decocms 4.27.0 → 4.28.1

package/dist/server/cli.js

@@ -84398,7 +84398,7 @@ ${d}`;h(N);return}if(E(null,y),t.strategy==="count"){if($--,$===0)h()}if(t.strat
     SELECT * FROM link_sandboxes WHERE handle = $handle
   `);function h(_){if(t===void 0)return!0;let v=FM(_),n=v&&FM(t)?Sru(t):t,D=v?Sru(_):jru(_),O=wbt(n,D);return O===""||!O.startsWith("..")&&!dbt(O)}return{upsert(_){f.run({$handle:_.handle,$status:_.status,$sandboxPath:_.sandboxPath,$port:_.port??null,$previewUrl:_.previewUrl??null,$repoCloneUrl:_.repoCloneUrl??null,$branch:_.branch??null,$projectName:_.projectName??null,$error:_.error??null,$now:Date.now()})},list(){return l.all().map(i1i)},reconcile(){let _=Date.now();for(let v of l.all().map(i1i)){if(!h(v.sandboxPath)){c.run({$handle:v.handle,$now:_});continue}if(!FM(v.sandboxPath)){E.run({$handle:v.handle,$now:_});continue}if(v.status==="spawning"||v.status==="ready"||v.status==="failed"||v.status==="missing")d.run({$handle:v.handle,$now:_})}return l.all().map(i1i)},prune(_){let v=[],n=[],D=this.reconcile();for(let O of D){if(!h(O.sandboxPath)){n.push({handle:O.handle,sandboxPath:O.sandboxPath,reason:"outside_root",deletedFiles:!1});continue}if(_.missing&&O.status==="missing"){$.run({$handle:O.handle}),v.push({handle:O.handle,sandboxPath:O.sandboxPath,reason:"missing",deletedFiles:!1});continue}if(!_.merged||!FM(O.sandboxPath))continue;if(O.branch===null||O.branch.trim()===""){n.push({handle:O.handle,sandboxPath:O.sandboxPath,reason:"no_branch",deletedFiles:!1});continue}if(!w2(O.sandboxPath,["rev-parse","--is-inside-work-tree"]).ok){n.push({handle:O.handle,sandboxPath:O.sandboxPath,reason:"git_unavailable",deletedFiles:!1});continue}let N=w2(O.sandboxPath,["status","--porcelain"]);if(!N.ok){n.push({handle:O.handle,sandboxPath:O.sandboxPath,reason:"git_unavailable",deletedFiles:!1});continue}if(N.stdout.trim()!==""){n.push({handle:O.handle,sandboxPath:O.sandboxPath,reason:"dirty_worktree",deletedFiles:!1});continue}let y=Jru(O.sandboxPath,O.branch);if(y===null){n.push({handle:O.handle,sandboxPath:O.sandboxPath,reason:"git_unavailable",deletedFiles:!1});continue}if(!y){n.push({handle:O.handle,sandboxPath:O.sandboxPath,reason:"branch_not_merged",deletedFiles:!1});continue}cbt(O.sandboxPath,{recursive:!0,force:!0}),$.run({$handle:O.handle}),v.push({handle:O.handle,sandboxPath:O.sandboxPath,reason:"merged",deletedFiles:!0})}return{removed:v,skipped:n}},delete(_){$.run({$handle:_})},inspect(_){let v=w.get({$handle:_});if(v===null)return null;let n=i1i(v),D=0,O=null;if(FM(n.sandboxPath)&&w2(n.sandboxPath,["rev-parse","--is-inside-work-tree"]).ok){let N=w2(n.sandboxPath,["status","--porcelain"]);if(N.ok){let y=N.stdout.trim();D=y===""?0:y.split(`
 `).length}if(n.branch!==null&&n.branch.trim()!=="")O=Jru(n.sandboxPath,n.branch)}return{handle:n.handle,branch:n.branch,sandboxPath:n.sandboxPath,dirtyCount:D,merged:O}},close(){u.close()}}}var qHi=()=>{};function Lru(i,u){if(process.platform==="win32")return;let t=u?[["umount","-f",i]]:[["fusermount","-u",i],["umount",i]];for(let f of t)if(Bun.spawnSync(f,{stdout:"ignore",stderr:"ignore",timeout:5000}).exitCode===0)break}import{existsSync as nbt,readdirSync as Dbt}from"fs";import{rm as gbt}from"fs/promises";import{join as Wru}from"path";async function Yru(i,u={}){let t=u.detach??Obt,f=u.exists??nbt,l=u.readdir??((d)=>Dbt(d)),c=u.rm??((d)=>gbt(d,{recursive:!0,force:!0})),E=Wru(i,"org");if(f(E))for(let d of l(E))t(Wru(E,d));await c(i)}var Obt=(i)=>Lru(i,process.platform==="darwin");var zru=()=>{};import{join as Nbt}from"path";function Qru(i){let u=i.purge??Yru;return{stopSandbox(t){return i.provider.deleteSandbox(t)},inspectSandbox(t){return i.registry.inspect(t)},async removeSandbox(t){try{return await Z1(async()=>{if(await i.provider.deleteSandbox(t),i.provider.hasHandle(t))throw Error("Can't delete \u2014 run in progress");let l=i.registry.inspect(t)?.sandboxPath??Nbt(i.dataDir,"sandboxes",t);await u(l)},{maxAttempts:2,minTimeout:250,jitter:0}),i.registry.delete(t),{ok:!0}}catch(f){let l=f instanceof Jc?f.cause:f;return{ok:!1,error:l instanceof Error?l.message:String(l)}}}}}var Hru=g(()=>{B4();zru()});import{randomBytes as ybt}from"crypto";import{mkdir as Zbt}from"fs/promises";import{createServer as Tbt}from"net";import{join as Bbt}from"path";function bru(i,u){return Error(`sandbox failed to start: ${i}`,{cause:u})}function Fbt(i){if(!(i instanceof Error))return!1;return i.name==="TimeoutError"||/timed out|timeout|operation was aborted|aborted/i.test(i.message)}function Rru(i){if(i instanceof Error){let u=i.cause;if(u instanceof Error&&u.message)return u.message;return i.message}return String(i)}function Ubt(i){if(!i)return null;let u=i.trim().replace(/\/+$/,"");if(!u)return null;let t=u.split(/[/:]/).filter(Boolean).at(-1);if(!t)return null;return t.replace(/\.git$/i,"")||null}function Ibt(i){return{repoCloneUrl:i.repo?.cloneUrl??null,branch:i.repo?.branch??null,projectName:Ubt(i.repo?.cloneUrl)}}function Cru(i){let u=i.maxSandboxes??20,t=new Map,f=i.pickPort??Pbt,l=i.fetchImpl??fetch,c=i.resolvePreviewUrl??((D,O)=>`http://127.0.0.1:${O}`),E=(D)=>Bbt(i.dataDir,"sandboxes",D),d=(D)=>{try{i.registry?.upsert(D)}catch(O){console.warn(`[user-desktop] failed to persist sandbox lifecycle handle=${D.handle} status=${D.status}:`,O)}},$=(D)=>{try{i.onEvent?.(D)}catch{}},w=async(D)=>{let O=new AbortController,N=setTimeout(()=>O.abort(),1500);try{let y=await l(`${D}/health`,{signal:O.signal});if(!y.ok)console.warn(`[user-desktop] probe ${D}/health \u2192 ${y.status} (treating as dead)`);return y.ok}catch(y){return console.warn(`[user-desktop] probe ${D}/health failed: ${y instanceof Error?y.message:String(y)} (treating as dead)`),!1}finally{clearTimeout(N)}},h=(D)=>{console.warn(`[user-desktop] evicting dead daemon handle=${D.handle} port=${D.port}`);try{D.process.kill("SIGTERM")}catch{}if(t.get(D.handle)===D)t.delete(D.handle),d({handle:D.handle,status:"stopped",sandboxPath:E(D.handle),port:null,previewUrl:null,...D.registryMetadata,error:null}),$({handle:D.handle,phase:"evicted"})},_=new Map;function v(){if(t.size<u)return;let D=[...t.values()].filter((N)=>N.activeDispatchCount===0).sort((N,y)=>N.lastUsedAt-y.lastUsedAt);if(D.length===0){console.warn(`[user-desktop] at cap ${t.size}/${u} but every sandbox is pinned (active dispatch) \u2014 exceeding cap temporarily`);return}let O=D[0];console.log(`[user-desktop] evicting LRU victim handle=${O.handle} port=${O.port} (cap ${u} reached, size=${t.size})`);try{O.process.kill("SIGTERM")}catch{}t.delete(O.handle),d({handle:O.handle,status:"stopped",sandboxPath:E(O.handle),port:null,previewUrl:null,...O.registryMetadata,error:null}),$({handle:O.handle,phase:"evicted"})}let n=async(D)=>{let O=Ibt(D),N=E(D.handle);d({handle:D.handle,status:"spawning",sandboxPath:N,port:null,previewUrl:null,...O,error:null}),$({handle:D.handle,phase:"spawning",sandboxPath:N,projectName:O.projectName,branch:O.branch}),v();let y,Z=null,T;try{await Zbt(N,{recursive:!0}),console.log(`[user-desktop] ensure handle=${D.handle} repo=${D.repo?.cloneUrl??"(none)"} branch=${D.repo?.branch??"(none)"} runtime=${D.workload?.runtime??"(autodetect)"} pm=${D.workload?.packageManager??"(autodetect)"}`),T=ybt(24).toString("hex");let[S,A]=await Promise.all([f(),f()]);y=S,console.log(`[user-desktop] spawn handle=${D.handle} port=${y} devPort=${A} workdir=${N}`),Z=await Promise.resolve(i.spawnDaemon({workdir:N,handle:D.handle,port:y,daemonToken:T,offloadAllowedHosts:D.offloadAllowedHosts??[],offloadAllowSameHostDev:D.offloadAllowSameHostDev??!1,orgFsConfigJson:D.orgFsConfigJson}));try{await i.waitForHealth(y)}catch(k){throw bru("the sandbox didn't come online in time",k)}console.log(`[user-desktop] healthy handle=${D.handle} port=${y} \u2014 posting config`);try{await i.postConfig(y,A,{repo:D.repo,workload:D.workload,operator:D.operator},T)}catch(k){throw bru(Fbt(k)?"configuration timed out":"the sandbox rejected its configuration",k)}}catch(S){if(console.error(`[user-desktop] sandbox bring-up failed handle=${D.handle} port=${y??"(none)"}${Z?" (killing daemon)":""}:`,S),Z)try{Z.kill("SIGKILL")}catch{}throw $({handle:D.handle,phase:"failed",error:Rru(S),sandboxPath:N,projectName:O.projectName,branch:O.branch}),d({handle:D.handle,status:"failed",sandboxPath:N,port:null,previewUrl:null,...O,error:Rru(S)}),S}if(!Z||y===void 0)throw Error("sandbox bring-up invariant violated");let B=`http://127.0.0.1:${y}`,F=c(D.handle,y);console.log(`[user-desktop] ready handle=${D.handle} port=${y} sandboxApiUrl=${B} previewUrl=${F}`);let P={handle:D.handle,port:y,process:Z,sandboxApiUrl:B,previewUrl:F,lastUsedAt:Date.now(),activeDispatchCount:0,daemonToken:T,registryMetadata:O};if(t.set(D.handle,P),d({handle:D.handle,status:"ready",sandboxPath:N,port:y,previewUrl:F,...O,error:null}),$({handle:D.handle,phase:"ready",port:y,previewUrl:F,sandboxPath:N,projectName:O.projectName,branch:O.branch}),Z.exited)Z.exited.then(()=>{if(t.get(D.handle)===P)console.warn(`[user-desktop] daemon process exited unexpectedly handle=${D.handle} port=${y} \u2014 removing from cache`),t.delete(D.handle),d({handle:D.handle,status:"stopped",sandboxPath:N,port:null,previewUrl:null,...O,error:null}),$({handle:D.handle,phase:"evicted"});else console.log(`[user-desktop] daemon process exited handle=${D.handle} port=${y} (already replaced/removed)`)});return{sandboxApiUrl:B,previewUrl:F,port:y}};return{async ensureSandbox(D){let O=t.get(D.handle);if(O){if(await w(O.sandboxApiUrl))return console.log(`[user-desktop] cache hit handle=${D.handle} port=${O.port} (alive)`),O.lastUsedAt=Date.now(),{sandboxApiUrl:O.sandboxApiUrl,previewUrl:O.previewUrl,port:O.port};console.warn(`[user-desktop] cache stale handle=${D.handle} port=${O.port} \u2014 respawning`),h(O)}let N=_.get(D.handle);if(N)return console.log(`[user-desktop] joining in-flight ensure handle=${D.handle}`),N;let y=n(D).finally(()=>{_.delete(D.handle)});return _.set(D.handle,y),y},proxyPort(D){let O=t.get(D);if(O)O.lastUsedAt=Date.now();return O?.port??null},getDaemonToken(D){return t.get(D)?.daemonToken??null},hasHandle(D){return t.has(D)||_.has(D)},recordHit(D){let O=t.get(D);if(O)O.lastUsedAt=Date.now()},acquireDispatch(D){let O=t.get(D);if(!O)return()=>{};O.activeDispatchCount+=1;let N=!1;return()=>{if(N)return;N=!0;let y=t.get(D);if(y)y.activeDispatchCount=Math.max(0,y.activeDispatchCount-1)}},listSandboxes(){return[...t.values()]},async deleteSandbox(D){let O=t.get(D);if(!O){console.log(`[user-desktop] delete handle=${D} (not found, no-op)`);return}if(O.activeDispatchCount>0){console.warn(`[user-desktop] delete handle=${D} port=${O.port} REFUSED \u2014 ${O.activeDispatchCount} active dispatch(es) in flight`);return}console.log(`[user-desktop] delete handle=${D} port=${O.port}`);try{O.process.kill("SIGTERM")}catch{}t.delete(D),d({handle:D,status:"stopped",sandboxPath:E(D),port:null,previewUrl:null,repoCloneUrl:null,branch:null,projectName:null,error:null}),$({handle:D,phase:"deleted"})},async shutdown(){console.log(`[user-desktop] shutdown \u2014 killing ${t.size} sandbox(es)`);for(let D of t.values())try{D.process.kill("SIGTERM")}catch{}t.clear()}}}function Pbt(){return new Promise((i,u)=>{let t=Tbt();t.unref(),t.on("error",u),t.listen(0,"127.0.0.1",()=>{let f=t.address();if(f&&typeof f==="object"){let l=f.port;t.close(()=>i(l))}else t.close(()=>u(Error("could not allocate port")))})})}var Mru=()=>{};import{randomUUID as Abt}from"crypto";import{hostname as xbt}from"os";async function qru(i){let u=xbt()||void 0;i.monitor?.onMachine?.(u??"this machine");let t=Abu(i.dataDir,{outFd:i.logFd,perSandboxLog:i.perSandboxLogs,hotReload:i.hotReload}),f=t1i({path:u1i(i.dataDir),managedSandboxRoot:`${i.dataDir}/sandboxes`}),l=!1,c=()=>{if(l)return;l=!0;try{f.close()}catch{}};try{let E=0,d=Cru({dataDir:i.dataDir,registry:f,resolvePreviewUrl:(k,M)=>E>0?`http://${k}.localhost:${E}`:`http://127.0.0.1:${M}`,spawnDaemon:async(k)=>{let M={DAEMON_BOOT_ID:Abt(),APP_ROOT:k.workdir,PROXY_PORT:String(k.port),DAEMON_TOKEN:k.daemonToken,OFFLOAD_ALLOWED_HOSTS:k.offloadAllowedHosts.join(","),...k.offloadAllowSameHostDev?{OFFLOAD_ALLOW_SAME_HOST_DEV:"1"}:{}};if(k.orgFsConfigJson){let L=await Sbu(i.dataDir);if(L)M.ORGFS_CONFIG=k.orgFsConfigJson,M.ORGFS_RCLONE_PATH=L}let J=await t({workdir:k.workdir,env:M,daemonPort:k.port});return{port:k.port,kill:(L)=>J.kill(L),exited:J.exited.then(()=>{return})}},postConfig:async(k,M,J,L)=>{let m={port:M};if(J.workload)m.runtime=J.workload.runtime,m.packageManager={name:J.workload.packageManager,...J.workload.packageManagerPath?{path:J.workload.packageManagerPath}:{}};let z={application:m},di=fh(J.operator??null);if(di)z.operator=di;if(J.repo)z.git={repository:{cloneUrl:J.repo.cloneUrl,branch:J.repo.branch},...J.repo.userName&&J.repo.userEmail?{identity:{userName:J.repo.userName,userEmail:J.repo.userEmail}}:{}};await s8(`http://127.0.0.1:${k}`,L,z)},waitForHealth:async(k)=>{await uli(`http://127.0.0.1:${k}`)},maxSandboxes:20,onEvent:i.monitor?.onEvent}),$=await yru({port:i.port,lookupSandboxPort:(k)=>d.proxyPort(k)});E=$.port,console.log(`Local ingress listening on http://127.0.0.1:${$.port} (use http://<handle>.localhost:${$.port}/)`),i.monitor?.onIngress?.($.port);let w=Kbu({provider:d}),h=async()=>{let k=await o8({dataDir:i.dataDir,target:i.clusterBaseUrl});if(!k)throw Object.assign(Error(`Session for ${i.clusterBaseUrl} is no longer valid \u2014 run \`deco auth login --target ${i.clusterBaseUrl}\` and restart \`deco link\`.`),{fatal:!0});return k.accessToken},_=await kru(i.dataDir),v=process.env.npm_package_version??"0.0.0",n=await MHi(),D=Aru(n,{onChange:(k)=>{console.log(`[link-daemon] capabilities detected: +${k.join(",")} (now: ${n.join(",")})`)}}),O=Kzi({path:`${i.dataDir}/link/outbox.sqlite`});O.clear();let N=()=>{},y=new AbortController,Z={clusterBaseUrl:i.clusterBaseUrl,getAccessToken:h,provider:d,outbox:O,controlHandler:w,capabilities:n,machineId:_,cliVersion:v,previewPort:$.port,onConnected:()=>{i.monitor?.onCluster?.("linked"),console.log(`Linked to ${i.clusterBaseUrl}`)},onShutdown:()=>N(),runLifetimeSignal:y.signal};console.log(`[link-daemon] transport=tunnel cluster=${i.clusterBaseUrl}`);let T=await Eru(Z);console.log("[link-daemon] active transport=tunnel");let B,F=new Promise((k)=>{B=k}),P=!1,S=async()=>{if(P)return;P=!0,y.abort(),console.log(`
