decocms 4.262.0 → 4.262.2

package/dist/server/server.js

@@ -888,7 +888,7 @@ You are the Usage Manager. You analyze how this workspace is actually used \u201
    d. Report the failing tool/connection, error pattern, and suggest the fix or owner.
 </workflows>`,lo1={id:"studio-usage-manager",title:"Usage Manager",icon:"icon://BarChart10?color=blue",description:"Analyze usage, costs, and clean up idle agents and connections",selectedTools:["MONITORING_STATS","MONITORING_LOGS_LIST","MONITORING_LOG_GET","MONITORING_THREAD_USAGE","COLLECTION_VIRTUAL_MCP_LIST","COLLECTION_VIRTUAL_MCP_GET","COLLECTION_VIRTUAL_MCP_DELETE","VIRTUAL_MCP_LAST_USED_LIST","COLLECTION_CONNECTIONS_LIST","COLLECTION_CONNECTIONS_GET","COLLECTION_CONNECTIONS_DELETE","ORGANIZATION_MEMBER_LIST"],selectedConnections:null,selectedPrompts:[],instructions:dt8,getId:RQ.USAGE_MANAGER}});function Dc0($){return cw.find((Z)=>$.startsWith(`${Z.id}_`))??null}async function it8($,Z){if("resolveRuntime"in $)return $.resolveRuntime(Z);return{instructions:$.instructions,selectedTools:$.selectedTools}}async function r50({virtualMcp:$,agentId:Z=$.id,organizationId:X,ctx:Q}){let Y=Dc0(Z);if(!Y)return $;let G=await it8(Y,{orgId:X,ctx:Q}),J=G.selectedTools?[...G.selectedTools]:null;return{...$,metadata:{...$.metadata??{},instructions:G.instructions},connections:$.connections.map((W)=>({...W,selected_tools:J}))}}async function a50($,Z){if(!("checklist"in $))return[];return Promise.all($.checklist.map(async(X)=>({label:X.label,activeForm:X.activeForm,action:X.action,completed:await X.isCompleted(Z),alwaysSuggest:X.alwaysSuggest})))}async function mo1($,Z,X){let Q={self:g8.SELF($),registry:g8.REGISTRY($),"community-registry":g8.COMMUNITY_REGISTRY($)};await Promise.all(mt8.map((Y)=>X.delete(`${Y}${$}`))),await Promise.all(cw.map(async(Y)=>{let G=Y.getId($),J=await X.findById(G,$),K=(Y.selectedConnections??["self"]).map((H)=>Q[H]);if(J){await X.update(G,Z,{metadata:{...J.metadata??{},instructions:Y.instructions},connections:K.map((H)=>{let F=J.connections.find((N)=>N.connection_id===H);return{connection_id:H,selected_tools:Y.selectedTools?[...Y.selectedTools]:null,selected_resources:F?.selected_resources??null,selected_prompts:F?.selected_prompts??null}})});return}await X.create($,Z,{title:Y.title,description:Y.description,icon:Y.icon,status:"active",pinned:!1,metadata:{instructions:Y.instructions},connections:K.map((H)=>({connection_id:H,selected_tools:Y.selectedTools?[...Y.selectedTools]:null,selected_resources:null,selected_prompts:Y.selectedPrompts?[...Y.selectedPrompts]:null}))},{id:G})}))}var mt8,cw;var Vx=D(()=>{P8();ko1();So1();_o1();yo1();ho1();co1();do1();mt8=["studio-task-manager_"],cw=[xo1,Mo1,Co1,go1,Vo1,uo1,lo1]});import{DBOS as s50}from"@dbos-inc/dbos-sdk";async function pt8($){let Z=l8(),X=new Nb(Z.db);await mo1($.orgId,$.createdBy,X)}async function nt8($){let Z=l8(),X=new Nb(Z.db);for(let Q of cw){let Y=Q.getId($.orgId),G=await X.findById(Y,$.orgId);if(!G)continue;let J=Q.selectedPrompts?[...Q.selectedPrompts]:null;if(G.connections.every((K)=>{let H=K.selected_prompts;if(J===null)return H===null;if(H===null)return!1;if(H.length!==J.length)return!1;return H.every((F,N)=>F===J[N])}))continue;await X.update(Y,$.createdBy,{connections:G.connections.map((K)=>({connection_id:K.connection_id,selected_tools:K.selected_tools,selected_resources:K.selected_resources,selected_prompts:J}))})}}async function tt8($){await s50.runStep(()=>pt8($),{name:"installStudioPack"}),await s50.runStep(()=>nt8($),{name:"backfillSelectedPrompts"})}async function Lc0($){await s50.startWorkflow(ot8,{workflowID:`install-studio-pack:${rt8}:${$.orgId}`})($)}async function io1(){let Z=await l8().db.selectFrom("member").select(["organizationId","userId"]).orderBy("createdAt","asc").execute(),X=new Map;for(let Q of Z)if(!X.has(Q.organizationId))X.set(Q.organizationId,Q.userId);await o50(Array.from(X),10,async([Q,Y])=>{try{await Lc0({orgId:Q,createdBy:Y})}catch(G){console.error("[studio-pack-backfill] enqueue failed",{orgId:Q},G)}})}var ot8,rt8="v6";var e50=D(()=>{gG();ky0();Vx();ot8=s50.registerWorkflow(tt8,{name:"installStudioPackWorkflow"})});class Mi{constructor(){this._messageQueue=[]}static createLinkedPair(){let $=new Mi,Z=new Mi;return $._otherTransport=Z,Z._otherTransport=$,[$,Z]}async start(){while(this._messageQueue.length>0){let $=this._messageQueue.shift();this.onmessage?.($.message,$.extra)}}async close(){let $=this._otherTransport;this._otherTransport=void 0,await $?.close(),this.onclose?.()}async send($,Z){if(!this._otherTransport)throw Error("Not connected");if(this._otherTransport.onmessage)this._otherTransport.onmessage($,{authInfo:Z?.authInfo});else this._otherTransport._messageQueue.push({message:$,extra:{authInfo:Z?.authInfo}})}}import{z as X4}from"zod";var $90,po1,no1,to1,oo1,ro1,ao1,so1,eo1,$r1;var Sx=D(()=>{$90=X4.record(X4.string(),X4.array(X4.string())),po1=X4.object({id:X4.string().describe("Unique identifier for the API key"),name:X4.string().describe("Human-readable name for the API key"),userId:X4.string().describe("ID of the user who owns this API key"),permissions:$90.describe('Permissions granted to this API key. Format: { resource: [actions] } where resource is "self" for management tools or "conn_<UUID>" for connection-specific tools. Example: { "self": ["API_KEY_CREATE"], "conn_abc123": ["SEND_MESSAGE"] }'),expiresAt:X4.string().datetime().nullable().optional().describe("Expiration date of the API key (ISO 8601)"),createdAt:X4.string().datetime().describe("When the API key was created (ISO 8601)")}),no1=X4.object({name:X4.string().min(1).max(64).describe("Human-readable name for the API key"),permissions:$90.describe(`Permissions to grant (REQUIRED \u2014 there is no implicit default). Format: { resource: [actions] }. Resource is "self" for management tools or "conn_<UUID>" for connection-specific tools. Actions are tool names (e.g., ["ORGANIZATION_GET"]) or ["*"] for all. Example: { "self": ["ORGANIZATION_GET", "COLLECTION_CONNECTIONS_LIST"] }. The key is authorized solely by this allowlist; the creator's role does not widen it.`),expiresIn:X4.number().positive().optional().describe("Expiration time in seconds. If not provided, key never expires."),metadata:X4.record(X4.string(),X4.unknown()).optional().describe("Additional metadata to store with the API key")}),to1=X4.object({id:X4.string().describe("Unique identifier for the API key"),name:X4.string().describe("Human-readable name for the API key"),key:X4.string().describe("The actual API key value. STORE THIS SECURELY - it will not be shown again!"),permissions:$90.describe('Permissions granted to this API key. Format: { resource: [actions] } where resource is "self" for management tools or "conn_<UUID>" for connection-specific tools'),expiresAt:X4.string().datetime().nullable().optional().describe("Expiration date of the API key (ISO 8601)"),createdAt:X4.string().datetime().describe("When the API key was created (ISO 8601)")}),oo1=X4.object({}),ro1=X4.object({items:X4.array(po1).describe("List of API keys (without key values)")}),ao1=X4.object({keyId:X4.string().describe("ID of the API key to update"),name:X4.string().min(1).max(64).optional().describe("New name for the API key"),permissions:$90.optional().describe('New permissions. Format: { resource: [actions] } where resource is "self" for management tools or "conn_<UUID>" for connection-specific tools. Actions are tool names or "*" for all. Example: { "self": ["API_KEY_CREATE"] }. Replaces existing permissions.'),metadata:X4.record(X4.string(),X4.unknown()).optional().describe("New metadata. Replaces existing metadata.")}),so1=X4.object({item:po1.describe("The updated API key (without key value)")}),eo1=X4.object({keyId:X4.string().describe("ID of the API key to delete")}),$r1=X4.object({success:X4.boolean().describe("Whether the deletion was successful"),keyId:X4.string().describe("ID of the deleted API key")})});var wc0;var Zr1=D(()=>{C4();S0();Sx();wc0=c({name:"API_KEY_CREATE",description:"Create an API key with scoped permissions. The key value is returned only once \u2014 store it immediately.",annotations:{title:"Create API Key",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!1,openWorldHint:!1},inputSchema:no1,outputSchema:to1,handler:async($,Z)=>{r(Z),await Z.access.check();let X=await Z.boundAuth.apiKey.create({name:$.name,permissions:$.permissions,expiresIn:$.expiresIn,metadata:{...$.metadata,organization:Z.organization}}),Q=X.expiresAt?X.expiresAt instanceof Date?X.expiresAt.toISOString():X.expiresAt:null,Y=X.createdAt instanceof Date?X.createdAt.toISOString():X.createdAt,G=Y1(Z);if(G)y1.capture({distinctId:G,event:"api_key_created",...Z.organization?.id?{groups:{organization:Z.organization.id}}:{},properties:{key_id:X.id,key_name:X.name??$.name,organization_id:Z.organization?.id,has_expiry:!!Q}});return{id:X.id,name:X.name??$.name,key:X.key,permissions:X.permissions??{},expiresAt:Q,createdAt:Y}}})});var Ec0;var Xr1=D(()=>{C4();S0();Sx();Ec0=c({name:"API_KEY_DELETE",description:"Delete and instantly revoke an API key. Cannot be undone.",annotations:{title:"Delete API Key",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:eo1,outputSchema:$r1,handler:async($,Z)=>{r(Z),await Z.access.check();let X=Y1(Z);if(!X)throw Error("User ID required to delete API key");let Y=(await Z.boundAuth.apiKey.list())?.find((K)=>K.id===$.keyId);if(!Y)throw Error("API key not found");let J=Y.metadata?.organization?.id,W=Z.organization?.id;if(J!==W)throw Error("Cannot delete API key from another organization");if(await Z.boundAuth.apiKey.delete($.keyId),W)y1.capture({distinctId:X,event:"api_key_deleted",groups:{organization:W},properties:{key_id:$.keyId,organization_id:W}});return{success:!0,keyId:$.keyId}}})});var jc0;var Qr1=D(()=>{S0();Sx();jc0=c({name:"API_KEY_LIST",description:"List API keys for the current user in the current organization. Returns metadata only \u2014 key values are never shown after creation.",annotations:{title:"List API Keys",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:oo1,outputSchema:ro1,handler:async($,Z)=>{r(Z),await Z.access.check();let X=await Z.boundAuth.apiKey.list(),Q=Z.organization?.id;return{items:(X??[]).filter((G)=>{return G.metadata?.organization?.id===Q}).map((G)=>({id:G.id,name:G.name??"Unnamed Key",userId:G.userId,permissions:G.permissions??{},expiresAt:G.expiresAt?G.expiresAt instanceof Date?G.expiresAt.toISOString():G.expiresAt:null,createdAt:G.createdAt instanceof Date?G.createdAt.toISOString():G.createdAt}))}}})});var zc0;var Yr1=D(()=>{S0();Sx();zc0=c({name:"API_KEY_UPDATE",description:"Update an API key's name, permissions, or metadata. The key value cannot be changed or retrieved.",annotations:{title:"Update API Key",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:ao1,outputSchema:so1,handler:async($,Z)=>{if(r(Z),await Z.access.check(),!Y1(Z))throw Error("User ID required to update API key");let Y=(await Z.boundAuth.apiKey.list())?.find((H)=>H.id===$.keyId);if(!Y)throw Error(`API key not found: ${$.keyId}`);let J=Y.metadata?.organization?.id,W=Z.organization?.id;if(J!==W)throw Error("Cannot update API key from another organization");let K=await Z.boundAuth.apiKey.update({keyId:$.keyId,name:$.name,permissions:$.permissions,metadata:{...$.metadata,organization:Z.organization}});if(!K)throw Error(`Failed to update API key: ${$.keyId}`);return{item:{id:K.id,name:K.name??$.name??"Unnamed Key",userId:K.userId,permissions:K.permissions??{},expiresAt:K.expiresAt?K.expiresAt instanceof Date?K.expiresAt.toISOString():K.expiresAt:null,createdAt:K.createdAt instanceof Date?K.createdAt.toISOString():K.createdAt}}}})});var Gr1=D(()=>{Zr1();Xr1();Qr1();Yr1();Sx()});function VO($){let Z=$.trim();if(!Z)return{ok:!1,error:"Enter a website URL."};let X=st8.test(Z),Q=et8.test(Z),Y=$o8.test(Z);if(X&&!Q&&!Y)return{ok:!1,error:"Use an HTTP or HTTPS website URL."};let G=Q?Z:`https://${Z}`,J;try{J=new URL(G)}catch{return{ok:!1,error:"Enter a valid website URL."}}if(J.protocol!=="http:"&&J.protocol!=="https:")return{ok:!1,error:"Use an HTTP or HTTPS website URL."};let W=J.hostname.split(".");if(W.length<2||W.some((K)=>!K||!Zo8.test(K)))return{ok:!1,error:"Enter a valid website URL."};return J.protocol="https:",{ok:!0,value:J.origin}}var st8,et8,$o8,Zo8;var ki=D(()=>{st8=/^[a-zA-Z][a-zA-Z\d+.-]*:/,et8=/^[a-zA-Z][a-zA-Z\d+.-]*:\/\//,$o8=/^[^\s/:?#]+\.[^\s/:?#]+:\d+(?:[/?#]|$)/,Zo8=/^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/i});import{z as mX}from"zod";function QK($){if($.baseUrl)return $.baseUrl.replace(/\/+$/,"");return(($.settings??b0()).reportsInternalApiUrl??Xo8).replace(/\/+$/,"")}function Wr1($={}){return`${QK($)}/api/v2/mcp`}function lw($){let Z=$.apiKey??($.settings??b0()).reportsInternalApiKey;if(!Z)throw Error("REPORTS_INTERNAL_API_KEY (or the legacy COMMERCE_DISCOVERY_INTERNAL_API_KEY) is required to set up reports.");return Z}function Z90($){return new URL($).hostname}function Yo8($){return $==="ownership_unverified"||$==="already_claimed_by_other_org"}function Go8($,Z={}){switch($){case"ownership_unverified":{let X=Z.email?`O e-mail ${Z.email}`:"Este e-mail",Q=Z.domain?` ${Z.domain}`:" este site";return`${X} n\xE3o tem permiss\xE3o para reivindicar${Q}. Use um e-mail do dom\xEDnio do site ou pe\xE7a ao suporte para autorizar seu dom\xEDnio.`}case"already_claimed_by_other_org":return"Este site j\xE1 pertence a outra organiza\xE7\xE3o. Fale com o suporte para transferir o acesso.";case"unknown":return"N\xE3o foi poss\xEDvel configurar o Commerce Discovery. Tente novamente ou fale com o suporte.";default:return $}}async function Jo8($){let Z=await Vi($);return Yo8(Z?.error)?Z.error:"unknown"}async function Vi($){let Z=await $.text().catch(()=>"");if(!Z)return;try{return JSON.parse(Z)}catch{return}}async function Pc0($){let Z=`Commerce Discovery auth failed with status ${$.status}.`,X=await $.text().catch(()=>"");if(!X)return Z;try{let Q=JSON.parse(X),Y=typeof Q.error==="string"?Q.error:typeof Q.message==="string"?Q.message:null;return Y?`Commerce Discovery auth failed: ${Y}.`:Z}catch{return Z}}async function Hr1($,Z={}){let X=QK(Z),Q=lw(Z),Y=Z.fetchImpl??fetch,G=Z90($.siteUrl),J=`${X}/api/v2/internal/diagnostics/${encodeURIComponent(G)}/upgrade`,W=await Y(J,{method:"POST",headers:{Authorization:`Bearer ${Q}`,"Content-Type":"application/json"},body:JSON.stringify({org_id:$.orgId,...$.orgName?{name:$.orgName}:{},...$.email?{email:$.email}:{},...$.reportUrl?{report_url:$.reportUrl}:{}})});if(!W.ok){let H=await Jo8(W);throw new Kr1(H,{email:$.email,domain:G})}let K=Qo8.safeParse(await Vi(W));if(!K.success)throw Error("Commerce Discovery auth response did not include a token.");return{authorizationToken:K.data.token}}async function Fr1($,Z={}){let X=QK(Z),Q=lw(Z),Y=Z.fetchImpl??fetch,G=Z90($.siteUrl),J=`${X}/api/v2/internal/diagnostics/${encodeURIComponent(G)}/bindings`,W=await Y(J,{method:"POST",headers:{Authorization:`Bearer ${Q}`,"Content-Type":"application/json"},body:JSON.stringify({org_id:$.orgId,provider:$.provider,resource_id:$.resourceId})});if(W.status===409)return{ok:!1,reason:"resource_already_bound",detail:"Este recurso j\xE1 est\xE1 vinculado a outra loja. Se ele \xE9 seu, fale com o suporte para revis\xE3o manual."};if(W.status===422){let H=Jr1.safeParse(await Vi(W));return{ok:!1,reason:H.success?H.data.reason??"verification_failed":"verification_failed",detail:(H.success?H.data.detail:void 0)??"N\xE3o foi poss\xEDvel verificar o acesso a este recurso."}}if(!W.ok)throw Error(await Pc0(W));let K=Jr1.safeParse(await Vi(W));if(!K.success||!K.data.binding)throw Error("Commerce Discovery bind response did not include a binding.");return{ok:!0,resourceId:K.data.binding.resource_id,evidence:K.data.binding.evidence}}async function Nr1($,Z={}){let X=QK(Z),Q=lw(Z),Y=Z.fetchImpl??fetch,G=Z90($.siteUrl),J=`${X}/api/v2/internal/diagnostics/${encodeURIComponent(G)}/run`,W=await Y(J,{method:"POST",headers:{Authorization:`Bearer ${Q}`,"Content-Type":"application/json"},body:JSON.stringify({org_id:$.orgId,...$.githubRepo?{github_repo:$.githubRepo}:{}})});if(W.status===409)return{triggered:!1,reason:"not_upgraded"};if(!W.ok)throw Error(await Pc0(W));return{triggered:!0}}async function Ur1($,Z={}){let X=QK(Z),Q=lw(Z),Y=Z.fetchImpl??fetch,G=Z90($.siteUrl),J=`${X}/api/v2/internal/diagnostics/${encodeURIComponent(G)}/connections/status?org_id=${encodeURIComponent($.orgId)}`,W=await Y(J,{method:"GET",headers:{Authorization:`Bearer ${Q}`}});if(W.status===404||W.status===409)return{providers:{},claimed:!1};if(!W.ok)throw Error(await Pc0(W));let K=Wo8.safeParse(await Vi(W));return{providers:K.success?K.data.providers:{},claimed:!0}}var Xo8,Qo8,Jr1,Kr1,Wo8;var dw=D(()=>{P8();q$();Xo8=new URL(my1).origin,Qo8=mX.object({token:mX.string().min(1)}),Jr1=mX.object({binding:mX.object({resource_id:mX.string(),evidence:mX.string()}).optional(),reason:mX.string().optional(),detail:mX.string().optional()});Kr1=class Kr1 extends Error{code;constructor($,Z={}){super(Go8($,Z));this.name="CommerceDiscoveryClaimError",this.code=$}};Wo8=mX.object({providers:mX.record(mX.string(),mX.object({connected:mX.boolean(),via:mX.enum(["oauth","sa"]).nullable(),resource:mX.string().nullable()}))})});import{z as bY}from"zod";var Ko8,Ho8,Ac0;var Or1=D(()=>{ki();S0();dw();Ko8=bY.object({siteUrl:bY.string().min(1).describe("Website URL of the store being bound."),provider:bY.enum(["ga4","gsc"]).describe("Which Google source to bind: ga4 (Analytics) or gsc (Search Console)."),resourceId:bY.string().min(1).describe("The resource id the client typed: GA4 numeric property id, or GSC site (sc-domain:example.com or https://example.com/).")}),Ho8=bY.discriminatedUnion("ok",[bY.object({ok:bY.literal(!0),resourceId:bY.string(),evidence:bY.string()}),bY.object({ok:bY.literal(!1),reason:bY.string(),detail:bY.string()})]),Ac0=c({name:"COMMERCE_DISCOVERY_BIND",description:"Bind a GA4 property or GSC site to the org's store via the shared service account (consent-free lane). The client grants deco-reader@\u2026 access to the resource and provides its id; Commerce Discovery verifies the resource belongs to this domain before persisting. Returns ok:false with an actionable pt-BR detail when verification fails or the resource is already bound elsewhere.",annotations:{title:"Bind Commerce Discovery Data Source",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!0},inputSchema:Ko8,outputSchema:Ho8,handler:async($,Z)=>{r(Z);let X=t(Z);await Z.access.check();let Q=VO($.siteUrl);if(!Q.ok)throw Error(Q.error);return Fr1({siteUrl:Q.value,orgId:X.id,provider:$.provider,resourceId:$.resourceId.trim()})}})});import{z as YK}from"zod";var Fo8,No8,Tc0;var Br1=D(()=>{ki();S0();dw();Fo8=YK.object({siteUrl:YK.string().min(1).describe("Website URL of the store to inspect.")}),No8=YK.object({providers:YK.record(YK.string(),YK.object({connected:YK.boolean(),via:YK.enum(["oauth","sa"]).nullable(),resource:YK.string().nullable()})),claimed:YK.boolean().describe("False when the site isn't claimed/upgraded for this org \u2014 providers is then empty because the status is unreadable, NOT because nothing is connected. The UI must warn instead of rendering existing bindings as disconnected.")}),Tc0=c({name:"COMMERCE_DISCOVERY_CONNECTION_STATUS",description:"Read per-provider connection status (ga4/gsc/vtex) for the org's store \u2014 { connected, via: oauth|sa, resource }. The single source of truth for whether a data source is connected, unifying the OAuth (Studio vault) and shared-SA binding lanes. Read-only.",annotations:{title:"Commerce Discovery Connection Status",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!0},inputSchema:Fo8,outputSchema:No8,handler:async($,Z)=>{r(Z);let X=t(Z);await Z.access.check();let Q=VO($.siteUrl);if(!Q.ok)throw Error(Q.error);return Ur1({siteUrl:Q.value,orgId:X.id})}})});import{z as Si}from"zod";var Uo8,Oo8,Rc0;var Dr1=D(()=>{P8();ki();S0();dw();Uo8=Si.object({siteUrl:Si.string().min(1).describe("Website URL to run the diagnostic for.")}),Oo8=Si.object({triggered:Si.boolean(),reason:Si.string().optional()}),Rc0=c({name:"COMMERCE_DISCOVERY_RUN",description:"Trigger the Commerce Discovery diagnostic run for the current organization's store. Call once the data sources (GA4/GSC/VTEX) are connected \u2014 this run resolves credentials and produces the enriched report.",annotations:{title:"Run Commerce Discovery",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!0},inputSchema:Uo8,outputSchema:Oo8,handler:async($,Z)=>{r(Z);let X=t(Z);await Z.access.check();let Q=VO($.siteUrl);if(!Q.ok)throw Error(Q.error);let Y=g8.COMMERCE_DISCOVERY(X.id),J=(await Z.storage.connections.findById(Y,X.id))?.configuration_state,W=J&&typeof J==="object"&&typeof J.github_repo==="string"&&J.github_repo.length>0?J.github_repo:void 0;return Nr1({siteUrl:Q.value,orgId:X.id,githubRepo:W})}})});var SO=D(()=>{Y80()});import{z as GK}from"zod";async function wo8($,Z,X,Q){let Y=await $.storage.connections.findById(Z,X);if(Y)return Y;throw Q}async function Eo8($,Z,X,Q){let Y=await $.storage.virtualMcps.findById(Z,X);if(Y)return Y;throw Q}var Ic0,Bo8=3600000,Do8,Lo8,qc0;var Lr1=D(()=>{P8();ki();S0();yW();SO();dw();Ic0=R40,Do8=GK.object({siteUrl:GK.string().min(1).describe("Website URL to configure.")}),Lo8=GK.object({connection:g7,virtualMcp:h7,reportApp:GK.object({connectionId:GK.string(),virtualMcpId:GK.string(),toolName:GK.literal(Ic0)}),created:GK.object({connection:GK.boolean(),virtualMcp:GK.boolean()})});qc0=c({name:"COMMERCE_DISCOVERY_SETUP",description:"Create or return the Commerce Discovery connection and virtual MCP for the current organization.",annotations:{title:"Set Up Commerce Discovery",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:Do8,outputSchema:Lo8,handler:async($,Z)=>{r(Z);let X=t(Z);await Z.access.check("COLLECTION_CONNECTIONS_CREATE");let Q=Y1(Z);if(!Q)throw Error("User ID required to set up Commerce Discovery");let Y=VO($.siteUrl);if(!Y.ok)throw Error(Y.error);let G=g8.COMMERCE_DISCOVERY(X.id),J=q40(X.id),W=new URLSearchParams({virtualmcpid:J,main:`app:${G}:${Ic0}`}),K={email:Z.auth.user?.email,reportUrl:`${Z.baseUrl}/${encodeURIComponent(X.slug??X.id)}/${crypto.randomUUID()}?${W.toString()}`},H=await Z.storage.connections.findById(G,X.id),F={connection:!1,virtualMcp:!1},N=await Hr1({siteUrl:Y.value,orgId:X.id,orgName:X.name,...K}),U=Wr1();if(H)console.log("[commerce-discovery] syncing connection to claimed site",{orgId:X.id,siteUrl:Y.value,connectionId:G}),H=await Z.storage.connections.update(H.id,{connection_url:U,connection_token:N.authorizationToken,metadata:{...H.metadata??{},siteUrl:Y.value}});else{console.log("[commerce-discovery] creating connection",{orgId:X.id,siteUrl:Y.value,connectionId:G});try{let w=Qg1(X.id,N.authorizationToken,U);H=await Z.storage.connections.create({...w,metadata:{...w.metadata??{},siteUrl:Y.value},organization_id:X.id,created_by:Q}),F.connection=!0}catch(w){H=await wo8(Z,G,X.id,w)}}let O=await Z.storage.virtualMcps.findById(J,X.id);if(!O){console.log("[commerce-discovery] creating virtual MCP",{orgId:X.id,siteUrl:Y.value,connectionId:H.id,virtualMcpId:J});try{O=await Z.storage.virtualMcps.create(X.id,Q,Yg1(X.id,H.id),{id:J}),F.virtualMcp=!0}catch(w){O=await Eo8(Z,J,X.id,w)}}if(!O.pinned)O=await Z.storage.virtualMcps.update(O.id,Q,{pinned:!0});let B=await Z.db.selectFrom("organization").select(["createdAt"]).where("id","=",X.id).executeTakeFirst();if((B?Date.now()-new Date(B.createdAt).getTime():Number.POSITIVE_INFINITY)<Bo8){let E=(await Z.storage.organizationSettings.get(X.id))?.flags,j={};if(E?.reports_only==null)j.reports_only=!0;if(Object.keys(j).length>0)await Z.storage.organizationSettings.upsert(X.id,{flags:j})}return{connection:H,virtualMcp:O,reportApp:{connectionId:H.id,virtualMcpId:O.id,toolName:Ic0},created:F}}})});var wr1=D(()=>{Or1();Br1();Dr1();Lr1()});var Mc0=_((Er1)=>{Object.defineProperty(Er1,"__esModule",{value:!0});Er1.kvPrefix=Er1.KvWatchInclude=void 0;Er1.KvWatchInclude={LastValue:"",AllHistory:"history",UpdatesOnly:"updates"};Er1.kvPrefix="KV_"});var Sr1=_((kr1)=>{Object.defineProperty(kr1,"__esModule",{value:!0});kr1.KvStatusImpl=kr1.Bucket=kr1.Kvm=kr1.kvOperationHdr=void 0;kr1.Base64KeyCodec=Po8;kr1.NoopKvCodecs=kc0;kr1.defaultBucketOpts=Pr1;kr1.validateKey=Ar1;kr1.validateSearchKey=Tr1;kr1.hasWildcards=Rr1;kr1.validateBucket=X90;var x5=EY(),X5=ns(),b5=Mc0();function Po8(){let $=(Z,X)=>{let Q=[];for(let Y of Z.split("."))switch(Y){case">":case"*":Q.push(Y);break;default:Q.push(X(Y));break}return Q.join(".")};return{encode(Z){return $(Z,btoa)},decode(Z){return $(Z,atob)}}}function kc0(){return{key:{encode($){return $},decode($){return $}},value:{encode($){return typeof $==="string"?new TextEncoder().encode($):$},decode($){return $}}}}function Pr1(){return{replicas:1,history:1,timeout:2000,max_bytes:-1,maxValueSize:-1,codec:kc0(),storage:X5.StorageType.File}}kr1.kvOperationHdr="KV-Operation";var zr1="$KV",Ao8=/^[-/=.\w]+$/,To8=/^[-/=.>*\w]+$/,Ro8=/^[-\w]+$/;function Ar1($){if($.startsWith(".")||$.endsWith(".")||!Ao8.test($))throw Error(`invalid key: ${$}`)}function Tr1($){if($.startsWith(".")||$.endsWith(".")||$.includes("..")||!To8.test($))throw Error(`invalid key: ${$}`)}function Rr1($){if($.startsWith(".")||$.endsWith("."))throw Error(`invalid key: ${$}`);let Z=$.split("."),X=!1;for(let Q=0;Q<Z.length;Q++)switch(Z[Q]){case"*":X=!0;break;case">":if(Q!==Z.length-1)throw Error(`invalid key: ${$}`);X=!0;break;default:}return X}function X90($){if(!Ro8.test($))throw Error(`invalid bucket name: ${$}`)}class Ir1{js;constructor($){this.js=(0,X5.toJetStreamClient)($)}create($,Z={}){return this.#$($,Z)}open($,Z={}){return Z.bindOnly=!0,this.#$($,Z)}#$($,Z={}){let{ok:X,min:Q}=this.js.nc.features.get(x5.Feature.JS_KV);if(!X)return Promise.reject(Error(`kv is only supported on servers ${Q} or better`));if(Z.bindOnly)return Cx.bind(this.js,$,Z);return Cx.create(this.js,$,Z)}list(){let $=(X)=>{let Y=X.streams.filter((J)=>{return J.config.name.startsWith(b5.kvPrefix)});Y.forEach((J)=>{J.config.sealed=J.config.sealed||!1,J.config.deny_delete=J.config.deny_delete||!1,J.config.deny_purge=J.config.deny_purge||!1,J.config.allow_rollup_hdrs=J.config.allow_rollup_hdrs||!1});let G="";if(Y.length)G=this.js.nc.info?.cluster??"";return Y.map((J)=>{return new Q90(J,G)})},Z=`${this.js.prefix}.STREAM.LIST`;return new X5.ListerImpl(Z,$,this.js)}}kr1.Kvm=Ir1;class Cx{js;jsm;stream;bucket;direct;codec;prefix;editPrefix;useJsPrefix;_prefixLen;constructor($,Z,X){X90($),this.js=Z,this.jsm=X,this.bucket=$,this.prefix=zr1,this.editPrefix="",this.useJsPrefix=!1,this._prefixLen=0}static async create($,Z,X={}){X90(Z);let Q=await $.jetstreamManager(),Y=new Cx(Z,$,Q);return await Y.init(X),Y}static async bind($,Z,X={}){let Q=$.getOptions()?.checkAPI||X.bindOnly===!1,Y=await $.jetstreamManager(Q),G={config:{allow_direct:X.allow_direct}};X90(Z);let J=new Cx(Z,$,Y);return G.config.name=X.streamName??J.bucketName(),Object.assign(J,G),J.stream=G.config.name,J.codec=X.codec||kc0(),J.direct=G.config.allow_direct??!1,J.initializePrefixes(G),J}async init($={}){let Z=Object.assign(Pr1(),$);this.codec=Z.codec;let X={};if(this.stream=X.name=$.streamName??this.bucketName(),X.retention=X5.RetentionPolicy.Limits,X.max_msgs_per_subject=Z.history,Z.max_bytes)X.max_bytes=Z.max_bytes;if(X.max_msg_size=Z.maxValueSize,X.storage=Z.storage,$.placement)X.placement=$.placement;if($.republish)X.republish=$.republish;if($.description)X.description=$.description;if($.markerTTL)X.allow_msg_ttl=!0,X.subject_delete_marker_ttl=(0,x5.nanos)(Z.markerTTL);if($.mirror){let H=Object.assign({},$.mirror);if(!H.name.startsWith(b5.kvPrefix))H.name=`${b5.kvPrefix}${H.name}`;X.mirror=H,X.mirror_direct=!0}else if($.sources){let H=$.sources.map((F)=>{let N=Object.assign({},F),U=N.name.startsWith(b5.kvPrefix)?N.name.substring(b5.kvPrefix.length):N.name;if(!N.name.startsWith(b5.kvPrefix))N.name=`${b5.kvPrefix}${N.name}`;if(!F.external&&U!==this.bucket)N.subject_transforms=[{src:`$KV.${U}.>`,dest:`$KV.${this.bucket}.>`}];return N});X.sources=H,X.subjects=[this.subjectForBucket()]}else X.subjects=[this.subjectForBucket()];if($.metadata)X.metadata=$.metadata;if(typeof $.compression==="boolean")X.compression=$.compression?X5.StoreCompression.S2:X5.StoreCompression.None;let Q=this.js.nc,Y=Q.getServerVersion(),G=Y?(0,x5.compare)(Y,(0,x5.parseSemVer)("2.7.2"))>=0:!1;X.discard=G?X5.DiscardPolicy.New:X5.DiscardPolicy.Old;let{ok:J,min:W}=Q.features.get(x5.Feature.JS_ALLOW_DIRECT);if(!J&&$.allow_direct===!0){let H=Y?`${Y.major}.${Y.minor}.${Y.micro}`:"unknown";return Promise.reject(Error(`allow_direct is not available on server version ${H} - requires ${W}`))}if($.allow_direct=typeof $.allow_direct==="boolean"?$.allow_direct:J,X.allow_direct=$.allow_direct,this.direct=X.allow_direct,X.num_replicas=Z.replicas,Z.ttl)X.max_age=(0,x5.nanos)(Z.ttl);X.allow_rollup_hdrs=!0;let K;try{if(K=await this.jsm.streams.info(X.name),!K.config.allow_direct&&this.direct===!0)this.direct=!1}catch(H){if(H.message==="stream not found")K=await this.jsm.streams.add(X);else throw H}this.initializePrefixes(K)}initializePrefixes($){this._prefixLen=0,this.prefix=`$KV.${this.bucket}`,this.useJsPrefix=this.js.apiPrefix!=="$JS.API";let{mirror:Z}=$.config;if(Z){let X=Z.name;if(X.startsWith(b5.kvPrefix))X=X.substring(b5.kvPrefix.length);if(Z.external&&Z.external.api!==""){let Q=Z.name.substring(b5.kvPrefix.length);this.useJsPrefix=!1,this.prefix=`$KV.${Q}`,this.editPrefix=`${Z.external.api}.$KV.${X}`}else this.editPrefix=this.prefix}}bucketName(){return this.stream??`${b5.kvPrefix}${this.bucket}`}subjectForBucket(){return`${this.prefix}.${this.bucket}.>`}subjectForKey($,Z=!1){let X=[];if(Z){if(this.useJsPrefix)X.push(this.js.apiPrefix);if(this.editPrefix!=="")X.push(this.editPrefix);else X.push(this.prefix)}else if(this.prefix)X.push(this.prefix);return X.push($),X.join(".")}fullKeyName($){if(this.prefix!=="")return`${this.prefix}.${$}`;return`${zr1}.${this.bucket}.${$}`}get prefixLen(){if(this._prefixLen===0)this._prefixLen=this.prefix.length+1;return this._prefixLen}encodeKey($){let Z=[];for(let X of $.split("."))switch(X){case">":case"*":Z.push(X);break;default:Z.push(this.codec.key.encode(X));break}return Z.join(".")}decodeKey($){let Z=[];for(let X of $.split("."))switch(X){case">":case"*":Z.push(X);break;default:Z.push(this.codec.key.decode(X));break}return Z.join(".")}validateKey=Ar1;validateSearchKey=Tr1;hasWildcards=Rr1;close(){return Promise.resolve()}dataLen($,Z){let X=Z?Z.get(X5.JsHeaders.MessageSizeHdr)||"":"";if(X!=="")return parseInt(X,10);return $.length}smToEntry($){return new qr1(this.bucket,this.prefixLen,$,this.codec)}jmToWatchEntry($,Z){return new Mr1(this.bucket,this.prefixLen,$,Z,this.codec)}async create($,Z,X){let Q;try{let G={previousSeq:0},J=await this._put($,Z,G,X);return Promise.resolve(J)}catch(G){if(Q=G,G instanceof X5.JetStreamApiError){let J=G;if(J.code!==X5.JetStreamApiCodes.StreamWrongLastSequence&&J.code!==X5.JetStreamApiCodes.StreamWrongLastSequenceUnknown)return Promise.reject(G)}}let Y=0;try{let G=await this.get($);if(G?.operation==="DEL"||G?.operation==="PURGE")return Y=G!==null?G.revision:0,this._put($,Z,{previousSeq:Y},X);else return Promise.reject(Q)}catch(G){return Promise.reject(G)}}update($,Z,X,Q){if(X<=0)throw Error("version must be greater than 0");return this.put($,Z,{previousSeq:X,timeout:Q})}async _put($,Z,X={},Q){let Y=this.encodeKey($);this.validateKey(Y),Z=this.codec.value.encode(Z);let G={timeout:X?.timeout};if(X.previousSeq!==void 0){let J=(0,x5.headers)();G.headers=J,J.set(X5.PubHeaders.ExpectedLastSubjectSequenceHdr,`${X.previousSeq}`)}if(Q)(G.headers||(0,x5.headers)()).set(X5.PubHeaders.MessageTTL,Q);try{return(await this.js.publish(this.subjectForKey(Y,!0),Z,G)).seq}catch(J){return Promise.reject(J)}}put($,Z,X={}){return this._put($,Z,X)}async get($,Z){let X=this.encodeKey($);this.validateKey(X);let Q={last_by_subj:this.subjectForKey(X)};if(Z&&Z.revision>0)Q={seq:Z.revision};let Y=null;try{if(this.direct)Y=await this.jsm.direct.getMessage(this.bucketName(),Q);else Y=await this.jsm.streams.getMessage(this.bucketName(),Q);if(Y===null)return null;let G=this.smToEntry(Y);if(G.rawKey!==X)return null;return G}catch(G){throw G}}purge($,Z){return this._deleteOrPurge($,"PURGE",Z)}delete($,Z){return this._deleteOrPurge($,"DEL",Z)}async purgeDeletes($=1800000){let Z=[],X=await this.history({key:">"});await(async()=>{for await(let J of X)if(J.operation==="DEL"||J.operation==="PURGE")Z.push(J)})().then(),X.stop();let Q=Date.now()-$,Y=Z.map((J)=>{let W=this.subjectForKey(J.key);if(J.created.getTime()>=Q)return this.jsm.streams.purge(this.stream,{filter:W,keep:1});else return this.jsm.streams.purge(this.stream,{filter:W,keep:0})}),G=await Promise.all(Y);return G.unshift({success:!0,purged:0}),G.reduce((J,W)=>{return J.purged+=W.purged,J})}async _deleteOrPurge($,Z,X){if(!this.hasWildcards($))return this._doDeleteOrPurge($,Z,X);let Q=await this.keys($),Y=[];for await(let G of Q)if(Y.push(this._doDeleteOrPurge(G,Z)),Y.length===100)await Promise.all(Y),Y.length=0;if(Y.length>0)await Promise.all(Y)}async _doDeleteOrPurge($,Z,X){let Q=this.encodeKey($);this.validateKey(Q);let Y=(0,x5.headers)();if(Y.set(kr1.kvOperationHdr,Z),Z==="PURGE"){let G=X;if(Y.set(X5.JsHeaders.RollupHdr,X5.JsHeaders.RollupValueSubject),typeof G?.ttl==="string"&&G.ttl!=="")Y.set(X5.PubHeaders.MessageTTL,`${G.ttl}`)}if(X?.previousSeq)Y.set(X5.PubHeaders.ExpectedLastSubjectSequenceHdr,`${X.previousSeq}`);await this.js.publish(this.subjectForKey(Q,!0),x5.Empty,{headers:Y})}_buildCC($,Z,X={}){let Y=(!Array.isArray($)?[$]:$).map((W)=>{let K=this.encodeKey(W);return this.validateSearchKey(W),this.fullKeyName(K)}),G=X5.DeliverPolicy.LastPerSubject;if(Z===b5.KvWatchInclude.AllHistory)G=X5.DeliverPolicy.All;if(Z===b5.KvWatchInclude.UpdatesOnly)G=X5.DeliverPolicy.New;let J=void 0;if(Y.length===1)J=Y[0],Y=void 0;return Object.assign({deliver_policy:G,ack_policy:X5.AckPolicy.None,filter_subjects:Y,filter_subject:J,flow_control:!0,idle_heartbeat:(0,x5.nanos)(5000)},X)}remove($){return this.purge($)}async history($={}){let Z=$.key??">",X={};X.headers_only=$.headers_only||!1;let Q=new x5.QueuedIteratorImpl,Y=()=>{Q.stop()},G=this._buildCC(Z,b5.KvWatchInclude.AllHistory,X),J=await this.js.consumers.getPushConsumer(this.stream,G);if(Q._data=J,(await J.info(!0)).num_pending===0)return Q.push(Y),Q;let K=await J.consume({callback:(H)=>{let F=this.jmToWatchEntry(H,!1);if(Q.push(F),Q.received++,H.info.pending===0)Q.push(Y)}});return K.closed().then(()=>{Q.push(Y)}),(async()=>{for await(let H of K.status())switch(H.type){case"heartbeat":Q.push(()=>{Q.stop()});break}})().then(),Q.iterClosed.then(()=>{K.stop()}),Q}canSetWatcherName(){let $=this.js.nc,{ok:Z}=$.features.get(x5.Feature.JS_NEW_CONSUMER_CREATE_API);return Z}async watch($={}){let Z=$.key??">",X=new x5.QueuedIteratorImpl,Q={};Q.headers_only=$.headers_only||!1;let Y=b5.KvWatchInclude.LastValue;if($.include===b5.KvWatchInclude.AllHistory)Y=b5.KvWatchInclude.AllHistory;else if($.include===b5.KvWatchInclude.UpdatesOnly)Y=b5.KvWatchInclude.UpdatesOnly;let G=$.ignoreDeletes===!0,J=this._buildCC(Z,Y,Q);if(J.name=`KV_WATCHER_${x5.nuid.next()}`,$.resumeFromRevision&&$.resumeFromRevision>0)J.deliver_policy=X5.DeliverPolicy.StartSequence,J.opt_start_seq=$.resumeFromRevision;let W=await this.js.consumers.getPushConsumer(this.stream,J),H=(await W.info(!0)).num_pending,F=Y===b5.KvWatchInclude.UpdatesOnly||H===0;X._data=W;let N=0,U=await W.consume({callback:(O)=>{if(!F)N++,F=N>=H;let B=this.jmToWatchEntry(O,F);if(G&&B.operation==="DEL")return;X.push(B),X.received++}});return X.iterClosed.then(()=>{U.stop()}),U.closed().then(()=>{X.push(()=>{X.stop()})}),X}async keys($=">"){let Z=new x5.QueuedIteratorImpl,X=this._buildCC($,b5.KvWatchInclude.LastValue,{headers_only:!0}),Q=await this.js.consumers.getPushConsumer(this.stream,X);if((await Q.info()).num_pending===0)return Z.stop(),Z;Z._data=Q;let G=await Q.consume({callback:(J)=>{let W=J.headers?.get(kr1.kvOperationHdr);if(W!=="DEL"&&W!=="PURGE"){let K=this.decodeKey(J.subject.substring(this.prefixLen));Z.push(K)}if(J.info.pending===0)G.stop()}});return(async()=>{for await(let J of G.status())switch(J.type){case"heartbeat":Z.push(()=>{Z.stop()});break}})().then(),G.closed().then(()=>{Z.push(()=>{Z.stop()})}),Z.iterClosed.then(()=>{G.stop()}),Z}purgeBucket($){return this.jsm.streams.purge(this.bucketName(),$)}destroy(){return this.jsm.streams.delete(this.bucketName())}async status(){let Z=this.js.nc.info?.cluster??"",X=this.bucketName(),Q=await this.jsm.streams.info(X);return new Q90(Q,Z)}}kr1.Bucket=Cx;class Q90{si;cluster;constructor($,Z=""){this.si=$,this.cluster=Z}get bucket(){return this.si.config.name.startsWith(b5.kvPrefix)?this.si.config.name.substring(b5.kvPrefix.length):this.si.config.name}get values(){return this.si.state.messages}get history(){return this.si.config.max_msgs_per_subject}get ttl(){return(0,x5.millis)(this.si.config.max_age)}get markerTTL(){if(typeof this.si.config.subject_delete_marker_ttl==="number")return(0,x5.millis)(this.si.config.subject_delete_marker_ttl);return 0}get bucket_location(){return this.cluster}get backingStore(){return this.si.config.storage}get storage(){return this.si.config.storage}get replicas(){return this.si.config.num_replicas}get description(){return this.si.config.description??""}get maxBucketSize(){return this.si.config.max_bytes}get maxValueSize(){return this.si.config.max_msg_size}get max_bytes(){return this.si.config.max_bytes}get placement(){return this.si.config.placement||{cluster:"",tags:[]}}get placementCluster(){return this.si.config.placement?.cluster??""}get republish(){return this.si.config.republish??{src:"",dest:""}}get streamInfo(){return this.si}get size(){return this.si.state.bytes}get metadata(){return this.si.config.metadata??{}}get compression(){if(this.si.config.compression)return this.si.config.compression!==X5.StoreCompression.None;return!1}}kr1.KvStatusImpl=Q90;class qr1{bucket;sm;prefixLen;codec;constructor($,Z,X,Q){this.bucket=$,this.prefixLen=Z,this.sm=X,this.codec=Q}get rawKey(){return this.sm.subject.substring(this.prefixLen)}get key(){return this.codec.key.decode(this.rawKey)}get value(){return this.codec.value.decode(this.sm.data)}get delta(){return 0}get created(){return this.sm.time}get revision(){return this.sm.seq}get operation(){if(this.sm.header?.has("Nats-Marker-Reason")){if(this.sm.header?.get("Nats-Marker-Reason")==="MaxAge")return"PURGE"}return this.sm.header?.get(kr1.kvOperationHdr)||"PUT"}get length(){let $=this.sm.header.get(X5.JsHeaders.MessageSizeHdr)||"";if($!=="")return parseInt($,10);return this.sm.data.length}json($){return JSON.parse(x5.TD.decode(this.value),$)}string(){return x5.TD.decode(this.value)}}class Mr1{bucket;sm;prefixLen;update;codec;constructor($,Z,X,Q,Y){this.bucket=$,this.prefixLen=Z,this.sm=X,this.update=Q,this.codec=Y}get rawKey(){return this.sm.subject.substring(this.prefixLen)}get key(){return this.codec.key.decode(this.rawKey)}get value(){return this.codec.value.decode(this.sm.data)}get created(){return new Date((0,x5.millis)(this.sm.info.timestampNanos))}get revision(){return this.sm.seq}get operation(){if(this.sm.headers?.has("Nats-Marker-Reason")){if(this.sm.headers?.get("Nats-Marker-Reason")==="MaxAge")return"PURGE"}return this.sm.headers?.get(kr1.kvOperationHdr)||"PUT"}get delta(){return this.sm.info.pending}get length(){let $=this.sm.headers?.get(X5.JsHeaders.MessageSizeHdr)||"";if($!=="")return parseInt($,10);return this.sm.data.length}get isUpdate(){return this.update}json($){return JSON.parse(x5.TD.decode(this.value),$)}string(){return x5.TD.decode(this.value)}}});var Vc0=_((j3)=>{Object.defineProperty(j3,"__esModule",{value:!0});j3.validateKey=j3.validateBucket=j3.NoopKvCodecs=j3.Kvm=j3.defaultBucketOpts=j3.Bucket=j3.Base64KeyCodec=j3.KvWatchInclude=j3.kvPrefix=void 0;var Cr1=Mc0();Object.defineProperty(j3,"kvPrefix",{enumerable:!0,get:function(){return Cr1.kvPrefix}});Object.defineProperty(j3,"KvWatchInclude",{enumerable:!0,get:function(){return Cr1.KvWatchInclude}});var mw=Sr1();Object.defineProperty(j3,"Base64KeyCodec",{enumerable:!0,get:function(){return mw.Base64KeyCodec}});Object.defineProperty(j3,"Bucket",{enumerable:!0,get:function(){return mw.Bucket}});Object.defineProperty(j3,"defaultBucketOpts",{enumerable:!0,get:function(){return mw.defaultBucketOpts}});Object.defineProperty(j3,"Kvm",{enumerable:!0,get:function(){return mw.Kvm}});Object.defineProperty(j3,"NoopKvCodecs",{enumerable:!0,get:function(){return mw.NoopKvCodecs}});Object.defineProperty(j3,"validateBucket",{enumerable:!0,get:function(){return mw.validateBucket}});Object.defineProperty(j3,"validateKey",{enumerable:!0,get:function(){return mw.validateKey}})});var Sc0=_((CO)=>{Object.defineProperty(CO,"__esModule",{value:!0});CO.NoopKvCodecs=CO.Kvm=CO.defaultBucketOpts=CO.Bucket=CO.Base64KeyCodec=CO.KvWatchInclude=void 0;var bo8=Vc0();Object.defineProperty(CO,"KvWatchInclude",{enumerable:!0,get:function(){return bo8.KvWatchInclude}});var _i=Vc0();Object.defineProperty(CO,"Base64KeyCodec",{enumerable:!0,get:function(){return _i.Base64KeyCodec}});Object.defineProperty(CO,"Bucket",{enumerable:!0,get:function(){return _i.Bucket}});Object.defineProperty(CO,"defaultBucketOpts",{enumerable:!0,get:function(){return _i.defaultBucketOpts}});Object.defineProperty(CO,"Kvm",{enumerable:!0,get:function(){return _i.Kvm}});Object.defineProperty(CO,"NoopKvCodecs",{enumerable:!0,get:function(){return _i.NoopKvCodecs}})});function Y90(){let $=new TextEncoder,Z=new TextDecoder;return{encode:(X)=>$.encode(JSON.stringify(X)),decode:(X)=>JSON.parse(Z.decode(X))}}class _c0{options;kv=null;codec=Y90();constructor($){this.options=$}async init(){let $=this.options.getJetStream();if(!$)return;this.kv=await new vr1.Kvm($).create(yo8,{storage:_r1.StorageType.Memory})}async get($,Z){if(!this.kv)return null;try{let X=await this.kv.get(`${$}.${Z}`);if(!X?.value?.length)return null;if(X.operation==="DEL"||X.operation==="PURGE")return null;return this.codec.decode(X.value)}catch{return null}}async set($,Z,X){if(!this.kv)return;try{await this.kv.put(`${$}.${Z}`,this.codec.encode(X))}catch{}}async invalidate($){if(!this.kv)return;await Promise.all(["tools","resources","prompts"].map(async(X)=>{try{await this.kv.delete(`${X}.${$}`)}catch{}}))}teardown(){this.kv=null}}function go8($,Z,X){if(X<=0)return!0;if($===void 0)return!0;return Z-$>=X}function G90($){return $ instanceof L1&&$.code===q1.MethodNotFound}function ho8($){return $ instanceof L1&&$.code===-32000&&/connection closed/i.test($.message)}async function vO($,Z,X,Q,Y,G=0){if(!Q)try{return await X()}catch(H){if(G90(H))return[];return vi.add(1,{type:$,outcome:"error",stage:"no_cache"}),null}let J=`${$}:${Z}`,W=await Q.get($,Z);if(W===null)try{let H=await X();return Q.set($,Z,H).catch(()=>{}),Cc0.set(J,Date.now()),vi.add(1,{type:$,outcome:"miss",stage:"miss"}),H}catch(H){if(G90(H))return Q.set($,Z,[]).catch(()=>{}),[];return vi.add(1,{type:$,outcome:"error",stage:"miss"}),null}if(vi.add(1,{type:$,outcome:"hit",stage:"hit"}),go8(Cc0.get(J),Date.now(),G)&&!J90.has(J)){J90.add(J),Cc0.set(J,Date.now());let H=X().then((F)=>Q.set($,Z,F)).catch((F)=>{if(G90(F)||ho8(F)){if(G90(F))Q.set($,Z,[]).catch(()=>{});return}vi.add(1,{type:$,outcome:"error",stage:"revalidation"})}).finally(()=>J90.delete(J));Y?.(H)}return W}function vc0($){fr1=$}function Z9(){return fr1}var _r1,vr1,vi,yo8="DECOCMS_MCP_LISTS",J90,Cc0,_O=30000,fr1=null;var xY=D(()=>{e5();I6();_r1=V(pD(),1),vr1=V(Sc0(),1),vi=L$.createCounter("mcp_list_cache.fetches",{description:"MCP list cache fetch outcomes (hit, miss, error)",unit:"{fetches}"});J90=new Set;L$.createObservableGauge("mcp_list_cache.pending_revalidations",{description:"In-flight background MCP list revalidations on this pod",unit:"{revalidations}"}).addCallback(($)=>$.observe(J90.size));Cc0=new Map});async function fc0($,Z,X){let Q=new AbortController,Y,G=new Promise((W,K)=>{Y=setTimeout(()=>{Q.abort(),K(new br1($.id,X))},X)}),J=(async()=>{let W=await N5($,Z,!0);try{return(await W.listTools(void 0,{timeout:X,signal:Q.signal})).tools}finally{await W.close().catch(()=>{})}})();J.catch(()=>{});try{return await Promise.race([J,G])}finally{if(Y)clearTimeout(Y)}}var br1;var xr1=D(()=>{fi();br1=class br1 extends Error{constructor($,Z){super(`listTools timed out after ${Z}ms for connection ${$}`);this.name="ListToolsTimeoutError"}}});function W90($){return(Z)=>{if(Z instanceof L1&&Z.code===q1.MethodNotFound)return $;throw Z}}var yr1=D(()=>{e5()});function K90($,Z,X){let Q=fO($,Z,X,Z9()??void 0),Y=tL(Q,{name:"studio-mcp-server",version:"1.0.0"},{capabilities:uo8,toolCallTimeoutMs:Hb});Y.server.setRequestHandler(IU,async()=>{return await Q.listResources().catch(W90({resources:[]}))}),Y.server.setRequestHandler(qU,async()=>{return await Q.listResourceTemplates().catch(W90({resourceTemplates:[]}))}),Y.server.setRequestHandler(MU,async()=>{return await Q.listPrompts().catch(W90({prompts:[]}))});let G=Y.close.bind(Y);return Y.close=async()=>{await G(),await Q.close().catch(()=>{})},Y}var uo8;var gr1=D(()=>{yX();e5();bi();xY();yr1();uo8={tools:{},resources:{},prompts:{}}});var DF=D(()=>{fi();xr1();gr1()});function xi($,Z,X){if(Z.some((Q)=>Q!=="*"&&Q.startsWith("SELF::"))&&$.SELF===void 0)$.SELF={value:`${X}_self`}}function yi($,Z){let X=new Map;for(let Q of Z){if(Q==="*")continue;let[Y,G]=e60(Q);if(!co8.has(G))continue;let J=mm(Y,$);if(typeof J!=="object"||J===null||!("value"in J))continue;let W=J.value;if(typeof W!=="string")continue;X.set(`${W}:${G}`,{targetConnectionId:W,scope:G})}return[...X.values()]}async function gi($,Z,X,Q){for(let J of Z){if(J==="*")continue;let[W]=e60(J),K=mm(W,$);if(K===void 0||K===null)throw Error(`Scope references key "${W}" but it's not present in state`)}let Y=hd1($,Z),G=`${X}_self`;for(let J of Y){if(J===G)continue;let W=await Q.storage.connections.findById(J);if(!W||W.organization_id!==X)throw Error(`Referenced connection not found: ${J}`);try{await Q.access.check(J)}catch(K){throw Error(`Access denied to referenced connection: ${J}. ${K.message}`)}}}var co8;var bc0=D(()=>{xh0();f40();co8=new Set([_40,v40])});import{z as hr1}from"zod";var lo8,do8,xc0;var ur1=D(()=>{C4();S0();q$();xY();DF();bc0();qi();yW();lo8=hr1.object({data:r$0.describe("Data for the new connection (id is auto-generated if not provided)")}),do8=hr1.object({item:g7.describe("The created connection entity")}),xc0=c({name:"COLLECTION_CONNECTIONS_CREATE",description:"Create a new MCP connection. Auto-fetches and caches the server's tool list.",annotations:{title:"Create Connection",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!1,openWorldHint:!1},inputSchema:lo8,outputSchema:do8,handler:async($,Z)=>{r(Z);let X=t(Z);await Z.access.check();let Q=Y1(Z);if(!Q)throw Error("User ID required to create connection");let Y={...$.data,organization_id:X.id,created_by:Q};if(Y.id){if((await Z.storage.connections.findById(Y.id))?.organization_id===X.id)throw Error("Connection already exists in organization")}if(Y.connection_type==="VIRTUAL"){let N=Mf(Y.connection_url);if(!N)throw Error("VIRTUAL connection requires connection_url in format: virtual://$virtual_mcp_id");let U=await Z.storage.virtualMcps.findById(N);if(!U)throw Error(`Virtual MCP not found: ${N}`);if(U.organization_id!==X.id)throw Error("Virtual MCP does not belong to the current organization");Y.connection_url=kf(N)}if(Y.connection_type==="STDIO"&&!b0().localMode)throw Error("STDIO connections are only available in local mode (--local-mode).");let G=await kO({id:`pending-${Date.now()}`,title:Y.title,connection_type:Y.connection_type,connection_url:Y.connection_url,connection_token:Y.connection_token,connection_headers:Y.connection_headers}).catch(()=>null),J=G?.tools?.length?G.tools:null,W=G?.scopes?.length?G.scopes:Y.configuration_scopes??null,K=Y.configuration_state??null;if(K&&W?.length)xi(K,W,X.id),await gi(K,W,X.id,Z);let H=await Z.storage.connections.createNew({...Y,tools:null,configuration_state:K,configuration_scopes:W}),F=K&&W?.length?yi(K,W):[];if(F.length>0){let N;try{await Z.storage.connectionCredentialVault.replaceGrantsForSubject({organizationId:X.id,subjectConnectionId:H.id,createdBy:Q,grants:F});let{plaintextToken:U,record:O}=await Z.storage.connectionCredentialVault.createOrRotateWorkloadToken({organizationId:X.id,subjectConnectionId:H.id});N=O.id,await(await N5(H,Z,!1)).callTool({name:"ON_MCP_CONFIGURATION",arguments:{state:K,scopes:W,firstRun:!0,vault:{baseUrl:Z.baseUrl,org:X.slug??X.id,subjectConnectionId:H.id,token:U}}})}catch(U){if(N)await Z.storage.connectionCredentialVault.revokeWorkloadToken({organizationId:X.id,subjectConnectionId:H.id,tokenId:N});throw await Z.storage.connections.delete(H.id),U}}if(J)Z9()?.set("tools",H.id,J).catch(()=>{});return y1.capture({distinctId:Q,event:"connection_created",groups:{organization:X.id},properties:{connection_id:H.id,connection_type:H.connection_type,app_name:H.app_name??null,organization_id:X.id,tools_count:J?.length??0}}),{item:H}}})});import{z as uG}from"zod/v4";import{z as cr1}from"zod/v4";import{z as H90}from"zod/v4";import{z as JK}from"zod/v4";import{z as no8}from"zod/v4";import{z as iw}from"zod/v4";import{z as WK}from"zod/v4";import{z as _Z}from"zod/v4";import{z as lr1}from"zod/v4";import{z as U90}from"zod/v4";import{z as Lr8}from"zod/v4";import{z as dr1}from"zod/v4";import{z as F90}from"zod/v4";import{z as Ir8}from"zod/v4";function hi($,Z){if($===Z)return!0;if($==null||Z==null)return $===Z;if(typeof $!==typeof Z)return!1;if(Array.isArray($)&&Array.isArray(Z)){if($.length!==Z.length)return!1;return $.every((X,Q)=>hi(X,Z[Q]))}if(typeof $==="object"&&typeof Z==="object"){let X=Object.keys($),Q=Object.keys(Z);if(X.length!==Q.length)return!1;return X.every((Y)=>Q.includes(Y)&&hi($[Y],Z[Y]))}return!1}function Or8(){return($)=>{if(!Array.isArray($))return!0;let Z=[];return $.every((X)=>{if(Z.some((Y)=>hi(X,Y)))return!1;return Z.push(X),!0})}}function N90($,Z){return $.safeParse(Z).success}function U7($){if(typeof $==="boolean")return $?uG.any():uG.never();let Z={};for(let Y of Vr8)Y.apply(Z,$);let X=[];if(Z.string!==!1)X.push(Z.string||uG.string());if(Z.number!==!1)X.push(Z.number||uG.number());if(Z.boolean!==!1)X.push(Z.boolean||uG.boolean());if(Z.null!==!1)X.push(Z.null||uG.null());if(Z.array!==!1)X.push(Z.array||uG.array(uG.any()));if(Z.tuple!==!1&&Z.tuple!==void 0)X.push(Z.tuple);if(Z.object!==!1)if(Z.object)X.push(Z.object);else{let Y=uG.custom((G)=>{return typeof G==="object"&&G!==null&&!Array.isArray(G)},"Must be an object, not an array");X.push(Y)}if(Z.file!==!1&&Z.file!==void 0)X.push(Z.file);let Q;if(X.length===0)Q=uG.never();else if(X.length===1)Q=X[0];else if(!Object.keys($).some((G)=>G!=="$schema"&&G!=="title"&&G!=="description"))Q=uG.any();else Q=uG.union(X);for(let Y of Sr8)Q=Y.apply(Q,$);return Q}var mo8=class{apply($,Z){if(!Z.type)return;let X=Array.isArray(Z.type)?Z.type:[Z.type],Q=new Set(X);if(!Q.has("string"))$.string=!1;if(!Q.has("number")&&!Q.has("integer"))$.number=!1;if(!Q.has("boolean"))$.boolean=!1;if(!Q.has("null"))$.null=!1;if(!Q.has("array"))$.array=!1;if(!Q.has("object"))$.object=!1;if(Q.has("integer")&&$.number!==!1){let Y=$.number||cr1.number();if(Y instanceof cr1.ZodNumber)$.number=Y.int()}}},io8=class{apply($,Z){if(Z.const===void 0)return;let X=Z.const;if($.string=!1,$.number=!1,$.boolean=!1,$.null=!1,$.array=!1,$.object=!1,typeof X==="string")$.string=H90.literal(X);else if(typeof X==="number")$.number=H90.literal(X);else if(typeof X==="boolean")$.boolean=H90.literal(X);else if(X===null)$.null=H90.null();else if(Array.isArray(X))$.array=void 0;else if(typeof X==="object")$.object=void 0}},po8=class{apply($,Z){if(!Z.enum)return;if(Z.enum.length===0){if(!Z.type)$.string=!1,$.number=!1,$.boolean=!1,$.null=!1,$.array=!1,$.object=!1;return}let X={string:Z.enum.filter((Q)=>typeof Q==="string"),number:Z.enum.filter((Q)=>typeof Q==="number"),boolean:Z.enum.filter((Q)=>typeof Q==="boolean"),null:Z.enum.filter((Q)=>Q===null),array:Z.enum.filter((Q)=>Array.isArray(Q)),object:Z.enum.filter((Q)=>typeof Q==="object"&&Q!==null&&!Array.isArray(Q))};$.string=this.createTypeSchema(X.string,"string"),$.number=this.createTypeSchema(X.number,"number"),$.boolean=this.createTypeSchema(X.boolean,"boolean"),$.null=X.null.length>0?JK.null():!1,$.array=X.array.length>0?void 0:!1,$.object=X.object.length>0?void 0:!1}createTypeSchema($,Z){if($.length===0)return!1;if($.length===1)return JK.literal($[0]);if(Z==="string")return JK.enum($);if(Z==="number"){let[X,Q,...Y]=$;return JK.union([JK.literal(X),JK.literal(Q),...Y.map((G)=>JK.literal(G))])}if(Z==="boolean")return JK.union([JK.literal(!0),JK.literal(!1)]);return!1}},to8=class{apply($,Z){let X=Z;if(X.type==="string"&&X.format==="binary"&&X.contentEncoding==="binary"){let Q=no8.file();if(X.minLength!==void 0)Q=Q.min(X.minLength);if(X.maxLength!==void 0)Q=Q.max(X.maxLength);if(X.contentMediaType!==void 0)Q=Q.mime(X.contentMediaType);$.file=Q,$.string=!1}}},oo8=class{apply($,Z){let X=Z;if(Z.type===void 0&&(X.minLength!==void 0||X.maxLength!==void 0||X.pattern!==void 0)){if($.string===void 0)$.string=iw.string()}}},ro8=class{apply($,Z){let X=Z;if(X.minLength===void 0)return;if($.string!==!1){let Q=$.string||iw.string();if(Q instanceof iw.ZodString)$.string=Q.refine((Y)=>{return Array.from(Y).length>=X.minLength},{message:`String must be at least ${X.minLength} characters long`})}}},ao8=class{apply($,Z){let X=Z;if(X.maxLength===void 0)return;if($.string!==!1){let Q=$.string||iw.string();if(Q instanceof iw.ZodString)$.string=Q.refine((Y)=>{return Array.from(Y).length<=X.maxLength},{message:`String must be at most ${X.maxLength} characters long`})}}},so8=class{apply($,Z){let X=Z;if(!X.pattern)return;if($.string!==!1){let Q=$.string||iw.string();if(Q instanceof iw.ZodString){let Y=new RegExp(X.pattern);$.string=Q.regex(Y)}}}},eo8=class{apply($,Z){let X=Z;if(X.minimum===void 0)return;if($.number!==!1){let Q=$.number||WK.number();if(Q instanceof WK.ZodNumber)$.number=Q.min(X.minimum)}}},$r8=class{apply($,Z){let X=Z;if(X.maximum===void 0)return;if($.number!==!1){let Q=$.number||WK.number();if(Q instanceof WK.ZodNumber)$.number=Q.max(X.maximum)}}},Zr8=class{apply($,Z){let X=Z;if(X.exclusiveMinimum===void 0)return;if($.number!==!1){let Q=$.number||WK.number();if(Q instanceof WK.ZodNumber)if(typeof X.exclusiveMinimum==="number")$.number=Q.gt(X.exclusiveMinimum);else $.number=!1}}},Xr8=class{apply($,Z){let X=Z;if(X.exclusiveMaximum===void 0)return;if($.number!==!1){let Q=$.number||WK.number();if(Q instanceof WK.ZodNumber)if(typeof X.exclusiveMaximum==="number")$.number=Q.lt(X.exclusiveMaximum);else $.number=!1}}},Qr8=class{apply($,Z){let X=Z;if(X.multipleOf===void 0)return;if($.number!==!1){let Q=$.number||WK.number();if(Q instanceof WK.ZodNumber)$.number=Q.refine((Y)=>{if(X.multipleOf===0)return!1;let G=Y/X.multipleOf,J=Math.round(G),W=Math.min(Math.abs(Y)*Number.EPSILON*10,Math.abs(X.multipleOf)*Number.EPSILON*10);return Math.abs(G-J)<=W/Math.abs(X.multipleOf)},{message:`Must be a multiple of ${X.multipleOf}`})}}},Yr8=class{apply($,Z){let X=Z;if(Z.type===void 0&&(X.minItems!==void 0||X.maxItems!==void 0||X.items!==void 0||X.prefixItems!==void 0)){if($.array===void 0)$.array=_Z.array(_Z.any())}}},Gr8=class{apply($,Z){let X=Z;if(X.minItems===void 0)return;if($.array!==!1)$.array=($.array||_Z.array(_Z.any())).min(X.minItems)}},Jr8=class{apply($,Z){let X=Z;if(X.maxItems===void 0)return;if($.array!==!1)$.array=($.array||_Z.array(_Z.any())).max(X.maxItems)}},Wr8=class{apply($,Z){let X=Z;if($.array===!1)return;if(Array.isArray(X.items))$.array=$.array||_Z.array(_Z.any());else if(X.items&&typeof X.items!=="boolean"&&!X.prefixItems){let Q=U7(X.items),Y=_Z.array(Q);if($.array&&$.array instanceof _Z.ZodArray){let G=$.array._def;if(G.checks)G.checks.forEach((J)=>{if(J._zod&&J._zod.def){let W=J._zod.def;if(W.check==="min_length"&&W.minimum!==void 0)Y=Y.min(W.minimum);else if(W.check==="max_length"&&W.maximum!==void 0)Y=Y.max(W.maximum)}})}$.array=Y}else if(typeof X.items==="boolean"&&X.items===!1)if(!X.prefixItems)$.array=_Z.array(_Z.any()).max(0);else $.array=$.array||_Z.array(_Z.any());else if(typeof X.items==="boolean"&&X.items===!0)$.array=$.array||_Z.array(_Z.any());else if(X.prefixItems)$.array=$.array||_Z.array(_Z.any())}},Kr8=class{apply($,Z){if(Z.type!=="array")return;let X=Z;if(!Array.isArray(X.items))return;if($.array===!1)return;let Q=X.items.map((G)=>U7(G)),Y;if(Q.length===0)Y=lr1.tuple([]);else Y=lr1.tuple(Q);if(X.minItems!==void 0&&X.minItems>Q.length)Y=!1;if(X.maxItems!==void 0&&X.maxItems<Q.length)Y=!1;$.tuple=Y,$.array=!1}},Hr8=class{apply($,Z){let X=Z;if($.object===!1)return;if(X.properties||X.required||X.additionalProperties!==void 0)$.object=$.object||U90.object({}).passthrough()}},Fr8=class{apply($,Z){let X=Z;if(Z.type===void 0&&(X.maxProperties!==void 0||X.minProperties!==void 0)){if($.object===void 0)$.object=U90.object({}).passthrough()}}},Nr8=class{apply($,Z){let X=Z;if(X.maxProperties===void 0)return;if($.object!==!1){let Q=$.object||U90.object({}).passthrough();$.object=Q.refine((Y)=>Object.keys(Y).length<=X.maxProperties,{message:`Object must have at most ${X.maxProperties} properties`})}}},Ur8=class{apply($,Z){let X=Z;if(X.minProperties===void 0)return;if($.object!==!1){let Q=$.object||U90.object({}).passthrough();$.object=Q.refine((Y)=>Object.keys(Y).length>=X.minProperties,{message:`Object must have at least ${X.minProperties} properties`})}}},Br8=class{apply($,Z){if(!Z.not)return $;let X=U7(Z.not);return $.refine((Q)=>!N90(X,Q),{message:"Value must not match the 'not' schema"})}},Dr8=class{apply($,Z){if(Z.uniqueItems!==!0)return $;return $.refine(Or8(),{message:"Array items must be unique"})}},wr8=class{apply($,Z){if(!Z.allOf||Z.allOf.length===0)return $;return Z.allOf.map((Q)=>U7(Q)).reduce((Q,Y)=>Lr8.intersection(Q,Y),$)}},Er8=class{apply($,Z){if(!Z.anyOf||Z.anyOf.length===0)return $;let X=Z.anyOf.length===1?U7(Z.anyOf[0]):dr1.union([U7(Z.anyOf[0]),U7(Z.anyOf[1]),...Z.anyOf.slice(2).map((Q)=>U7(Q))]);return dr1.intersection($,X)}},jr8=class{apply($,Z){if(!Z.oneOf||Z.oneOf.length===0)return $;let X=Z.oneOf.map((Q)=>U7(Q));return $.refine((Q)=>{let Y=0;for(let G of X)if(G.safeParse(Q).success){if(Y++,Y>1)return!1}return Y===1},{message:"Value must match exactly one of the oneOf schemas"})}},zr8=class{apply($,Z){let X=Z;if(X.prefixItems&&Array.isArray(X.prefixItems)){let Y=X.prefixItems.map((G)=>U7(G));return $.refine((G)=>{if(!Array.isArray(G))return!0;for(let J=0;J<Math.min(G.length,Y.length);J++)if(!N90(Y[J],G[J]))return!1;if(G.length>Y.length){if(typeof X.items==="boolean"&&X.items===!1)return!1;else if(X.items&&typeof X.items==="object"&&!Array.isArray(X.items)){let J=U7(X.items);for(let W=Y.length;W<G.length;W++)if(!N90(J,G[W]))return!1}}return!0},{message:"Array does not match prefixItems schema"})}return $}},Pr8=class{apply($,Z){let X=Z;if(!X.properties&&!X.required&&X.additionalProperties!==!1)return $;if($ instanceof F90.ZodObject||$ instanceof F90.ZodRecord){let Q={};if(X.properties){for(let[Y,G]of Object.entries(X.properties))if(G!==void 0)Q[Y]=U7(G)}if(X.required&&Array.isArray(X.required)){let Y=new Set(X.required);for(let G of Object.keys(Q))if(!Y.has(G))Q[G]=Q[G].optional()}else for(let Y of Object.keys(Q))Q[Y]=Q[Y].optional();if(X.additionalProperties===!1)return F90.object(Q);else return F90.object(Q).passthrough()}return $.refine((Q)=>{if(typeof Q!=="object"||Q===null||Array.isArray(Q))return!0;if(X.properties){for(let[Y,G]of Object.entries(X.properties))if(G!==void 0){if(Object.getOwnPropertyDescriptor(Q,Y)!==void 0){if(!U7(G).safeParse(Q[Y]).success)return!1}}}if(X.required&&Array.isArray(X.required)){for(let Y of X.required)if(Object.getOwnPropertyDescriptor(Q,Y)===void 0)return!1}if(X.additionalProperties===!1&&X.properties){let Y=new Set(Object.keys(X.properties));for(let G in Q)if(!Y.has(G))return!1}return!0},{message:"Object constraints validation failed"})}},Ar8=class{apply($,Z){if(!Z.enum||Z.enum.length===0)return $;let X=Z.enum.filter((Q)=>Array.isArray(Q)||typeof Q==="object"&&Q!==null);if(X.length===0)return $;return $.refine((Q)=>{if(typeof Q!=="object"||Q===null)return!0;return X.some((Y)=>hi(Q,Y))},{message:"Value must match one of the enum values"})}},Tr8=class{apply($,Z){if(Z.const===void 0)return $;let X=Z.const;if(typeof X!=="object"||X===null)return $;return $.refine((Q)=>hi(Q,X),{message:"Value must equal the const value"})}},Rr8=class{apply($,Z){if(Z.description)$=$.describe(Z.description);return $}},qr8=class{apply($,Z){var X;let Q=Z;if(!((X=Q.required)==null?void 0:X.includes("__proto__"))||Z.type!==void 0)return $;return Ir8.any().refine((Y)=>this.validateRequired(Y,Q.required),{message:"Missing required properties"})}validateRequired($,Z){if(typeof $!=="object"||$===null||Array.isArray($))return!0;return Z.every((X)=>Object.prototype.hasOwnProperty.call($,X))}},Mr8=class{apply($,Z){var X;let Q=Z;if(Q.contains===void 0)return $;let Y=U7(Q.contains),G=(X=Q.minContains)!=null?X:1,J=Q.maxContains;return $.refine((W)=>{if(!Array.isArray(W))return!0;let K=0;for(let H of W)if(N90(Y,H))K++;if(K<G)return!1;if(J!==void 0&&K>J)return!1;return!0},{message:"Array must contain required items matching the schema"})}},kr8=class{apply($,Z){let{default:X}=Z;if(X===void 0)return $;if(!$.safeParse(X).success)return $;return $.default(X)}},Vr8,Sr8;var mr1=D(()=>{Vr8=[new io8,new po8,new mo8,new to8,new oo8,new Yr8,new Fr8,new ro8,new ao8,new so8,new eo8,new $r8,new Zr8,new Xr8,new Qr8,new Kr8,new Gr8,new Jr8,new Wr8,new Nr8,new Ur8,new Hr8],Sr8=[new qr8,new Ar8,new Tr8,new wr8,new Er8,new jr8,new zr8,new Pr8,new Mr8,new Br8,new Dr8,new kr8,new Rr8]});class yc0{constructor($){this._url=$}start(){if(this._socket)throw Error("WebSocketClientTransport already started! If using Client class, note that connect() calls start() automatically.");return new Promise(($,Z)=>{this._socket=new WebSocket(this._url,Cr8),this._socket.onerror=(X)=>{let Q="error"in X?X.error:Error(`WebSocket error: ${JSON.stringify(X)}`);Z(Q),this.onerror?.(Q)},this._socket.onopen=()=>{$()},this._socket.onclose=()=>{this.onclose?.()},this._socket.onmessage=(X)=>{let Q;try{Q=VY.parse(JSON.parse(X.data))}catch(Y){this.onerror?.(Y);return}this.onmessage?.(Q)}})}async close(){this._socket?.close()}send($){return new Promise((Z,X)=>{if(!this._socket){X(Error("Not connected"));return}this._socket?.send(JSON.stringify($)),Z()})}}var Cr8="mcp";var ir1=D(()=>{e5()});function _r8($){let Z=$;if(!Z||typeof Z!=="object"||!("method"in Z))return null;switch(Z.method){case"initialize":{let X=Z?.params?.protocolVersion;if(!X)return null;return{type:"emit",message:{result:{protocolVersion:X,capabilities:{tools:{}},serverInfo:{name:"deco-chat-server",version:"1.0.0"}},jsonrpc:Z.jsonrpc??"2.0",id:Z.id}}}case"notifications/roots/list_changed":case"notifications/initialized":case"notifications/cancelled":case"notifications/progress":return{type:"suppress"};default:return null}}var O90;var gc0=D(()=>{sf();O90=class O90 extends mW{constructor($,Z){super($,Z)}send($,Z){let X=_r8($);if(X?.type==="emit")return this.onmessage?.(X.message),Promise.resolve();if(X?.type==="suppress")return Promise.resolve();return super.send($,Z)}}});var pr1,nr1=async($,Z,X)=>{let Q=vr8($.connection,Z,X);if(!Q)throw Error("Unknown MCP connection type");let Y=new pr1({name:$?.name??"MCP Client",version:"1.0.0"});return await Y.connect(Q),{client:Y}},vr8=($,Z,X)=>{if($.type==="Websocket")return new yc0(new URL($.url));if($.type!=="SSE"&&$.type!=="HTTP")return null;let Y={...$.token?{authorization:`Bearer ${$.token}`}:{},...X??{},..."headers"in $?$.headers||{}:{}};if($.type==="SSE"){let G={requestInit:{headers:Y,signal:Z}};if($.token)G.eventSourceInit={fetch:(J,W)=>{return fetch(J,{...W,headers:{...Y,Accept:"text/event-stream"},signal:Z})}};return new QF(new URL($.url),G)}return new O90(new URL($.url),{requestInit:{headers:Y,signal:Z,credentials:"include"}})};var tr1=D(()=>{lW();zd();ir1();e5();yX();gc0();pr1=class pr1 extends y9{constructor($,Z){super($,{jsonSchemaValidator:F5,...Z})}async listTools($,Z){return await this.request({method:"tools/list",params:$},bl,Z)}}});function br8($,Z){if(pw.set($,Z),pw.size>fr8){let X=pw.keys().next().value;if(X!==void 0)pw.delete(X)}}function ar1($){let Z=(X)=>{if("connection"in $)return nr1({connection:$.connection},void 0,X);return $.client};return new Proxy({},{get(X,Q){if(Q==="toJSON")return null;if(typeof Q!=="string")throw Error("Name must be a string");if(Q==="listTools")return W;async function Y(K,H=Q){let F=$?.debugId?.(),N=F?{"x-trace-debug-id":F}:void 0,{client:U}=await Z(N),{structuredContent:O,isError:B,content:L}=await U.callTool({name:String(H),arguments:K});if(B){let E=L?.[0]?.text,j=typeof E==="string"?or1(E):null,z=j?.code&&typeof $?.getErrorByStatusCode==="function"?$.getErrorByStatusCode(j.code,j.message,j.traceId):null;if(z)throw z;throw Error(`Tool ${String(H)} returned an error: ${JSON.stringify(O??L)}`)}if(O!==void 0)return O;let w=L?.[0]?.text;return typeof w==="string"?or1(w):void 0}async function G(){let{client:K}=await Z(),{tools:H}=await K.listTools();return H}async function J(){if(!("connection"in $))return G();let K=$.connection,H=JSON.stringify(K);try{if(!pw.has(H))br8(H,G());return await pw.get(H)}catch(F){console.error("Failed to list tools",F),pw.delete(H);return}}async function W(){return(await J()??[]).map((H)=>rr1(H,Y))}return Y.asTool=async()=>{let H=(await J()??[]).find((F)=>F.name===Q);if(!H)throw Error(`Tool ${Q} not found`);return rr1(H,Y)},Y}})}var or1=($)=>{try{return JSON.parse($)}catch{return $}},fr8=500,pw,rr1=($,Z)=>{return{...$,id:$.name,inputSchema:$.inputSchema?U7($.inputSchema):void 0,outputSchema:$.outputSchema?U7($.outputSchema):void 0,execute:(X)=>{return Z(X.context,$.name)}}};var sr1=D(()=>{mr1();tr1();pw=new Map});function bO($){return ar1($)}var _x;var hc0=D(()=>{sr1();_x=new Proxy({},{get($,Z){if(Z==="toJSON")return null;if(Z==="forConnection")return(X)=>bO({connection:X});if(Z==="forClient")return(X)=>bO({client:X});return globalThis[Z]}})});function B90($){return{isImplementedBy:(Z)=>{for(let X of $){let Q=typeof X.name==="string"?new RegExp(`^${X.name}$`):X.name,Y=Z.find((G)=>Q.test(G.name));if(!Y&&X.opt)continue;if(!Y)return!1}return!0}}}var KK=($)=>{return{...B90($),forClient:(Z)=>{return bO({client:Z})},forConnection:(Z)=>{return bO({connection:Z})}}};var nw=D(()=>{hc0()});import{z as y5}from"zod";var er1,D90,$a1,L90,Za1,xr8;var Xa1=D(()=>{nw();er1=y5.object({specversion:y5.literal("1.0").describe("CloudEvents specification version"),id:y5.string().describe("Unique identifier for this event (UUID recommended)"),source:y5.string().describe("Connection ID of the event publisher"),type:y5.string().describe("Event type (e.g., 'order.created', 'user.signup')"),time:y5.string().datetime().optional().describe("Timestamp of when the event occurred (ISO 8601)"),subject:y5.string().optional().describe("Subject/resource identifier (e.g., order ID, user ID)"),datacontenttype:y5.string().optional().default("application/json").describe("Content type of the data attribute"),dataschema:y5.string().url().optional().describe("URI to the schema for the data attribute"),data:y5.unknown().optional().describe("Event payload (any JSON value)")}),D90=y5.object({events:y5.array(er1).min(1).describe("Batch of CloudEvents to process")}),$a1=y5.object({success:y5.boolean().optional().describe("Whether this event was processed successfully"),error:y5.string().optional().describe("Error message for this event"),retryAfter:y5.number().int().positive().optional().describe("Re-deliver this event after this many ms")}),L90=y5.object({success:y5.boolean().optional().describe("Batch success - applies to events not in results"),error:y5.string().optional().describe("Batch error message - applies to events not in results"),processedCount:y5.number().int().min(0).optional().describe("Number of events successfully processed"),retryAfter:y5.number().int().positive().optional().describe("Batch retryAfter - applies to events not in results"),results:y5.record(y5.string(),$a1).optional().describe("Per-event results keyed by event ID")}),Za1=[{name:"ON_EVENTS",inputSchema:D90,outputSchema:L90}],xr8=KK(Za1)});import{z as g5}from"zod";var Qa1,Ya1,Ga1,Ja1,Wa1,Ka1,w90,uc0;var cc0=D(()=>{nw();Qa1=g5.object({type:g5.literal("string"),enum:g5.array(g5.string()).optional(),description:g5.string().optional()}),Ya1=g5.object({type:g5.string(),description:g5.string(),paramsSchema:g5.record(g5.string(),Qa1)}),Ga1=g5.object({}),Ja1=g5.object({triggers:g5.array(Ya1)}),Wa1=g5.object({type:g5.string(),params:g5.record(g5.string(),g5.string()),enabled:g5.boolean(),callbackUrl:g5.url().optional(),callbackToken:g5.string().min(1).optional()}),Ka1=g5.object({success:g5.boolean()}),w90=[{name:"TRIGGER_LIST",inputSchema:Ga1,outputSchema:Ja1},{name:"TRIGGER_CONFIGURE",inputSchema:Wa1,outputSchema:Ka1}],uc0=KK(w90)});import{z as k$}from"zod";var yr8,gr8,hr8,ur8,cr8,lr8,dr8,mr8,ir8,pr8,nr8,tr8,tw;var ui=D(()=>{yr8=k$.object({prefix:k$.string().optional().describe("Filter objects by prefix (e.g., 'folder/' for folder contents)"),maxKeys:k$.number().optional().default(1000).describe("Maximum number of keys to return (default: 1000)"),continuationToken:k$.string().optional().describe("Token for pagination from previous response"),delimiter:k$.string().optional().describe("Delimiter for grouping keys (typically '/'). When set, commonPrefixes returns folder paths.")}),gr8=k$.object({objects:k$.array(k$.object({key:k$.string().describe("Object key/path"),size:k$.number().describe("Object size in bytes"),lastModified:k$.string().describe("Last modified timestamp"),etag:k$.string().describe("Entity tag for the object")})),nextContinuationToken:k$.string().optional().describe("Token for fetching next page of results"),isTruncated:k$.boolean().describe("Whether there are more results available"),commonPrefixes:k$.array(k$.string()).optional().describe("Folder paths when delimiter is used (e.g., ['photos/2024/', 'photos/2025/'])")}),hr8=k$.object({key:k$.string().describe("Object key/path to get metadata for")}),ur8=k$.object({contentType:k$.string().optional().describe("MIME type of the object"),contentLength:k$.number().describe("Size of the object in bytes"),lastModified:k$.string().describe("Last modified timestamp"),etag:k$.string().describe("Entity tag for the object"),metadata:k$.record(k$.string(),k$.string()).optional().describe("Custom metadata key-value pairs")}),cr8=k$.object({key:k$.string().describe("Object key/path to generate URL for"),expiresIn:k$.number().optional().describe("URL expiration time in seconds (default: from state config or 3600)")}),lr8=k$.object({url:k$.string().describe("Presigned URL for downloading the object"),expiresIn:k$.number().describe("Expiration time in seconds that was used")}),dr8=k$.object({key:k$.string().describe("Object key/path for the upload"),expiresIn:k$.number().optional().describe("URL expiration time in seconds (default: from state config or 3600)"),contentType:k$.string().optional().describe("MIME type for the object being uploaded")}),mr8=k$.object({url:k$.string().describe("Presigned URL for uploading the object"),expiresIn:k$.number().describe("Expiration time in seconds that was used")}),ir8=k$.object({key:k$.string().describe("Object key/path to delete")}),pr8=k$.object({success:k$.boolean().describe("Whether the deletion was successful"),key:k$.string().describe("The key that was deleted")}),nr8=k$.object({keys:k$.array(k$.string()).max(1000).describe("Array of object keys/paths to delete (max 1000)")}),tr8=k$.object({deleted:k$.array(k$.string()).describe("Array of successfully deleted keys"),errors:k$.array(k$.object({key:k$.string(),message:k$.string()})).describe("Array of errors for failed deletions")}),tw=[{name:"LIST_OBJECTS",inputSchema:yr8,outputSchema:gr8},{name:"GET_OBJECT_METADATA",inputSchema:hr8,outputSchema:ur8},{name:"GET_PRESIGNED_URL",inputSchema:cr8,outputSchema:lr8},{name:"PUT_PRESIGNED_URL",inputSchema:dr8,outputSchema:mr8},{name:"DELETE_OBJECT",inputSchema:ir8,outputSchema:pr8},{name:"DELETE_OBJECTS",inputSchema:nr8,outputSchema:tr8}]});import{z as E6}from"zod";var Ha1,Fa1,Na1,ci,E90,j90,z90,P90,or8;var lc0=D(()=>{nw();Ha1=E6.object({primary:E6.string().optional().describe("Primary brand color (hex)"),secondary:E6.string().optional().describe("Secondary brand color (hex)"),accent:E6.string().optional().describe("Accent / highlight color (hex)"),background:E6.string().optional().describe("Background color (hex)"),foreground:E6.string().optional().describe("Foreground / text color (hex)")}),Fa1=E6.object({heading:E6.string().optional().describe("Font family for headings"),body:E6.string().optional().describe("Font family for body text"),code:E6.string().optional().describe("Font family for code / monospace")}),Na1=E6.object({logo:E6.string().optional().describe("Logo URL"),favicon:E6.string().optional().describe("Favicon URL"),ogImage:E6.string().optional().describe("Open Graph image URL")}),ci=E6.object({id:E6.string(),name:E6.string().describe("Brand / company name"),domain:E6.string().optional().describe("Company domain (e.g. example.com)"),colors:Ha1.optional().describe("Semantic color palette"),fonts:Fa1.optional().describe("Font families by role"),assets:Na1.optional().describe("Visual identity assets"),overview:E6.string().optional().describe("Company overview / description"),tagline:E6.string().optional().describe("Brand tagline"),tone:E6.string().optional().describe("Tone of voice description"),metadata:E6.record(E6.string(),E6.unknown()).optional().describe("Extra design tokens and metadata")}),E90=E6.object({id:E6.string().optional().describe("Brand ID. Omit to get the default brand.")