number(fa1%(1n<<32n));function fa6($){for(let Z=0;Z<$.length;Z++)$[Z]=Math.floor(Math.random()*256)}function ba6($){if(globalThis?.crypto?.getRandomValues)globalThis.crypto.getRandomValues($);else fa6($)}class ip0{buf;cbuf;seqHi;seqLo;inc;inited;constructor(){this.buf=new Uint8Array(va1),this.cbuf=new Uint8Array(E70),this.inited=!1}init(){this.inited=!0,this.setPre(),this.initSeqAndInc(),this.fillSeq()}initSeqAndInc(){let $=0;do this.seqHi=Math.floor(Math.random()*(Kp+1)),this.seqLo=Math.floor(Math.random()*D70);while($++<8&&this.seqHi===Kp&&this.seqLo>=dp0);if(this.seqHi===Kp&&this.seqLo>=dp0)this.seqLo=0;this.inc=Math.random()*(xa6-_a1)+_a1|0}setPre(){ba6(this.cbuf);for(let $=0;$<E70;$++)this.buf[$]=mp0[this.cbuf[$]%sB]}fillSeq(){let $=this.seqHi,Z=this.seqLo;for(let X=va1-1;X>=E70;X--){let Q=Math.floor($/sB),G=($-Q*sB)*D70+Z,J=Math.floor(G/sB),K=G-J*sB;this.buf[X]=mp0[K],$=Q,Z=J}}next(){if(!this.inited)this.init();if(this.seqLo+=this.inc,this.seqLo>=D70)this.seqLo-=D70,this.seqHi+=1;if(this.seqHi>Kp||this.seqHi===Kp&&this.seqLo>=dp0)this.setPre(),this.initSeqAndInc();this.fillSeq();let $=this.buf;return String.fromCharCode($[0],$[1],$[2],$[3],$[4],$[5],$[6],$[7],$[8],$[9],$[10],$[11],$[12],$[13],$[14],$[15],$[16],$[17],$[18],$[19],$[20],$[21])}reset(){this.init()}}ba1.NuidImpl=ip0;ba1.nuid=new ip0});var la1=v((ua1)=>{Object.defineProperty(ua1,"__esModule",{value:!0});ua1.nuid=ua1.Nuid=void 0;var ha1=ga1();ua1.Nuid=ha1.NuidImpl;ua1.nuid=ha1.nuid});var z70=v((j70)=>{Object.defineProperty(j70,"__esModule",{value:!0});j70.nuid=j70.Nuid=void 0;var da1=la1();Object.defineProperty(j70,"Nuid",{enumerable:!0,get:function(){return da1.Nuid}});Object.defineProperty(j70,"nuid",{enumerable:!0,get:function(){return da1.nuid}})});var eB=v((ma1)=>{Object.defineProperty(ma1,"__esModule",{value:!0});ma1.DEFAULT_HOST=ma1.DEFAULT_PORT=ma1.Match=void 0;ma1.syncIterator=la6;ma1.createInbox=da6;var ua6=z70(),ca6=JG();ma1.Match={Exact:"exact",CanonicalMIME:"canonical",IgnoreCase:"insensitive"};function la6($){let Z=$[Symbol.asyncIterator]();return{async next(){let X=await Z.next();if(X.done)return Promise.resolve(null);return Promise.resolve(X.value)}}}function da6($=""){if($=$||"_INBOX",typeof $!=="string")throw TypeError("prefix must be a string");return $.split(".").forEach((Z)=>{if(Z==="*"||Z===">")throw ca6.InvalidArgumentError.format("prefix",`cannot have wildcards ('${$}')`)}),`${$}.${ua6.nuid.next()}`}ma1.DEFAULT_PORT=4222;ma1.DEFAULT_HOST="127.0.0.1"});var Wp=v((ta1)=>{Object.defineProperty(ta1,"__esModule",{value:!0});ta1.DataBuffer=void 0;var pa1=GG();class na1{buffers;byteLength;constructor(){this.buffers=[],this.byteLength=0}static concat(...$){let Z=0;for(let Y=0;Y<$.length;Y++)Z+=$[Y].length;let X=new Uint8Array(Z),Q=0;for(let Y=0;Y<$.length;Y++)X.set($[Y],Q),Q+=$[Y].length;return X}static fromAscii($){if(!$)$="";return pa1.TE.encode($)}static toAscii($){return pa1.TD.decode($)}reset(){this.buffers.length=0,this.byteLength=0}pack(){if(this.buffers.length>1){let $=new Uint8Array(this.byteLength),Z=0;for(let X=0;X<this.buffers.length;X++)$.set(this.buffers[X],Z),Z+=this.buffers[X].length;this.buffers.length=0,this.buffers.push($)}}shift(){if(this.buffers.length){let $=this.buffers.shift();if($)return this.byteLength-=$.length,$}return new Uint8Array(0)}drain($){if(this.buffers.length){this.pack();let Z=this.buffers.pop();if(Z){let X=this.byteLength;if($===void 0||$>X)$=X;let Q=Z.subarray(0,$);if(X>$)this.buffers.push(Z.subarray($));return this.byteLength=X-$,Q}}return new Uint8Array(0)}fill($,...Z){if($)this.buffers.push($),this.byteLength+=$.length;for(let X=0;X<Z.length;X++)if(Z[X]&&Z[X].length)this.buffers.push(Z[X]),this.byteLength+=Z[X].length}peek(){if(this.buffers.length)return this.pack(),this.buffers[0];return new Uint8Array(0)}size(){return this.byteLength}length(){return this.buffers.length}}ta1.DataBuffer=na1});var fE=v((aa1)=>{Object.defineProperty(aa1,"__esModule",{value:!0});aa1.LF=aa1.CR=aa1.CRLF=aa1.CR_LF_LEN=aa1.CR_LF=void 0;aa1.setTransportFactory=aa6;aa1.defaultPort=sa6;aa1.getUrlParseFn=ea6;aa1.newTransport=$s6;aa1.getResolveFn=Zs6;aa1.protoLen=ra1;aa1.extractProtocolMessage=Xs6;var ta6=GG(),oa6=eB(),ra6=Wp(),KG;function aa6($){KG=$}function sa6(){return KG!==void 0&&KG.defaultPort!==void 0?KG.defaultPort:oa6.DEFAULT_PORT}function ea6(){return KG!==void 0&&KG.urlParseFn?KG.urlParseFn:void 0}function $s6(){if(!KG||typeof KG.factory!=="function")throw Error("transport fn is not set");return KG.factory()}function Zs6(){return KG!==void 0&&KG.dnsResolveFn?KG.dnsResolveFn:void 0}aa1.CR_LF=`\r
 `;aa1.CR_LF_LEN=aa1.CR_LF.length;aa1.CRLF=ra6.DataBuffer.fromAscii(aa1.CR_LF);aa1.CR=new Uint8Array(aa1.CRLF)[0];aa1.LF=new Uint8Array(aa1.CRLF)[1];function ra1($){for(let Z=0;Z<$.length;Z++){let X=Z+1;if($.byteLength>X&&$[Z]===aa1.CR&&$[X]===aa1.LF)return X+1}return 0}function Xs6($){let Z=ra1($);if(Z>0){let Q=new Uint8Array($).slice(0,Z);return ta6.TD.decode(Q)}return""}});var rp0=v((Gs1)=>{Object.defineProperty(Gs1,"__esModule",{value:!0});Gs1.ipV4=Xs1;Gs1.isIP=Bs6;Gs1.parseIP=Qs1;var Hp=4,bE=16,P70=48,Zs1=57,ea1=65,Us6=70,$s1=97,Ns6=102,op0=16777215;function Xs1($,Z,X,Q){let Y=new Uint8Array(bE);return[0,0,0,0,0,0,0,0,0,0,255,255].forEach((J,K)=>{Y[K]=J}),Y[12]=$,Y[13]=Z,Y[14]=X,Y[15]=Q,Y}function Bs6($){return Qs1($)!==void 0}function Qs1($){for(let Z=0;Z<$.length;Z++)switch($[Z]){case".":return Ys1($);case":":return Os6($)}return}function Ys1($){let Z=new Uint8Array(Hp);for(let X=0;X<Hp;X++){if($.length===0)return;if(X>0){if($[0]!==".")return;$=$.substring(1)}let{n:Q,c:Y,ok:G}=Ls6($);if(!G||Q>255)return;$=$.substring(Y),Z[X]=Q}return Xs1(Z[0],Z[1],Z[2],Z[3])}function Os6($){let Z=new Uint8Array(bE),X=-1;if($.length>=2&&$[0]===":"&&$[1]===":"){if(X=0,$=$.substring(2),$.length===0)return Z}let Q=0;while(Q<bE){let{n:Y,c:G,ok:J}=ws6($);if(!J||Y>65535)return;if(G<$.length&&$[G]==="."){if(X<0&&Q!=bE-Hp)return;if(Q+Hp>bE)return;let K=Ys1($);if(K===void 0)return;Z[Q]=K[12],Z[Q+1]=K[13],Z[Q+2]=K[14],Z[Q+3]=K[15],$="",Q+=Hp;break}if(Z[Q]=Y>>8,Z[Q+1]=Y,Q+=2,$=$.substring(G),$.length===0)break;if($[0]!==":"||$.length==1)return;if($=$.substring(1),$[0]===":"){if(X>=0)return;if(X=Q,$=$.substring(1),$.length===0)break}}if($.length!==0)return;if(Q<bE){if(X<0)return;let Y=bE-Q;for(let G=Q-1;G>=X;G--)Z[G+Y]=Z[G];for(let G=X+Y-1;G>=X;G--)Z[G]=0}else if(X>=0)return;return Z}function Ls6($){let Z=0,X=0;for(Z=0;Z<$.length&&P70<=$.charCodeAt(Z)&&$.charCodeAt(Z)<=Zs1;Z++)if(X=X*10+($.charCodeAt(Z)-P70),X>=op0)return{n:op0,c:Z,ok:!1};if(Z===0)return{n:0,c:0,ok:!1};return{n:X,c:Z,ok:!0}}function ws6($){let Z=0,X=0;for(X=0;X<$.length;X++){if(P70<=$.charCodeAt(X)&&$.charCodeAt(X)<=Zs1)Z*=16,Z+=$.charCodeAt(X)-P70;else if($s1<=$.charCodeAt(X)&&$.charCodeAt(X)<=Ns6)Z*=16,Z+=$.charCodeAt(X)-$s1+10;else if(ea1<=$.charCodeAt(X)&&$.charCodeAt(X)<=Us6)Z*=16,Z+=$.charCodeAt(X)-ea1+10;else break;if(Z>=op0)return{n:0,c:X,ok:!1}}if(X===0)return{n:0,c:X,ok:!1};return{n:Z,c:X,ok:!0}}});var Xn0=v((Ks1)=>{Object.defineProperty(Ks1,"__esModule",{value:!0});Ks1.Servers=Ks1.ServerImpl=void 0;Ks1.isIPV4OrHostname=Js1;Ks1.hostPort=Zn0;var ap0=fE(),sp0=dJ(),ep0=rp0(),zs6=eB(),Ps6=JG();function Js1($){if($.indexOf("[")!==-1||$.indexOf("::")!==-1)return!1;if($.indexOf(".")!==-1)return!0;if($.split(":").length<=2)return!0;return!1}function $n0($){return!Js1($)}function As6($){let X=$.toUpperCase().indexOf("::FFFF:");if(X!==-1&&$.indexOf(".")!==-1){let Q=$.substring(X+7);return Q=Q.replace("[",""),Q.replace("]","")}return $}function Zn0($){if($=$.trim(),$.match(/^(.*:\/\/)(.*)/m))$=$.replace(/^(.*:\/\/)(.*)/gm,"$2");if($=As6($),$n0($)&&$.indexOf("[")===-1)$=`[${$}]`;let Z=$n0($)?$.match(/(]:)(\d+)/):$.match(/(:)(\d+)/),X=Z&&Z.length===3&&Z[1]&&Z[2]?parseInt(Z[2]):zs6.DEFAULT_PORT,Y=new URL(`${X===80?"https":"http"}://${$}`);Y.port=`${X}`;let G=Y.hostname;if(G.charAt(0)==="[")G=G.substring(1,G.length-1);return{listen:Y.host,hostname:G,port:X}}class Hy{src;listen;hostname;port;didConnect;reconnects;lastConnect;gossiped;tlsName;resolves;constructor($,Z=!1){this.src=$,this.tlsName="";let X=Zn0($);this.listen=X.listen,this.hostname=X.hostname,this.port=X.port,this.didConnect=!1,this.reconnects=0,this.lastConnect=0,this.gossiped=Z}toString(){return this.listen}async resolve($){if(!$.fn||$.resolve===!1)return[this];let Z=[];if((0,ep0.isIP)(this.hostname))return[this];else{let X=await $.fn(this.hostname);if($.debug)console.log(`resolve ${this.hostname} = ${X.join(",")}`);for(let Q of X){let Y=this.port===80?"https":"http",G=new URL(`${Y}://${$n0(Q)?"["+Q+"]":Q}`);G.port=`${this.port}`;let J=new Hy(G.host,!1);J.tlsName=this.hostname,Z.push(J)}}if($.randomize)(0,sp0.shuffle)(Z);return this.resolves=Z,Z}}Ks1.ServerImpl=Hy;class A70{firstSelect;servers;currentServer;tlsName;randomize;constructor($={}){this.firstSelect=!0,this.servers=[],this.tlsName="",this.randomize=$.randomize||!1}setServers($){if(!Array.isArray($)||$.length===0)throw Ps6.InvalidArgumentError.format("servers","cannot be empty");let Z=(0,ap0.getUrlParseFn)(),X=new Map;for(let Y of this.servers)X.set(Y.listen,Y);let Q=[];for(let Y of $){Y=Z?Z(Y):Y;let{listen:G}=Zn0(Y),J=X.get(G);if(J)J.gossiped=!1,Q.push(J);else Q.push(new Hy(Y))}if(this.randomize)(0,sp0.shuffle)(Q);if(this.servers=Q,this.currentServer===void 0||!Q.includes(this.currentServer))this.currentServer=Q[0],this.firstSelect=!0}clear(){this.servers.length=0}updateTLSName(){let $=this.getCurrentServer();if(!(0,ep0.isIP)($.hostname))this.tlsName=$.hostname,this.servers.forEach((Z)=>{if(Z.gossiped)Z.tlsName=this.tlsName})}getCurrentServer(){return this.currentServer}addServer($,Z=!1){let X=(0,ap0.getUrlParseFn)();$=X?X($):$;let Q=new Hy($,Z);if((0,ep0.isIP)(Q.hostname))Q.tlsName=this.tlsName;this.servers.push(Q)}selectServer(){if(this.firstSelect)return this.firstSelect=!1,this.currentServer;let $=this.servers.shift();if($)this.servers.push($),this.currentServer=$;return $}removeCurrentServer(){this.removeServer(this.currentServer)}removeServer($){if($){let Z=this.servers.indexOf($);this.servers.splice(Z,1)}}snapshot(){return A70.freezeAll(this.servers)}snapshotForHandler(){let $=this.currentServer;if(!$)return this.snapshot();let Z=this.servers.indexOf($);if(Z<=0)return this.snapshot();return A70.freezeAll([$,...this.servers.slice(0,Z),...this.servers.slice(Z+1)])}static freezeAll($){return $.map((Z)=>Object.freeze({hostname:Z.hostname,port:Z.port,listen:Z.listen,src:Z.src,tlsName:Z.tlsName,reconnects:Z.reconnects,lastConnect:Z.lastConnect,gossiped:Z.gossiped,didConnect:Z.didConnect}))}find($){return this.servers.find((Z)=>Z.listen===$.listen)}setCurrent($){this.currentServer=$}length(){return this.servers.length}next(){return this.servers.length?this.servers[0]:void 0}getServers(){return this.servers}update($,Z){let X=[],Q=[],Y=(0,ap0.getUrlParseFn)(),G=new Map;if($.connect_urls&&$.connect_urls.length>0)$.connect_urls.forEach((K)=>{K=Y?Y(K,Z):K;let W=new Hy(K,!0);G.set(K,W)});let J=[];if(this.servers.forEach((K,W)=>{let H=K.listen;if(K.gossiped&&this.currentServer.listen!==H&&G.get(H)===void 0)J.push(W);G.delete(H)}),J.reverse(),J.forEach((K)=>{let W=this.servers.splice(K,1);Q=Q.concat(W[0].listen)}),G.forEach((K,W)=>{this.servers.push(K),X.push(W)}),this.randomize&&X.length>0){let K=this.currentServer,W=this.servers.filter((H)=>H!==K);(0,sp0.shuffle)(W),this.servers=K?[K,...W]:W}return{added:X,deleted:Q}}}Ks1.Servers=A70});var T70=v((Us1)=>{Object.defineProperty(Us1,"__esModule",{value:!0});Us1.QueuedIteratorImpl=void 0;var Qn0=dJ(),Hs1=JG();class Fs1{inflight;processed;received;noIterator;iterClosed;done;signal;yields;filtered;pendingFiltered;ctx;_data;err;time;profile;yielding;didBreak;constructor(){this.inflight=0,this.filtered=0,this.pendingFiltered=0,this.processed=0,this.received=0,this.noIterator=!1,this.done=!1,this.signal=(0,Qn0.deferred)(),this.yields=[],this.iterClosed=(0,Qn0.deferred)(),this.time=0,this.yielding=!1,this.didBreak=!1,this.profile=!1}[Symbol.asyncIterator](){return this.iterate()}push($){if(this.done)return;if(this.didBreak){if(typeof $==="function"){let Z=$;try{Z()}catch(X){}}return}if(typeof $==="function")this.pendingFiltered++;this.yields.push($),this.signal.resolve()}async*iterate(){if(this.noIterator)throw new Hs1.InvalidOperationError("iterator cannot be used when a callback is registered");if(this.yielding)throw new Hs1.InvalidOperationError("iterator is already yielding");this.yielding=!0;try{while(!0){if(this.yields.length===0)await this.signal;if(this.err)throw this.err;let $=this.yields;this.inflight=$.length,this.yields=[];for(let Z=0;Z<$.length;Z++){if(typeof $[Z]==="function"){this.pendingFiltered--;let Q=$[Z];try{Q()}catch(Y){throw Y}if(this.err)throw this.err;continue}this.processed++,this.inflight--;let X=this.profile?Date.now():0;yield $[Z],this.time=this.profile?Date.now()-X:0}if(this.done)break;else if(this.yields.length===0)$.length=0,this.yields=$,this.signal=(0,Qn0.deferred)()}}finally{this.didBreak=!0,this.stop()}}stop($){if(this.done)return;this.err=$,this.done=!0,this.signal.resolve(),this.iterClosed.resolve($)}getProcessed(){return this.noIterator?this.received:this.processed}getPending(){return this.yields.length+this.inflight-this.pendingFiltered}getReceived(){return this.received-this.filtered}}Us1.QueuedIteratorImpl=Fs1});var Yn0=v((Ls1)=>{Object.defineProperty(Ls1,"__esModule",{value:!0});Ls1.MuxSubscription=void 0;var qs6=eB(),Bs1=JG();class Os1{baseInbox;reqs;constructor(){this.reqs=new Map}size(){return this.reqs.size}init($){return this.baseInbox=`${(0,qs6.createInbox)($)}.`,this.baseInbox}add($){if(!isNaN($.received))$.received=0;this.reqs.set($.token,$)}get($){return this.reqs.get($)}cancel($){this.reqs.delete($.token)}getToken($){let Z=$.subject||"";if(Z.indexOf(this.baseInbox)===0)return Z.substring(this.baseInbox.length);return null}all(){return Array.from(this.reqs.values())}handleError($,Z){if($)return this.all().forEach((X)=>{X.resolver(Z,{})}),!0;if(Z.operation==="publish"){let X=this.all().find((Q)=>{return Q.requestSubject===Z.subject});if(X)return X.resolver(Z,{}),!0}return!1}dispatcher(){return($,Z)=>{let X=this.getToken(Z);if(X){let Q=this.get(X);if(Q){if($===null)$=Z?.data?.length===0&&Z.headers?.code===503?new Bs1.NoRespondersError(Q.requestSubject):null;Q.resolver($,Z)}}}}close(){let $=new Bs1.RequestError("connection closed");this.reqs.forEach((Z)=>{Z.resolver($,{})})}}Ls1.MuxSubscription=Os1});var Gn0=v((Es1)=>{Object.defineProperty(Es1,"__esModule",{value:!0});Es1.Heartbeat=void 0;var Ms6=dJ();class Ds1{ph;interval;maxOut;timer;pendings;constructor($,Z,X){this.ph=$,this.interval=Z,this.maxOut=X,this.pendings=[]}start(){this.cancel(),this._schedule()}cancel($){if(this.timer)clearTimeout(this.timer),this.timer=void 0;if(this._reset(),$)this.ph.disconnect()}_schedule(){this.timer=setTimeout(()=>{if(this.ph.dispatchStatus({type:"ping",pendingPings:this.pendings.length+1}),this.pendings.length===this.maxOut){this.cancel(!0);return}let $=(0,Ms6.deferred)();this.ph.flush($).then(()=>{this._reset()}).catch(()=>{this.cancel()}),this.pendings.push($),this._schedule()},this.interval)}_reset(){this.pendings=this.pendings.filter(($)=>{return $.resolve(),!1})}}Es1.Heartbeat=Ds1});var Wn0=v((Ts1)=>{Object.defineProperty(Ts1,"__esModule",{value:!0});Ts1.DenoBuffer=Ts1.MAX_SIZE=Ts1.AssertionError=void 0;Ts1.assert=Ps1;Ts1.concat=As1;Ts1.append=ks6;Ts1.readAll=Ss6;Ts1.writeAll=Cs6;var Vs6=GG();class Jn0 extends Error{constructor($){super($);this.name="AssertionError"}}Ts1.AssertionError=Jn0;function Ps1($,Z="Assertion failed."){if(!$)throw new Jn0(Z)}var zs1=32768;Ts1.MAX_SIZE=4294967294;function R70($,Z,X=0){let Q=Z.byteLength-X;if($.byteLength>Q)$=$.subarray(0,Q);return Z.set($,X),$.byteLength}function As1($,Z){if($===void 0&&Z===void 0)return new Uint8Array(0);if($===void 0)return Z;if(Z===void 0)return $;let X=new Uint8Array($.length+Z.length);return X.set($,0),X.set(Z,$.length),X}function ks6($,Z){return As1($,Uint8Array.of(Z))}class Kn0{_buf;_off;constructor($){if(this._off=0,$==null){this._buf=new Uint8Array(0);return}this._buf=new Uint8Array($)}bytes($={copy:!0}){if($.copy===!1)return this._buf.subarray(this._off);return this._buf.slice(this._off)}empty(){return this._buf.byteLength<=this._off}get length(){return this._buf.byteLength-this._off}get capacity(){return this._buf.buffer.byteLength}truncate($){if($===0){this.reset();return}if($<0||$>this.length)throw Error("bytes.Buffer: truncation out of range");this._reslice(this._off+$)}reset(){this._reslice(0),this._off=0}_tryGrowByReslice($){let Z=this._buf.byteLength;if($<=this.capacity-Z)return this._reslice(Z+$),Z;return-1}_reslice($){Ps1($<=this._buf.buffer.byteLength),this._buf=new Uint8Array(this._buf.buffer,0,$)}readByte(){let $=new Uint8Array(1);if(this.read($))return $[0];return null}read($){if(this.empty()){if(this.reset(),$.byteLength===0)return 0;return null}let Z=R70(this._buf.subarray(this._off),$);return this._off+=Z,Z}writeByte($){return this.write(Uint8Array.of($))}writeString($){return this.write(Vs6.TE.encode($))}write($){let Z=this._grow($.byteLength);return R70($,this._buf,Z)}_grow($){let Z=this.length;if(Z===0&&this._off!==0)this.reset();let X=this._tryGrowByReslice($);if(X>=0)return X;let Q=this.capacity;if($<=Math.floor(Q/2)-Z)R70(this._buf.subarray(this._off),this._buf);else if(Q+$>Ts1.MAX_SIZE)throw Error("The buffer cannot be grown beyond the maximum size.");else{let Y=new Uint8Array(Math.min(2*Q+$,Ts1.MAX_SIZE));R70(this._buf.subarray(this._off),Y),this._buf=Y}return this._off=0,this._reslice(Math.min(Z+$,Ts1.MAX_SIZE)),Z}grow($){if($<0)throw Error("Buffer._grow: negative count");let Z=this._grow($);this._reslice(Z)}readFrom($){let Z=0,X=new Uint8Array(zs1);while(!0){let Q=this.capacity-this.length<zs1,Y=Q?X:new Uint8Array(this._buf.buffer,this.length),G=$.read(Y);if(G===null)return Z;if(Q)this.write(Y.subarray(0,G));else this._reslice(this.length+G);Z+=G}}}Ts1.DenoBuffer=Kn0;function Ss6($){let Z=new Kn0;return Z.readFrom($),Z.bytes()}function Cs6($,Z){let X=0;while(X<Z.length)X+=$.write(Z.subarray(X))}});var Un0=v((Vs1)=>{Object.defineProperty(Vs1,"__esModule",{value:!0});Vs1.cc=Vs1.State=Vs1.Parser=Vs1.Kind=void 0;Vs1.describe=gs6;var Hn0=Wn0(),Fn0=GG();Vs1.Kind={OK:0,ERR:1,MSG:2,INFO:3,PING:4,PONG:5};function gs6($){let Z,X="";switch($.kind){case Vs1.Kind.MSG:Z="MSG";break;case Vs1.Kind.OK:Z="OK";break;case Vs1.Kind.ERR:Z="ERR",X=Fn0.TD.decode($.data);break;case Vs1.Kind.PING:Z="PING";break;case Vs1.Kind.PONG:Z="PONG";break;case Vs1.Kind.INFO:Z="INFO",X=Fn0.TD.decode($.data)}return`${Z}: ${X}`}function Is1(){let $={};return $.sid=-1,$.hdr=-1,$.size=-1,$}var qs1=48,hs6=57,Fy=67108864;class Ms1{dispatcher;state;as;drop;hdr;ma;argBuf;msgBuf;constructor($){this.dispatcher=$,this.state=Vs1.State.OP_START,this.as=0,this.drop=0,this.hdr=0}parse($){let Z;for(Z=0;Z<$.length;Z++){let X=$[Z];switch(this.state){case Vs1.State.OP_START:switch(X){case Vs1.cc.M:case Vs1.cc.m:this.state=Vs1.State.OP_M,this.hdr=-1,this.ma=Is1();break;case Vs1.cc.H:case Vs1.cc.h:this.state=Vs1.State.OP_H,this.hdr=0,this.ma=Is1();break;case Vs1.cc.P:case Vs1.cc.p:this.state=Vs1.State.OP_P;break;case Vs1.cc.PLUS:this.state=Vs1.State.OP_PLUS;break;case Vs1.cc.MINUS:this.state=Vs1.State.OP_MINUS;break;case Vs1.cc.I:case Vs1.cc.i:this.state=Vs1.State.OP_I;break;default:throw this.fail($.subarray(Z))}break;case Vs1.State.OP_H:switch(X){case Vs1.cc.M:case Vs1.cc.m:this.state=Vs1.State.OP_M;break;default:throw this.fail($.subarray(Z))}break;case Vs1.State.OP_M:switch(X){case Vs1.cc.S:case Vs1.cc.s:this.state=Vs1.State.OP_MS;break;default:throw this.fail($.subarray(Z))}break;case Vs1.State.OP_MS:switch(X){case Vs1.cc.G:case Vs1.cc.g:this.state=Vs1.State.OP_MSG;break;default:throw this.fail($.subarray(Z))}break;case Vs1.State.OP_MSG:switch(X){case Vs1.cc.SPACE:case Vs1.cc.TAB:this.state=Vs1.State.OP_MSG_SPC;break;default:throw this.fail($.subarray(Z))}break;case Vs1.State.OP_MSG_SPC:switch(X){case Vs1.cc.SPACE:case Vs1.cc.TAB:continue;default:this.state=Vs1.State.MSG_ARG,this.as=Z}break;case Vs1.State.MSG_ARG:switch(X){case Vs1.cc.CR:this.drop=1;break;case Vs1.cc.NL:{let Q=this.argBuf?this.argBuf.bytes():$.subarray(this.as,Z-this.drop);this.processMsgArgs(Q),this.drop=0,this.as=Z+1,this.state=Vs1.State.MSG_PAYLOAD,Z=this.as+this.ma.size-1;break}default:if(this.argBuf)this.argBuf.writeByte(X)}break;case Vs1.State.MSG_PAYLOAD:if(this.msgBuf)if(this.msgBuf.length>=this.ma.size){let Q=this.msgBuf.bytes({copy:!1});this.dispatcher.push({kind:Vs1.Kind.MSG,msg:this.ma,data:Q}),this.argBuf=void 0,this.msgBuf=void 0,this.state=Vs1.State.MSG_END}else{let Q=this.ma.size-this.msgBuf.length,Y=$.length-Z;if(Y<Q)Q=Y;if(Q>0)this.msgBuf.write($.subarray(Z,Z+Q)),Z=Z+Q-1;else this.msgBuf.writeByte(X)}else if(Z-this.as>=this.ma.size)this.dispatcher.push({kind:Vs1.Kind.MSG,msg:this.ma,data:$.subarray(this.as,Z)}),this.argBuf=void 0,this.msgBuf=void 0,this.state=Vs1.State.MSG_END;break;case Vs1.State.MSG_END:switch(X){case Vs1.cc.NL:this.drop=0,this.as=Z+1,this.state=Vs1.State.OP_START;break;default:continue}break;case Vs1.State.OP_PLUS:switch(X){case Vs1.cc.O:case Vs1.cc.o:this.state=Vs1.State.OP_PLUS_O;break;default:throw this.fail($.subarray(Z))}break;case Vs1.State.OP_PLUS_O:switch(X){case Vs1.cc.K:case Vs1.cc.k:this.state=Vs1.State.OP_PLUS_OK;break;default:throw this.fail($.subarray(Z))}break;case Vs1.State.OP_PLUS_OK:switch(X){case Vs1.cc.NL:this.dispatcher.push({kind:Vs1.Kind.OK}),this.drop=0,this.state=Vs1.State.OP_START;break}break;case Vs1.State.OP_MINUS:switch(X){case Vs1.cc.E:case Vs1.cc.e:this.state=Vs1.State.OP_MINUS_E;break;default:throw this.fail($.subarray(Z))}break;case Vs1.State.OP_MINUS_E:switch(X){case Vs1.cc.R:case Vs1.cc.r:this.state=Vs1.State.OP_MINUS_ER;break;default:throw this.fail($.subarray(Z))}break;case Vs1.State.OP_MINUS_ER:switch(X){case Vs1.cc.R:case Vs1.cc.r:this.state=Vs1.State.OP_MINUS_ERR;break;default:throw this.fail($.subarray(Z))}break;case Vs1.State.OP_MINUS_ERR:switch(X){case Vs1.cc.SPACE:case Vs1.cc.TAB:this.state=Vs1.State.OP_MINUS_ERR_SPC;break;default:throw this.fail($.subarray(Z))}break;case Vs1.State.OP_MINUS_ERR_SPC:switch(X){case Vs1.cc.SPACE:case Vs1.cc.TAB:continue;default:this.state=Vs1.State.MINUS_ERR_ARG,this.as=Z}break;case Vs1.State.MINUS_ERR_ARG:switch(X){case Vs1.cc.CR:this.drop=1;break;case Vs1.cc.NL:{let Q;if(this.argBuf)Q=this.argBuf.bytes(),this.argBuf=void 0;else Q=$.subarray(this.as,Z-this.drop);this.dispatcher.push({kind:Vs1.Kind.ERR,data:Q}),this.drop=0,this.as=Z+1,this.state=Vs1.State.OP_START;break}default:if(this.argBuf)this.argBuf.write(Uint8Array.of(X))}break;case Vs1.State.OP_P:switch(X){case Vs1.cc.I:case Vs1.cc.i:this.state=Vs1.State.OP_PI;break;case Vs1.cc.O:case Vs1.cc.o:this.state=Vs1.State.OP_PO;break;default:throw this.fail($.subarray(Z))}break;case Vs1.State.OP_PO:switch(X){case Vs1.cc.N:case Vs1.cc.n:this.state=Vs1.State.OP_PON;break;default:throw this.fail($.subarray(Z))}break;case Vs1.State.OP_PON:switch(X){case Vs1.cc.G:case Vs1.cc.g:this.state=Vs1.State.OP_PONG;break;default:throw this.fail($.subarray(Z))}break;case Vs1.State.OP_PONG:switch(X){case Vs1.cc.NL:this.dispatcher.push({kind:Vs1.Kind.PONG}),this.drop=0,this.state=Vs1.State.OP_START;break}break;case Vs1.State.OP_PI:switch(X){case Vs1.cc.N:case Vs1.cc.n:this.state=Vs1.State.OP_PIN;break;default:throw this.fail($.subarray(Z))}break;case Vs1.State.OP_PIN:switch(X){case Vs1.cc.G:case Vs1.cc.g:this.state=Vs1.State.OP_PING;break;default:throw this.fail($.subarray(Z))}break;case Vs1.State.OP_PING:switch(X){case Vs1.cc.NL:this.dispatcher.push({kind:Vs1.Kind.PING}),this.drop=0,this.state=Vs1.State.OP_START;break}break;case Vs1.State.OP_I:switch(X){case Vs1.cc.N:case Vs1.cc.n:this.state=Vs1.State.OP_IN;break;default:throw this.fail($.subarray(Z))}break;case Vs1.State.OP_IN:switch(X){case Vs1.cc.F:case Vs1.cc.f:this.state=Vs1.State.OP_INF;break;default:throw this.fail($.subarray(Z))}break;case Vs1.State.OP_INF:switch(X){case Vs1.cc.O:case Vs1.cc.o:this.state=Vs1.State.OP_INFO;break;default:throw this.fail($.subarray(Z))}break;case Vs1.State.OP_INFO:switch(X){case Vs1.cc.SPACE:case Vs1.cc.TAB:this.state=Vs1.State.OP_INFO_SPC;break;default:throw this.fail($.subarray(Z))}break;case Vs1.State.OP_INFO_SPC:switch(X){case Vs1.cc.SPACE:case Vs1.cc.TAB:continue;default:this.state=Vs1.State.INFO_ARG,this.as=Z}break;case Vs1.State.INFO_ARG:switch(X){case Vs1.cc.CR:this.drop=1;break;case Vs1.cc.NL:{let Q;if(this.argBuf)Q=this.argBuf.bytes(),this.argBuf=void 0;else Q=$.subarray(this.as,Z-this.drop);this.dispatcher.push({kind:Vs1.Kind.INFO,data:Q}),this.drop=0,this.as=Z+1,this.state=Vs1.State.OP_START;break}default:if(this.argBuf)this.argBuf.writeByte(X)}break;default:throw this.fail($.subarray(Z))}}if((this.state===Vs1.State.MSG_ARG||this.state===Vs1.State.MINUS_ERR_ARG||this.state===Vs1.State.INFO_ARG)&&!this.argBuf)this.argBuf=new Hn0.DenoBuffer($.subarray(this.as,Z-this.drop));if(this.state===Vs1.State.MSG_PAYLOAD&&!this.msgBuf){if(!this.argBuf)this.cloneMsgArg();this.msgBuf=new Hn0.DenoBuffer($.subarray(this.as))}}cloneMsgArg(){let $=this.ma.subject.length,Z=this.ma.reply?this.ma.reply.length:0,X=new Uint8Array($+Z);if(X.set(this.ma.subject),this.ma.reply)X.set(this.ma.reply,$);if(this.argBuf=new Hn0.DenoBuffer(X),this.ma.subject=X.subarray(0,$),this.ma.reply)this.ma.reply=X.subarray($)}processMsgArgs($){if(this.hdr>=0)return this.processHeaderMsgArgs($);let Z=[],X=-1;for(let Q=0;Q<$.length;Q++)switch($[Q]){case Vs1.cc.SPACE:case Vs1.cc.TAB:case Vs1.cc.CR:case Vs1.cc.NL:if(X>=0)Z.push($.subarray(X,Q)),X=-1;break;default:if(X<0)X=Q}if(X>=0)Z.push($.subarray(X));switch(Z.length){case 3:this.ma.subject=Z[0],this.ma.sid=this.protoParseInt(Z[1]),this.ma.reply=void 0,this.ma.size=this.protoParseInt(Z[2],Fy);break;case 4:this.ma.subject=Z[0],this.ma.sid=this.protoParseInt(Z[1]),this.ma.reply=Z[2],this.ma.size=this.protoParseInt(Z[3],Fy);break;default:throw this.fail($,"processMsgArgs Parse Error")}if(this.ma.sid<0)throw this.fail($,"processMsgArgs Bad or Missing Sid Error");if(this.ma.size<0)throw this.fail($,"processMsgArgs Bad or Missing Size Error")}fail($,Z=""){if(!Z)Z=`parse error [${this.state}]`;else Z=`${Z} [${this.state}]`;return Error(`${Z}: ${Fn0.TD.decode($)}`)}processHeaderMsgArgs($){let Z=[],X=-1;for(let Q=0;Q<$.length;Q++)switch($[Q]){case Vs1.cc.SPACE:case Vs1.cc.TAB:case Vs1.cc.CR:case Vs1.cc.NL:if(X>=0)Z.push($.subarray(X,Q)),X=-1;break;default:if(X<0)X=Q}if(X>=0)Z.push($.subarray(X));switch(Z.length){case 4:this.ma.subject=Z[0],this.ma.sid=this.protoParseInt(Z[1]),this.ma.reply=void 0,this.ma.hdr=this.protoParseInt(Z[2],Fy),this.ma.size=this.protoParseInt(Z[3],Fy);break;case 5:this.ma.subject=Z[0],this.ma.sid=this.protoParseInt(Z[1]),this.ma.reply=Z[2],this.ma.hdr=this.protoParseInt(Z[3],Fy),this.ma.size=this.protoParseInt(Z[4],Fy);break;default:throw this.fail($,"processHeaderMsgArgs Parse Error")}if(this.ma.sid<0)throw this.fail($,"processHeaderMsgArgs Bad or Missing Sid Error");if(this.ma.hdr<0||this.ma.hdr>this.ma.size)throw this.fail($,"processHeaderMsgArgs Bad or Missing Header Size Error");if(this.ma.size<0)throw this.fail($,"processHeaderMsgArgs Bad or Missing Size Error")}protoParseInt($,Z){if($.length===0||$.length>15)return-1;let X=0;for(let Q=0;Q<$.length;Q++){if($[Q]<qs1||$[Q]>hs6)return-1;X=X*10+($[Q]-qs1)}return Z!==void 0&&X>Z?-1:X}}Vs1.Parser=Ms1;Vs1.State={OP_START:0,OP_PLUS:1,OP_PLUS_O:2,OP_PLUS_OK:3,OP_MINUS:4,OP_MINUS_E:5,OP_MINUS_ER:6,OP_MINUS_ERR:7,OP_MINUS_ERR_SPC:8,MINUS_ERR_ARG:9,OP_M:10,OP_MS:11,OP_MSG:12,OP_MSG_SPC:13,MSG_ARG:14,MSG_PAYLOAD:15,MSG_END:16,OP_H:17,OP_P:18,OP_PI:19,OP_PIN:20,OP_PING:21,OP_PO:22,OP_PON:23,OP_PONG:24,OP_I:25,OP_IN:26,OP_INF:27,OP_INFO:28,OP_INFO_SPC:29,INFO_ARG:30};Vs1.cc={CR:13,E:69,e:101,F:70,f:102,G:71,g:103,H:72,h:104,I:73,i:105,K:75,k:107,M:77,m:109,MINUS:45,N:78,n:110,NL:10,O:79,o:111,P:80,p:112,PLUS:43,R:82,r:114,S:83,s:115,SPACE:32,TAB:9}});var M70=v((Ss1)=>{Object.defineProperty(Ss1,"__esModule",{value:!0});Ss1.MsgHdrsImpl=void 0;Ss1.canonicalMIMEHeaderKey=Bn0;Ss1.headers=ls6;var ks1=GG(),mJ=eB(),q70=JG();function Bn0($){let F=!0,U=Array($.length);for(let N=0;N<$.length;N++){let B=$.charCodeAt(N);if(B===58||B<33||B>126)throw q70.InvalidArgumentError.format("header",`'${$[N]}' is not a valid character in a header name`);if(F&&97<=B&&B<=122)B-=32;else if(!F&&65<=B&&B<=90)B+=32;U[N]=B,F=B==45}return String.fromCharCode(...U)}function ls6($=0,Z=""){if($===0&&Z!=="")throw q70.InvalidArgumentError.format("code","is required");else if($>0&&Z==="")throw q70.InvalidArgumentError.format("description","is required");return new Uy($,Z)}var Nn0="NATS/1.0";class Uy{_code;headers;_description;constructor($=0,Z=""){this._code=$,this._description=Z,this.headers=new Map}[Symbol.iterator](){return this.headers.entries()}size(){return this.headers.size}equals($){if($&&this.headers.size===$.headers.size&&this._code===$._code){for(let[Z,X]of this.headers){let Q=$.values(Z);if(X.length!==Q.length)return!1;let Y=[...X].sort(),G=[...Q].sort();for(let J=0;J<Y.length;J++)if(Y[J]!==G[J])return!1}return!0}return!1}static decode($){let Z=new Uy,Q=ks1.TD.decode($).split(`\r
 `),Y=Q[0];if(Y!==Nn0){let G=Y.replace(Nn0,"").trim();if(G.length>0){if(Z._code=parseInt(G,10),isNaN(Z._code))Z._code=0;let J=Z._code.toString();G=G.replace(J,""),Z._description=G.trim()}}if(Q.length>=1)Q.slice(1).map((G)=>{if(G){let J=G.indexOf(":");if(J>-1){let K=G.slice(0,J),W=G.slice(J+1).trim();Z.append(K,W)}}});return Z}toString(){if(this.headers.size===0&&this._code===0)return"";let $=Nn0;if(this._code>0&&this._description!=="")$+=` ${this._code} ${this._description}`;for(let[Z,X]of this.headers)for(let Q=0;Q<X.length;Q++)$=`${$}\r
 ${Z}: ${X[Q]}`;return`${$}\r
@@ -2232,7 +2232,7 @@ You are the Usage Manager. You analyze how this workspace is actually used \u201
    d. Report the failing tool/connection, error pattern, and suggest the fix or owner.
 </workflows>`,OU8={id:"studio-usage-manager",title:"Usage Manager",icon:"icon://BarChart10?color=blue",description:"Analyze usage, costs, and clean up idle agents and connections",selectedTools:["MONITORING_STATS","MONITORING_LOGS_LIST","MONITORING_LOG_GET","MONITORING_THREAD_USAGE","COLLECTION_VIRTUAL_MCP_LIST","COLLECTION_VIRTUAL_MCP_GET","COLLECTION_VIRTUAL_MCP_DELETE","VIRTUAL_MCP_LAST_USED_LIST","COLLECTION_CONNECTIONS_LIST","COLLECTION_CONNECTIONS_GET","COLLECTION_CONNECTIONS_DELETE","ORGANIZATION_MEMBER_LIST"],selectedConnections:null,selectedPrompts:[],instructions:qz4,getId:YY.USAGE_MANAGER}});function M11($){return aj.find((Z)=>$.startsWith(`${Z.id}_`))??null}async function Vz4($,Z){if("resolveRuntime"in $)return $.resolveRuntime(Z);return{instructions:$.instructions,selectedTools:$.selectedTools}}async function A30({virtualMcp:$,agentId:Z=$.id,organizationId:X,ctx:Q}){let Y=M11(Z);if(!Y)return $;let G=await Vz4(Y,{orgId:X,ctx:Q}),J=G.selectedTools?[...G.selectedTools]:null;return{...$,metadata:{...$.metadata??{},instructions:G.instructions},connections:$.connections.map((K)=>({...K,selected_tools:J}))}}async function T30($,Z){if(!("checklist"in $))return[];return Promise.all($.checklist.map(async(X)=>({label:X.label,activeForm:X.activeForm,action:X.action,completed:await X.isCompleted(Z),alwaysSuggest:X.alwaysSuggest})))}async function wU8($,Z,X){let Q={self:r6.SELF($),registry:r6.REGISTRY($),"community-registry":r6.COMMUNITY_REGISTRY($)};await Promise.all(Mz4.map((Y)=>X.delete(`${Y}${$}`))),await Promise.all(aj.map(async(Y)=>{let G=Y.getId($),J=await X.findById(G,$),W=(Y.selectedConnections??["self"]).map((H)=>Q[H]);if(J){await X.update(G,Z,{metadata:{...J.metadata??{},instructions:Y.instructions},connections:W.map((H)=>{let F=J.connections.find((U)=>U.connection_id===H);return{connection_id:H,selected_tools:Y.selectedTools?[...Y.selectedTools]:null,selected_resources:F?.selected_resources??null,selected_prompts:F?.selected_prompts??null}})});return}await X.create($,Z,{title:Y.title,description:Y.description,icon:Y.icon,status:"active",pinned:!1,metadata:{instructions:Y.instructions},connections:W.map((H)=>({connection_id:H,selected_tools:Y.selectedTools?[...Y.selectedTools]:null,selected_resources:null,selected_prompts:Y.selectedPrompts?[...Y.selectedPrompts]:null}))},{id:G})}))}var Mz4,aj;var kh=L(()=>{S6();$U8();XU8();YU8();HU8();UU8();BU8();LU8();Mz4=["studio-task-manager_"],aj=[WU8,eF8,QU8,FU8,ZU8,NU8,OU8]});import{DBOS as R30}from"@dbos-inc/dbos-sdk";async function kz4($){let Z=W6(),X=new Ug(Z.db);await wU8($.orgId,$.createdBy,X)}async function Sz4($){let Z=W6(),X=new Ug(Z.db);for(let Q of aj){let Y=Q.getId($.orgId),G=await X.findById(Y,$.orgId);if(!G)continue;let J=Q.selectedPrompts?[...Q.selectedPrompts]:null;if(G.connections.every((W)=>{let H=W.selected_prompts;if(J===null)return H===null;if(H===null)return!1;if(H.length!==J.length)return!1;return H.every((F,U)=>F===J[U])}))continue;await X.update(Y,$.createdBy,{connections:G.connections.map((W)=>({connection_id:W.connection_id,selected_tools:W.selected_tools,selected_resources:W.selected_resources,selected_prompts:J}))})}}async function Cz4($){await R30.runStep(()=>kz4($),{name:"installStudioPack"}),await R30.runStep(()=>Sz4($),{name:"backfillSelectedPrompts"})}async function V11($){await R30.startWorkflow(_z4,{workflowID:`install-studio-pack:${vz4}:${$.orgId}`})($)}async function DU8(){let Z=await W6().db.selectFrom("member").select(["organizationId","userId"]).orderBy("createdAt","asc").execute(),X=new Map;for(let Q of Z)if(!X.has(Q.organizationId))X.set(Q.organizationId,Q.userId);await P30(Array.from(X),10,async([Q,Y])=>{try{await V11({orgId:Q,createdBy:Y})}catch(G){console.error("[studio-pack-backfill] enqueue failed",{orgId:Q},G)}})}var _z4,vz4="v6";var I30=L(()=>{JX();ua0();kh();_z4=R30.registerWorkflow(Cz4,{name:"installStudioPackWorkflow"})});class fo{constructor(){this._messageQueue=[]}static createLinkedPair(){let $=new fo,Z=new fo;return $._otherTransport=Z,Z._otherTransport=$,[$,Z]}async start(){while(this._messageQueue.length>0){let $=this._messageQueue.shift();this.onmessage?.($.message,$.extra)}}async close(){let $=this._otherTransport;this._otherTransport=void 0,await $?.close(),this.onclose?.()}async send($,Z){if(!this._otherTransport)throw Error("Not connected");if(this._otherTransport.onmessage)this._otherTransport.onmessage($,{authInfo:Z?.authInfo});else this._otherTransport._messageQueue.push({message:$,extra:{authInfo:Z?.authInfo}})}}import{z as w4}from"zod";var q30,EU8,jU8,zU8,PU8,AU8,TU8,RU8,IU8,qU8;var Sh=L(()=>{q30=w4.record(w4.string(),w4.array(w4.string())),EU8=w4.object({id:w4.string().describe("Unique identifier for the API key"),name:w4.string().describe("Human-readable name for the API key"),userId:w4.string().describe("ID of the user who owns this API key"),permissions:q30.describe('Permissions granted to this API key. Format: { resource: [actions] } where resource is "self" for management tools or "conn_<UUID>" for connection-specific tools. Example: { "self": ["API_KEY_CREATE"], "conn_abc123": ["SEND_MESSAGE"] }'),expiresAt:w4.string().datetime().nullable().optional().describe("Expiration date of the API key (ISO 8601)"),createdAt:w4.string().datetime().describe("When the API key was created (ISO 8601)")}),jU8=w4.object({name:w4.string().min(1).max(64).describe("Human-readable name for the API key"),permissions:q30.describe(`Permissions to grant (REQUIRED \u2014 there is no implicit default). Format: { resource: [actions] }. Resource is "self" for management tools or "conn_<UUID>" for connection-specific tools. Actions are tool names (e.g., ["ORGANIZATION_GET"]) or ["*"] for all. Example: { "self": ["ORGANIZATION_GET", "COLLECTION_CONNECTIONS_LIST"] }. The key is authorized solely by this allowlist; the creator's role does not widen it.`),expiresIn:w4.number().positive().optional().describe("Expiration time in seconds. If not provided, key never expires."),metadata:w4.record(w4.string(),w4.unknown()).optional().describe("Additional metadata to store with the API key")}),zU8=w4.object({id:w4.string().describe("Unique identifier for the API key"),name:w4.string().describe("Human-readable name for the API key"),key:w4.string().describe("The actual API key value. STORE THIS SECURELY - it will not be shown again!"),permissions:q30.describe('Permissions granted to this API key. Format: { resource: [actions] } where resource is "self" for management tools or "conn_<UUID>" for connection-specific tools'),expiresAt:w4.string().datetime().nullable().optional().describe("Expiration date of the API key (ISO 8601)"),createdAt:w4.string().datetime().describe("When the API key was created (ISO 8601)")}),PU8=w4.object({}),AU8=w4.object({items:w4.array(EU8).describe("List of API keys (without key values)")}),TU8=w4.object({keyId:w4.string().describe("ID of the API key to update"),name:w4.string().min(1).max(64).optional().describe("New name for the API key"),permissions:q30.optional().describe('New permissions. Format: { resource: [actions] } where resource is "self" for management tools or "conn_<UUID>" for connection-specific tools. Actions are tool names or "*" for all. Example: { "self": ["API_KEY_CREATE"] }. Replaces existing permissions.'),metadata:w4.record(w4.string(),w4.unknown()).optional().describe("New metadata. Replaces existing metadata.")}),RU8=w4.object({item:EU8.describe("The updated API key (without key value)")}),IU8=w4.object({keyId:w4.string().describe("ID of the API key to delete")}),qU8=w4.object({success:w4.boolean().describe("Whether the deletion was successful"),keyId:w4.string().describe("ID of the deleted API key")})});var k11;var MU8=L(()=>{l4();m0();Sh();k11=m({name:"API_KEY_CREATE",description:"Create an API key with scoped permissions. The key value is returned only once \u2014 store it immediately.",annotations:{title:"Create API Key",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!1,openWorldHint:!1},inputSchema:jU8,outputSchema:zU8,handler:async($,Z)=>{G0(Z),await Z.access.check();let X=await Z.boundAuth.apiKey.create({name:$.name,permissions:$.permissions,expiresIn:$.expiresIn,metadata:{...$.metadata,organization:Z.organization}}),Q=X.expiresAt?X.expiresAt instanceof Date?X.expiresAt.toISOString():X.expiresAt:null,Y=X.createdAt instanceof Date?X.createdAt.toISOString():X.createdAt,G=w1(Z);if(G)p1.capture({distinctId:G,event:"api_key_created",...Z.organization?.id?{groups:{organization:Z.organization.id}}:{},properties:{key_id:X.id,key_name:X.name??$.name,organization_id:Z.organization?.id,has_expiry:!!Q}});return{id:X.id,name:X.name??$.name,key:X.key,permissions:X.permissions??{},expiresAt:Q,createdAt:Y}}})});var S11;var VU8=L(()=>{l4();m0();Sh();S11=m({name:"API_KEY_DELETE",description:"Delete and instantly revoke an API key. Cannot be undone.",annotations:{title:"Delete API Key",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:IU8,outputSchema:qU8,handler:async($,Z)=>{G0(Z),await Z.access.check();let X=w1(Z);if(!X)throw Error("User ID required to delete API key");let Y=(await Z.boundAuth.apiKey.list())?.find((W)=>W.id===$.keyId);if(!Y)throw Error("API key not found");let J=Y.metadata?.organization?.id,K=Z.organization?.id;if(J!==K)throw Error("Cannot delete API key from another organization");if(await Z.boundAuth.apiKey.delete($.keyId),K)p1.capture({distinctId:X,event:"api_key_deleted",groups:{organization:K},properties:{key_id:$.keyId,organization_id:K}});return{success:!0,keyId:$.keyId}}})});var C11;var kU8=L(()=>{m0();Sh();C11=m({name:"API_KEY_LIST",description:"List API keys for the current user in the current organization. Returns metadata only \u2014 key values are never shown after creation.",annotations:{title:"List API Keys",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:PU8,outputSchema:AU8,handler:async($,Z)=>{G0(Z),await Z.access.check();let X=await Z.boundAuth.apiKey.list(),Q=Z.organization?.id;return{items:(X??[]).filter((G)=>{return G.metadata?.organization?.id===Q}).map((G)=>({id:G.id,name:G.name??"Unnamed Key",userId:G.userId,permissions:G.permissions??{},expiresAt:G.expiresAt?G.expiresAt instanceof Date?G.expiresAt.toISOString():G.expiresAt:null,createdAt:G.createdAt instanceof Date?G.createdAt.toISOString():G.createdAt}))}}})});var _11;var SU8=L(()=>{m0();Sh();_11=m({name:"API_KEY_UPDATE",description:"Update an API key's name, permissions, or metadata. The key value cannot be changed or retrieved.",annotations:{title:"Update API Key",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:TU8,outputSchema:RU8,handler:async($,Z)=>{if(G0(Z),await Z.access.check(),!w1(Z))throw Error("User ID required to update API key");let Y=(await Z.boundAuth.apiKey.list())?.find((H)=>H.id===$.keyId);if(!Y)throw Error(`API key not found: ${$.keyId}`);let J=Y.metadata?.organization?.id,K=Z.organization?.id;if(J!==K)throw Error("Cannot update API key from another organization");let W=await Z.boundAuth.apiKey.update({keyId:$.keyId,name:$.name,permissions:$.permissions,metadata:{...$.metadata,organization:Z.organization}});if(!W)throw Error(`Failed to update API key: ${$.keyId}`);return{item:{id:W.id,name:W.name??$.name??"Unnamed Key",userId:W.userId,permissions:W.permissions??{},expiresAt:W.expiresAt?W.expiresAt instanceof Date?W.expiresAt.toISOString():W.expiresAt:null,createdAt:W.createdAt instanceof Date?W.createdAt.toISOString():W.createdAt}}}})});var CU8=L(()=>{MU8();VU8();kU8();SU8();Sh()});function wL($){let Z=$.trim();if(!Z)return{ok:!1,error:"Enter a website URL."};let X=fz4.test(Z),Q=bz4.test(Z),Y=yz4.test(Z);if(X&&!Q&&!Y)return{ok:!1,error:"Use an HTTP or HTTPS website URL."};let G=Q?Z:`https://${Z}`,J;try{J=new URL(G)}catch{return{ok:!1,error:"Enter a valid website URL."}}if(J.protocol!=="http:"&&J.protocol!=="https:")return{ok:!1,error:"Use an HTTP or HTTPS website URL."};let K=J.hostname.split(".");if(K.length<2||K.some((W)=>!W||!gz4.test(W)))return{ok:!1,error:"Enter a valid website URL."};return J.protocol="https:",{ok:!0,value:J.origin}}var fz4,bz4,yz4,gz4;var bo=L(()=>{fz4=/^[a-zA-Z][a-zA-Z\d+.-]*:/,bz4=/^[a-zA-Z][a-zA-Z\d+.-]*:\/\//,yz4=/^[^\s/:?#]+\.[^\s/:?#]+:\d+(?:[/?#]|$)/,gz4=/^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/i});import{z as DQ}from"zod";function NH($){if($.baseUrl)return $.baseUrl.replace(/\/+$/,"");return(($.settings??o0()).reportsInternalApiUrl??hz4).replace(/\/+$/,"")}function vU8($={}){return`${NH($)}/api/v2/mcp`}function sj($){let Z=$.apiKey??($.settings??o0()).reportsInternalApiKey;if(!Z)throw Error("REPORTS_INTERNAL_API_KEY (or the legacy COMMERCE_DISCOVERY_INTERNAL_API_KEY) is required to set up reports.");return Z}function M30($){return new URL($).hostname}function cz4($){return $==="ownership_unverified"||$==="already_claimed_by_other_org"}function lz4($,Z={}){switch($){case"ownership_unverified":{let X=Z.email?`O e-mail ${Z.email}`:"Este e-mail",Q=Z.domain?` ${Z.domain}`:" este site";return`${X} n\xE3o tem permiss\xE3o para reivindicar${Q}. Use um e-mail do dom\xEDnio do site ou pe\xE7a ao suporte para autorizar seu dom\xEDnio.`}case"already_claimed_by_other_org":return"Este site j\xE1 pertence a outra organiza\xE7\xE3o. Fale com o suporte para transferir o acesso.";case"unknown":return"N\xE3o foi poss\xEDvel configurar o Commerce Discovery. Tente novamente ou fale com o suporte.";default:return $}}async function dz4($){let Z=await yo($);return cz4(Z?.error)?Z.error:"unknown"}async function yo($){let Z=await $.text().catch(()=>"");if(!Z)return;try{return JSON.parse(Z)}catch{return}}async function v11($){let Z=`Commerce Discovery auth failed with status ${$.status}.`,X=await $.text().catch(()=>"");if(!X)return Z;try{let Q=JSON.parse(X),Y=typeof Q.error==="string"?Q.error:typeof Q.message==="string"?Q.message:null;return Y?`Commerce Discovery auth failed: ${Y}.`:Z}catch{return Z}}async function fU8($,Z={}){let X=NH(Z),Q=sj(Z),Y=Z.fetchImpl??fetch,G=M30($.siteUrl),J=`${X}/api/v2/internal/diagnostics/${encodeURIComponent(G)}/upgrade`,K=await Y(J,{method:"POST",headers:{Authorization:`Bearer ${Q}`,"Content-Type":"application/json"},body:JSON.stringify({org_id:$.orgId,...$.orgName?{name:$.orgName}:{},...$.email?{email:$.email}:{},...$.reportUrl?{report_url:$.reportUrl}:{}})});if(!K.ok){let H=await dz4(K);throw new xU8(H,{email:$.email,domain:G})}let W=uz4.safeParse(await yo(K));if(!W.success)throw Error("Commerce Discovery auth response did not include a token.");return{authorizationToken:W.data.token}}async function bU8($,Z={}){let X=NH(Z),Q=sj(Z),Y=Z.fetchImpl??fetch,G=M30($.siteUrl),J=`${X}/api/v2/internal/diagnostics/${encodeURIComponent(G)}/bindings`,K=await Y(J,{method:"POST",headers:{Authorization:`Bearer ${Q}`,"Content-Type":"application/json"},body:JSON.stringify({org_id:$.orgId,provider:$.provider,resource_id:$.resourceId})});if(K.status===409)return{ok:!1,reason:"resource_already_bound",detail:"Este recurso j\xE1 est\xE1 vinculado a outra loja. Se ele \xE9 seu, fale com o suporte para revis\xE3o manual."};if(K.status===422){let H=_U8.safeParse(await yo(K));return{ok:!1,reason:H.success?H.data.reason??"verification_failed":"verification_failed",detail:(H.success?H.data.detail:void 0)??"N\xE3o foi poss\xEDvel verificar o acesso a este recurso."}}if(!K.ok)throw Error(await v11(K));let W=_U8.safeParse(await yo(K));if(!W.success||!W.data.binding)throw Error("Commerce Discovery bind response did not include a binding.");return{ok:!0,resourceId:W.data.binding.resource_id,evidence:W.data.binding.evidence}}async function yU8($,Z={}){let X=NH(Z),Q=sj(Z),Y=Z.fetchImpl??fetch,G=M30($.siteUrl),J=`${X}/api/v2/internal/diagnostics/${encodeURIComponent(G)}/run`,K=await Y(J,{method:"POST",headers:{Authorization:`Bearer ${Q}`,"Content-Type":"application/json"},body:JSON.stringify({org_id:$.orgId,...$.githubRepo?{github_repo:$.githubRepo}:{}})});if(K.status===409)return{triggered:!1,reason:"not_upgraded"};if(!K.ok)throw Error(await v11(K));return{triggered:!0}}async function gU8($,Z={}){let X=NH(Z),Q=sj(Z),Y=Z.fetchImpl??fetch,G=M30($.siteUrl),J=`${X}/api/v2/internal/diagnostics/${encodeURIComponent(G)}/connections/status?org_id=${encodeURIComponent($.orgId)}`,K=await Y(J,{method:"GET",headers:{Authorization:`Bearer ${Q}`}});if(K.status===404||K.status===409)return{providers:{},claimed:!1};if(!K.ok)throw Error(await v11(K));let W=mz4.safeParse(await yo(K));return{providers:W.success?W.data.providers:{},claimed:!0}}var hz4,uz4,_U8,xU8,mz4;var ej=L(()=>{S6();_8();hz4=new URL(IZ8).origin,uz4=DQ.object({token:DQ.string().min(1)}),_U8=DQ.object({binding:DQ.object({resource_id:DQ.string(),evidence:DQ.string()}).optional(),reason:DQ.string().optional(),detail:DQ.string().optional()});xU8=class xU8 extends Error{code;constructor($,Z={}){super(lz4($,Z));this.name="CommerceDiscoveryClaimError",this.code=$}};mz4=DQ.object({providers:DQ.record(DQ.string(),DQ.object({connected:DQ.boolean(),via:DQ.enum(["oauth","sa"]).nullable(),resource:DQ.string().nullable()}))})});import{z as EG}from"zod";var iz4,pz4,x11;var hU8=L(()=>{bo();m0();ej();iz4=EG.object({siteUrl:EG.string().min(1).describe("Website URL of the store being bound."),provider:EG.enum(["ga4","gsc"]).describe("Which Google source to bind: ga4 (Analytics) or gsc (Search Console)."),resourceId:EG.string().min(1).describe("The resource id the client typed: GA4 numeric property id, or GSC site (sc-domain:example.com or https://example.com/).")}),pz4=EG.discriminatedUnion("ok",[EG.object({ok:EG.literal(!0),resourceId:EG.string(),evidence:EG.string()}),EG.object({ok:EG.literal(!1),reason:EG.string(),detail:EG.string()})]),x11=m({name:"COMMERCE_DISCOVERY_BIND",description:"Bind a GA4 property or GSC site to the org's store via the shared service account (consent-free lane). The client grants deco-reader@\u2026 access to the resource and provides its id; Commerce Discovery verifies the resource belongs to this domain before persisting. Returns ok:false with an actionable pt-BR detail when verification fails or the resource is already bound elsewhere.",annotations:{title:"Bind Commerce Discovery Data Source",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!0},inputSchema:iz4,outputSchema:pz4,handler:async($,Z)=>{G0(Z);let X=X0(Z);await Z.access.check();let Q=wL($.siteUrl);if(!Q.ok)throw Error(Q.error);return bU8({siteUrl:Q.value,orgId:X.id,provider:$.provider,resourceId:$.resourceId.trim()})}})});import{z as BH}from"zod";var nz4,tz4,f11;var uU8=L(()=>{bo();m0();ej();nz4=BH.object({siteUrl:BH.string().min(1).describe("Website URL of the store to inspect.")}),tz4=BH.object({providers:BH.record(BH.string(),BH.object({connected:BH.boolean(),via:BH.enum(["oauth","sa"]).nullable(),resource:BH.string().nullable()})),claimed:BH.boolean().describe("False when the site isn't claimed/upgraded for this org \u2014 providers is then empty because the status is unreadable, NOT because nothing is connected. The UI must warn instead of rendering existing bindings as disconnected.")}),f11=m({name:"COMMERCE_DISCOVERY_CONNECTION_STATUS",description:"Read per-provider connection status (ga4/gsc/vtex) for the org's store \u2014 { connected, via: oauth|sa, resource }. The single source of truth for whether a data source is connected, unifying the OAuth (Studio vault) and shared-SA binding lanes. Read-only.",annotations:{title:"Commerce Discovery Connection Status",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!0},inputSchema:nz4,outputSchema:tz4,handler:async($,Z)=>{G0(Z);let X=X0(Z);await Z.access.check();let Q=wL($.siteUrl);if(!Q.ok)throw Error(Q.error);return gU8({siteUrl:Q.value,orgId:X.id})}})});import{z as go}from"zod";var oz4,rz4,b11;var cU8=L(()=>{S6();bo();m0();ej();oz4=go.object({siteUrl:go.string().min(1).describe("Website URL to run the diagnostic for.")}),rz4=go.object({triggered:go.boolean(),reason:go.string().optional()}),b11=m({name:"COMMERCE_DISCOVERY_RUN",description:"Trigger the Commerce Discovery diagnostic run for the current organization's store. Call once the data sources (GA4/GSC/VTEX) are connected \u2014 this run resolves credentials and produces the enriched report.",annotations:{title:"Run Commerce Discovery",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!0},inputSchema:oz4,outputSchema:rz4,handler:async($,Z)=>{G0(Z);let X=X0(Z);await Z.access.check();let Q=wL($.siteUrl);if(!Q.ok)throw Error(Q.error);let Y=r6.COMMERCE_DISCOVERY(X.id),J=(await Z.storage.connections.findById(Y,X.id))?.configuration_state,K=J&&typeof J==="object"&&typeof J.github_repo==="string"&&J.github_repo.length>0?J.github_repo:void 0;return yU8({siteUrl:Q.value,orgId:X.id,githubRepo:K})}})});var DL=L(()=>{_X0()});import{z as OH}from"zod";async function $P4($,Z,X,Q){let Y=await $.storage.connections.findById(Z,X);if(Y)return Y;throw Q}async function ZP4($,Z,X,Q){let Y=await $.storage.virtualMcps.findById(Z,X);if(Y)return Y;throw Q}var y11,az4=3600000,sz4,ez4,g11;var lU8=L(()=>{S6();bo();m0();pW();DL();ej();y11=aQ0,sz4=OH.object({siteUrl:OH.string().min(1).describe("Website URL to configure.")}),ez4=OH.object({connection:WX,virtualMcp:HX,reportApp:OH.object({connectionId:OH.string(),virtualMcpId:OH.string(),toolName:OH.literal(y11)}),created:OH.object({connection:OH.boolean(),virtualMcp:OH.boolean()})});g11=m({name:"COMMERCE_DISCOVERY_SETUP",description:"Create or return the Commerce Discovery connection and virtual MCP for the current organization.",annotations:{title:"Set Up Commerce Discovery",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:sz4,outputSchema:ez4,handler:async($,Z)=>{G0(Z);let X=X0(Z);await Z.access.check("COLLECTION_CONNECTIONS_CREATE");let Q=w1(Z);if(!Q)throw Error("User ID required to set up Commerce Discovery");let Y=wL($.siteUrl);if(!Y.ok)throw Error(Y.error);let G=r6.COMMERCE_DISCOVERY(X.id),J=eQ0(X.id),K=new URLSearchParams({virtualmcpid:J,main:`app:${G}:${y11}`}),W={email:Z.auth.user?.email,reportUrl:`${Z.baseUrl}/${encodeURIComponent(X.slug??X.id)}/${crypto.randomUUID()}?${K.toString()}`},H=await Z.storage.connections.findById(G,X.id),F={connection:!1,virtualMcp:!1},U=await fU8({siteUrl:Y.value,orgId:X.id,orgName:X.name,...W}),N=vU8();if(H)console.log("[commerce-discovery] syncing connection to claimed site",{orgId:X.id,siteUrl:Y.value,connectionId:G}),H=await Z.storage.connections.update(H.id,{connection_url:N,connection_token:U.authorizationToken,metadata:{...H.metadata??{},siteUrl:Y.value}});else{console.log("[commerce-discovery] creating connection",{orgId:X.id,siteUrl:Y.value,connectionId:G});try{let D=gZ8(X.id,U.authorizationToken,N);H=await Z.storage.connections.create({...D,metadata:{...D.metadata??{},siteUrl:Y.value},organization_id:X.id,created_by:Q}),F.connection=!0}catch(D){H=await $P4(Z,G,X.id,D)}}let B=await Z.storage.virtualMcps.findById(J,X.id);if(!B){console.log("[commerce-discovery] creating virtual MCP",{orgId:X.id,siteUrl:Y.value,connectionId:H.id,virtualMcpId:J});try{B=await Z.storage.virtualMcps.create(X.id,Q,hZ8(X.id,H.id),{id:J}),F.virtualMcp=!0}catch(D){B=await ZP4(Z,J,X.id,D)}}if(!B.pinned)B=await Z.storage.virtualMcps.update(B.id,Q,{pinned:!0});let O=await Z.db.selectFrom("organization").select(["createdAt"]).where("id","=",X.id).executeTakeFirst();if((O?Date.now()-new Date(O.createdAt).getTime():Number.POSITIVE_INFINITY)<az4){let E=(await Z.storage.organizationSettings.get(X.id))?.flags,j={};if(E?.reports_only==null)j.reports_only=!0;if(Object.keys(j).length>0)await Z.storage.organizationSettings.upsert(X.id,{flags:j})}return{connection:H,virtualMcp:B,reportApp:{connectionId:H.id,virtualMcpId:B.id,toolName:y11},created:F}}})});var dU8=L(()=>{hU8();uU8();cU8();lU8()});var h11=v((mU8)=>{Object.defineProperty(mU8,"__esModule",{value:!0});mU8.kvPrefix=mU8.KvWatchInclude=void 0;mU8.KvWatchInclude={LastValue:"",AllHistory:"history",UpdatesOnly:"updates"};mU8.kvPrefix="KV_"});var XN8=v(($N8)=>{Object.defineProperty($N8,"__esModule",{value:!0});$N8.KvStatusImpl=$N8.Bucket=$N8.Kvm=$N8.kvOperationHdr=void 0;$N8.Base64KeyCodec=YP4;$N8.NoopKvCodecs=u11;$N8.defaultBucketOpts=nU8;$N8.validateKey=tU8;$N8.validateSearchKey=oU8;$N8.hasWildcards=rU8;$N8.validateBucket=V30;var a5=WG(),L5=$X0(),r5=h11();function YP4(){let $=(Z,X)=>{let Q=[];for(let Y of Z.split("."))switch(Y){case">":case"*":Q.push(Y);break;default:Q.push(X(Y));break}return Q.join(".")};return{encode(Z){return $(Z,btoa)},decode(Z){return $(Z,atob)}}}function u11(){return{key:{encode($){return $},decode($){return $}},value:{encode($){return typeof $==="string"?new TextEncoder().encode($):$},decode($){return $}}}}function nU8(){return{replicas:1,history:1,timeout:2000,max_bytes:-1,maxValueSize:-1,codec:u11(),storage:L5.StorageType.File}}$N8.kvOperationHdr="KV-Operation";var pU8="$KV",GP4=/^[-/=.\w]+$/,JP4=/^[-/=.>*\w]+$/,KP4=/^[-\w]+$/;function tU8($){if($.startsWith(".")||$.endsWith(".")||!GP4.test($))throw Error(`invalid key: ${$}`)}function oU8($){if($.startsWith(".")||$.endsWith(".")||$.includes("..")||!JP4.test($))throw Error(`invalid key: ${$}`)}function rU8($){if($.startsWith(".")||$.endsWith("."))throw Error(`invalid key: ${$}`);let Z=$.split("."),X=!1;for(let Q=0;Q<Z.length;Q++)switch(Z[Q]){case"*":X=!0;break;case">":if(Q!==Z.length-1)throw Error(`invalid key: ${$}`);X=!0;break;default:}return X}function V30($){if(!KP4.test($))throw Error(`invalid bucket name: ${$}`)}class aU8{js;constructor($){this.js=(0,L5.toJetStreamClient)($)}create($,Z={}){return this.#$($,Z)}open($,Z={}){return Z.bindOnly=!0,this.#$($,Z)}#$($,Z={}){let{ok:X,min:Q}=this.js.nc.features.get(a5.Feature.JS_KV);if(!X)return Promise.reject(Error(`kv is only supported on servers ${Q} or better`));if(Z.bindOnly)return Ch.bind(this.js,$,Z);return Ch.create(this.js,$,Z)}list(){let $=(X)=>{let Y=X.streams.filter((J)=>{return J.config.name.startsWith(r5.kvPrefix)});Y.forEach((J)=>{J.config.sealed=J.config.sealed||!1,J.config.deny_delete=J.config.deny_delete||!1,J.config.deny_purge=J.config.deny_purge||!1,J.config.allow_rollup_hdrs=J.config.allow_rollup_hdrs||!1});let G="";if(Y.length)G=this.js.nc.info?.cluster??"";return Y.map((J)=>{return new k30(J,G)})},Z=`${this.js.prefix}.STREAM.LIST`;return new L5.ListerImpl(Z,$,this.js)}}$N8.Kvm=aU8;class Ch{js;jsm;stream;bucket;direct;codec;prefix;editPrefix;useJsPrefix;_prefixLen;constructor($,Z,X){V30($),this.js=Z,this.jsm=X,this.bucket=$,this.prefix=pU8,this.editPrefix="",this.useJsPrefix=!1,this._prefixLen=0}static async create($,Z,X={}){V30(Z);let Q=await $.jetstreamManager(),Y=new Ch(Z,$,Q);return await Y.init(X),Y}static async bind($,Z,X={}){let Q=$.getOptions()?.checkAPI||X.bindOnly===!1,Y=await $.jetstreamManager(Q),G={config:{allow_direct:X.allow_direct}};V30(Z);let J=new Ch(Z,$,Y);return G.config.name=X.streamName??J.bucketName(),Object.assign(J,G),J.stream=G.config.name,J.codec=X.codec||u11(),J.direct=G.config.allow_direct??!1,J.initializePrefixes(G),J}async init($={}){let Z=Object.assign(nU8(),$);this.codec=Z.codec;let X={};if(this.stream=X.name=$.streamName??this.bucketName(),X.retention=L5.RetentionPolicy.Limits,X.max_msgs_per_subject=Z.history,Z.max_bytes)X.max_bytes=Z.max_bytes;if(X.max_msg_size=Z.maxValueSize,X.storage=Z.storage,$.placement)X.placement=$.placement;if($.republish)X.republish=$.republish;if($.description)X.description=$.description;if($.markerTTL)X.allow_msg_ttl=!0,X.subject_delete_marker_ttl=(0,a5.nanos)(Z.markerTTL);if($.mirror){let H=Object.assign({},$.mirror);if(!H.name.startsWith(r5.kvPrefix))H.name=`${r5.kvPrefix}${H.name}`;X.mirror=H,X.mirror_direct=!0}else if($.sources){let H=$.sources.map((F)=>{let U=Object.assign({},F),N=U.name.startsWith(r5.kvPrefix)?U.name.substring(r5.kvPrefix.length):U.name;if(!U.name.startsWith(r5.kvPrefix))U.name=`${r5.kvPrefix}${U.name}`;if(!F.external&&N!==this.bucket)U.subject_transforms=[{src:`$KV.${N}.>`,dest:`$KV.${this.bucket}.>`}];return U});X.sources=H,X.subjects=[this.subjectForBucket()]}else X.subjects=[this.subjectForBucket()];if($.metadata)X.metadata=$.metadata;if(typeof $.compression==="boolean")X.compression=$.compression?L5.StoreCompression.S2:L5.StoreCompression.None;let Q=this.js.nc,Y=Q.getServerVersion(),G=Y?(0,a5.compare)(Y,(0,a5.parseSemVer)("2.7.2"))>=0:!1;X.discard=G?L5.DiscardPolicy.New:L5.DiscardPolicy.Old;let{ok:J,min:K}=Q.features.get(a5.Feature.JS_ALLOW_DIRECT);if(!J&&$.allow_direct===!0){let H=Y?`${Y.major}.${Y.minor}.${Y.micro}`:"unknown";return Promise.reject(Error(`allow_direct is not available on server version ${H} - requires ${K}`))}if($.allow_direct=typeof $.allow_direct==="boolean"?$.allow_direct:J,X.allow_direct=$.allow_direct,this.direct=X.allow_direct,X.num_replicas=Z.replicas,Z.ttl)X.max_age=(0,a5.nanos)(Z.ttl);X.allow_rollup_hdrs=!0;let W;try{if(W=await this.jsm.streams.info(X.name),!W.config.allow_direct&&this.direct===!0)this.direct=!1}catch(H){if(H.message==="stream not found")W=await this.jsm.streams.add(X);else throw H}this.initializePrefixes(W)}initializePrefixes($){this._prefixLen=0,this.prefix=`$KV.${this.bucket}`,this.useJsPrefix=this.js.apiPrefix!=="$JS.API";let{mirror:Z}=$.config;if(Z){let X=Z.name;if(X.startsWith(r5.kvPrefix))X=X.substring(r5.kvPrefix.length);if(Z.external&&Z.external.api!==""){let Q=Z.name.substring(r5.kvPrefix.length);this.useJsPrefix=!1,this.prefix=`$KV.${Q}`,this.editPrefix=`${Z.external.api}.$KV.${X}`}else this.editPrefix=this.prefix}}bucketName(){return this.stream??`${r5.kvPrefix}${this.bucket}`}subjectForBucket(){return`${this.prefix}.${this.bucket}.>`}subjectForKey($,Z=!1){let X=[];if(Z){if(this.useJsPrefix)X.push(this.js.apiPrefix);if(this.editPrefix!=="")X.push(this.editPrefix);else X.push(this.prefix)}else if(this.prefix)X.push(this.prefix);return X.push($),X.join(".")}fullKeyName($){if(this.prefix!=="")return`${this.prefix}.${$}`;return`${pU8}.${this.bucket}.${$}`}get prefixLen(){if(this._prefixLen===0)this._prefixLen=this.prefix.length+1;return this._prefixLen}encodeKey($){let Z=[];for(let X of $.split("."))switch(X){case">":case"*":Z.push(X);break;default:Z.push(this.codec.key.encode(X));break}return Z.join(".")}decodeKey($){let Z=[];for(let X of $.split("."))switch(X){case">":case"*":Z.push(X);break;default:Z.push(this.codec.key.decode(X));break}return Z.join(".")}validateKey=tU8;validateSearchKey=oU8;hasWildcards=rU8;close(){return Promise.resolve()}dataLen($,Z){let X=Z?Z.get(L5.JsHeaders.MessageSizeHdr)||"":"";if(X!=="")return parseInt(X,10);return $.length}smToEntry($){return new sU8(this.bucket,this.prefixLen,$,this.codec)}jmToWatchEntry($,Z){return new eU8(this.bucket,this.prefixLen,$,Z,this.codec)}async create($,Z,X){let Q;try{let G={previousSeq:0},J=await this._put($,Z,G,X);return Promise.resolve(J)}catch(G){if(Q=G,G instanceof L5.JetStreamApiError){let J=G;if(J.code!==L5.JetStreamApiCodes.StreamWrongLastSequence&&J.code!==L5.JetStreamApiCodes.StreamWrongLastSequenceUnknown)return Promise.reject(G)}}let Y=0;try{let G=await this.get($);if(G?.operation==="DEL"||G?.operation==="PURGE")return Y=G!==null?G.revision:0,this._put($,Z,{previousSeq:Y},X);else return Promise.reject(Q)}catch(G){return Promise.reject(G)}}update($,Z,X,Q){if(X<=0)throw Error("version must be greater than 0");return this.put($,Z,{previousSeq:X,timeout:Q})}async _put($,Z,X={},Q){let Y=this.encodeKey($);this.validateKey(Y),Z=this.codec.value.encode(Z);let G={timeout:X?.timeout};if(X.previousSeq!==void 0){let J=(0,a5.headers)();G.headers=J,J.set(L5.PubHeaders.ExpectedLastSubjectSequenceHdr,`${X.previousSeq}`)}if(Q)(G.headers||(0,a5.headers)()).set(L5.PubHeaders.MessageTTL,Q);try{return(await this.js.publish(this.subjectForKey(Y,!0),Z,G)).seq}catch(J){return Promise.reject(J)}}put($,Z,X={}){return this._put($,Z,X)}async get($,Z){let X=this.encodeKey($);this.validateKey(X);let Q={last_by_subj:this.subjectForKey(X)};if(Z&&Z.revision>0)Q={seq:Z.revision};let Y=null;try{if(this.direct)Y=await this.jsm.direct.getMessage(this.bucketName(),Q);else Y=await this.jsm.streams.getMessage(this.bucketName(),Q);if(Y===null)return null;let G=this.smToEntry(Y);if(G.rawKey!==X)return null;return G}catch(G){throw G}}purge($,Z){return this._deleteOrPurge($,"PURGE",Z)}delete($,Z){return this._deleteOrPurge($,"DEL",Z)}async purgeDeletes($=1800000){let Z=[],X=await this.history({key:">"});await(async()=>{for await(let J of X)if(J.operation==="DEL"||J.operation==="PURGE")Z.push(J)})().then(),X.stop();let Q=Date.now()-$,Y=Z.map((J)=>{let K=this.subjectForKey(J.key);if(J.created.getTime()>=Q)return this.jsm.streams.purge(this.stream,{filter:K,keep:1});else return this.jsm.streams.purge(this.stream,{filter:K,keep:0})}),G=await Promise.all(Y);return G.unshift({success:!0,purged:0}),G.reduce((J,K)=>{return J.purged+=K.purged,J})}async _deleteOrPurge($,Z,X){if(!this.hasWildcards($))return this._doDeleteOrPurge($,Z,X);let Q=await this.keys($),Y=[];for await(let G of Q)if(Y.push(this._doDeleteOrPurge(G,Z)),Y.length===100)await Promise.all(Y),Y.length=0;if(Y.length>0)await Promise.all(Y)}async _doDeleteOrPurge($,Z,X){let Q=this.encodeKey($);this.validateKey(Q);let Y=(0,a5.headers)();if(Y.set($N8.kvOperationHdr,Z),Z==="PURGE"){let G=X;if(Y.set(L5.JsHeaders.RollupHdr,L5.JsHeaders.RollupValueSubject),typeof G?.ttl==="string"&&G.ttl!