-Shutting down\u2026`),D();try{await T.close()}catch{}try{await $.stop()}catch{}try{await d.shutdown()}catch{}try{O.close()}catch{}c(),B(0)};process.on("SIGINT",()=>void S()),process.on("SIGTERM",()=>void S()),N=()=>{console.log("Disconnect requested from the Studio web UI \u2014 shutting down. Run `bunx decocms@latest link` to reconnect."),S()},T.closed.then(()=>{if(i.monitor?.onCluster?.("closed"),!P)console.error("Cluster connection closed permanently; exiting."),S()});let A=Qru({provider:d,registry:f,dataDir:i.dataDir});return{stopped:F,stop:S,stopSandbox:A.stopSandbox,removeSandbox:A.removeSandbox,inspectSandbox:A.inspectSandbox}}catch(E){throw c(),E}}var Vru=g(()=>{Pzi();qC();xbu();jbu();Jbu();Jzi();dru();Zru();xru();Gru();MC();qHi();Hru();Mru()});function VHi(i){return i.map((u)=>typeof u==="string"?u:String(u)).join(" ")}var SL;var f1i=g(()=>{SL={name:"decocms",version:"4.27.0",description:"Deco CMS \u2014 Self-hostable MCP Gateway for managing AI connections and tools",author:"Deco team",repository:{type:"git",url:"git+https://github.com/decocms/studio.git",directory:"apps/mesh"},bugs:{url:"https://github.com/decocms/studio/issues"},type:"module",bin:{deco:"./dist/server/cli.js"},files:["dist/**/*"],scripts:{dev:'bun run migrate && concurrently "bun run dev:client" "bun run dev:server"',"dev:servers":'concurrently "bun run dev:client" "bun run dev:server"',"dev:client":"vite dev","dev:server":"bun run --cwd=../../packages/sandbox build && NODE_ENV=development bun --env-file=.env --hot run src/index.ts","build:client":"bun --bun vite build","build:server":"bun run scripts/bundle-server-script.ts --dist ./dist/server","db:migrate":"bun run ./dist/server/migrate.js",check:"tsc --noEmit",start:"bun run ./dist/server/server.js",migrate:"bun run src/database/migrate.ts",test:"bun test","test:ct":"playwright test -c playwright-ct.config.ts","test:ct:ui":"playwright test -c playwright-ct.config.ts --ui","better-auth:migrate":"bunx --bun @better-auth/cli migrate -y --config src/auth/index.ts","smoke:link":"bun run scripts/smoke-link.ts",prepublishOnly:"bun run build:client && bun run build:server"},optionalDependencies:{"@anthropic-ai/claude-agent-sdk":"^0.3.181","@duckdb/node-api":"^1.5.0-r.1","@openai/codex":"0.144.3","@openai/codex-darwin-arm64":"npm:@openai/codex@0.144.3-darwin-arm64","@openai/codex-darwin-x64":"npm:@openai/codex@0.144.3-darwin-x64","@openai/codex-linux-arm64":"npm:@openai/codex@0.144.3-linux-arm64","@openai/codex-linux-x64":"npm:@openai/codex@0.144.3-linux-x64","@openai/codex-win32-arm64":"npm:@openai/codex@0.144.3-win32-arm64","@openai/codex-win32-x64":"npm:@openai/codex@0.144.3-win32-x64"},dependencies:{"@ai-sdk/anthropic":"^3.0.85","@ai-sdk/google":"^3.0.83","@ai-sdk/openai":"^3.0.73","@anthropic-ai/sdk":"^0.105.0","@aws-sdk/client-s3":"^3.1013.0","@aws-sdk/client-sts":"^3.1013.0","@aws-sdk/lib-storage":"^3.1013.0","@aws-sdk/s3-request-presigner":"^3.1013.0","@clickhouse/client":"^1.8.1","@dbos-inc/dbos-sdk":"^4.21.6","@dnd-kit/core":"^6.3.1","@dnd-kit/sortable":"^10.0.0","@dnd-kit/utilities":"^3.2.2","@inkjs/ui":"^2.0.0","@modelcontextprotocol/ext-apps":"^1.7.1","@nats-io/jetstream":"3.4.0","@nats-io/kv":"3.4.0","@nats-io/nats-core":"3.4.0","@nats-io/transport-node":"3.4.0","@openrouter/ai-sdk-provider":"^2.9.1","@opentelemetry/core":"^2.6.0","@tanstack/react-virtual":"3.13.24","@tiptap/extension-text-align":"3.20.2","@xterm/addon-fit":"^0.11.0","@xterm/xterm":"^6.0.0","embedded-postgres":"^18.3.0-beta.16",ink:"^6.8.0",kysely:"^0.28.12","node-pty":"^1.0.0","posthog-js":"^1.371.1","posthog-node":"^5.0.0",react:"^19.2.6","react-dom":"^19.2.6","use-stick-to-bottom":"^1.1.6"},devDependencies:{"@ai-sdk/provider":"^3.0.10","@ai-sdk/react":"^3.0.210","@better-auth/sso":"1.4.1","@daveyplate/better-auth-ui":"^3.2.7","@deco/ui":"workspace:*","@decocms/better-auth":"1.5.17","@decocms/bindings":"workspace:*","@decocms/harness":"workspace:*","@decocms/mcp-utils":"workspace:*","@decocms/mesh-sdk":"workspace:*","@decocms/runtime":"workspace:*","@decocms/sandbox":"workspace:*","@decocms/std":"workspace:*","@decocms/tunnel":"workspace:*","@floating-ui/react":"^0.27.16","@happy-dom/global-registrator":"^20.9.0","@hookform/resolvers":"^5.2.2","@jitl/quickjs-wasmfile-release-sync":"0.31.0","@modelcontextprotocol/sdk":"1.29.0","@monaco-editor/react":"^4.7.0","@nats-io/jwt":"0.0.10-5","@opentelemetry/api":"^1.9.0","@opentelemetry/api-logs":"^0.211.0","@opentelemetry/exporter-logs-otlp-proto":"^0.211.0","@opentelemetry/exporter-prometheus":"^0.208.0","@opentelemetry/exporter-trace-otlp-proto":"^0.207.0","@opentelemetry/instrumentation-runtime-node":"^0.24.0","@opentelemetry/resources":"^2.6.0","@opentelemetry/sdk-logs":"^0.211.0","@opentelemetry/sdk-metrics":"^2.2.0","@opentelemetry/sdk-node":"^0.207.0","@opentelemetry/sdk-trace-base":"^2.5.0","@playwright/experimental-ct-react":"1.59.1","@playwright/test":"^1.58.2","@radix-ui/react-avatar":"^1.1.10","@radix-ui/react-checkbox":"^1.3.3","@radix-ui/react-dialog":"^1.1.15","@radix-ui/react-dropdown-menu":"^2.1.16","@radix-ui/react-label":"^2.1.7","@radix-ui/react-select":"^2.2.6","@radix-ui/react-separator":"^1.1.7","@radix-ui/react-slot":"^1.2.3","@radix-ui/react-tabs":"^1.1.13","@rjsf/shadcn":"^6.6.2","@rjsf/utils":"^6.6.2","@rjsf/validator-ajv8":"^6.6.2","@tailwindcss/vite":"^4.1.17","@tanstack/react-query":"5.100.10","@tanstack/react-router":"1.169.2","@testing-library/jest-dom":"^6.9.1","@testing-library/react":"^16.3.2","@tiptap/core":"3.20.2","@tiptap/extension-placeholder":"3.20.2","@tiptap/pm":"3.20.2","@tiptap/react":"3.20.2","@tiptap/starter-kit":"3.20.2","@tiptap/suggestion":"3.20.2","@types/bun":"^1.3.1","@types/google.maps":"^3.65.2","@types/pg":"^8.15.6","@types/react-syntax-highlighter":"^15.5.13","@untitledui/icons":"^0.0.19","@vercel/nft":"^1.1.1","@vitejs/plugin-react":"^5.1.0",ai:"^6.0.208","babel-plugin-react-compiler":"^1.0.0","better-auth":"1.4.22","class-variance-authority":"^0.7.1",clsx:"^2.1.1",concurrently:"^9.2.1",croner:"^9.1.0","date-fns":"^4.1.0",degit:"^2.8.4",hono:"^4.10.7","input-otp":"^1.4.2",jose:"^6.0.11","lucide-react":"^0.468.0",marked:"^15.0.6",nanoid:"^5.1.6",pg:"^8.16.3",prettier:"^3.4.2","react-hook-form":"^7.66.0","react-markdown":"^10.1.0","react-resizable-panels":"^2.1.7","react-syntax-highlighter":"^15.6.1",recharts:"^3.6.0","rehype-raw":"^7.0.0","remark-gfm":"^4.0.0","sass-embedded":"^1.97.2",sonner:"^2.0.7","tailwind-merge":"^3.3.1",tailwindcss:"^4.1.17",typescript:"^5.9.3",vite:"^7.2.1","vite-tsconfig-paths":"^5.1.4",zod:"^4.0.0"},homepage:"https://github.com/decocms/studio",keywords:["mcp","model-context-protocol","ai","gateway","self-hosted","mesh","tools"],license:"MIT",publishConfig:{access:"public"}}});var UM={};Yi(UM,{printBanner:()=>Sbt,bannerLines:()=>rru,BANNER_LINES:()=>l1i,BANNER_GRADIENT:()=>c1i});function Gbt(i){let u=Number.parseInt(i.slice(1),16);return[u>>16&255,u>>8&255,u&255]}function rru(i){let u=l1i.map((t,f)=>{let[l,c,E]=Gbt(c1i[f]);return`\x1B[38;2;${l};${c};${E}m${t}\x1B[39m`});if(i!==void 0)u.push(`\x1B[2m  v${i}\x1B[22m`);return u}function Sbt(i){console.log("");for(let u of rru(i))console.log(u);console.log("")}var l1i,c1i;var jL=g(()=>{l1i=[" \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588     \u2588\u2588\u2588\u2588\u2588\u2588\u2588   ","\u2591\u2591\u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2588\u2588\u2588 \u2591\u2591\u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2591\u2588  \u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2591\u2588\u2588\u2588  \u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2591\u2588\u2588\u2588 "," \u2591\u2588\u2588\u2588   \u2591\u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588  \u2588 \u2591  \u2588\u2588\u2588     \u2591\u2591\u2591  \u2588\u2588\u2588     \u2591\u2591\u2588\u2588\u2588"," \u2591\u2588\u2588\u2588    \u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588\u2588\u2588\u2588   \u2591\u2588\u2588\u2588         \u2591\u2588\u2588\u2588      \u2591\u2588\u2588\u2588"," \u2591\u2588\u2588\u2588    \u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588\u2591\u2591\u2588   \u2591\u2588\u2588\u2588         \u2591\u2588\u2588\u2588      \u2591\u2588\u2588\u2588"," \u2591\u2588\u2588\u2588    \u2588\u2588\u2588  \u2591\u2588\u2588\u2588 \u2591   \u2588\u2591\u2591\u2588\u2588\u2588     \u2588\u2588\u2588\u2591\u2591\u2588\u2588\u2588     \u2588\u2588\u2588 "," \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588 \u2591\u2591\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588  \u2591\u2591\u2591\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2591  ","\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591   \u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591   \u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591     \u2591\u2591\u2591\u2591\u2591\u2591\u2591   "],c1i=["#00ff64","#00ee5e","#00dc56","#00c84e","#00b444","#00a03c","#008832","#006e28"]});import{Box as jbt,Text as mru}from"ink";import{jsx as Kbt,jsxs as eru}from"react/jsx-runtime";function E1i({version:i}){return eru(jbt,{flexDirection:"column",marginTop:1,children:[l1i.map((u,t)=>Kbt(mru,{color:c1i[t],children:u},t)),eru(mru,{dimColor:!0,children:[" v",i]})]})}var rHi=g(()=>{jL()});function aru(i){let u=i.branch??i.handle,t=[];if(i.dirtyCount>0)t.push(`${i.dirtyCount} uncommitted file${i.dirtyCount===1?"":"s"}`);if(i.merged===!1)t.push("branch not merged");return t.length>0?`\u26A0 ${t.join(", ")} \u2014 delete ${u}? (y/n)`:`Delete ${u}? (y/n)`}function KL(i){return[...i.values()].map((u)=>u.handle).sort((u,t)=>u.localeCompare(t))}function oru(i,u,t){if(i.length===0)return null;let f=u===null?-1:i.indexOf(u);if(f===-1)return t>0?i[0]:i[i.length-1];let l=Math.max(0,Math.min(i.length-1,f+t));return i[l]}function sru(i,u,t){if(t!==u)return t;let f=i.indexOf(u);if(f===-1)return t;return i[f+1]??i[f-1]??null}var oHi={};Yi(oHi,{subscribeLinkState:()=>mHi,setSelectedHandle:()=>eHi,setRemoving:()=>w1i,setPersistedSandboxes:()=>Rbt,setPendingConfirm:()=>PM,setMachine:()=>zbt,setLogPath:()=>Hbt,setLinkActions:()=>bbt,setIngress:()=>Ybt,setDaemonError:()=>Qbt,setClusterUrl:()=>Wbt,setCluster:()=>Lbt,setActionError:()=>$1i,resetLinkStateForTests:()=>Mbt,removeSandboxRow:()=>aHi,pushSandboxEvent:()=>Cbt,getLinkState:()=>IM,applySandboxEvent:()=>pru});function Xbt(i){return i==="spawning"||i==="ready"||i==="failed"}function pru(i,u){let t=new Map(i),f=t.get(u.handle);if(u.phase==="evicted"||u.phase==="deleted"){if(f)t.set(u.handle,{...f,port:null,previewUrl:null,status:"stopped",error:null});return t}return t.set(u.handle,{handle:u.handle,port:u.port??f?.port??null,previewUrl:u.previewUrl??f?.previewUrl??null,status:u.phase,error:u.phase==="failed"?u.error??"failed":null,projectName:u.projectName??f?.projectName??null,branch:u.branch??f?.branch??null,sandboxPath:u.sandboxPath??f?.sandboxPath??null}),t}function imu(){return{cluster:"connecting",clusterUrl:null,ingressUrl:null,ingressPort:null,machine:null,cap:Jbt,sandboxes:new Map,daemonError:null,logPath:null,selectedHandle:null,pendingConfirm:null,removingHandles:new Set,actionError:null,actions:null}}function Jd(){for(let i of d1i)i()}function IM(){return tf}function mHi(i){return d1i.add(i),()=>d1i.delete(i)}function Lbt(i){tf={...tf,cluster:i},Jd()}function Wbt(i){tf={...tf,clusterUrl:i},Jd()}function Ybt(i,u){tf={...tf,ingressPort:i,ingressUrl:u},Jd()}function zbt(i){tf={...tf,machine:i},Jd()}function Qbt(i){tf={...tf,daemonError:i},Jd()}function Hbt(i){tf={...tf,logPath:i},Jd()}function eHi(i){tf={...tf,selectedHandle:i},Jd()}function PM(i){tf={...tf,pendingConfirm:i},Jd()}function $1i(i){tf={...tf,actionError:i},Jd()}function w1i(i,u){if(tf.removingHandles.has(i)===u)return;let t=new Set(tf.removingHandles);if(u)t.add(i);else t.delete(i);tf={...tf,removingHandles:t},Jd()}function bbt(i){tf={...tf,actions:i},Jd()}function aHi(i){let u=KL(tf.sandboxes),t=sru(u,i,tf.selectedHandle),f=new Map(tf.sandboxes);f.delete(i);let l=new Set(tf.removingHandles);l.delete(i),tf={...tf,sandboxes:f,selectedHandle:t,pendingConfirm:null,removingHandles:l},Jd()}function Rbt(i){let u=new Map;for(let t of i)u.set(t.handle,{handle:t.handle,port:t.port,previewUrl:t.previewUrl,status:t.status,error:t.error,projectName:t.projectName,branch:t.branch,sandboxPath:t.sandboxPath});for(let[t,f]of tf.sandboxes)if(Xbt(f.status))u.set(t,f);tf={...tf,sandboxes:u},Jd()}function Cbt(i){tf={...tf,sandboxes:pru(tf.sandboxes,i)},Jd()}function Mbt(){tf=imu(),d1i.clear()}var Jbt=20,tf,d1i;var AM=g(()=>{tf=imu(),d1i=new Set});import{spawn as qbt}from"child_process";function Vbt(i){if(i==="darwin")return"open";if(i==="win32")return"start";return"xdg-open"}function umu(i,u=process.platform){let t=Vbt(u);try{qbt(t,[i],{stdio:"ignore",detached:!0}).unref()}catch{}}var tmu=()=>{};function fmu(i,u={}){let t=u.openUrl??umu,f=IM(),l=KL(f.sandboxes),c=f.selectedHandle!==null&&l.includes(f.selectedHandle)?f.selectedHandle:l[0]??null,E=f.actions;switch(i.type){case"move":eHi(oru(l,f.selectedHandle,i.delta));return;case"open":{if(c===null)return;let d=f.sandboxes.get(c);if(d?.status==="ready"&&d.previewUrl)t(d.previewUrl);return}case"stop":if(c!==null&&E)E.stopSandbox(c);return;case"delete":{if(c===null||!E)return;let d=E.inspectSandbox(c),$=f.sandboxes.get(c);$1i(null),PM({handle:c,branch:d?.branch??$?.branch??null,dirtyCount:d?.dirtyCount??0,merged:d?.merged??null});return}case"confirmYes":{let d=f.pendingConfirm;if(PM(null),d===null||!E)return;w1i(d.handle,!0),E.removeSandbox(d.handle).then(($)=>{if($.ok)aHi(d.handle);else w1i(d.handle,!1),$1i($.error)});return}case"confirmNo":PM(null);return;case"quit":if(E)E.quit();return}}var lmu=g(()=>{AM();tmu()});function cmu(i,u,t){if(t)return i==="y"||i==="Y"?{type:"confirmYes"}:{type:"confirmNo"};if(u.upArrow||i==="k")return{type:"move",delta:-1};if(u.downArrow||i==="j")return{type:"move",delta:1};if(i==="s")return{type:"stop"};if(i==="d")return{type:"delete"};if(i==="o")return{type:"open"};if(i==="q"||u.ctrl===!0&&i==="c")return{type:"quit"};return null}var Emu={};Yi(Emu,{LinkApp:()=>abt});import{Box as bl,Text as d1,useInput as rbt}from"ink";import{useSyncExternalStore as mbt}from"react";import{jsx as Pf,jsxs as Dh}from"react/jsx-runtime";function ebt(i,u){if(u)return{color:"yellow",text:"\u25CC Removing\u2026"};if(i.status==="ready")return{color:"green",text:"\u25CF Live"};if(i.status==="spawning")return{color:"yellow",text:"\u25CC Starting\u2026"};if(i.status==="stopped")return{color:"gray",text:"\u25A0 Stopped"};if(i.status==="missing")return{color:"yellow",text:"\u25A1 Missing"};if(i.status==="merged")return{color:"cyan",text:"\u2713 Merged"};if(i.status==="invalid")return{color:"red",text:"\u2717 Invalid"};if(i.status==="failed")return{color:"red",text:`\u2717 Failed: ${i.error??"failed"}`};return{color:"red",text:`\u2717 Error: ${i.error??""}`}}function abt(){let i=mbt(mHi,IM),u=[...i.sandboxes.values()].sort((l,c)=>l.handle.localeCompare(c.handle)),t=KL(i.sandboxes),f=i.selectedHandle!==null&&t.includes(i.selectedHandle)?i.selectedHandle:t[0]??null;return rbt((l,c)=>{let E=cmu(l,c,i.pendingConfirm!==null);if(E!==null)fmu(E)}),Dh(bl,{flexDirection:"column",children:[Pf(E1i,{version:SL.version}),Pf(bl,{marginBottom:1,children:Pf(d1,{dimColor:!0,children:"\u2500".repeat(80)})}),Pf(bl,{children:i.cluster==="linked"?Dh(d1,{color:"green",children:["\u2713 Connected to ",i.clusterUrl??"deco"]}):i.cluster==="connecting"?Dh(d1,{color:"yellow",children:["\u25CC Connecting to ",i.clusterUrl??"deco","\u2026"]}):Dh(d1,{color:"red",children:["\u2717 Disconnected from ",i.clusterUrl??"deco"]})}),Pf(bl,{children:i.ingressUrl?Dh(d1,{color:"green",children:["\u2713 Serving at ",i.ingressUrl]}):Pf(d1,{dimColor:!0,children:"\u25CC Starting local server\u2026"})}),Pf(bl,{marginBottom:1,children:Pf(d1,{dimColor:!0,children:`${"Computer".padEnd(16)}${i.machine??"this computer"} \xB7 ${u.length} of ${i.cap} previews`})}),u.length===0?Pf(d1,{dimColor:!0,children:"No previews running yet."}):Dh(bl,{flexDirection:"column",children:[Dh(bl,{children:[Pf(bl,{width:2,flexShrink:0}),Pf(bl,{width:JL.project,flexShrink:0,marginRight:1,children:Pf(d1,{dimColor:!0,wrap:"truncate-end",children:"PROJECT"})}),Pf(bl,{width:JL.branch,flexShrink:0,marginRight:1,children:Pf(d1,{dimColor:!0,wrap:"truncate-end",children:"BRANCH"})}),Pf(bl,{width:JL.status,flexShrink:0,marginRight:1,children:Pf(d1,{dimColor:!0,wrap:"truncate-end",children:"STATUS"})}),Pf(bl,{flexGrow:1,children:Pf(d1,{dimColor:!0,wrap:"truncate-end",children:"PREVIEW URL"})})]}),u.map((l)=>{let c=ebt(l,i.removingHandles.has(l.handle)),E=l.handle===f;return Dh(bl,{children:[Pf(bl,{width:2,flexShrink:0,children:Pf(d1,{color:"cyan",children:E?"\u203A":" "})}),Pf(bl,{width:JL.project,flexShrink:0,marginRight:1,children:Pf(d1,{bold:E,wrap:"truncate-end",children:l.projectName??l.handle})}),Pf(bl,{width:JL.branch,flexShrink:0,marginRight:1,children:Pf(d1,{bold:E,wrap:"truncate-end",children:l.branch??"\u2014"})}),Pf(bl,{width:JL.status,flexShrink:0,marginRight:1,children:Pf(d1,{color:c.color,bold:E,wrap:"truncate-end",children:c.text})}),Pf(bl,{flexGrow:1,children:Pf(d1,{dimColor:!0,wrap:"truncate-end",children:l.previewUrl??"\u2014"})})]},l.handle)})]}),i.daemonError?Pf(bl,{marginTop:1,children:Dh(d1,{color:"red",children:["\u26A0 ",i.daemonError]})}):null,i.logPath?Pf(bl,{marginTop:1,children:Dh(d1,{dimColor:!0,children:["Logs: ",i.logPath]})}):null,i.pendingConfirm?Pf(bl,{marginTop:1,children:Pf(d1,{color:"yellow",children:aru(i.pendingConfirm)})}):null,i.actionError?Pf(bl,{marginTop:1,children:Dh(d1,{color:"red",children:["\u2717 ",i.actionError]})}):null,Pf(bl,{marginTop:1,children:Pf(d1,{dimColor:!0,children:"\u2191\u2193 move \xB7 s stop \xB7 d delete \xB7 o open \xB7 q quit"})})]})}var JL;var dmu=g(()=>{f1i();rHi();lmu();AM();JL={project:18,branch:22,status:14}});var $mu={};Yi($mu,{runLinkCommand:()=>lRt});import{closeSync as obt,mkdirSync as sbt,openSync as pbt,writeSync as iRt}from"fs";import{homedir as uRt}from"os";import{join as sHi}from"path";function tRt(i,u){let t={log:console.log,warn:console.warn,error:console.error},f=(l)=>{if(u===void 0)return;try{iRt(u,`${VHi(l)}