}),j90=E6.object({}),z90=E6.object({items:E6.array(ci)}),P90=[{name:"BRAND_GET",inputSchema:E90,outputSchema:ci},{name:"BRAND_LIST",inputSchema:j90,outputSchema:z90,opt:!0}],or8=KK(P90)});var dc0=D(()=>{nw();Xa1();cc0();ui();lc0()});import{z as L8}from"zod";function LF($){return L8.object({items:L8.array($).describe("Array of collection items"),totalCount:L8.number().int().min(0).optional().describe("Total number of matching items (if available)"),hasMore:L8.boolean().optional().describe("Whether there are more items available")})}function di($){return L8.object({item:$.nullable().describe("The retrieved item, or null if not found")})}function sr8($){return L8.object({data:$.partial().describe("Data for the new entity (id may be auto-generated)")})}function er8($){return L8.object({item:$.describe("The created entity with generated id")})}function $a8($){return L8.object({id:L8.string().describe("ID of the entity to update"),data:$.partial().describe("Partial entity data to update")})}function Za8($){return L8.object({item:$.describe("The updated entity")})}function ii($){return L8.object({item:$.describe("The deleted entity")})}function T90($,Z,X){let Q=$.toUpperCase(),Y=X?.readOnly??!1,G=[{name:`COLLECTION_${Q}_LIST`,inputSchema:z3,outputSchema:LF(Z)},{name:`COLLECTION_${Q}_GET`,inputSchema:li,outputSchema:di(Z)}];if(!Y)G.push({name:`COLLECTION_${Q}_CREATE`,inputSchema:sr8(Z),outputSchema:er8(Z),opt:!0},{name:`COLLECTION_${Q}_UPDATE`,inputSchema:$a8(Z),outputSchema:Za8(Z),opt:!0},{name:`COLLECTION_${Q}_DELETE`,inputSchema:mi,outputSchema:ii(Z),opt:!0});return G}var A90,rr8,Ua1,ar8,z3,li,mi;var cG=D(()=>{A90=L8.object({id:L8.string().describe("Unique identifier for the entity"),title:L8.string().describe("Human-readable title for the entity"),description:L8.string().nullish().describe("Description of the entity"),created_at:L8.string().datetime(),updated_at:L8.string().datetime(),created_by:L8.string().optional(),updated_by:L8.string().optional()}),rr8=L8.object({field:L8.array(L8.string()),operator:L8.enum(["eq","gt","gte","lt","lte","in","like","contains"]),value:L8.unknown()}),Ua1=L8.lazy(()=>L8.union([rr8,L8.object({operator:L8.enum(["and","or","not"]),conditions:L8.array(Ua1)})])),ar8=L8.object({field:L8.array(L8.string()),direction:L8.enum(["asc","desc"]),nulls:L8.enum(["first","last"]).optional()}),z3=L8.object({where:Ua1.optional().describe("Filter expression"),orderBy:L8.array(ar8).optional().describe("Sort expressions"),limit:L8.number().int().min(1).max(1000).optional().describe("Maximum number of items to return"),offset:L8.number().int().min(0).optional().describe("Number of items to skip")});li=L8.object({id:L8.string().describe("ID of the entity to retrieve")});mi=L8.object({id:L8.string().describe("ID of the entity to delete")})});import{z as vx}from"zod";var Xa8,Qa8,Oa1;var Ba1=D(()=>{cG();Xa8=A90.extend({avatar:vx.string().describe("URL or data URI to the assistant's avatar image"),system_prompt:vx.string().describe("System prompt that defines the assistant's behavior"),virtual_mcp_id:vx.string().describe("Virtual MCP ID to use for this assistant"),model:vx.object({id:vx.string().describe("Model ID"),connectionId:vx.string().describe("Connection ID that provides the model")}).describe("Selected model reference for this assistant")}),Qa8=T90("assistant",Xa8),Oa1=[...Qa8]});import{z as H0}from"zod";var pi,wF,La1,Ya8,Ga8,wa1,Ja8,Wa8,Ka8,Ha8,Fa8,Na8,Ea1,Ua8,Oa8,Ba8,Da8,La8,wa8,Ea8,ja8,za8,Pa8,wZ5,Aa8,EZ5,Da1,Ta8,Ra8,R90,jZ5;var ja1=D(()=>{nw();cG();pi=H0.lazy(()=>H0.union([H0.null(),H0.string(),H0.number(),H0.boolean(),H0.record(H0.string(),pi),H0.array(pi)])),wF=H0.record(H0.string(),H0.record(H0.string(),pi)).optional().describe("Additional provider-specific options. Outer record keyed by provider name, inner by option key"),La1=H0.object({type:H0.literal("text"),text:H0.string().describe("The text content"),providerOptions:wF}),Ya8=H0.object({type:H0.literal("text"),text:H0.string().describe("The text content"),providerMetadata:H0.any().optional().describe("Additional provider-specific metadata")}),Ga8=H0.string().describe("File data as URL string"),wa1=H0.object({type:H0.literal("file"),filename:H0.string().optional().describe("Optional filename of the file"),data:Ga8,mediaType:H0.string().describe("IANA media type of the file (e.g., image/png, audio/mp3)"),providerOptions:wF}),Ja8=H0.object({type:H0.literal("file"),mediaType:H0.string().describe("IANA media type of the file (e.g., image/png, audio/mp3)"),data:H0.string().describe("Generated file data as base64 encoded string")}),Wa8=H0.object({type:H0.literal("reasoning"),text:H0.string().describe("The reasoning text"),providerOptions:wF}),Ka8=H0.object({type:H0.literal("reasoning"),text:H0.string().describe("The reasoning text"),providerMetadata:H0.any().optional().describe("Additional provider-specific metadata")}),Ha8=H0.object({type:H0.literal("tool-call"),toolCallId:H0.string().describe("ID of the tool call, used to match with tool result"),toolName:H0.string().describe("Name of the tool being called"),input:H0.string().describe("Arguments of the tool call (JSON-serializable object matching tool input schema)"),providerExecuted:H0.boolean().optional().describe("Whether the tool call will be executed by the provider"),providerOptions:wF}),Fa8=H0.object({type:H0.literal("tool-call"),toolCallId:H0.string().describe("ID of the tool call"),toolName:H0.string().describe("Name of the tool being called"),input:H0.string().describe("Stringified JSON object with the tool call arguments"),providerExecuted:H0.boolean().optional().describe("Whether the tool call will be executed by the provider"),providerMetadata:H0.any().optional().describe("Additional provider-specific metadata")}),Na8=H0.union([H0.object({type:H0.literal("text"),value:H0.string()}),H0.object({type:H0.literal("json"),value:pi}),H0.object({type:H0.literal("error-text"),value:H0.string()}),H0.object({type:H0.literal("error-json"),value:pi}),H0.object({type:H0.literal("content"),value:H0.array(H0.union([H0.object({type:H0.literal("text"),text:H0.string().describe("Text content")}),H0.object({type:H0.literal("media"),data:H0.string().describe("Base-64 encoded media data"),mediaType:H0.string().describe("IANA media type")})]))}),H0.object({type:H0.literal("execution-denied"),reason:H0.string().optional()}),H0.string().describe("Raw or JSON-serialized output (e.g. from AI SDK mapToolResultOutput)")]),Ea1=H0.object({type:H0.literal("tool-result"),toolCallId:H0.string().describe("ID of the tool call that this result is associated with"),toolName:H0.string().describe("Name of the tool that generated this result"),output:Na8.describe("Result of the tool call"),result:H0.unknown().describe("Unknown result of the tool call"),providerOptions:wF}),Ua8=H0.object({type:H0.literal("tool-result"),toolCallId:H0.string().describe("ID of the tool call that this result is associated with"),toolName:H0.string().describe("Name of the tool that generated this result"),result:H0.any().describe("Result of the tool call (JSON-serializable)"),isError:H0.boolean().optional().describe("Whether the result is an error or error message"),providerExecuted:H0.boolean().optional().describe("Whether the tool result was generated by the provider"),providerMetadata:H0.any().optional().describe("Additional provider-specific metadata")}),Oa8=H0.union([H0.object({type:H0.literal("source"),sourceType:H0.literal("url"),id:H0.string().describe("The ID of the source"),url:H0.string().describe("The URL of the source"),title:H0.string().optional().describe("The title of the source"),providerMetadata:H0.any().optional().describe("Additional provider-specific metadata")}),H0.object({type:H0.literal("source"),sourceType:H0.literal("document"),id:H0.string().describe("The ID of the source"),mediaType:H0.string().describe("IANA media type of the document (e.g., application/pdf)"),title:H0.string().describe("The title of the document"),filename:H0.string().optional().describe("Optional filename of the document"),providerMetadata:H0.any().optional().describe("Additional provider-specific metadata")})]),Ba8=H0.object({role:H0.literal("system"),content:H0.string().describe("System message content"),providerOptions:wF}),Da8=H0.object({role:H0.literal("user"),content:H0.array(H0.union([La1,wa1])).describe("User message content parts (text or file)"),providerOptions:wF}),La8=H0.object({role:H0.literal("assistant"),content:H0.array(H0.union([La1,wa1,Wa8,Ha8,Ea1])).describe("Assistant message content parts (text, file, reasoning, tool-call, or tool-result)"),providerOptions:wF}),wa8=H0.object({role:H0.literal("tool"),content:H0.array(Ea1).describe("Tool message content (tool results)"),providerOptions:wF}),Ea8=H0.union([Ba8,Da8,La8,wa8]),ja8=H0.array(Ea8).describe("A list of messages forming the prompt"),za8=H0.object({prompt:ja8.describe("A language model prompt is a standardized prompt type (array of messages with roles: system, user, assistant, tool)"),maxOutputTokens:H0.number().optional().describe("Maximum number of tokens to generate"),temperature:H0.number().optional().describe("Temperature setting. The range depends on the provider and model"),topP:H0.number().optional().describe("Nucleus sampling parameter"),topK:H0.number().optional().describe("Only sample from the top K options for each subsequent token. Used to remove long tail low probability responses"),presencePenalty:H0.number().optional().describe("Presence penalty setting. It affects the likelihood of the model to repeat information that is already in the prompt"),frequencyPenalty:H0.number().optional().describe("Frequency penalty setting. It affects the likelihood of the model to repeatedly use the same words or phrases"),seed:H0.number().optional().describe("The seed (integer) to use for random sampling. If set and supported by the model, calls will generate deterministic results"),stopSequences:H0.array(H0.string()).optional().describe("Stop sequences. If set, the model will stop generating text when one of the stop sequences is generated"),responseFormat:H0.union([H0.object({type:H0.literal("text")}),H0.object({type:H0.literal("json"),schema:H0.any().optional().describe("JSON schema that the generated output should conform to"),name:H0.string().optional().describe("Name of output that should be generated"),description:H0.string().optional().describe("Description of the output that should be generated")})]).optional().describe("Response format. The output can either be text or JSON. Default is text"),tools:H0.array(H0.any()).optional().describe("The tools that are available for the model"),toolChoice:H0.any().optional().describe("Specifies how the tool should be selected. Defaults to 'auto'"),includeRawChunks:H0.boolean().optional().describe("Include raw chunks in the stream. Only applicable for streaming calls"),abortSignal:H0.any().optional().describe("Abort signal for cancelling the operation"),providerOptions:H0.any().optional().describe("Additional provider-specific options")}),Pa8=H0.object({content:H0.array(H0.union([Ya8,Ja8,Ka8,Fa8,Ua8,Oa8])).describe("Ordered content that the model has generated (text, tool-calls, reasoning, files, sources)"),finishReason:H0.enum(["stop","length","content-filter","tool-calls","error","other","unknown"]).describe("Reason why generation stopped"),usage:H0.looseObject({inputTokens:H0.number().optional(),outputTokens:H0.number().optional(),totalTokens:H0.number().optional(),reasoningTokens:H0.number().optional()}).describe("Usage information for the language model call"),providerMetadata:H0.any().optional().describe("Additional provider-specific metadata"),request:H0.object({body:H0.any().optional().describe("Request HTTP body sent to the provider API")}).optional().describe("Optional request information for telemetry and debugging"),response:H0.object({id:H0.string().optional().describe("ID for the generated response"),timestamp:H0.iso.datetime().optional().describe("Timestamp for the start of the generated response"),modelId:H0.string().optional().describe("The ID of the response model that was used"),headers:H0.record(H0.string(),H0.string()).optional().describe("Response headers"),body:H0.any().optional().describe("Response HTTP body")}).optional().describe("Optional response information for telemetry and debugging"),warnings:H0.array(H0.any()).describe("Warnings for the call, e.g. unsupported settings")}),wZ5=H0.object({stream:H0.any().describe("ReadableStream of LanguageModelV2StreamPart"),request:H0.object({body:H0.any().optional().describe("Request HTTP body sent to the provider API")}).optional().describe("Optional request information for telemetry and debugging"),response:H0.object({headers:H0.record(H0.string(),H0.string()).optional().describe("Response headers")}).optional().describe("Optional response data")}),Aa8=H0.object({supportedUrls:H0.record(H0.string(),H0.array(H0.string())).describe("Supported URL patterns by media type for the provider")}),EZ5=H0.object({modelId:H0.string().describe("The ID of the model"),logo:H0.string().nullable(),description:H0.string().nullable(),capabilities:H0.array(H0.string()),limits:H0.object({contextWindow:H0.number(),maxOutputTokens:H0.number()}).nullable(),costs:H0.object({input:H0.number(),output:H0.number()}).nullable(),provider:H0.enum(["openai","anthropic","google","x-ai","deepseek","openai-compatible","openrouter"]).nullable()}),Da1=H0.object({modelId:H0.string().describe("The ID of the model"),callOptions:za8}),Ta8=A90.extend({logo:H0.string().nullable(),description:H0.string().nullable(),capabilities:H0.array(H0.string()),limits:H0.object({contextWindow:H0.number(),maxOutputTokens:H0.number()}).nullable(),costs:H0.object({input:H0.number(),output:H0.number()}).nullable(),provider:H0.enum(["openai","anthropic","google","xai","deepseek","openai-compatible","openrouter"]).nullable()}),Ra8=T90("llm",Ta8,{readOnly:!0}),R90=[{name:"LLM_METADATA",inputSchema:H0.object({modelId:H0.string().describe("The ID of the model")}),outputSchema:Aa8},{name:"LLM_DO_STREAM",inputSchema:Da1},{name:"LLM_DO_GENERATE",inputSchema:Da1,outputSchema:Pa8},...Ra8],jZ5=KK(R90)});import{z as ow}from"zod";var Ia8,za1;var Pa1=D(()=>{Ia8=ow.object({scopes:ow.array(ow.string()).describe("List of scopes available"),stateSchema:ow.record(ow.string(),ow.unknown()).describe("JSON Schema (draft-07) defining the state structure")}),za1=[{name:"MCP_CONFIGURATION",inputSchema:ow.object({}),outputSchema:Ia8}]});import{z as h5}from"zod";var qa8,Ma8,Aa1;var Ta1=D(()=>{qa8=h5.object({}).strict(),Ma8=h5.object({billing:h5.object({mode:h5.enum(["prepaid","postpaid"]),limitPeriod:h5.enum(["daily","weekly","monthly"]).nullable()}),limit:h5.object({total:h5.number().nullable(),remaining:h5.number().nullable(),reset:h5.string().nullable()}),usage:h5.object({total:h5.number(),daily:h5.number(),weekly:h5.number(),monthly:h5.number()}),alert:h5.object({enabled:h5.boolean(),threshold_usd:h5.number(),email:h5.string().nullable()}),connectionId:h5.string()}),Aa1=[{name:"GATEWAY_USAGE",inputSchema:qa8,outputSchema:Ma8},{name:"GATEWAY_SET_LIMIT",inputSchema:h5.object({}),outputSchema:h5.object({}),opt:!0},{name:"GATEWAY_SET_ALERT",inputSchema:h5.object({}),outputSchema:h5.object({}),opt:!0}]});import{z as Ra1}from"zod";function lG(){return qY()===null}function I90($,Z){return $===g8.DEV_ASSETS(Z)}function fx($,Z){let X=ty1(Z,$),Q=new Date().toISOString();return{id:X.id??g8.DEV_ASSETS($),title:X.title,description:X.description??null,icon:X.icon??null,app_name:X.app_name??null,app_id:X.app_id??null,organization_id:$,created_by:"system",created_at:Q,updated_at:Q,connection_type:X.connection_type,connection_url:X.connection_url??null,connection_token:null,connection_headers:null,oauth_config:null,configuration_state:null,configuration_scopes:null,metadata:X.metadata??null,tools:ka8,bindings:["OBJECT_STORAGE"],status:"active"}}var ka8;var bx=D(()=>{fL();ui();P8();ka8=tw.map(($)=>({name:$.name,description:`${$.name} operation for local file storage`,inputSchema:Ra1.toJSONSchema($.inputSchema),outputSchema:Ra1.toJSONSchema($.outputSchema)}))});function Ia1($,Z){return $||Z===0}function qa1($,Z,X,Q,Y){let G=Z?Y+1:Y,J=$.slice(0,X),W=Q+X<G;return{items:J,totalCount:G,hasMore:W}}function Ma1($,Z,X){if(!X)return{sqlOffset:$,sqlLimit:Z};if($===0)return{sqlOffset:0,sqlLimit:Math.max(Z-1,0)};return{sqlOffset:$-1,sqlLimit:Z}}function Va8($,Z){if(Z.length===0)return;let[X,...Q]=Z,Y=X==="slug"?lU($):$[X];for(let G of Q){if(Y===null||typeof Y!=="object")return;Y=Y[G]}return Y}function Sa8($){let X=$.replace(/[.*+?^${}()|[\]\\]/g,"\\$&").replace(/%/g,".*").replace(/_/g,".");return new RegExp(`^${X}$`,"i")}function Ca8($,Z,X){if($===void 0)return!0;switch(Z){case"eq":return X===null?$===null:$===X;case"gt":return $>X;case"gte":return $>=X;case"lt":return $<X;case"lte":return $<=X;case"in":return Array.isArray(X)&&X.includes($);case"like":return typeof $==="string"&&Sa8(String(X)).test($);case"contains":return String($).toLowerCase().includes(String(X).toLowerCase());default:return!0}}function ni($,Z){if(!Z)return!0;if("conditions"in Z){let{operator:Q,conditions:Y}=Z;if(Y.length===0)return!0;switch(Q){case"and":return Y.every((G)=>ni($,G));case"or":return Y.some((G)=>ni($,G));case"not":return!Y.every((G)=>ni($,G));default:return!0}}let X=Va8($,Z.field);return Ca8(X,Z.operator,Z.value)}var ka1=D(()=>{V40()});import{z as xO}from"zod";var _a8=8,va8,fa8,ba8,xa8,mc0;var Va1=D(()=>{dc0();Ba1();cG();ja1();Pa1();ui();Ta1();P8();S0();L9();xY();DF();bx();yW();V40();ka1();va8=[{name:/^(COLLECTION_REGISTRY_APP_LIST|REGISTRY_ITEM_LIST)$/,inputSchema:xO.object({})}],fa8={LLM:R90,LLMS:R90,ASSISTANTS:Oa1,MCP:za1,OBJECT_STORAGE:tw,AI_GATEWAY_BILLING:Aa1,TRIGGER:w90,REGISTRY:va8,BRAND:P90},ba8=z3.extend({binding:xO.union([xO.array(xO.object({}).passthrough()),xO.object({}).passthrough(),xO.string()]).optional(),include_virtual:xO.boolean().optional().describe("Whether to include VIRTUAL connections in the results. Defaults to false."),slug:xO.string().optional().describe("Filter by connection slug. Matches against app_name, or a slug derived from connection_url or title.")}),xa8=LF(g7),mc0=c({name:"COLLECTION_CONNECTIONS_LIST",description:"List all connections in the organization with filtering, sorting, and pagination",annotations:{title:"List Connections",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:ba8,outputSchema:xa8,handler:async($,Z)=>{await Z.access.check();let X=t(Z),Q=$.binding?typeof $.binding==="string"?(()=>{let E=fa8[$.binding.toUpperCase()];if(!E)throw Error(`Unknown binding: ${$.binding}`);return E})():$.binding:void 0,Y=Q?B90(Q):void 0,G=!!Y,J=$.limit??100,W=$.offset??0,K=f9(),H=g8.DEV_ASSETS(X.id),F=fx(X.id,K),N=(!$.slug||lU(F)===$.slug)&&ni(F,$.where),U=lG()&&!G&&N,{sqlOffset:O,sqlLimit:B}=Ma1(W,J,U),{items:L,totalCount:w}=await Z.storage.connections.list(X.id,{includeVirtual:$.include_virtual??!1,slug:$.slug,where:$.where,orderBy:$.orderBy,limit:G?void 0:B,offset:G?void 0:O});if(Y){let E=Z9(),j=g8.SELF(X.id);await o50(L,_a8,async(z)=>{if(z.tools!==null)return;let A=z.id===j?async()=>{let{listManagementTools:I}=await Promise.resolve().then(() => (yO(),q90));return I(Z)}:()=>fc0(z,Z,S40),P=await vO("tools",z.id,A,E,(I)=>Z.pendingRevalidations.push(I),_O);if(P!==null)z.tools=P})}if(lG()&&Ia1(G,W)&&N&&!L.some((E)=>E.id===H))L.unshift(F);if(G){let E=(await Promise.all(L.map(async(P)=>{if(!P.tools||P.tools.length===0)return null;return Y.isImplementedBy(P.tools.map((q)=>({name:q.name,inputSchema:q.inputSchema,outputSchema:q.outputSchema})))?P:null}))).filter((P)=>P!==null),j=E.length,z=E.slice(W,W+J),A=W+J<j;return{items:z,totalCount:j,hasMore:A}}return qa1(L,U,J,W,w)}})});var ya8,ic0;var Sa1=D(()=>{cG();P8();S0();L9();xY();DF();bx();yW();ya8=di(g7),ic0=c({name:"COLLECTION_CONNECTIONS_GET",description:"Get a connection's configuration, tools list, and status by ID.",annotations:{title:"Get Connection",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},_meta:{ui:{visibility:["app"]}},inputSchema:li,outputSchema:ya8,handler:async($,Z)=>{let X=t(Z);if(await Z.access.check(),lG()&&I90($.id,X.id))return{item:fx(X.id,f9())};let Q=await Z.storage.connections.findById($.id);if(!Q||Q.organization_id!==X.id)return{item:null};if(Q.tools===null){let Y=g8.SELF(X.id),G=Q.id===Y?async()=>{let{listManagementTools:W}=await Promise.resolve().then(() => (yO(),q90));return W(Z)}:async()=>{let W=await N5(Q,Z,!0);try{return(await W.listTools()).tools}finally{await W.close().catch(()=>{})}},J=await vO("tools",Q.id,G,Z9(),(W)=>Z.pendingRevalidations.push(W),_O);if(J!==null)Q.tools=J}return{item:Q}}})});class l6{db;vault;constructor($,Z){this.db=$;this.vault=Z}async get($){let Z=await this.db.selectFrom("downstream_tokens").selectAll().where("connectionId","=",$).executeTakeFirst();if(!Z)return null;return this.decryptToken(Z)}async upsert($){let Z=new Date().toISOString(),X=await this.vault.encrypt($.accessToken),Q=$.refreshToken?await this.vault.encrypt($.refreshToken):null,Y=$.clientSecret?await this.vault.encrypt($.clientSecret):null,G=$.expiresAt?.toISOString()??null,J=await this.db.insertInto("downstream_tokens").values({id:t8("dtok"),connectionId:$.connectionId,accessToken:X,refreshToken:Q,scope:$.scope,expiresAt:G,clientId:$.clientId,clientSecret:Y,tokenEndpoint:$.tokenEndpoint,createdAt:Z,updatedAt:Z}).onConflict((W)=>W.column("connectionId").doUpdateSet({accessToken:X,refreshToken:Q,scope:$.scope,expiresAt:G,clientId:$.clientId,clientSecret:Y,tokenEndpoint:$.tokenEndpoint,updatedAt:Z})).returning(["id","createdAt"]).executeTakeFirstOrThrow();return{id:J.id,connectionId:$.connectionId,accessToken:$.accessToken,refreshToken:$.refreshToken,scope:$.scope,expiresAt:$.expiresAt,createdAt:J.createdAt,updatedAt:Z,clientId:$.clientId,clientSecret:$.clientSecret,tokenEndpoint:$.tokenEndpoint}}async delete($){await this.db.deleteFrom("downstream_tokens").where("connectionId","=",$).execute()}isExpired($,Z=0){if(!$.expiresAt)return!1;let Q=($.expiresAt instanceof Date?$.expiresAt:new Date($.expiresAt)).getTime();if(Number.isNaN(Q))return!0;return Q-Z<Date.now()}async decryptToken($){let Z=await this.vault.decrypt($.accessToken),X=$.refreshToken?await this.vault.decrypt($.refreshToken):null,Q=$.clientSecret?await this.vault.decrypt($.clientSecret):null;return{id:$.id,connectionId:$.connectionId,accessToken:Z,refreshToken:X,scope:$.scope,expiresAt:$.expiresAt,createdAt:$.createdAt,updatedAt:$.updatedAt,clientId:$.clientId,clientSecret:Q,tokenEndpoint:$.tokenEndpoint}}}var dG=D(()=>{gX()});function xx(...$){if(ca8)console.log("[mcp-read-cache]",...$)}function la8($){return $.kind==="org"?"org":`u:${$.userId}`}function pc0($){if($===null||typeof $!=="object")return JSON.stringify($)??"null";if(Array.isArray($))return`[${$.map(pc0).join(",")}]`;return`{${Object.keys($).sort().map((X)=>`${JSON.stringify(X)}:${pc0($[X])}`).join(",")}}`}class V90{config;maxEntries;now;maxTotalBytes;store=new Map;revalidating=new Set;totalBytes=0;constructor($=ga8,Z=ha8,X=()=>Date.now(),Q=ua8){this.config=$;this.maxEntries=Z;this.now=X;this.maxTotalBytes=Q}stats(){return{entries:this.store.size,bytes:this.totalBytes}}deleteKey($){let Z=this.store.get($);if(Z)this.store.delete($),this.totalBytes-=Z.bytes}key($,Z,X,Q){return`${Z}:${la8(X)}:${$}:${pc0(Q)}`}storeSet($,Z,X,Q){let Y;try{Y=JSON.stringify(Z).length}catch{xx("SKIP non-serializable",$);return}if(Y>Q){xx("SKIP oversize",$,`${Y}b > cap ${Q}b`);return}this.deleteKey($);while(this.store.size>0&&(this.store.size>=this.maxEntries||this.totalBytes+Y>this.maxTotalBytes)){let G=this.store.keys().next().value;if(G===void 0)break;this.deleteKey(G)}this.store.set($,{value:Z,storedAt:X,bytes:Y}),this.totalBytes+=Y}async fetch($){let{type:Z,connectionId:X,scope:Q,params:Y,fetchLive:G,shouldCache:J,onRevalidation:W}=$,K=this.config[Z],H=this.key(Z,X,Q,Y),F=this.now(),N=this.store.get(H),U=N?F-N.storedAt:1/0;if(!N||U>K.maxStaleMs){M90.add(1,{type:Z,outcome:"miss"}),xx(N?"EXPIRED":"MISS",H);let O=await G();if(J?.(O)??!0)this.storeSet(H,O,this.now(),K.maxValueBytes);else xx("NOT-CACHED (shouldCache=false)",H);return O}if(this.store.delete(H),this.store.set(H,N),U>K.revalidateAfterMs&&!this.revalidating.has(H)){M90.add(1,{type:Z,outcome:"stale"}),xx("STALE \u2192 serve + revalidate",H,`age=${U}ms`),this.revalidating.add(H);let O=G().then((B)=>{if(J?.(B)??!0)this.storeSet(H,B,this.now(),K.maxValueBytes)}).catch(()=>{M90.add(1,{type:Z,outcome:"error"})}).finally(()=>this.revalidating.delete(H));W?.(O)}else M90.add(1,{type:Z,outcome:"hit"}),xx("HIT",H,`age=${U}ms`);return N.value}invalidate($){let Z=`${$}:`;for(let X of[...this.store.keys()])if(X.startsWith(Z))this.deleteKey(X)}}function tc0(){return b0().mcpCacheEnabled}function S90(){return tc0()?nc0:null}var M90,k90=1024,Ca1,ga8,ha8=2000,ua8,ca8,nc0;var ti=D(()=>{I6();q$();M90=L$.createCounter("mcp_read_cache.fetches",{description:"MCP read cache outcomes (hit, stale, miss, error)",unit:"{fetches}"}),Ca1=k90*k90,ga8={"tools/call":{revalidateAfterMs:30000,maxStaleMs:300000,maxValueBytes:512*k90},"resources/read":{revalidateAfterMs:60000,maxStaleMs:300000,maxValueBytes:4*Ca1},"prompts/get":{revalidateAfterMs:60000,maxStaleMs:300000,maxValueBytes:512*k90}},ua8=256*Ca1,ca8=typeof process<"u"&&!!process.env?.MCP_CACHE_DEBUG;nc0=new V90;L$.createObservableGauge("mcp_read_cache.entries",{description:"Current entry count in the per-pod MCP read cache",unit:"{entries}"}).addCallback(($)=>$.observe(nc0.stats().entries));L$.createObservableGauge("mcp_read_cache.bytes",{description:"Approximate total bytes held in the per-pod MCP read cache",unit:"By"}).addCallback(($)=>$.observe(nc0.stats().bytes))});function fa1($){S90()?.invalidate($)}function yx($){fa1($);let Z=oc0?.();if(!Z)return;try{Z.publish(_a1,da8.encode(JSON.stringify({connectionId:$,originId:va1})))}catch(X){console.warn("[McpCacheInvalidation] publish failed (non-critical):",X)}}function ba1($){if(oc0=$,oi)return;let Z=$();if(!Z)return;oi=Z.subscribe(_a1),(async()=>{for await(let X of oi)try{let Q=JSON.parse(ma8.decode(X.data));if(Q.originId===va1)continue;fa1(Q.connectionId)}catch{}})().catch(console.error)}function xa1(){oi?.unsubscribe(),oi=null,oc0=void 0}var _a1="studio.mcp-cache.invalidate",va1,da8,ma8,oc0,oi=null;var ri=D(()=>{ti();va1=crypto.randomUUID(),da8=new TextEncoder,ma8=new TextDecoder});import{z as rc0}from"zod";function pa8($){let Z={...$};for(let X of ia8)delete Z[X];return Z}function na8($,Z){return $.connection_url!==void 0?$.connection_url:Z}function ra8($,Z){return $.length===Z.length&&$.every((X,Q)=>X===Z[Q])}var ia8,ta8,oa8,ac0;var ya1=D(()=>{DF();dG();S0();q$();xY();ri();bc0();qi();yW();ia8=["id","organization_id","created_by","created_at"];ta8=rc0.object({id:rc0.string().describe("ID of the connection to update"),data:a$0.describe("Partial connection data to update")}),oa8=rc0.object({item:g7.describe("The updated connection entity")});ac0=c({name:"COLLECTION_CONNECTIONS_UPDATE",description:"Update a connection's configuration. Re-fetches tools from the server on URL change.",annotations:{title:"Update Connection",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:ta8,outputSchema:oa8,handler:async($,Z)=>{r(Z);let X=t(Z);await Z.access.check();let Q=Y1(Z);if(!Q)throw Error("User ID required to update connection");let{id:Y}=$,G=pa8($.data),J=G.configuration_state!==void 0||G.configuration_scopes!==void 0,W=await Z.storage.connections.findById(Y);if(!W||W.organization_id!==X.id)throw Error("Connection not found in organization");let K=G.connection_type??W.connection_type,H=na8(G,W.connection_url);if(K==="VIRTUAL"){let f=Mf(H);if(!f)throw Error("VIRTUAL connection requires connection_url in format: virtual://$virtual_mcp_id");let x=await Z.storage.virtualMcps.findById(f);if(!x)throw Error(`Virtual MCP not found: ${f}`);if(x.organization_id!==X.id)throw Error("Virtual MCP does not belong to the current organization");H=kf(f)}let F=G.configuration_state??W.configuration_state??{},N=G.configuration_scopes??W.configuration_scopes??[];if(J){if(G.configuration_state!==void 0)F=G.configuration_state??{};else if(F===null||F===void 0)F={};if(G.configuration_scopes!==void 0)N=G.configuration_scopes??[];if(N.length>0){let f=F;xi(f,N,X.id),await gi(f,N,X.id,Z)}}if(K==="STDIO"&&!b0().localMode)throw Error("STDIO connections are only available in local mode (--local-mode).");let U=G.connection_token??W.connection_token;if(!U)try{let x=await new l6(Z.db,Z.vault).get(Y);if(x?.accessToken)U=x.accessToken}catch{}let O=await kO({id:W.id,title:G.title??W.title,connection_type:K,connection_url:H,connection_token:U,connection_headers:G.connection_headers??W.connection_headers}).catch(()=>null),B=O?.tools?.length?O.tools:null,L=!1;if(G.configuration_scopes===void 0&&O?.scopes?.length)L=!ra8(N,O.scopes),N=O.scopes;if(xi(F,N,X.id),L&&N.length>0)await gi(F,N,X.id,Z);let w=J||L,E=w?yi(F,N):[],j=w?yi(W.configuration_state??{},W.configuration_scopes??[]):[],z=W.configuration_state,A=z==null||Object.keys(z).length===0,P,I,q=async()=>{try{await Z.storage.connectionCredentialVault.replaceGrantsForSubject({organizationId:X.id,subjectConnectionId:Y,createdBy:Q,grants:j})}catch(f){console.error("Failed to restore credential grants after credential vault mutation failed",f)}},M={...G,connection_url:H,tools:null,configuration_state:F,configuration_scopes:N,updated_by:Q},C={...W,...M};if(w)try{if(await Z.storage.connectionCredentialVault.replaceGrantsForSubject({organizationId:X.id,subjectConnectionId:Y,createdBy:Q,grants:E}),E.length>0){if(!await Z.storage.connectionCredentialVault.findActiveWorkloadToken({organizationId:X.id,subjectConnectionId:Y})){let{plaintextToken:x,record:n}=await Z.storage.connectionCredentialVault.createOrRotateWorkloadToken({organizationId:X.id,subjectConnectionId:Y});I=n.id,P={baseUrl:Z.baseUrl,org:X.slug??X.id,subjectConnectionId:Y,token:x}}}}catch(f){if(I)await Z.storage.connectionCredentialVault.revokeWorkloadToken({organizationId:X.id,subjectConnectionId:Y,tokenId:I});throw await q(),f}if(w&&F&&N)try{await(await N5(C,Z,!1)).callTool({name:"ON_MCP_CONFIGURATION",arguments:{state:F,scopes:N,firstRun:A,...P?{vault:P}:{}}})}catch(f){if(console.error("Failed to invoke ON_MCP_CONFIGURATION callback",f),I)await Z.storage.connectionCredentialVault.revokeWorkloadToken({organizationId:X.id,subjectConnectionId:Y,tokenId:I});if(E.length>0)throw await q(),f}let l;try{l=await Z.storage.connections.update(Y,M)}catch(f){if(w){if(I)await Z.storage.connectionCredentialVault.revokeWorkloadToken({organizationId:X.id,subjectConnectionId:Y,tokenId:I});await q()}throw f}if(B)Z9()?.set("tools",Y,B).catch(()=>{});return yx(Y),{item:l}}})});import{z as aa8}from"zod";var sa8,sc0;var ga1=D(()=>{cG();C4();S0();xY();ri();yW();sa8=mi.extend({force:aa8.boolean().optional().describe("If true, removes this connection from all agents that reference it before deleting")}),sc0=c({name:"COLLECTION_CONNECTIONS_DELETE",description:"Permanently delete a connection. Set force=true to auto-remove from referencing Virtual MCPs.",annotations:{title:"Delete Connection",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:sa8,outputSchema:ii(g7),handler:async($,Z)=>{r(Z);let X=t(Z);await Z.access.check();let Q=await Z.storage.connections.findById($.id);if(!Q)throw Error(`Connection not found: ${$.id}`);if(Q.organization_id!==X.id)throw Error("Connection not found in organization");if(Q.metadata?.isFixed===!0)throw Error("This connection is a fixed system connection and cannot be deleted");let G=await Z.storage.virtualMcps.listByConnectionId(X.id,$.id);if(G.length>0)if($.force)await Z.storage.virtualMcps.removeConnectionReferences($.id);else throw Error(JSON.stringify({code:"CONNECTION_IN_USE",agentNames:G.map((K)=>K.title)}));await Z.storage.connections.delete($.id);let J=await Z.storage.organizationSettings.get(X.id);if(J?.registry_config){let{registries:K,blockedMcps:H}=J.registry_config;if($.id in K){let{[$.id]:F,...N}=K;await Z.storage.organizationSettings.upsert(X.id,{registry_config:{registries:N,blockedMcps:H}})}}Z9()?.invalidate($.id).catch(()=>{}),yx($.id);let W=Y1(Z);if(W)y1.capture({distinctId:W,event:"connection_deleted",groups:{organization:X.id},properties:{connection_id:Q.id,connection_type:Q.connection_type,app_name:Q.app_name??null,organization_id:X.id,forced:$.force??!1}});return{item:Q}}})});import{z as gx}from"zod";var ec0;var ha1=D(()=>{S0();ec0=c({name:"CONNECTION_TEST",description:"Test connection health and latency",annotations:{title:"Test Connection",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!0},inputSchema:gx.object({id:gx.string()}),outputSchema:gx.object({id:gx.string(),healthy:gx.boolean(),latencyMs:gx.number()}),handler:async($,Z)=>{let X=t(Z);await Z.access.check();let Q=await Z.storage.connections.findById($.id);if(!Q||Q.organization_id!==X.id)throw Error("Connection not found");let Y=await Z.storage.connections.testConnection($.id);return{id:$.id,...Y}}})});var ua1=D(()=>{ur1();Va1();Sa1();ya1();ga1();ha1()});import{sql as _4}from"kysely";import{z as HK}from"zod";function ca1($){if($===null||$===void 0)return"NULL";if(typeof $==="number")return String($);if(typeof $==="boolean")return $?"TRUE":"FALSE";if(typeof $==="string")return`'${$.replace(/'/g,"''")}'`;if($ instanceof Date)return`'${$.toISOString()}'`;return`'${JSON.stringify($).replace(/'/g,"''")}'`}function Zs8($,Z){let X=$;for(let Y=Z.length;Y>=1;Y--){let G=`$${Y}`;if(X.includes(G))X=X.replaceAll(G,ca1(Z[Y-1]))}let Q=[];for(let Y=0;Y<X.length;Y++)if(X[Y]==="?")Q.push(Y);for(let Y=Math.min(Q.length,Z.length)-1;Y>=0;Y--){let G=Q[Y],J=ca1(Z[Y]);X=X.slice(0,G)+J+X.slice(G+1)}return X}function la1($){return $.replace(/-/g,"_")}function Qs8($){return`app_${la1($)}`}function Ys8($){return`app_role_${la1($)}`}function Gs8($){if($ instanceof Error){let Z=$.message.toLowerCase(),X=$.code;return X==="3F000"||X==="42704"||X==="22023"||Z.includes("schema")&&Z.includes("does not exist")||Z.includes("role")&&Z.includes("does not exist")}return!1}async function Js8($,Z,X){if(await _4`CREATE SCHEMA IF NOT EXISTS ${_4.id(Z)}`.execute($),!(await _4`
     SELECT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = ${X}) as exists
-  `.execute($)).rows[0]?.exists)await _4`CREATE ROLE ${_4.id(X)} NOLOGIN`.execute($);await _4`GRANT ${_4.id(X)} TO CURRENT_USER`.execute($),await _4`GRANT USAGE, CREATE ON SCHEMA ${_4.id(Z)} TO ${_4.id(X)}`.execute($),await _4`GRANT ALL ON ALL TABLES IN SCHEMA ${_4.id(Z)} TO ${_4.id(X)}`.execute($),await _4`GRANT ALL ON ALL SEQUENCES IN SCHEMA ${_4.id(Z)} TO ${_4.id(X)}`.execute($),await _4`ALTER DEFAULT PRIVILEGES IN SCHEMA ${_4.id(Z)} GRANT ALL ON TABLES TO ${_4.id(X)}`.execute($),await _4`ALTER DEFAULT PRIVILEGES IN SCHEMA ${_4.id(Z)} GRANT ALL ON SEQUENCES TO ${_4.id(X)}`.execute($),await _4`REVOKE ALL ON SCHEMA public FROM ${_4.id(X)}`.execute($)}async function Ws8($,Z,X,Q){try{return await $.transaction().execute(async(Y)=>{return await _4`SET LOCAL ROLE ${_4.id(X)}`.execute(Y),await _4`SET LOCAL search_path TO ${_4.id(Z)}`.execute(Y),await _4.raw(Q).execute(Y)})}catch(Y){if(Gs8(Y))return await Js8($,Z,X),await $.transaction().execute(async(G)=>{return await _4`SET LOCAL ROLE ${_4.id(X)}`.execute(G),await _4`SET LOCAL search_path TO ${_4.id(Z)}`.execute(G),await _4.raw(Q).execute(G)});throw Y}}var $s8,Xs8,da1;var ma1=D(()=>{S0();$s8=HK.object({results:HK.array(HK.unknown()).optional(),success:HK.boolean().optional()});Xs8=HK.object({sql:HK.string().describe("The SQL query to run"),params:HK.array(HK.any()).describe("The parameters to pass to the SQL query").optional()});da1=c({name:"DATABASES_RUN_SQL",description:"Run a SQL query in a connection-scoped isolated schema. Supports SELECT, DDL, and DML.",annotations:{title:"Run SQL Query",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!1,openWorldHint:!1},inputSchema:Xs8,outputSchema:HK.object({result:HK.array($s8)}),handler:async($,Z)=>{r(Z),await Z.access.check();let X=Zs8($.sql,$.params||[]);if(!Z.connectionId)throw Error("Connection context required for database access");console.warn("DATABASES_RUN_SQL invoked",{"tool.deprecation_probe":"DATABASES_RUN_SQL","connection.id":Z.connectionId,"organization.id":Z.organization?.id??null,"user.id":Z.auth.user?.id??null});let Q=Qs8(Z.connectionId),Y=Ys8(Z.connectionId);return{result:[{results:(await Ws8(Z.db,Q,Y,X)).rows,success:!0}]}}})});function C90($){let Z=$.access.getRole();if(!i7(Z))throw new KF("Only organization owners and admins can change org-wide pin status")}var $l0=D(()=>{MQ();qw()});async function _90($,Z,X){let Q=[...new Set(X)],Y=await Promise.all(Q.map((J)=>$.storage.connections.findById(J,Z))),G=Q.filter((J,W)=>!Y[W]);if(G.length>0)throw Error(`Connection not found: ${G.join(", ")}`)}function EF($){return $.toLowerCase().replace(/[^a-z0-9]+/g,"-").replace(/^-|-$/g,"")}function v90($){let Z=2166136261;for(let X=0;X<$.length;X++)Z=Math.imul(Z^$.charCodeAt(X),16777619);return`a${(Z>>>0).toString(36).padStart(6,"0").slice(-6)}`}function ai($){if($&&typeof $==="object"&&"gatewayClientId"in $&&typeof $.gatewayClientId==="string")return $.gatewayClientId;return}function si($,Z){if(!Z)return $;let X=`${v90(Z)}_`;return $.startsWith(X)?$.slice(X.length):$}function Hs8($){return $.split(/[-_]/).map((Z)=>Z?Z.charAt(0).toUpperCase()+Z.slice(1):Z).join(" ")}var hx;var ia1=D(()=>{lW();hx=class hx extends y9{static MAX_PAGES_PER_CLIENT=1000;clients;slugToKey=new Map;resolvedClients=new Map;toolsCache=null;resourcesCache=null;resourceTemplatesCache=null;promptsCache=null;resourceRouteMap=new Map;constructor($,Z){super(Z?.clientInfo??{name:"gateway-client",version:"1.0.0"},{capabilities:Z?.capabilities});this.clients=$;for(let X of Object.keys($)){let Q=v90(X);if(this.slugToKey.has(Q))throw Error(`GatewayClient: duplicate namespace code "${Q}" from keys "${this.slugToKey.get(Q)}" and "${X}"`);this.slugToKey.set(Q,X)}}namespace($,Z){return`${v90($)}_${Z}`}async resolveToolTarget($){let Z=$.indexOf("_");if(Z!==-1){let Q=$.slice(0,Z),Y=this.slugToKey.get(Q);if(Y)return[Y,$.slice(Z+1)]}let{tools:X}=await this.listTools();for(let Q of X){let Y=ai(Q._meta);if(!Y)continue;if(si(Q.name,Y)===$)return[Y,$]}if(Z===-1)throw Error(`GatewayClient: could not resolve tool "${$}" \u2014 no namespace prefix and not found in any client`);throw Error(`GatewayClient: unknown namespace "${$.slice(0,Z)}" in "${$}" and not found by original name in any client`)}async resolvePromptTarget($){let Z=$.indexOf("_");if(Z!==-1){let Q=$.slice(0,Z),Y=this.slugToKey.get(Q);if(Y)return[Y,$.slice(Z+1)]}let{prompts:X}=await this.listPrompts();for(let Q of X){let Y=ai(Q._meta);if(!Y)continue;if(si(Q.name,Y)===$)return[Y,$]}if(Z===-1)throw Error(`GatewayClient: could not resolve prompt "${$}" \u2014 no namespace prefix and not found in any client`);throw Error(`GatewayClient: unknown namespace "${$.slice(0,Z)}" in "${$}" and not found by original name in any client`)}resolveClient($){let Z=this.resolvedClients.get($);if(Z)return Z;let X=this.clients[$];if(!X)return Promise.reject(Error(`GatewayClient: unknown client key "${$}"`));let Q=X.client,Y;try{Y=typeof Q==="function"?Promise.resolve(Q()):Promise.resolve(Q)}catch(J){return Promise.reject(J)}let G=Y.catch((J)=>{throw this.resolvedClients.delete($),J});return this.resolvedClients.set($,G),G}getResolvedClient($){return this.resolveClient($)}async listFromClient($,Z,X){try{let Q=await this.resolveClient($);return await Z(Q)}catch(Q){return console.warn(`GatewayClient: skipping ${X} from client "${$}" \u2014 ${Q?.message??Q}`),[]}}async paginate($,Z,X){let Q=[],Y,G=0;do{let J=await X(Y);Q.push(...J.items),Y=J.nextCursor,G++}while(Y&&G<hx.MAX_PAGES_PER_CLIENT);if(Y)console.warn(`GatewayClient: client "${$}" exceeded ${hx.MAX_PAGES_PER_CLIENT} pages listing ${Z} \u2014 truncating`);return Q}fetchAllTools($,Z){return this.paginate(Z,"tools",async(X)=>{let Q=await $.listTools(X?{cursor:X}:void 0);return{items:Q.tools,nextCursor:Q.nextCursor}})}fetchAllResources($,Z){return this.paginate(Z,"resources",async(X)=>{let Q=await $.listResources(X?{cursor:X}:void 0);return{items:Q.resources,nextCursor:Q.nextCursor}})}fetchAllResourceTemplates($,Z){return this.paginate(Z,"resource templates",async(X)=>{let Q=await $.listResourceTemplates(X?{cursor:X}:void 0);return{items:Q.resourceTemplates,nextCursor:Q.nextCursor}})}fetchAllPrompts($,Z){return this.paginate(Z,"prompts",async(X)=>{let Q=await $.listPrompts(X?{cursor:X}:void 0);return{items:Q.prompts,nextCursor:Q.nextCursor}})}listTools($,Z){if(!this.toolsCache)this.toolsCache=this.aggregateTools();return this.toolsCache}async aggregateTools(){let $=[];for(let[Z,X]of Object.entries(this.clients)){let Q=await this.listFromClient(Z,(J)=>this.fetchAllTools(J,Z),"tools"),Y=X.tools,G=Y?new Set(Y):null;for(let J of Q){if(G&&!G.has(J.name))continue;$.push({...J,name:this.namespace(Z,J.name),_meta:{...J._meta??{},gatewayClientId:Z}})}}return{tools:$}}listResources($,Z){if(!this.resourcesCache)this.resourcesCache=this.aggregateResources();return this.resourcesCache}async aggregateResources(){let $=new Set,Z=[],X=new Map;for(let[Q,Y]of Object.entries(this.clients)){let G=await this.listFromClient(Q,(K)=>this.fetchAllResources(K,Q),"resources"),J=Y.resources,W=J?new Set(J):null;for(let K of G){if(W&&!W.has(K.uri)&&!(K.name&&W.has(K.name)))continue;if($.has(K.uri)){console.warn(`GatewayClient: duplicate resource "${K.uri}" from client "${Q}" \u2014 skipping`);continue}$.add(K.uri),X.set(K.uri,Q),Z.push({...K,_meta:{...K._meta??{},gatewayClientId:Q}})}}return this.resourceRouteMap=X,{resources:Z}}listResourceTemplates($,Z){if(!this.resourceTemplatesCache)this.resourceTemplatesCache=this.aggregateResourceTemplates();return this.resourceTemplatesCache}async aggregateResourceTemplates(){let $=new Set,Z=[];for(let[X,Q]of Object.entries(this.clients)){let Y=await this.listFromClient(X,(G)=>this.fetchAllResourceTemplates(G,X),"resource templates");for(let G of Y){if($.has(G.uriTemplate)){console.warn(`GatewayClient: duplicate resource template "${G.uriTemplate}" from client "${X}" \u2014 skipping`);continue}$.add(G.uriTemplate),Z.push({...G,_meta:{...G._meta??{},gatewayClientId:X}})}}return{resourceTemplates:Z}}listPrompts($,Z){if(!this.promptsCache)this.promptsCache=this.aggregatePrompts();return this.promptsCache}async aggregatePrompts(){let $=[];for(let[Z,X]of Object.entries(this.clients)){let Q=await this.listFromClient(Z,(J)=>this.fetchAllPrompts(J,Z),"prompts"),Y=X.prompts,G=Y?new Set(Y):null;for(let J of Q){if(G&&!G.has(J.name))continue;$.push({...J,name:this.namespace(Z,J.name),title:J.title??Hs8(J.name),_meta:{...J._meta??{},gatewayClientId:Z}})}}return{prompts:$}}async callTool($,Z,X){let[Q,Y]=await this.resolveToolTarget($.name);return(await this.resolveClient(Q)).callTool({...$,name:Y},Z,X)}async readResource($,Z){let X=await this.resolveResourceRoute($.uri);return(await this.resolveClient(X)).readResource($)}async getPrompt($,Z){let[X,Q]=await this.resolvePromptTarget($.name);return(await this.resolveClient(X)).getPrompt({...$,name:Q})}async resolveResourceRoute($){let Z=this.resourceRouteMap.get($);if(Z)return Z;if(this.resourcesCache=null,await this.listResources(),Z=this.resourceRouteMap.get($),Z)return Z;throw Error(`GatewayClient: resource "${$}" not found in any upstream client`)}getServerCapabilities(){return{tools:{},resources:{},prompts:{}}}getInstructions(){return}refresh(){this.toolsCache=null,this.resourcesCache=null,this.resourceTemplatesCache=null,this.promptsCache=null}async close(){let $=[...this.resolvedClients.values()].map((Z)=>Z.then((X)=>X.close()).catch(()=>{}));await Promise.allSettled($),await super.close()}}});var f90=D(()=>{ia1()});function Xl0($){return EF($)}function Ns8($,Z){let X=EF(Z)||"prompt";return`${String($).padStart(Fs8,"0")}-${X}`}async function Ql0($,Z,X){try{await $.delete(b90,Xl0(Z),{actor:X})}catch(Q){console.error("[agent-prompts] failed to delete prompts",{agentId:Z,err:Q})}}async function x90($,Z,X,Q){let Y=Xl0(Z);await Ql0($,Z,X),await Promise.all(Q.slice(0,Zl0).map(async(G,J)=>{let W=Ns8(J,G.title),K={name:W,title:G.title,description:G.description,text:G.text};try{await $.write(b90,`${Y}/${W}.json`,JSON.stringify(K),{actor:X,contentType:"application/json"})}catch(H){console.error("[agent-prompts] failed to seed prompt",{agentId:Z,name:W,err:H})}}))}async function pa1($,Z){let X=Xl0(Z),Q;try{Q=await $.listDir(b90,X)}catch{return[]}let Y=Q.filter((J)=>J.kind==="file"&&J.path.endsWith(".json")).slice(0,Zl0),G=[];for(let J of Y)try{let W=await $.read(b90,J.path),K=JSON.parse(new TextDecoder().decode(W));if(K&&typeof K.name==="string"&&typeof K.title==="string"&&typeof K.text==="string")G.push(K)}catch{}return G}var b90="agent-prompts",Zl0=20,Fs8;var ei=D(()=>{f90();Fs8=String(Zl0-1).length});import{z as oa1}from"zod";function Us8(){let $=na1[Math.floor(Math.random()*na1.length)];return`icon://${ta1[Math.floor(Math.random()*ta1.length)]}?color=${$}`}var na1,ta1,Os8,Bs8,Yl0;var ra1=D(()=>{S0();SO();$l0();ei();na1=["red","orange","amber","yellow","lime","green","emerald","cyan","sky","blue","indigo","violet","purple","fuchsia","pink","rose"],ta1=["Star01","Zap","Heart","Globe01","Compass03","Lightbulb02","Rocket01","Flag01","BookOpen01","Shield01","Key01","Diamond01","Cube01","Target04","Award01","Briefcase01","Coffee","Feather","Hexagon01","Layers3_01","Map01","Palette","Package","Terminal"];Os8=oa1.object({data:$80.describe("Data for the new virtual MCP")}),Bs8=oa1.object({item:h7.describe("The created virtual MCP entity")}),Yl0=c({name:"COLLECTION_VIRTUAL_MCP_CREATE",description:"Create a Virtual MCP (agent) that aggregates tools from multiple connections into one endpoint. Pass `prompts` to seed the agent with kickstart prompts (conversation starters shown as icebreakers). Author them from the agent's role/instructions and the descriptions of the tools it will have, so the starters are coherent and immediately useful.",annotations:{title:"Create Virtual MCP",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!1,openWorldHint:!1},inputSchema:Os8,outputSchema:Bs8,handler:async($,Z)=>{r(Z);let X=t(Z);await Z.access.check();let Q=Y1(Z);if(!Q)throw Error("User ID required to create virtual MCP");if($.data.pinned===!0)C90(Z);let{prompts:Y,...G}=$.data;if(G.connections.length>0)await _90(Z,X.id,G.connections.map((K)=>K.connection_id));let J={...G,icon:G.icon??Us8()},W=await Z.storage.virtualMcps.create(X.id,Q,J);if(Y?.length&&Z.orgFs&&W.id)await x90(Z.orgFs,W.id,Q,Y);return{item:W}}})});function Ds8($){let Z=[],X=0;while(X<$.length){let Q=$[X];if(Q==="%")Z.push(".*");else if(Q==="_")Z.push(".");else if(/[.*+?^${}()|[\]\\]/.test(Q))Z.push("\\"+Q);else Z.push(Q);X++}return Z.join("")}function gO($){return typeof $==="string"||typeof $==="number"}function Gl0($,Z){let X=Z.split("."),Q=$;for(let Y of X){if(Q==null||typeof Q!=="object")return;Q=Q[Y]}return Q}function Ls8($,Z){return $.connections.some((X)=>X.connection_id===Z)}function y90($,Z){if("conditions"in Z){let{operator:W,conditions:K}=Z;switch(W){case"and":return K.every((H)=>y90($,H));case"or":return K.some((H)=>y90($,H));case"not":return!K.every((H)=>y90($,H));default:return!0}}let{field:X,operator:Q,value:Y}=Z,G=X.join(".");if(G==="connection_id"){if(Q!=="eq"||typeof Y!=="string")return!1;return Ls8($,Y)}let J=Gl0($,G);switch(Q){case"eq":return J===Y;case"gt":return gO(J)&&gO(Y)&&J>Y;case"gte":return gO(J)&&gO(Y)&&J>=Y;case"lt":return gO(J)&&gO(Y)&&J<Y;case"lte":return gO(J)&&gO(Y)&&J<=Y;case"in":return Array.isArray(Y)&&Y.includes(J);case"like":if(typeof J!=="string"||typeof Y!=="string")return!1;if(Y.length>100)return!1;let W=Ds8(Y);return new RegExp(`^${W}$`,"i").test(J);case"contains":if(typeof J!=="string"||typeof Y!=="string")return!1;return J.toLowerCase().includes(Y.toLowerCase());default:return!0}}function ws8($,Z){return[...$].sort((X,Q)=>{for(let Y of Z){let G=Y.field.join("."),J=Gl0(X,G),W=Gl0(Q,G),K=0;if(J==null&&W==null)continue;if(J==null)K=Y.nulls==="first"?-1:1;else if(W==null)K=Y.nulls==="first"?1:-1;else if(typeof J==="string"&&typeof W==="string")K=J.localeCompare(W);else if(typeof J==="number"&&typeof W==="number")K=J-W;else K=String(J).localeCompare(String(W));if(K!==0)return Y.direction==="desc"?-K:K}return 0})}var Es8,js8,Jl0;var aa1=D(()=>{cG();S0();SO();Es8=z3,js8=LF(h7),Jl0=c({name:"COLLECTION_VIRTUAL_MCP_LIST",description:"List all MCP virtual MCPs in the organization",annotations:{title:"List Virtual MCPs",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:Es8,outputSchema:js8,handler:async($,Z)=>{await Z.access.check();let X=t(Z),Q=$.where&&!("conditions"in $.where)&&$.where.field.join(".")==="connection_id"&&$.where.operator==="eq"&&typeof $.where.value==="string"?$.where.value:void 0,Y=$.where&&!("conditions"in $.where)&&$.where.field.join(".")==="pinned"&&$.where.operator==="eq"&&typeof $.where.value==="boolean"?$.where.value:void 0,J=Q?await Z.storage.virtualMcps.listByConnectionId(X.id,Q):await Z.storage.virtualMcps.list(X.id,Y!==void 0?{pinnedOnly:Y}:void 0);if($.where)J=J.filter((U)=>y90(U,$.where));if($.orderBy&&$.orderBy.length>0)J=ws8(J,$.orderBy);let W=J.length,K=$.offset??0,H=$.limit??100,F=J.slice(K,K+H),N=K+H<W;return{items:F,totalCount:W,hasMore:N}}})});import{z as Wl0}from"zod";var zs8,Ps8,Kl0;var sa1=D(()=>{S0();SO();zs8=Wl0.object({id:Wl0.string().describe("ID of the virtual MCP to retrieve")}),Ps8=Wl0.object({item:h7.nullable().describe("The retrieved virtual MCP, or null if not found")}),Kl0=c({name:"COLLECTION_VIRTUAL_MCP_GET",description:"Get a Virtual MCP's configuration, connections, and virtual tools by ID.",annotations:{title:"Get Virtual MCP",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:zs8,outputSchema:Ps8,handler:async($,Z)=>{r(Z);let X=t(Z);await Z.access.check();let Q=await Z.storage.virtualMcps.findById($.id);if(Q&&Q.organization_id!==X.id)return{item:null};if(!Q)return{item:null};return{item:Q}}})});function mG($){return Hl0.test($)}function ea1($){let Z=(X)=>typeof X==="string"?X.trim().toLowerCase():"";return Z($?.metadata?.siteSlug)||Z($?.title)||null}var Hl0;var hO=D(()=>{Hl0=/^[a-z0-9][a-z0-9-]{0,59}$/});function $s1($){let{nextTitle:Z,currentTitle:X,currentSiteSlug:Q}=$;if(Q?.trim())return null;if(Z===void 0||Z===X)return null;let Y=X?.trim().toLowerCase()??"";return mG(Y)?Y:null}var Zs1=D(()=>{hO()});import{z as Fl0}from"zod";var As8,Ts8,Nl0;var Xs1=D(()=>{S0();ei();SO();$l0();Zs1();As8=Fl0.object({id:Fl0.string().describe("ID of the virtual MCP to update"),data:Z80.describe("Partial virtual MCP data to update")}),Ts8=Fl0.object({item:h7.describe("The updated virtual MCP entity")}),Nl0=c({name:"COLLECTION_VIRTUAL_MCP_UPDATE",description:"Update a Virtual MCP's name, slug, connection list, or kickstart prompts. Pass `prompts` to replace the agent's conversation starters (full set; empty array clears them).",annotations:{title:"Update Virtual MCP",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:As8,outputSchema:Ts8,handler:async($,Z)=>{r(Z);let X=t(Z);await Z.access.check();let Q=Y1(Z);if(!Q)throw Error("User ID required to update virtual MCP");let Y=await Z.storage.virtualMcps.findById($.id);if(!Y)throw Error(`Virtual MCP not found: ${$.id}`);if(Y.organization_id!==X.id)throw Error(`Virtual MCP not found: ${$.id}`);let{prompts:G,...J}=$.data;if(J.metadata&&Y.metadata)J.metadata={...Y.metadata,...J.metadata};let W=$s1({nextTitle:J.title,currentTitle:Y.title,currentSiteSlug:Y.metadata?.siteSlug});if(W)J.metadata={...Y.metadata,...J.metadata,siteSlug:W};if(J.pinned!==void 0&&J.pinned!==Y.pinned)C90(Z);if(J.connections?.length)await _90(Z,X.id,J.connections.map((H)=>H.connection_id));let K=await Z.storage.virtualMcps.update($.id,Q,J);if(G!==void 0&&Z.orgFs)await x90(Z.orgFs,$.id,Q,G);return{item:K}}})});function Rs8($){if(!$)return!1;let Z=Ol0.join("|");return new RegExp(`permission\\s+"?(?:${Z})"?\\s+is not allowed`,"i").test($)||/permissions exceed what the github app/i.test($)}function Ys1($){let Z={...$};for(let X of Ol0)Z[X]="read";return Z}async function Gs1($,Z){let X={...Z};for(;;){let Q=await $(X);if(!Q.isError)return{result:Q,grantedPermissions:X};let Y=Q.content?.find((K)=>K.type==="text")?.text,G=Ol0.find((K)=>(K in X));if(!G||!Rs8(Y))return{result:Q,grantedPermissions:X};let{[G]:J,...W}=X;X=W}}function Is8($){if(!$||typeof $!=="object"||Array.isArray($))return Qs1;let Z=$;if(Object.values(Z).some((X)=>typeof X!=="string"))return Qs1;return Z}function qs8($){if(typeof $!=="number"||!Number.isFinite($)||!Number.isInteger($)||$<=0)return;return $}function q5($){let Z=$.metadata?.repoScope;if(!Z||typeof Z.installationId!=="number"||!Number.isFinite(Z.installationId)||!Number.isInteger(Z.installationId)||Z.installationId<=0||typeof Z.owner!=="string"||typeof Z.repo!=="string"||Z.owner.length===0||Z.repo.length===0)return null;let X=qs8(Z.repositoryId);return{sourceConnectionId:typeof Z.sourceConnectionId==="string"?Z.sourceConnectionId:void 0,installationId:Z.installationId,repositoryId:X,owner:Z.owner,repo:Z.repo,permissions:Is8(Z.permissions),grantProvider:Z.grantProvider==="github-mcp"?"github-mcp":void 0}}function rw($){return $.metadata?.orgShared===!0}function Js1($){let Z=new Set,X=[];for(let Q of $??[]){if(Q.status!=="active")continue;let Y=q5(Q);if(Y===null)continue;let G=Ul0(Y.owner,Y.repo);if(Z.has(G))continue;Z.add(G),X.push(`${Y.owner}/${Y.repo}`)}return X}function g90($,Z,X){let Q=Ul0(Z,X),Y=($??[]).filter((G)=>{if(G.status&&G.status!=="active")return!1;let J=q5(G);return J!==null&&Ul0(J.owner,J.repo)===Q});return Y.find(rw)??Y[0]??null}var Qs1,Ol0,Ul0=($,Z)=>`${$}/${Z}`.toLowerCase();var VQ=D(()=>{Qs1={contents:"write",metadata:"read",pull_requests:"write",issues:"write",checks:"read",deployments:"read"},Ol0=["deployments","checks"]});function Ws1($){return CG($)!==null||I40($)!==null}var Ks1=D(()=>{P8()});import{z as Bl0}from"zod";var Ms8,ks8,Dl0;var Hs1=D(()=>{VQ();dG();S0();ei();SO();Ks1();Ms8=Bl0.object({id:Bl0.string().describe("ID of the virtual MCP to delete")}),ks8=Bl0.object({item:h7.describe("The deleted virtual MCP entity")}),Dl0=c({name:"COLLECTION_VIRTUAL_MCP_DELETE",description:"Permanently delete a Virtual MCP and its virtual tools.",annotations:{title:"Delete Virtual MCP",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:Ms8,outputSchema:ks8,handler:async($,Z)=>{r(Z);let X=t(Z);if(await Z.access.check(),Ws1($.id))throw Error(`Virtual MCP not found: ${$.id}`);let Q=await Z.storage.virtualMcps.findById($.id);if(!Q)throw Error(`Virtual MCP not found: ${$.id}`);if(Q.organization_id!==X.id)throw Error(`Virtual MCP not found: ${$.id}`);await Z.storage.virtualMcps.delete($.id);try{if((await Z.storage.organizationSettings.get(X.id))?.main_agent_id===$.id)await Z.storage.organizationSettings.upsert(X.id,{main_agent_id:null})}catch(G){console.error("[VIRTUAL_MCP_DELETE] failed to clear main agent pointer",{id:$.id,error:G.message})}if(Z.orgFs)await Ql0(Z.orgFs,$.id,Y1(Z)??"system");let Y=Q.metadata?.githubRepo?.connectionId;if(Y)try{let G=await Z.storage.connections.findById(Y,X.id),J=G&&(rw(G)||(await Z.storage.virtualMcps.listByConnectionId(X.id,Y)).length>0||await Z.storage.connections.isReferencedByThread(Y));if(G&&q5(G)&&!J){let K=await new l6(Z.db,Z.vault).get(Y);if(K?.accessToken)try{await fetch("https://api.github.com/installation/token",{method:"DELETE",headers:{Authorization:`Bearer ${K.accessToken}`,Accept:"application/vnd.github+json","X-GitHub-Api-Version":"2022-11-28"},signal:AbortSignal.timeout(5000)})}catch{}await Z.storage.connections.delete(Y)}}catch(G){console.error("[VIRTUAL_MCP_DELETE] failed to tear down repo-scoped connection",{childConnectionId:Y,error:G.message})}return{item:Q}}})});import{z as SQ}from"zod";var Vs8,Ll0;var Fs1=D(()=>{S0();Vs8=SQ.object({id:SQ.string(),virtualMcpId:SQ.string(),pluginId:SQ.string(),connectionId:SQ.string().nullable(),settings:SQ.record(SQ.string(),SQ.unknown()).nullable(),createdAt:SQ.string(),updatedAt:SQ.string()}),Ll0=c({name:"VIRTUAL_MCP_PLUGIN_CONFIG_GET",description:"Get a plugin's current configuration for a specific virtual MCP.",annotations:{title:"Get Virtual MCP Plugin Config",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:SQ.object({virtualMcpId:SQ.string().describe("Virtual MCP ID"),pluginId:SQ.string().describe("Plugin ID")}),outputSchema:SQ.object({config:Vs8.nullable()}),handler:async($,Z)=>{r(Z);let X=t(Z);await Z.access.check();let{virtualMcpId:Q,pluginId:Y}=$,G=await Z.storage.connections.findById(Q);if(!G||G.organization_id!==X.id)return{config:null};if(G.connection_type!=="VIRTUAL")return{config:null};let J=await Z.storage.virtualMcpPluginConfigs.get(Q,Y);if(!J)return{config:null};return{config:{id:J.id,virtualMcpId:J.virtualMcpId,pluginId:J.pluginId,connectionId:J.connectionId,settings:J.settings,createdAt:J.createdAt instanceof Date?J.createdAt.toISOString():J.createdAt,updatedAt:J.updatedAt instanceof Date?J.updatedAt.toISOString():J.updatedAt}}}})});import{z as vZ}from"zod";var Ss8,wl0;var Ns1=D(()=>{S0();bx();L9();Ss8=vZ.object({id:vZ.string(),virtualMcpId:vZ.string(),pluginId:vZ.string(),connectionId:vZ.string().nullable(),settings:vZ.record(vZ.string(),vZ.unknown()).nullable(),createdAt:vZ.string(),updatedAt:vZ.string()}),wl0=c({name:"VIRTUAL_MCP_PLUGIN_CONFIG_UPDATE",description:"Set or update a plugin's configuration for a specific virtual MCP.",annotations:{title:"Update Virtual MCP Plugin Config",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:vZ.object({virtualMcpId:vZ.string().describe("Virtual MCP ID"),pluginId:vZ.string().describe("Plugin ID"),connectionId:vZ.string().nullable().optional().describe("MCP connection to bind"),settings:vZ.record(vZ.string(),vZ.unknown()).nullable().optional().describe("Plugin-specific settings")}),outputSchema:vZ.object({config:Ss8}),handler:async($,Z)=>{r(Z);let X=t(Z);await Z.access.check();let{virtualMcpId:Q,pluginId:Y,connectionId:G,settings:J}=$,W=Y1(Z),K=await Z.storage.connections.findById(Q);if(!K)throw Error(`Connection not found: ${Q}`);if(K.organization_id!==X.id)throw Error(`Connection not found: ${Q}`);if(K.connection_type!=="VIRTUAL")throw Error(`Connection not found: ${Q}`);let H=G?await Z.storage.connections.findById(G):null;if(G&&H&&H.organization_id!==X.id)throw Error(`Connection not found: ${G}`);if(G&&K.organization_id&&!H&&lG()&&I90(G,K.organization_id)){if(!W)throw Error("User ID required to create dev-assets connection");let N=fx(K.organization_id,f9());await Z.storage.connections.create({...N,organization_id:K.organization_id,created_by:W})}else if(G&&!H)throw Error(`Connection not found: ${G}`);let F=await Z.storage.virtualMcpPluginConfigs.upsert(Q,Y,{connectionId:G,settings:J});return{config:{id:F.id,virtualMcpId:F.virtualMcpId,pluginId:F.pluginId,connectionId:F.connectionId,settings:F.settings,createdAt:F.createdAt instanceof Date?F.createdAt.toISOString():F.createdAt,updatedAt:F.updatedAt instanceof Date?F.updatedAt.toISOString():F.updatedAt}}}})});import{z as iX}from"zod";var Cs8,El0;var Us1=D(()=>{S0();SO();Cs8=iX.object({connectionId:iX.string(),toolName:iX.string(),label:iX.string(),icon:iX.string().nullable().optional()}),El0=c({name:"VIRTUAL_MCP_PINNED_VIEWS_UPDATE",description:"Update the pinned sidebar views for a virtual MCP. Replaces all current pins.",annotations:{title:"Update Pinned Views",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:iX.object({virtualMcpId:iX.string().describe("Virtual MCP ID"),pinnedViews:iX.array(Cs8).describe("Pinned views to set for the virtual MCP sidebar"),layout:iX.object({defaultMainView:iX.object({type:iX.string(),id:iX.string().optional(),toolName:iX.string().optional()}).nullable().optional(),chatDefaultOpen:iX.boolean().nullable().optional()}).optional()}),outputSchema:iX.object({item:h7.nullable()}),handler:async($,Z)=>{r(Z);let X=t(Z);await Z.access.check();let{virtualMcpId:Q,pinnedViews:Y,layout:G}=$,J=Y1(Z),W=await Z.storage.virtualMcps.findById(Q);if(!W)throw Error(`Virtual MCP not found: ${Q}`);if(W.organization_id!==X.id)throw Error(`Virtual MCP not found: ${Q}`);let K=W.metadata?.ui??{},H={...K,pinnedViews:Y.length>0?Y:null,layout:G??K.layout??null};return{item:await Z.storage.virtualMcps.update(Q,J??"system",{metadata:{...W.metadata,ui:H}})}}})});import{z as jF}from"zod";var _s8,vs8,jl0;var Os1=D(()=>{S0();_s8=jF.object({ids:jF.array(jF.string()).describe("Virtual MCP ids to look up")}),vs8=jF.object({items:jF.array(jF.object({id:jF.string(),last_used_at:jF.string().optional(),last_used_by:jF.string().optional()}))}),jl0=c({name:"VIRTUAL_MCP_LAST_USED_LIST",description:"Get last-used info (timestamp + user) for one or more virtual MCPs, derived from the most recent thread per agent.",annotations:{title:"List Virtual MCP Last Used",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:_s8,outputSchema:vs8,handler:async($,Z)=>{r(Z),t(Z),await Z.access.check();let X=await Z.storage.threads.findLastUsedByVirtualMcpIds($.ids);return{items:$.ids.map((Q)=>({id:Q,last_used_at:X.get(Q)?.last_used_at,last_used_by:X.get(Q)?.last_used_by}))}}})});var Bs1=D(()=>{ra1();aa1();sa1();Xs1();Hs1();Fs1();Ns1();Us1();Os1()});import{z as o7}from"zod";var zl0;var Ds1=D(()=>{I6();S0();zl0=c({name:"MONITORING_HEATMAP",description:"Get tool-call volume broken down by agent and tool name, for spotting heavily-used tools per agent.",annotations:{title:"Get Tool-Call Heatmap",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:o7.object({startDate:o7.string().datetime().optional().describe("Filter by start date (ISO 8601 datetime string)"),endDate:o7.string().datetime().optional().describe("Filter by end date (ISO 8601 datetime string)"),virtualMcpIds:o7.array(o7.string()).max(100).optional().describe("Filter by specific agent (Virtual MCP) IDs"),excludeConnectionIds:o7.array(o7.string()).max(100).optional().describe("Exclude tool calls from these connection IDs"),limit:o7.number().int().min(1).max(1000).optional().describe("Max number of (agent, tool) cells to return")}),outputSchema:o7.object({cells:o7.array(o7.object({virtualMcpId:o7.string().nullable(),toolName:o7.string(),calls:o7.number(),errors:o7.number(),outputSize:o7.number().describe("Sum of tool-output character length \u2014 a proxy for context weight, not LLM token count")}))}),handler:async($,Z)=>{let X=t(Z);return await Z.access.check(),await WQ(),Z.storage.monitoring.queryToolCallHeatmap({organizationId:X.id,startDate:$.startDate?new Date($.startDate):void 0,endDate:$.endDate?new Date($.endDate):void 0,filters:{virtualMcpIds:$.virtualMcpIds,excludeConnectionIds:$.excludeConnectionIds},limit:$.limit})}})});import{z as U5}from"zod";var Pl0;var Ls1=D(()=>{I6();S0();Pl0=c({name:"MONITORING_LOG_GET",description:"Get a single monitoring log by ID with full input and output data.",annotations:{title:"Get Monitoring Log",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:U5.object({id:U5.string().describe("Log ID to fetch")}),outputSchema:U5.object({log:U5.object({id:U5.string().optional(),organizationId:U5.string(),connectionId:U5.string(),toolName:U5.string(),input:U5.record(U5.string(),U5.unknown()),output:U5.record(U5.string(),U5.unknown()),isError:U5.boolean(),errorMessage:U5.string().nullish(),durationMs:U5.number(),timestamp:U5.string(),userId:U5.string().nullish(),requestId:U5.string(),userAgent:U5.string().nullish(),virtualMcpId:U5.string().nullish(),properties:U5.record(U5.string(),U5.string()).nullish()}).nullable().describe("The monitoring log, or null if not found")}),handler:async($,Z)=>{await Z.access.check(),await WQ();let X=t(Z),Q=await Z.storage.monitoring.getById(X.id,$.id);if(!Q)return{log:null};return{log:{...Q,timestamp:Q.timestamp instanceof Date?Q.timestamp.toISOString():Q.timestamp}}}})});import{z as K8}from"zod";var bs8,Al0;var ws1=D(()=>{I6();S0();bs8=K8.object({id:K8.string().optional().describe("Unique log identifier"),organizationId:K8.string().describe("Organization ID"),connectionId:K8.string().describe("Connection ID"),toolName:K8.string().describe("Name of the tool that was called"),isError:K8.boolean().describe("Whether the call resulted in an error"),errorMessage:K8.string().nullish().describe("Error message if applicable"),durationMs:K8.number().describe("Call duration in milliseconds"),timestamp:K8.string().describe("ISO 8601 timestamp of the call"),userId:K8.string().nullish().describe("User who triggered the call"),requestId:K8.string().describe("Unique request identifier"),userAgent:K8.string().nullish().describe("Client identifier (x-studio-client header)"),virtualMcpId:K8.string().nullish().describe("Virtual MCP (Agent) ID if routed through an agent"),properties:K8.record(K8.string(),K8.string()).nullish().describe("Custom key-value metadata attached to the log")}),Al0=c({name:"MONITORING_LOGS_LIST",description:"List monitoring logs for tool calls with filtering and pagination.",annotations:{title:"List Monitoring Logs",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:K8.object({connectionId:K8.string().optional().describe("Filter by connection ID"),excludeConnectionIds:K8.array(K8.string()).optional().describe("Exclude logs from these connection IDs (e.g. system connections)"),virtualMcpId:K8.string().optional().describe("Filter by Virtual MCP (Agent) ID"),toolName:K8.string().optional().describe("Filter by tool name"),isError:K8.boolean().optional().describe("Filter by error status"),startDate:K8.string().datetime().optional().describe("Filter by start date (ISO 8601 datetime string)"),endDate:K8.string().datetime().optional().describe("Filter by end date (ISO 8601 datetime string)"),limit:K8.number().default(20).describe("Maximum number of results"),offset:K8.number().default(0).describe("Offset for pagination"),properties:K8.record(K8.string(),K8.string()).optional().describe("Filter by exact property key=value matches"),propertyKeys:K8.array(K8.string()).optional().describe("Filter by logs that have these property keys"),propertyPatterns:K8.record(K8.string(),K8.string()).optional().describe("Filter by property value patterns (SQL LIKE, use % as wildcard)"),propertyInValues:K8.record(K8.string(),K8.string()).optional().describe("Filter by exact match within comma-separated values (e.g., user_tags in 'Engineering')")}),outputSchema:K8.object({logs:K8.array(bs8).describe("Array of monitoring logs"),total:K8.number().describe("Total number of logs matching filters"),offset:K8.number().describe("Current offset for pagination"),limit:K8.number().describe("Current limit for pagination")}),handler:async($,Z)=>{await Z.access.check(),await WQ();let X=t(Z),Y=$.properties||$.propertyKeys||$.propertyPatterns||$.propertyInValues?{properties:$.properties,propertyKeys:$.propertyKeys,propertyPatterns:$.propertyPatterns,propertyInValues:$.propertyInValues}:void 0,G={organizationId:X.id,connectionId:$.connectionId,excludeConnectionIds:$.excludeConnectionIds,virtualMcpId:$.virtualMcpId,toolName:$.toolName,isError:$.isError,startDate:$.startDate?new Date($.startDate):void 0,endDate:$.endDate?new Date($.endDate):void 0,limit:$.limit,offset:$.offset,propertyFilters:Y},J=await Z.storage.monitoring.query(G);return{logs:J.logs.map(({input:W,output:K,...H})=>({...H,timestamp:H.timestamp instanceof Date?H.timestamp.toISOString():H.timestamp})),total:J.total,offset:$.offset,limit:$.limit}}})});import{z as J$}from"zod";var Tl0;var Es1=D(()=>{I6();S0();Tl0=c({name:"MONITORING_STATS",description:"Get aggregated statistics (counts, latency, error rates) for tool call monitoring.",annotations:{title:"Get Monitoring Stats",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:J$.object({startDate:J$.string().datetime().optional().describe("Filter by start date (ISO 8601 datetime string)"),endDate:J$.string().datetime().optional().describe("Filter by end date (ISO 8601 datetime string)"),interval:J$.string().regex(/^\d+[mhd]$/).optional().describe("Bucket interval for timeseries data (e.g. 1m, 5m, 2h, 1d). When provided, returns timeseries array."),connectionIds:J$.array(J$.string()).max(100).optional().describe("Filter by specific connection IDs (max 100)"),excludeConnectionIds:J$.array(J$.string()).max(100).optional().describe("Exclude specific connection IDs (max 100)"),toolNames:J$.array(J$.string()).max(100).optional().describe("Filter by specific tool names (max 100)"),status:J$.enum(["success","error"]).optional().describe("Filter metrics by execution status"),topN:J$.number().int().min(1).max(20).optional().describe("When provided with interval, also return top tools and their timeseries"),userIds:J$.array(J$.string()).max(100).optional().describe("Filter LLM usage by user IDs (only applied when llmUsage is true)"),llmUsage:J$.boolean().optional().describe("Aggregate LLM-call usage (tokens + USD cost) from raw log rows for the given connection. Returns token/cost totals and timeseries. Requires interval.")}),outputSchema:J$.object({totalCalls:J$.number().describe("Total number of tool calls"),errorRate:J$.number().optional().describe("Error rate as a decimal (0 to 1)"),avgDurationMs:J$.number().describe("Average call duration in milliseconds"),errorRatePercent:J$.string().optional().describe("Error rate as a percentage string"),totalErrors:J$.number().optional().describe("Total number of errors"),p50DurationMs:J$.number().optional().describe("50th percentile duration in milliseconds"),p95DurationMs:J$.number().optional().describe("95th percentile duration in milliseconds"),connectionBreakdown:J$.array(J$.object({connectionId:J$.string(),calls:J$.number(),errors:J$.number(),errorRate:J$.number(),avgDurationMs:J$.number()})).optional().describe("Per-connection metric breakdown"),totalInputTokens:J$.number().optional().describe("Total input tokens (LLM usage mode)"),totalOutputTokens:J$.number().optional().describe("Total output tokens (LLM usage mode)"),totalTokens:J$.number().optional().describe("Total tokens (LLM usage mode)"),totalCostUsd:J$.number().optional().describe("Total USD cost (LLM usage mode; only non-zero for providers that report cost)"),topTools:J$.array(J$.object({toolName:J$.string(),connectionId:J$.string().nullable(),calls:J$.number(),inputTokens:J$.number().optional(),outputTokens:J$.number().optional(),costUsd:J$.number().optional()})).optional().describe("Top tools ranked by calls"),topToolsTimeseries:J$.array(J$.object({timestamp:J$.string(),toolName:J$.string(),calls:J$.number(),errors:J$.number(),avg:J$.number(),p95:J$.number()})).optional().describe("Per-tool metric timeseries for the top tools"),timeseries:J$.array(J$.object({timestamp:J$.string(),calls:J$.number(),errors:J$.number(),errorRate:J$.number(),avg:J$.number(),p50:J$.number(),p95:J$.number(),inputTokens:J$.number().optional(),outputTokens:J$.number().optional(),totalTokens:J$.number().optional(),costUsd:J$.number().optional()})).optional().describe("Timeseries data points bucketed by interval")}),handler:async($,Z)=>{let X=t(Z);if(await Z.access.check(),await WQ(),$.interval&&$.llmUsage)return Z.storage.monitoring.queryLlmUsageStats({organizationId:X.id,interval:$.interval,connectionId:$.connectionIds?.[0]??"decopilot",startDate:$.startDate?new Date($.startDate):void 0,endDate:$.endDate?new Date($.endDate):void 0,userIds:$.userIds,topN:$.topN});if($.interval){let Y=await Z.storage.monitoring.queryMetricTimeseries({organizationId:X.id,interval:$.interval,startDate:$.startDate?new Date($.startDate):void 0,endDate:$.endDate?new Date($.endDate):void 0,filters:{connectionIds:$.connectionIds,excludeConnectionIds:$.excludeConnectionIds,toolNames:$.toolNames,status:$.status}});if(!$.topN)return Y;let G=await Z.storage.monitoring.queryMetricTopToolsTimeseries({organizationId:X.id,interval:$.interval,startDate:$.startDate?new Date($.startDate):void 0,endDate:$.endDate?new Date($.endDate):void 0,topN:$.topN,filters:{connectionIds:$.connectionIds,excludeConnectionIds:$.excludeConnectionIds,toolNames:$.toolNames,status:$.status}});return{...Y,topTools:G.topTools,topToolsTimeseries:G.timeseries}}let Q=await Z.storage.monitoring.getStats({organizationId:X.id,startDate:$.startDate?new Date($.startDate):void 0,endDate:$.endDate?new Date($.endDate):void 0});return{...Q,errorRatePercent:(Q.errorRate*100).toFixed(2)}}})});import{z as pX}from"zod";var Rl0;var js1=D(()=>{I6();S0();Rl0=c({name:"MONITORING_THREAD_USAGE",description:"Aggregate LLM token usage and USD cost per thread for the given thread IDs.",annotations:{title:"Get Thread Usage",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:pX.object({threadIds:pX.array(pX.string()).min(1).max(500).describe("Thread IDs to aggregate usage for (max 500)"),connectionId:pX.string().optional().describe("LLM connection ID (defaults to 'decopilot')"),startDate:pX.string().datetime().optional().describe("Filter by start date (ISO 8601 datetime string)"),endDate:pX.string().datetime().optional().describe("Filter by end date (ISO 8601 datetime string)")}),outputSchema:pX.object({items:pX.array(pX.object({threadId:pX.string(),calls:pX.number(),inputTokens:pX.number(),outputTokens:pX.number(),totalTokens:pX.number(),costUsd:pX.number()}))}),handler:async($,Z)=>{let X=t(Z);return await Z.access.check(),await WQ(),{items:await Z.storage.monitoring.queryThreadUsage({organizationId:X.id,connectionId:$.connectionId??"decopilot",threadIds:$.threadIds,startDate:$.startDate?new Date($.startDate):void 0,endDate:$.endDate?new Date($.endDate):void 0})}}})});var zs1=D(()=>{Ds1();Ls1();ws1();Es1();js1()});function h90($){return typeof $==="string"&&ys8.has($.trim().toLowerCase())}var ys8;var Il0=D(()=>{ys8=new Set([".well-known","_admin","api","auth","cli","commerce-onboarding","dbos-queue-depth","health","hosted-run-pending","login","mcp","metrics","oauth","oauth-proxy","onboarding","org","report","reset-password"])});import{z as yY}from"zod";var ql0;var Ps1=D(()=>{S0();Il0();ql0=c({name:"ORGANIZATION_CREATE",description:"Create a new organization. The caller becomes the owner automatically.",annotations:{title:"Create Organization",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!1,openWorldHint:!1},inputSchema:yY.object({slug:yY.string().min(1).max(50).regex(/^[a-z0-9-]+$/,"Slug must be lowercase alphanumeric with hyphens").refine(($)=>!h90($),"Slug is reserved by Studio"),name:yY.string().min(1).max(255),description:yY.string().optional()}),outputSchema:yY.object({id:yY.string(),name:yY.string(),slug:yY.string(),logo:yY.string().nullable().optional(),metadata:yY.any().optional(),createdAt:yY.string().datetime().describe("ISO 8601 timestamp"),members:yY.array(yY.any()).optional()}),handler:async($,Z)=>{r(Z),await Z.access.check();let X=Y1(Z);if(!X)throw Error("User ID required to create organization");let Q=await Z.boundAuth.organization.create({name:$.name,slug:$.slug,metadata:$.description?{description:$.description}:void 0,userId:X});if(!Q)throw Error("Failed to create organization");return{...Q,createdAt:Q.createdAt instanceof Date?Q.createdAt.toISOString():Q.createdAt}}})});import{z as FK}from"zod";var Ml0;var As1=D(()=>{S0();Ml0=c({name:"ORGANIZATION_LIST",description:"List organizations the current user belongs to.",annotations:{title:"List Organizations",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},_meta:{ui:{visibility:"app"}},inputSchema:FK.object({}),outputSchema:FK.object({organizations:FK.array(FK.object({id:FK.string(),name:FK.string(),slug:FK.string(),logo:FK.string().nullable().optional(),metadata:FK.any().optional(),createdAt:FK.string().datetime().describe("ISO 8601 timestamp")}))}),handler:async($,Z)=>{if(r(Z),await Z.access.check(),!Y1(Z))throw Error("User ID required to list organizations");return{organizations:(await Z.boundAuth.organization.list()).map((Q)=>({...Q,createdAt:Q.createdAt instanceof Date?Q.createdAt.toISOString():Q.createdAt}))}}})});import{z as iG}from"zod";var kl0;var Ts1=D(()=>{S0();kl0=c({name:"ORGANIZATION_GET",description:"Get an organization's details, members, and settings by slug or ID.",annotations:{title:"Get Organization",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:iG.object({}),outputSchema:iG.object({id:iG.string(),name:iG.string(),slug:iG.string(),logo:iG.string().nullable().optional(),metadata:iG.any().optional(),createdAt:iG.string().datetime().describe("ISO 8601 timestamp"),members:iG.array(iG.any()).optional(),invitations:iG.array(iG.any()).optional()}),handler:async($,Z)=>{r(Z),await Z.access.check();let X=Z.organization?.id;if(!X)throw Error("Organization ID required (no active organization in context)");let Q=await Z.boundAuth.organization.get(X);if(!Q)throw Error("No active organization found");let Y=new Date,G=Q.invitations?.filter((J)=>new Date(J.expiresAt)>Y);return{...Q,invitations:G,createdAt:Q.createdAt instanceof Date?Q.createdAt.toISOString():Q.createdAt}}})});import{z as P3}from"zod";var Vl0;var Rs1=D(()=>{S0();Vl0=c({name:"ORGANIZATION_UPDATE",description:"Update an organization's name or description.",annotations:{title:"Update Organization",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:P3.object({id:P3.string(),name:P3.string().min(1).max(255).optional(),description:P3.string().optional()}),outputSchema:P3.object({id:P3.string(),name:P3.string(),slug:P3.string(),logo:P3.string().nullable().optional(),metadata:P3.any().optional(),createdAt:P3.string().datetime().describe("ISO 8601 timestamp")}),handler:async($,Z)=>{r(Z),await Z.access.check();let X={};if($.name)X.name=$.name;if($.description!