=="")Y.set(L5.PubHeaders.MessageTTL,`${G.ttl}`)}if(X?.previousSeq)Y.set(L5.PubHeaders.ExpectedLastSubjectSequenceHdr,`${X.previousSeq}`);await this.js.publish(this.subjectForKey(Q,!0),a5.Empty,{headers:Y})}_buildCC($,Z,X={}){let Y=(!Array.isArray($)?[$]:$).map((K)=>{let W=this.encodeKey(K);return this.validateSearchKey(K),this.fullKeyName(W)}),G=L5.DeliverPolicy.LastPerSubject;if(Z===r5.KvWatchInclude.AllHistory)G=L5.DeliverPolicy.All;if(Z===r5.KvWatchInclude.UpdatesOnly)G=L5.DeliverPolicy.New;let J=void 0;if(Y.length===1)J=Y[0],Y=void 0;return Object.assign({deliver_policy:G,ack_policy:L5.AckPolicy.None,filter_subjects:Y,filter_subject:J,flow_control:!0,idle_heartbeat:(0,a5.nanos)(5000)},X)}remove($){return this.purge($)}async history($={}){let Z=$.key??">",X={};X.headers_only=$.headers_only||!1;let Q=new a5.QueuedIteratorImpl,Y=()=>{Q.stop()},G=this._buildCC(Z,r5.KvWatchInclude.AllHistory,X),J=await this.js.consumers.getPushConsumer(this.stream,G);if(Q._data=J,(await J.info(!0)).num_pending===0)return Q.push(Y),Q;let W=await J.consume({callback:(H)=>{let F=this.jmToWatchEntry(H,!1);if(Q.push(F),Q.received++,H.info.pending===0)Q.push(Y)}});return W.closed().then(()=>{Q.push(Y)}),(async()=>{for await(let H of W.status())switch(H.type){case"heartbeat":Q.push(()=>{Q.stop()});break}})().then(),Q.iterClosed.then(()=>{W.stop()}),Q}canSetWatcherName(){let $=this.js.nc,{ok:Z}=$.features.get(a5.Feature.JS_NEW_CONSUMER_CREATE_API);return Z}async watch($={}){let Z=$.key??">",X=new a5.QueuedIteratorImpl,Q={};Q.headers_only=$.headers_only||!1;let Y=r5.KvWatchInclude.LastValue;if($.include===r5.KvWatchInclude.AllHistory)Y=r5.KvWatchInclude.AllHistory;else if($.include===r5.KvWatchInclude.UpdatesOnly)Y=r5.KvWatchInclude.UpdatesOnly;let G=$.ignoreDeletes===!0,J=this._buildCC(Z,Y,Q);if(J.name=`KV_WATCHER_${a5.nuid.next()}`,$.resumeFromRevision&&$.resumeFromRevision>0)J.deliver_policy=L5.DeliverPolicy.StartSequence,J.opt_start_seq=$.resumeFromRevision;let K=await this.js.consumers.getPushConsumer(this.stream,J),H=(await K.info(!0)).num_pending,F=Y===r5.KvWatchInclude.UpdatesOnly||H===0;X._data=K;let U=0,N=await K.consume({callback:(B)=>{if(!F)U++,F=U>=H;let O=this.jmToWatchEntry(B,F);if(G&&O.operation==="DEL")return;X.push(O),X.received++}});return X.iterClosed.then(()=>{N.stop()}),N.closed().then(()=>{X.push(()=>{X.stop()})}),X}async keys($=">"){let Z=new a5.QueuedIteratorImpl,X=this._buildCC($,r5.KvWatchInclude.LastValue,{headers_only:!0}),Q=await this.js.consumers.getPushConsumer(this.stream,X);if((await Q.info()).num_pending===0)return Z.stop(),Z;Z._data=Q;let G=await Q.consume({callback:(J)=>{let K=J.headers?.get($N8.kvOperationHdr);if(K!=="DEL"&&K!=="PURGE"){let W=this.decodeKey(J.subject.substring(this.prefixLen));Z.push(W)}if(J.info.pending===0)G.stop()}});return(async()=>{for await(let J of G.status())switch(J.type){case"heartbeat":Z.push(()=>{Z.stop()});break}})().then(),G.closed().then(()=>{Z.push(()=>{Z.stop()})}),Z.iterClosed.then(()=>{G.stop()}),Z}purgeBucket($){return this.jsm.streams.purge(this.bucketName(),$)}destroy(){return this.jsm.streams.delete(this.bucketName())}async status(){let Z=this.js.nc.info?.cluster??"",X=this.bucketName(),Q=await this.jsm.streams.info(X);return new k30(Q,Z)}}$N8.Bucket=Ch;class k30{si;cluster;constructor($,Z=""){this.si=$,this.cluster=Z}get bucket(){return this.si.config.name.startsWith(r5.kvPrefix)?this.si.config.name.substring(r5.kvPrefix.length):this.si.config.name}get values(){return this.si.state.messages}get history(){return this.si.config.max_msgs_per_subject}get ttl(){return(0,a5.millis)(this.si.config.max_age)}get markerTTL(){if(typeof this.si.config.subject_delete_marker_ttl==="number")return(0,a5.millis)(this.si.config.subject_delete_marker_ttl);return 0}get bucket_location(){return this.cluster}get backingStore(){return this.si.config.storage}get storage(){return this.si.config.storage}get replicas(){return this.si.config.num_replicas}get description(){return this.si.config.description??""}get maxBucketSize(){return this.si.config.max_bytes}get maxValueSize(){return this.si.config.max_msg_size}get max_bytes(){return this.si.config.max_bytes}get placement(){return this.si.config.placement||{cluster:"",tags:[]}}get placementCluster(){return this.si.config.placement?.cluster??""}get republish(){return this.si.config.republish??{src:"",dest:""}}get streamInfo(){return this.si}get size(){return this.si.state.bytes}get metadata(){return this.si.config.metadata??{}}get compression(){if(this.si.config.compression)return this.si.config.compression!==L5.StoreCompression.None;return!1}}$N8.KvStatusImpl=k30;class sU8{bucket;sm;prefixLen;codec;constructor($,Z,X,Q){this.bucket=$,this.prefixLen=Z,this.sm=X,this.codec=Q}get rawKey(){return this.sm.subject.substring(this.prefixLen)}get key(){return this.codec.key.decode(this.rawKey)}get value(){return this.codec.value.decode(this.sm.data)}get delta(){return 0}get created(){return this.sm.time}get revision(){return this.sm.seq}get operation(){if(this.sm.header?.has("Nats-Marker-Reason")){if(this.sm.header?.get("Nats-Marker-Reason")==="MaxAge")return"PURGE"}return this.sm.header?.get($N8.kvOperationHdr)||"PUT"}get length(){let $=this.sm.header.get(L5.JsHeaders.MessageSizeHdr)||"";if($!=="")return parseInt($,10);return this.sm.data.length}json($){return JSON.parse(a5.TD.decode(this.value),$)}string(){return a5.TD.decode(this.value)}}class eU8{bucket;sm;prefixLen;update;codec;constructor($,Z,X,Q,Y){this.bucket=$,this.prefixLen=Z,this.sm=X,this.update=Q,this.codec=Y}get rawKey(){return this.sm.subject.substring(this.prefixLen)}get key(){return this.codec.key.decode(this.rawKey)}get value(){return this.codec.value.decode(this.sm.data)}get created(){return new Date((0,a5.millis)(this.sm.info.timestampNanos))}get revision(){return this.sm.seq}get operation(){if(this.sm.headers?.has("Nats-Marker-Reason")){if(this.sm.headers?.get("Nats-Marker-Reason")==="MaxAge")return"PURGE"}return this.sm.headers?.get($N8.kvOperationHdr)||"PUT"}get delta(){return this.sm.info.pending}get length(){let $=this.sm.headers?.get(L5.JsHeaders.MessageSizeHdr)||"";if($!=="")return parseInt($,10);return this.sm.data.length}get isUpdate(){return this.update}json($){return JSON.parse(a5.TD.decode(this.value),$)}string(){return a5.TD.decode(this.value)}}});var c11=v((EK)=>{Object.defineProperty(EK,"__esModule",{value:!0});EK.validateKey=EK.validateBucket=EK.NoopKvCodecs=EK.Kvm=EK.defaultBucketOpts=EK.Bucket=EK.Base64KeyCodec=EK.KvWatchInclude=EK.kvPrefix=void 0;var QN8=h11();Object.defineProperty(EK,"kvPrefix",{enumerable:!0,get:function(){return QN8.kvPrefix}});Object.defineProperty(EK,"KvWatchInclude",{enumerable:!0,get:function(){return QN8.KvWatchInclude}});var $z=XN8();Object.defineProperty(EK,"Base64KeyCodec",{enumerable:!0,get:function(){return $z.Base64KeyCodec}});Object.defineProperty(EK,"Bucket",{enumerable:!0,get:function(){return $z.Bucket}});Object.defineProperty(EK,"defaultBucketOpts",{enumerable:!0,get:function(){return $z.defaultBucketOpts}});Object.defineProperty(EK,"Kvm",{enumerable:!0,get:function(){return $z.Kvm}});Object.defineProperty(EK,"NoopKvCodecs",{enumerable:!0,get:function(){return $z.NoopKvCodecs}});Object.defineProperty(EK,"validateBucket",{enumerable:!0,get:function(){return $z.validateBucket}});Object.defineProperty(EK,"validateKey",{enumerable:!0,get:function(){return $z.validateKey}})});var l11=v((EL)=>{Object.defineProperty(EL,"__esModule",{value:!0});EL.NoopKvCodecs=EL.Kvm=EL.defaultBucketOpts=EL.Bucket=EL.Base64KeyCodec=EL.KvWatchInclude=void 0;var EP4=c11();Object.defineProperty(EL,"KvWatchInclude",{enumerable:!0,get:function(){return EP4.KvWatchInclude}});var uo=c11();Object.defineProperty(EL,"Base64KeyCodec",{enumerable:!0,get:function(){return uo.Base64KeyCodec}});Object.defineProperty(EL,"Bucket",{enumerable:!0,get:function(){return uo.Bucket}});Object.defineProperty(EL,"defaultBucketOpts",{enumerable:!0,get:function(){return uo.defaultBucketOpts}});Object.defineProperty(EL,"Kvm",{enumerable:!0,get:function(){return uo.Kvm}});Object.defineProperty(EL,"NoopKvCodecs",{enumerable:!0,get:function(){return uo.NoopKvCodecs}})});function S30(){let $=new TextEncoder,Z=new TextDecoder;return{encode:(X)=>$.encode(JSON.stringify(X)),decode:(X)=>JSON.parse(Z.decode(X))}}class m11{options;kv=null;codec=S30();constructor($){this.options=$}async init(){let $=this.options.getJetStream();if(!$)return;this.kv=await new GN8.Kvm($).create(zP4,{storage:YN8.StorageType.Memory})}async get($,Z){if(!this.kv)return null;try{let X=await this.kv.get(`${$}.${Z}`);if(!X?.value?.length)return null;if(X.operation==="DEL"||X.operation==="PURGE")return null;return this.codec.decode(X.value)}catch{return null}}async set($,Z,X){if(!this.kv)return;try{await this.kv.put(`${$}.${Z}`,this.codec.encode(X))}catch{}}async invalidate($){if(!this.kv)return;await Promise.all(["tools","resources","prompts"].map(async(X)=>{try{await this.kv.delete(`${X}.${$}`)}catch{}}))}teardown(){this.kv=null}}function PP4($,Z,X){if(X<=0)return!0;if($===void 0)return!0;return Z-$>=X}function C30($){return $ instanceof C1&&$.code===g1.MethodNotFound}function AP4($){return $ instanceof C1&&$.code===-32000&&/connection closed/i.test($.message)}async function zL($,Z,X,Q,Y,G=0){if(!Q)try{return await X()}catch(H){if(C30(H))return[];return co.add(1,{type:$,outcome:"error",stage:"no_cache"}),null}let J=`${$}:${Z}`,K=await Q.get($,Z);if(K===null)try{let H=await X();return Q.set($,Z,H).catch(()=>{}),d11.set(J,Date.now()),co.add(1,{type:$,outcome:"miss",stage:"miss"}),H}catch(H){if(C30(H))return Q.set($,Z,[]).catch(()=>{}),[];return co.add(1,{type:$,outcome:"error",stage:"miss"}),null}if(co.add(1,{type:$,outcome:"hit",stage:"hit"}),PP4(d11.get(J),Date.now(),G)&&!_30.has(J)){_30.add(J),d11.set(J,Date.now());let H=X().then((F)=>Q.set($,Z,F)).catch((F)=>{if(C30(F)||AP4(F)){if(C30(F))Q.set($,Z,[]).catch(()=>{});return}co.add(1,{type:$,outcome:"error",stage:"revalidation"})}).finally(()=>_30.delete(J));Y?.(H)}return K}function i11($){JN8=$}function z9(){return JN8}var YN8,GN8,co,zP4="DECOCMS_MCP_LISTS",_30,d11,jL=30000,JN8=null;var jG=L(()=>{E9();u$();YN8=k(iE(),1),GN8=k(l11(),1),co=R8.createCounter("mcp_list_cache.fetches",{description:"MCP list cache fetch outcomes (hit, miss, error)",unit:"{fetches}"});_30=new Set;R8.createObservableGauge("mcp_list_cache.pending_revalidations",{description:"In-flight background MCP list revalidations on this pod",unit:"{revalidations}"}).addCallback(($)=>$.observe(_30.size));d11=new Map});async function p11($,Z,X){let Q=new AbortController,Y,G=new Promise((K,W)=>{Y=setTimeout(()=>{Q.abort(),W(new KN8($.id,X))},X)}),J=(async()=>{let K=await q5($,Z,!0);try{return(await K.listTools(void 0,{timeout:X,signal:Q.signal})).tools}finally{await K.close().catch(()=>{})}})();J.catch(()=>{});try{return await Promise.race([J,G])}finally{if(Y)clearTimeout(Y)}}var KN8;var WN8=L(()=>{lo();KN8=class KN8 extends Error{constructor($,Z){super(`listTools timed out after ${Z}ms for connection ${$}`);this.name="ListToolsTimeoutError"}}});function v30($){return(Z)=>{if(Z instanceof C1&&Z.code===g1.MethodNotFound)return $;throw Z}}var HN8=L(()=>{E9()});function x30($,Z,X){let Q=PL($,Z,X,z9()??void 0),Y=Gj(Q,{name:"studio-mcp-server",version:"1.0.0"},{capabilities:TP4,toolCallTimeoutMs:Hg});Y.server.setRequestHandler(NO,async()=>{return await Q.listResources().catch(v30({resources:[]}))}),Y.server.setRequestHandler(BO,async()=>{return await Q.listResourceTemplates().catch(v30({resourceTemplates:[]}))}),Y.server.setRequestHandler(OO,async()=>{return await Q.listPrompts().catch(v30({prompts:[]}))});let G=Y.close.bind(Y);return Y.close=async()=>{await G(),await Q.close().catch(()=>{})},Y}var TP4;var FN8=L(()=>{FQ();E9();mo();jG();HN8();TP4={tools:{},resources:{},prompts:{}}});var xU=L(()=>{lo();WN8();FN8()});function io($,Z,X){if(Z.some((Q)=>Q!=="*"&&Q.startsWith("SELF::"))&&$.SELF===void 0)$.SELF={value:`${X}_self`}}function po($,Z){let X=new Map;for(let Q of Z){if(Q==="*")continue;let[Y,G]=qG0(Q);if(!RP4.has(G))continue;let J=$o(Y,$);if(typeof J!=="object"||J===null||!("value"in J))continue;let K=J.value;if(typeof K!=="string")continue;X.set(`${K}:${G}`,{targetConnectionId:K,scope:G})}return[...X.values()]}async function no($,Z,X,Q){for(let J of Z){if(J==="*")continue;let[K]=qG0(J),W=$o(K,$);if(W===void 0||W===null)throw Error(`Scope references key "${K}" but it's not present in state`)}let Y=z38($,Z),G=`${X}_self`;for(let J of Y){if(J===G)continue;let K=await Q.storage.connections.findById(J);if(!K||K.organization_id!==X)throw Error(`Referenced connection not found: ${J}`);try{await Q.access.check(J)}catch(W){throw Error(`Access denied to referenced connection: ${J}. ${W.message}`)}}}var RP4;var n11=L(()=>{te0();KY0();RP4=new Set([GY0,JY0])});import{z as UN8}from"zod";var IP4,qP4,t11;var NN8=L(()=>{l4();m0();_8();jG();xU();n11();xo();pW();IP4=UN8.object({data:RX0.describe("Data for the new connection (id is auto-generated if not provided)")}),qP4=UN8.object({item:WX.describe("The created connection entity")}),t11=m({name:"COLLECTION_CONNECTIONS_CREATE",description:"Create a new MCP connection. Auto-fetches and caches the server's tool list.",annotations:{title:"Create Connection",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!1,openWorldHint:!1},inputSchema:IP4,outputSchema:qP4,handler:async($,Z)=>{G0(Z);let X=X0(Z);await Z.access.check();let Q=w1(Z);if(!Q)throw Error("User ID required to create connection");let Y={...$.data,organization_id:X.id,created_by:Q};if(Y.id){if((await Z.storage.connections.findById(Y.id))?.organization_id===X.id)throw Error("Connection already exists in organization")}if(Y.connection_type==="VIRTUAL"){let U=ky(Y.connection_url);if(!U)throw Error("VIRTUAL connection requires connection_url in format: virtual://$virtual_mcp_id");let N=await Z.storage.virtualMcps.findById(U);if(!N)throw Error(`Virtual MCP not found: ${U}`);if(N.organization_id!==X.id)throw Error("Virtual MCP does not belong to the current organization");Y.connection_url=Sy(U)}if(Y.connection_type==="STDIO"&&!o0().localMode)throw Error("STDIO connections are only available in local mode (--local-mode).");let G=await LL({id:`pending-${Date.now()}`,title:Y.title,connection_type:Y.connection_type,connection_url:Y.connection_url,connection_token:Y.connection_token,connection_headers:Y.connection_headers}).catch(()=>null),J=G?.tools?.length?G.tools:null,K=G?.scopes?.length?G.scopes:Y.configuration_scopes??null,W=Y.configuration_state??null;if(W&&K?.length)io(W,K,X.id),await no(W,K,X.id,Z);let H=await Z.storage.connections.createNew({...Y,tools:null,configuration_state:W,configuration_scopes:K}),F=W&&K?.length?po(W,K):[];if(F.length>0){let U;try{await Z.storage.connectionCredentialVault.replaceGrantsForSubject({organizationId:X.id,subjectConnectionId:H.id,createdBy:Q,grants:F});let{plaintextToken:N,record:B}=await Z.storage.connectionCredentialVault.createOrRotateWorkloadToken({organizationId:X.id,subjectConnectionId:H.id});U=B.id,await(await q5(H,Z,!1)).callTool({name:"ON_MCP_CONFIGURATION",arguments:{state:W,scopes:K,firstRun:!0,vault:{baseUrl:Z.baseUrl,org:X.slug??X.id,subjectConnectionId:H.id,token:N}}})}catch(N){if(U)await Z.storage.connectionCredentialVault.revokeWorkloadToken({organizationId:X.id,subjectConnectionId:H.id,tokenId:U});throw await Z.storage.connections.delete(H.id),N}}if(J)z9()?.set("tools",H.id,J).catch(()=>{});return p1.capture({distinctId:Q,event:"connection_created",groups:{organization:X.id},properties:{connection_id:H.id,connection_type:H.connection_type,app_name:H.app_name??null,organization_id:X.id,tools_count:J?.length??0}}),{item:H}}})});import{z as _3}from"zod/v4";import{z as BN8}from"zod/v4";import{z as f30}from"zod/v4";import{z as LH}from"zod/v4";import{z as SP4}from"zod/v4";import{z as Zz}from"zod/v4";import{z as wH}from"zod/v4";import{z as eZ}from"zod/v4";import{z as ON8}from"zod/v4";import{z as g30}from"zod/v4";import{z as eP4}from"zod/v4";import{z as LN8}from"zod/v4";import{z as b30}from"zod/v4";import{z as WA4}from"zod/v4";function to($,Z){if($===Z)return!0;if($==null||Z==null)return $===Z;if(typeof $!==typeof Z)return!1;if(Array.isArray($)&&Array.isArray(Z)){if($.length!==Z.length)return!1;return $.every((X,Q)=>to(X,Z[Q]))}if(typeof $==="object"&&typeof Z==="object"){let X=Object.keys($),Q=Object.keys(Z);if(X.length!==Q.length)return!1;return X.every((Y)=>Q.includes(Y)&&to($[Y],Z[Y]))}return!1}function rP4(){return($)=>{if(!Array.isArray($))return!0;let Z=[];return $.every((X)=>{if(Z.some((Y)=>to(X,Y)))return!1;return Z.push(X),!0})}}function y30($,Z){return $.safeParse(Z).success}function C7($){if(typeof $==="boolean")return $?_3.any():_3.never();let Z={};for(let Y of NA4)Y.apply(Z,$);let X=[];if(Z.string!==!1)X.push(Z.string||_3.string());if(Z.number!==!1)X.push(Z.number||_3.number());if(Z.boolean!==!1)X.push(Z.boolean||_3.boolean());if(Z.null!==!1)X.push(Z.null||_3.null());if(Z.array!==!1)X.push(Z.array||_3.array(_3.any()));if(Z.tuple!==!1&&Z.tuple!==void 0)X.push(Z.tuple);if(Z.object!==!1)if(Z.object)X.push(Z.object);else{let Y=_3.custom((G)=>{return typeof G==="object"&&G!==null&&!Array.isArray(G)},"Must be an object, not an array");X.push(Y)}if(Z.file!==!1&&Z.file!==void 0)X.push(Z.file);let Q;if(X.length===0)Q=_3.never();else if(X.length===1)Q=X[0];else if(!Object.keys($).some((G)=>G!=="$schema"&&G!=="title"&&G!=="description"))Q=_3.any();else Q=_3.union(X);for(let Y of BA4)Q=Y.apply(Q,$);return Q}var MP4=class{apply($,Z){if(!Z.type)return;let X=Array.isArray(Z.type)?Z.type:[Z.type],Q=new Set(X);if(!Q.has("string"))$.string=!1;if(!Q.has("number")&&!Q.has("integer"))$.number=!1;if(!Q.has("boolean"))$.boolean=!1;if(!Q.has("null"))$.null=!1;if(!Q.has("array"))$.array=!1;if(!Q.has("object"))$.object=!1;if(Q.has("integer")&&$.number!==!1){let Y=$.number||BN8.number();if(Y instanceof BN8.ZodNumber)$.number=Y.int()}}},VP4=class{apply($,Z){if(Z.const===void 0)return;let X=Z.const;if($.string=!1,$.number=!1,$.boolean=!1,$.null=!1,$.array=!1,$.object=!1,typeof X==="string")$.string=f30.literal(X);else if(typeof X==="number")$.number=f30.literal(X);else if(typeof X==="boolean")$.boolean=f30.literal(X);else if(X===null)$.null=f30.null();else if(Array.isArray(X))$.array=void 0;else if(typeof X==="object")$.object=void 0}},kP4=class{apply($,Z){if(!Z.enum)return;if(Z.enum.length===0){if(!Z.type)$.string=!1,$.number=!1,$.boolean=!1,$.null=!1,$.array=!1,$.object=!1;return}let X={string:Z.enum.filter((Q)=>typeof Q==="string"),number:Z.enum.filter((Q)=>typeof Q==="number"),boolean:Z.enum.filter((Q)=>typeof Q==="boolean"),null:Z.enum.filter((Q)=>Q===null),array:Z.enum.filter((Q)=>Array.isArray(Q)),object:Z.enum.filter((Q)=>typeof Q==="object"&&Q!==null&&!Array.isArray(Q))};$.string=this.createTypeSchema(X.string,"string"),$.number=this.createTypeSchema(X.number,"number"),$.boolean=this.createTypeSchema(X.boolean,"boolean"),$.null=X.null.length>0?LH.null():!1,$.array=X.array.length>0?void 0:!1,$.object=X.object.length>0?void 0:!1}createTypeSchema($,Z){if($.length===0)return!1;if($.length===1)return LH.literal($[0]);if(Z==="string")return LH.enum($);if(Z==="number"){let[X,Q,...Y]=$;return LH.union([LH.literal(X),LH.literal(Q),...Y.map((G)=>LH.literal(G))])}if(Z==="boolean")return LH.union([LH.literal(!0),LH.literal(!1)]);return!1}},CP4=class{apply($,Z){let X=Z;if(X.type==="string"&&X.format==="binary"&&X.contentEncoding==="binary"){let Q=SP4.file();if(X.minLength!==void 0)Q=Q.min(X.minLength);if(X.maxLength!==void 0)Q=Q.max(X.maxLength);if(X.contentMediaType!==void 0)Q=Q.mime(X.contentMediaType);$.file=Q,$.string=!1}}},_P4=class{apply($,Z){let X=Z;if(Z.type===void 0&&(X.minLength!==void 0||X.maxLength!==void 0||X.pattern!==void 0)){if($.string===void 0)$.string=Zz.string()}}},vP4=class{apply($,Z){let X=Z;if(X.minLength===void 0)return;if($.string!==!1){let Q=$.string||Zz.string();if(Q instanceof Zz.ZodString)$.string=Q.refine((Y)=>{return Array.from(Y).length>=X.minLength},{message:`String must be at least ${X.minLength} characters long`})}}},xP4=class{apply($,Z){let X=Z;if(X.maxLength===void 0)return;if($.string!==!1){let Q=$.string||Zz.string();if(Q instanceof Zz.ZodString)$.string=Q.refine((Y)=>{return Array.from(Y).length<=X.maxLength},{message:`String must be at most ${X.maxLength} characters long`})}}},fP4=class{apply($,Z){let X=Z;if(!X.pattern)return;if($.string!==!1){let Q=$.string||Zz.string();if(Q instanceof Zz.ZodString){let Y=new RegExp(X.pattern);$.string=Q.regex(Y)}}}},bP4=class{apply($,Z){let X=Z;if(X.minimum===void 0)return;if($.number!==!1){let Q=$.number||wH.number();if(Q instanceof wH.ZodNumber)$.number=Q.min(X.minimum)}}},yP4=class{apply($,Z){let X=Z;if(X.maximum===void 0)return;if($.number!==!1){let Q=$.number||wH.number();if(Q instanceof wH.ZodNumber)$.number=Q.max(X.maximum)}}},gP4=class{apply($,Z){let X=Z;if(X.exclusiveMinimum===void 0)return;if($.number!==!1){let Q=$.number||wH.number();if(Q instanceof wH.ZodNumber)if(typeof X.exclusiveMinimum==="number")$.number=Q.gt(X.exclusiveMinimum);else $.number=!1}}},hP4=class{apply($,Z){let X=Z;if(X.exclusiveMaximum===void 0)return;if($.number!==!1){let Q=$.number||wH.number();if(Q instanceof wH.ZodNumber)if(typeof X.exclusiveMaximum==="number")$.number=Q.lt(X.exclusiveMaximum);else $.number=!1}}},uP4=class{apply($,Z){let X=Z;if(X.multipleOf===void 0)return;if($.number!==!1){let Q=$.number||wH.number();if(Q instanceof wH.ZodNumber)$.number=Q.refine((Y)=>{if(X.multipleOf===0)return!1;let G=Y/X.multipleOf,J=Math.round(G),K=Math.min(Math.abs(Y)*Number.EPSILON*10,Math.abs(X.multipleOf)*Number.EPSILON*10);return Math.abs(G-J)<=K/Math.abs(X.multipleOf)},{message:`Must be a multiple of ${X.multipleOf}`})}}},cP4=class{apply($,Z){let X=Z;if(Z.type===void 0&&(X.minItems!==void 0||X.maxItems!==void 0||X.items!==void 0||X.prefixItems!==void 0)){if($.array===void 0)$.array=eZ.array(eZ.any())}}},lP4=class{apply($,Z){let X=Z;if(X.minItems===void 0)return;if($.array!==!1)$.array=($.array||eZ.array(eZ.any())).min(X.minItems)}},dP4=class{apply($,Z){let X=Z;if(X.maxItems===void 0)return;if($.array!==!1)$.array=($.array||eZ.array(eZ.any())).max(X.maxItems)}},mP4=class{apply($,Z){let X=Z;if($.array===!1)return;if(Array.isArray(X.items))$.array=$.array||eZ.array(eZ.any());else if(X.items&&typeof X.items!=="boolean"&&!X.prefixItems){let Q=C7(X.items),Y=eZ.array(Q);if($.array&&$.array instanceof eZ.ZodArray){let G=$.array._def;if(G.checks)G.checks.forEach((J)=>{if(J._zod&&J._zod.def){let K=J._zod.def;if(K.check==="min_length"&&K.minimum!==void 0)Y=Y.min(K.minimum);else if(K.check==="max_length"&&K.maximum!==void 0)Y=Y.max(K.maximum)}})}$.array=Y}else if(typeof X.items==="boolean"&&X.items===!1)if(!X.prefixItems)$.array=eZ.array(eZ.any()).max(0);else $.array=$.array||eZ.array(eZ.any());else if(typeof X.items==="boolean"&&X.items===!0)$.array=$.array||eZ.array(eZ.any());else if(X.prefixItems)$.array=$.array||eZ.array(eZ.any())}},iP4=class{apply($,Z){if(Z.type!=="array")return;let X=Z;if(!Array.isArray(X.items))return;if($.array===!1)return;let Q=X.items.map((G)=>C7(G)),Y;if(Q.length===0)Y=ON8.tuple([]);else Y=ON8.tuple(Q);if(X.minItems!==void 0&&X.minItems>Q.length)Y=!1;if(X.maxItems!==void 0&&X.maxItems<Q.length)Y=!1;$.tuple=Y,$.array=!1}},pP4=class{apply($,Z){let X=Z;if($.object===!1)return;if(X.properties||X.required||X.additionalProperties!==void 0)$.object=$.object||g30.object({}).passthrough()}},nP4=class{apply($,Z){let X=Z;if(Z.type===void 0&&(X.maxProperties!==void 0||X.minProperties!==void 0)){if($.object===void 0)$.object=g30.object({}).passthrough()}}},tP4=class{apply($,Z){let X=Z;if(X.maxProperties===void 0)return;if($.object!==!1){let Q=$.object||g30.object({}).passthrough();$.object=Q.refine((Y)=>Object.keys(Y).length<=X.maxProperties,{message:`Object must have at most ${X.maxProperties} properties`})}}},oP4=class{apply($,Z){let X=Z;if(X.minProperties===void 0)return;if($.object!==!1){let Q=$.object||g30.object({}).passthrough();$.object=Q.refine((Y)=>Object.keys(Y).length>=X.minProperties,{message:`Object must have at least ${X.minProperties} properties`})}}},aP4=class{apply($,Z){if(!Z.not)return $;let X=C7(Z.not);return $.refine((Q)=>!y30(X,Q),{message:"Value must not match the 'not' schema"})}},sP4=class{apply($,Z){if(Z.uniqueItems!==!0)return $;return $.refine(rP4(),{message:"Array items must be unique"})}},$A4=class{apply($,Z){if(!Z.allOf||Z.allOf.length===0)return $;return Z.allOf.map((Q)=>C7(Q)).reduce((Q,Y)=>eP4.intersection(Q,Y),$)}},ZA4=class{apply($,Z){if(!Z.anyOf||Z.anyOf.length===0)return $;let X=Z.anyOf.length===1?C7(Z.anyOf[0]):LN8.union([C7(Z.anyOf[0]),C7(Z.anyOf[1]),...Z.anyOf.slice(2).map((Q)=>C7(Q))]);return LN8.intersection($,X)}},XA4=class{apply($,Z){if(!Z.oneOf||Z.oneOf.length===0)return $;let X=Z.oneOf.map((Q)=>C7(Q));return $.refine((Q)=>{let Y=0;for(let G of X)if(G.safeParse(Q).success){if(Y++,Y>1)return!1}return Y===1},{message:"Value must match exactly one of the oneOf schemas"})}},QA4=class{apply($,Z){let X=Z;if(X.prefixItems&&Array.isArray(X.prefixItems)){let Y=X.prefixItems.map((G)=>C7(G));return $.refine((G)=>{if(!Array.isArray(G))return!0;for(let J=0;J<Math.min(G.length,Y.length);J++)if(!y30(Y[J],G[J]))return!1;if(G.length>Y.length){if(typeof X.items==="boolean"&&X.items===!1)return!1;else if(X.items&&typeof X.items==="object"&&!Array.isArray(X.items)){let J=C7(X.items);for(let K=Y.length;K<G.length;K++)if(!y30(J,G[K]))return!1}}return!0},{message:"Array does not match prefixItems schema"})}return $}},YA4=class{apply($,Z){let X=Z;if(!X.properties&&!X.required&&X.additionalProperties!==!1)return $;if($ instanceof b30.ZodObject||$ instanceof b30.ZodRecord){let Q={};if(X.properties){for(let[Y,G]of Object.entries(X.properties))if(G!==void 0)Q[Y]=C7(G)}if(X.required&&Array.isArray(X.required)){let Y=new Set(X.required);for(let G of Object.keys(Q))if(!Y.has(G))Q[G]=Q[G].optional()}else for(let Y of Object.keys(Q))Q[Y]=Q[Y].optional();if(X.additionalProperties===!1)return b30.object(Q);else return b30.object(Q).passthrough()}return $.refine((Q)=>{if(typeof Q!=="object"||Q===null||Array.isArray(Q))return!0;if(X.properties){for(let[Y,G]of Object.entries(X.properties))if(G!==void 0){if(Object.getOwnPropertyDescriptor(Q,Y)!==void 0){if(!C7(G).safeParse(Q[Y]).success)return!1}}}if(X.required&&Array.isArray(X.required)){for(let Y of X.required)if(Object.getOwnPropertyDescriptor(Q,Y)===void 0)return!1}if(X.additionalProperties===!1&&X.properties){let Y=new Set(Object.keys(X.properties));for(let G in Q)if(!Y.has(G))return!1}return!0},{message:"Object constraints validation failed"})}},GA4=class{apply($,Z){if(!Z.enum||Z.enum.length===0)return $;let X=Z.enum.filter((Q)=>Array.isArray(Q)||typeof Q==="object"&&Q!==null);if(X.length===0)return $;return $.refine((Q)=>{if(typeof Q!=="object"||Q===null)return!0;return X.some((Y)=>to(Q,Y))},{message:"Value must match one of the enum values"})}},JA4=class{apply($,Z){if(Z.const===void 0)return $;let X=Z.const;if(typeof X!=="object"||X===null)return $;return $.refine((Q)=>to(Q,X),{message:"Value must equal the const value"})}},KA4=class{apply($,Z){if(Z.description)$=$.describe(Z.description);return $}},HA4=class{apply($,Z){var X;let Q=Z;if(!((X=Q.required)==null?void 0:X.includes("__proto__"))||Z.type!==void 0)return $;return WA4.any().refine((Y)=>this.validateRequired(Y,Q.required),{message:"Missing required properties"})}validateRequired($,Z){if(typeof $!=="object"||$===null||Array.isArray($))return!0;return Z.every((X)=>Object.prototype.hasOwnProperty.call($,X))}},FA4=class{apply($,Z){var X;let Q=Z;if(Q.contains===void 0)return $;let Y=C7(Q.contains),G=(X=Q.minContains)!=null?X:1,J=Q.maxContains;return $.refine((K)=>{if(!Array.isArray(K))return!0;let W=0;for(let H of K)if(y30(Y,H))W++;if(W<G)return!1;if(J!==void 0&&W>J)return!1;return!0},{message:"Array must contain required items matching the schema"})}},UA4=class{apply($,Z){let{default:X}=Z;if(X===void 0)return $;if(!$.safeParse(X).success)return $;return $.default(X)}},NA4,BA4;var wN8=L(()=>{NA4=[new VP4,new kP4,new MP4,new CP4,new _P4,new cP4,new nP4,new vP4,new xP4,new fP4,new bP4,new yP4,new gP4,new hP4,new uP4,new iP4,new lP4,new dP4,new mP4,new tP4,new oP4,new pP4],BA4=[new HA4,new GA4,new JA4,new $A4,new ZA4,new XA4,new QA4,new YA4,new FA4,new aP4,new sP4,new UA4,new KA4]});class o11{constructor($){this._url=$}start(){if(this._socket)throw Error("WebSocketClientTransport already started! If using Client class, note that connect() calls start() automatically.");return new Promise(($,Z)=>{this._socket=new WebSocket(this._url,OA4),this._socket.onerror=(X)=>{let Q="error"in X?X.error:Error(`WebSocket error: ${JSON.stringify(X)}`);Z(Q),this.onerror?.(Q)},this._socket.onopen=()=>{$()},this._socket.onclose=()=>{this.onclose?.()},this._socket.onmessage=(X)=>{let Q;try{Q=NG.parse(JSON.parse(X.data))}catch(Y){this.onerror?.(Y);return}this.onmessage?.(Q)}})}async close(){this._socket?.close()}send($){return new Promise((Z,X)=>{if(!this._socket){X(Error("Not connected"));return}this._socket?.send(JSON.stringify($)),Z()})}}var OA4="mcp";var DN8=L(()=>{E9()});function LA4($){let Z=$;if(!Z||typeof Z!=="object"||!("method"in Z))return null;switch(Z.method){case"initialize":{let X=Z?.params?.protocolVersion;if(!X)return null;return{type:"emit",message:{result:{protocolVersion:X,capabilities:{tools:{}},serverInfo:{name:"deco-chat-server",version:"1.0.0"}},jsonrpc:Z.jsonrpc??"2.0",id:Z.id}}}case"notifications/roots/list_changed":case"notifications/initialized":case"notifications/cancelled":case"notifications/progress":return{type:"suppress"};default:return null}}var h30;var r11=L(()=>{ey();h30=class h30 extends eW{constructor($,Z){super($,Z)}send($,Z){let X=LA4($);if(X?.type==="emit")return this.onmessage?.(X.message),Promise.resolve();if(X?.type==="suppress")return Promise.resolve();return super.send($,Z)}}});var EN8,jN8=async($,Z,X)=>{let Q=wA4($.connection,Z,X);if(!Q)throw Error("Unknown MCP connection type");let Y=new EN8({name:$?.name??"MCP Client",version:"1.0.0"});return await Y.connect(Q),{client:Y}},wA4=($,Z,X)=>{if($.type==="Websocket")return new o11(new URL($.url));if($.type!=="SSE"&&$.type!=="HTTP")return null;let Y={...$.token?{authorization:`Bearer ${$.token}`}:{},...X??{},..."headers"in $?$.headers||{}:{}};if($.type==="SSE"){let G={requestInit:{headers:Y,signal:Z}};if($.token)G.eventSourceInit={fetch:(J,K)=>{return fetch(J,{...K,headers:{...Y,Accept:"text/event-stream"},signal:Z})}};return new AU(new URL($.url),G)}return new h30(new URL($.url),{requestInit:{headers:Y,signal:Z,credentials:"include"}})};var zN8=L(()=>{aW();kn();DN8();E9();FQ();r11();EN8=class EN8 extends ZZ{constructor($,Z){super($,{jsonSchemaValidator:I5,...Z})}async listTools($,Z){return await this.request({method:"tools/list",params:$},mp,Z)}}});function EA4($,Z){if(Xz.set($,Z),Xz.size>DA4){let X=Xz.keys().next().value;if(X!==void 0)Xz.delete(X)}}function TN8($){let Z=(X)=>{if("connection"in $)return jN8({connection:$.connection},void 0,X);return $.client};return new Proxy({},{get(X,Q){if(Q==="toJSON")return null;if(typeof Q!=="string")throw Error("Name must be a string");if(Q==="listTools")return K;async function Y(W,H=Q){let F=$?.debugId?.(),U=F?{"x-trace-debug-id":F}:void 0,{client:N}=await Z(U),{structuredContent:B,isError:O,content:w}=await N.callTool({name:String(H),arguments:W});if(O){let E=w?.[0]?.text,j=typeof E==="string"?PN8(E):null,z=j?.code&&typeof $?.getErrorByStatusCode==="function"?$.getErrorByStatusCode(j.code,j.message,j.traceId):null;if(z)throw z;throw Error(`Tool ${String(H)} returned an error: ${JSON.stringify(B??w)}`)}if(B!==void 0)return B;let D=w?.[0]?.text;return typeof D==="string"?PN8(D):void 0}async function G(){let{client:W}=await Z(),{tools:H}=await W.listTools();return H}async function J(){if(!("connection"in $))return G();let W=$.connection,H=JSON.stringify(W);try{if(!Xz.has(H))EA4(H,G());return await Xz.get(H)}catch(F){console.error("Failed to list tools",F),Xz.delete(H);return}}async function K(){return(await J()??[]).map((H)=>AN8(H,Y))}return Y.asTool=async()=>{let H=(await J()??[]).find((F)=>F.name===Q);if(!H)throw Error(`Tool ${Q} not found`);return AN8(H,Y)},Y}})}var PN8=($)=>{try{return JSON.parse($)}catch{return $}},DA4=500,Xz,AN8=($,Z)=>{return{...$,id:$.name,inputSchema:$.inputSchema?C7($.inputSchema):void 0,outputSchema:$.outputSchema?C7($.outputSchema):void 0,execute:(X)=>{return Z(X.context,$.name)}}};var RN8=L(()=>{wN8();zN8();Xz=new Map});function AL($){return TN8($)}var _h;var a11=L(()=>{RN8();_h=new Proxy({},{get($,Z){if(Z==="toJSON")return null;if(Z==="forConnection")return(X)=>AL({connection:X});if(Z==="forClient")return(X)=>AL({client:X});return globalThis[Z]}})});function u30($){return{isImplementedBy:(Z)=>{for(let X of $){let Q=typeof X.name==="string"?new RegExp(`^${X.name}$`):X.name,Y=Z.find((G)=>Q.test(G.name));if(!Y&&X.opt)continue;if(!Y)return!1}return!0}}}var DH=($)=>{return{...u30($),forClient:(Z)=>{return AL({client:Z})},forConnection:(Z)=>{return AL({connection:Z})}}};var Qz=L(()=>{a11()});import{z as s5}from"zod";var IN8,c30,qN8,l30,MN8,jA4;var VN8=L(()=>{Qz();IN8=s5.object({specversion:s5.literal("1.0").describe("CloudEvents specification version"),id:s5.string().describe("Unique identifier for this event (UUID recommended)"),source:s5.string().describe("Connection ID of the event publisher"),type:s5.string().describe("Event type (e.g., 'order.created', 'user.signup')"),time:s5.string().datetime().optional().describe("Timestamp of when the event occurred (ISO 8601)"),subject:s5.string().optional().describe("Subject/resource identifier (e.g., order ID, user ID)"),datacontenttype:s5.string().optional().default("application/json").describe("Content type of the data attribute"),dataschema:s5.string().url().optional().describe("URI to the schema for the data attribute"),data:s5.unknown().optional().describe("Event payload (any JSON value)")}),c30=s5.object({events:s5.array(IN8).min(1).describe("Batch of CloudEvents to process")}),qN8=s5.object({success:s5.boolean().optional().describe("Whether this event was processed successfully"),error:s5.string().optional().describe("Error message for this event"),retryAfter:s5.number().int().positive().optional().describe("Re-deliver this event after this many ms")}),l30=s5.object({success:s5.boolean().optional().describe("Batch success - applies to events not in results"),error:s5.string().optional().describe("Batch error message - applies to events not in results"),processedCount:s5.number().int().min(0).optional().describe("Number of events successfully processed"),retryAfter:s5.number().int().positive().optional().describe("Batch retryAfter - applies to events not in results"),results:s5.record(s5.string(),qN8).optional().describe("Per-event results keyed by event ID")}),MN8=[{name:"ON_EVENTS",inputSchema:c30,outputSchema:l30}],jA4=DH(MN8)});import{z as e5}from"zod";var kN8,SN8,CN8,_N8,vN8,xN8,d30,s11;var e11=L(()=>{Qz();kN8=e5.object({type:e5.literal("string"),enum:e5.array(e5.string()).optional(),description:e5.string().optional()}),SN8=e5.object({type:e5.string(),description:e5.string(),paramsSchema:e5.record(e5.string(),kN8)}),CN8=e5.object({}),_N8=e5.object({triggers:e5.array(SN8)}),vN8=e5.object({type:e5.string(),params:e5.record(e5.string(),e5.string()),enabled:e5.boolean(),callbackUrl:e5.url().optional(),callbackToken:e5.string().min(1).optional()}),xN8=e5.object({success:e5.boolean()}),d30=[{name:"TRIGGER_LIST",inputSchema:CN8,outputSchema:_N8},{name:"TRIGGER_CONFIGURE",inputSchema:vN8,outputSchema:xN8}],s11=DH(d30)});import{z as f8}from"zod";var zA4,PA4,AA4,TA4,RA4,IA4,qA4,MA4,VA4,kA4,SA4,CA4,Yz;var oo=L(()=>{zA4=f8.object({prefix:f8.string().optional().describe("Filter objects by prefix (e.g., 'folder/' for folder contents)"),maxKeys:f8.number().optional().default(1000).describe("Maximum number of keys to return (default: 1000)"),continuationToken:f8.string().optional().describe("Token for pagination from previous response"),delimiter:f8.string().optional().describe("Delimiter for grouping keys (typically '/'). When set, commonPrefixes returns folder paths.")}),PA4=f8.object({objects:f8.array(f8.object({key:f8.string().describe("Object key/path"),size:f8.number().describe("Object size in bytes"),lastModified:f8.string().describe("Last modified timestamp"),etag:f8.string().describe("Entity tag for the object")})),nextContinuationToken:f8.string().optional().describe("Token for fetching next page of results"),isTruncated:f8.boolean().describe("Whether there are more results available"),commonPrefixes:f8.array(f8.string()).optional().describe("Folder paths when delimiter is used (e.g., ['photos/2024/', 'photos/2025/'])")}),AA4=f8.object({key:f8.string().describe("Object key/path to get metadata for")}),TA4=f8.object({contentType:f8.string().optional().describe("MIME type of the object"),contentLength:f8.number().describe("Size of the object in bytes"),lastModified:f8.string().describe("Last modified timestamp"),etag:f8.string().describe("Entity tag for the object"),metadata:f8.record(f8.string(),f8.string()).optional().describe("Custom metadata key-value pairs")}),RA4=f8.object({key:f8.string().describe("Object key/path to generate URL for"),expiresIn:f8.number().optional().describe("URL expiration time in seconds (default: from state config or 3600)")}),IA4=f8.object({url:f8.string().describe("Presigned URL for downloading the object"),expiresIn:f8.number().describe("Expiration time in seconds that was used")}),qA4=f8.object({key:f8.string().describe("Object key/path for the upload"),expiresIn:f8.number().optional().describe("URL expiration time in seconds (default: from state config or 3600)"),contentType:f8.string().optional().describe("MIME type for the object being uploaded")}),MA4=f8.object({url:f8.string().describe("Presigned URL for uploading the object"),expiresIn:f8.number().describe("Expiration time in seconds that was used")}),VA4=f8.object({key:f8.string().describe("Object key/path to delete")}),kA4=f8.object({success:f8.boolean().describe("Whether the deletion was successful"),key:f8.string().describe("The key that was deleted")}),SA4=f8.object({keys:f8.array(f8.string()).max(1000).describe("Array of object keys/paths to delete (max 1000)")}),CA4=f8.object({deleted:f8.array(f8.string()).describe("Array of successfully deleted keys"),errors:f8.array(f8.object({key:f8.string(),message:f8.string()})).describe("Array of errors for failed deletions")}),Yz=[{name:"LIST_OBJECTS",inputSchema:zA4,outputSchema:PA4},{name:"GET_OBJECT_METADATA",inputSchema:AA4,outputSchema:TA4},{name:"GET_PRESIGNED_URL",inputSchema:RA4,outputSchema:IA4},{name:"PUT_PRESIGNED_URL",inputSchema:qA4,outputSchema:MA4},{name:"DELETE_OBJECT",inputSchema:VA4,outputSchema:kA4},{name:"DELETE_OBJECTS",inputSchema:SA4,outputSchema:CA4}]});import{z as k$}from"zod";var fN8,bN8,yN8,ro,m30,i30,p30,n30,_A4;var $81=L(()=>{Qz();fN8=k$.object({primary:k$.string().optional().describe("Primary brand color (hex)"),secondary:k$.string().optional().describe("Secondary brand color (hex)"),accent:k$.string().optional().describe("Accent / highlight color (hex)"),background:k$.string().optional().describe("Background color (hex)"),foreground:k$.string().optional().describe("Foreground / text color (hex)")}),bN8=k$.object({heading:k$.string().optional().describe("Font family for headings"),body:k$.string().optional().describe("Font family for body text"),code:k$.string().optional().describe("Font family for code / monospace")}),yN8=k$.object({logo:k$.string().optional().describe("Logo URL"),favicon:k$.string().optional().describe("Favicon URL"),ogImage:k$.string().optional().describe("Open Graph image URL")}),ro=k$.object({id:k$.string(),name:k$.string().describe("Brand / company name"),domain:k$.string().optional().describe("Company domain (e.g. example.com)"),colors:fN8.optional().describe("Semantic color palette"),fonts:bN8.optional().describe("Font families by role"),assets:yN8.optional().describe("Visual identity assets"),overview:k$.string().optional().describe("Company overview / description"),tagline:k$.string().optional().describe("Brand tagline"),tone:k$.string().optional().describe("Tone of voice description"),metadata:k$.record(k$.string(),k$.unknown()).optional().describe("Extra design tokens and metadata")}),m30=k$.object({id:k$.string().optional().describe("Brand ID. Omit to get the default brand.")}),i30=k$.object({}),p30=k$.object({items:k$.array(ro)}),n30=[{name:"BRAND_GET",inputSchema:m30,outputSchema:ro},{name:"BRAND_LIST",inputSchema:i30,outputSchema:p30,opt:!0}],_A4=DH(n30)});var Z81=L(()=>{Qz();VN8();e11();oo();$81()});import{z as q6}from"zod";function fU($){return q6.object({items:q6.array($).describe("Array of collection items"),totalCount:q6.number().int().min(0).optional().describe("Total number of matching items (if available)"),hasMore:q6.boolean().optional().describe("Whether there are more items available")})}function so($){return q6.object({item:$.nullable().describe("The retrieved item, or null if not found")})}function fA4($){return q6.object({data:$.partial().describe("Data for the new entity (id may be auto-generated)")})}function bA4($){return q6.object({item:$.describe("The created entity with generated id")})}function yA4($){return q6.object({id:q6.string().describe("ID of the entity to update"),data:$.partial().describe("Partial entity data to update")})}function gA4($){return q6.object({item:$.describe("The updated entity")})}function $r($){return q6.object({item:$.describe("The deleted entity")})}function o30($,Z,X){let Q=$.toUpperCase(),Y=X?.readOnly??!1,G=[{name:`COLLECTION_${Q}_LIST`,inputSchema:jK,outputSchema:fU(Z)},{name:`COLLECTION_${Q}_GET`,inputSchema:ao,outputSchema:so(Z)}];if(!Y)G.push({name:`COLLECTION_${Q}_CREATE`,inputSchema:fA4(Z),outputSchema:bA4(Z),opt:!0},{name:`COLLECTION_${Q}_UPDATE`,inputSchema:yA4(Z),outputSchema:gA4(Z),opt:!0},{name:`COLLECTION_${Q}_DELETE`,inputSchema:eo,outputSchema:$r(Z),opt:!0});return G}var t30,vA4,gN8,xA4,jK,ao,eo;var v3=L(()=>{t30=q6.object({id:q6.string().describe("Unique identifier for the entity"),title:q6.string().describe("Human-readable title for the entity"),description:q6.string().nullish().describe("Description of the entity"),created_at:q6.string().datetime(),updated_at:q6.string().datetime(),created_by:q6.string().optional(),updated_by:q6.string().optional()}),vA4=q6.object({field:q6.array(q6.string()),operator:q6.enum(["eq","gt","gte","lt","lte","in","like","contains"]),value:q6.unknown()}),gN8=q6.lazy(()=>q6.union([vA4,q6.object({operator:q6.enum(["and","or","not"]),conditions:q6.array(gN8)})])),xA4=q6.object({field:q6.array(q6.string()),direction:q6.enum(["asc","desc"]),nulls:q6.enum(["first","last"]).optional()}),jK=q6.object({where:gN8.optional().describe("Filter expression"),orderBy:q6.array(xA4).optional().describe("Sort expressions"),limit:q6.number().int().min(1).max(1000).optional().describe("Maximum number of items to return"),offset:q6.number().int().min(0).optional().describe("Number of items to skip")});ao=q6.object({id:q6.string().describe("ID of the entity to retrieve")});eo=q6.object({id:q6.string().describe("ID of the entity to delete")})});import{z as vh}from"zod";var hA4,uA4,hN8;var uN8=L(()=>{v3();hA4=t30.extend({avatar:vh.string().describe("URL or data URI to the assistant's avatar image"),system_prompt:vh.string().describe("System prompt that defines the assistant's behavior"),virtual_mcp_id:vh.string().describe("Virtual MCP ID to use for this assistant"),model:vh.object({id:vh.string().describe("Model ID"),connectionId:vh.string().describe("Connection ID that provides the model")}).describe("Selected model reference for this assistant")}),uA4=o30("assistant",hA4),hN8=[...uA4]});import{z as T0}from"zod";var Zr,bU,lN8,cA4,lA4,dN8,dA4,mA4,iA4,pA4,nA4,tA4,mN8,oA4,rA4,aA4,sA4,eA4,$T4,ZT4,XT4,QT4,YT4,ab5,GT4,sb5,cN8,JT4,KT4,r30,eb5;var iN8=L(()=>{Qz();v3();Zr=T0.lazy(()=>T0.union([T0.null(),T0.string(),T0.number(),T0.boolean(),T0.record(T0.string(),Zr),T0.array(Zr)])),bU=T0.record(T0.string(),T0.record(T0.string(),Zr)).optional().describe("Additional provider-specific options. Outer record keyed by provider name, inner by option key"),lN8=T0.object({type:T0.literal("text"),text:T0.string().describe("The text content"),providerOptions:bU}),cA4=T0.object({type:T0.literal("text"),text:T0.string().describe("The text content"),providerMetadata:T0.any().optional().describe("Additional provider-specific metadata")}),lA4=T0.string().describe("File data as URL string"),dN8=T0.object({type:T0.literal("file"),filename:T0.string().optional().describe("Optional filename of the file"),data:lA4,mediaType:T0.string().describe("IANA media type of the file (e.g., image/png, audio/mp3)"),providerOptions:bU}),dA4=T0.object({type:T0.literal("file"),mediaType:T0.string().describe("IANA media type of the file (e.g., image/png, audio/mp3)"),data:T0.string().describe("Generated file data as base64 encoded string")}),mA4=T0.object({type:T0.literal("reasoning"),text:T0.string().describe("The reasoning text"),providerOptions:bU}),iA4=T0.object({type:T0.literal("reasoning"),text:T0.string().describe("The reasoning text"),providerMetadata:T0.any().optional().describe("Additional provider-specific metadata")}),pA4=T0.object({type:T0.literal("tool-call"),toolCallId:T0.string().describe("ID of the tool call, used to match with tool result"),toolName:T0.string().describe("Name of the tool being called"),input:T0.string().describe("Arguments of the tool call (JSON-serializable object matching tool input schema)"),providerExecuted:T0.boolean().optional().describe("Whether the tool call will be executed by the provider"),providerOptions:bU}),nA4=T0.object({type:T0.literal("tool-call"),toolCallId:T0.string().describe("ID of the tool call"),toolName:T0.string().describe("Name of the tool being called"),input:T0.string().describe("Stringified JSON object with the tool call arguments"),providerExecuted:T0.boolean().optional().describe("Whether the tool call will be executed by the provider"),providerMetadata:T0.any().optional().describe("Additional provider-specific metadata")}),tA4=T0.union([T0.object({type:T0.literal("text"),value:T0.string()}),T0.object({type:T0.literal("json"),value:Zr}),T0.object({type:T0.literal("error-text"),value:T0.string()}),T0.object({type:T0.literal("error-json"),value:Zr}),T0.object({type:T0.literal("content"),value:T0.array(T0.union([T0.object({type:T0.literal("text"),text:T0.string().describe("Text content")}),T0.object({type:T0.literal("media"),data:T0.string().describe("Base-64 encoded media data"),mediaType:T0.string().describe("IANA media type")})]))}),T0.object({type:T0.literal("execution-denied"),reason:T0.string().optional()}),T0.string().describe("Raw or JSON-serialized output (e.g. from AI SDK mapToolResultOutput)")]),mN8=T0.object({type:T0.literal("tool-result"),toolCallId:T0.string().describe("ID of the tool call that this result is associated with"),toolName:T0.string().describe("Name of the tool that generated this result"),output:tA4.describe("Result of the tool call"),result:T0.unknown().describe("Unknown result of the tool call"),providerOptions:bU}),oA4=T0.object({type:T0.literal("tool-result"),toolCallId:T0.string().describe("ID of the tool call that this result is associated with"),toolName:T0.string().describe("Name of the tool that generated this result"),result:T0.any().describe("Result of the tool call (JSON-serializable)"),isError:T0.boolean().optional().describe("Whether the result is an error or error message"),providerExecuted:T0.boolean().optional().describe("Whether the tool result was generated by the provider"),providerMetadata:T0.any().optional().describe("Additional provider-specific metadata")}),rA4=T0.union([T0.object({type:T0.literal("source"),sourceType:T0.literal("url"),id:T0.string().describe("The ID of the source"),url:T0.string().describe("The URL of the source"),title:T0.string().optional().describe("The title of the source"),providerMetadata:T0.any().optional().describe("Additional provider-specific metadata")}),T0.object({type:T0.literal("source"),sourceType:T0.literal("document"),id:T0.string().describe("The ID of the source"),mediaType:T0.string().describe("IANA media type of the document (e.g., application/pdf)"),title:T0.string().describe("The title of the document"),filename:T0.string().optional().describe("Optional filename of the document"),providerMetadata:T0.any().optional().describe("Additional provider-specific metadata")})]),aA4=T0.object({role:T0.literal("system"),content:T0.string().describe("System message content"),providerOptions:bU}),sA4=T0.object({role:T0.literal("user"),content:T0.array(T0.union([lN8,dN8])).describe("User message content parts (text or file)"),providerOptions:bU}),eA4=T0.object({role:T0.literal("assistant"),content:T0.array(T0.union([lN8,dN8,mA4,pA4,mN8])).describe("Assistant message content parts (text, file, reasoning, tool-call, or tool-result)"),providerOptions:bU}),$T4=T0.object({role:T0.literal("tool"),content:T0.array(mN8).describe("Tool message content (tool results)"),providerOptions:bU}),ZT4=T0.union([aA4,sA4,eA4,$T4]),XT4=T0.array(ZT4).describe("A list of messages forming the prompt"),QT4=T0.object({prompt:XT4.describe("A language model prompt is a standardized prompt type (array of messages with roles: system, user, assistant, tool)"),maxOutputTokens:T0.number().optional().describe("Maximum number of tokens to generate"),temperature:T0.number().optional().describe("Temperature setting. The range depends on the provider and model"),topP:T0.number().optional().describe("Nucleus sampling parameter"),topK:T0.number().optional().describe("Only sample from the top K options for each subsequent token. Used to remove long tail low probability responses"),presencePenalty:T0.number().optional().describe("Presence penalty setting. It affects the likelihood of the model to repeat information that is already in the prompt"),frequencyPenalty:T0.number().optional().describe("Frequency penalty setting. It affects the likelihood of the model to repeatedly use the same words or phrases"),seed:T0.number().optional().describe("The seed (integer) to use for random sampling. If set and supported by the model, calls will generate deterministic results"),stopSequences:T0.array(T0.string()).optional().describe("Stop sequences. If set, the model will stop generating text when one of the stop sequences is generated"),responseFormat:T0.union([T0.object({type:T0.literal("text")}),T0.object({type:T0.literal("json"),schema:T0.any().optional().describe("JSON schema that the generated output should conform to"),name:T0.string().optional().describe("Name of output that should be generated"),description:T0.string().optional().describe("Description of the output that should be generated")})]).optional().describe("Response format. The output can either be text or JSON. Default is text"),tools:T0.array(T0.any()).optional().describe("The tools that are available for the model"),toolChoice:T0.any().optional().describe("Specifies how the tool should be selected. Defaults to 'auto'"),includeRawChunks:T0.boolean().optional().describe("Include raw chunks in the stream. Only applicable for streaming calls"),abortSignal:T0.any().optional().describe("Abort signal for cancelling the operation"),providerOptions:T0.any().optional().describe("Additional provider-specific options")}),YT4=T0.object({content:T0.array(T0.union([cA4,dA4,iA4,nA4,oA4,rA4])).describe("Ordered content that the model has generated (text, tool-calls, reasoning, files, sources)"),finishReason:T0.enum(["stop","length","content-filter","tool-calls","error","other","unknown"]).describe("Reason why generation stopped"),usage:T0.looseObject({inputTokens:T0.number().optional(),outputTokens:T0.number().optional(),totalTokens:T0.number().optional(),reasoningTokens:T0.number().optional()}).describe("Usage information for the language model call"),providerMetadata:T0.any().optional().describe("Additional provider-specific metadata"),request:T0.object({body:T0.any().optional().describe("Request HTTP body sent to the provider API")}).optional().describe("Optional request information for telemetry and debugging"),response:T0.object({id:T0.string().optional().describe("ID for the generated response"),timestamp:T0.iso.datetime().optional().describe("Timestamp for the start of the generated response"),modelId:T0.string().optional().describe("The ID of the response model that was used"),headers:T0.record(T0.string(),T0.string()).optional().describe("Response headers"),body:T0.any().optional().describe("Response HTTP body")}).optional().describe("Optional response information for telemetry and debugging"),warnings:T0.array(T0.any()).describe("Warnings for the call, e.g. unsupported settings")}),ab5=T0.object({stream:T0.any().describe("ReadableStream of LanguageModelV2StreamPart"),request:T0.object({body:T0.any().optional().describe("Request HTTP body sent to the provider API")}).optional().describe("Optional request information for telemetry and debugging"),response:T0.object({headers:T0.record(T0.string(),T0.string()).optional().describe("Response headers")}).optional().describe("Optional response data")}),GT4=T0.object({supportedUrls:T0.record(T0.string(),T0.array(T0.string())).describe("Supported URL patterns by media type for the provider")}),sb5=T0.object({modelId:T0.string().describe("The ID of the model"),logo:T0.string().nullable(),description:T0.string().nullable(),capabilities:T0.array(T0.string()),limits:T0.object({contextWindow:T0.number(),maxOutputTokens:T0.number()}).nullable(),costs:T0.object({input:T0.number(),output:T0.number()}).nullable(),provider:T0.enum(["openai","anthropic","google","x-ai","deepseek","openai-compatible","openrouter"]).nullable()}),cN8=T0.object({modelId:T0.string().describe("The ID of the model"),callOptions:QT4}),JT4=t30.extend({logo:T0.string().nullable(),description:T0.string().nullable(),capabilities:T0.array(T0.string()),limits:T0.object({contextWindow:T0.number(),maxOutputTokens:T0.number()}).nullable(),costs:T0.object({input:T0.number(),output:T0.number()}).nullable(),provider:T0.enum(["openai","anthropic","google","xai","deepseek","openai-compatible","openrouter"]).nullable()}),KT4=o30("llm",JT4,{readOnly:!0}),r30=[{name:"LLM_METADATA",inputSchema:T0.object({modelId:T0.string().describe("The ID of the model")}),outputSchema:GT4},{name:"LLM_DO_STREAM",inputSchema:cN8},{name:"LLM_DO_GENERATE",inputSchema:cN8,outputSchema:YT4},...KT4],eb5=DH(r30)});import{z as Gz}from"zod";var WT4,pN8;var nN8=L(()=>{WT4=Gz.object({scopes:Gz.array(Gz.string()).describe("List of scopes available"),stateSchema:Gz.record(Gz.string(),Gz.unknown()).describe("JSON Schema (draft-07) defining the state structure")}),pN8=[{name:"MCP_CONFIGURATION",inputSchema:Gz.object({}),outputSchema:WT4}]});import{z as $9}from"zod";var HT4,FT4,tN8;var oN8=L(()=>{HT4=$9.object({}).strict(),FT4=$9.object({billing:$9.object({mode:$9.enum(["prepaid","postpaid"]),limitPeriod:$9.enum(["daily","weekly","monthly"]).nullable()}),limit:$9.object({total:$9.number().nullable(),remaining:$9.number().nullable(),reset:$9.string().nullable()}),usage:$9.object({total:$9.number(),daily:$9.number(),weekly:$9.number(),monthly:$9.number()}),alert:$9.object({enabled:$9.boolean(),threshold_usd:$9.number(),email:$9.string().nullable()}),connectionId:$9.string()}),tN8=[{name:"GATEWAY_USAGE",inputSchema:HT4,outputSchema:FT4},{name:"GATEWAY_SET_LIMIT",inputSchema:$9.object({}),outputSchema:$9.object({}),opt:!0},{name:"GATEWAY_SET_ALERT",inputSchema:$9.object({}),outputSchema:$9.object({}),opt:!0}]});import{z as rN8}from"zod";function x3(){return XQ()===null}function a30($,Z){return $===r6.DEV_ASSETS(Z)}function xh($,Z){let X=kZ8(Z,$),Q=new Date().toISOString();return{id:X.id??r6.DEV_ASSETS($),title:X.title,description:X.description??null,icon:X.icon??null,app_name:X.app_name??null,app_id:X.app_id??null,organization_id:$,created_by:"system",created_at:Q,updated_at:Q,connection_type:X.connection_type,connection_url:X.connection_url??null,connection_token:null,connection_headers:null,oauth_config:null,configuration_state:null,configuration_scopes:null,metadata:X.metadata??null,tools:UT4,bindings:["OBJECT_STORAGE"],status:"active"}}var UT4;var fh=L(()=>{pB();oo();S6();UT4=Yz.map(($)=>({name:$.name,description:`${$.name} operation for local file storage`,inputSchema:rN8.toJSONSchema($.inputSchema),outputSchema:rN8.toJSONSchema($.outputSchema)}))});function aN8($,Z){return $||Z===0}function sN8($,Z,X,Q,Y){let G=Z?Y+1:Y,J=$.slice(0,X),K=Q+X<G;return{items:J,totalCount:G,hasMore:K}}function eN8($,Z,X){if(!X)return{sqlOffset:$,sqlLimit:Z};if($===0)return{sqlOffset:0,sqlLimit:Math.max(Z-1,0)};return{sqlOffset:$-1,sqlLimit:Z}}function NT4($,Z){if(Z.length===0)return;let[X,...Q]=Z,Y=X==="slug"?kO($):$[X];for(let G of Q){if(Y===null||typeof Y!=="object")return;Y=Y[G]}return Y}function BT4($){let X=$.replace(/[.*+?^${}()|[\]\\]/g,"\\$&").replace(/%/g,".*").replace(/_/g,".");return new RegExp(`^${X}$`,"i")}function OT4($,Z,X){if($===void 0)return!0;switch(Z){case"eq":return X===null?$===null:$===X;case"gt":return $>X;case"gte":return $>=X;case"lt":return $<X;case"lte":return $<=X;case"in":return Array.isArray(X)&&X.includes($);case"like":return typeof $==="string"&&BT4(String(X)).test($);case"contains":return String($).toLowerCase().includes(String(X).toLowerCase());default:return!0}}function Xr($,Z){if(!Z)return!0;if("conditions"in Z){let{operator:Q,conditions:Y}=Z;if(Y.length===0)return!0;switch(Q){case"and":return Y.every((G)=>Xr($,G));case"or":return Y.some((G)=>Xr($,G));case"not":return!Y.every((G)=>Xr($,G));default:return!0}}let X=NT4($,Z.field);return OT4(X,Z.operator,Z.value)}var $B8=L(()=>{XY0()});import{z as TL}from"zod";var LT4=8,wT4,DT4,ET4,jT4,X81;var ZB8=L(()=>{Z81();uN8();v3();iN8();nN8();oo();oN8();S6();m0();L9();jG();xU();fh();pW();XY0();$B8();wT4=[{name:/^(COLLECTION_REGISTRY_APP_LIST|REGISTRY_ITEM_LIST)$/,inputSchema:TL.object({})}],DT4={LLM:r30,LLMS:r30,ASSISTANTS:hN8,MCP:pN8,OBJECT_STORAGE:Yz,AI_GATEWAY_BILLING:tN8,TRIGGER:d30,REGISTRY:wT4,BRAND:n30},ET4=jK.extend({binding:TL.union([TL.array(TL.object({}).passthrough()),TL.object({}).passthrough(),TL.string()]).optional(),include_virtual:TL.boolean().optional().describe("Whether to include VIRTUAL connections in the results. Defaults to false."),slug:TL.string().optional().describe("Filter by connection slug. Matches against app_name, or a slug derived from connection_url or title.")}),jT4=fU(WX),X81=m({name:"COLLECTION_CONNECTIONS_LIST",description:"List all connections in the organization with filtering, sorting, and pagination",annotations:{title:"List Connections",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:ET4,outputSchema:jT4,handler:async($,Z)=>{await Z.access.check();let X=X0(Z),Q=$.binding?typeof $.binding==="string"?(()=>{let E=DT4[$.binding.toUpperCase()];if(!E)throw Error(`Unknown binding: ${$.binding}`);return E})():$.binding:void 0,Y=Q?u30(Q):void 0,G=!!Y,J=$.limit??100,K=$.offset??0,W=O9(),H=r6.DEV_ASSETS(X.id),F=xh(X.id,W),U=(!$.slug||kO(F)===$.slug)&&Xr(F,$.where),N=x3()&&!G&&U,{sqlOffset:B,sqlLimit:O}=eN8(K,J,N),{items:w,totalCount:D}=await Z.storage.connections.list(X.id,{includeVirtual:$.include_virtual??!1,slug:$.slug,where:$.where,orderBy:$.orderBy,limit:G?void 0:O,offset:G?void 0:B});if(Y){let E=z9(),j=r6.SELF(X.id);await P30(w,LT4,async(z)=>{if(z.tools!==null)return;let A=z.id===j?async()=>{let{listManagementTools:I}=await Promise.resolve().then(() => (RL(),s30));return I(Z)}:()=>p11(z,Z,QY0),P=await zL("tools",z.id,A,E,(I)=>Z.pendingRevalidations.push(I),jL);if(P!==null)z.tools=P})}if(x3()&&aN8(G,K)&&U&&!w.some((E)=>E.id===H))w.unshift(F);if(G){let E=(await Promise.all(w.map(async(P)=>{if(!P.tools||P.tools.length===0)return null;return Y.isImplementedBy(P.tools.map((q)=>({name:q.name,inputSchema:q.inputSchema,outputSchema:q.outputSchema})))?P:null}))).filter((P)=>P!==null),j=E.length,z=E.slice(K,K+J),A=K+J<j;return{items:z,totalCount:j,hasMore:A}}return sN8(w,N,J,K,D)}})});var zT4,Q81;var XB8=L(()=>{v3();S6();m0();L9();jG();xU();fh();pW();zT4=so(WX),Q81=m({name:"COLLECTION_CONNECTIONS_GET",description:"Get a connection's configuration, tools list, and status by ID.",annotations:{title:"Get Connection",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},_meta:{ui:{visibility:["app"]}},inputSchema:ao,outputSchema:zT4,handler:async($,Z)=>{let X=X0(Z);if(await Z.access.check(),x3()&&a30($.id,X.id))return{item:xh(X.id,O9())};let Q=await Z.storage.connections.findById($.id);if(!Q||Q.organization_id!==X.id)return{item:null};if(Q.tools===null){let Y=r6.SELF(X.id),G=Q.id===Y?async()=>{let{listManagementTools:K}=await Promise.resolve().then(() => (RL(),s30));return K(Z)}:async()=>{let K=await q5(Q,Z,!0);try{return(await K.listTools()).tools}finally{await K.close().catch(()=>{})}},J=await zL("tools",Q.id,G,z9(),(K)=>Z.pendingRevalidations.push(K),jL);if(J!==null)Q.tools=J}return{item:Q}}})});class X5{db;vault;constructor($,Z){this.db=$;this.vault=Z}async get($){let Z=await this.db.selectFrom("downstream_tokens").selectAll().where("connectionId","=",$).executeTakeFirst();if(!Z)return null;return this.decryptToken(Z)}async upsert($){let Z=new Date().toISOString(),X=await this.vault.encrypt($.accessToken),Q=$.refreshToken?await this.vault.encrypt($.refreshToken):null,Y=$.clientSecret?await this.vault.encrypt($.clientSecret):null,G=$.expiresAt?.toISOString()??null,J=await this.db.insertInto("downstream_tokens").values({id:J4("dtok"),connectionId:$.connectionId,accessToken:X,refreshToken:Q,scope:$.scope,expiresAt:G,clientId:$.clientId,clientSecret:Y,tokenEndpoint:$.tokenEndpoint,createdAt:Z,updatedAt:Z}).onConflict((K)=>K.column("connectionId").doUpdateSet({accessToken:X,refreshToken:Q,scope:$.scope,expiresAt:G,clientId:$.clientId,clientSecret:Y,tokenEndpoint:$.tokenEndpoint,updatedAt:Z})).returning(["id","createdAt"]).executeTakeFirstOrThrow();return{id:J.id,connectionId:$.connectionId,accessToken:$.accessToken,refreshToken:$.refreshToken,scope:$.scope,expiresAt:$.expiresAt,createdAt:J.createdAt,updatedAt:Z,clientId:$.clientId,clientSecret:$.clientSecret,tokenEndpoint:$.tokenEndpoint}}async delete($){await this.db.deleteFrom("downstream_tokens").where("connectionId","=",$).execute()}isExpired($,Z=0){if(!