+Shutting down\u2026`),D();try{await T.close()}catch{}try{await $.stop()}catch{}try{await d.shutdown()}catch{}try{O.close()}catch{}c(),B(0)};process.on("SIGINT",()=>void S()),process.on("SIGTERM",()=>void S()),N=()=>{console.log("Disconnect requested from the Studio web UI \u2014 shutting down. Run `bunx decocms@latest link` to reconnect."),S()},T.closed.then(()=>{if(i.monitor?.onCluster?.("closed"),!P)console.error("Cluster connection closed permanently; exiting."),S()});let A=Qru({provider:d,registry:f,dataDir:i.dataDir});return{stopped:F,stop:S,stopSandbox:A.stopSandbox,removeSandbox:A.removeSandbox,inspectSandbox:A.inspectSandbox}}catch(E){throw c(),E}}var Vru=g(()=>{Pzi();qC();xbu();jbu();Jbu();Jzi();dru();Zru();xru();Gru();MC();qHi();Hru();Mru()});function VHi(i){return i.map((u)=>typeof u==="string"?u:String(u)).join(" ")}var SL;var f1i=g(()=>{SL={name:"decocms",version:"4.28.1",description:"Deco CMS \u2014 Self-hostable MCP Gateway for managing AI connections and tools",author:"Deco team",repository:{type:"git",url:"git+https://github.com/decocms/studio.git",directory:"apps/mesh"},bugs:{url:"https://github.com/decocms/studio/issues"},type:"module",bin:{deco:"./dist/server/cli.js"},files:["dist/**/*"],scripts:{dev:'bun run migrate && concurrently "bun run dev:client" "bun run dev:server"',"dev:servers":'concurrently "bun run dev:client" "bun run dev:server"',"dev:client":"vite dev","dev:server":"bun run --cwd=../../packages/sandbox build && NODE_ENV=development bun --env-file=.env --hot run src/index.ts","build:client":"bun --bun vite build","build:server":"bun run scripts/bundle-server-script.ts --dist ./dist/server","db:migrate":"bun run ./dist/server/migrate.js",check:"tsc --noEmit",start:"bun run ./dist/server/server.js",migrate:"bun run src/database/migrate.ts",test:"bun test","test:ct":"playwright test -c playwright-ct.config.ts","test:ct:ui":"playwright test -c playwright-ct.config.ts --ui","better-auth:migrate":"bunx --bun @better-auth/cli migrate -y --config src/auth/index.ts","smoke:link":"bun run scripts/smoke-link.ts",prepublishOnly:"bun run build:client && bun run build:server"},optionalDependencies:{"@anthropic-ai/claude-agent-sdk":"^0.3.181","@duckdb/node-api":"^1.5.0-r.1","@openai/codex":"0.144.3","@openai/codex-darwin-arm64":"npm:@openai/codex@0.144.3-darwin-arm64","@openai/codex-darwin-x64":"npm:@openai/codex@0.144.3-darwin-x64","@openai/codex-linux-arm64":"npm:@openai/codex@0.144.3-linux-arm64","@openai/codex-linux-x64":"npm:@openai/codex@0.144.3-linux-x64","@openai/codex-win32-arm64":"npm:@openai/codex@0.144.3-win32-arm64","@openai/codex-win32-x64":"npm:@openai/codex@0.144.3-win32-x64"},dependencies:{"@ai-sdk/anthropic":"^3.0.85","@ai-sdk/google":"^3.0.83","@ai-sdk/openai":"^3.0.73","@anthropic-ai/sdk":"^0.105.0","@aws-sdk/client-s3":"^3.1013.0","@aws-sdk/client-sts":"^3.1013.0","@aws-sdk/lib-storage":"^3.1013.0","@aws-sdk/s3-request-presigner":"^3.1013.0","@clickhouse/client":"^1.8.1","@dbos-inc/dbos-sdk":"^4.21.6","@dnd-kit/core":"^6.3.1","@dnd-kit/sortable":"^10.0.0","@dnd-kit/utilities":"^3.2.2","@inkjs/ui":"^2.0.0","@modelcontextprotocol/ext-apps":"^1.7.1","@nats-io/jetstream":"3.4.0","@nats-io/kv":"3.4.0","@nats-io/nats-core":"3.4.0","@nats-io/transport-node":"3.4.0","@openrouter/ai-sdk-provider":"^2.9.1","@opentelemetry/core":"^2.6.0","@tanstack/react-virtual":"3.13.24","@tiptap/extension-text-align":"3.20.2","@xterm/addon-fit":"^0.11.0","@xterm/xterm":"^6.0.0","embedded-postgres":"^18.3.0-beta.16",ink:"^6.8.0",kysely:"^0.28.12","node-pty":"^1.0.0","posthog-js":"^1.371.1","posthog-node":"^5.0.0",react:"^19.2.6","react-dom":"^19.2.6","use-stick-to-bottom":"^1.1.6"},devDependencies:{"@ai-sdk/provider":"^3.0.10","@ai-sdk/react":"^3.0.210","@better-auth/sso":"1.4.1","@daveyplate/better-auth-ui":"^3.2.7","@deco/ui":"workspace:*","@decocms/better-auth":"1.5.17","@decocms/bindings":"workspace:*","@decocms/harness":"workspace:*","@decocms/mcp-utils":"workspace:*","@decocms/mesh-sdk":"workspace:*","@decocms/runtime":"workspace:*","@decocms/sandbox":"workspace:*","@decocms/std":"workspace:*","@decocms/tunnel":"workspace:*","@floating-ui/react":"^0.27.16","@happy-dom/global-registrator":"^20.9.0","@hookform/resolvers":"^5.2.2","@jitl/quickjs-wasmfile-release-sync":"0.31.0","@modelcontextprotocol/sdk":"1.29.0","@monaco-editor/react":"^4.7.0","@nats-io/jwt":"0.0.10-5","@opentelemetry/api":"^1.9.0","@opentelemetry/api-logs":"^0.211.0","@opentelemetry/exporter-logs-otlp-proto":"^0.211.0","@opentelemetry/exporter-prometheus":"^0.208.0","@opentelemetry/exporter-trace-otlp-proto":"^0.207.0","@opentelemetry/instrumentation-runtime-node":"^0.24.0","@opentelemetry/resources":"^2.6.0","@opentelemetry/sdk-logs":"^0.211.0","@opentelemetry/sdk-metrics":"^2.2.0","@opentelemetry/sdk-node":"^0.207.0","@opentelemetry/sdk-trace-base":"^2.5.0","@playwright/experimental-ct-react":"1.59.1","@playwright/test":"^1.58.2","@radix-ui/react-avatar":"^1.1.10","@radix-ui/react-checkbox":"^1.3.3","@radix-ui/react-dialog":"^1.1.15","@radix-ui/react-dropdown-menu":"^2.1.16","@radix-ui/react-label":"^2.1.7","@radix-ui/react-select":"^2.2.6","@radix-ui/react-separator":"^1.1.7","@radix-ui/react-slot":"^1.2.3","@radix-ui/react-tabs":"^1.1.13","@rjsf/shadcn":"^6.6.2","@rjsf/utils":"^6.6.2","@rjsf/validator-ajv8":"^6.6.2","@tailwindcss/vite":"^4.1.17","@tanstack/react-query":"5.100.10","@tanstack/react-router":"1.169.2","@testing-library/jest-dom":"^6.9.1","@testing-library/react":"^16.3.2","@tiptap/core":"3.20.2","@tiptap/extension-placeholder":"3.20.2","@tiptap/pm":"3.20.2","@tiptap/react":"3.20.2","@tiptap/starter-kit":"3.20.2","@tiptap/suggestion":"3.20.2","@types/bun":"^1.3.1","@types/google.maps":"^3.65.2","@types/pg":"^8.15.6","@types/react-syntax-highlighter":"^15.5.13","@untitledui/icons":"^0.0.19","@vercel/nft":"^1.1.1","@vitejs/plugin-react":"^5.1.0",ai:"^6.0.208","babel-plugin-react-compiler":"^1.0.0","better-auth":"1.4.22","class-variance-authority":"^0.7.1",clsx:"^2.1.1",concurrently:"^9.2.1",croner:"^9.1.0","date-fns":"^4.1.0",degit:"^2.8.4",hono:"^4.10.7","input-otp":"^1.4.2",jose:"^6.0.11","lucide-react":"^0.468.0",marked:"^15.0.6",nanoid:"^5.1.6",pg:"^8.16.3",prettier:"^3.4.2","react-hook-form":"^7.66.0","react-markdown":"^10.1.0","react-resizable-panels":"^2.1.7","react-syntax-highlighter":"^15.6.1",recharts:"^3.6.0","rehype-raw":"^7.0.0","remark-gfm":"^4.0.0","sass-embedded":"^1.97.2",sonner:"^2.0.7","tailwind-merge":"^3.3.1",tailwindcss:"^4.1.17",typescript:"^5.9.3",vite:"^7.2.1","vite-tsconfig-paths":"^5.1.4",zod:"^4.0.0"},homepage:"https://github.com/decocms/studio",keywords:["mcp","model-context-protocol","ai","gateway","self-hosted","mesh","tools"],license:"MIT",publishConfig:{access:"public"}}});var UM={};Yi(UM,{printBanner:()=>Sbt,bannerLines:()=>rru,BANNER_LINES:()=>l1i,BANNER_GRADIENT:()=>c1i});function Gbt(i){let u=Number.parseInt(i.slice(1),16);return[u>>16&255,u>>8&255,u&255]}function rru(i){let u=l1i.map((t,f)=>{let[l,c,E]=Gbt(c1i[f]);return`\x1B[38;2;${l};${c};${E}m${t}\x1B[39m`});if(i!==void 0)u.push(`\x1B[2m  v${i}\x1B[22m`);return u}function Sbt(i){console.log("");for(let u of rru(i))console.log(u);console.log("")}var l1i,c1i;var jL=g(()=>{l1i=[" \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588     \u2588\u2588\u2588\u2588\u2588\u2588\u2588   ","\u2591\u2591\u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2588\u2588\u2588 \u2591\u2591\u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2591\u2588  \u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2591\u2588\u2588\u2588  \u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2591\u2588\u2588\u2588 "," \u2591\u2588\u2588\u2588   \u2591\u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588  \u2588 \u2591  \u2588\u2588\u2588     \u2591\u2591\u2591  \u2588\u2588\u2588     \u2591\u2591\u2588\u2588\u2588"," \u2591\u2588\u2588\u2588    \u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588\u2588\u2588\u2588   \u2591\u2588\u2588\u2588         \u2591\u2588\u2588\u2588      \u2591\u2588\u2588\u2588"," \u2591\u2588\u2588\u2588    \u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588\u2591\u2591\u2588   \u2591\u2588\u2588\u2588         \u2591\u2588\u2588\u2588      \u2591\u2588\u2588\u2588"," \u2591\u2588\u2588\u2588    \u2588\u2588\u2588  \u2591\u2588\u2588\u2588 \u2591   \u2588\u2591\u2591\u2588\u2588\u2588     \u2588\u2588\u2588\u2591\u2591\u2588\u2588\u2588     \u2588\u2588\u2588 "," \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588 \u2591\u2591\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588  \u2591\u2591\u2591\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2591  ","\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591   \u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591   \u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591     \u2591\u2591\u2591\u2591\u2591\u2591\u2591   "],c1i=["#00ff64","#00ee5e","#00dc56","#00c84e","#00b444","#00a03c","#008832","#006e28"]});import{Box as jbt,Text as mru}from"ink";import{jsx as Kbt,jsxs as eru}from"react/jsx-runtime";function E1i({version:i}){return eru(jbt,{flexDirection:"column",marginTop:1,children:[l1i.map((u,t)=>Kbt(mru,{color:c1i[t],children:u},t)),eru(mru,{dimColor:!0,children:[" v",i]})]})}var rHi=g(()=>{jL()});function aru(i){let u=i.branch??i.handle,t=[];if(i.dirtyCount>0)t.push(`${i.dirtyCount} uncommitted file${i.dirtyCount===1?"":"s"}`);if(i.merged===!1)t.push("branch not merged");return t.length>0?`\u26A0 ${t.join(", ")} \u2014 delete ${u}? (y/n)`:`Delete ${u}? (y/n)`}function KL(i){return[...i.values()].map((u)=>u.handle).sort((u,t)=>u.localeCompare(t))}function oru(i,u,t){if(i.length===0)return null;let f=u===null?-1:i.indexOf(u);if(f===-1)return t>0?i[0]:i[i.length-1];let l=Math.max(0,Math.min(i.length-1,f+t));return i[l]}function sru(i,u,t){if(t!==u)return t;let f=i.indexOf(u);if(f===-1)return t;return i[f+1]??i[f-1]??null}var oHi={};Yi(oHi,{subscribeLinkState:()=>mHi,setSelectedHandle:()=>eHi,setRemoving:()=>w1i,setPersistedSandboxes:()=>Rbt,setPendingConfirm:()=>PM,setMachine:()=>zbt,setLogPath:()=>Hbt,setLinkActions:()=>bbt,setIngress:()=>Ybt,setDaemonError:()=>Qbt,setClusterUrl:()=>Wbt,setCluster:()=>Lbt,setActionError:()=>$1i,resetLinkStateForTests:()=>Mbt,removeSandboxRow:()=>aHi,pushSandboxEvent:()=>Cbt,getLinkState:()=>IM,applySandboxEvent:()=>pru});function Xbt(i){return i==="spawning"||i==="ready"||i==="failed"}function pru(i,u){let t=new Map(i),f=t.get(u.handle);if(u.phase==="evicted"||u.phase==="deleted"){if(f)t.set(u.handle,{...f,port:null,previewUrl:null,status:"stopped",error:null});return t}return t.set(u.handle,{handle:u.handle,port:u.port??f?.port??null,previewUrl:u.previewUrl??f?.previewUrl??null,status:u.phase,error:u.phase==="failed"?u.error??"failed":null,projectName:u.projectName??f?.projectName??null,branch:u.branch??f?.branch??null,sandboxPath:u.sandboxPath??f?.sandboxPath??null}),t}function imu(){return{cluster:"connecting",clusterUrl:null,ingressUrl:null,ingressPort:null,machine:null,cap:Jbt,sandboxes:new Map,daemonError:null,logPath:null,selectedHandle:null,pendingConfirm:null,removingHandles:new Set,actionError:null,actions:null}}function Jd(){for(let i of d1i)i()}function IM(){return tf}function mHi(i){return d1i.add(i),()=>d1i.delete(i)}function Lbt(i){tf={...tf,cluster:i},Jd()}function Wbt(i){tf={...tf,clusterUrl:i},Jd()}function Ybt(i,u){tf={...tf,ingressPort:i,ingressUrl:u},Jd()}function zbt(i){tf={...tf,machine:i},Jd()}function Qbt(i){tf={...tf,daemonError:i},Jd()}function Hbt(i){tf={...tf,logPath:i},Jd()}function eHi(i){tf={...tf,selectedHandle:i},Jd()}function PM(i){tf={...tf,pendingConfirm:i},Jd()}function $1i(i){tf={...tf,actionError:i},Jd()}function w1i(i,u){if(tf.removingHandles.has(i)===u)return;let t=new Set(tf.removingHandles);if(u)t.add(i);else t.delete(i);tf={...tf,removingHandles:t},Jd()}function bbt(i){tf={...tf,actions:i},Jd()}function aHi(i){let u=KL(tf.sandboxes),t=sru(u,i,tf.selectedHandle),f=new Map(tf.sandboxes);f.delete(i);let l=new Set(tf.removingHandles);l.delete(i),tf={...tf,sandboxes:f,selectedHandle:t,pendingConfirm:null,removingHandles:l},Jd()}function Rbt(i){let u=new Map;for(let t of i)u.set(t.handle,{handle:t.handle,port:t.port,previewUrl:t.previewUrl,status:t.status,error:t.error,projectName:t.projectName,branch:t.branch,sandboxPath:t.sandboxPath});for(let[t,f]of tf.sandboxes)if(Xbt(f.status))u.set(t,f);tf={...tf,sandboxes:u},Jd()}function Cbt(i){tf={...tf,sandboxes:pru(tf.sandboxes,i)},Jd()}function Mbt(){tf=imu(),d1i.clear()}var Jbt=20,tf,d1i;var AM=g(()=>{tf=imu(),d1i=new Set});import{spawn as qbt}from"child_process";function Vbt(i){if(i==="darwin")return"open";if(i==="win32")return"start";return"xdg-open"}function umu(i,u=process.platform){let t=Vbt(u);try{qbt(t,[i],{stdio:"ignore",detached:!0}).unref()}catch{}}var tmu=()=>{};function fmu(i,u={}){let t=u.openUrl??umu,f=IM(),l=KL(f.sandboxes),c=f.selectedHandle!==null&&l.includes(f.selectedHandle)?f.selectedHandle:l[0]??null,E=f.actions;switch(i.type){case"move":eHi(oru(l,f.selectedHandle,i.delta));return;case"open":{if(c===null)return;let d=f.sandboxes.get(c);if(d?.status==="ready"&&d.previewUrl)t(d.previewUrl);return}case"stop":if(c!==null&&E)E.stopSandbox(c);return;case"delete":{if(c===null||!E)return;let d=E.inspectSandbox(c),$=f.sandboxes.get(c);$1i(null),PM({handle:c,branch:d?.branch??$?.branch??null,dirtyCount:d?.dirtyCount??0,merged:d?.merged??null});return}case"confirmYes":{let d=f.pendingConfirm;if(PM(null),d===null||!E)return;w1i(d.handle,!0),E.removeSandbox(d.handle).then(($)=>{if($.ok)aHi(d.handle);else w1i(d.handle,!1),$1i($.error)});return}case"confirmNo":PM(null);return;case"quit":if(E)E.quit();return}}var lmu=g(()=>{AM();tmu()});function cmu(i,u,t){if(t)return i==="y"||i==="Y"?{type:"confirmYes"}:{type:"confirmNo"};if(u.upArrow||i==="k")return{type:"move",delta:-1};if(u.downArrow||i==="j")return{type:"move",delta:1};if(i==="s")return{type:"stop"};if(i==="d")return{type:"delete"};if(i==="o")return{type:"open"};if(i==="q"||u.ctrl===!0&&i==="c")return{type:"quit"};return null}var Emu={};Yi(Emu,{LinkApp:()=>abt});import{Box as bl,Text as d1,useInput as rbt}from"ink";import{useSyncExternalStore as mbt}from"react";import{jsx as Pf,jsxs as Dh}from"react/jsx-runtime";function ebt(i,u){if(u)return{color:"yellow",text:"\u25CC Removing\u2026"};if(i.status==="ready")return{color:"green",text:"\u25CF Live"};if(i.status==="spawning")return{color:"yellow",text:"\u25CC Starting\u2026"};if(i.status==="stopped")return{color:"gray",text:"\u25A0 Stopped"};if(i.status==="missing")return{color:"yellow",text:"\u25A1 Missing"};if(i.status==="merged")return{color:"cyan",text:"\u2713 Merged"};if(i.status==="invalid")return{color:"red",text:"\u2717 Invalid"};if(i.status==="failed")return{color:"red",text:`\u2717 Failed: ${i.error??"failed"}`};return{color:"red",text:`\u2717 Error: ${i.error??""}`}}function abt(){let i=mbt(mHi,IM),u=[...i.sandboxes.values()].sort((l,c)=>l.handle.localeCompare(c.handle)),t=KL(i.sandboxes),f=i.selectedHandle!==null&&t.includes(i.selectedHandle)?i.selectedHandle:t[0]??null;return rbt((l,c)=>{let E=cmu(l,c,i.pendingConfirm!==null);if(E!==null)fmu(E)}),Dh(bl,{flexDirection:"column",children:[Pf(E1i,{version:SL.version}),Pf(bl,{marginBottom:1,children:Pf(d1,{dimColor:!0,children:"\u2500".repeat(80)})}),Pf(bl,{children:i.cluster==="linked"?Dh(d1,{color:"green",children:["\u2713 Connected to ",i.clusterUrl??"deco"]}):i.cluster==="connecting"?Dh(d1,{color:"yellow",children:["\u25CC Connecting to ",i.clusterUrl??"deco","\u2026"]}):Dh(d1,{color:"red",children:["\u2717 Disconnected from ",i.clusterUrl??"deco"]})}),Pf(bl,{children:i.ingressUrl?Dh(d1,{color:"green",children:["\u2713 Serving at ",i.ingressUrl]}):Pf(d1,{dimColor:!0,children:"\u25CC Starting local server\u2026"})}),Pf(bl,{marginBottom:1,children:Pf(d1,{dimColor:!0,children:`${"Computer".padEnd(16)}${i.machine??"this computer"} \xB7 ${u.length} of ${i.cap} previews`})}),u.length===0?Pf(d1,{dimColor:!0,children:"No previews running yet."}):Dh(bl,{flexDirection:"column",children:[Dh(bl,{children:[Pf(bl,{width:2,flexShrink:0}),Pf(bl,{width:JL.project,flexShrink:0,marginRight:1,children:Pf(d1,{dimColor:!0,wrap:"truncate-end",children:"PROJECT"})}),Pf(bl,{width:JL.branch,flexShrink:0,marginRight:1,children:Pf(d1,{dimColor:!0,wrap:"truncate-end",children:"BRANCH"})}),Pf(bl,{width:JL.status,flexShrink:0,marginRight:1,children:Pf(d1,{dimColor:!0,wrap:"truncate-end",children:"STATUS"})}),Pf(bl,{flexGrow:1,children:Pf(d1,{dimColor:!0,wrap:"truncate-end",children:"PREVIEW URL"})})]}),u.map((l)=>{let c=ebt(l,i.removingHandles.has(l.handle)),E=l.handle===f;return Dh(bl,{children:[Pf(bl,{width:2,flexShrink:0,children:Pf(d1,{color:"cyan",children:E?"\u203A":" "})}),Pf(bl,{width:JL.project,flexShrink:0,marginRight:1,children:Pf(d1,{bold:E,wrap:"truncate-end",children:l.projectName??l.handle})}),Pf(bl,{width:JL.branch,flexShrink:0,marginRight:1,children:Pf(d1,{bold:E,wrap:"truncate-end",children:l.branch??"\u2014"})}),Pf(bl,{width:JL.status,flexShrink:0,marginRight:1,children:Pf(d1,{color:c.color,bold:E,wrap:"truncate-end",children:c.text})}),Pf(bl,{flexGrow:1,children:Pf(d1,{dimColor:!0,wrap:"truncate-end",children:l.previewUrl??"\u2014"})})]},l.handle)})]}),i.daemonError?Pf(bl,{marginTop:1,children:Dh(d1,{color:"red",children:["\u26A0 ",i.daemonError]})}):null,i.logPath?Pf(bl,{marginTop:1,children:Dh(d1,{dimColor:!0,children:["Logs: ",i.logPath]})}):null,i.pendingConfirm?Pf(bl,{marginTop:1,children:Pf(d1,{color:"yellow",children:aru(i.pendingConfirm)})}):null,i.actionError?Pf(bl,{marginTop:1,children:Dh(d1,{color:"red",children:["\u2717 ",i.actionError]})}):null,Pf(bl,{marginTop:1,children:Pf(d1,{dimColor:!0,children:"\u2191\u2193 move \xB7 s stop \xB7 d delete \xB7 o open \xB7 q quit"})})]})}var JL;var dmu=g(()=>{f1i();rHi();lmu();AM();JL={project:18,branch:22,status:14}});var $mu={};Yi($mu,{runLinkCommand:()=>lRt});import{closeSync as obt,mkdirSync as sbt,openSync as pbt,writeSync as iRt}from"fs";import{homedir as uRt}from"os";import{join as sHi}from"path";function tRt(i,u){let t={log:console.log,warn:console.warn,error:console.error},f=(l)=>{if(u===void 0)return;try{iRt(u,`${VHi(l)}