==void 0)X.metadata={description:$.description};let Q=await Z.boundAuth.organization.update({organizationId:$.id,data:X});if(!Q)throw Error("Failed to update organization");return{...Q,createdAt:Q.createdAt instanceof Date?Q.createdAt.toISOString():Q.createdAt}}})});import{z as $p}from"zod";var Sl0;var Is1=D(()=>{S0();Sl0=c({name:"ORGANIZATION_DELETE",description:"Archive an organization (soft delete).",annotations:{title:"Delete Organization",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:$p.object({id:$p.string()}),outputSchema:$p.object({success:$p.boolean(),id:$p.string()}),handler:async($,Z)=>{return r(Z),await Z.access.check(),await Z.boundAuth.organization.update({organizationId:$.id,data:{metadata:{archived:!0,archivedAt:new Date().toISOString()}}}),{success:!0,id:$.id}}})});import{z as zF}from"zod";var Cl0;var qs1=D(()=>{S0();n7();Cl0=c({name:"ORGANIZATION_SETTINGS_GET",description:"Get organization-level settings including sidebar configuration, store registry settings, simple model mode, and default home agents.",annotations:{title:"Get Organization Settings",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:zF.object({}),outputSchema:zF.object({organizationId:zF.string(),sidebar_items:zF.array(Ni).nullable().optional(),enabled_plugins:zF.array(zF.string()).nullable().optional(),registry_config:Ui.nullable().optional(),simple_mode:Oi.nullable().optional(),default_home_agents:Di.nullable().optional(),flags:wi.nullable().optional(),main_agent_id:zF.string().nullable().optional(),sprint_config:Li.nullable().optional(),createdAt:zF.string().datetime().optional().describe("ISO 8601 timestamp"),updatedAt:zF.string().datetime().optional().describe("ISO 8601 timestamp")}),handler:async($,Z)=>{r(Z),await Z.access.check();let X=Z.organization?.id;if(!X)throw Error("Organization ID required (no active organization in context)");let Q=await Z.storage.organizationSettings.get(X);if(!Q)return{organizationId:X};return{...Q,createdAt:Q.createdAt instanceof Date?Q.createdAt.toISOString():Q.createdAt,updatedAt:Q.updatedAt instanceof Date?Q.updatedAt.toISOString():Q.updatedAt}}})});import{z as CQ}from"zod";var _l0;var Ms1=D(()=>{S0();n7();_l0=c({name:"ORGANIZATION_SETTINGS_UPDATE",description:"Update organization-level settings such as sidebar configuration, store registry settings, simple model mode, and default home agents.",annotations:{title:"Update Organization Settings",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:CQ.object({organizationId:CQ.string(),sidebar_items:CQ.array(Ni).optional(),enabled_plugins:CQ.array(CQ.string()).optional(),registry_config:Ui.optional(),simple_mode:Oi.optional(),default_home_agents:Di.optional(),flags:wi.strict().optional().describe("Org boolean toggles. Shallow-merged into the stored flags: keys you pass win (explicit false persists), omitted keys keep their value."),main_agent_id:CQ.string().nullable().optional().describe("Virtual MCP id the org lands on instead of the Super Agent. Pass null to clear."),sprint_config:Li.optional().describe("Task board sprint cadence. Replaced whole (not merged), so pass all three fields.")}),outputSchema:CQ.object({organizationId:CQ.string(),sidebar_items:CQ.array(Ni).nullable().optional(),enabled_plugins:CQ.array(CQ.string()).nullable().optional(),registry_config:Ui.nullable().optional(),simple_mode:Oi.nullable().optional(),default_home_agents:Di.nullable().optional(),flags:wi.nullable().optional(),main_agent_id:CQ.string().nullable().optional(),sprint_config:Li.nullable().optional(),createdAt:CQ.string().datetime().describe("ISO 8601 timestamp"),updatedAt:CQ.string().datetime().describe("ISO 8601 timestamp")}),handler:async($,Z)=>{if(r(Z),await Z.access.check(),t(Z).id!==$.organizationId)throw Error("Cannot update settings for a different organization");let Q=await Z.storage.organizationSettings.upsert($.organizationId,{sidebar_items:$.sidebar_items,enabled_plugins:$.enabled_plugins,registry_config:$.registry_config,simple_mode:$.simple_mode,default_home_agents:$.default_home_agents,flags:$.flags,main_agent_id:$.main_agent_id,sprint_config:$.sprint_config});return{...Q,createdAt:Q.createdAt instanceof Date?Q.createdAt.toISOString():Q.createdAt,updatedAt:Q.updatedAt instanceof Date?Q.updatedAt.toISOString():Q.updatedAt}}})});import{z as A3}from"zod";var ks1,vl0,fl0;var Vs1=D(()=>{S0();n7();ks1=AO.extend({organizationId:A3.string(),archivedAt:A3.string().nullable().optional().describe("ISO 8601 timestamp"),createdAt:A3.string().describe("ISO 8601 timestamp"),updatedAt:A3.string().describe("ISO 8601 timestamp")}),vl0=c({name:"BRAND_CONTEXT_LIST",description:"List all brand contexts (company profiles) for the current organization.",annotations:{title:"List Brand Contexts",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:A3.object({includeArchived:A3.boolean().optional().describe("Include archived brands in the list")}),outputSchema:A3.object({items:A3.array(ks1)}),handler:async($,Z)=>{r(Z),await Z.access.check();let X=Z.organization?.id;if(!X)throw Error("Organization ID required (no active organization in context)");return{items:(await Z.storage.brandContext.list(X,{includeArchived:$.includeArchived})).map((Y)=>({...Y,archivedAt:Y.archivedAt instanceof Date?Y.archivedAt.toISOString():Y.archivedAt,createdAt:Y.createdAt instanceof Date?Y.createdAt.toISOString():Y.createdAt,updatedAt:Y.updatedAt instanceof Date?Y.updatedAt.toISOString():Y.updatedAt}))}}}),fl0=c({name:"BRAND_CONTEXT_GET",description:"Get a specific brand context by ID.",annotations:{title:"Get Brand Context",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:A3.object({id:A3.string().describe("Brand context ID")}),outputSchema:ks1.extend({organizationId:A3.string()}),handler:async($,Z)=>{r(Z),await Z.access.check();let X=Z.organization?.id;if(!X)throw Error("Organization ID required (no active organization in context)");let Q=await Z.storage.brandContext.get($.id,X);if(!Q)throw Error("Brand context not found");return{...Q,archivedAt:Q.archivedAt instanceof Date?Q.archivedAt.toISOString():Q.archivedAt,createdAt:Q.createdAt instanceof Date?Q.createdAt.toISOString():Q.createdAt,updatedAt:Q.updatedAt instanceof Date?Q.updatedAt.toISOString():Q.updatedAt}}})});import{z as aw}from"zod";var Ss1,bl0,xl0,yl0;var Cs1=D(()=>{S0();n7();Ss1=AO.extend({organizationId:aw.string(),createdAt:aw.string().describe("ISO 8601 timestamp"),updatedAt:aw.string().describe("ISO 8601 timestamp")}),bl0=c({name:"BRAND_CONTEXT_CREATE",description:"Create a new brand context (company profile) for the current organization.",annotations:{title:"Create Brand Context",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!1,openWorldHint:!1},inputSchema:AO.omit({id:!0}),outputSchema:Ss1,handler:async($,Z)=>{r(Z),await Z.access.check();let X=Z.organization?.id;if(!X)throw Error("Organization ID required (no active organization in context)");let Q=await Z.storage.brandContext.create(X,{name:$.name,domain:$.domain,overview:$.overview,logo:$.logo??null,favicon:$.favicon??null,ogImage:$.ogImage??null,fonts:$.fonts??null,colors:$.colors??null,images:$.images??null,metadata:$.metadata??null});return{...Q,archivedAt:Q.archivedAt instanceof Date?Q.archivedAt.toISOString():Q.archivedAt,createdAt:Q.createdAt instanceof Date?Q.createdAt.toISOString():Q.createdAt,updatedAt:Q.updatedAt instanceof Date?Q.updatedAt.toISOString():Q.updatedAt}}}),xl0=c({name:"BRAND_CONTEXT_UPDATE",description:"Update an existing brand context by ID.",annotations:{title:"Update Brand Context",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:AO.partial().required({id:!0}),outputSchema:Ss1,handler:async($,Z)=>{r(Z),await Z.access.check();let X=Z.organization?.id;if(!X)throw Error("Organization ID required (no active organization in context)");if(!await Z.storage.brandContext.get($.id,X))throw Error("Brand context not found");let{id:Y,...G}=$;if(G.isDefault===!0)await Z.storage.brandContext.setDefault(Y,X);let J=await Z.storage.brandContext.update(Y,X,{name:G.name,domain:G.domain,overview:G.overview,logo:G.logo!==void 0?G.logo??null:void 0,favicon:G.favicon!==void 0?G.favicon??null:void 0,ogImage:G.ogImage!==void 0?G.ogImage??null:void 0,fonts:G.fonts!==void 0?G.fonts??null:void 0,colors:G.colors!==void 0?G.colors??null:void 0,images:G.images!==void 0?G.images??null:void 0,metadata:G.metadata!==void 0?G.metadata??null:void 0,archivedAt:G.archivedAt!==void 0?G.archivedAt??null:void 0,isDefault:G.isDefault===!1?!1:void 0});return{...J,archivedAt:J.archivedAt instanceof Date?J.archivedAt.toISOString():J.archivedAt,createdAt:J.createdAt instanceof Date?J.createdAt.toISOString():J.createdAt,updatedAt:J.updatedAt instanceof Date?J.updatedAt.toISOString():J.updatedAt}}}),yl0=c({name:"BRAND_CONTEXT_DELETE",description:"Archive a brand context by ID (soft delete).",annotations:{title:"Archive Brand Context",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:aw.object({id:aw.string().describe("Brand context ID")}),outputSchema:aw.object({success:aw.boolean()}),handler:async($,Z)=>{r(Z),await Z.access.check();let X=Z.organization?.id;if(!X)throw Error("Organization ID required (no active organization in context)");if(!await Z.storage.brandContext.get($.id,X))throw Error("Brand context not found");return await Z.storage.brandContext.update($.id,X,{archivedAt:new Date().toISOString(),isDefault:!1}),{success:!0}}})});async function u90($,Z,X){let Q=$.trim();if(!Q.startsWith("http"))Q=`https://${Q}`;let Y=await fetch("https://api.firecrawl.dev/v1/scrape",{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${Z}`},body:JSON.stringify({url:Q,formats:["branding"]})});if(!Y.ok){let U=await Y.text().catch(()=>"");throw Error(`Firecrawl API error: ${Y.status} ${U.slice(0,200)}`)}let G=await Y.json();if(!G.success||!G.data?.branding)return null;let J=G.data.branding,W=G.data.metadata??{},K=us8(J,W);return{name:W.title?.split(/[|\u2013\u2014]|\s+-\s+/).map((U)=>U.trim()).filter(Boolean)?.slice().sort((U,O)=>U.length-O.length)[0]??W.ogSiteName??X??$,domain:$,overview:W.description??"",logo:K.logo,favicon:K.favicon,ogImage:K.ogImage,fonts:K.fonts,colors:K.colors,images:null,metadata:Object.keys(K.metadata).length>0?K.metadata:null}}function us8($,Z){let X=$.images??{},Q=$.colors??{},Y={};for(let[F,N]of Object.entries(Q))if(typeof N==="string"&&N&&gs8.has(F))Y[F]=N;let G={},W=($.typography??{}).fontFamilies??{};for(let[F,N]of Object.entries(W))if(typeof N==="string"&&N){let U=hs8[F.toLowerCase()];if(U&&!G[U])G[U]=N}let K=$.fonts;if(Array.isArray(K))for(let F of K){let N=F.family;if(typeof N==="string"&&N&&!G.body)G.body=N}let H={};for(let F of["typography","components","spacing","layout","animations","icons","tone","personality","colorScheme"])if($[F]!==void 0)H[F]=$[F];return{logo:X.logo??null,favicon:X.favicon??null,ogImage:X.ogImage??Z.ogImage??null,fonts:Object.keys(G).length>0?G:null,colors:Object.keys(Y).length>0?Y:null,metadata:H}}var gs8,hs8;var gl0=D(()=>{gs8=new Set(["primary","secondary","accent","background","foreground"]),hs8={heading:"heading",headings:"heading",head:"heading",title:"heading",body:"body",primary:"body",text:"body",code:"code",monospace:"code",mono:"code"}});import{z as c90}from"zod";var cs8,hl0;var _s1=D(()=>{S0();gl0();n7();cs8=AO.pick({id:!0,name:!0,domain:!0,overview:!0,logo:!0,favicon:!0,ogImage:!0,fonts:!0,colors:!0}).extend({success:c90.boolean()}),hl0=c({name:"BRAND_CONTEXT_EXTRACT",description:"Extract brand context (colors, fonts, logos) from a website URL using Firecrawl.",annotations:{title:"Extract Brand Context",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!0},inputSchema:c90.object({domain:c90.string().describe("Website domain to extract brand from"),brandId:c90.string().optional().describe("Existing brand context ID to update (creates new if omitted)")}),outputSchema:cs8,modelSummary:($)=>$.success?`Brand saved (id=${$.id}, name=${$.name}, domain=${$.domain}). The UI rendered the logo, colors, fonts, and overview.`:"Brand extraction failed.",handler:async($,Z)=>{r(Z),await Z.access.check();let X=Z.organization?.id;if(!X)throw Error("Organization ID required (no active organization in context)");let Q=Z.firecrawlApiKey;if(!Q)throw Error("FIRECRAWL_API_KEY is not configured. Set the environment variable to enable brand extraction.");let Y=await u90($.domain,Q,$.domain);if(!Y)throw Error("Firecrawl did not return branding data for this URL");let G={name:Y.name,domain:Y.domain,overview:Y.overview,logo:Y.logo,favicon:Y.favicon,ogImage:Y.ogImage,fonts:Y.fonts,colors:Y.colors,images:Y.images,metadata:Y.metadata},J=$.brandId?await(async()=>{if(!await Z.storage.brandContext.get($.brandId,X))throw Error("Brand context not found");return Z.storage.brandContext.update($.brandId,X,G)})():await Z.storage.brandContext.create(X,G);return{id:J.id,name:J.name,domain:J.domain,overview:J.overview,logo:J.logo,favicon:J.favicon,ogImage:J.ogImage,fonts:J.fonts,colors:J.colors,success:!0}}})});function vs1($){let Z=$.metadata??{};return{id:$.id,name:$.name,domain:$.domain||void 0,colors:$.colors??void 0,fonts:$.fonts??void 0,assets:$.logo||$.favicon||$.ogImage?{logo:$.logo??void 0,favicon:$.favicon??void 0,ogImage:$.ogImage??void 0}:void 0,overview:$.overview||void 0,tagline:typeof Z.tagline==="string"?Z.tagline:void 0,tone:typeof Z.tone==="string"?Z.tone:void 0,metadata:(()=>{let X=Object.fromEntries(Object.entries(Z).filter(([Q])=>Q!=="tagline"&&Q!=="tone"));return Object.keys(X).length>0?X:void 0})()}}var ul0,cl0;var fs1=D(()=>{lc0();S0();ul0=c({name:"BRAND_GET",description:"Get a brand context by ID. Omit the ID to get the default brand for the organization.",annotations:{title:"Get Brand",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:E90,outputSchema:ci,handler:async($,Z)=>{r(Z),await Z.access.check();let X=Z.organization?.id;if(!X)throw Error("Organization ID required (no active organization in context)");let Q=$.id?await Z.storage.brandContext.get($.id,X):await Z.storage.brandContext.getDefault(X);if(!Q)throw Error($.id?"Brand not found":"No default brand configured");return vs1(Q)}}),cl0=c({name:"BRAND_LIST",description:"List all active brands for the current organization.",annotations:{title:"List Brands",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:j90,outputSchema:z90,handler:async($,Z)=>{r(Z),await Z.access.check();let X=Z.organization?.id;if(!X)throw Error("Organization ID required (no active organization in context)");return{items:(await Z.storage.brandContext.list(X)).map(vs1)}}})});import{resolveTxt as ls8}from"dns/promises";function ll0($){return`${ds8}.${$.toLowerCase()}`}function bs1(){return`deco-verify-${crypto.randomUUID().replace(/-/g,"")}`}async function xs1($,Z,X=ls8){if(!Z)return!1;try{return(await X(ll0($))).some((Y)=>Y.join("").trim()===Z)}catch{return!1}}var ds8="_deco-verify";var ys1=()=>{};import{z as M5}from"zod";function uO($){let Z=$.verificationStatus==="pending"&&Boolean($.verificationToken);return{id:$.id,domain:$.domain,joinMode:$.joinMode,verificationStatus:$.verificationStatus,verificationMethod:$.verificationMethod,verifiedAt:$.verifiedAt?new Date($.verifiedAt).toISOString():null,recordName:Z?ll0($.domain):null,recordValue:Z?$.verificationToken:null}}function is8($){let Z=$.toLowerCase().trim();if(!ms8.test(Z))throw Error(`Invalid domain format: "${Z}". Must be a valid domain like "acme.com"`);if(T3.has(Z))throw Error(`Cannot claim generic email domain "${Z}". Only corporate domains are allowed.`);return Z}var ms8,dl0,l90,ml0,il0,pl0,nl0,tl0;var gs1=D(()=>{gY();ys1();S0();ms8=/^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+$/,dl0=M5.enum(["off","auto","request"]),l90=M5.object({id:M5.string(),domain:M5.string(),joinMode:dl0,verificationStatus:M5.enum(["pending","verified"]),verificationMethod:M5.enum(["email","dns"]).nullable(),verifiedAt:M5.string().nullable(),recordName:M5.string().nullable(),recordValue:M5.string().nullable()});ml0=c({name:"ORGANIZATION_DOMAIN_LIST",description:"List the email domains claimed by an organization.",annotations:{title:"List Organization Domains",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:M5.object({}),outputSchema:M5.object({domains:M5.array(l90)}),handler:async($,Z)=>{r(Z),await Z.access.check();let X=t(Z);return{domains:(await Z.storage.organizationDomains.listByOrganizationId(X.id)).map(uO)}}}),il0=c({name:"ORGANIZATION_DOMAIN_ADD",description:"Claim an email domain for an organization. If the caller's verified email matches the domain it is trusted immediately; otherwise it requires DNS verification.",annotations:{title:"Add Organization Domain",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:M5.object({domain:M5.string().min(1).max(255).describe("Domain to claim, e.g. acme.com"),joinMode:dl0.optional().describe("Initial join mode (only applied when the domain is trusted immediately via email match).")}),outputSchema:l90,handler:async($,Z)=>{r(Z),await Z.access.check();let X=t(Z),Q=is8($.domain),G=Z.auth.user?.email?.split("@")[1]?.toLowerCase(),J=Boolean(Z.auth.user?.emailVerified)&&G===Q,W=await Z.storage.organizationDomains.getByOrgAndDomain(X.id,Q);if(W){if(W.verificationStatus!=="verified"&&J){let H=await Z.storage.organizationDomains.markVerified(W.id,"email");return uO(H)}return uO(W)}let K=J?await Z.storage.organizationDomains.add(X.id,Q,{joinMode:$.joinMode??"off",verificationStatus:"verified",verificationMethod:"email"}):await Z.storage.organizationDomains.add(X.id,Q,{joinMode:"off",verificationStatus:"pending",verificationToken:bs1()});return uO(K)}}),pl0=c({name:"ORGANIZATION_DOMAIN_UPDATE",description:"Set the join mode for a claimed domain. Discoverable modes (auto/request) require the domain to be verified.",annotations:{title:"Update Organization Domain",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:M5.object({id:M5.string(),joinMode:dl0}),outputSchema:l90,handler:async($,Z)=>{r(Z),await Z.access.check();let X=t(Z),Q=await Z.storage.organizationDomains.getById($.id);if(!Q||Q.organizationId!==X.id)throw Error("Domain not found");if($.joinMode!=="off"&&Q.verificationStatus!=="verified")throw Error("Verify the domain before enabling auto-join or requests.");let Y=await Z.storage.organizationDomains.updateJoinMode($.id,$.joinMode);return uO(Y)}}),nl0=c({name:"ORGANIZATION_DOMAIN_VERIFY",description:"Check the DNS TXT record for a pending domain and mark it verified if present.",annotations:{title:"Verify Organization Domain",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!0},inputSchema:M5.object({id:M5.string()}),outputSchema:M5.object({verified:M5.boolean(),domain:l90}),handler:async($,Z)=>{r(Z),await Z.access.check();let X=t(Z),Q=await Z.storage.organizationDomains.getById($.id);if(!Q||Q.organizationId!==X.id)throw Error("Domain not found");if(Q.verificationStatus==="verified")return{verified:!0,domain:uO(Q)};if(!Q.verificationToken)throw Error("Domain has no pending DNS verification.");if(!await xs1(Q.domain,Q.verificationToken))return{verified:!1,domain:uO(Q)};let G=await Z.storage.organizationDomains.markVerified($.id,"dns");return{verified:!0,domain:uO(G)}}}),tl0=c({name:"ORGANIZATION_DOMAIN_REMOVE",description:"Remove a claimed domain from an organization.",annotations:{title:"Remove Organization Domain",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:M5.object({id:M5.string()}),outputSchema:M5.object({success:M5.boolean()}),handler:async($,Z)=>{r(Z),await Z.access.check();let X=t(Z),Q=await Z.storage.organizationDomains.getById($.id);if(!Q||Q.organizationId!==X.id)throw Error("Domain not found");return await Z.storage.organizationDomains.removeById($.id),{success:!0}}})});function cO($){return($ instanceof Error?$.message.toLowerCase():"").includes("already a member")}import{z as z9}from"zod";var ps8,ol0,rl0,al0;var hs1=D(()=>{S0();C4();ps8=z9.object({id:z9.string(),userId:z9.string(),status:z9.enum(["pending","approved","denied"]),createdAt:z9.string(),user:z9.object({id:z9.string(),name:z9.string(),email:z9.string(),image:z9.string().nullable()}).nullable()}),ol0=c({name:"ORGANIZATION_JOIN_REQUEST_LIST",description:"List pending requests to join the organization.",annotations:{title:"List Join Requests",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:z9.object({}),outputSchema:z9.object({requests:z9.array(ps8)}),handler:async($,Z)=>{r(Z),await Z.access.check();let X=t(Z);return{requests:(await Z.storage.organizationJoinRequests.listPendingWithUser(X.id)).map((Y)=>({id:Y.id,userId:Y.userId,status:Y.status,createdAt:new Date(Y.createdAt).toISOString(),user:Y.user}))}}}),rl0=c({name:"ORGANIZATION_JOIN_REQUEST_APPROVE",description:"Approve a pending join request, adding the user as a member.",annotations:{title:"Approve Join Request",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:z9.object({requestId:z9.string()}),outputSchema:z9.object({success:z9.boolean()}),handler:async($,Z)=>{r(Z),await Z.access.check();let X=t(Z),Q=await Z.storage.organizationJoinRequests.getById($.requestId);if(!Q||Q.organizationId!==X.id)throw Error("Join request not found");if(Q.status!=="pending")throw Error("Join request has already been decided");let Y=Y1(Z);if(!await Z.storage.organizationJoinRequests.decide(Q.id,"approved",Y??Q.userId))return{success:!0};try{await Z.boundAuth.organization.addMember({organizationId:X.id,userId:Q.userId,role:["user"]})}catch(J){if(!cO(J))throw J}if(Y)y1.capture({distinctId:Y,event:"organization_join_request_approved",groups:{organization:X.id},properties:{organization_id:X.id,user_id:Q.userId}});return{success:!0}}}),al0=c({name:"ORGANIZATION_JOIN_REQUEST_DENY",description:"Deny a pending join request.",annotations:{title:"Deny Join Request",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:z9.object({requestId:z9.string()}),outputSchema:z9.object({success:z9.boolean()}),handler:async($,Z)=>{r(Z),await Z.access.check();let X=t(Z),Q=await Z.storage.organizationJoinRequests.getById($.requestId);if(!Q||Q.organizationId!==X.id)throw Error("Join request not found");if(Q.status!=="pending")throw Error("Join request has already been decided");let Y=Y1(Z);if(await Z.storage.organizationJoinRequests.decide(Q.id,"denied",Y??Q.userId)&&Y)y1.capture({distinctId:Y,event:"organization_join_request_denied",groups:{organization:X.id},properties:{organization_id:X.id,user_id:Q.userId}});return{success:!0}}})});import{z as _Q}from"zod";var sl0;var us1=D(()=>{C4();S0();MQ();sl0=c({name:"ORGANIZATION_MEMBER_ADD",description:"Invite a member to the organization by email with an assigned role.",annotations:{title:"Add Organization Member",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:_Q.object({organizationId:_Q.string().optional(),userId:_Q.string(),role:_Q.array(_Q.string())}),outputSchema:_Q.object({id:_Q.string(),organizationId:_Q.string(),userId:_Q.string(),role:_Q.union([_Q.string(),_Q.array(_Q.string())]),createdAt:_Q.string().datetime().describe("ISO 8601 timestamp")}),handler:async($,Z)=>{r(Z),await Z.access.check();let X=$.organizationId||Z.organization?.id;if(!X)throw Error("Organization ID required (no active organization in context)");if(X!==Z.organization?.id)throw Error("Organization ID does not match authenticated organization");let Q=await Z.db.selectFrom("member").select(["role"]).where("userId","=",Y1(Z)??"").where("organizationId","=",X).executeTakeFirst();if(!t60(Q?.role,$.role))throw Error(`Insufficient privileges to assign role "${$.role.join(",")}"`);let Y=await Z.boundAuth.organization.addMember({organizationId:X,userId:$.userId,role:$.role});if(!Y)throw Error("Failed to add member");let G=Y1(Z);if(G)y1.capture({distinctId:G,event:"organization_member_added",groups:{organization:X},properties:{organization_id:X,added_user_id:$.userId,role:$.role}});return{...Y,role:Y.role,createdAt:Y.createdAt instanceof Date?Y.createdAt.toISOString():Y.createdAt}}})});import{z as ux}from"zod";var el0;var cs1=D(()=>{C4();S0();el0=c({name:"ORGANIZATION_MEMBER_REMOVE",description:"Remove a member from the organization. Revokes all their access immediately.",annotations:{title:"Remove Organization Member",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:ux.object({organizationId:ux.string().optional(),memberIdOrEmail:ux.string()}),outputSchema:ux.object({success:ux.boolean(),memberIdOrEmail:ux.string()}),handler:async($,Z)=>{r(Z),await Z.access.check();let X=$.organizationId||Z.organization?.id;if(!X)throw Error("Organization ID required (no active organization in context)");if(X!==Z.organization?.id)throw Error("Organization ID does not match authenticated organization");let Q=await Z.boundAuth.organization.removeMember({organizationId:X,memberIdOrEmail:$.memberIdOrEmail});Z.invalidateMemberRole?.(Q.member.userId,X);let Y=Y1(Z);if(Y)y1.capture({distinctId:Y,event:"organization_member_removed",groups:{organization:X},properties:{organization_id:X,member_id_or_email:$.memberIdOrEmail}});return{success:!0,memberIdOrEmail:$.memberIdOrEmail}}})});import{z as r7}from"zod";var $d0;var ls1=D(()=>{S0();$d0=c({name:"ORGANIZATION_MEMBER_LIST",description:"List all members in the organization with their roles.",annotations:{title:"List Organization Members",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:r7.object({limit:r7.number().int().min(1).max(1000).optional(),offset:r7.number().int().min(0).optional()}),outputSchema:r7.object({members:r7.array(r7.object({id:r7.string(),organizationId:r7.string(),userId:r7.string(),role:r7.string(),createdAt:r7.string().datetime().describe("ISO 8601 timestamp"),user:r7.object({id:r7.string(),name:r7.string(),email:r7.string(),image:r7.string().optional()}).optional()}))}),handler:async($,Z)=>{r(Z),await Z.access.check();let X=Z.organization?.id;if(!X)throw Error("Organization ID required (no active organization in context)");return{members:((await Z.boundAuth.organization.listMembers({organizationId:X,limit:$.limit,offset:$.offset}))?.members??[]).map((G)=>({...G,createdAt:G.createdAt instanceof Date?G.createdAt.toISOString():G.createdAt}))}}})});import{z as fZ}from"zod";var Zd0;var ds1=D(()=>{C4();S0();MQ();Zd0=c({name:"ORGANIZATION_MEMBER_UPDATE_ROLE",description:"Change a member's role (e.g., admin, member) within the organization.",annotations:{title:"Update Member Role",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:fZ.object({organizationId:fZ.string().optional(),memberId:fZ.string(),role:fZ.array(fZ.string())}),outputSchema:fZ.object({id:fZ.string(),organizationId:fZ.string(),userId:fZ.string(),role:fZ.union([fZ.string(),fZ.array(fZ.string())]),createdAt:fZ.string().datetime().describe("ISO 8601 timestamp"),user:fZ.object({email:fZ.string(),name:fZ.string(),image:fZ.string().optional()})}),handler:async($,Z)=>{r(Z),await Z.access.check();let X=$.organizationId||Z.organization?.id;if(!X)throw Error("Organization ID required (no active organization in context)");let Q=await Z.db.selectFrom("member").select(["role"]).where("userId","=",Y1(Z)??"").where("organizationId","=",X).executeTakeFirst();if(!t60(Q?.role,$.role))throw Error(`Insufficient privileges to assign role "${$.role.join(",")}"`);let Y=await Z.boundAuth.organization.updateMemberRole({organizationId:X,memberId:$.memberId,role:$.role});if(!Y)throw Error("Failed to update member role");Z.invalidateMemberRole?.(Y.userId,X);let G=Y1(Z);if(G)y1.capture({distinctId:G,event:"organization_member_role_updated",groups:{organization:X},properties:{organization_id:X,member_id:$.memberId,target_user_id:Y.userId,new_role:Array.isArray($.role)?$.role.join(","):$.role}});return{...Y,createdAt:Y.createdAt instanceof Date?Y.createdAt.toISOString():Y.createdAt}}})});async function ms1(){if(Zp&&Date.now()-Zp.fetchedAt<600000)return Zp.rate;try{let Z=await(await fetch("https://economia.awesomeapi.com.br/json/last/USD-BRL",{signal:AbortSignal.timeout(5000)})).json(),X=parseFloat(Z.USDBRL?.bid??"");if(Number.isNaN(X)||X<=0)throw Error("Invalid rate");return Zp={rate:X,fetchedAt:Date.now()},X}catch{return Zp?.rate??5.5}}function is1($,Z,X){if(Z==="brl")return Math.round($/X);return $}var Zp=null;function Xd0($,Z="",X=new URLSearchParams){for(let[Q,Y]of Object.entries($)){if(Y===void 0||Y===null)continue;let G=Z?`${Z}[${Q}]`:Q;if(Array.isArray(Y))Y.forEach((J,W)=>{if(typeof J==="object"&&J!==null)Xd0(J,`${G}[${W}]`,X);else X.append(`${G}[${W}]`,String(J))});else if(typeof Y==="object")Xd0(Y,G,X);else X.append(G,String(Y))}return X}async function Xp($,Z){let X=b0().stripeSecretKey;if(!X)throw new hY(503,"billing is not configured");let Q=Z?.params?Xd0(Z.params).toString():void 0,Y=await fetch(`${ns8}${$}`,{method:Z?.method??(Q?"POST":"GET"),headers:{Authorization:`Bearer ${X}`,...Q&&{"Content-Type":"application/x-www-form-urlencoded"}},body:Q,signal:AbortSignal.timeout(ts8)}),G=await Y.json().catch(()=>({}));if(!Y.ok){let J=G.error?.message??`HTTP ${Y.status}`;throw new hY(Y.status,J)}return G}function ps1($){return{billing_address_collection:"required",tax_id_collection:{enabled:!0},...$&&{customer_update:{address:"auto",name:"auto"}}}}async function ns1($){let Z=b0().stripeOrgPriceId;if(!Z)throw new hY(503,"billing is not configured");let X=await Xp("/checkout/sessions",{params:{mode:"subscription",...ps1(null),line_items:[{price:Z,quantity:1}],success_url:$.successUrl,cancel_url:$.cancelUrl,metadata:{orgId:$.organizationId},subscription_data:{metadata:{orgId:$.organizationId}}}});if(!X.url)throw new hY(500,"checkout session lacks url");return{url:X.url}}function os8($,Z){return Math.round($*(1+Z/100))}async function ts1($){let Z=os8($.amountCents,$.feePercent),X=is1($.amountCents,$.currency,await ms1()),Q=b0().stripeTopupProductId,Y={kind:"topup",orgId:$.organizationId,creditCents:X},G=$.currency==="brl"?`Studio AI credits (R$ ${($.amountCents/100).toFixed(2)})`:`Studio AI credits ($${($.amountCents/100).toFixed(2)})`,J=await Xp("/checkout/sessions",{params:{mode:"payment",...$.customerId&&{customer:$.customerId},...ps1($.customerId),line_items:[{quantity:1,price_data:{currency:$.currency,unit_amount:Z,...Q?{product:Q}:{product_data:{name:G}}}}],success_url:$.successUrl,cancel_url:$.cancelUrl,metadata:Y,payment_intent_data:{metadata:Y}}});if(!J.url)throw new hY(500,"checkout session lacks url");return{url:J.url}}async function d90($){let Z=await Xp("/billing_portal/sessions",{params:{customer:$.customerId,return_url:$.returnUrl}});if(!Z.url)throw new hY(500,"portal session lacks url");return{url:Z.url}}async function m90($){return Xp(`/subscriptions/${encodeURIComponent($)}`)}async function os1($){await Xp(`/subscriptions/${encodeURIComponent($)}`,{method:"DELETE"})}var ns8="https://api.stripe.com/v1",hY,ts8=15000;var sw=D(()=>{q$();hY=class hY extends Error{status;constructor($,Z){super(`Stripe API ${$}: ${Z}`);this.status=$;this.name="StripeApiError"}}});import{z as Qd0}from"zod";var Yd0;var rs1=D(()=>{sw();L9();S0();C4();Yd0=c({name:"ORGANIZATION_BILLING_CHECKOUT_START",description:"Start the organization's subscription: creates a Stripe Checkout session and returns its URL.",annotations:{title:"Start Billing Checkout",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!1,openWorldHint:!0},inputSchema:Qd0.object({}),outputSchema:Qd0.object({url:Qd0.string()}),handler:async($,Z)=>{r(Z),await Z.access.check();let X=Z.organization?.id,Q=Z.organization?.slug;if(!X||!Q)throw Error("Organization context required");let Y=await Z.storage.organizationBilling.getBilling(X);if(Y?.status==="active")throw Error("This organization already has an active subscription.");if(Y?.stripeSubscriptionId)throw Error("This organization still has a subscription on file \u2014 settle or cancel it before starting a new checkout.");let G=`${b9()}/${encodeURIComponent(Q)}/members`,{url:J}=await ns1({organizationId:X,successUrl:`${G}?checkout=success`,cancelUrl:`${G}?checkout=canceled`});return vY({event:"subscription_checkout_started",organizationId:X,...Z.auth?.user?.id?{userId:Z.auth.user.id}:{}}),{url:J}}})});import{z as Gd0}from"zod";var Jd0;var as1=D(()=>{sw();L9();S0();Jd0=c({name:"ORGANIZATION_BILLING_PORTAL",description:"Open the organization's Stripe billing portal (manage card, invoices, cancellation). Returns the portal URL.",annotations:{title:"Open Billing Portal",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!1,openWorldHint:!0},inputSchema:Gd0.object({}),outputSchema:Gd0.object({url:Gd0.string()}),handler:async($,Z)=>{r(Z),await Z.access.check();let X=t(Z);if(!X.slug)throw Error("Organization context required");let Q=await Z.storage.organizationBilling.getBilling(X.id);if(!Q?.stripeCustomerId)throw Error("This organization has no billing account yet \u2014 subscribe first.");try{return await d90({customerId:Q.stripeCustomerId,returnUrl:`${b9()}/${encodeURIComponent(X.slug)}/members`})}catch(Y){if(Y instanceof hY)throw Error(Y.message);throw Y}}})});function i90($){return Wd0[$%Wd0.length]??rs8}function vQ($){return $.createdBy==="system"}function PF($){return p90.filter((Z)=>Rx($,as8[Z]))}function lx($,Z){return $?.startsWith(`${cx[Z]}:`)??!1}function AF($){let Z=0;for(let X of $){if(X.action!=="status_changed")continue;if(X.data?.to!=="in_review")continue;Z=Math.max(Z,new Date(X.occurredAt).getTime())}return Z}function Kd0($,Z){let X=AF($),Q=new Map;for(let Y of $){if(Y.action!=="review_approved"&&Y.action!=="review_changes_requested")continue;if(new Date(Y.occurredAt).getTime()<X)continue;let G=Y.data??{};if(G.reviewer!=="qa"&&G.reviewer!=="code_review")continue;if(Y.action==="review_approved"){if(Z?.verifiedOnly&&G.verified!==!0)continue;Q.set(G.reviewer,"approved")}else Q.set(G.reviewer,"changes_requested")}return Q}function lO($,Z,X){if(Z.length===0)return!1;let Q=Kd0($,X);return Z.every((Y)=>Q.get(Y)==="approved")}function es1($,Z){return lO($,Z)&&!lO($,Z,{verifiedOnly:!0})}function $e1($){let Z=null;for(let X of $){if(X.action!=="review_approved"&&X.action!=="review_changes_requested")continue;let Q=new Date(X.occurredAt).getTime();if(Z&&Q<Z.at)continue;let Y=X.data?.notes;Z={at:Q,notes:X.action==="review_changes_requested"&&typeof Y==="string"?Y:null}}return Z?.notes??null}function ss8($){let Z=0;for(let X of $){if(X.action!=="assignee_changed")continue;if(X.data?.to!==T8)continue;Z=Math.max(Z,new Date(X.occurredAt).getTime())}return Z}function Ze1($,Z=Hd0){let X=ss8($),Q=new Set,Y=0;for(let G of[...$].sort((J,W)=>J.occurredAt.localeCompare(W.occurredAt))){let J=new Date(G.occurredAt).getTime();if(G.action==="status_changed"){if(G.data?.to==="in_review")Y=J;continue}if(G.action==="review_changes_requested"&&J>=X)Q.add(Y)}return Q.size+1>=Z}var T8="super-agent",Wd0,rs8,Qp='Your checkout is SHALLOW (`git clone --depth 1`), so it has no merge base and `git diff main...HEAD` (three dots) fails with "fatal: main...HEAD: no merge base". To see a branch diff, either use the two-dot form against the fetched remote ref (`git fetch origin <base> && git diff origin/<base> HEAD`), or deepen first with `git fetch --deepen=100`. Same for `git log main..HEAD` and anything else that needs shared history.',ss1,p90,cx,as8,Hd0=5,Xe1="task-board.item.updated",Qe1="task-board.item.deleted";var X9=D(()=>{n7();Wd0=["#9ca3af","#ef4444","#f97316","#f59e0b","#22c55e","#3b82f6","#a855f7","#ec4899"],rs8=Wd0[0];ss1="Read the diff with `gh pr diff <number>`. It comes from the API, so it needs no fetch, no merge base, and is unaffected by the shallow checkout. "+"Read it ONCE \u2014 `gh pr diff <number> --name-only` first if you need to size "+"it, then pull the hunks you need per FILE. Do NOT re-run the diff sliced by directory: each slice re-reads bytes you already have into every remaining turn's context, and it is the largest avoidable cost in a review.",p90=["qa","code_review"],cx={qa:"QA Agent",code_review:"Code Reviewer"},as8={qa:"qa_agent_enabled",code_review:"code_reviewer_enabled"}});function Fd0($){return $==="trial"?"trial":"subscription"}function Yp($,Z,X,Q={}){vY({event:Z,organizationId:X.organizationId,...$.auth?.user?.id?{userId:$.auth.user.id}:{},properties:{task_id:X.id,...Q}})}function Nd0($){return $?.status==="active"||$?.status==="past_due"}function n90($,Z){if(Nd0($))return{periodKey:$?.currentPeriodEnd?`sub:${$.currentPeriodEnd.toISOString()}`:"sub:pending",limit:$?.monthlyTaskExecutions??Z.monthlyTaskExecutions,exhaustedReason:"monthly_exhausted"};return{periodKey:"trial",limit:$?.freeTaskExecutions??Z.freeTaskExecutions,exhaustedReason:"trial_exhausted"}}function Gp(){let $=b0();return{enforced:$.taskQuotaEnforced,freeTaskExecutions:$.freeTaskExecutions,monthlyTaskExecutions:$.monthlyTaskExecutions,maxRunsPerTask:$.maxRunsPerTask}}function dO(){return{...Gp(),maxRunsPerTask:Number.POSITIVE_INFINITY}}async function dx($,Z,X=Gp()){if(!X.enforced||!vQ(Z))return;let Q=await $.storage.organizationBilling.taskClaim(Z.id);if(Q&&Q.runCount>=X.maxRunsPerTask)throw Yp($,"task_quota_blocked",Z,{phase:"precheck",reason:"runs_exhausted"}),new a7("runs_exhausted");if(Q&&Q.state!=="released")return;let Y=await $.storage.organizationBilling.getBilling(Z.organizationId),G=n90(Y,X);if(await $.storage.organizationBilling.countTaskClaims(Z.organizationId,G.periodKey)>=G.limit)throw Yp($,"task_quota_blocked",Z,{phase:"precheck",reason:G.exhaustedReason,billing_mode:Fd0(G.periodKey),limit:G.limit}),new a7(G.exhaustedReason)}async function Ye1($,Z,X=Gp()){if(!X.enforced||!vQ(Z))return"skipped";let Q=await $.storage.organizationBilling.getBilling(Z.organizationId),Y=n90(Q,X),G=await $.storage.organizationBilling.claimTaskUnderLimit(Z.organizationId,Z.id,Y.periodKey,Y.limit,X.maxRunsPerTask);if(G==="exhausted")throw Yp($,"task_quota_blocked",Z,{phase:"claim",reason:Y.exhaustedReason,billing_mode:Fd0(Y.periodKey),limit:Y.limit}),new a7(Y.exhaustedReason);if(G==="runs_exhausted")throw Yp($,"task_quota_blocked",Z,{phase:"claim",reason:"runs_exhausted"}),new a7("runs_exhausted");if(G==="claimed")Yp($,"task_quota_claimed",Z,{billing_mode:Fd0(Y.periodKey),period_key:Y.periodKey,limit:Y.limit});return G}async function Ge1($,Z,X,Q){if(Q==="skipped")return;await $.rollbackTaskClaim(Z,X,{releaseSlot:Q==="claimed"}).catch((Y)=>console.error("[task-quota] rollback failed (stays charged)",Y))}async function Je1($,Z){let X=await $.storage.organizationBilling.taskClaim(Z);return!!X&&X.state!=="released"}async function We1($,Z,X){if(await $.releaseTaskClaim(Z,X).catch((Y)=>{return console.error("[task-quota] refund failed (stays charged)",Y),!1}))vY({event:"task_quota_refunded",organizationId:Z,properties:{task_id:X}})}var es8="[SUBSCRIPTION_REQUIRED]",$e8,a7;var pG=D(()=>{X9();C4();q$();$e8={trial_exhausted:"this organization used its free task executions \u2014 subscribe to keep running tasks",monthly_exhausted:"this organization used its monthly task executions \u2014 more become available next billing cycle",runs_exhausted:"this task reached its execution limit \u2014 create a new task to keep going"};a7=class a7 extends Error{reason;constructor($){super(`${es8} ${$e8[$]}`);this.reason=$;this.name="TaskQuotaError"}}});import{z as TF}from"zod";var Ud0;var Ke1=D(()=>{S0();pG();Ud0=c({name:"ORGANIZATION_TASK_QUOTA_GET",description:"Get the organization's auto-task quota: how many runs are used in the current period, the limit, and the subscription's billing status.",annotations:{title:"Get Task Quota",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:TF.object({}),outputSchema:TF.object({enforced:TF.boolean(),billingStatus:TF.string(),subscribed:TF.boolean(),hasBillingAccount:TF.boolean(),used:TF.number(),limit:TF.number(),currentPeriodEnd:TF.string().datetime().nullable()}),handler:async($,Z)=>{r(Z),await Z.access.check();let X=t(Z),Q=Gp(),Y=await Z.storage.organizationBilling.getBilling(X.id),G=n90(Y,Q),J=await Z.storage.organizationBilling.countTaskClaims(X.id,G.periodKey);return{enforced:Q.enforced,billingStatus:Y?.status??"none",subscribed:Nd0(Y),hasBillingAccount:!!Y?.stripeCustomerId,used:J,limit:G.limit,currentPeriodEnd:Y?.currentPeriodEnd?.toISOString()??null}}})});var He1=D(()=>{Ps1();As1();Ts1();Rs1();Is1();qs1();Ms1();Vs1();Cs1();_s1();fs1();gs1();hs1();us1();cs1();ls1();ds1();rs1();as1();Ke1()});function NK($){if($==null)return"unknown error";if(typeof $==="string")return $;if($ instanceof Error)return $.message;return JSON.stringify($)}function t90($){if($===null||typeof $==="string"||typeof $==="number"||typeof $==="boolean")return!0;if(Array.isArray($))return $.every(t90);if(typeof $==="object")return Object.entries($).every(([Z,X])=>typeof Z==="string"&&(X===void 0||t90(X)));return!1}function Od0($){return Array.isArray($)&&$.every(t90)}function Jp($){return $!=null&&typeof $==="object"&&Object.entries($).every(([Z,X])=>typeof Z==="string"&&(X===void 0||t90(X)))}var ge1="vercel.ai.error",Xe8,Fe1,Ne1,J1,he1="AI_APICallError",ue1,Qe8,Ue1,Oe1,Q4,ce1="AI_EmptyResponseBodyError",le1,Ye8,Be1,De1,o90,de1="AI_InvalidArgumentError",me1,Ge8,Le1,we1,mO,ie1="AI_InvalidPromptError",pe1,Je8,Ee1,je1,nG,ne1="AI_InvalidResponseDataError",te1,We8,ze1,Pe1,mx,oe1="AI_JSONParseError",re1,Ke8,Ae1,Te1,RF,ae1="AI_LoadAPIKeyError",se1,He8,Re1,Ie1,ew,ee1="AI_LoadSettingError",$0$,Fe8,qe1,Me1,Z0$,X0$="AI_NoContentGeneratedError",Q0$,Ne8,ke1,Ve1,Y0$,G0$="AI_NoSuchModelError",J0$,Ue8,Se1,Ce1,u5,W0$="AI_TooManyEmbeddingValuesForCallError",K0$,Oe8,_e1,ve1,ix,H0$="AI_TypeValidationError",F0$,Be8,fe1,be1,O5,N0$="AI_UnsupportedFunctionalityError",U0$,De8,xe1,ye1,v4;var a1=D(()=>{Xe8=Symbol.for(ge1),J1=class $ extends(Ne1=Error,Fe1=Xe8,Ne1){constructor({name:Z,message:X,cause:Q}){super(X);this[Fe1]=!0,this.name=Z,this.cause=Q}static isInstance(Z){return $.hasMarker(Z,ge1)}static hasMarker(Z,X){let Q=Symbol.for(X);return Z!=null&&typeof Z==="object"&&Q in Z&&typeof Z[Q]==="boolean"&&Z[Q]===!0}},ue1=`vercel.ai.error.${he1}`,Qe8=Symbol.for(ue1),Q4=class extends(Oe1=J1,Ue1=Qe8,Oe1){constructor({message:$,url:Z,requestBodyValues:X,statusCode:Q,responseHeaders:Y,responseBody:G,cause:J,isRetryable:W=Q!=null&&(Q===408||Q===409||Q===429||Q>=500),data:K}){super({name:he1,message:$,cause:J});this[Ue1]=!0,this.url=Z,this.requestBodyValues=X,this.statusCode=Q,this.responseHeaders=Y,this.responseBody=G,this.isRetryable=W,this.data=K}static isInstance($){return J1.hasMarker($,ue1)}},le1=`vercel.ai.error.${ce1}`,Ye8=Symbol.for(le1),o90=class extends(De1=J1,Be1=Ye8,De1){constructor({message:$="Empty response body"}={}){super({name:ce1,message:$});this[Be1]=!0}static isInstance($){return J1.hasMarker($,le1)}};me1=`vercel.ai.error.${de1}`,Ge8=Symbol.for(me1),mO=class extends(we1=J1,Le1=Ge8,we1){constructor({message:$,cause:Z,argument:X}){super({name:de1,message:$,cause:Z});this[Le1]=!0,this.argument=X}static isInstance($){return J1.hasMarker($,me1)}},pe1=`vercel.ai.error.${ie1}`,Je8=Symbol.for(pe1),nG=class extends(je1=J1,Ee1=Je8,je1){constructor({prompt:$,message:Z,cause:X}){super({name:ie1,message:`Invalid prompt: ${Z}`,cause:X});this[Ee1]=!0,this.prompt=$}static isInstance($){return J1.hasMarker($,pe1)}},te1=`vercel.ai.error.${ne1}`,We8=Symbol.for(te1),mx=class extends(Pe1=J1,ze1=We8,Pe1){constructor({data:$,message:Z=`Invalid response data: ${JSON.stringify($)}.`}){super({name:ne1,message:Z});this[ze1]=!0,this.data=$}static isInstance($){return J1.hasMarker($,te1)}},re1=`vercel.ai.error.${oe1}`,Ke8=Symbol.for(re1),RF=class extends(Te1=J1,Ae1=Ke8,Te1){constructor({text:$,cause:Z}){super({name:oe1,message:`JSON parsing failed: Text: ${$}.
+  `.execute($)).rows[0]?.exists)await _4`CREATE ROLE ${_4.id(X)} NOLOGIN`.execute($);await _4`GRANT ${_4.id(X)} TO CURRENT_USER`.execute($),await _4`GRANT USAGE, CREATE ON SCHEMA ${_4.id(Z)} TO ${_4.id(X)}`.execute($),await _4`GRANT ALL ON ALL TABLES IN SCHEMA ${_4.id(Z)} TO ${_4.id(X)}`.execute($),await _4`GRANT ALL ON ALL SEQUENCES IN SCHEMA ${_4.id(Z)} TO ${_4.id(X)}`.execute($),await _4`ALTER DEFAULT PRIVILEGES IN SCHEMA ${_4.id(Z)} GRANT ALL ON TABLES TO ${_4.id(X)}`.execute($),await _4`ALTER DEFAULT PRIVILEGES IN SCHEMA ${_4.id(Z)} GRANT ALL ON SEQUENCES TO ${_4.id(X)}`.execute($),await _4`REVOKE ALL ON SCHEMA public FROM ${_4.id(X)}`.execute($)}async function Ws8($,Z,X,Q){try{return await $.transaction().execute(async(Y)=>{return await _4`SET LOCAL ROLE ${_4.id(X)}`.execute(Y),await _4`SET LOCAL search_path TO ${_4.id(Z)}`.execute(Y),await _4.raw(Q).execute(Y)})}catch(Y){if(Gs8(Y))return await Js8($,Z,X),await $.transaction().execute(async(G)=>{return await _4`SET LOCAL ROLE ${_4.id(X)}`.execute(G),await _4`SET LOCAL search_path TO ${_4.id(Z)}`.execute(G),await _4.raw(Q).execute(G)});throw Y}}var $s8,Xs8,da1;var ma1=D(()=>{S0();$s8=HK.object({results:HK.array(HK.unknown()).optional(),success:HK.boolean().optional()});Xs8=HK.object({sql:HK.string().describe("The SQL query to run"),params:HK.array(HK.any()).describe("The parameters to pass to the SQL query").optional()});da1=c({name:"DATABASES_RUN_SQL",description:"Run a SQL query in a connection-scoped isolated schema. Supports SELECT, DDL, and DML.",annotations:{title:"Run SQL Query",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!1,openWorldHint:!1},inputSchema:Xs8,outputSchema:HK.object({result:HK.array($s8)}),handler:async($,Z)=>{r(Z),await Z.access.check();let X=Zs8($.sql,$.params||[]);if(!Z.connectionId)throw Error("Connection context required for database access");console.warn("DATABASES_RUN_SQL invoked",{"tool.deprecation_probe":"DATABASES_RUN_SQL","connection.id":Z.connectionId,"organization.id":Z.organization?.id??null,"user.id":Z.auth.user?.id??null});let Q=Qs8(Z.connectionId),Y=Ys8(Z.connectionId);return{result:[{results:(await Ws8(Z.db,Q,Y,X)).rows,success:!0}]}}})});function C90($){let Z=$.access.getRole();if(!i7(Z))throw new KF("Only organization owners and admins can change org-wide pin status")}var $l0=D(()=>{MQ();qw()});async function _90($,Z,X){let Q=[...new Set(X)],Y=await Promise.all(Q.map((J)=>$.storage.connections.findById(J,Z))),G=Q.filter((J,W)=>!Y[W]);if(G.length>0)throw Error(`Connection not found: ${G.join(", ")}`)}function EF($){return $.toLowerCase().replace(/[^a-z0-9]+/g,"-").replace(/^-|-$/g,"")}function v90($){let Z=2166136261;for(let X=0;X<$.length;X++)Z=Math.imul(Z^$.charCodeAt(X),16777619);return`a${(Z>>>0).toString(36).padStart(6,"0").slice(-6)}`}function ai($){if($&&typeof $==="object"&&"gatewayClientId"in $&&typeof $.gatewayClientId==="string")return $.gatewayClientId;return}function si($,Z){if(!Z)return $;let X=`${v90(Z)}_`;return $.startsWith(X)?$.slice(X.length):$}function Hs8($){return $.split(/[-_]/).map((Z)=>Z?Z.charAt(0).toUpperCase()+Z.slice(1):Z).join(" ")}var hx;var ia1=D(()=>{lW();hx=class hx extends y9{static MAX_PAGES_PER_CLIENT=1000;clients;slugToKey=new Map;resolvedClients=new Map;toolsCache=null;resourcesCache=null;resourceTemplatesCache=null;promptsCache=null;resourceRouteMap=new Map;constructor($,Z){super(Z?.clientInfo??{name:"gateway-client",version:"1.0.0"},{capabilities:Z?.capabilities});this.clients=$;for(let X of Object.keys($)){let Q=v90(X);if(this.slugToKey.has(Q))throw Error(`GatewayClient: duplicate namespace code "${Q}" from keys "${this.slugToKey.get(Q)}" and "${X}"`);this.slugToKey.set(Q,X)}}namespace($,Z){return`${v90($)}_${Z}`}async resolveToolTarget($){let Z=$.indexOf("_");if(Z!==-1){let Q=$.slice(0,Z),Y=this.slugToKey.get(Q);if(Y)return[Y,$.slice(Z+1)]}let{tools:X}=await this.listTools();for(let Q of X){let Y=ai(Q._meta);if(!Y)continue;if(si(Q.name,Y)===$)return[Y,$]}if(Z===-1)throw Error(`GatewayClient: could not resolve tool "${$}" \u2014 no namespace prefix and not found in any client`);throw Error(`GatewayClient: unknown namespace "${$.slice(0,Z)}" in "${$}" and not found by original name in any client`)}async resolvePromptTarget($){let Z=$.indexOf("_");if(Z!==-1){let Q=$.slice(0,Z),Y=this.slugToKey.get(Q);if(Y)return[Y,$.slice(Z+1)]}let{prompts:X}=await this.listPrompts();for(let Q of X){let Y=ai(Q._meta);if(!Y)continue;if(si(Q.name,Y)===$)return[Y,$]}if(Z===-1)throw Error(`GatewayClient: could not resolve prompt "${$}" \u2014 no namespace prefix and not found in any client`);throw Error(`GatewayClient: unknown namespace "${$.slice(0,Z)}" in "${$}" and not found by original name in any client`)}resolveClient($){let Z=this.resolvedClients.get($);if(Z)return Z;let X=this.clients[$];if(!X)return Promise.reject(Error(`GatewayClient: unknown client key "${$}"`));let Q=X.client,Y;try{Y=typeof Q==="function"?Promise.resolve(Q()):Promise.resolve(Q)}catch(J){return Promise.reject(J)}let G=Y.catch((J)=>{throw this.resolvedClients.delete($),J});return this.resolvedClients.set($,G),G}getResolvedClient($){return this.resolveClient($)}async listFromClient($,Z,X){try{let Q=await this.resolveClient($);return await Z(Q)}catch(Q){return console.warn(`GatewayClient: skipping ${X} from client "${$}" \u2014 ${Q?.message??Q}`),[]}}async paginate($,Z,X){let Q=[],Y,G=0;do{let J=await X(Y);Q.push(...J.items),Y=J.nextCursor,G++}while(Y&&G<hx.MAX_PAGES_PER_CLIENT);if(Y)console.warn(`GatewayClient: client "${$}" exceeded ${hx.MAX_PAGES_PER_CLIENT} pages listing ${Z} \u2014 truncating`);return Q}fetchAllTools($,Z){return this.paginate(Z,"tools",async(X)=>{let Q=await $.listTools(X?{cursor:X}:void 0);return{items:Q.tools,nextCursor:Q.nextCursor}})}fetchAllResources($,Z){return this.paginate(Z,"resources",async(X)=>{let Q=await $.listResources(X?{cursor:X}:void 0);return{items:Q.resources,nextCursor:Q.nextCursor}})}fetchAllResourceTemplates($,Z){return this.paginate(Z,"resource templates",async(X)=>{let Q=await $.listResourceTemplates(X?{cursor:X}:void 0);return{items:Q.resourceTemplates,nextCursor:Q.nextCursor}})}fetchAllPrompts($,Z){return this.paginate(Z,"prompts",async(X)=>{let Q=await $.listPrompts(X?{cursor:X}:void 0);return{items:Q.prompts,nextCursor:Q.nextCursor}})}listTools($,Z){if(!this.toolsCache)this.toolsCache=this.aggregateTools();return this.toolsCache}async aggregateTools(){let $=[];for(let[Z,X]of Object.entries(this.clients)){let Q=await this.listFromClient(Z,(J)=>this.fetchAllTools(J,Z),"tools"),Y=X.tools,G=Y?new Set(Y):null;for(let J of Q){if(G&&!G.has(J.name))continue;$.push({...J,name:this.namespace(Z,J.name),_meta:{...J._meta??{},gatewayClientId:Z}})}}return{tools:$}}listResources($,Z){if(!this.resourcesCache)this.resourcesCache=this.aggregateResources();return this.resourcesCache}async aggregateResources(){let $=new Set,Z=[],X=new Map;for(let[Q,Y]of Object.entries(this.clients)){let G=await this.listFromClient(Q,(K)=>this.fetchAllResources(K,Q),"resources"),J=Y.resources,W=J?new Set(J):null;for(let K of G){if(W&&!W.has(K.uri)&&!(K.name&&W.has(K.name)))continue;if($.has(K.uri)){console.warn(`GatewayClient: duplicate resource "${K.uri}" from client "${Q}" \u2014 skipping`);continue}$.add(K.uri),X.set(K.uri,Q),Z.push({...K,_meta:{...K._meta??{},gatewayClientId:Q}})}}return this.resourceRouteMap=X,{resources:Z}}listResourceTemplates($,Z){if(!this.resourceTemplatesCache)this.resourceTemplatesCache=this.aggregateResourceTemplates();return this.resourceTemplatesCache}async aggregateResourceTemplates(){let $=new Set,Z=[];for(let[X,Q]of Object.entries(this.clients)){let Y=await this.listFromClient(X,(G)=>this.fetchAllResourceTemplates(G,X),"resource templates");for(let G of Y){if($.has(G.uriTemplate)){console.warn(`GatewayClient: duplicate resource template "${G.uriTemplate}" from client "${X}" \u2014 skipping`);continue}$.add(G.uriTemplate),Z.push({...G,_meta:{...G._meta??{},gatewayClientId:X}})}}return{resourceTemplates:Z}}listPrompts($,Z){if(!this.promptsCache)this.promptsCache=this.aggregatePrompts();return this.promptsCache}async aggregatePrompts(){let $=[];for(let[Z,X]of Object.entries(this.clients)){let Q=await this.listFromClient(Z,(J)=>this.fetchAllPrompts(J,Z),"prompts"),Y=X.prompts,G=Y?new Set(Y):null;for(let J of Q){if(G&&!G.has(J.name))continue;$.push({...J,name:this.namespace(Z,J.name),title:J.title??Hs8(J.name),_meta:{...J._meta??{},gatewayClientId:Z}})}}return{prompts:$}}async callTool($,Z,X){let[Q,Y]=await this.resolveToolTarget($.name);return(await this.resolveClient(Q)).callTool({...$,name:Y},Z,X)}async readResource($,Z){let X=await this.resolveResourceRoute($.uri);return(await this.resolveClient(X)).readResource($)}async getPrompt($,Z){let[X,Q]=await this.resolvePromptTarget($.name);return(await this.resolveClient(X)).getPrompt({...$,name:Q})}async resolveResourceRoute($){let Z=this.resourceRouteMap.get($);if(Z)return Z;if(this.resourcesCache=null,await this.listResources(),Z=this.resourceRouteMap.get($),Z)return Z;throw Error(`GatewayClient: resource "${$}" not found in any upstream client`)}getServerCapabilities(){return{tools:{},resources:{},prompts:{}}}getInstructions(){return}refresh(){this.toolsCache=null,this.resourcesCache=null,this.resourceTemplatesCache=null,this.promptsCache=null}async close(){let $=[...this.resolvedClients.values()].map((Z)=>Z.then((X)=>X.close()).catch(()=>{}));await Promise.allSettled($),await super.close()}}});var f90=D(()=>{ia1()});function Xl0($){return EF($)}function Ns8($,Z){let X=EF(Z)||"prompt";return`${String($).padStart(Fs8,"0")}-${X}`}async function Ql0($,Z,X){try{await $.delete(b90,Xl0(Z),{actor:X})}catch(Q){console.error("[agent-prompts] failed to delete prompts",{agentId:Z,err:Q})}}async function x90($,Z,X,Q){let Y=Xl0(Z);await Ql0($,Z,X),await Promise.all(Q.slice(0,Zl0).map(async(G,J)=>{let W=Ns8(J,G.title),K={name:W,title:G.title,description:G.description,text:G.text};try{await $.write(b90,`${Y}/${W}.json`,JSON.stringify(K),{actor:X,contentType:"application/json"})}catch(H){console.error("[agent-prompts] failed to seed prompt",{agentId:Z,name:W,err:H})}}))}async function pa1($,Z){let X=Xl0(Z),Q;try{Q=await $.listDir(b90,X)}catch{return[]}let Y=Q.filter((J)=>J.kind==="file"&&J.path.endsWith(".json")).slice(0,Zl0),G=[];for(let J of Y)try{let W=await $.read(b90,J.path),K=JSON.parse(new TextDecoder().decode(W));if(K&&typeof K.name==="string"&&typeof K.title==="string"&&typeof K.text==="string")G.push(K)}catch{}return G}var b90="agent-prompts",Zl0=20,Fs8;var ei=D(()=>{f90();Fs8=String(Zl0-1).length});import{z as oa1}from"zod";function Us8(){let $=na1[Math.floor(Math.random()*na1.length)];return`icon://${ta1[Math.floor(Math.random()*ta1.length)]}?color=${$}`}var na1,ta1,Os8,Bs8,Yl0;var ra1=D(()=>{S0();SO();$l0();ei();na1=["red","orange","amber","yellow","lime","green","emerald","cyan","sky","blue","indigo","violet","purple","fuchsia","pink","rose"],ta1=["Star01","Zap","Heart","Globe01","Compass03","Lightbulb02","Rocket01","Flag01","BookOpen01","Shield01","Key01","Diamond01","Cube01","Target04","Award01","Briefcase01","Coffee","Feather","Hexagon01","Layers3_01","Map01","Palette","Package","Terminal"];Os8=oa1.object({data:$80.describe("Data for the new virtual MCP")}),Bs8=oa1.object({item:h7.describe("The created virtual MCP entity")}),Yl0=c({name:"COLLECTION_VIRTUAL_MCP_CREATE",description:"Create a Virtual MCP (agent) that aggregates tools from multiple connections into one endpoint. Pass `prompts` to seed the agent with kickstart prompts (conversation starters shown as icebreakers). Author them from the agent's role/instructions and the descriptions of the tools it will have, so the starters are coherent and immediately useful.",annotations:{title:"Create Virtual MCP",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!1,openWorldHint:!1},inputSchema:Os8,outputSchema:Bs8,handler:async($,Z)=>{r(Z);let X=t(Z);await Z.access.check();let Q=Y1(Z);if(!Q)throw Error("User ID required to create virtual MCP");if($.data.pinned===!0)C90(Z);let{prompts:Y,...G}=$.data;if(G.connections.length>0)await _90(Z,X.id,G.connections.map((K)=>K.connection_id));let J={...G,icon:G.icon??Us8()},W=await Z.storage.virtualMcps.create(X.id,Q,J);if(Y?.length&&Z.orgFs&&W.id)await x90(Z.orgFs,W.id,Q,Y);return{item:W}}})});function Ds8($){let Z=[],X=0;while(X<$.length){let Q=$[X];if(Q==="%")Z.push(".*");else if(Q==="_")Z.push(".");else if(/[.*+?^${}()|[\]\\]/.test(Q))Z.push("\\"+Q);else Z.push(Q);X++}return Z.join("")}function gO($){return typeof $==="string"||typeof $==="number"}function Gl0($,Z){let X=Z.split("."),Q=$;for(let Y of X){if(Q==null||typeof Q!=="object")return;Q=Q[Y]}return Q}function Ls8($,Z){return $.connections.some((X)=>X.connection_id===Z)}function y90($,Z){if("conditions"in Z){let{operator:W,conditions:K}=Z;switch(W){case"and":return K.every((H)=>y90($,H));case"or":return K.some((H)=>y90($,H));case"not":return!K.every((H)=>y90($,H));default:return!0}}let{field:X,operator:Q,value:Y}=Z,G=X.join(".");if(G==="connection_id"){if(Q!=="eq"||typeof Y!=="string")return!1;return Ls8($,Y)}let J=Gl0($,G);switch(Q){case"eq":return J===Y;case"gt":return gO(J)&&gO(Y)&&J>Y;case"gte":return gO(J)&&gO(Y)&&J>=Y;case"lt":return gO(J)&&gO(Y)&&J<Y;case"lte":return gO(J)&&gO(Y)&&J<=Y;case"in":return Array.isArray(Y)&&Y.includes(J);case"like":if(typeof J!=="string"||typeof Y!=="string")return!1;if(Y.length>100)return!1;let W=Ds8(Y);return new RegExp(`^${W}$`,"i").test(J);case"contains":if(typeof J!=="string"||typeof Y!=="string")return!1;return J.toLowerCase().includes(Y.toLowerCase());default:return!0}}function ws8($,Z){return[...$].sort((X,Q)=>{for(let Y of Z){let G=Y.field.join("."),J=Gl0(X,G),W=Gl0(Q,G),K=0;if(J==null&&W==null)continue;if(J==null)K=Y.nulls==="first"?-1:1;else if(W==null)K=Y.nulls==="first"?1:-1;else if(typeof J==="string"&&typeof W==="string")K=J.localeCompare(W);else if(typeof J==="number"&&typeof W==="number")K=J-W;else K=String(J).localeCompare(String(W));if(K!==0)return Y.direction==="desc"?-K:K}return 0})}var Es8,js8,Jl0;var aa1=D(()=>{cG();S0();SO();Es8=z3,js8=LF(h7),Jl0=c({name:"COLLECTION_VIRTUAL_MCP_LIST",description:"List all MCP virtual MCPs in the organization",annotations:{title:"List Virtual MCPs",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:Es8,outputSchema:js8,handler:async($,Z)=>{await Z.access.check();let X=t(Z),Q=$.where&&!("conditions"in $.where)&&$.where.field.join(".")==="connection_id"&&$.where.operator==="eq"&&typeof $.where.value==="string"?$.where.value:void 0,Y=$.where&&!("conditions"in $.where)&&$.where.field.join(".")==="pinned"&&$.where.operator==="eq"&&typeof $.where.value==="boolean"?$.where.value:void 0,J=Q?await Z.storage.virtualMcps.listByConnectionId(X.id,Q):await Z.storage.virtualMcps.list(X.id,Y!==void 0?{pinnedOnly:Y}:void 0);if($.where)J=J.filter((U)=>y90(U,$.where));if($.orderBy&&$.orderBy.length>0)J=ws8(J,$.orderBy);let W=J.length,K=$.offset??0,H=$.limit??100,F=J.slice(K,K+H),N=K+H<W;return{items:F,totalCount:W,hasMore:N}}})});import{z as Wl0}from"zod";var zs8,Ps8,Kl0;var sa1=D(()=>{S0();SO();zs8=Wl0.object({id:Wl0.string().describe("ID of the virtual MCP to retrieve")}),Ps8=Wl0.object({item:h7.nullable().describe("The retrieved virtual MCP, or null if not found")}),Kl0=c({name:"COLLECTION_VIRTUAL_MCP_GET",description:"Get a Virtual MCP's configuration, connections, and virtual tools by ID.",annotations:{title:"Get Virtual MCP",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:zs8,outputSchema:Ps8,handler:async($,Z)=>{r(Z);let X=t(Z);await Z.access.check();let Q=await Z.storage.virtualMcps.findById($.id);if(Q&&Q.organization_id!==X.id)return{item:null};if(!Q)return{item:null};return{item:Q}}})});function mG($){return Hl0.test($)}function ea1($){let Z=(X)=>typeof X==="string"?X.trim().toLowerCase():"";return Z($?.metadata?.siteSlug)||Z($?.title)||null}var Hl0;var hO=D(()=>{Hl0=/^[a-z0-9][a-z0-9-]{0,59}$/});function $s1($){let{nextTitle:Z,currentTitle:X,currentSiteSlug:Q}=$;if(Q?.trim())return null;if(Z===void 0||Z===X)return null;let Y=X?.trim().toLowerCase()??"";return mG(Y)?Y:null}var Zs1=D(()=>{hO()});import{z as Fl0}from"zod";var As8,Ts8,Nl0;var Xs1=D(()=>{S0();ei();SO();$l0();Zs1();As8=Fl0.object({id:Fl0.string().describe("ID of the virtual MCP to update"),data:Z80.describe("Partial virtual MCP data to update")}),Ts8=Fl0.object({item:h7.describe("The updated virtual MCP entity")}),Nl0=c({name:"COLLECTION_VIRTUAL_MCP_UPDATE",description:"Update a Virtual MCP's name, slug, connection list, or kickstart prompts. Pass `prompts` to replace the agent's conversation starters (full set; empty array clears them).",annotations:{title:"Update Virtual MCP",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:As8,outputSchema:Ts8,handler:async($,Z)=>{r(Z);let X=t(Z);await Z.access.check();let Q=Y1(Z);if(!Q)throw Error("User ID required to update virtual MCP");let Y=await Z.storage.virtualMcps.findById($.id);if(!Y)throw Error(`Virtual MCP not found: ${$.id}`);if(Y.organization_id!==X.id)throw Error(`Virtual MCP not found: ${$.id}`);let{prompts:G,...J}=$.data;if(J.metadata&&Y.metadata)J.metadata={...Y.metadata,...J.metadata};let W=$s1({nextTitle:J.title,currentTitle:Y.title,currentSiteSlug:Y.metadata?.siteSlug});if(W)J.metadata={...Y.metadata,...J.metadata,siteSlug:W};if(J.pinned!==void 0&&J.pinned!==Y.pinned)C90(Z);if(J.connections?.length)await _90(Z,X.id,J.connections.map((H)=>H.connection_id));let K=await Z.storage.virtualMcps.update($.id,Q,J);if(G!==void 0&&Z.orgFs)await x90(Z.orgFs,$.id,Q,G);return{item:K}}})});function Rs8($){if(!$)return!1;let Z=Ol0.join("|");return new RegExp(`permission\\s+"?(?:${Z})"?\\s+is not allowed`,"i").test($)||/permissions exceed what the github app/i.test($)}function Ys1($){let Z={...$};for(let X of Ol0)Z[X]="read";return Z}async function Gs1($,Z){let X={...Z};for(;;){let Q=await $(X);if(!Q.isError)return{result:Q,grantedPermissions:X};let Y=Q.content?.find((K)=>K.type==="text")?.text,G=Ol0.find((K)=>(K in X));if(!G||!Rs8(Y))return{result:Q,grantedPermissions:X};let{[G]:J,...W}=X;X=W}}function Is8($){if(!$||typeof $!=="object"||Array.isArray($))return Qs1;let Z=$;if(Object.values(Z).some((X)=>typeof X!=="string"))return Qs1;return Z}function qs8($){if(typeof $!=="number"||!Number.isFinite($)||!Number.isInteger($)||$<=0)return;return $}function q5($){let Z=$.metadata?.repoScope;if(!Z||typeof Z.installationId!=="number"||!Number.isFinite(Z.installationId)||!Number.isInteger(Z.installationId)||Z.installationId<=0||typeof Z.owner!=="string"||typeof Z.repo!=="string"||Z.owner.length===0||Z.repo.length===0)return null;let X=qs8(Z.repositoryId);return{sourceConnectionId:typeof Z.sourceConnectionId==="string"?Z.sourceConnectionId:void 0,installationId:Z.installationId,repositoryId:X,owner:Z.owner,repo:Z.repo,permissions:Is8(Z.permissions),grantProvider:Z.grantProvider==="github-mcp"?"github-mcp":void 0}}function rw($){return $.metadata?.orgShared===!0}function Js1($){let Z=new Set,X=[];for(let Q of $??[]){if(Q.status!=="active")continue;let Y=q5(Q);if(Y===null)continue;let G=Ul0(Y.owner,Y.repo);if(Z.has(G))continue;Z.add(G),X.push(`${Y.owner}/${Y.repo}`)}return X}function g90($,Z,X){let Q=Ul0(Z,X),Y=($??[]).filter((G)=>{if(G.status&&G.status!=="active")return!1;let J=q5(G);return J!==null&&Ul0(J.owner,J.repo)===Q});return Y.find(rw)??Y[0]??null}var Qs1,Ol0,Ul0=($,Z)=>`${$}/${Z}`.toLowerCase();var VQ=D(()=>{Qs1={contents:"write",metadata:"read",pull_requests:"write",issues:"write",checks:"read",deployments:"read"},Ol0=["deployments","checks"]});function Ws1($){return CG($)!==null||I40($)!==null}var Ks1=D(()=>{P8()});import{z as Bl0}from"zod";var Ms8,ks8,Dl0;var Hs1=D(()=>{VQ();dG();S0();ei();SO();Ks1();Ms8=Bl0.object({id:Bl0.string().describe("ID of the virtual MCP to delete")}),ks8=Bl0.object({item:h7.describe("The deleted virtual MCP entity")}),Dl0=c({name:"COLLECTION_VIRTUAL_MCP_DELETE",description:"Permanently delete a Virtual MCP and its virtual tools.",annotations:{title:"Delete Virtual MCP",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:Ms8,outputSchema:ks8,handler:async($,Z)=>{r(Z);let X=t(Z);if(await Z.access.check(),Ws1($.id))throw Error(`Virtual MCP not found: ${$.id}`);let Q=await Z.storage.virtualMcps.findById($.id);if(!Q)throw Error(`Virtual MCP not found: ${$.id}`);if(Q.organization_id!==X.id)throw Error(`Virtual MCP not found: ${$.id}`);await Z.storage.virtualMcps.delete($.id);try{if((await Z.storage.organizationSettings.get(X.id))?.main_agent_id===$.id)await Z.storage.organizationSettings.upsert(X.id,{main_agent_id:null})}catch(G){console.error("[VIRTUAL_MCP_DELETE] failed to clear main agent pointer",{id:$.id,error:G.message})}if(Z.orgFs)await Ql0(Z.orgFs,$.id,Y1(Z)??"system");let Y=Q.metadata?.githubRepo?.connectionId;if(Y)try{let G=await Z.storage.connections.findById(Y,X.id),J=G&&(rw(G)||(await Z.storage.virtualMcps.listByConnectionId(X.id,Y)).length>0||await Z.storage.connections.isReferencedByThread(Y));if(G&&q5(G)&&!J){let K=await new l6(Z.db,Z.vault).get(Y);if(K?.accessToken)try{await fetch("https://api.github.com/installation/token",{method:"DELETE",headers:{Authorization:`Bearer ${K.accessToken}`,Accept:"application/vnd.github+json","X-GitHub-Api-Version":"2022-11-28"},signal:AbortSignal.timeout(5000)})}catch{}await Z.storage.connections.delete(Y)}}catch(G){console.error("[VIRTUAL_MCP_DELETE] failed to tear down repo-scoped connection",{childConnectionId:Y,error:G.message})}return{item:Q}}})});import{z as SQ}from"zod";var Vs8,Ll0;var Fs1=D(()=>{S0();Vs8=SQ.object({id:SQ.string(),virtualMcpId:SQ.string(),pluginId:SQ.string(),connectionId:SQ.string().nullable(),settings:SQ.record(SQ.string(),SQ.unknown()).nullable(),createdAt:SQ.string(),updatedAt:SQ.string()}),Ll0=c({name:"VIRTUAL_MCP_PLUGIN_CONFIG_GET",description:"Get a plugin's current configuration for a specific virtual MCP.",annotations:{title:"Get Virtual MCP Plugin Config",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:SQ.object({virtualMcpId:SQ.string().describe("Virtual MCP ID"),pluginId:SQ.string().describe("Plugin ID")}),outputSchema:SQ.object({config:Vs8.nullable()}),handler:async($,Z)=>{r(Z);let X=t(Z);await Z.access.check();let{virtualMcpId:Q,pluginId:Y}=$,G=await Z.storage.connections.findById(Q);if(!G||G.organization_id!==X.id)return{config:null};if(G.connection_type!=="VIRTUAL")return{config:null};let J=await Z.storage.virtualMcpPluginConfigs.get(Q,Y);if(!J)return{config:null};return{config:{id:J.id,virtualMcpId:J.virtualMcpId,pluginId:J.pluginId,connectionId:J.connectionId,settings:J.settings,createdAt:J.createdAt instanceof Date?J.createdAt.toISOString():J.createdAt,updatedAt:J.updatedAt instanceof Date?J.updatedAt.toISOString():J.updatedAt}}}})});import{z as vZ}from"zod";var Ss8,wl0;var Ns1=D(()=>{S0();bx();L9();Ss8=vZ.object({id:vZ.string(),virtualMcpId:vZ.string(),pluginId:vZ.string(),connectionId:vZ.string().nullable(),settings:vZ.record(vZ.string(),vZ.unknown()).nullable(),createdAt:vZ.string(),updatedAt:vZ.string()}),wl0=c({name:"VIRTUAL_MCP_PLUGIN_CONFIG_UPDATE",description:"Set or update a plugin's configuration for a specific virtual MCP.",annotations:{title:"Update Virtual MCP Plugin Config",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:vZ.object({virtualMcpId:vZ.string().describe("Virtual MCP ID"),pluginId:vZ.string().describe("Plugin ID"),connectionId:vZ.string().nullable().optional().describe("MCP connection to bind"),settings:vZ.record(vZ.string(),vZ.unknown()).nullable().optional().describe("Plugin-specific settings")}),outputSchema:vZ.object({config:Ss8}),handler:async($,Z)=>{r(Z);let X=t(Z);await Z.access.check();let{virtualMcpId:Q,pluginId:Y,connectionId:G,settings:J}=$,W=Y1(Z),K=await Z.storage.connections.findById(Q);if(!K)throw Error(`Connection not found: ${Q}`);if(K.organization_id!==X.id)throw Error(`Connection not found: ${Q}`);if(K.connection_type!=="VIRTUAL")throw Error(`Connection not found: ${Q}`);let H=G?await Z.storage.connections.findById(G):null;if(G&&H&&H.organization_id!==X.id)throw Error(`Connection not found: ${G}`);if(G&&K.organization_id&&!H&&lG()&&I90(G,K.organization_id)){if(!W)throw Error("User ID required to create dev-assets connection");let N=fx(K.organization_id,f9());await Z.storage.connections.create({...N,organization_id:K.organization_id,created_by:W})}else if(G&&!H)throw Error(`Connection not found: ${G}`);let F=await Z.storage.virtualMcpPluginConfigs.upsert(Q,Y,{connectionId:G,settings:J});return{config:{id:F.id,virtualMcpId:F.virtualMcpId,pluginId:F.pluginId,connectionId:F.connectionId,settings:F.settings,createdAt:F.createdAt instanceof Date?F.createdAt.toISOString():F.createdAt,updatedAt:F.updatedAt instanceof Date?F.updatedAt.toISOString():F.updatedAt}}}})});import{z as iX}from"zod";var Cs8,El0;var Us1=D(()=>{S0();SO();Cs8=iX.object({connectionId:iX.string(),toolName:iX.string(),label:iX.string(),icon:iX.string().nullable().optional()}),El0=c({name:"VIRTUAL_MCP_PINNED_VIEWS_UPDATE",description:"Update the pinned sidebar views for a virtual MCP. Replaces all current pins.",annotations:{title:"Update Pinned Views",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:iX.object({virtualMcpId:iX.string().describe("Virtual MCP ID"),pinnedViews:iX.array(Cs8).describe("Pinned views to set for the virtual MCP sidebar"),layout:iX.object({defaultMainView:iX.object({type:iX.string(),id:iX.string().optional(),toolName:iX.string().optional()}).nullable().optional(),chatDefaultOpen:iX.boolean().nullable().optional()}).optional()}),outputSchema:iX.object({item:h7.nullable()}),handler:async($,Z)=>{r(Z);let X=t(Z);await Z.access.check();let{virtualMcpId:Q,pinnedViews:Y,layout:G}=$,J=Y1(Z),W=await Z.storage.virtualMcps.findById(Q);if(!W)throw Error(`Virtual MCP not found: ${Q}`);if(W.organization_id!==X.id)throw Error(`Virtual MCP not found: ${Q}`);let K=W.metadata?.ui??{},H={...K,pinnedViews:Y.length>0?Y:null,layout:G??K.layout??null};return{item:await Z.storage.virtualMcps.update(Q,J??"system",{metadata:{...W.metadata,ui:H}})}}})});import{z as jF}from"zod";var _s8,vs8,jl0;var Os1=D(()=>{S0();_s8=jF.object({ids:jF.array(jF.string()).describe("Virtual MCP ids to look up")}),vs8=jF.object({items:jF.array(jF.object({id:jF.string(),last_used_at:jF.string().optional(),last_used_by:jF.string().optional()}))}),jl0=c({name:"VIRTUAL_MCP_LAST_USED_LIST",description:"Get last-used info (timestamp + user) for one or more virtual MCPs, derived from the most recent thread per agent.",annotations:{title:"List Virtual MCP Last Used",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:_s8,outputSchema:vs8,handler:async($,Z)=>{r(Z),t(Z),await Z.access.check();let X=await Z.storage.threads.findLastUsedByVirtualMcpIds($.ids);return{items:$.ids.map((Q)=>({id:Q,last_used_at:X.get(Q)?.last_used_at,last_used_by:X.get(Q)?.last_used_by}))}}})});var Bs1=D(()=>{ra1();aa1();sa1();Xs1();Hs1();Fs1();Ns1();Us1();Os1()});import{z as o7}from"zod";var zl0;var Ds1=D(()=>{I6();S0();zl0=c({name:"MONITORING_HEATMAP",description:"Get tool-call volume broken down by agent and tool name, for spotting heavily-used tools per agent.",annotations:{title:"Get Tool-Call Heatmap",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:o7.object({startDate:o7.string().datetime().optional().describe("Filter by start date (ISO 8601 datetime string)"),endDate:o7.string().datetime().optional().describe("Filter by end date (ISO 8601 datetime string)"),virtualMcpIds:o7.array(o7.string()).max(100).optional().describe("Filter by specific agent (Virtual MCP) IDs"),excludeConnectionIds:o7.array(o7.string()).max(100).optional().describe("Exclude tool calls from these connection IDs"),limit:o7.number().int().min(1).max(1000).optional().describe("Max number of (agent, tool) cells to return")}),outputSchema:o7.object({cells:o7.array(o7.object({virtualMcpId:o7.string().nullable(),toolName:o7.string(),calls:o7.number(),errors:o7.number(),outputSize:o7.number().describe("Sum of tool-output character length \u2014 a proxy for context weight, not LLM token count")}))}),handler:async($,Z)=>{let X=t(Z);return await Z.access.check(),await WQ(),Z.storage.monitoring.queryToolCallHeatmap({organizationId:X.id,startDate:$.startDate?new Date($.startDate):void 0,endDate:$.endDate?new Date($.endDate):void 0,filters:{virtualMcpIds:$.virtualMcpIds,excludeConnectionIds:$.excludeConnectionIds},limit:$.limit})}})});import{z as U5}from"zod";var Pl0;var Ls1=D(()=>{I6();S0();Pl0=c({name:"MONITORING_LOG_GET",description:"Get a single monitoring log by ID with full input and output data.",annotations:{title:"Get Monitoring Log",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:U5.object({id:U5.string().describe("Log ID to fetch")}),outputSchema:U5.object({log:U5.object({id:U5.string().optional(),organizationId:U5.string(),connectionId:U5.string(),toolName:U5.string(),input:U5.record(U5.string(),U5.unknown()),output:U5.record(U5.string(),U5.unknown()),isError:U5.boolean(),errorMessage:U5.string().nullish(),durationMs:U5.number(),timestamp:U5.string(),userId:U5.string().nullish(),requestId:U5.string(),userAgent:U5.string().nullish(),virtualMcpId:U5.string().nullish(),properties:U5.record(U5.string(),U5.string()).nullish()}).nullable().describe("The monitoring log, or null if not found")}),handler:async($,Z)=>{await Z.access.check(),await WQ();let X=t(Z),Q=await Z.storage.monitoring.getById(X.id,$.id);if(!Q)return{log:null};return{log:{...Q,timestamp:Q.timestamp instanceof Date?Q.timestamp.toISOString():Q.timestamp}}}})});import{z as K8}from"zod";var bs8,Al0;var ws1=D(()=>{I6();S0();bs8=K8.object({id:K8.string().optional().describe("Unique log identifier"),organizationId:K8.string().describe("Organization ID"),connectionId:K8.string().describe("Connection ID"),toolName:K8.string().describe("Name of the tool that was called"),isError:K8.boolean().describe("Whether the call resulted in an error"),errorMessage:K8.string().nullish().describe("Error message if applicable"),durationMs:K8.number().describe("Call duration in milliseconds"),timestamp:K8.string().describe("ISO 8601 timestamp of the call"),userId:K8.string().nullish().describe("User who triggered the call"),requestId:K8.string().describe("Unique request identifier"),userAgent:K8.string().nullish().describe("Client identifier (x-studio-client header)"),virtualMcpId:K8.string().nullish().describe("Virtual MCP (Agent) ID if routed through an agent"),properties:K8.record(K8.string(),K8.string()).nullish().describe("Custom key-value metadata attached to the log")}),Al0=c({name:"MONITORING_LOGS_LIST",description:"List monitoring logs for tool calls with filtering and pagination.",annotations:{title:"List Monitoring Logs",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:K8.object({connectionId:K8.string().optional().describe("Filter by connection ID"),excludeConnectionIds:K8.array(K8.string()).optional().describe("Exclude logs from these connection IDs (e.g. system connections)"),virtualMcpId:K8.string().optional().describe("Filter by Virtual MCP (Agent) ID"),toolName:K8.string().optional().describe("Filter by tool name"),isError:K8.boolean().optional().describe("Filter by error status"),startDate:K8.string().datetime().optional().describe("Filter by start date (ISO 8601 datetime string)"),endDate:K8.string().datetime().optional().describe("Filter by end date (ISO 8601 datetime string)"),limit:K8.number().default(20).describe("Maximum number of results"),offset:K8.number().default(0).describe("Offset for pagination"),properties:K8.record(K8.string(),K8.string()).optional().describe("Filter by exact property key=value matches"),propertyKeys:K8.array(K8.string()).optional().describe("Filter by logs that have these property keys"),propertyPatterns:K8.record(K8.string(),K8.string()).optional().describe("Filter by property value patterns (SQL LIKE, use % as wildcard)"),propertyInValues:K8.record(K8.string(),K8.string()).optional().describe("Filter by exact match within comma-separated values (e.g., user_tags in 'Engineering')")}),outputSchema:K8.object({logs:K8.array(bs8).describe("Array of monitoring logs"),total:K8.number().describe("Total number of logs matching filters"),offset:K8.number().describe("Current offset for pagination"),limit:K8.number().describe("Current limit for pagination")}),handler:async($,Z)=>{await Z.access.check(),await WQ();let X=t(Z),Y=$.properties||$.propertyKeys||$.propertyPatterns||$.propertyInValues?{properties:$.properties,propertyKeys:$.propertyKeys,propertyPatterns:$.propertyPatterns,propertyInValues:$.propertyInValues}:void 0,G={organizationId:X.id,connectionId:$.connectionId,excludeConnectionIds:$.excludeConnectionIds,virtualMcpId:$.virtualMcpId,toolName:$.toolName,isError:$.isError,startDate:$.startDate?new Date($.startDate):void 0,endDate:$.endDate?new Date($.endDate):void 0,limit:$.limit,offset:$.offset,propertyFilters:Y},J=await Z.storage.monitoring.query(G);return{logs:J.logs.map(({input:W,output:K,...H})=>({...H,timestamp:H.timestamp instanceof Date?H.timestamp.toISOString():H.timestamp})),total:J.total,offset:$.offset,limit:$.limit}}})});import{z as J$}from"zod";var Tl0;var Es1=D(()=>{I6();S0();Tl0=c({name:"MONITORING_STATS",description:"Get aggregated statistics (counts, latency, error rates) for tool call monitoring.",annotations:{title:"Get Monitoring Stats",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:J$.object({startDate:J$.string().datetime().optional().describe("Filter by start date (ISO 8601 datetime string)"),endDate:J$.string().datetime().optional().describe("Filter by end date (ISO 8601 datetime string)"),interval:J$.string().regex(/^\d+[mhd]$/).optional().describe("Bucket interval for timeseries data (e.g. 1m, 5m, 2h, 1d). When provided, returns timeseries array."),connectionIds:J$.array(J$.string()).max(100).optional().describe("Filter by specific connection IDs (max 100)"),excludeConnectionIds:J$.array(J$.string()).max(100).optional().describe("Exclude specific connection IDs (max 100)"),toolNames:J$.array(J$.string()).max(100).optional().describe("Filter by specific tool names (max 100)"),status:J$.enum(["success","error"]).optional().describe("Filter metrics by execution status"),topN:J$.number().int().min(1).max(20).optional().describe("When provided with interval, also return top tools and their timeseries"),userIds:J$.array(J$.string()).max(100).optional().describe("Filter LLM usage by user IDs (only applied when llmUsage is true)"),llmUsage:J$.boolean().optional().describe("Aggregate LLM-call usage (tokens + USD cost) from raw log rows for the given connection. Returns token/cost totals and timeseries. Requires interval.")