$.expiresAt)return!1;let Q=($.expiresAt instanceof Date?$.expiresAt:new Date($.expiresAt)).getTime();if(Number.isNaN(Q))return!0;return Q-Z<Date.now()}async decryptToken($){let Z=await this.vault.decrypt($.accessToken),X=$.refreshToken?await this.vault.decrypt($.refreshToken):null,Q=$.clientSecret?await this.vault.decrypt($.clientSecret):null;return{id:$.id,connectionId:$.connectionId,accessToken:Z,refreshToken:X,scope:$.scope,expiresAt:$.expiresAt,createdAt:$.createdAt,updatedAt:$.updatedAt,clientId:$.clientId,clientSecret:Q,tokenEndpoint:$.tokenEndpoint}}}var f3=L(()=>{UQ()});function bh(...$){if(RT4)console.log("[mcp-read-cache]",...$)}function IT4($){return $.kind==="org"?"org":`u:${$.userId}`}function Y81($){if($===null||typeof $!=="object")return JSON.stringify($)??"null";if(Array.isArray($))return`[${$.map(Y81).join(",")}]`;return`{${Object.keys($).sort().map((X)=>`${JSON.stringify(X)}:${Y81($[X])}`).join(",")}}`}class ZJ0{config;maxEntries;now;maxTotalBytes;store=new Map;revalidating=new Set;totalBytes=0;constructor($=PT4,Z=AT4,X=()=>Date.now(),Q=TT4){this.config=$;this.maxEntries=Z;this.now=X;this.maxTotalBytes=Q}stats(){return{entries:this.store.size,bytes:this.totalBytes}}deleteKey($){let Z=this.store.get($);if(Z)this.store.delete($),this.totalBytes-=Z.bytes}key($,Z,X,Q){return`${Z}:${IT4(X)}:${$}:${Y81(Q)}`}storeSet($,Z,X,Q){let Y;try{Y=JSON.stringify(Z).length}catch{bh("SKIP non-serializable",$);return}if(Y>Q){bh("SKIP oversize",$,`${Y}b > cap ${Q}b`);return}this.deleteKey($);while(this.store.size>0&&(this.store.size>=this.maxEntries||this.totalBytes+Y>this.maxTotalBytes)){let G=this.store.keys().next().value;if(G===void 0)break;this.deleteKey(G)}this.store.set($,{value:Z,storedAt:X,bytes:Y}),this.totalBytes+=Y}async fetch($){let{type:Z,connectionId:X,scope:Q,params:Y,fetchLive:G,shouldCache:J,onRevalidation:K}=$,W=this.config[Z],H=this.key(Z,X,Q,Y),F=this.now(),U=this.store.get(H),N=U?F-U.storedAt:1/0;if(!U||N>W.maxStaleMs){e30.add(1,{type:Z,outcome:"miss"}),bh(U?"EXPIRED":"MISS",H);let B=await G();if(J?.(B)??!0)this.storeSet(H,B,this.now(),W.maxValueBytes);else bh("NOT-CACHED (shouldCache=false)",H);return B}if(this.store.delete(H),this.store.set(H,U),N>W.revalidateAfterMs&&!this.revalidating.has(H)){e30.add(1,{type:Z,outcome:"stale"}),bh("STALE \u2192 serve + revalidate",H,`age=${N}ms`),this.revalidating.add(H);let B=G().then((O)=>{if(J?.(O)??!0)this.storeSet(H,O,this.now(),W.maxValueBytes)}).catch(()=>{e30.add(1,{type:Z,outcome:"error"})}).finally(()=>this.revalidating.delete(H));K?.(B)}else e30.add(1,{type:Z,outcome:"hit"}),bh("HIT",H,`age=${N}ms`);return U.value}invalidate($){let Z=`${$}:`;for(let X of[...this.store.keys()])if(X.startsWith(Z))this.deleteKey(X)}}function J81(){return o0().mcpCacheEnabled}function XJ0(){return J81()?G81:null}var e30,$J0=1024,QB8,PT4,AT4=2000,TT4,RT4,G81;var Qr=L(()=>{u$();_8();e30=R8.createCounter("mcp_read_cache.fetches",{description:"MCP read cache outcomes (hit, stale, miss, error)",unit:"{fetches}"}),QB8=$J0*$J0,PT4={"tools/call":{revalidateAfterMs:30000,maxStaleMs:300000,maxValueBytes:512*$J0},"resources/read":{revalidateAfterMs:60000,maxStaleMs:300000,maxValueBytes:4*QB8},"prompts/get":{revalidateAfterMs:60000,maxStaleMs:300000,maxValueBytes:512*$J0}},TT4=256*QB8,RT4=typeof process<"u"&&!!process.env?.MCP_CACHE_DEBUG;G81=new ZJ0;R8.createObservableGauge("mcp_read_cache.entries",{description:"Current entry count in the per-pod MCP read cache",unit:"{entries}"}).addCallback(($)=>$.observe(G81.stats().entries));R8.createObservableGauge("mcp_read_cache.bytes",{description:"Approximate total bytes held in the per-pod MCP read cache",unit:"By"}).addCallback(($)=>$.observe(G81.stats().bytes))});function JB8($){XJ0()?.invalidate($)}function yh($){JB8($);let Z=K81?.();if(!Z)return;try{Z.publish(YB8,qT4.encode(JSON.stringify({connectionId:$,originId:GB8})))}catch(X){console.warn("[McpCacheInvalidation] publish failed (non-critical):",X)}}function KB8($){if(K81=$,Yr)return;let Z=$();if(!Z)return;Yr=Z.subscribe(YB8),(async()=>{for await(let X of Yr)try{let Q=JSON.parse(MT4.decode(X.data));if(Q.originId===GB8)continue;JB8(Q.connectionId)}catch{}})().catch(console.error)}function WB8(){Yr?.unsubscribe(),Yr=null,K81=void 0}var YB8="studio.mcp-cache.invalidate",GB8,qT4,MT4,K81,Yr=null;var Gr=L(()=>{Qr();GB8=crypto.randomUUID(),qT4=new TextEncoder,MT4=new TextDecoder});import{z as W81}from"zod";function kT4($){let Z={...$};for(let X of VT4)delete Z[X];return Z}function ST4($,Z){return $.connection_url!==void 0?$.connection_url:Z}function vT4($,Z){return $.length===Z.length&&$.every((X,Q)=>X===Z[Q])}var VT4,CT4,_T4,H81;var HB8=L(()=>{xU();f3();m0();_8();jG();Gr();n11();xo();pW();VT4=["id","organization_id","created_by","created_at"];CT4=W81.object({id:W81.string().describe("ID of the connection to update"),data:IX0.describe("Partial connection data to update")}),_T4=W81.object({item:WX.describe("The updated connection entity")});H81=m({name:"COLLECTION_CONNECTIONS_UPDATE",description:"Update a connection's configuration. Re-fetches tools from the server on URL change.",annotations:{title:"Update Connection",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:CT4,outputSchema:_T4,handler:async($,Z)=>{G0(Z);let X=X0(Z);await Z.access.check();let Q=w1(Z);if(!Q)throw Error("User ID required to update connection");let{id:Y}=$,G=kT4($.data),J=G.configuration_state!==void 0||G.configuration_scopes!==void 0,K=await Z.storage.connections.findById(Y);if(!K||K.organization_id!==X.id)throw Error("Connection not found in organization");let W=G.connection_type??K.connection_type,H=ST4(G,K.connection_url);if(W==="VIRTUAL"){let f=ky(H);if(!f)throw Error("VIRTUAL connection requires connection_url in format: virtual://$virtual_mcp_id");let y=await Z.storage.virtualMcps.findById(f);if(!y)throw Error(`Virtual MCP not found: ${f}`);if(y.organization_id!==X.id)throw Error("Virtual MCP does not belong to the current organization");H=Sy(f)}let F=G.configuration_state??K.configuration_state??{},U=G.configuration_scopes??K.configuration_scopes??[];if(J){if(G.configuration_state!==void 0)F=G.configuration_state??{};else if(F===null||F===void 0)F={};if(G.configuration_scopes!==void 0)U=G.configuration_scopes??[];if(U.length>0){let f=F;io(f,U,X.id),await no(f,U,X.id,Z)}}if(W==="STDIO"&&!o0().localMode)throw Error("STDIO connections are only available in local mode (--local-mode).");let N=G.connection_token??K.connection_token;if(!N)try{let y=await new X5(Z.db,Z.vault).get(Y);if(y?.accessToken)N=y.accessToken}catch{}let B=await LL({id:K.id,title:G.title??K.title,connection_type:W,connection_url:H,connection_token:N,connection_headers:G.connection_headers??K.connection_headers}).catch(()=>null),O=B?.tools?.length?B.tools:null,w=!1;if(G.configuration_scopes===void 0&&B?.scopes?.length)w=!vT4(U,B.scopes),U=B.scopes;if(io(F,U,X.id),w&&U.length>0)await no(F,U,X.id,Z);let D=J||w,E=D?po(F,U):[],j=D?po(K.configuration_state??{},K.configuration_scopes??[]):[],z=K.configuration_state,A=z==null||Object.keys(z).length===0,P,I,q=async()=>{try{await Z.storage.connectionCredentialVault.replaceGrantsForSubject({organizationId:X.id,subjectConnectionId:Y,createdBy:Q,grants:j})}catch(f){console.error("Failed to restore credential grants after credential vault mutation failed",f)}},M={...G,connection_url:H,tools:null,configuration_state:F,configuration_scopes:U,updated_by:Q},S={...K,...M};if(D)try{if(await Z.storage.connectionCredentialVault.replaceGrantsForSubject({organizationId:X.id,subjectConnectionId:Y,createdBy:Q,grants:E}),E.length>0){if(!await Z.storage.connectionCredentialVault.findActiveWorkloadToken({organizationId:X.id,subjectConnectionId:Y})){let{plaintextToken:y,record:o}=await Z.storage.connectionCredentialVault.createOrRotateWorkloadToken({organizationId:X.id,subjectConnectionId:Y});I=o.id,P={baseUrl:Z.baseUrl,org:X.slug??X.id,subjectConnectionId:Y,token:y}}}}catch(f){if(I)await Z.storage.connectionCredentialVault.revokeWorkloadToken({organizationId:X.id,subjectConnectionId:Y,tokenId:I});throw await q(),f}if(D&&F&&U)try{await(await q5(S,Z,!1)).callTool({name:"ON_MCP_CONFIGURATION",arguments:{state:F,scopes:U,firstRun:A,...P?{vault:P}:{}}})}catch(f){if(console.error("Failed to invoke ON_MCP_CONFIGURATION callback",f),I)await Z.storage.connectionCredentialVault.revokeWorkloadToken({organizationId:X.id,subjectConnectionId:Y,tokenId:I});if(E.length>0)throw await q(),f}let d;try{d=await Z.storage.connections.update(Y,M)}catch(f){if(D){if(I)await Z.storage.connectionCredentialVault.revokeWorkloadToken({organizationId:X.id,subjectConnectionId:Y,tokenId:I});await q()}throw f}if(O)z9()?.set("tools",Y,O).catch(()=>{});return yh(Y),{item:d}}})});import{z as xT4}from"zod";var fT4,F81;var FB8=L(()=>{v3();l4();m0();jG();Gr();pW();fT4=eo.extend({force:xT4.boolean().optional().describe("If true, removes this connection from all agents that reference it before deleting")}),F81=m({name:"COLLECTION_CONNECTIONS_DELETE",description:"Permanently delete a connection. Set force=true to auto-remove from referencing Virtual MCPs.",annotations:{title:"Delete Connection",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:fT4,outputSchema:$r(WX),handler:async($,Z)=>{G0(Z);let X=X0(Z);await Z.access.check();let Q=await Z.storage.connections.findById($.id);if(!Q)throw Error(`Connection not found: ${$.id}`);if(Q.organization_id!==X.id)throw Error("Connection not found in organization");if(Q.metadata?.isFixed===!0)throw Error("This connection is a fixed system connection and cannot be deleted");let G=await Z.storage.virtualMcps.listByConnectionId(X.id,$.id);if(G.length>0)if($.force)await Z.storage.virtualMcps.removeConnectionReferences($.id);else throw Error(JSON.stringify({code:"CONNECTION_IN_USE",agentNames:G.map((W)=>W.title)}));await Z.storage.connections.delete($.id);let J=await Z.storage.organizationSettings.get(X.id);if(J?.registry_config){let{registries:W,blockedMcps:H}=J.registry_config;if($.id in W){let{[$.id]:F,...U}=W;await Z.storage.organizationSettings.upsert(X.id,{registry_config:{registries:U,blockedMcps:H}})}}z9()?.invalidate($.id).catch(()=>{}),yh($.id);let K=w1(Z);if(K)p1.capture({distinctId:K,event:"connection_deleted",groups:{organization:X.id},properties:{connection_id:Q.id,connection_type:Q.connection_type,app_name:Q.app_name??null,organization_id:X.id,forced:$.force??!1}});return{item:Q}}})});import{z as gh}from"zod";var U81;var UB8=L(()=>{m0();U81=m({name:"CONNECTION_TEST",description:"Test connection health and latency",annotations:{title:"Test Connection",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!0},inputSchema:gh.object({id:gh.string()}),outputSchema:gh.object({id:gh.string(),healthy:gh.boolean(),latencyMs:gh.number()}),handler:async($,Z)=>{let X=X0(Z);await Z.access.check();let Q=await Z.storage.connections.findById($.id);if(!Q||Q.organization_id!==X.id)throw Error("Connection not found");let Y=await Z.storage.connections.testConnection($.id);return{id:$.id,...Y}}})});var NB8=L(()=>{NN8();ZB8();XB8();HB8();FB8();UB8()});import{sql as d4}from"kysely";import{z as EH}from"zod";function BB8($){if($===null||$===void 0)return"NULL";if(typeof $==="number")return String($);if(typeof $==="boolean")return $?"TRUE":"FALSE";if(typeof $==="string")return`'${$.replace(/'/g,"''")}'`;if($ instanceof Date)return`'${$.toISOString()}'`;return`'${JSON.stringify($).replace(/'/g,"''")}'`}function gT4($,Z){let X=$;for(let Y=Z.length;Y>=1;Y--){let G=`$${Y}`;if(X.includes(G))X=X.replaceAll(G,BB8(Z[Y-1]))}let Q=[];for(let Y=0;Y<X.length;Y++)if(X[Y]==="?")Q.push(Y);for(let Y=Math.min(Q.length,Z.length)-1;Y>=0;Y--){let G=Q[Y],J=BB8(Z[Y]);X=X.slice(0,G)+J+X.slice(G+1)}return X}function OB8($){return $.replace(/-/g,"_")}function uT4($){return`app_${OB8($)}`}function cT4($){return`app_role_${OB8($)}`}function lT4($){if($ instanceof Error){let Z=$.message.toLowerCase(),X=$.code;return X==="3F000"||X==="42704"||X==="22023"||Z.includes("schema")&&Z.includes("does not exist")||Z.includes("role")&&Z.includes("does not exist")}return!1}async function dT4($,Z,X){if(await d4`CREATE SCHEMA IF NOT EXISTS ${d4.id(Z)}`.execute($),!(await d4`
     SELECT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = ${X}) as exists
-  `.execute($)).rows[0]?.exists)await d4`CREATE ROLE ${d4.id(X)} NOLOGIN`.execute($);await d4`GRANT ${d4.id(X)} TO CURRENT_USER`.execute($),await d4`GRANT USAGE, CREATE ON SCHEMA ${d4.id(Z)} TO ${d4.id(X)}`.execute($),await d4`GRANT ALL ON ALL TABLES IN SCHEMA ${d4.id(Z)} TO ${d4.id(X)}`.execute($),await d4`GRANT ALL ON ALL SEQUENCES IN SCHEMA ${d4.id(Z)} TO ${d4.id(X)}`.execute($),await d4`ALTER DEFAULT PRIVILEGES IN SCHEMA ${d4.id(Z)} GRANT ALL ON TABLES TO ${d4.id(X)}`.execute($),await d4`ALTER DEFAULT PRIVILEGES IN SCHEMA ${d4.id(Z)} GRANT ALL ON SEQUENCES TO ${d4.id(X)}`.execute($),await d4`REVOKE ALL ON SCHEMA public FROM ${d4.id(X)}`.execute($)}async function mT4($,Z,X,Q){try{return await $.transaction().execute(async(Y)=>{return await d4`SET LOCAL ROLE ${d4.id(X)}`.execute(Y),await d4`SET LOCAL search_path TO ${d4.id(Z)}`.execute(Y),await d4.raw(Q).execute(Y)})}catch(Y){if(lT4(Y))return await dT4($,Z,X),await $.transaction().execute(async(G)=>{return await d4`SET LOCAL ROLE ${d4.id(X)}`.execute(G),await d4`SET LOCAL search_path TO ${d4.id(Z)}`.execute(G),await d4.raw(Q).execute(G)});throw Y}}var yT4,hT4,LB8;var wB8=L(()=>{m0();yT4=EH.object({results:EH.array(EH.unknown()).optional(),success:EH.boolean().optional()});hT4=EH.object({sql:EH.string().describe("The SQL query to run"),params:EH.array(EH.any()).describe("The parameters to pass to the SQL query").optional()});LB8=m({name:"DATABASES_RUN_SQL",description:"Run a SQL query in a connection-scoped isolated schema. Supports SELECT, DDL, and DML.",annotations:{title:"Run SQL Query",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!1,openWorldHint:!1},inputSchema:hT4,outputSchema:EH.object({result:EH.array(yT4)}),handler:async($,Z)=>{G0(Z),await Z.access.check();let X=gT4($.sql,$.params||[]);if(!Z.connectionId)throw Error("Connection context required for database access");console.warn("DATABASES_RUN_SQL invoked",{"tool.deprecation_probe":"DATABASES_RUN_SQL","connection.id":Z.connectionId,"organization.id":Z.organization?.id??null,"user.id":Z.auth.user?.id??null});let Q=uT4(Z.connectionId),Y=cT4(Z.connectionId);return{result:[{results:(await mT4(Z.db,Q,Y,X)).rows,success:!0}]}}})});function QJ0($){let Z=$.access.getRole();if(!LX(Z))throw new MU("Only organization owners and admins can change org-wide pin status")}var N81=L(()=>{KY();bj()});async function YJ0($,Z,X){let Q=[...new Set(X)],Y=await Promise.all(Q.map((J)=>$.storage.connections.findById(J,Z))),G=Q.filter((J,K)=>!Y[K]);if(G.length>0)throw Error(`Connection not found: ${G.join(", ")}`)}function yU($){return $.toLowerCase().replace(/[^a-z0-9]+/g,"-").replace(/^-|-$/g,"")}function GJ0($){let Z=2166136261;for(let X=0;X<$.length;X++)Z=Math.imul(Z^$.charCodeAt(X),16777619);return`a${(Z>>>0).toString(36).padStart(6,"0").slice(-6)}`}function Jr($){if($&&typeof $==="object"&&"gatewayClientId"in $&&typeof $.gatewayClientId==="string")return $.gatewayClientId;return}function Kr($,Z){if(!Z)return $;let X=`${GJ0(Z)}_`;return $.startsWith(X)?$.slice(X.length):$}function pT4($){return $.split(/[-_]/).map((Z)=>Z?Z.charAt(0).toUpperCase()+Z.slice(1):Z).join(" ")}var hh;var DB8=L(()=>{aW();hh=class hh extends ZZ{static MAX_PAGES_PER_CLIENT=1000;clients;slugToKey=new Map;resolvedClients=new Map;toolsCache=null;resourcesCache=null;resourceTemplatesCache=null;promptsCache=null;resourceRouteMap=new Map;constructor($,Z){super(Z?.clientInfo??{name:"gateway-client",version:"1.0.0"},{capabilities:Z?.capabilities});this.clients=$;for(let X of Object.keys($)){let Q=GJ0(X);if(this.slugToKey.has(Q))throw Error(`GatewayClient: duplicate namespace code "${Q}" from keys "${this.slugToKey.get(Q)}" and "${X}"`);this.slugToKey.set(Q,X)}}namespace($,Z){return`${GJ0($)}_${Z}`}async resolveToolTarget($){let Z=$.indexOf("_");if(Z!==-1){let Q=$.slice(0,Z),Y=this.slugToKey.get(Q);if(Y)return[Y,$.slice(Z+1)]}let{tools:X}=await this.listTools();for(let Q of X){let Y=Jr(Q._meta);if(!Y)continue;if(Kr(Q.name,Y)===$)return[Y,$]}if(Z===-1)throw Error(`GatewayClient: could not resolve tool "${$}" \u2014 no namespace prefix and not found in any client`);throw Error(`GatewayClient: unknown namespace "${$.slice(0,Z)}" in "${$}" and not found by original name in any client`)}async resolvePromptTarget($){let Z=$.indexOf("_");if(Z!==-1){let Q=$.slice(0,Z),Y=this.slugToKey.get(Q);if(Y)return[Y,$.slice(Z+1)]}let{prompts:X}=await this.listPrompts();for(let Q of X){let Y=Jr(Q._meta);if(!Y)continue;if(Kr(Q.name,Y)===$)return[Y,$]}if(Z===-1)throw Error(`GatewayClient: could not resolve prompt "${$}" \u2014 no namespace prefix and not found in any client`);throw Error(`GatewayClient: unknown namespace "${$.slice(0,Z)}" in "${$}" and not found by original name in any client`)}resolveClient($){let Z=this.resolvedClients.get($);if(Z)return Z;let X=this.clients[$];if(!X)return Promise.reject(Error(`GatewayClient: unknown client key "${$}"`));let Q=X.client,Y;try{Y=typeof Q==="function"?Promise.resolve(Q()):Promise.resolve(Q)}catch(J){return Promise.reject(J)}let G=Y.catch((J)=>{throw this.resolvedClients.delete($),J});return this.resolvedClients.set($,G),G}getResolvedClient($){return this.resolveClient($)}async listFromClient($,Z,X){try{let Q=await this.resolveClient($);return await Z(Q)}catch(Q){return console.warn(`GatewayClient: skipping ${X} from client "${$}" \u2014 ${Q?.message??Q}`),[]}}async paginate($,Z,X){let Q=[],Y,G=0;do{let J=await X(Y);Q.push(...J.items),Y=J.nextCursor,G++}while(Y&&G<hh.MAX_PAGES_PER_CLIENT);if(Y)console.warn(`GatewayClient: client "${$}" exceeded ${hh.MAX_PAGES_PER_CLIENT} pages listing ${Z} \u2014 truncating`);return Q}fetchAllTools($,Z){return this.paginate(Z,"tools",async(X)=>{let Q=await $.listTools(X?{cursor:X}:void 0);return{items:Q.tools,nextCursor:Q.nextCursor}})}fetchAllResources($,Z){return this.paginate(Z,"resources",async(X)=>{let Q=await $.listResources(X?{cursor:X}:void 0);return{items:Q.resources,nextCursor:Q.nextCursor}})}fetchAllResourceTemplates($,Z){return this.paginate(Z,"resource templates",async(X)=>{let Q=await $.listResourceTemplates(X?{cursor:X}:void 0);return{items:Q.resourceTemplates,nextCursor:Q.nextCursor}})}fetchAllPrompts($,Z){return this.paginate(Z,"prompts",async(X)=>{let Q=await $.listPrompts(X?{cursor:X}:void 0);return{items:Q.prompts,nextCursor:Q.nextCursor}})}listTools($,Z){if(!this.toolsCache)this.toolsCache=this.aggregateTools();return this.toolsCache}async aggregateTools(){let $=[];for(let[Z,X]of Object.entries(this.clients)){let Q=await this.listFromClient(Z,(J)=>this.fetchAllTools(J,Z),"tools"),Y=X.tools,G=Y?new Set(Y):null;for(let J of Q){if(G&&!G.has(J.name))continue;$.push({...J,name:this.namespace(Z,J.name),_meta:{...J._meta??{},gatewayClientId:Z}})}}return{tools:$}}listResources($,Z){if(!this.resourcesCache)this.resourcesCache=this.aggregateResources();return this.resourcesCache}async aggregateResources(){let $=new Set,Z=[],X=new Map;for(let[Q,Y]of Object.entries(this.clients)){let G=await this.listFromClient(Q,(W)=>this.fetchAllResources(W,Q),"resources"),J=Y.resources,K=J?new Set(J):null;for(let W of G){if(K&&!K.has(W.uri)&&!(W.name&&K.has(W.name)))continue;if($.has(W.uri)){console.warn(`GatewayClient: duplicate resource "${W.uri}" from client "${Q}" \u2014 skipping`);continue}$.add(W.uri),X.set(W.uri,Q),Z.push({...W,_meta:{...W._meta??{},gatewayClientId:Q}})}}return this.resourceRouteMap=X,{resources:Z}}listResourceTemplates($,Z){if(!this.resourceTemplatesCache)this.resourceTemplatesCache=this.aggregateResourceTemplates();return this.resourceTemplatesCache}async aggregateResourceTemplates(){let $=new Set,Z=[];for(let[X,Q]of Object.entries(this.clients)){let Y=await this.listFromClient(X,(G)=>this.fetchAllResourceTemplates(G,X),"resource templates");for(let G of Y){if($.has(G.uriTemplate)){console.warn(`GatewayClient: duplicate resource template "${G.uriTemplate}" from client "${X}" \u2014 skipping`);continue}$.add(G.uriTemplate),Z.push({...G,_meta:{...G._meta??{},gatewayClientId:X}})}}return{resourceTemplates:Z}}listPrompts($,Z){if(!this.promptsCache)this.promptsCache=this.aggregatePrompts();return this.promptsCache}async aggregatePrompts(){let $=[];for(let[Z,X]of Object.entries(this.clients)){let Q=await this.listFromClient(Z,(J)=>this.fetchAllPrompts(J,Z),"prompts"),Y=X.prompts,G=Y?new Set(Y):null;for(let J of Q){if(G&&!G.has(J.name))continue;$.push({...J,name:this.namespace(Z,J.name),title:J.title??pT4(J.name),_meta:{...J._meta??{},gatewayClientId:Z}})}}return{prompts:$}}async callTool($,Z,X){let[Q,Y]=await this.resolveToolTarget($.name);return(await this.resolveClient(Q)).callTool({...$,name:Y},Z,X)}async readResource($,Z){let X=await this.resolveResourceRoute($.uri);return(await this.resolveClient(X)).readResource($)}async getPrompt($,Z){let[X,Q]=await this.resolvePromptTarget($.name);return(await this.resolveClient(X)).getPrompt({...$,name:Q})}async resolveResourceRoute($){let Z=this.resourceRouteMap.get($);if(Z)return Z;if(this.resourcesCache=null,await this.listResources(),Z=this.resourceRouteMap.get($),Z)return Z;throw Error(`GatewayClient: resource "${$}" not found in any upstream client`)}getServerCapabilities(){return{tools:{},resources:{},prompts:{}}}getInstructions(){return}refresh(){this.toolsCache=null,this.resourcesCache=null,this.resourceTemplatesCache=null,this.promptsCache=null}async close(){let $=[...this.resolvedClients.values()].map((Z)=>Z.then((X)=>X.close()).catch(()=>{}));await Promise.allSettled($),await super.close()}}});var JJ0=L(()=>{DB8()});function O81($){return yU($)}function tT4($,Z){let X=yU(Z)||"prompt";return`${String($).padStart(nT4,"0")}-${X}`}async function L81($,Z,X){try{await $.delete(KJ0,O81(Z),{actor:X})}catch(Q){console.error("[agent-prompts] failed to delete prompts",{agentId:Z,err:Q})}}async function WJ0($,Z,X,Q){let Y=O81(Z);await L81($,Z,X),await Promise.all(Q.slice(0,B81).map(async(G,J)=>{let K=tT4(J,G.title),W={name:K,title:G.title,description:G.description,text:G.text};try{await $.write(KJ0,`${Y}/${K}.json`,JSON.stringify(W),{actor:X,contentType:"application/json"})}catch(H){console.error("[agent-prompts] failed to seed prompt",{agentId:Z,name:K,err:H})}}))}async function EB8($,Z){let X=O81(Z),Q;try{Q=await $.listDir(KJ0,X)}catch{return[]}let Y=Q.filter((J)=>J.kind==="file"&&J.path.endsWith(".json")).slice(0,B81),G=[];for(let J of Y)try{let K=await $.read(KJ0,J.path),W=JSON.parse(new TextDecoder().decode(K));if(W&&typeof W.name==="string"&&typeof W.title==="string"&&typeof W.text==="string")G.push(W)}catch{}return G}var KJ0="agent-prompts",B81=20,nT4;var Wr=L(()=>{JJ0();nT4=String(B81-1).length});import{z as PB8}from"zod";function oT4(){let $=jB8[Math.floor(Math.random()*jB8.length)];return`icon://${zB8[Math.floor(Math.random()*zB8.length)]}?color=${$}`}var jB8,zB8,rT4,aT4,w81;var AB8=L(()=>{m0();DL();N81();Wr();jB8=["red","orange","amber","yellow","lime","green","emerald","cyan","sky","blue","indigo","violet","purple","fuchsia","pink","rose"],zB8=["Star01","Zap","Heart","Globe01","Compass03","Lightbulb02","Rocket01","Flag01","BookOpen01","Shield01","Key01","Diamond01","Cube01","Target04","Award01","Briefcase01","Coffee","Feather","Hexagon01","Layers3_01","Map01","Palette","Package","Terminal"];rT4=PB8.object({data:VX0.describe("Data for the new virtual MCP")}),aT4=PB8.object({item:HX.describe("The created virtual MCP entity")}),w81=m({name:"COLLECTION_VIRTUAL_MCP_CREATE",description:"Create a Virtual MCP (agent) that aggregates tools from multiple connections into one endpoint. Pass `prompts` to seed the agent with kickstart prompts (conversation starters shown as icebreakers). Author them from the agent's role/instructions and the descriptions of the tools it will have, so the starters are coherent and immediately useful.",annotations:{title:"Create Virtual MCP",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!1,openWorldHint:!1},inputSchema:rT4,outputSchema:aT4,handler:async($,Z)=>{G0(Z);let X=X0(Z);await Z.access.check();let Q=w1(Z);if(!Q)throw Error("User ID required to create virtual MCP");if($.data.pinned===!0)QJ0(Z);let{prompts:Y,...G}=$.data;if(G.connections.length>0)await YJ0(Z,X.id,G.connections.map((W)=>W.connection_id));let J={...G,icon:G.icon??oT4()},K=await Z.storage.virtualMcps.create(X.id,Q,J);if(Y?.length&&Z.orgFs&&K.id)await WJ0(Z.orgFs,K.id,Q,Y);return{item:K}}})});function sT4($){let Z=[],X=0;while(X<$.length){let Q=$[X];if(Q==="%")Z.push(".*");else if(Q==="_")Z.push(".");else if(/[.*+?^${}()|[\]\\]/.test(Q))Z.push("\\"+Q);else Z.push(Q);X++}return Z.join("")}function IL($){return typeof $==="string"||typeof $==="number"}function D81($,Z){let X=Z.split("."),Q=$;for(let Y of X){if(Q==null||typeof Q!=="object")return;Q=Q[Y]}return Q}function eT4($,Z){return $.connections.some((X)=>X.connection_id===Z)}function HJ0($,Z){if("conditions"in Z){let{operator:K,conditions:W}=Z;switch(K){case"and":return W.every((H)=>HJ0($,H));case"or":return W.some((H)=>HJ0($,H));case"not":return!W.every((H)=>HJ0($,H));default:return!0}}let{field:X,operator:Q,value:Y}=Z,G=X.join(".");if(G==="connection_id"){if(Q!=="eq"||typeof Y!=="string")return!1;return eT4($,Y)}let J=D81($,G);switch(Q){case"eq":return J===Y;case"gt":return IL(J)&&IL(Y)&&J>Y;case"gte":return IL(J)&&IL(Y)&&J>=Y;case"lt":return IL(J)&&IL(Y)&&J<Y;case"lte":return IL(J)&&IL(Y)&&J<=Y;case"in":return Array.isArray(Y)&&Y.includes(J);case"like":if(typeof J!=="string"||typeof Y!=="string")return!1;if(Y.length>100)return!1;let K=sT4(Y);return new RegExp(`^${K}$`,"i").test(J);case"contains":if(typeof J!=="string"||typeof Y!=="string")return!1;return J.toLowerCase().includes(Y.toLowerCase());default:return!0}}function $24($,Z){return[...$].sort((X,Q)=>{for(let Y of Z){let G=Y.field.join("."),J=D81(X,G),K=D81(Q,G),W=0;if(J==null&&K==null)continue;if(J==null)W=Y.nulls==="first"?-1:1;else if(K==null)W=Y.nulls==="first"?1:-1;else if(typeof J==="string"&&typeof K==="string")W=J.localeCompare(K);else if(typeof J==="number"&&typeof K==="number")W=J-K;else W=String(J).localeCompare(String(K));if(W!==0)return Y.direction==="desc"?-W:W}return 0})}var Z24,X24,E81;var TB8=L(()=>{v3();m0();DL();Z24=jK,X24=fU(HX),E81=m({name:"COLLECTION_VIRTUAL_MCP_LIST",description:"List all MCP virtual MCPs in the organization",annotations:{title:"List Virtual MCPs",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:Z24,outputSchema:X24,handler:async($,Z)=>{await Z.access.check();let X=X0(Z),Q=$.where&&!("conditions"in $.where)&&$.where.field.join(".")==="connection_id"&&$.where.operator==="eq"&&typeof $.where.value==="string"?$.where.value:void 0,Y=$.where&&!("conditions"in $.where)&&$.where.field.join(".")==="pinned"&&$.where.operator==="eq"&&typeof $.where.value==="boolean"?$.where.value:void 0,J=Q?await Z.storage.virtualMcps.listByConnectionId(X.id,Q):await Z.storage.virtualMcps.list(X.id,Y!==void 0?{pinnedOnly:Y}:void 0);if($.where)J=J.filter((N)=>HJ0(N,$.where));if($.orderBy&&$.orderBy.length>0)J=$24(J,$.orderBy);let K=J.length,W=$.offset??0,H=$.limit??100,F=J.slice(W,W+H),U=W+H<K;return{items:F,totalCount:K,hasMore:U}}})});import{z as j81}from"zod";var Q24,Y24,z81;var RB8=L(()=>{m0();DL();Q24=j81.object({id:j81.string().describe("ID of the virtual MCP to retrieve")}),Y24=j81.object({item:HX.nullable().describe("The retrieved virtual MCP, or null if not found")}),z81=m({name:"COLLECTION_VIRTUAL_MCP_GET",description:"Get a Virtual MCP's configuration, connections, and virtual tools by ID.",annotations:{title:"Get Virtual MCP",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:Q24,outputSchema:Y24,handler:async($,Z)=>{G0(Z);let X=X0(Z);await Z.access.check();let Q=await Z.storage.virtualMcps.findById($.id);if(Q&&Q.organization_id!==X.id)return{item:null};if(!Q)return{item:null};return{item:Q}}})});function b3($){return P81.test($)}function IB8($){let Z=(X)=>typeof X==="string"?X.trim().toLowerCase():"";return Z($?.metadata?.siteSlug)||Z($?.title)||null}var P81;var qL=L(()=>{P81=/^[a-z0-9][a-z0-9-]{0,59}$/});function qB8($){let{nextTitle:Z,currentTitle:X,currentSiteSlug:Q}=$;if(Q?.trim())return null;if(Z===void 0||Z===X)return null;let Y=X?.trim().toLowerCase()??"";return b3(Y)?Y:null}var MB8=L(()=>{qL()});import{z as A81}from"zod";var G24,J24,T81;var VB8=L(()=>{m0();Wr();DL();N81();MB8();G24=A81.object({id:A81.string().describe("ID of the virtual MCP to update"),data:kX0.describe("Partial virtual MCP data to update")}),J24=A81.object({item:HX.describe("The updated virtual MCP entity")}),T81=m({name:"COLLECTION_VIRTUAL_MCP_UPDATE",description:"Update a Virtual MCP's name, slug, connection list, or kickstart prompts. Pass `prompts` to replace the agent's conversation starters (full set; empty array clears them).",annotations:{title:"Update Virtual MCP",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:G24,outputSchema:J24,handler:async($,Z)=>{G0(Z);let X=X0(Z);await Z.access.check();let Q=w1(Z);if(!Q)throw Error("User ID required to update virtual MCP");let Y=await Z.storage.virtualMcps.findById($.id);if(!Y)throw Error(`Virtual MCP not found: ${$.id}`);if(Y.organization_id!==X.id)throw Error(`Virtual MCP not found: ${$.id}`);let{prompts:G,...J}=$.data;if(J.metadata&&Y.metadata)J.metadata={...Y.metadata,...J.metadata};let K=qB8({nextTitle:J.title,currentTitle:Y.title,currentSiteSlug:Y.metadata?.siteSlug});if(K)J.metadata={...Y.metadata,...J.metadata,siteSlug:K};if(J.pinned!==void 0&&J.pinned!==Y.pinned)QJ0(Z);if(J.connections?.length)await YJ0(Z,X.id,J.connections.map((H)=>H.connection_id));let W=await Z.storage.virtualMcps.update($.id,Q,J);if(G!==void 0&&Z.orgFs)await WJ0(Z.orgFs,$.id,Q,G);return{item:W}}})});function K24($){if(!$)return!1;let Z=I81.join("|");return new RegExp(`permission\\s+"?(?:${Z})"?\\s+is not allowed`,"i").test($)||/permissions exceed what the github app/i.test($)}function SB8($){let Z={...$};for(let X of I81)Z[X]="read";return Z}async function CB8($,Z){let X={...Z};for(;;){let Q=await $(X);if(!Q.isError)return{result:Q,grantedPermissions:X};let Y=Q.content?.find((W)=>W.type==="text")?.text,G=I81.find((W)=>(W in X));if(!G||!K24(Y))return{result:Q,grantedPermissions:X};let{[G]:J,...K}=X;X=K}}function W24($){if(!$||typeof $!=="object"||Array.isArray($))return kB8;let Z=$;if(Object.values(Z).some((X)=>typeof X!=="string"))return kB8;return Z}function H24($){if(typeof $!=="number"||!Number.isFinite($)||!Number.isInteger($)||$<=0)return;return $}function c5($){let Z=$.metadata?.repoScope;if(!Z||typeof Z.installationId!=="number"||!Number.isFinite(Z.installationId)||!Number.isInteger(Z.installationId)||Z.installationId<=0||typeof Z.owner!=="string"||typeof Z.repo!=="string"||Z.owner.length===0||Z.repo.length===0)return null;let X=H24(Z.repositoryId);return{sourceConnectionId:typeof Z.sourceConnectionId==="string"?Z.sourceConnectionId:void 0,installationId:Z.installationId,repositoryId:X,owner:Z.owner,repo:Z.repo,permissions:W24(Z.permissions),grantProvider:Z.grantProvider==="github-mcp"?"github-mcp":void 0}}function Jz($){return $.metadata?.orgShared===!0}function _B8($){let Z=new Set,X=[];for(let Q of $??[]){if(Q.status!=="active")continue;let Y=c5(Q);if(Y===null)continue;let G=R81(Y.owner,Y.repo);if(Z.has(G))continue;Z.add(G),X.push(`${Y.owner}/${Y.repo}`)}return X}function FJ0($,Z,X){let Q=R81(Z,X),Y=($??[]).filter((G)=>{if(G.status&&G.status!=="active")return!1;let J=c5(G);return J!==null&&R81(J.owner,J.repo)===Q});return Y.find(Jz)??Y[0]??null}var kB8,I81,R81=($,Z)=>`${$}/${Z}`.toLowerCase();var HY=L(()=>{kB8={contents:"write",metadata:"read",pull_requests:"write",issues:"write",checks:"read",deployments:"read"},I81=["deployments","checks"]});function vB8($){return R3($)!==null||sQ0($)!==null}var xB8=L(()=>{S6()});import{z as q81}from"zod";var F24,U24,M81;var fB8=L(()=>{HY();f3();m0();Wr();DL();xB8();F24=q81.object({id:q81.string().describe("ID of the virtual MCP to delete")}),U24=q81.object({item:HX.describe("The deleted virtual MCP entity")}),M81=m({name:"COLLECTION_VIRTUAL_MCP_DELETE",description:"Permanently delete a Virtual MCP and its virtual tools.",annotations:{title:"Delete Virtual MCP",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:F24,outputSchema:U24,handler:async($,Z)=>{G0(Z);let X=X0(Z);if(await Z.access.check(),vB8($.id))throw Error(`Virtual MCP not found: ${$.id}`);let Q=await Z.storage.virtualMcps.findById($.id);if(!Q)throw Error(`Virtual MCP not found: ${$.id}`);if(Q.organization_id!==X.id)throw Error(`Virtual MCP not found: ${$.id}`);await Z.storage.virtualMcps.delete($.id);try{if((await Z.storage.organizationSettings.get(X.id))?.main_agent_id===$.id)await Z.storage.organizationSettings.upsert(X.id,{main_agent_id:null})}catch(G){console.error("[VIRTUAL_MCP_DELETE] failed to clear main agent pointer",{id:$.id,error:G.message})}if(Z.orgFs)await L81(Z.orgFs,$.id,w1(Z)??"system");let Y=Q.metadata?.githubRepo?.connectionId;if(Y)try{let G=await Z.storage.connections.findById(Y,X.id),J=G&&(Jz(G)||(await Z.storage.virtualMcps.listByConnectionId(X.id,Y)).length>0||await Z.storage.connections.isReferencedByThread(Y));if(G&&c5(G)&&!J){let W=await new X5(Z.db,Z.vault).get(Y);if(W?.accessToken)try{await fetch("https://api.github.com/installation/token",{method:"DELETE",headers:{Authorization:`Bearer ${W.accessToken}`,Accept:"application/vnd.github+json","X-GitHub-Api-Version":"2022-11-28"},signal:AbortSignal.timeout(5000)})}catch{}await Z.storage.connections.delete(Y)}}catch(G){console.error("[VIRTUAL_MCP_DELETE] failed to tear down repo-scoped connection",{childConnectionId:Y,error:G.message})}return{item:Q}}})});import{z as FY}from"zod";var N24,V81;var bB8=L(()=>{m0();N24=FY.object({id:FY.string(),virtualMcpId:FY.string(),pluginId:FY.string(),connectionId:FY.string().nullable(),settings:FY.record(FY.string(),FY.unknown()).nullable(),createdAt:FY.string(),updatedAt:FY.string()}),V81=m({name:"VIRTUAL_MCP_PLUGIN_CONFIG_GET",description:"Get a plugin's current configuration for a specific virtual MCP.",annotations:{title:"Get Virtual MCP Plugin Config",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:FY.object({virtualMcpId:FY.string().describe("Virtual MCP ID"),pluginId:FY.string().describe("Plugin ID")}),outputSchema:FY.object({config:N24.nullable()}),handler:async($,Z)=>{G0(Z);let X=X0(Z);await Z.access.check();let{virtualMcpId:Q,pluginId:Y}=$,G=await Z.storage.connections.findById(Q);if(!G||G.organization_id!==X.id)return{config:null};if(G.connection_type!=="VIRTUAL")return{config:null};let J=await Z.storage.virtualMcpPluginConfigs.get(Q,Y);if(!J)return{config:null};return{config:{id:J.id,virtualMcpId:J.virtualMcpId,pluginId:J.pluginId,connectionId:J.connectionId,settings:J.settings,createdAt:J.createdAt instanceof Date?J.createdAt.toISOString():J.createdAt,updatedAt:J.updatedAt instanceof Date?J.updatedAt.toISOString():J.updatedAt}}}})});import{z as $7}from"zod";var B24,k81;var yB8=L(()=>{m0();fh();L9();B24=$7.object({id:$7.string(),virtualMcpId:$7.string(),pluginId:$7.string(),connectionId:$7.string().nullable(),settings:$7.record($7.string(),$7.unknown()).nullable(),createdAt:$7.string(),updatedAt:$7.string()}),k81=m({name:"VIRTUAL_MCP_PLUGIN_CONFIG_UPDATE",description:"Set or update a plugin's configuration for a specific virtual MCP.",annotations:{title:"Update Virtual MCP Plugin Config",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:$7.object({virtualMcpId:$7.string().describe("Virtual MCP ID"),pluginId:$7.string().describe("Plugin ID"),connectionId:$7.string().nullable().optional().describe("MCP connection to bind"),settings:$7.record($7.string(),$7.unknown()).nullable().optional().describe("Plugin-specific settings")}),outputSchema:$7.object({config:B24}),handler:async($,Z)=>{G0(Z);let X=X0(Z);await Z.access.check();let{virtualMcpId:Q,pluginId:Y,connectionId:G,settings:J}=$,K=w1(Z),W=await Z.storage.connections.findById(Q);if(!W)throw Error(`Connection not found: ${Q}`);if(W.organization_id!==X.id)throw Error(`Connection not found: ${Q}`);if(W.connection_type!=="VIRTUAL")throw Error(`Connection not found: ${Q}`);let H=G?await Z.storage.connections.findById(G):null;if(G&&H&&H.organization_id!==X.id)throw Error(`Connection not found: ${G}`);if(G&&W.organization_id&&!H&&x3()&&a30(G,W.organization_id)){if(!K)throw Error("User ID required to create dev-assets connection");let U=xh(W.organization_id,O9());await Z.storage.connections.create({...U,organization_id:W.organization_id,created_by:K})}else if(G&&!H)throw Error(`Connection not found: ${G}`);let F=await Z.storage.virtualMcpPluginConfigs.upsert(Q,Y,{connectionId:G,settings:J});return{config:{id:F.id,virtualMcpId:F.virtualMcpId,pluginId:F.pluginId,connectionId:F.connectionId,settings:F.settings,createdAt:F.createdAt instanceof Date?F.createdAt.toISOString():F.createdAt,updatedAt:F.updatedAt instanceof Date?F.updatedAt.toISOString():F.updatedAt}}}})});import{z as EQ}from"zod";var O24,S81;var gB8=L(()=>{m0();DL();O24=EQ.object({connectionId:EQ.string(),toolName:EQ.string(),label:EQ.string(),icon:EQ.string().nullable().optional()}),S81=m({name:"VIRTUAL_MCP_PINNED_VIEWS_UPDATE",description:"Update the pinned sidebar views for a virtual MCP. Replaces all current pins.",annotations:{title:"Update Pinned Views",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:EQ.object({virtualMcpId:EQ.string().describe("Virtual MCP ID"),pinnedViews:EQ.array(O24).describe("Pinned views to set for the virtual MCP sidebar"),layout:EQ.object({defaultMainView:EQ.object({type:EQ.string(),id:EQ.string().optional(),toolName:EQ.string().optional()}).nullable().optional(),chatDefaultOpen:EQ.boolean().nullable().optional()}).optional()}),outputSchema:EQ.object({item:HX.nullable()}),handler:async($,Z)=>{G0(Z);let X=X0(Z);await Z.access.check();let{virtualMcpId:Q,pinnedViews:Y,layout:G}=$,J=w1(Z),K=await Z.storage.virtualMcps.findById(Q);if(!K)throw Error(`Virtual MCP not found: ${Q}`);if(K.organization_id!==X.id)throw Error(`Virtual MCP not found: ${Q}`);let W=K.metadata?.ui??{},H={...W,pinnedViews:Y.length>0?Y:null,layout:G??W.layout??null};return{item:await Z.storage.virtualMcps.update(Q,J??"system",{metadata:{...K.metadata,ui:H}})}}})});import{z as gU}from"zod";var L24,w24,C81;var hB8=L(()=>{m0();L24=gU.object({ids:gU.array(gU.string()).describe("Virtual MCP ids to look up")}),w24=gU.object({items:gU.array(gU.object({id:gU.string(),last_used_at:gU.string().optional(),last_used_by:gU.string().optional()}))}),C81=m({name:"VIRTUAL_MCP_LAST_USED_LIST",description:"Get last-used info (timestamp + user) for one or more virtual MCPs, derived from the most recent thread per agent.",annotations:{title:"List Virtual MCP Last Used",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:L24,outputSchema:w24,handler:async($,Z)=>{G0(Z),X0(Z),await Z.access.check();let X=await Z.storage.threads.findLastUsedByVirtualMcpIds($.ids);return{items:$.ids.map((Q)=>({id:Q,last_used_at:X.get(Q)?.last_used_at,last_used_by:X.get(Q)?.last_used_by}))}}})});var uB8=L(()=>{AB8();TB8();RB8();VB8();fB8();bB8();yB8();gB8();hB8()});import{z as jX}from"zod";var _81;var cB8=L(()=>{u$();m0();_81=m({name:"MONITORING_HEATMAP",description:"Get tool-call volume broken down by agent and tool name, for spotting heavily-used tools per agent.",annotations:{title:"Get Tool-Call Heatmap",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:jX.object({startDate:jX.string().datetime().optional().describe("Filter by start date (ISO 8601 datetime string)"),endDate:jX.string().datetime().optional().describe("Filter by end date (ISO 8601 datetime string)"),virtualMcpIds:jX.array(jX.string()).max(100).optional().describe("Filter by specific agent (Virtual MCP) IDs"),excludeConnectionIds:jX.array(jX.string()).max(100).optional().describe("Exclude tool calls from these connection IDs"),limit:jX.number().int().min(1).max(1000).optional().describe("Max number of (agent, tool) cells to return")}),outputSchema:jX.object({cells:jX.array(jX.object({virtualMcpId:jX.string().nullable(),toolName:jX.string(),calls:jX.number(),errors:jX.number(),outputSize:jX.number().describe("Sum of tool-output character length \u2014 a proxy for context weight, not LLM token count")}))}),handler:async($,Z)=>{let X=X0(Z);return await Z.access.check(),await pQ(),Z.storage.monitoring.queryToolCallHeatmap({organizationId:X.id,startDate:$.startDate?new Date($.startDate):void 0,endDate:$.endDate?new Date($.endDate):void 0,filters:{virtualMcpIds:$.virtualMcpIds,excludeConnectionIds:$.excludeConnectionIds},limit:$.limit})}})});import{z as M5}from"zod";var v81;var lB8=L(()=>{u$();m0();v81=m({name:"MONITORING_LOG_GET",description:"Get a single monitoring log by ID with full input and output data.",annotations:{title:"Get Monitoring Log",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:M5.object({id:M5.string().describe("Log ID to fetch")}),outputSchema:M5.object({log:M5.object({id:M5.string().optional(),organizationId:M5.string(),connectionId:M5.string(),toolName:M5.string(),input:M5.record(M5.string(),M5.unknown()),output:M5.record(M5.string(),M5.unknown()),isError:M5.boolean(),errorMessage:M5.string().nullish(),durationMs:M5.number(),timestamp:M5.string(),userId:M5.string().nullish(),requestId:M5.string(),userAgent:M5.string().nullish(),virtualMcpId:M5.string().nullish(),properties:M5.record(M5.string(),M5.string()).nullish()}).nullable().describe("The monitoring log, or null if not found")}),handler:async($,Z)=>{await Z.access.check(),await pQ();let X=X0(Z),Q=await Z.storage.monitoring.getById(X.id,$.id);if(!Q)return{log:null};return{log:{...Q,timestamp:Q.timestamp instanceof Date?Q.timestamp.toISOString():Q.timestamp}}}})});import{z as j6}from"zod";var E24,x81;var dB8=L(()=>{u$();m0();E24=j6.object({id:j6.string().optional().describe("Unique log identifier"),organizationId:j6.string().describe("Organization ID"),connectionId:j6.string().describe("Connection ID"),toolName:j6.string().describe("Name of the tool that was called"),isError:j6.boolean().describe("Whether the call resulted in an error"),errorMessage:j6.string().nullish().describe("Error message if applicable"),durationMs:j6.number().describe("Call duration in milliseconds"),timestamp:j6.string().describe("ISO 8601 timestamp of the call"),userId:j6.string().nullish().describe("User who triggered the call"),requestId:j6.string().describe("Unique request identifier"),userAgent:j6.string().nullish().describe("Client identifier (x-studio-client header)"),virtualMcpId:j6.string().nullish().describe("Virtual MCP (Agent) ID if routed through an agent"),properties:j6.record(j6.string(),j6.string()).nullish().describe("Custom key-value metadata attached to the log")}),x81=m({name:"MONITORING_LOGS_LIST",description:"List monitoring logs for tool calls with filtering and pagination.",annotations:{title:"List Monitoring Logs",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:j6.object({connectionId:j6.string().optional().describe("Filter by connection ID"),excludeConnectionIds:j6.array(j6.string()).optional().describe("Exclude logs from these connection IDs (e.g. system connections)"),virtualMcpId:j6.string().optional().describe("Filter by Virtual MCP (Agent) ID"),toolName:j6.string().optional().describe("Filter by tool name"),isError:j6.boolean().optional().describe("Filter by error status"),startDate:j6.string().datetime().optional().describe("Filter by start date (ISO 8601 datetime string)"),endDate:j6.string().datetime().optional().describe("Filter by end date (ISO 8601 datetime string)"),limit:j6.number().default(20).describe("Maximum number of results"),offset:j6.number().default(0).describe("Offset for pagination"),properties:j6.record(j6.string(),j6.string()).optional().describe("Filter by exact property key=value matches"),propertyKeys:j6.array(j6.string()).optional().describe("Filter by logs that have these property keys"),propertyPatterns:j6.record(j6.string(),j6.string()).optional().describe("Filter by property value patterns (SQL LIKE, use % as wildcard)"),propertyInValues:j6.record(j6.string(),j6.string()).optional().describe("Filter by exact match within comma-separated values (e.g., user_tags in 'Engineering')")}),outputSchema:j6.object({logs:j6.array(E24).describe("Array of monitoring logs"),total:j6.number().describe("Total number of logs matching filters"),offset:j6.number().describe("Current offset for pagination"),limit:j6.number().describe("Current limit for pagination")}),handler:async($,Z)=>{await Z.access.check(),await pQ();let X=X0(Z),Y=$.properties||$.propertyKeys||$.propertyPatterns||$.propertyInValues?{properties:$.properties,propertyKeys:$.propertyKeys,propertyPatterns:$.propertyPatterns,propertyInValues:$.propertyInValues}:void 0,G={organizationId:X.id,connectionId:$.connectionId,excludeConnectionIds:$.excludeConnectionIds,virtualMcpId:$.virtualMcpId,toolName:$.toolName,isError:$.isError,startDate:$.startDate?new Date($.startDate):void 0,endDate:$.endDate?new Date($.endDate):void 0,limit:$.limit,offset:$.offset,propertyFilters:Y},J=await Z.storage.monitoring.query(G);return{logs:J.logs.map(({input:K,output:W,...H})=>({...H,timestamp:H.timestamp instanceof Date?H.timestamp.toISOString():H.timestamp})),total:J.total,offset:$.offset,limit:$.limit}}})});import{z as B8}from"zod";var f81;var mB8=L(()=>{u$();m0();f81=m({name:"MONITORING_STATS",description:"Get aggregated statistics (counts, latency, error rates) for tool call monitoring.",annotations:{title:"Get Monitoring Stats",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:B8.object({startDate:B8.string().datetime().optional().describe("Filter by start date (ISO 8601 datetime string)"),endDate:B8.string().datetime().optional().describe("Filter by end date (ISO 8601 datetime string)"),interval:B8.string().regex(/^\d+[mhd]$/).optional().describe("Bucket interval for timeseries data (e.g. 1m, 5m, 2h, 1d). When provided, returns timeseries array."),connectionIds:B8.array(B8.string()).max(100).optional().describe("Filter by specific connection IDs (max 100)"),excludeConnectionIds:B8.array(B8.string()).max(100).optional().describe("Exclude specific connection IDs (max 100)"),toolNames:B8.array(B8.string()).max(100).optional().describe("Filter by specific tool names (max 100)"),status:B8.enum(["success","error"]).optional().describe("Filter metrics by execution status"),topN:B8.number().int().min(1).max(20).optional().describe("When provided with interval, also return top tools and their timeseries"),userIds:B8.array(B8.string()).max(100).optional().describe("Filter LLM usage by user IDs (only applied when llmUsage is true)"),llmUsage:B8.boolean().optional().describe("Aggregate LLM-call usage (tokens + USD cost) from raw log rows for the given connection. Returns token/cost totals and timeseries. Requires interval.")}),outputSchema:B8.object({totalCalls:B8.number().describe("Total number of tool calls"),errorRate:B8.number().optional().describe("Error rate as a decimal (0 to 1)"),avgDurationMs:B8.number().describe("Average call duration in milliseconds"),errorRatePercent:B8.string().optional().describe("Error rate as a percentage string"),totalErrors:B8.number().optional().describe("Total number of errors"),p50DurationMs:B8.number().optional().describe("50th percentile duration in milliseconds"),p95DurationMs:B8.number().optional().describe("95th percentile duration in milliseconds"),connectionBreakdown:B8.array(B8.object({connectionId:B8.string(),calls:B8.number(),errors:B8.number(),errorRate:B8.number(),avgDurationMs:B8.number()})).optional().describe("Per-connection metric breakdown"),totalInputTokens:B8.number().optional().describe("Total input tokens (LLM usage mode)"),totalOutputTokens:B8.number().optional().describe("Total output tokens (LLM usage mode)"),totalTokens:B8.number().optional().describe("Total tokens (LLM usage mode)"),totalCostUsd:B8.number().optional().describe("Total USD cost (LLM usage mode; only non-zero for providers that report cost)"),topTools:B8.array(B8.object({toolName:B8.string(),connectionId:B8.string().nullable(),calls:B8.number(),inputTokens:B8.number().optional(),outputTokens:B8.number().optional(),costUsd:B8.number().optional()})).optional().describe("Top tools ranked by calls"),topToolsTimeseries:B8.array(B8.object({timestamp:B8.string(),toolName:B8.string(),calls:B8.number(),errors:B8.number(),avg:B8.number(),p95:B8.number()})).optional().describe("Per-tool metric timeseries for the top tools"),timeseries:B8.array(B8.object({timestamp:B8.string(),calls:B8.number(),errors:B8.number(),errorRate:B8.number(),avg:B8.number(),p50:B8.number(),p95:B8.number(),inputTokens:B8.number().optional(),outputTokens:B8.number().optional(),totalTokens:B8.number().optional(),costUsd:B8.number().optional()})).optional().describe("Timeseries data points bucketed by interval")}),handler:async($,Z)=>{let X=X0(Z);if(await Z.access.check(),await pQ(),$.interval&&$.llmUsage)return Z.storage.monitoring.queryLlmUsageStats({organizationId:X.id,interval:$.interval,connectionId:$.connectionIds?.[0]??"decopilot",startDate:$.startDate?new Date($.startDate):void 0,endDate:$.endDate?new Date($.endDate):void 0,userIds:$.userIds,topN:$.topN});if($.interval){let Y=await Z.storage.monitoring.queryMetricTimeseries({organizationId:X.id,interval:$.interval,startDate:$.startDate?new Date($.startDate):void 0,endDate:$.endDate?new Date($.endDate):void 0,filters:{connectionIds:$.connectionIds,excludeConnectionIds:$.excludeConnectionIds,toolNames:$.toolNames,status:$.status}});if(!$.topN)return Y;let G=await Z.storage.monitoring.queryMetricTopToolsTimeseries({organizationId:X.id,interval:$.interval,startDate:$.startDate?new Date($.startDate):void 0,endDate:$.endDate?new Date($.endDate):void 0,topN:$.topN,filters:{connectionIds:$.connectionIds,excludeConnectionIds:$.excludeConnectionIds,toolNames:$.toolNames,status:$.status}});return{...Y,topTools:G.topTools,topToolsTimeseries:G.timeseries}}let Q=await Z.storage.monitoring.getStats({organizationId:X.id,startDate:$.startDate?new Date($.startDate):void 0,endDate:$.endDate?new Date($.endDate):void 0});return{...Q,errorRatePercent:(Q.errorRate*100).toFixed(2)}}})});import{z as jQ}from"zod";var b81;var iB8=L(()=>{u$();m0();b81=m({name:"MONITORING_THREAD_USAGE",description:"Aggregate LLM token usage and USD cost per thread for the given thread IDs.",annotations:{title:"Get Thread Usage",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:jQ.object({threadIds:jQ.array(jQ.string()).min(1).max(500).describe("Thread IDs to aggregate usage for (max 500)"),connectionId:jQ.string().optional().describe("LLM connection ID (defaults to 'decopilot')"),startDate:jQ.string().datetime().optional().describe("Filter by start date (ISO 8601 datetime string)"),endDate:jQ.string().datetime().optional().describe("Filter by end date (ISO 8601 datetime string)")}),outputSchema:jQ.object({items:jQ.array(jQ.object({threadId:jQ.string(),calls:jQ.number(),inputTokens:jQ.number(),outputTokens:jQ.number(),totalTokens:jQ.number(),costUsd:jQ.number()}))}),handler:async($,Z)=>{let X=X0(Z);return await Z.access.check(),await pQ(),{items:await Z.storage.monitoring.queryThreadUsage({organizationId:X.id,connectionId:$.connectionId??"decopilot",threadIds:$.threadIds,startDate:$.startDate?new Date($.startDate):void 0,endDate:$.endDate?new Date($.endDate):void 0})}}})});var pB8=L(()=>{cB8();lB8();dB8();mB8();iB8()});function UJ0($){return typeof $==="string"&&z24.has($.trim().toLowerCase())}var z24;var y81=L(()=>{z24=new Set([".well-known","_admin","api","auth","cli","commerce-onboarding","dbos-queue-depth","health","hosted-run-pending","login","mcp","metrics","oauth","oauth-proxy","onboarding","org","report","reset-password"])});import{z as zG}from"zod";var g81;var nB8=L(()=>{m0();y81();g81=m({name:"ORGANIZATION_CREATE",description:"Create a new organization. The caller becomes the owner automatically.",annotations:{title:"Create Organization",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!1,openWorldHint:!1},inputSchema:zG.object({slug:zG.string().min(1).max(50).regex(/^[a-z0-9-]+$/,"Slug must be lowercase alphanumeric with hyphens").refine(($)=>!UJ0($),"Slug is reserved by Studio"),name:zG.string().min(1).max(255),description:zG.string().optional()}),outputSchema:zG.object({id:zG.string(),name:zG.string(),slug:zG.string(),logo:zG.string().nullable().optional(),metadata:zG.any().optional(),createdAt:zG.string().datetime().describe("ISO 8601 timestamp"),members:zG.array(zG.any()).optional()}),handler:async($,Z)=>{G0(Z),await Z.access.check();let X=w1(Z);if(!X)throw Error("User ID required to create organization");let Q=await Z.boundAuth.organization.create({name:$.name,slug:$.slug,metadata:$.description?{description:$.description}:void 0,userId:X});if(!Q)throw Error("Failed to create organization");return{...Q,createdAt:Q.createdAt instanceof Date?Q.createdAt.toISOString():Q.createdAt}}})});import{z as jH}from"zod";var h81;var tB8=L(()=>{m0();h81=m({name:"ORGANIZATION_LIST",description:"List organizations the current user belongs to.",annotations:{title:"List Organizations",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},_meta:{ui:{visibility:"app"}},inputSchema:jH.object({}),outputSchema:jH.object({organizations:jH.array(jH.object({id:jH.string(),name:jH.string(),slug:jH.string(),logo:jH.string().nullable().optional(),metadata:jH.any().optional(),createdAt:jH.string().datetime().describe("ISO 8601 timestamp")}))}),handler:async($,Z)=>{if(G0(Z),await Z.access.check(),!w1(Z))throw Error("User ID required to list organizations");return{organizations:(await Z.boundAuth.organization.list()).map((Q)=>({...Q,createdAt:Q.createdAt instanceof Date?Q.createdAt.toISOString():Q.createdAt}))}}})});import{z as y3}from"zod";var u81;var oB8=L(()=>{m0();u81=m({name:"ORGANIZATION_GET",description:"Get an organization's details, members, and settings by slug or ID.",annotations:{title:"Get Organization",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:y3.object({}),outputSchema:y3.object({id:y3.string(),name:y3.string(),slug:y3.string(),logo:y3.string().nullable().optional(),metadata:y3.any().optional(),createdAt:y3.string().datetime().describe("ISO 8601 timestamp"),members:y3.array(y3.any()).optional(),invitations:y3.array(y3.any()).optional()}),handler:async($,Z)=>{G0(Z),await Z.access.check();let X=Z.organization?.id;if(!X)throw Error("Organization ID required (no active organization in context)");let Q=await Z.boundAuth.organization.get(X);if(!Q)throw Error("No active organization found");let Y=new Date,G=Q.invitations?.filter((J)=>new Date(J.expiresAt)>Y);return{...Q,invitations:G,createdAt:Q.createdAt instanceof Date?Q.createdAt.toISOString():Q.createdAt}}})});import{z as zK}from"zod";var c81;var rB8=L(()=>{m0();c81=m({name:"ORGANIZATION_UPDATE",description:"Update an organization's name or description.",annotations:{title:"Update Organization",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:zK.object({id:zK.string(),name:zK.string().min(1).max(255).optional(),description:zK.string().optional()}),outputSchema:zK.object({id:zK.string(),name:zK.string(),slug:zK.string(),logo:zK.string().nullable().optional(),metadata:zK.any().optional(),createdAt:zK.string().datetime().describe("ISO 8601 timestamp")}),handler:async($,Z)=>{G0(Z),await Z.access.check();let X={};if($.name)X.name=$.name;if($.description!==void 0)X.metadata={description:$.description};let Q=await Z.boundAuth.organization.update({organizationId:$.id,data:X});if(!Q)throw Error("Failed to update organization");return{...Q,createdAt:Q.createdAt instanceof Date?Q.createdAt.toISOString():Q.createdAt}}})});import{z as Hr}from"zod";var l81;var aB8=L(()=>{m0();l81=m({name:"ORGANIZATION_DELETE",description:"Archive an organization (soft delete).",annotations:{title:"Delete Organization",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:Hr.object({id:Hr.string()}),outputSchema:Hr.object({success:Hr.boolean(),id:Hr.string()}),handler:async($,Z)=>{return G0(Z),await Z.access.check(),await Z.boundAuth.organization.update({organizationId:$.id,data:{metadata:{archived:!0,archivedAt:new Date().toISOString()}}}),{success:!0,id:$.id}}})});import{z as hU}from"zod";var d81;var sB8=L(()=>{m0();DX();d81=m({name:"ORGANIZATION_SETTINGS_GET",description:"Get organization-level settings including sidebar configuration, store registry settings, simple model mode, and default home agents.",annotations:{title:"Get Organization Settings",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:hU.object({}),outputSchema:hU.object({organizationId:hU.string(),sidebar_items:hU.array(jo).nullable().optional(),enabled_plugins:hU.array(hU.string()).nullable().optional(),registry_config:zo.nullable().optional(),simple_mode:Po.nullable().optional(),default_home_agents:To.nullable().optional(),flags:Io.nullable().optional(),main_agent_id:hU.string().nullable().optional(),sprint_config:Ro.nullable().optional(),createdAt:hU.string().datetime().optional().describe("ISO 8601 timestamp"),updatedAt:hU.string().datetime().optional().describe("ISO 8601 timestamp")}),handler:async($,Z)=>{G0(Z),await Z.access.check();let X=Z.organization?.id;if(!X)throw Error("Organization ID required (no active organization in context)");let Q=await Z.storage.organizationSettings.get(X);if(!Q)return{organizationId:X};return{...Q,createdAt:Q.createdAt instanceof Date?Q.createdAt.toISOString():Q.createdAt,updatedAt:Q.updatedAt instanceof Date?Q.updatedAt.toISOString():Q.updatedAt}}})});import{z as UY}from"zod";var m81;var eB8=L(()=>{m0();DX();m81=m({name:"ORGANIZATION_SETTINGS_UPDATE",description:"Update organization-level settings such as sidebar configuration, store registry settings, simple model mode, and default home agents.",annotations:{title:"Update Organization Settings",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:UY.object({organizationId:UY.string(),sidebar_items:UY.array(jo).optional(),enabled_plugins:UY.array(UY.string()).optional(),registry_config:zo.optional(),simple_mode:Po.optional(),default_home_agents:To.optional(),flags:Io.strict().optional().describe("Org boolean toggles. Shallow-merged into the stored flags: keys you pass win (explicit false persists), omitted keys keep their value."),main_agent_id:UY.string().nullable().optional().describe("Virtual MCP id the org lands on instead of the Super Agent. Pass null to clear."),sprint_config:Ro.optional().describe("Task board sprint cadence. Replaced whole (not merged), so pass all three fields.")}),outputSchema:UY.object({organizationId:UY.string(),sidebar_items:UY.array(jo).nullable().optional(),enabled_plugins:UY.array(UY.string()).nullable().optional(),registry_config:zo.nullable().optional(),simple_mode:Po.nullable().optional(),default_home_agents:To.nullable().optional(),flags:Io.nullable().optional(),main_agent_id:UY.string().nullable().optional(),sprint_config:Ro.nullable().optional(),createdAt:UY.string().datetime().describe("ISO 8601 timestamp"),updatedAt:UY.string().datetime().describe("ISO 8601 timestamp")}),handler:async($,Z)=>{if(G0(Z),await Z.access.check(),X0(Z).id!==$.organizationId)throw Error("Cannot update settings for a different organization");let Q=await Z.storage.organizationSettings.upsert($.organizationId,{sidebar_items:$.sidebar_items,enabled_plugins:$.enabled_plugins,registry_config:$.registry_config,simple_mode:$.simple_mode,default_home_agents:$.default_home_agents,flags:$.flags,main_agent_id:$.main_agent_id,sprint_config:$.sprint_config});return{...Q,createdAt:Q.createdAt instanceof Date?Q.createdAt.toISOString():Q.createdAt,updatedAt:Q.updatedAt instanceof Date?Q.updatedAt.toISOString():Q.updatedAt}}})});import{z as PK}from"zod";var $O8,i81,p81;var ZO8=L(()=>{m0();DX();$O8=HL.extend({organizationId:PK.string(),archivedAt:PK.string().nullable().optional().describe("ISO 8601 timestamp"),createdAt:PK.string().describe("ISO 8601 timestamp"),updatedAt:PK.string().describe("ISO 8601 timestamp")}),i81=m({name:"BRAND_CONTEXT_LIST",description:"List all brand contexts (company profiles) for the current organization.",annotations:{title:"List Brand Contexts",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:PK.object({includeArchived:PK.boolean().optional().describe("Include archived brands in the list")}),outputSchema:PK.object({items:PK.array($O8)}),handler:async($,Z)=>{G0(Z),await Z.access.check();let X=Z.organization?.id;if(!X)throw Error("Organization ID required (no active organization in context)");return{items:(await Z.storage.brandContext.list(X,{includeArchived:$.includeArchived})).map((Y)=>({...Y,archivedAt:Y.archivedAt instanceof Date?Y.archivedAt.toISOString():Y.archivedAt,createdAt:Y.createdAt instanceof Date?Y.createdAt.toISOString():Y.createdAt,updatedAt:Y.updatedAt instanceof Date?Y.updatedAt.toISOString():Y.updatedAt}))}}}),p81=m({name:"BRAND_CONTEXT_GET",description:"Get a specific brand context by ID.",annotations:{title:"Get Brand Context",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:PK.object({id:PK.string().describe("Brand context ID")}),outputSchema:$O8.extend({organizationId:PK.string()}),handler:async($,Z)=>{G0(Z),await Z.access.check();let X=Z.organization?.id;if(!X)throw Error("Organization ID required (no active organization in context)");let Q=await Z.storage.brandContext.get($.id,X);if(!Q)throw Error("Brand context not found");return{...Q,archivedAt:Q.archivedAt instanceof Date?Q.archivedAt.toISOString():Q.archivedAt,createdAt:Q.createdAt instanceof Date?Q.createdAt.toISOString():Q.createdAt,updatedAt:Q.updatedAt instanceof Date?Q.updatedAt.toISOString():Q.updatedAt}}})});import{z as Kz}from"zod";var XO8,n81,t81,o81;var QO8=L(()=>{m0();DX();XO8=HL.extend({organizationId:Kz.string(),createdAt:Kz.string().describe("ISO 8601 timestamp"),updatedAt:Kz.string().describe("ISO 8601 timestamp")}),n81=m({name:"BRAND_CONTEXT_CREATE",description:"Create a new brand context (company profile) for the current organization.",annotations:{title:"Create Brand Context",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!1,openWorldHint:!1},inputSchema:HL.omit({id:!0}),outputSchema:XO8,handler:async($,Z)=>{G0(Z),await Z.access.check();let X=Z.organization?.id;if(!X)throw Error("Organization ID required (no active organization in context)");let Q=await Z.storage.brandContext.create(X,{name:$.name,domain:$.domain,overview:$.overview,logo:$.logo??null,favicon:$.favicon??null,ogImage:$.ogImage??null,fonts:$.fonts??null,colors:$.colors??null,images:$.images??null,metadata:$.metadata??null});return{...Q,archivedAt:Q.archivedAt instanceof Date?Q.archivedAt.toISOString():Q.archivedAt,createdAt:Q.createdAt instanceof Date?Q.createdAt.toISOString():Q.createdAt,updatedAt:Q.updatedAt instanceof Date?Q.updatedAt.toISOString():Q.updatedAt}}}),t81=m({name:"BRAND_CONTEXT_UPDATE",description:"Update an existing brand context by ID.",annotations:{title:"Update Brand Context",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:HL.partial().required({id:!0}),outputSchema:XO8,handler:async($,Z)=>{G0(Z),await Z.access.check();let X=Z.organization?.id;if(!X)throw Error("Organization ID required (no active organization in context)");if(!await Z.storage.brandContext.get($.id,X))throw Error("Brand context not found");let{id:Y,...G}=$;if(G.isDefault===!0)await Z.storage.brandContext.setDefault(Y,X);let J=await Z.storage.brandContext.update(Y,X,{name:G.name,domain:G.domain,overview:G.overview,logo:G.logo!