 `)}catch{}};return console.log=(...l)=>f(l),console.warn=(...l)=>f(l),console.error=(...l)=>{f(l),i(VHi(l))},()=>{console.log=t.log,console.warn=t.warn,console.error=t.error}}async function fRt(i,u){let t;try{t=await fetch(`${i}/api/links/me`,{headers:{authorization:`Bearer ${u}`},signal:AbortSignal.timeout(1e4)})}catch{return}if(t.status===401||t.status===403)throw Error(`Authentication rejected by ${i} \u2014 the session token was not accepted. `+`Run \`deco auth login --target ${i}\` and try again.`)}async function lRt(i={}){let u=i.port??5174,t=i.dataDir??process.env.DATA_DIR??process.env.DECOCMS_HOME??sHi(uRt(),"deco"),f=i.clusterBaseUrl??process.env.MESH_CLUSTER_URL??"https://studio.decocms.com",l,c,E,d=()=>{if(E===void 0)return;try{E.close()}catch{}finally{E=void 0}};try{let $=sHi(t,"sandboxes");E=t1i({path:u1i(t),managedSandboxRoot:$});let w=await o4i({dataDir:t,intent:"Link",target:f});if(process.env.DECOCMS_LINK_MANAGED!=="1")await fRt(f,w.accessToken);let h=E.reconcile();if(i.prune){let D=E.prune({missing:!0,merged:!0});if(!i.tui)console.log(`Pruned local sandboxes: removed ${D.removed.length}, skipped ${D.skipped.length}.`);h=E.reconcile()}let _;if(i.tui){let{render:D}=await import("ink"),{createElement:O}=await import("react"),{LinkApp:N}=await Promise.resolve().then(() => (dmu(),Emu)),{pushSandboxEvent:y,setCluster:Z,setClusterUrl:T,setDaemonError:B,setIngress:F,setLogPath:P,setMachine:S,setPersistedSandboxes:A}=await Promise.resolve().then(() => (AM(),oHi));sbt(t,{recursive:!0});let k=sHi(t,"link.log");c=pbt(k,"w"),P(k),A(h),T(f),Z("connecting"),_={onEvent:(M)=>y(M),onIngress:(M)=>F(M,`http://127.0.0.1:${M}`),onCluster:(M)=>Z(M),onMachine:(M)=>S(M)},l=tRt(B,c),D(O(N),{patchConsole:!1})}else if(i.banner!==!1){let{printBanner:D}=await Promise.resolve().then(() => (jL(),UM));D(i.version??"0.0.0")}d();let v=process.env.DECOCMS_LINK_MANAGED!=="1",n=await qru({port:u,clusterBaseUrl:f,dataDir:t,session:w,monitor:_,logFd:c,perSandboxLogs:v,hotReload:i.hotReload});if(i.tui){let{setLinkActions:D}=await Promise.resolve().then(() => (AM(),oHi));D({stopSandbox:n.stopSandbox,removeSandbox:n.removeSandbox,inspectSandbox:n.inspectSandbox,quit:n.stop})}return await n.stopped}catch($){return l?.(),console.error($ instanceof Error?$.message:String($)),1}finally{if(l?.(),c!==void 0)try{obt(c)}catch{}d()}}var wmu=g(()=>{Izi();Vru();qHi()});var lbi={};Yi(lbi,{resolveDevLinkClusterUrl:()=>$Rt,populateDevLinkToxiProxy:()=>gmu,isDevLinkToxiProxyEnabled:()=>dRt,ensureDevLinkToxiProxy:()=>nRt,buildDevLinkToxiProxyConfig:()=>nmu,DEV_LINK_TOXIPROXY_SERVICE_NAME:()=>_mu,DEV_LINK_TOXIPROXY_PROXY_NAME:()=>vmu});function dRt(i=process.env){return i.DECO_DEV_LINK_TOXIPROXY==="1"}function pHi(i,u){if(!Number.isInteger(i)||i<1||i>65535)throw Error(`${u} must be an integer port in 1..65535`);return i}function nmu(i){let u=new URL(i.serverUrl);if(u.protocol!=="http:")throw Error("DECO_DEV_LINK_TOXIPROXY only supports http local Studio URLs");let t=pHi(i.apiPort,"apiPort"),f=pHi(i.listenPort,"listenPort");if(u.port.length===0)throw Error("serverUrl must include an explicit valid port");let l=pHi(Number.parseInt(u.port,10),"upstreamPort"),c=`http://127.0.0.1:${l}`,E=`http://127.0.0.1:${f}`;return{serviceName:_mu,proxyName:vmu,apiUrl:`http://127.0.0.1:${t}`,listen:`0.0.0.0:${f}`,upstream:`host.docker.internal:${l}`,publicTargetUrl:c,clusterUrl:E,logLine:`[dev-link-toxiproxy] ready: ${E} -> ${c}`}}function $Rt(i){return i.toxiproxy?.clusterUrl??i.serverUrl}async function ibi(i,u,t){if(i.ok)return;let f=await i.text();throw Error(`ToxiProxy ${u} failed for ${t}: status=${i.status} statusText=${i.statusText} body=${f}`)}function fbi(i){if(i instanceof Error)return i.name==="Error"?i.message:`${i.name}: ${i.message}`;return String(i)}function Dmu(i){if(!(i instanceof Error))return!1;if(i.name==="TimeoutError")return!0;return Dmu(i.cause)}async function ubi(i,u,t,f){try{return await i(t,f)}catch(l){throw Error(`ToxiProxy ${u} failed for ${t}: ${fbi(l)}`,{cause:l})}}async function gmu(i,u=fetch){let t=`${i.apiUrl}/reset`,f=await ubi(u,"reset",t,{method:"POST"});await ibi(f,"reset",t);let l=`${i.apiUrl}/populate`,c=await ubi(u,"populate",l,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify([{name:i.proxyName,listen:i.listen,upstream:i.upstream,enabled:!0}])});await ibi(c,"populate",l)}async function wRt(i,u){let t=`${i.apiUrl}/version`;try{await Z1(async()=>{let f=await ubi(u,"readiness check",t,{method:"GET",signal:AbortSignal.timeout(ERt)});await ibi(f,"readiness check",t)},{maxAttempts:cRt,minTimeout:hmu,maxTimeout:hmu,multiplier:1,jitter:0,isRetriable:(f)=>!Dmu(f)})}catch(f){let l=f instanceof Jc?f.cause:f;throw Error(`ToxiProxy API did not become ready at ${t}: ${fbi(l)}`,{cause:l})}}async function hRt(i){if(i===null)return"";return await new Response(i).text()}async function tbi(i,u={}){let t=["docker",...i].join(" "),f=(()=>{try{return Bun.spawn(["docker",...i],{stdout:"ignore",stderr:"pipe"})}catch(d){throw Error(`Docker command failed to start (${t}): ${fbi(d)}`,{cause:d})}})(),[l,c]=await Promise.all([f.exited,hRt(f.stderr)]);if(l===0||u.ignoreFailure===!0)return;let E=c.trim().length>0?`: ${c.trim()}`:"";throw Error(`Docker command failed (${t}) with exit ${l}${E}`)}async function _Rt(i,u){let t=`deco-dev-link-toxiproxy-${i}`;await tbi(["rm","-f",t],{ignoreFailure:!0}),await tbi(["run","--rm","-d","--name",t,"-p",`127.0.0.1:${i}:8474`,"-p",`127.0.0.1:${u}:${u}`,"ghcr.io/shopify/toxiproxy:2.12.0","-host=0.0.0.0"])}async function vRt(i,u){let t=`deco-dev-link-toxiproxy-${i}`;await tbi(["rm","-f",t],{ignoreFailure:!0})}async function nRt(i){let u=nmu(i),t=i.startDaemon??_Rt,f=i.stopDaemon??(i.startDaemon===void 0?vRt:void 0);await t(i.apiPort,i.listenPort);let l=i.fetchImpl??fetch;try{await wRt(u,l),await gmu(u,l)}catch(c){if(f!==void 0)try{await f(i.apiPort,i.listenPort)}catch{}throw c}return{config:u,stop:async()=>{if(f!==void 0)await f(i.apiPort,i.listenPort)}}}var _mu="ToxiProxy",vmu="dev_link_studio",cRt=20,hmu=100,ERt=100;var cbi=g(()=>{B4()});var Omu={};Yi(Omu,{migrateBetterAuth:()=>Ebi});import{getMigrations as DRt}from"better-auth/db";import{sso as gRt}from"@better-auth/sso";import{organization as ORt}from"@decocms/better-auth/plugins";import{admin as NRt,apiKey as yRt,jwt as ZRt,magicLink as TRt,mcp as BRt,openAPI as FRt}from"better-auth/plugins";import{emailOTP as URt}from"better-auth/plugins/email-otp";async function Ebi(i){let t={database:zC(i||r8()),plugins:[ORt({dynamicAccessControl:{enabled:!0,enableCustomResources:!0}}),NRt(),yRt(),ZRt(),FRt(),BRt({loginPage:"/login"}),gRt(),TRt({sendMagicLink:async()=>{}}),URt({sendVerificationOTP:async()=>{}})]},{toBeAdded:f,toBeCreated:l,runMigrations:c}=await DRt(t);if(!f.length&&!l.length)return"up to date";return await c(),`${l.length+f.length} table(s) migrated`}var dbi=g(()=>{QE()});var $bi={};Yi($bi,{up:()=>IRt,down:()=>PRt});import{sql as p_}from"kysely";async function IRt(i){await i.schema.createTable("connections").addColumn("id","text",(u)=>u.primaryKey()).addColumn("organizationId","text",(u)=>u.notNull().references("organization.id").onDelete("cascade")).addColumn("createdById","text",(u)=>u.notNull().references("user.id").onDelete("cascade")).addColumn("name","text",(u)=>u.notNull()).addColumn("description","text").addColumn("icon","text").addColumn("appName","text").addColumn("appId","text").addColumn("connectionType","text",(u)=>u.notNull()).addColumn("connectionUrl","text",(u)=>u.notNull()).addColumn("connectionToken","text").addColumn("connectionHeaders","text").addColumn("oauthConfig","text").addColumn("metadata","text").addColumn("tools","text").addColumn("bindings","text").addColumn("status","text",(u)=>u.notNull().defaultTo("active")).addColumn("createdAt","text",(u)=>u.notNull().defaultTo(p_`CURRENT_TIMESTAMP`)).addColumn("updatedAt","text",(u)=>u.notNull().defaultTo(p_`CURRENT_TIMESTAMP`)).execute(),await i.schema.createTable("api_keys").addColumn("id","text",(u)=>u.primaryKey()).addColumn("userId","text",(u)=>u.notNull().references("user.id").onDelete("cascade")).addColumn("name","text",(u)=>u.notNull()).addColumn("hashedKey","text",(u)=>u.notNull().unique()).addColumn("permissions","text",(u)=>u.notNull()).addColumn("expiresAt","text").addColumn("remaining","integer").addColumn("metadata","text").addColumn("createdAt","text",(u)=>u.notNull().defaultTo(p_`CURRENT_TIMESTAMP`)).addColumn("updatedAt","text",(u)=>u.notNull().defaultTo(p_`CURRENT_TIMESTAMP`)).execute(),await i.schema.createTable("audit_logs").addColumn("id","text",(u)=>u.primaryKey()).addColumn("organizationId","text").addColumn("userId","text",(u)=>u.references("user.id").onDelete("set null")).addColumn("connectionId","text",(u)=>u.references("connections.id").onDelete("set null")).addColumn("toolName","text",(u)=>u.notNull()).addColumn("allowed","integer",(u)=>u.notNull()).addColumn("duration","integer").addColumn("timestamp","text",(u)=>u.notNull().defaultTo(p_`CURRENT_TIMESTAMP`)).addColumn("requestMetadata","text").execute(),await i.schema.createTable("oauth_clients").addColumn("id","text",(u)=>u.primaryKey()).addColumn("clientId","text",(u)=>u.notNull().unique()).addColumn("clientSecret","text").addColumn("clientName","text",(u)=>u.notNull()).addColumn("redirectUris","text",(u)=>u.notNull()).addColumn("grantTypes","text",(u)=>u.notNull()).addColumn("scope","text").addColumn("clientUri","text").addColumn("logoUri","text").addColumn("createdAt","text",(u)=>u.notNull().defaultTo(p_`CURRENT_TIMESTAMP`)).execute(),await i.schema.createTable("oauth_authorization_codes").addColumn("code","text",(u)=>u.primaryKey()).addColumn("clientId","text",(u)=>u.notNull().references("oauth_clients.clientId").onDelete("cascade")).addColumn("userId","text",(u)=>u.notNull().references("user.id").onDelete("cascade")).addColumn("redirectUri","text",(u)=>u.notNull()).addColumn("scope","text").addColumn("codeChallenge","text").addColumn("codeChallengeMethod","text").addColumn("expiresAt","text",(u)=>u.notNull()).addColumn("createdAt","text",(u)=>u.notNull().defaultTo(p_`CURRENT_TIMESTAMP`)).execute(),await i.schema.createTable("oauth_refresh_tokens").addColumn("token","text",(u)=>u.primaryKey()).addColumn("clientId","text",(u)=>u.notNull().references("oauth_clients.clientId").onDelete("cascade")).addColumn("userId","text",(u)=>u.notNull().references("user.id").onDelete("cascade")).addColumn("scope","text").addColumn("expiresAt","text").addColumn("createdAt","text",(u)=>u.notNull().defaultTo(p_`CURRENT_TIMESTAMP`)).execute(),await i.schema.createTable("downstream_tokens").addColumn("id","text",(u)=>u.primaryKey()).addColumn("connectionId","text",(u)=>u.notNull().references("connections.id").onDelete("cascade")).addColumn("userId","text",(u)=>u.references("user.id").onDelete("cascade")).addColumn("accessToken","text",(u)=>u.notNull()).addColumn("refreshToken","text").addColumn("scope","text").addColumn("expiresAt","text").addColumn("createdAt","text",(u)=>u.notNull().defaultTo(p_`CURRENT_TIMESTAMP`)).addColumn("updatedAt","text",(u)=>u.notNull().defaultTo(p_`CURRENT_TIMESTAMP`)).execute(),await i.schema.createIndex("idx_connections_organizationId").on("connections").column("organizationId").execute(),await i.schema.createIndex("idx_audit_logs_organizationId").on("audit_logs").column("organizationId").execute(),await i.schema.createIndex("idx_audit_logs_userId").on("audit_logs").column("userId").execute(),await i.schema.createIndex("idx_audit_logs_timestamp").on("audit_logs").column("timestamp").execute()}async function PRt(i){await i.schema.dropTable("downstream_tokens").execute(),await i.schema.dropTable("oauth_refresh_tokens").execute(),await i.schema.dropTable("oauth_authorization_codes").execute(),await i.schema.dropTable("oauth_clients").execute(),await i.schema.dropTable("audit_logs").execute(),await i.schema.dropTable("api_keys").execute(),await i.schema.dropTable("connections").execute()}var Nmu=()=>{};var wbi={};Yi(wbi,{up:()=>ARt,down:()=>xRt});import{sql as ymu}from"kysely";async function ARt(i){await i.schema.createTable("organization_settings").addColumn("organizationId","text",(u)=>u.primaryKey().references("organization.id").onDelete("cascade")).addColumn("modelsBindingConnectionId","text",(u)=>u.references("connections.id").onDelete("set null")).addColumn("createdAt","text",(u)=>u.notNull().defaultTo(ymu`CURRENT_TIMESTAMP`)).addColumn("updatedAt","text",(u)=>u.notNull().defaultTo(ymu`CURRENT_TIMESTAMP`)).execute()}async function xRt(i){await i.schema.dropTable("organization_settings").execute()}var Zmu=()=>{};var hbi={};Yi(hbi,{up:()=>kRt,down:()=>GRt});async function kRt(i){await i.schema.alterTable("connections").renameColumn("name","title").execute(),await i.schema.alterTable("connections").renameColumn("createdById","created_by").execute(),await i.schema.alterTable("connections").renameColumn("createdAt","created_at").execute(),await i.schema.alterTable("connections").renameColumn("updatedAt","updated_at").execute(),await i.schema.alterTable("connections").renameColumn("organizationId","organization_id").execute(),await i.schema.alterTable("connections").renameColumn("connectionType","connection_type").execute(),await i.schema.alterTable("connections").renameColumn("connectionUrl","connection_url").execute(),await i.schema.alterTable("connections").renameColumn("connectionToken","connection_token").execute(),await i.schema.alterTable("connections").renameColumn("connectionHeaders","connection_headers").execute(),await i.schema.alterTable("connections").renameColumn("oauthConfig","oauth_config").execute(),await i.schema.alterTable("connections").renameColumn("appName","app_name").execute(),await i.schema.alterTable("connections").renameColumn("appId","app_id").execute()}async function GRt(i){await i.schema.alterTable("connections").renameColumn("title","name").execute(),await i.schema.alterTable("connections").renameColumn("created_by","createdById").execute(),await i.schema.alterTable("connections").renameColumn("created_at","createdAt").execute(),await i.schema.alterTable("connections").renameColumn("updated_at","updatedAt").execute(),await i.schema.alterTable("connections").renameColumn("organization_id","organizationId").execute(),await i.schema.alterTable("connections").renameColumn("connection_type","connectionType").execute(),await i.schema.alterTable("connections").renameColumn("connection_url","connectionUrl").execute(),await i.schema.alterTable("connections").renameColumn("connection_token","connectionToken").execute(),await i.schema.alterTable("connections").renameColumn("connection_headers","connectionHeaders").execute(),await i.schema.alterTable("connections").renameColumn("oauth_config","oauthConfig").execute(),await i.schema.alterTable("connections").renameColumn("app_name","appName").execute(),await i.schema.alterTable("connections").renameColumn("app_id","appId").execute()}var _bi={};Yi(_bi,{up:()=>SRt,down:()=>jRt});async function SRt(i){await i.schema.createTable("organization_settings_new").addColumn("organizationId","text",(u)=>u.primaryKey().references("organization.id").onDelete("cascade")).addColumn("createdAt","text",(u)=>u.notNull()).addColumn("updatedAt","text",(u)=>u.notNull()).execute(),await i.insertInto("organization_settings_new").columns(["organizationId","createdAt","updatedAt"]).expression((u)=>u.selectFrom("organization_settings").select(["organizationId","createdAt","updatedAt"])).execute(),await i.schema.dropTable("organization_settings").execute(),await i.schema.alterTable("organization_settings_new").renameTo("organization_settings").execute()}async function jRt(i){await i.schema.createTable("organization_settings_new").addColumn("organizationId","text",(u)=>u.primaryKey().references("organization.id").onDelete("cascade")).addColumn("modelsBindingConnectionId","text",(u)=>u.references("connections.id").onDelete("set null")).addColumn("createdAt","text",(u)=>u.notNull()).addColumn("updatedAt","text",(u)=>u.notNull()).execute(),await i.insertInto("organization_settings_new").columns(["organizationId","modelsBindingConnectionId","createdAt","updatedAt"]).expression((u)=>u.selectFrom("organization_settings").select(["organizationId",u.val(null).as("modelsBindingConnectionId"),"createdAt","updatedAt"])).execute(),await i.schema.dropTable("organization_settings").execute(),await