}),outputSchema:J$.object({totalCalls:J$.number().describe("Total number of tool calls"),errorRate:J$.number().optional().describe("Error rate as a decimal (0 to 1)"),avgDurationMs:J$.number().describe("Average call duration in milliseconds"),errorRatePercent:J$.string().optional().describe("Error rate as a percentage string"),totalErrors:J$.number().optional().describe("Total number of errors"),p50DurationMs:J$.number().optional().describe("50th percentile duration in milliseconds"),p95DurationMs:J$.number().optional().describe("95th percentile duration in milliseconds"),connectionBreakdown:J$.array(J$.object({connectionId:J$.string(),calls:J$.number(),errors:J$.number(),errorRate:J$.number(),avgDurationMs:J$.number()})).optional().describe("Per-connection metric breakdown"),totalInputTokens:J$.number().optional().describe("Total input tokens (LLM usage mode)"),totalOutputTokens:J$.number().optional().describe("Total output tokens (LLM usage mode)"),totalTokens:J$.number().optional().describe("Total tokens (LLM usage mode)"),totalCostUsd:J$.number().optional().describe("Total USD cost (LLM usage mode; only non-zero for providers that report cost)"),topTools:J$.array(J$.object({toolName:J$.string(),connectionId:J$.string().nullable(),calls:J$.number(),inputTokens:J$.number().optional(),outputTokens:J$.number().optional(),costUsd:J$.number().optional()})).optional().describe("Top tools ranked by calls"),topToolsTimeseries:J$.array(J$.object({timestamp:J$.string(),toolName:J$.string(),calls:J$.number(),errors:J$.number(),avg:J$.number(),p95:J$.number()})).optional().describe("Per-tool metric timeseries for the top tools"),timeseries:J$.array(J$.object({timestamp:J$.string(),calls:J$.number(),errors:J$.number(),errorRate:J$.number(),avg:J$.number(),p50:J$.number(),p95:J$.number(),inputTokens:J$.number().optional(),outputTokens:J$.number().optional(),totalTokens:J$.number().optional(),costUsd:J$.number().optional()})).optional().describe("Timeseries data points bucketed by interval")}),handler:async($,Z)=>{let X=t(Z);if(await Z.access.check(),await WQ(),$.interval&&$.llmUsage)return Z.storage.monitoring.queryLlmUsageStats({organizationId:X.id,interval:$.interval,connectionId:$.connectionIds?.[0]??"decopilot",startDate:$.startDate?new Date($.startDate):void 0,endDate:$.endDate?new Date($.endDate):void 0,userIds:$.userIds,topN:$.topN});if($.interval){let Y=await Z.storage.monitoring.queryMetricTimeseries({organizationId:X.id,interval:$.interval,startDate:$.startDate?new Date($.startDate):void 0,endDate:$.endDate?new Date($.endDate):void 0,filters:{connectionIds:$.connectionIds,excludeConnectionIds:$.excludeConnectionIds,toolNames:$.toolNames,status:$.status}});if(!$.topN)return Y;let G=await Z.storage.monitoring.queryMetricTopToolsTimeseries({organizationId:X.id,interval:$.interval,startDate:$.startDate?new Date($.startDate):void 0,endDate:$.endDate?new Date($.endDate):void 0,topN:$.topN,filters:{connectionIds:$.connectionIds,excludeConnectionIds:$.excludeConnectionIds,toolNames:$.toolNames,status:$.status}});return{...Y,topTools:G.topTools,topToolsTimeseries:G.timeseries}}let Q=await Z.storage.monitoring.getStats({organizationId:X.id,startDate:$.startDate?new Date($.startDate):void 0,endDate:$.endDate?new Date($.endDate):void 0});return{...Q,errorRatePercent:(Q.errorRate*100).toFixed(2)}}})});import{z as pX}from"zod";var Rl0;var js1=D(()=>{I6();S0();Rl0=c({name:"MONITORING_THREAD_USAGE",description:"Aggregate LLM token usage and USD cost per thread for the given thread IDs.",annotations:{title:"Get Thread Usage",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:pX.object({threadIds:pX.array(pX.string()).min(1).max(500).describe("Thread IDs to aggregate usage for (max 500)"),connectionId:pX.string().optional().describe("LLM connection ID (defaults to 'decopilot')"),startDate:pX.string().datetime().optional().describe("Filter by start date (ISO 8601 datetime string)"),endDate:pX.string().datetime().optional().describe("Filter by end date (ISO 8601 datetime string)")}),outputSchema:pX.object({items:pX.array(pX.object({threadId:pX.string(),calls:pX.number(),inputTokens:pX.number(),outputTokens:pX.number(),totalTokens:pX.number(),costUsd:pX.number()}))}),handler:async($,Z)=>{let X=t(Z);return await Z.access.check(),await WQ(),{items:await Z.storage.monitoring.queryThreadUsage({organizationId:X.id,connectionId:$.connectionId??"decopilot",threadIds:$.threadIds,startDate:$.startDate?new Date($.startDate):void 0,endDate:$.endDate?new Date($.endDate):void 0})}}})});var zs1=D(()=>{Ds1();Ls1();ws1();Es1();js1()});function h90($){return typeof $==="string"&&ys8.has($.trim().toLowerCase())}var ys8;var Il0=D(()=>{ys8=new Set([".well-known","_admin","api","auth","cli","commerce-onboarding","dbos-queue-depth","health","hosted-run-pending","login","mcp","metrics","oauth","oauth-proxy","onboarding","org","report","reset-password"])});import{z as yY}from"zod";var ql0;var Ps1=D(()=>{S0();Il0();ql0=c({name:"ORGANIZATION_CREATE",description:"Create a new organization. The caller becomes the owner automatically.",annotations:{title:"Create Organization",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!1,openWorldHint:!1},inputSchema:yY.object({slug:yY.string().min(1).max(50).regex(/^[a-z0-9-]+$/,"Slug must be lowercase alphanumeric with hyphens").refine(($)=>!h90($),"Slug is reserved by Studio"),name:yY.string().min(1).max(255),description:yY.string().optional()}),outputSchema:yY.object({id:yY.string(),name:yY.string(),slug:yY.string(),logo:yY.string().nullable().optional(),metadata:yY.any().optional(),createdAt:yY.string().datetime().describe("ISO 8601 timestamp"),members:yY.array(yY.any()).optional()}),handler:async($,Z)=>{r(Z),await Z.access.check();let X=Y1(Z);if(!X)throw Error("User ID required to create organization");let Q=await Z.boundAuth.organization.create({name:$.name,slug:$.slug,metadata:$.description?{description:$.description}:void 0,userId:X});if(!Q)throw Error("Failed to create organization");return{...Q,createdAt:Q.createdAt instanceof Date?Q.createdAt.toISOString():Q.createdAt}}})});import{z as FK}from"zod";var Ml0;var As1=D(()=>{S0();Ml0=c({name:"ORGANIZATION_LIST",description:"List organizations the current user belongs to.",annotations:{title:"List Organizations",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},_meta:{ui:{visibility:"app"}},inputSchema:FK.object({}),outputSchema:FK.object({organizations:FK.array(FK.object({id:FK.string(),name:FK.string(),slug:FK.string(),logo:FK.string().nullable().optional(),metadata:FK.any().optional(),createdAt:FK.string().datetime().describe("ISO 8601 timestamp")}))}),handler:async($,Z)=>{if(r(Z),await Z.access.check(),!Y1(Z))throw Error("User ID required to list organizations");return{organizations:(await Z.boundAuth.organization.list()).map((Q)=>({...Q,createdAt:Q.createdAt instanceof Date?Q.createdAt.toISOString():Q.createdAt}))}}})});import{z as iG}from"zod";var kl0;var Ts1=D(()=>{S0();kl0=c({name:"ORGANIZATION_GET",description:"Get an organization's details, members, and settings by slug or ID.",annotations:{title:"Get Organization",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:iG.object({}),outputSchema:iG.object({id:iG.string(),name:iG.string(),slug:iG.string(),logo:iG.string().nullable().optional(),metadata:iG.any().optional(),createdAt:iG.string().datetime().describe("ISO 8601 timestamp"),members:iG.array(iG.any()).optional(),invitations:iG.array(iG.any()).optional()}),handler:async($,Z)=>{r(Z),await Z.access.check();let X=Z.organization?.id;if(!X)throw Error("Organization ID required (no active organization in context)");let Q=await Z.boundAuth.organization.get(X);if(!Q)throw Error("No active organization found");let Y=new Date,G=Q.invitations?.filter((J)=>new Date(J.expiresAt)>Y);return{...Q,invitations:G,createdAt:Q.createdAt instanceof Date?Q.createdAt.toISOString():Q.createdAt}}})});import{z as P3}from"zod";var Vl0;var Rs1=D(()=>{S0();Vl0=c({name:"ORGANIZATION_UPDATE",description:"Update an organization's name or description.",annotations:{title:"Update Organization",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:P3.object({id:P3.string(),name:P3.string().min(1).max(255).optional(),description:P3.string().optional()}),outputSchema:P3.object({id:P3.string(),name:P3.string(),slug:P3.string(),logo:P3.string().nullable().optional(),metadata:P3.any().optional(),createdAt:P3.string().datetime().describe("ISO 8601 timestamp")}),handler:async($,Z)=>{r(Z),await Z.access.check();let X={};if($.name)X.name=$.name;if($.description!==void 0)X.metadata={description:$.description};let Q=await Z.boundAuth.organization.update({organizationId:$.id,data:X});if(!Q)throw Error("Failed to update organization");return{...Q,createdAt:Q.createdAt instanceof Date?Q.createdAt.toISOString():Q.createdAt}}})});import{z as $p}from"zod";var Sl0;var Is1=D(()=>{S0();Sl0=c({name:"ORGANIZATION_DELETE",description:"Archive an organization (soft delete).",annotations:{title:"Delete Organization",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:$p.object({id:$p.string()}),outputSchema:$p.object({success:$p.boolean(),id:$p.string()}),handler:async($,Z)=>{r(Z),await Z.access.check();let X=await Z.boundAuth.organization.get($.id);return await Z.boundAuth.organization.update({organizationId:$.id,data:{metadata:{...X?.metadata,archived:!0,archivedAt:new Date().toISOString()}}}),{success:!0,id:$.id}}})});import{z as zF}from"zod";var Cl0;var qs1=D(()=>{S0();n7();Cl0=c({name:"ORGANIZATION_SETTINGS_GET",description:"Get organization-level settings including sidebar configuration, store registry settings, simple model mode, and default home agents.",annotations:{title:"Get Organization Settings",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:zF.object({}),outputSchema:zF.object({organizationId:zF.string(),sidebar_items:zF.array(Ni).nullable().optional(),enabled_plugins:zF.array(zF.string()).nullable().optional(),registry_config:Ui.nullable().optional(),simple_mode:Oi.nullable().optional(),default_home_agents:Di.nullable().optional(),flags:wi.nullable().optional(),main_agent_id:zF.string().nullable().optional(),sprint_config:Li.nullable().optional(),createdAt:zF.string().datetime().optional().describe("ISO 8601 timestamp"),updatedAt:zF.string().datetime().optional().describe("ISO 8601 timestamp")}),handler:async($,Z)=>{r(Z),await Z.access.check();let X=Z.organization?.id;if(!X)throw Error("Organization ID required (no active organization in context)");let Q=await Z.storage.organizationSettings.get(X);if(!Q)return{organizationId:X};return{...Q,createdAt:Q.createdAt instanceof Date?Q.createdAt.toISOString():Q.createdAt,updatedAt:Q.updatedAt instanceof Date?Q.updatedAt.toISOString():Q.updatedAt}}})});import{z as CQ}from"zod";var _l0;var Ms1=D(()=>{S0();n7();_l0=c({name:"ORGANIZATION_SETTINGS_UPDATE",description:"Update organization-level settings such as sidebar configuration, store registry settings, simple model mode, and default home agents.",annotations:{title:"Update Organization Settings",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:CQ.object({organizationId:CQ.string(),sidebar_items:CQ.array(Ni).optional(),enabled_plugins:CQ.array(CQ.string()).optional(),registry_config:Ui.optional(),simple_mode:Oi.optional(),default_home_agents:Di.optional(),flags:wi.strict().optional().describe("Org boolean toggles. Shallow-merged into the stored flags: keys you pass win (explicit false persists), omitted keys keep their value."),main_agent_id:CQ.string().nullable().optional().describe("Virtual MCP id the org lands on instead of the Super Agent. Pass null to clear."),sprint_config:Li.optional().describe("Task board sprint cadence. Replaced whole (not merged), so pass all three fields.")}),outputSchema:CQ.object({organizationId:CQ.string(),sidebar_items:CQ.array(Ni).nullable().optional(),enabled_plugins:CQ.array(CQ.string()).nullable().optional(),registry_config:Ui.nullable().optional(),simple_mode:Oi.nullable().optional(),default_home_agents:Di.nullable().optional(),flags:wi.nullable().optional(),main_agent_id:CQ.string().nullable().optional(),sprint_config:Li.nullable().optional(),createdAt:CQ.string().datetime().describe("ISO 8601 timestamp"),updatedAt:CQ.string().datetime().describe("ISO 8601 timestamp")}),handler:async($,Z)=>{if(r(Z),await Z.access.check(),t(Z).id!==$.organizationId)throw Error("Cannot update settings for a different organization");let Q=await Z.storage.organizationSettings.upsert($.organizationId,{sidebar_items:$.sidebar_items,enabled_plugins:$.enabled_plugins,registry_config:$.registry_config,simple_mode:$.simple_mode,default_home_agents:$.default_home_agents,flags:$.flags,main_agent_id:$.main_agent_id,sprint_config:$.sprint_config});return{...Q,createdAt:Q.createdAt instanceof Date?Q.createdAt.toISOString():Q.createdAt,updatedAt:Q.updatedAt instanceof Date?Q.updatedAt.toISOString():Q.updatedAt}}})});import{z as A3}from"zod";var ks1,vl0,fl0;var Vs1=D(()=>{S0();n7();ks1=AO.extend({organizationId:A3.string(),archivedAt:A3.string().nullable().optional().describe("ISO 8601 timestamp"),createdAt:A3.string().describe("ISO 8601 timestamp"),updatedAt:A3.string().describe("ISO 8601 timestamp")}),vl0=c({name:"BRAND_CONTEXT_LIST",description:"List all brand contexts (company profiles) for the current organization.",annotations:{title:"List Brand Contexts",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:A3.object({includeArchived:A3.boolean().optional().describe("Include archived brands in the list")}),outputSchema:A3.object({items:A3.array(ks1)}),handler:async($,Z)=>{r(Z),await Z.access.check();let X=Z.organization?.id;if(!X)throw Error("Organization ID required (no active organization in context)");return{items:(await Z.storage.brandContext.list(X,{includeArchived:$.includeArchived})).map((Y)=>({...Y,archivedAt:Y.archivedAt instanceof Date?Y.archivedAt.toISOString():Y.archivedAt,createdAt:Y.createdAt instanceof Date?Y.createdAt.toISOString():Y.createdAt,updatedAt:Y.updatedAt instanceof Date?Y.updatedAt.toISOString():Y.updatedAt}))}}}),fl0=c({name:"BRAND_CONTEXT_GET",description:"Get a specific brand context by ID.",annotations:{title:"Get Brand Context",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:A3.object({id:A3.string().describe("Brand context ID")}),outputSchema:ks1.extend({organizationId:A3.string()}),handler:async($,Z)=>{r(Z),await Z.access.check();let X=Z.organization?.id;if(!X)throw Error("Organization ID required (no active organization in context)");let Q=await Z.storage.brandContext.get($.id,X);if(!Q)throw Error("Brand context not found");return{...Q,archivedAt:Q.archivedAt instanceof Date?Q.archivedAt.toISOString():Q.archivedAt,createdAt:Q.createdAt instanceof Date?Q.createdAt.toISOString():Q.createdAt,updatedAt:Q.updatedAt instanceof Date?Q.updatedAt.toISOString():Q.updatedAt}}})});import{z as aw}from"zod";var Ss1,bl0,xl0,yl0;var Cs1=D(()=>{S0();n7();Ss1=AO.extend({organizationId:aw.string(),createdAt:aw.string().describe("ISO 8601 timestamp"),updatedAt:aw.string().describe("ISO 8601 timestamp")}),bl0=c({name:"BRAND_CONTEXT_CREATE",description:"Create a new brand context (company profile) for the current organization.",annotations:{title:"Create Brand Context",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!1,openWorldHint:!1},inputSchema:AO.omit({id:!0}),outputSchema:Ss1,handler:async($,Z)=>{r(Z),await Z.access.check();let X=Z.organization?.id;if(!X)throw Error("Organization ID required (no active organization in context)");let Q=await Z.storage.brandContext.create(X,{name:$.name,domain:$.domain,overview:$.overview,logo:$.logo??null,favicon:$.favicon??null,ogImage:$.ogImage??null,fonts:$.fonts??null,colors:$.colors??null,images:$.images??null,metadata:$.metadata??null});return{...Q,archivedAt:Q.archivedAt instanceof Date?Q.archivedAt.toISOString():Q.archivedAt,createdAt:Q.createdAt instanceof Date?Q.createdAt.toISOString():Q.createdAt,updatedAt:Q.updatedAt instanceof Date?Q.updatedAt.toISOString():Q.updatedAt}}}),xl0=c({name:"BRAND_CONTEXT_UPDATE",description:"Update an existing brand context by ID.",annotations:{title:"Update Brand Context",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:AO.partial().required({id:!0}),outputSchema:Ss1,handler:async($,Z)=>{r(Z),await Z.access.check();let X=Z.organization?.id;if(!X)throw Error("Organization ID required (no active organization in context)");if(!await Z.storage.brandContext.get($.id,X))throw Error("Brand context not found");let{id:Y,...G}=$;if(G.isDefault===!0)await Z.storage.brandContext.setDefault(Y,X);let J=await Z.storage.brandContext.update(Y,X,{name:G.name,domain:G.domain,overview:G.overview,logo:G.logo!==void 0?G.logo??null:void 0,favicon:G.favicon!==void 0?G.favicon??null:void 0,ogImage:G.ogImage!==void 0?G.ogImage??null:void 0,fonts:G.fonts!==void 0?G.fonts??null:void 0,colors:G.colors!==void 0?G.colors??null:void 0,images:G.images!==void 0?G.images??null:void 0,metadata:G.metadata!==void 0?G.metadata??null:void 0,archivedAt:G.archivedAt!==void 0?G.archivedAt??null:void 0,isDefault:G.isDefault===!1?!1:void 0});return{...J,archivedAt:J.archivedAt instanceof Date?J.archivedAt.toISOString():J.archivedAt,createdAt:J.createdAt instanceof Date?J.createdAt.toISOString():J.createdAt,updatedAt:J.updatedAt instanceof Date?J.updatedAt.toISOString():J.updatedAt}}}),yl0=c({name:"BRAND_CONTEXT_DELETE",description:"Archive a brand context by ID (soft delete).",annotations:{title:"Archive Brand Context",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:aw.object({id:aw.string().describe("Brand context ID")}),outputSchema:aw.object({success:aw.boolean()}),handler:async($,Z)=>{r(Z),await Z.access.check();let X=Z.organization?.id;if(!X)throw Error("Organization ID required (no active organization in context)");if(!await Z.storage.brandContext.get($.id,X))throw Error("Brand context not found");return await Z.storage.brandContext.update($.id,X,{archivedAt:new Date().toISOString(),isDefault:!1}),{success:!0}}})});async function u90($,Z,X){let Q=$.trim();if(!Q.startsWith("http"))Q=`https://${Q}`;let Y=await fetch("https://api.firecrawl.dev/v1/scrape",{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${Z}`},body:JSON.stringify({url:Q,formats:["branding"]})});if(!Y.ok){let U=await Y.text().catch(()=>"");throw Error(`Firecrawl API error: ${Y.status} ${U.slice(0,200)}`)}let G=await Y.json();if(!G.success||!G.data?.branding)return null;let J=G.data.branding,W=G.data.metadata??{},K=us8(J,W);return{name:W.title?.split(/[|\u2013\u2014]|\s+-\s+/).map((U)=>U.trim()).filter(Boolean)?.slice().sort((U,O)=>U.length-O.length)[0]??W.ogSiteName??X??$,domain:$,overview:W.description??"",logo:K.logo,favicon:K.favicon,ogImage:K.ogImage,fonts:K.fonts,colors:K.colors,images:null,metadata:Object.keys(K.metadata).length>0?K.metadata:null}}function us8($,Z){let X=$.images??{},Q=$.colors??{},Y={};for(let[F,N]of Object.entries(Q))if(typeof N==="string"&&N&&gs8.has(F))Y[F]=N;let G={},W=($.typography??{}).fontFamilies??{};for(let[F,N]of Object.entries(W))if(typeof N==="string"&&N){let U=hs8[F.toLowerCase()];if(U&&!G[U])G[U]=N}let K=$.fonts;if(Array.isArray(K))for(let F of K){let N=F.family;if(typeof N==="string"&&N&&!G.body)G.body=N}let H={};for(let F of["typography","components","spacing","layout","animations","icons","tone","personality","colorScheme"])if($[F]!==void 0)H[F]=$[F];return{logo:X.logo??null,favicon:X.favicon??null,ogImage:X.ogImage??Z.ogImage??null,fonts:Object.keys(G).length>0?G:null,colors:Object.keys(Y).length>0?Y:null,metadata:H}}var gs8,hs8;var gl0=D(()=>{gs8=new Set(["primary","secondary","accent","background","foreground"]),hs8={heading:"heading",headings:"heading",head:"heading",title:"heading",body:"body",primary:"body",text:"body",code:"code",monospace:"code",mono:"code"}});import{z as c90}from"zod";var cs8,hl0;var _s1=D(()=>{S0();gl0();n7();cs8=AO.pick({id:!0,name:!0,domain:!0,overview:!0,logo:!0,favicon:!0,ogImage:!0,fonts:!0,colors:!0}).extend({success:c90.boolean()}),hl0=c({name:"BRAND_CONTEXT_EXTRACT",description:"Extract brand context (colors, fonts, logos) from a website URL using Firecrawl.",annotations:{title:"Extract Brand Context",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!0},inputSchema:c90.object({domain:c90.string().describe("Website domain to extract brand from"),brandId:c90.string().optional().describe("Existing brand context ID to update (creates new if omitted)")}),outputSchema:cs8,modelSummary:($)=>$.success?`Brand saved (id=${$.id}, name=${$.name}, domain=${$.domain}). The UI rendered the logo, colors, fonts, and overview.`:"Brand extraction failed.",handler:async($,Z)=>{r(Z),await Z.access.check();let X=Z.organization?.id;if(!X)throw Error("Organization ID required (no active organization in context)");let Q=Z.firecrawlApiKey;if(!Q)throw Error("FIRECRAWL_API_KEY is not configured. Set the environment variable to enable brand extraction.");let Y=await u90($.domain,Q,$.domain);if(!Y)throw Error("Firecrawl did not return branding data for this URL");let G={name:Y.name,domain:Y.domain,overview:Y.overview,logo:Y.logo,favicon:Y.favicon,ogImage:Y.ogImage,fonts:Y.fonts,colors:Y.colors,images:Y.images,metadata:Y.metadata},J=$.brandId?await(async()=>{if(!await Z.storage.brandContext.get($.brandId,X))throw Error("Brand context not found");return Z.storage.brandContext.update($.brandId,X,G)})():await Z.storage.brandContext.create(X,G);return{id:J.id,name:J.name,domain:J.domain,overview:J.overview,logo:J.logo,favicon:J.favicon,ogImage:J.ogImage,fonts:J.fonts,colors:J.colors,success:!0}}})});function vs1($){let Z=$.metadata??{};return{id:$.id,name:$.name,domain:$.domain||void 0,colors:$.colors??void 0,fonts:$.fonts??void 0,assets:$.logo||$.favicon||$.ogImage?{logo:$.logo??void 0,favicon:$.favicon??void 0,ogImage:$.ogImage??void 0}:void 0,overview:$.overview||void 0,tagline:typeof Z.tagline==="string"?Z.tagline:void 0,tone:typeof Z.tone==="string"?Z.tone:void 0,metadata:(()=>{let X=Object.fromEntries(Object.entries(Z).filter(([Q])=>Q!=="tagline"&&Q!=="tone"));return Object.keys(X).length>0?X:void 0})()}}var ul0,cl0;var fs1=D(()=>{lc0();S0();ul0=c({name:"BRAND_GET",description:"Get a brand context by ID. Omit the ID to get the default brand for the organization.",annotations:{title:"Get Brand",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:E90,outputSchema:ci,handler:async($,Z)=>{r(Z),await Z.access.check();let X=Z.organization?.id;if(!X)throw Error("Organization ID required (no active organization in context)");let Q=$.id?await Z.storage.brandContext.get($.id,X):await Z.storage.brandContext.getDefault(X);if(!Q)throw Error($.id?"Brand not found":"No default brand configured");return vs1(Q)}}),cl0=c({name:"BRAND_LIST",description:"List all active brands for the current organization.",annotations:{title:"List Brands",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:j90,outputSchema:z90,handler:async($,Z)=>{r(Z),await Z.access.check();let X=Z.organization?.id;if(!X)throw Error("Organization ID required (no active organization in context)");return{items:(await Z.storage.brandContext.list(X)).map(vs1)}}})});import{resolveTxt as ls8}from"dns/promises";function ll0($){return`${ds8}.${$.toLowerCase()}`}function bs1(){return`deco-verify-${crypto.randomUUID().replace(/-/g,"")}`}async function xs1($,Z,X=ls8){if(!Z)return!1;try{return(await X(ll0($))).some((Y)=>Y.join("").trim()===Z)}catch{return!1}}var ds8="_deco-verify";var ys1=()=>{};import{z as M5}from"zod";function uO($){let Z=$.verificationStatus==="pending"&&Boolean($.verificationToken);return{id:$.id,domain:$.domain,joinMode:$.joinMode,verificationStatus:$.verificationStatus,verificationMethod:$.verificationMethod,verifiedAt:$.verifiedAt?new Date($.verifiedAt).toISOString():null,recordName:Z?ll0($.domain):null,recordValue:Z?$.verificationToken:null}}function is8($){let Z=$.toLowerCase().trim();if(!ms8.test(Z))throw Error(`Invalid domain format: "${Z}". Must be a valid domain like "acme.com"`);if(T3.has(Z))throw Error(`Cannot claim generic email domain "${Z}". Only corporate domains are allowed.`);return Z}var ms8,dl0,l90,ml0,il0,pl0,nl0,tl0;var gs1=D(()=>{gY();ys1();S0();ms8=/^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+$/,dl0=M5.enum(["off","auto","request"]),l90=M5.object({id:M5.string(),domain:M5.string(),joinMode:dl0,verificationStatus:M5.enum(["pending","verified"]),verificationMethod:M5.enum(["email","dns"]).nullable(),verifiedAt:M5.string().nullable(),recordName:M5.string().nullable(),recordValue:M5.string().nullable()});ml0=c({name:"ORGANIZATION_DOMAIN_LIST",description:"List the email domains claimed by an organization.",annotations:{title:"List Organization Domains",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:M5.object({}),outputSchema:M5.object({domains:M5.array(l90)}),handler:async($,Z)=>{r(Z),await Z.access.check();let X=t(Z);return{domains:(await Z.storage.organizationDomains.listByOrganizationId(X.id)).map(uO)}}}),il0=c({name:"ORGANIZATION_DOMAIN_ADD",description:"Claim an email domain for an organization. If the caller's verified email matches the domain it is trusted immediately; otherwise it requires DNS verification.",annotations:{title:"Add Organization Domain",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:M5.object({domain:M5.string().min(1).max(255).describe("Domain to claim, e.g. acme.com"),joinMode:dl0.optional().describe("Initial join mode (only applied when the domain is trusted immediately via email match).")}),outputSchema:l90,handler:async($,Z)=>{r(Z),await Z.access.check();let X=t(Z),Q=is8($.domain),G=Z.auth.user?.email?.split("@")[1]?.toLowerCase(),J=Boolean(Z.auth.user?.emailVerified)&&G===Q,W=await Z.storage.organizationDomains.getByOrgAndDomain(X.id,Q);if(W){if(W.verificationStatus!=="verified"&&J){let H=await Z.storage.organizationDomains.markVerified(W.id,"email");return uO(H)}return uO(W)}let K=J?await Z.storage.organizationDomains.add(X.id,Q,{joinMode:$.joinMode??"off",verificationStatus:"verified",verificationMethod:"email"}):await Z.storage.organizationDomains.add(X.id,Q,{joinMode:"off",verificationStatus:"pending",verificationToken:bs1()});return uO(K)}}),pl0=c({name:"ORGANIZATION_DOMAIN_UPDATE",description:"Set the join mode for a claimed domain. Discoverable modes (auto/request) require the domain to be verified.",annotations:{title:"Update Organization Domain",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:M5.object({id:M5.string(),joinMode:dl0}),outputSchema:l90,handler:async($,Z)=>{r(Z),await Z.access.check();let X=t(Z),Q=await Z.storage.organizationDomains.getById($.id);if(!Q||Q.organizationId!==X.id)throw Error("Domain not found");if($.joinMode!=="off"&&Q.verificationStatus!=="verified")throw Error("Verify the domain before enabling auto-join or requests.");let Y=await Z.storage.organizationDomains.updateJoinMode($.id,$.joinMode);return uO(Y)}}),nl0=c({name:"ORGANIZATION_DOMAIN_VERIFY",description:"Check the DNS TXT record for a pending domain and mark it verified if present.",annotations:{title:"Verify Organization Domain",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!0},inputSchema:M5.object({id:M5.string()}),outputSchema:M5.object({verified:M5.boolean(),domain:l90}),handler:async($,Z)=>{r(Z),await Z.access.check();let X=t(Z),Q=await Z.storage.organizationDomains.getById($.id);if(!Q||Q.organizationId!==X.id)throw Error("Domain not found");if(Q.verificationStatus==="verified")return{verified:!0,domain:uO(Q)};if(!Q.verificationToken)throw Error("Domain has no pending DNS verification.");if(!await xs1(Q.domain,Q.verificationToken))return{verified:!1,domain:uO(Q)};let G=await Z.storage.organizationDomains.markVerified($.id,"dns");return{verified:!0,domain:uO(G)}}}),tl0=c({name:"ORGANIZATION_DOMAIN_REMOVE",description:"Remove a claimed domain from an organization.",annotations:{title:"Remove Organization Domain",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:M5.object({id:M5.string()}),outputSchema:M5.object({success:M5.boolean()}),handler:async($,Z)=>{r(Z),await Z.access.check();let X=t(Z),Q=await Z.storage.organizationDomains.getById($.id);if(!Q||Q.organizationId!==X.id)throw Error("Domain not found");return await Z.storage.organizationDomains.removeById($.id),{success:!0}}})});function cO($){return($ instanceof Error?$.message.toLowerCase():"").includes("already a member")}import{z as z9}from"zod";var ps8,ol0,rl0,al0;var hs1=D(()=>{S0();C4();ps8=z9.object({id:z9.string(),userId:z9.string(),status:z9.enum(["pending","approved","denied"]),createdAt:z9.string(),user:z9.object({id:z9.string(),name:z9.string(),email:z9.string(),image:z9.string().nullable()}).nullable()}),ol0=c({name:"ORGANIZATION_JOIN_REQUEST_LIST",description:"List pending requests to join the organization.",annotations:{title:"List Join Requests",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:z9.object({}),outputSchema:z9.object({requests:z9.array(ps8)}),handler:async($,Z)=>{r(Z),await Z.access.check();let X=t(Z);return{requests:(await Z.storage.organizationJoinRequests.listPendingWithUser(X.id)).map((Y)=>({id:Y.id,userId:Y.userId,status:Y.status,createdAt:new Date(Y.createdAt).toISOString(),user:Y.user}))}}}),rl0=c({name:"ORGANIZATION_JOIN_REQUEST_APPROVE",description:"Approve a pending join request, adding the user as a member.",annotations:{title:"Approve Join Request",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:z9.object({requestId:z9.string()}),outputSchema:z9.object({success:z9.boolean()}),handler:async($,Z)=>{r(Z),await Z.access.check();let X=t(Z),Q=await Z.storage.organizationJoinRequests.getById($.requestId);if(!Q||Q.organizationId!==X.id)throw Error("Join request not found");if(Q.status!=="pending")throw Error("Join request has already been decided");let Y=Y1(Z);if(!await Z.storage.organizationJoinRequests.decide(Q.id,"approved",Y??Q.userId))return{success:!0};try{await Z.boundAuth.organization.addMember({organizationId:X.id,userId:Q.userId,role:["user"]})}catch(J){if(!cO(J))throw J}if(Y)y1.capture({distinctId:Y,event:"organization_join_request_approved",groups:{organization:X.id},properties:{organization_id:X.id,user_id:Q.userId}});return{success:!0}}}),al0=c({name:"ORGANIZATION_JOIN_REQUEST_DENY",description:"Deny a pending join request.",annotations:{title:"Deny Join Request",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:z9.object({requestId:z9.string()}),outputSchema:z9.object({success:z9.boolean()}),handler:async($,Z)=>{r(Z),await Z.access.check();let X=t(Z),Q=await Z.storage.organizationJoinRequests.getById($.requestId);if(!Q||Q.organizationId!==X.id)throw Error("Join request not found");if(Q.status!=="pending")throw Error("Join request has already been decided");let Y=Y1(Z);if(await Z.storage.organizationJoinRequests.decide(Q.id,"denied",Y??Q.userId)&&Y)y1.capture({distinctId:Y,event:"organization_join_request_denied",groups:{organization:X.id},properties:{organization_id:X.id,user_id:Q.userId}});return{success:!0}}})});import{z as _Q}from"zod";var sl0;var us1=D(()=>{C4();S0();MQ();sl0=c({name:"ORGANIZATION_MEMBER_ADD",description:"Invite a member to the organization by email with an assigned role.",annotations:{title:"Add Organization Member",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:_Q.object({organizationId:_Q.string().optional(),userId:_Q.string(),role:_Q.array(_Q.string())}),outputSchema:_Q.object({id:_Q.string(),organizationId:_Q.string(),userId:_Q.string(),role:_Q.union([_Q.string(),_Q.array(_Q.string())]),createdAt:_Q.string().datetime().describe("ISO 8601 timestamp")}),handler:async($,Z)=>{r(Z),await Z.access.check();let X=$.organizationId||Z.organization?.id;if(!X)throw Error("Organization ID required (no active organization in context)");if(X!==Z.organization?.id)throw Error("Organization ID does not match authenticated organization");let Q=await Z.db.selectFrom("member").select(["role"]).where("userId","=",Y1(Z)??"").where("organizationId","=",X).executeTakeFirst();if(!t60(Q?.role,$.role))throw Error(`Insufficient privileges to assign role "${$.role.join(",")}"`);let Y=await Z.boundAuth.organization.addMember({organizationId:X,userId:$.userId,role:$.role});if(!Y)throw Error("Failed to add member");let G=Y1(Z);if(G)y1.capture({distinctId:G,event:"organization_member_added",groups:{organization:X},properties:{organization_id:X,added_user_id:$.userId,role:$.role}});return{...Y,role:Y.role,createdAt:Y.createdAt instanceof Date?Y.createdAt.toISOString():Y.createdAt}}})});import{z as ux}from"zod";var el0;var cs1=D(()=>{C4();S0();el0=c({name:"ORGANIZATION_MEMBER_REMOVE",description:"Remove a member from the organization. Revokes all their access immediately.",annotations:{title:"Remove Organization Member",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:ux.object({organizationId:ux.string().optional(),memberIdOrEmail:ux.string()}),outputSchema:ux.object({success:ux.boolean(),memberIdOrEmail:ux.string()}),handler:async($,Z)=>{r(Z),await Z.access.check();let X=$.organizationId||Z.organization?.id;if(!X)throw Error("Organization ID required (no active organization in context)");if(X!==Z.organization?.id)throw Error("Organization ID does not match authenticated organization");let Q=await Z.boundAuth.organization.removeMember({organizationId:X,memberIdOrEmail:$.memberIdOrEmail});Z.invalidateMemberRole?.(Q.member.userId,X);let Y=Y1(Z);if(Y)y1.capture({distinctId:Y,event:"organization_member_removed",groups:{organization:X},properties:{organization_id:X,member_id_or_email:$.memberIdOrEmail}});return{success:!0,memberIdOrEmail:$.memberIdOrEmail}}})});import{z as r7}from"zod";var $d0;var ls1=D(()=>{S0();$d0=c({name:"ORGANIZATION_MEMBER_LIST",description:"List all members in the organization with their roles.",annotations:{title:"List Organization Members",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:r7.object({limit:r7.number().int().min(1).max(1000).optional(),offset:r7.number().int().min(0).optional()}),outputSchema:r7.object({members:r7.array(r7.object({id:r7.string(),organizationId:r7.string(),userId:r7.string(),role:r7.string(),createdAt:r7.string().datetime().describe("ISO 8601 timestamp"),user:r7.object({id:r7.string(),name:r7.string(),email:r7.string(),image:r7.string().optional()}).optional()}))}),handler:async($,Z)=>{r(Z),await Z.access.check();let X=Z.organization?.id;if(!X)throw Error("Organization ID required (no active organization in context)");return{members:((await Z.boundAuth.organization.listMembers({organizationId:X,limit:$.limit,offset:$.offset}))?.members??[]).map((G)=>({...G,createdAt:G.createdAt instanceof Date?G.createdAt.toISOString():G.createdAt}))}}})});import{z as fZ}from"zod";var Zd0;var ds1=D(()=>{C4();S0();MQ();Zd0=c({name:"ORGANIZATION_MEMBER_UPDATE_ROLE",description:"Change a member's role (e.g., admin, member) within the organization.",annotations:{title:"Update Member Role",readOnlyHint:!1,destructiveHint:!0,idempotentHint:!0,openWorldHint:!1},inputSchema:fZ.object({organizationId:fZ.string().optional(),memberId:fZ.string(),role:fZ.array(fZ.string())}),outputSchema:fZ.object({id:fZ.string(),organizationId:fZ.string(),userId:fZ.string(),role:fZ.union([fZ.string(),fZ.array(fZ.string())]),createdAt:fZ.string().datetime().describe("ISO 8601 timestamp"),user:fZ.object({email:fZ.string(),name:fZ.string(),image:fZ.string().optional()})}),handler:async($,Z)=>{r(Z),await Z.access.check();let X=$.organizationId||Z.organization?.id;if(!X)throw Error("Organization ID required (no active organization in context)");let Q=await Z.db.selectFrom("member").select(["role"]).where("userId","=",Y1(Z)??"").where("organizationId","=",X).executeTakeFirst();if(!t60(Q?.role,$.role))throw Error(`Insufficient privileges to assign role "${$.role.join(",")}"`);let Y=await Z.boundAuth.organization.updateMemberRole({organizationId:X,memberId:$.memberId,role:$.role});if(!Y)throw Error("Failed to update member role");Z.invalidateMemberRole?.(Y.userId,X);let G=Y1(Z);if(G)y1.capture({distinctId:G,event:"organization_member_role_updated",groups:{organization:X},properties:{organization_id:X,member_id:$.memberId,target_user_id:Y.userId,new_role:Array.isArray($.role)?$.role.join(","):$.role}});return{...Y,createdAt:Y.createdAt instanceof Date?Y.createdAt.toISOString():Y.createdAt}}})});async function ms1(){if(Zp&&Date.now()-Zp.fetchedAt<600000)return Zp.rate;try{let Z=await(await fetch("https://economia.awesomeapi.com.br/json/last/USD-BRL",{signal:AbortSignal.timeout(5000)})).json(),X=parseFloat(Z.USDBRL?.bid??"");if(Number.isNaN(X)||X<=0)throw Error("Invalid rate");return Zp={rate:X,fetchedAt:Date.now()},X}catch{return Zp?.rate??5.5}}function is1($,Z,X){if(Z==="brl")return Math.round($/X);return $}var Zp=null;function Xd0($,Z="",X=new URLSearchParams){for(let[Q,Y]of Object.entries($)){if(Y===void 0||Y===null)continue;let G=Z?`${Z}[${Q}]`:Q;if(Array.isArray(Y))Y.forEach((J,W)=>{if(typeof J==="object"&&J!==null)Xd0(J,`${G}[${W}]`,X);else X.append(`${G}[${W}]`,String(J))});else if(typeof Y==="object")Xd0(Y,G,X);else X.append(G,String(Y))}return X}async function Xp($,Z){let X=b0().stripeSecretKey;if(!X)throw new hY(503,"billing is not configured");let Q=Z?.params?Xd0(Z.params).toString():void 0,Y=await fetch(`${ns8}${$}`,{method:Z?.method??(Q?"POST":"GET"),headers:{Authorization:`Bearer ${X}`,...Q&&{"Content-Type":"application/x-www-form-urlencoded"}},body:Q,signal:AbortSignal.timeout(ts8)}),G=await Y.json().catch(()=>({}));if(!Y.ok){let J=G.error?.message??`HTTP ${Y.status}`;throw new hY(Y.status,J)}return G}function ps1($){return{billing_address_collection:"required",tax_id_collection:{enabled:!0},...$&&{customer_update:{address:"auto",name:"auto"}}}}async function ns1($){let Z=b0().stripeOrgPriceId;if(!Z)throw new hY(503,"billing is not configured");let X=await Xp("/checkout/sessions",{params:{mode:"subscription",...ps1(null),line_items:[{price:Z,quantity:1}],success_url:$.successUrl,cancel_url:$.cancelUrl,metadata:{orgId:$.organizationId},subscription_data:{metadata:{orgId:$.organizationId}}}});if(!X.url)throw new hY(500,"checkout session lacks url");return{url:X.url}}function os8($,Z){return Math.round($*(1+Z/100))}async function ts1($){let Z=os8($.amountCents,$.feePercent),X=is1($.amountCents,$.currency,await ms1()),Q=b0().stripeTopupProductId,Y={kind:"topup",orgId:$.organizationId,creditCents:X},G=$.currency==="brl"?`Studio AI credits (R$ ${($.amountCents/100).toFixed(2)})`:`Studio AI credits ($${($.amountCents/100).toFixed(2)})`,J=await Xp("/checkout/sessions",{params:{mode:"payment",...$.customerId&&{customer:$.customerId},...ps1($.customerId),line_items:[{quantity:1,price_data:{currency:$.currency,unit_amount:Z,...Q?{product:Q}:{product_data:{name:G}}}}],success_url:$.successUrl,cancel_url:$.cancelUrl,metadata:Y,payment_intent_data:{metadata:Y}}});if(!J.url)throw new hY(500,"checkout session lacks url");return{url:J.url}}async function d90($){let Z=await Xp("/billing_portal/sessions",{params:{customer:$.customerId,return_url:$.returnUrl}});if(!Z.url)throw new hY(500,"portal session lacks url");return{url:Z.url}}async function m90($){return Xp(`/subscriptions/${encodeURIComponent($)}`)}async function os1($){await Xp(`/subscriptions/${encodeURIComponent($)}`,{method:"DELETE"})}var ns8="https://api.stripe.com/v1",hY,ts8=15000;var sw=D(()=>{q$();hY=class hY extends Error{status;constructor($,Z){super(`Stripe API ${$}: ${Z}`);this.status=$;this.name="StripeApiError"}}});import{z as Qd0}from"zod";var Yd0;var rs1=D(()=>{sw();L9();S0();C4();Yd0=c({name:"ORGANIZATION_BILLING_CHECKOUT_START",description:"Start the organization's subscription: creates a Stripe Checkout session and returns its URL.",annotations:{title:"Start Billing Checkout",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!1,openWorldHint:!0},inputSchema:Qd0.object({}),outputSchema:Qd0.object({url:Qd0.string()}),handler:async($,Z)=>{r(Z),await Z.access.check();let X=Z.organization?.id,Q=Z.organization?.slug;if(!X||!Q)throw Error("Organization context required");let Y=await Z.storage.organizationBilling.getBilling(X);if(Y?.status==="active")throw Error("This organization already has an active subscription.");if(Y?.stripeSubscriptionId)throw Error("This organization still has a subscription on file \u2014 settle or cancel it before starting a new checkout.");let G=`${b9()}/${encodeURIComponent(Q)}/members`,{url:J}=await ns1({organizationId:X,successUrl:`${G}?checkout=success`,cancelUrl:`${G}?checkout=canceled`});return vY({event:"subscription_checkout_started",organizationId:X,...Z.auth?.user?.id?{userId:Z.auth.user.id}:{}}),{url:J}}})});import{z as Gd0}from"zod";var Jd0;var as1=D(()=>{sw();L9();S0();Jd0=c({name:"ORGANIZATION_BILLING_PORTAL",description:"Open the organization's Stripe billing portal (manage card, invoices, cancellation). Returns the portal URL.",annotations:{title:"Open Billing Portal",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!1,openWorldHint:!0},inputSchema:Gd0.object({}),outputSchema:Gd0.object({url:Gd0.string()}),handler:async($,Z)=>{r(Z),await Z.access.check();let X=t(Z);if(!X.slug)throw Error("Organization context required");let Q=await Z.storage.organizationBilling.getBilling(X.id);if(!Q?.stripeCustomerId)throw Error("This organization has no billing account yet \u2014 subscribe first.");try{return await d90({customerId:Q.stripeCustomerId,returnUrl:`${b9()}/${encodeURIComponent(X.slug)}/members`})}catch(Y){if(Y instanceof hY)throw Error(Y.message);throw Y}}})});function i90($){return Wd0[$%Wd0.length]??rs8}function vQ($){return $.createdBy==="system"}function PF($){return p90.filter((Z)=>Rx($,as8[Z]))}function lx($,Z){return $?.startsWith(`${cx[Z]}:`)??!1}function AF($){let Z=0;for(let X of $){if(X.action!=="status_changed")continue;if(X.data?.to!=="in_review")continue;Z=Math.max(Z,new Date(X.occurredAt).getTime())}return Z}function Kd0($,Z){let X=AF($),Q=new Map;for(let Y of $){if(Y.action!=="review_approved"&&Y.action!=="review_changes_requested")continue;if(new Date(Y.occurredAt).getTime()<X)continue;let G=Y.data??{};if(G.reviewer!=="qa"&&G.reviewer!=="code_review")continue;if(Y.action==="review_approved"){if(Z?.verifiedOnly&&G.verified!==!0)continue;Q.set(G.reviewer,"approved")}else Q.set(G.reviewer,"changes_requested")}return Q}function lO($,Z,X){if(Z.length===0)return!1;let Q=Kd0($,X);return Z.every((Y)=>Q.get(Y)==="approved")}function es1($,Z){return lO($,Z)&&!lO($,Z,{verifiedOnly:!0})}function $e1($){let Z=null;for(let X of $){if(X.action!=="review_approved"&&X.action!=="review_changes_requested")continue;let Q=new Date(X.occurredAt).getTime();if(Z&&Q<Z.at)continue;let Y=X.data?.notes;Z={at:Q,notes:X.action==="review_changes_requested"&&typeof Y==="string"?Y:null}}return Z?.notes??null}function ss8($){let Z=0;for(let X of $){if(X.action!=="assignee_changed")continue;if(X.data?.to!==T8)continue;Z=Math.max(Z,new Date(X.occurredAt).getTime())}return Z}function Ze1($,Z=Hd0){let X=ss8($),Q=new Set,Y=0;for(let G of[...$].sort((J,W)=>J.occurredAt.localeCompare(W.occurredAt))){let J=new Date(G.occurredAt).getTime();if(G.action==="status_changed"){if(G.data?.to==="in_review")Y=J;continue}if(G.action==="review_changes_requested"&&J>=X)Q.add(Y)}return Q.size+1>=Z}var T8="super-agent",Wd0,rs8,Qp='Your checkout is SHALLOW (`git clone --depth 1`), so it has no merge base and `git diff main...HEAD` (three dots) fails with "fatal: main...HEAD: no merge base". To see a branch diff, either use the two-dot form against the fetched remote ref (`git fetch origin <base> && git diff origin/<base> HEAD`), or deepen first with `git fetch --deepen=100`. Same for `git log main..HEAD` and anything else that needs shared history.',ss1,p90,cx,as8,Hd0=5,Xe1="task-board.item.updated",Qe1="task-board.item.deleted";var X9=D(()=>{n7();Wd0=["#9ca3af","#ef4444","#f97316","#f59e0b","#22c55e","#3b82f6","#a855f7","#ec4899"],rs8=Wd0[0];ss1="Read the diff with `gh pr diff <number>`. It comes from the API, so it needs no fetch, no merge base, and is unaffected by the shallow checkout. "+"Read it ONCE \u2014 `gh pr diff <number> --name-only` first if you need to size "+"it, then pull the hunks you need per FILE. Do NOT re-run the diff sliced by directory: each slice re-reads bytes you already have into every remaining turn's context, and it is the largest avoidable cost in a review.",p90=["qa","code_review"],cx={qa:"QA Agent",code_review:"Code Reviewer"},as8={qa:"qa_agent_enabled",code_review:"code_reviewer_enabled"}});function Fd0($){return $==="trial"?"trial":"subscription"}function Yp($,Z,X,Q={}){vY({event:Z,organizationId:X.organizationId,...$.auth?.user?.id?{userId:$.auth.user.id}:{},properties:{task_id:X.id,...Q}})}function Nd0($){return $?.status==="active"||$?.status==="past_due"}function n90($,Z){if(Nd0($))return{periodKey:$?.currentPeriodEnd?`sub:${$.currentPeriodEnd.toISOString()}`:"sub:pending",limit:$?.monthlyTaskExecutions??Z.monthlyTaskExecutions,exhaustedReason:"monthly_exhausted"};return{periodKey:"trial",limit:$?.freeTaskExecutions??Z.freeTaskExecutions,exhaustedReason:"trial_exhausted"}}function Gp(){let $=b0();return{enforced:$.taskQuotaEnforced,freeTaskExecutions:$.freeTaskExecutions,monthlyTaskExecutions:$.monthlyTaskExecutions,maxRunsPerTask:$.maxRunsPerTask}}function dO(){return{...Gp(),maxRunsPerTask:Number.POSITIVE_INFINITY}}async function dx($,Z,X=Gp()){if(!X.enforced||!vQ(Z))return;let Q=await $.storage.organizationBilling.taskClaim(Z.id);if(Q&&Q.runCount>=X.maxRunsPerTask)throw Yp($,"task_quota_blocked",Z,{phase:"precheck",reason:"runs_exhausted"}),new a7("runs_exhausted");if(Q&&Q.state!=="released")return;let Y=await $.storage.organizationBilling.getBilling(Z.organizationId),G=n90(Y,X);if(await $.storage.organizationBilling.countTaskClaims(Z.organizationId,G.periodKey)>=G.limit)throw Yp($,"task_quota_blocked",Z,{phase:"precheck",reason:G.exhaustedReason,billing_mode:Fd0(G.periodKey),limit:G.limit}),new a7(G.exhaustedReason)}async function Ye1($,Z,X=Gp()){if(!X.enforced||!vQ(Z))return"skipped";let Q=await $.storage.organizationBilling.getBilling(Z.organizationId),Y=n90(Q,X),G=await $.storage.organizationBilling.claimTaskUnderLimit(Z.organizationId,Z.id,Y.periodKey,Y.limit,X.maxRunsPerTask);if(G==="exhausted")throw Yp($,"task_quota_blocked",Z,{phase:"claim",reason:Y.exhaustedReason,billing_mode:Fd0(Y.periodKey),limit:Y.limit}),new a7(Y.exhaustedReason);if(G==="runs_exhausted")throw Yp($,"task_quota_blocked",Z,{phase:"claim",reason:"runs_exhausted"}),new a7("runs_exhausted");if(G==="claimed")Yp($,"task_quota_claimed",Z,{billing_mode:Fd0(Y.periodKey),period_key:Y.periodKey,limit:Y.limit});return G}async function Ge1($,Z,X,Q){if(Q==="skipped")return;await $.rollbackTaskClaim(Z,X,{releaseSlot:Q==="claimed"}).catch((Y)=>console.error("[task-quota] rollback failed (stays charged)",Y))}async function Je1($,Z){let X=await $.storage.organizationBilling.taskClaim(Z);return!!X&&X.state!=="released"}async function We1($,Z,X){if(await $.releaseTaskClaim(Z,X).catch((Y)=>{return console.error("[task-quota] refund failed (stays charged)",Y),!1}))vY({event:"task_quota_refunded",organizationId:Z,properties:{task_id:X}})}var es8="[SUBSCRIPTION_REQUIRED]",$e8,a7;var pG=D(()=>{X9();C4();q$();$e8={trial_exhausted:"this organization used its free task executions \u2014 subscribe to keep running tasks",monthly_exhausted:"this organization used its monthly task executions \u2014 more become available next billing cycle",runs_exhausted:"this task reached its execution limit \u2014 create a new task to keep going"};a7=class a7 extends Error{reason;constructor($){super(`${es8} ${$e8[$]}`);this.reason=$;this.name="TaskQuotaError"}}});import{z as TF}from"zod";var Ud0;var Ke1=D(()=>{S0();pG();Ud0=c({name:"ORGANIZATION_TASK_QUOTA_GET",description:"Get the organization's auto-task quota: how many runs are used in the current period, the limit, and the subscription's billing status.",annotations:{title:"Get Task Quota",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:TF.object({}),outputSchema:TF.object({enforced:TF.boolean(),billingStatus:TF.string(),subscribed:TF.boolean(),hasBillingAccount:TF.boolean(),used:TF.number(),limit:TF.number(),currentPeriodEnd:TF.string().datetime().nullable()}),handler:async($,Z)=>{r(Z),await Z.access.check();let X=t(Z),Q=Gp(),Y=await Z.storage.organizationBilling.getBilling(X.id),G=n90(Y,Q),J=await Z.storage.organizationBilling.countTaskClaims(X.id,G.periodKey);return{enforced:Q.enforced,billingStatus:Y?.status??"none",subscribed:Nd0(Y),hasBillingAccount:!!Y?.stripeCustomerId,used:J,limit:G.limit,currentPeriodEnd:Y?.currentPeriodEnd?.toISOString()??null}}})});var He1=D(()=>{Ps1();As1();Ts1();Rs1();Is1();qs1();Ms1();Vs1();Cs1();_s1();fs1();gs1();hs1();us1();cs1();ls1();ds1();rs1();as1();Ke1()});function NK($){if($==null)return"unknown error";if(typeof $==="string")return $;if($ instanceof Error)return $.message;return JSON.stringify($)}function t90($){if($===null||typeof $==="string"||typeof $==="number"||typeof $==="boolean")return!0;if(Array.isArray($))return $.every(t90);if(typeof $==="object")return Object.entries($).every(([Z,X])=>typeof Z==="string"&&(X===void 0||t90(X)));return!1}function Od0($){return Array.isArray($)&&$.every(t90)}function Jp($){return $!=null&&typeof $==="object"&&Object.entries($).every(([Z,X])=>typeof Z==="string"&&(X===void 0||t90(X)))}var ge1="vercel.ai.error",Xe8,Fe1,Ne1,J1,he1="AI_APICallError",ue1,Qe8,Ue1,Oe1,Q4,ce1="AI_EmptyResponseBodyError",le1,Ye8,Be1,De1,o90,de1="AI_InvalidArgumentError",me1,Ge8,Le1,we1,mO,ie1="AI_InvalidPromptError",pe1,Je8,Ee1,je1,nG,ne1="AI_InvalidResponseDataError",te1,We8,ze1,Pe1,mx,oe1="AI_JSONParseError",re1,Ke8,Ae1,Te1,RF,ae1="AI_LoadAPIKeyError",se1,He8,Re1,Ie1,ew,ee1="AI_LoadSettingError",$0$,Fe8,qe1,Me1,Z0$,X0$="AI_NoContentGeneratedError",Q0$,Ne8,ke1,Ve1,Y0$,G0$="AI_NoSuchModelError",J0$,Ue8,Se1,Ce1,u5,W0$="AI_TooManyEmbeddingValuesForCallError",K0$,Oe8,_e1,ve1,ix,H0$="AI_TypeValidationError",F0$,Be8,fe1,be1,O5,N0$="AI_UnsupportedFunctionalityError",U0$,De8,xe1,ye1,v4;var a1=D(()=>{Xe8=Symbol.for(ge1),J1=class $ extends(Ne1=Error,Fe1=Xe8,Ne1){constructor({name:Z,message:X,cause:Q}){super(X);this[Fe1]=!0,this.name=Z,this.cause=Q}static isInstance(Z){return $.hasMarker(Z,ge1)}static hasMarker(Z,X){let Q=Symbol.for(X);return Z!=null&&typeof Z==="object"&&Q in Z&&typeof Z[Q]==="boolean"&&Z[Q]===!0}},ue1=`vercel.ai.error.${he1}`,Qe8=Symbol.for(ue1),Q4=class extends(Oe1=J1,Ue1=Qe8,Oe1){constructor({message:$,url:Z,requestBodyValues:X,statusCode:Q,responseHeaders:Y,responseBody:G,cause:J,isRetryable:W=Q!=null&&(Q===408||Q===409||Q===429||Q>=500),data:K}){super({name:he1,message:$,cause:J});this[Ue1]=!0,this.url=Z,this.requestBodyValues=X,this.statusCode=Q,this.responseHeaders=Y,this.responseBody=G,this.isRetryable=W,this.data=K}static isInstance($){return J1.hasMarker($,ue1)}},le1=`vercel.ai.error.${ce1}`,Ye8=Symbol.for(le1),o90=class extends(De1=J1,Be1=Ye8,De1){constructor({message:$="Empty response body"}={}){super({name:ce1,message:$});this[Be1]=!0}static isInstance($){return J1.hasMarker($,le1)}};me1=`vercel.ai.error.${de1}`,Ge8=Symbol.for(me1),mO=class extends(we1=J1,Le1=Ge8,we1){constructor({message:$,cause:Z,argument:X}){super({name:de1,message:$,cause:Z});this[Le1]=!0,this.argument=X}static isInstance($){return J1.hasMarker($,me1)}},pe1=`vercel.ai.error.${ie1}`,Je8=Symbol.for(pe1),nG=class extends(je1=J1,Ee1=Je8,je1){constructor({prompt:$,message:Z,cause:X}){super({name:ie1,message:`Invalid prompt: ${Z}`,cause:X});this[Ee1]=!0,this.prompt=$}static isInstance($){return J1.hasMarker($,pe1)}},te1=`vercel.ai.error.${ne1}`,We8=Symbol.for(te1),mx=class extends(Pe1=J1,ze1=We8,Pe1){constructor({data:$,message:Z=`Invalid response data: ${JSON.stringify($)}.`}){super({name:ne1,message:Z});this[ze1]=!0,this.data=$}static isInstance($){return J1.hasMarker($,te1)}},re1=`vercel.ai.error.${oe1}`,Ke8=Symbol.for(re1),RF=class extends(Te1=J1,Ae1=Ke8,Te1){constructor({text:$,cause:Z}){super({name:oe1,message:`JSON parsing failed: Text: ${$}.
 Error message: ${NK(Z)}`,cause:Z});this[Ae1]=!0,this.text=$}static isInstance($){return J1.hasMarker($,re1)}},se1=`vercel.ai.error.${ae1}`,He8=Symbol.for(se1),ew=class extends(Ie1=J1,Re1=He8,Ie1){constructor({message:$}){super({name:ae1,message:$});this[Re1]=!0}static isInstance($){return J1.hasMarker($,se1)}},$0$=`vercel.ai.error.${ee1}`,Fe8=Symbol.for($0$),Z0$=class extends(Me1=J1,qe1=Fe8,Me1){constructor({message:$}){super({name:ee1,message:$});this[qe1]=!0}static isInstance($){return J1.hasMarker($,$0$)}},Q0$=`vercel.ai.error.${X0$}`,Ne8=Symbol.for(Q0$),Y0$=class extends(Ve1=J1,ke1=Ne8,Ve1){constructor({message:$="No content generated."}={}){super({name:X0$,message:$});this[ke1]=!0}static isInstance($){return J1.hasMarker($,Q0$)}},J0$=`vercel.ai.error.${G0$}`,Ue8=Symbol.for(J0$),u5=class extends(Ce1=J1,Se1=Ue8,Ce1){constructor({errorName:$=G0$,modelId:Z,modelType:X,message:Q=`No such ${X}: ${Z}`}){super({name:$,message:Q});this[Se1]=!0,this.modelId=Z,this.modelType=X}static isInstance($){return J1.hasMarker($,J0$)}},K0$=`vercel.ai.error.${W0$}`,Oe8=Symbol.for(K0$),ix=class extends(ve1=J1,_e1=Oe8,ve1){constructor($){super({name:W0$,message:`Too many values for a single embedding call. The ${$.provider} model "${$.modelId}" can only embed up to ${$.maxEmbeddingsPerCall} values per call, but ${$.values.length} values were provided.`});this[_e1]=!0,this.provider=$.provider,this.modelId=$.modelId,this.maxEmbeddingsPerCall=$.maxEmbeddingsPerCall,this.values=$.values}static isInstance($){return J1.hasMarker($,K0$)}},F0$=`vercel.ai.error.${H0$}`,Be8=Symbol.for(F0$),O5=class $ extends(be1=J1,fe1=Be8,be1){constructor({value:Z,cause:X,context:Q}){let Y="Type validation failed";if(Q==null?void 0:Q.field)Y+=` for ${Q.field}`;if((Q==null?void 0:Q.entityName)||(Q==null?void 0:Q.entityId)){Y+=" (";let G=[];if(Q.entityName)G.push(Q.entityName);if(Q.entityId)G.push(`id: "${Q.entityId}"`);Y+=G.join(", "),Y+=")"}super({name:H0$,message:`${Y}: Value: ${JSON.stringify(Z)}.
 Error message: ${NK(X)}`,cause:X});this[fe1]=!0,this.value=Z,this.context=Q}static isInstance(Z){return J1.hasMarker(Z,F0$)}static wrap({value:Z,cause:X,context:Q}){var Y,G,J;if($.isInstance(X)&&X.value===Z&&((Y=X.context)==null?void 0:Y.field)===(Q==null?void 0:Q.field)&&((G=X.context)==null?void 0:G.entityName)===(Q==null?void 0:Q.entityName)&&((J=X.context)==null?void 0:J.entityId)===(Q==null?void 0:Q.entityId))return X;return new $({value:Z,cause:X,context:Q})}},U0$=`vercel.ai.error.${N0$}`,De8=Symbol.for(U0$),v4=class extends(ye1=J1,xe1=De8,ye1){constructor({functionality:$,message:Z=`'${$}' functionality not supported.`}){super({name:N0$,message:Z});this[xe1]=!0,this.functionality=$}static isInstance($){return J1.hasMarker($,U0$)}}});import*as e90 from"zod/v4";import{ZodFirstPartyTypeKind as O4}from"zod/v3";import{ZodFirstPartyTypeKind as ve8}from"zod/v3";import{ZodFirstPartyTypeKind as r90}from"zod/v3";function o$(...$){return $.reduce((Z,X)=>({...Z,...X!=null?X:{}}),{})}function a90({tools:$=[],providerToolNames:Z,resolveProviderToolName:X}){var Q;let Y={},G={};for(let J of $)if(J.type==="provider"){let W=(Q=X==null?void 0:X(J))!=null?Q:(J.id in Z)?Z[J.id]:void 0;if(W==null)continue;Y[J.name]=W,G[W]=J.name}return{toProviderToolName:(J)=>{var W;return(W=Y[J])!=null?W:J},toCustomToolName:(J)=>{var W;return(W=G[J])!=null?W:J}}}async function bQ($,Z){if($==null)return Promise.resolve();let X=Z==null?void 0:Z.abortSignal;return new Promise((Q,Y)=>{if(X==null?void 0:X.aborted){Y(O0$());return}let G=setTimeout(()=>{J(),Q()},$),J=()=>{clearTimeout(G),X==null||X.removeEventListener("abort",W)},W=()=>{J(),Y(O0$())};X==null||X.addEventListener("abort",W)})}function O0$(){return new DOMException("Delay was aborted","AbortError")}function px($){return Object.fromEntries([...$.headers])}function P9($){let Z=$.replace(/-/g,"+").replace(/_/g,"/"),X=we8(Z);return Uint8Array.from(X,(Q)=>Q.codePointAt(0))}function yQ($){let Z="";for(let X=0;X<$.length;X++)Z+=String.fromCodePoint($[X]);return Le8(Z)}function KZ($){return $ instanceof Uint8Array?yQ($):$}function j0$($,Z={}){let{useArrayBrackets:X=!0}=Z,Q=new FormData;for(let[Y,G]of Object.entries($)){if(G==null)continue;if(Array.isArray(G)){if(G.length===1){Q.append(Y,G[0]);continue}let J=X?`${Y}[]`:Y;for(let W of G)Q.append(J,W);continue}Q.append(Y,G)}return Q}async function Wp($){var Z;try{await((Z=$.body)==null?void 0:Z.cancel())}catch(X){}}function je8($=globalThis){return $.window!=null}function ze8($){let Z;try{Z=new URL($)}catch(Q){throw new WZ({url:$,message:`Invalid URL: ${$}`})}if(Z.protocol==="data:")return;if(Z.protocol!=="http:"&&Z.protocol!=="https:")throw new WZ({url:$,message:`URL scheme must be http, https, or data, got ${Z.protocol}`});let X=Z.hostname.toLowerCase().replace(/\.+$/,"");if(!X)throw new WZ({url:$,message:"URL must have a hostname"});if(X==="localhost"||X.endsWith(".local")||X.endsWith(".localhost"))throw new WZ({url:$,message:`URL with hostname ${X} is not allowed`});if(X.startsWith("[")&&X.endsWith("]")){let Q=X.slice(1,-1);if(Ae8(Q))throw new WZ({url:$,message:`URL with IPv6 address ${X} is not allowed`});return}if(A0$(X)){if(T0$(X))throw new WZ({url:$,message:`URL with IP address ${X} is not allowed`});return}}function A0$($){let Z=$.split(".");if(Z.length!==4)return!1;return Z.every((X)=>{let Q=Number(X);return Number.isInteger(Q)&&Q>=0&&Q<=255&&String(Q)===X})}function T0$($){let Z=$.split(".").map(Number),[X,Q,Y]=Z;if(X===0)return!0;if(X===10)return!0;if(X===100&&Q>=64&&Q<=127)return!0;if(X===127)return!0;if(X===169&&Q===254)return!0;if(X===172&&Q>=16&&Q<=31)return!0;if(X===192&&Q===0&&Y===0)return!0;if(X===192&&Q===168)return!0;if(X===198&&(Q===18||Q===19))return!0;if(X>=240)return!0;return!1}function Pe8($){let Z=$.toLowerCase(),X=Z.indexOf("%");if(X!==-1)Z=Z.slice(0,X);let Q=Z.split("::");if(Q.length>2)return null;let Y=(J)=>{if(J==="")return[];let W=[],K=J.split(":");for(let H=0;H<K.length;H++){let F=K[H];if(F.includes(".")){if(H!==K.length-1||!A0$(F))return null;let[N,U,O,B]=F.split(".").map(Number);W.push(N<<8|U,O<<8|B);continue}if(!/^[0-9a-f]{1,4}$/.test(F))return null;W.push(parseInt(F,16))}return W},G=Y(Q[0]);if(G===null)return null;if(Q.length===2){let J=Y(Q[1]);if(J===null)return null;let W=8-G.length-J.length;if(W<0)return null;return[...G,...Array(W).fill(0),...J]}return G.length===8?G:null}function Ae8($){let Z=Pe8($);if(Z===null)return!0;let X=(Y)=>Z.slice(0,Y).every((G)=>G===0);if(X(7)&&(Z[7]===0||Z[7]===1))return!0;if((Z[0]&65024)===64512)return!0;if((Z[0]&65472)===65152)return!0;if((Z[0]&65472)===65216)return!0;if((Z[0]&65280)===65280)return!0;if(X(6)||X(5)&&Z[5]===65535||X(4)&&Z[4]===65535&&Z[5]===0||Z[0]===100&&Z[1]===65435&&Z[2]===0&&Z[3]===0&&Z[4]===0&&Z[5]===0||Z[0]===100&&Z[1]===65435&&Z[2]===1){let Y=Z[6]>>8&255,G=Z[6]&255,J=Z[7]>>8&255,W=Z[7]&255;return T0$(`${Y}.${G}.${J}.${W}`)}return!1}async function Ed0({url:$,headers:Z,abortSignal:X,maxRedirects:Q=Te8}){let Y={signal:X};if(Z!==void 0)Y.headers=Z;let G=$;for(let J=0;J<=Q;J++){ze8(G);let W=await fetch(G,{...Y,redirect:"manual"});if(W.type==="opaqueredirect"){if(!je8())throw new WZ({url:$,message:`Redirect from ${G} could not be validated and was blocked`});return await fetch(G,{...Y,redirect:"follow"})}let K=W.headers.get("location");if(W.status>=300&&W.status<400&&K){await Wp(W),G=new URL(K,G).toString();continue}return W}throw new WZ({url:$,message:`Too many redirects (max ${Q})`})}async function jd0({response:$,url:Z,maxBytes:X=s90}){let Q=$.headers.get("content-length");if(Q!=null){let F=parseInt(Q,10);if(!isNaN(F)&&F>X)throw await Wp($),new WZ({url:Z,message:`Download of ${Z} exceeded maximum size of ${X} bytes (Content-Length: ${F}).`})}let Y=$.body;if(Y==null)return new Uint8Array(0);let G=Y.getReader(),J=[],W=0;try{while(!0){let{done:F,value:N}=await G.read();if(F)break;if(W+=N.length,W>X)throw new WZ({url:Z,message:`Download of ${Z} exceeded maximum size of ${X} bytes.`});J.push(N)}}finally{try{await G.cancel()}finally{G.releaseLock()}}let K=new Uint8Array(W),H=0;for(let F of J)K.set(F,H),H+=F.length;return K}async function zd0($,Z){var X,Q;try{let Y=await Ed0({url:$,abortSignal:Z==null?void 0:Z.abortSignal});if(!Y.ok)throw await Wp(Y),new WZ({url:$,statusCode:Y.status,statusText:Y.statusText});let G=await jd0({response:Y,url:$,maxBytes:(X=Z==null?void 0:Z.maxBytes)!=null?X:s90}),J=(Q=Y.headers.get("content-type"))!=null?Q:void 0;return new Blob([G],J?{type:J}:void 0)}catch(Y){if(WZ.isInstance(Y))throw Y;throw new WZ({url:$,cause:Y})}}function nx($){if($==null)return"unknown error";if(typeof $==="string")return $;if($ instanceof Error)return $.message;return JSON.stringify($)}function fQ($){return($ instanceof Error||$ instanceof DOMException)&&($.name==="AbortError"||$.name==="ResponseAborted"||$.name==="TimeoutError")}function qe8($){if(!($ instanceof Error))return!1;let Z=$.code;if(typeof Z==="string"&&Ie8.includes(Z))return!0;return!1}function R0$({error:$,url:Z,requestBodyValues:X}){if(fQ($))return $;if($ instanceof TypeError&&Re8.includes($.message.toLowerCase())){let Q=$.cause;if(Q!=null)return new Q4({message:`Cannot connect to API: ${Q.message}`,cause:Q,url:Z,requestBodyValues:X,isRetryable:!0})}if(qe8($))return new Q4({message:`Cannot connect to API: ${$.message}`,cause:$,url:Z,requestBodyValues:X,isRetryable:!0});return $}function iO($=globalThis){var Z,X,Q;if($.window)return"runtime/browser";if((Z=$.navigator)==null?void 0:Z.userAgent)return`runtime/${$.navigator.userAgent.toLowerCase()}`;if((Q=(X=$.process)==null?void 0:X.versions)==null?void 0:Q.node)return`runtime/node.js/${$.process.version.substring(0)}`;if($.EdgeRuntime)return"runtime/vercel-edge";return"runtime/unknown"}function pO($){if($==null)return{};let Z={};if($ instanceof Headers)$.forEach((X,Q)=>{Z[Q.toLowerCase()]=X});else{if(!Array.isArray($))$=Object.entries($);for(let[X,Q]of $)if(Q!=null)Z[X.toLowerCase()]=Q}return Z}function t4($,...Z){let X=new Headers(pO($)),Q=X.get("user-agent")||"";return X.set("user-agent",[Q,...Z].filter(Boolean).join(" ")),Object.fromEntries(X.entries())}function ZE($){return $!=null}function q0$($,Z){try{return new URL($).origin===new URL(Z).origin}catch(X){return!1}}function M0$({mediaType:$,url:Z,supportedUrls:X}){return Z=Z.toLowerCase(),$=$.toLowerCase(),Object.entries(X).map(([Q,Y])=>{let G=Q.toLowerCase();return G==="*"||G==="*/*"?{mediaTypePrefix:"",regexes:Y}:{mediaTypePrefix:G.replace(/\*/,""),regexes:Y}}).filter(({mediaTypePrefix:Q})=>$.startsWith(Q)).flatMap(({regexes:Q})=>Q).some((Q)=>Q.test(Z))}function tx({apiKey:$,environmentVariableName:Z,apiKeyParameterName:X="apiKey",description:Q}){if(typeof $==="string")return $;if($!=null)throw new ew({message:`${Q} API key must be a string.`});if(typeof process>"u")throw new ew({message:`${Q} API key is missing. Pass it using the '${X}' parameter. Environment variables are not supported in this environment.`});if($=process.env[Z],$==null)throw new ew({message:`${Q} API key is missing. Pass it using the '${X}' parameter or the ${Z} environment variable.`});if(typeof $!=="string")throw new ew({message:`${Q} API key must be a string. The value of the ${Z} environment variable is not a string.`});return $}function UK({settingValue:$,environmentVariableName:Z}){if(typeof $==="string")return $;if($!=null||typeof process>"u")return;if($=process.env[Z],$==null||typeof $!=="string")return;return $}function k0$($){var Z;let[X,Q=""]=$.toLowerCase().split("/");return(Z={mpeg:"mp3","x-wav":"wav",opus:"ogg",mp4:"m4a","x-m4a":"m4a"}[Q])!=null?Z:Q}function L0$($){let Z=JSON.parse($);if(Z===null||typeof Z!=="object")return Z;if(ke8.test($)===!1&&Ve8.test($)===!1)return Z;return Se8(Z)}function Se8($){let Z=[$];while(Z.length){let X=Z;Z=[];for(let Q of X){if(Object.prototype.hasOwnProperty.call(Q,"__proto__"))throw SyntaxError("Object contains forbidden prototype property");if(Object.prototype.hasOwnProperty.call(Q,"constructor")&&Q.constructor!==null&&typeof Q.constructor==="object"&&Object.prototype.hasOwnProperty.call(Q.constructor,"prototype"))throw SyntaxError("Object contains forbidden prototype property");for(let Y in Q){let G=Q[Y];if(G&&typeof G==="object")Z.push(G)}}}return $}function Pd0($){let{stackTraceLimit:Z}=Error;try{Error.stackTraceLimit=0}catch(X){return L0$($)}try{return L0$($)}finally{Error.stackTraceLimit=Z}}function Ad0($){if($.type==="object"||Array.isArray($.type)&&$.type.includes("object")){$.additionalProperties=!1;let{properties:X}=$;if(X!=null)for(let Q of Object.keys(X))X[Q]=$E(X[Q])}if($.items!=null)$.items=Array.isArray($.items)?$.items.map($E):$E($.items);if($.anyOf!=null)$.anyOf=$.anyOf.map($E);if($.allOf!=null)$.allOf=$.allOf.map($E);if($.oneOf!=null)$.oneOf=$.oneOf.map($E);let{definitions:Z}=$;if(Z!=null)for(let X of Object.keys(Z))Z[X]=$E(Z[X]);return $}function $E($){if(typeof $==="boolean")return $;return Ad0($)}function uY(){return{}}function fe8($,Z){var X,Q,Y;let G={type:"array"};if(((X=$.type)==null?void 0:X._def)&&((Y=(Q=$.type)==null?void 0:Q._def)==null?void 0:Y.typeName)!==ve8.ZodAny)G.items=j6($.type._def,{...Z,currentPath:[...Z.currentPath,"items"]});if($.minLength)G.minItems=$.minLength.value;if($.maxLength)G.maxItems=$.maxLength.value;if($.exactLength)G.minItems=$.exactLength.value,G.maxItems=$.exactLength.value;return G}function be8($){let Z={type:"integer",format:"int64"};if(!$.checks)return Z;for(let X of $.checks)switch(X.kind){case"min":if(X.inclusive)Z.minimum=X.value;else Z.exclusiveMinimum=X.value;break;case"max":if(X.inclusive)Z.maximum=X.value;else Z.exclusiveMaximum=X.value;break;case"multipleOf":Z.multipleOf=X.value;break}return Z}function xe8(){return{type:"boolean"}}function V0$($,Z){return j6($.type._def,Z)}function S0$($,Z,X){let Q=X!=null?X:Z.dateStrategy;if(Array.isArray(Q))return{anyOf:Q.map((Y,G)=>S0$($,Z,Y))};switch(Q){case"string":case"format:date-time":return{type:"string",format:"date-time"};case"format:date":return{type:"string",format:"date"};case"integer":return ge8($)}}function he8($,Z){return{...j6($.innerType._def,Z),default:$.defaultValue()}}function ue8($,Z){return Z.effectStrategy==="input"?j6($.schema._def,Z):uY()}function ce8($){return{type:"string",enum:Array.from($.values)}}function de8($,Z){let X=[j6($.left._def,{...Z,currentPath:[...Z.currentPath,"allOf","0"]}),j6($.right._def,{...Z,currentPath:[...Z.currentPath,"allOf","1"]})].filter((Y)=>!!Y),Q=[];return X.forEach((Y)=>{if(le8(Y))Q.push(...Y.allOf);else{let G=Y;if("additionalProperties"in Y&&Y.additionalProperties===!1){let{additionalProperties:J,...W}=Y;G=W}Q.push(G)}}),Q.length?{allOf:Q}:void 0}function me8($){let Z=typeof $.value;if(Z!=="bigint"&&Z!=="number"&&Z!=="boolean"&&Z!=="string")return{type:Array.isArray($.value)?"array":"object"};return{type:Z==="bigint"?"integer":Z,const:$.value}}function C0$($,Z){let X={type:"string"};if($.checks)for(let Q of $.checks)switch(Q.kind){case"min":X.minLength=typeof X.minLength==="number"?Math.max(X.minLength,Q.value):Q.value;break;case"max":X.maxLength=typeof X.maxLength==="number"?Math.min(X.maxLength,Q.value):Q.value;break;case"email":switch(Z.emailStrategy){case"format:email":I3(X,"email",Q.message,Z);break;case"format:idn-email":I3(X,"idn-email",Q.message,Z);break;case"pattern:zod":nX(X,R3.email,Q.message,Z);break}break;case"url":I3(X,"uri",Q.message,Z);break;case"uuid":I3(X,"uuid",Q.message,Z);break;case"regex":nX(X,Q.regex,Q.message,Z);break;case"cuid":nX(X,R3.cuid,Q.message,Z);break;case"cuid2":nX(X,R3.cuid2,Q.message,Z);break;case"startsWith":nX(X,RegExp(`^${Dd0(Q.value,Z)}`),Q.message,Z);break;case"endsWith":nX(X,RegExp(`${Dd0(Q.value,Z)}$`),Q.message,Z);break;case"datetime":I3(X,"date-time",Q.message,Z);break;case"date":I3(X,"date",Q.message,Z);break;case"time":I3(X,"time",Q.message,Z);break;case"duration":I3(X,"duration",Q.message,Z);break;case"length":X.minLength=typeof X.minLength==="number"?Math.max(X.minLength,Q.value):Q.value,X.maxLength=typeof X.maxLength==="number"?Math.min(X.maxLength,Q.value):Q.value;break;case"includes":{nX(X,RegExp(Dd0(Q.value,Z)),Q.message,Z);break}case"ip":{if(Q.version!=="v6")I3(X,"ipv4",Q.message,Z);if(Q.version!=="v4")I3(X,"ipv6",Q.message,Z);break}case"base64url":nX(X,R3.base64url,Q.message,Z);break;case"jwt":nX(X,R3.jwt,Q.message,Z);break;case"cidr":{if(Q.version!=="v6")nX(X,R3.ipv4Cidr,Q.message,Z);if(Q.version!=="v4")nX(X,R3.ipv6Cidr,Q.message,Z);break}case"emoji":nX(X,R3.emoji(),Q.message,Z);break;case"ulid":{nX(X,R3.ulid,Q.message,Z);break}case"base64":{switch(Z.base64Strategy){case"format:binary":{I3(X,"binary",Q.message,Z);break}case"contentEncoding:base64":{X.contentEncoding="base64";break}case"pattern:zod":{nX(X,R3.base64,Q.message,Z);break}}break}case"nanoid":nX(X,R3.nanoid,Q.message,Z);case"toLowerCase":case"toUpperCase":case"trim":break;default:}return X}function Dd0($,Z){return Z.patternStrategy==="escape"?pe8($):$}function pe8($){let Z="";for(let X=0;X<$.length;X++){if(!ie8.has($[X]))Z+="\\";Z+=$[X]}return Z}function I3($,Z,X,Q){var Y;if($.format||((Y=$.anyOf)==null?void 0:Y.some((G)=>G.format))){if(!$.anyOf)$.anyOf=[];if($.format)$.anyOf.push({format:$.format}),delete $.format;$.anyOf.push({format:Z,...X&&Q.errorMessages&&{errorMessage:{format:X}}})}else $.format=Z}function nX($,Z,X,Q){var Y;if($.pattern||((Y=$.allOf)==null?void 0:Y.some((G)=>G.pattern))){if(!$.allOf)$.allOf=[];if($.pattern)$.allOf.push({pattern:$.pattern}),delete $.pattern;$.allOf.push({pattern:E0$(Z,Q),...X&&Q.errorMessages&&{errorMessage:{pattern:X}}})}else $.pattern=E0$(Z,Q)}function E0$($,Z){var X;if(!Z.applyRegexFlags||!$.flags)return $.source;let Q={i:$.flags.includes("i"),m:$.flags.includes("m"),s:$.flags.includes("s")},Y=Q.i?$.source.toLowerCase():$.source,G="",J=!1,W=!1,K=!1;for(let H=0;H<Y.length;H++){if(J){G+=Y[H],J=!1;continue}if(Q.i){if(W){if(Y[H].match(/[a-z]/)){if(K)G+=Y[H],G+=`${Y[H-2]}-${Y[H]}`.toUpperCase(),K=!1;else if(Y[H+1]==="-"&&((X=Y[H+2])==null?void 0:X.match(/[a-z]/)))G+=Y[H],K=!0;else G+=`${Y[H]}${Y[H].toUpperCase()}`;continue}}else if(Y[H].match(/[a-z]/)){G+=`[${Y[H]}${Y[H].toUpperCase()}]`;continue}}if(Q.m){if(Y[H]==="^"){G+=`(^|(?<=[\r
 ]))`;continue}else if(Y[H]==="$"){G+=`($|(?=[\r
@@ -977,7 +977,7 @@ ${Y}`:Y}var a4$,s64;var Rm0=D(()=>{a4$=/[\r\n<>]/,s64=/^[^\s@<>]+@[^\s@<>]+\.[^\
 `);let Q=Z.pax;if(Q)for(let Y in Q)X+=jp0(" "+Y+"="+Q[Y]+`