==void 0?G.logo??null:void 0,favicon:G.favicon!==void 0?G.favicon??null:void 0,ogImage:G.ogImage!==void 0?G.ogImage??null:void 0,fonts:G.fonts!==void 0?G.fonts??null:void 0,colors:G.colors!==void 0?G.colors??null:void 0,images:G.images!==void 0?G.images??null:void 0,metadata:G.metadata!==void 0?G.metadata??null:void 0,archivedAt:G.archivedAt!==void 0?G.archivedAt??null:void 0,isDefault:G.isDefault===!1?!1:void 0});return{...J,archivedAt:J.archivedAt instanceof Date?J.archivedAt.toISOString():J.archivedAt,createdAt:J.createdAt instanceof Date?J.createdAt.toISOString():J.createdAt,updatedAt:J.updatedAt instanceof Date?J.updatedAt.toISOString():J.updatedAt}}}),o81=m({name:"BRAND_CONTEXT_DELETE",description:"Archive a brand context by ID (soft delete).",annotations:{title:"Archive Brand Context",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:Kz.object({id:Kz.string().describe("Brand context ID")}),outputSchema:Kz.object({success:Kz.boolean()}),handler:async($,Z)=>{G0(Z),await Z.access.check();let X=Z.organization?.id;if(!X)throw Error("Organization ID required (no active organization in context)");if(!await Z.storage.brandContext.get($.id,X))throw Error("Brand context not found");return await Z.storage.brandContext.update($.id,X,{archivedAt:new Date().toISOString(),isDefault:!1}),{success:!0}}})});async function NJ0($,Z,X){let Q=$.trim();if(!Q.startsWith("http"))Q=`https://${Q}`;let Y=await fetch("https://api.firecrawl.dev/v1/scrape",{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${Z}`},body:JSON.stringify({url:Q,formats:["branding"]})});if(!Y.ok){let N=await Y.text().catch(()=>"");throw Error(`Firecrawl API error: ${Y.status} ${N.slice(0,200)}`)}let G=await Y.json();if(!G.success||!G.data?.branding)return null;let J=G.data.branding,K=G.data.metadata??{},W=T24(J,K);return{name:K.title?.split(/[|\u2013\u2014]|\s+-\s+/).map((N)=>N.trim()).filter(Boolean)?.slice().sort((N,B)=>N.length-B.length)[0]??K.ogSiteName??X??$,domain:$,overview:K.description??"",logo:W.logo,favicon:W.favicon,ogImage:W.ogImage,fonts:W.fonts,colors:W.colors,images:null,metadata:Object.keys(W.metadata).length>0?W.metadata:null}}function T24($,Z){let X=$.images??{},Q=$.colors??{},Y={};for(let[F,U]of Object.entries(Q))if(typeof U==="string"&&U&&P24.has(F))Y[F]=U;let G={},K=($.typography??{}).fontFamilies??{};for(let[F,U]of Object.entries(K))if(typeof U==="string"&&U){let N=A24[F.toLowerCase()];if(N&&!G[N])G[N]=U}let W=$.fonts;if(Array.isArray(W))for(let F of W){let U=F.family;if(typeof U==="string"&&U&&!G.body)G.body=U}let H={};for(let F of["typography","components","spacing","layout","animations","icons","tone","personality","colorScheme"])if($[F]!==void 0)H[F]=$[F];return{logo:X.logo??null,favicon:X.favicon??null,ogImage:X.ogImage??Z.ogImage??null,fonts:Object.keys(G).length>0?G:null,colors:Object.keys(Y).length>0?Y:null,metadata:H}}var P24,A24;var r81=L(()=>{P24=new Set(["primary","secondary","accent","background","foreground"]),A24={heading:"heading",headings:"heading",head:"heading",title:"heading",body:"body",primary:"body",text:"body",code:"code",monospace:"code",mono:"code"}});import{z as BJ0}from"zod";var R24,a81;var YO8=L(()=>{m0();r81();DX();R24=HL.pick({id:!0,name:!0,domain:!0,overview:!0,logo:!0,favicon:!0,ogImage:!0,fonts:!0,colors:!0}).extend({success:BJ0.boolean()}),a81=m({name:"BRAND_CONTEXT_EXTRACT",description:"Extract brand context (colors, fonts, logos) from a website URL using Firecrawl.",annotations:{title:"Extract Brand Context",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!0},inputSchema:BJ0.object({domain:BJ0.string().describe("Website domain to extract brand from"),brandId:BJ0.string().optional().describe("Existing brand context ID to update (creates new if omitted)")}),outputSchema:R24,modelSummary:($)=>$.success?`Brand saved (id=${$.id}, name=${$.name}, domain=${$.domain}). The UI rendered the logo, colors, fonts, and overview.`:"Brand extraction failed.",handler:async($,Z)=>{G0(Z),await Z.access.check();let X=Z.organization?.id;if(!X)throw Error("Organization ID required (no active organization in context)");let Q=Z.firecrawlApiKey;if(!Q)throw Error("FIRECRAWL_API_KEY is not configured. Set the environment variable to enable brand extraction.");let Y=await NJ0($.domain,Q,$.domain);if(!Y)throw Error("Firecrawl did not return branding data for this URL");let G={name:Y.name,domain:Y.domain,overview:Y.overview,logo:Y.logo,favicon:Y.favicon,ogImage:Y.ogImage,fonts:Y.fonts,colors:Y.colors,images:Y.images,metadata:Y.metadata},J=$.brandId?await(async()=>{if(!await Z.storage.brandContext.get($.brandId,X))throw Error("Brand context not found");return Z.storage.brandContext.update($.brandId,X,G)})():await Z.storage.brandContext.create(X,G);return{id:J.id,name:J.name,domain:J.domain,overview:J.overview,logo:J.logo,favicon:J.favicon,ogImage:J.ogImage,fonts:J.fonts,colors:J.colors,success:!0}}})});function GO8($){let Z=$.metadata??{};return{id:$.id,name:$.name,domain:$.domain||void 0,colors:$.colors??void 0,fonts:$.fonts??void 0,assets:$.logo||$.favicon||$.ogImage?{logo:$.logo??void 0,favicon:$.favicon??void 0,ogImage:$.ogImage??void 0}:void 0,overview:$.overview||void 0,tagline:typeof Z.tagline==="string"?Z.tagline:void 0,tone:typeof Z.tone==="string"?Z.tone:void 0,metadata:(()=>{let X=Object.fromEntries(Object.entries(Z).filter(([Q])=>Q!=="tagline"&&Q!=="tone"));return Object.keys(X).length>0?X:void 0})()}}var s81,e81;var JO8=L(()=>{$81();m0();s81=m({name:"BRAND_GET",description:"Get a brand context by ID. Omit the ID to get the default brand for the organization.",annotations:{title:"Get Brand",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:m30,outputSchema:ro,handler:async($,Z)=>{G0(Z),await Z.access.check();let X=Z.organization?.id;if(!X)throw Error("Organization ID required (no active organization in context)");let Q=$.id?await Z.storage.brandContext.get($.id,X):await Z.storage.brandContext.getDefault(X);if(!Q)throw Error($.id?"Brand not found":"No default brand configured");return GO8(Q)}}),e81=m({name:"BRAND_LIST",description:"List all active brands for the current organization.",annotations:{title:"List Brands",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:i30,outputSchema:p30,handler:async($,Z)=>{G0(Z),await Z.access.check();let X=Z.organization?.id;if(!X)throw Error("Organization ID required (no active organization in context)");return{items:(await Z.storage.brandContext.list(X)).map(GO8)}}})});import{resolveTxt as I24}from"dns/promises";function $61($){return`${q24}.${$.toLowerCase()}`}function KO8(){return`deco-verify-${crypto.randomUUID().replace(/-/g,"")}`}async function WO8($,Z,X=I24){if(!Z)return!1;try{return(await X($61($))).some((Y)=>Y.join("").trim()===Z)}catch{return!1}}var q24="_deco-verify";var HO8=()=>{};import{z as l5}from"zod";function ML($){let Z=$.verificationStatus==="pending"&&Boolean($.verificationToken);return{id:$.id,domain:$.domain,joinMode:$.joinMode,verificationStatus:$.verificationStatus,verificationMethod:$.verificationMethod,verifiedAt:$.verifiedAt?new Date($.verifiedAt).toISOString():null,recordName:Z?$61($.domain):null,recordValue:Z?$.verificationToken:null}}function V24($){let Z=$.toLowerCase().trim();if(!M24.test(Z))throw Error(`Invalid domain format: "${Z}". Must be a valid domain like "acme.com"`);if(AK.has(Z))throw Error(`Cannot claim generic email domain "${Z}". Only corporate domains are allowed.`);return Z}var M24,Z61,OJ0,X61,Q61,Y61,G61,J61;var FO8=L(()=>{PG();HO8();m0();M24=/^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+$/,Z61=l5.enum(["off","auto","request"]),OJ0=l5.object({id:l5.string(),domain:l5.string(),joinMode:Z61,verificationStatus:l5.enum(["pending","verified"]),verificationMethod:l5.enum(["email","dns"]).nullable(),verifiedAt:l5.string().nullable(),recordName:l5.string().nullable(),recordValue:l5.string().nullable()});X61=m({name:"ORGANIZATION_DOMAIN_LIST",description:"List the email domains claimed by an organization.",annotations:{title:"List Organization Domains",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:l5.object({}),outputSchema:l5.object({domains:l5.array(OJ0)}),handler:async($,Z)=>{G0(Z),await Z.access.check();let X=X0(Z);return{domains:(await Z.storage.organizationDomains.listByOrganizationId(X.id)).map(ML)}}}),Q61=m({name:"ORGANIZATION_DOMAIN_ADD",description:"Claim an email domain for an organization. If the caller's verified email matches the domain it is trusted immediately; otherwise it requires DNS verification.",annotations:{title:"Add Organization Domain",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:l5.object({domain:l5.string().min(1).max(255).describe("Domain to claim, e.g. acme.com"),joinMode:Z61.optional().describe("Initial join mode (only applied when the domain is trusted immediately via email match).")}),outputSchema:OJ0,handler:async($,Z)=>{G0(Z),await Z.access.check();let X=X0(Z),Q=V24($.domain),G=Z.auth.user?.email?.split("@")[1]?.toLowerCase(),J=Boolean(Z.auth.user?.emailVerified)&&G===Q,K=await Z.storage.organizationDomains.getByOrgAndDomain(X.id,Q);if(K){if(K.verificationStatus!=="verified"&&J){let H=await Z.storage.organizationDomains.markVerified(K.id,"email");return ML(H)}return ML(K)}let W=J?await Z.storage.organizationDomains.add(X.id,Q,{joinMode:$.joinMode??"off",verificationStatus:"verified",verificationMethod:"email"}):await Z.storage.organizationDomains.add(X.id,Q,{joinMode:"off",verificationStatus:"pending",verificationToken:KO8()});return ML(W)}}),Y61=m({name:"ORGANIZATION_DOMAIN_UPDATE",description:"Set the join mode for a claimed domain. Discoverable modes (auto/request) require the domain to be verified.",annotations:{title:"Update Organization Domain",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:l5.object({id:l5.string(),joinMode:Z61}),outputSchema:OJ0,handler:async($,Z)=>{G0(Z),await Z.access.check();let X=X0(Z),Q=await Z.storage.organizationDomains.getById($.id);if(!Q||Q.organizationId!==X.id)throw Error("Domain not found");if($.joinMode!=="off"&&Q.verificationStatus!=="verified")throw Error("Verify the domain before enabling auto-join or requests.");let Y=await Z.storage.organizationDomains.updateJoinMode($.id,$.joinMode);return ML(Y)}}),G61=m({name:"ORGANIZATION_DOMAIN_VERIFY",description:"Check the DNS TXT record for a pending domain and mark it verified if present.",annotations:{title:"Verify Organization Domain",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!0},inputSchema:l5.object({id:l5.string()}),outputSchema:l5.object({verified:l5.boolean(),domain:OJ0}),handler:async($,Z)=>{G0(Z),await Z.access.check();let X=X0(Z),Q=await Z.storage.organizationDomains.getById($.id);if(!Q||Q.organizationId!==X.id)throw Error("Domain not found");if(Q.verificationStatus==="verified")return{verified:!0,domain:ML(Q)};if(!Q.verificationToken)throw Error("Domain has no pending DNS verification.");if(!await WO8(Q.domain,Q.verificationToken))return{verified:!1,domain:ML(Q)};let G=await Z.storage.organizationDomains.markVerified($.id,"dns");return{verified:!0,domain:ML(G)}}}),J61=m({name:"ORGANIZATION_DOMAIN_REMOVE",description:"Remove a claimed domain from an organization.",annotations:{title:"Remove Organization Domain",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:l5.object({id:l5.string()}),outputSchema:l5.object({success:l5.boolean()}),handler:async($,Z)=>{G0(Z),await Z.access.check();let X=X0(Z),Q=await Z.storage.organizationDomains.getById($.id);if(!Q||Q.organizationId!==X.id)throw Error("Domain not found");return await Z.storage.organizationDomains.removeById($.id),{success:!0}}})});function VL($){return($ instanceof Error?$.message.toLowerCase():"").includes("already a member")}import{z as h9}from"zod";var k24,K61,W61,H61;var UO8=L(()=>{m0();l4();k24=h9.object({id:h9.string(),userId:h9.string(),status:h9.enum(["pending","approved","denied"]),createdAt:h9.string(),user:h9.object({id:h9.string(),name:h9.string(),email:h9.string(),image:h9.string().nullable()}).nullable()}),K61=m({name:"ORGANIZATION_JOIN_REQUEST_LIST",description:"List pending requests to join the organization.",annotations:{title:"List Join Requests",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:h9.object({}),outputSchema:h9.object({requests:h9.array(k24)}),handler:async($,Z)=>{G0(Z),await Z.access.check();let X=X0(Z);return{requests:(await Z.storage.organizationJoinRequests.listPendingWithUser(X.id)).map((Y)=>({id:Y.id,userId:Y.userId,status:Y.status,createdAt:new Date(Y.createdAt).toISOString(),user:Y.user}))}}}),W61=m({name:"ORGANIZATION_JOIN_REQUEST_APPROVE",description:"Approve a pending join request, adding the user as a member.",annotations:{title:"Approve Join Request",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:h9.object({requestId:h9.string()}),outputSchema:h9.object({success:h9.boolean()}),handler:async($,Z)=>{G0(Z),await Z.access.check();let X=X0(Z),Q=await Z.storage.organizationJoinRequests.getById($.requestId);if(!Q||Q.organizationId!==X.id)throw Error("Join request not found");if(Q.status!=="pending")throw Error("Join request has already been decided");let Y=w1(Z);if(!await Z.storage.organizationJoinRequests.decide(Q.id,"approved",Y??Q.userId))return{success:!0};try{await Z.boundAuth.organization.addMember({organizationId:X.id,userId:Q.userId,role:["user"]})}catch(J){if(!VL(J))throw J}if(Y)p1.capture({distinctId:Y,event:"organization_join_request_approved",groups:{organization:X.id},properties:{organization_id:X.id,user_id:Q.userId}});return{success:!0}}}),H61=m({name:"ORGANIZATION_JOIN_REQUEST_DENY",description:"Deny a pending join request.",annotations:{title:"Deny Join Request",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:h9.object({requestId:h9.string()}),outputSchema:h9.object({success:h9.boolean()}),handler:async($,Z)=>{G0(Z),await Z.access.check();let X=X0(Z),Q=await Z.storage.organizationJoinRequests.getById($.requestId);if(!Q||Q.organizationId!==X.id)throw Error("Join request not found");if(Q.status!=="pending")throw Error("Join request has already been decided");let Y=w1(Z);if(await Z.storage.organizationJoinRequests.decide(Q.id,"denied",Y??Q.userId)&&Y)p1.capture({distinctId:Y,event:"organization_join_request_denied",groups:{organization:X.id},properties:{organization_id:X.id,user_id:Q.userId}});return{success:!0}}})});import{z as NY}from"zod";var F61;var NO8=L(()=>{l4();m0();KY();F61=m({name:"ORGANIZATION_MEMBER_ADD",description:"Invite a member to the organization by email with an assigned role.",annotations:{title:"Add Organization Member",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:NY.object({organizationId:NY.string().optional(),userId:NY.string(),role:NY.array(NY.string())}),outputSchema:NY.object({id:NY.string(),organizationId:NY.string(),userId:NY.string(),role:NY.union([NY.string(),NY.array(NY.string())]),createdAt:NY.string().datetime().describe("ISO 8601 timestamp")}),handler:async($,Z)=>{G0(Z),await Z.access.check();let X=$.organizationId||Z.organization?.id;if(!X)throw Error("Organization ID required (no active organization in context)");if(X!==Z.organization?.id)throw Error("Organization ID does not match authenticated organization");let Q=await Z.db.selectFrom("member").select(["role"]).where("userId","=",w1(Z)??"").where("organizationId","=",X).executeTakeFirst();if(!PG0(Q?.role,$.role))throw Error(`Insufficient privileges to assign role "${$.role.join(",")}"`);let Y=await Z.boundAuth.organization.addMember({organizationId:X,userId:$.userId,role:$.role});if(!Y)throw Error("Failed to add member");let G=w1(Z);if(G)p1.capture({distinctId:G,event:"organization_member_added",groups:{organization:X},properties:{organization_id:X,added_user_id:$.userId,role:$.role}});return{...Y,role:Y.role,createdAt:Y.createdAt instanceof Date?Y.createdAt.toISOString():Y.createdAt}}})});import{z as uh}from"zod";var U61;var BO8=L(()=>{l4();m0();U61=m({name:"ORGANIZATION_MEMBER_REMOVE",description:"Remove a member from the organization. Revokes all their access immediately.",annotations:{title:"Remove Organization Member",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:uh.object({organizationId:uh.string().optional(),memberIdOrEmail:uh.string()}),outputSchema:uh.object({success:uh.boolean(),memberIdOrEmail:uh.string()}),handler:async($,Z)=>{G0(Z),await Z.access.check();let X=$.organizationId||Z.organization?.id;if(!X)throw Error("Organization ID required (no active organization in context)");if(X!==Z.organization?.id)throw Error("Organization ID does not match authenticated organization");let Q=await Z.boundAuth.organization.removeMember({organizationId:X,memberIdOrEmail:$.memberIdOrEmail});Z.invalidateMemberRole?.(Q.member.userId,X);let Y=w1(Z);if(Y)p1.capture({distinctId:Y,event:"organization_member_removed",groups:{organization:X},properties:{organization_id:X,member_id_or_email:$.memberIdOrEmail}});return{success:!0,memberIdOrEmail:$.memberIdOrEmail}}})});import{z as zX}from"zod";var N61;var OO8=L(()=>{m0();N61=m({name:"ORGANIZATION_MEMBER_LIST",description:"List all members in the organization with their roles.",annotations:{title:"List Organization Members",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:zX.object({limit:zX.number().int().min(1).max(1000).optional(),offset:zX.number().int().min(0).optional()}),outputSchema:zX.object({members:zX.array(zX.object({id:zX.string(),organizationId:zX.string(),userId:zX.string(),role:zX.string(),createdAt:zX.string().datetime().describe("ISO 8601 timestamp"),user:zX.object({id:zX.string(),name:zX.string(),email:zX.string(),image:zX.string().optional()}).optional()}))}),handler:async($,Z)=>{G0(Z),await Z.access.check();let X=Z.organization?.id;if(!X)throw Error("Organization ID required (no active organization in context)");return{members:((await Z.boundAuth.organization.listMembers({organizationId:X,limit:$.limit,offset:$.offset}))?.members??[]).map((G)=>({...G,createdAt:G.createdAt instanceof Date?G.createdAt.toISOString():G.createdAt}))}}})});import{z as Z7}from"zod";var B61;var LO8=L(()=>{l4();m0();KY();B61=m({name:"ORGANIZATION_MEMBER_UPDATE_ROLE",description:"Change a member's role (e.g., admin, member) within the organization.",annotations:{title:"Update Member Role",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:Z7.object({organizationId:Z7.string().optional(),memberId:Z7.string(),role:Z7.array(Z7.string())}),outputSchema:Z7.object({id:Z7.string(),organizationId:Z7.string(),userId:Z7.string(),role:Z7.union([Z7.string(),Z7.array(Z7.string())]),createdAt:Z7.string().datetime().describe("ISO 8601 timestamp"),user:Z7.object({email:Z7.string(),name:Z7.string(),image:Z7.string().optional()})}),handler:async($,Z)=>{G0(Z),await Z.access.check();let X=$.organizationId||Z.organization?.id;if(!X)throw Error("Organization ID required (no active organization in context)");let Q=await Z.db.selectFrom("member").select(["role"]).where("userId","=",w1(Z)??"").where("organizationId","=",X).executeTakeFirst();if(!PG0(Q?.role,$.role))throw Error(`Insufficient privileges to assign role "${$.role.join(",")}"`);let Y=await Z.boundAuth.organization.updateMemberRole({organizationId:X,memberId:$.memberId,role:$.role});if(!Y)throw Error("Failed to update member role");Z.invalidateMemberRole?.(Y.userId,X);let G=w1(Z);if(G)p1.capture({distinctId:G,event:"organization_member_role_updated",groups:{organization:X},properties:{organization_id:X,member_id:$.memberId,target_user_id:Y.userId,new_role:Array.isArray($.role)?$.role.join(","):$.role}});return{...Y,createdAt:Y.createdAt instanceof Date?Y.createdAt.toISOString():Y.createdAt}}})});async function wO8(){if(Fr&&Date.now()-Fr.fetchedAt<600000)return Fr.rate;try{let Z=await(await fetch("https://economia.awesomeapi.com.br/json/last/USD-BRL",{signal:AbortSignal.timeout(5000)})).json(),X=parseFloat(Z.USDBRL?.bid??"");if(Number.isNaN(X)||X<=0)throw Error("Invalid rate");return Fr={rate:X,fetchedAt:Date.now()},X}catch{return Fr?.rate??5.5}}function DO8($,Z,X){if(Z==="brl")return Math.round($/X);return $}var Fr=null;function O61($,Z="",X=new URLSearchParams){for(let[Q,Y]of Object.entries($)){if(Y===void 0||Y===null)continue;let G=Z?`${Z}[${Q}]`:Q;if(Array.isArray(Y))Y.forEach((J,K)=>{if(typeof J==="object"&&J!==null)O61(J,`${G}[${K}]`,X);else X.append(`${G}[${K}]`,String(J))});else if(typeof Y==="object")O61(Y,G,X);else X.append(G,String(Y))}return X}async function Ur($,Z){let X=o0().stripeSecretKey;if(!X)throw new AG(503,"billing is not configured");let Q=Z?.params?O61(Z.params).toString():void 0,Y=await fetch(`${S24}${$}`,{method:Z?.method??(Q?"POST":"GET"),headers:{Authorization:`Bearer ${X}`,...Q&&{"Content-Type":"application/x-www-form-urlencoded"}},body:Q,signal:AbortSignal.timeout(C24)}),G=await Y.json().catch(()=>({}));if(!Y.ok){let J=G.error?.message??`HTTP ${Y.status}`;throw new AG(Y.status,J)}return G}function EO8($){return{billing_address_collection:"required",tax_id_collection:{enabled:!0},...$&&{customer_update:{address:"auto",name:"auto"}}}}async function jO8($){let Z=o0().stripeOrgPriceId;if(!Z)throw new AG(503,"billing is not configured");let X=await Ur("/checkout/sessions",{params:{mode:"subscription",...EO8(null),line_items:[{price:Z,quantity:1}],success_url:$.successUrl,cancel_url:$.cancelUrl,metadata:{orgId:$.organizationId},subscription_data:{metadata:{orgId:$.organizationId}}}});if(!X.url)throw new AG(500,"checkout session lacks url");return{url:X.url}}function _24($,Z){return Math.round($*(1+Z/100))}async function zO8($){let Z=_24($.amountCents,$.feePercent),X=DO8($.amountCents,$.currency,await wO8()),Q=o0().stripeTopupProductId,Y={kind:"topup",orgId:$.organizationId,creditCents:X},G=$.currency==="brl"?`Studio AI credits (R$ ${($.amountCents/100).toFixed(2)})`:`Studio AI credits ($${($.amountCents/100).toFixed(2)})`,J=await Ur("/checkout/sessions",{params:{mode:"payment",...$.customerId&&{customer:$.customerId},...EO8($.customerId),line_items:[{quantity:1,price_data:{currency:$.currency,unit_amount:Z,...Q?{product:Q}:{product_data:{name:G}}}}],success_url:$.successUrl,cancel_url:$.cancelUrl,metadata:Y,payment_intent_data:{metadata:Y}}});if(!J.url)throw new AG(500,"checkout session lacks url");return{url:J.url}}async function LJ0($){let Z=await Ur("/billing_portal/sessions",{params:{customer:$.customerId,return_url:$.returnUrl}});if(!Z.url)throw new AG(500,"portal session lacks url");return{url:Z.url}}async function wJ0($){return Ur(`/subscriptions/${encodeURIComponent($)}`)}async function PO8($){await Ur(`/subscriptions/${encodeURIComponent($)}`,{method:"DELETE"})}var S24="https://api.stripe.com/v1",AG,C24=15000;var Wz=L(()=>{_8();AG=class AG extends Error{status;constructor($,Z){super(`Stripe API ${$}: ${Z}`);this.status=$;this.name="StripeApiError"}}});import{z as L61}from"zod";var w61;var AO8=L(()=>{Wz();L9();m0();l4();w61=m({name:"ORGANIZATION_BILLING_CHECKOUT_START",description:"Start the organization's subscription: creates a Stripe Checkout session and returns its URL.",annotations:{title:"Start Billing Checkout",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!1,openWorldHint:!0},inputSchema:L61.object({}),outputSchema:L61.object({url:L61.string()}),handler:async($,Z)=>{G0(Z),await Z.access.check();let X=Z.organization?.id,Q=Z.organization?.slug;if(!X||!Q)throw Error("Organization context required");let Y=await Z.storage.organizationBilling.getBilling(X);if(Y?.status==="active")throw Error("This organization already has an active subscription.");if(Y?.stripeSubscriptionId)throw Error("This organization still has a subscription on file \u2014 settle or cancel it before starting a new checkout.");let G=`${s9()}/${encodeURIComponent(Q)}/members`,{url:J}=await jO8({organizationId:X,successUrl:`${G}?checkout=success`,cancelUrl:`${G}?checkout=canceled`});return wG({event:"subscription_checkout_started",organizationId:X,...Z.auth?.user?.id?{userId:Z.auth.user.id}:{}}),{url:J}}})});import{z as D61}from"zod";var E61;var TO8=L(()=>{Wz();L9();m0();E61=m({name:"ORGANIZATION_BILLING_PORTAL",description:"Open the organization's Stripe billing portal (manage card, invoices, cancellation). Returns the portal URL.",annotations:{title:"Open Billing Portal",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!1,openWorldHint:!0},inputSchema:D61.object({}),outputSchema:D61.object({url:D61.string()}),handler:async($,Z)=>{G0(Z),await Z.access.check();let X=X0(Z);if(!X.slug)throw Error("Organization context required");let Q=await Z.storage.organizationBilling.getBilling(X.id);if(!Q?.stripeCustomerId)throw Error("This organization has no billing account yet \u2014 subscribe first.");try{return await LJ0({customerId:Q.stripeCustomerId,returnUrl:`${s9()}/${encodeURIComponent(X.slug)}/members`})}catch(Y){if(Y instanceof AG)throw Error(Y.message);throw Y}}})});function DJ0($){return j61[$%j61.length]??v24}function BY($){return $.createdBy==="system"}function uU($){return EJ0.filter((Z)=>Rh($,x24[Z]))}function lh($,Z){return $?.startsWith(`${ch[Z]}:`)??!1}function cU($){let Z=0;for(let X of $){if(X.action!=="status_changed")continue;if(X.data?.to!=="in_review")continue;Z=Math.max(Z,new Date(X.occurredAt).getTime())}return Z}function z61($,Z){let X=cU($),Q=new Map;for(let Y of $){if(Y.action!=="review_approved"&&Y.action!=="review_changes_requested")continue;if(new Date(Y.occurredAt).getTime()<X)continue;let G=Y.data??{};if(G.reviewer!=="qa"&&G.reviewer!=="code_review")continue;if(Y.action==="review_approved"){if(Z?.verifiedOnly&&G.verified!==!0)continue;Q.set(G.reviewer,"approved")}else Q.set(G.reviewer,"changes_requested")}return Q}function kL($,Z,X){if(Z.length===0)return!1;let Q=z61($,X);return Z.every((Y)=>Q.get(Y)==="approved")}function IO8($,Z){return kL($,Z)&&!kL($,Z,{verifiedOnly:!0})}function qO8($){let Z=null;for(let X of $){if(X.action!=="review_approved"&&X.action!=="review_changes_requested")continue;let Q=new Date(X.occurredAt).getTime();if(Z&&Q<Z.at)continue;let Y=X.data?.notes;Z={at:Q,notes:X.action==="review_changes_requested"&&typeof Y==="string"?Y:null}}return Z?.notes??null}function f24($){let Z=0;for(let X of $){if(X.action!=="assignee_changed")continue;if(X.data?.to!==_6)continue;Z=Math.max(Z,new Date(X.occurredAt).getTime())}return Z}function MO8($,Z=P61){let X=f24($),Q=new Set,Y=0;for(let G of[...$].sort((J,K)=>J.occurredAt.localeCompare(K.occurredAt))){let J=new Date(G.occurredAt).getTime();if(G.action==="status_changed"){if(G.data?.to==="in_review")Y=J;continue}if(G.action==="review_changes_requested"&&J>=X)Q.add(Y)}return Q.size+1>=Z}var _6="super-agent",j61,v24,Nr='Your checkout is SHALLOW (`git clone --depth 1`), so it has no merge base and `git diff main...HEAD` (three dots) fails with "fatal: main...HEAD: no merge base". To see a branch diff, either use the two-dot form against the fetched remote ref (`git fetch origin <base> && git diff origin/<base> HEAD`), or deepen first with `git fetch --deepen=100`. Same for `git log main..HEAD` and anything else that needs shared history.',RO8,EJ0,ch,x24,P61=5,VO8="task-board.item.updated",kO8="task-board.item.deleted";var P9=L(()=>{DX();j61=["#9ca3af","#ef4444","#f97316","#f59e0b","#22c55e","#3b82f6","#a855f7","#ec4899"],v24=j61[0];RO8="Read the diff with `gh pr diff <number>`. It comes from the API, so it needs no fetch, no merge base, and is unaffected by the shallow checkout. "+"Read it ONCE \u2014 `gh pr diff <number> --name-only` first if you need to size "+"it, then pull the hunks you need per FILE. Do NOT re-run the diff sliced by directory: each slice re-reads bytes you already have into every remaining turn's context, and it is the largest avoidable cost in a review.",EJ0=["qa","code_review"],ch={qa:"QA Agent",code_review:"Code Reviewer"},x24={qa:"qa_agent_enabled",code_review:"code_reviewer_enabled"}});function A61($){return $==="trial"?"trial":"subscription"}function Br($,Z,X,Q={}){wG({event:Z,organizationId:X.organizationId,...$.auth?.user?.id?{userId:$.auth.user.id}:{},properties:{task_id:X.id,...Q}})}function T61($){return $?.status==="active"||$?.status==="past_due"}function jJ0($,Z){if(T61($))return{periodKey:$?.currentPeriodEnd?`sub:${$.currentPeriodEnd.toISOString()}`:"sub:pending",limit:$?.monthlyTaskExecutions??Z.monthlyTaskExecutions,exhaustedReason:"monthly_exhausted"};return{periodKey:"trial",limit:$?.freeTaskExecutions??Z.freeTaskExecutions,exhaustedReason:"trial_exhausted"}}function Or(){let $=o0();return{enforced:$.taskQuotaEnforced,freeTaskExecutions:$.freeTaskExecutions,monthlyTaskExecutions:$.monthlyTaskExecutions,maxRunsPerTask:$.maxRunsPerTask}}function SL(){return{...Or(),maxRunsPerTask:Number.POSITIVE_INFINITY}}async function dh($,Z,X=Or()){if(!X.enforced||!BY(Z))return;let Q=await $.storage.organizationBilling.taskClaim(Z.id);if(Q&&Q.runCount>=X.maxRunsPerTask)throw Br($,"task_quota_blocked",Z,{phase:"precheck",reason:"runs_exhausted"}),new PX("runs_exhausted");if(Q&&Q.state!=="released")return;let Y=await $.storage.organizationBilling.getBilling(Z.organizationId),G=jJ0(Y,X);if(await $.storage.organizationBilling.countTaskClaims(Z.organizationId,G.periodKey)>=G.limit)throw Br($,"task_quota_blocked",Z,{phase:"precheck",reason:G.exhaustedReason,billing_mode:A61(G.periodKey),limit:G.limit}),new PX(G.exhaustedReason)}async function SO8($,Z,X=Or()){if(!X.enforced||!BY(Z))return"skipped";let Q=await $.storage.organizationBilling.getBilling(Z.organizationId),Y=jJ0(Q,X),G=await $.storage.organizationBilling.claimTaskUnderLimit(Z.organizationId,Z.id,Y.periodKey,Y.limit,X.maxRunsPerTask);if(G==="exhausted")throw Br($,"task_quota_blocked",Z,{phase:"claim",reason:Y.exhaustedReason,billing_mode:A61(Y.periodKey),limit:Y.limit}),new PX(Y.exhaustedReason);if(G==="runs_exhausted")throw Br($,"task_quota_blocked",Z,{phase:"claim",reason:"runs_exhausted"}),new PX("runs_exhausted");if(G==="claimed")Br($,"task_quota_claimed",Z,{billing_mode:A61(Y.periodKey),period_key:Y.periodKey,limit:Y.limit});return G}async function CO8($,Z,X,Q){if(Q==="skipped")return;await $.rollbackTaskClaim(Z,X,{releaseSlot:Q==="claimed"}).catch((Y)=>console.error("[task-quota] rollback failed (stays charged)",Y))}async function _O8($,Z){let X=await $.storage.organizationBilling.taskClaim(Z);return!!X&&X.state!=="released"}async function vO8($,Z,X){if(await $.releaseTaskClaim(Z,X).catch((Y)=>{return console.error("[task-quota] refund failed (stays charged)",Y),!1}))wG({event:"task_quota_refunded",organizationId:Z,properties:{task_id:X}})}var b24="[SUBSCRIPTION_REQUIRED]",y24,PX;var g3=L(()=>{P9();l4();_8();y24={trial_exhausted:"this organization used its free task executions \u2014 subscribe to keep running tasks",monthly_exhausted:"this organization used its monthly task executions \u2014 more become available next billing cycle",runs_exhausted:"this task reached its execution limit \u2014 create a new task to keep going"};PX=class PX extends Error{reason;constructor($){super(`${b24} ${y24[$]}`);this.reason=$;this.name="TaskQuotaError"}}});import{z as lU}from"zod";var R61;var xO8=L(()=>{m0();g3();R61=m({name:"ORGANIZATION_TASK_QUOTA_GET",description:"Get the organization's auto-task quota: how many runs are used in the current period, the limit, and the subscription's billing status.",annotations:{title:"Get Task Quota",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:lU.object({}),outputSchema:lU.object({enforced:lU.boolean(),billingStatus:lU.string(),subscribed:lU.boolean(),hasBillingAccount:lU.boolean(),used:lU.number(),limit:lU.number(),currentPeriodEnd:lU.string().datetime().nullable()}),handler:async($,Z)=>{G0(Z),await Z.access.check();let X=X0(Z),Q=Or(),Y=await Z.storage.organizationBilling.getBilling(X.id),G=jJ0(Y,Q),J=await Z.storage.organizationBilling.countTaskClaims(X.id,G.periodKey);return{enforced:Q.enforced,billingStatus:Y?.status??"none",subscribed:T61(Y),hasBillingAccount:!!Y?.stripeCustomerId,used:J,limit:G.limit,currentPeriodEnd:Y?.currentPeriodEnd?.toISOString()??null}}})});var fO8=L(()=>{nB8();tB8();oB8();rB8();aB8();sB8();eB8();ZO8();QO8();YO8();JO8();FO8();UO8();NO8();BO8();OO8();LO8();AO8();TO8();xO8()});function zH($){if($==null)return"unknown error";if(typeof $==="string")return $;if($ instanceof Error)return $.message;return JSON.stringify($)}function zJ0($){if($===null||typeof $==="string"||typeof $==="number"||typeof $==="boolean")return!0;if(Array.isArray($))return $.every(zJ0);if(typeof $==="object")return Object.entries($).every(([Z,X])=>typeof Z==="string"&&(X===void 0||zJ0(X)));return!1}function I61($){return Array.isArray($)&&$.every(zJ0)}function Lr($){return $!=null&&typeof $==="object"&&Object.entries($).every(([Z,X])=>typeof Z==="string"&&(X===void 0||zJ0(X)))}var FL8="vercel.ai.error",h24,bO8,yO8,E1,UL8="AI_APICallError",NL8,u24,gO8,hO8,D4,BL8="AI_EmptyResponseBodyError",OL8,c24,uO8,cO8,PJ0,LL8="AI_InvalidArgumentError",wL8,l24,lO8,dO8,CL,DL8="AI_InvalidPromptError",EL8,d24,mO8,iO8,h3,jL8="AI_InvalidResponseDataError",zL8,m24,pO8,nO8,mh,PL8="AI_JSONParseError",AL8,i24,tO8,oO8,dU,TL8="AI_LoadAPIKeyError",RL8,p24,rO8,aO8,Hz,IL8="AI_LoadSettingError",qL8,n24,sO8,eO8,ML8,VL8="AI_NoContentGeneratedError",kL8,t24,$L8,ZL8,SL8,CL8="AI_NoSuchModelError",_L8,o24,XL8,QL8,Z9,vL8="AI_TooManyEmbeddingValuesForCallError",xL8,r24,YL8,GL8,ih,fL8="AI_TypeValidationError",bL8,a24,JL8,KL8,V5,yL8="AI_UnsupportedFunctionalityError",gL8,s24,WL8,HL8,m4;var Y8=L(()=>{h24=Symbol.for(FL8),E1=class $ extends(yO8=Error,bO8=h24,yO8){constructor({name:Z,message:X,cause:Q}){super(X);this[bO8]=!0,this.name=Z,this.cause=Q}static isInstance(Z){return $.hasMarker(Z,FL8)}static hasMarker(Z,X){let Q=Symbol.for(X);return Z!=null&&typeof Z==="object"&&Q in Z&&typeof Z[Q]==="boolean"&&Z[Q]===!0}},NL8=`vercel.ai.error.${UL8}`,u24=Symbol.for(NL8),D4=class extends(hO8=E1,gO8=u24,hO8){constructor({message:$,url:Z,requestBodyValues:X,statusCode:Q,responseHeaders:Y,responseBody:G,cause:J,isRetryable:K=Q!=null&&(Q===408||Q===409||Q===429||Q>=500),data:W}){super({name:UL8,message:$,cause:J});this[gO8]=!0,this.url=Z,this.requestBodyValues=X,this.statusCode=Q,this.responseHeaders=Y,this.responseBody=G,this.isRetryable=K,this.data=W}static isInstance($){return E1.hasMarker($,NL8)}},OL8=`vercel.ai.error.${BL8}`,c24=Symbol.for(OL8),PJ0=class extends(cO8=E1,uO8=c24,cO8){constructor({message:$="Empty response body"}={}){super({name:BL8,message:$});this[uO8]=!0}static isInstance($){return E1.hasMarker($,OL8)}};wL8=`vercel.ai.error.${LL8}`,l24=Symbol.for(wL8),CL=class extends(dO8=E1,lO8=l24,dO8){constructor({message:$,cause:Z,argument:X}){super({name:LL8,message:$,cause:Z});this[lO8]=!0,this.argument=X}static isInstance($){return E1.hasMarker($,wL8)}},EL8=`vercel.ai.error.${DL8}`,d24=Symbol.for(EL8),h3=class extends(iO8=E1,mO8=d24,iO8){constructor({prompt:$,message:Z,cause:X}){super({name:DL8,message:`Invalid prompt: ${Z}`,cause:X});this[mO8]=!0,this.prompt=$}static isInstance($){return E1.hasMarker($,EL8)}},zL8=`vercel.ai.error.${jL8}`,m24=Symbol.for(zL8),mh=class extends(nO8=E1,pO8=m24,nO8){constructor({data:$,message:Z=`Invalid response data: ${JSON.stringify($)}.`}){super({name:jL8,message:Z});this[pO8]=!0,this.data=$}static isInstance($){return E1.hasMarker($,zL8)}},AL8=`vercel.ai.error.${PL8}`,i24=Symbol.for(AL8),dU=class extends(oO8=E1,tO8=i24,oO8){constructor({text:$,cause:Z}){super({name:PL8,message:`JSON parsing failed: Text: ${$}.
+  `.execute($)).rows[0]?.exists)await d4`CREATE ROLE ${d4.id(X)} NOLOGIN`.execute($);await d4`GRANT ${d4.id(X)} TO CURRENT_USER`.execute($),await d4`GRANT USAGE, CREATE ON SCHEMA ${d4.id(Z)} TO ${d4.id(X)}`.execute($),await d4`GRANT ALL ON ALL TABLES IN SCHEMA ${d4.id(Z)} TO ${d4.id(X)}`.execute($),await d4`GRANT ALL ON ALL SEQUENCES IN SCHEMA ${d4.id(Z)} TO ${d4.id(X)}`.execute($),await d4`ALTER DEFAULT PRIVILEGES IN SCHEMA ${d4.id(Z)} GRANT ALL ON TABLES TO ${d4.id(X)}`.execute($),await d4`ALTER DEFAULT PRIVILEGES IN SCHEMA ${d4.id(Z)} GRANT ALL ON SEQUENCES TO ${d4.id(X)}`.execute($),await d4`REVOKE ALL ON SCHEMA public FROM ${d4.id(X)}`.execute($)}async function mT4($,Z,X,Q){try{return await $.transaction().execute(async(Y)=>{return await d4`SET LOCAL ROLE ${d4.id(X)}`.execute(Y),await d4`SET LOCAL search_path TO ${d4.id(Z)}`.execute(Y),await d4.raw(Q).execute(Y)})}catch(Y){if(lT4(Y))return await dT4($,Z,X),await $.transaction().execute(async(G)=>{return await d4`SET LOCAL ROLE ${d4.id(X)}`.execute(G),await d4`SET LOCAL search_path TO ${d4.id(Z)}`.execute(G),await d4.raw(Q).execute(G)});throw Y}}var yT4,hT4,LB8;var wB8=L(()=>{m0();yT4=EH.object({results:EH.array(EH.unknown()).optional(),success:EH.boolean().optional()});hT4=EH.object({sql:EH.string().describe("The SQL query to run"),params:EH.array(EH.any()).describe("The parameters to pass to the SQL query").optional()});LB8=m({name:"DATABASES_RUN_SQL",description:"Run a SQL query in a connection-scoped isolated schema. Supports SELECT, DDL, and DML.",annotations:{title:"Run SQL Query",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!1,openWorldHint:!1},inputSchema:hT4,outputSchema:EH.object({result:EH.array(yT4)}),handler:async($,Z)=>{G0(Z),await Z.access.check();let X=gT4($.sql,$.params||[]);if(!Z.connectionId)throw Error("Connection context required for database access");console.warn("DATABASES_RUN_SQL invoked",{"tool.deprecation_probe":"DATABASES_RUN_SQL","connection.id":Z.connectionId,"organization.id":Z.organization?.id??null,"user.id":Z.auth.user?.id??null});let Q=uT4(Z.connectionId),Y=cT4(Z.connectionId);return{result:[{results:(await mT4(Z.db,Q,Y,X)).rows,success:!0}]}}})});function QJ0($){let Z=$.access.getRole();if(!LX(Z))throw new MU("Only organization owners and admins can change org-wide pin status")}var N81=L(()=>{KY();bj()});async function YJ0($,Z,X){let Q=[...new Set(X)],Y=await Promise.all(Q.map((J)=>$.storage.connections.findById(J,Z))),G=Q.filter((J,K)=>!Y[K]);if(G.length>0)throw Error(`Connection not found: ${G.join(", ")}`)}function yU($){return $.toLowerCase().replace(/[^a-z0-9]+/g,"-").replace(/^-|-$/g,"")}function GJ0($){let Z=2166136261;for(let X=0;X<$.length;X++)Z=Math.imul(Z^$.charCodeAt(X),16777619);return`a${(Z>>>0).toString(36).padStart(6,"0").slice(-6)}`}function Jr($){if($&&typeof $==="object"&&"gatewayClientId"in $&&typeof $.gatewayClientId==="string")return $.gatewayClientId;return}function Kr($,Z){if(!Z)return $;let X=`${GJ0(Z)}_`;return $.startsWith(X)?$.slice(X.length):$}function pT4($){return $.split(/[-_]/).map((Z)=>Z?Z.charAt(0).toUpperCase()+Z.slice(1):Z).join(" ")}var hh;var DB8=L(()=>{aW();hh=class hh extends ZZ{static MAX_PAGES_PER_CLIENT=1000;clients;slugToKey=new Map;resolvedClients=new Map;toolsCache=null;resourcesCache=null;resourceTemplatesCache=null;promptsCache=null;resourceRouteMap=new Map;constructor($,Z){super(Z?.clientInfo??{name:"gateway-client",version:"1.0.0"},{capabilities:Z?.capabilities});this.clients=$;for(let X of Object.keys($)){let Q=GJ0(X);if(this.slugToKey.has(Q))throw Error(`GatewayClient: duplicate namespace code "${Q}" from keys "${this.slugToKey.get(Q)}" and "${X}"`);this.slugToKey.set(Q,X)}}namespace($,Z){return`${GJ0($)}_${Z}`}async resolveToolTarget($){let Z=$.indexOf("_");if(Z!==-1){let Q=$.slice(0,Z),Y=this.slugToKey.get(Q);if(Y)return[Y,$.slice(Z+1)]}let{tools:X}=await this.listTools();for(let Q of X){let Y=Jr(Q._meta);if(!Y)continue;if(Kr(Q.name,Y)===$)return[Y,$]}if(Z===-1)throw Error(`GatewayClient: could not resolve tool "${$}" \u2014 no namespace prefix and not found in any client`);throw Error(`GatewayClient: unknown namespace "${$.slice(0,Z)}" in "${$}" and not found by original name in any client`)}async resolvePromptTarget($){let Z=$.indexOf("_");if(Z!==-1){let Q=$.slice(0,Z),Y=this.slugToKey.get(Q);if(Y)return[Y,$.slice(Z+1)]}let{prompts:X}=await this.listPrompts();for(let Q of X){let Y=Jr(Q._meta);if(!Y)continue;if(Kr(Q.name,Y)===$)return[Y,$]}if(Z===-1)throw Error(`GatewayClient: could not resolve prompt "${$}" \u2014 no namespace prefix and not found in any client`);throw Error(`GatewayClient: unknown namespace "${$.slice(0,Z)}" in "${$}" and not found by original name in any client`)}resolveClient($){let Z=this.resolvedClients.get($);if(Z)return Z;let X=this.clients[$];if(!X)return Promise.reject(Error(`GatewayClient: unknown client key "${$}"`));let Q=X.client,Y;try{Y=typeof Q==="function"?Promise.resolve(Q()):Promise.resolve(Q)}catch(J){return Promise.reject(J)}let G=Y.catch((J)=>{throw this.resolvedClients.delete($),J});return this.resolvedClients.set($,G),G}getResolvedClient($){return this.resolveClient($)}async listFromClient($,Z,X){try{let Q=await this.resolveClient($);return await Z(Q)}catch(Q){return console.warn(`GatewayClient: skipping ${X} from client "${$}" \u2014 ${Q?.message??Q}`),[]}}async paginate($,Z,X){let Q=[],Y,G=0;do{let J=await X(Y);Q.push(...J.items),Y=J.nextCursor,G++}while(Y&&G<hh.MAX_PAGES_PER_CLIENT);if(Y)console.warn(`GatewayClient: client "${$}" exceeded ${hh.MAX_PAGES_PER_CLIENT} pages listing ${Z} \u2014 truncating`);return Q}fetchAllTools($,Z){return this.paginate(Z,"tools",async(X)=>{let Q=await $.listTools(X?{cursor:X}:void 0);return{items:Q.tools,nextCursor:Q.nextCursor}})}fetchAllResources($,Z){return this.paginate(Z,"resources",async(X)=>{let Q=await $.listResources(X?{cursor:X}:void 0);return{items:Q.resources,nextCursor:Q.nextCursor}})}fetchAllResourceTemplates($,Z){return this.paginate(Z,"resource templates",async(X)=>{let Q=await $.listResourceTemplates(X?{cursor:X}:void 0);return{items:Q.resourceTemplates,nextCursor:Q.nextCursor}})}fetchAllPrompts($,Z){return this.paginate(Z,"prompts",async(X)=>{let Q=await $.listPrompts(X?{cursor:X}:void 0);return{items:Q.prompts,nextCursor:Q.nextCursor}})}listTools($,Z){if(!this.toolsCache)this.toolsCache=this.aggregateTools();return this.toolsCache}async aggregateTools(){let $=[];for(let[Z,X]of Object.entries(this.clients)){let Q=await this.listFromClient(Z,(J)=>this.fetchAllTools(J,Z),"tools"),Y=X.tools,G=Y?new Set(Y):null;for(let J of Q){if(G&&!G.has(J.name))continue;$.push({...J,name:this.namespace(Z,J.name),_meta:{...J._meta??{},gatewayClientId:Z}})}}return{tools:$}}listResources($,Z){if(!this.resourcesCache)this.resourcesCache=this.aggregateResources();return this.resourcesCache}async aggregateResources(){let $=new Set,Z=[],X=new Map;for(let[Q,Y]of Object.entries(this.clients)){let G=await this.listFromClient(Q,(W)=>this.fetchAllResources(W,Q),"resources"),J=Y.resources,K=J?new Set(J):null;for(let W of G){if(K&&!K.has(W.uri)&&!(W.name&&K.has(W.name)))continue;if($.has(W.uri)){console.warn(`GatewayClient: duplicate resource "${W.uri}" from client "${Q}" \u2014 skipping`);continue}$.add(W.uri),X.set(W.uri,Q),Z.push({...W,_meta:{...W._meta??{},gatewayClientId:Q}})}}return this.resourceRouteMap=X,{resources:Z}}listResourceTemplates($,Z){if(!this.resourceTemplatesCache)this.resourceTemplatesCache=this.aggregateResourceTemplates();return this.resourceTemplatesCache}async aggregateResourceTemplates(){let $=new Set,Z=[];for(let[X,Q]of Object.entries(this.clients)){let Y=await this.listFromClient(X,(G)=>this.fetchAllResourceTemplates(G,X),"resource templates");for(let G of Y){if($.has(G.uriTemplate)){console.warn(`GatewayClient: duplicate resource template "${G.uriTemplate}" from client "${X}" \u2014 skipping`);continue}$.add(G.uriTemplate),Z.push({...G,_meta:{...G._meta??{},gatewayClientId:X}})}}return{resourceTemplates:Z}}listPrompts($,Z){if(!this.promptsCache)this.promptsCache=this.aggregatePrompts();return this.promptsCache}async aggregatePrompts(){let $=[];for(let[Z,X]of Object.entries(this.clients)){let Q=await this.listFromClient(Z,(J)=>this.fetchAllPrompts(J,Z),"prompts"),Y=X.prompts,G=Y?new Set(Y):null;for(let J of Q){if(G&&!G.has(J.name))continue;$.push({...J,name:this.namespace(Z,J.name),title:J.title??pT4(J.name),_meta:{...J._meta??{},gatewayClientId:Z}})}}return{prompts:$}}async callTool($,Z,X){let[Q,Y]=await this.resolveToolTarget($.name);return(await this.resolveClient(Q)).callTool({...$,name:Y},Z,X)}async readResource($,Z){let X=await this.resolveResourceRoute($.uri);return(await this.resolveClient(X)).readResource($)}async getPrompt($,Z){let[X,Q]=await this.resolvePromptTarget($.name);return(await this.resolveClient(X)).getPrompt({...$,name:Q})}async resolveResourceRoute($){let Z=this.resourceRouteMap.get($);if(Z)return Z;if(this.resourcesCache=null,await this.listResources(),Z=this.resourceRouteMap.get($),Z)return Z;throw Error(`GatewayClient: resource "${$}" not found in any upstream client`)}getServerCapabilities(){return{tools:{},resources:{},prompts:{}}}getInstructions(){return}refresh(){this.toolsCache=null,this.resourcesCache=null,this.resourceTemplatesCache=null,this.promptsCache=null}async close(){let $=[...this.resolvedClients.values()].map((Z)=>Z.then((X)=>X.close()).catch(()=>{}));await Promise.allSettled($),await super.close()}}});var JJ0=L(()=>{DB8()});function O81($){return yU($)}function tT4($,Z){let X=yU(Z)||"prompt";return`${String($).padStart(nT4,"0")}-${X}`}async function L81($,Z,X){try{await $.delete(KJ0,O81(Z),{actor:X})}catch(Q){console.error("[agent-prompts] failed to delete prompts",{agentId:Z,err:Q})}}async function WJ0($,Z,X,Q){let Y=O81(Z);await L81($,Z,X),await Promise.all(Q.slice(0,B81).map(async(G,J)=>{let K=tT4(J,G.title),W={name:K,title:G.title,description:G.description,text:G.text};try{await $.write(KJ0,`${Y}/${K}.json`,JSON.stringify(W),{actor:X,contentType:"application/json"})}catch(H){console.error("[agent-prompts] failed to seed prompt",{agentId:Z,name:K,err:H})}}))}async function EB8($,Z){let X=O81(Z),Q;try{Q=await $.listDir(KJ0,X)}catch{return[]}let Y=Q.filter((J)=>J.kind==="file"&&J.path.endsWith(".json")).slice(0,B81),G=[];for(let J of Y)try{let K=await $.read(KJ0,J.path),W=JSON.parse(new TextDecoder().decode(K));if(W&&typeof W.name==="string"&&typeof W.title==="string"&&typeof W.text==="string")G.push(W)}catch{}return G}var KJ0="agent-prompts",B81=20,nT4;var Wr=L(()=>{JJ0();nT4=String(B81-1).length});import{z as PB8}from"zod";function oT4(){let $=jB8[Math.floor(Math.random()*jB8.length)];return`icon://${zB8[Math.floor(Math.random()*zB8.length)]}?color=${$}`}var jB8,zB8,rT4,aT4,w81;var AB8=L(()=>{m0();DL();N81();Wr();jB8=["red","orange","amber","yellow","lime","green","emerald","cyan","sky","blue","indigo","violet","purple","fuchsia","pink","rose"],zB8=["Star01","Zap","Heart","Globe01","Compass03","Lightbulb02","Rocket01","Flag01","BookOpen01","Shield01","Key01","Diamond01","Cube01","Target04","Award01","Briefcase01","Coffee","Feather","Hexagon01","Layers3_01","Map01","Palette","Package","Terminal"];rT4=PB8.object({data:VX0.describe("Data for the new virtual MCP")}),aT4=PB8.object({item:HX.describe("The created virtual MCP entity")}),w81=m({name:"COLLECTION_VIRTUAL_MCP_CREATE",description:"Create a Virtual MCP (agent) that aggregates tools from multiple connections into one endpoint. Pass `prompts` to seed the agent with kickstart prompts (conversation starters shown as icebreakers). Author them from the agent's role/instructions and the descriptions of the tools it will have, so the starters are coherent and immediately useful.",annotations:{title:"Create Virtual MCP",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!1,openWorldHint:!1},inputSchema:rT4,outputSchema:aT4,handler:async($,Z)=>{G0(Z);let X=X0(Z);await Z.access.check();let Q=w1(Z);if(!Q)throw Error("User ID required to create virtual MCP");if($.data.pinned===!0)QJ0(Z);let{prompts:Y,...G}=$.data;if(G.connections.length>0)await YJ0(Z,X.id,G.connections.map((W)=>W.connection_id));let J={...G,icon:G.icon??oT4()},K=await Z.storage.virtualMcps.create(X.id,Q,J);if(Y?.length&&Z.orgFs&&K.id)await WJ0(Z.orgFs,K.id,Q,Y);return{item:K}}})});function sT4($){let Z=[],X=0;while(X<$.length){let Q=$[X];if(Q==="%")Z.push(".*");else if(Q==="_")Z.push(".");else if(/[.*+?^${}()|[\]\\]/.test(Q))Z.push("\\"+Q);else Z.push(Q);X++}return Z.join("")}function IL($){return typeof $==="string"||typeof $==="number"}function D81($,Z){let X=Z.split("."),Q=$;for(let Y of X){if(Q==null||typeof Q!=="object")return;Q=Q[Y]}return Q}function eT4($,Z){return $.connections.some((X)=>X.connection_id===Z)}function HJ0($,Z){if("conditions"in Z){let{operator:K,conditions:W}=Z;switch(K){case"and":return W.every((H)=>HJ0($,H));case"or":return W.some((H)=>HJ0($,H));case"not":return!W.every((H)=>HJ0($,H));default:return!0}}let{field:X,operator:Q,value:Y}=Z,G=X.join(".");if(G==="connection_id"){if(Q!=="eq"||typeof Y!=="string")return!1;return eT4($,Y)}let J=D81($,G);switch(Q){case"eq":return J===Y;case"gt":return IL(J)&&IL(Y)&&J>Y;case"gte":return IL(J)&&IL(Y)&&J>=Y;case"lt":return IL(J)&&IL(Y)&&J<Y;case"lte":return IL(J)&&IL(Y)&&J<=Y;case"in":return Array.isArray(Y)&&Y.includes(J);case"like":if(typeof J!=="string"||typeof Y!=="string")return!1;if(Y.length>100)return!1;let K=sT4(Y);return new RegExp(`^${K}$`,"i").test(J);case"contains":if(typeof J!=="string"||typeof Y!=="string")return!1;return J.toLowerCase().includes(Y.toLowerCase());default:return!0}}function $24($,Z){return[...$].sort((X,Q)=>{for(let Y of Z){let G=Y.field.join("."),J=D81(X,G),K=D81(Q,G),W=0;if(J==null&&K==null)continue;if(J==null)W=Y.nulls==="first"?-1:1;else if(K==null)W=Y.nulls==="first"?1:-1;else if(typeof J==="string"&&typeof K==="string")W=J.localeCompare(K);else if(typeof J==="number"&&typeof K==="number")W=J-K;else W=String(J).localeCompare(String(K));if(W!==0)return Y.direction==="desc"?-W:W}return 0})}var Z24,X24,E81;var TB8=L(()=>{v3();m0();DL();Z24=jK,X24=fU(HX),E81=m({name:"COLLECTION_VIRTUAL_MCP_LIST",description:"List all MCP virtual MCPs in the organization",annotations:{title:"List Virtual MCPs",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:Z24,outputSchema:X24,handler:async($,Z)=>{await Z.access.check();let X=X0(Z),Q=$.where&&!("conditions"in $.where)&&$.where.field.join(".")==="connection_id"&&$.where.operator==="eq"&&typeof $.where.value==="string"?$.where.value:void 0,Y=$.where&&!("conditions"in $.where)&&$.where.field.join(".")==="pinned"&&$.where.operator==="eq"&&typeof $.where.value==="boolean"?$.where.value:void 0,J=Q?await Z.storage.virtualMcps.listByConnectionId(X.id,Q):await Z.storage.virtualMcps.list(X.id,Y!==void 0?{pinnedOnly:Y}:void 0);if($.where)J=J.filter((N)=>HJ0(N,$.where));if($.orderBy&&$.orderBy.length>0)J=$24(J,$.orderBy);let K=J.length,W=$.offset??0,H=$.limit??100,F=J.slice(W,W+H),U=W+H<K;return{items:F,totalCount:K,hasMore:U}}})});import{z as j81}from"zod";var Q24,Y24,z81;var RB8=L(()=>{m0();DL();Q24=j81.object({id:j81.string().describe("ID of the virtual MCP to retrieve")}),Y24=j81.object({item:HX.nullable().describe("The retrieved virtual MCP, or null if not found")}),z81=m({name:"COLLECTION_VIRTUAL_MCP_GET",description:"Get a Virtual MCP's configuration, connections, and virtual tools by ID.",annotations:{title:"Get Virtual MCP",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:Q24,outputSchema:Y24,handler:async($,Z)=>{G0(Z);let X=X0(Z);await Z.access.check();let Q=await Z.storage.virtualMcps.findById($.id);if(Q&&Q.organization_id!==X.id)return{item:null};if(!Q)return{item:null};return{item:Q}}})});function b3($){return P81.test($)}function IB8($){let Z=(X)=>typeof X==="string"?X.trim().toLowerCase():"";return Z($?.metadata?.siteSlug)||Z($?.title)||null}var P81;var qL=L(()=>{P81=/^[a-z0-9][a-z0-9-]{0,59}$/});function qB8($){let{nextTitle:Z,currentTitle:X,currentSiteSlug:Q}=$;if(Q?.trim())return null;if(Z===void 0||Z===X)return null;let Y=X?.trim().toLowerCase()??"";return b3(Y)?Y:null}var MB8=L(()=>{qL()});import{z as A81}from"zod";var G24,J24,T81;var VB8=L(()=>{m0();Wr();DL();N81();MB8();G24=A81.object({id:A81.string().describe("ID of the virtual MCP to update"),data:kX0.describe("Partial virtual MCP data to update")}),J24=A81.object({item:HX.describe("The updated virtual MCP entity")}),T81=m({name:"COLLECTION_VIRTUAL_MCP_UPDATE",description:"Update a Virtual MCP's name, slug, connection list, or kickstart prompts. Pass `prompts` to replace the agent's conversation starters (full set; empty array clears them).",annotations:{title:"Update Virtual MCP",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:G24,outputSchema:J24,handler:async($,Z)=>{G0(Z);let X=X0(Z);await Z.access.check();let Q=w1(Z);if(!Q)throw Error("User ID required to update virtual MCP");let Y=await Z.storage.virtualMcps.findById($.id);if(!Y)throw Error(`Virtual MCP not found: ${$.id}`);if(Y.organization_id!==X.id)throw Error(`Virtual MCP not found: ${$.id}`);let{prompts:G,...J}=$.data;if(J.metadata&&Y.metadata)J.metadata={...Y.metadata,...J.metadata};let K=qB8({nextTitle:J.title,currentTitle:Y.title,currentSiteSlug:Y.metadata?.siteSlug});if(K)J.metadata={...Y.metadata,...J.metadata,siteSlug:K};if(J.pinned!==void 0&&J.pinned!==Y.pinned)QJ0(Z);if(J.connections?.length)await YJ0(Z,X.id,J.connections.map((H)=>H.connection_id));let W=await Z.storage.virtualMcps.update($.id,Q,J);if(G!==void 0&&Z.orgFs)await WJ0(Z.orgFs,$.id,Q,G);return{item:W}}})});function K24($){if(!$)return!1;let Z=I81.join("|");return new RegExp(`permission\\s+"?(?:${Z})"?\\s+is not allowed`,"i").test($)||/permissions exceed what the github app/i.test($)}function SB8($){let Z={...$};for(let X of I81)Z[X]="read";return Z}async function CB8($,Z){let X={...Z};for(;;){let Q=await $(X);if(!Q.isError)return{result:Q,grantedPermissions:X};let Y=Q.content?.find((W)=>W.type==="text")?.text,G=I81.find((W)=>(W in X));if(!G||!K24(Y))return{result:Q,grantedPermissions:X};let{[G]:J,...K}=X;X=K}}function W24($){if(!$||typeof $!=="object"||Array.isArray($))return kB8;let Z=$;if(Object.values(Z).some((X)=>typeof X!=="string"))return kB8;return Z}function H24($){if(typeof $!=="number"||!Number.isFinite($)||!Number.isInteger($)||$<=0)return;return $}function c5($){let Z=$.metadata?.repoScope;if(!Z||typeof Z.installationId!=="number"||!Number.isFinite(Z.installationId)||!Number.isInteger(Z.installationId)||Z.installationId<=0||typeof Z.owner!=="string"||typeof Z.repo!=="string"||Z.owner.length===0||Z.repo.length===0)return null;let X=H24(Z.repositoryId);return{sourceConnectionId:typeof Z.sourceConnectionId==="string"?Z.sourceConnectionId:void 0,installationId:Z.installationId,repositoryId:X,owner:Z.owner,repo:Z.repo,permissions:W24(Z.permissions),grantProvider:Z.grantProvider==="github-mcp"?"github-mcp":void 0}}function Jz($){return $.metadata?.orgShared===!0}function _B8($){let Z=new Set,X=[];for(let Q of $??[]){if(Q.status!=="active")continue;let Y=c5(Q);if(Y===null)continue;let G=R81(Y.owner,Y.repo);if(Z.has(G))continue;Z.add(G),X.push(`${Y.owner}/${Y.repo}`)}return X}function FJ0($,Z,X){let Q=R81(Z,X),Y=($??[]).filter((G)=>{if(G.status&&G.status!=="active")return!1;let J=c5(G);return J!==null&&R81(J.owner,J.repo)===Q});return Y.find(Jz)??Y[0]??null}var kB8,I81,R81=($,Z)=>`${$}/${Z}`.toLowerCase();var HY=L(()=>{kB8={contents:"write",metadata:"read",pull_requests:"write",issues:"write",checks:"read",deployments:"read"},I81=["deployments","checks"]});function vB8($){return R3($)!==null||sQ0($)!==null}var xB8=L(()=>{S6()});import{z as q81}from"zod";var F24,U24,M81;var fB8=L(()=>{HY();f3();m0();Wr();DL();xB8();F24=q81.object({id:q81.string().describe("ID of the virtual MCP to delete")}),U24=q81.object({item:HX.describe("The deleted virtual MCP entity")}),M81=m({name:"COLLECTION_VIRTUAL_MCP_DELETE",description:"Permanently delete a Virtual MCP and its virtual tools.",annotations:{title:"Delete Virtual MCP",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:F24,outputSchema:U24,handler:async($,Z)=>{G0(Z);let X=X0(Z);if(await Z.access.check(),vB8($.id))throw Error(`Virtual MCP not found: ${$.id}`);let Q=await Z.storage.virtualMcps.findById($.id);if(!Q)throw Error(`Virtual MCP not found: ${$.id}`);if(Q.organization_id!==X.id)throw Error(`Virtual MCP not found: ${$.id}`);await Z.storage.virtualMcps.delete($.id);try{if((await Z.storage.organizationSettings.get(X.id))?.main_agent_id===$.id)await Z.storage.organizationSettings.upsert(X.id,{main_agent_id:null})}catch(G){console.error("[VIRTUAL_MCP_DELETE] failed to clear main agent pointer",{id:$.id,error:G.message})}if(Z.orgFs)await L81(Z.orgFs,$.id,w1(Z)??"system");let Y=Q.metadata?.githubRepo?.connectionId;if(Y)try{let G=await Z.storage.connections.findById(Y,X.id),J=G&&(Jz(G)||(await Z.storage.virtualMcps.listByConnectionId(X.id,Y)).length>0||await Z.storage.connections.isReferencedByThread(Y));if(G&&c5(G)&&!J){let W=await new X5(Z.db,Z.vault).get(Y);if(W?.accessToken)try{await fetch("https://api.github.com/installation/token",{method:"DELETE",headers:{Authorization:`Bearer ${W.accessToken}`,Accept:"application/vnd.github+json","X-GitHub-Api-Version":"2022-11-28"},signal:AbortSignal.timeout(5000)})}catch{}await Z.storage.connections.delete(Y)}}catch(G){console.error("[VIRTUAL_MCP_DELETE] failed to tear down repo-scoped connection",{childConnectionId:Y,error:G.message})}return{item:Q}}})});import{z as FY}from"zod";var N24,V81;var bB8=L(()=>{m0();N24=FY.object({id:FY.string(),virtualMcpId:FY.string(),pluginId:FY.string(),connectionId:FY.string().nullable(),settings:FY.record(FY.string(),FY.unknown()).nullable(),createdAt:FY.string(),updatedAt:FY.string()}),V81=m({name:"VIRTUAL_MCP_PLUGIN_CONFIG_GET",description:"Get a plugin's current configuration for a specific virtual MCP.",annotations:{title:"Get Virtual MCP Plugin Config",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:FY.object({virtualMcpId:FY.string().describe("Virtual MCP ID"),pluginId:FY.string().describe("Plugin ID")}),outputSchema:FY.object({config:N24.nullable()}),handler:async($,Z)=>{G0(Z);let X=X0(Z);await Z.access.check();let{virtualMcpId:Q,pluginId:Y}=$,G=await Z.storage.connections.findById(Q);if(!G||G.organization_id!==X.id)return{config:null};if(G.connection_type!=="VIRTUAL")return{config:null};let J=await Z.storage.virtualMcpPluginConfigs.get(Q,Y);if(!J)return{config:null};return{config:{id:J.id,virtualMcpId:J.virtualMcpId,pluginId:J.pluginId,connectionId:J.connectionId,settings:J.settings,createdAt:J.createdAt instanceof Date?J.createdAt.toISOString():J.createdAt,updatedAt:J.updatedAt instanceof Date?J.updatedAt.toISOString():J.updatedAt}}}})});import{z as $7}from"zod";var B24,k81;var yB8=L(()=>{m0();fh();L9();B24=$7.object({id:$7.string(),virtualMcpId:$7.string(),pluginId:$7.string(),connectionId:$7.string().nullable(),settings:$7.record($7.string(),$7.unknown()).nullable(),createdAt:$7.string(),updatedAt:$7.string()}),k81=m({name:"VIRTUAL_MCP_PLUGIN_CONFIG_UPDATE",description:"Set or update a plugin's configuration for a specific virtual MCP.",annotations:{title:"Update Virtual MCP Plugin Config",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:$7.object({virtualMcpId:$7.string().describe("Virtual MCP ID"),pluginId:$7.string().describe("Plugin ID"),connectionId:$7.string().nullable().optional().describe("MCP connection to bind"),settings:$7.record($7.string(),$7.unknown()).nullable().optional().describe("Plugin-specific settings")}),outputSchema:$7.object({config:B24}),handler:async($,Z)=>{G0(Z);let X=X0(Z);await Z.access.check();let{virtualMcpId:Q,pluginId:Y,connectionId:G,settings:J}=$,K=w1(Z),W=await Z.storage.connections.findById(Q);if(!W)throw Error(`Connection not found: ${Q}`);if(W.organization_id!==X.id)throw Error(`Connection not found: ${Q}`);if(W.connection_type!=="VIRTUAL")throw Error(`Connection not found: ${Q}`);let H=G?await Z.storage.connections.findById(G):null;if(G&&H&&H.organization_id!==X.id)throw Error(`Connection not found: ${G}`);if(G&&W.organization_id&&!H&&x3()&&a30(G,W.organization_id)){if(!K)throw Error("User ID required to create dev-assets connection");let U=xh(W.organization_id,O9());await Z.storage.connections.create({...U,organization_id:W.organization_id,created_by:K})}else if(G&&!H)throw Error(`Connection not found: ${G}`);let F=await Z.storage.virtualMcpPluginConfigs.upsert(Q,Y,{connectionId:G,settings:J});return{config:{id:F.id,virtualMcpId:F.virtualMcpId,pluginId:F.pluginId,connectionId:F.connectionId,settings:F.settings,createdAt:F.createdAt instanceof Date?F.createdAt.toISOString():F.createdAt,updatedAt:F.updatedAt instanceof Date?F.updatedAt.toISOString():F.updatedAt}}}})});import{z as EQ}from"zod";var O24,S81;var gB8=L(()=>{m0();DL();O24=EQ.object({connectionId:EQ.string(),toolName:EQ.string(),label:EQ.string(),icon:EQ.string().nullable().optional()}),S81=m({name:"VIRTUAL_MCP_PINNED_VIEWS_UPDATE",description:"Update the pinned sidebar views for a virtual MCP. Replaces all current pins.",annotations:{title:"Update Pinned Views",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:EQ.object({virtualMcpId:EQ.string().describe("Virtual MCP ID"),pinnedViews:EQ.array(O24).describe("Pinned views to set for the virtual MCP sidebar"),layout:EQ.object({defaultMainView:EQ.object({type:EQ.string(),id:EQ.string().optional(),toolName:EQ.string().optional()}).nullable().optional(),chatDefaultOpen:EQ.boolean().nullable().optional()}).optional()}),outputSchema:EQ.object({item:HX.nullable()}),handler:async($,Z)=>{G0(Z);let X=X0(Z);await Z.access.check();let{virtualMcpId:Q,pinnedViews:Y,layout:G}=$,J=w1(Z),K=await Z.storage.virtualMcps.findById(Q);if(!K)throw Error(`Virtual MCP not found: ${Q}`);if(K.organization_id!==X.id)throw Error(`Virtual MCP not found: ${Q}`);let W=K.metadata?.ui??