i.schema.alterTable("organization_settings_new").renameTo("organization_settings").execute()}var vbi={};Yi(vbi,{up:()=>KRt,down:()=>JRt});async function KRt(i){await i.schema.alterTable("connections").addColumn("configuration_state","text").execute(),await i.schema.alterTable("connections").addColumn("configuration_scopes","text").execute()}async function JRt(i){await i.schema.alterTable("connections").dropColumn("configuration_state").execute(),await i.schema.alterTable("connections").dropColumn("configuration_scopes").execute()}var nbi={};Yi(nbi,{up:()=>LRt,down:()=>WRt});import{sql as XRt}from"kysely";async function LRt(i){await i.schema.alterTable("organization_settings").addColumn("sidebar_items",XRt`text`).execute()}async function WRt(i){await i.schema.alterTable("organization_settings").dropColumn("sidebar_items").execute()}var Tmu=()=>{};var Dbi={};Yi(Dbi,{up:()=>YRt,down:()=>zRt});async function YRt(i){await i.schema.createTable("monitoring_logs").addColumn("id","text",(u)=>u.primaryKey()).addColumn("organization_id","text",(u)=>u.notNull().references("organization.id").onDelete("cascade")).addColumn("connection_id","text",(u)=>u.notNull().references("connections.id").onDelete("cascade")).addColumn("connection_title","text",(u)=>u.notNull()).addColumn("tool_name","text",(u)=>u.notNull()).addColumn("input","text",(u)=>u.notNull()).addColumn("output","text",(u)=>u.notNull()).addColumn("is_error","integer",(u)=>u.notNull()).addColumn("error_message","text").addColumn("duration_ms","integer",(u)=>u.notNull()).addColumn("timestamp","text",(u)=>u.notNull()).addColumn("user_id","text").addColumn("request_id","text",(u)=>u.notNull()).execute(),await i.schema.createIndex("monitoring_logs_org_timestamp").on("monitoring_logs").columns(["organization_id","timestamp"]).execute(),await i.schema.createIndex("monitoring_logs_connection_timestamp").on("monitoring_logs").columns(["connection_id","timestamp"]).execute(),await i.schema.createIndex("monitoring_logs_is_error").on("monitoring_logs").columns(["organization_id","is_error","timestamp"]).execute()}async function zRt(i){await i.schema.dropIndex("monitoring_logs_is_error").execute(),await i.schema.dropIndex("monitoring_logs_connection_timestamp").execute(),await i.schema.dropIndex("monitoring_logs_org_timestamp").execute(),await i.schema.dropTable("monitoring_logs").execute()}var gbi={};Yi(gbi,{up:()=>QRt,down:()=>HRt});import{sql as xM}from"kysely";async function QRt(i){await i.schema.createTable("events").addColumn("id","text",(u)=>u.primaryKey()).addColumn("organization_id","text",(u)=>u.notNull().references("organization.id").onDelete("cascade")).addColumn("type","text",(u)=>u.notNull()).addColumn("source","text",(u)=>u.notNull()).addColumn("specversion","text",(u)=>u.notNull().defaultTo("1.0")).addColumn("subject","text").addColumn("time","text",(u)=>u.notNull()).addColumn("datacontenttype","text",(u)=>u.notNull().defaultTo("application/json")).addColumn("dataschema","text").addColumn("data","text").addColumn("cron","varchar(255)").addColumn("status","text",(u)=>u.notNull().defaultTo("pending")).addColumn("attempts","integer",(u)=>u.notNull().defaultTo(0)).addColumn("last_error","text").addColumn("next_retry_at","text").addColumn("created_at","text",(u)=>u.notNull().defaultTo(xM`CURRENT_TIMESTAMP`)).addColumn("updated_at","text",(u)=>u.notNull().defaultTo(xM`CURRENT_TIMESTAMP`)).execute(),await i.schema.createTable("event_subscriptions").addColumn("id","text",(u)=>u.primaryKey()).addColumn("organization_id","text",(u)=>u.notNull().references("organization.id").onDelete("cascade")).addColumn("connection_id","text",(u)=>u.notNull().references("connections.id").onDelete("cascade")).addColumn("publisher","text").addColumn("event_type","text",(u)=>u.notNull()).addColumn("filter","text").addColumn("enabled","integer",(u)=>u.notNull().defaultTo(1)).addColumn("created_at","text",(u)=>u.notNull().defaultTo(xM`CURRENT_TIMESTAMP`)).addColumn("updated_at","text",(u)=>u.notNull().defaultTo(xM`CURRENT_TIMESTAMP`)).execute(),await i.schema.createTable("event_deliveries").addColumn("id","text",(u)=>u.primaryKey()).addColumn("event_id","text",(u)=>u.notNull()).addColumn("subscription_id","text",(u)=>u.notNull().references("event_subscriptions.id").onDelete("cascade")).addColumn("status","text",(u)=>u.notNull().defaultTo("pending")).addColumn("attempts","integer",(u)=>u.notNull().defaultTo(0)).addColumn("last_error","text").addColumn("delivered_at","text").addColumn("next_retry_at","text").addColumn("created_at","text",(u)=>u.notNull().defaultTo(xM`CURRENT_TIMESTAMP`)).execute(),await i.schema.createIndex("idx_events_org_status").on("events").columns(["organization_id","status"]).execute(),await i.schema.createIndex("idx_events_source").on("events").columns(["source"]).execute(),await i.schema.createIndex("idx_events_type").on("events").columns(["type"]).execute(),await i.schema.createIndex("idx_events_retry").on("events").columns(["status","next_retry_at"]).execute(),await i.schema.createIndex("idx_subscriptions_connection").on("event_subscriptions").columns(["connection_id"]).execute(),await i.schema.createIndex("idx_subscriptions_type").on("event_subscriptions").columns(["event_type"]).execute(),await i.schema.createIndex("idx_subscriptions_org_enabled").on("event_subscriptions").columns(["organization_id","enabled"]).execute(),await i.schema.createIndex("idx_subscriptions_unique").on("event_subscriptions").columns(["connection_id","event_type","publisher","filter"]).unique().execute(),await i.schema.createIndex("idx_deliveries_event").on("event_deliveries").columns(["event_id"]).execute(),await i.schema.createIndex("idx_deliveries_subscription_status").on("event_deliveries").columns(["subscription_id","status"]).execute(),await i.schema.createIndex("idx_deliveries_retry").on("event_deliveries").columns(["status","next_retry_at"]).execute()}async function HRt(i){await i.schema.dropIndex("idx_deliveries_retry").execute(),await i.schema.dropIndex("idx_deliveries_subscription_status").execute(),await i.schema.dropIndex("idx_deliveries_event").execute(),await i.schema.dropIndex("idx_subscriptions_unique").execute(),await i.schema.dropIndex("idx_subscriptions_org_enabled").execute(),await i.schema.dropIndex("idx_subscriptions_type").execute(),await i.schema.dropIndex("idx_subscriptions_connection").execute(),await i.schema.dropIndex("idx_events_retry").execute(),await i.schema.dropIndex("idx_events_type").execute(),await i.schema.dropIndex("idx_events_source").execute(),await i.schema.dropIndex("idx_events_org_status").execute(),await i.schema.dropTable("event_deliveries").execute(),await i.schema.dropTable("event_subscriptions").execute(),await i.schema.dropTable("events").execute()}var Bmu=()=>{};var Obi={};Yi(Obi,{up:()=>RRt,down:()=>CRt});import{sql as bRt}from"kysely";async function RRt(i){await i.schema.dropTable("audit_logs").ifExists().execute()}async function CRt(i){await i.schema.createTable("audit_logs").ifNotExists().addColumn("id","text",(u)=>u.primaryKey()).addColumn("organizationId","text").addColumn("userId","text",(u)=>u.references("user.id").onDelete("set null")).addColumn("connectionId","text",(u)=>u.references("connections.id").onDelete("set null")).addColumn("toolName","text",(u)=>u.notNull()).addColumn("allowed","integer",(u)=>u.notNull()).addColumn("duration","integer").addColumn("timestamp","text",(u)=>u.notNull().defaultTo(bRt`CURRENT_TIMESTAMP`)).addColumn("requestMetadata","text").execute(),await i.schema.createIndex("idx_audit_logs_organizationId").on("audit_logs").column("organizationId").execute(),await i.schema.createIndex("idx_audit_logs_userId").on("audit_logs").column("userId").execute(),await i.schema.createIndex("idx_audit_logs_timestamp").on("audit_logs").column("timestamp").execute()}var Fmu=()=>{};var Nbi={};Yi(Nbi,{up:()=>MRt,down:()=>qRt});import{sql as h1i}from"kysely";async function MRt(i){await i.schema.createTable("gateways").addColumn("id","text",(u)=>u.primaryKey()).addColumn("organization_id","text",(u)=>u.notNull().references("organization.id").onDelete("cascade")).addColumn("title","text",(u)=>u.notNull()).addColumn("description","text").addColumn("tool_selection_strategy","text").addColumn("status","text",(u)=>u.notNull().defaultTo("active")).addColumn("is_default","integer",(u)=>u.notNull().defaultTo(0)).addColumn("created_at","text",(u)=>u.notNull().defaultTo(h1i`CURRENT_TIMESTAMP`)).addColumn("updated_at","text",(u)=>u.notNull().defaultTo(h1i`CURRENT_TIMESTAMP`)).addColumn("created_by","text",(u)=>u.notNull().references("user.id").onDelete("cascade")).addColumn("updated_by","text").execute(),await i.schema.createTable("gateway_connections").addColumn("id","text",(u)=>u.primaryKey()).addColumn("gateway_id","text",(u)=>u.notNull().references("gateways.id").onDelete("cascade")).addColumn("connection_id","text",(u)=>u.notNull().references("connections.id").onDelete("cascade")).addColumn("selected_tools","text").addColumn("created_at","text",(u)=>u.notNull().defaultTo(h1i`CURRENT_TIMESTAMP`)).execute(),await i.schema.createIndex("idx_gateways_org").on("gateways").columns(["organization_id"]).execute(),await i.schema.createIndex("idx_gateways_org_status").on("gateways").columns(["organization_id","status"]).execute(),await h1i`CREATE UNIQUE INDEX idx_gateways_default_per_org ON gateways (organization_id) WHERE is_default = 1`.execute(i),await i.schema.createIndex("idx_gateway_connections_gateway").on("gateway_connections").columns(["gateway_id"]).execute(),await i.schema.createIndex("idx_gateway_connections_connection").on("gateway_connections").columns(["connection_id"]).execute(),await i.schema.createIndex("idx_gateway_connections_unique").on("gateway_connections").columns(["gateway_id","connection_id"]).unique().execute()}async function qRt(i){await i.schema.dropIndex("idx_gateway_connections_unique").execute(),await i.schema.dropIndex("idx_gateway_connections_connection").execute(),await i.schema.dropIndex("idx_gateway_connections_gateway").execute(),await i.schema.dropIndex("idx_gateways_default_per_org").execute(),await i.schema.dropIndex("idx_gateways_org_status").execute(),await i.schema.dropIndex("idx_gateways_org").execute(),await i.schema.dropTable("gateway_connections").execute(),await i.schema.dropTable("gateways").execute()}var Umu=()=>{};var ybi={};Yi(ybi,{up:()=>VRt,down:()=>rRt});async function VRt(i){await i.schema.alterTable("gateways").addColumn("icon","text").execute()}async function rRt(i){await i.schema.alterTable("gateways").dropColumn("icon").execute()}var Zbi={};Yi(Zbi,{up:()=>mRt,down:()=>eRt});import{sql as _1i}from"kysely";async function mRt(i){await i.schema.alterTable("gateways").addColumn("tool_selection_mode","text",(u)=>u.notNull().defaultTo("inclusion")).execute(),await _1i`
     UPDATE gateways
     SET tool_selection_mode = CASE
@@ -86491,7 +86491,7 @@ ${zjf}`:""}
 `);let f=u.pax;if(f)for(let l in f)t+=Alu(" "+l+"="+f[l]+`
 `);return rf.from(t)};aQf.decodePax=function(u){let t={};while(u.length){let f=0;while(f<u.length&&u[f]!==32)f++;let l=parseInt(rf.toString(u.subarray(0,f)),10);if(!l)return t;let c=rf.toString(u.subarray(f+1,l-1)),E=c.indexOf("=");if(E===-1)return t;t[c.slice(0,E)]=c.slice(E+1),u=u.subarray(l)}return t};aQf.encode=function(u){let t=rf.alloc(512),f=u.name,l="";if(u.typeflag===5&&f[f.length-1]!=="/")f+="/";if(rf.byteLength(f)!==f.length)return null;while(rf.byteLength(f)>100){let c=f.indexOf("/");if(c===-1)return null;l+=l?"/"+f.slice(0,c):f.slice(0,c),f=f.slice(c+1)}if(rf.byteLength(f)>100||rf.byteLength(l)>155)return null;if(u.linkname&&rf.byteLength(u.linkname)>100)return null;if(rf.write(t,f),rf.write(t,I7(u.mode&4095,6),100),rf.write(t,I7(u.uid,6),108),rf.write(t,I7(u.gid,6),116),mQf(u.size,t,124),rf.write(t,I7(u.mtime.getTime()/1000|0,11),136),t[156]=48+VQf(u.type),u.linkname)rf.write(t,u.linkname,157);if(rf.copy(Bx0,t,257),rf.copy(QQf,t,263),u.uname)rf.write(t,u.uname,265);if(u.gname)rf.write(t,u.gname,297);if(rf.write(t,I7(u.devmajor||0,6),329),rf.write(t,I7(u.devminor||0,6),337),l)rf.write(t,l,345);return rf.write(t,I7(Ux0(t),6),148),t};aQf.decode=function(u,t,f){let l=u[156]===0?0:u[156]-48,c=kQ(u,0,100,t),E=U7(u,100,8),d=U7(u,108,8),$=U7(u,116,8),w=U7(u,124,12),h=U7(u,136,12),_=qQf(l),v=u[157]===0?null:kQ(u,157,100,t),n=kQ(u,265,32),D=kQ(u,297,32),O=U7(u,329,8),N=U7(u,337,8),y=Ux0(u);if(y===256)return null;if(y!==U7(u,148,8))throw Error("Invalid tar header. Maybe the tar is corrupted or it needs to be gunzipped?");if(RQf(u)){if(u[345])c=kQ(u,345,155,t)+"/"+c}else if(CQf(u));else if(!f)throw Error("Invalid tar header: unknown format.");if(l===0&&c&&c[c.length-1]==="/")l=5;return{name:c,mode:E,uid:d,gid:$,size:w,mtime:new Date(1000*h),type:_,linkname:v,uname:n,gname:D,devmajor:O,devminor:N,pax:null}};function RQf(i){return rf.equals(Bx0,i.subarray(257,263))}function CQf(i){return rf.equals(HQf,i.subarray(257,263))&&rf.equals(bQf,i.subarray(263,265))}function MQf(i,u,t){if(typeof i!=="number")return t;if(i=~~i,i>=u)return u;if(i>=0)return i;if(i+=u,i>=0)return i;return 0}function qQf(i){switch(i){case 0:return"file";case 1:return"link";case 2:return"symlink";case 3:return"character-device";case 4:return"block-device";case 5:return"directory";case 6:return"fifo";case 7:return"contiguous-file";case 72:return"pax-header";case 55:return"pax-global-header";case 27:return"gnu-long-link-path";case 28:case 30:return"gnu-long-path"}return null}function VQf(i){switch(i){case"file":return 0;case"link":return 1;case"symlink":return 2;case"character-device":return 3;case"block-device":return 4;case"directory":return 5;case"fifo":return 6;case"contiguous-file":return 7;case"pax-header":return 72}return 0}function Fx0(i,u,t,f){for(;t<f;t++)if(i[t]===u)return t;return f}function Ux0(i){let u=256;for(let t=0;t<148;t++)u+=i[t];for(let t=156;t<512;t++)u+=i[t];return u}function I7(i,u){if(i=i.toString(8),i.length>u)return"7777777777777777777".slice(0,u)+" ";return"0000000000000000000".slice(0,u-i.length)+i+" "}function rQf(i,u,t){u[t]=128;for(let f=11;f>0;f--)u[t+f]=i&255,i=Math.floor(i/256)}function mQf(i,u,t){if(i.toString(8).length>11)rQf(i,u,t);else rf.write(u,I7(i,11),t)}function eQf(i){let u;if(i[0]===128)u=!0;else if(i[0]===255)u=!1;else return null;let t=[],f;for(f=i.length-1;f>0;f--){let E=i[f];if(u)t.push(E);else t.push(255-E)}let l=0,c=t.length;for(f=0;f<c;f++)l+=t[f]*Math.pow(256,f);return u?l:-1*l}function U7(i,u,t){if(i=i.subarray(u,u+t),u=0,i[u]&128)return eQf(i);else{while(u<i.length&&i[u]===32)u++;let f=MQf(Fx0(i,32,u,i.length),i.length,i.length);while(u<f&&i[u]===0)u++;if(f===u)return 0;return parseInt(rf.toString(i.subarray(u,f)),8)}}function kQ(i,u,t,f){return rf.toString(i.subarray(u,Fx0(i,0,u,u+t)),f)}function Alu(i){let u=rf.byteLength(i),t=Math.floor(Math.log(u)/Math.log(10))+1;if(u+t>=Math.pow(10,t))t++;return u+t+i}});var jx0=K((iEc,Sx0)=>{var{Writable:tHf,Readable:fHf,getStreamError:Ix0}=Plu(),lHf=Zlu(),Px0=xQ(),GQ=xlu(),cHf=Px0.alloc(0);class Ax0{constructor(){this.buffered=0,this.shifted=0,this.queue=new lHf,this._offset=0}push(i){this.buffered+=i.byteLength,this.queue.push(i)}shiftFirst(i){return this._buffered===0?null:this._next(i)}shift(i){if(i>this.buffered)return null;if(i===0)return cHf;let u=this._next(i);if(i===u.byteLength)return u;let t=[u];while((i-=u.byteLength)>0)u=this._next(i),t.push(u);return Px0.concat(t)}_next(i){let u=this.queue.peek(),t=u.byteLength-this._offset;if(i>=t){let f=this._offset?u.subarray(this._offset,u.byteLength):u;return this.queue.shift(),this._offset=0,this.buffered-=t,this.shifted+=t,f}return this.buffered-=i,this.shifted+=i,u.subarray(this._offset,this._offset+=i)}}class xx0 extends fHf{constructor(i,u,t){super();this.header=u,this.offset=t,this._parent=i}_read(i){if(this.header.size===0)this.push(null);if(this._parent._stream===this)this._parent._update();i(null)}_predestroy(){this._parent.destroy(Ix0(this))}_detach(){if(this._parent._stream===this)this._parent._stream=null,this._parent._missing=Gx0(this.header.size),this._parent._update()}_destroy(i){this._detach(),i(null)}}class kx0 extends tHf{constructor(i){super(i);if(!i)i={};this._buffer=new Ax0,this._offset=0,this._header=null,this._stream=null,this._missing=0,this._longHeader=!1,this._callback=klu,this._locked=!1,this._finished=!1,this._pax=null,this._paxGlobal=null,this._gnuLongPath=null,this._gnuLongLinkPath=null,this._filenameEncoding=i.filenameEncoding||"utf-8",this._allowUnknownFormat=!!i.allowUnknownFormat,this._unlockBound=this._unlock.bind(this)}_unlock(i){if(this._locked=!1,i){this.destroy(i),this._continueWrite(i);return}this._update()}_consumeHeader(){if(this._locked)return!1;this._offset=this._buffer.shifted;try{this._header=GQ.decode(this._buffer.shift(512),this._filenameEncoding,this._allowUnknownFormat)}catch(i){return this._continueWrite(i),!1}if(!this._header)return!0;switch(this._header.type){case"gnu-long-path":case"gnu-long-link-path":case"pax-global-header":case"pax-header":return this._longHeader=!0,this._missing=this._header.size,!0}if(this._locked=!0,this._applyLongHeaders(),this._header.size===0||this._header.type==="directory")return this.emit("entry",this._header,this._createStream(),this._unlockBound),!0;return this._stream=this._createStream(),this._missing=this._header.size,this.emit("entry",this._header,this._stream,this._unlockBound),!0}_applyLongHeaders(){if(this._gnuLongPath)this._header.name=this._gnuLongPath,this._gnuLongPath=null;if(this._gnuLongLinkPath)this._header.linkname=this._gnuLongLinkPath,this._gnuLongLinkPath=null;if(this._pax){if(this._pax.path)this._header.name=this._pax.path;if(this._pax.linkpath)this._header.linkname=this._pax.linkpath;if(this._pax.size)this._header.size=parseInt(this._pax.size,10);this._header.pax=this._pax,this._pax=null}}_decodeLongHeader(i){switch(this._header.type){case"gnu-long-path":this._gnuLongPath=GQ.decodeLongPath(i,this._filenameEncoding);break;case"gnu-long-link-path":this._gnuLongLinkPath=GQ.decodeLongPath(i,this._filenameEncoding);break;case"pax-global-header":this._paxGlobal=GQ.decodePax(i);break;case"pax-header":this._pax=this._paxGlobal===null?GQ.decodePax(i):Object.assign({},this._paxGlobal,GQ.decodePax(i));break}}_consumeLongHeader(){this._longHeader=!1,this._missing=Gx0(this._header.size);let i=this._buffer.shift(this._header.size);try{this._decodeLongHeader(i)}catch(u){return this._continueWrite(u),!1}return!0}_consumeStream(){let i=this._buffer.shiftFirst(this._missing);if(i===null)return!1;this._missing-=i.byteLength;let u=this._stream.push(i);if(this._missing===0){if(this._stream.push(null),u)this._stream._detach();return u&&this._locked===!1}return u}_createStream(){return new xx0(this,this._header,this._offset)}_update(){while(this._buffer.buffered>0&&!this.destroying){if(this._missing>0){if(this._stream!