 `);return y4.from(X)};IJ4.decodePax=function(Z){let X={};while(Z.length){let Q=0;while(Q<Z.length&&Z[Q]!==32)Q++;let Y=parseInt(y4.toString(Z.subarray(0,Q)),10);if(!Y)return X;let G=y4.toString(Z.subarray(Q+1,Y-1)),J=G.indexOf("=");if(J===-1)return X;X[G.slice(0,J)]=G.slice(J+1),Z=Z.subarray(Y)}return X};IJ4.encode=function(Z){let X=y4.alloc(512),Q=Z.name,Y="";if(Z.typeflag===5&&Q[Q.length-1]!=="/")Q+="/";if(y4.byteLength(Q)!==Q.length)return null;while(y4.byteLength(Q)>100){let G=Q.indexOf("/");if(G===-1)return null;Y+=Y?"/"+Q.slice(0,G):Q.slice(0,G),Q=Q.slice(G+1)}if(y4.byteLength(Q)>100||y4.byteLength(Y)>155)return null;if(Z.linkname&&y4.byteLength(Z.linkname)>100)return null;if(y4.write(X,Q),y4.write(X,BB(Z.mode&4095,6),100),y4.write(X,BB(Z.uid,6),108),y4.write(X,BB(Z.gid,6),116),TJ4(Z.size,X,124),y4.write(X,BB(Z.mtime.getTime()/1000|0,11),136),X[156]=48+PJ4(Z.type),Z.linkname)y4.write(X,Z.linkname,157);if(y4.copy(tX$,X,257),y4.copy(BJ4,X,263),Z.uname)y4.write(X,Z.uname,265);if(Z.gname)y4.write(X,Z.gname,297);if(y4.write(X,BB(Z.devmajor||0,6),329),y4.write(X,BB(Z.devminor||0,6),337),Y)y4.write(X,Y,345);return y4.write(X,BB(rX$(X),6),148),X};IJ4.decode=function(Z,X,Q){let Y=Z[156]===0?0:Z[156]-48,G=Ey(Z,0,100,X),J=OB(Z,100,8),W=OB(Z,108,8),K=OB(Z,116,8),H=OB(Z,124,12),F=OB(Z,136,12),N=zJ4(Y),U=Z[157]===0?null:Ey(Z,157,100,X),O=Ey(Z,265,32),B=Ey(Z,297,32),L=OB(Z,329,8),w=OB(Z,337,8),E=rX$(Z);if(E===256)return null;if(E!==OB(Z,148,8))throw Error("Invalid tar header. Maybe the tar is corrupted or it needs to be gunzipped?");if(wJ4(Z)){if(Z[345])G=Ey(Z,345,155,X)+"/"+G}else if(EJ4(Z));else if(!Q)throw Error("Invalid tar header: unknown format.");if(Y===0&&G&&G[G.length-1]==="/")Y=5;return{name:G,mode:J,uid:W,gid:K,size:H,mtime:new Date(1000*F),type:N,linkname:U,uname:O,gname:B,devmajor:L,devminor:w,pax:null}};function wJ4($){return y4.equals(tX$,$.subarray(257,263))}function EJ4($){return y4.equals(DJ4,$.subarray(257,263))&&y4.equals(LJ4,$.subarray(263,265))}function jJ4($,Z,X){if(typeof $!=="number")return X;if($=~~$,$>=Z)return Z;if($>=0)return $;if($+=Z,$>=0)return $;return 0}function zJ4($){switch($){case 0:return"file";case 1:return"link";case 2:return"symlink";case 3:return"character-device";case 4:return"block-device";case 5:return"directory";case 6:return"fifo";case 7:return"contiguous-file";case 72:return"pax-header";case 55:return"pax-global-header";case 27:return"gnu-long-link-path";case 28:case 30:return"gnu-long-path"}return null}function PJ4($){switch($){case"file":return 0;case"link":return 1;case"symlink":return 2;case"character-device":return 3;case"block-device":return 4;case"directory":return 5;case"fifo":return 6;case"contiguous-file":return 7;case"pax-header":return 72}return 0}function oX$($,Z,X,Q){for(;X<Q;X++)if($[X]===Z)return X;return Q}function rX$($){let Z=256;for(let X=0;X<148;X++)Z+=$[X];for(let X=156;X<512;X++)Z+=$[X];return Z}function BB($,Z){if($=$.toString(8),$.length>Z)return"7777777777777777777".slice(0,Z)+" ";return"0000000000000000000".slice(0,Z-$.length)+$+" "}function AJ4($,Z,X){Z[X]=128;for(let Q=11;Q>0;Q--)Z[X+Q]=$&255,$=Math.floor($/256)}function TJ4($,Z,X){if($.toString(8).length>11)AJ4($,Z,X);else y4.write(Z,BB($,11),X)}function RJ4($){let Z;if($[0]===128)Z=!0;else if($[0]===255)Z=!1;else return null;let X=[],Q;for(Q=$.length-1;Q>0;Q--){let J=$[Q];if(Z)X.push(J);else X.push(255-J)}let Y=0,G=X.length;for(Q=0;Q<G;Q++)Y+=X[Q]*Math.pow(256,Q);return Z?Y:-1*Y}function OB($,Z,X){if($=$.subarray(Z,Z+X),Z=0,$[Z]&128)return RJ4($);else{while(Z<$.length&&$[Z]===32)Z++;let Q=jJ4(oX$($,32,Z,$.length),$.length,$.length);while(Z<Q&&$[Z]===0)Z++;if(Q===Z)return 0;return parseInt(y4.toString($.subarray(Z,Q)),8)}}function Ey($,Z,X,Q){return y4.toString($.subarray(Z,oX$($,0,Z,Z+X)),Q)}function jp0($){let Z=y4.byteLength($),X=Math.floor(Math.log(Z)/Math.log(10))+1;if(Z+X>=Math.pow(10,X))X++;return Z+X+$}});var YQ$=_((FE9,QQ$)=>{var{Writable:CJ4,Readable:_J4,getStreamError:aX$}=Ep0(),vJ4=Up0(),sX$=wy(),jy=zp0(),fJ4=sX$.alloc(0);class eX${constructor(){this.buffered=0,this.shifted=0,this.queue=new vJ4,this._offset=0}push($){this.buffered+=$.byteLength,this.queue.push($)}shiftFirst($){return this._buffered===0?null:this._next($)}shift($){if($>this.buffered)return null;if($===0)return fJ4;let Z=this._next($);if($===Z.byteLength)return Z;let X=[Z];while(($-=Z.byteLength)>0)Z=this._next($),X.push(Z);return sX$.concat(X)}_next($){let Z=this.queue.peek(),X=Z.byteLength-this._offset;if($>=X){let Q=this._offset?Z.subarray(this._offset,Z.byteLength):Z;return this.queue.shift(),this._offset=0,this.buffered-=X,this.shifted+=X,Q}return this.buffered-=$,this.shifted+=$,Z.subarray(this._offset,this._offset+=$)}}class $Q$ extends _J4{constructor($,Z,X){super();this.header=Z,this.offset=X,this._parent=$}_read($){if(this.header.size===0)this.push(null);if(this._parent._stream===this)this._parent._update();$(null)}_predestroy(){this._parent.destroy(aX$(this))}_detach(){if(this._parent._stream===this)this._parent._stream=null,this._parent._missing=XQ$(this.header.size),this._parent._update()}_destroy($){this._detach(),$(null)}}class ZQ$ extends CJ4{constructor($){super($);if(!$)$={};this._buffer=new eX$,this._offset=0,this._header=null,this._stream=null,this._missing=0,this._longHeader=!1,this._callback=Pp0,this._locked=!1,this._finished=!1,this._pax=null,this._paxGlobal=null,this._gnuLongPath=null,this._gnuLongLinkPath=null,this._filenameEncoding=$.filenameEncoding||"utf-8",this._allowUnknownFormat=!!$.allowUnknownFormat,this._unlockBound=this._unlock.bind(this)}_unlock($){if(this._locked=!1,$){this.destroy($),this._continueWrite($);return}this._update()}_consumeHeader(){if(this._locked)return!1;this._offset=this._buffer.shifted;try{this._header=jy.decode(this._buffer.shift(512),this._filenameEncoding,this._allowUnknownFormat)}catch($){return this._continueWrite($),!1}if(!this._header)return!0;switch(this._header.type){case"gnu-long-path":case"gnu-long-link-path":case"pax-global-header":case"pax-header":return this._longHeader=!0,this._missing=this._header.size,!0}if(this._locked=!0,this._applyLongHeaders(),this._header.size===0||this._header.type==="directory")return this.emit("entry",this._header,this._createStream(),this._unlockBound),!0;return this._stream=this._createStream(),this._missing=this._header.size,this.emit("entry",this._header,this._stream,this._unlockBound),!0}_applyLongHeaders(){if(this._gnuLongPath)this._header.name=this._gnuLongPath,this._gnuLongPath=null;if(this._gnuLongLinkPath)this._header.linkname=this._gnuLongLinkPath,this._gnuLongLinkPath=null;if(this._pax){if(this._pax.path)this._header.name=this._pax.path;if(this._pax.linkpath)this._header.linkname=this._pax.linkpath;if(this._pax.size)this._header.size=parseInt(this._pax.size,10);this._header.pax=this._pax,this._pax=null}}_decodeLongHeader($){switch(this._header.type){case"gnu-long-path":this._gnuLongPath=jy.decodeLongPath($,this._filenameEncoding);break;case"gnu-long-link-path":this._gnuLongLinkPath=jy.decodeLongPath($,this._filenameEncoding);break;case"pax-global-header":this._paxGlobal=jy.decodePax($);break;case"pax-header":this._pax=this._paxGlobal===null?jy.decodePax($):Object.assign({},this._paxGlobal,jy.decodePax($));break}}_consumeLongHeader(){this._longHeader=!1,this._missing=XQ$(this._header.size);let $=this._buffer.shift(this._header.size);try{this._decodeLongHeader($)}catch(Z){return this._continueWrite(Z),!1}return!0}_consumeStream(){let $=this._buffer.shiftFirst(this._missing);if($===null)return!1;this._missing-=$.byteLength;let Z=this._stream.push($);if(this._missing===0){if(this._stream.push(null),Z)this._stream._detach();return Z&&this._locked===!1}return Z}_createStream(){return new $Q$(this,this._header,this._offset)}_update(){while(this._buffer.buffered>0&&!this.destroying){if(this._missing>0){if(this._stream!==null){if(this._consumeStream()===!1)return;continue}if(this._longHeader===!0){if(this._missing>this._buffer.buffered)break;if(this._consumeLongHeader()===!1)return!1;continue}let $=this._buffer.shiftFirst(this._missing);if($!==null)this._missing-=$.byteLength;continue}if(this._buffer.buffered<512)break;if(this._stream!==null||this._consumeHeader()===!1)return}this._continueWrite(null)}_continueWrite($){let Z=this._callback;this._callback=Pp0,Z($)}_write($,Z){this._callback=Z,this._buffer.push($),this._update()}_final($){this._finished=this._missing===0&&this._buffer.buffered===0,$(this._finished?null:Error("Unexpected end of data"))}_predestroy(){this._continueWrite(null)}_destroy($){if(this._stream)this._stream.destroy(aX$(this));$(null)}[Symbol.asyncIterator](){let $=null,Z=null,X=null,Q=null,Y=null,G=this;return this.on("entry",K),this.on("error",(N)=>{$=N}),this.on("close",H),{[Symbol.asyncIterator](){return this},next(){return new Promise(W)},return(){return F(null)},throw(N){return F(N)}};function J(N){if(!Y)return;let U=Y;Y=null,U(N)}function W(N,U){if($)return U($);if(Q){N({value:Q,done:!1}),Q=null;return}if(Z=N,X=U,J(null),G._finished&&Z)Z({value:void 0,done:!0}),Z=X=null}function K(N,U,O){if(Y=O,U.on("error",Pp0),Z)Z({value:U,done:!1}),Z=X=null;else Q=U}function H(){if(J($),!Z)return;if($)X($);else Z({value:void 0,done:!0});Z=X=null}function F(N){return G.destroy(N),J(N),new Promise((U,O)=>{if(G.destroyed)return U({value:void 0,done:!0});G.once("close",function(){if(N)O(N);else U({value:void 0,done:!0})})})}}}QQ$.exports=function(Z){return new ZQ$(Z)};function Pp0(){}function XQ$($){return $&=511,$&&512-$}});var JQ$=_((NE9,Ap0)=>{var GQ$={S_IFMT:61440,S_IFDIR:16384,S_IFCHR:8192,S_IFBLK:24576,S_IFIFO:4096,S_IFLNK:40960};try{Ap0.exports=z0("fs").constants||GQ$}catch{Ap0.exports=GQ$}});var OQ$=_((UE9,UQ$)=>{var{Readable:bJ4,Writable:xJ4,getStreamError:WQ$}=Ep0(),dS=wy(),zy=JQ$(),tO0=zp0(),KQ$=dS.alloc(1024);class HQ$ extends xJ4{constructor($,Z,X){super({mapWritable:gJ4,eagerOpen:!0});if(this.written=0,this.header=Z,this._callback=X,this._linkname=null,this._isLinkname=Z.type==="symlink"&&!Z.linkname,this._isVoid=Z.type!=="file"&&Z.type!=="contiguous-file",this._finished=!1,this._pack=$,this._openCallback=null,this._pack._stream===null)this._pack._stream=this;else this._pack._pending.push(this)}_open($){if(this._openCallback=$,this._pack._stream===this)this._continueOpen()}_continuePack($){if(this._callback===null)return;let Z=this._callback;this._callback=null,Z($)}_continueOpen(){if(this._pack._stream===null)this._pack._stream=this;let $=this._openCallback;if(this._openCallback=null,$===null)return;if(this._pack.destroying)return $(Error("pack stream destroyed"));if(this._pack._finalized)return $(Error("pack stream is already finalized"));if(this._pack._stream=this,!this._isLinkname)this._pack._encode(this.header);if(this._isVoid)this._finish(),this._continuePack(null);$(null)}_write($,Z){if(this._isLinkname)return this._linkname=this._linkname?dS.concat([this._linkname,$]):$,Z(null);if(this._isVoid){if($.byteLength>0)return Z(Error("No body allowed for this entry"));return Z()}if(this.written+=$.byteLength,this._pack.push($))return Z();this._pack._drain=Z}_finish(){if(this._finished)return;if(this._finished=!0,this._isLinkname)this.header.linkname=this._linkname?dS.toString(this._linkname,"utf-8"):"",this._pack._encode(this.header);NQ$(this._pack,this.header.size),this._pack._done(this)}_final($){if(this.written!==this.header.size)return $(Error("Size mismatch"));this._finish(),$(null)}_getError(){return WQ$(this)||Error("tar entry destroyed")}_predestroy(){this._pack.destroy(this._getError())}_destroy($){this._pack._done(this),this._continuePack(this._finished?null:this._getError()),$()}}class FQ$ extends bJ4{constructor($){super($);this._drain=Tp0,this._finalized=!1,this._finalizing=!1,this._pending=[],this._stream=null}entry($,Z,X){if(this._finalized||this.destroying)throw Error("already finalized or destroyed");if(typeof Z==="function")X=Z,Z=null;if(!X)X=Tp0;if(!$.size||$.type==="symlink")$.size=0;if(!$.type)$.type=yJ4($.mode);if(!$.mode)$.mode=$.type==="directory"?493:420;if(!$.uid)$.uid=0;if(!$.gid)$.gid=0;if(!$.mtime)$.mtime=new Date;if(typeof Z==="string")Z=dS.from(Z);let Q=new HQ$(this,$,X);if(dS.isBuffer(Z))return $.size=Z.byteLength,Q.write(Z),Q.end(),Q;if(Q._isVoid)return Q;return Q}finalize(){if(this._stream||this._pending.length>0){this._finalizing=!0;return}if(this._finalized)return;this._finalized=!0,this.push(KQ$),this.push(null)}_done($){if($!==this._stream)return;if(this._stream=null,this._finalizing)this.finalize();if(this._pending.length)this._pending.shift()._continueOpen()}_encode($){if(!$.pax){let Z=tO0.encode($);if(Z){this.push(Z);return}}this._encodePax($)}_encodePax($){let Z=tO0.encodePax({name:$.name,linkname:$.linkname,pax:$.pax}),X={name:"PaxHeader",mode:$.mode,uid:$.uid,gid:$.gid,size:Z.byteLength,mtime:$.mtime,type:"pax-header",linkname:$.linkname&&"PaxHeader",uname:$.uname,gname:$.gname,devmajor:$.devmajor,devminor:$.devminor};this.push(tO0.encode(X)),this.push(Z),NQ$(this,Z.byteLength),X.size=$.size,X.type=$.type,this.push(tO0.encode(X))}_doDrain(){let $=this._drain;this._drain=Tp0,$()}_predestroy(){let $=WQ$(this);if(this._stream)this._stream.destroy($);while(this._pending.length){let Z=this._pending.shift();Z.destroy($),Z._continueOpen()}this._doDrain()}_read($){this._doDrain(),$()}}UQ$.exports=function(Z){return new FQ$(Z)};function yJ4($){switch($&zy.S_IFMT){case zy.S_IFBLK:return"block-device";case zy.S_IFCHR:return"character-device";case zy.S_IFDIR:return"directory";case zy.S_IFIFO:return"fifo";case zy.S_IFLNK:return"symlink"}return"file"}function Tp0(){}function NQ$($,Z){if(Z&=511,Z)$.push(KQ$.subarray(0,512-Z))}function gJ4($){return dS.isBuffer($)?$:dS.from($)}});var BQ$=_((hJ4)=>{hJ4.extract=YQ$();hJ4.pack=OQ$()});var wQ$=_((BE9,LQ$)=>{LQ$.exports=DQ$;function DQ$($,Z){if($&&Z)return DQ$($)(Z);if(typeof $!=="function")throw TypeError("need wrapper function");return Object.keys($).forEach(function(Q){X[Q]=$[Q]}),X;function X(){var Q=Array(arguments.length);for(var Y=0;Y<Q.length;Y++)Q[Y]=arguments[Y];var G=$.apply(this,Q),J=Q[Q.length-1];if(typeof G==="function"&&G!==J)Object.keys(J).forEach(function(W){G[W]=J[W]});return G}}});var Ip0=_((DE9,Rp0)=>{var EQ$=wQ$();Rp0.exports=EQ$(oO0);Rp0.exports.strict=EQ$(jQ$);oO0.proto=oO0(function(){Object.defineProperty(Function.prototype,"once",{value:function(){return oO0(this)},configurable:!0}),Object.defineProperty(Function.prototype,"onceStrict",{value:function(){return jQ$(this)},configurable:!0})});function oO0($){var Z=function(){if(Z.called)return Z.value;return Z.called=!0,Z.value=$.apply(this,arguments)};return Z.called=!1,Z}function jQ$($){var Z=function(){if(Z.called)throw Error(Z.onceError);return Z.called=!0,Z.value=$.apply(this,arguments)},X=$.name||"Function wrapped with `once`";return Z.onceError=X+" shouldn't be called more than once",Z.called=!1,Z}});var AQ$=_((LE9,PQ$)=>{var lJ4=Ip0(),dJ4=function(){},mJ4=global.Bare?queueMicrotask:process.nextTick.bind(process),iJ4=function($){return $.setHeader&&typeof $.abort==="function"},pJ4=function($){return $.stdio&&Array.isArray($.stdio)&&$.stdio.length===3},zQ$=function($,Z,X){if(typeof Z==="function")return zQ$($,null,Z);if(!Z)Z={};X=lJ4(X||dJ4);var{_writableState:Q,_readableState:Y}=$,G=Z.readable||Z.readable!==!1&&$.readable,J=Z.writable||Z.writable!==!1&&$.writable,W=!1,K=function(){if(!$.writable)H()},H=function(){if(J=!1,!G)X.call($)},F=function(){if(G=!1,!J)X.call($)},N=function(w){X.call($,w?Error("exited with error code: "+w):null)},U=function(w){X.call($,w)},O=function(){mJ4(B)},B=function(){if(W)return;if(G&&!(Y&&(Y.ended&&!Y.destroyed)))return X.call($,Error("premature close"));if(J&&!(Q&&(Q.ended&&!Q.destroyed)))return X.call($,Error("premature close"))},L=function(){$.req.on("finish",H)};if(iJ4($))if($.on("complete",H),$.on("abort",O),$.req)L();else $.on("request",L);else if(J&&!Q)$.on("end",K),$.on("close",K);if(pJ4($))$.on("exit",N);if($.on("end",F),$.on("finish",H),Z.error!==!1)$.on("error",U);return $.on("close",O),function(){if(W=!0,$.removeListener("complete",H),$.removeListener("abort",O),$.removeListener("request",L),$.req)$.req.removeListener("finish",H);$.removeListener("end",K),$.removeListener("close",K),$.removeListener("finish",H),$.removeListener("exit",N),$.removeListener("end",F),$.removeListener("error",U),$.removeListener("close",O)}};PQ$.exports=zQ$});var IQ$=_((wE9,RQ$)=>{var nJ4=Ip0(),tJ4=AQ$(),rO0;try{rO0=z0("fs")}catch($){}var op=function(){},oJ4=typeof process>"u"?!1:/^v?\.0/.test(process.version),aO0=function($){return typeof $==="function"},rJ4=function($){if(!oJ4)return!1;if(!rO0)return!1;return($ instanceof(rO0.ReadStream||op)||$ instanceof(rO0.WriteStream||op))&&aO0($.close)},aJ4=function($){return $.setHeader&&aO0($.abort)},sJ4=function($,Z,X,Q){Q=nJ4(Q);var Y=!1;$.on("close",function(){Y=!0}),tJ4($,{readable:Z,writable:X},function(J){if(J)return Q(J);Y=!0,Q()});var G=!1;return function(J){if(Y)return;if(G)return;if(G=!0,rJ4($))return $.close(op);if(aJ4($))return $.abort();if(aO0($.destroy))return $.destroy();Q(J||Error("stream was destroyed"))}},TQ$=function($){$()},eJ4=function($,Z){return $.pipe(Z)},$34=function(){var $=Array.prototype.slice.call(arguments),Z=aO0($[$.length-1]||op)&&$.pop()||op;if(Array.isArray($[0]))$=$[0];if($.length<2)throw Error("pump requires two streams per minimum");var X,Q=$.map(function(Y,G){var J=G<$.length-1,W=G>0;return sJ4(Y,J,W,function(K){if(!X)X=K;if(K)Q.forEach(TQ$);if(J)return;Q.forEach(TQ$),Z(X)})});return $.reduce(eJ4)};RQ$.exports=$34});var fQ$=_((Y34)=>{var qQ$=BQ$(),MQ$=IQ$(),kQ$=z0("fs"),G9=z0("path"),rp=(global.Bare?global.Bare.platform:process.platform)==="win32";Y34.pack=function(Z,X){if(!Z)Z=".";if(!X)X={};let Q=X.fs||kQ$,Y=X.ignore||X.filter||ap,G=X.mapStream||_Q$,J=Q34(Q,X.dereference?Q.stat:Q.lstat,Z,Y,X.entries,X.sort),W=X.strict!==!1,K=typeof X.umask==="number"?~X.umask:~VQ$(),H=X.pack||qQ$.pack(),F=X.finish||ap,N=X.map||ap,U=typeof X.dmode==="number"?X.dmode:0,O=typeof X.fmode==="number"?X.fmode:0;if(X.strip)N=vQ$(N,X.strip);if(X.readable)U|=parseInt(555,8),O|=parseInt(444,8);if(X.writable)U|=parseInt(333,8),O|=parseInt(222,8);w();function B(E,j){Q.readlink(G9.join(Z,E),function(z,A){if(z)return H.destroy(z);j.linkname=qp0(A),H.entry(j,w)})}function L(E,j,z){if(H.destroyed)return;if(E)return H.destroy(E);if(!j){if(X.finalize!==!1)H.finalize();return F(H)}if(z.isSocket())return w();let A={name:qp0(j),mode:(z.mode|(z.isDirectory()?U:O))&K,mtime:z.mtime,size:z.size,type:"file",uid:z.uid,gid:z.gid};if(z.isDirectory())return A.size=0,A.type="directory",A=N(A)||A,H.entry(A,w);if(z.isSymbolicLink())return A.size=0,A.type="symlink",A=N(A)||A,B(j,A);if(A=N(A)||A,!z.isFile()){if(W)return H.destroy(Error("unsupported type for "+j));return w()}let P=H.entry(A,w),I=G(Q.createReadStream(G9.join(Z,j),{start:0,end:A.size>0?A.size-1:A.size}),A);I.on("error",function(q){P.destroy(q)}),MQ$(I,P)}function w(E){if(E)return H.destroy(E);J(L)}return H};function Z34($){return $.length?$[$.length-1]:null}function X34(){return!global.Bare&&process.getuid?process.getuid():-1}function VQ$(){return!global.Bare&&process.umask?process.umask():0}Y34.extract=function(Z,X){if(!Z)Z=".";if(!X)X={};Z=G9.resolve(Z);let Q=X.fs||kQ$,Y=X.ignore||X.filter||ap,G=X.mapStream||_Q$,J=X.chown!==!1&&!rp&&X34()===0,W=X.extract||qQ$.extract(),K=[],H=new Date,F=typeof X.umask==="number"?~X.umask:~VQ$(),N=X.strict!==!1,U=X.validateSymlinks!==!1,O=X.map||ap,B=typeof X.dmode==="number"?X.dmode:0,L=typeof X.fmode==="number"?X.fmode:0;if(X.strip)O=vQ$(O,X.strip);if(X.readable)B|=parseInt(555,8),L|=parseInt(444,8);if(X.writable)B|=parseInt(333,8),L|=parseInt(222,8);if(W.on("entry",w),X.finish)W.on("finish",X.finish);return W;function w(P,I,q){P=O(P)||P,P.name=qp0(P.name);let M=G9.join(Z,G9.join("/",P.name));if(Y(M,P))return I.resume(),q();let C=G9.join(M,".")===G9.join(Z,".")?Z:G9.dirname(M);CQ$(Q,C,G9.join(Z,"."),function(a,O0){if(a)return q(a);if(!O0)return q(Error(C+" is not a valid path"));if(P.type==="directory")return K.push([M,P.mtime]),A(M,{fs:Q,own:J,uid:P.uid,gid:P.gid,mode:P.mode},l);A(C,{fs:Q,own:J,uid:P.uid,gid:P.gid,mode:493},function(L0){if(L0)return q(L0);switch(P.type){case"file":return u();case"link":return x();case"symlink":return f()}if(N)return q(Error("unsupported type for "+M+" ("+P.type+")"));I.resume(),q()})});function l(a){if(a)return q(a);j(M,P,function(O0){if(O0)return q(O0);if(rp)return q();z(M,P,q)})}function f(){if(rp)return q();Q.unlink(M,function(){let a=G9.resolve(G9.dirname(M),P.linkname);if(!n(a)&&U)return q(Error(M+" is not a valid symlink"));SQ$(Q,a,G9.join(Z,"."),function(O0,L0){if(O0)return q(O0);if(!L0&&U)return q(Error(M+" is not a valid symlink"));Q.symlink(P.linkname,M,l)})})}function x(){if(rp)return q();Q.unlink(M,function(){let a=G9.join(Z,G9.join("/",P.linkname));Q.realpath(a,function(O0,L0){if(O0||!n(L0))return q(Error(M+" is not a valid hardlink"));Q.link(L0,M,function(e){if(e&&e.code==="EPERM"&&X.hardlinkAsFilesFallback)return I=Q.createReadStream(L0),u();l(e)})})})}function n(a){return a===Z||a.startsWith(Z+G9.sep)}function u(){let a=Q.createWriteStream(M),O0=G(I,P);a.on("error",function(L0){O0.destroy(L0)}),MQ$(O0,a,function(L0){if(L0)return q(L0);a.on("close",l)})}}function E(P,I){let q;while((q=Z34(K))&&P.slice(0,q[0].length)!==q[0])K.pop();if(!q)return I();Q.utimes(q[0],H,q[1],I)}function j(P,I,q){if(X.utimes===!1)return q();if(I.type==="directory")return Q.utimes(P,H,I.mtime,q);if(I.type==="symlink")return E(P,q);Q.utimes(P,H,I.mtime,function(M){if(M)return q(M);E(P,q)})}function z(P,I,q){let M=I.type==="symlink",C=M?Q.lchmod:Q.chmod,l=M?Q.lchown:Q.chown;if(!C)return q();let f=(I.mode|(I.type==="directory"?B:L))&F;if(l&&J)l.call(Q,P,I.uid,I.gid,x);else x(null);function x(n){if(n)return q(n);if(!C)return q();C.call(Q,P,f,q)}}function A(P,I,q){Q.stat(P,function(M){if(!M)return q(null);if(M.code!=="ENOENT")return q(M);Q.mkdir(P,{mode:I.mode,recursive:!0},function(C,l){if(C)return q(C);z(P,I,q)})})}};function SQ$($,Z,X,Q){if(Z===X)return Q(null,!0);if(!Z.startsWith(X+G9.sep))return Q(null,!1);$.lstat(Z,function(Y,G){if(Y&&Y.code!=="ENOENT"&&Y.code!=="EPERM")return Q(Y);if(Y||!G.isSymbolicLink())return SQ$($,G9.join(Z,".."),X,Q);Q(null,!1)})}function CQ$($,Z,X,Q){if(Z===X)return Q(null,!0);$.lstat(Z,function(Y,G){if(Y&&Y.code!=="ENOENT"&&Y.code!=="EPERM")return Q(Y);if(Y||G.isDirectory())return CQ$($,G9.join(Z,".."),X,Q);Q(null,!1)})}function ap(){}function _Q$($){return $}function qp0($){return rp?$.replace(/\\/g,"/").replace(/[:?<>|]/g,"_"):$}function Q34($,Z,X,Q,Y,G){if(!Y)Y=["."];let J=Y.slice(0);return function(K){if(!J.length)return K(null);let H=J.shift(),F=G9.join(X,H);Z.call($,F,function(N,U){if(N)return K(Y.indexOf(H)===-1&&N.code==="ENOENT"?null:N);if(!U.isDirectory())return K(null,H,U);$.readdir(F,function(O,B){if(O)return K(O);if(G)B.sort();for(let L=0;L<B.length;L++)if(!Q(G9.join(X,H,B[L])))J.push(G9.join(H,B[L]));K(null,H,U)})})}}function vQ$($,Z){return function(X){X.name=X.name.split("/").slice(Z).join("/");let Q=X.linkname;if(Q&&(X.type==="link"||G9.isAbsolute(Q)))X.linkname=Q.split("/").slice(Z).join("/");return $(X)}}});var W34,K34;var bQ$=D(()=>{Fp0();W34=V(AX$(),1),K34=V(fQ$(),1)});var sO0=()=>{};var xQ$=D(()=>{UO0()});var yQ$=D(()=>{hO0();gO0();sO0()});var gQ$=()=>{};var hQ$=()=>{};var Mp0=D(()=>{QX$();Kp0();hO0();KX$();Jp0();Fp0();HX$();FX$();NX$();UX$();Wp0();OX$();bQ$();sO0();xQ$();yQ$();gQ$();hQ$();sO0()});var S5,I9,mS,sp;var ep=D(()=>{S5={CLAIM_API_GROUP:"extensions.agents.x-k8s.io",CLAIM_API_VERSION:"v1alpha1",CLAIM_PLURAL:"sandboxclaims",TEMPLATE_PLURAL:"sandboxtemplates",SANDBOX_API_GROUP:"agents.x-k8s.io",SANDBOX_API_VERSION:"v1alpha1",SANDBOX_PLURAL:"sandboxes",POD_NAME_ANNOTATION:"agents.x-k8s.io/pod-name",MAIN_CONTAINER_NAME:"sandbox"};I9=class I9 extends Error{cause;constructor($,Z){super($);if(this.name="SandboxError",this.cause=Z,Z instanceof Error&&Z.stack)this.stack=`${this.stack}
 Caused by: ${Z.stack}`}};mS=class mS extends I9{constructor($,Z){super($,Z);this.name="SandboxTimeoutError"}};sp=class sp extends I9{constructor($,Z){super($,Z);this.name="SandboxAlreadyExistsError"}}});async function H34($){let Z=$.getCurrentCluster();if(!Z)throw new I9("No active cluster in kubeconfig");let X={};await $.applyToHTTPSOptions(X);let Q={},Y=X.headers??{};for(let[G,J]of Object.entries(Y))if(Array.isArray(J))Q[G]=J.join(", ");else if(J!==void 0)Q[G]=String(J);if(typeof X.auth==="string"&&!Q.Authorization)Q.Authorization=`Basic ${Buffer.from(X.auth).toString("base64")}`;return{server:Z.server.replace(/\/+$/,""),headers:Q,tls:{cert:kp0(X.cert),key:kp0(X.key),ca:kp0(X.ca),rejectUnauthorized:Z.skipTLSVerify?!1:void 0}}}function kp0($){if($==null)return;if(typeof $==="string")return $;if(Buffer.isBuffer($))return $.toString("utf8");return String($)}async function tY($,Z){let X=await H34($),Q={...X.headers,...Z.headers};if(Z.method==="PATCH")Q["content-type"]=Z.patchType==="apply"?"application/apply-patch+yaml":Z.patchType==="strategic-merge"?"application/strategic-merge-patch+json":"application/merge-patch+json";else if(Z.body!==void 0&&!("content-type"in Q))Q["content-type"]="application/json";let Y={method:Z.method,headers:Q,body:Z.body===void 0?void 0:JSON.stringify(Z.body),signal:Z.signal,tls:X.tls,...Z.stream?{timeout:!1}:{}};return fetch(`${X.server}${Z.path}`,Y)}async function Vp0($){try{return await $.json()}catch{return null}}async function $n($,Z){if($.ok)return;let X=await Vp0($),Q=X?.message??`${Z} failed: ${$.status} ${$.statusText}`;throw new uQ$($.status,X,Q)}async function Py($,Z,X,Q,Y="none"){try{let G=await tY($,Z);if(G.status===404)return null;if(await $n(G,X),Y==="json")return await G.json();return null}catch(G){throw new I9(Q,G)}}async function cQ$($,Z,X){let Q=`${eO0}/${encodeURIComponent(Z)}/${S5.TEMPLATE_PLURAL}/${encodeURIComponent(X)}`;try{let Y=await tY($,{method:"GET",path:Q});if(Y.status===404||Y.status===403)return!1;return await $n(Y,"sandboxTemplateExists"),!0}catch(Y){throw new I9(`Failed to get SandboxTemplate: ${X}`,Y)}}async function Zn($,Z,X){let Q=`${eO0}/${encodeURIComponent(Z)}/${S5.CLAIM_PLURAL}`,Y;try{Y=await tY($,{method:"POST",path:Q,body:X})}catch(H){let F=H instanceof Error?H.message:String(H);throw console.warn(`[agent-sandbox/client] createSandboxClaim ${X.metadata.name} transport error: ${F}`),new I9(`Failed to create SandboxClaim: ${X.metadata.name} (transport error: ${F})`,H)}if(Y.ok)return;let G=await Vp0(Y),J=G?.reason?` ${G.reason}`:"",W=G?.message??Y.statusText,K=`Failed to create SandboxClaim: ${X.metadata.name} (${Y.status}${J}: ${W})`;if(console.warn(`[agent-sandbox/client] createSandboxClaim ${X.metadata.name} rejected: status=${Y.status} reason=${G?.reason??"<none>"} message=${W}`),Y.status===409)throw new sp(K);throw new I9(K)}async function $B0($,Z,X,Q=60000){let Y=Date.now()+Q,G=500,J;while(!0){let W=await v3($,Z,X).catch(()=>{return});if(!W)return;if(J=W,Date.now()>=Y){let K=J.metadata?.finalizers??[],H=J.metadata?.deletionTimestamp??"<unknown>";throw new mS(`SandboxClaim ${X} still terminating after ${Q}ms (deletionTimestamp=${H}, finalizers=[${K.join(", ")}])`)}await D$(500)}}function Sp0($,Z){return`${eO0}/${encodeURIComponent($)}/${S5.CLAIM_PLURAL}/${encodeURIComponent(Z)}`}async function ZB0($,Z,X,Q){await Py($,{method:"PATCH",path:Sp0(Z,X),patchType:"merge",body:{spec:{lifecycle:{shutdownPolicy:"Delete",shutdownTime:Q}}}},"patchSandboxClaimShutdown",`Failed to patch SandboxClaim shutdownTime: ${X}`)}async function DB($,Z,X){await Py($,{method:"DELETE",path:Sp0(Z,X)},"deleteSandboxClaim",`Failed to delete SandboxClaim: ${X}`)}async function v3($,Z,X){return await Py($,{method:"GET",path:Sp0(Z,X)},"getSandboxClaim",`Failed to get SandboxClaim: ${X}`,"json")??void 0}async function lQ$($,Z,X,Q=60){let Y=Date.now()+Q*1000,G=200;while(Date.now()<Y){let W=(await v3($,Z,X).catch(()=>{return}))?.status?.sandbox?.name;if(W)return W;await D$(200)}throw new mS(`SandboxClaim ${X} did not record an adopted Sandbox (status.sandbox.name) within ${Q}s`)}async function dQ$($,Z,X){let Y=(await Py($,{method:"GET",path:`${eO0}/${encodeURIComponent(Z)}/sandboxwarmpools/${encodeURIComponent(X)}`},"getSandboxWarmPool",`Failed to get SandboxWarmPool: ${X}`,"json"))?.status?.selector;if(!Y)return null;let G=await tY($,{method:"GET",path:`/api/v1/namespaces/${encodeURIComponent(Z)}/pods?labelSelector=${encodeURIComponent(Y)}`});return await $n(G,"listWarmPoolPods"),((await G.json()).items??[]).filter((W)=>W.status?.phase==="Running").flatMap((W)=>W.metadata?.name&&W.metadata.uid?[{name:W.metadata.name,uid:W.metadata.uid,labels:W.metadata.labels??{}}]:[])}async function mQ$($,Z,X,Q){try{let Y=await tY($,{method:"GET",path:`/api/v1/namespaces/${encodeURIComponent(Z)}/pods/${encodeURIComponent(X)}`});if(!Y.ok)return!1;return!(await Y.json()).metadata?.labels?.[Q]}catch{return!1}}async function iQ$($,Z,X,Q,Y){try{let G=await tY($,{method:"GET",path:`/api/v1/namespaces/${encodeURIComponent(Z)}/pods?labelSelector=${encodeURIComponent(`${X}=${Q}`)}`});if(!G.ok)return null;let W=((await G.json()).items??[]).reduce((K,H)=>K===null||(H.metadata?.creationTimestamp??"")>(K.metadata?.creationTimestamp??"")?H:K,null);return W?F34(W,Y):null}catch{return null}}function F34($,Z){let X=($.status?.containerStatuses??[]).find((G)=>G.name===Z),Q=X?.state?.terminated??X?.lastState?.terminated;if(!Q?.reason)return null;let Y=($.spec?.containers??[]).find((G)=>G.name===Z)?.resources?.limits?.memory;return{reason:Q.reason,oomKilled:Q.reason==="OOMKilled",...Q.exitCode===void 0?{}:{exitCode:Q.exitCode},...Y===void 0?{}:{memoryLimit:Y}}}function Cp0($,Z){return`${N34}/${encodeURIComponent($)}/${tQ$}/${encodeURIComponent(Z)}`}async function XB0($,Z,X){let Q=new URLSearchParams({fieldManager:rQ$,force:"true"}),Y=`${Cp0(Z,X.metadata.name)}?${Q}`;try{let G=await tY($,{method:"PATCH",path:Y,patchType:"apply",body:X});await $n(G,"applyHttpRoute")}catch(G){throw new I9(`Failed to apply HTTPRoute: ${X.metadata.name}`,G)}}async function QB0($,Z,X){await Py($,{method:"DELETE",path:Cp0(Z,X)},"deleteHttpRoute",`Failed to delete HTTPRoute: ${X}`)}async function oQ$($,Z,X){return await Py($,{method:"GET",path:Cp0(Z,X)},"getHttpRoute",`Failed to get HTTPRoute: ${X}`,"json")??void 0}async function aQ$($,Z,X,Q){let Y={apiVersion:"v1",kind:"Service",metadata:{name:X},spec:{ports:[{name:Q.name,port:Q.port,targetPort:Q.targetPort,protocol:Q.protocol??"TCP"}]}},G=new URLSearchParams({fieldManager:rQ$,force:"true"}),J=`/api/v1/namespaces/${encodeURIComponent(Z)}/services/${encodeURIComponent(X)}?${G}`;try{let W=await tY($,{method:"PATCH",path:J,patchType:"apply",body:Y});await $n(W,"ensureServicePort")}catch(W){throw new I9(`Failed to apply Service ports: ${X}`,W)}}function YB0($,Z,X,Q=180){let Y=`/apis/${S5.SANDBOX_API_GROUP}/${S5.SANDBOX_API_VERSION}/namespaces/${encodeURIComponent(Z)}/${S5.SANDBOX_PLURAL}?watch=true&fieldSelector=${encodeURIComponent(`metadata.name=${X}`)}`,{resolve:G,reject:J,promise:W}=Promise.withResolvers(),K=new AbortController,H=!1,F=setTimeout(()=>{if(H)return;H=!0,K.abort(),J(new mS(`Sandbox did not become ready within ${Q} seconds`))},Q*1000),N=(U)=>{if(H)return;H=!0,clearTimeout(F),K.abort(),U()};return(async()=>{let U;try{U=await tY($,{method:"GET",path:Y,signal:K.signal,headers:{accept:"application/json"},stream:!0})}catch(O){N(()=>J(new I9("Failed to start watch for sandbox readiness",O)));return}if(!U.ok||!U.body){let O=await Vp0(U).catch(()=>null);N(()=>J(new I9(`Watch handshake failed (${U.status}): ${O?.message??U.statusText}`)));return}try{for await(let O of _p0(U.body)){if(H)return;if(O.type==="ERROR"){let j=O.object;N(()=>J(new I9(`Watch stream error while waiting for sandbox: ${j.message??"unknown"}`)));return}if(O.type!=="ADDED"&&O.type!=="MODIFIED")continue;let B=O.object;if(!B.status?.conditions?.find((j)=>j.type==="Ready"&&j.status==="True"))continue;let w=B.metadata?.name;if(!w){N(()=>J(new I9("Sandbox metadata or name is missing")));return}let E=B.metadata?.annotations?.[S5.POD_NAME_ANNOTATION]??w;N(()=>G({sandboxName:w,podName:E}));return}N(()=>J(new I9("Watch stream closed before sandbox became ready")))}catch(O){if(H)return;if(O instanceof Error&&(O.name==="AbortError"||K.signal.aborted))return;N(()=>J(new I9("Watch stream error while waiting for sandbox",O)))}})(),W}async function*_p0($){let Z=$.getReader(),X=new TextDecoder,Q="";try{while(!0){let{value:G,done:J}=await Z.read();if(J)break;Q+=X.decode(G,{stream:!0});let W;while((W=Q.indexOf(`
-`))>=0){let K=Q.slice(0,W).trim();if(Q=Q.slice(W+1),!K)continue;yield JSON.parse(K)}}let Y=Q.trim();if(Y)yield JSON.parse(Y)}finally{Z.releaseLock()}}var uQ$,eO0,pQ$="gateway.networking.k8s.io",nQ$="v1",tQ$="httproutes",N34,Xn,rQ$="mesh-sandbox-runner";var Qn=D(()=>{w4();ep();uQ$=class uQ$ extends Error{status;body;constructor($,Z,X){super(X);this.status=$;this.body=Z;this.name="KubeHttpError"}};eO0=`/apis/${S5.CLAIM_API_GROUP}/${S5.CLAIM_API_VERSION}/namespaces`;N34=`/apis/${pQ$}/${nQ$}/namespaces`;Xn={API_GROUP:pQ$,API_VERSION:nQ$,PLURAL:tQ$}});function O34($){return($.items??[]).some((Z)=>{if(Z.status?.phase!=="Pending")return!1;return(Z.status?.conditions??[]).some((X)=>X.type==="PodScheduled"&&X.status==="False"&&X.reason==="Unschedulable")})}function eQ$($,Z){let X=0,Q=!0,Y=null,G=async()=>{try{let J=await tY($,{method:"GET",path:`/api/v1/namespaces/${encodeURIComponent(Z)}/pods?fieldSelector=status.phase%3DPending`});if(!J.ok)return sQ$;let W=await J.json();return!O34(W)}catch{return sQ$}};return async()=>{if(Date.now()-X<U34)return Q;return Y??=G().finally(()=>{Y=null}),Q=await Y,X=Date.now(),Q}}var U34=3000,sQ$=!0;var $Y$=D(()=>{Qn()});var GB0=D(()=>{w4();Rm0()});async function WB0($){try{let Z=await fetch(`${$}/health`,{signal:AbortSignal.timeout(B34)});if(!Z.ok)return null;let X=await Z.json();if(typeof X==="object"&&X!==null&&typeof X.bootId==="string"&&typeof X.ready==="boolean"&&X.setup&&typeof X.setup.running==="boolean"&&typeof X.setup.done==="boolean")return X;return null}catch{return null}}async function fp0($){for(let Z=0;Z<ZY$;Z++){if(await WB0($)!==null)return;let X=(Math.random()*2-1)*D34;await D$(XY$+X)}throw Error(`sandbox daemon at ${$} did not respond on /health within ${ZY$*XY$/1000}s`)}async function iS($,Z,X,Q,Y){return L34($,Z,"POST",X,Q,Y)}async function L34($,Z,X,Q,Y,G){let J={...Q};if(Y&&Y.rotateToken!==void 0)J.auth=Y;let W=await fetch(`${$}/_sandbox/config`,{method:X,headers:{"Content-Type":"application/json",Authorization:`Bearer ${Z}`},body:JSON.stringify(J),signal:AbortSignal.timeout(G?.timeoutMs??vp0)}),K=await W.text();if(!W.ok)throw new JB0(W.status,K);return JSON.parse(K)}async function QY$($,Z,X){let Q=await fetch(`${$}/_sandbox/setup/${X}`,{method:"POST",headers:{Authorization:`Bearer ${Z}`},signal:AbortSignal.timeout(vp0)});if(!Q.ok)throw Error(`sandbox daemon /_sandbox/setup/${X} returned ${Q.status}: ${await Q.text()}`)}async function YY$($,Z,X){let Q=await fetch(`${$}/_sandbox/orgfs-config`,{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${Z}`},body:X,signal:AbortSignal.timeout(vp0)}),Y=await Q.text();if(!Q.ok)throw Error(`sandbox daemon /_sandbox/orgfs-config returned ${Q.status}: ${Y}`);return JSON.parse(Y)}async function Yn($,Z,X,Q){let Y=new Headers(Q.headers);for(let W of w34)Y.delete(W);Y.set("authorization",`Bearer ${Z}`);let G=Q.method!=="GET"&&Q.method!=="HEAD",J=`${$}${X.startsWith("/")?X:`/${X}`}`;return fetch(J,{method:Q.method,headers:Y,body:G?Q.body:void 0,redirect:"manual",signal:Q.signal,duplex:G?"half":void 0})}var JB0,B34=500,vp0=30000,ZY$=25,XY$=200,D34=50,w34;var GY$=D(()=>{GB0();JB0=class JB0 extends Error{status;constructor($,Z){super(`sandbox daemon /_sandbox/config returned ${$}: ${Z}`);this.status=$;this.name="ConfigRequestError"}};w34=["cookie","host","connection","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","accept-encoding","content-length"]});async function*KY$($){let Z=$.now??(()=>Date.now()),X=Z(),Q=$.schedulingTimeoutMs??j34,Y={pod:{},sandbox:{},events:{hasPulling:!1,hasPulled:!1},startedAt:X},G=[],J=null,W=!1,K=(j)=>{if(W)return;if(J){let z=J;J=null,z(j)}else G.push(j)},H=()=>{if(G.length>0)return Promise.resolve(G.shift());if(W)return Promise.resolve(null);return new Promise((j)=>{J=j})},F=()=>{if(W)return;if(W=!0,J){let j=J;J=null,j(null)}},N=new AbortController,U=()=>{N.abort(),F()};if($.signal)if($.signal.aborted)N.abort(),F();else $.signal.addEventListener("abort",U,{once:!0});let O=Math.max(0,Q-(Z()-X)),B=setTimeout(()=>K("tick"),O+100),L,w=new Promise((j)=>{L=j}),E=Promise.allSettled([z34($.kc,$.namespace,$.claimName,N.signal,Y,K,Z,L),A34($.kc,$.namespace,$.claimName,N.signal,Y,K),T34($.kc,$.namespace,$.claimName,w,N.signal,Y,K,Z)]);try{let j=null,z=-1,A=JY$(Y,Q,Z);if(j=xp0(A),!bp0(A))z=WY$(A);if(yield A,bp0(A))return;while(!W){if(await H()===null)break;let I=JY$(Y,Q,Z);if(bp0(I)){let C=xp0(I);if(C!==j)j=C,yield I;return}let q=WY$(I);if(q<z)continue;let M=xp0(I);if(M!==j)j=M,z=q,yield I}}finally{if(clearTimeout(B),N.abort(),$.signal)$.signal.removeEventListener("abort",U);F(),await E.catch(()=>{})}}function JY$($,Z,X){let{pod:Q,sandbox:Y,events:G,startedAt:J}=$;if(Y.ready)return{kind:"ready"};let W=Q.containerWaitingReason;if(W==="ImagePullBackOff"||W==="ErrImagePull")return{kind:"failed",reason:"image-pull-backoff",message:"Sandbox image failed to download. The cluster may be missing pull credentials or the image tag may not exist."};if(W==="CrashLoopBackOff")return{kind:"failed",reason:"crash-loop-backoff",message:"Sandbox crashed during startup and is now in CrashLoopBackOff. Check pod logs."};if(!Q.scheduled&&G.lastFailedSchedulingAt!==void 0&&X()-J>Z)return{kind:"failed",reason:"scheduling-timeout",message:G.failedSchedulingMessage??`Pod could not be scheduled within ${Math.round(Z/1000)}s.`};if(Q.containerRunning&&!Q.containerReady)return{kind:"warming-daemon",since:J};if(G.hasPulling&&!G.hasPulled)return{kind:"pulling-image",since:J};if(W==="ContainerCreating"||W==="PodInitializing"||Q.scheduled&&!Q.containerRunning)return{kind:"starting-container",since:J};if(Q.scheduledFalseReason==="Unschedulable"||G.lastFailedSchedulingAt!==void 0&&!Q.scheduled)return{kind:"waiting-for-capacity",since:J,message:G.failedSchedulingMessage??Q.scheduledFalseMessage,nodeClaim:G.nominatedNodeClaim};return{kind:"claiming",since:J}}function bp0($){return $.kind==="ready"||$.kind==="failed"}function WY$($){switch($.kind){case"claiming":return 0;case"waiting-for-capacity":return 1;case"pulling-image":return 2;case"starting-container":return 3;case"warming-daemon":return 4;case"ready":case"failed":return 99}}function xp0($){switch($.kind){case"claiming":case"pulling-image":case"starting-container":case"warming-daemon":return $.kind;case"waiting-for-capacity":return`waiting-for-capacity:${$.message??""}:${$.nodeClaim??""}`;case"ready":return"ready";case"failed":return`failed:${$.reason}:${$.message}`}}async function z34($,Z,X,Q,Y,G,J,W){let K=`/api/v1/namespaces/${encodeURIComponent(Z)}/pods?watch=true&labelSelector=${encodeURIComponent(`${E34}=${X}`)}`;return KB0({kc:$,path:K,signal:Q,label:`pod/${X}`,onEvent:(H)=>{if(H.type!=="ADDED"&&H.type!=="MODIFIED")return;let F=H.object;if(F.metadata?.name)W(F.metadata.name);P34(F,Y,J),G("pod")}})}function P34($,Z,X){let Y=($.status?.conditions??[]).find((J)=>J.type==="PodScheduled");if(Y?.status==="True")Z.pod.scheduled=!0,Z.pod.scheduledFalseReason=void 0,Z.pod.scheduledFalseMessage=void 0;else if(Y?.status==="False")Z.pod.scheduled=!1,Z.pod.scheduledFalseReason=Y.reason,Z.pod.scheduledFalseMessage=Y.message;let G=($.status?.containerStatuses??[]).find((J)=>J.name===S5.MAIN_CONTAINER_NAME);if(G)Z.pod.containerWaitingReason=G.state?.waiting?.reason,Z.pod.containerRunning=!!G.state?.running,Z.pod.containerReady=G.ready===!0}async function A34($,Z,X,Q,Y,G){let J=`/apis/${S5.CLAIM_API_GROUP}/${S5.CLAIM_API_VERSION}/namespaces/${encodeURIComponent(Z)}/${S5.CLAIM_PLURAL}?watch=true&fieldSelector=${encodeURIComponent(`metadata.name=${X}`)}`;return KB0({kc:$,path:J,signal:Q,label:`sandboxclaim/${X}`,onEvent:(W)=>{if(W.type!=="ADDED"&&W.type!=="MODIFIED")return;let H=W.object.status?.conditions?.find((F)=>F.type==="Ready");if(!H)return;if(H.status==="True")Y.sandbox.ready=!0,Y.sandbox.notReadyReason=void 0,Y.sandbox.notReadyMessage=void 0;else Y.sandbox.ready=!1,Y.sandbox.notReadyReason=H.reason,Y.sandbox.notReadyMessage=H.message;G("sandbox")}})}async function T34($,Z,X,Q,Y,G,J,W){let K=await Promise.race([Q,new Promise((F)=>{if(Y.aborted){F(X);return}Y.addEventListener("abort",()=>F(X),{once:!0})})]);if(Y.aborted)return;let H=`/api/v1/namespaces/${encodeURIComponent(Z)}/events?watch=true&fieldSelector=${encodeURIComponent(`involvedObject.name=${K},involvedObject.kind=Pod`)}`;return KB0({kc:$,path:H,signal:Y,label:`events/${X}`,onEvent:(F)=>{if(F.type!=="ADDED"&&F.type!=="MODIFIED")return;let N=F.object,U=N.reason;if(!U)return;switch(U){case"Pulling":G.events.hasPulling=!0;break;case"Pulled":G.events.hasPulling=!0,G.events.hasPulled=!0;break;case"FailedScheduling":G.events.lastFailedSchedulingAt=W(),G.events.failedSchedulingMessage=N.message;break;case"Nominated":{let O=N.message?.match(/nodeclaim\/([\w-]+)/);if(O)G.events.nominatedNodeClaim=O[1];break}default:return}J("event")}})}async function HY$($){let{kc:Z,namespace:X,labelSelector:Q,signal:Y,onDelete:G}=$,J=`/apis/${S5.CLAIM_API_GROUP}/${S5.CLAIM_API_VERSION}/namespaces/${encodeURIComponent(X)}/${S5.CLAIM_PLURAL}?watch=true&labelSelector=${encodeURIComponent(Q)}`;return KB0({kc:Z,path:J,signal:Y,label:"sandboxclaim-reaper",onEvent:(W)=>{if(W.type!=="DELETED")return;let K=W.object.metadata?.name;if(K)G(K)}})}async function KB0($){let{kc:Z,path:X,signal:Q,label:Y,onEvent:G}=$,J=0;while(!Q.aborted){try{let K=await tY(Z,{method:"GET",path:X,signal:Q,headers:{accept:"application/json"},stream:!0});if(!K.ok||!K.body){try{await K.body?.cancel()}catch{}if(K.status===401||K.status===403){console.warn(`[lifecycle-watcher] ${Y} stopped: watch denied (${K.status} ${K.statusText}). `+"The kubeconfig in use cannot watch SandboxClaims \u2014 if you are running locally, "+"this provider should not be active (check STUDIO_SANDBOX_PROVIDER / your sandbox preference).");return}throw Error(`watch handshake failed: ${K.status} ${K.statusText}`)}J=0;for await(let H of _p0(K.body)){if(Q.aborted)return;try{G(H)}catch(F){console.warn(`[lifecycle-watcher] ${Y} onEvent threw: ${F instanceof Error?F.message:String(F)}`)}}}catch(K){if(Q.aborted)return;let H=K instanceof Error?K.message:String(K);console.warn(`[lifecycle-watcher] ${Y} watch ended: ${H}`)}if(Q.aborted)return;let W=oZ(5000,250,J,2,0);J+=1,await D$(W,{signal:Q}).catch(()=>{})}}var E34="studio.decocms.com/sandbox-handle",j34=300000;var FY$=D(()=>{w4();ep();Qn()});import{z as aG}from"zod";function NY$($){if(!$||$.trim()==="")return[];let Z=aG.array(R34).parse(JSON.parse($)),X=new Set;for(let Q of Z){if(X.has(Q.name))throw Error(`STUDIO_SANDBOX_TENANT_POOLS: duplicate pool name ${Q.name}`);X.add(Q.name)}return Z}function I34($){try{let[Z,X]=new URL($).pathname.replace(/^\/+/,"").split("/"),Q=X?.replace(/\.git$/,"");return Z&&Q?`${Z}/${Q}`.toLowerCase():null}catch{return null}}function UY$($,Z){let{orgId:X,cloneUrl:Q}=Z;if(Z.purpose==="harness-run")return null;if(!X||!Q)return null;let Y=I34(Q);if(!Y)return null;return $.find((G)=>G.orgId===X&&G.repo.toLowerCase()===Y)??null}function OY$($,Z,X){return $?.name??(Z?X:"none")}function q34($,Z){return $==="harness-run"?`${Z}-medium`:Z}async function BY$($){let Z=q34($.purpose,$.templateName);if(Z===$.templateName)return{name:Z,probe:$.probe};let X=$.probe!==null&&$.now-$.probe.checkedAt<$.ttlMs?$.probe:{checkedAt:$.now,present:await $.exists(Z)};if(X.present)return{name:Z,probe:X};if($.probe?.present!==!1)$.onAbsent?.(Z);return{name:$.templateName,probe:X}}function DY$($,Z,X){let Q=X.replace(/^refs\/heads\//,"");return $.filter((Y)=>Y.repo.toLowerCase()===Z.toLowerCase()&&Y.branch===Q)}function LY$($){return`https://github.com/${$.repo}.git`}var R34;var yp0=D(()=>{R34=aG.object({name:aG.string().regex(/^[a-z0-9]([-a-z0-9]*[a-z0-9])?$/,"pool name must be a DNS label (lowercase alphanumeric and '-')"),orgId:aG.string().min(1),repo:aG.string().regex(/^[^/\s]+\/[^/\s]+$/,"repo must be `owner/name`"),connectionId:aG.string().min(1).optional(),branch:aG.string().min(1).default("main"),workload:aG.object({runtime:aG.enum(["node","bun","deno"]).default("node"),packageManager:aG.enum(["npm","pnpm","yarn","bun","deno"]).optional(),packageManagerPath:aG.string().optional(),devPort:aG.number().int().positive().optional()}).default({runtime:"node"})})});async function wY$($,Z,X){let Q=new Map;for(let Y of $){let G=Z(Y);if(!G)continue;let J=Q.get(G);if(J)J.push(Y);else Q.set(G,[Y])}await Promise.allSettled([...Q.values()].map(async(Y)=>{for(let G of Y)await X(G).catch(()=>{})}))}import{createHash as M34,randomBytes as k34,randomUUID as V34}from"crypto";import*as RY$ from"net";import{PassThrough as S34}from"stream";function EY$($){if($ instanceof Error)return $.message;if($&&typeof $==="object"){let Z=$;if(Z.error instanceof Error)return Z.error.message;if(typeof Z.message==="string"&&Z.message)return Z.message}return String($)}class mp0{kind=tQ;records=new Map;inflight=new qZ0;activeGauge=new IZ0;stateStore;previewUrlPattern;kubeConfig;capacityProbe;portForward;namespace;sandboxTemplateName;envName;tokenGenerator;idleTtlMs;metrics;previewGateway;sentinelToken;mintCloneUrl;mintOrgFsConfig;tenantPools;tenantPoolRefreshMs;poolPods=new Map;mediumTemplateProbe=null;dirtyPools=new Set;closed=!1;claimWatchAbort=new AbortController;constructor($={}){this.stateStore=$.stateStore??null,this.previewUrlPattern=$.previewUrlPattern??null,this.kubeConfig=$.kubeConfig??m34(),this.portForward=new Np0(this.kubeConfig),this.namespace=$.namespace??C34,this.sandboxTemplateName=$.sandboxTemplateName??_34,this.envName=r34($.envName),this.tokenGenerator=$.tokenGenerator??(()=>k34(f34).toString("hex")),this.idleTtlMs=$.idleTtlMs??x34,this.metrics=$.meter?d34($.meter):null,this.previewGateway=$.previewGateway&&$.previewUrlPattern?{...$.previewGateway}:null;let Z=$.sentinelToken?.trim()??"";if(this.sentinelToken=Z.length>0?Z:null,this.mintCloneUrl=$.mintCloneUrl,this.mintOrgFsConfig=$.mintOrgFsConfig,this.tenantPools=this.sentinelToken!==null?$.tenantPools??[]:[],this.sentinelToken===null&&($.tenantPools?.length??0)>0)console.warn(`[${W6}] tenant pools configured without a sentinel token \u2014 ignoring them (warm-pool mode is off)`);this.tenantPoolRefreshMs=$.tenantPoolRefreshMs??g34,this.startClaimReaper(),this.startCredentialRefresher(),this.startTenantPoolReconciler()}startClaimReaper(){let $=["app.kubernetes.io/managed-by=studio","app.kubernetes.io/name=studio-sandbox",...this.envName?[`${sX.env}=${this.envName}`]:[]].join(",");HY$({kc:this.kubeConfig,namespace:this.namespace,labelSelector:$,signal:this.claimWatchAbort.signal,onDelete:(Z)=>this.invalidateRecord(Z)})}async ensure($,Z={}){let X=BE($);if(X.startsWith("s-"))throw Error(`ensure: projectRef has no slug source: ${$.projectRef}`);return this.inflight.run(X,()=>MZ0(this.stateStore,$,tQ,(Q)=>this.ensureLocked($,X,Z,Q)))}async delete($){let Z=await this.getRecord($);if(this.records.delete($),Z)this.dropRecord(Z);if(await this.deleteHttpRouteIfManaged($).catch((X)=>{console.warn(`[${W6}] HTTPRoute delete failed for ${$}: ${X instanceof Error?X.message:String(X)}`)}),await DB(this.kubeConfig,this.namespace,$),this.stateStore)if(Z)await this.stateStore.delete(Z.id,tQ);else await this.stateStore.deleteByHandle(tQ,$)}lastTermination($){return iQ$(this.kubeConfig,this.namespace,sX.sandboxHandle,$,S5.MAIN_CONTAINER_NAME)}async alive($){return await v3(this.kubeConfig,this.namespace,$)!==void 0}watchClaimLifecycle($,Z){return KY$({kc:this.kubeConfig,namespace:this.namespace,claimName:$,signal:Z})}hasSchedulableCapacity(){return this.capacityProbe??=eQ$(this.kubeConfig,this.namespace),this.capacityProbe()}async getPreviewUrl($){let Z=await this.getRecord($);if(!Z)return null;return this.composePreviewUrl(Z)}async proxyDaemonRequest($,Z,X){let Q=await this.getRecord($);if(!Q&&this.previewUrlPattern&&this.stateStore){let K=await this.stateStore.getByHandle(tQ,$),H=K?.state,F=H?.token;if(K&&F){let U=`http://${H?.adoptedSandboxName??$}.${this.namespace}.svc.cluster.local:${bF}`;try{let O=await Yn(U,F,Z,X);if(O.status!==404)return O;try{await O.body?.cancel()}catch{}}catch{}}}if(!Q)Q=await this.resurrectByHandle($);if(!Q)return new Response(JSON.stringify({error:"sandbox not found"}),{status:404,headers:{"content-type":"application/json"}});let Y=Q,G=performance.now(),J=0,W=!(X.body instanceof ReadableStream);try{let K=await Yn(Q.daemonUrl,Q.token,Z,X);if(K.status===401&&W){this.invalidateRecord($);let H=await this.getRecord($).catch(()=>null)??await this.resurrectByHandle($).catch(()=>null);if(H){try{await K.body?.cancel()}catch{}Y=H,K=await Yn(H.daemonUrl,H.token,Z,X)}}return J=K.status,K}catch(K){if(!W)throw K;this.invalidateRecord($);let H=await this.resurrectByHandle($)??await this.getRecord($).catch(()=>null);if(!H)throw K;Y=H;let F=await Yn(H.daemonUrl,H.token,Z,X);return J=F.status,F}finally{this.recordProxyDuration("daemon",J,Y,performance.now()-G)}}async adoptLiveClaim($,Z){if(this.records.has(Z))return!0;let X=await v3(this.kubeConfig,this.namespace,Z).catch(()=>{return});if(!X||X.metadata?.deletionTimestamp)return!1;return await this.inflight.run(Z,async()=>{let Y=this.records.get(Z);if(Y)return this.toSandbox(Y);let G=await this.adopt($,Z,X);if(!G)throw Error(`cannot adopt live claim ${Z}`);return MZ0(this.stateStore,$,tQ,(J)=>this.finish(G,J,!0,!0,"adopt"))}).catch(()=>null)!=null}async resolvePreviewUpstreamUrl($){if(this.previewUrlPattern)return`http://${await this.resolveServiceNameForHandle($)}.${this.namespace}.svc.cluster.local:${bF}`;let Z=await this.getRecord($);if(Z)return Z.daemonUrl;let X=await this.resurrectByHandle($);return X?X.daemonUrl:null}async resolveServiceNameForHandle($){let Z=this.records.get($);if(Z)return Z.adoptedSandboxName;if(this.stateStore){let Q=(await this.stateStore.getByHandle(tQ,$).catch(()=>null))?.state?.adoptedSandboxName;if(Q)return Q}return $}async proxyPreviewRequest($,Z){let X=performance.now(),Q=this.records.get($)??null,Y=0;try{let G=await this.resolvePreviewUpstreamUrl($);if(!G){Y=404;let B=hp0(404,{error:"sandbox not found"});return B.headers.set(nS,"1"),B}let J=new URL(Z.url);if((J.pathname==="/_sandbox"||J.pathname.startsWith("/_sandbox/")||J.pathname==="/_decopilot_vm"||J.pathname.startsWith("/_decopilot_vm/"))&&Z.method!=="GET")return Y=404,hp0(404,{error:"not found"});let K=(B)=>`${B}${J.pathname}${J.search}`,H=new Headers(Z.headers);for(let B of c34)H.delete(B);let F=Z.method!=="GET"&&Z.method!=="HEAD",N={method:Z.method,headers:H,body:F?Z.body:void 0,redirect:"manual",signal:Z.signal,duplex:F?"half":void 0},U;try{U=await fetch(K(G),N)}catch(B){let L=`${G}${J.pathname}`;if(console.warn(`[${W6}] preview fetch to ${L} failed: ${B instanceof Error?B.message:String(B)}`),Z.method==="GET"||Z.method==="HEAD"){if(this.invalidateRecord($),await this.resurrectByHandle($).catch(()=>null)){let j=await this.resolvePreviewUpstreamUrl($);if(j)try{U=await fetch(K(j),N);let z=new Headers;for(let[A,P]of U.headers.entries())if(!PY$.includes(A.toLowerCase()))z.set(A,P);return Y=U.status,new Response(U.body,{status:U.status,statusText:U.statusText,headers:z})}catch(z){console.warn(`[${W6}] preview fetch retry to ${L} failed: ${z instanceof Error?z.message:String(z)}`)}}}else this.invalidateRecord($);Y=502;let w=hp0(502,{error:"sandbox daemon unreachable"});return w.headers.set(nS,"1"),w}let O=new Headers;for(let[B,L]of U.headers.entries())if(!PY$.includes(B.toLowerCase()))O.set(B,L);return Y=U.status,new Response(U.body,{status:U.status,statusText:U.statusText,headers:O})}finally{this.recordProxyDuration("preview",Y,Q,performance.now()-X,$)}}async ensureLocked($,Z,X,Q){if(X.image)console.warn(`[${W6}] opts.image ignored (template ${this.sandboxTemplateName} pins image): got ${X.image}`);if(Q){let J=await Q.get($,tQ);if(J){let W=await this.rehydrate($,Z,J);if(W)return await this.refreshDaemonGitCredential(W,X),await this.relayOrgFsConfig(W.daemonUrl,W.token,X.orgFsConfigJson),this.finish(W,Q,!1,!0,"resume");await Q.delete($,tQ)}}let Y=await v3(this.kubeConfig,this.namespace,Z).catch(()=>{return});if(Y)if(Y.metadata?.deletionTimestamp)await $B0(this.kubeConfig,this.namespace,Z).catch((J)=>{console.warn(`[${W6}] wait for terminating claim ${Z} failed: ${J instanceof Error?J.message:String(J)}`)});else{let J=await this.adopt($,Z,Y).catch((W)=>{return console.warn(`[${W6}] adopt ${Z} failed, recreating: ${W instanceof Error?W.message:String(W)}`),null});if(J)return await this.refreshDaemonGitCredential(J,X),await this.relayOrgFsConfig(J.daemonUrl,J.token,X.orgFsConfigJson),this.finish(J,Q,!0,!0,"adopt");await DB(this.kubeConfig,this.namespace,Z).catch(()=>{}),await $B0(this.kubeConfig,this.namespace,Z).catch((W)=>{console.warn(`[${W6}] wait for deleted claim ${Z} failed: ${W instanceof Error?W.message:String(W)}`)})}let G=await this.provision($,Z,X);return this.finish(G,Q,!0,!1,"fresh")}async finish($,Z,X,Q,Y){let G=this.records.get($.handle),J=G!==void 0;if(G&&G.daemonForward!==$.daemonForward)this.closeForwarder(G.daemonForward);if(this.records.set($.handle,$),X)await this.persist(Z,$);if(Q)await ZB0(this.kubeConfig,this.namespace,$.handle,this.computeShutdownTime()).catch((W)=>console.warn(`[${W6}] TTL refresh failed for ${$.handle}: ${W instanceof Error?W.message:String(W)}`));if(this.metrics){let W=cp0($.tenant);if(this.metrics.ensureOutcome.add(1,{...W,outcome:Y}),!J)this.metrics.active.add(1,W),this.activeGauge.markCounted($.handle)}return this.toSandbox($)}buildEnvMap($,Z){let X={},Q=[];for(let[Y,G]of Object.entries($.env??{}))if(b34.has(Y))Q.push(Y);else X[Y]=G;if(Q.length>0)console.warn(`[${W6}] opts.env keys overlap reserved bootstrap names and were dropped: ${Q.join(",")}`);return{...X,DAEMON_TOKEN:Z.token,DAEMON_BOOT_ID:Z.daemonBootId,APP_ROOT:Z.workdir,PROXY_PORT:String(bF)}}async resolveTemplateName($){let{name:Z,probe:X}=await BY$({purpose:$,templateName:this.sandboxTemplateName,probe:this.mediumTemplateProbe,now:Date.now(),ttlMs:v34,exists:(Q)=>cQ$(this.kubeConfig,this.namespace,Q),onAbsent:(Q)=>console.warn(`[${W6}] SandboxTemplate ${Q} not found (or not readable) \u2014 harness-run claims fall back to ${this.sandboxTemplateName}. Upgrade the sandbox-env chart to the version that renders it.`)});return this.mediumTemplateProbe=X,Z}buildClaim($,Z,X,Q){let Y=this.sentinelToken!==null,G=UY$(this.tenantPools,{orgId:Z.tenant?.orgId,cloneUrl:Z.repo?.cloneUrl,purpose:Z.purpose}),J=Y?[]:Object.entries(this.buildEnvMap(Z,X)).sort(([H],[F])=>H<F?-1:H>F?1:0).map(([H,F])=>({name:H,value:F})),W=e34(Z),K=Object.keys(W).length>0;return{apiVersion:`${S5.CLAIM_API_GROUP}/${S5.CLAIM_API_VERSION}`,kind:"SandboxClaim",metadata:{name:$,namespace:this.namespace,labels:{"app.kubernetes.io/name":"studio-sandbox","app.kubernetes.io/managed-by":"studio",...this.envName?{[sX.env]:this.envName}:{},...up0(Z.tenant)},...K?{annotations:W}:{}},spec:{sandboxTemplateRef:{name:Q},additionalPodMetadata:{labels:up0(Z.tenant,{[sX.role]:"claimed",[sX.sandboxHandle]:$,...this.envName?{[sX.env]:this.envName}:{}}),...K?{annotations:W}:{}},env:J,warmpool:OY$(G,Y,Q),lifecycle:{shutdownPolicy:"Delete",shutdownTime:this.computeShutdownTime()}}}}async provision($,Z,X){let Q=this.tokenGenerator(),Y=V34(),G=gp0,J=this.buildClaim(Z,X,{token:Q,daemonBootId:Y,workdir:G},await this.resolveTemplateName(X.purpose));try{await Zn(this.kubeConfig,this.namespace,J)}catch(U){if(U instanceof sp)await $B0(this.kubeConfig,this.namespace,Z),await Zn(this.kubeConfig,this.namespace,J);else throw U}let W;try{W=await lQ$(this.kubeConfig,this.namespace,Z),await YB0(this.kubeConfig,this.namespace,W)}catch(U){throw await DB(this.kubeConfig,this.namespace,Z).catch(()=>{}),U}try{await this.ensureServicePortForAdoptedSandbox(W),await this.ensureHttpRouteForHandle(Z,W,X.tenant??null)}catch(U){throw await DB(this.kubeConfig,this.namespace,Z).catch(()=>{}),U}let K=await this.openForwarder(W,bF,Z),H=`http://127.0.0.1:${K.localPort}`,F=this.workloadConfigPayload(X),N=Y;try{if(await fp0(H),this.sentinelToken!==null){let U=await WB0(H);if(U)N=U.bootId;await iS(H,this.sentinelToken,F??{},{rotateToken:Q})}else if(F)await iS(H,Q,F);await this.relayOrgFsConfig(H,Q,X.orgFsConfigJson)}catch(U){throw this.closeForwarder(K),await this.deleteHttpRouteIfManaged(Z).catch(()=>{}),await DB(this.kubeConfig,this.namespace,Z).catch(()=>{}),U}return{id:$,handle:Z,adoptedSandboxName:W,token:Q,workdir:G,daemonUrl:H,daemonForward:K,workload:X.workload??null,daemonBootId:N,tenant:X.tenant??null,ensureOpts:YW4(X)}}workloadConfigPayload($){return VZ0({runtime:$?.workload?.runtime??"node",packageManager:$?.workload?.packageManager?{name:$.workload.packageManager,...$.workload.packageManagerPath?{path:$.workload.packageManagerPath}:{}}:null,repo:$?.repo??null,port:$?.workload?.devPort??jY$,tenant:$?.tenant??void 0,...$?{cloneOnly:$.cloneOnly===!0}:{}})}async relayOrgFsConfig($,Z,X){if(!X)return;await YY$($,Z,X).catch((Q)=>console.warn("[org-fs] sidecar config relay failed",Q))}async refreshDaemonGitCredential($,Z){let X=Im0(Z);if(!X)return;try{await iS($.daemonUrl,$.token,X)}catch(Q){console.warn(`[${W6}] git credential refresh failed for ${$.handle}: ${Q instanceof Error?Q.message:String(Q)}`)}}async withFreshCloneUrl($,Z){if(!this.mintCloneUrl)return $;try{let X=await this.mintCloneUrl($,Z!==void 0?{bufferMs:Z}:void 0);return X?{...$,cloneUrl:X}:$}catch(X){return console.warn(`[${W6}] clone credential re-mint failed: ${X instanceof Error?X.message:String(X)}`),$}}async withFreshCredentials($){return{...$,...$.repo?{repo:await this.withFreshCloneUrl($.repo)}:{},...$.orgFsConfigJson?{orgFsConfigJson:await QW4($,this.mintOrgFsConfig)}:{}}}startCredentialRefresher(){if(!this.mintCloneUrl)return;let{signal:$}=this.claimWatchAbort;(async()=>{while(!$.aborted){if(await D$(h34,{signal:$}).catch(()=>{}),$.aborted)break;try{await this.refreshAllGitCredentials()}catch(Z){console.warn(`[${W6}] periodic credential refresh failed: ${Z instanceof Error?Z.message:String(Z)}`)}}})()}startTenantPoolReconciler(){if(this.tenantPools.length===0)return;let{signal:$}=this.claimWatchAbort;(async()=>{while(!$.aborted){try{await this.reconcileTenantPools()}catch(Z){console.warn(`[${W6}] tenant pool reconcile failed: ${Z instanceof Error?Z.message:String(Z)}`)}await D$(y34,{signal:$}).catch(()=>{})}})()}markTenantPoolsDirty($,Z){let X=DY$(this.tenantPools,$,Z);for(let Q of X)this.dirtyPools.add(Q.name);return X.map((Q)=>Q.name)}async reconcileTenantPools(){for(let $ of this.tenantPools){let Z=await dQ$(this.kubeConfig,this.namespace,$.name);if(Z===null){console.warn(`[${W6}] tenant pool ${$.name}: no SandboxWarmPool (or no selector yet) in ${this.namespace}`);continue}let X=this.dirtyPools.delete($.name),Q=Z.filter((Y)=>!Y.labels[sX.sandboxHandle]);for(let[Y]of this.poolPods)if(!Z.some((G)=>G.uid===Y))this.poolPods.delete(Y);for(let Y of Q){if(this.claimWatchAbort.signal.aborted)return;await this.warmPoolPod($,Y,X)}this.recordPoolDepth($,Z,Q)}}recordPoolDepth($,Z,X){let Q=this.metrics?.poolPods;if(!Q)return;let Y=0,G=0;for(let W of X){let K=this.poolPods.get(W.uid);if(!K)continue;if(K.failures>=HB0)G++;else if(K.lastConfigAt>0)Y++}let J={pool:$.name,org:$.orgId};Q.record(Y,{...J,state:"ready"}),Q.record(Z.length-X.length,{...J,state:"bound"}),Q.record(X.length-Y-G,{...J,state:"pending"}),Q.record(G,{...J,state:"failed"})}async warmPoolPod($,Z,X){let Q=this.poolPods.get(Z.uid);if(Q&&Q.failures>=HB0){if(Date.now()-Q.lastFailureAt<zY$)return;this.poolPods.set(Z.uid,{...Q,failures:0})}let Y=X||Q!==void 0&&Date.now()-Q.lastConfigAt>=this.tenantPoolRefreshMs;if(Q&&!Y)return;let G={cloneUrl:LY$($),connectionId:$.connectionId,branch:$.branch,userName:"",userEmail:""},J=await this.withFreshCloneUrl(G);if($.connectionId&&J.cloneUrl===G.cloneUrl){this.recordPoolFailure(Z,$,"clone credential mint failed");return}let W=await this.openForwarder(Z.name,bF,Z.name).catch(()=>null);if(!W){this.recordPoolFailure(Z,$,"port-forward failed");return}let K=`http://127.0.0.1:${W.localPort}`;try{await fp0(K);let H=this.sentinelToken;if(!H)return;if(!await this.isPoolPodUnbound(Z))return;let F=VZ0({runtime:$.workload.runtime,packageManager:$.workload.packageManager?{name:$.workload.packageManager,...$.workload.packageManagerPath?{path:$.workload.packageManagerPath}:{}}:null,repo:J,port:$.workload.devPort??jY$})??{},{transition:N}=await iS(K,H,F);if(Y&&N!=="bootstrap"&&await this.isPoolPodUnbound(Z))await QY$(K,H,"clone");this.poolPods.set(Z.uid,{lastConfigAt:Date.now(),lastFailureAt:0,failures:0}),console.log(`[${W6}] tenant pool ${$.name}: warmed ${Z.name} (${N})`)}catch(H){this.recordPoolFailure(Z,$,H instanceof Error?H.message:String(H))}finally{this.closeForwarder(W)}}isPoolPodUnbound($){return mQ$(this.kubeConfig,this.namespace,$.name,sX.sandboxHandle)}recordPoolFailure($,Z,X){let Q=this.poolPods.get($.uid),Y=(Q?.failures??0)+1;this.poolPods.set($.uid,{lastConfigAt:Q?.lastConfigAt??0,lastFailureAt:Date.now(),failures:Y});let G=Y>=HB0?` \u2014 backing off ${zY$/60000}min`:"";console.warn(`[${W6}] tenant pool ${Z.name}: warming ${$.name} failed (${Y}/${HB0})${G}: ${X}`)}async refreshAllGitCredentials(){await wY$(this.records.values(),($)=>$.ensureOpts?.repo?.connectionId,async($)=>{if(this.claimWatchAbort.signal.aborted)return;let Z=$.ensureOpts?.repo;if(!Z)return;let X=await this.withFreshCloneUrl(Z,u34);await this.refreshDaemonGitCredential($,{...$.ensureOpts,repo:X}),$.ensureOpts={...$.ensureOpts,repo:X}})}async rebootstrapDaemon($,Z,X){if(this.sentinelToken===null)return!1;let Q=this.workloadConfigPayload(X)??{};try{return await iS($,this.sentinelToken,Q,{rotateToken:Z}),await this.relayOrgFsConfig($,Z,X?.orgFsConfigJson),!0}catch(Y){if(Y instanceof JB0&&Y.status===401)try{return await iS($,Z,Q,{rotateToken:Z}),await this.relayOrgFsConfig($,Z,X?.orgFsConfigJson),!0}catch(G){return console.warn(`[${W6}] re-bootstrap retry with claim token failed: ${G instanceof Error?G.message:String(G)}`),!1}return console.warn(`[${W6}] re-bootstrap failed: ${Y instanceof Error?Y.message:String(Y)}`),!1}}async ensureServicePortForAdoptedSandbox($){if(!this.previewGateway||!this.previewUrlPattern)return;await aQ$(this.kubeConfig,this.namespace,$,{name:"daemon",port:bF,targetPort:bF})}async ensureHttpRouteForHandle($,Z,X){if(!this.previewGateway||!this.previewUrlPattern)return;let Q=GW4(this.previewUrlPattern,$);if(!Q)throw new I9(`Unable to derive preview hostname for ${$} from pattern: ${this.previewUrlPattern}`);let Y={apiVersion:`${Xn.API_GROUP}/${Xn.API_VERSION}`,kind:"HTTPRoute",metadata:{name:$,namespace:this.namespace,labels:up0(X??void 0,{[sX.role]:"claimed",[sX.sandboxHandle]:$,"app.kubernetes.io/name":"studio-sandbox","app.kubernetes.io/managed-by":"studio",...this.envName?{[sX.env]:this.envName}:{}})},spec:{parentRefs:[{kind:"Gateway",group:"gateway.networking.k8s.io",name:this.previewGateway.name,namespace:this.previewGateway.namespace}],hostnames:[Q],rules:[{backendRefs:[{group:"",kind:"Service",name:Z,port:bF}]}]}};await XB0(this.kubeConfig,this.namespace,Y)}async deleteHttpRouteIfManaged($){if(!this.previewGateway)return;await QB0(this.kubeConfig,this.namespace,$)}async rehydrate($,Z,X){let Q=X.state;if(!Q.adoptedSandboxName&&!Q.podName||!Q.token)return null;let Y=await v3(this.kubeConfig,this.namespace,Z).catch(()=>{return});if(!Y||!AY$(Y))return null;let G=Y.status?.sandbox?.name??Q.adoptedSandboxName??Q.podName??Z,J=await this.openAndProbeDaemon(G,Z);if(!J)return null;if(Q.daemonBootId&&Q.daemonBootId!==J.bootId){if(this.sentinelToken!==null){let W=Q.ensureOpts?await this.withFreshCredentials(Q.ensureOpts):null;if(!await this.rebootstrapDaemon(J.daemonUrl,Q.token,W))return this.closeForwarder(J.daemonForward),null}else console.warn(`[${W6}] daemon restart detected (handle=${Z}): stored bootId=${Q.daemonBootId} live bootId=${J.bootId}`);await this.stateStore?.put($,tQ,{handle:Z,state:{...Q,daemonBootId:J.bootId}}).catch((W)=>console.warn(`[${W6}] bootId persist failed for ${Z}: ${W instanceof Error?W.message:String(W)}`))}return{id:$,handle:Z,adoptedSandboxName:G,token:Q.token,workdir:Q.workdir??gp0,daemonUrl:J.daemonUrl,daemonForward:J.daemonForward,workload:Q.workload??null,daemonBootId:J.bootId,tenant:Q.tenant??null,ensureOpts:Q.ensureOpts??null}}async adopt($,Z,X){if(!AY$(X))return null;let Q=X.status?.sandbox?.name??Z;if(this.sentinelToken!==null)return null;let Y=i34(X);if(!Y)return null;let G=await this.openAndProbeDaemon(Q,Z);if(!G)return null;let J=$W4(X);if(this.previewGateway)await this.ensureServicePortForAdoptedSandbox(Q).catch((W)=>{console.warn(`[${W6}] Service port backfill failed for ${Z}: ${W instanceof Error?W.message:String(W)}`)}),await this.ensureHttpRouteForHandle(Z,Q,J).catch((W)=>{console.warn(`[${W6}] HTTPRoute backfill failed for ${Z}: ${W instanceof Error?W.message:String(W)}`)});return{id:$,handle:Z,adoptedSandboxName:Q,token:Y,workdir:gp0,daemonUrl:G.daemonUrl,daemonForward:G.daemonForward,workload:null,daemonBootId:G.bootId,tenant:J,ensureOpts:null}}async openAndProbeDaemon($,Z){let X=await this.openForwarder($,bF,Z).catch(()=>null);if(!X)return null;let Q=`http://127.0.0.1:${X.localPort}`,Y=await WB0(Q);if(!Y)return this.closeForwarder(X),null;return{daemonForward:X,daemonUrl:Q,bootId:Y.bootId}}async getRecord($){let Z=this.records.get($);if(Z)return Z;if(!this.stateStore)return null;let X=await this.stateStore.getByHandle(tQ,$);if(!X)return null;let Q=await this.rehydrate(X.id,$,X);if(Q)this.records.set($,Q);return Q}async resurrectByHandle($){if(!this.stateStore)return null;let Z=await this.stateStore.getByHandle(tQ,$);if(!Z)return null;let X=Z.state.ensureOpts;if(!X)return null;let Q=await this.withFreshCredentials(X);if(BE(Z.id)!==$)return null;return await this.ensure(Z.id,Q),this.records.get($)??null}invalidateRecord($){let Z=this.records.get($);if(!Z)return;this.records.delete($),this.dropRecord(Z)}dropRecord($){if(this.closeForwarder($.daemonForward),this.metrics&&this.activeGauge.consume($.handle))this.metrics.active.add(-1,cp0($.tenant))}recordProxyDuration($,Z,X,Q,Y){if(!this.metrics)return;this.metrics.proxyDurationMs.record(Q,{...cp0(X?.tenant??null),source:$,sandbox_handle:X?.handle??Y??"",status_code:Z||0})}composePreviewUrl($){if(this.previewUrlPattern)return kZ0(this.previewUrlPattern,$.handle);return`http://127.0.0.1:${$.daemonForward.localPort}/`}toSandbox($){return{handle:$.handle,workdir:$.workdir,previewUrl:this.composePreviewUrl($)}}async persist($,Z){if(!$)return;let X={adoptedSandboxName:Z.adoptedSandboxName,token:Z.token,workdir:Z.workdir,workload:Z.workload,daemonBootId:Z.daemonBootId,tenant:Z.tenant,...Z.ensureOpts?{ensureOpts:Z.ensureOpts}:{}};await $.put(Z.id,tQ,{handle:Z.handle,state:X})}computeShutdownTime(){return new Date(Date.now()+this.idleTtlMs).toISOString()}async releaseAfter($,Z){let X=await v3(this.kubeConfig,this.namespace,$);if(!X)return;let Q=ZW4(X.spec?.lifecycle?.shutdownTime,new Date(Date.now()+Z));if(!Q)return;await ZB0(this.kubeConfig,this.namespace,$,Q).catch((Y)=>console.warn(`[${W6}] release failed for ${$}: ${Y instanceof Error?Y.message:String(Y)}`))}async renewTtl($){let Z=await v3(this.kubeConfig,this.namespace,$);if(!Z)return;let X=XW4(Z.spec?.lifecycle?.shutdownTime,new Date(Date.now()+this.idleTtlMs));if(!X)return;await ZB0(this.kubeConfig,this.namespace,$,X).catch((Q)=>console.warn(`[${W6}] TTL renew failed for ${$}: ${Q instanceof Error?Q.message:String(Q)}`))}openForwarder($,Z,X=$){let Q=p34(X,Z);return new Promise((Y,G)=>{let J=(W,K)=>{let H=RY$.createServer((F)=>this.handleForwardedConnection(F,$,Z,X));H.once("error",(F)=>{if(F.code==="EADDRINUSE"&&K<l34){try{H.close()}catch{}let N=lp0+(W-lp0+1)%IY$;J(N,K+1);return}G(F)}),H.listen(W,"127.0.0.1",()=>{let F=H.address();if(!F||typeof F==="string"){H.close(),G(Error("port-forward listener failed to bind"));return}Y({server:H,localPort:F.port})})};J(Q,0)})}handleForwardedConnection($,Z,X,Q){let Y=new S34,G=null,J=!1,W=()=>{if(J)return;if(J=!0,Y.destroy(),G)try{G.close()}catch{}if(!$.destroyed)$.destroy()};$.pipe(Y),$.on("error",W),$.on("close",W),this.portForward.portForward(this.namespace,Z,[X],$,null,Y).then((K)=>{let H=typeof K==="function"?K():K;if(!H){W();return}if(G=H,G.on("close",W),G.on("error",(F)=>{console.warn(`[${W6}] port-forward to ${Z}:${X} dropped mid-connection: ${EY$(F)}`,JSON.stringify(dp0(F))),this.invalidateRecord(Q),W()}),J)try{G.close()}catch{}}).catch((K)=>{console.warn(`[${W6}] port-forward to ${Z}:${X} failed: ${EY$(K)}`,JSON.stringify(dp0(K))),this.invalidateRecord(Q),W()})}closeForwarder($){$.server.close((Z)=>{if(Z)console.warn(`[${W6}] port-forward close on :${$.localPort} errored: ${Z instanceof Error?Z.message:String(Z)}`)})}close(){if(this.closed)return;this.closed=!0,this.claimWatchAbort.abort();for(let $ of this.records.values())this.dropRecord($);this.records.clear()}}function d34($){return{active:$.createUpDownCounter("studio.sandbox.active",{description:"Active sandbox count, by runner kind, owning org, and daemon impl. Cross-checks the cAdvisor-derived count from the cluster \u2014 divergence between the two indicates orphaned claims (studio deleted but K8s didn't reap) or unattributed pods.",unit:"{sandbox}"}),ensureOutcome:$.createCounter("studio.sandbox.ensure.outcome",{description:"Outcome of each ensure() call: fresh provision, resume from state-store after restart, or adopt of a cluster-side claim studio didn't know about. Cold-start ratio is the primary input for warm-pool sizing.",unit:"{call}"}),proxyDurationMs:$.createHistogram("studio.sandbox.proxy.duration_ms",{description:"Wall-clock latency of studio-mediated requests to the sandbox daemon: tool exec proxies (source=daemon) and preview iframe traffic (source=preview).",unit:"ms"}),poolPods:$.createGauge("studio.sandbox.pool.pods",{description:"Tenant warm pool depth by pool and state: ready (warmed and unbound \u2014 what a claim can actually bind instantly), bound (serving a user), pending (unbound, not yet warmed), failed (gave up after repeated bootstrap failures). Alert on sustained ready=0: a pool that is always empty is doing nothing while costing N pods.",unit:"{pod}"})}}function dp0($){let Z=[],X=$;for(let Q=0;Q<5&&X instanceof Error;Q++){let Y=X;if(Z.push({name:Y.name,message:Y.message,...Y.code!==void 0?{code:Y.code}:{},...Y.errno!==void 0?{errno:Y.errno}:{}}),Y.cause===X)break;X=Y.cause}if(X!==void 0&&!(X instanceof Error)&&X!==null){let Q=X,Y=Q.error instanceof Error?dp0(Q.error).chain:void 0;Z.push({nonError:String(X),...typeof Q.type==="string"?{type:Q.type}:{},...typeof Q.message==="string"?{message:Q.message}:{},...Q.code!==void 0?{code:Q.code}:{},...typeof Q.reason==="string"?{reason:Q.reason}:{},...Y?{error:Y}:{},...Y===void 0&&Q.error!==void 0?{rawError:String(Q.error)}:{},keys:Object.keys(Q)})}return{chain:Z}}function m34(){let $=new Ly;return $.loadFromDefault(),$}function AY$($){return Boolean($.status?.conditions?.some((Z)=>Z.type==="Ready"&&Z.status==="True"))}function i34($){let Z=$.spec?.env;if(!Z)return null;for(let X of Z)if(X.name==="DAEMON_TOKEN"&&X.value)return X.value;return null}function p34($,Z){let X=M34("sha256").update(`${$}:${Z}`).digest();return lp0+X.readUInt32BE(0)%IY$}function hp0($,Z){return new Response(JSON.stringify(Z),{status:$,headers:{"content-type":"application/json","access-control-allow-origin":"*"}})}function TY$($){let Z=$.slice(0,t34);return n34.test(Z)?Z:""}function r34($){if($===void 0)return null;let Z=$.trim();if(Z==="")return null;if(!o34.test(Z))throw Error(`AgentSandboxProvider: envName=${JSON.stringify(Z)} is not a valid DNS-label-safe environment name (lowercase alphanumeric or '-', starts with a letter, ends alphanumeric, \u226432 chars). Studio sets this from STUDIO_ENV; check the studio chart's configMap.`);return Z}function up0($,Z={}){let X={...Z};if($){let Q=TY$($.orgId),Y=TY$($.userId);if(Q)X[sX.orgId]=Q;if(Y)X[sX.userId]=Y}return X}function pS($){let Z="";for(let X of $){let Q=X.codePointAt(0)??0;Z+=Q<32||Q===127?" ":X}return Z.slice(0,a34)}function s34($){try{let Z=new URL($);return Z.username="",Z.password="",Z.toString()}catch{return""}}function e34($){let Z={},X=$.tenant;if(X?.orgSlug)Z[f3.orgSlug]=pS(X.orgSlug);if(X?.orgName)Z[f3.orgName]=pS(X.orgName);if(X?.userEmail)Z[f3.userEmail]=pS(X.userEmail);if(X?.userName)Z[f3.userName]=pS(X.userName);let Q=$.repo;if(Q){if(Q.displayName)Z[f3.gitRepo]=pS(Q.displayName);let Y=s34(Q.cloneUrl);if(Y)Z[f3.gitRepoUrl]=pS(Y);let G=$.branch??Q.branch;if(G)Z[f3.gitBranch]=pS(G)}return Z}function $W4($){let Z=$.metadata?.labels;if(!Z)return null;let X=Z[sX.orgId],Q=Z[sX.userId];if(!X||!Q)return null;let Y=$.metadata?.annotations??{};return{orgId:X,userId:Q,orgSlug:Y[f3.orgSlug],orgName:Y[f3.orgName],userEmail:Y[f3.userEmail],userName:Y[f3.userName]}}function ZW4($,Z){if($){let X=new Date($).getTime();if(Number.isFinite(X)&&X<=Z.getTime())return null}return Z.toISOString()}function XW4($,Z){if($){let X=new Date($).getTime();if(Number.isFinite(X)&&X>=Z.getTime())return null}return Z.toISOString()}function cp0($){return{org_id:$?.orgId??"",user_id:$?.userId??"",runner_kind:tQ}}async function QW4($,Z){if(!Z||!$.tenant)return $.orgFsConfigJson;try{return await Z($.tenant)??$.orgFsConfigJson}catch(X){return console.warn(`[${W6}] org-fs credential re-mint failed: ${X instanceof Error?X.message:String(X)}`),$.orgFsConfigJson}}function YW4($){let Z={};if($.branch)Z.branch=$.branch;if($.repo)Z.repo=$.repo;if($.workload)Z.workload=$.workload;if($.env&&Object.keys($.env).length>0)Z.env=$.env;if($.tenant)Z.tenant=$.tenant;if($.cloneOnly)Z.cloneOnly=!0;if($.purpose)Z.purpose=$.purpose;if($.orgFsConfigJson)Z.orgFsConfigJson=$.orgFsConfigJson;return Object.keys(Z).length>0?Z:null}function GW4($,Z){try{return new URL(kZ0($,Z)).hostname||null}catch{return null}}var tQ="agent-sandbox",W6="AgentSandboxProvider",nS="x-sandbox-preview-not-ready",C34="agent-sandbox-system",_34="studio-sandbox",v34=300000,bF=9000,jY$=3000,gp0="/app",f34=32,b34,x34=900000,y34=60000,g34=1800000,HB0=3,zY$=1800000,h34=900000,u34=1800000,c34,PY$,lp0=40000,IY$=1e4,l34=256,sX,f3,n34,t34=63,o34,a34=253;var qY$=D(()=>{w4();$Y$();Mp0();GY$();qm0();Qn();ep();FY$();yp0();b34=new Set(["DAEMON_TOKEN","DAEMON_BOOT_ID","APP_ROOT","PROXY_PORT"]),c34=["cookie","host","connection","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","accept-encoding","content-length","upgrade"],PY$=["connection","keep-alive","transfer-encoding","content-encoding","content-length"];sX={role:"studio.decocms.com/role",sandboxHandle:"studio.decocms.com/sandbox-handle",orgId:"studio.decocms.com/org-id",userId:"studio.decocms.com/user-id",env:"studio.decocms.com/env"},f3={orgSlug:"studio.decocms.com/org-slug",orgName:"studio.decocms.com/org-name",userEmail:"studio.decocms.com/user-email",userName:"studio.decocms.com/user-name",gitRepo:"studio.decocms.com/git-repo",gitRepoUrl:"studio.decocms.com/git-repo-url",gitBranch:"studio.decocms.com/git-branch"},n34=/^([A-Za-z0-9]([-A-Za-z0-9_.]*[A-Za-z0-9])?)?$/;o34=/^[a-z]([a-z0-9-]{0,30}[a-z0-9])?$/});var MY$={};J4(MY$,{waitForSandboxReady:()=>YB0,parseTenantPools:()=>NY$,getSandboxClaim:()=>v3,getHttpRoute:()=>oQ$,deleteSandboxClaim:()=>DB,deleteHttpRoute:()=>QB0,createSandboxClaim:()=>Zn,applyHttpRoute:()=>XB0,SandboxTimeoutError:()=>mS,SandboxError:()=>I9,PREVIEW_NOT_READY_HEADER:()=>nS,KubeConfig:()=>Ly,K8S_CONSTANTS:()=>S5,HTTPROUTE_CONSTANTS:()=>Xn,AgentSandboxProvider:()=>mp0});var ip0=D(()=>{Mp0();ep();Qn();qY$();yp0()});var vY$={};J4(vY$,{subscribeLifecycle:()=>op0,getSandboxProviderByKind:()=>np0,getOrInitSharedRunner:()=>tp0,__resetSharedLifecyclesForTesting:()=>wW4});function CY$($,Z){let X=kY$[$];if(X)return Promise.resolve(X);let Q=pp0[$];if(Q)return Q;let Y=Z().then((G)=>{return kY$[$]=G,G}).finally(()=>{delete pp0[$]});return pp0[$]=Y,Y}function KW4(){let $=process.env.STUDIO_SANDBOX_PREVIEW_URL_PATTERN;return $&&$.trim()!==""?$:void 0}function HW4(){let $=process.env.STUDIO_SANDBOX_TEMPLATE_NAME;return $&&$.trim()!==""?$:void 0}function FW4(){let $=process.env.STUDIO_ENV;return $&&$.trim()!==""?$:void 0}function NW4(){let $=process.env.STUDIO_SANDBOX_SENTINEL_TOKEN;return $&&$.trim()!==""?$:void 0}function UW4(){let $=process.env.STUDIO_SANDBOX_PREVIEW_GATEWAY_NAME?.trim(),Z=process.env.STUDIO_SANDBOX_PREVIEW_GATEWAY_NAMESPACE?.trim();if(!$&&!Z)return;if(!$||!Z)throw Error("STUDIO_SANDBOX_PREVIEW_GATEWAY_NAME and STUDIO_SANDBOX_PREVIEW_GATEWAY_NAMESPACE must both be set, or both unset. Half-configured per-claim HTTPRoute routing would silently fail to attach.");return{name:$,namespace:Z}}async function _Y$($,Z){let X=new kp(Z),Q=KW4();switch($){case"agent-sandbox":{let{AgentSandboxProvider:Y,parseTenantPools:G}=await Promise.resolve().then(() => (ip0(),MY$)),J=new MY(b0().encryptionKey);return new Y({stateStore:X,previewUrlPattern:Q,sandboxTemplateName:HW4(),envName:FW4(),previewGateway:UW4(),sentinelToken:NW4(),tenantPools:G(process.env.STUDIO_SANDBOX_TENANT_POOLS),meter:L$,mintCloneUrl:async(W,K)=>{if(!W.connectionId)return null;let H=O6$(W.cloneUrl);if(!H)return null;let{cloneUrl:F}=await QB(W.connectionId,H.owner,H.name,Z,J,{bufferMs:K?.bufferMs});return F},mintOrgFsConfig:async(W)=>{if(!W.orgSlug)return null;return await yZ0({boundAuth:{apiKey:{create:(H)=>F8.api.createApiKey({body:{...H,userId:W.userId}})}},storage:{orgRepoSyncs:new wE(Z)}},{orgSlug:W.orgSlug,orgId:W.orgId,baseUrl:b9()})??null}})}case"user-desktop":throw Error("user-desktop provider cannot be instantiated without a per-run link claim \u2014 call resolveSandboxProvider, which binds the link before constructing the provider.");default:throw Error(`Unknown sandbox provider kind: ${String($)}`)}}function np0($,Z){return CY$(Z,()=>_Y$(Z,$.db))}async function tp0(){let $;try{$=DE()}catch(X){return console.warn("[lifecycle] cannot resolve sandbox runner:",X instanceof Error?X.message:String(X)),null}return await CY$($,()=>_Y$($,l8().db))}function op0($,Z,X){let Q=LB.get(Z);if(Q){if(Q.terminated){if(Q.lastPhase)try{X(Q.lastPhase)}catch{}return{unsubscribe:DW4}}if(Q.listeners.add(X),Q.lastPhase)try{X(Q.lastPhase)}catch{}return VY$(Z,Q,X)}let Y=new AbortController,G={lastPhase:null,terminated:!1,listeners:new Set([X]),abort:Y};return LB.set(Z,G),LW4($,Z,G),VY$(Z,G,X)}function DW4(){}function VY$($,Z,X){return{unsubscribe(){if(LB.get($)!==Z)return;if(Z.listeners.delete(X),Z.listeners.size===0)LB.delete($),Z.abort.abort()}}}async function LW4($,Z,X){let Q=null;try{for await(let Y of $.watchClaimLifecycle(Z,X.abort.signal)){if(X.abort.signal.aborted)break;X.lastPhase=Y;let G=Y.kind==="ready"||Y.kind==="failed";if(G)X.terminated=!0;let J=Array.from(X.listeners);for(let W of J)try{W(Y)}catch{}if(G)break}}catch(Y){Q=Y}finally{if(!X.terminated&&!X.abort.signal.aborted&&X.listeners.size>0){let Y={kind:"failed",reason:"unknown",message:Q instanceof Error?Q.message:"Lifecycle watcher ended unexpectedly"};X.lastPhase=Y,X.terminated=!0;for(let G of Array.from(X.listeners))try{G(Y)}catch{}}if(LB.get(Z)===X)LB.delete(Z)}}function wW4(){for(let $ of LB.values())$.abort.abort();LB.clear()}var JW4,WW4,SY$,kY$,pp0,OW4,BW4,LB;var Gn=D(()=>{kF();gG();I6();Vm0();Yy();yL();q$();Gy();gY();L9();JW4=Symbol.for("decocms.sandbox.lifecycle.runners"),WW4=Symbol.for("decocms.sandbox.lifecycle.inflight"),SY$=globalThis,kY$=SY$[JW4]??={},pp0=SY$[WW4]??={};OW4=Symbol.for("decocms.sandbox.lifecycle.shared-lifecycles"),BW4=globalThis,LB=BW4[OW4]??=new Map});async function gZ($,Z){let{userId:X,branch:Q,virtualMcpMetadata:Y,explicitKind:G}=Z;if(G)return Jn($,G);if($.sandboxPreference==="agent-sandbox")return Jn($,"agent-sandbox");if($.sandboxPreference==="cluster-default")return Jn($,DE());let[J,...W]=EW4(Y,X,Q);if(J)return Jn($,W.length===0?J:jW4(J,W));return Jn($,fY$())}function EW4($,Z,X){let Q=c5($)[Z]?.[X];if(!Q)return[];let Y=Z3(Q);return Object.keys(Y)}function jW4($,Z){let X=fY$();if(X===$||Z.includes(X))return X;return $}function fY$(){return DE()}async function Jn($,Z){let X=Z==="user-desktop"?"agent-sandbox":Z;return{provider:await np0($,X),kind:X}}var xF=D(()=>{P8();kF();lQ();Gn()});var Wn;var rp0=D(()=>{Wn={npm:{install:"npm install",run:($)=>`npm run ${$}`,runtime:"node"},pnpm:{install:"pnpm install",run:($)=>`pnpm run ${$}`,runtime:"node"},yarn:{install:"yarn install",run:($)=>`yarn run ${$}`,runtime:"node"},bun:{install:"bun install",run:($)=>`bun run ${$}`,runtime:"bun"},deno:{install:"deno install",run:($)=>`deno task ${$}`,runtime:"deno"}}});function yF($,Z){return Z?`thread:${$}/${Z}`:`thread:${$}`}function gF($){return`sandbox/thread-${$.replace(/^thread:/,"").replace(/\//g,"-")}`}function b3($){if(!$||!$.startsWith("thread:"))return null;return $.slice(7).split("/")[0]||null}async function tS($,Z,X){return sp0(await ap0($,Z),X)}async function ap0($,Z){let X=b3(Z);if(!X)return null;return await $.storage.threads.get(X).catch(()=>null)}function sp0($,Z){return $?.created_by??Z}async function oS($,Z){if(!Z)return null;let X=await $.storage.threads.get(Z).catch(()=>null);if(!X)return null;return X.metadata??{}}async function bY$($,Z){let Q=(await oS($,Z))?.headRef;return typeof Q==="string"&&Q.length>0?Q:null}async function xY$($,Z,X){let Q=await oS($,Z);if(!Q)return;if(Q.headRef===X)return;await $.storage.threads.update(Z,{metadata:{...Q,headRef:X}}).catch((Y)=>console.warn("[thread-repo] setThreadHeadRef failed",Y))}function zW4($,Z){let X=g90(Z,$.owner,$.name);if(!X||X.id===$.connectionId)return null;let Q=q5(X);return{...$,connectionId:X.id,...Q?.installationId?{installationId:Q.installationId}:{}}}async function wB($,Z){let X=await oS($,Z),Q=X?.githubRepo??null;if(!Z||!X||!Q?.connectionId)return Q;try{let Y=$.storage.threads.getOrganizationId();if(!Y)return Q;if(await $.storage.connections.findById(Q.connectionId,Y))return Q;let{items:G}=await $.storage.connections.list(Y),J=zW4(Q,G);if(!J)return Q;return await $.storage.threads.update(Z,{metadata:{...X,githubRepo:J}}),console.warn("[thread-repo] re-pointed thread at a live repo connection",{threadId:Z,from:Q.connectionId,to:J.connectionId}),J}catch(Y){return console.warn("[thread-repo] repoint check failed",Y),Q}}function ep0($){if($.pinnedRef)return $.pinnedRef;if($.runBranch&&$.runBranch===yF($.threadId))return $.runBranch;if($.threadRepo)return yF($.threadId,$.threadRepo.connectionId);if(!