{},H={...W,pinnedViews:Y.length>0?Y:null,layout:G??W.layout??null};return{item:await Z.storage.virtualMcps.update(Q,J??"system",{metadata:{...K.metadata,ui:H}})}}})});import{z as gU}from"zod";var L24,w24,C81;var hB8=L(()=>{m0();L24=gU.object({ids:gU.array(gU.string()).describe("Virtual MCP ids to look up")}),w24=gU.object({items:gU.array(gU.object({id:gU.string(),last_used_at:gU.string().optional(),last_used_by:gU.string().optional()}))}),C81=m({name:"VIRTUAL_MCP_LAST_USED_LIST",description:"Get last-used info (timestamp + user) for one or more virtual MCPs, derived from the most recent thread per agent.",annotations:{title:"List Virtual MCP Last Used",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:L24,outputSchema:w24,handler:async($,Z)=>{G0(Z),X0(Z),await Z.access.check();let X=await Z.storage.threads.findLastUsedByVirtualMcpIds($.ids);return{items:$.ids.map((Q)=>({id:Q,last_used_at:X.get(Q)?.last_used_at,last_used_by:X.get(Q)?.last_used_by}))}}})});var uB8=L(()=>{AB8();TB8();RB8();VB8();fB8();bB8();yB8();gB8();hB8()});import{z as jX}from"zod";var _81;var cB8=L(()=>{u$();m0();_81=m({name:"MONITORING_HEATMAP",description:"Get tool-call volume broken down by agent and tool name, for spotting heavily-used tools per agent.",annotations:{title:"Get Tool-Call Heatmap",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:jX.object({startDate:jX.string().datetime().optional().describe("Filter by start date (ISO 8601 datetime string)"),endDate:jX.string().datetime().optional().describe("Filter by end date (ISO 8601 datetime string)"),virtualMcpIds:jX.array(jX.string()).max(100).optional().describe("Filter by specific agent (Virtual MCP) IDs"),excludeConnectionIds:jX.array(jX.string()).max(100).optional().describe("Exclude tool calls from these connection IDs"),limit:jX.number().int().min(1).max(1000).optional().describe("Max number of (agent, tool) cells to return")}),outputSchema:jX.object({cells:jX.array(jX.object({virtualMcpId:jX.string().nullable(),toolName:jX.string(),calls:jX.number(),errors:jX.number(),outputSize:jX.number().describe("Sum of tool-output character length \u2014 a proxy for context weight, not LLM token count")}))}),handler:async($,Z)=>{let X=X0(Z);return await Z.access.check(),await pQ(),Z.storage.monitoring.queryToolCallHeatmap({organizationId:X.id,startDate:$.startDate?new Date($.startDate):void 0,endDate:$.endDate?new Date($.endDate):void 0,filters:{virtualMcpIds:$.virtualMcpIds,excludeConnectionIds:$.excludeConnectionIds},limit:$.limit})}})});import{z as M5}from"zod";var v81;var lB8=L(()=>{u$();m0();v81=m({name:"MONITORING_LOG_GET",description:"Get a single monitoring log by ID with full input and output data.",annotations:{title:"Get Monitoring Log",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:M5.object({id:M5.string().describe("Log ID to fetch")}),outputSchema:M5.object({log:M5.object({id:M5.string().optional(),organizationId:M5.string(),connectionId:M5.string(),toolName:M5.string(),input:M5.record(M5.string(),M5.unknown()),output:M5.record(M5.string(),M5.unknown()),isError:M5.boolean(),errorMessage:M5.string().nullish(),durationMs:M5.number(),timestamp:M5.string(),userId:M5.string().nullish(),requestId:M5.string(),userAgent:M5.string().nullish(),virtualMcpId:M5.string().nullish(),properties:M5.record(M5.string(),M5.string()).nullish()}).nullable().describe("The monitoring log, or null if not found")}),handler:async($,Z)=>{await Z.access.check(),await pQ();let X=X0(Z),Q=await Z.storage.monitoring.getById(X.id,$.id);if(!Q)return{log:null};return{log:{...Q,timestamp:Q.timestamp instanceof Date?Q.timestamp.toISOString():Q.timestamp}}}})});import{z as j6}from"zod";var E24,x81;var dB8=L(()=>{u$();m0();E24=j6.object({id:j6.string().optional().describe("Unique log identifier"),organizationId:j6.string().describe("Organization ID"),connectionId:j6.string().describe("Connection ID"),toolName:j6.string().describe("Name of the tool that was called"),isError:j6.boolean().describe("Whether the call resulted in an error"),errorMessage:j6.string().nullish().describe("Error message if applicable"),durationMs:j6.number().describe("Call duration in milliseconds"),timestamp:j6.string().describe("ISO 8601 timestamp of the call"),userId:j6.string().nullish().describe("User who triggered the call"),requestId:j6.string().describe("Unique request identifier"),userAgent:j6.string().nullish().describe("Client identifier (x-studio-client header)"),virtualMcpId:j6.string().nullish().describe("Virtual MCP (Agent) ID if routed through an agent"),properties:j6.record(j6.string(),j6.string()).nullish().describe("Custom key-value metadata attached to the log")}),x81=m({name:"MONITORING_LOGS_LIST",description:"List monitoring logs for tool calls with filtering and pagination.",annotations:{title:"List Monitoring Logs",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:j6.object({connectionId:j6.string().optional().describe("Filter by connection ID"),excludeConnectionIds:j6.array(j6.string()).optional().describe("Exclude logs from these connection IDs (e.g. system connections)"),virtualMcpId:j6.string().optional().describe("Filter by Virtual MCP (Agent) ID"),toolName:j6.string().optional().describe("Filter by tool name"),isError:j6.boolean().optional().describe("Filter by error status"),startDate:j6.string().datetime().optional().describe("Filter by start date (ISO 8601 datetime string)"),endDate:j6.string().datetime().optional().describe("Filter by end date (ISO 8601 datetime string)"),limit:j6.number().default(20).describe("Maximum number of results"),offset:j6.number().default(0).describe("Offset for pagination"),properties:j6.record(j6.string(),j6.string()).optional().describe("Filter by exact property key=value matches"),propertyKeys:j6.array(j6.string()).optional().describe("Filter by logs that have these property keys"),propertyPatterns:j6.record(j6.string(),j6.string()).optional().describe("Filter by property value patterns (SQL LIKE, use % as wildcard)"),propertyInValues:j6.record(j6.string(),j6.string()).optional().describe("Filter by exact match within comma-separated values (e.g., user_tags in 'Engineering')")}),outputSchema:j6.object({logs:j6.array(E24).describe("Array of monitoring logs"),total:j6.number().describe("Total number of logs matching filters"),offset:j6.number().describe("Current offset for pagination"),limit:j6.number().describe("Current limit for pagination")}),handler:async($,Z)=>{await Z.access.check(),await pQ();let X=X0(Z),Y=$.properties||$.propertyKeys||$.propertyPatterns||$.propertyInValues?{properties:$.properties,propertyKeys:$.propertyKeys,propertyPatterns:$.propertyPatterns,propertyInValues:$.propertyInValues}:void 0,G={organizationId:X.id,connectionId:$.connectionId,excludeConnectionIds:$.excludeConnectionIds,virtualMcpId:$.virtualMcpId,toolName:$.toolName,isError:$.isError,startDate:$.startDate?new Date($.startDate):void 0,endDate:$.endDate?new Date($.endDate):void 0,limit:$.limit,offset:$.offset,propertyFilters:Y},J=await Z.storage.monitoring.query(G);return{logs:J.logs.map(({input:K,output:W,...H})=>({...H,timestamp:H.timestamp instanceof Date?H.timestamp.toISOString():H.timestamp})),total:J.total,offset:$.offset,limit:$.limit}}})});import{z as B8}from"zod";var f81;var mB8=L(()=>{u$();m0();f81=m({name:"MONITORING_STATS",description:"Get aggregated statistics (counts, latency, error rates) for tool call monitoring.",annotations:{title:"Get Monitoring Stats",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:B8.object({startDate:B8.string().datetime().optional().describe("Filter by start date (ISO 8601 datetime string)"),endDate:B8.string().datetime().optional().describe("Filter by end date (ISO 8601 datetime string)"),interval:B8.string().regex(/^\d+[mhd]$/).optional().describe("Bucket interval for timeseries data (e.g. 1m, 5m, 2h, 1d). When provided, returns timeseries array."),connectionIds:B8.array(B8.string()).max(100).optional().describe("Filter by specific connection IDs (max 100)"),excludeConnectionIds:B8.array(B8.string()).max(100).optional().describe("Exclude specific connection IDs (max 100)"),toolNames:B8.array(B8.string()).max(100).optional().describe("Filter by specific tool names (max 100)"),status:B8.enum(["success","error"]).optional().describe("Filter metrics by execution status"),topN:B8.number().int().min(1).max(20).optional().describe("When provided with interval, also return top tools and their timeseries"),userIds:B8.array(B8.string()).max(100).optional().describe("Filter LLM usage by user IDs (only applied when llmUsage is true)"),llmUsage:B8.boolean().optional().describe("Aggregate LLM-call usage (tokens + USD cost) from raw log rows for the given connection. Returns token/cost totals and timeseries. Requires interval.")}),outputSchema:B8.object({totalCalls:B8.number().describe("Total number of tool calls"),errorRate:B8.number().optional().describe("Error rate as a decimal (0 to 1)"),avgDurationMs:B8.number().describe("Average call duration in milliseconds"),errorRatePercent:B8.string().optional().describe("Error rate as a percentage string"),totalErrors:B8.number().optional().describe("Total number of errors"),p50DurationMs:B8.number().optional().describe("50th percentile duration in milliseconds"),p95DurationMs:B8.number().optional().describe("95th percentile duration in milliseconds"),connectionBreakdown:B8.array(B8.object({connectionId:B8.string(),calls:B8.number(),errors:B8.number(),errorRate:B8.number(),avgDurationMs:B8.number()})).optional().describe("Per-connection metric breakdown"),totalInputTokens:B8.number().optional().describe("Total input tokens (LLM usage mode)"),totalOutputTokens:B8.number().optional().describe("Total output tokens (LLM usage mode)"),totalTokens:B8.number().optional().describe("Total tokens (LLM usage mode)"),totalCostUsd:B8.number().optional().describe("Total USD cost (LLM usage mode; only non-zero for providers that report cost)"),topTools:B8.array(B8.object({toolName:B8.string(),connectionId:B8.string().nullable(),calls:B8.number(),inputTokens:B8.number().optional(),outputTokens:B8.number().optional(),costUsd:B8.number().optional()})).optional().describe("Top tools ranked by calls"),topToolsTimeseries:B8.array(B8.object({timestamp:B8.string(),toolName:B8.string(),calls:B8.number(),errors:B8.number(),avg:B8.number(),p95:B8.number()})).optional().describe("Per-tool metric timeseries for the top tools"),timeseries:B8.array(B8.object({timestamp:B8.string(),calls:B8.number(),errors:B8.number(),errorRate:B8.number(),avg:B8.number(),p50:B8.number(),p95:B8.number(),inputTokens:B8.number().optional(),outputTokens:B8.number().optional(),totalTokens:B8.number().optional(),costUsd:B8.number().optional()})).optional().describe("Timeseries data points bucketed by interval")}),handler:async($,Z)=>{let X=X0(Z);if(await Z.access.check(),await pQ(),$.interval&&$.llmUsage)return Z.storage.monitoring.queryLlmUsageStats({organizationId:X.id,interval:$.interval,connectionId:$.connectionIds?.[0]??"decopilot",startDate:$.startDate?new Date($.startDate):void 0,endDate:$.endDate?new Date($.endDate):void 0,userIds:$.userIds,topN:$.topN});if($.interval){let Y=await Z.storage.monitoring.queryMetricTimeseries({organizationId:X.id,interval:$.interval,startDate:$.startDate?new Date($.startDate):void 0,endDate:$.endDate?new Date($.endDate):void 0,filters:{connectionIds:$.connectionIds,excludeConnectionIds:$.excludeConnectionIds,toolNames:$.toolNames,status:$.status}});if(!$.topN)return Y;let G=await Z.storage.monitoring.queryMetricTopToolsTimeseries({organizationId:X.id,interval:$.interval,startDate:$.startDate?new Date($.startDate):void 0,endDate:$.endDate?new Date($.endDate):void 0,topN:$.topN,filters:{connectionIds:$.connectionIds,excludeConnectionIds:$.excludeConnectionIds,toolNames:$.toolNames,status:$.status}});return{...Y,topTools:G.topTools,topToolsTimeseries:G.timeseries}}let Q=await Z.storage.monitoring.getStats({organizationId:X.id,startDate:$.startDate?new Date($.startDate):void 0,endDate:$.endDate?new Date($.endDate):void 0});return{...Q,errorRatePercent:(Q.errorRate*100).toFixed(2)}}})});import{z as jQ}from"zod";var b81;var iB8=L(()=>{u$();m0();b81=m({name:"MONITORING_THREAD_USAGE",description:"Aggregate LLM token usage and USD cost per thread for the given thread IDs.",annotations:{title:"Get Thread Usage",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:jQ.object({threadIds:jQ.array(jQ.string()).min(1).max(500).describe("Thread IDs to aggregate usage for (max 500)"),connectionId:jQ.string().optional().describe("LLM connection ID (defaults to 'decopilot')"),startDate:jQ.string().datetime().optional().describe("Filter by start date (ISO 8601 datetime string)"),endDate:jQ.string().datetime().optional().describe("Filter by end date (ISO 8601 datetime string)")}),outputSchema:jQ.object({items:jQ.array(jQ.object({threadId:jQ.string(),calls:jQ.number(),inputTokens:jQ.number(),outputTokens:jQ.number(),totalTokens:jQ.number(),costUsd:jQ.number()}))}),handler:async($,Z)=>{let X=X0(Z);return await Z.access.check(),await pQ(),{items:await Z.storage.monitoring.queryThreadUsage({organizationId:X.id,connectionId:$.connectionId??"decopilot",threadIds:$.threadIds,startDate:$.startDate?new Date($.startDate):void 0,endDate:$.endDate?new Date($.endDate):void 0})}}})});var pB8=L(()=>{cB8();lB8();dB8();mB8();iB8()});function UJ0($){return typeof $==="string"&&z24.has($.trim().toLowerCase())}var z24;var y81=L(()=>{z24=new Set([".well-known","_admin","api","auth","cli","commerce-onboarding","dbos-queue-depth","health","hosted-run-pending","login","mcp","metrics","oauth","oauth-proxy","onboarding","org","report","reset-password"])});import{z as zG}from"zod";var g81;var nB8=L(()=>{m0();y81();g81=m({name:"ORGANIZATION_CREATE",description:"Create a new organization. The caller becomes the owner automatically.",annotations:{title:"Create Organization",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!1,openWorldHint:!1},inputSchema:zG.object({slug:zG.string().min(1).max(50).regex(/^[a-z0-9-]+$/,"Slug must be lowercase alphanumeric with hyphens").refine(($)=>!UJ0($),"Slug is reserved by Studio"),name:zG.string().min(1).max(255),description:zG.string().optional()}),outputSchema:zG.object({id:zG.string(),name:zG.string(),slug:zG.string(),logo:zG.string().nullable().optional(),metadata:zG.any().optional(),createdAt:zG.string().datetime().describe("ISO 8601 timestamp"),members:zG.array(zG.any()).optional()}),handler:async($,Z)=>{G0(Z),await Z.access.check();let X=w1(Z);if(!X)throw Error("User ID required to create organization");let Q=await Z.boundAuth.organization.create({name:$.name,slug:$.slug,metadata:$.description?{description:$.description}:void 0,userId:X});if(!Q)throw Error("Failed to create organization");return{...Q,createdAt:Q.createdAt instanceof Date?Q.createdAt.toISOString():Q.createdAt}}})});import{z as jH}from"zod";var h81;var tB8=L(()=>{m0();h81=m({name:"ORGANIZATION_LIST",description:"List organizations the current user belongs to.",annotations:{title:"List Organizations",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},_meta:{ui:{visibility:"app"}},inputSchema:jH.object({}),outputSchema:jH.object({organizations:jH.array(jH.object({id:jH.string(),name:jH.string(),slug:jH.string(),logo:jH.string().nullable().optional(),metadata:jH.any().optional(),createdAt:jH.string().datetime().describe("ISO 8601 timestamp")}))}),handler:async($,Z)=>{if(G0(Z),await Z.access.check(),!w1(Z))throw Error("User ID required to list organizations");return{organizations:(await Z.boundAuth.organization.list()).map((Q)=>({...Q,createdAt:Q.createdAt instanceof Date?Q.createdAt.toISOString():Q.createdAt}))}}})});import{z as y3}from"zod";var u81;var oB8=L(()=>{m0();u81=m({name:"ORGANIZATION_GET",description:"Get an organization's details, members, and settings by slug or ID.",annotations:{title:"Get Organization",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:y3.object({}),outputSchema:y3.object({id:y3.string(),name:y3.string(),slug:y3.string(),logo:y3.string().nullable().optional(),metadata:y3.any().optional(),createdAt:y3.string().datetime().describe("ISO 8601 timestamp"),members:y3.array(y3.any()).optional(),invitations:y3.array(y3.any()).optional()}),handler:async($,Z)=>{G0(Z),await Z.access.check();let X=Z.organization?.id;if(!X)throw Error("Organization ID required (no active organization in context)");let Q=await Z.boundAuth.organization.get(X);if(!Q)throw Error("No active organization found");let Y=new Date,G=Q.invitations?.filter((J)=>new Date(J.expiresAt)>Y);return{...Q,invitations:G,createdAt:Q.createdAt instanceof Date?Q.createdAt.toISOString():Q.createdAt}}})});import{z as zK}from"zod";var c81;var rB8=L(()=>{m0();c81=m({name:"ORGANIZATION_UPDATE",description:"Update an organization's name or description.",annotations:{title:"Update Organization",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:zK.object({id:zK.string(),name:zK.string().min(1).max(255).optional(),description:zK.string().optional()}),outputSchema:zK.object({id:zK.string(),name:zK.string(),slug:zK.string(),logo:zK.string().nullable().optional(),metadata:zK.any().optional(),createdAt:zK.string().datetime().describe("ISO 8601 timestamp")}),handler:async($,Z)=>{G0(Z),await Z.access.check();let X={};if($.name)X.name=$.name;if($.description!==void 0)X.metadata={description:$.description};let Q=await Z.boundAuth.organization.update({organizationId:$.id,data:X});if(!Q)throw Error("Failed to update organization");return{...Q,createdAt:Q.createdAt instanceof Date?Q.createdAt.toISOString():Q.createdAt}}})});import{z as Hr}from"zod";var l81;var aB8=L(()=>{m0();l81=m({name:"ORGANIZATION_DELETE",description:"Archive an organization (soft delete).",annotations:{title:"Delete Organization",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:Hr.object({id:Hr.string()}),outputSchema:Hr.object({success:Hr.boolean(),id:Hr.string()}),handler:async($,Z)=>{G0(Z),await Z.access.check();let X=await Z.boundAuth.organization.get($.id);return await Z.boundAuth.organization.update({organizationId:$.id,data:{metadata:{...X?.metadata,archived:!0,archivedAt:new Date().toISOString()}}}),{success:!0,id:$.id}}})});import{z as hU}from"zod";var d81;var sB8=L(()=>{m0();DX();d81=m({name:"ORGANIZATION_SETTINGS_GET",description:"Get organization-level settings including sidebar configuration, store registry settings, simple model mode, and default home agents.",annotations:{title:"Get Organization Settings",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:hU.object({}),outputSchema:hU.object({organizationId:hU.string(),sidebar_items:hU.array(jo).nullable().optional(),enabled_plugins:hU.array(hU.string()).nullable().optional(),registry_config:zo.nullable().optional(),simple_mode:Po.nullable().optional(),default_home_agents:To.nullable().optional(),flags:Io.nullable().optional(),main_agent_id:hU.string().nullable().optional(),sprint_config:Ro.nullable().optional(),createdAt:hU.string().datetime().optional().describe("ISO 8601 timestamp"),updatedAt:hU.string().datetime().optional().describe("ISO 8601 timestamp")}),handler:async($,Z)=>{G0(Z),await Z.access.check();let X=Z.organization?.id;if(!X)throw Error("Organization ID required (no active organization in context)");let Q=await Z.storage.organizationSettings.get(X);if(!Q)return{organizationId:X};return{...Q,createdAt:Q.createdAt instanceof Date?Q.createdAt.toISOString():Q.createdAt,updatedAt:Q.updatedAt instanceof Date?Q.updatedAt.toISOString():Q.updatedAt}}})});import{z as UY}from"zod";var m81;var eB8=L(()=>{m0();DX();m81=m({name:"ORGANIZATION_SETTINGS_UPDATE",description:"Update organization-level settings such as sidebar configuration, store registry settings, simple model mode, and default home agents.",annotations:{title:"Update Organization Settings",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:UY.object({organizationId:UY.string(),sidebar_items:UY.array(jo).optional(),enabled_plugins:UY.array(UY.string()).optional(),registry_config:zo.optional(),simple_mode:Po.optional(),default_home_agents:To.optional(),flags:Io.strict().optional().describe("Org boolean toggles. Shallow-merged into the stored flags: keys you pass win (explicit false persists), omitted keys keep their value."),main_agent_id:UY.string().nullable().optional().describe("Virtual MCP id the org lands on instead of the Super Agent. Pass null to clear."),sprint_config:Ro.optional().describe("Task board sprint cadence. Replaced whole (not merged), so pass all three fields.")}),outputSchema:UY.object({organizationId:UY.string(),sidebar_items:UY.array(jo).nullable().optional(),enabled_plugins:UY.array(UY.string()).nullable().optional(),registry_config:zo.nullable().optional(),simple_mode:Po.nullable().optional(),default_home_agents:To.nullable().optional(),flags:Io.nullable().optional(),main_agent_id:UY.string().nullable().optional(),sprint_config:Ro.nullable().optional(),createdAt:UY.string().datetime().describe("ISO 8601 timestamp"),updatedAt:UY.string().datetime().describe("ISO 8601 timestamp")}),handler:async($,Z)=>{if(G0(Z),await Z.access.check(),X0(Z).id!==$.organizationId)throw Error("Cannot update settings for a different organization");let Q=await Z.storage.organizationSettings.upsert($.organizationId,{sidebar_items:$.sidebar_items,enabled_plugins:$.enabled_plugins,registry_config:$.registry_config,simple_mode:$.simple_mode,default_home_agents:$.default_home_agents,flags:$.flags,main_agent_id:$.main_agent_id,sprint_config:$.sprint_config});return{...Q,createdAt:Q.createdAt instanceof Date?Q.createdAt.toISOString():Q.createdAt,updatedAt:Q.updatedAt instanceof Date?Q.updatedAt.toISOString():Q.updatedAt}}})});import{z as PK}from"zod";var $O8,i81,p81;var ZO8=L(()=>{m0();DX();$O8=HL.extend({organizationId:PK.string(),archivedAt:PK.string().nullable().optional().describe("ISO 8601 timestamp"),createdAt:PK.string().describe("ISO 8601 timestamp"),updatedAt:PK.string().describe("ISO 8601 timestamp")}),i81=m({name:"BRAND_CONTEXT_LIST",description:"List all brand contexts (company profiles) for the current organization.",annotations:{title:"List Brand Contexts",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:PK.object({includeArchived:PK.boolean().optional().describe("Include archived brands in the list")}),outputSchema:PK.object({items:PK.array($O8)}),handler:async($,Z)=>{G0(Z),await Z.access.check();let X=Z.organization?.id;if(!X)throw Error("Organization ID required (no active organization in context)");return{items:(await Z.storage.brandContext.list(X,{includeArchived:$.includeArchived})).map((Y)=>({...Y,archivedAt:Y.archivedAt instanceof Date?Y.archivedAt.toISOString():Y.archivedAt,createdAt:Y.createdAt instanceof Date?Y.createdAt.toISOString():Y.createdAt,updatedAt:Y.updatedAt instanceof Date?Y.updatedAt.toISOString():Y.updatedAt}))}}}),p81=m({name:"BRAND_CONTEXT_GET",description:"Get a specific brand context by ID.",annotations:{title:"Get Brand Context",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:PK.object({id:PK.string().describe("Brand context ID")}),outputSchema:$O8.extend({organizationId:PK.string()}),handler:async($,Z)=>{G0(Z),await Z.access.check();let X=Z.organization?.id;if(!X)throw Error("Organization ID required (no active organization in context)");let Q=await Z.storage.brandContext.get($.id,X);if(!Q)throw Error("Brand context not found");return{...Q,archivedAt:Q.archivedAt instanceof Date?Q.archivedAt.toISOString():Q.archivedAt,createdAt:Q.createdAt instanceof Date?Q.createdAt.toISOString():Q.createdAt,updatedAt:Q.updatedAt instanceof Date?Q.updatedAt.toISOString():Q.updatedAt}}})});import{z as Kz}from"zod";var XO8,n81,t81,o81;var QO8=L(()=>{m0();DX();XO8=HL.extend({organizationId:Kz.string(),createdAt:Kz.string().describe("ISO 8601 timestamp"),updatedAt:Kz.string().describe("ISO 8601 timestamp")}),n81=m({name:"BRAND_CONTEXT_CREATE",description:"Create a new brand context (company profile) for the current organization.",annotations:{title:"Create Brand Context",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!1,openWorldHint:!1},inputSchema:HL.omit({id:!0}),outputSchema:XO8,handler:async($,Z)=>{G0(Z),await Z.access.check();let X=Z.organization?.id;if(!X)throw Error("Organization ID required (no active organization in context)");let Q=await Z.storage.brandContext.create(X,{name:$.name,domain:$.domain,overview:$.overview,logo:$.logo??null,favicon:$.favicon??null,ogImage:$.ogImage??null,fonts:$.fonts??null,colors:$.colors??null,images:$.images??null,metadata:$.metadata??null});return{...Q,archivedAt:Q.archivedAt instanceof Date?Q.archivedAt.toISOString():Q.archivedAt,createdAt:Q.createdAt instanceof Date?Q.createdAt.toISOString():Q.createdAt,updatedAt:Q.updatedAt instanceof Date?Q.updatedAt.toISOString():Q.updatedAt}}}),t81=m({name:"BRAND_CONTEXT_UPDATE",description:"Update an existing brand context by ID.",annotations:{title:"Update Brand Context",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:HL.partial().required({id:!0}),outputSchema:XO8,handler:async($,Z)=>{G0(Z),await Z.access.check();let X=Z.organization?.id;if(!X)throw Error("Organization ID required (no active organization in context)");if(!await Z.storage.brandContext.get($.id,X))throw Error("Brand context not found");let{id:Y,...G}=$;if(G.isDefault===!0)await Z.storage.brandContext.setDefault(Y,X);let J=await Z.storage.brandContext.update(Y,X,{name:G.name,domain:G.domain,overview:G.overview,logo:G.logo!==void 0?G.logo??null:void 0,favicon:G.favicon!==void 0?G.favicon??null:void 0,ogImage:G.ogImage!==void 0?G.ogImage??null:void 0,fonts:G.fonts!==void 0?G.fonts??null:void 0,colors:G.colors!==void 0?G.colors??null:void 0,images:G.images!==void 0?G.images??null:void 0,metadata:G.metadata!==void 0?G.metadata??null:void 0,archivedAt:G.archivedAt!==void 0?G.archivedAt??null:void 0,isDefault:G.isDefault===!1?!1:void 0});return{...J,archivedAt:J.archivedAt instanceof Date?J.archivedAt.toISOString():J.archivedAt,createdAt:J.createdAt instanceof Date?J.createdAt.toISOString():J.createdAt,updatedAt:J.updatedAt instanceof Date?J.updatedAt.toISOString():J.updatedAt}}}),o81=m({name:"BRAND_CONTEXT_DELETE",description:"Archive a brand context by ID (soft delete).",annotations:{title:"Archive Brand Context",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:Kz.object({id:Kz.string().describe("Brand context ID")}),outputSchema:Kz.object({success:Kz.boolean()}),handler:async($,Z)=>{G0(Z),await Z.access.check();let X=Z.organization?.id;if(!X)throw Error("Organization ID required (no active organization in context)");if(!await Z.storage.brandContext.get($.id,X))throw Error("Brand context not found");return await Z.storage.brandContext.update($.id,X,{archivedAt:new Date().toISOString(),isDefault:!1}),{success:!0}}})});async function NJ0($,Z,X){let Q=$.trim();if(!Q.startsWith("http"))Q=`https://${Q}`;let Y=await fetch("https://api.firecrawl.dev/v1/scrape",{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${Z}`},body:JSON.stringify({url:Q,formats:["branding"]})});if(!Y.ok){let N=await Y.text().catch(()=>"");throw Error(`Firecrawl API error: ${Y.status} ${N.slice(0,200)}`)}let G=await Y.json();if(!G.success||!G.data?.branding)return null;let J=G.data.branding,K=G.data.metadata??{},W=T24(J,K);return{name:K.title?.split(/[|\u2013\u2014]|\s+-\s+/).map((N)=>N.trim()).filter(Boolean)?.slice().sort((N,B)=>N.length-B.length)[0]??K.ogSiteName??X??$,domain:$,overview:K.description??"",logo:W.logo,favicon:W.favicon,ogImage:W.ogImage,fonts:W.fonts,colors:W.colors,images:null,metadata:Object.keys(W.metadata).length>0?W.metadata:null}}function T24($,Z){let X=$.images??{},Q=$.colors??{},Y={};for(let[F,U]of Object.entries(Q))if(typeof U==="string"&&U&&P24.has(F))Y[F]=U;let G={},K=($.typography??{}).fontFamilies??{};for(let[F,U]of Object.entries(K))if(typeof U==="string"&&U){let N=A24[F.toLowerCase()];if(N&&!G[N])G[N]=U}let W=$.fonts;if(Array.isArray(W))for(let F of W){let U=F.family;if(typeof U==="string"&&U&&!G.body)G.body=U}let H={};for(let F of["typography","components","spacing","layout","animations","icons","tone","personality","colorScheme"])if($[F]!==void 0)H[F]=$[F];return{logo:X.logo??null,favicon:X.favicon??null,ogImage:X.ogImage??Z.ogImage??null,fonts:Object.keys(G).length>0?G:null,colors:Object.keys(Y).length>0?Y:null,metadata:H}}var P24,A24;var r81=L(()=>{P24=new Set(["primary","secondary","accent","background","foreground"]),A24={heading:"heading",headings:"heading",head:"heading",title:"heading",body:"body",primary:"body",text:"body",code:"code",monospace:"code",mono:"code"}});import{z as BJ0}from"zod";var R24,a81;var YO8=L(()=>{m0();r81();DX();R24=HL.pick({id:!0,name:!0,domain:!0,overview:!0,logo:!0,favicon:!0,ogImage:!0,fonts:!0,colors:!0}).extend({success:BJ0.boolean()}),a81=m({name:"BRAND_CONTEXT_EXTRACT",description:"Extract brand context (colors, fonts, logos) from a website URL using Firecrawl.",annotations:{title:"Extract Brand Context",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!0},inputSchema:BJ0.object({domain:BJ0.string().describe("Website domain to extract brand from"),brandId:BJ0.string().optional().describe("Existing brand context ID to update (creates new if omitted)")}),outputSchema:R24,modelSummary:($)=>$.success?`Brand saved (id=${$.id}, name=${$.name}, domain=${$.domain}). The UI rendered the logo, colors, fonts, and overview.`:"Brand extraction failed.",handler:async($,Z)=>{G0(Z),await Z.access.check();let X=Z.organization?.id;if(!X)throw Error("Organization ID required (no active organization in context)");let Q=Z.firecrawlApiKey;if(!Q)throw Error("FIRECRAWL_API_KEY is not configured. Set the environment variable to enable brand extraction.");let Y=await NJ0($.domain,Q,$.domain);if(!Y)throw Error("Firecrawl did not return branding data for this URL");let G={name:Y.name,domain:Y.domain,overview:Y.overview,logo:Y.logo,favicon:Y.favicon,ogImage:Y.ogImage,fonts:Y.fonts,colors:Y.colors,images:Y.images,metadata:Y.metadata},J=$.brandId?await(async()=>{if(!await Z.storage.brandContext.get($.brandId,X))throw Error("Brand context not found");return Z.storage.brandContext.update($.brandId,X,G)})():await Z.storage.brandContext.create(X,G);return{id:J.id,name:J.name,domain:J.domain,overview:J.overview,logo:J.logo,favicon:J.favicon,ogImage:J.ogImage,fonts:J.fonts,colors:J.colors,success:!0}}})});function GO8($){let Z=$.metadata??{};return{id:$.id,name:$.name,domain:$.domain||void 0,colors:$.colors??void 0,fonts:$.fonts??void 0,assets:$.logo||$.favicon||$.ogImage?{logo:$.logo??void 0,favicon:$.favicon??void 0,ogImage:$.ogImage??void 0}:void 0,overview:$.overview||void 0,tagline:typeof Z.tagline==="string"?Z.tagline:void 0,tone:typeof Z.tone==="string"?Z.tone:void 0,metadata:(()=>{let X=Object.fromEntries(Object.entries(Z).filter(([Q])=>Q!=="tagline"&&Q!=="tone"));return Object.keys(X).length>0?X:void 0})()}}var s81,e81;var JO8=L(()=>{$81();m0();s81=m({name:"BRAND_GET",description:"Get a brand context by ID. Omit the ID to get the default brand for the organization.",annotations:{title:"Get Brand",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:m30,outputSchema:ro,handler:async($,Z)=>{G0(Z),await Z.access.check();let X=Z.organization?.id;if(!X)throw Error("Organization ID required (no active organization in context)");let Q=$.id?await Z.storage.brandContext.get($.id,X):await Z.storage.brandContext.getDefault(X);if(!Q)throw Error($.id?"Brand not found":"No default brand configured");return GO8(Q)}}),e81=m({name:"BRAND_LIST",description:"List all active brands for the current organization.",annotations:{title:"List Brands",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:i30,outputSchema:p30,handler:async($,Z)=>{G0(Z),await Z.access.check();let X=Z.organization?.id;if(!X)throw Error("Organization ID required (no active organization in context)");return{items:(await Z.storage.brandContext.list(X)).map(GO8)}}})});import{resolveTxt as I24}from"dns/promises";function $61($){return`${q24}.${$.toLowerCase()}`}function KO8(){return`deco-verify-${crypto.randomUUID().replace(/-/g,"")}`}async function WO8($,Z,X=I24){if(!Z)return!1;try{return(await X($61($))).some((Y)=>Y.join("").trim()===Z)}catch{return!1}}var q24="_deco-verify";var HO8=()=>{};import{z as l5}from"zod";function ML($){let Z=$.verificationStatus==="pending"&&Boolean($.verificationToken);return{id:$.id,domain:$.domain,joinMode:$.joinMode,verificationStatus:$.verificationStatus,verificationMethod:$.verificationMethod,verifiedAt:$.verifiedAt?new Date($.verifiedAt).toISOString():null,recordName:Z?$61($.domain):null,recordValue:Z?$.verificationToken:null}}function V24($){let Z=$.toLowerCase().trim();if(!M24.test(Z))throw Error(`Invalid domain format: "${Z}". Must be a valid domain like "acme.com"`);if(AK.has(Z))throw Error(`Cannot claim generic email domain "${Z}". Only corporate domains are allowed.`);return Z}var M24,Z61,OJ0,X61,Q61,Y61,G61,J61;var FO8=L(()=>{PG();HO8();m0();M24=/^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+$/,Z61=l5.enum(["off","auto","request"]),OJ0=l5.object({id:l5.string(),domain:l5.string(),joinMode:Z61,verificationStatus:l5.enum(["pending","verified"]),verificationMethod:l5.enum(["email","dns"]).nullable(),verifiedAt:l5.string().nullable(),recordName:l5.string().nullable(),recordValue:l5.string().nullable()});X61=m({name:"ORGANIZATION_DOMAIN_LIST",description:"List the email domains claimed by an organization.",annotations:{title:"List Organization Domains",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:l5.object({}),outputSchema:l5.object({domains:l5.array(OJ0)}),handler:async($,Z)=>{G0(Z),await Z.access.check();let X=X0(Z);return{domains:(await Z.storage.organizationDomains.listByOrganizationId(X.id)).map(ML)}}}),Q61=m({name:"ORGANIZATION_DOMAIN_ADD",description:"Claim an email domain for an organization. If the caller's verified email matches the domain it is trusted immediately; otherwise it requires DNS verification.",annotations:{title:"Add Organization Domain",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:l5.object({domain:l5.string().min(1).max(255).describe("Domain to claim, e.g. acme.com"),joinMode:Z61.optional().describe("Initial join mode (only applied when the domain is trusted immediately via email match).")}),outputSchema:OJ0,handler:async($,Z)=>{G0(Z),await Z.access.check();let X=X0(Z),Q=V24($.domain),G=Z.auth.user?.email?.split("@")[1]?.toLowerCase(),J=Boolean(Z.auth.user?.emailVerified)&&G===Q,K=await Z.storage.organizationDomains.getByOrgAndDomain(X.id,Q);if(K){if(K.verificationStatus!=="verified"&&J){let H=await Z.storage.organizationDomains.markVerified(K.id,"email");return ML(H)}return ML(K)}let W=J?await Z.storage.organizationDomains.add(X.id,Q,{joinMode:$.joinMode??"off",verificationStatus:"verified",verificationMethod:"email"}):await Z.storage.organizationDomains.add(X.id,Q,{joinMode:"off",verificationStatus:"pending",verificationToken:KO8()});return ML(W)}}),Y61=m({name:"ORGANIZATION_DOMAIN_UPDATE",description:"Set the join mode for a claimed domain. Discoverable modes (auto/request) require the domain to be verified.",annotations:{title:"Update Organization Domain",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:l5.object({id:l5.string(),joinMode:Z61}),outputSchema:OJ0,handler:async($,Z)=>{G0(Z),await Z.access.check();let X=X0(Z),Q=await Z.storage.organizationDomains.getById($.id);if(!Q||Q.organizationId!==X.id)throw Error("Domain not found");if($.joinMode!=="off"&&Q.verificationStatus!=="verified")throw Error("Verify the domain before enabling auto-join or requests.");let Y=await Z.storage.organizationDomains.updateJoinMode($.id,$.joinMode);return ML(Y)}}),G61=m({name:"ORGANIZATION_DOMAIN_VERIFY",description:"Check the DNS TXT record for a pending domain and mark it verified if present.",annotations:{title:"Verify Organization Domain",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!0},inputSchema:l5.object({id:l5.string()}),outputSchema:l5.object({verified:l5.boolean(),domain:OJ0}),handler:async($,Z)=>{G0(Z),await Z.access.check();let X=X0(Z),Q=await Z.storage.organizationDomains.getById($.id);if(!Q||Q.organizationId!==X.id)throw Error("Domain not found");if(Q.verificationStatus==="verified")return{verified:!0,domain:ML(Q)};if(!Q.verificationToken)throw Error("Domain has no pending DNS verification.");if(!await WO8(Q.domain,Q.verificationToken))return{verified:!1,domain:ML(Q)};let G=await Z.storage.organizationDomains.markVerified($.id,"dns");return{verified:!0,domain:ML(G)}}}),J61=m({name:"ORGANIZATION_DOMAIN_REMOVE",description:"Remove a claimed domain from an organization.",annotations:{title:"Remove Organization Domain",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:l5.object({id:l5.string()}),outputSchema:l5.object({success:l5.boolean()}),handler:async($,Z)=>{G0(Z),await Z.access.check();let X=X0(Z),Q=await Z.storage.organizationDomains.getById($.id);if(!Q||Q.organizationId!==X.id)throw Error("Domain not found");return await Z.storage.organizationDomains.removeById($.id),{success:!0}}})});function VL($){return($ instanceof Error?$.message.toLowerCase():"").includes("already a member")}import{z as h9}from"zod";var k24,K61,W61,H61;var UO8=L(()=>{m0();l4();k24=h9.object({id:h9.string(),userId:h9.string(),status:h9.enum(["pending","approved","denied"]),createdAt:h9.string(),user:h9.object({id:h9.string(),name:h9.string(),email:h9.string(),image:h9.string().nullable()}).nullable()}),K61=m({name:"ORGANIZATION_JOIN_REQUEST_LIST",description:"List pending requests to join the organization.",annotations:{title:"List Join Requests",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:h9.object({}),outputSchema:h9.object({requests:h9.array(k24)}),handler:async($,Z)=>{G0(Z),await Z.access.check();let X=X0(Z);return{requests:(await Z.storage.organizationJoinRequests.listPendingWithUser(X.id)).map((Y)=>({id:Y.id,userId:Y.userId,status:Y.status,createdAt:new Date(Y.createdAt).toISOString(),user:Y.user}))}}}),W61=m({name:"ORGANIZATION_JOIN_REQUEST_APPROVE",description:"Approve a pending join request, adding the user as a member.",annotations:{title:"Approve Join Request",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:h9.object({requestId:h9.string()}),outputSchema:h9.object({success:h9.boolean()}),handler:async($,Z)=>{G0(Z),await Z.access.check();let X=X0(Z),Q=await Z.storage.organizationJoinRequests.getById($.requestId);if(!Q||Q.organizationId!==X.id)throw Error("Join request not found");if(Q.status!=="pending")throw Error("Join request has already been decided");let Y=w1(Z);if(!await Z.storage.organizationJoinRequests.decide(Q.id,"approved",Y??Q.userId))return{success:!0};try{await Z.boundAuth.organization.addMember({organizationId:X.id,userId:Q.userId,role:["user"]})}catch(J){if(!VL(J))throw J}if(Y)p1.capture({distinctId:Y,event:"organization_join_request_approved",groups:{organization:X.id},properties:{organization_id:X.id,user_id:Q.userId}});return{success:!0}}}),H61=m({name:"ORGANIZATION_JOIN_REQUEST_DENY",description:"Deny a pending join request.",annotations:{title:"Deny Join Request",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:h9.object({requestId:h9.string()}),outputSchema:h9.object({success:h9.boolean()}),handler:async($,Z)=>{G0(Z),await Z.access.check();let X=X0(Z),Q=await Z.storage.organizationJoinRequests.getById($.requestId);if(!Q||Q.organizationId!==X.id)throw Error("Join request not found");if(Q.status!=="pending")throw Error("Join request has already been decided");let Y=w1(Z);if(await Z.storage.organizationJoinRequests.decide(Q.id,"denied",Y??Q.userId)&&Y)p1.capture({distinctId:Y,event:"organization_join_request_denied",groups:{organization:X.id},properties:{organization_id:X.id,user_id:Q.userId}});return{success:!0}}})});import{z as NY}from"zod";var F61;var NO8=L(()=>{l4();m0();KY();F61=m({name:"ORGANIZATION_MEMBER_ADD",description:"Invite a member to the organization by email with an assigned role.",annotations:{title:"Add Organization Member",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:NY.object({organizationId:NY.string().optional(),userId:NY.string(),role:NY.array(NY.string())}),outputSchema:NY.object({id:NY.string(),organizationId:NY.string(),userId:NY.string(),role:NY.union([NY.string(),NY.array(NY.string())]),createdAt:NY.string().datetime().describe("ISO 8601 timestamp")}),handler:async($,Z)=>{G0(Z),await Z.access.check();let X=$.organizationId||Z.organization?.id;if(!X)throw Error("Organization ID required (no active organization in context)");if(X!==Z.organization?.id)throw Error("Organization ID does not match authenticated organization");let Q=await Z.db.selectFrom("member").select(["role"]).where("userId","=",w1(Z)??"").where("organizationId","=",X).executeTakeFirst();if(!PG0(Q?.role,$.role))throw Error(`Insufficient privileges to assign role "${$.role.join(",")}"`);let Y=await Z.boundAuth.organization.addMember({organizationId:X,userId:$.userId,role:$.role});if(!Y)throw Error("Failed to add member");let G=w1(Z);if(G)p1.capture({distinctId:G,event:"organization_member_added",groups:{organization:X},properties:{organization_id:X,added_user_id:$.userId,role:$.role}});return{...Y,role:Y.role,createdAt:Y.createdAt instanceof Date?Y.createdAt.toISOString():Y.createdAt}}})});import{z as uh}from"zod";var U61;var BO8=L(()=>{l4();m0();U61=m({name:"ORGANIZATION_MEMBER_REMOVE",description:"Remove a member from the organization. Revokes all their access immediately.",annotations:{title:"Remove Organization Member",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:uh.object({organizationId:uh.string().optional(),memberIdOrEmail:uh.string()}),outputSchema:uh.object({success:uh.boolean(),memberIdOrEmail:uh.string()}),handler:async($,Z)=>{G0(Z),await Z.access.check();let X=$.organizationId||Z.organization?.id;if(!X)throw Error("Organization ID required (no active organization in context)");if(X!==Z.organization?.id)throw Error("Organization ID does not match authenticated organization");let Q=await Z.boundAuth.organization.removeMember({organizationId:X,memberIdOrEmail:$.memberIdOrEmail});Z.invalidateMemberRole?.(Q.member.userId,X);let Y=w1(Z);if(Y)p1.capture({distinctId:Y,event:"organization_member_removed",groups:{organization:X},properties:{organization_id:X,member_id_or_email:$.memberIdOrEmail}});return{success:!0,memberIdOrEmail:$.memberIdOrEmail}}})});import{z as zX}from"zod";var N61;var OO8=L(()=>{m0();N61=m({name:"ORGANIZATION_MEMBER_LIST",description:"List all members in the organization with their roles.",annotations:{title:"List Organization Members",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:zX.object({limit:zX.number().int().min(1).max(1000).optional(),offset:zX.number().int().min(0).optional()}),outputSchema:zX.object({members:zX.array(zX.object({id:zX.string(),organizationId:zX.string(),userId:zX.string(),role:zX.string(),createdAt:zX.string().datetime().describe("ISO 8601 timestamp"),user:zX.object({id:zX.string(),name:zX.string(),email:zX.string(),image:zX.string().optional()}).optional()}))}),handler:async($,Z)=>{G0(Z),await Z.access.check();let X=Z.organization?.id;if(!X)throw Error("Organization ID required (no active organization in context)");return{members:((await Z.boundAuth.organization.listMembers({organizationId:X,limit:$.limit,offset:$.offset}))?.members??[]).map((G)=>({...G,createdAt:G.createdAt instanceof Date?G.createdAt.toISOString():G.createdAt}))}}})});import{z as Z7}from"zod";var B61;var LO8=L(()=>{l4();m0();KY();B61=m({name:"ORGANIZATION_MEMBER_UPDATE_ROLE",description:"Change a member's role (e.g., admin, member) within the organization.",annotations:{title:"Update Member Role",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:Z7.object({organizationId:Z7.string().optional(),memberId:Z7.string(),role:Z7.array(Z7.string())}),outputSchema:Z7.object({id:Z7.string(),organizationId:Z7.string(),userId:Z7.string(),role:Z7.union([Z7.string(),Z7.array(Z7.string())]),createdAt:Z7.string().datetime().describe("ISO 8601 timestamp"),user:Z7.object({email:Z7.string(),name:Z7.string(),image:Z7.string().optional()})}),handler:async($,Z)=>{G0(Z),await Z.access.check();let X=$.organizationId||Z.organization?.id;if(!X)throw Error("Organization ID required (no active organization in context)");let Q=await Z.db.selectFrom("member").select(["role"]).where("userId","=",w1(Z)??"").where("organizationId","=",X).executeTakeFirst();if(!PG0(Q?.role,$.role))throw Error(`Insufficient privileges to assign role "${$.role.join(",")}"`);let Y=await Z.boundAuth.organization.updateMemberRole({organizationId:X,memberId:$.memberId,role:$.role});if(!Y)throw Error("Failed to update member role");Z.invalidateMemberRole?.(Y.userId,X);let G=w1(Z);if(G)p1.capture({distinctId:G,event:"organization_member_role_updated",groups:{organization:X},properties:{organization_id:X,member_id:$.memberId,target_user_id:Y.userId,new_role:Array.isArray($.role)?$.role.join(","):$.role}});return{...Y,createdAt:Y.createdAt instanceof Date?Y.createdAt.toISOString():Y.createdAt}}})});async function wO8(){if(Fr&&Date.now()-Fr.fetchedAt<600000)return Fr.rate;try{let Z=await(await fetch("https://economia.awesomeapi.com.br/json/last/USD-BRL",{signal:AbortSignal.timeout(5000)})).json(),X=parseFloat(Z.USDBRL?.bid??"");if(Number.isNaN(X)||X<=0)throw Error("Invalid rate");return Fr={rate:X,fetchedAt:Date.now()},X}catch{return Fr?.rate??5.5}}function DO8($,Z,X){if(Z==="brl")return Math.round($/X);return $}var Fr=null;function O61($,Z="",X=new URLSearchParams){for(let[Q,Y]of Object.entries($)){if(Y===void 0||Y===null)continue;let G=Z?`${Z}[${Q}]`:Q;if(Array.isArray(Y))Y.forEach((J,K)=>{if(typeof J==="object"&&J!==null)O61(J,`${G}[${K}]`,X);else X.append(`${G}[${K}]`,String(J))});else if(typeof Y==="object")O61(Y,G,X);else X.append(G,String(Y))}return X}async function Ur($,Z){let X=o0().stripeSecretKey;if(!X)throw new AG(503,"billing is not configured");let Q=Z?.params?O61(Z.params).toString():void 0,Y=await fetch(`${S24}${$}`,{method:Z?.method??(Q?"POST":"GET"),headers:{Authorization:`Bearer ${X}`,...Q&&{"Content-Type":"application/x-www-form-urlencoded"}},body:Q,signal:AbortSignal.timeout(C24)}),G=await Y.json().catch(()=>({}));if(!Y.ok){let J=G.error?.message??`HTTP ${Y.status}`;throw new AG(Y.status,J)}return G}function EO8($){return{billing_address_collection:"required",tax_id_collection:{enabled:!0},...$&&{customer_update:{address:"auto",name:"auto"}}}}async function jO8($){let Z=o0().stripeOrgPriceId;if(!Z)throw new AG(503,"billing is not configured");let X=await Ur("/checkout/sessions",{params:{mode:"subscription",...EO8(null),line_items:[{price:Z,quantity:1}],success_url:$.successUrl,cancel_url:$.cancelUrl,metadata:{orgId:$.organizationId},subscription_data:{metadata:{orgId:$.organizationId}}}});if(!X.url)throw new AG(500,"checkout session lacks url");return{url:X.url}}function _24($,Z){return Math.round($*(1+Z/100))}async function zO8($){let Z=_24($.amountCents,$.feePercent),X=DO8($.amountCents,$.currency,await wO8()),Q=o0().stripeTopupProductId,Y={kind:"topup",orgId:$.organizationId,creditCents:X},G=$.currency==="brl"?`Studio AI credits (R$ ${($.amountCents/100).toFixed(2)})`:`Studio AI credits ($${($.amountCents/100).toFixed(2)})`,J=await Ur("/checkout/sessions",{params:{mode:"payment",...$.customerId&&{customer:$.customerId},...EO8($.customerId),line_items:[{quantity:1,price_data:{currency:$.currency,unit_amount:Z,...Q?{product:Q}:{product_data:{name:G}}}}],success_url:$.successUrl,cancel_url:$.cancelUrl,metadata:Y,payment_intent_data:{metadata:Y}}});if(!J.url)throw new AG(500,"checkout session lacks url");return{url:J.url}}async function LJ0($){let Z=await Ur("/billing_portal/sessions",{params:{customer:$.customerId,return_url:$.returnUrl}});if(!Z.url)throw new AG(500,"portal session lacks url");return{url:Z.url}}async function wJ0($){return Ur(`/subscriptions/${encodeURIComponent($)}`)}async function PO8($){await Ur(`/subscriptions/${encodeURIComponent($)}`,{method:"DELETE"})}var S24="https://api.stripe.com/v1",AG,C24=15000;var Wz=L(()=>{_8();AG=class AG extends Error{status;constructor($,Z){super(`Stripe API ${$}: ${Z}`);this.status=$;this.name="StripeApiError"}}});import{z as L61}from"zod";var w61;var AO8=L(()=>{Wz();L9();m0();l4();w61=m({name:"ORGANIZATION_BILLING_CHECKOUT_START",description:"Start the organization's subscription: creates a Stripe Checkout session and returns its URL.",annotations:{title:"Start Billing Checkout",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!1,openWorldHint:!0},inputSchema:L61.object({}),outputSchema:L61.object({url:L61.string()}),handler:async($,Z)=>{G0(Z),await Z.access.check();let X=Z.organization?.id,Q=Z.organization?.slug;if(!X||!Q)throw Error("Organization context required");let Y=await Z.storage.organizationBilling.getBilling(X);if(Y?.status==="active")throw Error("This organization already has an active subscription.");if(Y?.stripeSubscriptionId)throw Error("This organization still has a subscription on file \u2014 settle or cancel it before starting a new checkout.");let G=`${s9()}/${encodeURIComponent(Q)}/members`,{url:J}=await jO8({organizationId:X,successUrl:`${G}?checkout=success`,cancelUrl:`${G}?checkout=canceled`});return wG({event:"subscription_checkout_started",organizationId:X,...Z.auth?.user?.id?{userId:Z.auth.user.id}:{}}),{url:J}}})});import{z as D61}from"zod";var E61;var TO8=L(()=>{Wz();L9();m0();E61=m({name:"ORGANIZATION_BILLING_PORTAL",description:"Open the organization's Stripe billing portal (manage card, invoices, cancellation). Returns the portal URL.",annotations:{title:"Open Billing Portal",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!1,openWorldHint:!0},inputSchema:D61.object({}),outputSchema:D61.object({url:D61.string()}),handler:async($,Z)=>{G0(Z),await Z.access.check();let X=X0(Z);if(!X.slug)throw Error("Organization context required");let Q=await Z.storage.organizationBilling.getBilling(X.id);if(!Q?.stripeCustomerId)throw Error("This organization has no billing account yet \u2014 subscribe first.");try{return await LJ0({customerId:Q.stripeCustomerId,returnUrl:`${s9()}/${encodeURIComponent(X.slug)}/members`})}catch(Y){if(Y instanceof AG)throw Error(Y.message);throw Y}}})});function DJ0($){return j61[$%j61.length]??v24}function BY($){return $.createdBy==="system"}function uU($){return EJ0.filter((Z)=>Rh($,x24[Z]))}function lh($,Z){return $?.startsWith(`${ch[Z]}:`)??!1}function cU($){let Z=0;for(let X of $){if(X.action!=="status_changed")continue;if(X.data?.to!=="in_review")continue;Z=Math.max(Z,new Date(X.occurredAt).getTime())}return Z}function z61($,Z){let X=cU($),Q=new Map;for(let Y of $){if(Y.action!=="review_approved"&&Y.action!=="review_changes_requested")continue;if(new Date(Y.occurredAt).getTime()<X)continue;let G=Y.data??{};if(G.reviewer!=="qa"&&G.reviewer!=="code_review")continue;if(Y.action==="review_approved"){if(Z?.verifiedOnly&&G.verified!==!0)continue;Q.set(G.reviewer,"approved")}else Q.set(G.reviewer,"changes_requested")}return Q}function kL($,Z,X){if(Z.length===0)return!1;let Q=z61($,X);return Z.every((Y)=>Q.get(Y)==="approved")}function IO8($,Z){return kL($,Z)&&!kL($,Z,{verifiedOnly:!0})}function qO8($){let Z=null;for(let X of $){if(X.action!=="review_approved"&&X.action!=="review_changes_requested")continue;let Q=new Date(X.occurredAt).getTime();if(Z&&Q<Z.at)continue;let Y=X.data?.notes;Z={at:Q,notes:X.action==="review_changes_requested"&&typeof Y==="string"?Y:null}}return Z?.notes??null}function f24($){let Z=0;for(let X of $){if(X.action!=="assignee_changed")continue;if(X.data?.to!==_6)continue;Z=Math.max(Z,new Date(X.occurredAt).getTime())}return Z}function MO8($,Z=P61){let X=f24($),Q=new Set,Y=0;for(let G of[...$].sort((J,K)=>J.occurredAt.localeCompare(K.occurredAt))){let J=new Date(G.occurredAt).getTime();if(G.action==="status_changed"){if(G.data?.to==="in_review")Y=J;continue}if(G.action==="review_changes_requested"&&J>=X)Q.add(Y)}return Q.size+1>=Z}var _6="super-agent",j61,v24,Nr='Your checkout is SHALLOW (`git clone --depth 1`), so it has no merge base and `git diff main...HEAD` (three dots) fails with "fatal: main...HEAD: no merge base". To see a branch diff, either use the two-dot form against the fetched remote ref (`git fetch origin <base> && git diff origin/<base> HEAD`), or deepen first with `git fetch --deepen=100`. Same for `git log main..HEAD` and anything else that needs shared history.',RO8,EJ0,ch,x24,P61=5,VO8="task-board.item.updated",kO8="task-board.item.deleted";var P9=L(()=>{DX();j61=["#9ca3af","#ef4444","#f97316","#f59e0b","#22c55e","#3b82f6","#a855f7","#ec4899"],v24=j61[0];RO8="Read the diff with `gh pr diff <number>`. It comes from the API, so it needs no fetch, no merge base, and is unaffected by the shallow checkout. "+"Read it ONCE \u2014 `gh pr diff <number> --name-only` first if you need to size "+"it, then pull the hunks you need per FILE. Do NOT re-run the diff sliced by directory: each slice re-reads bytes you already have into every remaining turn's context, and it is the largest avoidable cost in a review.",EJ0=["qa","code_review"],ch={qa:"QA Agent",code_review:"Code Reviewer"},x24={qa:"qa_agent_enabled",code_review:"code_reviewer_enabled"}});function A61($){return $==="trial"?"trial":"subscription"}function Br($,Z,X,Q={}){wG({event:Z,organizationId:X.organizationId,...$.auth?.user?.id?{userId:$.auth.user.id}:{},properties:{task_id:X.id,...Q}})}function T61($){return $?.status==="active"||$?.status==="past_due"}function jJ0($,Z){if(T61($))return{periodKey:$?.currentPeriodEnd?`sub:${$.currentPeriodEnd.toISOString()}`:"sub:pending",limit:$?.monthlyTaskExecutions??Z.monthlyTaskExecutions,exhaustedReason:"monthly_exhausted"};return{periodKey:"trial",limit:$?.freeTaskExecutions??Z.freeTaskExecutions,exhaustedReason:"trial_exhausted"}}function Or(){let $=o0();return{enforced:$.taskQuotaEnforced,freeTaskExecutions:$.freeTaskExecutions,monthlyTaskExecutions:$.monthlyTaskExecutions,maxRunsPerTask:$.maxRunsPerTask}}function SL(){return{...Or(),maxRunsPerTask:Number.POSITIVE_INFINITY}}async function dh($,Z,X=Or()){if(!X.enforced||!BY(Z))return;let Q=await $.storage.organizationBilling.taskClaim(Z.id);if(Q&&Q.runCount>=X.maxRunsPerTask)throw Br($,"task_quota_blocked",Z,{phase:"precheck",reason:"runs_exhausted"}),new PX("runs_exhausted");if(Q&&Q.state!=="released")return;let Y=await $.storage.organizationBilling.getBilling(Z.organizationId),G=jJ0(Y,X);if(await $.storage.organizationBilling.countTaskClaims(Z.organizationId,G.periodKey)>=G.limit)throw Br($,"task_quota_blocked",Z,{phase:"precheck",reason:G.exhaustedReason,billing_mode:A61(G.periodKey),limit:G.limit}),new PX(G.exhaustedReason)}async function SO8($,Z,X=Or()){if(!X.enforced||!BY(Z))return"skipped";let Q=await $.storage.organizationBilling.getBilling(Z.organizationId),Y=jJ0(Q,X),G=await $.storage.organizationBilling.claimTaskUnderLimit(Z.organizationId,Z.id,Y.periodKey,Y.limit,X.maxRunsPerTask);if(G==="exhausted")throw Br($,"task_quota_blocked",Z,{phase:"claim",reason:Y.exhaustedReason,billing_mode:A61(Y.periodKey),limit:Y.limit}),new PX(Y.exhaustedReason);if(G==="runs_exhausted")throw Br($,"task_quota_blocked",Z,{phase:"claim",reason:"runs_exhausted"}),new PX("runs_exhausted");if(G==="claimed")Br($,"task_quota_claimed",Z,{billing_mode:A61(Y.periodKey),period_key:Y.periodKey,limit:Y.limit});return G}async function CO8($,Z,X,Q){if(Q==="skipped")return;await $.rollbackTaskClaim(Z,X,{releaseSlot:Q==="claimed"}).catch((Y)=>console.error("[task-quota] rollback failed (stays charged)",Y))}async function _O8($,Z){let X=await $.storage.organizationBilling.taskClaim(Z);return!!X&&X.state!=="released"}async function vO8($,Z,X){if(await $.releaseTaskClaim(Z,X).catch((Y)=>{return console.error("[task-quota] refund failed (stays charged)",Y),!1}))wG({event:"task_quota_refunded",organizationId:Z,properties:{task_id:X}})}var b24="[SUBSCRIPTION_REQUIRED]",y24,PX;var g3=L(()=>{P9();l4();_8();y24={trial_exhausted:"this organization used its free task executions \u2014 subscribe to keep running tasks",monthly_exhausted:"this organization used its monthly task executions \u2014 more become available next billing cycle",runs_exhausted:"this task reached its execution limit \u2014 create a new task to keep going"};PX=class PX extends Error{reason;constructor($){super(`${b24} ${y24[$]}`);this.reason=$;this.name="TaskQuotaError"}}});import{z as lU}from"zod";var R61;var xO8=L(()=>{m0();g3();R61=m({name:"ORGANIZATION_TASK_QUOTA_GET",description:"Get the organization's auto-task quota: how many runs are used in the current period, the limit, and the subscription's billing status.",annotations:{title:"Get Task Quota",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:lU.object({}),outputSchema:lU.object({enforced:lU.boolean(),billingStatus:lU.string(),subscribed:lU.boolean(),hasBillingAccount:lU.boolean(),used:lU.number(),limit:lU.number(),currentPeriodEnd:lU.string().datetime().nullable()}),handler:async($,Z)=>{G0(Z),await Z.access.check();let X=X0(Z),Q=Or(),Y=await Z.storage.organizationBilling.getBilling(X.id),G=jJ0(Y,Q),J=await Z.storage.organizationBilling.countTaskClaims(X.id,G.periodKey);return{enforced:Q.enforced,billingStatus:Y?.status??"none",subscribed:T61(Y),hasBillingAccount:!!Y?.stripeCustomerId,used:J,limit:G.limit,currentPeriodEnd:Y?.currentPeriodEnd?.toISOString()??null}}})});var fO8=L(()=>{nB8();tB8();oB8();rB8();aB8();sB8();eB8();ZO8();QO8();YO8();JO8();FO8();UO8();NO8();BO8();OO8();LO8();AO8();TO8();xO8()});function zH($){if($==null)return"unknown error";if(typeof $==="string")return $;if($ instanceof Error)return $.message;return JSON.stringify($)}function zJ0($){if($===null||typeof $==="string"||typeof $==="number"||typeof $==="boolean")return!0;if(Array.isArray($))return $.every(zJ0);if(typeof $==="object")return Object.entries($).every(([Z,X])=>typeof Z==="string"&&(X===void 0||zJ0(X)));return!1}function I61($){return Array.isArray($)&&$.every(zJ0)}function Lr($){return $!=null&&typeof $==="object"&&Object.entries($).every(([Z,X])=>typeof Z==="string"&&(X===void 0||zJ0(X)))}var FL8="vercel.ai.error",h24,bO8,yO8,E1,UL8="AI_APICallError",NL8,u24,gO8,hO8,D4,BL8="AI_EmptyResponseBodyError",OL8,c24,uO8,cO8,PJ0,LL8="AI_InvalidArgumentError",wL8,l24,lO8,dO8,CL,DL8="AI_InvalidPromptError",EL8,d24,mO8,iO8,h3,jL8="AI_InvalidResponseDataError",zL8,m24,pO8,nO8,mh,PL8="AI_JSONParseError",AL8,i24,tO8,oO8,dU,TL8="AI_LoadAPIKeyError",RL8,p24,rO8,aO8,Hz,IL8="AI_LoadSettingError",qL8,n24,sO8,eO8,ML8,VL8="AI_NoContentGeneratedError",kL8,t24,$L8,ZL8,SL8,CL8="AI_NoSuchModelError",_L8,o24,XL8,QL8,Z9,vL8="AI_TooManyEmbeddingValuesForCallError",xL8,r24,YL8,GL8,ih,fL8="AI_TypeValidationError",bL8,a24,JL8,KL8,V5,yL8="AI_UnsupportedFunctionalityError",gL8,s24,WL8,HL8,m4;var Y8=L(()=>{h24=Symbol.for(FL8),E1=class $ extends(yO8=Error,bO8=h24,yO8){constructor({name:Z,message:X,cause:Q}){super(X);this[bO8]=!0,this.name=Z,this.cause=Q}static isInstance(Z){return $.hasMarker(Z,FL8)}static hasMarker(Z,X){let Q=Symbol.for(X);return Z!=null&&typeof Z==="object"&&Q in Z&&typeof Z[Q]==="boolean"&&Z[Q]===!0}},NL8=`vercel.ai.error.${UL8}`,u24=Symbol.for(NL8),D4=class extends(hO8=E1,gO8=u24,hO8){constructor({message:$,url:Z,requestBodyValues:X,statusCode:Q,responseHeaders:Y,responseBody:G,cause:J,isRetryable:K=Q!=null&&(Q===408||Q===409||Q===429||Q>=500),data:W}){super({name:UL8,message:$,cause:J});this[gO8]=!0,this.url=Z,this.requestBodyValues=X,this.statusCode=Q,this.responseHeaders=Y,this.responseBody=G,this.isRetryable=K,this.data=W}static isInstance($){return E1.hasMarker($,NL8)}},OL8=`vercel.ai.error.${BL8}`,c24=Symbol.for(OL8),PJ0=class extends(cO8=E1,uO8=c24,cO8){constructor({message:$="Empty response body"}={}){super({name:BL8,message:$});this[uO8]=!0}static isInstance($){return E1.hasMarker($,OL8)}};wL8=`vercel.ai.error.${LL8}`,l24=Symbol.for(wL8),CL=class extends(dO8=E1,lO8=l24,dO8){constructor({message:$,cause:Z,argument:X}){super({name:LL8,message:$,cause:Z});this[lO8]=!0,this.argument=X}static isInstance($){return E1.hasMarker($,wL8)}},EL8=`vercel.ai.error.${DL8}`,d24=Symbol.for(EL8),h3=class extends(iO8=E1,mO8=d24,iO8){constructor({prompt:$,message:Z,cause:X}){super({name:DL8,message:`Invalid prompt: ${Z}`,cause:X});this[mO8]=!0,this.prompt=$}static isInstance($){return E1.hasMarker($,EL8)}},zL8=`vercel.ai.error.${jL8}`,m24=Symbol.for(zL8),mh=class extends(nO8=E1,pO8=m24,nO8){constructor({data:$,message:Z=`Invalid response data: ${JSON.stringify($)}.`}){super({name:jL8,message:Z});this[pO8]=!0,this.data=$}static isInstance($){return E1.hasMarker($,zL8)}},AL8=`vercel.ai.error.${PL8}`,i24=Symbol.for(AL8),dU=class extends(oO8=E1,tO8=i24,oO8){constructor({text:$,cause:Z}){super({name:PL8,message:`JSON parsing failed: Text: ${$}.
 Error message: ${zH(Z)}`,cause:Z});this[tO8]=!0,this.text=$}static isInstance($){return E1.hasMarker($,AL8)}},RL8=`vercel.ai.error.${TL8}`,p24=Symbol.for(RL8),Hz=class extends(aO8=E1,rO8=p24,aO8){constructor({message:$}){super({name:TL8,message:$});this[rO8]=!0}static isInstance($){return E1.hasMarker($,RL8)}},qL8=`vercel.ai.error.${IL8}`,n24=Symbol.for(qL8),ML8=class extends(eO8=E1,sO8=n24,eO8){constructor({message:$}){super({name:IL8,message:$});this[sO8]=!0}static isInstance($){return E1.hasMarker($,qL8)}},kL8=`vercel.ai.error.${VL8}`,t24=Symbol.for(kL8),SL8=class extends(ZL8=E1,$L8=t24,ZL8){constructor({message:$="No content generated."}={}){super({name:VL8,message:$});this[$L8]=!0}static isInstance($){return E1.hasMarker($,kL8)}},_L8=`vercel.ai.error.${CL8}`,o24=Symbol.for(_L8),Z9=class extends(QL8=E1,XL8=o24,QL8){constructor({errorName:$=CL8,modelId:Z,modelType:X,message:Q=`No such ${X}: ${Z}`}){super({name:$,message:Q});this[XL8]=!0,this.modelId=Z,this.modelType=X}static isInstance($){return E1.hasMarker($,_L8)}},xL8=`vercel.ai.error.${vL8}`,r24=Symbol.for(xL8),ih=class extends(GL8=E1,YL8=r24,GL8){constructor($){super({name:vL8,message:`Too many values for a single embedding call. The ${$.provider} model "${$.modelId}" can only embed up to ${$.maxEmbeddingsPerCall} values per call, but ${$.values.length} values were provided.`});this[YL8]=!0,this.provider=$.provider,this.modelId=$.modelId,this.maxEmbeddingsPerCall=$.maxEmbeddingsPerCall,this.values=$.values}static isInstance($){return E1.hasMarker($,xL8)}},bL8=`vercel.ai.error.${fL8}`,a24=Symbol.for(bL8),V5=class $ extends(KL8=E1,JL8=a24,KL8){constructor({value:Z,cause:X,context:Q}){let Y="Type validation failed";if(Q==null?void 0:Q.field)Y+=` for ${Q.field}`;if((Q==null?void 0:Q.entityName)||(Q==null?void 0:Q.entityId)){Y+=" (";let G=[];if(Q.entityName)G.push(Q.entityName);if(Q.entityId)G.push(`id: "${Q.entityId}"`);Y+=G.join(", "),Y+=")"}super({name:fL8,message:`${Y}: Value: ${JSON.stringify(Z)}.