==null){if(this._consumeStream()===!1)return;continue}if(this._longHeader===!0){if(this._missing>this._buffer.buffered)break;if(this._consumeLongHeader()===!1)return!1;continue}let i=this._buffer.shiftFirst(this._missing);if(i!==null)this._missing-=i.byteLength;continue}if(this._buffer.buffered<512)break;if(this._stream!==null||this._consumeHeader()===!1)return}this._continueWrite(null)}_continueWrite(i){let u=this._callback;this._callback=klu,u(i)}_write(i,u){this._callback=u,this._buffer.push(i),this._update()}_final(i){this._finished=this._missing===0&&this._buffer.buffered===0,i(this._finished?null:Error("Unexpected end of data"))}_predestroy(){this._continueWrite(null)}_destroy(i){if(this._stream)this._stream.destroy(Ix0(this));i(null)}[Symbol.asyncIterator](){let i=null,u=null,t=null,f=null,l=null,c=this;return this.on("entry",$),this.on("error",(_)=>{i=_}),this.on("close",w),{[Symbol.asyncIterator](){return this},next(){return new Promise(d)},return(){return h(null)},throw(_){return h(_)}};function E(_){if(!l)return;let v=l;l=null,v(_)}function d(_,v){if(i)return v(i);if(f){_({value:f,done:!1}),f=null;return}if(u=_,t=v,E(null),c._finished&&u)u({value:void 0,done:!0}),u=t=null}function $(_,v,n){if(l=n,v.on("error",klu),u)u({value:v,done:!1}),u=t=null;else f=v}function w(){if(E(i),!u)return;if(i)t(i);else u({value:void 0,done:!0});u=t=null}function h(_){return c.destroy(_),E(_),new Promise((v,n)=>{if(c.destroyed)return v({value:void 0,done:!0});c.once("close",function(){if(_)n(_);else v({value:void 0,done:!0})})})}}}Sx0.exports=function(u){return new kx0(u)};function klu(){}function Gx0(i){return i&=511,i&&512-i}});var Jx0=K((uEc,Glu)=>{var Kx0={S_IFMT:61440,S_IFDIR:16384,S_IFCHR:8192,S_IFBLK:24576,S_IFIFO:4096,S_IFLNK:40960};try{Glu.exports=Ni("fs").constants||Kx0}catch{Glu.exports=Kx0}});var Hx0=K((tEc,Qx0)=>{var{Readable:EHf,Writable:dHf,getStreamError:Xx0}=Plu(),NK=xQ(),SQ=Jx0(),IZi=xlu(),Lx0=NK.alloc(1024);class Wx0 extends dHf{constructor(i,u,t){super({mapWritable:wHf,eagerOpen:!0});if(this.written=0,this.header=u,this._callback=t,this._linkname=null,this._isLinkname=u.type==="symlink"&&!u.linkname,this._isVoid=u.type!=="file"&&u.type!=="contiguous-file",this._finished=!1,this._pack=i,this._openCallback=null,this._pack._stream===null)this._pack._stream=this;else this._pack._pending.push(this)}_open(i){if(this._openCallback=i,this._pack._stream===this)this._continueOpen()}_continuePack(i){if(this._callback===null)return;let u=this._callback;this._callback=null,u(i)}_continueOpen(){if(this._pack._stream===null)this._pack._stream=this;let i=this._openCallback;if(this._openCallback=null,i===null)return;if(this._pack.destroying)return i(Error("pack stream destroyed"));if(this._pack._finalized)return i(Error("pack stream is already finalized"));if(this._pack._stream=this,!this._isLinkname)this._pack._encode(this.header);if(this._isVoid)this._finish(),this._continuePack(null);i(null)}_write(i,u){if(this._isLinkname)return this._linkname=this._linkname?NK.concat([this._linkname,i]):i,u(null);if(this._isVoid){if(i.byteLength>0)return u(Error("No body allowed for this entry"));return u()}if(this.written+=i.byteLength,this._pack.push(i))return u();this._pack._drain=u}_finish(){if(this._finished)return;if(this._finished=!0,this._isLinkname)this.header.linkname=this._linkname?NK.toString(this._linkname,"utf-8"):"",this._pack._encode(this.header);zx0(this._pack,this.header.size),this._pack._done(this)}_final(i){if(this.written!==this.header.size)return i(Error("Size mismatch"));this._finish(),i(null)}_getError(){return Xx0(this)||Error("tar entry destroyed")}_predestroy(){this._pack.destroy(this._getError())}_destroy(i){this._pack._done(this),this._continuePack(this._finished?null:this._getError()),i()}}class Yx0 extends EHf{constructor(i){super(i);this._drain=Slu,this._finalized=!1,this._finalizing=!1,this._pending=[],this._stream=null}entry(i,u,t){if(this._finalized||this.destroying)throw Error("already finalized or destroyed");if(typeof u==="function")t=u,u=null;if(!t)t=Slu;if(!i.size||i.type==="symlink")i.size=0;if(!i.type)i.type=$Hf(i.mode);if(!i.mode)i.mode=i.type==="directory"?493:420;if(!i.uid)i.uid=0;if(!i.gid)i.gid=0;if(!i.mtime)i.mtime=new Date;if(typeof u==="string")u=NK.from(u);let f=new Wx0(this,i,t);if(NK.isBuffer(u))return i.size=u.byteLength,f.write(u),f.end(),f;if(f._isVoid)return f;return f}finalize(){if(this._stream||this._pending.length>0){this._finalizing=!0;return}if(this._finalized)return;this._finalized=!0,this.push(Lx0),this.push(null)}_done(i){if(i!==this._stream)return;if(this._stream=null,this._finalizing)this.finalize();if(this._pending.length)this._pending.shift()._continueOpen()}_encode(i){if(!i.pax){let u=IZi.encode(i);if(u){this.push(u);return}}this._encodePax(i)}_encodePax(i){let u=IZi.encodePax({name:i.name,linkname:i.linkname,pax:i.pax}),t={name:"PaxHeader",mode:i.mode,uid:i.uid,gid:i.gid,size:u.byteLength,mtime:i.mtime,type:"pax-header",linkname:i.linkname&&"PaxHeader",uname:i.uname,gname:i.gname,devmajor:i.devmajor,devminor:i.devminor};this.push(IZi.encode(t)),this.push(u),zx0(this,u.byteLength),t.size=i.size,t.type=i.type,this.push(IZi.encode(t))}_doDrain(){let i=this._drain;this._drain=Slu,i()}_predestroy(){let i=Xx0(this);if(this._stream)this._stream.destroy(i);while(this._pending.length){let u=this._pending.shift();u.destroy(i),u._continueOpen()}this._doDrain()}_read(i){this._doDrain(),i()}}Qx0.exports=function(u){return new Yx0(u)};function $Hf(i){switch(i&SQ.S_IFMT){case SQ.S_IFBLK:return"block-device";case SQ.S_IFCHR:return"character-device";case SQ.S_IFDIR:return"directory";case SQ.S_IFIFO:return"fifo";case SQ.S_IFLNK:return"symlink"}return"file"}function Slu(){}function zx0(i,u){if(u&=511,u)i.push(Lx0.subarray(0,512-u))}function wHf(i){return NK.isBuffer(i)?i:NK.from(i)}});var bx0=K((hHf)=>{hHf.extract=jx0();hHf.pack=Hx0()});var Mx0=K((lEc,Cx0)=>{Cx0.exports=Rx0;function Rx0(i,u){if(i&&u)return Rx0(i)(u);if(typeof i!=="function")throw TypeError("need wrapper function");return Object.keys(i).forEach(function(f){t[f]=i[f]}),t;function t(){var f=Array(arguments.length);for(var l=0;l<f.length;l++)f[l]=arguments[l];var c=i.apply(this,f),E=f[f.length-1];if(typeof c==="function"&&c!==E)Object.keys(E).forEach(function(d){c[d]=E[d]});return c}}});var Klu=K((cEc,jlu)=>{var qx0=Mx0();jlu.exports=qx0(PZi);jlu.exports.strict=qx0(Vx0);PZi.proto=PZi(function(){Object.defineProperty(Function.prototype,"once",{value:function(){return PZi(this)},configurable:!0}),Object.defineProperty(Function.prototype,"onceStrict",{value:function(){return Vx0(this)},configurable:!0})});function PZi(i){var u=function(){if(u.called)return u.value;return u.called=!0,u.value=i.apply(this,arguments)};return u.called=!1,u}function Vx0(i){var u=function(){if(u.called)throw Error(u.onceError);return u.called=!0,u.value=i.apply(this,arguments)},t=i.name||"Function wrapped with `once`";return u.onceError=t+" shouldn't be called more than once",u.called=!1,u}});var ex0=K((EEc,mx0)=>{var nHf=Klu(),DHf=function(){},gHf=global.Bare?queueMicrotask:process.nextTick.bind(process),OHf=function(i){return i.setHeader&&typeof i.abort==="function"},NHf=function(i){return i.stdio&&Array.isArray(i.stdio)&&i.stdio.length===3},rx0=function(i,u,t){if(typeof u==="function")return rx0(i,null,u);if(!u)u={};t=nHf(t||DHf);var{_writableState:f,_readableState:l}=i,c=u.readable||u.readable!==!1&&i.readable,E=u.writable||u.writable!==!1&&i.writable,d=!1,$=function(){if(!i.writable)w()},w=function(){if(E=!1,!c)t.call(i)},h=function(){if(c=!1,!E)t.call(i)},_=function(N){t.call(i,N?Error("exited with error code: "+N):null)},v=function(N){t.call(i,N)},n=function(){gHf(D)},D=function(){if(d)return;if(c&&!(l&&(l.ended&&!l.destroyed)))return t.call(i,Error("premature close"));if(E&&!(f&&(f.ended&&!f.destroyed)))return t.call(i,Error("premature close"))},O=function(){i.req.on("finish",w)};if(OHf(i))if(i.on("complete",w),i.on("abort",n),i.req)O();else i.on("request",O);else if(E&&!f)i.on("end",$),i.on("close",$);if(NHf(i))i.on("exit",_);if(i.on("end",h),i.on("finish",w),u.error!==!1)i.on("error",v);return i.on("close",n),function(){if(d=!0,i.removeListener("complete",w),i.removeListener("abort",n),i.removeListener("request",O),i.req)i.req.removeListener("finish",w);i.removeListener("end",$),i.removeListener("close",$),i.removeListener("finish",w),i.removeListener("exit",_),i.removeListener("end",h),i.removeListener("error",v),i.removeListener("close",n)}};mx0.exports=rx0});var sx0=K((dEc,ox0)=>{var yHf=Klu(),ZHf=ex0(),AZi;try{AZi=Ni("fs")}catch(i){}var Va=function(){},THf=typeof process>"u"?!1:/^v?\.0/.test(process.version),xZi=function(i){return typeof i==="function"},BHf=function(i){if(!THf)return!1;if(!AZi)return!1;return(i instanceof(AZi.ReadStream||Va)||i instanceof(AZi.WriteStream||Va))&&xZi(i.close)},FHf=function(i){return i.setHeader&&xZi(i.abort)},UHf=function(i,u,t,f){f=yHf(f);var l=!1;i.on("close",function(){l=!0}),ZHf(i,{readable:u,writable:t},function(E){if(E)return f(E);l=!0,f()});var c=!1;return function(E){if(l)return;if(c)return;if(c=!0,BHf(i))return i.close(Va);if(FHf(i))return i.abort();if(xZi(i.destroy))return i.destroy();f(E||Error("stream was destroyed"))}},ax0=function(i){i()},IHf=function(i,u){return i.pipe(u)},PHf=function(){var i=Array.prototype.slice.call(arguments),u=xZi(i[i.length-1]||Va)&&i.pop()||Va;if(Array.isArray(i[0]))i=i[0];if(i.length<2)throw Error("pump requires two streams per minimum");var t,f=i.map(function(l,c){var E=c<i.length-1,d=c>0;return UHf(l,E,d,function($){if(!t)t=$;if($)f.forEach(ax0);if(E)return;f.forEach(ax0),u(t)})});return i.reduce(IHf)};ox0.exports=PHf});var dk0=K((GHf)=>{var px0=bx0(),ik0=sx0(),uk0=Ni("fs"),D1=Ni("path"),ra=(global.Bare?global.Bare.platform:process.platform)==="win32";GHf.pack=function(u,t){if(!u)u=".";if(!t)t={};let f=t.fs||uk0,l=t.ignore||t.filter||ma,c=t.mapStream||ck0,E=kHf(f,t.dereference?f.stat:f.lstat,u,l,t.entries,t.sort),d=t.strict!==!1,$=typeof t.umask==="number"?~t.umask:~tk0(),w=t.pack||px0.pack(),h=t.finish||ma,_=t.map||ma,v=typeof t.dmode==="number"?t.dmode:0,n=typeof t.fmode==="number"?t.fmode:0;if(t.strip)_=Ek0(_,t.strip);if(t.readable)v|=parseInt(555,8),n|=parseInt(444,8);if(t.writable)v|=parseInt(333,8),n|=parseInt(222,8);N();function D(y,Z){f.readlink(D1.join(u,y),function(T,B){if(T)return w.destroy(T);Z.linkname=Jlu(B),w.entry(Z,N)})}function O(y,Z,T){if(w.destroyed)return;if(y)return w.destroy(y);if(!Z){if(t.finalize!==!1)w.finalize();return h(w)}if(T.isSocket())return N();let B={name:Jlu(Z),mode:(T.mode|(T.isDirectory()?v:n))&$,mtime:T.mtime,size:T.size,type:"file",uid:T.uid,gid:T.gid};if(T.isDirectory())return B.size=0,B.type="directory",B=_(B)||B,w.entry(B,N);if(T.isSymbolicLink())return B.size=0,B.type="symlink",B=_(B)||B,D(Z,B);if(B=_(B)||B,!T.isFile()){if(d)return w.destroy(Error("unsupported type for "+Z));return N()}let F=w.entry(B,N),P=c(f.createReadStream(D1.join(u,Z),{start:0,end:B.size>0?B.size-1:B.size}),B);P.on("error",function(S){F.destroy(S)}),ik0(P,F)}function N(y){if(y)return w.destroy(y);E(O)}return w};function AHf(i){return i.length?i[i.length-1]:null}function xHf(){return!global.Bare&&process.getuid?process.getuid():-1}function tk0(){return!global.Bare&&process.umask?process.umask():0}GHf.extract=function(u,t){if(!u)u=".";if(!t)t={};u=D1.resolve(u);let f=t.fs||uk0,l=t.ignore||t.filter||ma,c=t.mapStream||ck0,E=t.chown!==!1&&!ra&&xHf()===0,d=t.extract||px0.extract(),$=[],w=new Date,h=typeof t.umask==="number"?~t.umask:~tk0(),_=t.strict!==!1,v=t.validateSymlinks!==!1,n=t.map||ma,D=typeof t.dmode==="number"?t.dmode:0,O=typeof t.fmode==="number"?t.fmode:0;if(t.strip)n=Ek0(n,t.strip);if(t.readable)D|=parseInt(555,8),O|=parseInt(444,8);if(t.writable)D|=parseInt(333,8),O|=parseInt(222,8);if(d.on("entry",N),t.finish)d.on("finish",t.finish);return d;function N(F,P,S){F=n(F)||F,F.name=Jlu(F.name);let A=D1.join(u,D1.join("/",F.name));if(l(A,F))return P.resume(),S();let k=D1.join(A,".")===D1.join(u,".")?u:D1.dirname(A);lk0(f,k,D1.join(u,"."),function(di,wi){if(di)return S(di);if(!wi)return S(Error(k+" is not a valid path"));if(F.type==="directory")return $.push([A,F.mtime]),B(A,{fs:f,own:E,uid:F.uid,gid:F.gid,mode:F.mode},M);B(k,{fs:f,own:E,uid:F.uid,gid:F.gid,mode:493},function(li){if(li)return S(li);switch(F.type){case"file":return z();case"link":return L();case"symlink":return J()}if(_)return S(Error("unsupported type for "+A+" ("+F.type+")"));P.resume(),S()})});function M(di){if(di)return S(di);Z(A,F,function(wi){if(wi)return S(wi);if(ra)return S();T(A,F,S)})}function J(){if(ra)return S();f.unlink(A,function(){let di=D1.resolve(D1.dirname(A),F.linkname);if(!m(di)&&v)return S(Error(A+" is not a valid symlink"));fk0(f,di,D1.join(u,"."),function(wi,li){if(wi)return S(wi);if(!li&&v)return S(Error(A+" is not a valid symlink"));f.symlink(F.linkname,A,M)})})}function L(){if(ra)return S();f.unlink(A,function(){let di=D1.join(u,D1.join("/",F.linkname));f.realpath(di,function(wi,li){if(wi||!m(li))return S(Error(A+" is not a valid hardlink"));f.link(li,A,function(ii){if(ii&&ii.code==="EPERM"&&t.hardlinkAsFilesFallback)return P=f.createReadStream(li),z();M(ii)})})})}function m(di){return di===u||di.startsWith(u+D1.sep)}function z(){let di=f.createWriteStream(A),wi=c(P,F);di.on("error",function(li){wi.destroy(li)}),ik0(wi,di,function(li){if(li)return S(li);di.on("close",M)})}}function y(F,P){let S;while((S=AHf($))&&F.slice(0,S[0].length)!==S[0])$.pop();if(!S)return P();f.utimes(S[0],w,S[1],P)}function Z(F,P,S){if(t.utimes===!1)return S();if(P.type==="directory")return f.utimes(F,w,P.mtime,S);if(P.type==="symlink")return y(F,S);f.utimes(F,w,P.mtime,function(A){if(A)return S(A);y(F,S)})}function T(F,P,S){let A=P.type==="symlink",k=A?f.lchmod:f.chmod,M=A?f.lchown:f.chown;if(!k)return S();let J=(P.mode|(P.type==="directory"?D:O))&h;if(M&&E)M.call(f,F,P.uid,P.gid,L);else L(null);function L(m){if(m)return S(m);if(!k)return S();k.call(f,F,J,S)}}function B(F,P,S){f.stat(F,function(A){if(!A)return S(null);if(A.code!=="ENOENT")return S(A);f.mkdir(F,{mode:P.mode,recursive:!0},function(k,M){if(k)return S(k);T(F,P,S)})})}};function fk0(i,u,t,f){if(u===t)return f(null,!0);if(!u.startsWith(t+D1.sep))return f(null,!1);i.lstat(u,function(l,c){if(l&&l.code!=="ENOENT"&&l.code!=="EPERM")return f(l);if(l||!c.isSymbolicLink())return fk0(i,D1.join(u,".."),t,f);f(null,!1)})}function lk0(i,u,t,f){if(u===t)return f(null,!0);i.lstat(u,function(l,c){if(l&&l.code!=="ENOENT"&&l.code!=="EPERM")return f(l);if(l||c.isDirectory())return lk0(i,D1.join(u,".."),t,f);f(null,!1)})}function ma(){}function ck0(i){return i}function Jlu(i){return ra?i.replace(/\\/g,"/").replace(/[:?<>|]/g,"_"):i}function kHf(i,u,t,f,l,c){if(!l)l=["."];let E=l.slice(0);return function($){if(!E.length)return $(null);let w=E.shift(),h=D1.join(t,w);u.call(i,h,function(_,v){if(_)return $(l.indexOf(w)===-1&&_.code==="ENOENT"?null:_);if(!v.isDirectory())return $(null,w,v);i.readdir(h,function(n,D){if(n)return $(n);if(c)D.sort();for(let O=0;O<D.length;O++)if(!f(D1.join(t,w,D[O])))E.push(D1.join(w,D[O]));$(null,w,v)})})}}function Ek0(i,u){return function(t){t.name=t.name.split("/").slice(u).join("/");let f=t.linkname;if(f&&(t.type==="link"||D1.isAbsolute(f)))t.linkname=f.split("/").slice(u).join("/");return i(t)}}});var KHf,JHf;var $k0=g(()=>{Nlu();KHf=G(eA0(),1),JHf=G(dk0(),1)});var kZi=()=>{};var wk0=g(()=>{Ryi()});var hk0=g(()=>{gZi();DZi();kZi()});var _k0=()=>{};var vk0=()=>{};var Xlu=g(()=>{SA0();glu();gZi();LA0();nlu();Nlu();WA0();YA0();zA0();QA0();Dlu();HA0();$k0();kZi();wk0();hk0();_k0();vk0();kZi()});var W1,e1,yK,ea;var aa=g(()=>{W1={CLAIM_API_GROUP:"extensions.agents.x-k8s.io",CLAIM_API_VERSION:"v1alpha1",CLAIM_PLURAL:"sandboxclaims",SANDBOX_API_GROUP:"agents.x-k8s.io",SANDBOX_API_VERSION:"v1alpha1",SANDBOX_PLURAL:"sandboxes",POD_NAME_ANNOTATION:"agents.x-k8s.io/pod-name"};e1=class e1 extends Error{cause;constructor(i,u){super(i);if(this.name="SandboxError",this.cause=u,u instanceof Error&&u.stack)this.stack=`${this.stack}