$.agentRepo)return"ephemeral";return $.runBranch??`thread:${$.threadId}`}async function $n0($,Z){let Q=(await oS($,Z))?.pinnedRef;return typeof Q==="string"&&Q.length>0?Q:null}async function FB0($,Z){let[X,Q]=await Promise.all([wB($,Z.threadId),$n0($,Z.threadId)]);return ep0({...Z,threadRepo:X,pinnedRef:Q})}async function yY$($,Z,X,Q,Y,G){let J=await oS($,Z);if(!J)return;let W=Mp(c5(J),X,Q,Y,G);await $.storage.threads.update(Z,{metadata:{...J,sandboxMap:W}}).catch((K)=>console.warn("[thread-repo] setThreadSandboxMapEntry failed",K))}async function NB0($,Z){return c5(await oS($,Z))}async function gY$($,Z,X,Q,Y){let G=await oS($,Z);if(!G)return;let J=km0(c5(G),X,Q,Y);if(!J)return;await $.storage.threads.update(Z,{metadata:{...G,sandboxMap:J}}).catch((W)=>console.warn("[thread-repo] removeThreadSandboxMapEntry failed",W))}var x3=D(()=>{VQ();lQ()});function Ay($){if(!$)return null;let Z=$.runtime;if(!Z||typeof Z!=="object")return null;let X=Z.env;if(!Array.isArray(X))return null;let Q=[];for(let Y of X){if(!Y||typeof Y!=="object")continue;let G=Y;if(typeof G.key!=="string"||!s$0.test(G.key))continue;if(G.kind==="literal"&&typeof G.value==="string"){Q.push({key:G.key,kind:"literal",value:G.value});continue}if(G.kind==="secret"&&typeof G.secretId==="string"&&G.secretId.length>0)Q.push({key:G.key,kind:"secret",secretId:G.secretId})}return Q.length===0?null:Q}function hY$($){if(!$)return null;let Z=$.runtime;if(!Z||typeof Z!=="object")return null;let X=Z.submoduleCredentials;if(!Array.isArray(X))return null;let Q=[];for(let Y of X){if(!Y||typeof Y!=="object")continue;let G=Y;if(typeof G.host==="string"&&G.host.length>0&&typeof G.secretId==="string"&&G.secretId.length>0)Q.push({host:G.host,secretId:G.secretId})}return Q}async function uY$($,Z){r(Z);let X=t(Z);await Z.access.check();let Q=Y1(Z);if(!Q)throw Error("User ID required");let Y=await Z.storage.virtualMcps.findById($.virtualMcpId);if(!Y||Y.organization_id!==X.id)throw Error("Virtual MCP not found");let G=Y.metadata??{},J=c5(G),W=await tS(Z,$.branch,Q),K=EK(J,W,$.branch,$.sandboxProviderKind);return{virtualMcp:Y,metadata:G,userId:Q,sandboxUserId:W,entry:K,organization:X}}function PW4($){if($===null||!/^\d+$/.test($))return null;let Z=Number($);return Z>=1&&Z<=65535?$:null}function cY$($){let Z=$.runtime??null,Q=Z?.selected??null,Y=PW4(Z?.port??null),G=Z?.path??null;if(!Q||!(Q in Wn))return{packageManager:null,runtime:null,port:Y,packageManagerPath:G,runtimeBinPath:null};let J=Wn[Q].runtime;return{packageManager:Q,runtime:J,port:Y,packageManagerPath:G,runtimeBinPath:J==="deno"?"/opt/deno/bin":J==="bun"?"/opt/bun/bin":null}}var Kn=D(()=>{P8();rp0();lQ();x3()});import{sql as AW4}from"kysely";function lY$($){return $ instanceof Date?$.toISOString():String($)}class Zn0{db;vault;constructor($,Z){this.db=$;this.vault=Z}rowToInfo($){return{id:$.id,organizationId:$.organization_id,scope:$.scope,userId:$.user_id,name:$.name,description:$.description,createdBy:$.created_by,createdAt:lY$($.created_at),updatedBy:$.updated_by,updatedAt:lY$($.updated_at)}}assertVisible($,Z){if($.scope==="user"&&$.user_id!==Z)throw new EB($.id)}async create($){let Z=t8("sec"),X=await this.vault.encrypt($.value),Q=new Date,Y=await this.db.insertInto("secrets").values({id:Z,organization_id:$.organizationId,scope:$.scope.kind,user_id:$.scope.kind==="user"?$.scope.userId:null,name:$.name,encrypted_value:X,description:$.description??null,created_by:$.createdBy,created_at:Q,updated_by:$.createdBy,updated_at:Q}).returning(UB0).executeTakeFirstOrThrow();return this.rowToInfo(Y)}async update($){let Z=await this.db.selectFrom("secrets").where("id","=",$.id).where("organization_id","=",$.organizationId).select(["id","scope","user_id"]).executeTakeFirst();if(!Z)throw new sG($.id);this.assertVisible(Z,$.callerUserId);let X={updated_by:$.updatedBy,updated_at:new Date};if($.value!==void 0)X.encrypted_value=await this.vault.encrypt($.value);if($.description!==void 0)X.description=$.description;let Q=await this.db.updateTable("secrets").set(X).where("id","=",$.id).where("organization_id","=",$.organizationId).returning(UB0).executeTakeFirstOrThrow();return this.rowToInfo(Q)}async delete($,Z,X){let Q=await this.db.selectFrom("secrets").where("id","=",$).where("organization_id","=",Z).select(["id","scope","user_id"]).executeTakeFirst();if(!Q)throw new sG($);this.assertVisible(Q,X),await this.db.deleteFrom("secrets").where("id","=",$).where("organization_id","=",Z).execute()}async list($){let Z=this.db.selectFrom("secrets").where("organization_id","=",$.organizationId).select(UB0);if($.scope?.kind==="user")Z=Z.where("scope","=","user").where("user_id","=",$.scope.userId);else if($.scope?.kind==="organization")Z=Z.where("scope","=","organization");else Z=Z.where((Q)=>Q.or([Q("scope","=","organization"),Q.and([Q("scope","=","user"),Q("user_id","=",$.callerUserId)])]));return(await Z.orderBy("created_at","desc").execute()).map((Q)=>this.rowToInfo(Q))}async findById($,Z,X){let Q=await this.db.selectFrom("secrets").where("id","=",$).where("organization_id","=",Z).select(UB0).executeTakeFirst();if(!Q)throw new sG($);return this.assertVisible(Q,X),this.rowToInfo(Q)}async resolveById($,Z,X){let Q=await this.db.selectFrom("secrets").where("id","=",$).where("organization_id","=",Z).selectAll().executeTakeFirst();if(!Q)throw new sG($);this.assertVisible(Q,X);let Y=await this.vault.decrypt(Q.encrypted_value);return{info:this.rowToInfo(Q),value:Y}}async resolveByName($){let Z=this.db.selectFrom("secrets").where("organization_id","=",$.organizationId).where("scope","=",$.scope.kind).where(AW4`lower(name) = lower(${$.name})`).selectAll();if($.scope.kind==="user")Z=Z.where("user_id","=",$.scope.userId);let X=await Z.executeTakeFirst();if(!X)throw new sG(`${$.scope.kind}:${$.name}`);let Q=await this.vault.decrypt(X.encrypted_value);return{info:this.rowToInfo(X),value:Q}}}var UB0,sG,EB;var Hn=D(()=>{gX();UB0=["id","organization_id","scope","user_id","name","description","created_by","created_at","updated_by","updated_at"];sG=class sG extends Error{constructor($){super(`Secret ${$} not found`);this.name="SecretNotFoundError"}};EB=class EB extends Error{constructor($){super(`Access denied for secret ${$}`);this.name="SecretAccessDeniedError"}}});async function jB($,Z){let X=$.body?.getReader();if(!X)return $.text();let Q=new TextDecoder,Y="",G=0;for(;;){let{done:J,value:W}=await X.read();if(J)break;if(G+=W.byteLength,G>Z)throw await X.cancel().catch(()=>{}),new dY$(`Upstream response exceeded ${Z} bytes`);Y+=Q.decode(W,{stream:!0})}return Y+=Q.decode(),Y}var dY$;var Fn=D(()=>{dY$=class dY$ extends Error{}});async function OB0({ctx:$,runner:Z,handle:X,orgId:Q,userId:Y,entries:G}){if(!G||G.length===0)return;let J={};for(let K of G){if(K.kind==="literal"){J[K.key]=K.value;continue}try{let{value:H}=await $.storage.secrets.resolveById(K.secretId,Q,Y);J[K.key]=H}catch(H){if(H instanceof sG||H instanceof EB){console.warn(`[SANDBOX_START] skipping env ${K.key}: ${H.message}. Re-link or recreate the secret to restore.`);continue}throw H}}if(Object.keys(J).length===0)return;let W=await Z.proxyDaemonRequest(X,"/_sandbox/config",{method:"PUT",headers:new Headers({"content-type":"application/json"}),body:JSON.stringify({env:J})});if(!W.ok){let K=await jB(W,TW4).catch(()=>W.statusText);console.warn(`[SANDBOX_START] daemon rejected env patch (${W.status}): ${K}`)}}var TW4=10485760;var Xn0=D(()=>{Hn();Fn()});async function mY$({ctx:$,orgId:Z,userId:X,entries:Q}){if(!Q||Q.length===0)return[];let Y=[];for(let G of Q)try{let{value:J}=await $.storage.secrets.resolveById(G.secretId,Z,X);Y.push({host:G.host,token:J})}catch(J){if(J instanceof sG||J instanceof EB){console.warn(`[SANDBOX_START] skipping submodule credential for ${G.host}: ${J.message}. Re-link or recreate the secret to restore.`);continue}throw J}return Y}var iY$=D(()=>{Hn()});async function tY$($,Z,X,Q,Y){let G=await mY({connectionId:$,tokenStorage:new l6(Q,Y)});if(!G.accessToken)return null;return rY$(Z,X,G.accessToken)}function oY$($,Z){return rY$($,Z,null)}async function rY$($,Z,X){let Q=new Map,Y=new Set(pY$.map((K)=>K.path));for(let K of Object.values(nY$))for(let H of K??[])Y.add(H);await Promise.all(Array.from(Y).map(async(K)=>{Q.set(K,await IW4($,Z,K,X))}));let G=pY$.find(({path:K})=>Q.get(K)!==null);if(!G)return null;let J=nY$[G.pm]??[],W=null;for(let K of J)if(W=qW4(Q.get(K)??null),W)break;return{packageManager:G.pm,devPort:W}}async function IW4($,Z,X,Q){let Y=`https://api.github.com/repos/${$}/${Z}/contents/${encodeURIComponent(X)}`;try{let G={Accept:"application/vnd.github+json","User-Agent":"studio-runtime-detect"};if(Q)G.Authorization=`token ${Q}`;let J=await fetch(Y,{headers:G,signal:AbortSignal.timeout(5000)});if(!J.ok)return null;let W=await J.json();if(!W.content||W.encoding!=="base64")return null;return Buffer.from(W.content,"base64").toString("utf8")}catch{return null}}function qW4($){if(!$)return null;try{let Z=JSON.parse($),X=Z.tasks??Z.scripts??{},Y=(X.dev??X.start??"").match(RW4)?.[1]??null;if(!Y)return null;let G=Number(Y);return G>=1&&G<=65535?Y:null}catch{return null}}var pY$,nY$,RW4;var aY$=D(()=>{oG();dG();pY$=[{path:"deno.json",pm:"deno"},{path:"deno.jsonc",pm:"deno"},{path:"bun.lock",pm:"bun"},{path:"bunfig.toml",pm:"bun"},{path:"pnpm-lock.yaml",pm:"pnpm"},{path:"yarn.lock",pm:"yarn"},{path:"package-lock.json",pm:"npm"},{path:"package.json",pm:"bun"}],nY$={deno:["deno.json","deno.jsonc"],bun:["package.json"],pnpm:["package.json"],yarn:["package.json"],npm:["package.json"]},RW4=/(?:--port|PORT=|:)(\d{4,5})/});function MW4($){return($??"").normalize("NFKD").replace(/[\u0300-\u036F]/g,"").toLowerCase().replace(/[^a-z0-9]+/g,"-").replace(/^-+|-+$/g,"")||"user"}function BB0($){return $?.name||$?.email?.split("@")[0]||void 0}function DB0($){let Z=MW4($),X=Date.now().toString(36).split("").reverse().join("");return`${Z}-${X}`}async function Nn($,Z,X){try{await $.storage.threads.stampRuntimeIfAbsent(Z,X)}catch(Q){console.warn(`[stampRuntimeIfAbsent] ${Z}: ${Q instanceof Error?Q.message:String(Q)}`)}}function sY$($){let Z=$?.trim();if(!Z)return null;try{let X=new URL(Z);if(X.protocol!=="http:"&&X.protocol!=="https:")return null;return X.href}catch{return null}}function LB0($){return sY$($?.previewServerUrl)??sY$($?.productionUrl)}function rS($){return $==="cms"||$==="sandbox"?$:null}function kW4($){return!!LB0($)&&$?.fastPreview===!0}function wB0($){return kW4($)?"cms":"sandbox"}var Qn0;var Ty=D(()=>{Qn0=["cms","sandbox"]});function eY$($){let{current:Z,detached:X,base:Q}=$.status??{};if(typeof Z!=="string"||Z.length===0)return null;if(X===!0)return null;if(Z===$.requestedRef)return null;if(VW4.has(Z))return null;if(typeof Q==="string"&&Q.length>0&&Z===Q)return null;return Z}function EB0($){if(!$.branch.startsWith("thread:"))return $.branch;if($.sticky&&$.recordedHeadRef)return $.recordedHeadRef;return $.derivedRef}var VW4;var jB0=D(()=>{VW4=new Set(["main","master","trunk","develop","HEAD"])});async function $G$($,Z){if(!$)return{hosts:[],allowSameHostDev:!1};let X;try{X=await $.presignedGetUrl("link-dispatch/_allowlist_probe",60,{requireFetchable:!0})}catch{return{hosts:[],allowSameHostDev:!1}}let Q;try{Q=new URL(X)}catch{return{hosts:[],allowSameHostDev:!1}}if(Q.protocol!=="https:"&&Q.protocol!=="http:")return{hosts:[],allowSameHostDev:!1};let Y=Q.hostname,G=SW4.has(Y);return{hosts:[Y],allowSameHostDev:G&&!Z.isProduction}}var SW4;var ZG$=D(()=>{SW4=new Set(["127.0.0.1","localhost","::1","[::1]","0.0.0.0"])});import{z as y3}from"zod";async function Ry($,Z){r(Z);let X=t(Z),Q=Y1(Z);if(!Q)throw Error("User ID required");let Y=await Z.storage.virtualMcps.findById($.virtualMcpId);if(!Y||Y.organization_id!==X.id)throw Error("Virtual MCP not found");let G=Y.metadata??{},J=await tS(Z,$.branch,Q),W=EK(c5(G),J,$.branch,$.sandboxProviderKind),K=$.sandboxProviderKind,{provider:H}=await gZ(Z,{userId:J,branch:$.branch,virtualMcpMetadata:G,explicitKind:K});if(W){if(await H.alive(W.sandboxHandle).catch(()=>!0))return W;await ZB(Z.storage.virtualMcps,$.virtualMcpId,Q,J,$.branch,K).catch((L)=>{console.warn("[ensureSandbox] failed to reap stale entry",L)})}let F=b3($.branch)??Z.metadata?.threadId;if(F)Nn(Z,F,"sandbox");let U=await wB(Z,F)??G.githubRepo??null,{entry:O}=await QG$({ctx:Z,userId:Q,sandboxUserId:J,orgId:X.id,virtualMcpId:$.virtualMcpId,branch:$.branch,metadata:G,githubRepo:U,existing:null,providerKind:K,runner:H,...$.purpose?{purpose:$.purpose}:{}});return O}async function QG$($){let{ctx:Z,userId:X,sandboxUserId:Q,orgId:Y,virtualMcpId:G,branch:J,metadata:W,existing:K,runner:H,purpose:F}=$,N=F==="harness-run",U=$.githubRepo?await _W4({ctx:Z,orgId:Y,virtualMcpId:G,userId:X,githubRepo:$.githubRepo}):null,{runtime:O,packageManager:B,port:L,packageManagerPath:w}=cY$(W),E;if(U){if(U.connectionId)await XB({ctx:Z,connectionId:U.connectionId,organizationId:Y,forceRefresh:!0,onLegacyMintError:(x0)=>{console.error("[provisionSandbox] repo-scoped legacy token mint failed",{connectionId:U.connectionId,error:x0.message})}});let{cloneUrl:L0,gitUserName:e,gitUserEmail:o}=U.connectionId?await QB(U.connectionId,U.owner,U.name,Z.db,Z.vault):U6$(U.owner,U.name);if(!B){let x0=U.connectionId?await tY$(U.connectionId,U.owner,U.name,Z.db,Z.vault):await oY$(U.owner,U.name);if(x0)B=x0.packageManager,O=Wn[x0.packageManager].runtime,L=x0.devPort??L,await vW4(Z,G,X,x0.packageManager,x0.devPort)}let j0=b0().sandboxStickyHeadRefEnabled,X0=EB0({branch:J,derivedRef:gF(J),recordedHeadRef:j0?await bY$(Z,b3(J)):null,sticky:j0}),P0=await mY$({ctx:Z,orgId:Y,userId:X,entries:hY$(W)});E={cloneUrl:L0,...U.connectionId?{connectionId:U.connectionId}:{},userName:e,userEmail:o,branch:X0,displayName:`${U.owner}/${U.name}`,submoduleCredentials:P0}}let j=O&&B&&!N?{runtime:O,packageManager:B,...L!==null?{devPort:Number(L)}:{},...w?{packageManagerPath:w}:{}}:void 0,z=Ip({orgId:Y,virtualMcpId:G,branch:J}),A=H.kind==="user-desktop"?await $G$(Z.objectStorage,{isProduction:b0().nodeEnv==="production"}):null,P=(H.kind==="user-desktop"||H.kind==="agent-sandbox")&&!b0().orgFsMountsDisabled,I;if(P){let L0=Z.organization?.slug??(await Z.db.selectFrom("organization").select(["slug"]).where("id","=",Y).executeTakeFirst())?.slug;if(L0)I=await yZ0(Z,{orgSlug:L0,orgId:Y,baseUrl:b9()})}await bW4(H);let q=await H.ensure({userId:Q,projectRef:z},{branch:J,repo:E,workload:j,cloneOnly:N,...F?{purpose:F}:{},tenant:{orgId:Y,userId:Q,...Z.organization?.slug?{orgSlug:Z.organization.slug}:{},...Z.organization?.name?{orgName:Z.organization.name}:{},...Z.auth.user?.email?{userEmail:Z.auth.user.email}:{},...Z.auth.user?.name?{userName:Z.auth.user.name}:{}},...A?{offloadAllowedHosts:A.hosts,offloadAllowSameHostDev:A.allowSameHostDev}:{},...I?{orgFsConfigJson:I}:{}}),M=Ay(W);await OB0({ctx:Z,runner:H,handle:q.handle,orgId:Y,userId:X,entries:M});let l=!!K&&K.sandboxHandle===q.handle&&K?.createdAt?K.createdAt:Date.now(),f=W.runtime?.selected??null,x=W.runtime?.port??null,n=W.runtime?.path??null,u={sandboxHandle:q.handle,previewUrl:q.previewUrl,sandboxApiUrl:q.previewUrl,sandboxProviderKind:H.kind,createdAt:l,startedWith:{packageManager:f,port:x,path:n}};await Z6$(Z.storage.virtualMcps,G,X,Q,J,$.providerKind,u);let a=b3(J)??Z.metadata?.threadId;if(a)await yY$(Z,a,Q,J,$.providerKind,u);let O0=!K||K.sandboxHandle!==q.handle;return{entry:u,isNewVm:O0}}async function _W4($){let{ctx:Z,orgId:X,virtualMcpId:Q,userId:Y,githubRepo:G}=$;if(!G.connectionId)return G;if(await Z.storage.connections.findById(G.connectionId,X))return G;let{items:W}=await Z.storage.connections.list(X),K=g90(W,G.owner,G.name);if(!K)return console.warn("[provisionSandbox] recorded repo connection no longer exists and no live connection covers the repo",{virtualMcpId:Q,connectionId:G.connectionId}),G;console.warn("[provisionSandbox] healed dangling repo connection",{virtualMcpId:Q,staleConnectionId:G.connectionId,connectionId:K.id});try{let F=(await Z.storage.virtualMcps.findById(Q))?.metadata??{},N=F.githubRepo;if(N?.connectionId===G.connectionId){let U=q5(K);await Z.storage.virtualMcps.update(Q,Y,{metadata:{...F,githubRepo:{...N,connectionId:K.id,...U?{installationId:U.installationId}:{}}}})}}catch(H){console.warn("[provisionSandbox] failed to persist healed repo connection",{virtualMcpId:Q,error:H.message})}return{...G,connectionId:K.id}}async function vW4($,Z,X,Q,Y){let G=await $.storage.virtualMcps.findById(Z);if(!G)return;let J=G.metadata??{};await $.storage.virtualMcps.update(Z,X,{metadata:{...J,runtime:{selected:Q,port:Y}}})}async function bW4($){if(!$.hasSchedulableCapacity)return;let Z=Date.now()+XG$,X=!1;while(!await $.hasSchedulableCapacity()){if(Date.now()>=Z)throw Error(`sandbox provisioning failed: the cluster has had no room to schedule another sandbox for ${Math.round(XG$/1000)}s`);if(!X)X=!0,console.warn("[ensureSandbox] waiting for cluster capacity \u2014 a sandbox pod cannot be scheduled right now");await D$(fW4)}}var CW4,Yn0,XG$=150000,fW4=5000;var Un=D(()=>{kF();w4();S0();Kn();Xn0();iY$();lQ();VQ();Yy();aY$();rp0();xF();Ty();x3();jB0();ZG$();q$();L9();Gy();lQ();CW4=y3.enum(["agent-sandbox","user-desktop","cluster"]),Yn0=c({name:"SANDBOX_START",description:"Start a sandbox with the connected GitHub repo and dev server.",annotations:{title:"Start VM Preview",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!1,openWorldHint:!0},_meta:{ui:{visibility:"app"}},inputSchema:y3.object({virtualMcpId:y3.string().describe("Virtual MCP ID"),branch:y3.string().min(1).optional().describe("Git branch to check out. Pass the thread's branch whenever the caller has one: when omitted the handler mints a fresh `<user-slug>-<timestamp>` name, which becomes a SEPARATE sandbox from the one the thread's own branch resolves to. The resolved branch is returned in the response so callers can persist it."),sandboxProviderKind:CW4.optional().describe("Explicit runtime choice. Hosted provider is `agent-sandbox`; legacy `cluster` input is accepted only for compatibility and normalized to `agent-sandbox`. When omitted, defaults to `user-desktop` if the acting user's link daemon is online, else the env kind."),threadId:y3.string().optional().describe("The session asking for a sandbox. A thread stamped `cms` is refused \u2014 that session reads and writes over the decofile API and a pod would be invisible to it. Optional: an unstamped (legacy) thread is always allowed, and so is a caller with no thread.")}),outputSchema:y3.object({previewUrl:y3.string().nullable(),sandboxHandle:y3.string(),branch:y3.string(),isNewVm:y3.boolean(),sandboxProviderKind:y3.enum(["agent-sandbox","user-desktop"])}),handler:async($,Z)=>{r(Z);let X=t(Z);await Z.access.check();let Q=$.branch??DB0(BB0(Z.auth.user)),Y=b3(Q)??$.threadId??Z.metadata?.threadId;if(Y){let E=await Z.storage.threads.get(Y).catch(()=>null);if(rS(E?.metadata?.runtime)==="cms")throw Error("This chat is a CMS session and does not use a sandbox. Start a coding session to get one.")}let G=Y1(Z);if(!G)throw Error("User ID required");let J=await tS(Z,Q,G),W=await Z.storage.virtualMcps.findById($.virtualMcpId);if(!W||W.organization_id!==X.id)throw Error("Virtual MCP not found");let K=W.metadata??{},H=$.sandboxProviderKind?OE($.sandboxProviderKind):void 0,{provider:F,kind:N}=await gZ(Z,{userId:J,branch:Q,virtualMcpMetadata:K,explicitKind:H}),U=EK(c5(K),J,Q,N),B=await wB(Z,b3(Q)??Z.metadata?.threadId)??K.githubRepo??null,{entry:L,isNewVm:w}=await QG$({ctx:Z,userId:G,sandboxUserId:J,orgId:X.id,virtualMcpId:$.virtualMcpId,branch:Q,metadata:K,githubRepo:B,existing:U,providerKind:N,runner:F});if(Y)Nn(Z,Y,"sandbox");return{...L,branch:Q,isNewVm:w,sandboxProviderKind:N}}})});function xW4($){let{publicUrl:Z,agentId:X,organization:Q,target:Y,threadId:G}=$;if(Y==="agent-tools")return`${Z}/mcp/virtual-mcp/${X}`;if(!Q.slug)throw new GG$(Q.id);if(Y==="task-run"){if(!G)throw Error("a task-run MCP endpoint is scoped to a run: threadId is required");return`${Z}/api/${Q.slug}/mcp/task-run/${encodeURIComponent(G)}`}return`${Z}/api/${Q.slug}/mcp/self`}async function zB0($,Z,X,Q,Y="agent-tools",G,J={"*":["*"]}){let W=xW4({publicUrl:b9(),agentId:Z,organization:X,target:Y,...G?{threadId:G}:{}}),K=await $.boundAuth.apiKey.create({name:Q,permissions:J,expiresIn:YG$,metadata:{organization:{id:X.id,slug:X.slug,name:X.name}}});return{url:W,headers:{Authorization:`Bearer ${K.key}`,"x-org-id":X.id},expiresAt:Date.now()+YG$*1000}}function JG$($){let{publicUrl:Z,organizationSlug:X,headers:Q,connections:Y}=$,G=new Set;return Y.map((J)=>{let W=yW4(J.slug??J.title??"")||"mcp",K=W;for(let H=2;G.has(K);H++)K=`${W}-${H}`;return G.add(K),{name:K,url:`${Z}/api/${X}/mcp/${encodeURIComponent(J.id)}`,headers:Q}})}function yW4($){return $.toLowerCase().replace(/[^a-z0-9]+/g,"-").replace(/^-+|-+$/g,"")}function WG$($){return{self:[...$.toolNames],...$.grants}}var YG$=3600,GG$;var Gn0=D(()=>{L9();GG$=class GG$ extends Error{constructor($){super(`cannot mint a management MCP endpoint for organization "${$}": the org-scoped path /api/<slug>/mcp/self needs the org slug, which was not loaded.`);this.name="MissingOrganizationSlugError"}}});async function gW4($,Z,X,Q){try{let Y=$.organization;if(!Y)return;let G=await zB0($,Q.virtualMcpId,Y,"tool-scripting"),J=await Z.proxyDaemonRequest(X,"/_sandbox/tools/sync",{method:"POST",headers:new Headers({"content-type":"application/json"}),body:JSON.stringify(G)});if(!J.ok)console.warn("[cluster-sandbox-fs] tools/sync failed",J.status,await J.text().catch(()=>""))}catch(Y){console.warn("[cluster-sandbox-fs] tools/sync failed",Y)}}async function Iy($,Z){let{provider:X,kind:Q}=await gZ($,{userId:Z.userId,branch:Z.branch,virtualMcpMetadata:null}),Y=null,G=()=>{if(!Y){if(Y=Ry({virtualMcpId:Z.virtualMcpId,branch:Z.branch,sandboxProviderKind:Q},$).then((K)=>K.sandboxHandle),Y.catch(()=>{Y=null}),Z.syncTools)Y.then((K)=>gW4($,X,K,{virtualMcpId:Z.virtualMcpId,providerKind:Q})).catch(()=>{})}return Y},J=Z.branch==="ephemeral"||Q==="user-desktop";return Mm0(X,{ensureHandle:G,invalidateHandle:async(K)=>{let H=Y;if(Y=null,!J&&!K?.force)return;try{await ZB($.storage.virtualMcps,Z.virtualMcpId,Z.userId,Z.userId,Z.branch,Q)}catch(F){console.warn("[cluster-sandbox-fs] failed to reap vmMap entry",F)}if(H&&typeof X.forgetHandle==="function")try{let F=await H;await X.forgetHandle(F)}catch(F){console.warn("[cluster-sandbox-fs] forgetHandle failed",F)}},canAutoRestart:J,threadId:Z.threadId})}async function KG$($,Z){try{let X=await Iy($,Z),{stdout:Q}=await X.onBash("test -d .deco && echo __DECO_SITE__");return Q.includes("__DECO_SITE__")}catch(X){return console.warn("[cluster-sandbox-fs] .deco probe failed; assuming deco site",X),!0}}var PB0=D(()=>{kF();Gn0();xF();Un();lQ()});import{z as HG$}from"zod";function qy($){let Z=[];for(let X of $){if(X.status!=="active")continue;let Q=q5(X);if(!Q)continue;Z.push({connectionId:X.id,owner:Q.owner,repo:Q.repo,installationId:Q.installationId})}return Z}async function uW4($,Z){let{items:X}=await $.storage.connections.list(Z,{slug:"mcp-github"});return qy(X)}function cW4($){let Z=$.split(`
+`))>=0){let K=Q.slice(0,W).trim();if(Q=Q.slice(W+1),!K)continue;yield JSON.parse(K)}}let Y=Q.trim();if(Y)yield JSON.parse(Y)}finally{Z.releaseLock()}}var uQ$,eO0,pQ$="gateway.networking.k8s.io",nQ$="v1",tQ$="httproutes",N34,Xn,rQ$="mesh-sandbox-runner";var Qn=D(()=>{w4();ep();uQ$=class uQ$ extends Error{status;body;constructor($,Z,X){super(X);this.status=$;this.body=Z;this.name="KubeHttpError"}};eO0=`/apis/${S5.CLAIM_API_GROUP}/${S5.CLAIM_API_VERSION}/namespaces`;N34=`/apis/${pQ$}/${nQ$}/namespaces`;Xn={API_GROUP:pQ$,API_VERSION:nQ$,PLURAL:tQ$}});function O34($){return($.items??[]).some((Z)=>{if(Z.status?.phase!=="Pending")return!1;return(Z.status?.conditions??[]).some((X)=>X.type==="PodScheduled"&&X.status==="False"&&X.reason==="Unschedulable")})}function eQ$($,Z){let X=0,Q=!0,Y=null,G=async()=>{try{let J=await tY($,{method:"GET",path:`/api/v1/namespaces/${encodeURIComponent(Z)}/pods?fieldSelector=status.phase%3DPending`});if(!J.ok)return sQ$;let W=await J.json();return!O34(W)}catch{return sQ$}};return async()=>{if(Date.now()-X<U34)return Q;return Y??=G().finally(()=>{Y=null}),Q=await Y,X=Date.now(),Q}}var U34=3000,sQ$=!0;var $Y$=D(()=>{Qn()});var GB0=D(()=>{w4();Rm0()});async function WB0($){try{let Z=await fetch(`${$}/health`,{signal:AbortSignal.timeout(B34)});if(!Z.ok)return null;let X=await Z.json();if(typeof X==="object"&&X!==null&&typeof X.bootId==="string"&&typeof X.ready==="boolean"&&X.setup&&typeof X.setup.running==="boolean"&&typeof X.setup.done==="boolean")return X;return null}catch{return null}}async function fp0($){for(let Z=0;Z<ZY$;Z++){if(await WB0($)!==null)return;let X=(Math.random()*2-1)*D34;await D$(XY$+X)}throw Error(`sandbox daemon at ${$} did not respond on /health within ${ZY$*XY$/1000}s`)}async function iS($,Z,X,Q,Y){return L34($,Z,"POST",X,Q,Y)}async function L34($,Z,X,Q,Y,G){let J={...Q};if(Y&&Y.rotateToken!==void 0)J.auth=Y;let W=await fetch(`${$}/_sandbox/config`,{method:X,headers:{"Content-Type":"application/json",Authorization:`Bearer ${Z}`},body:JSON.stringify(J),signal:AbortSignal.timeout(G?.timeoutMs??vp0)}),K=await W.text();if(!W.ok)throw new JB0(W.status,K);return JSON.parse(K)}async function QY$($,Z,X){let Q=await fetch(`${$}/_sandbox/setup/${X}`,{method:"POST",headers:{Authorization:`Bearer ${Z}`},signal:AbortSignal.timeout(vp0)});if(!Q.ok)throw Error(`sandbox daemon /_sandbox/setup/${X} returned ${Q.status}: ${await Q.text()}`)}async function YY$($,Z,X){let Q=await fetch(`${$}/_sandbox/orgfs-config`,{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${Z}`},body:X,signal:AbortSignal.timeout(vp0)}),Y=await Q.text();if(!Q.ok)throw Error(`sandbox daemon /_sandbox/orgfs-config returned ${Q.status}: ${Y}`);return JSON.parse(Y)}async function Yn($,Z,X,Q){let Y=new Headers(Q.headers);for(let W of w34)Y.delete(W);Y.set("authorization",`Bearer ${Z}`);let G=Q.method!=="GET"&&Q.method!=="HEAD",J=`${$}${X.startsWith("/")?X:`/${X}`}`;return fetch(J,{method:Q.method,headers:Y,body:G?Q.body:void 0,redirect:"manual",signal:Q.signal,duplex:G?"half":void 0})}var JB0,B34=500,vp0=30000,ZY$=25,XY$=200,D34=50,w34;var GY$=D(()=>{GB0();JB0=class JB0 extends Error{status;constructor($,Z){super(`sandbox daemon /_sandbox/config returned ${$}: ${Z}`);this.status=$;this.name="ConfigRequestError"}};w34=["cookie","host","connection","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","accept-encoding","content-length"]});async function*KY$($){let Z=$.now??(()=>Date.now()),X=Z(),Q=$.schedulingTimeoutMs??j34,Y={pod:{},sandbox:{},events:{hasPulling:!1,hasPulled:!1},startedAt:X},G=[],J=null,W=!1,K=(j)=>{if(W)return;if(J){let z=J;J=null,z(j)}else G.push(j)},H=()=>{if(G.length>0)return Promise.resolve(G.shift());if(W)return Promise.resolve(null);return new Promise((j)=>{J=j})},F=()=>{if(W)return;if(W=!0,J){let j=J;J=null,j(null)}},N=new AbortController,U=()=>{N.abort(),F()};if($.signal)if($.signal.aborted)N.abort(),F();else $.signal.addEventListener("abort",U,{once:!0});let O=Math.max(0,Q-(Z()-X)),B=setTimeout(()=>K("tick"),O+100),L,w=new Promise((j)=>{L=j}),E=Promise.allSettled([z34($.kc,$.namespace,$.claimName,N.signal,Y,K,Z,L),A34($.kc,$.namespace,$.claimName,N.signal,Y,K),T34($.kc,$.namespace,$.claimName,w,N.signal,Y,K,Z)]);try{let j=null,z=-1,A=JY$(Y,Q,Z);if(j=xp0(A),!bp0(A))z=WY$(A);if(yield A,bp0(A))return;while(!W){if(await H()===null)break;let I=JY$(Y,Q,Z);if(bp0(I)){let C=xp0(I);if(C!==j)j=C,yield I;return}let q=WY$(I);if(q<z)continue;let M=xp0(I);if(M!==j)j=M,z=q,yield I}}finally{if(clearTimeout(B),N.abort(),$.signal)$.signal.removeEventListener("abort",U);F(),await E.catch(()=>{})}}function JY$($,Z,X){let{pod:Q,sandbox:Y,events:G,startedAt:J}=$;if(Y.ready)return{kind:"ready"};let W=Q.containerWaitingReason;if(W==="ImagePullBackOff"||W==="ErrImagePull")return{kind:"failed",reason:"image-pull-backoff",message:"Sandbox image failed to download. The cluster may be missing pull credentials or the image tag may not exist."};if(W==="CrashLoopBackOff")return{kind:"failed",reason:"crash-loop-backoff",message:"Sandbox crashed during startup and is now in CrashLoopBackOff. Check pod logs."};if(!Q.scheduled&&G.lastFailedSchedulingAt!==void 0&&X()-J>Z)return{kind:"failed",reason:"scheduling-timeout",message:G.failedSchedulingMessage??`Pod could not be scheduled within ${Math.round(Z/1000)}s.`};if(Q.containerRunning&&!Q.containerReady)return{kind:"warming-daemon",since:J};if(G.hasPulling&&!G.hasPulled)return{kind:"pulling-image",since:J};if(W==="ContainerCreating"||W==="PodInitializing"||Q.scheduled&&!Q.containerRunning)return{kind:"starting-container",since:J};if(Q.scheduledFalseReason==="Unschedulable"||G.lastFailedSchedulingAt!==void 0&&!Q.scheduled)return{kind:"waiting-for-capacity",since:J,message:G.failedSchedulingMessage??Q.scheduledFalseMessage,nodeClaim:G.nominatedNodeClaim};return{kind:"claiming",since:J}}function bp0($){return $.kind==="ready"||$.kind==="failed"}function WY$($){switch($.kind){case"claiming":return 0;case"waiting-for-capacity":return 1;case"pulling-image":return 2;case"starting-container":return 3;case"warming-daemon":return 4;case"ready":case"failed":return 99}}function xp0($){switch($.kind){case"claiming":case"pulling-image":case"starting-container":case"warming-daemon":return $.kind;case"waiting-for-capacity":return`waiting-for-capacity:${$.message??""}:${$.nodeClaim??""}`;case"ready":return"ready";case"failed":return`failed:${$.reason}:${$.message}`}}async function z34($,Z,X,Q,Y,G,J,W){let K=`/api/v1/namespaces/${encodeURIComponent(Z)}/pods?watch=true&labelSelector=${encodeURIComponent(`${E34}=${X}`)}`;return KB0({kc:$,path:K,signal:Q,label:`pod/${X}`,onEvent:(H)=>{if(H.type!=="ADDED"&&H.type!=="MODIFIED")return;let F=H.object;if(F.metadata?.name)W(F.metadata.name);P34(F,Y,J),G("pod")}})}function P34($,Z,X){let Y=($.status?.conditions??[]).find((J)=>J.type==="PodScheduled");if(Y?.status==="True")Z.pod.scheduled=!0,Z.pod.scheduledFalseReason=void 0,Z.pod.scheduledFalseMessage=void 0;else if(Y?.status==="False")Z.pod.scheduled=!1,Z.pod.scheduledFalseReason=Y.reason,Z.pod.scheduledFalseMessage=Y.message;let G=($.status?.containerStatuses??[]).find((J)=>J.name===S5.MAIN_CONTAINER_NAME);if(G)Z.pod.containerWaitingReason=G.state?.waiting?.reason,Z.pod.containerRunning=!!G.state?.running,Z.pod.containerReady=G.ready===!0}async function A34($,Z,X,Q,Y,G){let J=`/apis/${S5.CLAIM_API_GROUP}/${S5.CLAIM_API_VERSION}/namespaces/${encodeURIComponent(Z)}/${S5.CLAIM_PLURAL}?watch=true&fieldSelector=${encodeURIComponent(`metadata.name=${X}`)}`;return KB0({kc:$,path:J,signal:Q,label:`sandboxclaim/${X}`,onEvent:(W)=>{if(W.type!=="ADDED"&&W.type!=="MODIFIED")return;let H=W.object.status?.conditions?.find((F)=>F.type==="Ready");if(!H)return;if(H.status==="True")Y.sandbox.ready=!0,Y.sandbox.notReadyReason=void 0,Y.sandbox.notReadyMessage=void 0;else Y.sandbox.ready=!1,Y.sandbox.notReadyReason=H.reason,Y.sandbox.notReadyMessage=H.message;G("sandbox")}})}async function T34($,Z,X,Q,Y,G,J,W){let K=await Promise.race([Q,new Promise((F)=>{if(Y.aborted){F(X);return}Y.addEventListener("abort",()=>F(X),{once:!0})})]);if(Y.aborted)return;let H=`/api/v1/namespaces/${encodeURIComponent(Z)}/events?watch=true&fieldSelector=${encodeURIComponent(`involvedObject.name=${K},involvedObject.kind=Pod`)}`;return KB0({kc:$,path:H,signal:Y,label:`events/${X}`,onEvent:(F)=>{if(F.type!=="ADDED"&&F.type!=="MODIFIED")return;let N=F.object,U=N.reason;if(!U)return;switch(U){case"Pulling":G.events.hasPulling=!0;break;case"Pulled":G.events.hasPulling=!0,G.events.hasPulled=!0;break;case"FailedScheduling":G.events.lastFailedSchedulingAt=W(),G.events.failedSchedulingMessage=N.message;break;case"Nominated":{let O=N.message?.match(/nodeclaim\/([\w-]+)/);if(O)G.events.nominatedNodeClaim=O[1];break}default:return}J("event")}})}async function HY$($){let{kc:Z,namespace:X,labelSelector:Q,signal:Y,onDelete:G}=$,J=`/apis/${S5.CLAIM_API_GROUP}/${S5.CLAIM_API_VERSION}/namespaces/${encodeURIComponent(X)}/${S5.CLAIM_PLURAL}?watch=true&labelSelector=${encodeURIComponent(Q)}`;return KB0({kc:Z,path:J,signal:Y,label:"sandboxclaim-reaper",onEvent:(W)=>{if(W.type!=="DELETED")return;let K=W.object.metadata?.name;if(K)G(K)}})}async function KB0($){let{kc:Z,path:X,signal:Q,label:Y,onEvent:G}=$,J=0;while(!Q.aborted){try{let K=await tY(Z,{method:"GET",path:X,signal:Q,headers:{accept:"application/json"},stream:!0});if(!K.ok||!K.body){try{await K.body?.cancel()}catch{}if(K.status===401||K.status===403){console.warn(`[lifecycle-watcher] ${Y} stopped: watch denied (${K.status} ${K.statusText}). `+"The kubeconfig in use cannot watch SandboxClaims \u2014 if you are running locally, "+"this provider should not be active (check STUDIO_SANDBOX_PROVIDER / your sandbox preference).");return}throw Error(`watch handshake failed: ${K.status} ${K.statusText}`)}J=0;for await(let H of _p0(K.body)){if(Q.aborted)return;try{G(H)}catch(F){console.warn(`[lifecycle-watcher] ${Y} onEvent threw: ${F instanceof Error?F.message:String(F)}`)}}}catch(K){if(Q.aborted)return;let H=K instanceof Error?K.message:String(K);console.warn(`[lifecycle-watcher] ${Y} watch ended: ${H}`)}if(Q.aborted)return;let W=oZ(5000,250,J,2,0);J+=1,await D$(W,{signal:Q}).catch(()=>{})}}var E34="studio.decocms.com/sandbox-handle",j34=300000;var FY$=D(()=>{w4();ep();Qn()});import{z as aG}from"zod";function NY$($){if(!$||$.trim()==="")return[];let Z=aG.array(R34).parse(JSON.parse($)),X=new Set;for(let Q of Z){if(X.has(Q.name))throw Error(`STUDIO_SANDBOX_TENANT_POOLS: duplicate pool name ${Q.name}`);X.add(Q.name)}return Z}function I34($){try{let[Z,X]=new URL($).pathname.replace(/^\/+/,"").split("/"),Q=X?.replace(/\.git$/,"");return Z&&Q?`${Z}/${Q}`.toLowerCase():null}catch{return null}}function UY$($,Z){let{orgId:X,cloneUrl:Q}=Z;if(Z.purpose==="harness-run")return null;if(!X||!Q)return null;let Y=I34(Q);if(!Y)return null;return $.find((G)=>G.orgId===X&&G.repo.toLowerCase()===Y)??null}function OY$($,Z,X){return $?.name??(Z?X:"none")}function q34($,Z){return $==="harness-run"?`${Z}-medium`:Z}async function BY$($){let Z=q34($.purpose,$.templateName);if(Z===$.templateName)return{name:Z,probe:$.probe};let X=$.probe!==null&&$.now-$.probe.checkedAt<$.ttlMs?$.probe:{checkedAt:$.now,present:await $.exists(Z)};if(X.present)return{name:Z,probe:X};if($.probe?.present!==!1)$.onAbsent?.(Z);return{name:$.templateName,probe:X}}function DY$($,Z,X){let Q=X.replace(/^refs\/heads\//,"");return $.filter((Y)=>Y.repo.toLowerCase()===Z.toLowerCase()&&Y.branch===Q)}function LY$($){return`https://github.com/${$.repo}.git`}var R34;var yp0=D(()=>{R34=aG.object({name:aG.string().regex(/^[a-z0-9]([-a-z0-9]*[a-z0-9])?$/,"pool name must be a DNS label (lowercase alphanumeric and '-')"),orgId:aG.string().min(1),repo:aG.string().regex(/^[^/\s]+\/[^/\s]+$/,"repo must be `owner/name`"),connectionId:aG.string().min(1).optional(),branch:aG.string().min(1).default("main"),workload:aG.object({runtime:aG.enum(["node","bun","deno"]).default("node"),packageManager:aG.enum(["npm","pnpm","yarn","bun","deno"]).optional(),packageManagerPath:aG.string().optional(),devPort:aG.number().int().positive().optional()}).default({runtime:"node"})})});async function wY$($,Z,X){let Q=new Map;for(let Y of $){let G=Z(Y);if(!G)continue;let J=Q.get(G);if(J)J.push(Y);else Q.set(G,[Y])}await Promise.allSettled([...Q.values()].map(async(Y)=>{for(let G of Y)await X(G).catch(()=>{})}))}import{createHash as M34,randomBytes as k34,randomUUID as V34}from"crypto";import*as RY$ from"net";import{PassThrough as S34}from"stream";function EY$($){if($ instanceof Error)return $.message;if($&&typeof $==="object"){let Z=$;if(Z.error instanceof Error)return Z.error.message;if(typeof Z.message==="string"&&Z.message)return Z.message}return String($)}class mp0{kind=tQ;records=new Map;inflight=new qZ0;activeGauge=new IZ0;stateStore;previewUrlPattern;kubeConfig;capacityProbe;portForward;namespace;sandboxTemplateName;envName;tokenGenerator;idleTtlMs;metrics;previewGateway;sentinelToken;mintCloneUrl;mintOrgFsConfig;tenantPools;tenantPoolRefreshMs;poolPods=new Map;mediumTemplateProbe=null;dirtyPools=new Set;closed=!1;claimWatchAbort=new AbortController;constructor($={}){this.stateStore=$.stateStore??null,this.previewUrlPattern=$.previewUrlPattern??null,this.kubeConfig=$.kubeConfig??m34(),this.portForward=new Np0(this.kubeConfig),this.namespace=$.namespace??C34,this.sandboxTemplateName=$.sandboxTemplateName??_34,this.envName=r34($.envName),this.tokenGenerator=$.tokenGenerator??(()=>k34(f34).toString("hex")),this.idleTtlMs=$.idleTtlMs??x34,this.metrics=$.meter?d34($.meter):null,this.previewGateway=$.previewGateway&&$.previewUrlPattern?{...$.previewGateway}:null;let Z=$.sentinelToken?.trim()??"";if(this.sentinelToken=Z.length>0?Z:null,this.mintCloneUrl=$.mintCloneUrl,this.mintOrgFsConfig=$.mintOrgFsConfig,this.tenantPools=this.sentinelToken!==null?$.tenantPools??[]:[],this.sentinelToken===null&&($.tenantPools?.length??0)>0)console.warn(`[${W6}] tenant pools configured without a sentinel token \u2014 ignoring them (warm-pool mode is off)`);this.tenantPoolRefreshMs=$.tenantPoolRefreshMs??g34,this.startClaimReaper(),this.startCredentialRefresher(),this.startTenantPoolReconciler()}startClaimReaper(){let $=["app.kubernetes.io/managed-by=studio","app.kubernetes.io/name=studio-sandbox",...this.envName?[`${sX.env}=${this.envName}`]:[]].join(",");HY$({kc:this.kubeConfig,namespace:this.namespace,labelSelector:$,signal:this.claimWatchAbort.signal,onDelete:(Z)=>this.invalidateRecord(Z)})}async ensure($,Z={}){let X=BE($);if(X.startsWith("s-"))throw Error(`ensure: projectRef has no slug source: ${$.projectRef}`);return this.inflight.run(X,()=>MZ0(this.stateStore,$,tQ,(Q)=>this.ensureLocked($,X,Z,Q)))}async delete($){let Z=await this.getRecord($);if(this.records.delete($),Z)this.dropRecord(Z);if(await this.deleteHttpRouteIfManaged($).catch((X)=>{console.warn(`[${W6}] HTTPRoute delete failed for ${$}: ${X instanceof Error?X.message:String(X)}`)}),await DB(this.kubeConfig,this.namespace,$),this.stateStore)if(Z)await this.stateStore.delete(Z.id,tQ);else await this.stateStore.deleteByHandle(tQ,$)}lastTermination($){return iQ$(this.kubeConfig,this.namespace,sX.sandboxHandle,$,S5.MAIN_CONTAINER_NAME)}async alive($){return await v3(this.kubeConfig,this.namespace,$)!==void 0}watchClaimLifecycle($,Z){return KY$({kc:this.kubeConfig,namespace:this.namespace,claimName:$,signal:Z})}hasSchedulableCapacity(){return this.capacityProbe??=eQ$(this.kubeConfig,this.namespace),this.capacityProbe()}async getPreviewUrl($){let Z=await this.getRecord($);if(!Z)return null;return this.composePreviewUrl(Z)}async proxyDaemonRequest($,Z,X){let Q=await this.getRecord($);if(!Q&&this.previewUrlPattern&&this.stateStore){let K=await this.stateStore.getByHandle(tQ,$),H=K?.state,F=H?.token;if(K&&F){let U=`http://${H?.adoptedSandboxName??$}.${this.namespace}.svc.cluster.local:${bF}`;try{let O=await Yn(U,F,Z,X);if(O.status!==404)return O;try{await O.body?.cancel()}catch{}}catch{}}}if(!Q)Q=await this.resurrectByHandle($);if(!Q)return new Response(JSON.stringify({error:"sandbox not found"}),{status:404,headers:{"content-type":"application/json"}});let Y=Q,G=performance.now(),J=0,W=!(X.body instanceof ReadableStream);try{let K=await Yn(Q.daemonUrl,Q.token,Z,X);if(K.status===401&&W){this.invalidateRecord($);let H=await this.getRecord($).catch(()=>null)??await this.resurrectByHandle($).catch(()=>null);if(H){try{await K.body?.cancel()}catch{}Y=H,K=await Yn(H.daemonUrl,H.token,Z,X)}}return J=K.status,K}catch(K){if(!W)throw K;this.invalidateRecord($);let H=await this.resurrectByHandle($)??await this.getRecord($).catch(()=>null);if(!H)throw K;Y=H;let F=await Yn(H.daemonUrl,H.token,Z,X);return J=F.status,F}finally{this.recordProxyDuration("daemon",J,Y,performance.now()-G)}}async adoptLiveClaim($,Z){if(this.records.has(Z))return!0;let X=await v3(this.kubeConfig,this.namespace,Z).catch(()=>{return});if(!X||X.metadata?.deletionTimestamp)return!1;return await this.inflight.run(Z,async()=>{let Y=this.records.get(Z);if(Y)return this.toSandbox(Y);let G=await this.adopt($,Z,X);if(!G)throw Error(`cannot adopt live claim ${Z}`);return MZ0(this.stateStore,$,tQ,(J)=>this.finish(G,J,!0,!0,"adopt"))}).catch(()=>null)!=null}async resolvePreviewUpstreamUrl($){if(this.previewUrlPattern)return`http://${await this.resolveServiceNameForHandle($)}.${this.namespace}.svc.cluster.local:${bF}`;let Z=await this.getRecord($);if(Z)return Z.daemonUrl;let X=await this.resurrectByHandle($);return X?X.daemonUrl:null}async resolveServiceNameForHandle($){let Z=this.records.get($);if(Z)return Z.adoptedSandboxName;if(this.stateStore){let Q=(await this.stateStore.getByHandle(tQ,$).catch(()=>null))?.state?.adoptedSandboxName;if(Q)return Q}return $}async proxyPreviewRequest($,Z){let X=performance.now(),Q=this.records.get($)??null,Y=0;try{let G=await this.resolvePreviewUpstreamUrl($);if(!G){Y=404;let B=hp0(404,{error:"sandbox not found"});return B.headers.set(nS,"1"),B}let J=new URL(Z.url);if((J.pathname==="/_sandbox"||J.pathname.startsWith("/_sandbox/")||J.pathname==="/_decopilot_vm"||J.pathname.startsWith("/_decopilot_vm/"))&&Z.method!=="GET")return Y=404,hp0(404,{error:"not found"});let K=(B)=>`${B}${J.pathname}${J.search}`,H=new Headers(Z.headers);for(let B of c34)H.delete(B);let F=Z.method!=="GET"&&Z.method!=="HEAD",N={method:Z.method,headers:H,body:F?Z.body:void 0,redirect:"manual",signal:Z.signal,duplex:F?"half":void 0},U;try{U=await fetch(K(G),N)}catch(B){let L=`${G}${J.pathname}`;if(console.warn(`[${W6}] preview fetch to ${L} failed: ${B instanceof Error?B.message:String(B)}`),Z.method==="GET"||Z.method==="HEAD"){if(this.invalidateRecord($),await this.resurrectByHandle($).catch(()=>null)){let j=await this.resolvePreviewUpstreamUrl($);if(j)try{U=await fetch(K(j),N);let z=new Headers;for(let[A,P]of U.headers.entries())if(!PY$.includes(A.toLowerCase()))z.set(A,P);return Y=U.status,new Response(U.body,{status:U.status,statusText:U.statusText,headers:z})}catch(z){console.warn(`[${W6}] preview fetch retry to ${L} failed: ${z instanceof Error?z.message:String(z)}`)}}}else this.invalidateRecord($);Y=502;let w=hp0(502,{error:"sandbox daemon unreachable"});return w.headers.set(nS,"1"),w}let O=new Headers;for(let[B,L]of U.headers.entries())if(!PY$.includes(B.toLowerCase()))O.set(B,L);return Y=U.status,new Response(U.body,{status:U.status,statusText:U.statusText,headers:O})}finally{this.recordProxyDuration("preview",Y,Q,performance.now()-X,$)}}async ensureLocked($,Z,X,Q){if(X.image)console.warn(`[${W6}] opts.image ignored (template ${this.sandboxTemplateName} pins image): got ${X.image}`);if(Q){let J=await Q.get($,tQ);if(J){let W=await this.rehydrate($,Z,J);if(W)return await this.refreshDaemonGitCredential(W,X),await this.relayOrgFsConfig(W.daemonUrl,W.token,X.orgFsConfigJson),this.finish(W,Q,!1,!0,"resume");await Q.delete($,tQ)}}let Y=await v3(this.kubeConfig,this.namespace,Z).catch(()=>{return});if(Y)if(Y.metadata?.deletionTimestamp)await $B0(this.kubeConfig,this.namespace,Z).catch((J)=>{console.warn(`[${W6}] wait for terminating claim ${Z} failed: ${J instanceof Error?J.message:String(J)}`)});else{let J=await this.adopt($,Z,Y).catch((W)=>{return console.warn(`[${W6}] adopt ${Z} failed, recreating: ${W instanceof Error?W.message:String(W)}`),null});if(J)return await this.refreshDaemonGitCredential(J,X),await this.relayOrgFsConfig(J.daemonUrl,J.token,X.orgFsConfigJson),this.finish(J,Q,!0,!0,"adopt");await DB(this.kubeConfig,this.namespace,Z).catch(()=>{}),await $B0(this.kubeConfig,this.namespace,Z).catch((W)=>{console.warn(`[${W6}] wait for deleted claim ${Z} failed: ${W instanceof Error?W.message:String(W)}`)})}let G=await this.provision($,Z,X);return this.finish(G,Q,!0,!1,"fresh")}async finish($,Z,X,Q,Y){let G=this.records.get($.handle),J=G!==void 0;if(G&&G.daemonForward!==$.daemonForward)this.closeForwarder(G.daemonForward);if(this.records.set($.handle,$),X)await this.persist(Z,$);if(Q)await ZB0(this.kubeConfig,this.namespace,$.handle,this.computeShutdownTime()).catch((W)=>console.warn(`[${W6}] TTL refresh failed for ${$.handle}: ${W instanceof Error?W.message:String(W)}`));if(this.metrics){let W=cp0($.tenant);if(this.metrics.ensureOutcome.add(1,{...W,outcome:Y}),!J)this.metrics.active.add(1,W),this.activeGauge.markCounted($.handle)}return this.toSandbox($)}buildEnvMap($,Z){let X={},Q=[];for(let[Y,G]of Object.entries($.env??{}))if(b34.has(Y))Q.push(Y);else X[Y]=G;if(Q.length>0)console.warn(`[${W6}] opts.env keys overlap reserved bootstrap names and were dropped: ${Q.join(",")}`);return{...X,DAEMON_TOKEN:Z.token,DAEMON_BOOT_ID:Z.daemonBootId,APP_ROOT:Z.workdir,PROXY_PORT:String(bF)}}async resolveTemplateName($){let{name:Z,probe:X}=await BY$({purpose:$,templateName:this.sandboxTemplateName,probe:this.mediumTemplateProbe,now:Date.now(),ttlMs:v34,exists:(Q)=>cQ$(this.kubeConfig,this.namespace,Q),onAbsent:(Q)=>console.warn(`[${W6}] SandboxTemplate ${Q} not found (or not readable) \u2014 harness-run claims fall back to ${this.sandboxTemplateName}. Upgrade the sandbox-env chart to the version that renders it.`)});return this.mediumTemplateProbe=X,Z}buildClaim($,Z,X,Q){let Y=this.sentinelToken!==null,G=UY$(this.tenantPools,{orgId:Z.tenant?.orgId,cloneUrl:Z.repo?.cloneUrl,purpose:Z.purpose}),J=Y?[]:Object.entries(this.buildEnvMap(Z,X)).sort(([H],[F])=>H<F?-1:H>F?1:0).map(([H,F])=>({name:H,value:F})),W=e34(Z),K=Object.keys(W).length>0;return{apiVersion:`${S5.CLAIM_API_GROUP}/${S5.CLAIM_API_VERSION}`,kind:"SandboxClaim",metadata:{name:$,namespace:this.namespace,labels:{"app.kubernetes.io/name":"studio-sandbox","app.kubernetes.io/managed-by":"studio",...this.envName?{[sX.env]:this.envName}:{},...up0(Z.tenant)},...K?{annotations:W}:{}},spec:{sandboxTemplateRef:{name:Q},additionalPodMetadata:{labels:up0(Z.tenant,{[sX.role]:"claimed",[sX.sandboxHandle]:$,...this.envName?{[sX.env]:this.envName}:{}}),...K?{annotations:W}:{}},env:J,warmpool:OY$(G,Y,Q),lifecycle:{shutdownPolicy:"Delete",shutdownTime:this.computeShutdownTime()}}}}async provision($,Z,X){let Q=this.tokenGenerator(),Y=V34(),G=gp0,J=this.buildClaim(Z,X,{token:Q,daemonBootId:Y,workdir:G},await this.resolveTemplateName(X.purpose));try{await Zn(this.kubeConfig,this.namespace,J)}catch(U){if(U instanceof sp)await $B0(this.kubeConfig,this.namespace,Z),await Zn(this.kubeConfig,this.namespace,J);else throw U}let W;try{W=await lQ$(this.kubeConfig,this.namespace,Z),await YB0(this.kubeConfig,this.namespace,W)}catch(U){throw await DB(this.kubeConfig,this.namespace,Z).catch(()=>{}),U}try{await this.ensureServicePortForAdoptedSandbox(W),await this.ensureHttpRouteForHandle(Z,W,X.tenant??null)}catch(U){throw await DB(this.kubeConfig,this.namespace,Z).catch(()=>{}),U}let K=await this.openForwarder(W,bF,Z),H=`http://127.0.0.1:${K.localPort}`,F=this.workloadConfigPayload(X),N=Y;try{if(await fp0(H),this.sentinelToken!==null){let U=await WB0(H);if(U)N=U.bootId;await iS(H,this.sentinelToken,F??{},{rotateToken:Q})}else if(F)await iS(H,Q,F);await this.relayOrgFsConfig(H,Q,X.orgFsConfigJson)}catch(U){throw this.closeForwarder(K),await this.deleteHttpRouteIfManaged(Z).catch(()=>{}),await DB(this.kubeConfig,this.namespace,Z).catch(()=>{}),U}return{id:$,handle:Z,adoptedSandboxName:W,token:Q,workdir:G,daemonUrl:H,daemonForward:K,workload:X.workload??null,daemonBootId:N,tenant:X.tenant??null,ensureOpts:YW4(X)}}workloadConfigPayload($){return VZ0({runtime:$?.workload?.runtime??"node",packageManager:$?.workload?.packageManager?{name:$.workload.packageManager,...$.workload.packageManagerPath?{path:$.workload.packageManagerPath}:{}}:null,repo:$?.repo??null,port:$?.workload?.devPort??jY$,tenant:$?.tenant??void 0,...$?{cloneOnly:$.cloneOnly===!0}:{}})}async relayOrgFsConfig($,Z,X){if(!X)return;await YY$($,Z,X).catch((Q)=>console.warn("[org-fs] sidecar config relay failed",Q))}async refreshDaemonGitCredential($,Z){let X=Im0(Z);if(!X)return;try{await iS($.daemonUrl,$.token,X)}catch(Q){console.warn(`[${W6}] git credential refresh failed for ${$.handle}: ${Q instanceof Error?Q.message:String(Q)}`)}}async withFreshCloneUrl($,Z){if(!this.mintCloneUrl)return $;try{let X=await this.mintCloneUrl($,Z!==void 0?{bufferMs:Z}:void 0);return X?{...$,cloneUrl:X}:$}catch(X){return console.warn(`[${W6}] clone credential re-mint failed: ${X instanceof Error?X.message:String(X)}`),$}}async withFreshCredentials($){return{...$,...$.repo?{repo:await this.withFreshCloneUrl($.repo)}:{},...$.orgFsConfigJson?{orgFsConfigJson:await QW4($,this.mintOrgFsConfig)}:{}}}startCredentialRefresher(){if(!this.mintCloneUrl)return;let{signal:$}=this.claimWatchAbort;(async()=>{while(!$.aborted){if(await D$(h34,{signal:$}).catch(()=>{}),$.aborted)break;try{await this.refreshAllGitCredentials()}catch(Z){console.warn(`[${W6}] periodic credential refresh failed: ${Z instanceof Error?Z.message:String(Z)}`)}}})()}startTenantPoolReconciler(){if(this.tenantPools.length===0)return;let{signal:$}=this.claimWatchAbort;(async()=>{while(!$.aborted){try{await this.reconcileTenantPools()}catch(Z){console.warn(`[${W6}] tenant pool reconcile failed: ${Z instanceof Error?Z.message:String(Z)}`)}await D$(y34,{signal:$}).catch(()=>{})}})()}markTenantPoolsDirty($,Z){let X=DY$(this.tenantPools,$,Z);for(let Q of X)this.dirtyPools.add(Q.name);return X.map((Q)=>Q.name)}async reconcileTenantPools(){for(let $ of this.tenantPools){let Z=await dQ$(this.kubeConfig,this.namespace,$.name);if(Z===null){console.warn(`[${W6}] tenant pool ${$.name}: no SandboxWarmPool (or no selector yet) in ${this.namespace}`);continue}let X=this.dirtyPools.delete($.name),Q=Z.filter((Y)=>!Y.labels[sX.sandboxHandle]);for(let[Y]of this.poolPods)if(!Z.some((G)=>G.uid===Y))this.poolPods.delete(Y);for(let Y of Q){if(this.claimWatchAbort.signal.aborted)return;await this.warmPoolPod($,Y,X)}this.recordPoolDepth($,Z,Q)}}recordPoolDepth($,Z,X){let Q=this.metrics?.poolPods;if(!Q)return;let Y=0,G=0;for(let W of X){let K=this.poolPods.get(W.uid);if(!K)continue;if(K.failures>=HB0)G++;else if(K.lastConfigAt>0)Y++}let J={pool:$.name,org:$.orgId};Q.record(Y,{...J,state:"ready"}),Q.record(Z.length-X.length,{...J,state:"bound"}),Q.record(X.length-Y-G,{...J,state:"pending"}),Q.record(G,{...J,state:"failed"})}async warmPoolPod($,Z,X){let Q=this.poolPods.get(Z.uid);if(Q&&Q.failures>=HB0){if(Date.now()-Q.lastFailureAt<zY$)return;this.poolPods.set(Z.uid,{...Q,failures:0})}let Y=X||Q!==void 0&&Date.now()-Q.lastConfigAt>=this.tenantPoolRefreshMs;if(Q&&!Y)return;let G={cloneUrl:LY$($),connectionId:$.connectionId,branch:$.branch,userName:"",userEmail:""},J=await this.withFreshCloneUrl(G);if($.connectionId&&J.cloneUrl===G.cloneUrl){this.recordPoolFailure(Z,$,"clone credential mint failed");return}let W=await this.openForwarder(Z.name,bF,Z.name).catch(()=>null);if(!W){this.recordPoolFailure(Z,$,"port-forward failed");return}let K=`http://127.0.0.1:${W.localPort}`;try{await fp0(K);let H=this.sentinelToken;if(!H)return;if(!await this.isPoolPodUnbound(Z))return;let F=VZ0({runtime:$.workload.runtime,packageManager:$.workload.packageManager?{name:$.workload.packageManager,...$.workload.packageManagerPath?{path:$.workload.packageManagerPath}:{}}:null,repo:J,port:$.workload.devPort??jY$})??{},{transition:N}=await iS(K,H,F);if(Y&&N!=="bootstrap"&&await this.isPoolPodUnbound(Z))await QY$(K,H,"clone");this.poolPods.set(Z.uid,{lastConfigAt:Date.now(),lastFailureAt:0,failures:0}),console.log(`[${W6}] tenant pool ${$.name}: warmed ${Z.name} (${N})`)}catch(H){this.recordPoolFailure(Z,$,H instanceof Error?H.message:String(H))}finally{this.closeForwarder(W)}}isPoolPodUnbound($){return mQ$(this.kubeConfig,this.namespace,$.name,sX.sandboxHandle)}recordPoolFailure($,Z,X){let Q=this.poolPods.get($.uid),Y=(Q?.failures??0)+1;this.poolPods.set($.uid,{lastConfigAt:Q?.lastConfigAt??0,lastFailureAt:Date.now(),failures:Y});let G=Y>=HB0?` \u2014 backing off ${zY$/60000}min`:"";console.warn(`[${W6}] tenant pool ${Z.name}: warming ${$.name} failed (${Y}/${HB0})${G}: ${X}`)}async refreshAllGitCredentials(){await wY$(this.records.values(),($)=>$.ensureOpts?.repo?.connectionId,async($)=>{if(this.claimWatchAbort.signal.aborted)return;let Z=$.ensureOpts?.repo;if(!Z)return;let X=await this.withFreshCloneUrl(Z,u34);await this.refreshDaemonGitCredential($,{...$.ensureOpts,repo:X}),$.ensureOpts={...$.ensureOpts,repo:X}})}async rebootstrapDaemon($,Z,X){if(this.sentinelToken===null)return!1;let Q=this.workloadConfigPayload(X)??{};try{return await iS($,this.sentinelToken,Q,{rotateToken:Z}),await this.relayOrgFsConfig($,Z,X?.orgFsConfigJson),!0}catch(Y){if(Y instanceof JB0&&Y.status===401)try{return await iS($,Z,Q,{rotateToken:Z}),await this.relayOrgFsConfig($,Z,X?.orgFsConfigJson),!0}catch(G){return console.warn(`[${W6}] re-bootstrap retry with claim token failed: ${G instanceof Error?G.message:String(G)}`),!1}return console.warn(`[${W6}] re-bootstrap failed: ${Y instanceof Error?Y.message:String(Y)}`),!1}}async ensureServicePortForAdoptedSandbox($){if(!this.previewGateway||!this.previewUrlPattern)return;await aQ$(this.kubeConfig,this.namespace,$,{name:"daemon",port:bF,targetPort:bF})}async ensureHttpRouteForHandle($,Z,X){if(!this.previewGateway||!this.previewUrlPattern)return;let Q=GW4(this.previewUrlPattern,$);if(!Q)throw new I9(`Unable to derive preview hostname for ${$} from pattern: ${this.previewUrlPattern}`);let Y={apiVersion:`${Xn.API_GROUP}/${Xn.API_VERSION}`,kind:"HTTPRoute",metadata:{name:$,namespace:this.namespace,labels:up0(X??void 0,{[sX.role]:"claimed",[sX.sandboxHandle]:$,"app.kubernetes.io/name":"studio-sandbox","app.kubernetes.io/managed-by":"studio",...this.envName?{[sX.env]:this.envName}:{}})},spec:{parentRefs:[{kind:"Gateway",group:"gateway.networking.k8s.io",name:this.previewGateway.name,namespace:this.previewGateway.namespace}],hostnames:[Q],rules:[{backendRefs:[{group:"",kind:"Service",name:Z,port:bF}]}]}};await XB0(this.kubeConfig,this.namespace,Y)}async deleteHttpRouteIfManaged($){if(!this.previewGateway)return;await QB0(this.kubeConfig,this.namespace,$)}async rehydrate($,Z,X){let Q=X.state;if(!Q.adoptedSandboxName&&!Q.podName||!Q.token)return null;let Y=await v3(this.kubeConfig,this.namespace,Z).catch(()=>{return});if(!Y||!AY$(Y))return null;let G=Y.status?.sandbox?.name??Q.adoptedSandboxName??Q.podName??Z,J=await this.openAndProbeDaemon(G,Z);if(!J)return null;if(Q.daemonBootId&&Q.daemonBootId!==J.bootId){if(this.sentinelToken!==null){let W=Q.ensureOpts?await this.withFreshCredentials(Q.ensureOpts):null;if(!await this.rebootstrapDaemon(J.daemonUrl,Q.token,W))return this.closeForwarder(J.daemonForward),null}else console.warn(`[${W6}] daemon restart detected (handle=${Z}): stored bootId=${Q.daemonBootId} live bootId=${J.bootId}`);await this.stateStore?.put($,tQ,{handle:Z,state:{...Q,daemonBootId:J.bootId}}).catch((W)=>console.warn(`[${W6}] bootId persist failed for ${Z}: ${W instanceof Error?W.message:String(W)}`))}return{id:$,handle:Z,adoptedSandboxName:G,token:Q.token,workdir:Q.workdir??gp0,daemonUrl:J.daemonUrl,daemonForward:J.daemonForward,workload:Q.workload??null,daemonBootId:J.bootId,tenant:Q.tenant??null,ensureOpts:Q.ensureOpts??null}}async adopt($,Z,X){if(!AY$(X))return null;let Q=X.status?.sandbox?.name??Z;if(this.sentinelToken!==null)return null;let Y=i34(X);if(!Y)return null;let G=await this.openAndProbeDaemon(Q,Z);if(!G)return null;let J=$W4(X);if(this.previewGateway)await this.ensureServicePortForAdoptedSandbox(Q).catch((W)=>{console.warn(`[${W6}] Service port backfill failed for ${Z}: ${W instanceof Error?W.message:String(W)}`)}),await this.ensureHttpRouteForHandle(Z,Q,J).catch((W)=>{console.warn(`[${W6}] HTTPRoute backfill failed for ${Z}: ${W instanceof Error?W.message:String(W)}`)});return{id:$,handle:Z,adoptedSandboxName:Q,token:Y,workdir:gp0,daemonUrl:G.daemonUrl,daemonForward:G.daemonForward,workload:null,daemonBootId:G.bootId,tenant:J,ensureOpts:null}}async openAndProbeDaemon($,Z){let X=await this.openForwarder($,bF,Z).catch(()=>null);if(!X)return null;let Q=`http://127.0.0.1:${X.localPort}`,Y=await WB0(Q);if(!Y)return this.closeForwarder(X),null;return{daemonForward:X,daemonUrl:Q,bootId:Y.bootId}}async getRecord($){let Z=this.records.get($);if(Z)return Z;if(!this.stateStore)return null;let X=await this.stateStore.getByHandle(tQ,$);if(!X)return null;let Q=await this.rehydrate(X.id,$,X);if(Q)this.records.set($,Q);return Q}async resurrectByHandle($){if(!this.stateStore)return null;let Z=await this.stateStore.getByHandle(tQ,$);if(!Z)return null;let X=Z.state.ensureOpts;if(!X)return null;let Q=await this.withFreshCredentials(X);if(BE(Z.id)!==$)return null;return await this.ensure(Z.id,Q),this.records.get($)??null}invalidateRecord($){let Z=this.records.get($);if(!Z)return;this.records.delete($),this.dropRecord(Z)}dropRecord($){if(this.closeForwarder($.daemonForward),this.metrics&&this.activeGauge.consume($.handle))this.metrics.active.add(-1,cp0($.tenant))}recordProxyDuration($,Z,X,Q,Y){if(!this.metrics)return;this.metrics.proxyDurationMs.record(Q,{...cp0(X?.tenant??null),source:$,sandbox_handle:X?.handle??Y??"",status_code:Z||0})}composePreviewUrl($){if(this.previewUrlPattern)return kZ0(this.previewUrlPattern,$.handle);return`http://127.0.0.1:${$.daemonForward.localPort}/`}toSandbox($){return{handle:$.handle,workdir:$.workdir,previewUrl:this.composePreviewUrl($)}}async persist($,Z){if(!$)return;let X={adoptedSandboxName:Z.adoptedSandboxName,token:Z.token,workdir:Z.workdir,workload:Z.workload,daemonBootId:Z.daemonBootId,tenant:Z.tenant,...Z.ensureOpts?{ensureOpts:Z.ensureOpts}:{}};await $.put(Z.id,tQ,{handle:Z.handle,state:X})}computeShutdownTime(){return new Date(Date.now()+this.idleTtlMs).toISOString()}async releaseAfter($,Z){let X=await v3(this.kubeConfig,this.namespace,$);if(!X)return;let Q=ZW4(X.spec?.lifecycle?.shutdownTime,new Date(Date.now()+Z));if(!Q)return;await ZB0(this.kubeConfig,this.namespace,$,Q).catch((Y)=>console.warn(`[${W6}] release failed for ${$}: ${Y instanceof Error?Y.message:String(Y)}`))}async renewTtl($){let Z=await v3(this.kubeConfig,this.namespace,$);if(!Z)return;let X=XW4(Z.spec?.lifecycle?.shutdownTime,new Date(Date.now()+this.idleTtlMs));if(!X)return;await ZB0(this.kubeConfig,this.namespace,$,X).catch((Q)=>console.warn(`[${W6}] TTL renew failed for ${$}: ${Q instanceof Error?Q.message:String(Q)}`))}openForwarder($,Z,X=$){let Q=p34(X,Z);return new Promise((Y,G)=>{let J=(W,K)=>{let H=RY$.createServer((F)=>this.handleForwardedConnection(F,$,Z,X));H.once("error",(F)=>{if(F.code==="EADDRINUSE"&&K<l34){try{H.close()}catch{}let N=lp0+(W-lp0+1)%IY$;J(N,K+1);return}G(F)}),H.listen(W,"127.0.0.1",()=>{let F=H.address();if(!F||typeof F==="string"){H.close(),G(Error("port-forward listener failed to bind"));return}Y({server:H,localPort:F.port})})};J(Q,0)})}handleForwardedConnection($,Z,X,Q){let Y=new S34,G=null,J=!1,W=()=>{if(J)return;if(J=!0,Y.destroy(),G)try{G.close()}catch{}if(!$.destroyed)$.destroy()};$.pipe(Y),$.on("error",W),$.on("close",W),this.portForward.portForward(this.namespace,Z,[X],$,null,Y).then((K)=>{let H=typeof K==="function"?K():K;if(!H){W();return}if(G=H,G.on("close",W),G.on("error",(F)=>{console.warn(`[${W6}] port-forward to ${Z}:${X} dropped mid-connection: ${EY$(F)}`,JSON.stringify(dp0(F))),this.invalidateRecord(Q),W()}),J)try{G.close()}catch{}}).catch((K)=>{console.warn(`[${W6}] port-forward to ${Z}:${X} failed: ${EY$(K)}`,JSON.stringify(dp0(K))),this.invalidateRecord(Q),W()})}closeForwarder($){$.server.close((Z)=>{if(Z)console.warn(`[${W6}] port-forward close on :${$.localPort} errored: ${Z instanceof Error?Z.message:String(Z)}`)})}close(){if(this.closed)return;this.closed=!0,this.claimWatchAbort.abort();for(let $ of this.records.values())this.dropRecord($);this.records.clear()}}function d34($){return{active:$.createUpDownCounter("studio.sandbox.active",{description:"Active sandbox count, by runner kind, owning org, and daemon impl. Cross-checks the cAdvisor-derived count from the cluster \u2014 divergence between the two indicates orphaned claims (studio deleted but K8s didn't reap) or unattributed pods.",unit:"{sandbox}"}),ensureOutcome:$.createCounter("studio.sandbox.ensure.outcome",{description:"Outcome of each ensure() call: fresh provision, resume from state-store after restart, or adopt of a cluster-side claim studio didn't know about. Cold-start ratio is the primary input for warm-pool sizing.",unit:"{call}"}),proxyDurationMs:$.createHistogram("studio.sandbox.proxy.duration_ms",{description:"Wall-clock latency of studio-mediated requests to the sandbox daemon: tool exec proxies (source=daemon) and preview iframe traffic (source=preview).",unit:"ms"}),poolPods:$.createGauge("studio.sandbox.pool.pods",{description:"Tenant warm pool depth by pool and state: ready (warmed and unbound \u2014 what a claim can actually bind instantly), bound (serving a user), pending (unbound, not yet warmed), failed (gave up after repeated bootstrap failures). Alert on sustained ready=0: a pool that is always empty is doing nothing while costing N pods.",unit:"{pod}"})}}function dp0($){let Z=[],X=$;for(let Q=0;Q<5&&X instanceof Error;Q++){let Y=X;if(Z.push({name:Y.name,message:Y.message,...Y.code!==void 0?{code:Y.code}:{},...Y.errno!==void 0?{errno:Y.errno}:{}}),Y.cause===X)break;X=Y.cause}if(X!==void 0&&!(X instanceof Error)&&X!==null){let Q=X,Y=Q.error instanceof Error?dp0(Q.error).chain:void 0;Z.push({nonError:String(X),...typeof Q.type==="string"?{type:Q.type}:{},...typeof Q.message==="string"?{message:Q.message}:{},...Q.code!==void 0?{code:Q.code}:{},...typeof Q.reason==="string"?{reason:Q.reason}:{},...Y?{error:Y}:{},...Y===void 0&&Q.error!==void 0?{rawError:String(Q.error)}:{},keys:Object.keys(Q)})}return{chain:Z}}function m34(){let $=new Ly;return $.loadFromDefault(),$}function AY$($){return Boolean($.status?.conditions?.some((Z)=>Z.type==="Ready"&&Z.status==="True"))}function i34($){let Z=$.spec?.env;if(!Z)return null;for(let X of Z)if(X.name==="DAEMON_TOKEN"&&X.value)return X.value;return null}function p34($,Z){let X=M34("sha256").update(`${$}:${Z}`).digest();return lp0+X.readUInt32BE(0)%IY$}function hp0($,Z){return new Response(JSON.stringify(Z),{status:$,headers:{"content-type":"application/json","access-control-allow-origin":"*"}})}function TY$($){let Z=$.slice(0,t34);return n34.test(Z)?Z:""}function r34($){if($===void 0)return null;let Z=$.trim();if(Z==="")return null;if(!o34.test(Z))throw Error(`AgentSandboxProvider: envName=${JSON.stringify(Z)} is not a valid DNS-label-safe environment name (lowercase alphanumeric or '-', starts with a letter, ends alphanumeric, \u226432 chars). Studio sets this from STUDIO_ENV; check the studio chart's configMap.`);return Z}function up0($,Z={}){let X={...Z};if($){let Q=TY$($.orgId),Y=TY$($.userId);if(Q)X[sX.orgId]=Q;if(Y)X[sX.userId]=Y}return X}function pS($){let Z="";for(let X of $){let Q=X.codePointAt(0)??0;Z+=Q<32||Q===127?" ":X}return Z.slice(0,a34)}function s34($){try{let Z=new URL($);return Z.username="",Z.password="",Z.toString()}catch{return""}}function e34($){let Z={},X=$.tenant;if(X?.orgSlug)Z[f3.orgSlug]=pS(X.orgSlug);if(X?.orgName)Z[f3.orgName]=pS(X.orgName);if(X?.userEmail)Z[f3.userEmail]=pS(X.userEmail);if(X?.userName)Z[f3.userName]=pS(X.userName);let Q=$.repo;if(Q){if(Q.displayName)Z[f3.gitRepo]=pS(Q.displayName);let Y=s34(Q.cloneUrl);if(Y)Z[f3.gitRepoUrl]=pS(Y);let G=$.branch??Q.branch;if(G)Z[f3.gitBranch]=pS(G)}return Z}function $W4($){let Z=$.metadata?.labels;if(!Z)return null;let X=Z[sX.orgId],Q=Z[sX.userId];if(!X||!Q)return null;let Y=$.metadata?.annotations??{};return{orgId:X,userId:Q,orgSlug:Y[f3.orgSlug],orgName:Y[f3.orgName],userEmail:Y[f3.userEmail],userName:Y[f3.userName]}}function ZW4($,Z){if($){let X=new Date($).getTime();if(Number.isFinite(X)&&X<=Z.getTime())return null}return Z.toISOString()}function XW4($,Z){if($){let X=new Date($).getTime();if(Number.isFinite(X)&&X>=Z.getTime())return null}return Z.toISOString()}function cp0($){return{org_id:$?.orgId??"",user_id:$?.userId??"",runner_kind:tQ}}async function QW4($,Z){if(!Z||!$.tenant)return $.orgFsConfigJson;try{return await Z($.tenant)??$.orgFsConfigJson}catch(X){return console.warn(`[${W6}] org-fs credential re-mint failed: ${X instanceof Error?X.message:String(X)}`),$.orgFsConfigJson}}function YW4($){let Z={};if($.branch)Z.branch=$.branch;if($.repo)Z.repo=$.repo;if($.workload)Z.workload=$.workload;if($.env&&Object.keys($.env).length>0)Z.env=$.env;if($.tenant)Z.tenant=$.tenant;if($.cloneOnly)Z.cloneOnly=!0;if($.purpose)Z.purpose=$.purpose;if($.orgFsConfigJson)Z.orgFsConfigJson=$.orgFsConfigJson;return Object.keys(Z).length>0?Z:null}function GW4($,Z){try{return new URL(kZ0($,Z)).hostname||null}catch{return null}}var tQ="agent-sandbox",W6="AgentSandboxProvider",nS="x-sandbox-preview-not-ready",C34="agent-sandbox-system",_34="studio-sandbox",v34=300000,bF=9000,jY$=3000,gp0="/app",f34=32,b34,x34=900000,y34=60000,g34=1800000,HB0=3,zY$=1800000,h34=900000,u34=1800000,c34,PY$,lp0=40000,IY$=1e4,l34=256,sX,f3,n34,t34=63,o34,a34=253;var qY$=D(()=>{w4();$Y$();Mp0();GY$();qm0();Qn();ep();FY$();yp0();b34=new Set(["DAEMON_TOKEN","DAEMON_BOOT_ID","APP_ROOT","PROXY_PORT"]),c34=["cookie","host","connection","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","accept-encoding","content-length","upgrade"],PY$=["connection","keep-alive","transfer-encoding","content-encoding","content-length"];sX={role:"studio.decocms.com/role",sandboxHandle:"studio.decocms.com/sandbox-handle",orgId:"studio.decocms.com/org-id",userId:"studio.decocms.com/user-id",env:"studio.decocms.com/env"},f3={orgSlug:"studio.decocms.com/org-slug",orgName:"studio.decocms.com/org-name",userEmail:"studio.decocms.com/user-email",userName:"studio.decocms.com/user-name",gitRepo:"studio.decocms.com/git-repo",gitRepoUrl:"studio.decocms.com/git-repo-url",gitBranch:"studio.decocms.com/git-branch"},n34=/^([A-Za-z0-9]([-A-Za-z0-9_.]*[A-Za-z0-9])?)?$/;o34=/^[a-z]([a-z0-9-]{0,30}[a-z0-9])?$/});var MY$={};J4(MY$,{waitForSandboxReady:()=>YB0,parseTenantPools:()=>NY$,getSandboxClaim:()=>v3,getHttpRoute:()=>oQ$,deleteSandboxClaim:()=>DB,deleteHttpRoute:()=>QB0,createSandboxClaim:()=>Zn,applyHttpRoute:()=>XB0,SandboxTimeoutError:()=>mS,SandboxError:()=>I9,PREVIEW_NOT_READY_HEADER:()=>nS,KubeConfig:()=>Ly,K8S_CONSTANTS:()=>S5,HTTPROUTE_CONSTANTS:()=>Xn,AgentSandboxProvider:()=>mp0});var ip0=D(()=>{Mp0();ep();Qn();qY$();yp0()});var vY$={};J4(vY$,{subscribeLifecycle:()=>op0,getSandboxProviderByKind:()=>np0,getOrInitSharedRunner:()=>tp0,__resetSharedLifecyclesForTesting:()=>wW4});function CY$($,Z){let X=kY$[$];if(X)return Promise.resolve(X);let Q=pp0[$];if(Q)return Q;let Y=Z().then((G)=>{return kY$[$]=G,G}).finally(()=>{delete pp0[$]});return pp0[$]=Y,Y}function KW4(){let $=process.env.STUDIO_SANDBOX_PREVIEW_URL_PATTERN;return $&&$.trim()!==""?$:void 0}function HW4(){let $=process.env.STUDIO_SANDBOX_TEMPLATE_NAME;return $&&$.trim()!==""?$:void 0}function FW4(){let $=process.env.STUDIO_ENV;return $&&$.trim()!==""?$:void 0}function NW4(){let $=process.env.STUDIO_SANDBOX_SENTINEL_TOKEN;return $&&$.trim()!==""?$:void 0}function UW4(){let $=process.env.STUDIO_SANDBOX_PREVIEW_GATEWAY_NAME?.trim(),Z=process.env.STUDIO_SANDBOX_PREVIEW_GATEWAY_NAMESPACE?.trim();if(!$&&!Z)return;if(!$||!Z)throw Error("STUDIO_SANDBOX_PREVIEW_GATEWAY_NAME and STUDIO_SANDBOX_PREVIEW_GATEWAY_NAMESPACE must both be set, or both unset. Half-configured per-claim HTTPRoute routing would silently fail to attach.");return{name:$,namespace:Z}}async function _Y$($,Z){let X=new kp(Z),Q=KW4();switch($){case"agent-sandbox":{let{AgentSandboxProvider:Y,parseTenantPools:G}=await Promise.resolve().then(() => (ip0(),MY$)),J=new MY(b0().encryptionKey);return new Y({stateStore:X,previewUrlPattern:Q,sandboxTemplateName:HW4(),envName:FW4(),previewGateway:UW4(),sentinelToken:NW4(),tenantPools:G(process.env.STUDIO_SANDBOX_TENANT_POOLS),meter:L$,mintCloneUrl:async(W,K)=>{if(!W.connectionId)return null;let H=O6$(W.cloneUrl);if(!H)return null;let{cloneUrl:F}=await QB(W.connectionId,H.owner,H.name,Z,J,{bufferMs:K?.bufferMs});return F},mintOrgFsConfig:async(W)=>{if(!W.orgSlug)return null;return await yZ0({boundAuth:{apiKey:{create:(H)=>F8.api.createApiKey({body:{...H,userId:W.userId}})}},storage:{orgRepoSyncs:new wE(Z)}},{orgSlug:W.orgSlug,orgId:W.orgId,baseUrl:b9()})??null}})}case"user-desktop":throw Error("user-desktop provider cannot be instantiated without a per-run link claim \u2014 call resolveSandboxProvider, which binds the link before constructing the provider.");default:throw Error(`Unknown sandbox provider kind: ${String($)}`)}}function np0($,Z){return CY$(Z,()=>_Y$(Z,$.db))}async function tp0(){let $;try{$=DE()}catch(X){return console.warn("[lifecycle] cannot resolve sandbox runner:",X instanceof Error?X.message:String(X)),null}return await CY$($,()=>_Y$($,l8().db))}function op0($,Z,X){let Q=LB.get(Z);if(Q){if(Q.terminated){if(Q.lastPhase)try{X(Q.lastPhase)}catch{}return{unsubscribe:DW4}}if(Q.listeners.add(X),Q.lastPhase)try{X(Q.lastPhase)}catch{}return VY$(Z,Q,X)}let Y=new AbortController,G={lastPhase:null,terminated:!1,listeners:new Set([X]),abort:Y};return LB.set(Z,G),LW4($,Z,G),VY$(Z,G,X)}function DW4(){}function VY$($,Z,X){return{unsubscribe(){if(LB.get($)!==Z)return;if(Z.listeners.delete(X),Z.listeners.size===0)LB.delete($),Z.abort.abort()}}}async function LW4($,Z,X){let Q=null;try{for await(let Y of $.watchClaimLifecycle(Z,X.abort.signal)){if(X.abort.signal.aborted)break;X.lastPhase=Y;let G=Y.kind==="ready"||Y.kind==="failed";if(G)X.terminated=!0;let J=Array.from(X.listeners);for(let W of J)try{W(Y)}catch{}if(G)break}}catch(Y){Q=Y}finally{if(!X.terminated&&!X.abort.signal.aborted&&X.listeners.size>0){let Y={kind:"failed",reason:"unknown",message:Q instanceof Error?Q.message:"Lifecycle watcher ended unexpectedly"};X.lastPhase=Y,X.terminated=!0;for(let G of Array.from(X.listeners))try{G(Y)}catch{}}if(LB.get(Z)===X)LB.delete(Z)}}function wW4(){for(let $ of LB.values())$.abort.abort();LB.clear()}var JW4,WW4,SY$,kY$,pp0,OW4,BW4,LB;var Gn=D(()=>{kF();gG();I6();Vm0();Yy();yL();q$();Gy();gY();L9();JW4=Symbol.for("decocms.sandbox.lifecycle.runners"),WW4=Symbol.for("decocms.sandbox.lifecycle.inflight"),SY$=globalThis,kY$=SY$[JW4]??={},pp0=SY$[WW4]??={};OW4=Symbol.for("decocms.sandbox.lifecycle.shared-lifecycles"),BW4=globalThis,LB=BW4[OW4]??=new Map});async function gZ($,Z){let{userId:X,branch:Q,virtualMcpMetadata:Y,explicitKind:G}=Z;if(G)return Jn($,G);if($.sandboxPreference==="agent-sandbox")return Jn($,"agent-sandbox");if($.sandboxPreference==="cluster-default")return Jn($,DE());let[J,...W]=EW4(Y,X,Q);if(J)return Jn($,W.length===0?J:jW4(J,W));return Jn($,fY$())}function EW4($,Z,X){let Q=c5($)[Z]?.[X];if(!Q)return[];let Y=Z3(Q);return Object.keys(Y)}function jW4($,Z){let X=fY$();if(X===$||Z.includes(X))return X;return $}function fY$(){return DE()}async function Jn($,Z){let X=Z==="user-desktop"?"agent-sandbox":Z;return{provider:await np0($,X),kind:X}}var xF=D(()=>{P8();kF();lQ();Gn()});var Wn;var rp0=D(()=>{Wn={npm:{install:"npm install",run:($)=>`npm run ${$}`,runtime:"node"},pnpm:{install:"pnpm install",run:($)=>`pnpm run ${$}`,runtime:"node"},yarn:{install:"yarn install",run:($)=>`yarn run ${$}`,runtime:"node"},bun:{install:"bun install",run:($)=>`bun run ${$}`,runtime:"bun"},deno:{install:"deno install",run:($)=>`deno task ${$}`,runtime:"deno"}}});function yF($,Z){return Z?`thread:${$}/${Z}`:`thread:${$}`}function gF($){return`sandbox/thread-${$.replace(/^thread:/,"").replace(/\//g,"-")}`}function b3($){if(!$||!$.startsWith("thread:"))return null;return $.slice(7).split("/")[0]||null}async function tS($,Z,X){return sp0(await ap0($,Z),X)}async function ap0($,Z){let X=b3(Z);if(!X)return null;return await $.storage.threads.get(X).catch(()=>null)}function sp0($,Z){return $?.created_by??Z}async function oS($,Z){if(!Z)return null;let X=await $.storage.threads.get(Z).catch(()=>null);if(!X)return null;return X.metadata??{}}async function bY$($,Z){let Q=(await oS($,Z))?.headRef;return typeof Q==="string"&&Q.length>0?Q:null}async function xY$($,Z,X){let Q=await oS($,Z);if(!Q)return;if(Q.headRef===X)return;await $.storage.threads.update(Z,{metadata:{...Q,headRef:X}}).catch((Y)=>console.warn("[thread-repo] setThreadHeadRef failed",Y))}function zW4($,Z){let X=g90(Z,$.owner,$.name);if(!X||X.id===$.connectionId)return null;let Q=q5(X);return{...$,connectionId:X.id,...Q?.installationId?{installationId:Q.installationId}:{}}}async function wB($,Z){let X=await oS($,Z),Q=X?.githubRepo??null;if(!Z||!X||!Q?.connectionId)return Q;try{let Y=$.storage.threads.getOrganizationId();if(!Y)return Q;if(await $.storage.connections.findById(Q.connectionId,Y))return Q;let{items:G}=await $.storage.connections.list(Y),J=zW4(Q,G);if(!J)return Q;return await $.storage.threads.update(Z,{metadata:{...X,githubRepo:J}}),console.warn("[thread-repo] re-pointed thread at a live repo connection",{threadId:Z,from:Q.connectionId,to:J.connectionId}),J}catch(Y){return console.warn("[thread-repo] repoint check failed",Y),Q}}function ep0($){if($.pinnedRef)return $.pinnedRef;if($.runBranch&&$.runBranch===yF($.threadId))return $.runBranch;if($.threadRepo)return yF($.threadId,$.threadRepo.connectionId);if(!$.agentRepo)return"ephemeral";return $.runBranch??`thread:${$.threadId}`}async function $n0($,Z){let Q=(await oS($,Z))?.pinnedRef;return typeof Q==="string"&&Q.length>0?Q:null}async function FB0($,Z){let[X,Q]=await Promise.all([wB($,Z.threadId),$n0($,Z.threadId)]);return ep0({...Z,threadRepo:X,pinnedRef:Q})}async function yY$($,Z,X,Q,Y,G){let J=await oS($,Z);if(!J)return;let W=Mp(c5(J),X,Q,Y,G);await $.storage.threads.update(Z,{metadata:{...J,sandboxMap:W}}).catch((K)=>console.warn("[thread-repo] setThreadSandboxMapEntry failed",K))}async function NB0($,Z){return c5(await oS($,Z))}async function gY$($,Z,X,Q,Y){let G=await oS($,Z);if(!G)return;let J=km0(c5(G),X,Q,Y);if(!J)return;await $.storage.threads.update(Z,{metadata:{...G,sandboxMap:J}}).catch((W)=>console.warn("[thread-repo] removeThreadSandboxMapEntry failed",W))}var x3=D(()=>{VQ();lQ()});function Ay($){if(!$)return null;let Z=$.runtime;if(!Z||typeof Z!=="object")return null;let X=Z.env;if(!Array.isArray(X))return null;let Q=[];for(let Y of X){if(!Y||typeof Y!=="object")continue;let G=Y;if(typeof G.key!=="string"||!s$0.test(G.key))continue;if(G.kind==="literal"&&typeof G.value==="string"){Q.push({key:G.key,kind:"literal",value:G.value});continue}if(G.kind==="secret"&&typeof G.secretId==="string"&&G.secretId.length>0)Q.push({key:G.key,kind:"secret",secretId:G.secretId})}return Q.length===0?null:Q}function hY$($){if(!$)return null;let Z=$.runtime;if(!Z||typeof Z!=="object")return null;let X=Z.submoduleCredentials;if(!Array.isArray(X))return null;let Q=[];for(let Y of X){if(!Y||typeof Y!=="object")continue;let G=Y;if(typeof G.host==="string"&&G.host.length>0&&typeof G.secretId==="string"&&G.secretId.length>0)Q.push({host:G.host,secretId:G.secretId})}return Q}async function uY$($,Z){r(Z);let X=t(Z);await Z.access.check();let Q=Y1(Z);if(!Q)throw Error("User ID required");let Y=await Z.storage.virtualMcps.findById($.virtualMcpId);if(!Y||Y.organization_id!==X.id)throw Error("Virtual MCP not found");let G=Y.metadata??{},J=c5(G),W=await tS(Z,$.branch,Q),K=EK(J,W,$.branch,$.sandboxProviderKind);return{virtualMcp:Y,metadata:G,userId:Q,sandboxUserId:W,entry:K,organization:X}}function PW4($){if($===null||!/^\d+$/.test($))return null;let Z=Number($);return Z>=1&&Z<=65535?$:null}function cY$($){let Z=$.runtime??null,Q=Z?.selected??null,Y=PW4(Z?.port??null),G=Z?.path??null;if(!Q||!(Q in Wn))return{packageManager:null,runtime:null,port:Y,packageManagerPath:G,runtimeBinPath:null};let J=Wn[Q].runtime;return{packageManager:Q,runtime:J,port:Y,packageManagerPath:G,runtimeBinPath:J==="deno"?"/opt/deno/bin":J==="bun"?"/opt/bun/bin":null}}var Kn=D(()=>{P8();rp0();lQ();x3()});import{sql as AW4}from"kysely";function lY$($){return $ instanceof Date?