 Error message: ${zH(X)}`,cause:X});this[JL8]=!0,this.value=Z,this.context=Q}static isInstance(Z){return E1.hasMarker(Z,bL8)}static wrap({value:Z,cause:X,context:Q}){var Y,G,J;if($.isInstance(X)&&X.value===Z&&((Y=X.context)==null?void 0:Y.field)===(Q==null?void 0:Q.field)&&((G=X.context)==null?void 0:G.entityName)===(Q==null?void 0:Q.entityName)&&((J=X.context)==null?void 0:J.entityId)===(Q==null?void 0:Q.entityId))return X;return new $({value:Z,cause:X,context:Q})}},gL8=`vercel.ai.error.${yL8}`,s24=Symbol.for(gL8),m4=class extends(HL8=E1,WL8=s24,HL8){constructor({functionality:$,message:Z=`'${$}' functionality not supported.`}){super({name:yL8,message:Z});this[WL8]=!0,this.functionality=$}static isInstance($){return E1.hasMarker($,gL8)}}});import*as IJ0 from"zod/v4";import{ZodFirstPartyTypeKind as I4}from"zod/v3";import{ZodFirstPartyTypeKind as wR4}from"zod/v3";import{ZodFirstPartyTypeKind as AJ0}from"zod/v3";function X6(...$){return $.reduce((Z,X)=>({...Z,...X!=null?X:{}}),{})}function TJ0({tools:$=[],providerToolNames:Z,resolveProviderToolName:X}){var Q;let Y={},G={};for(let J of $)if(J.type==="provider"){let K=(Q=X==null?void 0:X(J))!=null?Q:(J.id in Z)?Z[J.id]:void 0;if(K==null)continue;Y[J.name]=K,G[K]=J.name}return{toProviderToolName:(J)=>{var K;return(K=Y[J])!=null?K:J},toCustomToolName:(J)=>{var K;return(K=G[J])!=null?K:J}}}async function LY($,Z){if($==null)return Promise.resolve();let X=Z==null?void 0:Z.abortSignal;return new Promise((Q,Y)=>{if(X==null?void 0:X.aborted){Y(hL8());return}let G=setTimeout(()=>{J(),Q()},$),J=()=>{clearTimeout(G),X==null||X.removeEventListener("abort",K)},K=()=>{J(),Y(hL8())};X==null||X.addEventListener("abort",K)})}function hL8(){return new DOMException("Delay was aborted","AbortError")}function ph($){return Object.fromEntries([...$.headers])}function u9($){let Z=$.replace(/-/g,"+").replace(/_/g,"/"),X=$R4(Z);return Uint8Array.from(X,(Q)=>Q.codePointAt(0))}function DY($){let Z="";for(let X=0;X<$.length;X++)Z+=String.fromCodePoint($[X]);return e24(Z)}function qZ($){return $ instanceof Uint8Array?DY($):$}function iL8($,Z={}){let{useArrayBrackets:X=!0}=Z,Q=new FormData;for(let[Y,G]of Object.entries($)){if(G==null)continue;if(Array.isArray(G)){if(G.length===1){Q.append(Y,G[0]);continue}let J=X?`${Y}[]`:Y;for(let K of G)Q.append(J,K);continue}Q.append(Y,G)}return Q}async function wr($){var Z;try{await((Z=$.body)==null?void 0:Z.cancel())}catch(X){}}function XR4($=globalThis){return $.window!=null}function QR4($){let Z;try{Z=new URL($)}catch(Q){throw new IZ({url:$,message:`Invalid URL: ${$}`})}if(Z.protocol==="data:")return;if(Z.protocol!=="http:"&&Z.protocol!=="https:")throw new IZ({url:$,message:`URL scheme must be http, https, or data, got ${Z.protocol}`});let X=Z.hostname.toLowerCase().replace(/\.+$/,"");if(!X)throw new IZ({url:$,message:"URL must have a hostname"});if(X==="localhost"||X.endsWith(".local")||X.endsWith(".localhost"))throw new IZ({url:$,message:`URL with hostname ${X} is not allowed`});if(X.startsWith("[")&&X.endsWith("]")){let Q=X.slice(1,-1);if(GR4(Q))throw new IZ({url:$,message:`URL with IPv6 address ${X} is not allowed`});return}if(tL8(X)){if(oL8(X))throw new IZ({url:$,message:`URL with IP address ${X} is not allowed`});return}}function tL8($){let Z=$.split(".");if(Z.length!==4)return!1;return Z.every((X)=>{let Q=Number(X);return Number.isInteger(Q)&&Q>=0&&Q<=255&&String(Q)===X})}function oL8($){let Z=$.split(".").map(Number),[X,Q,Y]=Z;if(X===0)return!0;if(X===10)return!0;if(X===100&&Q>=64&&Q<=127)return!0;if(X===127)return!0;if(X===169&&Q===254)return!0;if(X===172&&Q>=16&&Q<=31)return!0;if(X===192&&Q===0&&Y===0)return!0;if(X===192&&Q===168)return!0;if(X===198&&(Q===18||Q===19))return!0;if(X>=240)return!0;return!1}function YR4($){let Z=$.toLowerCase(),X=Z.indexOf("%");if(X!==-1)Z=Z.slice(0,X);let Q=Z.split("::");if(Q.length>2)return null;let Y=(J)=>{if(J==="")return[];let K=[],W=J.split(":");for(let H=0;H<W.length;H++){let F=W[H];if(F.includes(".")){if(H!==W.length-1||!tL8(F))return null;let[U,N,B,O]=F.split(".").map(Number);K.push(U<<8|N,B<<8|O);continue}if(!/^[0-9a-f]{1,4}$/.test(F))return null;K.push(parseInt(F,16))}return K},G=Y(Q[0]);if(G===null)return null;if(Q.length===2){let J=Y(Q[1]);if(J===null)return null;let K=8-G.length-J.length;if(K<0)return null;return[...G,...Array(K).fill(0),...J]}return G.length===8?G:null}function GR4($){let Z=YR4($);if(Z===null)return!0;let X=(Y)=>Z.slice(0,Y).every((G)=>G===0);if(X(7)&&(Z[7]===0||Z[7]===1))return!0;if((Z[0]&65024)===64512)return!0;if((Z[0]&65472)===65152)return!0;if((Z[0]&65472)===65216)return!0;if((Z[0]&65280)===65280)return!0;if(X(6)||X(5)&&Z[5]===65535||X(4)&&Z[4]===65535&&Z[5]===0||Z[0]===100&&Z[1]===65435&&Z[2]===0&&Z[3]===0&&Z[4]===0&&Z[5]===0||Z[0]===100&&Z[1]===65435&&Z[2]===1){let Y=Z[6]>>8&255,G=Z[6]&255,J=Z[7]>>8&255,K=Z[7]&255;return oL8(`${Y}.${G}.${J}.${K}`)}return!1}async function S61({url:$,headers:Z,abortSignal:X,maxRedirects:Q=JR4}){let Y={signal:X};if(Z!==void 0)Y.headers=Z;let G=$;for(let J=0;J<=Q;J++){QR4(G);let K=await fetch(G,{...Y,redirect:"manual"});if(K.type==="opaqueredirect"){if(!XR4())throw new IZ({url:$,message:`Redirect from ${G} could not be validated and was blocked`});return await fetch(G,{...Y,redirect:"follow"})}let W=K.headers.get("location");if(K.status>=300&&K.status<400&&W){await wr(K),G=new URL(W,G).toString();continue}return K}throw new IZ({url:$,message:`Too many redirects (max ${Q})`})}async function C61({response:$,url:Z,maxBytes:X=RJ0}){let Q=$.headers.get("content-length");if(Q!=null){let F=parseInt(Q,10);if(!isNaN(F)&&F>X)throw await wr($),new IZ({url:Z,message:`Download of ${Z} exceeded maximum size of ${X} bytes (Content-Length: ${F}).`})}let Y=$.body;if(Y==null)return new Uint8Array(0);let G=Y.getReader(),J=[],K=0;try{while(!0){let{done:F,value:U}=await G.read();if(F)break;if(K+=U.length,K>X)throw new IZ({url:Z,message:`Download of ${Z} exceeded maximum size of ${X} bytes.`});J.push(U)}}finally{try{await G.cancel()}finally{G.releaseLock()}}let W=new Uint8Array(K),H=0;for(let F of J)W.set(F,H),H+=F.length;return W}async function _61($,Z){var X,Q;try{let Y=await S61({url:$,abortSignal:Z==null?void 0:Z.abortSignal});if(!Y.ok)throw await wr(Y),new IZ({url:$,statusCode:Y.status,statusText:Y.statusText});let G=await C61({response:Y,url:$,maxBytes:(X=Z==null?void 0:Z.maxBytes)!=null?X:RJ0}),J=(Q=Y.headers.get("content-type"))!=null?Q:void 0;return new Blob([G],J?{type:J}:void 0)}catch(Y){if(IZ.isInstance(Y))throw Y;throw new IZ({url:$,cause:Y})}}function nh($){if($==null)return"unknown error";if(typeof $==="string")return $;if($ instanceof Error)return $.message;return JSON.stringify($)}function OY($){return($ instanceof Error||$ instanceof DOMException)&&($.name==="AbortError"||$.name==="ResponseAborted"||$.name==="TimeoutError")}function HR4($){if(!($ instanceof Error))return!1;let Z=$.code;if(typeof Z==="string"&&WR4.includes(Z))return!0;return!1}function rL8({error:$,url:Z,requestBodyValues:X}){if(OY($))return $;if($ instanceof TypeError&&KR4.includes($.message.toLowerCase())){let Q=$.cause;if(Q!=null)return new D4({message:`Cannot connect to API: ${Q.message}`,cause:Q,url:Z,requestBodyValues:X,isRetryable:!0})}if(HR4($))return new D4({message:`Cannot connect to API: ${$.message}`,cause:$,url:Z,requestBodyValues:X,isRetryable:!0});return $}function _L($=globalThis){var Z,X,Q;if($.window)return"runtime/browser";if((Z=$.navigator)==null?void 0:Z.userAgent)return`runtime/${$.navigator.userAgent.toLowerCase()}`;if((Q=(X=$.process)==null?void 0:X.versions)==null?void 0:Q.node)return`runtime/node.js/${$.process.version.substring(0)}`;if($.EdgeRuntime)return"runtime/vercel-edge";return"runtime/unknown"}function vL($){if($==null)return{};let Z={};if($ instanceof Headers)$.forEach((X,Q)=>{Z[Q.toLowerCase()]=X});else{if(!Array.isArray($))$=Object.entries($);for(let[X,Q]of $)if(Q!=null)Z[X.toLowerCase()]=Q}return Z}function J$($,...Z){let X=new Headers(vL($)),Q=X.get("user-agent")||"";return X.set("user-agent",[Q,...Z].filter(Boolean).join(" ")),Object.fromEntries(X.entries())}function Uz($){return $!=null}function sL8($,Z){try{return new URL($).origin===new URL(Z).origin}catch(X){return!1}}function eL8({mediaType:$,url:Z,supportedUrls:X}){return Z=Z.toLowerCase(),$=$.toLowerCase(),Object.entries(X).map(([Q,Y])=>{let G=Q.toLowerCase();return G==="*"||G==="*/*"?{mediaTypePrefix:"",regexes:Y}:{mediaTypePrefix:G.replace(/\*/,""),regexes:Y}}).filter(({mediaTypePrefix:Q})=>$.startsWith(Q)).flatMap(({regexes:Q})=>Q).some((Q)=>Q.test(Z))}function th({apiKey:$,environmentVariableName:Z,apiKeyParameterName:X="apiKey",description:Q}){if(typeof $==="string")return $;if($!=null)throw new Hz({message:`${Q} API key must be a string.`});if(typeof process>"u")throw new Hz({message:`${Q} API key is missing. Pass it using the '${X}' parameter. Environment variables are not supported in this environment.`});if($=process.env[Z],$==null)throw new Hz({message:`${Q} API key is missing. Pass it using the '${X}' parameter or the ${Z} environment variable.`});if(typeof $!=="string")throw new Hz({message:`${Q} API key must be a string. The value of the ${Z} environment variable is not a string.`});return $}function PH({settingValue:$,environmentVariableName:Z}){if(typeof $==="string")return $;if($!=null||typeof process>"u")return;if($=process.env[Z],$==null||typeof $!=="string")return;return $}function $w8($){var Z;let[X,Q=""]=$.toLowerCase().split("/");return(Z={mpeg:"mp3","x-wav":"wav",opus:"ogg",mp4:"m4a","x-m4a":"m4a"}[Q])!=null?Z:Q}function lL8($){let Z=JSON.parse($);if(Z===null||typeof Z!=="object")return Z;if(UR4.test($)===!1&&NR4.test($)===!1)return Z;return BR4(Z)}function BR4($){let Z=[$];while(Z.length){let X=Z;Z=[];for(let Q of X){if(Object.prototype.hasOwnProperty.call(Q,"__proto__"))throw SyntaxError("Object contains forbidden prototype property");if(Object.prototype.hasOwnProperty.call(Q,"constructor")&&Q.constructor!==null&&typeof Q.constructor==="object"&&Object.prototype.hasOwnProperty.call(Q.constructor,"prototype"))throw SyntaxError("Object contains forbidden prototype property");for(let Y in Q){let G=Q[Y];if(G&&typeof G==="object")Z.push(G)}}}return $}function v61($){let{stackTraceLimit:Z}=Error;try{Error.stackTraceLimit=0}catch(X){return lL8($)}try{return lL8($)}finally{Error.stackTraceLimit=Z}}function x61($){if($.type==="object"||Array.isArray($.type)&&$.type.includes("object")){$.additionalProperties=!1;let{properties:X}=$;if(X!=null)for(let Q of Object.keys(X))X[Q]=Fz(X[Q])}if($.items!=null)$.items=Array.isArray($.items)?$.items.map(Fz):Fz($.items);if($.anyOf!=null)$.anyOf=$.anyOf.map(Fz);if($.allOf!=null)$.allOf=$.allOf.map(Fz);if($.oneOf!=null)$.oneOf=$.oneOf.map(Fz);let{definitions:Z}=$;if(Z!=null)for(let X of Object.keys(Z))Z[X]=Fz(Z[X]);return $}function Fz($){if(typeof $==="boolean")return $;return x61($)}function TG(){return{}}function DR4($,Z){var X,Q,Y;let G={type:"array"};if(((X=$.type)==null?void 0:X._def)&&((Y=(Q=$.type)==null?void 0:Q._def)==null?void 0:Y.typeName)!==wR4.ZodAny)G.items=S$($.type._def,{...Z,currentPath:[...Z.currentPath,"items"]});if($.minLength)G.minItems=$.minLength.value;if($.maxLength)G.maxItems=$.maxLength.value;if($.exactLength)G.minItems=$.exactLength.value,G.maxItems=$.exactLength.value;return G}function ER4($){let Z={type:"integer",format:"int64"};if(!$.checks)return Z;for(let X of $.checks)switch(X.kind){case"min":if(X.inclusive)Z.minimum=X.value;else Z.exclusiveMinimum=X.value;break;case"max":if(X.inclusive)Z.maximum=X.value;else Z.exclusiveMaximum=X.value;break;case"multipleOf":Z.multipleOf=X.value;break}return Z}function jR4(){return{type:"boolean"}}function Zw8($,Z){return S$($.type._def,Z)}function Xw8($,Z,X){let Q=X!=null?X:Z.dateStrategy;if(Array.isArray(Q))return{anyOf:Q.map((Y,G)=>Xw8($,Z,Y))};switch(Q){case"string":case"format:date-time":return{type:"string",format:"date-time"};case"format:date":return{type:"string",format:"date"};case"integer":return PR4($)}}function AR4($,Z){return{...S$($.innerType._def,Z),default:$.defaultValue()}}function TR4($,Z){return Z.effectStrategy==="input"?S$($.schema._def,Z):TG()}function RR4($){return{type:"string",enum:Array.from($.values)}}function qR4($,Z){let X=[S$($.left._def,{...Z,currentPath:[...Z.currentPath,"allOf","0"]}),S$($.right._def,{...Z,currentPath:[...Z.currentPath,"allOf","1"]})].filter((Y)=>!!Y),Q=[];return X.forEach((Y)=>{if(IR4(Y))Q.push(...Y.allOf);else{let G=Y;if("additionalProperties"in Y&&Y.additionalProperties===!1){let{additionalProperties:J,...K}=Y;G=K}Q.push(G)}}),Q.length?{allOf:Q}:void 0}function MR4($){let Z=typeof $.value;if(Z!=="bigint"&&Z!=="number"&&Z!=="boolean"&&Z!=="string")return{type:Array.isArray($.value)?"array":"object"};return{type:Z==="bigint"?"integer":Z,const:$.value}}function Qw8($,Z){let X={type:"string"};if($.checks)for(let Q of $.checks)switch(Q.kind){case"min":X.minLength=typeof X.minLength==="number"?Math.max(X.minLength,Q.value):Q.value;break;case"max":X.maxLength=typeof X.maxLength==="number"?Math.min(X.maxLength,Q.value):Q.value;break;case"email":switch(Z.emailStrategy){case"format:email":RK(X,"email",Q.message,Z);break;case"format:idn-email":RK(X,"idn-email",Q.message,Z);break;case"pattern:zod":zQ(X,TK.email,Q.message,Z);break}break;case"url":RK(X,"uri",Q.message,Z);break;case"uuid":RK(X,"uuid",Q.message,Z);break;case"regex":zQ(X,Q.regex,Q.message,Z);break;case"cuid":zQ(X,TK.cuid,Q.message,Z);break;case"cuid2":zQ(X,TK.cuid2,Q.message,Z);break;case"startsWith":zQ(X,RegExp(`^${M61(Q.value,Z)}`),Q.message,Z);break;case"endsWith":zQ(X,RegExp(`${M61(Q.value,Z)}$`),Q.message,Z);break;case"datetime":RK(X,"date-time",Q.message,Z);break;case"date":RK(X,"date",Q.message,Z);break;case"time":RK(X,"time",Q.message,Z);break;case"duration":RK(X,"duration",Q.message,Z);break;case"length":X.minLength=typeof X.minLength==="number"?Math.max(X.minLength,Q.value):Q.value,X.maxLength=typeof X.maxLength==="number"?Math.min(X.maxLength,Q.value):Q.value;break;case"includes":{zQ(X,RegExp(M61(Q.value,Z)),Q.message,Z);break}case"ip":{if(Q.version!=="v6")RK(X,"ipv4",Q.message,Z);if(Q.version!=="v4")RK(X,"ipv6",Q.message,Z);break}case"base64url":zQ(X,TK.base64url,Q.message,Z);break;case"jwt":zQ(X,TK.jwt,Q.message,Z);break;case"cidr":{if(Q.version!=="v6")zQ(X,TK.ipv4Cidr,Q.message,Z);if(Q.version!=="v4")zQ(X,TK.ipv6Cidr,Q.message,Z);break}case"emoji":zQ(X,TK.emoji(),Q.message,Z);break;case"ulid":{zQ(X,TK.ulid,Q.message,Z);break}case"base64":{switch(Z.base64Strategy){case"format:binary":{RK(X,"binary",Q.message,Z);break}case"contentEncoding:base64":{X.contentEncoding="base64";break}case"pattern:zod":{zQ(X,TK.base64,Q.message,Z);break}}break}case"nanoid":zQ(X,TK.nanoid,Q.message,Z);case"toLowerCase":case"toUpperCase":case"trim":break;default:}return X}function M61($,Z){return Z.patternStrategy==="escape"?kR4($):$}function kR4($){let Z="";for(let X=0;X<$.length;X++){if(!VR4.has($[X]))Z+="\\";Z+=$[X]}return Z}function RK($,Z,X,Q){var Y;if($.format||((Y=$.anyOf)==null?void 0:Y.some((G)=>G.format))){if(!$.anyOf)$.anyOf=[];if($.format)$.anyOf.push({format:$.format}),delete $.format;$.anyOf.push({format:Z,...X&&Q.errorMessages&&{errorMessage:{format:X}}})}else $.format=Z}function zQ($,Z,X,Q){var Y;if($.pattern||((Y=$.allOf)==null?void 0:Y.some((G)=>G.pattern))){if(!$.allOf)$.allOf=[];if($.pattern)$.allOf.push({pattern:$.pattern}),delete $.pattern;$.allOf.push({pattern:mL8(Z,Q),...X&&Q.errorMessages&&{errorMessage:{pattern:X}}})}else $.pattern=mL8(Z,Q)}function mL8($,Z){var X;if(!Z.applyRegexFlags||!$.flags)return $.source;let Q={i:$.flags.includes("i"),m:$.flags.includes("m"),s:$.flags.includes("s")},Y=Q.i?$.source.toLowerCase():$.source,G="",J=!1,K=!1,W=!1;for(let H=0;H<Y.length;H++){if(J){G+=Y[H],J=!1;continue}if(Q.i){if(K){if(Y[H].match(/[a-z]/)){if(W)G+=Y[H],G+=`${Y[H-2]}-${Y[H]}`.toUpperCase(),W=!1;else if(Y[H+1]==="-"&&((X=Y[H+2])==null?void 0:X.match(/[a-z]/)))G+=Y[H],W=!0;else G+=`${Y[H]}${Y[H].toUpperCase()}`;continue}}else if(Y[H].match(/[a-z]/)){G+=`[${Y[H]}${Y[H].toUpperCase()}]`;continue}}if(Q.m){if(Y[H]==="^"){G+=`(^|(?<=[\r
 ]))`;continue}else if(Y[H]==="$"){G+=`($|(?=[\r
@@ -2321,7 +2321,7 @@ ${Y}`:Y}var Tz8,fS4;var b41=L(()=>{Tz8=/[\r\n<>]/,fS4=/^[^\s@<>]+@[^\s@<>]+\.[^\
 `);let Q=Z.pax;if(Q)for(let Y in Q)X+=C51(" "+Y+"="+Q[Y]+`
 `);return t4.from(X)};Wh4.decodePax=function(Z){let X={};while(Z.length){let Q=0;while(Q<Z.length&&Z[Q]!==32)Q++;let Y=parseInt(t4.toString(Z.subarray(0,Q)),10);if(!Y)return X;let G=t4.toString(Z.subarray(Q+1,Y-1)),J=G.indexOf("=");if(J===-1)return X;X[G.slice(0,J)]=G.slice(J+1),Z=Z.subarray(Y)}return X};Wh4.encode=function(Z){let X=t4.alloc(512),Q=Z.name,Y="";if(Z.typeflag===5&&Q[Q.length-1]!=="/")Q+="/";if(t4.byteLength(Q)!==Q.length)return null;while(t4.byteLength(Q)>100){let G=Q.indexOf("/");if(G===-1)return null;Y+=Y?"/"+Q.slice(0,G):Q.slice(0,G),Q=Q.slice(G+1)}if(t4.byteLength(Q)>100||t4.byteLength(Y)>155)return null;if(Z.linkname&&t4.byteLength(Z.linkname)>100)return null;if(t4.write(X,Q),t4.write(X,Zw(Z.mode&4095,6),100),t4.write(X,Zw(Z.uid,6),108),t4.write(X,Zw(Z.gid,6),116),Jh4(Z.size,X,124),t4.write(X,Zw(Z.mtime.getTime()/1000|0,11),136),X[156]=48+Yh4(Z.type),Z.linkname)t4.write(X,Z.linkname,157);if(t4.copy(zI8,X,257),t4.copy(ag4,X,263),Z.uname)t4.write(X,Z.uname,265);if(Z.gname)t4.write(X,Z.gname,297);if(t4.write(X,Zw(Z.devmajor||0,6),329),t4.write(X,Zw(Z.devminor||0,6),337),Y)t4.write(X,Y,345);return t4.write(X,Zw(AI8(X),6),148),X};Wh4.decode=function(Z,X,Q){let Y=Z[156]===0?0:Z[156]-48,G=Eu(Z,0,100,X),J=$w(Z,100,8),K=$w(Z,108,8),W=$w(Z,116,8),H=$w(Z,124,12),F=$w(Z,136,12),U=Qh4(Y),N=Z[157]===0?null:Eu(Z,157,100,X),B=Eu(Z,265,32),O=Eu(Z,297,32),w=$w(Z,329,8),D=$w(Z,337,8),E=AI8(Z);if(E===256)return null;if(E!==$w(Z,148,8))throw Error("Invalid tar header. Maybe the tar is corrupted or it needs to be gunzipped?");if($h4(Z)){if(Z[345])G=Eu(Z,345,155,X)+"/"+G}else if(Zh4(Z));else if(!Q)throw Error("Invalid tar header: unknown format.");if(Y===0&&G&&G[G.length-1]==="/")Y=5;return{name:G,mode:J,uid:K,gid:W,size:H,mtime:new Date(1000*F),type:U,linkname:N,uname:B,gname:O,devmajor:w,devminor:D,pax:null}};function $h4($){return t4.equals(zI8,$.subarray(257,263))}function Zh4($){return t4.equals(sg4,$.subarray(257,263))&&t4.equals(eg4,$.subarray(263,265))}function Xh4($,Z,X){if(typeof $!=="number")return X;if($=~~$,$>=Z)return Z;if($>=0)return $;if($+=Z,$>=0)return $;return 0}function Qh4($){switch($){case 0:return"file";case 1:return"link";case 2:return"symlink";case 3:return"character-device";case 4:return"block-device";case 5:return"directory";case 6:return"fifo";case 7:return"contiguous-file";case 72:return"pax-header";case 55:return"pax-global-header";case 27:return"gnu-long-link-path";case 28:case 30:return"gnu-long-path"}return null}function Yh4($){switch($){case"file":return 0;case"link":return 1;case"symlink":return 2;case"character-device":return 3;case"block-device":return 4;case"directory":return 5;case"fifo":return 6;case"contiguous-file":return 7;case"pax-header":return 72}return 0}function PI8($,Z,X,Q){for(;X<Q;X++)if($[X]===Z)return X;return Q}function AI8($){let Z=256;for(let X=0;X<148;X++)Z+=$[X];for(let X=156;X<512;X++)Z+=$[X];return Z}function Zw($,Z){if($=$.toString(8),$.length>Z)return"7777777777777777777".slice(0,Z)+" ";return"0000000000000000000".slice(0,Z-$.length)+$+" "}function Gh4($,Z,X){Z[X]=128;for(let Q=11;Q>0;Q--)Z[X+Q]=$&255,$=Math.floor($/256)}function Jh4($,Z,X){if($.toString(8).length>11)Gh4($,Z,X);else t4.write(Z,Zw($,11),X)}function Kh4($){let Z;if($[0]===128)Z=!0;else if($[0]===255)Z=!1;else return null;let X=[],Q;for(Q=$.length-1;Q>0;Q--){let J=$[Q];if(Z)X.push(J);else X.push(255-J)}let Y=0,G=X.length;for(Q=0;Q<G;Q++)Y+=X[Q]*Math.pow(256,Q);return Z?Y:-1*Y}function $w($,Z,X){if($=$.subarray(Z,Z+X),Z=0,$[Z]&128)return Kh4($);else{while(Z<$.length&&$[Z]===32)Z++;let Q=Xh4(PI8($,32,Z,$.length),$.length,$.length);while(Z<Q&&$[Z]===0)Z++;if(Q===Z)return 0;return parseInt(t4.toString($.subarray(Z,Q)),8)}}function Eu($,Z,X,Q){return t4.toString($.subarray(Z,PI8($,0,Z,Z+X)),Q)}function C51($){let Z=t4.byteLength($),X=Math.floor(Math.log(Z)/Math.log(10))+1;if(Z+X>=Math.pow(10,X))X++;return Z+X+$}});var SI8=v((m1Z,kI8)=>{var{Writable:Oh4,Readable:Lh4,getStreamError:TI8}=S51(),wh4=R51(),RI8=Du(),ju=_51(),Dh4=RI8.alloc(0);class II8{constructor(){this.buffered=0,this.shifted=0,this.queue=new wh4,this._offset=0}push($){this.buffered+=$.byteLength,this.queue.push($)}shiftFirst($){return this._buffered===0?null:this._next($)}shift($){if($>this.buffered)return null;if($===0)return Dh4;let Z=this._next($);if($===Z.byteLength)return Z;let X=[Z];while(($-=Z.byteLength)>0)Z=this._next($),X.push(Z);return RI8.concat(X)}_next($){let Z=this.queue.peek(),X=Z.byteLength-this._offset;if($>=X){let Q=this._offset?Z.subarray(this._offset,Z.byteLength):Z;return this.queue.shift(),this._offset=0,this.buffered-=X,this.shifted+=X,Q}return this.buffered-=$,this.shifted+=$,Z.subarray(this._offset,this._offset+=$)}}class qI8 extends Lh4{constructor($,Z,X){super();this.header=Z,this.offset=X,this._parent=$}_read($){if(this.header.size===0)this.push(null);if(this._parent._stream===this)this._parent._update();$(null)}_predestroy(){this._parent.destroy(TI8(this))}_detach(){if(this._parent._stream===this)this._parent._stream=null,this._parent._missing=VI8(this.header.size),this._parent._update()}_destroy($){this._detach(),$(null)}}class MI8 extends Oh4{constructor($){super($);if(!$)$={};this._buffer=new II8,this._offset=0,this._header=null,this._stream=null,this._missing=0,this._longHeader=!1,this._callback=v51,this._locked=!1,this._finished=!1,this._pax=null,this._paxGlobal=null,this._gnuLongPath=null,this._gnuLongLinkPath=null,this._filenameEncoding=$.filenameEncoding||"utf-8",this._allowUnknownFormat=!!$.allowUnknownFormat,this._unlockBound=this._unlock.bind(this)}_unlock($){if(this._locked=!1,$){this.destroy($),this._continueWrite($);return}this._update()}_consumeHeader(){if(this._locked)return!1;this._offset=this._buffer.shifted;try{this._header=ju.decode(this._buffer.shift(512),this._filenameEncoding,this._allowUnknownFormat)}catch($){return this._continueWrite($),!1}if(!this._header)return!0;switch(this._header.type){case"gnu-long-path":case"gnu-long-link-path":case"pax-global-header":case"pax-header":return this._longHeader=!0,this._missing=this._header.size,!0}if(this._locked=!0,this._applyLongHeaders(),this._header.size===0||this._header.type==="directory")return this.emit("entry",this._header,this._createStream(),this._unlockBound),!0;return this._stream=this._createStream(),this._missing=this._header.size,this.emit("entry",this._header,this._stream,this._unlockBound),!0}_applyLongHeaders(){if(this._gnuLongPath)this._header.name=this._gnuLongPath,this._gnuLongPath=null;if(this._gnuLongLinkPath)this._header.linkname=this._gnuLongLinkPath,this._gnuLongLinkPath=null;if(this._pax){if(this._pax.path)this._header.name=this._pax.path;if(this._pax.linkpath)this._header.linkname=this._pax.linkpath;if(this._pax.size)this._header.size=parseInt(this._pax.size,10);this._header.pax=this._pax,this._pax=null}}_decodeLongHeader($){switch(this._header.type){case"gnu-long-path":this._gnuLongPath=ju.decodeLongPath($,this._filenameEncoding);break;case"gnu-long-link-path":this._gnuLongLinkPath=ju.decodeLongPath($,this._filenameEncoding);break;case"pax-global-header":this._paxGlobal=ju.decodePax($);break;case"pax-header":this._pax=this._paxGlobal===null?ju.decodePax($):Object.assign({},this._paxGlobal,ju.decodePax($));break}}_consumeLongHeader(){this._longHeader=!1,this._missing=VI8(this._header.size);let $=this._buffer.shift(this._header.size);try{this._decodeLongHeader($)}catch(Z){return this._continueWrite(Z),!1}return!0}_consumeStream(){let $=this._buffer.shiftFirst(this._missing);if($===null)return!1;this._missing-=$.byteLength;let Z=this._stream.push($);if(this._missing===0){if(this._stream.push(null),Z)this._stream._detach();return Z&&this._locked===!1}return Z}_createStream(){return new qI8(this,this._header,this._offset)}_update(){while(this._buffer.buffered>0&&!this.destroying){if(this._missing>0){if(this._stream!==null){if(this._consumeStream()===!1)return;continue}if(this._longHeader===!0){if(this._missing>this._buffer.buffered)break;if(this._consumeLongHeader()===!1)return!1;continue}let $=this._buffer.shiftFirst(this._missing);if($!==null)this._missing-=$.byteLength;continue}if(this._buffer.buffered<512)break;if(this._stream!==null||this._consumeHeader()===!1)return}this._continueWrite(null)}_continueWrite($){let Z=this._callback;this._callback=v51,Z($)}_write($,Z){this._callback=Z,this._buffer.push($),this._update()}_final($){this._finished=this._missing===0&&this._buffer.buffered===0,$(this._finished?null:Error("Unexpected end of data"))}_predestroy(){this._continueWrite(null)}_destroy($){if(this._stream)this._stream.destroy(TI8(this));$(null)}[Symbol.asyncIterator](){let $=null,Z=null,X=null,Q=null,Y=null,G=this;return this.on("entry",W),this.on("error",(U)=>{$=U}),this.on("close",H),{[Symbol.asyncIterator](){return this},next(){return new Promise(K)},return(){return F(null)},throw(U){return F(U)}};function J(U){if(!Y)return;let N=Y;Y=null,N(U)}function K(U,N){if($)return N($);if(Q){U({value:Q,done:!1}),Q=null;return}if(Z=U,X=N,J(null),G._finished&&Z)Z({value:void 0,done:!0}),Z=X=null}function W(U,N,B){if(Y=B,N.on("error",v51),Z)Z({value:N,done:!1}),Z=X=null;else Q=N}function H(){if(J($),!Z)return;if($)X($);else Z({value:void 0,done:!0});Z=X=null}function F(U){return G.destroy(U),J(U),new Promise((N,B)=>{if(G.destroyed)return N({value:void 0,done:!0});G.once("close",function(){if(U)B(U);else N({value:void 0,done:!0})})})}}}kI8.exports=function(Z){return new MI8(Z)};function v51(){}function VI8($){return $&=511,$&&512-$}});var _I8=v((i1Z,x51)=>{var CI8={S_IFMT:61440,S_IFDIR:16384,S_IFCHR:8192,S_IFBLK:24576,S_IFIFO:4096,S_IFLNK:40960};try{x51.exports=N0("fs").constants||CI8}catch{x51.exports=CI8}});var hI8=v((p1Z,gI8)=>{var{Readable:Eh4,Writable:jh4,getStreamError:vI8}=S51(),e_=Du(),zu=_I8(),zP0=_51(),xI8=e_.alloc(1024);class fI8 extends jh4{constructor($,Z,X){super({mapWritable:Ph4,eagerOpen:!0});if(this.written=0,this.header=Z,this._callback=X,this._linkname=null,this._isLinkname=Z.type==="symlink"&&!Z.linkname,this._isVoid=Z.type!=="file"&&Z.type!=="contiguous-file",this._finished=!1,this._pack=$,this._openCallback=null,this._pack._stream===null)this._pack._stream=this;else this._pack._pending.push(this)}_open($){if(this._openCallback=$,this._pack._stream===this)this._continueOpen()}_continuePack($){if(this._callback===null)return;let Z=this._callback;this._callback=null,Z($)}_continueOpen(){if(this._pack._stream===null)this._pack._stream=this;let $=this._openCallback;if(this._openCallback=null,$===null)return;if(this._pack.destroying)return $(Error("pack stream destroyed"));if(this._pack._finalized)return $(Error("pack stream is already finalized"));if(this._pack._stream=this,!this._isLinkname)this._pack._encode(this.header);if(this._isVoid)this._finish(),this._continuePack(null);$(null)}_write($,Z){if(this._isLinkname)return this._linkname=this._linkname?e_.concat([this._linkname,$]):$,Z(null);if(this._isVoid){if($.byteLength>0)return Z(Error("No body allowed for this entry"));return Z()}if(this.written+=$.byteLength,this._pack.push($))return Z();this._pack._drain=Z}_finish(){if(this._finished)return;if(this._finished=!0,this._isLinkname)this.header.linkname=this._linkname?e_.toString(this._linkname,"utf-8"):"",this._pack._encode(this.header);yI8(this._pack,this.header.size),this._pack._done(this)}_final($){if(this.written!==this.header.size)return $(Error("Size mismatch"));this._finish(),$(null)}_getError(){return vI8(this)||Error("tar entry destroyed")}_predestroy(){this._pack.destroy(this._getError())}_destroy($){this._pack._done(this),this._continuePack(this._finished?null:this._getError()),$()}}class bI8 extends Eh4{constructor($){super($);this._drain=f51,this._finalized=!1,this._finalizing=!1,this._pending=[],this._stream=null}entry($,Z,X){if(this._finalized||this.destroying)throw Error("already finalized or destroyed");if(typeof Z==="function")X=Z,Z=null;if(!X)X=f51;if(!$.size||$.type==="symlink")$.size=0;if(!$.type)$.type=zh4($.mode);if(!$.mode)$.mode=$.type==="directory"?493:420;if(!$.uid)$.uid=0;if(!$.gid)$.gid=0;if(!$.mtime)$.mtime=new Date;if(typeof Z==="string")Z=e_.from(Z);let Q=new fI8(this,$,X);if(e_.isBuffer(Z))return $.size=Z.byteLength,Q.write(Z),Q.end(),Q;if(Q._isVoid)return Q;return Q}finalize(){if(this._stream||this._pending.length>0){this._finalizing=!0;return}if(this._finalized)return;this._finalized=!0,this.push(xI8),this.push(null)}_done($){if($!==this._stream)return;if(this._stream=null,this._finalizing)this.finalize();if(this._pending.length)this._pending.shift()._continueOpen()}_encode($){if(!$.pax){let Z=zP0.encode($);if(Z){this.push(Z);return}}this._encodePax($)}_encodePax($){let Z=zP0.encodePax({name:$.name,linkname:$.linkname,pax:$.pax}),X={name:"PaxHeader",mode:$.mode,uid:$.uid,gid:$.gid,size:Z.byteLength,mtime:$.mtime,type:"pax-header",linkname:$.linkname&&"PaxHeader",uname:$.uname,gname:$.gname,devmajor:$.devmajor,devminor:$.devminor};this.push(zP0.encode(X)),this.push(Z),yI8(this,Z.byteLength),X.size=$.size,X.type=$.type,this.push(zP0.encode(X))}_doDrain(){let $=this._drain;this._drain=f51,$()}_predestroy(){let $=vI8(this);if(this._stream)this._stream.destroy($);while(this._pending.length){let Z=this._pending.shift();Z.destroy($),Z._continueOpen()}this._doDrain()}_read($){this._doDrain(),$()}}gI8.exports=function(Z){return new bI8(Z)};function zh4($){switch($&zu.S_IFMT){case zu.S_IFBLK:return"block-device";case zu.S_IFCHR:return"character-device";case zu.S_IFDIR:return"directory";case zu.S_IFIFO:return"fifo";case zu.S_IFLNK:return"symlink"}return"file"}function f51(){}function yI8($,Z){if(Z&=511,Z)$.push(xI8.subarray(0,512-Z))}function Ph4($){return e_.isBuffer($)?$:e_.from($)}});var uI8=v((Ah4)=>{Ah4.extract=SI8();Ah4.pack=hI8()});var dI8=v((t1Z,lI8)=>{lI8.exports=cI8;function cI8($,Z){if($&&Z)return cI8($)(Z);if(typeof $!=="function")throw TypeError("need wrapper function");return Object.keys($).forEach(function(Q){X[Q]=$[Q]}),X;function X(){var Q=Array(arguments.length);for(var Y=0;Y<Q.length;Y++)Q[Y]=arguments[Y];var G=$.apply(this,Q),J=Q[Q.length-1];if(typeof G==="function"&&G!==J)Object.keys(J).forEach(function(K){G[K]=J[K]});return G}}});var y51=v((o1Z,b51)=>{var mI8=dI8();b51.exports=mI8(PP0);b51.exports.strict=mI8(iI8);PP0.proto=PP0(function(){Object.defineProperty(Function.prototype,"once",{value:function(){return PP0(this)},configurable:!0}),Object.defineProperty(Function.prototype,"onceStrict",{value:function(){return iI8(this)},configurable:!0})});function PP0($){var Z=function(){if(Z.called)return Z.value;return Z.called=!0,Z.value=$.apply(this,arguments)};return Z.called=!1,Z}function iI8($){var Z=function(){if(Z.called)throw Error(Z.onceError);return Z.called=!0,Z.value=$.apply(this,arguments)},X=$.name||"Function wrapped with `once`";return Z.onceError=X+" shouldn't be called more than once",Z.called=!1,Z}});var tI8=v((r1Z,nI8)=>{var Ih4=y51(),qh4=function(){},Mh4=global.Bare?queueMicrotask:process.nextTick.bind(process),Vh4=function($){return $.setHeader&&typeof $.abort==="function"},kh4=function($){return $.stdio&&Array.isArray($.stdio)&&$.stdio.length===3},pI8=function($,Z,X){if(typeof Z==="function")return pI8($,null,Z);if(!Z)Z={};X=Ih4(X||qh4);var{_writableState:Q,_readableState:Y}=$,G=Z.readable||Z.readable!==!1&&$.readable,J=Z.writable||Z.writable!==!1&&$.writable,K=!1,W=function(){if(!$.writable)H()},H=function(){if(J=!1,!G)X.call($)},F=function(){if(G=!1,!J)X.call($)},U=function(D){X.call($,D?Error("exited with error code: "+D):null)},N=function(D){X.call($,D)},B=function(){Mh4(O)},O=function(){if(K)return;if(G&&!(Y&&(Y.ended&&!Y.destroyed)))return X.call($,Error("premature close"));if(J&&!(Q&&(Q.ended&&!Q.destroyed)))return X.call($,Error("premature close"))},w=function(){$.req.on("finish",H)};if(Vh4($))if($.on("complete",H),$.on("abort",B),$.req)w();else $.on("request",w);else if(J&&!Q)$.on("end",W),$.on("close",W);if(kh4($))$.on("exit",U);if($.on("end",F),$.on("finish",H),Z.error!==!1)$.on("error",N);return $.on("close",B),function(){if(K=!0,$.removeListener("complete",H),$.removeListener("abort",B),$.removeListener("request",w),$.req)$.req.removeListener("finish",H);$.removeListener("end",W),$.removeListener("close",W),$.removeListener("finish",H),$.removeListener("exit",U),$.removeListener("end",F),$.removeListener("error",N),$.removeListener("close",B)}};nI8.exports=pI8});var aI8=v((a1Z,rI8)=>{var Sh4=y51(),Ch4=tI8(),AP0;try{AP0=N0("fs")}catch($){}var Ya=function(){},_h4=typeof process>"u"?!1:/^v?\.0/.test(process.version),TP0=function($){return typeof $==="function"},vh4=function($){if(!_h4)return!1;if(!AP0)return!1;return($ instanceof(AP0.ReadStream||Ya)||$ instanceof(AP0.WriteStream||Ya))&&TP0($.close)},xh4=function($){return $.setHeader&&TP0($.abort)},fh4=function($,Z,X,Q){Q=Sh4(Q);var Y=!1;$.on("close",function(){Y=!0}),Ch4($,{readable:Z,writable:X},function(J){if(J)return Q(J);Y=!0,Q()});var G=!1;return function(J){if(Y)return;if(G)return;if(G=!0,vh4($))return $.close(Ya);if(xh4($))return $.abort();if(TP0($.destroy))return $.destroy();Q(J||Error("stream was destroyed"))}},oI8=function($){$()},bh4=function($,Z){return $.pipe(Z)},yh4=function(){var $=Array.prototype.slice.call(arguments),Z=TP0($[$.length-1]||Ya)&&$.pop()||Ya;if(Array.isArray($[0]))$=$[0];if($.length<2)throw Error("pump requires two streams per minimum");var X,Q=$.map(function(Y,G){var J=G<$.length-1,K=G>0;return fh4(Y,J,K,function(W){if(!X)X=W;if(W)Q.forEach(oI8);if(J)return;Q.forEach(oI8),Z(X)})});return $.reduce(bh4)};rI8.exports=yh4});var Jq8=v((ch4)=>{var sI8=uI8(),eI8=aI8(),$q8=N0("fs"),R9=N0("path"),Ga=(global.Bare?global.Bare.platform:process.platform)==="win32";ch4.pack=function(Z,X){if(!Z)Z=".";if(!X)X={};let Q=X.fs||$q8,Y=X.ignore||X.filter||Ja,G=X.mapStream||Yq8,J=uh4(Q,X.dereference?Q.stat:Q.lstat,Z,Y,X.entries,X.sort),K=X.strict!==!1,W=typeof X.umask==="number"?~X.umask:~Zq8(),H=X.pack||sI8.pack(),F=X.finish||Ja,U=X.map||Ja,N=typeof X.dmode==="number"?X.dmode:0,B=typeof X.fmode==="number"?X.fmode:0;if(X.strip)U=Gq8(U,X.strip);if(X.readable)N|=parseInt(555,8),B|=parseInt(444,8);if(X.writable)N|=parseInt(333,8),B|=parseInt(222,8);D();function O(E,j){Q.readlink(R9.join(Z,E),function(z,A){if(z)return H.destroy(z);j.linkname=g51(A),H.entry(j,D)})}function w(E,j,z){if(H.destroyed)return;if(E)return H.destroy(E);if(!j){if(X.finalize!==!1)H.finalize();return F(H)}if(z.isSocket())return D();let A={name:g51(j),mode:(z.mode|(z.isDirectory()?N:B))&W,mtime:z.mtime,size:z.size,type:"file",uid:z.uid,gid:z.gid};if(z.isDirectory())return A.size=0,A.type="directory",A=U(A)||A,H.entry(A,D);if(z.isSymbolicLink())return A.size=0,A.type="symlink",A=U(A)||A,O(j,A);if(A=U(A)||A,!z.isFile()){if(K)return H.destroy(Error("unsupported type for "+j));return D()}let P=H.entry(A,D),I=G(Q.createReadStream(R9.join(Z,j),{start:0,end:A.size>0?A.size-1:A.size}),A);I.on("error",function(q){P.destroy(q)}),eI8(I,P)}function D(E){if(E)return H.destroy(E);J(w)}return H};function gh4($){return $.length?$[$.length-1]:null}function hh4(){return!global.Bare&&process.getuid?process.getuid():-1}function Zq8(){return!global.Bare&&process.umask?process.umask():0}ch4.extract=function(Z,X){if(!Z)Z=".";if(!X)X={};Z=R9.resolve(Z);let Q=X.fs||$q8,Y=X.ignore||X.filter||Ja,G=X.mapStream||Yq8,J=X.chown!==!1&&!Ga&&hh4()===0,K=X.extract||sI8.extract(),W=[],H=new Date,F=typeof X.umask==="number"?~X.umask:~Zq8(),U=X.strict!==!1,N=X.validateSymlinks!==!1,B=X.map||Ja,O=typeof X.dmode==="number"?X.dmode:0,w=typeof X.fmode==="number"?X.fmode:0;if(X.strip)B=Gq8(B,X.strip);if(X.readable)O|=parseInt(555,8),w|=parseInt(444,8);if(X.writable)O|=parseInt(333,8),w|=parseInt(222,8);if(K.on("entry",D),X.finish)K.on("finish",X.finish);return K;function D(P,I,q){P=B(P)||P,P.name=g51(P.name);let M=R9.join(Z,R9.join("/",P.name));if(Y(M,P))return I.resume(),q();let S=R9.join(M,".")===R9.join(Z,".")?Z:R9.dirname(M);Qq8(Q,S,R9.join(Z,"."),function(r,B0){if(r)return q(r);if(!B0)return q(Error(S+" is not a valid path"));if(P.type==="directory")return W.push([M,P.mtime]),A(M,{fs:Q,own:J,uid:P.uid,gid:P.gid,mode:P.mode},d);A(S,{fs:Q,own:J,uid:P.uid,gid:P.gid,mode:493},function(P0){if(P0)return q(P0);switch(P.type){case"file":return b();case"link":return y();case"symlink":return f()}if(U)return q(Error("unsupported type for "+M+" ("+P.type+")"));I.resume(),q()})});function d(r){if(r)return q(r);j(M,P,function(B0){if(B0)return q(B0);if(Ga)return q();z(M,P,q)})}function f(){if(Ga)return q();Q.unlink(M,function(){let r=R9.resolve(R9.dirname(M),P.linkname);if(!o(r)&&N)return q(Error(M+" is not a valid symlink"));Xq8(Q,r,R9.join(Z,"."),function(B0,P0){if(B0)return q(B0);if(!P0&&N)return q(Error(M+" is not a valid symlink"));Q.symlink(P.linkname,M,d)})})}function y(){if(Ga)return q();Q.unlink(M,function(){let r=R9.join(Z,R9.join("/",P.linkname));Q.realpath(r,function(B0,P0){if(B0||!o(P0))return q(Error(M+" is not a valid hardlink"));Q.link(P0,M,function($0){if($0&&$0.code==="EPERM"&&X.hardlinkAsFilesFallback)return I=Q.createReadStream(P0),b();d($0)})})})}function o(r){return r===Z||r.startsWith(Z+R9.sep)}function b(){let r=Q.createWriteStream(M),B0=G(I,P);r.on("error",function(P0){B0.destroy(P0)}),eI8(B0,r,function(P0){if(P0)return q(P0);r.on("close",d)})}}function E(P,I){let q;while((q=gh4(W))&&P.slice(0,q[0].length)!==q[0])W.pop();if(!q)return I();Q.utimes(q[0],H,q[1],I)}function j(P,I,q){if(X.utimes===!1)return q();if(I.type==="directory")return Q.utimes(P,H,I.mtime,q);if(I.type==="symlink")return E(P,q);Q.utimes(P,H,I.mtime,function(M){if(M)return q(M);E(P,q)})}function z(P,I,q){let M=I.type==="symlink",S=M?Q.lchmod:Q.chmod,d=M?Q.lchown:Q.chown;if(!S)return q();let f=(I.mode|(I.type==="directory"?O:w))&F;if(d&&J)d.call(Q,P,I.uid,I.gid,y);else y(null);function y(o){if(o)return q(o);if(!S)return q();S.call(Q,P,f,q)}}function A(P,I,q){Q.stat(P,function(M){if(!M)return q(null);if(M.code!=="ENOENT")return q(M);Q.mkdir(P,{mode:I.mode,recursive:!0},function(S,d){if(S)return q(S);z(P,I,q)})})}};function Xq8($,Z,X,Q){if(Z===X)return Q(null,!0);if(!Z.startsWith(X+R9.sep))return Q(null,!1);$.lstat(Z,function(Y,G){if(Y&&Y.code!=="ENOENT"&&Y.code!=="EPERM")return Q(Y);if(Y||!G.isSymbolicLink())return Xq8($,R9.join(Z,".."),X,Q);Q(null,!1)})}function Qq8($,Z,X,Q){if(Z===X)return Q(null,!0);$.lstat(Z,function(Y,G){if(Y&&Y.code!=="ENOENT"&&Y.code!=="EPERM")return Q(Y);if(Y||G.isDirectory())return Qq8($,R9.join(Z,".."),X,Q);Q(null,!1)})}function Ja(){}function Yq8($){return $}function g51($){return Ga?$.replace(/\\/g,"/").replace(/[:?<>|]/g,"_"):$}function uh4($,Z,X,Q,Y,G){if(!Y)Y=["."];let J=Y.slice(0);return function(W){if(!J.length)return W(null);let H=J.shift(),F=R9.join(X,H);Z.call($,F,function(U,N){if(U)return W(Y.indexOf(H)===-1&&U.code==="ENOENT"?null:U);if(!N.isDirectory())return W(null,H,N);$.readdir(F,function(B,O){if(B)return W(B);if(G)O.sort();for(let w=0;w<O.length;w++)if(!Q(R9.join(X,H,O[w])))J.push(R9.join(H,O[w]));W(null,H,N)})})}}function Gq8($,Z){return function(X){X.name=X.name.split("/").slice(Z).join("/");let Q=X.linkname;if(Q&&(X.type==="link"||R9.isAbsolute(Q)))X.linkname=Q.split("/").slice(Z).join("/");return $(X)}}});var mh4,ih4;var Kq8=L(()=>{A51();mh4=k(tR8(),1),ih4=k(Jq8(),1)});var RP0=()=>{};var Wq8=L(()=>{gz0()});var Hq8=L(()=>{UP0();FP0();RP0()});var Fq8=()=>{};var Uq8=()=>{};var h51=L(()=>{kR8();z51();UP0();xR8();E51();A51();fR8();bR8();yR8();gR8();j51();hR8();Kq8();RP0();Wq8();Hq8();Fq8();Uq8();RP0()});var i5,m9,$v,Ka;var Wa=L(()=>{i5={CLAIM_API_GROUP:"extensions.agents.x-k8s.io",CLAIM_API_VERSION:"v1alpha1",CLAIM_PLURAL:"sandboxclaims",TEMPLATE_PLURAL:"sandboxtemplates",SANDBOX_API_GROUP:"agents.x-k8s.io",SANDBOX_API_VERSION:"v1alpha1",SANDBOX_PLURAL:"sandboxes",POD_NAME_ANNOTATION:"agents.x-k8s.io/pod-name",MAIN_CONTAINER_NAME:"sandbox"};m9=class m9 extends Error{cause;constructor($,Z){super($);if(this.name="SandboxError",this.cause=Z,Z instanceof Error&&Z.stack)this.stack=`${this.stack}
 Caused by: ${Z.stack}`}};$v=class $v extends m9{constructor($,Z){super($,Z);this.name="SandboxTimeoutError"}};Ka=class Ka extends m9{constructor($,Z){super($,Z);this.name="SandboxAlreadyExistsError"}}});async function ph4($){let Z=$.getCurrentCluster();if(!Z)throw new m9("No active cluster in kubeconfig");let X={};await $.applyToHTTPSOptions(X);let Q={},Y=X.headers??{};for(let[G,J]of Object.entries(Y))if(Array.isArray(J))Q[G]=J.join(", ");else if(J!==void 0)Q[G]=String(J);if(typeof X.auth==="string"&&!Q.Authorization)Q.Authorization=`Basic ${Buffer.from(X.auth).toString("base64")}`;return{server:Z.server.replace(/\/+$/,""),headers:Q,tls:{cert:u51(X.cert),key:u51(X.key),ca:u51(X.ca),rejectUnauthorized:Z.skipTLSVerify?!1:void 0}}}function u51($){if($==null)return;if(typeof $==="string")return $;if(Buffer.isBuffer($))return $.toString("utf8");return String($)}async function CG($,Z){let X=await ph4($),Q={...X.headers,...Z.headers};if(Z.method==="PATCH")Q["content-type"]=Z.patchType==="apply"?"application/apply-patch+yaml":Z.patchType==="strategic-merge"?"application/strategic-merge-patch+json":"application/merge-patch+json";else if(Z.body!==void 0&&!("content-type"in Q))Q["content-type"]="application/json";let Y={method:Z.method,headers:Q,body:Z.body===void 0?void 0:JSON.stringify(Z.body),signal:Z.signal,tls:X.tls,...Z.stream?{timeout:!1}:{}};return fetch(`${X.server}${Z.path}`,Y)}async function c51($){try{return await $.json()}catch{return null}}async function Ha($,Z){if($.ok)return;let X=await c51($),Q=X?.message??`${Z} failed: ${$.status} ${$.statusText}`;throw new Nq8($.status,X,Q)}async function Pu($,Z,X,Q,Y="none"){try{let G=await CG($,Z);if(G.status===404)return null;if(await Ha(G,X),Y==="json")return await G.json();return null}catch(G){throw new m9(Q,G)}}async function Bq8($,Z,X){let Q=`${IP0}/${encodeURIComponent(Z)}/${i5.TEMPLATE_PLURAL}/${encodeURIComponent(X)}`;try{let Y=await CG($,{method:"GET",path:Q});if(Y.status===404||Y.status===403)return!1;return await Ha(Y,"sandboxTemplateExists"),!0}catch(Y){throw new m9(`Failed to get SandboxTemplate: ${X}`,Y)}}async function Fa($,Z,X){let Q=`${IP0}/${encodeURIComponent(Z)}/${i5.CLAIM_PLURAL}`,Y;try{Y=await CG($,{method:"POST",path:Q,body:X})}catch(H){let F=H instanceof Error?H.message:String(H);throw console.warn(`[agent-sandbox/client] createSandboxClaim ${X.metadata.name} transport error: ${F}`),new m9(`Failed to create SandboxClaim: ${X.metadata.name} (transport error: ${F})`,H)}if(Y.ok)return;let G=await c51(Y),J=G?.reason?` ${G.reason}`:"",K=G?.message??Y.statusText,W=`Failed to create SandboxClaim: ${X.metadata.name} (${Y.status}${J}: ${K})`;if(console.warn(`[agent-sandbox/client] createSandboxClaim ${X.metadata.name} rejected: status=${Y.status} reason=${G?.reason??"<none>"} message=${K}`),Y.status===409)throw new Ka(W);throw new m9(W)}async function qP0($,Z,X,Q=60000){let Y=Date.now()+Q,G=500,J;while(!0){let K=await _K($,Z,X).catch(()=>{return});if(!K)return;if(J=K,Date.now()>=Y){let W=J.metadata?.finalizers??[],H=J.metadata?.deletionTimestamp??"<unknown>";throw new $v(`SandboxClaim ${X} still terminating after ${Q}ms (deletionTimestamp=${H}, finalizers=[${W.join(", ")}])`)}await N8(500)}}function l51($,Z){return`${IP0}/${encodeURIComponent($)}/${i5.CLAIM_PLURAL}/${encodeURIComponent(Z)}`}async function MP0($,Z,X,Q){await Pu($,{method:"PATCH",path:l51(Z,X),patchType:"merge",body:{spec:{lifecycle:{shutdownPolicy:"Delete",shutdownTime:Q}}}},"patchSandboxClaimShutdown",`Failed to patch SandboxClaim shutdownTime: ${X}`)}async function Xw($,Z,X){await Pu($,{method:"DELETE",path:l51(Z,X)},"deleteSandboxClaim",`Failed to delete SandboxClaim: ${X}`)}async function _K($,Z,X){return await Pu($,{method:"GET",path:l51(Z,X)},"getSandboxClaim",`Failed to get SandboxClaim: ${X}`,"json")??void 0}async function Oq8($,Z,X,Q=60){let Y=Date.now()+Q*1000,G=200;while(Date.now()<Y){let K=(await _K($,Z,X).catch(()=>{return}))?.status?.sandbox?.name;if(K)return K;await N8(200)}throw new $v(`SandboxClaim ${X} did not record an adopted Sandbox (status.sandbox.name) within ${Q}s`)}async function Lq8($,Z,X){let Y=(await Pu($,{method:"GET",path:`${IP0}/${encodeURIComponent(Z)}/sandboxwarmpools/${encodeURIComponent(X)}`},"getSandboxWarmPool",`Failed to get SandboxWarmPool: ${X}`,"json"))?.status?.selector;if(!Y)return null;let G=await CG($,{method:"GET",path:`/api/v1/namespaces/${encodeURIComponent(Z)}/pods?labelSelector=${encodeURIComponent(Y)}`});return await Ha(G,"listWarmPoolPods"),((await G.json()).items??[]).filter((K)=>K.status?.phase==="Running").flatMap((K)=>K.metadata?.name&&K.metadata.uid?[{name:K.metadata.name,uid:K.metadata.uid,labels:K.metadata.labels??{}}]:[])}async function wq8($,Z,X,Q){try{let Y=await CG($,{method:"GET",path:`/api/v1/namespaces/${encodeURIComponent(Z)}/pods/${encodeURIComponent(X)}`});if(!Y.ok)return!1;return!(await Y.json()).metadata?.labels?.[Q]}catch{return!1}}async function Dq8($,Z,X,Q,Y){try{let G=await CG($,{method:"GET",path:`/api/v1/namespaces/${encodeURIComponent(Z)}/pods?labelSelector=${encodeURIComponent(`${X}=${Q}`)}`});if(!G.ok)return null;let K=((await G.json()).items??[]).reduce((W,H)=>W===null||(H.metadata?.creationTimestamp??"")>(W.metadata?.creationTimestamp??"")?H:W,null);return K?nh4(K,Y):null}catch{return null}}function nh4($,Z){let X=($.status?.containerStatuses??[]).find((G)=>G.name===Z),Q=X?.state?.terminated??X?.lastState?.terminated;if(!Q?.reason)return null;let Y=($.spec?.containers??[]).find((G)=>G.name===Z)?.resources?.limits?.memory;return{reason:Q.reason,oomKilled:Q.reason==="OOMKilled",...Q.exitCode===void 0?{}:{exitCode:Q.exitCode},...Y===void 0?{}:{memoryLimit:Y}}}function d51($,Z){return`${th4}/${encodeURIComponent($)}/${zq8}/${encodeURIComponent(Z)}`}async function VP0($,Z,X){let Q=new URLSearchParams({fieldManager:Aq8,force:"true"}),Y=`${d51(Z,X.metadata.name)}?${Q}`;try{let G=await CG($,{method:"PATCH",path:Y,patchType:"apply",body:X});await Ha(G,"applyHttpRoute")}catch(G){throw new m9(`Failed to apply HTTPRoute: ${X.metadata.name}`,G)}}async function kP0($,Z,X){await Pu($,{method:"DELETE",path:d51(Z,X)},"deleteHttpRoute",`Failed to delete HTTPRoute: ${X}`)}async function Pq8($,Z,X){return await Pu($,{method:"GET",path:d51(Z,X)},"getHttpRoute",`Failed to get HTTPRoute: ${X}`,"json")??void 0}async function Tq8($,Z,X,Q){let Y={apiVersion:"v1",kind:"Service",metadata:{name:X},spec:{ports:[{name:Q.name,port:Q.port,targetPort:Q.targetPort,protocol:Q.protocol??"TCP"}]}},G=new URLSearchParams({fieldManager:Aq8,force:"true"}),J=`/api/v1/namespaces/${encodeURIComponent(Z)}/services/${encodeURIComponent(X)}?${G}`;try{let K=await CG($,{method:"PATCH",path:J,patchType:"apply",body:Y});await Ha(K,"ensureServicePort")}catch(K){throw new m9(`Failed to apply Service ports: ${X}`,K)}}function SP0($,Z,X,Q=180){let Y=`/apis/${i5.SANDBOX_API_GROUP}/${i5.SANDBOX_API_VERSION}/namespaces/${encodeURIComponent(Z)}/${i5.SANDBOX_PLURAL}?watch=true&fieldSelector=${encodeURIComponent(`metadata.name=${X}`)}`,{resolve:G,reject:J,promise:K}=Promise.withResolvers(),W=new AbortController,H=!1,F=setTimeout(()=>{if(H)return;H=!0,W.abort(),J(new $v(`Sandbox did not become ready within ${Q} seconds`))},Q*1000),U=(N)=>{if(H)return;H=!0,clearTimeout(F),W.abort(),N()};return(async()=>{let N;try{N=await CG($,{method:"GET",path:Y,signal:W.signal,headers:{accept:"application/json"},stream:!0})}catch(B){U(()=>J(new m9("Failed to start watch for sandbox readiness",B)));return}if(!N.ok||!N.body){let B=await c51(N).catch(()=>null);U(()=>J(new m9(`Watch handshake failed (${N.status}): ${B?.message??N.statusText}`)));return}try{for await(let B of m51(N.body)){if(H)return;if(B.type==="ERROR"){let j=B.object;U(()=>J(new m9(`Watch stream error while waiting for sandbox: ${j.message??"unknown"}`)));return}if(B.type!=="ADDED"&&B.type!=="MODIFIED")continue;let O=B.object;if(!O.status?.conditions?.find((j)=>j.type==="Ready"&&j.status==="True"))continue;let D=O.metadata?.name;if(!D){U(()=>J(new m9("Sandbox metadata or name is missing")));return}let E=O.metadata?.annotations?.[i5.POD_NAME_ANNOTATION]??D;U(()=>G({sandboxName:D,podName:E}));return}U(()=>J(new m9("Watch stream closed before sandbox became ready")))}catch(B){if(H)return;if(B instanceof Error&&(B.name==="AbortError"||W.signal.aborted))return;U(()=>J(new m9("Watch stream error while waiting for sandbox",B)))}})(),K}async function*m51($){let Z=$.getReader(),X=new TextDecoder,Q="";try{while(!0){let{value:G,done:J}=await Z.read();if(J)break;Q+=X.decode(G,{stream:!0});let K;while((K=Q.indexOf(`
-`))>=0){let W=Q.slice(0,K).trim();if(Q=Q.slice(K+1),!W)continue;yield JSON.parse(W)}}let Y=Q.trim();if(Y)yield JSON.parse(Y)}finally{Z.releaseLock()}}var Nq8,IP0,Eq8="gateway.networking.k8s.io",jq8="v1",zq8="httproutes",th4,Ua,Aq8="mesh-sandbox-runner";var Na=L(()=>{B4();Wa();Nq8=class Nq8 extends Error{status;body;constructor($,Z,X){super(X);this.status=$;this.body=Z;this.name="KubeHttpError"}};IP0=`/apis/${i5.CLAIM_API_GROUP}/${i5.CLAIM_API_VERSION}/namespaces`;th4=`/apis/${Eq8}/${jq8}/namespaces`;Ua={API_GROUP:Eq8,API_VERSION:jq8,PLURAL:zq8}});function rh4($){return($.items??[]).some((Z)=>{if(Z.status?.phase!=="Pending")return!1;return(Z.status?.conditions??[]).some((X)=>X.type==="PodScheduled"&&X.status==="False"&&X.reason==="Unschedulable")})}function Iq8($,Z){let X=0,Q=!0,Y=null,G=async()=>{try{let J=await CG($,{method:"GET",path:`/api/v1/namespaces/${encodeURIComponent(Z)}/pods?fieldSelector=status.phase%3DPending`});if(!J.ok)return Rq8;let K=await J.json();return!rh4(K)}catch{return Rq8}};return async()=>{if(Date.now()-X<oh4)return Q;return Y??=G().finally(()=>{Y=null}),Q=await Y,X=Date.now(),Q}}var oh4=3000,Rq8=!0;var qq8=L(()=>{Na()});var CP0=L(()=>{B4();b41()});async function vP0($){try{let Z=await fetch(`${$}/health`,{signal:AbortSignal.timeout(ah4)});if(!Z.ok)return null;let X=await Z.json();if(typeof X==="object"&&X!==null&&typeof X.bootId==="string"&&typeof X.ready==="boolean"&&X.setup&&typeof X.setup.running==="boolean"&&typeof X.setup.done==="boolean")return X;return null}catch{return null}}async function p51($){for(let Z=0;Z<Mq8;Z++){if(await vP0($)!==null)return;let X=(Math.random()*2-1)*sh4;await N8(Vq8+X)}throw Error(`sandbox daemon at ${$} did not respond on /health within ${Mq8*Vq8/1000}s`)}async function Zv($,Z,X,Q,Y){return eh4($,Z,"POST",X,Q,Y)}async function eh4($,Z,X,Q,Y,G){let J={...Q};if(Y&&Y.rotateToken!==void 0)J.auth=Y;let K=await fetch(`${$}/_sandbox/config`,{method:X,headers:{"Content-Type":"application/json",Authorization:`Bearer ${Z}`},body:JSON.stringify(J),signal:AbortSignal.timeout(G?.timeoutMs??i51)}),W=await K.text();if(!K.ok)throw new _P0(K.status,W);return JSON.parse(W)}async function kq8($,Z,X){let Q=await fetch(`${$}/_sandbox/setup/${X}`,{method:"POST",headers:{Authorization:`Bearer ${Z}`},signal:AbortSignal.timeout(i51)});if(!Q.ok)throw Error(`sandbox daemon /_sandbox/setup/${X} returned ${Q.status}: ${await Q.text()}`)}async function Sq8($,Z,X){let Q=await fetch(`${$}/_sandbox/orgfs-config`,{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${Z}`},body:X,signal:AbortSignal.timeout(i51)}),Y=await Q.text();if(!Q.ok)throw Error(`sandbox daemon /_sandbox/orgfs-config returned ${Q.status}: ${Y}`);return JSON.parse(Y)}async function Ba($,Z,X,Q){let Y=new Headers(Q.headers);for(let K of $u4)Y.delete(K);Y.set("authorization",`Bearer ${Z}`);let G=Q.method!=="GET"&&Q.method!=="HEAD",J=`${$}${X.startsWith("/")?X:`/${X}`}`;return fetch(J,{method:Q.method,headers:Y,body:G?Q.body:void 0,redirect:"manual",signal:Q.signal,duplex:G?"half":void 0})}var _P0,ah4=500,i51=30000,Mq8=25,Vq8=200,sh4=50,$u4;var Cq8=L(()=>{CP0();_P0=class _P0 extends Error{status;constructor($,Z){super(`sandbox daemon /_sandbox/config returned ${$}: ${Z}`);this.status=$;this.name="ConfigRequestError"}};$u4=["cookie","host","connection","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","accept-encoding","content-length"]});async function*xq8($){let Z=$.now??(()=>Date.now()),X=Z(),Q=$.schedulingTimeoutMs??Xu4,Y={pod:{},sandbox:{},events:{hasPulling:!1,hasPulled:!1},startedAt:X},G=[],J=null,K=!1,W=(j)=>{if(K)return;if(J){let z=J;J=null,z(j)}else G.push(j)},H=()=>{if(G.length>0)return Promise.resolve(G.shift());if(K)return Promise.resolve(null);return new Promise((j)=>{J=j})},F=()=>{if(K)return;if(K=!0,J){let j=J;J=null,j(null)}},U=new AbortController,N=()=>{U.abort(),F()};if($.signal)if($.signal.aborted)U.abort(),F();else $.signal.addEventListener("abort",N,{once:!0});let B=Math.max(0,Q-(Z()-X)),O=setTimeout(()=>W("tick"),B+100),w,D=new Promise((j)=>{w=j}),E=Promise.allSettled([Qu4($.kc,$.namespace,$.claimName,U.signal,Y,W,Z,w),Gu4($.kc,$.namespace,$.claimName,U.signal,Y,W),Ju4($.kc,$.namespace,$.claimName,D,U.signal,Y,W,Z)]);try{let j=null,z=-1,A=_q8(Y,Q,Z);if(j=t51(A),!n51(A))z=vq8(A);if(yield A,n51(A))return;while(!K){if(await H()===null)break;let I=_q8(Y,Q,Z);if(n51(I)){let S=t51(I);if(S!==j)j=S,yield I;return}let q=vq8(I);if(q<z)continue;let M=t51(I);if(M!==j)j=M,z=q,yield I}}finally{if(clearTimeout(O),U.abort(),$.signal)$.signal.removeEventListener("abort",N);F(),await E.catch(()=>{})}}function _q8($,Z,X){let{pod:Q,sandbox:Y,events:G,startedAt:J}=$;if(Y.ready)return{kind:"ready"};let K=Q.containerWaitingReason;if(K==="ImagePullBackOff"||K==="ErrImagePull")return{kind:"failed",reason:"image-pull-backoff",message:"Sandbox image failed to download. The cluster may be missing pull credentials or the image tag may not exist."};if(K==="CrashLoopBackOff")return{kind:"failed",reason:"crash-loop-backoff",message:"Sandbox crashed during startup and is now in CrashLoopBackOff. Check pod logs."};if(!Q.scheduled&&G.lastFailedSchedulingAt!==void 0&&X()-J>Z)return{kind:"failed",reason:"scheduling-timeout",message:G.failedSchedulingMessage??`Pod could not be scheduled within ${Math.round(Z/1000)}s.`};if(Q.containerRunning&&!Q.containerReady)return{kind:"warming-daemon",since:J};if(G.hasPulling&&!G.hasPulled)return{kind:"pulling-image",since:J};if(K==="ContainerCreating"||K==="PodInitializing"||Q.scheduled&&!Q.containerRunning)return{kind:"starting-container",since:J};if(Q.scheduledFalseReason==="Unschedulable"||G.lastFailedSchedulingAt!==void 0&&!Q.scheduled)return{kind:"waiting-for-capacity",since:J,message:G.failedSchedulingMessage??Q.scheduledFalseMessage,nodeClaim:G.nominatedNodeClaim};return{kind:"claiming",since:J}}function n51($){return $.kind==="ready"||$.kind==="failed"}function vq8($){switch($.kind){case"claiming":return 0;case"waiting-for-capacity":return 1;case"pulling-image":return 2;case"starting-container":return 3;case"warming-daemon":return 4;case"ready":case"failed":return 99}}function t51($){switch($.kind){case"claiming":case"pulling-image":case"starting-container":case"warming-daemon":return $.kind;case"waiting-for-capacity":return`waiting-for-capacity:${$.message??""}:${$.nodeClaim??""}`;case"ready":return"ready";case"failed":return`failed:${$.reason}:${$.message}`}}async function Qu4($,Z,X,Q,Y,G,J,K){let W=`/api/v1/namespaces/${encodeURIComponent(Z)}/pods?watch=true&labelSelector=${encodeURIComponent(`${Zu4}=${X}`)}`;return xP0({kc:$,path:W,signal:Q,label:`pod/${X}`,onEvent:(H)=>{if(H.type!=="ADDED"&&H.type!=="MODIFIED")return;let F=H.object;if(F.metadata?.name)K(F.metadata.name);Yu4(F,Y,J),G("pod")}})}function Yu4($,Z,X){let Y=($.status?.conditions??[]).find((J)=>J.type==="PodScheduled");if(Y?.status==="True")Z.pod.scheduled=!0,Z.pod.scheduledFalseReason=void 0,Z.pod.scheduledFalseMessage=void 0;else if(Y?.status==="False")Z.pod.scheduled=!1,Z.pod.scheduledFalseReason=Y.reason,Z.pod.scheduledFalseMessage=Y.message;let G=($.status?.containerStatuses??[]).find((J)=>J.name===i5.MAIN_CONTAINER_NAME);if(G)Z.pod.containerWaitingReason=G.state?.waiting?.reason,Z.pod.containerRunning=!!G.state?.running,Z.pod.containerReady=G.ready===!0}async function Gu4($,Z,X,Q,Y,G){let J=`/apis/${i5.CLAIM_API_GROUP}/${i5.CLAIM_API_VERSION}/namespaces/${encodeURIComponent(Z)}/${i5.CLAIM_PLURAL}?watch=true&fieldSelector=${encodeURIComponent(`metadata.name=${X}`)}`;return xP0({kc:$,path:J,signal:Q,label:`sandboxclaim/${X}`,onEvent:(K)=>{if(K.type!=="ADDED"&&K.type!=="MODIFIED")return;let H=K.object.status?.conditions?.find((F)=>F.type==="Ready");if(!H)return;if(H.status==="True")Y.sandbox.ready=!0,Y.sandbox.notReadyReason=void 0,Y.sandbox.notReadyMessage=void 0;else Y.sandbox.ready=!1,Y.sandbox.notReadyReason=H.reason,Y.sandbox.notReadyMessage=H.message;G("sandbox")}})}async function Ju4($,Z,X,Q,Y,G,J,K){let W=await Promise.race([Q,new Promise((F)=>{if(Y.aborted){F(X);return}Y.addEventListener("abort",()=>F(X),{once:!0})})]);if(Y.aborted)return;let H=`/api/v1/namespaces/${encodeURIComponent(Z)}/events?watch=true&fieldSelector=${encodeURIComponent(`involvedObject.name=${W},involvedObject.kind=Pod`)}`;return xP0({kc:$,path:H,signal:Y,label:`events/${X}`,onEvent:(F)=>{if(F.type!=="ADDED"&&F.type!=="MODIFIED")return;let U=F.object,N=U.reason;if(!N)return;switch(N){case"Pulling":G.events.hasPulling=!0;break;case"Pulled":G.events.hasPulling=!0,G.events.hasPulled=!0;break;case"FailedScheduling":G.events.lastFailedSchedulingAt=K(),G.events.failedSchedulingMessage=U.message;break;case"Nominated":{let B=U.message?.match(/nodeclaim\/([\w-]+)/);if(B)G.events.nominatedNodeClaim=B[1];break}default:return}J("event")}})}async function fq8($){let{kc:Z,namespace:X,labelSelector:Q,signal:Y,onDelete:G}=$,J=`/apis/${i5.CLAIM_API_GROUP}/${i5.CLAIM_API_VERSION}/namespaces/${encodeURIComponent(X)}/${i5.CLAIM_PLURAL}?watch=true&labelSelector=${encodeURIComponent(Q)}`;return xP0({kc:Z,path:J,signal:Y,label:"sandboxclaim-reaper",onEvent:(K)=>{if(K.type!=="DELETED")return;let W=K.object.metadata?.name;if(W)G(W)}})}async function xP0($){let{kc:Z,path:X,signal:Q,label:Y,onEvent:G}=$,J=0;while(!Q.aborted){try{let W=await CG(Z,{method:"GET",path:X,signal:Q,headers:{accept:"application/json"},stream:!0});if(!W.ok||!W.body){try{await W.body?.cancel()}catch{}if(W.status===401||W.status===403){console.warn(`[lifecycle-watcher] ${Y} stopped: watch denied (${W.status} ${W.statusText}). `+"The kubeconfig in use cannot watch SandboxClaims \u2014 if you are running locally, "+"this provider should not be active (check STUDIO_SANDBOX_PROVIDER / your sandbox preference).");return}throw Error(`watch handshake failed: ${W.status} ${W.statusText}`)}J=0;for await(let H of m51(W.body)){if(Q.aborted)return;try{G(H)}catch(F){console.warn(`[lifecycle-watcher] ${Y} onEvent threw: ${F instanceof Error?F.message:String(F)}`)}}}catch(W){if(Q.aborted)return;let H=W instanceof Error?W.message:String(W);console.warn(`[lifecycle-watcher] ${Y} watch ended: ${H}`)}if(Q.aborted)return;let K=O7(5000,250,J,2,0);J+=1,await N8(K,{signal:Q}).catch(()=>{})}}var Zu4="studio.decocms.com/sandbox-handle",Xu4=300000;var bq8=L(()=>{B4();Wa();Na()});import{z as d3}from"zod";function yq8($){if(!$||$.trim()==="")return[];let Z=d3.array(Ku4).parse(JSON.parse($)),X=new Set;for(let Q of Z){if(X.has(Q.name))throw Error(`STUDIO_SANDBOX_TENANT_POOLS: duplicate pool name ${Q.name}`);X.add(Q.name)}return Z}function Wu4($){try{let[Z,X]=new URL($).pathname.replace(/^\/+/,"").split("/"),Q=X?.replace(/\.git$/,"");return Z&&Q?`${Z}/${Q}`.toLowerCase():null}catch{return null}}function gq8($,Z){let{orgId:X,cloneUrl:Q}=Z;if(Z.purpose==="harness-run")return null;if(!X||!Q)return null;let Y=Wu4(Q);if(!Y)return null;return $.find((G)=>G.orgId===X&&G.repo.toLowerCase()===Y)??null}function hq8($,Z,X){return $?.name??(Z?X:"none")}function Hu4($,Z){return $==="harness-run"?`${Z}-medium`:Z}async function uq8($){let Z=Hu4($.purpose,$.templateName);if(Z===$.templateName)return{name:Z,probe:$.probe};let X=$.probe!==null&&$.now-$.probe.checkedAt<$.ttlMs?$.probe:{checkedAt:$.now,present:await $.exists(Z)};if(X.present)return{name:Z,probe:X};if($.probe?.present!==!1)$.onAbsent?.(Z);return{name:$.templateName,probe:X}}function cq8($,Z,X){let Q=X.replace(/^refs\/heads\//,"");return $.filter((Y)=>Y.repo.toLowerCase()===Z.toLowerCase()&&Y.branch===Q)}function lq8($){return`https://github.com/${$.repo}.git`}var Ku4;var o51=L(()=>{Ku4=d3.object({name:d3.string().regex(/^[a-z0-9]([-a-z0-9]*[a-z0-9])?$/,"pool name must be a DNS label (lowercase alphanumeric and '-')"),orgId:d3.string().min(1),repo:d3.string().regex(/^[^/\s]+\/[^/\s]+$/,"repo must be `owner/name`"),connectionId:d3.string().min(1).optional(),branch:d3.string().min(1).default("main"),workload:d3.object({runtime:d3.enum(["node","bun","deno"]).default("node"),packageManager:d3.enum(["npm","pnpm","yarn","bun","deno"]).optional(),packageManagerPath:d3.string().optional(),devPort:d3.number().int().positive().optional()}).default({runtime:"node"})})});async function dq8($,Z,X){let Q=new Map;for(let Y of $){let G=Z(Y);if(!G)continue;let J=Q.get(G);if(J)J.push(Y);else Q.set(G,[Y])}await Promise.allSettled([...Q.values()].map(async(Y)=>{for(let G of Y)await X(G).catch(()=>{})}))}import{createHash as Fu4,randomBytes as Uu4,randomUUID as Nu4}from"crypto";import*as rq8 from"net";import{PassThrough as Bu4}from"stream";function mq8($){if($ instanceof Error)return $.message;if($&&typeof $==="object"){let Z=$;if(Z.error instanceof Error)return Z.error.message;if(typeof Z.message==="string"&&Z.message)return Z.message}return String($)}class X91{kind=VY;records=new Map;inflight=new sJ0;activeGauge=new aJ0;stateStore;previewUrlPattern;kubeConfig;capacityProbe;portForward;namespace;sandboxTemplateName;envName;tokenGenerator;idleTtlMs;metrics;previewGateway;sentinelToken;mintCloneUrl;mintOrgFsConfig;tenantPools;tenantPoolRefreshMs;poolPods=new Map;mediumTemplateProbe=null;dirtyPools=new Set;closed=!1;claimWatchAbort=new AbortController;constructor($={}){this.stateStore=$.stateStore??null,this.previewUrlPattern=$.previewUrlPattern??null,this.kubeConfig=$.kubeConfig??Mu4(),this.portForward=new T51(this.kubeConfig),this.namespace=$.namespace??Ou4,this.sandboxTemplateName=$.sandboxTemplateName??Lu4,this.envName=vu4($.envName),this.tokenGenerator=$.tokenGenerator??(()=>Uu4(Du4).toString("hex")),this.idleTtlMs=$.idleTtlMs??ju4,this.metrics=$.meter?qu4($.meter):null,this.previewGateway=$.previewGateway&&$.previewUrlPattern?{...$.previewGateway}:null;let Z=$.sentinelToken?.trim()??"";if(this.sentinelToken=Z.length>0?Z:null,this.mintCloneUrl=$.mintCloneUrl,this.mintOrgFsConfig=$.mintOrgFsConfig,this.tenantPools=this.sentinelToken!==null?$.tenantPools??[]:[],this.sentinelToken===null&&($.tenantPools?.length??0)>0)console.warn(`[${j$}] tenant pools configured without a sentinel token \u2014 ignoring them (warm-pool mode is off)`);this.tenantPoolRefreshMs=$.tenantPoolRefreshMs??Pu4,this.startClaimReaper(),this.startCredentialRefresher(),this.startTenantPoolReconciler()}startClaimReaper(){let $=["app.kubernetes.io/managed-by=studio","app.kubernetes.io/name=studio-sandbox",...this.envName?[`${IQ.env}=${this.envName}`]:[]].join(",");fq8({kc:this.kubeConfig,namespace:this.namespace,labelSelector:$,signal:this.claimWatchAbort.signal,onDelete:(Z)=>this.invalidateRecord(Z)})}async ensure($,Z={}){let X=Rz($);if(X.startsWith("s-"))throw Error(`ensure: projectRef has no slug source: ${$.projectRef}`);return this.inflight.run(X,()=>eJ0(this.stateStore,$,VY,(Q)=>this.ensureLocked($,X,Z,Q)))}async delete($){let Z=await this.getRecord($);if(this.records.delete($),Z)this.dropRecord(Z);if(await this.deleteHttpRouteIfManaged($).catch((X)=>{console.warn(`[${j$}] HTTPRoute delete failed for ${$}: ${X instanceof Error?X.message:String(X)}`)}),await Xw(this.kubeConfig,this.namespace,$),this.stateStore)if(Z)await this.stateStore.delete(Z.id,VY);else await this.stateStore.deleteByHandle(VY,$)}lastTermination($){return Dq8(this.kubeConfig,this.namespace,IQ.sandboxHandle,$,i5.MAIN_CONTAINER_NAME)}async alive($){return await _K(this.kubeConfig,this.namespace,$)!==void 0}watchClaimLifecycle($,Z){return xq8({kc:this.kubeConfig,namespace:this.namespace,claimName:$,signal:Z})}hasSchedulableCapacity(){return this.capacityProbe??=Iq8(this.kubeConfig,this.namespace),this.capacityProbe()}async getPreviewUrl($){let Z=await this.getRecord($);if(!Z)return null;return this.composePreviewUrl(Z)}async proxyDaemonRequest($,Z,X){let Q=await this.getRecord($);if(!Q&&this.previewUrlPattern&&this.stateStore){let W=await this.stateStore.getByHandle(VY,$),H=W?.state,F=H?.token;if(W&&F){let N=`http://${H?.adoptedSandboxName??$}.${this.namespace}.svc.cluster.local:${$N}`;try{let B=await Ba(N,F,Z,X);if(B.status!==404)return B;try{await B.body?.cancel()}catch{}}catch{}}}if(!Q)Q=await this.resurrectByHandle($);if(!Q)return new Response(JSON.stringify({error:"sandbox not found"}),{status:404,headers:{"content-type":"application/json"}});let Y=Q,G=performance.now(),J=0,K=!