 Caused by: ${u.stack}`}};yK=class yK extends e1{constructor(i,u){super(i,u);this.name="SandboxTimeoutError"}};ea=class ea extends e1{constructor(i,u){super(i,u);this.name="SandboxAlreadyExistsError"}}});async function XHf(i){let u=i.getCurrentCluster();if(!u)throw new e1("No active cluster in kubeconfig");let t={};await i.applyToHTTPSOptions(t);let f={},l=t.headers??{};for(let[c,E]of Object.entries(l))if(Array.isArray(E))f[c]=E.join(", ");else if(E!==void 0)f[c]=String(E);if(typeof t.auth==="string"&&!f.Authorization)f.Authorization=`Basic ${Buffer.from(t.auth).toString("base64")}`;return{server:u.server.replace(/\/+$/,""),headers:f,tls:{cert:Llu(t.cert),key:Llu(t.key),ca:Llu(t.ca),rejectUnauthorized:u.skipTLSVerify?!1:void 0}}}function Llu(i){if(i==null)return;if(typeof i==="string")return i;if(Buffer.isBuffer(i))return i.toString("utf8");return String(i)}async function ZK(i,u){let t=await XHf(i),f={...t.headers,...u.headers};if(u.method==="PATCH")f["content-type"]=u.patchType==="apply"?"application/apply-patch+yaml":u.patchType==="strategic-merge"?"application/strategic-merge-patch+json":"application/merge-patch+json";else if(u.body!==void 0&&!("content-type"in f))f["content-type"]="application/json";let l={method:u.method,headers:f,body:u.body===void 0?void 0:JSON.stringify(u.body),signal:u.signal,tls:t.tls,...u.stream?{timeout:!1}:{}};return fetch(`${t.server}${u.path}`,l)}async function Wlu(i){try{return await i.json()}catch{return null}}async function Ylu(i,u){if(i.ok)return;let t=await Wlu(i),f=t?.message??`${u} failed: ${i.status} ${i.statusText}`;throw new nk0(i.status,t,f)}async function oa(i,u,t,f,l="none"){try{let c=await ZK(i,u);if(c.status===404)return null;if(await Ylu(c,t),l==="json")return await c.json();return null}catch(c){throw new e1(f,c)}}async function sa(i,u,t){let f=`${Dk0}/${encodeURIComponent(u)}/${W1.CLAIM_PLURAL}`,l;try{l=await ZK(i,{method:"POST",path:f,body:t})}catch(w){let h=w instanceof Error?w.message:String(w);throw console.warn(`[agent-sandbox/client] createSandboxClaim ${t.metadata.name} transport error: ${h}`),new e1(`Failed to create SandboxClaim: ${t.metadata.name} (transport error: ${h})`,w)}if(l.ok)return;let c=await Wlu(l),E=c?.reason?` ${c.reason}`:"",d=c?.message??l.statusText,$=`Failed to create SandboxClaim: ${t.metadata.name} (${l.status}${E}: ${d})`;if(console.warn(`[agent-sandbox/client] createSandboxClaim ${t.metadata.name} rejected: status=${l.status} reason=${c?.reason??"<none>"} message=${d}`),l.status===409)throw new ea($);throw new e1($)}async function GZi(i,u,t,f=60000){let l=Date.now()+f,c=500,E;while(!0){let d=await KD(i,u,t).catch(()=>{return});if(!d)return;if(E=d,Date.now()>=l){let $=E.metadata?.finalizers??[],w=E.metadata?.deletionTimestamp??"<unknown>";throw new yK(`SandboxClaim ${t} still terminating after ${f}ms (deletionTimestamp=${w}, finalizers=[${$.join(", ")}])`)}await F0(500)}}function zlu(i,u){return`${Dk0}/${encodeURIComponent(i)}/${W1.CLAIM_PLURAL}/${encodeURIComponent(u)}`}async function gk0(i,u,t,f){await oa(i,{method:"PATCH",path:zlu(u,t),patchType:"merge",body:{spec:{lifecycle:{shutdownPolicy:"Delete",shutdownTime:f}}}},"patchSandboxClaimShutdown",`Failed to patch SandboxClaim shutdownTime: ${t}`)}async function P7(i,u,t){await oa(i,{method:"DELETE",path:zlu(u,t)},"deleteSandboxClaim",`Failed to delete SandboxClaim: ${t}`)}async function KD(i,u,t){return await oa(i,{method:"GET",path:zlu(u,t)},"getSandboxClaim",`Failed to get SandboxClaim: ${t}`,"json")??void 0}async function Ok0(i,u,t,f=60){let l=Date.now()+f*1000,c=200;while(Date.now()<l){let d=(await KD(i,u,t).catch(()=>{return}))?.status?.sandbox?.name;if(d)return d;await new Promise(($)=>setTimeout($,200))}throw new yK(`SandboxClaim ${t} did not record an adopted Sandbox (status.sandbox.name) within ${f}s`)}function Qlu(i,u){return`${LHf}/${encodeURIComponent(i)}/${Zk0}/${encodeURIComponent(u)}`}async function SZi(i,u,t){let f=new URLSearchParams({fieldManager:Bk0,force:"true"}),l=`${Qlu(u,t.metadata.name)}?${f}`;try{let c=await ZK(i,{method:"PATCH",path:l,patchType:"apply",body:t});await Ylu(c,"applyHttpRoute")}catch(c){throw new e1(`Failed to apply HTTPRoute: ${t.metadata.name}`,c)}}async function jZi(i,u,t){await oa(i,{method:"DELETE",path:Qlu(u,t)},"deleteHttpRoute",`Failed to delete HTTPRoute: ${t}`)}async function Tk0(i,u,t){return await oa(i,{method:"GET",path:Qlu(u,t)},"getHttpRoute",`Failed to get HTTPRoute: ${t}`,"json")??void 0}async function Fk0(i,u,t,f){let l={apiVersion:"v1",kind:"Service",metadata:{name:t},spec:{ports:[{name:f.name,port:f.port,targetPort:f.targetPort,protocol:f.protocol??"TCP"}]}},c=new URLSearchParams({fieldManager:Bk0,force:"true"}),E=`/api/v1/namespaces/${encodeURIComponent(u)}/services/${encodeURIComponent(t)}?${c}`;try{let d=await ZK(i,{method:"PATCH",path:E,patchType:"apply",body:l});await Ylu(d,"ensureServicePort")}catch(d){throw new e1(`Failed to apply Service ports: ${t}`,d)}}function KZi(i,u,t,f=180){let l=`/apis/${W1.SANDBOX_API_GROUP}/${W1.SANDBOX_API_VERSION}/namespaces/${encodeURIComponent(u)}/${W1.SANDBOX_PLURAL}?watch=true&fieldSelector=${encodeURIComponent(`metadata.name=${t}`)}`,{resolve:c,reject:E,promise:d}=Promise.withResolvers(),$=new AbortController,w=!1,h=setTimeout(()=>{if(w)return;w=!0,$.abort(),E(new yK(`Sandbox did not become ready within ${f} seconds`))},f*1000),_=(v)=>{if(w)return;w=!0,clearTimeout(h),$.abort(),v()};return(async()=>{let v;try{v=await ZK(i,{method:"GET",path:l,signal:$.signal,headers:{accept:"application/json"},stream:!0})}catch(n){_(()=>E(new e1("Failed to start watch for sandbox readiness",n)));return}if(!v.ok||!v.body){let n=await Wlu(v).catch(()=>null);_(()=>E(new e1(`Watch handshake failed (${v.status}): ${n?.message??v.statusText}`)));return}try{for await(let n of Hlu(v.body)){if(w)return;if(n.type==="ERROR"){let Z=n.object;_(()=>E(new e1(`Watch stream error while waiting for sandbox: ${Z.message??"unknown"}`)));return}if(n.type!=="ADDED"&&n.type!=="MODIFIED")continue;let D=n.object;if(!D.status?.conditions?.find((Z)=>Z.type==="Ready"&&Z.status==="True"))continue;let N=D.metadata?.name;if(!N){_(()=>E(new e1("Sandbox metadata or name is missing")));return}let y=D.metadata?.annotations?.[W1.POD_NAME_ANNOTATION]??N;_(()=>c({sandboxName:N,podName:y}));return}_(()=>E(new e1("Watch stream closed before sandbox became ready")))}catch(n){if(w)return;if(n instanceof Error&&(n.name==="AbortError"||$.signal.aborted))return;_(()=>E(new e1("Watch stream error while waiting for sandbox",n)))}})(),d}async function*Hlu(i){let u=i.getReader(),t=new TextDecoder,f="";try{while(!0){let{value:c,done:E}=await u.read();if(E)break;f+=t.decode(c,{stream:!0});let d;while((d=f.indexOf(`
-`))>=0){let $=f.slice(0,d).trim();if(f=f.slice(d+1),!$)continue;yield JSON.parse($)}}let l=f.trim();if(l)yield JSON.parse(l)}finally{u.releaseLock()}}var nk0,Dk0,Nk0="gateway.networking.k8s.io",yk0="v1",Zk0="httproutes",LHf,pa,Bk0="mesh-sandbox-runner";var JZi=g(()=>{B4();aa();nk0=class nk0 extends Error{status;body;constructor(i,u,t){super(t);this.status=i;this.body=u;this.name="KubeHttpError"}};Dk0=`/apis/${W1.CLAIM_API_GROUP}/${W1.CLAIM_API_VERSION}/namespaces`;LHf=`/apis/${Nk0}/${yk0}/namespaces`;pa={API_GROUP:Nk0,API_VERSION:yk0,PLURAL:Zk0}});async function*Pk0(i){let u=i.now??(()=>Date.now()),t=u(),f=i.schedulingTimeoutMs??zHf,l={pod:{},sandbox:{},events:{hasPulling:!1,hasPulled:!1},startedAt:t},c=[],E=null,d=!1,$=(Z)=>{if(d)return;if(E){let T=E;E=null,T(Z)}else c.push(Z)},w=()=>{if(c.length>0)return Promise.resolve(c.shift());if(d)return Promise.resolve(null);return new Promise((Z)=>{E=Z})},h=()=>{if(d)return;if(d=!0,E){let Z=E;E=null,Z(null)}},_=new AbortController,v=()=>{_.abort(),h()};if(i.signal)if(i.signal.aborted)_.abort(),h();else i.signal.addEventListener("abort",v,{once:!0});let n=Math.max(0,f-(u()-t)),D=setTimeout(()=>$("tick"),n+100),O,N=new Promise((Z)=>{O=Z}),y=Promise.allSettled([QHf(i.kc,i.namespace,i.claimName,_.signal,l,$,u,O),bHf(i.kc,i.namespace,i.claimName,_.signal,l,$),RHf(i.kc,i.namespace,i.claimName,N,_.signal,l,$,u)]);try{let Z=null,T=-1,B=Uk0(l,f,u);if(Z=Rlu(B),!blu(B))T=Ik0(B);if(yield B,blu(B))return;while(!d){if(await w()===null)break;let P=Uk0(l,f,u);if(blu(P)){let k=Rlu(P);if(k!==Z)Z=k,yield P;return}let S=Ik0(P);if(S<T)continue;let A=Rlu(P);if(A!==Z)Z=A,T=S,yield P}}finally{if(clearTimeout(D),_.abort(),i.signal)i.signal.removeEventListener("abort",v);h(),await y.catch(()=>{})}}function Uk0(i,u,t){let{pod:f,sandbox:l,events:c,startedAt:E}=i;if(l.ready)return{kind:"ready"};let d=f.containerWaitingReason;if(d==="ImagePullBackOff"||d==="ErrImagePull")return{kind:"failed",reason:"image-pull-backoff",message:"Sandbox image failed to download. The cluster may be missing pull credentials or the image tag may not exist."};if(d==="CrashLoopBackOff")return{kind:"failed",reason:"crash-loop-backoff",message:"Sandbox crashed during startup and is now in CrashLoopBackOff. Check pod logs."};if(!f.scheduled&&c.lastFailedSchedulingAt!==void 0&&t()-E>u)return{kind:"failed",reason:"scheduling-timeout",message:c.failedSchedulingMessage??`Pod could not be scheduled within ${Math.round(u/1000)}s.`};if(f.containerRunning&&!f.containerReady)return{kind:"warming-daemon",since:E};if(c.hasPulling&&!c.hasPulled)return{kind:"pulling-image",since:E};if(d==="ContainerCreating"||d==="PodInitializing"||f.scheduled&&!f.containerRunning)return{kind:"starting-container",since:E};if(f.scheduledFalseReason==="Unschedulable"||c.lastFailedSchedulingAt!==void 0&&!f.scheduled)return{kind:"waiting-for-capacity",since:E,message:c.failedSchedulingMessage??f.scheduledFalseMessage,nodeClaim:c.nominatedNodeClaim};return{kind:"claiming",since:E}}function blu(i){return i.kind==="ready"||i.kind==="failed"}function Ik0(i){switch(i.kind){case"claiming":return 0;case"waiting-for-capacity":return 1;case"pulling-image":return 2;case"starting-container":return 3;case"warming-daemon":return 4;case"ready":case"failed":return 99}}function Rlu(i){switch(i.kind){case"claiming":case"pulling-image":case"starting-container":case"warming-daemon":return i.kind;case"waiting-for-capacity":return`waiting-for-capacity:${i.message??""}:${i.nodeClaim??""}`;case"ready":return"ready";case"failed":return`failed:${i.reason}:${i.message}`}}async function QHf(i,u,t,f,l,c,E,d){let $=`/api/v1/namespaces/${encodeURIComponent(u)}/pods?watch=true&labelSelector=${encodeURIComponent(`${WHf}=${t}`)}`;return XZi({kc:i,path:$,signal:f,label:`pod/${t}`,onEvent:(w)=>{if(w.type!=="ADDED"&&w.type!=="MODIFIED")return;let h=w.object;if(h.metadata?.name)d(h.metadata.name);HHf(h,l,E),c("pod")}})}function HHf(i,u,t){let l=(i.status?.conditions??[]).find((E)=>E.type==="PodScheduled");if(l?.status==="True")u.pod.scheduled=!0,u.pod.scheduledFalseReason=void 0,u.pod.scheduledFalseMessage=void 0;else if(l?.status==="False")u.pod.scheduled=!1,u.pod.scheduledFalseReason=l.reason,u.pod.scheduledFalseMessage=l.message;let c=(i.status?.containerStatuses??[]).find((E)=>E.name===YHf);if(c)u.pod.containerWaitingReason=c.state?.waiting?.reason,u.pod.containerRunning=!!c.state?.running,u.pod.containerReady=c.ready===!0}async function bHf(i,u,t,f,l,c){let E=`/apis/${W1.CLAIM_API_GROUP}/${W1.CLAIM_API_VERSION}/namespaces/${encodeURIComponent(u)}/${W1.CLAIM_PLURAL}?watch=true&fieldSelector=${encodeURIComponent(`metadata.name=${t}`)}`;return XZi({kc:i,path:E,signal:f,label:`sandboxclaim/${t}`,onEvent:(d)=>{if(d.type!=="ADDED"&&d.type!=="MODIFIED")return;let w=d.object.status?.conditions?.find((h)=>h.type==="Ready");if(!w)return;if(w.status==="True")l.sandbox.ready=!0,l.sandbox.notReadyReason=void 0,l.sandbox.notReadyMessage=void 0;else l.sandbox.ready=!1,l.sandbox.notReadyReason=w.reason,l.sandbox.notReadyMessage=w.message;c("sandbox")}})}async function RHf(i,u,t,f,l,c,E,d){let $=await Promise.race([f,new Promise((h)=>{if(l.aborted){h(t);return}l.addEventListener("abort",()=>h(t),{once:!0})})]);if(l.aborted)return;let w=`/api/v1/namespaces/${encodeURIComponent(u)}/events?watch=true&fieldSelector=${encodeURIComponent(`involvedObject.name=${$},involvedObject.kind=Pod`)}`;return XZi({kc:i,path:w,signal:l,label:`events/${t}`,onEvent:(h)=>{if(h.type!=="ADDED"&&h.type!=="MODIFIED")return;let _=h.object,v=_.reason;if(!v)return;switch(v){case"Pulling":c.events.hasPulling=!0;break;case"Pulled":c.events.hasPulling=!0,c.events.hasPulled=!0;break;case"FailedScheduling":c.events.lastFailedSchedulingAt=d(),c.events.failedSchedulingMessage=_.message;break;case"Nominated":{let n=_.message?.match(/nodeclaim\/([\w-]+)/);if(n)c.events.nominatedNodeClaim=n[1];break}default:return}E("event")}})}async function Ak0(i){let{kc:u,namespace:t,labelSelector:f,signal:l,onDelete:c}=i,E=`/apis/${W1.CLAIM_API_GROUP}/${W1.CLAIM_API_VERSION}/namespaces/${encodeURIComponent(t)}/${W1.CLAIM_PLURAL}?watch=true&labelSelector=${encodeURIComponent(f)}`;return XZi({kc:u,path:E,signal:l,label:"sandboxclaim-reaper",onEvent:(d)=>{if(d.type!=="DELETED")return;let $=d.object.metadata?.name;if($)c($)}})}async function XZi(i){let{kc:u,path:t,signal:f,label:l,onEvent:c}=i,E=0;while(!f.aborted){try{let $=await ZK(u,{method:"GET",path:t,signal:f,headers:{accept:"application/json"},stream:!0});if(!$.ok||!$.body){try{await $.body?.cancel()}catch{}if($.status===401||$.status===403){console.warn(`[lifecycle-watcher] ${l} stopped: watch denied (${$.status} ${$.statusText}). `+"The kubeconfig in use cannot watch SandboxClaims \u2014 if you are running locally, "+"this provider should not be active (check STUDIO_SANDBOX_PROVIDER / your sandbox preference).");return}throw Error(`watch handshake failed: ${$.status} ${$.statusText}`)}E=0;for await(let w of Hlu($.body)){if(f.aborted)return;try{c(w)}catch(h){console.warn(`[lifecycle-watcher] ${l} onEvent threw: ${h instanceof Error?h.message:String(h)}`)}}}catch($){if(f.aborted)return;let w=$ instanceof Error?$.message:String($);console.warn(`[lifecycle-watcher] ${l} watch ended: ${w}`)}if(f.aborted)return;let d=t6(5000,250,E,2,0);E+=1,await F0(d,{signal:f}).catch(()=>{})}}var WHf="studio.decocms.com/sandbox-handle",YHf="sandbox",zHf=300000;var xk0=g(()=>{B4();aa();JZi()});async function kk0(i,u,t){let f=new Map;for(let l of i){let c=u(l);if(!c)continue;let E=f.get(c);if(E)E.push(l);else f.set(c,[l])}await Promise.allSettled([...f.values()].map(async(l)=>{for(let c of l)await t(c)}))}import{createHash as CHf,randomBytes as MHf,randomUUID as qHf}from"crypto";import*as Kk0 from"net";import{PassThrough as VHf}from"stream";function rHf(i){if(i instanceof Error)return i.message;if(i&&typeof i==="object"){let u=i;if(u.error instanceof Error)return u.error.message;if(typeof u.message==="string"&&u.message)return u.message}return String(i)}class mlu{kind=D$;records=new Map;inflight=new a3i;stateStore;previewUrlPattern;kubeConfig;portForward;namespace;sandboxTemplateName;envName;tokenGenerator;idleTtlMs;metrics;previewGateway;sentinelToken;mintCloneUrl;closed=!1;claimWatchAbort=new AbortController;constructor(i={}){this.stateStore=i.stateStore??null,this.previewUrlPattern=i.previewUrlPattern??null,this.kubeConfig=i.kubeConfig??cbf(),this.portForward=new ylu(this.kubeConfig),this.namespace=i.namespace??mHf,this.sandboxTemplateName=i.sandboxTemplateName??eHf,this.envName=_bf(i.envName),this.tokenGenerator=i.tokenGenerator??(()=>MHf(oHf).toString("hex")),this.idleTtlMs=i.idleTtlMs??pHf,this.metrics=i.meter?lbf(i.meter):null,this.previewGateway=i.previewGateway&&i.previewUrlPattern?