$.toISOString():String($)}class Zn0{db;vault;constructor($,Z){this.db=$;this.vault=Z}rowToInfo($){return{id:$.id,organizationId:$.organization_id,scope:$.scope,userId:$.user_id,name:$.name,description:$.description,createdBy:$.created_by,createdAt:lY$($.created_at),updatedBy:$.updated_by,updatedAt:lY$($.updated_at)}}assertVisible($,Z){if($.scope==="user"&&$.user_id!==Z)throw new EB($.id)}async create($){let Z=t8("sec"),X=await this.vault.encrypt($.value),Q=new Date,Y=await this.db.insertInto("secrets").values({id:Z,organization_id:$.organizationId,scope:$.scope.kind,user_id:$.scope.kind==="user"?$.scope.userId:null,name:$.name,encrypted_value:X,description:$.description??null,created_by:$.createdBy,created_at:Q,updated_by:$.createdBy,updated_at:Q}).returning(UB0).executeTakeFirstOrThrow();return this.rowToInfo(Y)}async update($){let Z=await this.db.selectFrom("secrets").where("id","=",$.id).where("organization_id","=",$.organizationId).select(["id","scope","user_id"]).executeTakeFirst();if(!Z)throw new sG($.id);this.assertVisible(Z,$.callerUserId);let X={updated_by:$.updatedBy,updated_at:new Date};if($.value!==void 0)X.encrypted_value=await this.vault.encrypt($.value);if($.description!==void 0)X.description=$.description;let Q=await this.db.updateTable("secrets").set(X).where("id","=",$.id).where("organization_id","=",$.organizationId).returning(UB0).executeTakeFirstOrThrow();return this.rowToInfo(Q)}async delete($,Z,X){let Q=await this.db.selectFrom("secrets").where("id","=",$).where("organization_id","=",Z).select(["id","scope","user_id"]).executeTakeFirst();if(!Q)throw new sG($);this.assertVisible(Q,X),await this.db.deleteFrom("secrets").where("id","=",$).where("organization_id","=",Z).execute()}async list($){let Z=this.db.selectFrom("secrets").where("organization_id","=",$.organizationId).select(UB0);if($.scope?.kind==="user")Z=Z.where("scope","=","user").where("user_id","=",$.scope.userId);else if($.scope?.kind==="organization")Z=Z.where("scope","=","organization");else Z=Z.where((Q)=>Q.or([Q("scope","=","organization"),Q.and([Q("scope","=","user"),Q("user_id","=",$.callerUserId)])]));return(await Z.orderBy("created_at","desc").execute()).map((Q)=>this.rowToInfo(Q))}async findById($,Z,X){let Q=await this.db.selectFrom("secrets").where("id","=",$).where("organization_id","=",Z).select(UB0).executeTakeFirst();if(!Q)throw new sG($);return this.assertVisible(Q,X),this.rowToInfo(Q)}async resolveById($,Z,X){let Q=await this.db.selectFrom("secrets").where("id","=",$).where("organization_id","=",Z).selectAll().executeTakeFirst();if(!Q)throw new sG($);this.assertVisible(Q,X);let Y=await this.vault.decrypt(Q.encrypted_value);return{info:this.rowToInfo(Q),value:Y}}async resolveByName($){let Z=this.db.selectFrom("secrets").where("organization_id","=",$.organizationId).where("scope","=",$.scope.kind).where(AW4`lower(name) = lower(${$.name})`).selectAll();if($.scope.kind==="user")Z=Z.where("user_id","=",$.scope.userId);let X=await Z.executeTakeFirst();if(!X)throw new sG(`${$.scope.kind}:${$.name}`);let Q=await this.vault.decrypt(X.encrypted_value);return{info:this.rowToInfo(X),value:Q}}}var UB0,sG,EB;var Hn=D(()=>{gX();UB0=["id","organization_id","scope","user_id","name","description","created_by","created_at","updated_by","updated_at"];sG=class sG extends Error{constructor($){super(`Secret ${$} not found`);this.name="SecretNotFoundError"}};EB=class EB extends Error{constructor($){super(`Access denied for secret ${$}`);this.name="SecretAccessDeniedError"}}});async function jB($,Z){let X=$.body?.getReader();if(!X)return $.text();let Q=new TextDecoder,Y="",G=0;for(;;){let{done:J,value:W}=await X.read();if(J)break;if(G+=W.byteLength,G>Z)throw await X.cancel().catch(()=>{}),new dY$(`Upstream response exceeded ${Z} bytes`);Y+=Q.decode(W,{stream:!0})}return Y+=Q.decode(),Y}var dY$;var Fn=D(()=>{dY$=class dY$ extends Error{}});async function OB0({ctx:$,runner:Z,handle:X,orgId:Q,userId:Y,entries:G}){if(!G||G.length===0)return;let J={};for(let K of G){if(K.kind==="literal"){J[K.key]=K.value;continue}try{let{value:H}=await $.storage.secrets.resolveById(K.secretId,Q,Y);J[K.key]=H}catch(H){if(H instanceof sG||H instanceof EB){console.warn(`[SANDBOX_START] skipping env ${K.key}: ${H.message}. Re-link or recreate the secret to restore.`);continue}throw H}}if(Object.keys(J).length===0)return;let W=await Z.proxyDaemonRequest(X,"/_sandbox/config",{method:"PUT",headers:new Headers({"content-type":"application/json"}),body:JSON.stringify({env:J})});if(!W.ok){let K=await jB(W,TW4).catch(()=>W.statusText);console.warn(`[SANDBOX_START] daemon rejected env patch (${W.status}): ${K}`)}}var TW4=10485760;var Xn0=D(()=>{Hn();Fn()});async function mY$({ctx:$,orgId:Z,userId:X,entries:Q}){if(!Q||Q.length===0)return[];let Y=[];for(let G of Q)try{let{value:J}=await $.storage.secrets.resolveById(G.secretId,Z,X);Y.push({host:G.host,token:J})}catch(J){if(J instanceof sG||J instanceof EB){console.warn(`[SANDBOX_START] skipping submodule credential for ${G.host}: ${J.message}. Re-link or recreate the secret to restore.`);continue}throw J}return Y}var iY$=D(()=>{Hn()});async function tY$($,Z,X,Q,Y){let G=await mY({connectionId:$,tokenStorage:new l6(Q,Y)});if(!G.accessToken)return null;return rY$(Z,X,G.accessToken)}function oY$($,Z){return rY$($,Z,null)}async function rY$($,Z,X){let Q=new Map,Y=new Set(pY$.map((K)=>K.path));for(let K of Object.values(nY$))for(let H of K??[])Y.add(H);await Promise.all(Array.from(Y).map(async(K)=>{Q.set(K,await IW4($,Z,K,X))}));let G=pY$.find(({path:K})=>Q.get(K)!==null);if(!G)return null;let J=nY$[G.pm]??[],W=null;for(let K of J)if(W=qW4(Q.get(K)??null),W)break;return{packageManager:G.pm,devPort:W}}async function IW4($,Z,X,Q){let Y=`https://api.github.com/repos/${$}/${Z}/contents/${encodeURIComponent(X)}`;try{let G={Accept:"application/vnd.github+json","User-Agent":"studio-runtime-detect"};if(Q)G.Authorization=`token ${Q}`;let J=await fetch(Y,{headers:G,signal:AbortSignal.timeout(5000)});if(!J.ok)return null;let W=await J.json();if(!W.content||W.encoding!=="base64")return null;return Buffer.from(W.content,"base64").toString("utf8")}catch{return null}}function qW4($){if(!$)return null;try{let Z=JSON.parse($),X=Z.tasks??Z.scripts??{},Y=(X.dev??X.start??"").match(RW4)?.[1]??null;if(!Y)return null;let G=Number(Y);return G>=1&&G<=65535?Y:null}catch{return null}}var pY$,nY$,RW4;var aY$=D(()=>{oG();dG();pY$=[{path:"deno.json",pm:"deno"},{path:"deno.jsonc",pm:"deno"},{path:"bun.lock",pm:"bun"},{path:"bunfig.toml",pm:"bun"},{path:"pnpm-lock.yaml",pm:"pnpm"},{path:"yarn.lock",pm:"yarn"},{path:"package-lock.json",pm:"npm"},{path:"package.json",pm:"bun"}],nY$={deno:["deno.json","deno.jsonc"],bun:["package.json"],pnpm:["package.json"],yarn:["package.json"],npm:["package.json"]},RW4=/(?:--port|PORT=|:)(\d{4,5})/});function MW4($){return($??"").normalize("NFKD").replace(/[\u0300-\u036F]/g,"").toLowerCase().replace(/[^a-z0-9]+/g,"-").replace(/^-+|-+$/g,"")||"user"}function BB0($){return $?.name||$?.email?.split("@")[0]||void 0}function DB0($){let Z=MW4($),X=Date.now().toString(36).split("").reverse().join("");return`${Z}-${X}`}async function Nn($,Z,X){try{await $.storage.threads.stampRuntimeIfAbsent(Z,X)}catch(Q){console.warn(`[stampRuntimeIfAbsent] ${Z}: ${Q instanceof Error?Q.message:String(Q)}`)}}function sY$($){let Z=$?.trim();if(!Z)return null;try{let X=new URL(Z);if(X.protocol!=="http:"&&X.protocol!=="https:")return null;return X.href}catch{return null}}function LB0($){return sY$($?.previewServerUrl)??sY$($?.productionUrl)}function rS($){return $==="cms"||$==="sandbox"?$:null}function kW4($){return!!LB0($)&&$?.fastPreview===!0}function wB0($){return kW4($)?"cms":"sandbox"}var Qn0;var Ty=D(()=>{Qn0=["cms","sandbox"]});function eY$($){let{current:Z,detached:X,base:Q}=$.status??{};if(typeof Z!=="string"||Z.length===0)return null;if(X===!0)return null;if(Z===$.requestedRef)return null;if(VW4.has(Z))return null;if(typeof Q==="string"&&Q.length>0&&Z===Q)return null;return Z}function EB0($){if(!$.branch.startsWith("thread:"))return $.branch;if($.sticky&&$.recordedHeadRef)return $.recordedHeadRef;return $.derivedRef}var VW4;var jB0=D(()=>{VW4=new Set(["main","master","trunk","develop","HEAD"])});async function $G$($,Z){if(!$)return{hosts:[],allowSameHostDev:!1};let X;try{X=await $.presignedGetUrl("link-dispatch/_allowlist_probe",60,{requireFetchable:!0})}catch{return{hosts:[],allowSameHostDev:!1}}let Q;try{Q=new URL(X)}catch{return{hosts:[],allowSameHostDev:!1}}if(Q.protocol!=="https:"&&Q.protocol!=="http:")return{hosts:[],allowSameHostDev:!1};let Y=Q.hostname,G=SW4.has(Y);return{hosts:[Y],allowSameHostDev:G&&!Z.isProduction}}var SW4;var ZG$=D(()=>{SW4=new Set(["127.0.0.1","localhost","::1","[::1]","0.0.0.0"])});import{z as y3}from"zod";async function Ry($,Z){r(Z);let X=t(Z),Q=Y1(Z);if(!Q)throw Error("User ID required");let Y=await Z.storage.virtualMcps.findById($.virtualMcpId);if(!Y||Y.organization_id!==X.id)throw Error("Virtual MCP not found");let G=Y.metadata??{},J=await tS(Z,$.branch,Q),W=EK(c5(G),J,$.branch,$.sandboxProviderKind),K=$.sandboxProviderKind,{provider:H}=await gZ(Z,{userId:J,branch:$.branch,virtualMcpMetadata:G,explicitKind:K});if(W){if(await H.alive(W.sandboxHandle).catch(()=>!0))return W;await ZB(Z.storage.virtualMcps,$.virtualMcpId,Q,J,$.branch,K).catch((L)=>{console.warn("[ensureSandbox] failed to reap stale entry",L)})}let F=b3($.branch)??Z.metadata?.threadId;if(F)Nn(Z,F,"sandbox");let U=await wB(Z,F)??G.githubRepo??null,{entry:O}=await QG$({ctx:Z,userId:Q,sandboxUserId:J,orgId:X.id,virtualMcpId:$.virtualMcpId,branch:$.branch,metadata:G,githubRepo:U,existing:null,providerKind:K,runner:H,...$.purpose?{purpose:$.purpose}:{}});return O}async function QG$($){let{ctx:Z,userId:X,sandboxUserId:Q,orgId:Y,virtualMcpId:G,branch:J,metadata:W,existing:K,runner:H,purpose:F}=$,N=F==="harness-run",U=$.githubRepo?await _W4({ctx:Z,orgId:Y,virtualMcpId:G,userId:X,githubRepo:$.githubRepo}):null,{runtime:O,packageManager:B,port:L,packageManagerPath:w}=cY$(W),E;if(U){if(U.connectionId)await XB({ctx:Z,connectionId:U.connectionId,organizationId:Y,forceRefresh:!0,onLegacyMintError:(x0)=>{console.error("[provisionSandbox] repo-scoped legacy token mint failed",{connectionId:U.connectionId,error:x0.message})}});let{cloneUrl:L0,gitUserName:e,gitUserEmail:o}=U.connectionId?await QB(U.connectionId,U.owner,U.name,Z.db,Z.vault):U6$(U.owner,U.name);if(!B){let x0=U.connectionId?await tY$(U.connectionId,U.owner,U.name,Z.db,Z.vault):await oY$(U.owner,U.name);if(x0)B=x0.packageManager,O=Wn[x0.packageManager].runtime,L=x0.devPort??L,await vW4(Z,G,X,x0.packageManager,x0.devPort)}let j0=b0().sandboxStickyHeadRefEnabled,X0=EB0({branch:J,derivedRef:gF(J),recordedHeadRef:j0?await bY$(Z,b3(J)):null,sticky:j0}),P0=await mY$({ctx:Z,orgId:Y,userId:X,entries:hY$(W)});E={cloneUrl:L0,...U.connectionId?{connectionId:U.connectionId}:{},userName:e,userEmail:o,branch:X0,displayName:`${U.owner}/${U.name}`,submoduleCredentials:P0}}let j=O&&B&&!N?{runtime:O,packageManager:B,...L!==null?{devPort:Number(L)}:{},...w?{packageManagerPath:w}:{}}:void 0,z=Ip({orgId:Y,virtualMcpId:G,branch:J}),A=H.kind==="user-desktop"?await $G$(Z.objectStorage,{isProduction:b0().nodeEnv==="production"}):null,P=(H.kind==="user-desktop"||H.kind==="agent-sandbox")&&!b0().orgFsMountsDisabled,I;if(P){let L0=Z.organization?.slug??(await Z.db.selectFrom("organization").select(["slug"]).where("id","=",Y).executeTakeFirst())?.slug;if(L0)I=await yZ0(Z,{orgSlug:L0,orgId:Y,baseUrl:b9()})}await bW4(H);let q=await H.ensure({userId:Q,projectRef:z},{branch:J,repo:E,workload:j,cloneOnly:N,...F?{purpose:F}:{},tenant:{orgId:Y,userId:Q,...Z.organization?.slug?{orgSlug:Z.organization.slug}:{},...Z.organization?.name?{orgName:Z.organization.name}:{},...Z.auth.user?.email?{userEmail:Z.auth.user.email}:{},...Z.auth.user?.name?{userName:Z.auth.user.name}:{}},...A?{offloadAllowedHosts:A.hosts,offloadAllowSameHostDev:A.allowSameHostDev}:{},...I?{orgFsConfigJson:I}:{}}),M=Ay(W);await OB0({ctx:Z,runner:H,handle:q.handle,orgId:Y,userId:X,entries:M});let l=!!K&&K.sandboxHandle===q.handle&&K?.createdAt?K.createdAt:Date.now(),f=W.runtime?.selected??null,x=W.runtime?.port??null,n=W.runtime?.path??null,u={sandboxHandle:q.handle,previewUrl:q.previewUrl,sandboxApiUrl:q.previewUrl,sandboxProviderKind:H.kind,createdAt:l,startedWith:{packageManager:f,port:x,path:n}};await Z6$(Z.storage.virtualMcps,G,X,Q,J,$.providerKind,u);let a=b3(J)??Z.metadata?.threadId;if(a)await yY$(Z,a,Q,J,$.providerKind,u);let O0=!K||K.sandboxHandle!==q.handle;return{entry:u,isNewVm:O0}}async function _W4($){let{ctx:Z,orgId:X,virtualMcpId:Q,userId:Y,githubRepo:G}=$;if(!G.connectionId)return G;if(await Z.storage.connections.findById(G.connectionId,X))return G;let{items:W}=await Z.storage.connections.list(X),K=g90(W,G.owner,G.name);if(!K)return console.warn("[provisionSandbox] recorded repo connection no longer exists and no live connection covers the repo",{virtualMcpId:Q,connectionId:G.connectionId}),G;console.warn("[provisionSandbox] healed dangling repo connection",{virtualMcpId:Q,staleConnectionId:G.connectionId,connectionId:K.id});try{let F=(await Z.storage.virtualMcps.findById(Q))?.metadata??{},N=F.githubRepo;if(N?.connectionId===G.connectionId){let U=q5(K);await Z.storage.virtualMcps.update(Q,Y,{metadata:{...F,githubRepo:{...N,connectionId:K.id,...U?{installationId:U.installationId}:{}}}})}}catch(H){console.warn("[provisionSandbox] failed to persist healed repo connection",{virtualMcpId:Q,error:H.message})}return{...G,connectionId:K.id}}async function vW4($,Z,X,Q,Y){let G=await $.storage.virtualMcps.findById(Z);if(!G)return;let J=G.metadata??{};await $.storage.virtualMcps.update(Z,X,{metadata:{...J,runtime:{selected:Q,port:Y}}})}async function bW4($){if(!$.hasSchedulableCapacity)return;let Z=Date.now()+XG$,X=!1;while(!await $.hasSchedulableCapacity()){if(Date.now()>=Z)throw Error(`sandbox provisioning failed: the cluster has had no room to schedule another sandbox for ${Math.round(XG$/1000)}s`);if(!X)X=!0,console.warn("[ensureSandbox] waiting for cluster capacity \u2014 a sandbox pod cannot be scheduled right now");await D$(fW4)}}var CW4,Yn0,XG$=150000,fW4=5000;var Un=D(()=>{kF();w4();S0();Kn();Xn0();iY$();lQ();VQ();Yy();aY$();rp0();xF();Ty();x3();jB0();ZG$();q$();L9();Gy();lQ();CW4=y3.enum(["agent-sandbox","user-desktop","cluster"]),Yn0=c({name:"SANDBOX_START",description:"Start a sandbox with the connected GitHub repo and dev server.",annotations:{title:"Start VM Preview",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!1,openWorldHint:!0},_meta:{ui:{visibility:"app"}},inputSchema:y3.object({virtualMcpId:y3.string().describe("Virtual MCP ID"),branch:y3.string().min(1).optional().describe("Git branch to check out. Pass the thread's branch whenever the caller has one: when omitted the handler mints a fresh `<user-slug>-<timestamp>` name, which becomes a SEPARATE sandbox from the one the thread's own branch resolves to. The resolved branch is returned in the response so callers can persist it."),sandboxProviderKind:CW4.optional().describe("Explicit runtime choice. Hosted provider is `agent-sandbox`; legacy `cluster` input is accepted only for compatibility and normalized to `agent-sandbox`. When omitted, defaults to `user-desktop` if the acting user's link daemon is online, else the env kind."),threadId:y3.string().optional().describe("The session asking for a sandbox. A thread stamped `cms` is refused \u2014 that session reads and writes over the decofile API and a pod would be invisible to it. Optional: an unstamped (legacy) thread is always allowed, and so is a caller with no thread.")}),outputSchema:y3.object({previewUrl:y3.string().nullable(),sandboxHandle:y3.string(),branch:y3.string(),isNewVm:y3.boolean(),sandboxProviderKind:y3.enum(["agent-sandbox","user-desktop"])}),handler:async($,Z)=>{r(Z);let X=t(Z);await Z.access.check();let Q=$.branch??DB0(BB0(Z.auth.user)),Y=b3(Q)??$.threadId??Z.metadata?.threadId;if(Y){let E=await Z.storage.threads.get(Y).catch(()=>null);if(rS(E?.metadata?.runtime)==="cms")throw Error("This chat is a CMS session and does not use a sandbox. Start a coding session to get one.")}let G=Y1(Z);if(!G)throw Error("User ID required");let J=await tS(Z,Q,G),W=await Z.storage.virtualMcps.findById($.virtualMcpId);if(!W||W.organization_id!==X.id)throw Error("Virtual MCP not found");let K=W.metadata??{},H=$.sandboxProviderKind?OE($.sandboxProviderKind):void 0,{provider:F,kind:N}=await gZ(Z,{userId:J,branch:Q,virtualMcpMetadata:K,explicitKind:H}),U=EK(c5(K),J,Q,N),B=await wB(Z,b3(Q)??Z.metadata?.threadId)??K.githubRepo??null,{entry:L,isNewVm:w}=await QG$({ctx:Z,userId:G,sandboxUserId:J,orgId:X.id,virtualMcpId:$.virtualMcpId,branch:Q,metadata:K,githubRepo:B,existing:U,providerKind:N,runner:F});if(Y)Nn(Z,Y,"sandbox");return{...L,branch:Q,isNewVm:w,sandboxProviderKind:N}}})});function xW4($){let{publicUrl:Z,agentId:X,organization:Q,target:Y,threadId:G}=$;if(Y==="agent-tools")return`${Z}/mcp/virtual-mcp/${X}`;if(!Q.slug)throw new GG$(Q.id,Y);if(Y==="task-run"){if(!G)throw Error("a task-run MCP endpoint is scoped to a run: threadId is required");return`${Z}/api/${Q.slug}/mcp/task-run/${encodeURIComponent(G)}`}return`${Z}/api/${Q.slug}/mcp/self`}async function zB0($,Z,X,Q,Y="agent-tools",G,J={"*":["*"]}){let W=xW4({publicUrl:b9(),agentId:Z,organization:X,target:Y,...G?{threadId:G}:{}}),K=await $.boundAuth.apiKey.create({name:Q,permissions:J,expiresIn:YG$,metadata:{organization:{id:X.id,slug:X.slug,name:X.name}}});return{url:W,headers:{Authorization:`Bearer ${K.key}`,"x-org-id":X.id},expiresAt:Date.now()+YG$*1000}}function JG$($){let{publicUrl:Z,organizationSlug:X,headers:Q,connections:Y}=$,G=new Set;return Y.map((J)=>{let W=yW4(J.slug??J.title??"")||"mcp",K=W;for(let H=2;G.has(K);H++)K=`${W}-${H}`;return G.add(K),{name:K,url:`${Z}/api/${X}/mcp/${encodeURIComponent(J.id)}`,headers:Q}})}function yW4($){return $.toLowerCase().replace(/[^a-z0-9]+/g,"-").replace(/^-+|-+$/g,"")}function WG$($){return{self:[...$.toolNames],...$.grants}}var YG$=3600,GG$;var Gn0=D(()=>{L9();GG$=class GG$ extends Error{constructor($,Z){super(`cannot mint a "${Z}" MCP endpoint for organization "${$}": the org-scoped path needs the org slug, which was not loaded.`);this.name="MissingOrganizationSlugError"}}});async function gW4($,Z,X,Q){try{let Y=$.organization;if(!Y)return;let G=await zB0($,Q.virtualMcpId,Y,"tool-scripting"),J=await Z.proxyDaemonRequest(X,"/_sandbox/tools/sync",{method:"POST",headers:new Headers({"content-type":"application/json"}),body:JSON.stringify(G)});if(!J.ok)console.warn("[cluster-sandbox-fs] tools/sync failed",J.status,await J.text().catch(()=>""))}catch(Y){console.warn("[cluster-sandbox-fs] tools/sync failed",Y)}}async function Iy($,Z){let{provider:X,kind:Q}=await gZ($,{userId:Z.userId,branch:Z.branch,virtualMcpMetadata:null}),Y=null,G=()=>{if(!Y){if(Y=Ry({virtualMcpId:Z.virtualMcpId,branch:Z.branch,sandboxProviderKind:Q},$).then((K)=>K.sandboxHandle),Y.catch(()=>{Y=null}),Z.syncTools)Y.then((K)=>gW4($,X,K,{virtualMcpId:Z.virtualMcpId,providerKind:Q})).catch(()=>{})}return Y},J=Z.branch==="ephemeral"||Q==="user-desktop";return Mm0(X,{ensureHandle:G,invalidateHandle:async(K)=>{let H=Y;if(Y=null,!J&&!K?.force)return;try{await ZB($.storage.virtualMcps,Z.virtualMcpId,Z.userId,Z.userId,Z.branch,Q)}catch(F){console.warn("[cluster-sandbox-fs] failed to reap vmMap entry",F)}if(H&&typeof X.forgetHandle==="function")try{let F=await H;await X.forgetHandle(F)}catch(F){console.warn("[cluster-sandbox-fs] forgetHandle failed",F)}},canAutoRestart:J,threadId:Z.threadId})}async function KG$($,Z){try{let X=await Iy($,Z),{stdout:Q}=await X.onBash("test -d .deco && echo __DECO_SITE__");return Q.includes("__DECO_SITE__")}catch(X){return console.warn("[cluster-sandbox-fs] .deco probe failed; assuming deco site",X),!0}}var PB0=D(()=>{kF();Gn0();xF();Un();lQ()});import{z as HG$}from"zod";function qy($){let Z=[];for(let X of $){if(X.status!=="active")continue;let Q=q5(X);if(!Q)continue;Z.push({connectionId:X.id,owner:Q.owner,repo:Q.repo,installationId:Q.installationId})}return Z}async function uW4($,Z){let{items:X}=await $.storage.connections.list(Z,{slug:"mcp-github"});return qy(X)}function cW4($){let Z=$.split(`
 `).map((Q)=>Q.trim()).filter((Q)=>Q&&Q!==".git"&&Q!=="__CLONED__"),X=Z.length>0;return{cloned:X,listing:X?Z.join(`
 `):""}}function lW4($){let Z="Load a GitHub repository into this conversation's sandbox so the file tools (read/write/edit/bash/grep/glob) and dev server operate on that repo, and open its live Preview. Waits until the repo is cloned before returning. Calling it again switches the repo. File tools operate on the loaded repo from your NEXT message (this turn's tools are still bound to the previous workspace), so after loading, prefer the file listing this tool returns over re-running bash in the same turn.",X=$.map((Q)=>`- ${Q.owner}/${Q.repo} (connectionId: ${Q.connectionId})`).join(`
 `);return`${Z}
@@ -2861,7 +2861,7 @@ Respond with the structured verdict and a short reason.`,bh$;var yh$=D(()=>{B4()
 ${G.join(`
 `)}`:Y}function JK6($){let Z=new Set;for(let X of $)for(let Q of X.split(`
 `)){let Y=Q.trim();if(/^Co-authored-by:\s/i.test(Y))Z.add(Y)}return[...Z]}var Pu$=200,aW6=12,eW6,ZK6=300,PZ1=3;var AZ1=D(()=>{d_();MA0();eW6={aheadBy:0,behindBy:0,files:[]}});function KK6($){if(!$||$.includes(".."))return!1;return WK6.test($)}function Tu$($){let Z=typeof $.__resolveType==="string"?$.__resolveType:null;if(!Z||!KK6(Z))return null;let{__resolveType:X,...Q}=$;return{resolveType:Z,payload:Q}}function Ru$($,Z){return`${$.replace(/\/+$/,"")}/deco/invoke/${Z}`}var WK6;var Iu$=D(()=>{WK6=/^[\w./@-]+$/});function TZ1($){let Z;try{Z=new URL($)}catch{return null}if(!Z.hostname.endsWith(".localhost"))return null;let X=Z.host;return Z.hostname="127.0.0.1",{url:Z.toString(),hostHeader:X}}function ca($,Z){let X=$?.githubRepo;if(!X?.owner||!X?.name)return null;if(!X.connectionId)return X;if(!Z.includes(X.connectionId))return null;return X}async function qu$($,Z,X,Q){if(!Q.connectionId)throw new i_("Push requires a connected GitHub account. Connect mcp-github for this project and restart the sandbox.");let Y=$.organization?.id;if(!Y)throw new i_(Y9);await XB({ctx:$,connectionId:Q.connectionId,organizationId:Y,forceRefresh:!0,onLegacyMintError:(F)=>{let N=F instanceof Error?F.message:Y9;throw new i_(N)}});let{cloneUrl:G,gitUserName:J,gitUserEmail:W}=await QB(Q.connectionId,Q.owner,Q.name,$.db,$.vault).catch((F)=>{let{code:N,message:U}=N6$(F instanceof Error?F.message:String(F));throw N?new i_(U):F}),K=Uu($),H=await Z.proxyDaemonRequest(X,"/_sandbox/config",{method:"PUT",headers:new Headers({"content-type":"application/json"}),body:JSON.stringify({git:{repository:{cloneUrl:G},identity:{userName:J,userEmail:W}},...K?{operator:K}:{}})});if(!H.ok){let F=await jB(H,HK6).catch(()=>H.statusText);throw Error(`Failed to refresh sandbox git credentials (${H.status}): ${F}`)}}var HK6=10485760,i_;var RZ1=D(()=>{oG();DA0();Fn();_m0();Yy();i_=class i_ extends Error{constructor($){super($);this.name="GitPushAuthError"}}});function NK6($){let Z=$.startsWith("thread:")?$.slice(7):$;if(!Z||Z.length>255||Z.includes("..")||Z.startsWith("/")||Z.endsWith("/")||Z.endsWith(".lock")||!FK6.test(Z))throw Error(`Invalid branch name: ${$}`)}function p_($){return AbortSignal.any([$.req.raw.signal,AbortSignal.timeout(OK6)])}async function DK6($,Z){let X=$.var.studioContext,Q=b3(Z.branch),Y=$.req.query("thread")??Q,G=Y&&Y===Q?Z.branchThread:Y?await X.storage.threads.get(Y).catch(()=>null):null,J=G?.virtual_mcp_id===Z.virtualMcpId?G:null,W=rS(J?.metadata?.runtime);if(W)return W;let K=wB0(Z.virtualMcpMetadata),H=K==="cms"?await ZZ1(X,{claimName:Z.claimName,userId:Z.sandboxUserId,branch:Z.branch,virtualMcpMetadata:Z.virtualMcpMetadata}):"alive",F=K==="cms"&&H!=="alive"?"cms":"sandbox",N=!!J&&(H==="gone"||H==="alive"&&K==="cms");if(N&&J)Nn(X,J.id,F);if(K==="cms")console.log("sandbox proxy: no runtime stamp",{route:$.req.path,method:$.req.method,reason:J?"unstamped":"threadless",liveness:H,resolved:F,stamped:N});return F}async function LK6($){let Z=$.get("vmClaim");if(Z.runner)return Z.runner;try{let{provider:X}=await gZ($.var.studioContext,{userId:Z.userId,branch:Z.branch,virtualMcpMetadata:Z.virtualMcpMetadata});return X}catch{return null}}function n_($){let{runner:Z}=$.get("vmClaim");if(!Z)return $.json({error:"No sandbox runner configured"},503);return Z}async function Eu($){let{virtualMcpMetadata:Z,connectionIds:X}=$.get("vmClaim"),Q=$.var.studioContext,Y=ca(Z,X);if(!Y)throw new u4(404,"AUTH","repo","Project has no GitHub repository");let G=t(Q);return wA0(Q,G.id,Y)}function IZ1($,Z){if(Z instanceof LA0)return $.json({error:Z.message},429,{...z5,...Z.retryAfterMs===null?{}:{"Retry-After":String(Math.ceil(Z.retryAfterMs/1000))}});if(Z instanceof u4){let Q=Z.status===404?404:Z.status===409||Z.status===422?409:502;return $.json({error:Z.message},Q,z5)}let X=Z instanceof Error?Z.message:String(Z);return $.json({error:X},502,z5)}async function Vu$($,Z,X){let Q;try{Q=await fetch(Z,X)}catch{return $.json({error:"Preview unreachable"},502)}let Y;try{Y=await Q.text()}catch{return $.json({error:"Preview unreachable"},502)}return new Response(Y,{status:Q.status,headers:{"content-type":Q.headers.get("content-type")??"application/json"}})}async function Su$($){try{let Z=await Eu($),X=await kA0(Z,$.get("vmClaim").branch);return $.json(X,200,z5)}catch(Z){return IZ1($,Z)}}function la($,Z){let Q=(CA0.get($)??Promise.resolve()).catch(()=>{}).then(Z),Y=Q.catch(()=>{});return CA0.set($,Y),Y.finally(()=>{if(CA0.get($)===Y)CA0.delete($)}),Q}async function pZ($,Z,X){if(!X?.runner&&$.get("vmClaim").runtime==="cms")return $.json({error:"sandbox not found: this session is sandbox-less"},404,z5);let Q=X?.runner??n_($);if(Q instanceof Response)return Q;let{claimName:Y,userId:G,projectRef:J}=$.get("vmClaim"),W=X?.method??"POST",K=null,H=new Headers;if(X?.jsonBody!==void 0)K=X.jsonBody,H.set("content-type","application/json");else if(X?.forwardJsonBody)K=await $.req.text(),H.set("content-type","application/json");let F=X?.signal,N={method:W,headers:H,body:K,...F?{signal:F}:{}},U=async()=>{let O=await Q.proxyDaemonRequest(Y,Z,N);if(X?.map404to410&&O.status===404){try{await O.body?.cancel()}catch{}if(await Q.adoptLiveClaim?.({userId:G,projectRef:J},Y))O=await Q.proxyDaemonRequest(Y,Z,N);if(O.status===404){try{await O.body?.cancel()}catch{}return new Response(JSON.stringify({error:"Sandbox handle is gone. The sandbox needs to be re-provisioned."}),{status:410,headers:{"content-type":"application/json",...z5}})}}let B=await O.text(),L=X?.redactRepoDirUnlessDesktop&&Q.kind!=="user-desktop"?wK6(B):B,w=O.headers.get("content-type")??"application/json";return new Response(L,{status:O.status,headers:{"content-type":w,...z5}})};try{if(F){let O=U();return O.catch(()=>{}),await Promise.race([O,new Promise((L,w)=>{if(F.aborted)return w(F.reason);F.addEventListener("abort",()=>w(F.reason),{once:!0})})])}return await U()}catch(O){let B=O instanceof Error?O.message:String(O);return $.json({error:`Daemon unreachable: ${B}`},502)}}function wK6($){try{let Z=JSON.parse($);if(Z&&typeof Z==="object"&&!Array.isArray(Z)&&"repoDir"in Z)return JSON.stringify({...Z,repoDir:null})}catch{}return $}async function _A0($,Z,X,Q="GET",Y){let G=await $.proxyDaemonRequest(Z,X,{method:Q,headers:new Headers,body:null});if(G.status===404&&Y){try{await G.body?.cancel()}catch{}if(await $.adoptLiveClaim?.(Y,Z))G=await $.proxyDaemonRequest(Z,X,{method:Q,headers:new Headers,body:null})}if(G.status===404){try{await G.body?.cancel()}catch{}throw Error("SANDBOX_GONE")}let J=await G.text();if(!G.ok){let W=`Daemon error (${G.status})`;try{W=JSON.parse(J).error??W}catch{}throw Error(W)}return JSON.parse(J)}function EK6($){return Cu$.includes($)}var FK6,Mu$=524288,UK6=65536,OK6=1e4,ku$=2000,BK6,CA0,z5,Cu$,_u$=()=>{let $=new F1;$.use("/:virtualMcpId/:branch/*",BK6),$.post("/:virtualMcpId/:branch/write",(X)=>pZ(X,"/_sandbox/write",{forwardJsonBody:!0,signal:p_(X)})),$.post("/:virtualMcpId/:branch/unlink",(X)=>pZ(X,"/_sandbox/unlink",{forwardJsonBody:!0,signal:p_(X)})),$.post("/:virtualMcpId/:branch/mkdir",(X)=>pZ(X,"/_sandbox/mkdir",{forwardJsonBody:!0,signal:p_(X)})),$.post("/:virtualMcpId/:branch/rename",(X)=>pZ(X,"/_sandbox/rename",{forwardJsonBody:!0,signal:p_(X)})),$.post("/:virtualMcpId/:branch/read",(X)=>pZ(X,"/_sandbox/read",{forwardJsonBody:!0,signal:p_(X)})),$.post("/:virtualMcpId/:branch/glob",(X)=>pZ(X,"/_sandbox/glob",{forwardJsonBody:!0,signal:p_(X)})),$.post("/:virtualMcpId/:branch/grep",(X)=>pZ(X,"/_sandbox/grep",{forwardJsonBody:!0,signal:p_(X)})),$.post("/:virtualMcpId/:branch/exec/:script",async(X)=>{let Q=X.req.param("script");if(!Q)return X.json({error:"missing script name"},400);return pZ(X,`/_sandbox/exec/${encodeURIComponent(Q)}`)}),$.post("/:virtualMcpId/:branch/exec/:script/kill",async(X)=>{let Q=X.req.param("script");if(!Q)return X.json({error:"missing script name"},400);return pZ(X,`/_sandbox/exec/${encodeURIComponent(Q)}/kill`)}),$.get("/:virtualMcpId/:branch/config",(X)=>pZ(X,"/_sandbox/config",{method:"GET",map404to410:!0,redactRepoDirUnlessDesktop:!0})),$.put("/:virtualMcpId/:branch/config",(X)=>pZ(X,"/_sandbox/config",{method:"PUT",forwardJsonBody:!0,map404to410:!0})),$.post("/:virtualMcpId/:branch/setup/:step",async(X)=>{let Q=X.req.param("step");if(!Q||!EK6(Q))return X.json({error:`step must be one of: ${Cu$.join(", ")}`},400);let Y=X.get("vmClaim"),G=await ZZ1(X.var.studioContext,{claimName:Y.claimName,userId:Y.userId,branch:Y.branch,virtualMcpMetadata:Y.virtualMcpMetadata})==="gone"?null:await LK6(X);if(!G)return X.json({error:"sandbox not found: nothing is running at this ref"},404,z5);if(Q==="start"){let J=t(X.var.studioContext),W=Ay(Y.virtualMcpMetadata);try{await OB0({ctx:X.var.studioContext,runner:G,handle:Y.claimName,orgId:J.id,userId:Y.callerUserId,entries:W})}catch(K){let H=K instanceof Error?K.message:String(K);return X.json({error:`Failed to push env to daemon: ${H}`},502)}}return pZ(X,`/_sandbox/setup/${Q}`,{signal:X.req.raw.signal,map404to410:!0,runner:G})}),$.get("/:virtualMcpId/:branch/events",(X)=>{let Q=X.get("vmClaim");if(!Q.runner)return kN(X,async(Y)=>{await Y.writeSSE({event:"phase",data:JSON.stringify({kind:"failed",reason:"unknown",message:"No sandbox runner configured on this studio instance."})})});return Vh$(X,{ctx:X.var.studioContext,claimName:Q.claimName,runner:Q.runner,virtualMcpId:Q.virtualMcpId,branch:Q.branch,userId:Q.userId,projectRef:Q.projectRef,virtualMcpMetadata:Q.virtualMcpMetadata})}),$.get("/:virtualMcpId/:branch/git/status",(X)=>{if(X.get("vmClaim").runtime==="cms")return Su$(X);return Z(X)});let Z=(X)=>pZ(X,"/_sandbox/git/status",{method:"GET",map404to410:!0,signal:AbortSignal.any([X.req.raw.signal,AbortSignal.timeout(ku$)])});return $.post("/:virtualMcpId/:branch/git/status",(X)=>{if(X.get("vmClaim").runtime==="cms")return Su$(X);return pZ(X,"/_sandbox/git/status",{map404to410:!0,signal:AbortSignal.any([X.req.raw.signal,AbortSignal.timeout(ku$)])})}),$.post("/:virtualMcpId/:branch/git/diff",async(X)=>{let Q=X.get("vmClaim");if(Q.runtime==="cms")try{let Y=await X.req.json().catch(()=>({})),G=await Eu(X),J=await VA0(G,Q.branch,Y.base);return X.json(J,200,z5)}catch(Y){return IZ1(X,Y)}return pZ(X,"/_sandbox/git/diff",{forwardJsonBody:!0,map404to410:!0})}),$.post("/:virtualMcpId/:branch/git/publish",async(X)=>{if(X.get("vmClaim").runtime==="cms")return X.json({ok:!0},200,z5);let Q=n_(X);if(Q instanceof Response)return Q;let{claimName:Y,virtualMcpMetadata:G,connectionIds:J}=X.get("vmClaim"),W=X.var.studioContext;return la(Y,async()=>{try{await XZ1(W,Q,Y);let K=ca(G,J);if(K)await qu$(W,Q,Y,K)}catch(K){if(K instanceof i_)return X.json({error:K.message},403,z5);let H=K instanceof Error?K.message:String(K);return X.json({error:H},502,z5)}return pZ(X,"/_sandbox/git/publish",{forwardJsonBody:!0,map404to410:!0})})}),$.post("/:virtualMcpId/:branch/git/discard",async(X)=>{let Q=X.get("vmClaim");if(Q.runtime==="cms")return la(Q.claimName,async()=>{let Y=await X.req.json().catch(()=>({})),G=Array.isArray(Y.filepaths)?Y.filepaths.filter((J)=>typeof J==="string"):[];if(G.length===0)return X.json({error:"filepaths is required"},400,z5);try{let J=await Eu(X);return await Au$(J,Q.branch,G),X.json({ok:!0},200,z5)}catch(J){let W=J instanceof u4&&J.status===409?409:502,K=J instanceof Error?J.message:String(J);return X.json({error:K},W,z5)}});return la(Q.claimName,()=>pZ(X,"/_sandbox/git/discard",{forwardJsonBody:!0,map404to410:!0}))}),$.post("/:virtualMcpId/:branch/git/rebase",async(X)=>{let Q=X.get("vmClaim");if(Q.runtime==="cms")return la(Q.claimName,async()=>{try{let W=await X.req.json().catch(()=>({})),K=await Eu(X),H=W.base??await K.getDefaultBranch();return await SA0(K,Q.branch,H),X.json({ok:!0},200,z5)}catch(W){return IZ1(X,W)}});let Y=n_(X);if(Y instanceof Response)return Y;let{claimName:G}=X.get("vmClaim"),J=X.var.studioContext;return la(G,async()=>{try{await XZ1(J,Y,G)}catch(W){let K=W instanceof Error?W.message:String(W);return X.json({error:K},502,z5)}return pZ(X,"/_sandbox/git/rebase",{forwardJsonBody:!0,map404to410:!0})})}),$.post("/:virtualMcpId/:branch/git/suggest-commit",V9({maxSize:Mu$,onError:(X)=>X.json({error:"Payload too large"},413,z5)}),async(X)=>{let Q=X.get("vmClaim"),Y=null;if(Q.runtime!=="cms"){let H=n_(X);if(H instanceof Response)return H;Y=H}let{claimName:G,userId:J,projectRef:W}=Q,K=X.var.studioContext;try{let H=await X.req.json().catch(()=>({})),F=H.status,N=H.diff,U=N!=null&&typeof N.diffs==="object"&&N.diffs!==null,[O,B]=GZ1(F)&&U?[F,N]:Y?await Promise.all([_A0(Y,G,"/_sandbox/git/status","GET",{userId:J,projectRef:W}),_A0(Y,G,"/_sandbox/git/diff","GET",{userId:J,projectRef:W})]):await(async()=>{let w=await Eu(X);return Promise.all([kA0(w,Q.branch),VA0(w,Q.branch)])})(),L=await fh$(K,O,B);return X.json(L,200,z5)}catch(H){let F=H instanceof Error?H.message:String(H);if(F==="SANDBOX_GONE")return X.json({error:"Sandbox handle is gone. The sandbox needs to be re-provisioned."},410,z5);return X.json({error:F},502,z5)}}),$.post("/:virtualMcpId/:branch/git/judge-review",V9({maxSize:Mu$,onError:(X)=>X.json({error:"Payload too large"},413,z5)}),async(X)=>{let Q=X.get("vmClaim"),Y=null;if(Q.runtime!=="cms"){let H=n_(X);if(H instanceof Response)return H;Y=H}let{claimName:G,userId:J,projectRef:W}=Q,K=X.var.studioContext;try{let H=await X.req.json().catch(()=>({})),F=H.status,N=H.diff,U=N!=null&&typeof N.diffs==="object"&&N.diffs!==null,[O,B]=GZ1(F)&&U?[F,N]:Y?await Promise.all([_A0(Y,G,"/_sandbox/git/status","GET",{userId:J,projectRef:W}),_A0(Y,G,"/_sandbox/git/diff","GET",{userId:J,projectRef:W})]):await(async()=>{let w=await Eu(X);return Promise.all([kA0(w,Q.branch),VA0(w,Q.branch)])})(),L=await xh$(K,O,B,typeof H.language==="string"?H.language:void 0);return X.json(L,200,z5)}catch(H){let F=H instanceof Error?H.message:String(H);if(F==="SANDBOX_GONE")return X.json({error:"Sandbox handle is gone. The sandbox needs to be re-provisioned."},410,z5);return X.json({error:F},502,z5)}}),$.get("/:virtualMcpId/:branch/preview-fetch",async(X)=>{let Q=n_(X);if(Q instanceof Response)return Q;let{claimName:Y}=X.get("vmClaim"),G=X.req.query("path");if(!G||!G.startsWith("/")||G.startsWith("//")||G.includes("..")||G.includes("\\"))return X.json({error:"Path not allowed"},403);let J;try{J=await Q.getPreviewUrl(Y)}catch{return X.json({error:"Preview not available"},502)}if(!J)return X.json({error:"Preview not available"},502);let W=J.replace(/\/+$/,""),K=TZ1(`${W}${G}`);return Vu$(X,K?.url??`${W}${G}`,{...K?{headers:{host:K.hostHeader}}:{}})}),$.post("/:virtualMcpId/:branch/preview-invoke",V9({maxSize:UK6,onError:(X)=>X.json({error:"Payload too large"},413)}),async(X)=>{let Q=n_(X);if(Q instanceof Response)return Q;let{claimName:Y}=X.get("vmClaim"),G;try{G=await Q.getPreviewUrl(Y)}catch{return X.json({error:"Preview not available"},502)}if(!G)return X.json({error:"Preview not available"},502);let J;try{J=await X.req.json()}catch{return X.json({error:"Invalid JSON body"},400)}if(!J||typeof J!=="object"||Array.isArray(J))return X.json({error:"Invalid JSON body"},400);let W=Tu$(J);if(!W)return X.json({error:"Invalid or missing __resolveType"},400);let K=Ru$(G,W.resolveType),H=TZ1(K);return Vu$(X,H?.url??K,{method:"POST",headers:{"content-type":"application/json",...H?{host:H.hostHeader}:{}},body:JSON.stringify(W.payload),signal:AbortSignal.timeout(30000)})}),$};var vu$=D(()=>{D8();jN();Nu();$Z1();kF();qh$();x3();Ty();Mh$();xF();kh$();Sh$();Xn0();Kn();KZ1();yh$();OZ1();d_();AZ1();Iu$();RZ1();FK6=/^[a-zA-Z0-9][a-zA-Z0-9/._-]*$/;BK6=BA0(async($,Z)=>{let X=$.var.studioContext;try{r(X)}catch{return $.json({error:"Unauthorized"},401)}let Q=Y1(X);if(!Q)return $.json({error:"Unauthorized"},401);let Y;try{Y=t(X)}catch{return $.json({error:"Organization scope required"},403)}let G=$.req.param("virtualMcpId"),J=$.req.param("branch");if(!G||!J)return $.json({error:"virtualMcpId and branch are required"},400);try{NK6(J)}catch(L){let w=L instanceof Error?L.message:String(L);return $.json({error:w},400)}let W=await X.storage.virtualMcps.findById(G);if(!W||W.organization_id!==Y.id)return $.json({error:"Virtual MCP not found"},404);let K=Ip({orgId:Y.id,virtualMcpId:G,branch:J}),H=await ap0(X,J),F=sp0(H,Q),N=Ih$({userId:F,projectRef:K}),U=W.metadata??null,O=await DK6($,{claimName:N,branch:J,virtualMcpId:G,sandboxUserId:F,virtualMcpMetadata:U,branchThread:H});if(O==="cms")return $.set("vmClaim",{claimName:N,callerUserId:Q,runner:null,virtualMcpId:G,branch:J,userId:F,projectRef:K,virtualMcpMetadata:U,connectionIds:W.connections?.map((L)=>L.connection_id)??[],runtime:O}),Z();let B;try{B=(await gZ(X,{userId:F,branch:J,virtualMcpMetadata:U})).provider}catch{B=null}if(!B)return $.json({error:"No sandbox runner found"},404);return $.set("vmClaim",{claimName:N,callerUserId:Q,runner:B,virtualMcpId:G,branch:J,userId:F,projectRef:K,virtualMcpMetadata:U,connectionIds:W.connections?.map((L)=>L.connection_id)??[],runtime:O}),Z()});CA0=new Map;z5={"Cache-Control":"no-store, no-cache, must-revalidate",Pragma:"no-cache"};Cu$=["clone","install","start"]});function fu$($,Z,X){let Q=qZ1.get($);if(!Q)Q={pending:null,running:!1},qZ1.set($,Q);if(!Q.pending)Q.pending={set:new Map,del:new Set,deps:Z,resolvers:[],rejecters:[]};let Y=Q.pending;Y.deps=Z;for(let[J,W]of Object.entries(X.set??{}))Y.set.set(J,W),Y.del.delete(J);for(let J of X.delete??[])Y.del.add(J),Y.set.delete(J);let G=new Promise((J,W)=>{Y.resolvers.push(J),Y.rejecters.push(W)});if(!Q.running)zK6($,Q);return G}async function zK6($,Z){Z.running=!0;try{while(Z.pending){let X=Z.pending;Z.pending=null;try{let Q=await PK6(X);for(let Y of X.resolvers)Y(Q)}catch(Q){for(let Y of X.rejecters)Y(Q)}}}finally{if(Z.running=!1,!Z.pending)qZ1.delete($)}}async function PK6($){let{client:Z,branch:X,packagePath:Q}=$.deps;for(let Y=0;;Y++){let G=await wu(Z,X),J=await Z.getCommitTreeSha(G),W=await Z.getTreeRecursive(J),K=jZ1(W,Q),H=[],F=new Map(K.map((B)=>[B.path,{stem:B.stem,sha:B.sha}]));for(let[B,L]of $.set){let w=zZ1(K,B),E=`${JSON.stringify(L,null,2)}
-`,j=await Z.createBlob(E);await Eu$(Z.owner,Z.repo,j,E);let z=w[0]??`${qA0(Q)}/${BZ1(B)}.json`;H.push({path:z,mode:"100644",type:"blob",sha:j});let A=z.slice(z.lastIndexOf("/")+1,-5);F.set(z,{stem:A,sha:j,content:E});for(let P of w.slice(1))H.push({path:P,mode:"100644",type:"blob",sha:null}),F.delete(P)}for(let B of $.del)for(let L of zZ1(K,B))H.push({path:L,mode:"100644",type:"blob",sha:null}),F.delete(L);if(H.length===0)return G;let N=Q?`${Q}/.deco/blocks.gen.json`:".deco/blocks.gen.json";if(W.some((B)=>B.type==="blob"&&B.path===N)){let B=await Promise.all([...F.values()].map(async(j)=>({stem:j.stem,content:j.content??await Z.getBlobText(j.sha)}))),{decofile:L,skipped:w}=ya(B);if(w.length>0)console.warn("decofile gen: dropped blocks that were not valid JSON",{repo:`${Z.owner}/${Z.repo}`,branch:X,packagePath:Q,blocks:w.map((j)=>j.key)});let E=await Z.createBlob(L);H.push({path:N,mode:"100644",type:"blob",sha:E})}let U=await Z.createTree(J,H),O=await Z.createCommit({message:AK6($),treeSha:U,parentShas:[G]});try{return await Z.updateRef(X,O),O}catch(B){if(!(B instanceof u4&&B.status===422)||Y>=jK6-1)throw B;await D$(oZ(2000,200,Y,2,0.5))}}}function AK6($){let Z=(Y)=>{let G=Y.slice(0,3).join(", ");return Y.length>3?`${G} (+${Y.length-3} more)`:G},X=[];if($.set.size>0)X.push(`update ${Z([...$.set.keys()])}`);if($.del.size>0)X.push(`delete ${Z([...$.del])}`);let Q=`chore(decofile): ${X.join("; ")}`;return Tm0(Q,$.deps.coAuthor)}var jK6=3,qZ1;var bu$=D(()=>{GB0();jA0();w4();d_();MA0();qZ1=new Map});import{createHmac as xu$,randomBytes as TK6,timingSafeEqual as RK6}from"crypto";function yu$(){if(vA0)return vA0;let $;try{let Z=b0();$=Z.studioJwtSecret??Z.betterAuthSecret}catch{$=void 0}return vA0=$?Buffer.from($):TK6(32),vA0}function MZ1($){let Z=$.nowMs??Date.now(),X={o:$.organizationId,m:$.virtualMcpId,b:$.branch,e:Math.floor((Z+IK6)/1000)},Q=Buffer.from(JSON.stringify(X)).toString("base64url"),Y=xu$("sha256",yu$()).update(Q).digest("base64url");return`${Q}.${Y}`}function gu$($,Z){let X=$.indexOf(".");if(X<0)return!1;let Q=$.slice(0,X),Y=Buffer.from($.slice(X+1)),G=Buffer.from(xu$("sha256",yu$()).update(Q).digest("base64url"));if(Y.length!==G.length||!RK6(Y,G))return!1;let J;try{J=JSON.parse(Buffer.from(Q,"base64url").toString())}catch{return!1}let W=Math.floor((Z.nowMs??Date.now())/1000);return J.o===Z.organizationId&&J.m===Z.virtualMcpId&&J.b===Z.branch&&typeof J.e==="number"&&J.e>=W}var IK6=21600000,vA0=null;var hu$=D(()=>{q$()});import{z as ju}from"zod";function MK6($){return $.length>0&&$.length<=255&&!$.includes("..")&&!$.endsWith("/")&&!$.endsWith(".lock")&&qK6.test($)}function cu$($){return $.req.header("x-forwarded-host")??new URL($.req.url).host}async function fA0($){let Z=$.get("decofileScope");return wA0($.var.studioContext,Z.organizationId,Z.githubRepo)}function bA0($,Z){if(Z instanceof u4){let Q=Z.status===404?404:Z.status===409?409:Z.status===422?409:502;return $.json({error:Z.message},Q)}let X=Z instanceof Error?Z.message:String(Z);return $.json({error:X},500)}function lu$(){let $=new F1;return $.use("/:virtualMcpId/:branch",uu$),$.use("/:virtualMcpId/:branch/*",uu$),$.get("/:virtualMcpId/:branch",async(Z)=>{let X=Z.get("decofileScope");try{let Q=await fA0(Z),Y=await ju$(Q,X.branch,X.packagePath,{createBranchIfMissing:!!X.userId}),G={ETag:`"${Y.sha}"`,"Cache-Control":"no-store","Access-Control-Allow-Origin":"*"};if(Z.req.header("if-none-match")===`"${Y.sha}"`)return Z.body(null,304,G);if(!X.userId)return Z.body(Y.decofile,200,{...G,"content-type":"application/json"});let J=MZ1({organizationId:X.organizationId,virtualMcpId:X.virtualMcpId,branch:X.branch});return Z.body(`{"version":${JSON.stringify(Y.sha)},"token":${JSON.stringify(J)},"apiHost":${JSON.stringify(cu$(Z))},"decofile":${Y.decofile}}`,200,{...G,"content-type":"application/json"})}catch(Q){return bA0(Z,Q)}}),$.patch("/:virtualMcpId/:branch",async(Z)=>{let X=Z.get("decofileScope"),Q=Z.var.studioContext,Y=kK6.safeParse(await Z.req.json().catch(()=>null));if(!Y.success)return Z.json({error:"Invalid body",details:Y.error.issues},400);let G=Y.data;for(let J of[...Object.keys(G.set??{}),...G.delete??[]])try{EA0(J)}catch(W){let K=W instanceof Error?W.message:String(W);return Z.json({error:K},400)}for(let[J,W]of Object.entries(G.set??{}))if(typeof W!=="object"||W===null||Array.isArray(W))return Z.json({error:`Block "${J}" must be a JSON object`},400);try{let J=await fA0(Z),W=await fu$(`${X.organizationId}/${X.virtualMcpId}/${X.branch}`,{client:J,branch:X.branch,packagePath:X.packagePath,coAuthor:Uu(Q)},G),K=MZ1({organizationId:X.organizationId,virtualMcpId:X.virtualMcpId,branch:X.branch});return Z.json({version:W,token:K,apiHost:cu$(Z)})}catch(J){return bA0(Z,J)}}),$.post("/:virtualMcpId/:branch/publish",async(Z)=>{let X=Z.get("decofileScope");try{let Q=await fA0(Z),Y=await Q.getDefaultBranch();if(Y===X.branch)return Z.json({error:"Branch is already the default branch"},400);let G=`chore(decofile): publish ${X.branch}`;try{let J;try{J=await Q.mergeBranch(Y,X.branch,G)}catch(W){if(!(W instanceof u4&&W.status===409))throw W;await SA0(Q,X.branch,Y),J=await Q.mergeBranch(Y,X.branch,G)}return J?Z.json({result:"merged",sha:J}):Z.json({result:"up-to-date"})}catch(J){if(J instanceof u4&&J.status===409)return Z.json({error:"merge-conflict"},409);if(J instanceof u4&&J.status===405){let K=await Q.findOpenPullRequest(Y,X.branch)??await Q.createPullRequest({base:Y,head:X.branch,title:`Publish ${X.branch}`});return Z.json({result:"pull-request",number:K.number,url:K.html_url})}throw J}}catch(Q){return bA0(Z,Q)}}),$.get("/:virtualMcpId/:branch/status",async(Z)=>{let X=Z.get("decofileScope");try{let Q=await fA0(Z),Y=await Q.getDefaultBranch();if(Y===X.branch)return Z.json({baseBranch:Y,aheadBy:0,behindBy:0});try{let{aheadBy:G,behindBy:J}=await Q.compare(Y,X.branch);return Z.json({baseBranch:Y,aheadBy:G,behindBy:J})}catch(G){if(G instanceof u4&&G.status===404)return Z.json({baseBranch:Y,aheadBy:0,behindBy:0});throw G}}catch(Q){return bA0(Z,Q)}}),$}var qK6,kK6,uu$;var du$=D(()=>{jA0();D8();$Z1();DA0();RZ1();OZ1();bu$();hu$();AZ1();d_();MA0();qK6=/^[a-zA-Z0-9][a-zA-Z0-9/._-]*$/;kK6=ju.object({set:ju.record(ju.string(),ju.unknown()).optional(),delete:ju.array(ju.string()).optional()}).refine(($)=>Object.keys($.set??{}).length>0||($.delete?.length??0)>0,{message:"Patch must set or delete at least one block"}),uu$=BA0(async($,Z)=>{let X=$.var.studioContext,Q=X.organization;if(!Q)return $.json({error:"Organization scope required"},500);let Y=$.req.param("virtualMcpId"),G=$.req.param("branch");if(!Y||!G)return $.json({error:"virtualMcpId and branch are required"},400);if(!MK6(G))return $.json({error:`Invalid branch name: ${G}`},400);let J=X.auth?.user?.id??null;if(!J){let O=$.req.query("token");if(!($.req.method==="GET"&&!$.req.path.match(/\/(publish|status)$/)))return $.json({error:"Unauthorized"},401);if(!O||!gu$(O,{organizationId:Q.id,virtualMcpId:Y,branch:G}))return $.json({error:"Unauthorized"},401)}let W=await X.storage.virtualMcps.findById(Y);if(!W||W.organization_id!==Q.id)return $.json({error:"Virtual MCP not found"},404);let K=W.metadata??null;if(!LB0(K))return $.json({error:"Project has no preview server configured"},404);let F=W.connections?.map((O)=>O.connection_id)??[],N=ca(K,F);if(!N)return $.json({error:"Project has no GitHub repository"},404);let U=K?.runtime;return $.set("decofileScope",{organizationId:Q.id,virtualMcpId:Y,branch:G,packagePath:U?.path?.replace(/^\/+|\/+$/g,"")||null,githubRepo:N,userId:J}),Z()})});var mu$=($)=>{let Z=new F1;if(Z.use("*",f_),Z.route("/",CP0()),Z.route("/",Jx$()),Z.route("/",Uh$()),Z.route("/",Hh$()),Z.route("/",NA0()),Z.route("/tools",jh$()),Z.route("/",Lh$()),Z.route("/",lg$({kvStorage:$.kvStorage})),Z.route("/",ug$()),Z.route("/fs",Xh$({getConnection:$.getNatsConnection})),Z.route("/sandbox",_u$()),Z.route("/decofile",lu$()),Z.route("/",Jh$()),Z.route("/deco-sites",vP0()),Z.route("/sso",IP0()),Z.route("/",UA0({tokenStorage:$.tokenStorage,automationEventDispatcher:$.automationEventDispatcher})),Z.route("/webhooks",sb$()),$.mountDevAssets)Z.route("/dev-assets",fP0({orgFromPath:!0}));return Z.use("/mcp/:connectionId?",$.mcpAuth),Z.use("/mcp/:connectionId/ui-resource",$.mcpAuth),Z.use("/mcp/gateway/:virtualMcpId?",$.mcpAuth),Z.use("/mcp/virtual-mcp/:virtualMcpId?",$.mcpAuth),Z.use("/mcp/self",$.mcpAuth),Z.use("/mcp/task-run/:threadId",$.mcpAuth),Z.route("/",_v$()),Z.get("/mcp/:gateway?/:connectionId/.well-known/oauth-protected-resource/*",$.betterAuthProtectedResourceHandler),Z.get("/mcp/.well-known/oauth-protected-resource",$.betterAuthProtectedResourceHandler),Z.route("/mcp/task-run",Yh$()),Z.route("/mcp",yL0()),Z.route("/mcp/self",FA0()),Z.route("/mcp",uL0()),Z.all("/oauth-proxy/:connectionId/*",$.oauthProxyHandler),Z.get("/watch",$.watchHandler),Z};var iu$=D(()=>{D8();A51();eb$();q51();bP0();Ha();z51();cg$();dg$();Qh$();Lt();U51();cL0();n91();Gh$();Wh$();Fh$();Oh$();wh$();o91();zh$();r91();gL0();vu$();du$()});function VK6($){return $.filter((Z)=>Z.vendors?.alias).map((Z)=>({name:Z.name,title:Z.title,description:Z.description,logo:Z.logo,category:Z.category,vendor:{alias:Z.vendors.alias,url:Z.vendors.url}}))}var SK6=async($,Z)=>{if(!$.get("studioContext").auth.user?.id)return $.json({error:"Unauthorized"},401);return Z()},pu$=()=>{let $=new F1;return $.use("*",SK6),$.get("/",async(Z)=>{let X=b0(),Q=X.decoSupabaseUrl,Y=X.decoSupabaseServiceKey;if(!Q||!Y)return Z.json({apps:[]});try{let G=await iZ(Q,Y,"apps?select=name,title,description,logo,category,vendors(alias,url)");return Z.json({apps:VK6(G)})}catch(G){return console.error("[deco-apps] GET error:",G),Z.json({error:"Failed to fetch apps"},502)}}),$};var nu$=D(()=>{D8();q$();Cz0()});import{z as M1}from"zod";function HH($,Z="invalid_request_error",X=null,Q=null){return{error:{message:$,type:Z,param:X,code:Q}}}function uK6($){if(!$)return null;let Z=$.indexOf(":");if(Z===-1)return{credentialId:null,modelId:$};let X=$.substring(0,Z),Q=$.substring(Z+1);if(!X||!Q)return null;return{credentialId:X,modelId:Q}}function cK6($,Z,X){try{return JSON.parse($)}catch{throw new ru$(`Invalid JSON in tool call arguments for function '${X}' (tool_call_id: ${Z}): ${$}`)}}function lK6($){let Z={};for(let X of $)if(X.role==="assistant"&&X.tool_calls)for(let Q of X.tool_calls)Z[Q.id]=Q.function.name;return $.map((X)=>{switch(X.role){case"system":return{role:"system",content:X.content};case"user":if(typeof X.content==="string")return{role:"user",content:X.content};return{role:"user",content:X.content.map((Y)=>{if(Y.type==="text")return{type:"text",text:Y.text};return{type:"image",image:Y.image_url.url}})};case"assistant":if(X.tool_calls&&X.tool_calls.length>0)return{role:"assistant",content:X.tool_calls.map((Y)=>({type:"tool-call",toolCallId:Y.id,toolName:Y.function.name,input:cK6(Y.function.arguments,Y.id,Y.function.name)}))};return{role:"assistant",content:X.content??""};case"tool":let Q=Z[X.tool_call_id]??"unknown";return{role:"tool",content:[{type:"tool-result",toolCallId:X.tool_call_id,toolName:Q,output:{type:"text",value:X.content}}]}}})}function dK6($){let Z=$.map((X)=>{let Q=X.function.parameters?lY(X.function.parameters):lY({type:"object",properties:{}});return[X.function.name,I$({description:X.function.description,inputSchema:Q})]});return Object.fromEntries(Z)}function mK6($){if(!$)return;return{openai:{response_format:$}}}function iK6(){return`chatcmpl-${crypto.randomUUID().replace(/-/g,"").substring(0,29)}`}function tu$($,Z,X,Q,Y,G){let J={model:$,messages:Z,tools:X,temperature:Q.temperature,maxTokens:Q.max_tokens,topP:Q.top_p,frequencyPenalty:Q.frequency_penalty,presencePenalty:Q.presence_penalty,stopSequences:Q.stop?Array.isArray(Q.stop)?Q.stop:[Q.stop]:void 0,abortSignal:G};return Y?{...J,providerOptions:Y}:J}function ou$($){if($==="tool-calls")return"tool_calls";if($==="length")return"length";return"stop"}var CK6=256,_K6,vK6,fK6,bK6,xK6,yK6,gK6,hK6,ru$,au$,su$;var eu$=D(()=>{B4();D8();Nu();WN();_K6=M1.object({type:M1.literal("function"),function:M1.object({name:M1.string(),description:M1.string().optional(),parameters:M1.record(M1.string(),M1.unknown()).optional()})}),vK6=M1.object({id:M1.string(),type:M1.literal("function"),function:M1.object({name:M1.string(),arguments:M1.string()})}),fK6=M1.discriminatedUnion("role",[M1.object({role:M1.literal("system"),content:M1.string(),name:M1.string().optional()}),M1.object({role:M1.literal("user"),content:M1.union([M1.string(),M1.array(M1.union([M1.object({type:M1.literal("text"),text:M1.string()}),M1.object({type:M1.literal("image_url"),image_url:M1.object({url:M1.string(),detail:M1.string().optional()})})]))]),name:M1.string().optional()}),M1.object({role:M1.literal("assistant"),content:M1.string().nullable().optional(),name:M1.string().optional(),tool_calls:M1.array(vK6).optional()}),M1.object({role:M1.literal("tool"),content:M1.string(),tool_call_id:M1.string()})]),bK6=M1.object({type:M1.literal("text")}),xK6=M1.object({type:M1.literal("json_object")}),yK6=M1.object({type:M1.literal("json_schema"),json_schema:M1.object({name:M1.string(),description:M1.string().optional(),schema:M1.record(M1.string(),M1.unknown()),strict:M1.boolean().optional()})}),gK6=M1.union([bK6,xK6,yK6]),hK6=M1.object({model:M1.string().describe("Format: 'model_id' or 'credential_id:model_id'"),messages:M1.array(fK6),stream:M1.boolean().optional().default(!1),temperature:M1.number().min(0).max(2).optional(),max_tokens:M1.number().positive().optional(),top_p:M1.number().min(0).max(1).optional(),frequency_penalty:M1.number().min(-2).max(2).optional(),presence_penalty:M1.number().min(-2).max(2).optional(),stop:M1.union([M1.string(),M1.array(M1.string())]).optional(),tools:M1.array(_K6).optional(),tool_choice:M1.union([M1.literal("auto"),M1.literal("none"),M1.literal("required"),M1.object({type:M1.literal("function"),function:M1.object({name:M1.string()})})]).optional(),response_format:gK6.optional(),user:M1.string().optional()});ru$=class ru$ extends Error{constructor($){super($);this.name="MessageConversionError"}};au$=new F1;au$.post("/:org/v1/chat/completions",async($)=>{let Z=$.get("studioContext"),X=$.req.param("org");try{if(!Z.auth.apiKey?.id)return $.json(HH("API key authentication required. Provide a valid API key via Authorization header.","authentication_error"),401);if(!Z.organization)return $.json(HH("Organization context is required. Ensure your API key has organization metadata.","invalid_request_error","organization"),400);if((Z.organization.slug??Z.organization.id)!==X)return $.json(HH("Organization mismatch. The API key's organization does not match the requested organization.","invalid_request_error","organization"),403);let Q=await $.req.json(),Y=hK6.safeParse(Q);if(!Y.success){let w=Y.error.issues[0]??{message:"Invalid request",path:[]};return $.json(HH(`Invalid request: ${w.message}`,"invalid_request_error",w.path.length>0?w.path.join("."):null),400)}let G=Y.data,J=uK6(G.model);if(!J)return $.json(HH("Invalid model format. Expected 'model_id' or 'credential_id:model_id' (e.g., 'claude-sonnet-4-6' or 'key_abc123:claude-sonnet-4-6')","invalid_request_error","model"),400);let{credentialId:W}=J,{modelId:K}=J;if(!W){let E=(await Z.storage.aiProviderKeys.list({organizationId:Z.organization.id})).find((j)=>hL(j.providerId));if(!E)return $.json(HH("No AI provider credentials configured for this organization. Add a credential in settings or specify one explicitly via 'credential_id:model_id'.","invalid_request_error","model"),400);W=E.id}let H;try{H=await Z.aiProviders.activate(W,Z.organization.id)}catch{return $.json(HH(`AI provider credential not found or inaccessible: ${W}`,"invalid_request_error","model"),404)}let F=H.aiSdk.languageModel(K),N=lK6(G.messages),U=G.tools?dK6(G.tools):void 0,O=mK6(G.response_format),B=iK6(),L=Math.floor(Date.now()/1000);if(G.stream)return kN($,async(w)=>{let E=tu$(F,N,U,G,O,$.req.raw.signal);try{let j=$B(E),z=!1,A=0,P="",I=async()=>{if(P.length===0)return;let q=P;P="",await w.writeSSE({data:JSON.stringify({id:B,object:"chat.completion.chunk",created:L,model:G.model,choices:[{index:0,delta:{content:q},finish_reason:null}]})})};for await(let q of j.fullStream){if(!z&&(q.type==="text-delta"||q.type==="tool-call"))await w.writeSSE({data:JSON.stringify({id:B,object:"chat.completion.chunk",created:L,model:G.model,choices:[{index:0,delta:{role:"assistant",content:""},finish_reason:null}]})}),z=!0;if(q.type==="text-delta"){if(P+=q.text,P.length>=CK6)await I()}else if(q.type==="tool-call"){await I();let M=A++;await w.writeSSE({data:JSON.stringify({id:B,object:"chat.completion.chunk",created:L,model:G.model,choices:[{index:0,delta:{tool_calls:[{index:M,id:q.toolCallId,type:"function",function:{name:q.toolName,arguments:JSON.stringify(q.input)}}]},finish_reason:null}]})})}else if(q.type==="finish")await I(),await w.writeSSE({data:JSON.stringify({id:B,object:"chat.completion.chunk",created:L,model:G.model,choices:[{index:0,delta:{},finish_reason:ou$(q.finishReason)}],usage:q.totalUsage?{prompt_tokens:q.totalUsage.inputTokens??0,completion_tokens:q.totalUsage.outputTokens??0,total_tokens:q.totalUsage.totalTokens??0}:void 0})})}await I(),await w.writeSSE({data:"[DONE]"})}catch(j){let z=j;console.error("[openai-compat:stream] Error:",z.message),await w.writeSSE({data:JSON.stringify({error:{message:z.message,type:"server_error"}})})}});else{let w=tu$(F,N,U,G,O,$.req.raw.signal),E=await sO(w),j={role:"assistant",content:E.text||null};if(E.toolCalls&&E.toolCalls.length>0)j.tool_calls=E.toolCalls.map((z)=>({id:z.toolCallId,type:"function",function:{name:z.toolName,arguments:JSON.stringify("input"in z?z.input:{})}})),j.content=null;return $.json({id:B,object:"chat.completion",created:L,model:G.model,choices:[{index:0,message:j,finish_reason:ou$(E.finishReason)}],usage:{prompt_tokens:E.usage?.inputTokens??0,completion_tokens:E.usage?.outputTokens??0,total_tokens:E.usage?.totalTokens??0}})}}catch(Q){let Y=Q;if(Y.name==="AbortError")return $.json(HH("Request aborted","invalid_request_error"),400);if(Y.name==="MessageConversionError")return $.json(HH(Y.message,"invalid_request_error","messages"),400);return console.error("[openai-compat] Error:",Y.message,Y.stack),$.json(HH(Y.message,"server_error"),500)}});su$=au$});function pK6($){if(typeof $!=="object"||$===null)return!1;let X=$.githubRepo?.url;return typeof X==="string"&&X.length>0}function $c$(){let $=new F1;return $.use("*",async(Z,X)=>{await X(),Z.header("Cache-Control","private, no-store"),Z.header("Vary","Cookie")}),$.get("/",async(Z)=>{let X=Z.get("studioContext"),Q=Y1(X);if(!Q)return Z.json({error:"Authentication required"},401);let G=(Z.req.query("site")??"").trim().toLowerCase();if(!mG(G))return Z.json({error:"Invalid site slug"},400);let J=await X.db.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["organization.id as id","organization.slug as slug","organization.name as name","organization.metadata as metadata"]).where("member.userId","=",Q).execute(),W=[];for(let H of J){if(!H.slug||H7(H))continue;let F=await X.storage.virtualMcps.list(H.id);for(let N of F){if(ea1(N)!==G)continue;if(!pK6(N.metadata))continue;W.push({orgSlug:H.slug,orgName:H.name??H.slug,project:{id:N.id,title:N.title,icon:N.icon??null}})}}let K={matches:W};return Z.json(K)}),$}var Zc$=D(()=>{D8();hO()});var Qc$;var Xc$=D(()=>{Qc$={name:"decocms",version:"4.262.0",description:"Deco CMS \u2014 Self-hostable MCP Gateway for managing AI connections and tools",author:"Deco team",repository:{type:"git",url:"git+https://github.com/decocms/studio.git",directory:"apps/api"},bugs:{url:"https://github.com/decocms/studio/issues"},type:"module",bin:{deco:"./dist/server/cli.js"},files:["dist/**/*"],scripts:{dev:"bun run migrate && bun run dev:server","dev:server":"bun run --cwd=../../packages/sandbox build && NODE_ENV=development bun --env-file=.env --hot run src/index.ts",build:"bun run build:server","build:server":"bun run scripts/bundle-server-script.ts --dist ./dist/server","generate:tool-contracts":"bun run scripts/generate-tool-contracts.ts","db:migrate":"bun run ./dist/server/migrate.js","db:migrate:dbos":"bun run ./dist/server/migrate-dbos.js",check:"tsc --noEmit",start:"bun run ./dist/server/server.js",migrate:"bun run src/database/migrate.ts","migrate:dbos":"bun run src/database/migrate-dbos.ts",test:"bun test src","better-auth:migrate":"bunx --bun @better-auth/cli migrate -y --config src/auth/index.ts",prepublishOnly:"bun run --cwd=../.. build:studio"},optionalDependencies:{"@duckdb/node-api":"^1.5.0-r.1"},dependencies:{"@ai-sdk/anthropic":"^3.0.85","@ai-sdk/google":"^3.0.83","@ai-sdk/openai":"^3.0.73","@anthropic-ai/sdk":"^0.105.0","@aws-sdk/client-s3":"^3.1013.0","@aws-sdk/client-sts":"^3.1013.0","@aws-sdk/lib-storage":"^3.1013.0","@aws-sdk/s3-request-presigner":"^3.1013.0","@clickhouse/client":"^1.8.1","@dbos-inc/dbos-sdk":"^4.21.6","@inkjs/ui":"^2.0.0","@nats-io/jetstream":"3.4.0","@nats-io/kv":"3.4.0","@nats-io/nats-core":"3.4.0","@nats-io/transport-node":"3.4.0","@openrouter/ai-sdk-provider":"^2.9.1","@opentelemetry/core":"^2.6.0","embedded-postgres":"^18.3.0-beta.16",ink:"^6.8.0",kysely:"^0.28.12","posthog-node":"^5.0.0",react:"^19.2.6","react-dom":"^19.2.6"},devDependencies:{"@ai-sdk/provider":"^3.0.10","@better-auth/sso":"1.4.1","@decocms/better-auth":"1.5.17","@decocms/bindings":"workspace:*","@decocms/mcp-utils":"workspace:*","@decocms/runtime":"workspace:*","@decocms/sandbox":"workspace:*","@decocms/shared":"workspace:*","@jitl/quickjs-wasmfile-release-sync":"0.31.0","@modelcontextprotocol/sdk":"1.29.0","@nats-io/jwt":"0.0.10-5","@opentelemetry/api":"^1.9.0","@opentelemetry/api-logs":"^0.211.0","@opentelemetry/exporter-logs-otlp-proto":"^0.211.0","@opentelemetry/exporter-prometheus":"^0.208.0","@opentelemetry/exporter-trace-otlp-proto":"^0.207.0","@opentelemetry/instrumentation-runtime-node":"^0.24.0","@opentelemetry/resources":"^2.6.0","@opentelemetry/sdk-logs":"^0.211.0","@opentelemetry/sdk-metrics":"^2.2.0","@opentelemetry/sdk-node":"^0.207.0","@opentelemetry/sdk-trace-base":"^2.5.0","@types/bun":"^1.3.1","@types/google.maps":"^3.65.2","@types/pg":"^8.15.6","@types/react-syntax-highlighter":"^15.5.13","@vercel/nft":"^1.1.1",ai:"^6.0.208","better-auth":"1.4.22",croner:"^9.1.0",degit:"^2.8.4",hono:"^4.10.7",jose:"^6.0.11",nanoid:"^5.1.6",pg:"^8.16.3",typescript:"^7.0.2",typescript5:"npm:typescript@^5.9.3",zod:"4.3.6"},homepage:"https://github.com/decocms/studio",keywords:["mcp","model-context-protocol","ai","gateway","self-hosted","tools"],license:"MIT",publishConfig:{access:"public"}}});function oK6(){let $=process.env.POSTHOG_KEY;if(!$)return null;return{key:$,host:process.env.POSTHOG_HOST??tK6}}var Yc$,tK6="https://ph.studio.decocms.com",Gc$;var Jc$=D(()=>{D8();eh0();qC();L9();q$();W51();Xc$();Yc$=new F1;Yc$.get("/",($)=>{let Z={version:Qc$.version,theme:Im1(),...Vw().logo&&{logo:Vw().logo},...fK()&&{internalUrl:XC1()},...b0().enableDecoImport&&{enableDecoImport:!0},brandExtractEnabled:!!b0().firecrawlApiKey,auth:Lb$(),posthog:oK6(),googleMapsApiKey:process.env.GOOGLE_MAPS_API_KEY?.trim()||null,runtime:{agentSandbox:!fK()&&b0().sandboxProviderKind==="agent-sandbox"}};return $.header("Cache-Control","no-store"),$.json({success:!0,config:Z})});Gc$=Yc$});function zu($){let Z=($??"").trim().toLowerCase();return Z=Z.replace(/^https?:\/\//,""),Z=Z.replace(/^www\./,""),Z=Z.split(/[/?#]/)[0]??"",Z.replace(/\/+$/,"")}function kZ1($){return(zu($).split(".")[0]||$).replace(/[-_]/g," ").split(" ").filter(Boolean).map((X)=>X.charAt(0).toUpperCase()+X.slice(1)).join(" ")}function Kc$($,Z=64){return`https://www.google.com/s2/favicons?domain=${encodeURIComponent(zu($))}&sz=${Z}`}function Wc$($,Z){let X=$.trim();if(X.length<=Z)return X;let Q=X.slice(0,Z-1),Y=Q.lastIndexOf(" ");return`${(Y>Z*0.6?Q.slice(0,Y):Q).trimEnd()}\u2026`}function Hc$($){let{brand:Z,domain:X,score:Q,verdict:Y}=$,G=typeof Q==="number"?`${Z} commerce report \u2014 ${Math.round(Q)}/100 \xB7 decocms`:`${Z} commerce report \xB7 decocms`,J=`See the full ${Z} scorecard \u2014 SEO, performance, conversion & AEO signals scored by decocms.`,W=Y?.trim()?Wc$(`${Y.trim().replace(/\s+/g," ")} \u2014 ${J}`,200):Wc$(`How does ${X} really perform? ${J}`,200);return{title:G,description:W}}import{z as l0}from"zod";var t_,rK6,aK6,sK6,eK6,Fc$;var Nc$=D(()=>{t_=l0.enum(["good","bad","neutral"]),rK6=l0.preprocess(($)=>{if(Array.isArray($))return{kind:"text",value:$.find((X)=>X!==null&&typeof X!=="object")??""};return $!==null&&typeof $==="object"?$:{kind:"text",value:$}},l0.object({kind:l0.enum(["text","number","sparkline","badge","score"]).catch("text"),value:l0.coerce.string().optional(),tone:t_.optional(),muted:l0.boolean().optional(),delta:l0.coerce.string().optional(),deltaDir:l0.enum(["up","down","neutral"]).optional(),points:l0.array(l0.coerce.number()).optional(),label:l0.coerce.string().optional()}).transform(($)=>{if($.kind==="badge"&&$.label==null)$.label=$.value??"";if($.kind==="score"){let Z=Number($.value);if(Number.isNaN(Z))return{...$,kind:"text"}}return $})),aK6=l0.preprocess(($)=>{let Z=$;if(Z&&typeof Z==="object"&&!Array.isArray(Z)&&Array.isArray(Z.cells))Z=Z.cells;if(Array.isArray(Z)&&Z.length===1&&Array.isArray(Z[0]))Z=Z[0];if(Array.isArray(Z))return Z;if(Z&&typeof Z==="object")return Object.values(Z);return Z},l0.array(rK6)),sK6={key:l0.coerce.string(),title:l0.coerce.string(),eyebrow:l0.coerce.string().optional(),headline:l0.coerce.string(),annotation:l0.coerce.string().optional(),methodology:l0.coerce.string().optional(),sources:l0.array(l0.object({name:l0.coerce.string(),logoUrl:l0.coerce.string()})).optional()},eK6=l0.discriminatedUnion("template",[l0.object({template:l0.literal("cover"),score:l0.object({value:l0.coerce.number(),max:l0.coerce.number().optional(),grade:l0.coerce.string().optional(),label:l0.coerce.string().optional()}).optional(),brandImage:l0.coerce.string().optional(),screenshot:l0.coerce.string().optional(),mobileScreenshot:l0.coerce.string().optional()}),l0.object({template:l0.literal("cta"),ctaUrl:l0.coerce.string().optional(),ctaLabel:l0.coerce.string().optional(),bullets:l0.array(l0.coerce.string()).optional()}),l0.object({template:l0.literal("series"),points:l0.array(l0.coerce.number()).min(2),xLabels:l0.array(l0.coerce.string()).min(1),unit:l0.coerce.string().optional(),callout:l0.object({index:l0.coerce.number(),value:l0.coerce.string(),tone:t_.optional()})}),l0.object({template:l0.literal("threshold"),value:l0.coerce.string().default(""),metricLabel:l0.coerce.string().optional(),ratio:l0.coerce.number(),thresholdRatio:l0.coerce.number().optional(),thresholdLabel:l0.coerce.string().default(""),tone:t_.optional()}),l0.object({template:l0.literal("stats"),stats:l0.array(l0.object({value:l0.coerce.string(),label:l0.coerce.string(),tone:t_.optional()})).min(1)}),l0.object({template:l0.literal("bars"),items:l0.array(l0.object({value:l0.coerce.string(),label:l0.coerce.string(),ratio:l0.coerce.number(),tone:t_.optional()})).min(1)}),l0.object({template:l0.literal("gauges"),gauges:l0.array(l0.object({label:l0.coerce.string(),value:l0.coerce.string(),status:l0.enum(["good","warn","bad"]).catch("warn"),caption:l0.coerce.string().optional(),ratio:l0.coerce.number().optional()})).min(1)}),l0.object({template:l0.literal("checklist"),checks:l0.array(l0.object({label:l0.coerce.string(),status:l0.enum(["pass","fail","warn"]).catch("fail"),value:l0.coerce.string().optional()})).min(1)}),l0.object({template:l0.literal("table"),columns:l0.array(l0.object({label:l0.coerce.string(),align:l0.enum(["left","right"]).optional()})).min(1),rows:l0.array(aK6).min(1),highlightRow:l0.coerce.number().optional()}),l0.object({template:l0.literal("products"),products:l0.array(l0.object({name:l0.coerce.string(),price:l0.coerce.string().optional(),image:l0.coerce.string().optional(),url:l0.coerce.string().optional()})).min(1)}),l0.object({template:l0.literal("list"),entries:l0.array(l0.object({label:l0.coerce.string(),severity:l0.enum(["error","warning","notice"]).catch("notice")})).min(1),moreCount:l0.coerce.number().optional()}),l0.object({template:l0.literal("keywords"),volumeLabel:l0.coerce.string().optional(),keywords:l0.array(l0.object({term:l0.coerce.string(),volume:l0.coerce.string(),position:l0.coerce.number().catch(0)})).min(1)}),l0.object({template:l0.literal("competitor"),metricLabel:l0.coerce.string().optional(),competitors:l0.array(l0.object({name:l0.coerce.string(),value:l0.coerce.string(),tone:t_.optional(),isYou:l0.boolean().optional()})).min(1)}),l0.object({template:l0.literal("scorecard"),rivalLabel:l0.coerce.string().optional(),dimensions:l0.array(l0.object({label:l0.coerce.string(),you:l0.coerce.string(),rival:l0.coerce.string().optional(),rivalName:l0.coerce.string().optional(),tone:t_.optional()})).min(1)})]),Fc$=l0.object({...sK6,template:eK6})});function xA0($){let Z=[],X=[...$.sections].sort((Y,G)=>Y.position-G.position).map((Y)=>{let G=Fc$.safeParse(Y.props);if(G.success)return G.data;let J=G.error.issues[0];return Z.push({section_type:Y.section_type,position:Y.position,reason:J?`${J.path.join(".")||"(root)"}: ${J.message}`:"contract violation"}),null}).filter((Y)=>Y!==null),Q=X.filter((Y)=>Y.template.template!=="cover"&&Y.template.template!=="cta").map((Y)=>({key:Y.key,title:Y.title}));return{deck:{meta:{...$.meta,scores:$.summary?.scores,scannedAt:$.scanned_at,toc:Q},slides:X},drops:Z}}var VZ1=D(()=>{Nc$()});import{join as Uc$}from"path";async function ZH6($){try{let Z=await fetch(`${QK({})}/api/v2/public/diagnostics/${encodeURIComponent($)}`,{headers:{Accept:"application/json"},signal:AbortSignal.timeout($H6)});if(!Z.ok)return null;let X=await Z.json(),{deck:Q}=xA0(X);if(!Q.slides.length)return null;let Y=Q.slides.find((W)=>W.template.template==="cover"),G=Y?.template,J=G&&G.template==="cover"?G:void 0;return{brand:Q.meta.brand?.trim()||kZ1($),score:Q.meta.scores?.cover??J?.score?.value,verdict:Y?.annotation?.trim()||Y?.headline?.trim()||void 0}}catch{return null}}function FG($){return $.replaceAll("&","&amp;").replaceAll("<","&lt;").replaceAll(">","&gt;").replaceAll('"',"&quot;")}function XH6($,Z){let X=zu($),Q=Z?.brand?.trim()||kZ1(X),Y=Kc$(X,128),J=`${(b0().baseUrl??"https://studio.decocms.com").replace(/\/+$/,"")}/report/${encodeURIComponent(X)}`,{title:W,description:K}=Hc$({brand:Q,domain:X,score:Z?.score,verdict:Z?.verdict}),H=`${J}/og.png`,F=`${Q} commerce report by decocms`;return[`<title>${FG(W)}</title>`,`<meta name="description" content="${FG(K)}" />`,'<meta name="robots" content="noindex, follow" />','<meta property="og:type" content="website" />','<meta property="og:site_name" content="decocms" />',`<meta property="og:title" content="${FG(W)}" />`,`<meta property="og:description" content="${FG(K)}" />`,`<meta property="og:url" content="${FG(J)}" />`,`<meta property="og:image" content="${FG(H)}" />`,'<meta property="og:image:width" content="1200" />','<meta property="og:image:height" content="630" />',`<meta property="og:image:alt" content="${FG(F)}" />`,'<meta name="twitter:card" content="summary_large_image" />',`<meta name="twitter:title" content="${FG(W)}" />`,`<meta name="twitter:description" content="${FG(K)}" />`,`<meta name="twitter:image" content="${FG(H)}" />`,`<meta name="twitter:image:alt" content="${FG(F)}" />`,`<link rel="canonical" href="${FG(J)}" />`,`<link rel="icon" href="${FG(Y)}" sizes="any" />`].join(`