(X.body instanceof ReadableStream);try{let W=await Ba(Q.daemonUrl,Q.token,Z,X);if(W.status===401&&K){this.invalidateRecord($);let H=await this.getRecord($).catch(()=>null)??await this.resurrectByHandle($).catch(()=>null);if(H){try{await W.body?.cancel()}catch{}Y=H,W=await Ba(H.daemonUrl,H.token,Z,X)}}return J=W.status,W}catch(W){if(!K)throw W;this.invalidateRecord($);let H=await this.resurrectByHandle($)??await this.getRecord($).catch(()=>null);if(!H)throw W;Y=H;let F=await Ba(H.daemonUrl,H.token,Z,X);return J=F.status,F}finally{this.recordProxyDuration("daemon",J,Y,performance.now()-G)}}async adoptLiveClaim($,Z){if(this.records.has(Z))return!0;let X=await _K(this.kubeConfig,this.namespace,Z).catch(()=>{return});if(!X||X.metadata?.deletionTimestamp)return!1;return await this.inflight.run(Z,async()=>{let Y=this.records.get(Z);if(Y)return this.toSandbox(Y);let G=await this.adopt($,Z,X);if(!G)throw Error(`cannot adopt live claim ${Z}`);return eJ0(this.stateStore,$,VY,(J)=>this.finish(G,J,!0,!0,"adopt"))}).catch(()=>null)!=null}async resolvePreviewUpstreamUrl($){if(this.previewUrlPattern)return`http://${await this.resolveServiceNameForHandle($)}.${this.namespace}.svc.cluster.local:${$N}`;let Z=await this.getRecord($);if(Z)return Z.daemonUrl;let X=await this.resurrectByHandle($);return X?X.daemonUrl:null}async resolveServiceNameForHandle($){let Z=this.records.get($);if(Z)return Z.adoptedSandboxName;if(this.stateStore){let Q=(await this.stateStore.getByHandle(VY,$).catch(()=>null))?.state?.adoptedSandboxName;if(Q)return Q}return $}async proxyPreviewRequest($,Z){let X=performance.now(),Q=this.records.get($)??null,Y=0;try{let G=await this.resolvePreviewUpstreamUrl($);if(!G){Y=404;let O=a51(404,{error:"sandbox not found"});return O.headers.set(Qv,"1"),O}let J=new URL(Z.url);if((J.pathname==="/_sandbox"||J.pathname.startsWith("/_sandbox/")||J.pathname==="/_decopilot_vm"||J.pathname.startsWith("/_decopilot_vm/"))&&Z.method!=="GET")return Y=404,a51(404,{error:"not found"});let W=(O)=>`${O}${J.pathname}${J.search}`,H=new Headers(Z.headers);for(let O of Ru4)H.delete(O);let F=Z.method!=="GET"&&Z.method!=="HEAD",U={method:Z.method,headers:H,body:F?Z.body:void 0,redirect:"manual",signal:Z.signal,duplex:F?"half":void 0},N;try{N=await fetch(W(G),U)}catch(O){let w=`${G}${J.pathname}`;if(console.warn(`[${j$}] preview fetch to ${w} failed: ${O instanceof Error?O.message:String(O)}`),Z.method==="GET"||Z.method==="HEAD"){if(this.invalidateRecord($),await this.resurrectByHandle($).catch(()=>null)){let j=await this.resolvePreviewUpstreamUrl($);if(j)try{N=await fetch(W(j),U);let z=new Headers;for(let[A,P]of N.headers.entries())if(!nq8.includes(A.toLowerCase()))z.set(A,P);return Y=N.status,new Response(N.body,{status:N.status,statusText:N.statusText,headers:z})}catch(z){console.warn(`[${j$}] preview fetch retry to ${w} failed: ${z instanceof Error?z.message:String(z)}`)}}}else this.invalidateRecord($);Y=502;let D=a51(502,{error:"sandbox daemon unreachable"});return D.headers.set(Qv,"1"),D}let B=new Headers;for(let[O,w]of N.headers.entries())if(!nq8.includes(O.toLowerCase()))B.set(O,w);return Y=N.status,new Response(N.body,{status:N.status,statusText:N.statusText,headers:B})}finally{this.recordProxyDuration("preview",Y,Q,performance.now()-X,$)}}async ensureLocked($,Z,X,Q){if(X.image)console.warn(`[${j$}] opts.image ignored (template ${this.sandboxTemplateName} pins image): got ${X.image}`);if(Q){let J=await Q.get($,VY);if(J){let K=await this.rehydrate($,Z,J);if(K)return await this.refreshDaemonGitCredential(K,X),await this.relayOrgFsConfig(K.daemonUrl,K.token,X.orgFsConfigJson),this.finish(K,Q,!1,!0,"resume");await Q.delete($,VY)}}let Y=await _K(this.kubeConfig,this.namespace,Z).catch(()=>{return});if(Y)if(Y.metadata?.deletionTimestamp)await qP0(this.kubeConfig,this.namespace,Z).catch((J)=>{console.warn(`[${j$}] wait for terminating claim ${Z} failed: ${J instanceof Error?J.message:String(J)}`)});else{let J=await this.adopt($,Z,Y).catch((K)=>{return console.warn(`[${j$}] adopt ${Z} failed, recreating: ${K instanceof Error?K.message:String(K)}`),null});if(J)return await this.refreshDaemonGitCredential(J,X),await this.relayOrgFsConfig(J.daemonUrl,J.token,X.orgFsConfigJson),this.finish(J,Q,!0,!0,"adopt");await Xw(this.kubeConfig,this.namespace,Z).catch(()=>{}),await qP0(this.kubeConfig,this.namespace,Z).catch((K)=>{console.warn(`[${j$}] wait for deleted claim ${Z} failed: ${K instanceof Error?K.message:String(K)}`)})}let G=await this.provision($,Z,X);return this.finish(G,Q,!0,!1,"fresh")}async finish($,Z,X,Q,Y){let G=this.records.get($.handle),J=G!==void 0;if(G&&G.daemonForward!==$.daemonForward)this.closeForwarder(G.daemonForward);if(this.records.set($.handle,$),X)await this.persist(Z,$);if(Q)await MP0(this.kubeConfig,this.namespace,$.handle,this.computeShutdownTime()).catch((K)=>console.warn(`[${j$}] TTL refresh failed for ${$.handle}: ${K instanceof Error?K.message:String(K)}`));if(this.metrics){let K=e51($.tenant);if(this.metrics.ensureOutcome.add(1,{...K,outcome:Y}),!J)this.metrics.active.add(1,K),this.activeGauge.markCounted($.handle)}return this.toSandbox($)}buildEnvMap($,Z){let X={},Q=[];for(let[Y,G]of Object.entries($.env??{}))if(Eu4.has(Y))Q.push(Y);else X[Y]=G;if(Q.length>0)console.warn(`[${j$}] opts.env keys overlap reserved bootstrap names and were dropped: ${Q.join(",")}`);return{...X,DAEMON_TOKEN:Z.token,DAEMON_BOOT_ID:Z.daemonBootId,APP_ROOT:Z.workdir,PROXY_PORT:String($N)}}async resolveTemplateName($){let{name:Z,probe:X}=await uq8({purpose:$,templateName:this.sandboxTemplateName,probe:this.mediumTemplateProbe,now:Date.now(),ttlMs:wu4,exists:(Q)=>Bq8(this.kubeConfig,this.namespace,Q),onAbsent:(Q)=>console.warn(`[${j$}] SandboxTemplate ${Q} not found (or not readable) \u2014 harness-run claims fall back to ${this.sandboxTemplateName}. Upgrade the sandbox-env chart to the version that renders it.`)});return this.mediumTemplateProbe=X,Z}buildClaim($,Z,X,Q){let Y=this.sentinelToken!==null,G=gq8(this.tenantPools,{orgId:Z.tenant?.orgId,cloneUrl:Z.repo?.cloneUrl,purpose:Z.purpose}),J=Y?[]:Object.entries(this.buildEnvMap(Z,X)).sort(([H],[F])=>H<F?-1:H>F?1:0).map(([H,F])=>({name:H,value:F})),K=bu4(Z),W=Object.keys(K).length>0;return{apiVersion:`${i5.CLAIM_API_GROUP}/${i5.CLAIM_API_VERSION}`,kind:"SandboxClaim",metadata:{name:$,namespace:this.namespace,labels:{"app.kubernetes.io/name":"studio-sandbox","app.kubernetes.io/managed-by":"studio",...this.envName?{[IQ.env]:this.envName}:{},...s51(Z.tenant)},...W?{annotations:K}:{}},spec:{sandboxTemplateRef:{name:Q},additionalPodMetadata:{labels:s51(Z.tenant,{[IQ.role]:"claimed",[IQ.sandboxHandle]:$,...this.envName?{[IQ.env]:this.envName}:{}}),...W?{annotations:K}:{}},env:J,warmpool:hq8(G,Y,Q),lifecycle:{shutdownPolicy:"Delete",shutdownTime:this.computeShutdownTime()}}}}async provision($,Z,X){let Q=this.tokenGenerator(),Y=Nu4(),G=r51,J=this.buildClaim(Z,X,{token:Q,daemonBootId:Y,workdir:G},await this.resolveTemplateName(X.purpose));try{await Fa(this.kubeConfig,this.namespace,J)}catch(N){if(N instanceof Ka)await qP0(this.kubeConfig,this.namespace,Z),await Fa(this.kubeConfig,this.namespace,J);else throw N}let K;try{K=await Oq8(this.kubeConfig,this.namespace,Z),await SP0(this.kubeConfig,this.namespace,K)}catch(N){throw await Xw(this.kubeConfig,this.namespace,Z).catch(()=>{}),N}try{await this.ensureServicePortForAdoptedSandbox(K),await this.ensureHttpRouteForHandle(Z,K,X.tenant??null)}catch(N){throw await Xw(this.kubeConfig,this.namespace,Z).catch(()=>{}),N}let W=await this.openForwarder(K,$N,Z),H=`http://127.0.0.1:${W.localPort}`,F=this.workloadConfigPayload(X),U=Y;try{if(await p51(H),this.sentinelToken!==null){let N=await vP0(H);if(N)U=N.bootId;await Zv(H,this.sentinelToken,F??{},{rotateToken:Q})}else if(F)await Zv(H,Q,F);await this.relayOrgFsConfig(H,Q,X.orgFsConfigJson)}catch(N){throw this.closeForwarder(W),await this.deleteHttpRouteIfManaged(Z).catch(()=>{}),await Xw(this.kubeConfig,this.namespace,Z).catch(()=>{}),N}return{id:$,handle:Z,adoptedSandboxName:K,token:Q,workdir:G,daemonUrl:H,daemonForward:W,workload:X.workload??null,daemonBootId:U,tenant:X.tenant??null,ensureOpts:cu4(X)}}workloadConfigPayload($){return ZK0({runtime:$?.workload?.runtime??"node",packageManager:$?.workload?.packageManager?{name:$.workload.packageManager,...$.workload.packageManagerPath?{path:$.workload.packageManagerPath}:{}}:null,repo:$?.repo??null,port:$?.workload?.devPort??iq8,tenant:$?.tenant??void 0,...$?{cloneOnly:$.cloneOnly===!0}:{}})}async relayOrgFsConfig($,Z,X){if(!X)return;await Sq8($,Z,X).catch((Q)=>console.warn("[org-fs] sidecar config relay failed",Q))}async refreshDaemonGitCredential($,Z){let X=y41(Z);if(!X)return;try{await Zv($.daemonUrl,$.token,X)}catch(Q){console.warn(`[${j$}] git credential refresh failed for ${$.handle}: ${Q instanceof Error?Q.message:String(Q)}`)}}async withFreshCloneUrl($,Z){if(!this.mintCloneUrl)return $;try{let X=await this.mintCloneUrl($,Z!==void 0?{bufferMs:Z}:void 0);return X?{...$,cloneUrl:X}:$}catch(X){return console.warn(`[${j$}] clone credential re-mint failed: ${X instanceof Error?X.message:String(X)}`),$}}async withFreshCredentials($){return{...$,...$.repo?{repo:await this.withFreshCloneUrl($.repo)}:{},...$.orgFsConfigJson?{orgFsConfigJson:await uu4($,this.mintOrgFsConfig)}:{}}}startCredentialRefresher(){if(!this.mintCloneUrl)return;let{signal:$}=this.claimWatchAbort;(async()=>{while(!$.aborted){if(await N8(Au4,{signal:$}).catch(()=>{}),$.aborted)break;try{await this.refreshAllGitCredentials()}catch(Z){console.warn(`[${j$}] periodic credential refresh failed: ${Z instanceof Error?Z.message:String(Z)}`)}}})()}startTenantPoolReconciler(){if(this.tenantPools.length===0)return;let{signal:$}=this.claimWatchAbort;(async()=>{while(!$.aborted){try{await this.reconcileTenantPools()}catch(Z){console.warn(`[${j$}] tenant pool reconcile failed: ${Z instanceof Error?Z.message:String(Z)}`)}await N8(zu4,{signal:$}).catch(()=>{})}})()}markTenantPoolsDirty($,Z){let X=cq8(this.tenantPools,$,Z);for(let Q of X)this.dirtyPools.add(Q.name);return X.map((Q)=>Q.name)}async reconcileTenantPools(){for(let $ of this.tenantPools){let Z=await Lq8(this.kubeConfig,this.namespace,$.name);if(Z===null){console.warn(`[${j$}] tenant pool ${$.name}: no SandboxWarmPool (or no selector yet) in ${this.namespace}`);continue}let X=this.dirtyPools.delete($.name),Q=Z.filter((Y)=>!Y.labels[IQ.sandboxHandle]);for(let[Y]of this.poolPods)if(!Z.some((G)=>G.uid===Y))this.poolPods.delete(Y);for(let Y of Q){if(this.claimWatchAbort.signal.aborted)return;await this.warmPoolPod($,Y,X)}this.recordPoolDepth($,Z,Q)}}recordPoolDepth($,Z,X){let Q=this.metrics?.poolPods;if(!Q)return;let Y=0,G=0;for(let K of X){let W=this.poolPods.get(K.uid);if(!W)continue;if(W.failures>=fP0)G++;else if(W.lastConfigAt>0)Y++}let J={pool:$.name,org:$.orgId};Q.record(Y,{...J,state:"ready"}),Q.record(Z.length-X.length,{...J,state:"bound"}),Q.record(X.length-Y-G,{...J,state:"pending"}),Q.record(G,{...J,state:"failed"})}async warmPoolPod($,Z,X){let Q=this.poolPods.get(Z.uid);if(Q&&Q.failures>=fP0){if(Date.now()-Q.lastFailureAt<pq8)return;this.poolPods.set(Z.uid,{...Q,failures:0})}let Y=X||Q!==void 0&&Date.now()-Q.lastConfigAt>=this.tenantPoolRefreshMs;if(Q&&!Y)return;let G={cloneUrl:lq8($),connectionId:$.connectionId,branch:$.branch,userName:"",userEmail:""},J=await this.withFreshCloneUrl(G);if($.connectionId&&J.cloneUrl===G.cloneUrl){this.recordPoolFailure(Z,$,"clone credential mint failed");return}let K=await this.openForwarder(Z.name,$N,Z.name).catch(()=>null);if(!K){this.recordPoolFailure(Z,$,"port-forward failed");return}let W=`http://127.0.0.1:${K.localPort}`;try{await p51(W);let H=this.sentinelToken;if(!H)return;if(!await this.isPoolPodUnbound(Z))return;let F=ZK0({runtime:$.workload.runtime,packageManager:$.workload.packageManager?{name:$.workload.packageManager,...$.workload.packageManagerPath?{path:$.workload.packageManagerPath}:{}}:null,repo:J,port:$.workload.devPort??iq8})??{},{transition:U}=await Zv(W,H,F);if(Y&&U!=="bootstrap"&&await this.isPoolPodUnbound(Z))await kq8(W,H,"clone");this.poolPods.set(Z.uid,{lastConfigAt:Date.now(),lastFailureAt:0,failures:0}),console.log(`[${j$}] tenant pool ${$.name}: warmed ${Z.name} (${U})`)}catch(H){this.recordPoolFailure(Z,$,H instanceof Error?H.message:String(H))}finally{this.closeForwarder(K)}}isPoolPodUnbound($){return wq8(this.kubeConfig,this.namespace,$.name,IQ.sandboxHandle)}recordPoolFailure($,Z,X){let Q=this.poolPods.get($.uid),Y=(Q?.failures??0)+1;this.poolPods.set($.uid,{lastConfigAt:Q?.lastConfigAt??0,lastFailureAt:Date.now(),failures:Y});let G=Y>=fP0?` \u2014 backing off ${pq8/60000}min`:"";console.warn(`[${j$}] tenant pool ${Z.name}: warming ${$.name} failed (${Y}/${fP0})${G}: ${X}`)}async refreshAllGitCredentials(){await dq8(this.records.values(),($)=>$.ensureOpts?.repo?.connectionId,async($)=>{if(this.claimWatchAbort.signal.aborted)return;let Z=$.ensureOpts?.repo;if(!Z)return;let X=await this.withFreshCloneUrl(Z,Tu4);await this.refreshDaemonGitCredential($,{...$.ensureOpts,repo:X}),$.ensureOpts={...$.ensureOpts,repo:X}})}async rebootstrapDaemon($,Z,X){if(this.sentinelToken===null)return!1;let Q=this.workloadConfigPayload(X)??{};try{return await Zv($,this.sentinelToken,Q,{rotateToken:Z}),await this.relayOrgFsConfig($,Z,X?.orgFsConfigJson),!0}catch(Y){if(Y instanceof _P0&&Y.status===401)try{return await Zv($,Z,Q,{rotateToken:Z}),await this.relayOrgFsConfig($,Z,X?.orgFsConfigJson),!0}catch(G){return console.warn(`[${j$}] re-bootstrap retry with claim token failed: ${G instanceof Error?G.message:String(G)}`),!1}return console.warn(`[${j$}] re-bootstrap failed: ${Y instanceof Error?Y.message:String(Y)}`),!1}}async ensureServicePortForAdoptedSandbox($){if(!this.previewGateway||!this.previewUrlPattern)return;await Tq8(this.kubeConfig,this.namespace,$,{name:"daemon",port:$N,targetPort:$N})}async ensureHttpRouteForHandle($,Z,X){if(!this.previewGateway||!this.previewUrlPattern)return;let Q=lu4(this.previewUrlPattern,$);if(!Q)throw new m9(`Unable to derive preview hostname for ${$} from pattern: ${this.previewUrlPattern}`);let Y={apiVersion:`${Ua.API_GROUP}/${Ua.API_VERSION}`,kind:"HTTPRoute",metadata:{name:$,namespace:this.namespace,labels:s51(X??void 0,{[IQ.role]:"claimed",[IQ.sandboxHandle]:$,"app.kubernetes.io/name":"studio-sandbox","app.kubernetes.io/managed-by":"studio",...this.envName?{[IQ.env]:this.envName}:{}})},spec:{parentRefs:[{kind:"Gateway",group:"gateway.networking.k8s.io",name:this.previewGateway.name,namespace:this.previewGateway.namespace}],hostnames:[Q],rules:[{backendRefs:[{group:"",kind:"Service",name:Z,port:$N}]}]}};await VP0(this.kubeConfig,this.namespace,Y)}async deleteHttpRouteIfManaged($){if(!this.previewGateway)return;await kP0(this.kubeConfig,this.namespace,$)}async rehydrate($,Z,X){let Q=X.state;if(!Q.adoptedSandboxName&&!Q.podName||!Q.token)return null;let Y=await _K(this.kubeConfig,this.namespace,Z).catch(()=>{return});if(!Y||!tq8(Y))return null;let G=Y.status?.sandbox?.name??Q.adoptedSandboxName??Q.podName??Z,J=await this.openAndProbeDaemon(G,Z);if(!J)return null;if(Q.daemonBootId&&Q.daemonBootId!==J.bootId){if(this.sentinelToken!==null){let K=Q.ensureOpts?await this.withFreshCredentials(Q.ensureOpts):null;if(!await this.rebootstrapDaemon(J.daemonUrl,Q.token,K))return this.closeForwarder(J.daemonForward),null}else console.warn(`[${j$}] daemon restart detected (handle=${Z}): stored bootId=${Q.daemonBootId} live bootId=${J.bootId}`);await this.stateStore?.put($,VY,{handle:Z,state:{...Q,daemonBootId:J.bootId}}).catch((K)=>console.warn(`[${j$}] bootId persist failed for ${Z}: ${K instanceof Error?K.message:String(K)}`))}return{id:$,handle:Z,adoptedSandboxName:G,token:Q.token,workdir:Q.workdir??r51,daemonUrl:J.daemonUrl,daemonForward:J.daemonForward,workload:Q.workload??null,daemonBootId:J.bootId,tenant:Q.tenant??null,ensureOpts:Q.ensureOpts??null}}async adopt($,Z,X){if(!tq8(X))return null;let Q=X.status?.sandbox?.name??Z;if(this.sentinelToken!==null)return null;let Y=Vu4(X);if(!Y)return null;let G=await this.openAndProbeDaemon(Q,Z);if(!G)return null;let J=yu4(X);if(this.previewGateway)await this.ensureServicePortForAdoptedSandbox(Q).catch((K)=>{console.warn(`[${j$}] Service port backfill failed for ${Z}: ${K instanceof Error?K.message:String(K)}`)}),await this.ensureHttpRouteForHandle(Z,Q,J).catch((K)=>{console.warn(`[${j$}] HTTPRoute backfill failed for ${Z}: ${K instanceof Error?K.message:String(K)}`)});return{id:$,handle:Z,adoptedSandboxName:Q,token:Y,workdir:r51,daemonUrl:G.daemonUrl,daemonForward:G.daemonForward,workload:null,daemonBootId:G.bootId,tenant:J,ensureOpts:null}}async openAndProbeDaemon($,Z){let X=await this.openForwarder($,$N,Z).catch(()=>null);if(!X)return null;let Q=`http://127.0.0.1:${X.localPort}`,Y=await vP0(Q);if(!Y)return this.closeForwarder(X),null;return{daemonForward:X,daemonUrl:Q,bootId:Y.bootId}}async getRecord($){let Z=this.records.get($);if(Z)return Z;if(!this.stateStore)return null;let X=await this.stateStore.getByHandle(VY,$);if(!X)return null;let Q=await this.rehydrate(X.id,$,X);if(Q)this.records.set($,Q);return Q}async resurrectByHandle($){if(!this.stateStore)return null;let Z=await this.stateStore.getByHandle(VY,$);if(!Z)return null;let X=Z.state.ensureOpts;if(!X)return null;let Q=await this.withFreshCredentials(X);if(Rz(Z.id)!==$)return null;return await this.ensure(Z.id,Q),this.records.get($)??null}invalidateRecord($){let Z=this.records.get($);if(!Z)return;this.records.delete($),this.dropRecord(Z)}dropRecord($){if(this.closeForwarder($.daemonForward),this.metrics&&this.activeGauge.consume($.handle))this.metrics.active.add(-1,e51($.tenant))}recordProxyDuration($,Z,X,Q,Y){if(!this.metrics)return;this.metrics.proxyDurationMs.record(Q,{...e51(X?.tenant??null),source:$,sandbox_handle:X?.handle??Y??"",status_code:Z||0})}composePreviewUrl($){if(this.previewUrlPattern)return $K0(this.previewUrlPattern,$.handle);return`http://127.0.0.1:${$.daemonForward.localPort}/`}toSandbox($){return{handle:$.handle,workdir:$.workdir,previewUrl:this.composePreviewUrl($)}}async persist($,Z){if(!$)return;let X={adoptedSandboxName:Z.adoptedSandboxName,token:Z.token,workdir:Z.workdir,workload:Z.workload,daemonBootId:Z.daemonBootId,tenant:Z.tenant,...Z.ensureOpts?{ensureOpts:Z.ensureOpts}:{}};await $.put(Z.id,VY,{handle:Z.handle,state:X})}computeShutdownTime(){return new Date(Date.now()+this.idleTtlMs).toISOString()}async releaseAfter($,Z){let X=await _K(this.kubeConfig,this.namespace,$);if(!X)return;let Q=gu4(X.spec?.lifecycle?.shutdownTime,new Date(Date.now()+Z));if(!Q)return;await MP0(this.kubeConfig,this.namespace,$,Q).catch((Y)=>console.warn(`[${j$}] release failed for ${$}: ${Y instanceof Error?Y.message:String(Y)}`))}async renewTtl($){let Z=await _K(this.kubeConfig,this.namespace,$);if(!Z)return;let X=hu4(Z.spec?.lifecycle?.shutdownTime,new Date(Date.now()+this.idleTtlMs));if(!X)return;await MP0(this.kubeConfig,this.namespace,$,X).catch((Q)=>console.warn(`[${j$}] TTL renew failed for ${$}: ${Q instanceof Error?Q.message:String(Q)}`))}openForwarder($,Z,X=$){let Q=ku4(X,Z);return new Promise((Y,G)=>{let J=(K,W)=>{let H=rq8.createServer((F)=>this.handleForwardedConnection(F,$,Z,X));H.once("error",(F)=>{if(F.code==="EADDRINUSE"&&W<Iu4){try{H.close()}catch{}let U=$91+(K-$91+1)%aq8;J(U,W+1);return}G(F)}),H.listen(K,"127.0.0.1",()=>{let F=H.address();if(!F||typeof F==="string"){H.close(),G(Error("port-forward listener failed to bind"));return}Y({server:H,localPort:F.port})})};J(Q,0)})}handleForwardedConnection($,Z,X,Q){let Y=new Bu4,G=null,J=!1,K=()=>{if(J)return;if(J=!0,Y.destroy(),G)try{G.close()}catch{}if(!$.destroyed)$.destroy()};$.pipe(Y),$.on("error",K),$.on("close",K),this.portForward.portForward(this.namespace,Z,[X],$,null,Y).then((W)=>{let H=typeof W==="function"?W():W;if(!H){K();return}if(G=H,G.on("close",K),G.on("error",(F)=>{console.warn(`[${j$}] port-forward to ${Z}:${X} dropped mid-connection: ${mq8(F)}`,JSON.stringify(Z91(F))),this.invalidateRecord(Q),K()}),J)try{G.close()}catch{}}).catch((W)=>{console.warn(`[${j$}] port-forward to ${Z}:${X} failed: ${mq8(W)}`,JSON.stringify(Z91(W))),this.invalidateRecord(Q),K()})}closeForwarder($){$.server.close((Z)=>{if(Z)console.warn(`[${j$}] port-forward close on :${$.localPort} errored: ${Z instanceof Error?Z.message:String(Z)}`)})}close(){if(this.closed)return;this.closed=!0,this.claimWatchAbort.abort();for(let $ of this.records.values())this.dropRecord($);this.records.clear()}}function qu4($){return{active:$.createUpDownCounter("studio.sandbox.active",{description:"Active sandbox count, by runner kind, owning org, and daemon impl. Cross-checks the cAdvisor-derived count from the cluster \u2014 divergence between the two indicates orphaned claims (studio deleted but K8s didn't reap) or unattributed pods.",unit:"{sandbox}"}),ensureOutcome:$.createCounter("studio.sandbox.ensure.outcome",{description:"Outcome of each ensure() call: fresh provision, resume from state-store after restart, or adopt of a cluster-side claim studio didn't know about. Cold-start ratio is the primary input for warm-pool sizing.",unit:"{call}"}),proxyDurationMs:$.createHistogram("studio.sandbox.proxy.duration_ms",{description:"Wall-clock latency of studio-mediated requests to the sandbox daemon: tool exec proxies (source=daemon) and preview iframe traffic (source=preview).",unit:"ms"}),poolPods:$.createGauge("studio.sandbox.pool.pods",{description:"Tenant warm pool depth by pool and state: ready (warmed and unbound \u2014 what a claim can actually bind instantly), bound (serving a user), pending (unbound, not yet warmed), failed (gave up after repeated bootstrap failures). Alert on sustained ready=0: a pool that is always empty is doing nothing while costing N pods.",unit:"{pod}"})}}function Z91($){let Z=[],X=$;for(let Q=0;Q<5&&X instanceof Error;Q++){let Y=X;if(Z.push({name:Y.name,message:Y.message,...Y.code!==void 0?{code:Y.code}:{},...Y.errno!==void 0?{errno:Y.errno}:{}}),Y.cause===X)break;X=Y.cause}if(X!==void 0&&!(X instanceof Error)&&X!==null){let Q=X,Y=Q.error instanceof Error?Z91(Q.error).chain:void 0;Z.push({nonError:String(X),...typeof Q.type==="string"?{type:Q.type}:{},...typeof Q.message==="string"?{message:Q.message}:{},...Q.code!==void 0?{code:Q.code}:{},...typeof Q.reason==="string"?{reason:Q.reason}:{},...Y?{error:Y}:{},...Y===void 0&&Q.error!==void 0?{rawError:String(Q.error)}:{},keys:Object.keys(Q)})}return{chain:Z}}function Mu4(){let $=new wu;return $.loadFromDefault(),$}function tq8($){return Boolean($.status?.conditions?.some((Z)=>Z.type==="Ready"&&Z.status==="True"))}function Vu4($){let Z=$.spec?.env;if(!Z)return null;for(let X of Z)if(X.name==="DAEMON_TOKEN"&&X.value)return X.value;return null}function ku4($,Z){let X=Fu4("sha256").update(`${$}:${Z}`).digest();return $91+X.readUInt32BE(0)%aq8}function a51($,Z){return new Response(JSON.stringify(Z),{status:$,headers:{"content-type":"application/json","access-control-allow-origin":"*"}})}function oq8($){let Z=$.slice(0,Cu4);return Su4.test(Z)?Z:""}function vu4($){if($===void 0)return null;let Z=$.trim();if(Z==="")return null;if(!_u4.test(Z))throw Error(`AgentSandboxProvider: envName=${JSON.stringify(Z)} is not a valid DNS-label-safe environment name (lowercase alphanumeric or '-', starts with a letter, ends alphanumeric, \u226432 chars). Studio sets this from STUDIO_ENV; check the studio chart's configMap.`);return Z}function s51($,Z={}){let X={...Z};if($){let Q=oq8($.orgId),Y=oq8($.userId);if(Q)X[IQ.orgId]=Q;if(Y)X[IQ.userId]=Y}return X}function Xv($){let Z="";for(let X of $){let Q=X.codePointAt(0)??0;Z+=Q<32||Q===127?" ":X}return Z.slice(0,xu4)}function fu4($){try{let Z=new URL($);return Z.username="",Z.password="",Z.toString()}catch{return""}}function bu4($){let Z={},X=$.tenant;if(X?.orgSlug)Z[vK.orgSlug]=Xv(X.orgSlug);if(X?.orgName)Z[vK.orgName]=Xv(X.orgName);if(X?.userEmail)Z[vK.userEmail]=Xv(X.userEmail);if(X?.userName)Z[vK.userName]=Xv(X.userName);let Q=$.repo;if(Q){if(Q.displayName)Z[vK.gitRepo]=Xv(Q.displayName);let Y=fu4(Q.cloneUrl);if(Y)Z[vK.gitRepoUrl]=Xv(Y);let G=$.branch??Q.branch;if(G)Z[vK.gitBranch]=Xv(G)}return Z}function yu4($){let Z=$.metadata?.labels;if(!Z)return null;let X=Z[IQ.orgId],Q=Z[IQ.userId];if(!X||!Q)return null;let Y=$.metadata?.annotations??{};return{orgId:X,userId:Q,orgSlug:Y[vK.orgSlug],orgName:Y[vK.orgName],userEmail:Y[vK.userEmail],userName:Y[vK.userName]}}function gu4($,Z){if($){let X=new Date($).getTime();if(Number.isFinite(X)&&X<=Z.getTime())return null}return Z.toISOString()}function hu4($,Z){if($){let X=new Date($).getTime();if(Number.isFinite(X)&&X>=Z.getTime())return null}return Z.toISOString()}function e51($){return{org_id:$?.orgId??"",user_id:$?.userId??"",runner_kind:VY}}async function uu4($,Z){if(!Z||!$.tenant)return $.orgFsConfigJson;try{return await Z($.tenant)??$.orgFsConfigJson}catch(X){return console.warn(`[${j$}] org-fs credential re-mint failed: ${X instanceof Error?X.message:String(X)}`),$.orgFsConfigJson}}function cu4($){let Z={};if($.branch)Z.branch=$.branch;if($.repo)Z.repo=$.repo;if($.workload)Z.workload=$.workload;if($.env&&Object.keys($.env).length>0)Z.env=$.env;if($.tenant)Z.tenant=$.tenant;if($.cloneOnly)Z.cloneOnly=!0;if($.purpose)Z.purpose=$.purpose;if($.orgFsConfigJson)Z.orgFsConfigJson=$.orgFsConfigJson;return Object.keys(Z).length>0?Z:null}function lu4($,Z){try{return new URL($K0($,Z)).hostname||null}catch{return null}}var VY="agent-sandbox",j$="AgentSandboxProvider",Qv="x-sandbox-preview-not-ready",Ou4="agent-sandbox-system",Lu4="studio-sandbox",wu4=300000,$N=9000,iq8=3000,r51="/app",Du4=32,Eu4,ju4=900000,zu4=60000,Pu4=1800000,fP0=3,pq8=1800000,Au4=900000,Tu4=1800000,Ru4,nq8,$91=40000,aq8=1e4,Iu4=256,IQ,vK,Su4,Cu4=63,_u4,xu4=253;var sq8=L(()=>{B4();qq8();h51();Cq8();g41();Na();Wa();bq8();o51();Eu4=new Set(["DAEMON_TOKEN","DAEMON_BOOT_ID","APP_ROOT","PROXY_PORT"]),Ru4=["cookie","host","connection","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","accept-encoding","content-length","upgrade"],nq8=["connection","keep-alive","transfer-encoding","content-encoding","content-length"];IQ={role:"studio.decocms.com/role",sandboxHandle:"studio.decocms.com/sandbox-handle",orgId:"studio.decocms.com/org-id",userId:"studio.decocms.com/user-id",env:"studio.decocms.com/env"},vK={orgSlug:"studio.decocms.com/org-slug",orgName:"studio.decocms.com/org-name",userEmail:"studio.decocms.com/user-email",userName:"studio.decocms.com/user-name",gitRepo:"studio.decocms.com/git-repo",gitRepoUrl:"studio.decocms.com/git-repo-url",gitBranch:"studio.decocms.com/git-branch"},Su4=/^([A-Za-z0-9]([-A-Za-z0-9_.]*[A-Za-z0-9])?)?$/;_u4=/^[a-z]([a-z0-9-]{0,30}[a-z0-9])?$/});var eq8={};U0(eq8,{waitForSandboxReady:()=>SP0,parseTenantPools:()=>yq8,getSandboxClaim:()=>_K,getHttpRoute:()=>Pq8,deleteSandboxClaim:()=>Xw,deleteHttpRoute:()=>kP0,createSandboxClaim:()=>Fa,applyHttpRoute:()=>VP0,SandboxTimeoutError:()=>$v,SandboxError:()=>m9,PREVIEW_NOT_READY_HEADER:()=>Qv,KubeConfig:()=>wu,K8S_CONSTANTS:()=>i5,HTTPROUTE_CONSTANTS:()=>Ua,AgentSandboxProvider:()=>X91});var Q91=L(()=>{h51();Wa();Na();sq8();o51()});var GM8={};U0(GM8,{subscribeLifecycle:()=>K91,getSandboxProviderByKind:()=>G91,getOrInitSharedRunner:()=>J91,__resetSharedLifecyclesForTesting:()=>$c4});function QM8($,Z){let X=$M8[$];if(X)return Promise.resolve(X);let Q=Y91[$];if(Q)return Q;let Y=Z().then((G)=>{return $M8[$]=G,G}).finally(()=>{delete Y91[$]});return Y91[$]=Y,Y}function iu4(){let $=process.env.STUDIO_SANDBOX_PREVIEW_URL_PATTERN;return $&&$.trim()!==""?$:void 0}function pu4(){let $=process.env.STUDIO_SANDBOX_TEMPLATE_NAME;return $&&$.trim()!==""?$:void 0}function nu4(){let $=process.env.STUDIO_ENV;return $&&$.trim()!==""?$:void 0}function tu4(){let $=process.env.STUDIO_SANDBOX_SENTINEL_TOKEN;return $&&$.trim()!==""?$:void 0}function ou4(){let $=process.env.STUDIO_SANDBOX_PREVIEW_GATEWAY_NAME?.trim(),Z=process.env.STUDIO_SANDBOX_PREVIEW_GATEWAY_NAMESPACE?.trim();if(!$&&!Z)return;if(!$||!Z)throw Error("STUDIO_SANDBOX_PREVIEW_GATEWAY_NAME and STUDIO_SANDBOX_PREVIEW_GATEWAY_NAMESPACE must both be set, or both unset. Half-configured per-claim HTTPRoute routing would silently fail to attach.");return{name:$,namespace:Z}}async function YM8($,Z){let X=new yr(Z),Q=iu4();switch($){case"agent-sandbox":{let{AgentSandboxProvider:Y,parseTenantPools:G}=await Promise.resolve().then(() => (Q91(),eq8)),J=new FG(o0().encryptionKey);return new Y({stateStore:X,previewUrlPattern:Q,sandboxTemplateName:pu4(),envName:nu4(),previewGateway:ou4(),sentinelToken:tu4(),tenantPools:G(process.env.STUDIO_SANDBOX_TENANT_POOLS),meter:R8,mintCloneUrl:async(K,W)=>{if(!K.connectionId)return null;let H=hz8(K.cloneUrl);if(!H)return null;let{cloneUrl:F}=await mL(K.connectionId,H.owner,H.name,Z,J,{bufferMs:W?.bufferMs});return F},mintOrgFsConfig:async(K)=>{if(!K.orgSlug)return null;return await HK0({boundAuth:{apiKey:{create:(H)=>P6.api.createApiKey({body:{...H,userId:K.userId}})}},storage:{orgRepoSyncs:new Mz(Z)}},{orgSlug:K.orgSlug,orgId:K.orgId,baseUrl:s9()})??null}})}case"user-desktop":throw Error("user-desktop provider cannot be instantiated without a per-run link claim \u2014 call resolveSandboxProvider, which binds the link before constructing the provider.");default:throw Error(`Unknown sandbox provider kind: ${String($)}`)}}function G91($,Z){return QM8(Z,()=>YM8(Z,$.db))}async function J91(){let $;try{$=Iz()}catch(X){return console.warn("[lifecycle] cannot resolve sandbox runner:",X instanceof Error?X.message:String(X)),null}return await QM8($,()=>YM8($,W6().db))}function K91($,Z,X){let Q=Qw.get(Z);if(Q){if(Q.terminated){if(Q.lastPhase)try{X(Q.lastPhase)}catch{}return{unsubscribe:su4}}if(Q.listeners.add(X),Q.lastPhase)try{X(Q.lastPhase)}catch{}return ZM8(Z,Q,X)}let Y=new AbortController,G={lastPhase:null,terminated:!1,listeners:new Set([X]),abort:Y};return Qw.set(Z,G),eu4($,Z,G),ZM8(Z,G,X)}function su4(){}function ZM8($,Z,X){return{unsubscribe(){if(Qw.get($)!==Z)return;if(Z.listeners.delete(X),Z.listeners.size===0)Qw.delete($),Z.abort.abort()}}}async function eu4($,Z,X){let Q=null;try{for await(let Y of $.watchClaimLifecycle(Z,X.abort.signal)){if(X.abort.signal.aborted)break;X.lastPhase=Y;let G=Y.kind==="ready"||Y.kind==="failed";if(G)X.terminated=!0;let J=Array.from(X.listeners);for(let K of J)try{K(Y)}catch{}if(G)break}}catch(Y){Q=Y}finally{if(!X.terminated&&!X.abort.signal.aborted&&X.listeners.size>0){let Y={kind:"failed",reason:"unknown",message:Q instanceof Error?Q.message:"Lifecycle watcher ended unexpectedly"};X.lastPhase=Y,X.terminated=!0;for(let G of Array.from(X.listeners))try{G(Y)}catch{}}if(Qw.get(Z)===X)Qw.delete(Z)}}function $c4(){for(let $ of Qw.values())$.abort.abort();Qw.clear()}var du4,mu4,XM8,$M8,Y91,ru4,au4,Qw;var Oa=L(()=>{nU();JX();u$();c41();Yu();tE();_8();Gu();PG();L9();du4=Symbol.for("decocms.sandbox.lifecycle.runners"),mu4=Symbol.for("decocms.sandbox.lifecycle.inflight"),XM8=globalThis,$M8=XM8[du4]??={},Y91=XM8[mu4]??={};ru4=Symbol.for("decocms.sandbox.lifecycle.shared-lifecycles"),au4=globalThis,Qw=au4[ru4]??=new Map});async function G7($,Z){let{userId:X,branch:Q,virtualMcpMetadata:Y,explicitKind:G}=Z;if(G)return La($,G);if($.sandboxPreference==="agent-sandbox")return La($,"agent-sandbox");if($.sandboxPreference==="cluster-default")return La($,Iz());let[J,...K]=Zc4(Y,X,Q);if(J)return La($,K.length===0?J:Xc4(J,K));return La($,JM8())}function Zc4($,Z,X){let Q=X9($)[Z]?.[X];if(!Q)return[];let Y=$K(Q);return Object.keys(Y)}function Xc4($,Z){let X=JM8();if(X===$||Z.includes(X))return X;return $}function JM8(){return Iz()}async function La($,Z){let X=Z==="user-desktop"?"agent-sandbox":Z;return{provider:await G91($,X),kind:X}}var ZN=L(()=>{S6();nU();AY();Oa()});var wa;var W91=L(()=>{wa={npm:{install:"npm install",run:($)=>`npm run ${$}`,runtime:"node"},pnpm:{install:"pnpm install",run:($)=>`pnpm run ${$}`,runtime:"node"},yarn:{install:"yarn install",run:($)=>`yarn run ${$}`,runtime:"node"},bun:{install:"bun install",run:($)=>`bun run ${$}`,runtime:"bun"},deno:{install:"deno install",run:($)=>`deno task ${$}`,runtime:"deno"}}});function XN($,Z){return Z?`thread:${$}/${Z}`:`thread:${$}`}function QN($){return`sandbox/thread-${$.replace(/^thread:/,"").replace(/\//g,"-")}`}function xK($){if(!$||!$.startsWith("thread:"))return null;return $.slice(7).split("/")[0]||null}async function Yv($,Z,X){return F91(await H91($,Z),X)}async function H91($,Z){let X=xK(Z);if(!X)return null;return await $.storage.threads.get(X).catch(()=>null)}function F91($,Z){return $?.created_by??Z}async function Gv($,Z){if(!Z)return null;let X=await $.storage.threads.get(Z).catch(()=>null);if(!X)return null;return X.metadata??{}}async function KM8($,Z){let Q=(await Gv($,Z))?.headRef;return typeof Q==="string"&&Q.length>0?Q:null}async function WM8($,Z,X){let Q=await Gv($,Z);if(!Q)return;if(Q.headRef===X)return;await $.storage.threads.update(Z,{metadata:{...Q,headRef:X}}).catch((Y)=>console.warn("[thread-repo] setThreadHeadRef failed",Y))}function Qc4($,Z){let X=FJ0(Z,$.owner,$.name);if(!X||X.id===$.connectionId)return null;let Q=c5(X);return{...$,connectionId:X.id,...Q?.installationId?{installationId:Q.installationId}:{}}}async function Yw($,Z){let X=await Gv($,Z),Q=X?.githubRepo??null;if(!Z||!X||!Q?.connectionId)return Q;try{let Y=$.storage.threads.getOrganizationId();if(!Y)return Q;if(await $.storage.connections.findById(Q.connectionId,Y))return Q;let{items:G}=await $.storage.connections.list(Y),J=Qc4(Q,G);if(!J)return Q;return await $.storage.threads.update(Z,{metadata:{...X,githubRepo:J}}),console.warn("[thread-repo] re-pointed thread at a live repo connection",{threadId:Z,from:Q.connectionId,to:J.connectionId}),J}catch(Y){return console.warn("[thread-repo] repoint check failed",Y),Q}}function U91($){if($.pinnedRef)return $.pinnedRef;if($.runBranch&&$.runBranch===XN($.threadId))return $.runBranch;if($.threadRepo)return XN($.threadId,$.threadRepo.connectionId);if(!$.agentRepo)return"ephemeral";return $.runBranch??`thread:${$.threadId}`}async function N91($,Z){let Q=(await Gv($,Z))?.pinnedRef;return typeof Q==="string"&&Q.length>0?Q:null}async function bP0($,Z){let[X,Q]=await Promise.all([Yw($,Z.threadId),N91($,Z.threadId)]);return U91({...Z,threadRepo:X,pinnedRef:Q})}async function HM8($,Z,X,Q,Y,G){let J=await Gv($,Z);if(!J)return;let K=br(X9(J),X,Q,Y,G);await $.storage.threads.update(Z,{metadata:{...J,sandboxMap:K}}).catch((W)=>console.warn("[thread-repo] setThreadSandboxMapEntry failed",W))}async function yP0($,Z){return X9(await Gv($,Z))}async function FM8($,Z,X,Q,Y){let G=await Gv($,Z);if(!G)return;let J=u41(X9(G),X,Q,Y);if(!J)return;await $.storage.threads.update(Z,{metadata:{...G,sandboxMap:J}}).catch((K)=>console.warn("[thread-repo] removeThreadSandboxMapEntry failed",K))}var fK=L(()=>{HY();AY()});function Au($){if(!$)return null;let Z=$.runtime;if(!Z||typeof Z!=="object")return null;let X=Z.env;if(!Array.isArray(X))return null;let Q=[];for(let Y of X){if(!Y||typeof Y!=="object")continue;let G=Y;if(typeof G.key!=="string"||!qX0.test(G.key))continue;if(G.kind==="literal"&&typeof G.value==="string"){Q.push({key:G.key,kind:"literal",value:G.value});continue}if(G.kind==="secret"&&typeof G.secretId==="string"&&G.secretId.length>0)Q.push({key:G.key,kind:"secret",secretId:G.secretId})}return Q.length===0?null:Q}function UM8($){if(!$)return null;let Z=$.runtime;if(!Z||typeof Z!=="object")return null;let X=Z.submoduleCredentials;if(!Array.isArray(X))return null;let Q=[];for(let Y of X){if(!Y||typeof Y!=="object")continue;let G=Y;if(typeof G.host==="string"&&G.host.length>0&&typeof G.secretId==="string"&&G.secretId.length>0)Q.push({host:G.host,secretId:G.secretId})}return Q}async function NM8($,Z){G0(Z);let X=X0(Z);await Z.access.check();let Q=w1(Z);if(!Q)throw Error("User ID required");let Y=await Z.storage.virtualMcps.findById($.virtualMcpId);if(!Y||Y.organization_id!==X.id)throw Error("Virtual MCP not found");let G=Y.metadata??{},J=X9(G),K=await Yv(Z,$.branch,Q),W=MH(J,K,$.branch,$.sandboxProviderKind);return{virtualMcp:Y,metadata:G,userId:Q,sandboxUserId:K,entry:W,organization:X}}function Yc4($){if($===null||!/^\d+$/.test($))return null;let Z=Number($);return Z>=1&&Z<=65535?$:null}function BM8($){let Z=$.runtime??null,Q=Z?.selected??null,Y=Yc4(Z?.port??null),G=Z?.path??null;if(!Q||!(Q in wa))return{packageManager:null,runtime:null,port:Y,packageManagerPath:G,runtimeBinPath:null};let J=wa[Q].runtime;return{packageManager:Q,runtime:J,port:Y,packageManagerPath:G,runtimeBinPath:J==="deno"?"/opt/deno/bin":J==="bun"?"/opt/bun/bin":null}}var Da=L(()=>{S6();W91();AY();fK()});import{sql as Gc4}from"kysely";function OM8($){return $ instanceof Date?$.toISOString():String($)}class B91{db;vault;constructor($,Z){this.db=$;this.vault=Z}rowToInfo($){return{id:$.id,organizationId:$.organization_id,scope:$.scope,userId:$.user_id,name:$.name,description:$.description,createdBy:$.created_by,createdAt:OM8($.created_at),updatedBy:$.updated_by,updatedAt:OM8($.updated_at)}}assertVisible($,Z){if($.scope==="user"&&$.user_id!==Z)throw new Gw($.id)}async create($){let Z=J4("sec"),X=await this.vault.encrypt($.value),Q=new Date,Y=await this.db.insertInto("secrets").values({id:Z,organization_id:$.organizationId,scope:$.scope.kind,user_id:$.scope.kind==="user"?$.scope.userId:null,name:$.name,encrypted_value:X,description:$.description??null,created_by:$.createdBy,created_at:Q,updated_by:$.createdBy,updated_at:Q}).returning(gP0).executeTakeFirstOrThrow();return this.rowToInfo(Y)}async update($){let Z=await this.db.selectFrom("secrets").where("id","=",$.id).where("organization_id","=",$.organizationId).select(["id","scope","user_id"]).executeTakeFirst();if(!Z)throw new m3($.id);this.assertVisible(Z,$.callerUserId);let X={updated_by:$.updatedBy,updated_at:new Date};if($.value!==void 0)X.encrypted_value=await this.vault.encrypt($.value);if($.description!==void 0)X.description=$.description;let Q=await this.db.updateTable("secrets").set(X).where("id","=",$.id).where("organization_id","=",$.organizationId).returning(gP0).executeTakeFirstOrThrow();return this.rowToInfo(Q)}async delete($,Z,X){let Q=await this.db.selectFrom("secrets").where("id","=",$).where("organization_id","=",Z).select(["id","scope","user_id"]).executeTakeFirst();if(!Q)throw new m3($);this.assertVisible(Q,X),await this.db.deleteFrom("secrets").where("id","=",$).where("organization_id","=",Z).execute()}async list($){let Z=this.db.selectFrom("secrets").where("organization_id","=",$.organizationId).select(gP0);if($.scope?.kind==="user")Z=Z.where("scope","=","user").where("user_id","=",$.scope.userId);else if($.scope?.kind==="organization")Z=Z.where("scope","=","organization");else Z=Z.where((Q)=>Q.or([Q("scope","=","organization"),Q.and([Q("scope","=","user"),Q("user_id","=",$.callerUserId)])]));return(await Z.orderBy("created_at","desc").execute()).map((Q)=>this.rowToInfo(Q))}async findById($,Z,X){let Q=await this.db.selectFrom("secrets").where("id","=",$).where("organization_id","=",Z).select(gP0).executeTakeFirst();if(!Q)throw new m3($);return this.assertVisible(Q,X),this.rowToInfo(Q)}async resolveById($,Z,X){let Q=await this.db.selectFrom("secrets").where("id","=",$).where("organization_id","=",Z).selectAll().executeTakeFirst();if(!Q)throw new m3($);this.assertVisible(Q,X);let Y=await this.vault.decrypt(Q.encrypted_value);return{info:this.rowToInfo(Q),value:Y}}async resolveByName($){let Z=this.db.selectFrom("secrets").where("organization_id","=",$.organizationId).where("scope","=",$.scope.kind).where(Gc4`lower(name) = lower(${$.name})`).selectAll();if($.scope.kind==="user")Z=Z.where("user_id","=",$.scope.userId);let X=await Z.executeTakeFirst();if(!X)throw new m3(`${$.scope.kind}:${$.name}`);let Q=await this.vault.decrypt(X.encrypted_value);return{info:this.rowToInfo(X),value:Q}}}var gP0,m3,Gw;var Ea=L(()=>{UQ();gP0=["id","organization_id","scope","user_id","name","description","created_by","created_at","updated_by","updated_at"];m3=class m3 extends Error{constructor($){super(`Secret ${$} not found`);this.name="SecretNotFoundError"}};Gw=class Gw extends Error{constructor($){super(`Access denied for secret ${$}`);this.name="SecretAccessDeniedError"}}});async function Jw($,Z){let X=$.body?.getReader();if(!X)return $.text();let Q=new TextDecoder,Y="",G=0;for(;;){let{done:J,value:K}=await X.read();if(J)break;if(G+=K.byteLength,G>Z)throw await X.cancel().catch(()=>{}),new LM8(`Upstream response exceeded ${Z} bytes`);Y+=Q.decode(K,{stream:!0})}return Y+=Q.decode(),Y}var LM8;var ja=L(()=>{LM8=class LM8 extends Error{}});async function hP0({ctx:$,runner:Z,handle:X,orgId:Q,userId:Y,entries:G}){if(!G||G.length===0)return;let J={};for(let W of G){if(W.kind==="literal"){J[W.key]=W.value;continue}try{let{value:H}=await $.storage.secrets.resolveById(W.secretId,Q,Y);J[W.key]=H}catch(H){if(H instanceof m3||H instanceof Gw){console.warn(`[SANDBOX_START] skipping env ${W.key}: ${H.message}. Re-link or recreate the secret to restore.`);continue}throw H}}if(Object.keys(J).length===0)return;let K=await Z.proxyDaemonRequest(X,"/_sandbox/config",{method:"PUT",headers:new Headers({"content-type":"application/json"}),body:JSON.stringify({env:J})});if(!K.ok){let W=await Jw(K,Jc4).catch(()=>K.statusText);console.warn(`[SANDBOX_START] daemon rejected env patch (${K.status}): ${W}`)}}var Jc4=10485760;var O91=L(()=>{Ea();ja()});async function wM8({ctx:$,orgId:Z,userId:X,entries:Q}){if(!Q||Q.length===0)return[];let Y=[];for(let G of Q)try{let{value:J}=await $.storage.secrets.resolveById(G.secretId,Z,X);Y.push({host:G.host,token:J})}catch(J){if(J instanceof m3||J instanceof Gw){console.warn(`[SANDBOX_START] skipping submodule credential for ${G.host}: ${J.message}. Re-link or recreate the secret to restore.`);continue}throw J}return Y}var DM8=L(()=>{Ea()});async function zM8($,Z,X,Q,Y){let G=await MG({connectionId:$,tokenStorage:new X5(Q,Y)});if(!G.accessToken)return null;return AM8(Z,X,G.accessToken)}function PM8($,Z){return AM8($,Z,null)}async function AM8($,Z,X){let Q=new Map,Y=new Set(EM8.map((W)=>W.path));for(let W of Object.values(jM8))for(let H of W??[])Y.add(H);await Promise.all(Array.from(Y).map(async(W)=>{Q.set(W,await Wc4($,Z,W,X))}));let G=EM8.find(({path:W})=>Q.get(W)!==null);if(!G)return null;let J=jM8[G.pm]??[],K=null;for(let W of J)if(K=Hc4(Q.get(W)??null),K)break;return{packageManager:G.pm,devPort:K}}async function Wc4($,Z,X,Q){let Y=`https://api.github.com/repos/${$}/${Z}/contents/${encodeURIComponent(X)}`;try{let G={Accept:"application/vnd.github+json","User-Agent":"studio-runtime-detect"};if(Q)G.Authorization=`token ${Q}`;let J=await fetch(Y,{headers:G,signal:AbortSignal.timeout(5000)});if(!J.ok)return null;let K=await J.json();if(!K.content||K.encoding!=="base64")return null;return Buffer.from(K.content,"base64").toString("utf8")}catch{return null}}function Hc4($){if(!$)return null;try{let Z=JSON.parse($),X=Z.tasks??Z.scripts??{},Y=(X.dev??X.start??"").match(Kc4)?.[1]??null;if(!Y)return null;let G=Number(Y);return G>=1&&G<=65535?Y:null}catch{return null}}var EM8,jM8,Kc4;var TM8=L(()=>{c3();f3();EM8=[{path:"deno.json",pm:"deno"},{path:"deno.jsonc",pm:"deno"},{path:"bun.lock",pm:"bun"},{path:"bunfig.toml",pm:"bun"},{path:"pnpm-lock.yaml",pm:"pnpm"},{path:"yarn.lock",pm:"yarn"},{path:"package-lock.json",pm:"npm"},{path:"package.json",pm:"bun"}],jM8={deno:["deno.json","deno.jsonc"],bun:["package.json"],pnpm:["package.json"],yarn:["package.json"],npm:["package.json"]},Kc4=/(?:--port|PORT=|:)(\d{4,5})/});function Fc4($){return($??"").normalize("NFKD").replace(/[\u0300-\u036F]/g,"").toLowerCase().replace(/[^a-z0-9]+/g,"-").replace(/^-+|-+$/g,"")||"user"}function uP0($){return $?.name||$?.email?.split("@")[0]||void 0}function cP0($){let Z=Fc4($),X=Date.now().toString(36).split("").reverse().join("");return`${Z}-${X}`}async function za($,Z,X){try{await $.storage.threads.stampRuntimeIfAbsent(Z,X)}catch(Q){console.warn(`[stampRuntimeIfAbsent] ${Z}: ${Q instanceof Error?Q.message:String(Q)}`)}}function RM8($){let Z=$?.trim();if(!Z)return null;try{let X=new URL(Z);if(X.protocol!=="http:"&&X.protocol!=="https:")return null;return X.href}catch{return null}}function lP0($){return RM8($?.previewServerUrl)??RM8($?.productionUrl)}function Jv($){return $==="cms"||$==="sandbox"?$:null}function Uc4($){return!!lP0($)&&$?.fastPreview===!0}function dP0($){return Uc4($)?"cms":"sandbox"}var L91;var Tu=L(()=>{L91=["cms","sandbox"]});function IM8($){let{current:Z,detached:X,base:Q}=$.status??{};if(typeof Z!=="string"||Z.length===0)return null;if(X===!0)return null;if(Z===$.requestedRef)return null;if(Nc4.has(Z))return null;if(typeof Q==="string"&&Q.length>0&&Z===Q)return null;return Z}function mP0($){if(!$.branch.startsWith("thread:"))return $.branch;if($.sticky&&$.recordedHeadRef)return $.recordedHeadRef;return $.derivedRef}var Nc4;var iP0=L(()=>{Nc4=new Set(["main","master","trunk","develop","HEAD"])});async function qM8($,Z){if(!$)return{hosts:[],allowSameHostDev:!1};let X;try{X=await $.presignedGetUrl("link-dispatch/_allowlist_probe",60,{requireFetchable:!0})}catch{return{hosts:[],allowSameHostDev:!1}}let Q;try{Q=new URL(X)}catch{return{hosts:[],allowSameHostDev:!1}}if(Q.protocol!=="https:"&&Q.protocol!=="http:")return{hosts:[],allowSameHostDev:!1};let Y=Q.hostname,G=Bc4.has(Y);return{hosts:[Y],allowSameHostDev:G&&!Z.isProduction}}var Bc4;var MM8=L(()=>{Bc4=new Set(["127.0.0.1","localhost","::1","[::1]","0.0.0.0"])});import{z as bK}from"zod";async function Ru($,Z){G0(Z);let X=X0(Z),Q=w1(Z);if(!Q)throw Error("User ID required");let Y=await Z.storage.virtualMcps.findById($.virtualMcpId);if(!Y||Y.organization_id!==X.id)throw Error("Virtual MCP not found");let G=Y.metadata??{},J=await Yv(Z,$.branch,Q),K=MH(X9(G),J,$.branch,$.sandboxProviderKind),W=$.sandboxProviderKind,{provider:H}=await G7(Z,{userId:J,branch:$.branch,virtualMcpMetadata:G,explicitKind:W});if(K){if(await H.alive(K.sandboxHandle).catch(()=>!0))return K;await lL(Z.storage.virtualMcps,$.virtualMcpId,Q,J,$.branch,W).catch((w)=>{console.warn("[ensureSandbox] failed to reap stale entry",w)})}let F=xK($.branch)??Z.metadata?.threadId;if(F)za(Z,F,"sandbox");let N=await Yw(Z,F)??G.githubRepo??null,{entry:B}=await kM8({ctx:Z,userId:Q,sandboxUserId:J,orgId:X.id,virtualMcpId:$.virtualMcpId,branch:$.branch,metadata:G,githubRepo:N,existing:null,providerKind:W,runner:H,...$.purpose?{purpose:$.purpose}:{}});return B}async function kM8($){let{ctx:Z,userId:X,sandboxUserId:Q,orgId:Y,virtualMcpId:G,branch:J,metadata:K,existing:W,runner:H,purpose:F}=$,U=F==="harness-run",N=$.githubRepo?await Lc4({ctx:Z,orgId:Y,virtualMcpId:G,userId:X,githubRepo:$.githubRepo}):null,{runtime:B,packageManager:O,port:w,packageManagerPath:D}=BM8(K),E;if(N){if(N.connectionId)await dL({ctx:Z,connectionId:N.connectionId,organizationId:Y,forceRefresh:!0,onLegacyMintError:(t0)=>{console.error("[provisionSandbox] repo-scoped legacy token mint failed",{connectionId:N.connectionId,error:t0.message})}});let{cloneUrl:P0,gitUserName:$0,gitUserEmail:e}=N.connectionId?await mL(N.connectionId,N.owner,N.name,Z.db,Z.vault):gz8(N.owner,N.name);if(!O){let t0=N.connectionId?await zM8(N.connectionId,N.owner,N.name,Z.db,Z.vault):await PM8(N.owner,N.name);if(t0)O=t0.packageManager,B=wa[t0.packageManager].runtime,w=t0.devPort??w,await wc4(Z,G,X,t0.packageManager,t0.devPort)}let A0=o0().sandboxStickyHeadRefEnabled,Q0=mP0({branch:J,derivedRef:QN(J),recordedHeadRef:A0?await KM8(Z,xK(J)):null,sticky:A0}),M0=await wM8({ctx:Z,orgId:Y,userId:X,entries:UM8(K)});E={cloneUrl:P0,...N.connectionId?{connectionId:N.connectionId}:{},userName:$0,userEmail:e,branch:Q0,displayName:`${N.owner}/${N.name}`,submoduleCredentials:M0}}let j=B&&O&&!U?{runtime:B,packageManager:O,...w!==null?{devPort:Number(w)}:{},...D?{packageManagerPath:D}:{}}:void 0,z=xr({orgId:Y,virtualMcpId:G,branch:J}),A=H.kind==="user-desktop"?await qM8(Z.objectStorage,{isProduction:o0().nodeEnv==="production"}):null,P=(H.kind==="user-desktop"||H.kind==="agent-sandbox")&&!o0().orgFsMountsDisabled,I;if(P){let P0=Z.organization?.slug??(await Z.db.selectFrom("organization").select(["slug"]).where("id","=",Y).executeTakeFirst())?.slug;if(P0)I=await HK0(Z,{orgSlug:P0,orgId:Y,baseUrl:s9()})}await Ec4(H);let q=await H.ensure({userId:Q,projectRef:z},{branch:J,repo:E,workload:j,cloneOnly:U,...F?{purpose:F}:{},tenant:{orgId:Y,userId:Q,...Z.organization?.slug?{orgSlug:Z.organization.slug}:{},...Z.organization?.name?{orgName:Z.organization.name}:{},...Z.auth.user?.email?{userEmail:Z.auth.user.email}:{},...Z.auth.user?.name?{userName:Z.auth.user.name}:{}},...A?{offloadAllowedHosts:A.hosts,offloadAllowSameHostDev:A.allowSameHostDev}:{},...I?{orgFsConfigJson:I}:{}}),M=Au(K);await hP0({ctx:Z,runner:H,handle:q.handle,orgId:Y,userId:X,entries:M});let d=!!W&&W.sandboxHandle===q.handle&&W?.createdAt?W.createdAt:Date.now(),f=K.runtime?.selected??null,y=K.runtime?.port??null,o=K.runtime?.path??null,b={sandboxHandle:q.handle,previewUrl:q.previewUrl,sandboxApiUrl:q.previewUrl,sandboxProviderKind:H.kind,createdAt:d,startedWith:{packageManager:f,port:y,path:o}};await Mz8(Z.storage.virtualMcps,G,X,Q,J,$.providerKind,b);let r=xK(J)??Z.metadata?.threadId;if(r)await HM8(Z,r,Q,J,$.providerKind,b);let B0=!W||W.sandboxHandle!==q.handle;return{entry:b,isNewVm:B0}}async function Lc4($){let{ctx:Z,orgId:X,virtualMcpId:Q,userId:Y,githubRepo:G}=$;if(!G.connectionId)return G;if(await Z.storage.connections.findById(G.connectionId,X))return G;let{items:K}=await Z.storage.connections.list(X),W=FJ0(K,G.owner,G.name);if(!W)return console.warn("[provisionSandbox] recorded repo connection no longer exists and no live connection covers the repo",{virtualMcpId:Q,connectionId:G.connectionId}),G;console.warn("[provisionSandbox] healed dangling repo connection",{virtualMcpId:Q,staleConnectionId:G.connectionId,connectionId:W.id});try{let F=(await Z.storage.virtualMcps.findById(Q))?.metadata??{},U=F.githubRepo;if(U?.connectionId===G.connectionId){let N=c5(W);await Z.storage.virtualMcps.update(Q,Y,{metadata:{...F,githubRepo:{...U,connectionId:W.id,...N?{installationId:N.installationId}:{}}}})}}catch(H){console.warn("[provisionSandbox] failed to persist healed repo connection",{virtualMcpId:Q,error:H.message})}return{...G,connectionId:W.id}}async function wc4($,Z,X,Q,Y){let G=await $.storage.virtualMcps.findById(Z);if(!G)return;let J=G.metadata??{};await $.storage.virtualMcps.update(Z,X,{metadata:{...J,runtime:{selected:Q,port:Y}}})}async function Ec4($){if(!$.hasSchedulableCapacity)return;let Z=Date.now()+VM8,X=!1;while(!await $.hasSchedulableCapacity()){if(Date.now()>=Z)throw Error(`sandbox provisioning failed: the cluster has had no room to schedule another sandbox for ${Math.round(VM8/1000)}s`);if(!X)X=!0,console.warn("[ensureSandbox] waiting for cluster capacity \u2014 a sandbox pod cannot be scheduled right now");await N8(Dc4)}}var Oc4,w91,VM8=150000,Dc4=5000;var Pa=L(()=>{nU();B4();m0();Da();O91();DM8();AY();HY();Yu();TM8();W91();ZN();Tu();fK();iP0();MM8();_8();L9();Gu();AY();Oc4=bK.enum(["agent-sandbox","user-desktop","cluster"]),w91=m({name:"SANDBOX_START",description:"Start a sandbox with the connected GitHub repo and dev server.",annotations:{title:"Start VM Preview",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!1,openWorldHint:!0},_meta:{ui:{visibility:"app"}},inputSchema:bK.object({virtualMcpId:bK.string().describe("Virtual MCP ID"),branch:bK.string().min(1).optional().describe("Git branch to check out. Pass the thread's branch whenever the caller has one: when omitted the handler mints a fresh `<user-slug>-<timestamp>` name, which becomes a SEPARATE sandbox from the one the thread's own branch resolves to. The resolved branch is returned in the response so callers can persist it."),sandboxProviderKind:Oc4.optional().describe("Explicit runtime choice. Hosted provider is `agent-sandbox`; legacy `cluster` input is accepted only for compatibility and normalized to `agent-sandbox`. When omitted, defaults to `user-desktop` if the acting user's link daemon is online, else the env kind."),threadId:bK.string().optional().describe("The session asking for a sandbox. A thread stamped `cms` is refused \u2014 that session reads and writes over the decofile API and a pod would be invisible to it. Optional: an unstamped (legacy) thread is always allowed, and so is a caller with no thread.")}),outputSchema:bK.object({previewUrl:bK.string().nullable(),sandboxHandle:bK.string(),branch:bK.string(),isNewVm:bK.boolean(),sandboxProviderKind:bK.enum(["agent-sandbox","user-desktop"])}),handler:async($,Z)=>{G0(Z);let X=X0(Z);await Z.access.check();let Q=$.branch??cP0(uP0(Z.auth.user)),Y=xK(Q)??$.threadId??Z.metadata?.threadId;if(Y){let E=await Z.storage.threads.get(Y).catch(()=>null);if(Jv(E?.metadata?.runtime)==="cms")throw Error("This chat is a CMS session and does not use a sandbox. Start a coding session to get one.")}let G=w1(Z);if(!G)throw Error("User ID required");let J=await Yv(Z,Q,G),K=await Z.storage.virtualMcps.findById($.virtualMcpId);if(!K||K.organization_id!==X.id)throw Error("Virtual MCP not found");let W=K.metadata??{},H=$.sandboxProviderKind?Tz($.sandboxProviderKind):void 0,{provider:F,kind:U}=await G7(Z,{userId:J,branch:Q,virtualMcpMetadata:W,explicitKind:H}),N=MH(X9(W),J,Q,U),O=await Yw(Z,xK(Q)??Z.metadata?.threadId)??W.githubRepo??null,{entry:w,isNewVm:D}=await kM8({ctx:Z,userId:G,sandboxUserId:J,orgId:X.id,virtualMcpId:$.virtualMcpId,branch:Q,metadata:W,githubRepo:O,existing:N,providerKind:U,runner:F});if(Y)za(Z,Y,"sandbox");return{...w,branch:Q,isNewVm:D,sandboxProviderKind:U}}})});function jc4($){let{publicUrl:Z,agentId:X,organization:Q,target:Y,threadId:G}=$;if(Y==="agent-tools")return`${Z}/mcp/virtual-mcp/${X}`;if(!Q.slug)throw new CM8(Q.id);if(Y==="task-run"){if(!G)throw Error("a task-run MCP endpoint is scoped to a run: threadId is required");return`${Z}/api/${Q.slug}/mcp/task-run/${encodeURIComponent(G)}`}return`${Z}/api/${Q.slug}/mcp/self`}async function pP0($,Z,X,Q,Y="agent-tools",G,J={"*":["*"]}){let K=jc4({publicUrl:s9(),agentId:Z,organization:X,target:Y,...G?{threadId:G}:{}}),W=await $.boundAuth.apiKey.create({name:Q,permissions:J,expiresIn:SM8,metadata:{organization:{id:X.id,slug:X.slug,name:X.name}}});return{url:K,headers:{Authorization:`Bearer ${W.key}`,"x-org-id":X.id},expiresAt:Date.now()+SM8*1000}}function _M8($){let{publicUrl:Z,organizationSlug:X,headers:Q,connections:Y}=$,G=new Set;return Y.map((J)=>{let K=zc4(J.slug??J.title??"")||"mcp",W=K;for(let H=2;G.has(W);H++)W=`${K}-${H}`;return G.add(W),{name:W,url:`${Z}/api/${X}/mcp/${encodeURIComponent(J.id)}`,headers:Q}})}function zc4($){return $.toLowerCase().replace(/[^a-z0-9]+/g,"-").replace(/^-+|-+$/g,"")}function vM8($){return{self:[...$.toolNames],...$.grants}}var SM8=3600,CM8;var D91=L(()=>{L9();CM8=class CM8 extends Error{constructor($){super(`cannot mint a management MCP endpoint for organization "${$}": the org-scoped path /api/<slug>/mcp/self needs the org slug, which was not loaded.`);this.name="MissingOrganizationSlugError"}}});async function Pc4($,Z,X,Q){try{let Y=$.organization;if(!Y)return;let G=await pP0($,Q.virtualMcpId,Y,"tool-scripting"),J=await Z.proxyDaemonRequest(X,"/_sandbox/tools/sync",{method:"POST",headers:new Headers({"content-type":"application/json"}),body:JSON.stringify(G)});if(!J.ok)console.warn("[cluster-sandbox-fs] tools/sync failed",J.status,await J.text().catch(()=>""))}catch(Y){console.warn("[cluster-sandbox-fs] tools/sync failed",Y)}}async function Iu($,Z){let{provider:X,kind:Q}=await G7($,{userId:Z.userId,branch:Z.branch,virtualMcpMetadata:null}),Y=null,G=()=>{if(!Y){if(Y=Ru({virtualMcpId:Z.virtualMcpId,branch:Z.branch,sandboxProviderKind:Q},$).then((W)=>W.sandboxHandle),Y.catch(()=>{Y=null}),Z.syncTools)Y.then((W)=>Pc4($,X,W,{virtualMcpId:Z.virtualMcpId,providerKind:Q})).catch(()=>{})}return Y},J=Z.branch==="ephemeral"||Q==="user-desktop";return h41(X,{ensureHandle:G,invalidateHandle:async(W)=>{let H=Y;if(Y=null,!J&&!W?.force)return;try{await lL($.storage.virtualMcps,Z.virtualMcpId,Z.userId,Z.userId,Z.branch,Q)}catch(F){console.warn("[cluster-sandbox-fs] failed to reap vmMap entry",F)}if(H&&typeof X.forgetHandle==="function")try{let F=await H;await X.forgetHandle(F)}catch(F){console.warn("[cluster-sandbox-fs] forgetHandle failed",F)}},canAutoRestart:J,threadId:Z.threadId})}async function xM8($,Z){try{let X=await Iu($,Z),{stdout:Q}=await X.onBash("test -d .deco && echo __DECO_SITE__");return Q.includes("__DECO_SITE__")}catch(X){return console.warn("[cluster-sandbox-fs] .deco probe failed; assuming deco site",X),!0}}var nP0=L(()=>{nU();D91();ZN();Pa();AY()});import{z as fM8}from"zod";function qu($){let Z=[];for(let X of $){if(X.status!=="active")continue;let Q=c5(X);if(!Q)continue;Z.push({connectionId:X.id,owner:Q.owner,repo:Q.repo,installationId:Q.installationId})}return Z}async function Tc4($,Z){let{items:X}=await $.storage.connections.list(Z,{slug:"mcp-github"});return qu(X)}function Rc4($){let Z=$.split(`
+`))>=0){let W=Q.slice(0,K).trim();if(Q=Q.slice(K+1),!W)continue;yield JSON.parse(W)}}let Y=Q.trim();if(Y)yield JSON.parse(Y)}finally{Z.releaseLock()}}var Nq8,IP0,Eq8="gateway.networking.k8s.io",jq8="v1",zq8="httproutes",th4,Ua,Aq8="mesh-sandbox-runner";var Na=L(()=>{B4();Wa();Nq8=class Nq8 extends Error{status;body;constructor($,Z,X){super(X);this.status=$;this.body=Z;this.name="KubeHttpError"}};IP0=`/apis/${i5.CLAIM_API_GROUP}/${i5.CLAIM_API_VERSION}/namespaces`;th4=`/apis/${Eq8}/${jq8}/namespaces`;Ua={API_GROUP:Eq8,API_VERSION:jq8,PLURAL:zq8}});function rh4($){return($.items??[]).some((Z)=>{if(Z.status?.phase!=="Pending")return!1;return(Z.status?.conditions??[]).some((X)=>X.type==="PodScheduled"&&X.status==="False"&&X.reason==="Unschedulable")})}function Iq8($,Z){let X=0,Q=!0,Y=null,G=async()=>{try{let J=await CG($,{method:"GET",path:`/api/v1/namespaces/${encodeURIComponent(Z)}/pods?fieldSelector=status.phase%3DPending`});if(!J.ok)return Rq8;let K=await J.json();return!rh4(K)}catch{return Rq8}};return async()=>{if(Date.now()-X<oh4)return Q;return Y??=G().finally(()=>{Y=null}),Q=await Y,X=Date.now(),Q}}var oh4=3000,Rq8=!0;var qq8=L(()=>{Na()});var CP0=L(()=>{B4();b41()});async function vP0($){try{let Z=await fetch(`${$}/health`,{signal:AbortSignal.timeout(ah4)});if(!Z.ok)return null;let X=await Z.json();if(typeof X==="object"&&X!==null&&typeof X.bootId==="string"&&typeof X.ready==="boolean"&&X.setup&&typeof X.setup.running==="boolean"&&typeof X.setup.done==="boolean")return X;return null}catch{return null}}async function p51($){for(let Z=0;Z<Mq8;Z++){if(await vP0($)!==null)return;let X=(Math.random()*2-1)*sh4;await N8(Vq8+X)}throw Error(`sandbox daemon at ${$} did not respond on /health within ${Mq8*Vq8/1000}s`)}async function Zv($,Z,X,Q,Y){return eh4($,Z,"POST",X,Q,Y)}async function eh4($,Z,X,Q,Y,G){let J={...Q};if(Y&&Y.rotateToken!==void 0)J.auth=Y;let K=await fetch(`${$}/_sandbox/config`,{method:X,headers:{"Content-Type":"application/json",Authorization:`Bearer ${Z}`},body:JSON.stringify(J),signal:AbortSignal.timeout(G?.timeoutMs??i51)}),W=await K.text();if(!K.ok)throw new _P0(K.status,W);return JSON.parse(W)}async function kq8($,Z,X){let Q=await fetch(`${$}/_sandbox/setup/${X}`,{method:"POST",headers:{Authorization:`Bearer ${Z}`},signal:AbortSignal.timeout(i51)});if(!Q.ok)throw Error(`sandbox daemon /_sandbox/setup/${X} returned ${Q.status}: ${await Q.text()}`)}async function Sq8($,Z,X){let Q=await fetch(`${$}/_sandbox/orgfs-config`,{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${Z}`},body:X,signal:AbortSignal.timeout(i51)}),Y=await Q.text();if(!Q.ok)throw Error(`sandbox daemon /_sandbox/orgfs-config returned ${Q.status}: ${Y}`);return JSON.parse(Y)}async function Ba($,Z,X,Q){let Y=new Headers(Q.headers);for(let K of $u4)Y.delete(K);Y.set("authorization",`Bearer ${Z}`);let G=Q.method!=="GET"&&Q.method!=="HEAD",J=`${$}${X.startsWith("/")?X:`/${X}`}`;return fetch(J,{method:Q.method,headers:Y,body:G?Q.body:void 0,redirect:"manual",signal:Q.signal,duplex:G?"half":void 0})}var _P0,ah4=500,i51=30000,Mq8=25,Vq8=200,sh4=50,$u4;var Cq8=L(()=>{CP0();_P0=class _P0 extends Error{status;constructor($,Z){super(`sandbox daemon /_sandbox/config returned ${$}: ${Z}`);this.status=$;this.name="ConfigRequestError"}};$u4=["cookie","host","connection","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","accept-encoding","content-length"]});async function*xq8($){let Z=$.now??(()=>Date.now()),X=Z(),Q=$.schedulingTimeoutMs??Xu4,Y={pod:{},sandbox:{},events:{hasPulling:!1,hasPulled:!1},startedAt:X},G=[],J=null,K=!1,W=(j)=>{if(K)return;if(J){let z=J;J=null,z(j)}else G.push(j)},H=()=>{if(G.length>0)return Promise.resolve(G.shift());if(K)return Promise.resolve(null);return new Promise((j)=>{J=j})},F=()=>{if(K)return;if(K=!0,J){let j=J;J=null,j(null)}},U=new AbortController,N=()=>{U.abort(),F()};if($.signal)if($.signal.aborted)U.abort(),F();else $.signal.addEventListener("abort",N,{once:!0});let B=Math.max(0,Q-(Z()-X)),O=setTimeout(()=>W("tick"),B+100),w,D=new Promise((j)=>{w=j}),E=Promise.allSettled([Qu4($.kc,$.namespace,$.claimName,U.signal,Y,W,Z,w),Gu4($.kc,$.namespace,$.claimName,U.signal,Y,W),Ju4($.kc,$.namespace,$.claimName,D,U.signal,Y,W,Z)]);try{let j=null,z=-1,A=_q8(Y,Q,Z);if(j=t51(A),!n51(A))z=vq8(A);if(yield A,n51(A))return;while(!K){if(await H()===null)break;let I=_q8(Y,Q,Z);if(n51(I)){let S=t51(I);if(S!==j)j=S,yield I;return}let q=vq8(I);if(q<z)continue;let M=t51(I);if(M!==j)j=M,z=q,yield I}}finally{if(clearTimeout(O),U.abort(),$.signal)$.signal.removeEventListener("abort",N);F(),await E.catch(()=>{})}}function _q8($,Z,X){let{pod:Q,sandbox:Y,events:G,startedAt:J}=$;if(Y.ready)return{kind:"ready"};let K=Q.containerWaitingReason;if(K==="ImagePullBackOff"||K==="ErrImagePull")return{kind:"failed",reason:"image-pull-backoff",message:"Sandbox image failed to download. The cluster may be missing pull credentials or the image tag may not exist."};if(K==="CrashLoopBackOff")return{kind:"failed",reason:"crash-loop-backoff",message:"Sandbox crashed during startup and is now in CrashLoopBackOff. Check pod logs."};if(!Q.scheduled&&G.lastFailedSchedulingAt!==void 0&&X()-J>Z)return{kind:"failed",reason:"scheduling-timeout",message:G.failedSchedulingMessage??`Pod could not be scheduled within ${Math.round(Z/1000)}s.`};if(Q.containerRunning&&!Q.containerReady)return{kind:"warming-daemon",since:J};if(G.hasPulling&&!G.hasPulled)return{kind:"pulling-image",since:J};if(K==="ContainerCreating"||K==="PodInitializing"||Q.scheduled&&!Q.containerRunning)return{kind:"starting-container",since:J};if(Q.scheduledFalseReason==="Unschedulable"||G.lastFailedSchedulingAt!==void 0&&!Q.scheduled)return{kind:"waiting-for-capacity",since:J,message:G.failedSchedulingMessage??Q.scheduledFalseMessage,nodeClaim:G.nominatedNodeClaim};return{kind:"claiming",since:J}}function n51($){return $.kind==="ready"||$.kind==="failed"}function vq8($){switch($.kind){case"claiming":return 0;case"waiting-for-capacity":return 1;case"pulling-image":return 2;case"starting-container":return 3;case"warming-daemon":return 4;case"ready":case"failed":return 99}}function t51($){switch($.kind){case"claiming":case"pulling-image":case"starting-container":case"warming-daemon":return $.kind;case"waiting-for-capacity":return`waiting-for-capacity:${$.message??""}:${$.nodeClaim??""}`;case"ready":return"ready";case"failed":return`failed:${$.reason}:${$.message}`}}async function Qu4($,Z,X,Q,Y,G,J,K){let W=`/api/v1/namespaces/${encodeURIComponent(Z)}/pods?watch=true&labelSelector=${encodeURIComponent(`${Zu4}=${X}`)}`;return xP0({kc:$,path:W,signal:Q,label:`pod/${X}`,onEvent:(H)=>{if(H.type!=="ADDED"&&H.type!=="MODIFIED")return;let F=H.object;if(F.metadata?.name)K(F.metadata.name);Yu4(F,Y,J),G("pod")}})}function Yu4($,Z,X){let Y=($.status?.conditions??[]).find((J)=>J.type==="PodScheduled");if(Y?.status==="True")Z.pod.scheduled=!0,Z.pod.scheduledFalseReason=void 0,Z.pod.scheduledFalseMessage=void 0;else if(Y?.status==="False")Z.pod.scheduled=!1,Z.pod.scheduledFalseReason=Y.reason,Z.pod.scheduledFalseMessage=Y.message;let G=($.status?.containerStatuses??[]).find((J)=>J.name===i5.MAIN_CONTAINER_NAME);if(G)Z.pod.containerWaitingReason=G.state?.waiting?.reason,Z.pod.containerRunning=!!G.state?.running,Z.pod.containerReady=G.ready===!0}async function Gu4($,Z,X,Q,Y,G){let J=`/apis/${i5.CLAIM_API_GROUP}/${i5.CLAIM_API_VERSION}/namespaces/${encodeURIComponent(Z)}/${i5.CLAIM_PLURAL}?watch=true&fieldSelector=${encodeURIComponent(`metadata.name=${X}`)}`;return xP0({kc:$,path:J,signal:Q,label:`sandboxclaim/${X}`,onEvent:(K)=>{if(K.type!=="ADDED"&&K.type!=="MODIFIED")return;let H=K.object.status?.conditions?.find((F)=>F.type==="Ready");if(!H)return;if(H.status==="True")Y.sandbox.ready=!0,Y.sandbox.notReadyReason=void 0,Y.sandbox.notReadyMessage=void 0;else Y.sandbox.ready=!1,Y.sandbox.notReadyReason=H.reason,Y.sandbox.notReadyMessage=H.message;G("sandbox")}})}async function Ju4($,Z,X,Q,Y,G,J,K){let W=await Promise.race([Q,new Promise((F)=>{if(Y.aborted){F(X);return}Y.addEventListener("abort",()=>F(X),{once:!0})})]);if(Y.aborted)return;let H=`/api/v1/namespaces/${encodeURIComponent(Z)}/events?watch=true&fieldSelector=${encodeURIComponent(`involvedObject.name=${W},involvedObject.kind=Pod`)}`;return xP0({kc:$,path:H,signal:Y,label:`events/${X}`,onEvent:(F)=>{if(F.type!=="ADDED"&&F.type!=="MODIFIED")return;let U=F.object,N=U.reason;if(!N)return;switch(N){case"Pulling":G.events.hasPulling=!0;break;case"Pulled":G.events.hasPulling=!0,G.events.hasPulled=!0;break;case"FailedScheduling":G.events.lastFailedSchedulingAt=K(),G.events.failedSchedulingMessage=U.message;break;case"Nominated":{let B=U.message?.match(/nodeclaim\/([\w-]+)/);if(B)G.events.nominatedNodeClaim=B[1];break}default:return}J("event")}})}async function fq8($){let{kc:Z,namespace:X,labelSelector:Q,signal:Y,onDelete:G}=$,J=`/apis/${i5.CLAIM_API_GROUP}/${i5.CLAIM_API_VERSION}/namespaces/${encodeURIComponent(X)}/${i5.CLAIM_PLURAL}?watch=true&labelSelector=${encodeURIComponent(Q)}`;return xP0({kc:Z,path:J,signal:Y,label:"sandboxclaim-reaper",onEvent:(K)=>{if(K.type!=="DELETED")return;let W=K.object.metadata?.name;if(W)G(W)}})}async function xP0($){let{kc:Z,path:X,signal:Q,label:Y,onEvent:G}=$,J=0;while(!Q.aborted){try{let W=await CG(Z,{method:"GET",path:X,signal:Q,headers:{accept:"application/json"},stream:!0});if(!W.ok||!W.body){try{await W.body?.cancel()}catch{}if(W.status===401||W.status===403){console.warn(`[lifecycle-watcher] ${Y} stopped: watch denied (${W.status} ${W.statusText}). `+"The kubeconfig in use cannot watch SandboxClaims \u2014 if you are running locally, "+"this provider should not be active (check STUDIO_SANDBOX_PROVIDER / your sandbox preference).");return}throw Error(`watch handshake failed: ${W.status} ${W.statusText}`)}J=0;for await(let H of m51(W.body)){if(Q.aborted)return;try{G(H)}catch(F){console.warn(`[lifecycle-watcher] ${Y} onEvent threw: ${F instanceof Error?F.message:String(F)}`)}}}catch(W){if(Q.aborted)return;let H=W instanceof Error?W.message:String(W);console.warn(`[lifecycle-watcher] ${Y} watch ended: ${H}`)}if(Q.aborted)return;let K=O7(5000,250,J,2,0);J+=1,await N8(K,{signal:Q}).catch(()=>{})}}var Zu4="studio.decocms.com/sandbox-handle",Xu4=300000;var bq8=L(()=>{B4();Wa();Na()});import{z as d3}from"zod";function yq8($){if(!$||$.trim()==="")return[];let Z=d3.array(Ku4).parse(JSON.parse($)),X=new Set;for(let Q of Z){if(X.has(Q.name))throw Error(`STUDIO_SANDBOX_TENANT_POOLS: duplicate pool name ${Q.name}`);X.add(Q.name)}return Z}function Wu4($){try{let[Z,X]=new URL($).pathname.replace(/^\/+/,"").split("/"),Q=X?.replace(/\.git$/,"");return Z&&Q?`${Z}/${Q}`.toLowerCase():null}catch{return null}}function gq8($,Z){let{orgId:X,cloneUrl:Q}=Z;if(Z.purpose==="harness-run")return null;if(!X||!Q)return null;let Y=Wu4(Q);if(!Y)return null;return $.find((G)=>G.orgId===X&&G.repo.toLowerCase()===Y)??null}function hq8($,Z,X){return $?.name??(Z?X:"none")}function Hu4($,Z){return $==="harness-run"?`${Z}-medium`:Z}async function uq8($){let Z=Hu4($.purpose,$.templateName);if(Z===$.templateName)return{name:Z,probe:$.probe};let X=$.probe!==null&&$.now-$.probe.checkedAt<$.ttlMs?$.probe:{checkedAt:$.now,present:await $.exists(Z)};if(X.present)return{name:Z,probe:X};if($.probe?.present!==!1)$.onAbsent?.(Z);return{name:$.templateName,probe:X}}function cq8($,Z,X){let Q=X.replace(/^refs\/heads\//,"");return $.filter((Y)=>Y.repo.toLowerCase()===Z.toLowerCase()&&Y.branch===Q)}function lq8($){return`https://github.com/${$.repo}.git`}var Ku4;var o51=L(()=>{Ku4=d3.object({name:d3.string().regex(/^[a-z0-9]([-a-z0-9]*[a-z0-9])?$/,"pool name must be a DNS label (lowercase alphanumeric and '-')"),orgId:d3.string().min(1),repo:d3.string().regex(/^[^/\s]+\/[^/\s]+$/,"repo must be `owner/name`"),connectionId:d3.string().min(1).optional(),branch:d3.string().min(1).default("main"),workload:d3.object({runtime:d3.enum(["node","bun","deno"]).default("node"),packageManager:d3.enum(["npm","pnpm","yarn","bun","deno"]).optional(),packageManagerPath:d3.string().optional(),devPort:d3.number().int().positive().optional()}).default({runtime:"node"})})});async function dq8($,Z,X){let Q=new Map;for(let Y of $){let G=Z(Y);if(!G)continue;let J=Q.get(G);if(J)J.push(Y);else Q.set(G,[Y])}await Promise.allSettled([...Q.values()].map(async(Y)=>{for(let G of Y)await X(G).catch(()=>{})}))}import{createHash as Fu4,randomBytes as Uu4,randomUUID as Nu4}from"crypto";import*as rq8 from"net";import{PassThrough as Bu4}from"stream";function mq8($){if($ instanceof Error)return $.message;if($&&typeof $==="object"){let Z=$;if(Z.error instanceof Error)return Z.error.message;if(typeof Z.message==="string"&&Z.message)return Z.message}return String($)}class X91{kind=VY;records=new Map;inflight=new sJ0;activeGauge=new aJ0;stateStore;previewUrlPattern;kubeConfig;capacityProbe;portForward;namespace;sandboxTemplateName;envName;tokenGenerator;idleTtlMs;metrics;previewGateway;sentinelToken;mintCloneUrl;mintOrgFsConfig;tenantPools;tenantPoolRefreshMs;poolPods=new Map;mediumTemplateProbe=null;dirtyPools=new Set;closed=!1;claimWatchAbort=new AbortController;constructor($={}){this.stateStore=$.stateStore??null,this.previewUrlPattern=$.previewUrlPattern??null,this.kubeConfig=$.kubeConfig??Mu4(),this.portForward=new T51(this.kubeConfig),this.namespace=$.namespace??Ou4,this.sandboxTemplateName=$.sandboxTemplateName??Lu4,this.envName=vu4($.envName),this.tokenGenerator=$.tokenGenerator??(()=>Uu4(Du4).toString("hex")),this.idleTtlMs=$.idleTtlMs??ju4,this.metrics=$.meter?qu4($.meter):null,this.previewGateway=$.previewGateway&&$.previewUrlPattern?{...$.previewGateway}:null;let Z=$.sentinelToken?.trim()??"";if(this.sentinelToken=Z.length>0?Z:null,this.mintCloneUrl=$.mintCloneUrl,this.mintOrgFsConfig=$.mintOrgFsConfig,this.tenantPools=this.sentinelToken!==null?$.tenantPools??[]:[],this.sentinelToken===null&&($.tenantPools?.length??0)>0)console.warn(`[${j$}] tenant pools configured without a sentinel token \u2014 ignoring them (warm-pool mode is off)`);this.tenantPoolRefreshMs=$.tenantPoolRefreshMs??Pu4,this.startClaimReaper(),this.startCredentialRefresher(),this.startTenantPoolReconciler()}startClaimReaper(){let $=["app.kubernetes.io/managed-by=studio","app.kubernetes.io/name=studio-sandbox",...this.envName?[`${IQ.env}=${this.envName}`]:[]].join(",");fq8({kc:this.kubeConfig,namespace:this.namespace,labelSelector:$,signal:this.claimWatchAbort.signal,onDelete:(Z)=>this.invalidateRecord(Z)})}async ensure($,Z={}){let X=Rz($);if(X.startsWith("s-"))throw Error(`ensure: projectRef has no slug source: ${$.projectRef}`);return this.inflight.run(X,()=>eJ0(this.stateStore,$,VY,(Q)=>this.ensureLocked($,X,Z,Q)))}async delete($){let Z=await this.getRecord($);if(this.records.delete($),Z)this.dropRecord(Z);if(await this.deleteHttpRouteIfManaged($).catch((X)=>{console.warn(`[${j$}] HTTPRoute delete failed for ${$}: ${X instanceof Error?X.message:String(X)}`)}),await Xw(this.kubeConfig,this.namespace,$),this.stateStore)if(Z)await this.stateStore.delete(Z.id,VY);else await this.stateStore.deleteByHandle(VY,$)}lastTermination($){return Dq8(this.kubeConfig,this.namespace,IQ.sandboxHandle,$,i5.MAIN_CONTAINER_NAME)}async alive($){return await _K(this.kubeConfig,this.namespace,$)!==void 0}watchClaimLifecycle($,Z){return xq8({kc:this.kubeConfig,namespace:this.namespace,claimName:$,signal:Z})}hasSchedulableCapacity(){return this.capacityProbe??=Iq8(this.kubeConfig,this.namespace),this.capacityProbe()}async getPreviewUrl($){let Z=await this.getRecord($);if(!Z)return null;return this.composePreviewUrl(Z)}async proxyDaemonRequest($,Z,X){let Q=await this.getRecord($);if(!Q&&this.previewUrlPattern&&this.stateStore){let W=await this.stateStore.getByHandle(VY,$),H=W?.state,F=H?.token;if(W&&F){let N=`http://${H?.adoptedSandboxName??$}.${this.namespace}.svc.cluster.local:${$N}`;try{let B=await Ba(N,F,Z,X);if(B.status!==404)return B;try{await B.body?.cancel()}catch{}}catch{}}}if(!Q)Q=await this.resurrectByHandle($);if(!Q)return new Response(JSON.stringify({error:"sandbox not found"}),{status:404,headers:{"content-type":"application/json"}});let Y=Q,G=performance.now(),J=0,K=!(X.body instanceof ReadableStream);try{let W=await Ba(Q.daemonUrl,Q.token,Z,X);if(W.status===401&&K){this.invalidateRecord($);let H=await this.getRecord($).catch(()=>null)??await this.resurrectByHandle($).catch(()=>null);if(H){try{await W.body?.cancel()}catch{}Y=H,W=await Ba(H.daemonUrl,H.token,Z,X)}}return J=W.status,W}catch(W){if(!K)throw W;this.invalidateRecord($);let H=await this.resurrectByHandle($)??await this.getRecord($).catch(()=>null);if(!H)throw W;Y=H;let F=await Ba(H.daemonUrl,H.token,Z,X);return J=F.status,F}finally{this.recordProxyDuration("daemon",J,Y,performance.now()-G)}}async adoptLiveClaim($,Z){if(this.records.has(Z))return!0;let X=await _K(this.kubeConfig,this.namespace,Z).catch(()=>{return});if(!X||X.metadata?.deletionTimestamp)return!1;return await this.inflight.run(Z,async()=>{let Y=this.records.get(Z);if(Y)return this.toSandbox(Y);let G=await this.adopt($,Z,X);if(!G)throw Error(`cannot adopt live claim ${Z}`);return eJ0(this.stateStore,$,VY,(J)=>this.finish(G,J,!0,!0,"adopt"))}).catch(()=>null)!=null}async resolvePreviewUpstreamUrl($){if(this.previewUrlPattern)return`http://${await this.resolveServiceNameForHandle($)}.${this.namespace}.svc.cluster.local:${$N}`;let Z=await this.getRecord($);if(Z)return Z.daemonUrl;let X=await this.resurrectByHandle($);return X?X.daemonUrl:null}async resolveServiceNameForHandle($){let Z=this.records.get($);if(Z)return Z.adoptedSandboxName;if(this.stateStore){let Q=(await this.stateStore.getByHandle(VY,$).catch(()=>null))?.state?.adoptedSandboxName;if(Q)return Q}return $}async proxyPreviewRequest($,Z){let X=performance.now(),Q=this.records.get($)??null,Y=0;try{let G=await this.resolvePreviewUpstreamUrl($);if(!G){Y=404;let O=a51(404,{error:"sandbox not found"});return O.headers.set(Qv,"1"),O}let J=new URL(Z.url);if((J.pathname==="/_sandbox"||J.pathname.startsWith("/_sandbox/")||J.pathname==="/_decopilot_vm"||J.pathname.startsWith("/_decopilot_vm/"))&&Z.method!=="GET")return Y=404,a51(404,{error:"not found"});let W=(O)=>`${O}${J.pathname}${J.search}`,H=new Headers(Z.headers);for(let O of Ru4)H.delete(O);let F=Z.method!=="GET"&&Z.method!=="HEAD",U={method:Z.method,headers:H,body:F?Z.body:void 0,redirect:"manual",signal:Z.signal,duplex:F?"half":void 0},N;try{N=await fetch(W(G),U)}catch(O){let w=`${G}${J.pathname}`;if(console.warn(`[${j$}] preview fetch to ${w} failed: ${O instanceof Error?O.message:String(O)}`),Z.method==="GET"||Z.method==="HEAD"){if(this.invalidateRecord($),await this.resurrectByHandle($).catch(()=>null)){let j=await this.resolvePreviewUpstreamUrl($);if(j)try{N=await fetch(W(j),U);let z=new Headers;for(let[A,P]of N.headers.entries())if(!nq8.includes(A.toLowerCase()))z.set(A,P);return Y=N.status,new Response(N.body,{status:N.status,statusText:N.statusText,headers:z})}catch(z){console.warn(`[${j$}] preview fetch retry to ${w} failed: ${z instanceof Error?z.message:String(z)}`)}}}else this.invalidateRecord($);Y=502;let D=a51(502,{error:"sandbox daemon unreachable"});return D.headers.set(Qv,"1"),D}let B=new Headers;for(let[O,w]of N.headers.entries())if(!nq8.includes(O.toLowerCase()))B.set(O,w);return Y=N.status,new Response(N.body,{status:N.status,statusText:N.statusText,headers:B})}finally{this.recordProxyDuration("preview",Y,Q,performance.now()-X,$)}}async ensureLocked($,Z,X,Q){if(X.image)console.warn(`[${j$}] opts.image ignored (template ${this.sandboxTemplateName} pins image): got ${X.image}`);if(Q){let J=await Q.get($,VY);if(J){let K=await this.rehydrate($,Z,J);if(K)return await this.refreshDaemonGitCredential(K,X),await this.relayOrgFsConfig(K.daemonUrl,K.token,X.orgFsConfigJson),this.finish(K,Q,!1,!0,"resume");await Q.delete($,VY)}}let Y=await _K(this.kubeConfig,this.namespace,Z).catch(()=>{return});if(Y)if(Y.metadata?.deletionTimestamp)await qP0(this.kubeConfig,this.namespace,Z).catch((J)=>{console.warn(`[${j$}] wait for terminating claim ${Z} failed: ${J instanceof Error?J.message:String(J)}`)});else{let J=await this.adopt($,Z,Y).catch((K)=>{return console.warn(`[${j$}] adopt ${Z} failed, recreating: ${K instanceof Error?K.message:String(K)}`),null});if(J)return await this.refreshDaemonGitCredential(J,X),await this.relayOrgFsConfig(J.daemonUrl,J.token,X.orgFsConfigJson),this.finish(J,Q,!0,!0,"adopt");await Xw(this.kubeConfig,this.namespace,Z).catch(()=>{}),await qP0(this.kubeConfig,this.namespace,Z).catch((K)=>{console.warn(`[${j$}] wait for deleted claim ${Z} failed: ${K instanceof Error?K.message:String(K)}`)})}let G=await this.provision($,Z,X);return this.finish(G,Q,!0,!1,"fresh")}async finish($,Z,X,Q,Y){let G=this.records.get($.handle),J=G!==void 0;if(G&&G.daemonForward!==$.daemonForward)this.closeForwarder(G.daemonForward);if(this.records.set($.handle,$),X)await this.persist(Z,$);if(Q)await MP0(this.kubeConfig,this.namespace,$.handle,this.computeShutdownTime()).catch((K)=>console.warn(`[${j$}] TTL refresh failed for ${$.handle}: ${K instanceof Error?K.message:String(K)}`));if(this.metrics){let K=e51($.tenant);if(this.metrics.ensureOutcome.add(1,{...K,outcome:Y}),!J)this.metrics.active.add(1,K),this.activeGauge.markCounted($.handle)}return this.toSandbox($)}buildEnvMap($,Z){let X={},Q=[];for(let[Y,G]of Object.entries($.env??{}))if(Eu4.has(Y))Q.push(Y);else X[Y]=G;if(Q.length>0)console.warn(`[${j$}] opts.env keys overlap reserved bootstrap names and were dropped: ${Q.join(",")}`);return{...X,DAEMON_TOKEN:Z.token,DAEMON_BOOT_ID:Z.daemonBootId,APP_ROOT:Z.workdir,PROXY_PORT:String($N)}}async resolveTemplateName($){let{name:Z,probe:X}=await uq8({purpose:$,templateName:this.sandboxTemplateName,probe:this.mediumTemplateProbe,now:Date.now(),ttlMs:wu4,exists:(Q)=>Bq8(this.kubeConfig,this.namespace,Q),onAbsent:(Q)=>console.warn(`[${j$}] SandboxTemplate ${Q} not found (or not readable) \u2014 harness-run claims fall back to ${this.sandboxTemplateName}. Upgrade the sandbox-env chart to the version that renders it.`)});return this.mediumTemplateProbe=X,Z}buildClaim($,Z,X,Q){let Y=this.sentinelToken!==null,G=gq8(this.tenantPools,{orgId:Z.tenant?.orgId,cloneUrl:Z.repo?.cloneUrl,purpose:Z.purpose}),J=Y?[]:Object.entries(this.buildEnvMap(Z,X)).sort(([H],[F])=>H<F?-1:H>F?1:0).map(([H,F])=>({name:H,value:F})),K=bu4(Z),W=Object.keys(K).length>0;return{apiVersion:`${i5.CLAIM_API_GROUP}/${i5.CLAIM_API_VERSION}`,kind:"SandboxClaim",metadata:{name:$,namespace:this.namespace,labels:{"app.kubernetes.io/name":"studio-sandbox","app.kubernetes.io/managed-by":"studio",...this.envName?{[IQ.env]:this.envName}:{},...s51(Z.tenant)},...W?{annotations:K}:{}},spec:{sandboxTemplateRef:{name:Q},additionalPodMetadata:{labels:s51(Z.tenant,{[IQ.role]:"claimed",[IQ.sandboxHandle]:$,...this.envName?{[IQ.env]:this.envName}:{}}),...W?{annotations:K}:{}},env:J,warmpool:hq8(G,Y,Q),lifecycle:{shutdownPolicy:"Delete",shutdownTime:this.computeShutdownTime()}}}}async provision($,Z,X){let Q=this.tokenGenerator(),Y=Nu4(),G=r51,J=this.buildClaim(Z,X,{token:Q,daemonBootId:Y,workdir:G},await this.resolveTemplateName(X.purpose));try{await Fa(this.kubeConfig,this.namespace,J)}catch(N){if(N instanceof Ka)await qP0(this.kubeConfig,this.namespace,Z),await Fa(this.kubeConfig,this.namespace,J);else throw N}let K;try{K=await Oq8(this.kubeConfig,this.namespace,Z),await SP0(this.kubeConfig,this.namespace,K)}catch(N){throw await Xw(this.kubeConfig,this.namespace,Z).catch(()=>{}),N}try{await this.ensureServicePortForAdoptedSandbox(K),await this.ensureHttpRouteForHandle(Z,K,X.tenant??null)}catch(N){throw await Xw(this.kubeConfig,this.namespace,Z).catch(()=>{}),N}let W=await this.openForwarder(K,$N,Z),H=`http://127.0.0.1:${W.localPort}`,F=this.workloadConfigPayload(X),U=Y;try{if(await p51(H),this.sentinelToken!==null){let N=await vP0(H);if(N)U=N.bootId;await Zv(H,this.sentinelToken,F??{},{rotateToken:Q})}else if(F)await Zv(H,Q,F);await this.relayOrgFsConfig(H,Q,X.orgFsConfigJson)}catch(N){throw this.closeForwarder(W),await this.deleteHttpRouteIfManaged(Z).catch(()=>{}),await Xw(this.kubeConfig,this.namespace,Z).catch(()=>{}),N}return{id:$,handle:Z,adoptedSandboxName:K,token:Q,workdir:G,daemonUrl:H,daemonForward:W,workload:X.workload??null,daemonBootId:U,tenant:X.tenant??null,ensureOpts:cu4(X)}}workloadConfigPayload($){return ZK0({runtime:$?.workload?.runtime??"node",packageManager:$?.workload?.packageManager?{name:$.workload.packageManager,...$.workload.packageManagerPath?{path:$.workload.packageManagerPath}:{}}:null,repo:$?.repo??null,port:$?.workload?.devPort??iq8,tenant:$?.tenant??void 0,...$?{cloneOnly:$.cloneOnly===!0}:{}})}async relayOrgFsConfig($,Z,X){if(!X)return;await Sq8($,Z,X).catch((Q)=>console.warn("[org-fs] sidecar config relay failed",Q))}async refreshDaemonGitCredential($,Z){let X=y41(Z);if(!X)return;try{await Zv($.daemonUrl,$.token,X)}catch(Q){console.warn(`[${j$}] git credential refresh failed for ${$.handle}: ${Q instanceof Error?Q.message:String(Q)}`)}}async withFreshCloneUrl($,Z){if(!this.mintCloneUrl)return $;try{let X=await this.mintCloneUrl($,Z!==void 0?{bufferMs:Z}:void 0);return X?{...$,cloneUrl:X}:$}catch(X){return console.warn(`[${j$}] clone credential re-mint failed: ${X instanceof Error?X.message:String(X)}`),$}}async withFreshCredentials($){return{...$,...$.repo?{repo:await this.withFreshCloneUrl($.repo)}:{},...$.orgFsConfigJson?{orgFsConfigJson:await uu4($,this.mintOrgFsConfig)}:{}}}startCredentialRefresher(){if(!this.mintCloneUrl)return;let{signal:$}=this.claimWatchAbort;(async()=>{while(!$.aborted){if(await N8(Au4,{signal:$}).catch(()=>{}),$.aborted)break;try{await this.refreshAllGitCredentials()}catch(Z){console.warn(`[${j$}] periodic credential refresh failed: ${Z instanceof Error?Z.message:String(Z)}`)}}})()}startTenantPoolReconciler(){if(this.tenantPools.length===0)return;let{signal:$}=this.claimWatchAbort;(async()=>{while(!$.aborted){try{await this.reconcileTenantPools()}catch(Z){console.warn(`[${j$}] tenant pool reconcile failed: ${Z instanceof Error?Z.message:String(Z)}`)}await N8(zu4,{signal:$}).catch(()=>{})}})()}markTenantPoolsDirty($,Z){let X=cq8(this.tenantPools,$,Z);for(let Q of X)this.dirtyPools.add(Q.name);return X.map((Q)=>Q.name)}async reconcileTenantPools(){for(let $ of this.tenantPools){let Z=await Lq8(this.kubeConfig,this.namespace,$.name);if(Z===null){console.warn(`[${j$}] tenant pool ${$.name}: no SandboxWarmPool (or no selector yet) in ${this.namespace}`);continue}let X=this.dirtyPools.delete($.name),Q=Z.filter((Y)=>!Y.labels[IQ.sandboxHandle]);for(let[Y]of this.poolPods)if(!Z.some((G)=>G.uid===Y))this.poolPods.delete(Y);for(let Y of Q){if(this.claimWatchAbort.signal.aborted)return;await this.warmPoolPod($,Y,X)}this.recordPoolDepth($,Z,Q)}}recordPoolDepth($,Z,X){let Q=this.metrics?.poolPods;if(!Q)return;let Y=0,G=0;for(let K of X){let W=this.poolPods.get(K.uid);if(!W)continue;if(W.failures>=fP0)G++;else if(W.lastConfigAt>0)Y++}let J={pool:$.name,org:$.orgId};Q.record(Y,{...J,state:"ready"}),Q.record(Z.length-X.length,{...J,state:"bound"}),Q.record(X.length-Y-G,{...J,state:"pending"}),Q.record(G,{...J,state:"failed"})}async warmPoolPod($,Z,X){let Q=this.poolPods.get(Z.uid);if(Q&&Q.failures>=fP0){if(Date.now()-Q.lastFailureAt<pq8)return;this.poolPods.set(Z.uid,{...Q,failures:0})}let Y=X||Q!==void 0&&Date.now()-Q.lastConfigAt>=this.tenantPoolRefreshMs;if(Q&&!Y)return;let G={cloneUrl:lq8($),connectionId:$.connectionId,branch:$.branch,userName:"",userEmail:""},J=await this.withFreshCloneUrl(G);if($.connectionId&&J.cloneUrl===G.cloneUrl){this.recordPoolFailure(Z,$,"clone credential mint failed");return}let K=await this.openForwarder(Z.name,$N,Z.name).catch(()=>null);if(!K){this.recordPoolFailure(Z,$,"port-forward failed");return}let W=`http://127.0.0.1:${K.localPort}`;try{await p51(W);let H=this.sentinelToken;if(!H)return;if(!await this.isPoolPodUnbound(Z))return;let F=ZK0({runtime:$.workload.runtime,packageManager:$.workload.packageManager?{name:$.workload.packageManager,...$.workload.packageManagerPath?{path:$.workload.packageManagerPath}:{}}:null,repo:J,port:$.workload.devPort??iq8})??{},{transition:U}=await Zv(W,H,F);if(Y&&U!=="bootstrap"&&await this.isPoolPodUnbound(Z))await kq8(W,H,"clone");this.poolPods.set(Z.uid,{lastConfigAt:Date.now(),lastFailureAt:0,failures:0}),console.log(`[${j$}] tenant pool ${$.name}: warmed ${Z.name} (${U})`)}catch(H){this.recordPoolFailure(Z,$,H instanceof Error?H.message:String(H))}finally{this.closeForwarder(K)}}isPoolPodUnbound($){return wq8(this.kubeConfig,this.namespace,$.name,IQ.sandboxHandle)}recordPoolFailure($,Z,X){let Q=this.poolPods.get($.uid),Y=(Q?.failures??0)+1;this.poolPods.set($.uid,{lastConfigAt:Q?.lastConfigAt??0,lastFailureAt:Date.now(),failures:Y});let G=Y>=fP0?` \u2014 backing off ${pq8/60000}min`:"";console.warn(`[${j$}] tenant pool ${Z.name}: warming ${$.name} failed (${Y}/${fP0})${G}: ${X}`)}async refreshAllGitCredentials(){await dq8(this.records.values(),($)=>$.ensureOpts?.repo?.connectionId,async($)=>{if(this.claimWatchAbort.signal.aborted)return;let Z=$.ensureOpts?.repo;if(!Z)return;let X=await this.withFreshCloneUrl(Z,Tu4);await this.refreshDaemonGitCredential($,{...$.ensureOpts,repo:X}),$.ensureOpts={...$.ensureOpts,repo:X}})}async rebootstrapDaemon($,Z,X){if(this.sentinelToken===null)return!1;let Q=this.workloadConfigPayload(X)??{};try{return await Zv($,this.sentinelToken,Q,{rotateToken:Z}),await this.relayOrgFsConfig($,Z,X?.orgFsConfigJson),!0}catch(Y){if(Y instanceof _P0&&Y.status===401)try{return await Zv($,Z,Q,{rotateToken:Z}),await this.relayOrgFsConfig($,Z,X?.orgFsConfigJson),!0}catch(G){return console.warn(`[${j$}] re-bootstrap retry with claim token failed: ${G instanceof Error?G.message:String(G)}`),!1}return console.warn(`[${j$}] re-bootstrap failed: ${Y instanceof Error?Y.message:String(Y)}`),!1}}async ensureServicePortForAdoptedSandbox($){if(!this.previewGateway||!this.previewUrlPattern)return;await Tq8(this.kubeConfig,this.namespace,$,{name:"daemon",port:$N,targetPort:$N})}async ensureHttpRouteForHandle($,Z,X){if(!this.previewGateway||!this.previewUrlPattern)return;let Q=lu4(this.previewUrlPattern,$);if(!Q)throw new m9(`Unable to derive preview hostname for ${$} from pattern: ${this.previewUrlPattern}`);let Y={apiVersion:`${Ua.API_GROUP}/${Ua.API_VERSION}`,kind:"HTTPRoute",metadata:{name:$,namespace:this.namespace,labels:s51(X??void 0,{[IQ.role]:"claimed",[IQ.sandboxHandle]:$,"app.kubernetes.io/name":"studio-sandbox","app.kubernetes.io/managed-by":"studio",...this.envName?{[IQ.env]:this.envName}:{}})},spec:{parentRefs:[{kind:"Gateway",group:"gateway.networking.k8s.io",name:this.previewGateway.name,namespace:this.previewGateway.namespace}],hostnames:[Q],rules:[{backendRefs:[{group:"",kind:"Service",name:Z,port:$N}]}]}};await VP0(this.kubeConfig,this.namespace,Y)}async deleteHttpRouteIfManaged($){if(!this.previewGateway)return;await kP0(this.kubeConfig,this.namespace,$)}async rehydrate($,Z,X){let Q=X.state;if(!Q.adoptedSandboxName&&!Q.podName||!Q.token)return null;let Y=await _K(this.kubeConfig,this.namespace,Z).catch(()=>{return});if(!Y||!tq8(Y))return null;let G=Y.status?.sandbox?.name??Q.adoptedSandboxName??Q.podName??Z,J=await this.openAndProbeDaemon(G,Z);if(!J)return null;if(Q.daemonBootId&&Q.daemonBootId!==J.bootId){if(this.sentinelToken!==null){let K=Q.ensureOpts?await this.withFreshCredentials(Q.ensureOpts):null;if(!await this.rebootstrapDaemon(J.daemonUrl,Q.token,K))return this.closeForwarder(J.daemonForward),null}else console.warn(`[${j$}] daemon restart detected (handle=${Z}): stored bootId=${Q.daemonBootId} live bootId=${J.bootId}`);await this.stateStore?.put($,VY,{handle:Z,state:{...Q,daemonBootId:J.bootId}}).catch((K)=>console.warn(`[${j$}] bootId persist failed for ${Z}: ${K instanceof Error?K.message:String(K)}`))}return{id:$,handle:Z,adoptedSandboxName:G,token:Q.token,workdir:Q.workdir??r51,daemonUrl:J.daemonUrl,daemonForward:J.daemonForward,workload:Q.workload??null,daemonBootId:J.bootId,tenant:Q.tenant??null,ensureOpts:Q.ensureOpts??null}}async adopt($,Z,X){if(!tq8(X))return null;let Q=X.status?.sandbox?.name??Z;if(this.sentinelToken!==null)return null;let Y=Vu4(X);if(!Y)return null;let G=await this.openAndProbeDaemon(Q,Z);if(!G)return null;let J=yu4(X);if(this.previewGateway)await this.ensureServicePortForAdoptedSandbox(Q).catch((K)=>{console.warn(`[${j$}] Service port backfill failed for ${Z}: ${K instanceof Error?K.message:String(K)}`)}),await this.ensureHttpRouteForHandle(Z,Q,J).catch((K)=>{console.warn(`[${j$}] HTTPRoute backfill failed for ${Z}: ${K instanceof Error?K.message:String(K)}`)});return{id:$,handle:Z,adoptedSandboxName:Q,token:Y,workdir:r51,daemonUrl:G.daemonUrl,daemonForward:G.daemonForward,workload:null,daemonBootId:G.bootId,tenant:J,ensureOpts:null}}async openAndProbeDaemon($,Z){let X=await this.openForwarder($,$N,Z).catch(()=>null);if(!X)return null;let Q=`http://127.0.0.1:${X.localPort}`,Y=await vP0(Q);if(!Y)return this.closeForwarder(X),null;return{daemonForward:X,daemonUrl:Q,bootId:Y.bootId}}async getRecord($){let Z=this.records.get($);if(Z)return Z;if(!this.stateStore)return null;let X=await this.stateStore.getByHandle(VY,$);if(!X)return null;let Q=await this.rehydrate(X.id,$,X);if(Q)this.records.set($,Q);return Q}async resurrectByHandle($){if(!this.stateStore)return null;let Z=await this.stateStore.getByHandle(VY,$);if(!Z)return null;let X=Z.state.ensureOpts;if(!X)return null;let Q=await this.withFreshCredentials(X);if(Rz(Z.id)!==$)return null;return await this.ensure(Z.id,Q),this.records.get($)??null}invalidateRecord($){let Z=this.records.get($);if(!Z)return;this.records.delete($),this.dropRecord(Z)}dropRecord($){if(this.closeForwarder($.daemonForward),this.metrics&&this.activeGauge.consume($.handle))this.metrics.active.add(-1,e51($.tenant))}recordProxyDuration($,Z,X,Q,Y){if(!this.metrics)return;this.metrics.proxyDurationMs.record(Q,{...e51(X?.tenant??null),source:$,sandbox_handle:X?.handle??Y??"",status_code:Z||0})}composePreviewUrl($){if(this.previewUrlPattern)return $K0(this.previewUrlPattern,$.handle);return`http://127.0.0.1:${$.daemonForward.localPort}/`}toSandbox($){return{handle:$.handle,workdir:$.workdir,previewUrl:this.composePreviewUrl($)}}async persist($,Z){if(!$)return;let X={adoptedSandboxName:Z.adoptedSandboxName,token:Z.token,workdir:Z.workdir,workload:Z.workload,daemonBootId:Z.daemonBootId,tenant:Z.tenant,...Z.ensureOpts?{ensureOpts:Z.ensureOpts}:{}};await $.put(Z.id,VY,{handle:Z.handle,state:X})}computeShutdownTime(){return new Date(Date.now()+this.idleTtlMs).toISOString()}async releaseAfter($,Z){let X=await _K(this.kubeConfig,this.namespace,$);if(!X)return;let Q=gu4(X.spec?.lifecycle?.shutdownTime,new Date(Date.now()+Z));if(!Q)return;await MP0(this.kubeConfig,this.namespace,$,Q).catch((Y)=>console.warn(`[${j$}] release failed for ${$}: ${Y instanceof Error?Y.message:String(Y)}`))}async renewTtl($){let Z=await _K(this.kubeConfig,this.namespace,$);if(!Z)return;let X=hu4(Z.spec?.lifecycle?.shutdownTime,new Date(Date.now()+this.idleTtlMs));if(!X)return;await MP0(this.kubeConfig,this.namespace,$,X).catch((Q)=>console.warn(`[${j$}] TTL renew failed for ${$}: ${Q instanceof Error?Q.message:String(Q)}`))}openForwarder($,Z,X=$){let Q=ku4(X,Z);return new Promise((Y,G)=>{let J=(K,W)=>{let H=rq8.createServer((F)=>this.handleForwardedConnection(F,$,Z,X));H.once("error",(F)=>{if(F.code==="EADDRINUSE"&&W<Iu4){try{H.close()}catch{}let U=$91+(K-$91+1)%aq8;J(U,W+1);return}G(F)}),H.listen(K,"127.0.0.1",()=>{let F=H.address();if(!F||typeof F==="string"){H.close(),G(Error("port-forward listener failed to bind"));return}Y({server:H,localPort:F.port})})};J(Q,0)})}handleForwardedConnection($,Z,X,Q){let Y=new Bu4,G=null,J=!1,K=()=>{if(J)return;if(J=!0,Y.destroy(),G)try{G.close()}catch{}if(!$.destroyed)$.destroy()};$.pipe(Y),$.on("error",K),$.on("close",K),this.portForward.portForward(this.namespace,Z,[X],$,null,Y).then((W)=>{let H=typeof W==="function"?W():W;if(!H){K();return}if(G=H,G.on("close",K),G.on("error",(F)=>{console.warn(`[${j$}] port-forward to ${Z}:${X} dropped mid-connection: ${mq8(F)}`,JSON.stringify(Z91(F))),this.invalidateRecord(Q),K()}),J)try{G.close()}catch{}}).catch((W)=>{console.warn(`[${j$}] port-forward to ${Z}:${X} failed: ${mq8(W)}`,JSON.stringify(Z91(W))),this.invalidateRecord(Q),K()})}closeForwarder($){$.server.close((Z)=>{if(Z)console.warn(`[${j$}] port-forward close on :${$.localPort} errored: ${Z instanceof Error?Z.message:String(Z)}`)})}close(){if(this.closed)return;this.closed=!0,this.claimWatchAbort.abort();for(let $ of this.records.values())this.dropRecord($);this.records.clear()}}function qu4($){return{active:$.createUpDownCounter("studio.sandbox.active",{description:"Active sandbox count, by runner kind, owning org, and daemon impl. Cross-checks the cAdvisor-derived count from the cluster \u2014 divergence between the two indicates orphaned claims (studio deleted but K8s didn't reap) or unattributed pods.",unit:"{sandbox}"}),ensureOutcome:$.createCounter("studio.sandbox.ensure.outcome",{description:"Outcome of each ensure() call: fresh provision, resume from state-store after restart, or adopt of a cluster-side claim studio didn't know about. Cold-start ratio is the primary input for warm-pool sizing.",unit:"{call}"}),proxyDurationMs:$.createHistogram("studio.sandbox.proxy.duration_ms",{description:"Wall-clock latency of studio-mediated requests to the sandbox daemon: tool exec proxies (source=daemon) and preview iframe traffic (source=preview).",unit:"ms"}),poolPods:$.createGauge("studio.sandbox.pool.pods",{description:"Tenant warm pool depth by pool and state: ready (warmed and unbound \u2014 what a claim can actually bind instantly), bound (serving a user), pending (unbound, not yet warmed), failed (gave up after repeated bootstrap failures). Alert on sustained ready=0: a pool that is always empty is doing nothing while costing N pods.",unit:"{pod}"})}}function Z91($){let Z=[],X=$;for(let Q=0;Q<5&&X instanceof Error;Q++){let Y=X;if(Z.push({name:Y.name,message:Y.message,...Y.code!==void 0?{code:Y.code}:{},...Y.errno!==void 0?{errno:Y.errno}:{}}),Y.cause===X)break;X=Y.cause}if(X!==void 0&&!(X instanceof Error)&&X!==null){let Q=X,Y=Q.error instanceof Error?Z91(Q.error).chain:void 0;Z.push({nonError:String(X),...typeof Q.type==="string"?{type:Q.type}:{},...typeof Q.message==="string"?{message:Q.message}:{},...Q.code!==void 0?{code:Q.code}:{},...typeof Q.reason==="string"?{reason:Q.reason}:{},...Y?{error:Y}:{},...Y===void 0&&Q.error!==void 0?{rawError:String(Q.error)}:{},keys:Object.keys(Q)})}return{chain:Z}}function Mu4(){let $=new wu;return $.loadFromDefault(),$}function tq8($){return Boolean($.status?.conditions?.some((Z)=>Z.type==="Ready"&&Z.status==="True"))}function Vu4($){let Z=$.spec?.env;if(!Z)return null;for(let X of Z)if(X.name==="DAEMON_TOKEN"&&X.value)return X.value;return null}function ku4($,Z){let X=Fu4("sha256").update(`${$}:${Z}`).digest();return $91+X.readUInt32BE(0)%aq8}function a51($,Z){return new Response(JSON.stringify(Z),{status:$,headers:{"content-type":"application/json","access-control-allow-origin":"*"}})}function oq8($){let Z=$.slice(0,Cu4);return Su4.test(Z)?Z:""}function vu4($){if($===void 0)return null;let Z=$.trim();if(Z==="")return null;if(!_u4.test(Z))throw Error(`AgentSandboxProvider: envName=${JSON.stringify(Z)} is not a valid DNS-label-safe environment name (lowercase alphanumeric or '-', starts with a letter, ends alphanumeric, \u226432 chars). Studio sets this from STUDIO_ENV; check the studio chart's configMap.`);return Z}function s51($,Z={}){let X={...Z};if($){let Q=oq8($.orgId),Y=oq8($.userId);if(Q)X[IQ.orgId]=Q;if(Y)X[IQ.userId]=Y}return X}function Xv($){let Z="";for(let X of $){let Q=X.codePointAt(0)??0;Z+=Q<32||Q===127?" ":X}return Z.slice(0,xu4)}function fu4($){try{let Z=new URL($);return Z.username="",Z.password="",Z.toString()}catch{return""}}function bu4($){let Z={},X=$.tenant;if(X?.orgSlug)Z[vK.orgSlug]=Xv(X.orgSlug);if(X?.orgName)Z[vK.orgName]=Xv(X.orgName);if(X?.userEmail)Z[vK.userEmail]=Xv(X.userEmail);if(X?.userName)Z[vK.userName]=Xv(X.userName);let Q=$.repo;if(Q){if(Q.displayName)Z[vK.gitRepo]=Xv(Q.displayName);let Y=fu4(Q.cloneUrl);if(Y)Z[vK.gitRepoUrl]=Xv(Y);let G=$.branch??Q.branch;if(G)Z[vK.gitBranch]=Xv(G)}return Z}function yu4($){let Z=$.metadata?.labels;if(!Z)return null;let X=Z[IQ.orgId],Q=Z[IQ.userId];if(!X||!Q)return null;let Y=$.metadata?.annotations??{};return{orgId:X,userId:Q,orgSlug:Y[vK.orgSlug],orgName:Y[vK.orgName],userEmail:Y[vK.userEmail],userName:Y[vK.userName]}}function gu4($,Z){if($){let X=new Date($).getTime();if(Number.isFinite(X)&&X<=Z.getTime())return null}return Z.toISOString()}function hu4($,Z){if($){let X=new Date($).getTime();if(Number.isFinite(X)&&X>=Z.getTime())return null}return Z.toISOString()}function e51($){return{org_id:$?.orgId??"",user_id:$?.userId??"",runner_kind:VY}}async function uu4($,Z){if(!Z||!$.tenant)return $.orgFsConfigJson;try{return await Z($.tenant)??$.orgFsConfigJson}catch(X){return console.warn(`[${j$}] org-fs credential re-mint failed: ${X instanceof Error?X.message:String(X)}`),$.orgFsConfigJson}}function cu4($){let Z={};if($.branch)Z.branch=$.branch;if($.repo)Z.repo=$.repo;if($.workload)Z.workload=$.workload;if($.env&&Object.keys($.env).length>0)Z.env=$.env;if($.tenant)Z.tenant=$.tenant;if($.cloneOnly)Z.cloneOnly=!0;if($.purpose)Z.purpose=$.purpose;if($.orgFsConfigJson)Z.orgFsConfigJson=$.orgFsConfigJson;return Object.keys(Z).length>0?Z:null}function lu4($,Z){try{return new URL($K0($,Z)).hostname||null}catch{return null}}var VY="agent-sandbox",j$="AgentSandboxProvider",Qv="x-sandbox-preview-not-ready",Ou4="agent-sandbox-system",Lu4="studio-sandbox",wu4=300000,$N=9000,iq8=3000,r51="/app",Du4=32,Eu4,ju4=900000,zu4=60000,Pu4=1800000,fP0=3,pq8=1800000,Au4=900000,Tu4=1800000,Ru4,nq8,$91=40000,aq8=1e4,Iu4=256,IQ,vK,Su4,Cu4=63,_u4,xu4=253;var sq8=L(()=>{B4();qq8();h51();Cq8();g41();Na();Wa();bq8();o51();Eu4=new Set(["DAEMON_TOKEN","DAEMON_BOOT_ID","APP_ROOT","PROXY_PORT"]),Ru4=["cookie","host","connection","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","accept-encoding","content-length","upgrade"],nq8=["connection","keep-alive","transfer-encoding","content-encoding","content-length"];IQ={role:"studio.decocms.com/role",sandboxHandle:"studio.decocms.com/sandbox-handle",orgId:"studio.decocms.com/org-id",userId:"studio.decocms.com/user-id",env:"studio.decocms.com/env"},vK={orgSlug:"studio.decocms.com/org-slug",orgName:"studio.decocms.com/org-name",userEmail:"studio.decocms.com/user-email",userName:"studio.decocms.com/user-name",gitRepo:"studio.decocms.com/git-repo",gitRepoUrl:"studio.decocms.com/git-repo-url",gitBranch:"studio.decocms.com/git-branch"},Su4=/^([A-Za-z0-9]([-A-Za-z0-9_.]*[A-Za-z0-9])?)?$/;_u4=/^[a-z]([a-z0-9-]{0,30}[a-z0-9])?$/});var eq8={};U0(eq8,{waitForSandboxReady:()=>SP0,parseTenantPools:()=>yq8,getSandboxClaim:()=>_K,getHttpRoute:()=>Pq8,deleteSandboxClaim:()=>Xw,deleteHttpRoute:()=>kP0,createSandboxClaim:()=>Fa,applyHttpRoute:()=>VP0,SandboxTimeoutError:()=>$v,SandboxError:()=>m9,PREVIEW_NOT_READY_HEADER:()=>Qv,KubeConfig:()=>wu,K8S_CONSTANTS:()=>i5,HTTPROUTE_CONSTANTS:()=>Ua,AgentSandboxProvider:()=>X91});var Q91=L(()=>{h51();Wa();Na();sq8();o51()});var GM8={};U0(GM8,{subscribeLifecycle:()=>K91,getSandboxProviderByKind:()=>G91,getOrInitSharedRunner:()=>J91,__resetSharedLifecyclesForTesting:()=>$c4});function QM8($,Z){let X=$M8[$];if(X)return Promise.resolve(X);let Q=Y91[$];if(Q)return Q;let Y=Z().then((G)=>{return $M8[$]=G,G}).finally(()=>{delete Y91[$]});return Y91[$]=Y,Y}function iu4(){let $=process.env.STUDIO_SANDBOX_PREVIEW_URL_PATTERN;return $&&$.trim()!==""?$:void 0}function pu4(){let $=process.env.STUDIO_SANDBOX_TEMPLATE_NAME;return $&&$.trim()!==""?$:void 0}function nu4(){let $=process.env.STUDIO_ENV;return $&&$.trim()!==""?$:void 0}function tu4(){let $=process.env.STUDIO_SANDBOX_SENTINEL_TOKEN;return $&&$.trim()!==""?$:void 0}function ou4(){let $=process.env.STUDIO_SANDBOX_PREVIEW_GATEWAY_NAME?.trim(),Z=process.env.STUDIO_SANDBOX_PREVIEW_GATEWAY_NAMESPACE?.trim();if(!$&&!Z)return;if(!$||!Z)throw Error("STUDIO_SANDBOX_PREVIEW_GATEWAY_NAME and STUDIO_SANDBOX_PREVIEW_GATEWAY_NAMESPACE must both be set, or both unset. Half-configured per-claim HTTPRoute routing would silently fail to attach.");return{name:$,namespace:Z}}async function YM8($,Z){let X=new yr(Z),Q=iu4();switch($){case"agent-sandbox":{let{AgentSandboxProvider:Y,parseTenantPools:G}=await Promise.resolve().then(() => (Q91(),eq8)),J=new FG(o0().encryptionKey);return new Y({stateStore:X,previewUrlPattern:Q,sandboxTemplateName:pu4(),envName:nu4(),previewGateway:ou4(),sentinelToken:tu4(),tenantPools:G(process.env.STUDIO_SANDBOX_TENANT_POOLS),meter:R8,mintCloneUrl:async(K,W)=>{if(!K.connectionId)return null;let H=hz8(K.cloneUrl);if(!H)return null;let{cloneUrl:F}=await mL(K.connectionId,H.owner,H.name,Z,J,{bufferMs:W?.bufferMs});return F},mintOrgFsConfig:async(K)=>{if(!K.orgSlug)return null;return await HK0({boundAuth:{apiKey:{create:(H)=>P6.api.createApiKey({body:{...H,userId:K.userId}})}},storage:{orgRepoSyncs:new Mz(Z)}},{orgSlug:K.orgSlug,orgId:K.orgId,baseUrl:s9()})??null}})}case"user-desktop":throw Error("user-desktop provider cannot be instantiated without a per-run link claim \u2014 call resolveSandboxProvider, which binds the link before constructing the provider.");default:throw Error(`Unknown sandbox provider kind: ${String($)}`)}}function G91($,Z){return QM8(Z,()=>YM8(Z,$.db))}async function J91(){let $;try{$=Iz()}catch(X){return console.warn("[lifecycle] cannot resolve sandbox runner:",X instanceof Error?X.message:String(X)),null}return await QM8($,()=>YM8($,W6().db))}function K91($,Z,X){let Q=Qw.get(Z);if(Q){if(Q.terminated){if(Q.lastPhase)try{X(Q.lastPhase)}catch{}return{unsubscribe:su4}}if(Q.listeners.add(X),Q.lastPhase)try{X(Q.lastPhase)}catch{}return ZM8(Z,Q,X)}let Y=new AbortController,G={lastPhase:null,terminated:!1,listeners:new Set([X]),abort:Y};return Qw.set(Z,G),eu4($,Z,G),ZM8(Z,G,X)}function su4(){}function ZM8($,Z,X){return{unsubscribe(){if(Qw.get($)!==Z)return;if(Z.listeners.delete(X),Z.listeners.size===0)Qw.delete($),Z.abort.abort()}}}async function eu4($,Z,X){let Q=null;try{for await(let Y of $.watchClaimLifecycle(Z,X.abort.signal)){if(X.abort.signal.aborted)break;X.lastPhase=Y;let G=Y.kind==="ready"||Y.kind==="failed";if(G)X.terminated=!0;let J=Array.from(X.listeners);for(let K of J)try{K(Y)}catch{}if(G)break}}catch(Y){Q=Y}finally{if(!X.terminated&&!X.abort.signal.aborted&&X.listeners.size>0){let Y={kind:"failed",reason:"unknown",message:Q instanceof Error?Q.message:"Lifecycle watcher ended unexpectedly"};X.lastPhase=Y,X.terminated=!0;for(let G of Array.from(X.listeners))try{G(Y)}catch{}}if(Qw.get(Z)===X)Qw.delete(Z)}}function $c4(){for(let $ of Qw.values())$.abort.abort();Qw.clear()}var du4,mu4,XM8,$M8,Y91,ru4,au4,Qw;var Oa=L(()=>{nU();JX();u$();c41();Yu();tE();_8();Gu();PG();L9();du4=Symbol.for("decocms.sandbox.lifecycle.runners"),mu4=Symbol.for("decocms.sandbox.lifecycle.inflight"),XM8=globalThis,$M8=XM8[du4]??={},Y91=XM8[mu4]??={};ru4=Symbol.for("decocms.sandbox.lifecycle.shared-lifecycles"),au4=globalThis,Qw=au4[ru4]??=new Map});async function G7($,Z){let{userId:X,branch:Q,virtualMcpMetadata:Y,explicitKind:G}=Z;if(G)return La($,G);if($.sandboxPreference==="agent-sandbox")return La($,"agent-sandbox");if($.sandboxPreference==="cluster-default")return La($,Iz());let[J,...K]=Zc4(Y,X,Q);if(J)return La($,K.length===0?J:Xc4(J,K));return La($,JM8())}function Zc4($,Z,X){let Q=X9($)[Z]?.[X];if(!Q)return[];let Y=$K(Q);return Object.keys(Y)}function Xc4($,Z){let X=JM8();if(X===$||Z.includes(X))return X;return $}function JM8(){return Iz()}async function La($,Z){let X=Z==="user-desktop"?"agent-sandbox":Z;return{provider:await G91($,X),kind:X}}var ZN=L(()=>{S6();nU();AY();Oa()});var wa;var W91=L(()=>{wa={npm:{install:"npm install",run:($)=>`npm run ${$}`,runtime:"node"},pnpm:{install:"pnpm install",run:($)=>`pnpm run ${$}`,runtime:"node"},yarn:{install:"yarn install",run:($)=>`yarn run ${$}`,runtime:"node"},bun:{install:"bun install",run:($)=>`bun run ${$}`,runtime:"bun"},deno:{install:"deno install",run:($)=>`deno task ${$}`,runtime:"deno"}}});function XN($,Z){return Z?`thread:${$}/${Z}`:`thread:${$}`}function QN($){return`sandbox/thread-${$.replace(/^thread:/,"").replace(/\//g,"-")}`}function xK($){if(!$||!$.startsWith("thread:"))return null;return $.slice(7).split("/")[0]||null}async function Yv($,Z,X){return F91(await H91($,Z),X)}async function H91($,Z){let X=xK(Z);if(!X)return null;return await $.storage.threads.get(X).catch(()=>null)}function F91($,Z){return $?.created_by??Z}async function Gv($,Z){if(!Z)return null;let X=await $.storage.threads.get(Z).catch(()=>null);if(!X)return null;return X.metadata??{}}async function KM8($,Z){let Q=(await Gv($,Z))?.headRef;return typeof Q==="string"&&Q.length>0?Q:null}async function WM8($,Z,X){let Q=await Gv($,Z);if(!Q)return;if(Q.headRef===X)return;await $.storage.threads.update(Z,{metadata:{...Q,headRef:X}}).catch((Y)=>console.warn("[thread-repo] setThreadHeadRef failed",Y))}function Qc4($,Z){let X=FJ0(Z,$.owner,$.name);if(!X||X.id===$.connectionId)return null;let Q=c5(X);return{...$,connectionId:X.id,...Q?.installationId?{installationId:Q.installationId}:{}}}async function Yw($,Z){let X=await Gv($,Z),Q=X?.githubRepo??null;if(!Z||!X||!Q?.connectionId)return Q;try{let Y=$.storage.threads.getOrganizationId();if(!Y)return Q;if(await $.storage.connections.findById(Q.connectionId,Y))return Q;let{items:G}=await $.storage.connections.list(Y),J=Qc4(Q,G);if(!J)return Q;return await $.storage.threads.update(Z,{metadata:{...X,githubRepo:J}}),console.warn("[thread-repo] re-pointed thread at a live repo connection",{threadId:Z,from:Q.connectionId,to:J.connectionId}),J}catch(Y){return console.warn("[thread-repo] repoint check failed",Y),Q}}function U91($){if($.pinnedRef)return $.pinnedRef;if($.runBranch&&$.runBranch===XN($.threadId))return $.runBranch;if($.threadRepo)return XN($.threadId,$.threadRepo.connectionId);if(!$.agentRepo)return"ephemeral";return $.runBranch??`thread:${$.threadId}`}async function N91($,Z){let Q=(await Gv($,Z))?.pinnedRef;return typeof Q==="string"&&Q.length>0?Q:null}async function bP0($,Z){let[X,Q]=await Promise.all([Yw($,Z.threadId),N91($,Z.threadId)]);return U91({...Z,threadRepo:X,pinnedRef:Q})}async function HM8($,Z,X,Q,Y,G){let J=await Gv($,Z);if(!J)return;let K=br(X9(J),X,Q,Y,G);await $.storage.threads.update(Z,{metadata:{...J,sandboxMap:K}}).catch((W)=>console.warn("[thread-repo] setThreadSandboxMapEntry failed",W))}async function yP0($,Z){return X9(await Gv($,Z))}async function FM8($,Z,X,Q,Y){let G=await Gv($,Z);if(!G)return;let J=u41(X9(G),X,Q,Y);if(!J)return;await $.storage.threads.update(Z,{metadata:{...G,sandboxMap:J}}).catch((K)=>console.warn("[thread-repo] removeThreadSandboxMapEntry failed",K))}var fK=L(()=>{HY();AY()});function Au($){if(!$)return null;let Z=$.runtime;if(!Z||typeof Z!=="object")return null;let X=Z.env;if(!Array.isArray(X))return null;let Q=[];for(let Y of X){if(!Y||typeof Y!=="object")continue;let G=Y;if(typeof G.key!=="string"||!qX0.test(G.key))continue;if(G.kind==="literal"&&typeof G.value==="string"){Q.push({key:G.key,kind:"literal",value:G.value});continue}if(G.kind==="secret"&&typeof G.secretId==="string"&&G.secretId.length>0)Q.push({key:G.key,kind:"secret",secretId:G.secretId})}return Q.length===0?null:Q}function UM8($){if(!$)return null;let Z=$.runtime;if(!Z||typeof Z!=="object")return null;let X=Z.submoduleCredentials;if(!Array.isArray(X))return null;let Q=[];for(let Y of X){if(!Y||typeof Y!=="object")continue;let G=Y;if(typeof G.host==="string"&&G.host.length>0&&typeof G.secretId==="string"&&G.secretId.length>0)Q.push({host:G.host,secretId:G.secretId})}return Q}async function NM8($,Z){G0(Z);let X=X0(Z);await Z.access.check();let Q=w1(Z);if(!Q)throw Error("User ID required");let Y=await Z.storage.virtualMcps.findById($.virtualMcpId);if(!Y||Y.organization_id!==X.id)throw Error("Virtual MCP not found");let G=Y.metadata??{},J=X9(G),K=await Yv(Z,$.branch,Q),W=MH(J,K,$.branch,$.sandboxProviderKind);return{virtualMcp:Y,metadata:G,userId:Q,sandboxUserId:K,entry:W,organization:X}}function Yc4($){if($===null||!/^\d+$/.test($))return null;let Z=Number($);return Z>=1&&Z<=65535?$:null}function BM8($){let Z=$.runtime??null,Q=Z?.selected??null,Y=Yc4(Z?.port??null),G=Z?.path??null;if(!Q||!(Q in wa))return{packageManager:null,runtime:null,port:Y,packageManagerPath:G,runtimeBinPath:null};let J=wa[Q].runtime;return{packageManager:Q,runtime:J,port:Y,packageManagerPath:G,runtimeBinPath:J==="deno"?"/opt/deno/bin":J==="bun"?"/opt/bun/bin":null}}var Da=L(()=>{S6();W91();AY();fK()});import{sql as Gc4}from"kysely";function OM8($){return $ instanceof Date?$.toISOString():String($)}class B91{db;vault;constructor($,Z){this.db=$;this.vault=Z}rowToInfo($){return{id:$.id,organizationId:$.organization_id,scope:$.scope,userId:$.user_id,name:$.name,description:$.description,createdBy:$.created_by,createdAt:OM8($.created_at),updatedBy:$.updated_by,updatedAt:OM8($.updated_at)}}assertVisible($,Z){if($.scope==="user"&&$.user_id!==Z)throw new Gw($.id)}async create($){let Z=J4("sec"),X=await this.vault.encrypt($.value),Q=new Date,Y=await this.db.insertInto("secrets").values({id:Z,organization_id:$.organizationId,scope:$.scope.kind,user_id:$.scope.kind==="user"?$.scope.userId:null,name:$.name,encrypted_value:X,description:$.description??null,created_by:$.createdBy,created_at:Q,updated_by:$.createdBy,updated_at:Q}).returning(gP0).executeTakeFirstOrThrow();return this.rowToInfo(Y)}async update($){let Z=await this.db.selectFrom("secrets").where("id","=",$.id).where("organization_id","=",$.organizationId).select(["id","scope","user_id"]).executeTakeFirst();if(!Z)throw new m3($.id);this.assertVisible(Z,$.callerUserId);let X={updated_by:$.updatedBy,updated_at:new Date};if($.value!==void 0)X.encrypted_value=await this.vault.encrypt($.value);if($.description!==void 0)X.description=$.description;let Q=await this.db.updateTable("secrets").set(X).where("id","=",$.id).where("organization_id","=",$.organizationId).returning(gP0).executeTakeFirstOrThrow();return this.rowToInfo(Q)}async delete($,Z,X){let Q=await this.db.selectFrom("secrets").where("id","=",$).where("organization_id","=",Z).select(["id","scope","user_id"]).executeTakeFirst();if(!Q)throw new m3($);this.assertVisible(Q,X),await this.db.deleteFrom("secrets").where("id","=",$).where("organization_id","=",Z).execute()}async list($){let Z=this.db.selectFrom("secrets").where("organization_id","=",$.organizationId).select(gP0);if($.scope?.kind==="user")Z=Z.where("scope","=","user").where("user_id","=",$.scope.userId);else if($.scope?.kind==="organization")Z=Z.where("scope","=","organization");else Z=Z.where((Q)=>Q.or([Q("scope","=","organization"),Q.and([Q("scope","=","user"),Q("user_id","=",$.callerUserId)])]));return(await Z.orderBy("created_at","desc").execute()).map((Q)=>this.rowToInfo(Q))}async findById($,Z,X){let Q=await this.db.selectFrom("secrets").where("id","=",$).where("organization_id","=",Z).select(gP0).executeTakeFirst();if(!Q)throw new m3($);return this.assertVisible(Q,X),this.rowToInfo(Q)}async resolveById($,Z,X){let Q=await this.db.selectFrom("secrets").where("id","=",$).where("organization_id","=",Z).selectAll().executeTakeFirst();if(!Q)throw new m3($);this.assertVisible(Q,X);let Y=await this.vault.decrypt(Q.encrypted_value);return{info:this.rowToInfo(Q),value:Y}}async resolveByName($){let Z=this.db.selectFrom("secrets").where("organization_id","=",$.organizationId).where("scope","=",$.scope.kind).where(Gc4`lower(name) = lower(${$.name})`).selectAll();if($.scope.kind==="user")Z=Z.where("user_id","=",$.scope.userId);let X=await Z.executeTakeFirst();if(!X)throw new m3(`${$.scope.kind}:${$.name}`);let Q=await this.vault.decrypt(X.encrypted_value);return{info:this.rowToInfo(X),value:Q}}}var gP0,m3,Gw;var Ea=L(()=>{UQ();gP0=["id","organization_id","scope","user_id","name","description","created_by","created_at","updated_by","updated_at"];m3=class m3 extends Error{constructor($){super(`Secret ${$} not found`);this.name="SecretNotFoundError"}};Gw=class Gw extends Error{constructor($){super(`Access denied for secret ${$}`);this.name="SecretAccessDeniedError"}}});async function Jw($,Z){let X=$.body?.getReader();if(!X)return $.text();let Q=new TextDecoder,Y="",G=0;for(;;){let{done:J,value:K}=await X.read();if(J)break;if(G+=K.byteLength,G>Z)throw await X.cancel().catch(()=>{}),new LM8(`Upstream response exceeded ${Z} bytes`);Y+=Q.decode(K,{stream:!0})}return Y+=Q.decode(),Y}var LM8;var ja=L(()=>{LM8=class LM8 extends Error{}});async function hP0({ctx:$,runner:Z,handle:X,orgId:Q,userId:Y,entries:G}){if(!G||G.length===0)return;let J={};for(let W of G){if(W.kind==="literal"){J[W.key]=W.value;continue}try{let{value:H}=await $.storage.secrets.resolveById(W.secretId,Q,Y);J[W.key]=H}catch(H){if(H instanceof m3||H instanceof Gw){console.warn(`[SANDBOX_START] skipping env ${W.key}: ${H.message}. Re-link or recreate the secret to restore.`);continue}throw H}}if(Object.keys(J).length===0)return;let K=await Z.proxyDaemonRequest(X,"/_sandbox/config",{method:"PUT",headers:new Headers({"content-type":"application/json"}),body:JSON.stringify({env:J})});if(!K.ok){let W=await Jw(K,Jc4).catch(()=>K.statusText);console.warn(`[SANDBOX_START] daemon rejected env patch (${K.status}): ${W}`)}}var Jc4=10485760;var O91=L(()=>{Ea();ja()});async function wM8({ctx:$,orgId:Z,userId:X,entries:Q}){if(!Q||Q.length===0)return[];let Y=[];for(let G of Q)try{let{value:J}=await $.storage.secrets.resolveById(G.secretId,Z,X);Y.push({host:G.host,token:J})}catch(J){if(J instanceof m3||J instanceof Gw){console.warn(`[SANDBOX_START] skipping submodule credential for ${G.host}: ${J.message}. Re-link or recreate the secret to restore.`);continue}throw J}return Y}var DM8=L(()=>{Ea()});async function zM8($,Z,X,Q,Y){let G=await MG({connectionId:$,tokenStorage:new X5(Q,Y)});if(!G.accessToken)return null;return AM8(Z,X,G.accessToken)}function PM8($,Z){return AM8($,Z,null)}async function AM8($,Z,X){let Q=new Map,Y=new Set(EM8.map((W)=>W.path));for(let W of Object.values(jM8))for(let H of W??[])Y.add(H);await Promise.all(Array.from(Y).map(async(W)=>{Q.set(W,await Wc4($,Z,W,X))}));let G=EM8.find(({path:W})=>Q.get(W)!==null);if(!G)return null;let J=jM8[G.pm]??[],K=null;for(let W of J)if(K=Hc4(Q.get(W)??null),K)break;return{packageManager:G.pm,devPort:K}}async function Wc4($,Z,X,Q){let Y=`https://api.github.com/repos/${$}/${Z}/contents/${encodeURIComponent(X)}`;try{let G={Accept:"application/vnd.github+json","User-Agent":"studio-runtime-detect"};if(Q)G.Authorization=`token ${Q}`;let J=await fetch(Y,{headers:G,signal:AbortSignal.timeout(5000)});if(!J.ok)return null;let K=await J.json();if(!K.content||K.encoding!=="base64")return null;return Buffer.from(K.content,"base64").toString("utf8")}catch{return null}}function Hc4($){if(!$)return null;try{let Z=JSON.parse($),X=Z.tasks??Z.scripts??{},Y=(X.dev??X.start??"").match(Kc4)?.[1]??null;if(!Y)return null;let G=Number(Y);return G>=1&&G<=65535?Y:null}catch{return null}}var EM8,jM8,Kc4;var TM8=L(()=>{c3();f3();EM8=[{path:"deno.json",pm:"deno"},{path:"deno.jsonc",pm:"deno"},{path:"bun.lock",pm:"bun"},{path:"bunfig.toml",pm:"bun"},{path:"pnpm-lock.yaml",pm:"pnpm"},{path:"yarn.lock",pm:"yarn"},{path:"package-lock.json",pm:"npm"},{path:"package.json",pm:"bun"}],jM8={deno:["deno.json","deno.jsonc"],bun:["package.json"],pnpm:["package.json"],yarn:["package.json"],npm:["package.json"]},Kc4=/(?:--port|PORT=|:)(\d{4,5})/});function Fc4($){return($??"").normalize("NFKD").replace(/[\u0300-\u036F]/g,"").toLowerCase().replace(/[^a-z0-9]+/g,"-").replace(/^-+|-+$/g,"")||"user"}function uP0($){return $?.name||$?.email?.split("@")[0]||void 0}function cP0($){let Z=Fc4($),X=Date.now().toString(36).split("").reverse().join("");return`${Z}-${X}`}async function za($,Z,X){try{await $.storage.threads.stampRuntimeIfAbsent(Z,X)}catch(Q){console.warn(`[stampRuntimeIfAbsent] ${Z}: ${Q instanceof Error?Q.message:String(Q)}`)}}function RM8($){let Z=$?.trim();if(!Z)return null;try{let X=new URL(Z);if(X.protocol!=="http:"&&X.protocol!=="https:")return null;return X.href}catch{return null}}function lP0($){return RM8($?.previewServerUrl)??RM8($?.productionUrl)}function Jv($){return $==="cms"||$==="sandbox"?$:null}function Uc4($){return!!lP0($)&&$?.fastPreview===!0}function dP0($){return Uc4($)?"cms":"sandbox"}var L91;var Tu=L(()=>{L91=["cms","sandbox"]});function IM8($){let{current:Z,detached:X,base:Q}=$.status??{};if(typeof Z!=="string"||Z.length===0)return null;if(X===!0)return null;if(Z===$.requestedRef)return null;if(Nc4.has(Z))return null;if(typeof Q==="string"&&Q.length>0&&Z===Q)return null;return Z}function mP0($){if(!$.branch.startsWith("thread:"))return $.branch;if($.sticky&&$.recordedHeadRef)return $.recordedHeadRef;return $.derivedRef}var Nc4;var iP0=L(()=>{Nc4=new Set(["main","master","trunk","develop","HEAD"])});async function qM8($,Z){if(!$)return{hosts:[],allowSameHostDev:!1};let X;try{X=await $.presignedGetUrl("link-dispatch/_allowlist_probe",60,{requireFetchable:!0})}catch{return{hosts:[],allowSameHostDev:!1}}let Q;try{Q=new URL(X)}catch{return{hosts:[],allowSameHostDev:!1}}if(Q.protocol!=="https:"&&Q.protocol!=="http:")return{hosts:[],allowSameHostDev:!1};let Y=Q.hostname,G=Bc4.has(Y);return{hosts:[Y],allowSameHostDev:G&&!Z.isProduction}}var Bc4;var MM8=L(()=>{Bc4=new Set(["127.0.0.1","localhost","::1","[::1]","0.0.0.0"])});import{z as bK}from"zod";async function Ru($,Z){G0(Z);let X=X0(Z),Q=w1(Z);if(!Q)throw Error("User ID required");let Y=await Z.storage.virtualMcps.findById($.virtualMcpId);if(!Y||Y.organization_id!==X.id)throw Error("Virtual MCP not found");let G=Y.metadata??{},J=await Yv(Z,$.branch,Q),K=MH(X9(G),J,$.branch,$.sandboxProviderKind),W=$.sandboxProviderKind,{provider:H}=await G7(Z,{userId:J,branch:$.branch,virtualMcpMetadata:G,explicitKind:W});if(K){if(await H.alive(K.sandboxHandle).catch(()=>!0))return K;await lL(Z.storage.virtualMcps,$.virtualMcpId,Q,J,$.branch,W).catch((w)=>{console.warn("[ensureSandbox] failed to reap stale entry",w)})}let F=xK($.branch)??Z.metadata?.threadId;if(F)za(Z,F,"sandbox");let N=await Yw(Z,F)??G.githubRepo??null,{entry:B}=await kM8({ctx:Z,userId:Q,sandboxUserId:J,orgId:X.id,virtualMcpId:$.virtualMcpId,branch:$.branch,metadata:G,githubRepo:N,existing:null,providerKind:W,runner:H,...$.purpose?{purpose:$.purpose}:{}});return B}async function kM8($){let{ctx:Z,userId:X,sandboxUserId:Q,orgId:Y,virtualMcpId:G,branch:J,metadata:K,existing:W,runner:H,purpose:F}=$,U=F==="harness-run",N=$.githubRepo?await Lc4({ctx:Z,orgId:Y,virtualMcpId:G,userId:X,githubRepo:$.githubRepo}):null,{runtime:B,packageManager:O,port:w,packageManagerPath:D}=BM8(K),E;if(N){if(N.connectionId)await dL({ctx:Z,connectionId:N.connectionId,organizationId:Y,forceRefresh:!0,onLegacyMintError:(t0)=>{console.error("[provisionSandbox] repo-scoped legacy token mint failed",{connectionId:N.connectionId,error:t0.message})}});let{cloneUrl:P0,gitUserName:$0,gitUserEmail:e}=N.connectionId?await mL(N.connectionId,N.owner,N.name,Z.db,Z.vault):gz8(N.owner,N.name);if(!O){let t0=N.connectionId?await zM8(N.connectionId,N.owner,N.name,Z.db,Z.vault):await PM8(N.owner,N.name);if(t0)O=t0.packageManager,B=wa[t0.packageManager].runtime,w=t0.devPort??w,await wc4(Z,G,X,t0.packageManager,t0.devPort)}let A0=o0().sandboxStickyHeadRefEnabled,Q0=mP0({branch:J,derivedRef:QN(J),recordedHeadRef:A0?await KM8(Z,xK(J)):null,sticky:A0}),M0=await wM8({ctx:Z,orgId:Y,userId:X,entries:UM8(K)});E={cloneUrl:P0,...N.connectionId?{connectionId:N.connectionId}:{},userName:$0,userEmail:e,branch:Q0,displayName:`${N.owner}/${N.name}`,submoduleCredentials:M0}}let j=B&&O&&!U?{runtime:B,packageManager:O,...w!==null?{devPort:Number(w)}:{},...D?{packageManagerPath:D}:{}}:void 0,z=xr({orgId:Y,virtualMcpId:G,branch:J}),A=H.kind==="user-desktop"?await qM8(Z.objectStorage,{isProduction:o0().nodeEnv==="production"}):null,P=(H.kind==="user-desktop"||H.kind==="agent-sandbox")&&!o0().orgFsMountsDisabled,I;if(P){let P0=Z.organization?.slug??(await Z.db.selectFrom("organization").select(["slug"]).where("id","=",Y).executeTakeFirst())?.slug;if(P0)I=await HK0(Z,{orgSlug:P0,orgId:Y,baseUrl:s9()})}await Ec4(H);let q=await H.ensure({userId:Q,projectRef:z},{branch:J,repo:E,workload:j,cloneOnly:U,...F?{purpose:F}:{},tenant:{orgId:Y,userId:Q,...Z.organization?.slug?{orgSlug:Z.organization.slug}:{},...Z.organization?.name?{orgName:Z.organization.name}:{},...Z.auth.user?.email?{userEmail:Z.auth.user.email}:{},...Z.auth.user?.name?{userName:Z.auth.user.name}:{}},...A?{offloadAllowedHosts:A.hosts,offloadAllowSameHostDev:A.allowSameHostDev}:{},...I?{orgFsConfigJson:I}:{}}),M=Au(K);await hP0({ctx:Z,runner:H,handle:q.handle,orgId:Y,userId:X,entries:M});let d=!!W&&W.sandboxHandle===q.handle&&W?.createdAt?W.createdAt:Date.now(),f=K.runtime?.selected??null,y=K.runtime?.port??null,o=K.runtime?.path??null,b={sandboxHandle:q.handle,previewUrl:q.previewUrl,sandboxApiUrl:q.previewUrl,sandboxProviderKind:H.kind,createdAt:d,startedWith:{packageManager:f,port:y,path:o}};await Mz8(Z.storage.virtualMcps,G,X,Q,J,$.providerKind,b);let r=xK(J)??Z.metadata?.threadId;if(r)await HM8(Z,r,Q,J,$.providerKind,b);let B0=!W||W.sandboxHandle!==q.handle;return{entry:b,isNewVm:B0}}async function Lc4($){let{ctx:Z,orgId:X,virtualMcpId:Q,userId:Y,githubRepo:G}=$;if(!G.connectionId)return G;if(await Z.storage.connections.findById(G.connectionId,X))return G;let{items:K}=await Z.storage.connections.list(X),W=FJ0(K,G.owner,G.name);if(!W)return console.warn("[provisionSandbox] recorded repo connection no longer exists and no live connection covers the repo",{virtualMcpId:Q,connectionId:G.connectionId}),G;console.warn("[provisionSandbox] healed dangling repo connection",{virtualMcpId:Q,staleConnectionId:G.connectionId,connectionId:W.id});try{let F=(await Z.storage.virtualMcps.findById(Q))?.metadata??{},U=F.githubRepo;if(U?.connectionId===G.connectionId){let N=c5(W);await Z.storage.virtualMcps.update(Q,Y,{metadata:{...F,githubRepo:{...U,connectionId:W.id,...N?{installationId:N.installationId}:{}}}})}}catch(H){console.warn("[provisionSandbox] failed to persist healed repo connection",{virtualMcpId:Q,error:H.message})}return{...G,connectionId:W.id}}async function wc4($,Z,X,Q,Y){let G=await $.storage.virtualMcps.findById(Z);if(!G)return;let J=G.metadata??{};await $.storage.virtualMcps.update(Z,X,{metadata:{...J,runtime:{selected:Q,port:Y}}})}async function Ec4($){if(!$.hasSchedulableCapacity)return;let Z=Date.now()+VM8,X=!1;while(!await $.hasSchedulableCapacity()){if(Date.now()>=Z)throw Error(`sandbox provisioning failed: the cluster has had no room to schedule another sandbox for ${Math.round(VM8/1000)}s`);if(!X)X=!0,console.warn("[ensureSandbox] waiting for cluster capacity \u2014 a sandbox pod cannot be scheduled right now");await N8(Dc4)}}var Oc4,w91,VM8=150000,Dc4=5000;var Pa=L(()=>{nU();B4();m0();Da();O91();DM8();AY();HY();Yu();TM8();W91();ZN();Tu();fK();iP0();MM8();_8();L9();Gu();AY();Oc4=bK.enum(["agent-sandbox","user-desktop","cluster"]),w91=m({name:"SANDBOX_START",description:"Start a sandbox with the connected GitHub repo and dev server.",annotations:{title:"Start VM Preview",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!1,openWorldHint:!0},_meta:{ui:{visibility:"app"}},inputSchema:bK.object({virtualMcpId:bK.string().describe("Virtual MCP ID"),branch:bK.string().min(1).optional().describe("Git branch to check out. Pass the thread's branch whenever the caller has one: when omitted the handler mints a fresh `<user-slug>-<timestamp>` name, which becomes a SEPARATE sandbox from the one the thread's own branch resolves to. The resolved branch is returned in the response so callers can persist it."),sandboxProviderKind:Oc4.optional().describe("Explicit runtime choice. Hosted provider is `agent-sandbox`; legacy `cluster` input is accepted only for compatibility and normalized to `agent-sandbox`. When omitted, defaults to `user-desktop` if the acting user's link daemon is online, else the env kind."),threadId:bK.string().optional().describe("The session asking for a sandbox. A thread stamped `cms` is refused \u2014 that session reads and writes over the decofile API and a pod would be invisible to it. Optional: an unstamped (legacy) thread is always allowed, and so is a caller with no thread.")}),outputSchema:bK.object({previewUrl:bK.string().nullable(),sandboxHandle:bK.string(),branch:bK.string(),isNewVm:bK.boolean(),sandboxProviderKind:bK.enum(["agent-sandbox","user-desktop"])}),handler:async($,Z)=>{G0(Z);let X=X0(Z);await Z.access.check();let Q=$.branch??cP0(uP0(Z.auth.user)),Y=xK(Q)??$.threadId??Z.metadata?.threadId;if(Y){let E=await Z.storage.threads.get(Y).catch(()=>null);if(Jv(E?.metadata?.runtime)==="cms")throw Error("This chat is a CMS session and does not use a sandbox. Start a coding session to get one.")}let G=w1(Z);if(!G)throw Error("User ID required");let J=await Yv(Z,Q,G),K=await Z.storage.virtualMcps.findById($.virtualMcpId);if(!K||K.organization_id!==X.id)throw Error("Virtual MCP not found");let W=K.metadata??{},H=$.sandboxProviderKind?Tz($.sandboxProviderKind):void 0,{provider:F,kind:U}=await G7(Z,{userId:J,branch:Q,virtualMcpMetadata:W,explicitKind:H}),N=MH(X9(W),J,Q,U),O=await Yw(Z,xK(Q)??Z.metadata?.threadId)??W.githubRepo??null,{entry:w,isNewVm:D}=await kM8({ctx:Z,userId:G,sandboxUserId:J,orgId:X.id,virtualMcpId:$.virtualMcpId,branch:Q,metadata:W,githubRepo:O,existing:N,providerKind:U,runner:F});if(Y)za(Z,Y,"sandbox");return{...w,branch:Q,isNewVm:D,sandboxProviderKind:U}}})});function jc4($){let{publicUrl:Z,agentId:X,organization:Q,target:Y,threadId:G}=$;if(Y==="agent-tools")return`${Z}/mcp/virtual-mcp/${X}`;if(!Q.slug)throw new CM8(Q.id,Y);if(Y==="task-run"){if(!G)throw Error("a task-run MCP endpoint is scoped to a run: threadId is required");return`${Z}/api/${Q.slug}/mcp/task-run/${encodeURIComponent(G)}`}return`${Z}/api/${Q.slug}/mcp/self`}async function pP0($,Z,X,Q,Y="agent-tools",G,J={"*":["*"]}){let K=jc4({publicUrl:s9(),agentId:Z,organization:X,target:Y,...G?{threadId:G}:{}}),W=await $.boundAuth.apiKey.create({name:Q,permissions:J,expiresIn:SM8,metadata:{organization:{id:X.id,slug:X.slug,name:X.name}}});return{url:K,headers:{Authorization:`Bearer ${W.key}`,"x-org-id":X.id},expiresAt:Date.now()+SM8*1000}}function _M8($){let{publicUrl:Z,organizationSlug:X,headers:Q,connections:Y}=$,G=new Set;return Y.map((J)=>{let K=zc4(J.slug??J.title??"")||"mcp",W=K;for(let H=2;G.has(W);H++)W=`${K}-${H}`;return G.add(W),{name:W,url:`${Z}/api/${X}/mcp/${encodeURIComponent(J.id)}`,headers:Q}})}function zc4($){return $.toLowerCase().replace(/[^a-z0-9]+/g,"-").replace(/^-+|-+$/g,"")}function vM8($){return{self:[...$.toolNames],...$.grants}}var SM8=3600,CM8;var D91=L(()=>{L9();CM8=class CM8 extends Error{constructor($,Z){super(`cannot mint a "${Z}" MCP endpoint for organization "${$}": the org-scoped path needs the org slug, which was not loaded.`);this.name="MissingOrganizationSlugError"}}});async function Pc4($,Z,X,Q){try{let Y=$.organization;if(!Y)return;let G=await pP0($,Q.virtualMcpId,Y,"tool-scripting"),J=await Z.proxyDaemonRequest(X,"/_sandbox/tools/sync",{method:"POST",headers:new Headers({"content-type":"application/json"}),body:JSON.stringify(G)});if(!J.ok)console.warn("[cluster-sandbox-fs] tools/sync failed",J.status,await J.text().catch(()=>""))}catch(Y){console.warn("[cluster-sandbox-fs] tools/sync failed",Y)}}async function Iu($,Z){let{provider:X,kind:Q}=await G7($,{userId:Z.userId,branch:Z.branch,virtualMcpMetadata:null}),Y=null,G=()=>{if(!Y){if(Y=Ru({virtualMcpId:Z.virtualMcpId,branch:Z.branch,sandboxProviderKind:Q},$).then((W)=>W.sandboxHandle),Y.catch(()=>{Y=null}),Z.syncTools)Y.then((W)=>Pc4($,X,W,{virtualMcpId:Z.virtualMcpId,providerKind:Q})).catch(()=>{})}return Y},J=Z.branch==="ephemeral"||Q==="user-desktop";return h41(X,{ensureHandle:G,invalidateHandle:async(W)=>{let H=Y;if(Y=null,!J&&!W?.force)return;try{await lL($.storage.virtualMcps,Z.virtualMcpId,Z.userId,Z.userId,Z.branch,Q)}catch(F){console.warn("[cluster-sandbox-fs] failed to reap vmMap entry",F)}if(H&&typeof X.forgetHandle==="function")try{let F=await H;await X.forgetHandle(F)}catch(F){console.warn("[cluster-sandbox-fs] forgetHandle failed",F)}},canAutoRestart:J,threadId:Z.threadId})}async function xM8($,Z){try{let X=await Iu($,Z),{stdout:Q}=await X.onBash("test -d .deco && echo __DECO_SITE__");return Q.includes("__DECO_SITE__")}catch(X){return console.warn("[cluster-sandbox-fs] .deco probe failed; assuming deco site",X),!0}}var nP0=L(()=>{nU();D91();ZN();Pa();AY()});import{z as fM8}from"zod";function qu($){let Z=[];for(let X of $){if(X.status!=="active")continue;let Q=c5(X);if(!Q)continue;Z.push({connectionId:X.id,owner:Q.owner,repo:Q.repo,installationId:Q.installationId})}return Z}async function Tc4($,Z){let{items:X}=await $.storage.connections.list(Z,{slug:"mcp-github"});return qu(X)}function Rc4($){let Z=$.split(`
 `).map((Q)=>Q.trim()).filter((Q)=>Q&&Q!==".git"&&Q!=="__CLONED__"),X=Z.length>0;return{cloned:X,listing:X?Z.join(`
 `):""}}function Ic4($){let Z="Load a GitHub repository into this conversation's sandbox so the file tools (read/write/edit/bash/grep/glob) and dev server operate on that repo, and open its live Preview. Waits until the repo is cloned before returning. Calling it again switches the repo. File tools operate on the loaded repo from your NEXT message (this turn's tools are still bound to the previous workspace), so after loading, prefer the file listing this tool returns over re-running bash in the same turn.",X=$.map((Q)=>`- ${Q.owner}/${Q.repo} (connectionId: ${Q.connectionId})`).join(`
 `);return`${Z}