+`,j=await Z.createBlob(E);await Eu$(Z.owner,Z.repo,j,E);let z=w[0]??`${qA0(Q)}/${BZ1(B)}.json`;H.push({path:z,mode:"100644",type:"blob",sha:j});let A=z.slice(z.lastIndexOf("/")+1,-5);F.set(z,{stem:A,sha:j,content:E});for(let P of w.slice(1))H.push({path:P,mode:"100644",type:"blob",sha:null}),F.delete(P)}for(let B of $.del)for(let L of zZ1(K,B))H.push({path:L,mode:"100644",type:"blob",sha:null}),F.delete(L);if(H.length===0)return G;let N=Q?`${Q}/.deco/blocks.gen.json`:".deco/blocks.gen.json";if(W.some((B)=>B.type==="blob"&&B.path===N)){let B=await Promise.all([...F.values()].map(async(j)=>({stem:j.stem,content:j.content??await Z.getBlobText(j.sha)}))),{decofile:L,skipped:w}=ya(B);if(w.length>0)console.warn("decofile gen: dropped blocks that were not valid JSON",{repo:`${Z.owner}/${Z.repo}`,branch:X,packagePath:Q,blocks:w.map((j)=>j.key)});let E=await Z.createBlob(L);H.push({path:N,mode:"100644",type:"blob",sha:E})}let U=await Z.createTree(J,H),O=await Z.createCommit({message:AK6($),treeSha:U,parentShas:[G]});try{return await Z.updateRef(X,O),O}catch(B){if(!(B instanceof u4&&B.status===422)||Y>=jK6-1)throw B;await D$(oZ(2000,200,Y,2,0.5))}}}function AK6($){let Z=(Y)=>{let G=Y.slice(0,3).join(", ");return Y.length>3?`${G} (+${Y.length-3} more)`:G},X=[];if($.set.size>0)X.push(`update ${Z([...$.set.keys()])}`);if($.del.size>0)X.push(`delete ${Z([...$.del])}`);let Q=`chore(decofile): ${X.join("; ")}`;return Tm0(Q,$.deps.coAuthor)}var jK6=3,qZ1;var bu$=D(()=>{GB0();jA0();w4();d_();MA0();qZ1=new Map});import{createHmac as xu$,randomBytes as TK6,timingSafeEqual as RK6}from"crypto";function yu$(){if(vA0)return vA0;let $;try{let Z=b0();$=Z.studioJwtSecret??Z.betterAuthSecret}catch{$=void 0}return vA0=$?Buffer.from($):TK6(32),vA0}function MZ1($){let Z=$.nowMs??Date.now(),X={o:$.organizationId,m:$.virtualMcpId,b:$.branch,e:Math.floor((Z+IK6)/1000)},Q=Buffer.from(JSON.stringify(X)).toString("base64url"),Y=xu$("sha256",yu$()).update(Q).digest("base64url");return`${Q}.${Y}`}function gu$($,Z){let X=$.indexOf(".");if(X<0)return!1;let Q=$.slice(0,X),Y=Buffer.from($.slice(X+1)),G=Buffer.from(xu$("sha256",yu$()).update(Q).digest("base64url"));if(Y.length!==G.length||!RK6(Y,G))return!1;let J;try{J=JSON.parse(Buffer.from(Q,"base64url").toString())}catch{return!1}let W=Math.floor((Z.nowMs??Date.now())/1000);return J.o===Z.organizationId&&J.m===Z.virtualMcpId&&J.b===Z.branch&&typeof J.e==="number"&&J.e>=W}var IK6=21600000,vA0=null;var hu$=D(()=>{q$()});import{z as ju}from"zod";function MK6($){return $.length>0&&$.length<=255&&!$.includes("..")&&!$.endsWith("/")&&!$.endsWith(".lock")&&qK6.test($)}function cu$($){return $.req.header("x-forwarded-host")??new URL($.req.url).host}async function fA0($){let Z=$.get("decofileScope");return wA0($.var.studioContext,Z.organizationId,Z.githubRepo)}function bA0($,Z){if(Z instanceof u4){let Q=Z.status===404?404:Z.status===409?409:Z.status===422?409:502;return $.json({error:Z.message},Q)}let X=Z instanceof Error?Z.message:String(Z);return $.json({error:X},500)}function lu$(){let $=new F1;return $.use("/:virtualMcpId/:branch",uu$),$.use("/:virtualMcpId/:branch/*",uu$),$.get("/:virtualMcpId/:branch",async(Z)=>{let X=Z.get("decofileScope");try{let Q=await fA0(Z),Y=await ju$(Q,X.branch,X.packagePath,{createBranchIfMissing:!!X.userId}),G={ETag:`"${Y.sha}"`,"Cache-Control":"no-store","Access-Control-Allow-Origin":"*"};if(Z.req.header("if-none-match")===`"${Y.sha}"`)return Z.body(null,304,G);if(!X.userId)return Z.body(Y.decofile,200,{...G,"content-type":"application/json"});let J=MZ1({organizationId:X.organizationId,virtualMcpId:X.virtualMcpId,branch:X.branch});return Z.body(`{"version":${JSON.stringify(Y.sha)},"token":${JSON.stringify(J)},"apiHost":${JSON.stringify(cu$(Z))},"decofile":${Y.decofile}}`,200,{...G,"content-type":"application/json"})}catch(Q){return bA0(Z,Q)}}),$.patch("/:virtualMcpId/:branch",async(Z)=>{let X=Z.get("decofileScope"),Q=Z.var.studioContext,Y=kK6.safeParse(await Z.req.json().catch(()=>null));if(!Y.success)return Z.json({error:"Invalid body",details:Y.error.issues},400);let G=Y.data;for(let J of[...Object.keys(G.set??{}),...G.delete??[]])try{EA0(J)}catch(W){let K=W instanceof Error?W.message:String(W);return Z.json({error:K},400)}for(let[J,W]of Object.entries(G.set??{}))if(typeof W!=="object"||W===null||Array.isArray(W))return Z.json({error:`Block "${J}" must be a JSON object`},400);try{let J=await fA0(Z),W=await fu$(`${X.organizationId}/${X.virtualMcpId}/${X.branch}`,{client:J,branch:X.branch,packagePath:X.packagePath,coAuthor:Uu(Q)},G),K=MZ1({organizationId:X.organizationId,virtualMcpId:X.virtualMcpId,branch:X.branch});return Z.json({version:W,token:K,apiHost:cu$(Z)})}catch(J){return bA0(Z,J)}}),$.post("/:virtualMcpId/:branch/publish",async(Z)=>{let X=Z.get("decofileScope");try{let Q=await fA0(Z),Y=await Q.getDefaultBranch();if(Y===X.branch)return Z.json({error:"Branch is already the default branch"},400);let G=`chore(decofile): publish ${X.branch}`;try{let J;try{J=await Q.mergeBranch(Y,X.branch,G)}catch(W){if(!(W instanceof u4&&W.status===409))throw W;await SA0(Q,X.branch,Y),J=await Q.mergeBranch(Y,X.branch,G)}return J?Z.json({result:"merged",sha:J}):Z.json({result:"up-to-date"})}catch(J){if(J instanceof u4&&J.status===409)return Z.json({error:"merge-conflict"},409);if(J instanceof u4&&J.status===405){let K=await Q.findOpenPullRequest(Y,X.branch)??await Q.createPullRequest({base:Y,head:X.branch,title:`Publish ${X.branch}`});return Z.json({result:"pull-request",number:K.number,url:K.html_url})}throw J}}catch(Q){return bA0(Z,Q)}}),$.get("/:virtualMcpId/:branch/status",async(Z)=>{let X=Z.get("decofileScope");try{let Q=await fA0(Z),Y=await Q.getDefaultBranch();if(Y===X.branch)return Z.json({baseBranch:Y,aheadBy:0,behindBy:0});try{let{aheadBy:G,behindBy:J}=await Q.compare(Y,X.branch);return Z.json({baseBranch:Y,aheadBy:G,behindBy:J})}catch(G){if(G instanceof u4&&G.status===404)return Z.json({baseBranch:Y,aheadBy:0,behindBy:0});throw G}}catch(Q){return bA0(Z,Q)}}),$}var qK6,kK6,uu$;var du$=D(()=>{jA0();D8();$Z1();DA0();RZ1();OZ1();bu$();hu$();AZ1();d_();MA0();qK6=/^[a-zA-Z0-9][a-zA-Z0-9/._-]*$/;kK6=ju.object({set:ju.record(ju.string(),ju.unknown()).optional(),delete:ju.array(ju.string()).optional()}).refine(($)=>Object.keys($.set??{}).length>0||($.delete?.length??0)>0,{message:"Patch must set or delete at least one block"}),uu$=BA0(async($,Z)=>{let X=$.var.studioContext,Q=X.organization;if(!Q)return $.json({error:"Organization scope required"},500);let Y=$.req.param("virtualMcpId"),G=$.req.param("branch");if(!Y||!G)return $.json({error:"virtualMcpId and branch are required"},400);if(!MK6(G))return $.json({error:`Invalid branch name: ${G}`},400);let J=X.auth?.user?.id??null;if(!J){let O=$.req.query("token");if(!($.req.method==="GET"&&!$.req.path.match(/\/(publish|status)$/)))return $.json({error:"Unauthorized"},401);if(!O||!gu$(O,{organizationId:Q.id,virtualMcpId:Y,branch:G}))return $.json({error:"Unauthorized"},401)}let W=await X.storage.virtualMcps.findById(Y);if(!W||W.organization_id!==Q.id)return $.json({error:"Virtual MCP not found"},404);let K=W.metadata??null;if(!LB0(K))return $.json({error:"Project has no preview server configured"},404);let F=W.connections?.map((O)=>O.connection_id)??[],N=ca(K,F);if(!N)return $.json({error:"Project has no GitHub repository"},404);let U=K?.runtime;return $.set("decofileScope",{organizationId:Q.id,virtualMcpId:Y,branch:G,packagePath:U?.path?.replace(/^\/+|\/+$/g,"")||null,githubRepo:N,userId:J}),Z()})});var mu$=($)=>{let Z=new F1;if(Z.use("*",f_),Z.route("/",CP0()),Z.route("/",Jx$()),Z.route("/",Uh$()),Z.route("/",Hh$()),Z.route("/",NA0()),Z.route("/tools",jh$()),Z.route("/",Lh$()),Z.route("/",lg$({kvStorage:$.kvStorage})),Z.route("/",ug$()),Z.route("/fs",Xh$({getConnection:$.getNatsConnection})),Z.route("/sandbox",_u$()),Z.route("/decofile",lu$()),Z.route("/",Jh$()),Z.route("/deco-sites",vP0()),Z.route("/sso",IP0()),Z.route("/",UA0({tokenStorage:$.tokenStorage,automationEventDispatcher:$.automationEventDispatcher})),Z.route("/webhooks",sb$()),$.mountDevAssets)Z.route("/dev-assets",fP0({orgFromPath:!0}));return Z.use("/mcp/:connectionId?",$.mcpAuth),Z.use("/mcp/:connectionId/ui-resource",$.mcpAuth),Z.use("/mcp/gateway/:virtualMcpId?",$.mcpAuth),Z.use("/mcp/virtual-mcp/:virtualMcpId?",$.mcpAuth),Z.use("/mcp/self",$.mcpAuth),Z.use("/mcp/task-run/:threadId",$.mcpAuth),Z.route("/",_v$()),Z.get("/mcp/:gateway?/:connectionId/.well-known/oauth-protected-resource/*",$.betterAuthProtectedResourceHandler),Z.get("/mcp/.well-known/oauth-protected-resource",$.betterAuthProtectedResourceHandler),Z.route("/mcp/task-run",Yh$()),Z.route("/mcp",yL0()),Z.route("/mcp/self",FA0()),Z.route("/mcp",uL0()),Z.all("/oauth-proxy/:connectionId/*",$.oauthProxyHandler),Z.get("/watch",$.watchHandler),Z};var iu$=D(()=>{D8();A51();eb$();q51();bP0();Ha();z51();cg$();dg$();Qh$();Lt();U51();cL0();n91();Gh$();Wh$();Fh$();Oh$();wh$();o91();zh$();r91();gL0();vu$();du$()});function VK6($){return $.filter((Z)=>Z.vendors?.alias).map((Z)=>({name:Z.name,title:Z.title,description:Z.description,logo:Z.logo,category:Z.category,vendor:{alias:Z.vendors.alias,url:Z.vendors.url}}))}var SK6=async($,Z)=>{if(!$.get("studioContext").auth.user?.id)return $.json({error:"Unauthorized"},401);return Z()},pu$=()=>{let $=new F1;return $.use("*",SK6),$.get("/",async(Z)=>{let X=b0(),Q=X.decoSupabaseUrl,Y=X.decoSupabaseServiceKey;if(!Q||!Y)return Z.json({apps:[]});try{let G=await iZ(Q,Y,"apps?select=name,title,description,logo,category,vendors(alias,url)");return Z.json({apps:VK6(G)})}catch(G){return console.error("[deco-apps] GET error:",G),Z.json({error:"Failed to fetch apps"},502)}}),$};var nu$=D(()=>{D8();q$();Cz0()});import{z as M1}from"zod";function HH($,Z="invalid_request_error",X=null,Q=null){return{error:{message:$,type:Z,param:X,code:Q}}}function uK6($){if(!$)return null;let Z=$.indexOf(":");if(Z===-1)return{credentialId:null,modelId:$};let X=$.substring(0,Z),Q=$.substring(Z+1);if(!X||!Q)return null;return{credentialId:X,modelId:Q}}function cK6($,Z,X){try{return JSON.parse($)}catch{throw new ru$(`Invalid JSON in tool call arguments for function '${X}' (tool_call_id: ${Z}): ${$}`)}}function lK6($){let Z={};for(let X of $)if(X.role==="assistant"&&X.tool_calls)for(let Q of X.tool_calls)Z[Q.id]=Q.function.name;return $.map((X)=>{switch(X.role){case"system":return{role:"system",content:X.content};case"user":if(typeof X.content==="string")return{role:"user",content:X.content};return{role:"user",content:X.content.map((Y)=>{if(Y.type==="text")return{type:"text",text:Y.text};return{type:"image",image:Y.image_url.url}})};case"assistant":if(X.tool_calls&&X.tool_calls.length>0)return{role:"assistant",content:X.tool_calls.map((Y)=>({type:"tool-call",toolCallId:Y.id,toolName:Y.function.name,input:cK6(Y.function.arguments,Y.id,Y.function.name)}))};return{role:"assistant",content:X.content??""};case"tool":let Q=Z[X.tool_call_id]??"unknown";return{role:"tool",content:[{type:"tool-result",toolCallId:X.tool_call_id,toolName:Q,output:{type:"text",value:X.content}}]}}})}function dK6($){let Z=$.map((X)=>{let Q=X.function.parameters?lY(X.function.parameters):lY({type:"object",properties:{}});return[X.function.name,I$({description:X.function.description,inputSchema:Q})]});return Object.fromEntries(Z)}function mK6($){if(!$)return;return{openai:{response_format:$}}}function iK6(){return`chatcmpl-${crypto.randomUUID().replace(/-/g,"").substring(0,29)}`}function tu$($,Z,X,Q,Y,G){let J={model:$,messages:Z,tools:X,temperature:Q.temperature,maxTokens:Q.max_tokens,topP:Q.top_p,frequencyPenalty:Q.frequency_penalty,presencePenalty:Q.presence_penalty,stopSequences:Q.stop?Array.isArray(Q.stop)?Q.stop:[Q.stop]:void 0,abortSignal:G};return Y?{...J,providerOptions:Y}:J}function ou$($){if($==="tool-calls")return"tool_calls";if($==="length")return"length";return"stop"}var CK6=256,_K6,vK6,fK6,bK6,xK6,yK6,gK6,hK6,ru$,au$,su$;var eu$=D(()=>{B4();D8();Nu();WN();_K6=M1.object({type:M1.literal("function"),function:M1.object({name:M1.string(),description:M1.string().optional(),parameters:M1.record(M1.string(),M1.unknown()).optional()})}),vK6=M1.object({id:M1.string(),type:M1.literal("function"),function:M1.object({name:M1.string(),arguments:M1.string()})}),fK6=M1.discriminatedUnion("role",[M1.object({role:M1.literal("system"),content:M1.string(),name:M1.string().optional()}),M1.object({role:M1.literal("user"),content:M1.union([M1.string(),M1.array(M1.union([M1.object({type:M1.literal("text"),text:M1.string()}),M1.object({type:M1.literal("image_url"),image_url:M1.object({url:M1.string(),detail:M1.string().optional()})})]))]),name:M1.string().optional()}),M1.object({role:M1.literal("assistant"),content:M1.string().nullable().optional(),name:M1.string().optional(),tool_calls:M1.array(vK6).optional()}),M1.object({role:M1.literal("tool"),content:M1.string(),tool_call_id:M1.string()})]),bK6=M1.object({type:M1.literal("text")}),xK6=M1.object({type:M1.literal("json_object")}),yK6=M1.object({type:M1.literal("json_schema"),json_schema:M1.object({name:M1.string(),description:M1.string().optional(),schema:M1.record(M1.string(),M1.unknown()),strict:M1.boolean().optional()})}),gK6=M1.union([bK6,xK6,yK6]),hK6=M1.object({model:M1.string().describe("Format: 'model_id' or 'credential_id:model_id'"),messages:M1.array(fK6),stream:M1.boolean().optional().default(!1),temperature:M1.number().min(0).max(2).optional(),max_tokens:M1.number().positive().optional(),top_p:M1.number().min(0).max(1).optional(),frequency_penalty:M1.number().min(-2).max(2).optional(),presence_penalty:M1.number().min(-2).max(2).optional(),stop:M1.union([M1.string(),M1.array(M1.string())]).optional(),tools:M1.array(_K6).optional(),tool_choice:M1.union([M1.literal("auto"),M1.literal("none"),M1.literal("required"),M1.object({type:M1.literal("function"),function:M1.object({name:M1.string()})})]).optional(),response_format:gK6.optional(),user:M1.string().optional()});ru$=class ru$ extends Error{constructor($){super($);this.name="MessageConversionError"}};au$=new F1;au$.post("/:org/v1/chat/completions",async($)=>{let Z=$.get("studioContext"),X=$.req.param("org");try{if(!Z.auth.apiKey?.id)return $.json(HH("API key authentication required. Provide a valid API key via Authorization header.","authentication_error"),401);if(!Z.organization)return $.json(HH("Organization context is required. Ensure your API key has organization metadata.","invalid_request_error","organization"),400);if((Z.organization.slug??Z.organization.id)!==X)return $.json(HH("Organization mismatch. The API key's organization does not match the requested organization.","invalid_request_error","organization"),403);let Q=await $.req.json(),Y=hK6.safeParse(Q);if(!Y.success){let w=Y.error.issues[0]??{message:"Invalid request",path:[]};return $.json(HH(`Invalid request: ${w.message}`,"invalid_request_error",w.path.length>0?w.path.join("."):null),400)}let G=Y.data,J=uK6(G.model);if(!J)return $.json(HH("Invalid model format. Expected 'model_id' or 'credential_id:model_id' (e.g., 'claude-sonnet-4-6' or 'key_abc123:claude-sonnet-4-6')","invalid_request_error","model"),400);let{credentialId:W}=J,{modelId:K}=J;if(!W){let E=(await Z.storage.aiProviderKeys.list({organizationId:Z.organization.id})).find((j)=>hL(j.providerId));if(!E)return $.json(HH("No AI provider credentials configured for this organization. Add a credential in settings or specify one explicitly via 'credential_id:model_id'.","invalid_request_error","model"),400);W=E.id}let H;try{H=await Z.aiProviders.activate(W,Z.organization.id)}catch{return $.json(HH(`AI provider credential not found or inaccessible: ${W}`,"invalid_request_error","model"),404)}let F=H.aiSdk.languageModel(K),N=lK6(G.messages),U=G.tools?dK6(G.tools):void 0,O=mK6(G.response_format),B=iK6(),L=Math.floor(Date.now()/1000);if(G.stream)return kN($,async(w)=>{let E=tu$(F,N,U,G,O,$.req.raw.signal);try{let j=$B(E),z=!1,A=0,P="",I=async()=>{if(P.length===0)return;let q=P;P="",await w.writeSSE({data:JSON.stringify({id:B,object:"chat.completion.chunk",created:L,model:G.model,choices:[{index:0,delta:{content:q},finish_reason:null}]})})};for await(let q of j.fullStream){if(!z&&(q.type==="text-delta"||q.type==="tool-call"))await w.writeSSE({data:JSON.stringify({id:B,object:"chat.completion.chunk",created:L,model:G.model,choices:[{index:0,delta:{role:"assistant",content:""},finish_reason:null}]})}),z=!0;if(q.type==="text-delta"){if(P+=q.text,P.length>=CK6)await I()}else if(q.type==="tool-call"){await I();let M=A++;await w.writeSSE({data:JSON.stringify({id:B,object:"chat.completion.chunk",created:L,model:G.model,choices:[{index:0,delta:{tool_calls:[{index:M,id:q.toolCallId,type:"function",function:{name:q.toolName,arguments:JSON.stringify(q.input)}}]},finish_reason:null}]})})}else if(q.type==="finish")await I(),await w.writeSSE({data:JSON.stringify({id:B,object:"chat.completion.chunk",created:L,model:G.model,choices:[{index:0,delta:{},finish_reason:ou$(q.finishReason)}],usage:q.totalUsage?{prompt_tokens:q.totalUsage.inputTokens??0,completion_tokens:q.totalUsage.outputTokens??0,total_tokens:q.totalUsage.totalTokens??0}:void 0})})}await I(),await w.writeSSE({data:"[DONE]"})}catch(j){let z=j;console.error("[openai-compat:stream] Error:",z.message),await w.writeSSE({data:JSON.stringify({error:{message:z.message,type:"server_error"}})})}});else{let w=tu$(F,N,U,G,O,$.req.raw.signal),E=await sO(w),j={role:"assistant",content:E.text||null};if(E.toolCalls&&E.toolCalls.length>0)j.tool_calls=E.toolCalls.map((z)=>({id:z.toolCallId,type:"function",function:{name:z.toolName,arguments:JSON.stringify("input"in z?z.input:{})}})),j.content=null;return $.json({id:B,object:"chat.completion",created:L,model:G.model,choices:[{index:0,message:j,finish_reason:ou$(E.finishReason)}],usage:{prompt_tokens:E.usage?.inputTokens??0,completion_tokens:E.usage?.outputTokens??0,total_tokens:E.usage?.totalTokens??0}})}}catch(Q){let Y=Q;if(Y.name==="AbortError")return $.json(HH("Request aborted","invalid_request_error"),400);if(Y.name==="MessageConversionError")return $.json(HH(Y.message,"invalid_request_error","messages"),400);return console.error("[openai-compat] Error:",Y.message,Y.stack),$.json(HH(Y.message,"server_error"),500)}});su$=au$});function pK6($){if(typeof $!=="object"||$===null)return!1;let X=$.githubRepo?.url;return typeof X==="string"&&X.length>0}function $c$(){let $=new F1;return $.use("*",async(Z,X)=>{await X(),Z.header("Cache-Control","private, no-store"),Z.header("Vary","Cookie")}),$.get("/",async(Z)=>{let X=Z.get("studioContext"),Q=Y1(X);if(!Q)return Z.json({error:"Authentication required"},401);let G=(Z.req.query("site")??"").trim().toLowerCase();if(!mG(G))return Z.json({error:"Invalid site slug"},400);let J=await X.db.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["organization.id as id","organization.slug as slug","organization.name as name","organization.metadata as metadata"]).where("member.userId","=",Q).execute(),W=[];for(let H of J){if(!H.slug||H7(H))continue;let F=await X.storage.virtualMcps.list(H.id);for(let N of F){if(ea1(N)!==G)continue;if(!pK6(N.metadata))continue;W.push({orgSlug:H.slug,orgName:H.name??H.slug,project:{id:N.id,title:N.title,icon:N.icon??null}})}}let K={matches:W};return Z.json(K)}),$}var Zc$=D(()=>{D8();hO()});var Qc$;var Xc$=D(()=>{Qc$={name:"decocms",version:"4.262.2",description:"Deco CMS \u2014 Self-hostable MCP Gateway for managing AI connections and tools",author:"Deco team",repository:{type:"git",url:"git+https://github.com/decocms/studio.git",directory:"apps/api"},bugs:{url:"https://github.com/decocms/studio/issues"},type:"module",bin:{deco:"./dist/server/cli.js"},files:["dist/**/*"],scripts:{dev:"bun run migrate && bun run dev:server","dev:server":"bun run --cwd=../../packages/sandbox build && NODE_ENV=development bun --env-file=.env --hot run src/index.ts",build:"bun run build:server","build:server":"bun run scripts/bundle-server-script.ts --dist ./dist/server","generate:tool-contracts":"bun run scripts/generate-tool-contracts.ts","db:migrate":"bun run ./dist/server/migrate.js","db:migrate:dbos":"bun run ./dist/server/migrate-dbos.js",check:"tsc --noEmit",start:"bun run ./dist/server/server.js",migrate:"bun run src/database/migrate.ts","migrate:dbos":"bun run src/database/migrate-dbos.ts",test:"bun test src","better-auth:migrate":"bunx --bun @better-auth/cli migrate -y --config src/auth/index.ts",prepublishOnly:"bun run --cwd=../.. build:studio"},optionalDependencies:{"@duckdb/node-api":"^1.5.0-r.1"},dependencies:{"@ai-sdk/anthropic":"^3.0.85","@ai-sdk/google":"^3.0.83","@ai-sdk/openai":"^3.0.73","@anthropic-ai/sdk":"^0.105.0","@aws-sdk/client-s3":"^3.1013.0","@aws-sdk/client-sts":"^3.1013.0","@aws-sdk/lib-storage":"^3.1013.0","@aws-sdk/s3-request-presigner":"^3.1013.0","@clickhouse/client":"^1.8.1","@dbos-inc/dbos-sdk":"^4.21.6","@inkjs/ui":"^2.0.0","@nats-io/jetstream":"3.4.0","@nats-io/kv":"3.4.0","@nats-io/nats-core":"3.4.0","@nats-io/transport-node":"3.4.0","@openrouter/ai-sdk-provider":"^2.9.1","@opentelemetry/core":"^2.6.0","embedded-postgres":"^18.3.0-beta.16",ink:"^6.8.0",kysely:"^0.28.12","posthog-node":"^5.0.0",react:"^19.2.6","react-dom":"^19.2.6"},devDependencies:{"@ai-sdk/provider":"^3.0.10","@better-auth/sso":"1.4.1","@decocms/better-auth":"1.5.17","@decocms/bindings":"workspace:*","@decocms/mcp-utils":"workspace:*","@decocms/runtime":"workspace:*","@decocms/sandbox":"workspace:*","@decocms/shared":"workspace:*","@jitl/quickjs-wasmfile-release-sync":"0.31.0","@modelcontextprotocol/sdk":"1.29.0","@nats-io/jwt":"0.0.10-5","@opentelemetry/api":"^1.9.0","@opentelemetry/api-logs":"^0.211.0","@opentelemetry/exporter-logs-otlp-proto":"^0.211.0","@opentelemetry/exporter-prometheus":"^0.208.0","@opentelemetry/exporter-trace-otlp-proto":"^0.207.0","@opentelemetry/instrumentation-runtime-node":"^0.24.0","@opentelemetry/resources":"^2.6.0","@opentelemetry/sdk-logs":"^0.211.0","@opentelemetry/sdk-metrics":"^2.2.0","@opentelemetry/sdk-node":"^0.207.0","@opentelemetry/sdk-trace-base":"^2.5.0","@types/bun":"^1.3.1","@types/google.maps":"^3.65.2","@types/pg":"^8.15.6","@types/react-syntax-highlighter":"^15.5.13","@vercel/nft":"^1.1.1",ai:"^6.0.208","better-auth":"1.4.22",croner:"^9.1.0",degit:"^2.8.4",hono:"^4.10.7",jose:"^6.0.11",nanoid:"^5.1.6",pg:"^8.16.3",typescript:"^7.0.2",typescript5:"npm:typescript@^5.9.3",zod:"4.3.6"},homepage:"https://github.com/decocms/studio",keywords:["mcp","model-context-protocol","ai","gateway","self-hosted","tools"],license:"MIT",publishConfig:{access:"public"}}});function oK6(){let $=process.env.POSTHOG_KEY;if(!$)return null;return{key:$,host:process.env.POSTHOG_HOST??tK6}}var Yc$,tK6="https://ph.studio.decocms.com",Gc$;var Jc$=D(()=>{D8();eh0();qC();L9();q$();W51();Xc$();Yc$=new F1;Yc$.get("/",($)=>{let Z={version:Qc$.version,theme:Im1(),...Vw().logo&&{logo:Vw().logo},...fK()&&{internalUrl:XC1()},...b0().enableDecoImport&&{enableDecoImport:!0},brandExtractEnabled:!!b0().firecrawlApiKey,auth:Lb$(),posthog:oK6(),googleMapsApiKey:process.env.GOOGLE_MAPS_API_KEY?.trim()||null,runtime:{agentSandbox:!fK()&&b0().sandboxProviderKind==="agent-sandbox"}};return $.header("Cache-Control","no-store"),$.json({success:!0,config:Z})});Gc$=Yc$});function zu($){let Z=($??"").trim().toLowerCase();return Z=Z.replace(/^https?:\/\//,""),Z=Z.replace(/^www\./,""),Z=Z.split(/[/?#]/)[0]??"",Z.replace(/\/+$/,"")}function kZ1($){return(zu($).split(".")[0]||$).replace(/[-_]/g," ").split(" ").filter(Boolean).map((X)=>X.charAt(0).toUpperCase()+X.slice(1)).join(" ")}function Kc$($,Z=64){return`https://www.google.com/s2/favicons?domain=${encodeURIComponent(zu($))}&sz=${Z}`}function Wc$($,Z){let X=$.trim();if(X.length<=Z)return X;let Q=X.slice(0,Z-1),Y=Q.lastIndexOf(" ");return`${(Y>Z*0.6?Q.slice(0,Y):Q).trimEnd()}\u2026`}function Hc$($){let{brand:Z,domain:X,score:Q,verdict:Y}=$,G=typeof Q==="number"?`${Z} commerce report \u2014 ${Math.round(Q)}/100 \xB7 decocms`:`${Z} commerce report \xB7 decocms`,J=`See the full ${Z} scorecard \u2014 SEO, performance, conversion & AEO signals scored by decocms.`,W=Y?.trim()?Wc$(`${Y.trim().replace(/\s+/g," ")} \u2014 ${J}`,200):Wc$(`How does ${X} really perform? ${J}`,200);return{title:G,description:W}}import{z as l0}from"zod";var t_,rK6,aK6,sK6,eK6,Fc$;var Nc$=D(()=>{t_=l0.enum(["good","bad","neutral"]),rK6=l0.preprocess(($)=>{if(Array.isArray($))return{kind:"text",value:$.find((X)=>X!==null&&typeof X!=="object")??""};return $!==null&&typeof $==="object"?$:{kind:"text",value:$}},l0.object({kind:l0.enum(["text","number","sparkline","badge","score"]).catch("text"),value:l0.coerce.string().optional(),tone:t_.optional(),muted:l0.boolean().optional(),delta:l0.coerce.string().optional(),deltaDir:l0.enum(["up","down","neutral"]).optional(),points:l0.array(l0.coerce.number()).optional(),label:l0.coerce.string().optional()}).transform(($)=>{if($.kind==="badge"&&$.label==null)$.label=$.value??"";if($.kind==="score"){let Z=Number($.value);if(Number.isNaN(Z))return{...$,kind:"text"}}return $})),aK6=l0.preprocess(($)=>{let Z=$;if(Z&&typeof Z==="object"&&!Array.isArray(Z)&&Array.isArray(Z.cells))Z=Z.cells;if(Array.isArray(Z)&&Z.length===1&&Array.isArray(Z[0]))Z=Z[0];if(Array.isArray(Z))return Z;if(Z&&typeof Z==="object")return Object.values(Z);return Z},l0.array(rK6)),sK6={key:l0.coerce.string(),title:l0.coerce.string(),eyebrow:l0.coerce.string().optional(),headline:l0.coerce.string(),annotation:l0.coerce.string().optional(),methodology:l0.coerce.string().optional(),sources:l0.array(l0.object({name:l0.coerce.string(),logoUrl:l0.coerce.string()})).optional()},eK6=l0.discriminatedUnion("template",[l0.object({template:l0.literal("cover"),score:l0.object({value:l0.coerce.number(),max:l0.coerce.number().optional(),grade:l0.coerce.string().optional(),label:l0.coerce.string().optional()}).optional(),brandImage:l0.coerce.string().optional(),screenshot:l0.coerce.string().optional(),mobileScreenshot:l0.coerce.string().optional()}),l0.object({template:l0.literal("cta"),ctaUrl:l0.coerce.string().optional(),ctaLabel:l0.coerce.string().optional(),bullets:l0.array(l0.coerce.string()).optional()}),l0.object({template:l0.literal("series"),points:l0.array(l0.coerce.number()).min(2),xLabels:l0.array(l0.coerce.string()).min(1),unit:l0.coerce.string().optional(),callout:l0.object({index:l0.coerce.number(),value:l0.coerce.string(),tone:t_.optional()})}),l0.object({template:l0.literal("threshold"),value:l0.coerce.string().default(""),metricLabel:l0.coerce.string().optional(),ratio:l0.coerce.number(),thresholdRatio:l0.coerce.number().optional(),thresholdLabel:l0.coerce.string().default(""),tone:t_.optional()}),l0.object({template:l0.literal("stats"),stats:l0.array(l0.object({value:l0.coerce.string(),label:l0.coerce.string(),tone:t_.optional()})).min(1)}),l0.object({template:l0.literal("bars"),items:l0.array(l0.object({value:l0.coerce.string(),label:l0.coerce.string(),ratio:l0.coerce.number(),tone:t_.optional()})).min(1)}),l0.object({template:l0.literal("gauges"),gauges:l0.array(l0.object({label:l0.coerce.string(),value:l0.coerce.string(),status:l0.enum(["good","warn","bad"]).catch("warn"),caption:l0.coerce.string().optional(),ratio:l0.coerce.number().optional()})).min(1)}),l0.object({template:l0.literal("checklist"),checks:l0.array(l0.object({label:l0.coerce.string(),status:l0.enum(["pass","fail","warn"]).catch("fail"),value:l0.coerce.string().optional()})).min(1)}),l0.object({template:l0.literal("table"),columns:l0.array(l0.object({label:l0.coerce.string(),align:l0.enum(["left","right"]).optional()})).min(1),rows:l0.array(aK6).min(1),highlightRow:l0.coerce.number().optional()}),l0.object({template:l0.literal("products"),products:l0.array(l0.object({name:l0.coerce.string(),price:l0.coerce.string().optional(),image:l0.coerce.string().optional(),url:l0.coerce.string().optional()})).min(1)}),l0.object({template:l0.literal("list"),entries:l0.array(l0.object({label:l0.coerce.string(),severity:l0.enum(["error","warning","notice"]).catch("notice")})).min(1),moreCount:l0.coerce.number().optional()}),l0.object({template:l0.literal("keywords"),volumeLabel:l0.coerce.string().optional(),keywords:l0.array(l0.object({term:l0.coerce.string(),volume:l0.coerce.string(),position:l0.coerce.number().catch(0)})).min(1)}),l0.object({template:l0.literal("competitor"),metricLabel:l0.coerce.string().optional(),competitors:l0.array(l0.object({name:l0.coerce.string(),value:l0.coerce.string(),tone:t_.optional(),isYou:l0.boolean().optional()})).min(1)}),l0.object({template:l0.literal("scorecard"),rivalLabel:l0.coerce.string().optional(),dimensions:l0.array(l0.object({label:l0.coerce.string(),you:l0.coerce.string(),rival:l0.coerce.string().optional(),rivalName:l0.coerce.string().optional(),tone:t_.optional()})).min(1)})]),Fc$=l0.object({...sK6,template:eK6})});function xA0($){let Z=[],X=[...$.sections].sort((Y,G)=>Y.position-G.position).map((Y)=>{let G=Fc$.safeParse(Y.props);if(G.success)return G.data;let J=G.error.issues[0];return Z.push({section_type:Y.section_type,position:Y.position,reason:J?`${J.path.join(".")||"(root)"}: ${J.message}`:"contract violation"}),null}).filter((Y)=>Y!==null),Q=X.filter((Y)=>Y.template.template!=="cover"&&Y.template.template!=="cta").map((Y)=>({key:Y.key,title:Y.title}));return{deck:{meta:{...$.meta,scores:$.summary?.scores,scannedAt:$.scanned_at,toc:Q},slides:X},drops:Z}}var VZ1=D(()=>{Nc$()});import{join as Uc$}from"path";async function ZH6($){try{let Z=await fetch(`${QK({})}/api/v2/public/diagnostics/${encodeURIComponent($)}`,{headers:{Accept:"application/json"},signal:AbortSignal.timeout($H6)});if(!Z.ok)return null;let X=await Z.json(),{deck:Q}=xA0(X);if(!Q.slides.length)return null;let Y=Q.slides.find((W)=>W.template.template==="cover"),G=Y?.template,J=G&&G.template==="cover"?G:void 0;return{brand:Q.meta.brand?.trim()||kZ1($),score:Q.meta.scores?.cover??J?.score?.value,verdict:Y?.annotation?.trim()||Y?.headline?.trim()||void 0}}catch{return null}}function FG($){return $.replaceAll("&","&amp;").replaceAll("<","&lt;").replaceAll(">","&gt;").replaceAll('"',"&quot;")}function XH6($,Z){let X=zu($),Q=Z?.brand?.trim()||kZ1(X),Y=Kc$(X,128),J=`${(b0().baseUrl??"https://studio.decocms.com").replace(/\/+$/,"")}/report/${encodeURIComponent(X)}`,{title:W,description:K}=Hc$({brand:Q,domain:X,score:Z?.score,verdict:Z?.verdict}),H=`${J}/og.png`,F=`${Q} commerce report by decocms`;return[`<title>${FG(W)}</title>`,`<meta name="description" content="${FG(K)}" />`,'<meta name="robots" content="noindex, follow" />','<meta property="og:type" content="website" />','<meta property="og:site_name" content="decocms" />',`<meta property="og:title" content="${FG(W)}" />`,`<meta property="og:description" content="${FG(K)}" />`,`<meta property="og:url" content="${FG(J)}" />`,`<meta property="og:image" content="${FG(H)}" />`,'<meta property="og:image:width" content="1200" />','<meta property="og:image:height" content="630" />',`<meta property="og:image:alt" content="${FG(F)}" />`,'<meta name="twitter:card" content="summary_large_image" />',`<meta name="twitter:title" content="${FG(W)}" />`,`<meta name="twitter:description" content="${FG(K)}" />`,`<meta name="twitter:image" content="${FG(H)}" />`,`<meta name="twitter:image:alt" content="${FG(F)}" />`,`<link rel="canonical" href="${FG(J)}" />`,`<link rel="icon" href="${FG(Y)}" sizes="any" />`].join(`
     `)}function QH6($,Z){return $.replace(/<title>[\s\S]*?<\/title>\s*/i,"").replace(/<meta\s+name="(?:description|twitter:[^"]*)"[^>]*>\s*/gi,"").replace(/<meta\s+property="og:[^"]*"[^>]*>\s*/gi,"").replace(/<link\s+rel="icon"[^>]*>\s*/gi,"").replace("</head>",`    ${Z}
   </head>`)}function Oc$($){let Z=new F1;return Z.get("/:domain/og.png",async(X)=>{let Q=zu(X.req.param("domain")),Y=async()=>{let G=$?Bun.file(Uc$($,"report-og-fallback.png")):null;if(!G||!await G.exists())return X.notFound();return X.body(new Uint8Array(await G.arrayBuffer()),200,{"Content-Type":"image/png","Cache-Control":"public, max-age=0, s-maxage=3600"})};try{let G=await fetch(`${QK({})}/api/v2/public/diagnostics/${encodeURIComponent(Q)}/og.png`,{signal:AbortSignal.timeout(YH6)}),J=G.headers.get("content-type")??"";if(!G.ok||!J.startsWith("image/")||!G.body)return Y();return X.body(G.body,200,{"Content-Type":J,"Cache-Control":"public, max-age=0, s-maxage=604800"})}catch{return Y()}}),Z.get("/:domain",async(X)=>{let Q=X.req.param("domain"),Y=$?Uc$($,"index.html"):null,G=Y?Bun.file(Y):null;if(!G||!await G.exists())return X.notFound();let J=await G.text();try{let W=await ZH6(zu(Q)),K=XH6(Q,W);return X.html(QH6(J,K),200,{"Cache-Control":"public, max-age=0, s-maxage=300"})}catch{return X.html(J)}}),Z}var $H6=2500,YH6=1e4;var Bc$=D(()=>{D8();VZ1();dw();q$()});function da($,Z){return fetch(`${QK({})}${$}`,Z)}async function GH6($,Z,X){let Q=new URLSearchParams;if(Z)Q.set("pw",Z);if(X)Q.set("lang",X);let Y=Q.toString()?`?${Q.toString()}`:"",G=await da(`/api/v2/public/diagnostics/${encodeURIComponent($)}${Y}`,{headers:{Accept:"application/json"}});if(G.status===404)return{status:"not_found",deck:null,scanned_at:null,drops:[]};if(!G.ok)throw Error(`report read HTTP ${G.status}`);let J=await G.json(),{deck:W,drops:K}=xA0(J);return{status:W.slides.length?"ready":"empty",deck:W,scanned_at:J.scanned_at,drops:K}}var JH6,SN,Dc$=async($,Z)=>{if(!$.get("reportUser"))return $.json({error:"Authentication required"},401);await Z();return},Lc$;var wc$=D(()=>{D8();gY();dw();VZ1();JH6=new Set(["complete","errored","terminated","unknown"]),SN=new F1;SN.use("*",async($,Z)=>{let X=await F8.api.getSession({headers:$.req.raw.headers});$.set("reportUser",X?.user?.id?{email:X.user.email}:void 0),await Z(),$.header("Cache-Control","private, no-store"),$.header("Vary","Cookie");return});SN.use("/link-token/*",Dc$);SN.use("/suggest",Dc$);SN.get("/site/:domain",async($)=>{let Z=$.req.param("domain").trim();if(!Z)return $.json({error:"domain is required"},400);let X=$.get("reportUser"),Q=$.req.query("key")?.trim()||void 0,Y=$.req.query("lang")?.trim()||void 0;try{let G=await GH6(Z,Q,Y);if($.header("Cache-Control","private, no-store"),X||!G.deck)return $.json(G);return $.json({...G,deck:{...G.deck,slides:G.deck.slides.slice(0,1)},truncated:G.status==="ready"})}catch{return $.json({error:"report read failed"},502)}});SN.post("/run",async($)=>{let Z=$.get("reportUser"),X;try{X=await $.req.json()}catch{return $.json({error:"invalid JSON"},400)}let Q=typeof X.domain==="string"?X.domain.trim():"";if(!Q)return $.json({error:"domain is required"},400);let Y=Z?.email,G=typeof X.distinctId==="string"&&X.distinctId.trim()&&X.distinctId.length<=200?X.distinctId.trim():void 0;try{let J=await da("/api/v2/diagnostics/run",{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${lw({})}`},body:JSON.stringify({url:Q,...Y?{email:Y}:{},distinct_id:G})});if(!J.ok)return $.json({error:`run HTTP ${J.status}`},502);let W=await J.json(),K=W.blocked?{state:"blocked"}:W.status==="fresh"?{state:"fresh"}:W.mode==="sync"?{state:"sync"}:{state:"running",id:W.id??null};return $.json(K)}catch{return $.json({error:"run failed"},502)}});SN.get("/status",async($)=>{let Z=$.req.query("id");if(!Z)return $.json({error:"id is required"},400);try{let X=await da(`/api/v2/diagnostics/status?id=${encodeURIComponent(Z)}`,{headers:{Authorization:`Bearer ${lw({})}`}});if(!X.ok)return $.json({error:`status HTTP ${X.status}`},502);let Y=(await X.json()).status??"unknown",G={done:JH6.has(Y),status:Y};return $.json(G)}catch{return $.json({error:"status failed"},502)}});SN.get("/link-token/:id",async($)=>{let Z=$.req.param("id");try{let X=await da(`/api/v2/public/link-tokens/${encodeURIComponent(Z)}`,{headers:{Accept:"application/json"}});if(X.status===404)return $.json(null);if(!X.ok)return $.json({error:`link token HTTP ${X.status}`},502);return $.json(await X.json())}catch{return $.json({error:"link token resolve failed"},502)}});SN.get("/suggest",async($)=>{let Z=($.req.query("q")??"").trim().slice(0,64);if(Z.length<2)return $.json({suggestions:[]});try{let X=await da(`/api/v2/public/suggest?q=${encodeURIComponent(Z)}`,{headers:{Accept:"application/json"}});if(!X.ok)return $.json({suggestions:[]});let Q=await X.json();return $.json({suggestions:Array.isArray(Q.suggestions)?Q.suggestions:[]})}catch{return $.json({suggestions:[]})}});Lc$=SN});import{createHmac as WH6,timingSafeEqual as KH6}from"crypto";function jc$($,Z,X,Q=Date.now()){if(!Z||!X)return!1;let Y,G=[];for(let H of Z.split(",")){let F=H.indexOf("=");if(F<=0)continue;let N=H.slice(0,F).trim(),U=H.slice(F+1).trim();if(N==="t")Y=U;else if(N==="v1")G.push(U)}if(!Y||G.length===0)return!1;let J=Number(Y);if(!Number.isFinite(J)||Math.abs(Q/1000-J)>HH6)return!1;let W=WH6("sha256",X).update(`${Y}.${$}`).digest("hex"),K=Buffer.from(W,"hex");return G.some((H)=>{let F=Buffer.from(H,"hex");return K.length===F.length&&KH6(K,F)})}function zc$($){let Z;try{Z=JSON.parse($)}catch{return null}let X=SJ(Z),Q=SJ(SJ(X?.data)?.object);if(!X||typeof X.type!=="string"||!Q)return null;return{id:FH(X.id),type:X.type,created:typeof X.created==="number"?X.created:void 0,livemode:typeof X.livemode==="boolean"?X.livemode:void 0,data:{object:Q}}}function Pc$($){switch($){case"active":case"trialing":return"active";case"past_due":return"past_due";default:return"canceled"}}function FH($){return typeof $==="string"?$:void 0}function SJ($){return typeof $==="object"&&$!==null?$:void 0}function yA0($){return typeof $==="number"?new Date($*1000):null}function _Z1($){return FH($)??FH(SJ($)?.id)}function FH6($){return _Z1($.subscription)??FH(SJ(SJ($.parent)?.subscription_details)?.subscription)}function NH6($){let Z=yA0($.current_period_end);if(Z)return Z;let X=SJ($.items)?.data;if(!Array.isArray(X))return null;let Q=0;for(let Y of X){let G=SJ(Y)?.current_period_end;if(typeof G==="number"&&G>Q)Q=G}return Q>0?new Date(Q*1000):null}function SZ1($,Z){let X=yA0($.created);return!!X&&!!Z.lastStripeEventAt&&X<Z.lastStripeEventAt}function CZ1($,Z){let X=yA0($.created);if(!X)return;return Z.lastStripeEventAt&&Z.lastStripeEventAt>X?void 0:X}async function UH6($,Z){let X=Z.data.object;switch(Z.type){case"checkout.session.completed":case"checkout.session.async_payment_succeeded":{let Q=FH(SJ(X.metadata)?.orgId);if(!Q)return{handled:!1,reason:"no orgId"};if(FH(SJ(X.metadata)?.kind)==="topup"){if(X.mode!=="payment")return{handled:!1,reason:"topup with wrong mode"};if(FH(X.payment_status)!=="paid")return{handled:!1,reason:"payment not confirmed"};let J=FH(X.id);if(!J)return console.error("stripe webhook: topup session without id",{eventId:Z.id,organizationId:Q}),{handled:!1,reason:"topup session without id"};let W=Number(SJ(X.metadata)?.creditCents);if(!Number.isInteger(W)||W<=0)return console.error("stripe webhook: paid topup with bad metadata \u2014 credit NOT applied",{eventId:Z.id,organizationId:Q,creditCents:SJ(X.metadata)?.creditCents}),{handled:!1,reason:"bad topup metadata"};return{handled:!0,organizationId:Q,topUp:{creditCents:W,referenceId:`stripe-topup:${J}`}}}if(X.mode!=="subscription")return{handled:!1,reason:"not a subscription checkout"};if(FH(X.payment_status)!=="paid")return{handled:!1,reason:"payment not confirmed"};let Y=await $.getBilling(Q);if(!Y)return{handled:!1,reason:"unknown org"};let G=_Z1(X.subscription);if(Y.stripeSubscriptionId&&G&&Y.stripeSubscriptionId!==G)return console.error("stripe webhook: refused checkout rebind",{organizationId:Q,eventId:Z.id}),{handled:!1,reason:"org already bound to another subscription",orphanSubscriptionId:G};if(SZ1(Z,Y))return{handled:!1,reason:"stale event"};return await $.updateStripeState(Q,{stripeCustomerId:_Z1(X.customer),stripeSubscriptionId:G,status:"active",lastStripeEventAt:CZ1(Z,Y)}),{handled:!0,organizationId:Q}}case"customer.subscription.updated":case"customer.subscription.deleted":{let Q=FH(X.id);if(!Q)return{handled:!1,reason:"no sub id"};let Y=await $.getBillingByStripeSubscriptionId(Q);if(!Y)return{handled:!1,reason:"unknown subscription"};let G=Z.type==="customer.subscription.deleted";if(!G&&SZ1(Z,Y))return{handled:!1,reason:"stale event"};let J=G?"canceled":Pc$(X.status);return await $.updateStripeState(Y.organizationId,{status:J,currentPeriodEnd:NH6(X),...G&&{stripeSubscriptionId:null},lastStripeEventAt:CZ1(Z,Y)}),{handled:!0,organizationId:Y.organizationId}}case"invoice.paid":{let Q=FH6(X);if(!Q)return{handled:!1,reason:"no sub id"};let Y=await $.getBillingByStripeSubscriptionId(Q);if(!Y)return{handled:!1,reason:"unknown subscription"};if(SZ1(Z,Y))return{handled:!1,reason:"stale event"};return await $.updateStripeState(Y.organizationId,{status:"active",currentPeriodEnd:yA0(X.period_end),lastStripeEventAt:CZ1(Z,Y)}),{handled:!0,organizationId:Y.organizationId}}default:return{handled:!1,reason:`unhandled event ${Z.type}`}}}function OH6($,Z){if(!Z.handled||$.livemode===!1)return null;let X=$.data.object;if(Z.topUp)return{name:"credits_topup_succeeded",organizationId:Z.organizationId,properties:{credit_cents:Z.topUp.creditCents}};switch($.type){case"checkout.session.completed":case"checkout.session.async_payment_succeeded":return{name:"subscription_started",organizationId:Z.organizationId,properties:{}};case"customer.subscription.deleted":return{name:"subscription_canceled",organizationId:Z.organizationId,properties:{}};case"customer.subscription.updated":return{name:"subscription_updated",organizationId:Z.organizationId,properties:{status:Pc$(X.status),...typeof X.cancel_at_period_end==="boolean"?{cancel_at_period_end:X.cancel_at_period_end}:{}}};case"invoice.paid":if(X.billing_reason==="subscription_create")return null;return{name:"subscription_renewed",organizationId:Z.organizationId,properties:{}};default:return null}}function Ec$($,Z){let X=OH6($,Z);if(!X)return;vY({event:X.name,organizationId:X.organizationId,...$.id?{uuid:vp1(`stripe:${$.id}:${X.name}`)}:{},...$.created?{timestamp:new Date($.created*1000)}:{},properties:X.properties})}async function Ac$($){let Z=new eW(l8().db),X=await UH6(Z,$);if(!(X.handled&&X.topUp))Ec$($,X);if(X.handled&&X.topUp)await $w$({organizationId:X.organizationId,amountCents:X.topUp.creditCents,referenceId:X.topUp.referenceId}),Ec$($,X);if(!X.handled&&X.orphanSubscriptionId)try{await os1(X.orphanSubscriptionId),console.error("stripe webhook: canceled orphan subscription",{subscriptionId:X.orphanSubscriptionId,eventId:$.id})}catch(Q){if(!(Q instanceof hY&&(Q.status===400||Q.status===404)))throw Q}return X}var HH6=300;var Tc$=D(()=>{gG();C4();i60();sw();me0()});var BH6=1048576,vZ1;var Rc$=D(()=>{D8();jN();q$();Tc$();vZ1=new F1;vZ1.post("/webhook",V9({maxSize:BH6,onError:($)=>$.json({error:"payload too large"},413)}),async($)=>{let Z=b0().stripeWebhookSecret;if(!Z)return $.json({error:"stripe billing not configured"},503);let X=await $.req.text();if(!jc$(X,$.req.header("stripe-signature"),Z))return $.json({error:"invalid signature"},400);let Y=zc$(X);if(!Y)return $.json({error:"invalid payload"},400);let G=await Ac$(Y);return console.log("stripe webhook",{eventId:Y.id,type:Y.type,livemode:Y.livemode,...G}),$.json({received:!0})})});import{timingSafeEqual as DH6}from"crypto";function wH6($,Z,X){if(!Z?.startsWith("sha256="))return!1;let Q=new Bun.CryptoHasher("sha256",X).update($).digest("hex"),Y=Z.slice(7);if(Y.length!==Q.length)return!1;return DH6(Buffer.from(Y),Buffer.from(Q))}var LH6=5242880,fZ1;var Ic$=D(()=>{D8();jN();Gn();fZ1=new F1;fZ1.post("/webhook",V9({maxSize:LH6,onError:($)=>$.json({error:"payload too large"},413)}),async($)=>{let Z=process.env.GITHUB_WEBHOOK_SECRET;if(!Z)return $.json({error:"github webhook not configured"},503);let X=await $.req.text();if(!wH6(X,$.req.header("x-hub-signature-256"),Z))return $.json({error:"invalid signature"},400);if($.req.header("x-github-event")!=="push")return $.json({ok:!0,ignored:"event"});let Q;try{Q=JSON.parse(X)}catch{return $.json({error:"invalid payload"},400)}let Y=Q.ref,G=Q.repository?.full_name;if(!Y||!G)return $.json({ok:!0,ignored:"shape"});let W=(await tp0())?.markTenantPoolsDirty(G,Y)??[];return $.json({ok:!0,pools:W})})});function qc$($,Z){if(Z.startsWith("text/html")||Z.startsWith("image/svg"))$.set("Content-Security-Policy","sandbox allow-scripts allow-modals allow-same-origin")}var Mc$,EH6,jH6,kc$;var Vc$=D(()=>{D8();L3();py();bx();Mc$=new F1,EH6=["range","if-none-match","if-modified-since"],jH6=["content-type","content-length","content-range","accept-ranges","etag","last-modified"];Mc$.get("/:org/files/*",async($)=>{let Z=$.get("studioContext"),X=Z.organization?.id;if(!Z.auth?.user?.id){if(ph($))return $.redirect(`/login?next=${encodeURIComponent($.req.path)}`,302);throw new Z$(401,{message:"Authentication required"})}if(!X)throw new Z$(401,{message:"Organization context required"});let Q=$.req.path.replace(/^.*\/files\//,"");if(!Q)throw new Z$(400,{message:"Missing file key"});let Y=await rn(Q,Z);if(!Y)throw new Z$(503,{message:"Object storage not configured"});if(Y.startsWith("data:")&&lG()){let K=Y.match(/^data:([^;]+);base64,(.+)$/s);if(!K)throw new Z$(500,{message:"Invalid data URL from storage"});let[,H,F]=K,N=Buffer.from(F,"base64"),U=new Headers({"Content-Type":H,"Cache-Control":"private, max-age=86400"});return qc$(U,H),new Response(N,{status:200,headers:U})}let G=new Headers;for(let K of EH6){let H=$.req.header(K);if(H)G.set(K,H)}let J=await fetch(Y,{headers:G});if(J.status===403||J.status===404)throw new Z$(404,{message:"File not found"});if(!J.ok&&J.status!==304&&J.status!==416)throw console.error(`[files] upstream storage error ${J.status} for key:`,Q),new Z$(502,{message:"Upstream storage error"});let W=new Headers;for(let K of jH6){let H=J.headers.get(K);if(H)W.set(K,H)}return W.set("Cache-Control","private, max-age=86400"),qc$(W,W.get("content-type")??""),new Response(J.body,{status:J.status,headers:W})});kc$=Mc$});var ma=_((o_)=>{var zH6=o_&&o_.__createBinding||(Object.create?function($,Z,X,Q){if(Q===void 0)Q=X;var Y=Object.getOwnPropertyDescriptor(Z,X);if(!Y||("get"in Y?!Z.__esModule:Y.writable||Y.configurable))Y={enumerable:!0,get:function(){return Z[X]}};Object.defineProperty($,Q,Y)}:function($,Z,X,Q){if(Q===void 0)Q=X;$[Q]=Z[X]}),PH6=o_&&o_.__exportStar||function($,Z){for(var X in $)if(X!=="default"&&!Object.prototype.hasOwnProperty.call(Z,X))zH6(Z,$,X)};Object.defineProperty(o_,"__esModule",{value:!0});PH6(EY(),o_)});var _c$=_((Sc$)=>{Object.defineProperty(Sc$,"__esModule",{value:!0});Sc$.version=void 0;Sc$.version="3.4.0"});var bc$=_((NH)=>{var AH6=NH&&NH.__importDefault||function($){return $&&$.__esModule?$:{default:$}};Object.defineProperty(NH,"__esModule",{value:!0});NH.NodeTransport=NH.VERSION=void 0;NH.nodeResolveHost=kH6;var r6=ma(),TH6=z0("net"),bZ1=z0("tls"),RH6=z0("path"),vc$=z0("fs"),IH6=AH6(z0("dns")),qH6=_c$();NH.VERSION=qH6.version;var MH6="nats.js";class fc${socket;version;lang;yields=[];signal=(0,r6.deferred)();closedNotification=(0,r6.deferred)();options;connected=!1;tlsName="";done=!1;closeError;constructor(){this.lang=MH6,this.version=NH.VERSION}async connect($,Z){this.tlsName=$.tlsName,this.options=Z;let{tls:X}=this.options,{handshakeFirst:Q}=X||{};try{if(Q===!0)this.socket=await this.tlsFirst($);else this.socket=await this.dial($);if(this.done)this.socket?.destroy();let Y=await this.peekInfo();(0,r6.checkOptions)(Y,Z);let{tls_required:G,tls_available:J}=Y,W=J===!0&&Z.tls!==null;if(!Q&&(G||W))this.socket=await this.startTLS();if(this.done)this.socket?.destroy();if(G&&this.socket.encrypted!==!0)throw r6.errors.InvalidArgumentError.format("tls","is not available on this server");return this.connected=!0,this.setupHandlers(),this.signal.resolve(),Promise.resolve()}catch(Y){let G=Y;if(!G)G=new r6.errors.ConnectionError("error connecting - node provided an undefined error");let{code:J}=G,W=J==="ECONNREFUSED"?new r6.errors.ConnectionError("connection refused",{cause:G}):G;throw this.socket?.destroy(),W}}dial($){let Z=(0,r6.deferred)(),X,Q=(0,TH6.createConnection)($.port,$.hostname,()=>{Z.resolve(Q),Q.removeAllListeners()});return Q.on("error",(Y)=>{X=Y}),Q.on("close",()=>{Q.removeAllListeners(),Z.reject(X)}),Q.setNoDelay(!0),Z}get isClosed(){return this.done}close($){return this._closed($,!1)}peekInfo(){let $=(0,r6.deferred)(),Z;return this.socket.on("data",(X)=>{this.yields.push(X);let Q=r6.DataBuffer.concat(...this.yields),Y=(0,r6.extractProtocolMessage)(Q);if(Y!=="")try{let G=r6.INFO.exec(Y);if(!G)throw Error("unexpected response from server");let J=JSON.parse(G[1]);$.resolve(J)}catch(G){$.reject(G)}finally{this.socket.removeAllListeners()}}),this.socket.on("error",(X)=>{Z=X}),this.socket.on("close",()=>{this.socket.removeAllListeners(),$.reject(Z)}),$}loadFile($){if(!$)return Promise.resolve();let Z=(0,r6.deferred)();try{if($=(0,RH6.resolve)($),!(0,vc$.existsSync)($))Z.reject(Error(`${$} doesn't exist`));(0,vc$.readFile)($,(X,Q)=>{if(X)return Z.reject(X);Z.resolve(Q)})}catch(X){Z.reject(X)}return Z}async loadClientCerts(){let $={},{certFile:Z,cert:X,caFile:Q,ca:Y,keyFile:G,key:J}=this.options.tls;try{if(Z){let W=await this.loadFile(Z);if(W)$.cert=W}else if(X)$.cert=X;if(G){let W=await this.loadFile(G);if(W)$.key=W}else if(J)$.key=J;if(Q){let W=await this.loadFile(Q);if(W)$.ca=[W]}else if(Y)$.ca=Y;return Promise.resolve($)}catch(W){return Promise.reject(W)}}async tlsFirst($){let Z,X={servername:this.tlsName,rejectUnauthorized:!0};if(this.socket)X.socket=this.socket;if(typeof this.options.tls==="object")try{let Y=await this.loadClientCerts()||{};X=(0,r6.extend)(X,this.options.tls,Y)}catch(Y){return Promise.reject(new r6.errors.ConnectionError(Y.message,{cause:Y}))}let Q=(0,r6.deferred)();try{let Y=(0,bZ1.connect)($.port,$.hostname,X,()=>{Y.removeAllListeners(),Q.resolve(Y)});Y.on("error",(G)=>{Z=G}),Y.on("secureConnect",()=>{if(X.rejectUnauthorized===!1)return;if(!Y.authorized)throw Y.authorizationError}),Y.on("close",()=>{Q.reject(Z),Y.removeAllListeners()}),Y.setNoDelay(!0)}catch(Y){Q.reject(new r6.errors.ConnectionError(Y.message,{cause:Y}))}return Q}async startTLS(){let $,Z={socket:this.socket,servername:this.tlsName,rejectUnauthorized:!0};if(typeof this.options.tls==="object")try{let Q=await this.loadClientCerts()||{};Z=(0,r6.extend)(Z,this.options.tls,Q)}catch(Q){return Promise.reject(new r6.errors.ConnectionError(Q.message,{cause:Q}))}let X=(0,r6.deferred)();try{let Q=(0,bZ1.connect)(Z,()=>{Q.removeAllListeners(),X.resolve(Q)});Q.on("error",(Y)=>{$=Y}),Q.on("secureConnect",()=>{if(Z.rejectUnauthorized===!1)return;if(!Q.authorized)throw Q.authorizationError}),Q.on("close",()=>{X.reject($),Q.removeAllListeners()})}catch(Q){X.reject(new r6.errors.ConnectionError(Q.message,{cause:Q}))}return X}setupHandlers(){let $;this.socket.on("data",(Z)=>{return this.yields.push(Z),this.signal.resolve()}),this.socket.on("error",(Z)=>{$=Z}),this.socket.on("end",()=>{if(this.socket?.destroyed)return;this.socket?.write(new Uint8Array(0),()=>{this.socket?.end()})}),this.socket.on("close",()=>{this._closed($,!1)})}[Symbol.asyncIterator](){return this.iterate()}async*iterate(){while(!0){if(this.yields.length===0)await this.signal;let $=this.yields;this.yields=[];for(let Z=0;Z<$.length;Z++){if(this.options.debug)console.info(`> ${(0,r6.render)($[Z])}`);yield $[Z]}if(this.done)break;else if(this.yields.length===0)$.length=0,this.yields=$,this.signal=(0,r6.deferred)()}}discard(){if(this.done=!0,this.socket)try{this.socket.removeAllListeners(),this.socket.destroy()}catch{}}disconnect(){this._closed(void 0,!0).then().catch()}isEncrypted(){return this.socket instanceof bZ1.TLSSocket}_send($){if(this.isClosed||this.socket===void 0)return Promise.resolve();if(this.options.debug)console.info(`< ${(0,r6.render)($)}`);let Z=(0,r6.deferred)();try{this.socket.write($,(X)=>{if(X){if(this.options.debug)console.error(`!!! ${(0,r6.render)($)}: ${X}`);return Z.reject(X)}return Z.resolve()})}catch(X){if(this.options.debug)console.error(`!!! ${(0,r6.render)($)}: ${X}`);Z.reject(X)}return Z}send($){this._send($).catch((X)=>{})}async _closed($,Z=!0){if(!this.connected)return;if(this.done){this.socket?.destroy();return}if(this.closeError=$,!$&&this.socket&&Z)try{await this._send(new TextEncoder().encode(""))}catch(X){if(this.options.debug)console.log("transport close terminated with an error",X)}try{if(this.socket)this.socket.removeAllListeners(),this.socket?.destroy(),this.socket=void 0}catch(X){console.log(X)}this.done=!0,this.closedNotification.resolve(this.closeError)}closed(){return this.closedNotification}}NH.NodeTransport=fc$;function kH6($){let Z=(0,r6.deferred)();return IH6.default.lookup($,{all:!0},(X,Q)=>{if(X){Z.reject(X);return}let Y=[];for(let G of Q)Y.push(G.address);if(Y.length===0)Y.push($);Z.resolve(Y)}),Z}});var uc$=_((hc$)=>{Object.defineProperty(hc$,"__esModule",{value:!0});hc$.connect=VH6;var xc$=bc$(),yc$=ma(),gc$=ma();function VH6($={}){if((0,gc$.hasWsProtocol)($))return Promise.reject(gc$.errors.InvalidArgumentError.format("servers","node client doesn't support websockets, use the 'wsconnect' function instead"));return(0,yc$.setTransportFactory)({factory:()=>{return new xc$.NodeTransport},dnsResolveFn:xc$.nodeResolveHost}),yc$.NatsConnectionImpl.connect($)}});var cc$=_((CN)=>{var CH6=CN&&CN.__createBinding||(Object.create?function($,Z,X,Q){if(Q===void 0)Q=X;var Y=Object.getOwnPropertyDescriptor(Z,X);if(!Y||("get"in Y?!Z.__esModule:Y.writable||Y.configurable))Y={enumerable:!0,get:function(){return Z[X]}};Object.defineProperty($,Q,Y)}:function($,Z,X,Q){if(Q===void 0)Q=X;$[Q]=Z[X]}),_H6=CN&&CN.__exportStar||function($,Z){for(var X in $)if(X!=="default"&&!Object.prototype.hasOwnProperty.call(Z,X))CH6(Z,$,X)};Object.defineProperty(CN,"__esModule",{value:!0});CN.connect=void 0;var vH6=uc$();Object.defineProperty(CN,"connect",{enumerable:!0,get:function(){return vH6.connect}});_H6(ma(),CN)});function ic$($){let Z=$?.connectFn??yH6,X=null,Q=null,Y=!1,G=!1,J=!1,W=[];function K(){return X!==null&&!X.isClosed()&&!X.isDraining()&&!J}function H(){console.log(`[NatsProvider] fireReady: ${W.length} callbacks`);for(let U of W)try{U()}catch{}}function F(U){(async()=>{for await(let O of U.status())if(O.type==="disconnect")console.log("[NatsProvider] Disconnected"),J=!0;else if(O.type==="reconnect")console.log("[NatsProvider] Reconnected, re-firing ready callbacks"),J=!1,Q=null,H()})().catch(()=>{})}async function N(U,O){let B=0;while(!G)try{X=await Z({servers:U,timeout:xH6,reconnect:!0,maxReconnectAttempts:-1,...O?{authenticator:O}:{}}),console.log(`[NatsProvider] Connected to ${X.getServer()} after ${B} attempt(s)`),Q=null,J=!1,F(X),H();return}catch{B++;let L=oZ(bH6,fH6,B-1,2,0.5);await D$(L)}}return{init(U,O){if(Y)return;Y=!0,G=!1;let B=O?.creds?lc$.credsAuthenticator(new TextEncoder().encode(O.creds)):void 0;N(U,B).catch(()=>{})},isConnected(){return K()},getConnection(){return K()?X:null},getJetStream(){if(!K())return null;if(!Q)Q=mc$.jetstream(X);return Q},onReady(U){if(W.push(U),K())try{U()}catch{}},async drain(){if(G=!0,Y=!1,Q=null,J=!1,X){let U=X;X=null,await U.drain().catch(()=>{})}}}}function yH6($){return dc$.connect($)}var lc$,dc$,mc$,fH6=100,bH6=3000,xH6=3000;var pc$=D(()=>{w4();lc$=V(iu(),1),dc$=V(cc$(),1),mc$=V(pD(),1)});function xZ1($,Z){return`${$}.${Z}`}class yZ1{cache;constructor($){this.cache=Vh({ttlMs:$?.ttlMs??gH6,maxSize:$?.maxSize??hH6})}async get($,Z){return this.cache.get(xZ1($,Z))??null}async set($,Z,X){this.cache.set(xZ1($,Z),X)}async invalidate($,Z){this.cache.delete(xZ1($,Z))}teardown(){this.cache.clear()}}var gH6=600000,hH6=5000;var nc$=()=>{};function gA0($,Z){return`${$}:${Z}`}function gZ1($){let Z=Vh({ttlMs:$?.ttlMs??uH6,maxSize:$?.maxSize??cH6}),X=$?.getConnection,Q=crypto.randomUUID(),Y=new TextEncoder,G=new TextDecoder,J=null;function W(K,H){let F=X?.();if(!F)return;try{F.publish(tc$,Y.encode(JSON.stringify({organizationId:K,keyId:H,originId:Q})))}catch(N){console.warn("[ProviderKeyCache] Publish failed (non-critical):",N)}}return{get(K,H){return Z.get(gA0(K,H))},set(K,H,F){Z.set(gA0(K,H),F)},invalidate(K,H){Z.delete(gA0(K,H)),W(K,H)},start(){if(J)return;let K=X?.();if(!K)return;J=K.subscribe(tc$),(async()=>{for await(let H of J)try{let F=JSON.parse(G.decode(H.data));if(F.originId===Q)continue;Z.delete(gA0(F.organizationId,F.keyId))}catch{}})().catch(console.error)},teardown(){J?.unsubscribe(),J=null,Z.clear()}}}var tc$="studio.ai-provider-keys.invalidate",uH6=30000,cH6=5000;var oc$=()=>{};class hZ1{options;subscriptions=[];onCancel=null;encoder=new TextEncoder;originId=crypto.randomUUID();seenMessageIds=new Set;constructor($){this.options=$}async start($){if($)this.onCancel=$;if(this.subscriptions.length>0)return;if(!this.onCancel)return;let Z=this.options.getConnection();if(!Z)return;let X=new TextDecoder;this.subscriptions=rc$.map((Q)=>Z.subscribe(Q));for(let Q of this.subscriptions)(async()=>{for await(let Y of Q)try{let G=JSON.parse(X.decode(Y.data));if(G.originId===this.originId)continue;if(G.messageId&&this.hasSeen(G.messageId))continue;this.onCancel?.(G.taskId)}catch{}})().catch(console.error)}broadcast($){if(/[.*>\s]/.test($)){console.warn("[NatsCancelBroadcast] Invalid threadId, skipping broadcast");return}this.onCancel?.($);try{let Z=this.options.getConnection();if(!Z)return;let X=this.encoder.encode(JSON.stringify({taskId:$,originId:this.originId,messageId:crypto.randomUUID()}));for(let Q of rc$)Z.publish(Q,X)}catch(Z){console.warn("[NatsCancelBroadcast] Publish failed (non-critical):",Z)}}publishControlFrame($,Z){}async stop(){for(let $ of this.subscriptions)$.unsubscribe();this.subscriptions=[],this.seenMessageIds.clear(),this.onCancel=null}hasSeen($){if(this.seenMessageIds.has($))return!0;if(this.seenMessageIds.add($),this.seenMessageIds.size>1000){let Z=this.seenMessageIds.values().next().value;if(Z)this.seenMessageIds.delete(Z)}return!1}}var rc$;var ac$=D(()=>{rc$=["studio.decopilot.cancel","mesh.decopilot.cancel"]});var sc$=($)=>{let Z;return()=>Z??=$()},uZ1,cZ1;var ec$=D(()=>{I6();uZ1=sc$(()=>L$.createHistogram("decopilot.stream.encode_ms",{description:"Per-chunk JSON.stringify+encode time for decopilot stream",unit:"ms"})),cZ1=sc$(()=>L$.createCounter("decopilot.stream.published_chunks",{description:"Logical decopilot stream chunks published to JetStream",unit:"{chunks}"}))});function tH6(){return{name:aF,subjects:[`${UL0}.>`],storage:BW.StorageType.File,max_age:mH6,max_bytes:pH6,max_msgs_per_subject:nH6,discard:BW.DiscardPolicy.Old,retention:BW.RetentionPolicy.Limits,duplicate_window:iH6,num_replicas:1}}class Xl${chunks=0;encodeMs=0;maxMs=0;bytes=0;windowStart=performance.now();constructor(){setInterval(()=>this.flush(),1e4).unref?.()}record($,Z){if(this.chunks++,this.encodeMs+=$,$>this.maxMs)this.maxMs=$;this.bytes+=Z}flush(){let $=performance.now(),Z=$-this.windowStart;if(this.chunks>0&&Z>0)console.warn(JSON.stringify({msg:"stream-encode-trace",windowMs:Math.round(Z),chunks:this.chunks,encodeMs:Math.round(this.encodeMs),pctOfLoop:+(this.encodeMs/Z*100).toFixed(1),maxChunkMs:+this.maxMs.toFixed(2),mbEncoded:+(this.bytes/1048576).toFixed(2)}));this.chunks=0,this.encodeMs=0,this.maxMs=0,this.bytes=0,this.windowStart=$}}function $l$($){let Z=Zl$.headers();for(let[X,Q]of Object.entries($))Z.set(X,Q);return Z}function sH6($,Z){let X=0;return{publish(Q,Y,G,J){Q.publish(Y,G,J?{headers:J}:void 0).catch((W)=>{if(X++,dH6().add(1,{"org.id":Z??"unknown"}),X===1||X%100===0)console.warn(`[Decopilot] JetStream publish failed for thread ${$} (${X} total):`,W)})},get errorCount(){return X}}}function eH6($){if(!($ instanceof Error))return!1;if($.name==="TimeoutError")return!0;return/timeout|no responders|503/i.test($.message)}class lZ1{options;js=null;jsm=null;constructor($){this.options=$}async init(){let $=this.options.getConnection();if(!$){console.log("[Decopilot] StreamBuffer.init skipped: NATS not connected yet");return}let Z=tH6(),X=await v5(async()=>{let Q=this.options.getJetStreamManager?await this.options.getJetStreamManager():await BW.jetstreamManager($);try{await Q.streams.info(aF),await Q.streams.update(aF,Z)}catch(Y){if(Y instanceof Error&&Y.message.includes("stream not found"))await Q.streams.add(Z);else if(Y instanceof Error&&/can ?not change.*storage|storage type/i.test(Y.message))await Q.streams.delete(aF),await Q.streams.add(Z);else throw Y}return Q},{maxAttempts:5,minTimeout:250,maxTimeout:4000,jitter:0.5,isRetriable:eH6});this.js=this.options.getJetStream(),this.jsm=X,console.log(`[Decopilot] StreamBuffer.init ${this.js?"ready":"degraded (js=null)"}`)}pump($,Z,X,Q){let Y=this.js;if(!Y)return console.warn(`[Decopilot] pump: JetStream client unavailable for thread ${Z}; chunks NOT published to NATS`),Promise.resolve();let G=sH6(Z,Q),J=!1,W=()=>{if(J)return;J=!0;let H=QU$(Z);Y.publish(H.subject,H.data).catch(()=>{})};X.addEventListener("abort",W,{once:!0});let K=(H)=>{let F=performance.now(),N=Nr0(H,{runId:Z}),U=performance.now()-F;if(uZ1().record(U),cZ1().add(1,{"org.id":Q??"unknown"}),aH6?.record(U,N.reduce((O,B)=>O+B.data.length,0)),N.length===0){console.warn(`[Decopilot] dropping oversized stream chunk for thread ${Z}`);return}for(let O of N)G.publish(Y,O.subject,O.data,O.headers?$l$(O.headers):void 0)};return(async()=>{let H=$.getReader(),F=0,N=0,U;try{while(!0){let{done:O,value:B}=await H.read();if(O)break;if(K(B),N++,++F>=64)F=0,await new Promise((L)=>setImmediate(L))}}catch(O){U=O,console.warn(`[Decopilot] stream pump error for thread ${Z}:`,O?.message??O)}finally{if(H.releaseLock(),W(),rH6)console.warn(JSON.stringify({msg:"decopilot-stream-diag",event:"pump-done",taskId:Z,publishedChunks:N,publishErrors:G.errorCount}))}if(U!==void 0)throw U})()}async publishRawChunk($,Z,X){let Q=this.js;if(!Q)return!1;let Y=performance.now(),G=Nr0(Z,{runId:$,dedup:X});if(uZ1().record(performance.now()-Y),cZ1().add(1),G.length===0)return console.warn(`[Decopilot] dropping oversized raw chunk for thread ${$} (> MAX_CHUNKED_BYTES)`),!0;for(let J of G)await Q.publish(J.subject,J.data,{...J.headers?{headers:$l$(J.headers)}:{},...J.msgId?{msgID:J.msgId}:{}});return!0}async publishDone($,Z,X){let Q=this.js;if(!Q)return!1;let Y=XU$({runId:$,fenceToken:Z,finalSeq:X});return await Q.publish(Y.subject,Y.data,{msgID:Y.msgId}),!0}async createTailStream($,Z,X){let Q=this.js;if(!Q)return console.warn(`[Decopilot] createTailStream: JetStream client unavailable for thread ${$}; no live tail`),null;let Y=X?.deliverPolicy==="new"?BW.DeliverPolicy.New:BW.DeliverPolicy.All,G=X?.closeOnDone??!1,J=gB($),W;try{W=await(await Q.consumers.get(aF,{filter_subjects:J,deliver_policy:Y})).consume()}catch(L){return console.warn("[Decopilot] JetStream tail unavailable (non-critical):",L?.message??L),null}let F=wL0({messages:async function*(){try{for await(let L of W)yield{subject:L.subject,data:L.data,headers:L.headers}}finally{W.stop()}}(),onCancel:()=>W.stop()}).pipeThrough(OL0()).pipeThrough(BL0()).getReader(),N=!1,U=()=>{if(N)return;N=!0;try{F.releaseLock()}catch{}},O=!1,B=()=>{if(O)return;O=!0,W.stop(),F.cancel().catch(()=>{}),U()};return Z?.addEventListener("abort",B,{once:!0}),new ReadableStream({async pull(L){for(;;){let{done:w,value:E}=await F.read();if(w){B(),L.close();return}let j=E;if(j.kind==="done"){if(G){B(),L.close();return}continue}L.enqueue(j.chunk);return}},cancel(){B()}})}purge($){if(!this.jsm)return;this.jsm.streams.purge(aF,{filter:gB($)}).catch(()=>{})}teardown(){this.js=null,this.jsm=null}}var BW,Zl$,lH6=($)=>{let Z;return()=>Z??=$()},dH6,mH6=86400000000000,iH6=120000000000,pH6=4294967296,nH6=500000,oH6,rH6,aH6;var Ql$=D(()=>{w4();Ur0();EL0();DL0();I6();ec$();BW=V(pD(),1),Zl$=V(iu(),1),dH6=lH6(()=>L$.createCounter("decopilot.stream.publish_errors",{description:"Number of JetStream publish failures for decopilot stream chunks",unit:"{errors}"}));oH6=process.env.STREAM_ENCODE_TRACE==="1",rH6=process.env.DECOPILOT_STREAM_TRACE==="1";aH6=oH6?new Xl$:null});function hA0($,Z,X,Q){if(!Q)return!1;return $.emit(Z,xW(X,Q.status,{title:Q.title??void 0,virtualMcpId:Q.virtual_mcp_id??void 0,createdBy:Q.created_by??void 0,triggerId:Q.trigger_id??null,branch:Q.branch??null,harnessId:Q.harness_id??void 0,createdAt:Q.created_at,updatedAt:Q.updated_at})),!0}var Yl$=D(()=>{P8()});class dZ1{storage;options;timer=null;constructor($,Z={}){this.storage=$;this.options=Z}start(){if(this.timer)return;let $=this.options.intervalMs??300000;this.timer=setInterval(()=>{this.runOnce()},$)}async runOnce(){let $=this.options.staleAfterMs??3600000;try{let Z=await this.storage.sweepAbandoned($);if(Z>0)console.log(`[async-research-sweeper] marked ${Z} stale jobs as abandoned`);return Z}catch(Z){return console.error("[async-research-sweeper] sweep failed",Z),0}}dispose(){if(this.timer)clearInterval(this.timer),this.timer=null}}async function Gl$($,Z,X){let Q=Z.organizationId;if(Z.status!=="in_review")return!1;if(!Xa(X))return!1;if(await $.storage.taskBoard.hasHumanRejectedDone(Z.id,Q))return!1;let Y=await $.storage.taskBoard.update(Z.id,Q,{status:"done"},Z.updatedBy);return await F6($,{taskBoardItemId:Z.id,action:"status_changed",actorId:null,data:{from:Z.status,to:"done",reason:"pr_merged"}}),h$(Q,Y),console.log(`[task-board-review-sweeper] ${Z.id}: linked PR already merged \u2014 moved to done`),!0}var Jl$=D(()=>{HX();Qa();w5()});function JF6($){return $ instanceof a7}function WF6($,Z){return Z-$>=YF6}class mZ1{taskBoard;contextFactory;billing;options;timer=null;running=!1;cursor=null;constructor($,Z,X,Q={}){this.taskBoard=$;this.contextFactory=Z;this.billing=X;this.options=Q}start(){if(this.timer)return;let $=this.options.intervalMs??$F6;this.timer=setInterval(()=>{this.runOnce()},$),this.timer.unref()}async runOnce(){if(this.running)return 0;this.running=!0;let $=0;try{let Z=this.options.batchSize??XF6,X=this.options.itemIntervalMs??ZF6,Q=new Date(Date.now()-X),Y=await this.taskBoard.listItemsPendingReview(Z,this.cursor,Q),G=Y.at(-1);this.cursor=Y.length===Z&&G?{updatedAt:G.updatedAt,id:G.id}:null;for(let{id:J,organizationId:W}of Y)try{if(await this.reconcileItem(J,W,Q))$++}catch(K){console.error(`[task-board-review-sweeper] ${J} failed`,K)}await this.reapNeverStartedThreads(Z),$+=await this.dispatchDueRetries(Z),await this.reactToUnhandledFailures(Z)}catch(Z){console.error("[task-board-review-sweeper] sweep failed",Z)}finally{this.running=!1}return $}async reapNeverStartedThreads($){try{let Z=await this.taskBoard.failNeverStartedLinkedThreads($,new Date(Date.now()-Mt0),Fo0);for(let X of Z)console.warn(`[task-board-review-sweeper] failed never-started thread ${X.threadId} on ${X.itemId}`)}catch(Z){console.error("[task-board-review-sweeper] reaping failed",Z)}}async reactToUnhandledFailures($){let Z=await this.taskBoard.listItemsStuckAfterFailure($,new Date(Date.now()-GF6));for(let{id:X,organizationId:Q,threadId:Y}of Z)try{console.warn(`[task-board-review-sweeper] reacting to an unhandled failure on ${X}`),await Ko0(this.taskBoard,Y,Q),await Ho0(this.taskBoard,this.billing,Y,Q)}catch(G){console.error(`[task-board-review-sweeper] unhandled-failure reaction for ${X} failed`,G)}}async dispatchDueRetries($){let Z=0,X=await this.taskBoard.listItemsDueForRetry($,new Date);for(let{id:Q,organizationId:Y,attempts:G}of X)try{if(!await this.taskBoard.claimDueRetry(Q,Y,new Date))continue;let J=await this.taskBoard.getById(Q,Y);if(!J||J.status!=="in_progress"||J.assigneeId!==T8)continue;let W=await this.contextFactory(Y,J.assignedBy??J.createdBy);if(!W)continue;await n3(W,J,{runClass:"retry"}),Z++,console.warn(`[task-board-review-sweeper] re-dispatched ${Q} after a failure (attempt ${G})`)}catch(J){if(console.error(`[task-board-review-sweeper] retry dispatch for ${Q} failed`,J),JF6(J)){await this.returnToTodo(Q,Y,J instanceof Error?J.message:String(J));continue}await this.taskBoard.scheduleRunRetry(Q,Y,G,new Date(Date.now()+QF6)).catch((W)=>console.error(`[task-board-review-sweeper] re-arming ${Q} failed`,W))}return Z}async returnToTodo($,Z,X){try{let Q=await this.taskBoard.getById($,Z);if(!Q||Q.status!=="in_progress")return;let Y=await this.taskBoard.returnToTodoAfterFailure($,Z,Q.updatedBy);if(!Y)return;await this.taskBoard.recordActivity({taskBoardItemId:$,action:"status_changed",actorId:null,data:{from:"in_progress",to:"todo",reason:X}}).catch(()=>{}),h$(Z,Y)}catch(Q){console.error(`[task-board-review-sweeper] returning ${$} to todo failed`,Q)}}async handOffReviewWithoutPr($,Z){let X=await this.taskBoard.listActivity(Z.id,Z.organizationId);if(!WF6(AF(X),Date.now()))return;await vK($,Z,"no pull request is linked to this task \u2014 there is nothing for a "+"reviewer to review")}async reconcileItem($,Z,X){if(!await this.taskBoard.claimSweep($,Z,X))return!1;let Q=await this.taskBoard.getById($,Z);if(!Q)return!1;if(Q.status!=="in_review")return!1;let Y=Q.assigneeId===T8,G=await this.taskBoard.listPrs($,Z),J=await this.contextFactory(Z,Q.assignedBy??Q.createdBy);if(!J)return!1;if(G.length===0){if(Y)await this.handOffReviewWithoutPr(J,Q);return!1}let W=await Promise.all(G.map(async(K)=>({...K,...await iy(Z,K)})));if(W.every((K)=>K.state===null))console.warn(`[task-board-review-sweeper] ${$}: no live PR state from GitHub (${W.length} PR(s)) \u2014 proceeding on unknown`);if(await Gl$(J,Q,W.map((K)=>K.merged)))return!0;if(await dU$(J,Q))return!0;if(!Y)return!1;if(!So0(W))return!1;return await xD0(J,Q,{previewMatchesHead:Co0(W)}),!0}dispose(){if(this.timer)clearInterval(this.timer),this.timer=null}}var $F6=60000,ZF6=300000,XF6=50,QF6=60000,YF6=900000,GF6=120000;var Wl$=D(()=>{X9();Po0();_K();Ft();Jl$();w5();pG();No0();HJ();pn()});import{readdir as KF6,rm as uA0}from"fs/promises";import{join as cA0}from"path";async function lA0($){let Z=new Date;Z.setUTCDate(Z.getUTCDate()-HF6),Z.setUTCHours(0,0,0,0);let X=0;try{let Q=await r_($);for(let Y of Q)if(/^\d{4}$/.test(Y))X+=await Kl$($,Y,Z);else if(!Y.startsWith(".")){let G=cA0($,Y),J=await r_(G);for(let K of J){if(!/^\d{4}$/.test(K))continue;X+=await Kl$(G,K,Z)}if((await r_(G)).length===0)await uA0(G,{recursive:!0,force:!0})}}catch(Q){console.warn("monitoring retention cleanup failed:",Q)}return X}async function Kl$($,Z,X){let Q=0,Y=cA0($,Z),G=await r_(Y);for(let W of G){if(!/^\d{2}$/.test(W))continue;let K=cA0(Y,W),H=await r_(K);for(let N of H){if(!/^\d{2}$/.test(N))continue;let U=new Date(`${Z}-${W}-${N}T00:00:00Z`);if(isNaN(U.getTime()))continue;if(U<X){let O=cA0(K,N);await uA0(O,{recursive:!0,force:!0}),Q++}}if((await r_(K)).length===0)await uA0(K,{recursive:!0,force:!0})}if((await r_(Y)).length===0)await uA0(Y,{recursive:!0,force:!0});return Q}async function r_($){try{return(await KF6($)).filter((X)=>!X.startsWith("."))}catch{return[]}}var HF6=30;var iZ1=()=>{};import{DBOS as pZ1,SchedulerMode as FF6}from"@dbos-inc/dbos-sdk";async function UF6(){let $=[vJ(),a_(),DH()],Z=0;for(let X of $)try{Z+=await lA0(X)}catch(Q){console.error("[monitoring-retention] cleanup failed:",Q)}return console.log(`[monitoring-retention] deleted ${Z} day-dir(s) across ${$.length} signal dir(s)`),{deleted:Z,dirs:$.length}}async function OF6($,Z){await pZ1.runStep(()=>UF6(),{name:"monitoringRetention"})}function Fl$(){if(Hl$)return;Hl$=!0;let $=pZ1.registerWorkflow(OF6,{name:"monitoringRetentionWorkflow"});pZ1.registerScheduled($,{name:"monitoringRetentionWorkflow",crontab:NF6,mode:FF6.ExactlyOncePerIntervalWhenActive})}var NF6="23 4 * * *",Hl$=!1;var Nl$=D(()=>{BY();iZ1()});function Ul$($){return async(Z,X)=>{let Q=await $.db.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["member.role","organization.id as orgId","organization.slug as orgSlug","organization.name as orgName"]).where("member.userId","=",X).where("member.organizationId","=",Z).executeTakeFirst();if(!Q)return console.warn(`[automationContextFactory] User ${X} not found in org ${Z} \u2014 returning null`),null;let Y=await WJ.create();Y.auth.user={id:X,role:Q.role},Y.organization={id:Q.orgId,slug:Q.orgSlug,name:Q.orgName};let G=await $t($.db,Z,Q.role);return Y.boundAuth=m61({auth:Y.authInstance,headers:new Headers,role:Q.role,permissions:G,userId:X}),Y.access=new Iw(X,void 0,Y.boundAuth,Q.role,"self"),CB(Y,{id:Q.orgId,slug:Q.orgSlug}),Y}}var Ol$=D(()=>{qw();_B()});function BF6(){return{services:[{name:"Postgres",status:"pending",port:0},{name:"NATS",status:"pending",port:0}],migrationsStatus:"pending",serverUrl:null,logs:[]}}function LF6(){for(let $ of DF6)$()}function Bl$($){let Z=[...nZ1.logs,$];nZ1={...nZ1,logs:Z.length>500?Z.slice(-500):Z},LF6()}function tZ1(){return wF6}var nZ1,DF6,wF6=!1;var oZ1=D(()=>{nZ1=BF6(),DF6=new Set});import{EventEmitter as EF6}from"events";var rZ1;var Dl$=D(()=>{oZ1();rZ1=new EF6;rZ1.on("request",($)=>{Bl$($)})});function Ll$(){return async($,Z)=>{let X=Date.now(),Q=$.req.method,Y=$.req.path;if(Y==="/api/auth/get-session"||Y.includes("favicon")){await Z();return}let G="",J=!1;if(Y.startsWith("/mcp")&&Q==="POST"){J=!0;try{if($.req.header("Content-Type")?.includes("application/json")){let U=await $.req.raw.clone().json();if(U.method==="tools/call"&&U.params?.name){let O=Pu(U.params.name),B=U.params.arguments||{},L=Object.keys(B).map((E)=>Pu(E)),w=L.length>0?L.slice(0,3).join(",")+(L.length>3?"\u2026":""):"";G=`${G5.tool}${O}${G5.dim}(${w})${G5.reset}`}else if(U.method)G=`${G5.dim}${Pu(U.method)}${G5.reset}`}}catch{}}let W=Pu(Y);if(Y.startsWith("/mcp/conn_")){let F=Y.split("/")[2]??"";W=`/mcp/${G5.mcp}${Pu(F.slice(0,12))}\u2026${G5.reset}`}else if(Y==="/mcp")W=`${G5.mcp}/mcp${G5.reset}`;else if(Y==="/mcp/registry")W=`${G5.mcp}/mcp/registry${G5.reset}`;let K=zF6(Q),H=J?"\u25C0":"\u2190";if(!tZ1())console.log(`${G5.dim}${H}${G5.reset} ${K}${Q}${G5.reset} ${W}${G?` ${G}`:""}`);try{await Z()}finally{let F=Date.now()-X,N=$.res.status,U=jF6(N),O=F<1000?`${F}ms`:`${(F/1000).toFixed(1)}s`,B=J?"\u25B6":"\u2192";if(!tZ1())console.log(`${G5.dim}${B}${G5.reset} ${K}${Q}${G5.reset} ${W}${G?` ${G}`:""} ${U}${N}${G5.reset} ${G5.duration}${O}${G5.reset}`);rZ1.emit("request",{method:Q,path:Pu(Y),status:N,duration:F,timestamp:new Date})}}}var G5,jF6=($)=>{if($>=500)return G5.serverError;if($>=400)return G5.clientError;if($>=300)return G5.redirect;return G5.ok},zF6=($)=>{return G5[$]||G5.reset},Pu=($)=>{return $.replace(/\r/g,"").replace(/\n/g,"").replace(/\x1b\[[0-9;]*m/g,"").replace(/[\x00-\x1f\x7f-\x9f]/g,"")};var wl$=D(()=>{oZ1();Dl$();G5={reset:"\x1B[0m",dim:"\x1B[2m",bold:"\x1B[1m",GET:"\x1B[36m",POST:"\x1B[33m",PUT:"\x1B[35m",DELETE:"\x1B[31m",ok:"\x1B[32m",redirect:"\x1B[36m",clientError:"\x1B[33m",serverError:"\x1B[31m",mcp:"\x1B[35m",tool:"\x1B[96m",duration:"\x1B[90m"}});import{createHmac as Pl$}from"crypto";import{mkdir as PF6,readdir as AF6,rm as El$,stat as Al$}from"fs/promises";import{join as sZ1,relative as TF6}from"path";import{z as A$}from"zod";function Rl$($){let Z=$.replace(/[^a-zA-Z0-9_-]/g,"_");return sZ1(RF6,Z)}function Il$($){return $.replace(/^\/+/,"").replace(/\.\./g,"")}function aZ1($,Z){let X=Rl$($),Q=Il$(Z);return sZ1(X,Q)}function IF6($,Z,X,Q){let Y=b0().encryptionKey||"dev-secret",G=`${$}:${Z}:${X}:${Q}`;return Pl$("sha256",Y).update(G).digest("hex")}function zl$($,Z,X,Q,Y){let G=Math.floor(Date.now()/1000)+Q,J=IF6(Z,X,G,Y),W=new URL(`/api/dev-assets/${Z}/${Il$(X)}`,$);return W.searchParams.set("expires",G.toString()),W.searchParams.set("signature",J),W.searchParams.set("method",Y),W.toString()}function ql$($,Z,X){let Q=`${$}:${Z.getTime()}:${X}`;return`"${Pl$("md5","etag").update(Q).digest("hex")}"`}async function Ml$($,Z,X,Q,Y){try{let G=await AF6($,{withFileTypes:!0});for(let J of G){let W=sZ1($,J.name),H=TF6(Z,W).replace(/\\/g,"/");if(X&&!H.startsWith(X))continue;if(J.isDirectory())if(Q){let F=H+"/";if(!X||F.startsWith(X)){if(!(X?H.slice(X.length):H).includes("/"))Y.commonPrefixes.add(F)}}else await Ml$(W,Z,X,Q,Y);else if(J.isFile()){if(Q&&X){let F=H.slice(X.length);if(F.includes(Q)){let N=F.indexOf(Q),U=X+F.slice(0,N+1);Y.commonPrefixes.add(U);continue}}try{let F=await Al$(W);Y.objects.push({key:H,size:F.size,lastModified:F.mtime.toISOString(),etag:ql$(W,F.mtime,F.size)})}catch{}}}}catch{}}function kl$($,Z){let Q=t($).id;return[{name:"LIST_OBJECTS",description:"List objects in the local assets directory with pagination support",inputSchema:A$.object({prefix:A$.string().optional(),maxKeys:A$.number().optional().default(1000),continuationToken:A$.string().optional(),delimiter:A$.string().optional()}),outputSchema:A$.object({objects:A$.array(A$.object({key:A$.string(),size:A$.number(),lastModified:A$.string(),etag:A$.string()})),nextContinuationToken:A$.string().optional(),isTruncated:A$.boolean(),commonPrefixes:A$.array(A$.string()).optional()}),handler:async(Y)=>{let G=Y,J=G.prefix||"",W=G.maxKeys??1000,K=G.delimiter,H=G.continuationToken,F=Rl$(Q);await PF6(F,{recursive:!0});let N={objects:[],commonPrefixes:new Set};await Ml$(F,F,J,K,N),N.objects.sort((w,E)=>w.key.localeCompare(E.key));let U=0;if(H){if(U=N.objects.findIndex((w)=>w.key>H),U===-1)U=N.objects.length}let O=N.objects.slice(U,U+W),B=U+W<N.objects.length,L=B?O[O.length-1]?.key:void 0;return{objects:O,isTruncated:B,nextContinuationToken:L,commonPrefixes:Array.from(N.commonPrefixes).sort()}}},{name:"GET_OBJECT_METADATA",description:"Get metadata for a file in the local assets directory",inputSchema:A$.object({key:A$.string()}),outputSchema:A$.object({contentType:A$.string().optional(),contentLength:A$.number(),lastModified:A$.string(),etag:A$.string(),metadata:A$.record(A$.string(),A$.string()).optional()}),handler:async(Y)=>{let G=Y,J=aZ1(Q,G.key),W=await Al$(J);return{contentType:k51(G.key),contentLength:W.size,lastModified:W.mtime.toISOString(),etag:ql$(J,W.mtime,W.size)}}},{name:"GET_PRESIGNED_URL",description:"Generate a presigned URL for downloading a file from local storage",inputSchema:A$.object({key:A$.string(),expiresIn:A$.number().optional()}),outputSchema:A$.object({url:A$.string(),expiresIn:A$.number()}),handler:async(Y)=>{let G=Y,J=G.expiresIn??jl$;return{url:zl$(Z,Q,G.key,J,"GET"),expiresIn:J}}},{name:"PUT_PRESIGNED_URL",description:"Generate a presigned URL for uploading a file to local storage",inputSchema:A$.object({key:A$.string(),expiresIn:A$.number().optional(),contentType:A$.string().optional()}),outputSchema:A$.object({url:A$.string(),expiresIn:A$.number()}),handler:async(Y)=>{let G=Y,J=G.expiresIn??jl$;return{url:zl$(Z,Q,G.key,J,"PUT"),expiresIn:J}}},{name:"DELETE_OBJECT",description:"Delete a single file from local storage",inputSchema:A$.object({key:A$.string()}),outputSchema:A$.object({success:A$.boolean(),key:A$.string()}),handler:async(Y)=>{let G=Y,J=aZ1(Q,G.key);try{return await El$(J),{success:!0,key:G.key}}catch{return{success:!1,key:G.key}}}},{name:"DELETE_OBJECTS",description:"Delete multiple files from local storage",inputSchema:A$.object({keys:A$.array(A$.string()).max(1000)}),outputSchema:A$.object({deleted:A$.array(A$.string()),errors:A$.array(A$.object({key:A$.string(),message:A$.string()}))}),handler:async(Y)=>{let G=Y,J=[],W=[];return await Promise.all(G.keys.map(async(K)=>{let H=aZ1(Q,K);try{await El$(H),J.push(K)}catch(F){W.push({key:K,message:F instanceof Error?F.message:"Unknown error"})}})),{deleted:J,errors:W}}}]}async function eZ1($,Z,X){let Q=kl$(Z,X),Y=new dW({name:"dev-assets-mcp",version:"1.0.0"},{capabilities:{tools:{}},jsonSchemaValidator:F5});for(let J of Q){let W="shape"in J.inputSchema?J.inputSchema.shape:A$.object({}).shape,K=J.outputSchema&&"shape"in J.outputSchema?J.outputSchema.shape:A$.object({}).shape;Y.registerTool(J.name,{description:J.description??"",inputSchema:W,outputSchema:K,annotations:J.annotations,_meta:J._meta},async(H)=>{try{let F=await J.handler(H);return{content:[{type:"text",text:JSON.stringify(F)}],structuredContent:F}}catch(F){return{content:[{type:"text",text:`Error: ${F.message}`}],isError:!0}}})}let G=new XQ({enableJsonResponse:$.headers.get("Accept")?.includes("application/json")??!1});return await Y.connect(G),BJ(Y,G,$,"mcp:dev-assets")}async function Vl$($,Z,X,Q){let G=kl$(X,Q).find((J)=>J.name===$);if(!G)return{content:[{type:"text",text:`Tool not found: ${$}`}],isError:!0};try{let J=await G.handler(Z);return{content:[{type:"text",text:JSON.stringify(J)}]}}catch(J){return{content:[{type:"text",text:J instanceof Error?J.message:String(J)}],isError:!0}}}var RF6="./data/assets",jl$=3600,Tl$,Sl$;var Cl$=D(()=>{q$();Gg();D8();Bd();vC();yX();bP0();Tl$=new F1;Tl$.all("/",async($)=>{let Z=$.get("studioContext"),X=new URL($.req.url),Q=`${X.protocol}//${X.host}`;return eZ1($.req.raw,Z,Q)});Sl$=Tl$});var _l$={};J4(_l$,{mountDevRoutes:()=>qF6});function qF6($,Z){$.all("/mcp/:connectionId{.*_dev-assets$}",Z,async(Q)=>{let Y=Q.get("studioContext"),G=new URL(Q.req.url),J=`${G.protocol}//${G.host}`;return eZ1(Q.req.raw,Y,J)}),$.all("/mcp/:connectionId{.*_dev-assets$}/call-tool/:toolName",Z,async(Q)=>{let Y=Q.get("studioContext"),G=new URL(Q.req.url),J=`${G.protocol}//${G.host}`,W=Q.req.param("toolName");if(!W)return Q.json({error:"Missing tool name"},400);let K=await Q.req.json(),H=await Vl$(W,K,Y,J);if(H.isError)return Q.json(H.content,500);return Q.json(H.content)}),$.use("/mcp/dev-assets",Z),$.route("/mcp/dev-assets",Sl$);let X=new F1;X.use("*",UW({mountPath:"/api/dev-assets"})),X.route("/",fP0({orgFromPath:!1})),$.route("/api/dev-assets",X)}var vl$=D(()=>{D8();P51();bP0();Cl$()});import{sql as MF6}from"kysely";import{randomUUID as fl$}from"crypto";import{z as kF6}from"zod";async function SF6($){let Z=new Date().toISOString(),X=fl$(),Q=g8.SELF($.organizationId),Y="registry.publish_request.created",G={requestId:$.request.id,requestedId:$.request.requested_id,title:$.request.title,status:$.request.status,createdAt:$.request.created_at,requester:{name:$.request.requester_name,email:$.request.requester_email}};await $.db.insertInto("events").values({id:X,organization_id:$.organizationId,type:"registry.publish_request.created",source:Q,specversion:"1.0",subject:$.request.id,time:Z,datacontenttype:"application/json",dataschema:null,data:JSON.stringify(G),cron:null,status:"pending",attempts:0,last_error:null,next_retry_at:null,created_at:Z,updated_at:Z}).execute();let J=await $.db.selectFrom("event_subscriptions").select(["id"]).where("organization_id","=",$.organizationId).where("enabled","=",1).where("event_type","=","registry.publish_request.created").where((W)=>W.or([W("publisher","is",null),W("publisher","=",Q)])).execute();if(J.length>0)await $.db.insertInto("event_deliveries").values(J.map((W)=>({id:fl$(),event_id:X,subscription_id:W.id,status:"pending",attempts:0,last_error:null,delivered_at:null,next_retry_at:null,created_at:Z}))).execute();try{await MF6`SELECT
       pg_notify('studio_events', ${X}),