{...i.previewGateway}:null;let u=i.sentinelToken?.trim()??"";this.sentinelToken=u.length>0?u:null,this.mintCloneUrl=i.mintCloneUrl,this.startClaimReaper(),this.startCredentialRefresher()}startClaimReaper(){let i=["app.kubernetes.io/managed-by=studio","app.kubernetes.io/name=studio-sandbox",...this.envName?[`${S3.env}=${this.envName}`]:[]].join(",");Ak0({kc:this.kubeConfig,namespace:this.namespace,labelSelector:i,signal:this.claimWatchAbort.signal,onDelete:(u)=>this.invalidateRecord(u)})}async ensure(i,u={}){let t=h7(i,u.branch??u.repo?.branch??null);return this.inflight.run(t,()=>o3i(this.stateStore,i,D$,(f)=>this.ensureLocked(i,t,u,f)))}async delete(i){let u=await this.getRecord(i);if(this.records.delete(i),u)this.closeForwarder(u.daemonForward),this.metrics?.active.add(-1,Vlu(u.tenant));if(await this.deleteHttpRouteIfManaged(i).catch((t)=>{console.warn(`[${a1}] HTTPRoute delete failed for ${i}: ${t instanceof Error?t.message:String(t)}`)}),await P7(this.kubeConfig,this.namespace,i),this.stateStore)if(u)await this.stateStore.delete(u.id,D$);else await this.stateStore.deleteByHandle(D$,i)}async alive(i){return await KD(this.kubeConfig,this.namespace,i)!==void 0}watchClaimLifecycle(i,u){return Pk0({kc:this.kubeConfig,namespace:this.namespace,claimName:i,signal:u})}async getPreviewUrl(i){let u=await this.getRecord(i);if(!u)return null;return this.composePreviewUrl(u)}async proxyDaemonRequest(i,u,t){let f=await this.getRecord(i);if(!f&&this.previewUrlPattern&&this.stateStore){let $=await this.stateStore.getByHandle(D$,i),w=$?.state,h=w?.token;if($&&h){let v=`http://${w?.adoptedSandboxName??i}.${this.namespace}.svc.cluster.local:${A7}`;try{let n=await VC(v,h,u,t);if(n.status!==404)return n;try{await n.body?.cancel()}catch{}}catch{}}}if(!f)f=await this.resurrectByHandle(i);if(!f)return new Response(JSON.stringify({error:"sandbox not found"}),{status:404,headers:{"content-type":"application/json"}});let l=f,c=performance.now(),E=0,d=!(t.body instanceof ReadableStream);try{let $=await VC(f.daemonUrl,f.token,u,t);if($.status===401&&d){this.invalidateRecord(i);let w=await this.getRecord(i).catch(()=>null)??await this.resurrectByHandle(i).catch(()=>null);if(w)l=w,$=await VC(w.daemonUrl,w.token,u,t)}return E=$.status,$}catch($){if(!d)throw $;this.invalidateRecord(i);let w=await this.resurrectByHandle(i)??await this.getRecord(i).catch(()=>null);if(!w)throw $;l=w;let h=await VC(w.daemonUrl,w.token,u,t);return E=h.status,h}finally{this.recordProxyDuration("daemon",E,l,performance.now()-c)}}async adoptLiveClaim(i,u){if(this.records.has(u))return!0;let t=await KD(this.kubeConfig,this.namespace,u).catch(()=>{return});if(!t||t.metadata?.deletionTimestamp)return!1;return await this.inflight.run(u,async()=>{let l=this.records.get(u);if(l)return this.toSandbox(l);let c=await this.adopt(i,u,t);if(!c)throw Error(`cannot adopt live claim ${u}`);return o3i(this.stateStore,i,D$,(E)=>this.finish(c,E,!0,!0,"adopt"))}).catch(()=>null)!=null}async resolvePreviewUpstreamUrl(i){if(this.previewUrlPattern)return`http://${await this.resolveServiceNameForHandle(i)}.${this.namespace}.svc.cluster.local:${A7}`;let u=await this.getRecord(i);if(u)return u.daemonUrl;let t=await this.resurrectByHandle(i);return t?t.daemonUrl:null}async resolveServiceNameForHandle(i){let u=this.records.get(i);if(u)return u.adoptedSandboxName;if(this.stateStore){let f=(await this.stateStore.getByHandle(D$,i).catch(()=>null))?.state?.adoptedSandboxName;if(f)return f}return i}async proxyPreviewRequest(i,u){let t=performance.now(),f=this.records.get(i)??null,l=0;try{let c=await this.resolvePreviewUpstreamUrl(i);if(!c){l=404;let D=Mlu(404,{error:"sandbox not found"});return D.headers.set(BK,"1"),D}let E=new URL(u.url);if((E.pathname==="/_sandbox"||E.pathname.startsWith("/_sandbox/")||E.pathname==="/_decopilot_vm"||E.pathname.startsWith("/_decopilot_vm/"))&&u.method!=="GET")return l=404,Mlu(404,{error:"not found"});let $=(D)=>`${D}${E.pathname}${E.search}`,w=new Headers(u.headers);for(let D of tbf)w.delete(D);let h=u.method!=="GET"&&u.method!=="HEAD",_={method:u.method,headers:w,body:h?u.body:void 0,redirect:"manual",signal:u.signal,duplex:h?"half":void 0},v;try{v=await fetch($(c),_)}catch(D){let O=`${c}${E.pathname}`;if(console.warn(`[${a1}] preview fetch to ${O} failed: ${D instanceof Error?D.message:String(D)}`),u.method==="GET"||u.method==="HEAD"){if(this.invalidateRecord(i),await this.resurrectByHandle(i).catch(()=>null)){let Z=await this.resolvePreviewUpstreamUrl(i);if(Z)try{v=await fetch($(Z),_);let T=new Headers;for(let[B,F]of v.headers.entries())if(!Gk0.includes(B.toLowerCase()))T.set(B,F);return l=v.status,new Response(v.body,{status:v.status,statusText:v.statusText,headers:T})}catch(T){console.warn(`[${a1}] preview fetch retry to ${O} failed: ${T instanceof Error?T.message:String(T)}`)}}}else this.invalidateRecord(i);l=502;let N=Mlu(502,{error:"sandbox daemon unreachable"});return N.headers.set(BK,"1"),N}let n=new Headers;for(let[D,O]of v.headers.entries())if(!Gk0.includes(D.toLowerCase()))n.set(D,O);return l=v.status,new Response(v.body,{status:v.status,statusText:v.statusText,headers:n})}finally{this.recordProxyDuration("preview",l,f,performance.now()-t,i)}}async ensureLocked(i,u,t,f){if(t.image)console.warn(`[${a1}] opts.image ignored (template ${this.sandboxTemplateName} pins image): got ${t.image}`);if(f){let E=await f.get(i,D$);if(E){let d=await this.rehydrate(i,u,E);if(d)return await this.refreshDaemonGitCredential(d,t),this.finish(d,f,!1,!0,"resume");await f.delete(i,D$)}}let l=await KD(this.kubeConfig,this.namespace,u).catch(()=>{return});if(l)if(l.metadata?.deletionTimestamp)await GZi(this.kubeConfig,this.namespace,u).catch((E)=>{console.warn(`[${a1}] wait for terminating claim ${u} failed: ${E instanceof Error?E.message:String(E)}`)});else{let E=await this.adopt(i,u,l).catch((d)=>{return console.warn(`[${a1}] adopt ${u} failed, recreating: ${d instanceof Error?d.message:String(d)}`),null});if(E)return await this.refreshDaemonGitCredential(E,t),this.finish(E,f,!0,!0,"adopt");await P7(this.kubeConfig,this.namespace,u).catch(()=>{}),await GZi(this.kubeConfig,this.namespace,u).catch((d)=>{console.warn(`[${a1}] wait for deleted claim ${u} failed: ${d instanceof Error?d.message:String(d)}`)})}let c=await this.provision(i,u,t);return this.finish(c,f,!0,!1,"fresh")}async finish(i,u,t,f,l){let c=this.records.get(i.handle),E=c!==void 0;if(c&&c.daemonForward!==i.daemonForward)this.closeForwarder(c.daemonForward);if(this.records.set(i.handle,i),t)await this.persist(u,i);if(f)await gk0(this.kubeConfig,this.namespace,i.handle,this.computeShutdownTime()).catch((d)=>console.warn(`[${a1}] TTL refresh failed for ${i.handle}: ${d instanceof Error?d.message:String(d)}`));if(this.metrics){let d=Vlu(i.tenant);if(this.metrics.ensureOutcome.add(1,{...d,outcome:l}),!E)this.metrics.active.add(1,d)}return this.toSandbox(i)}buildEnvMap(i,u){let t={},f=[];for(let[l,c]of Object.entries(i.env??{}))if(sHf.has(l))f.push(l);else t[l]=c;if(f.length>0)console.warn(`[${a1}] opts.env keys overlap reserved bootstrap names and were dropped: ${f.join(",")}`);return{...t,DAEMON_TOKEN:u.token,DAEMON_BOOT_ID:u.daemonBootId,APP_ROOT:u.workdir,PROXY_PORT:String(A7)}}buildClaim(i,u,t){let f=this.sentinelToken!==null,l=f?[]:Object.entries(this.buildEnvMap(u,t)).sort(([d],[$])=>d<$?-1:d>$?1:0).map(([d,$])=>({name:d,value:$})),c=Dbf(u),E=Object.keys(c).length>0;return{apiVersion:`${W1.CLAIM_API_GROUP}/${W1.CLAIM_API_VERSION}`,kind:"SandboxClaim",metadata:{name:i,namespace:this.namespace,labels:{"app.kubernetes.io/name":"studio-sandbox","app.kubernetes.io/managed-by":"studio",...this.envName?{[S3.env]:this.envName}:{},...qlu(u.tenant)},...E?{annotations:c}:{}},spec:{sandboxTemplateRef:{name:this.sandboxTemplateName},additionalPodMetadata:{labels:qlu(u.tenant,{[S3.role]:"claimed",[S3.sandboxHandle]:i,...this.envName?{[S3.env]:this.envName}:{}}),...E?{annotations:c}:{}},env:l,warmpool:f?"default":"none",lifecycle:{shutdownPolicy:"Delete",shutdownTime:this.computeShutdownTime()}}}}async provision(i,u,t){let f=this.tokenGenerator(),l=qHf(),c=Clu,E=this.buildClaim(u,t,{token:f,daemonBootId:l,workdir:c});try{await sa(this.kubeConfig,this.namespace,E)}catch(v){if(v instanceof ea)await GZi(this.kubeConfig,this.namespace,u),await sa(this.kubeConfig,this.namespace,E);else throw v}let d;try{d=await Ok0(this.kubeConfig,this.namespace,u),await KZi(this.kubeConfig,this.namespace,d)}catch(v){throw await P7(this.kubeConfig,this.namespace,u).catch(()=>{}),v}try{await this.ensureServicePortForAdoptedSandbox(d),await this.ensureHttpRouteForHandle(u,d,t.tenant??null)}catch(v){throw await P7(this.kubeConfig,this.namespace,u).catch(()=>{}),v}let $=await this.openForwarder(d,A7,u),w=`http://127.0.0.1:${$.localPort}`,h=this.workloadConfigPayload(t),_=l;try{if(await uli(w),this.sentinelToken!==null){let v=await ili(w);if(v)_=v.bootId;await s8(w,this.sentinelToken,h??{},{rotateToken:f})}else if(h)await s8(w,f,h);if(t.orgFsConfigJson)await Zbu(w,f,t.orgFsConfigJson).catch((v)=>console.warn("[org-fs] sidecar config relay failed",v))}catch(v){throw this.closeForwarder($),await this.deleteHttpRouteIfManaged(u).catch(()=>{}),await P7(this.kubeConfig,this.namespace,u).catch(()=>{}),v}return{id:i,handle:u,adoptedSandboxName:d,token:f,workdir:c,daemonUrl:w,daemonForward:$,workload:t.workload??null,daemonBootId:_,tenant:t.tenant??null,ensureOpts:Obf(t)}}workloadConfigPayload(i){return kfu({runtime:i?.workload?.runtime??"node",packageManager:i?.workload?.packageManager?{name:i.workload.packageManager,...i.workload.packageManagerPath?{path:i.workload.packageManagerPath}:{}}:null,repo:i?.repo??null,port:i?.workload?.devPort??aHf,tenant:i?.tenant??void 0})}async refreshDaemonGitCredential(i,u){let t=Gfu(u);if(!t)return;try{await s8(i.daemonUrl,i.token,t)}catch(f){console.warn(`[${a1}] git credential refresh failed for ${i.handle}: ${f instanceof Error?f.message:String(f)}`)}}async withFreshCloneUrl(i,u){if(!this.mintCloneUrl)return i;try{let t=await this.mintCloneUrl(i,u!==void 0?{bufferMs:u}:void 0);return t?{...i,cloneUrl:t}:i}catch(t){return console.warn(`[${a1}] clone credential re-mint failed: ${t instanceof Error?t.message:String(t)}`),i}}startCredentialRefresher(){if(!this.mintCloneUrl)return;let{signal:i}=this.claimWatchAbort;(async()=>{while(!i.aborted){if(await F0(ibf,{signal:i}).catch(()=>{}),i.aborted)break;try{await this.refreshAllGitCredentials()}catch(u){console.warn(`[${a1}] periodic credential refresh failed: ${u instanceof Error?u.message:String(u)}`)}}})()}async refreshAllGitCredentials(){await kk0(this.records.values(),(i)=>i.ensureOpts?.repo?.connectionId,async(i)=>{if(this.claimWatchAbort.signal.aborted)return;let u=i.ensureOpts?.repo;if(!u)return;let t=await this.withFreshCloneUrl(u,ubf);await this.refreshDaemonGitCredential(i,{...i.ensureOpts,repo:t}),i.ensureOpts={...i.ensureOpts,repo:t}})}async rebootstrapDaemon(i,u,t){if(this.sentinelToken===null)return!1;let f=this.workloadConfigPayload(t)??{};try{return await s8(i,this.sentinelToken,f,{rotateToken:u}),!0}catch(l){if(l instanceof p4i&&l.status===401)try{return await s8(i,u,f,{rotateToken:u}),!0}catch(c){return console.warn(`[${a1}] re-bootstrap retry with claim token failed: ${c instanceof Error?c.message:String(c)}`),!1}return console.warn(`[${a1}] re-bootstrap failed: ${l instanceof Error?l.message:String(l)}`),!1}}async ensureServicePortForAdoptedSandbox(i){if(!this.previewGateway||!this.previewUrlPattern)return;await Fk0(this.kubeConfig,this.namespace,i,{name:"daemon",port:A7,targetPort:A7})}async ensureHttpRouteForHandle(i,u,t){if(!this.previewGateway||!this.previewUrlPattern)return;let f=Nbf(this.previewUrlPattern,i);if(!f)throw new e1(`Unable to derive preview hostname for ${i} from pattern: ${this.previewUrlPattern}`);let l={apiVersion:`${pa.API_GROUP}/${pa.API_VERSION}`,kind:"HTTPRoute",metadata:{name:i,namespace:this.namespace,labels:qlu(t??void 0,{[S3.role]:"claimed",[S3.sandboxHandle]:i,"app.kubernetes.io/name":"studio-sandbox","app.kubernetes.io/managed-by":"studio",...this.envName?{[S3.env]:this.envName}:{}})},spec:{parentRefs:[{kind:"Gateway",group:"gateway.networking.k8s.io",name:this.previewGateway.name,namespace:this.previewGateway.namespace}],hostnames:[f],rules:[{backendRefs:[{group:"",kind:"Service",name:u,port:A7}]}]}};await SZi(this.kubeConfig,this.namespace,l)}async deleteHttpRouteIfManaged(i){if(!this.previewGateway)return;await jZi(this.kubeConfig,this.namespace,i)}async rehydrate(i,u,t){let f=t.state;if(!f.adoptedSandboxName&&!f.podName||!f.token)return null;let l=await KD(this.kubeConfig,this.namespace,u).catch(()=>{return});if(!l||!Sk0(l))return null;let c=l.status?.sandbox?.name??f.adoptedSandboxName??f.podName??u,E=await this.openAndProbeDaemon(c,u);if(!E)return null;if(f.daemonBootId&&f.daemonBootId!==E.bootId){if(this.sentinelToken!==null){let d=f.ensureOpts?.repo?{...f.ensureOpts,repo:await this.withFreshCloneUrl(f.ensureOpts.repo)}:f.ensureOpts??null;if(!await this.rebootstrapDaemon(E.daemonUrl,f.token,d))return this.closeForwarder(E.daemonForward),null}else console.warn(`[${a1}] daemon restart detected (handle=${u}): stored bootId=${f.daemonBootId} live bootId=${E.bootId}`);await this.stateStore?.put(i,D$,{handle:u,state:{...f,daemonBootId:E.bootId}}).catch((d)=>console.warn(`[${a1}] bootId persist failed for ${u}: ${d instanceof Error?d.message:String(d)}`))}return{id:i,handle:u,adoptedSandboxName:c,token:f.token,workdir:f.workdir??Clu,daemonUrl:E.daemonUrl,daemonForward:E.daemonForward,workload:f.workload??null,daemonBootId:E.bootId,tenant:f.tenant??null,ensureOpts:f.ensureOpts??null}}async adopt(i,u,t){if(!Sk0(t))return null;let f=t.status?.sandbox?.name??u;if(this.sentinelToken!==null)return null;let l=Ebf(t);if(!l)return null;let c=await this.openAndProbeDaemon(f,u);if(!c)return null;let E=gbf(t);if(this.previewGateway)await this.ensureServicePortForAdoptedSandbox(f).catch((d)=>{console.warn(`[${a1}] Service port backfill failed for ${u}: ${d instanceof Error?d.message:String(d)}`)}),await this.ensureHttpRouteForHandle(u,f,E).catch((d)=>{console.warn(`[${a1}] HTTPRoute backfill failed for ${u}: ${d instanceof Error?d.message:String(d)}`)});return{id:i,handle:u,adoptedSandboxName:f,token:l,workdir:Clu,daemonUrl:c.daemonUrl,daemonForward:c.daemonForward,workload:null,daemonBootId:c.bootId,tenant:E,ensureOpts:null}}async openAndProbeDaemon(i,u){let t=await this.openForwarder(i,A7,u).catch(()=>null);if(!t)return null;let f=`http://127.0.0.1:${t.localPort}`,l=await ili(f);if(!l)return this.closeForwarder(t),null;return{daemonForward:t,daemonUrl:f,bootId:l.bootId}}async getRecord(i){let u=this.records.get(i);if(u)return u;if(!this.stateStore)return null;let t=await this.stateStore.getByHandle(D$,i);if(!t)return null;let f=await this.rehydrate(t.id,i,t);if(f)this.records.set(i,f);return f}async resurrectByHandle(i){if(!this.stateStore)return null;let u=await this.stateStore.getByHandle(D$,i);if(!u)return null;let t=u.state.ensureOpts;if(!t)return null;let f=t.repo?{...t,repo:await this.withFreshCloneUrl(t.repo)}:t;return await this.ensure(u.id,f),this.records.get(i)??null}invalidateRecord(i){let u=this.records.get(i);if(!u)return;this.records.delete(i),this.closeForwarder(u.daemonForward)}recordProxyDuration(i,u,t,f,l){if(!this.metrics)return;this.metrics.proxyDurationMs.record(f,{...Vlu(t?.tenant??null),source:i,sandbox_handle:t?.handle??l??"",status_code:u||0})}composePreviewUrl(i){if(this.previewUrlPattern)return s3i(this.previewUrlPattern,i.handle);return`http://127.0.0.1:${i.daemonForward.localPort}/`}toSandbox(i){return{handle:i.handle,workdir:i.workdir,previewUrl:this.composePreviewUrl(i)}}async persist(i,u){if(!i)return;let t={adoptedSandboxName:u.adoptedSandboxName,token:u.token,workdir:u.workdir,workload:u.workload,daemonBootId:u.daemonBootId,tenant:u.tenant,...u.ensureOpts?{ensureOpts:u.ensureOpts}:{}};await i.put(u.id,D$,{handle:u.handle,state:t})}computeShutdownTime(){return new Date(Date.now()+this.idleTtlMs).toISOString()}openForwarder(i,u,t=i){let f=dbf(t,u);return new Promise((l,c)=>{let E=(d,$)=>{let w=Kk0.createServer((h)=>this.handleForwardedConnection(h,i,u,t));w.once("error",(h)=>{if(h.code==="EADDRINUSE"&&$<fbf){try{w.close()}catch{}let _=rlu+(d-rlu+1)%Jk0;E(_,$+1);return}c(h)}),w.listen(d,"127.0.0.1",()=>{let h=w.address();if(!h||typeof h==="string"){w.close(),c(Error("port-forward listener failed to bind"));return}l({server:w,localPort:h.port})})};E(f,0)})}handleForwardedConnection(i,u,t,f){let l=new VHf,c=null,E=!1,d=()=>{if(E)return;if(E=!0,l.destroy(),c)try{c.close()}catch{}if(!i.destroyed)i.destroy()};i.pipe(l),i.on("error",d),i.on("close",d),this.portForward.portForward(this.namespace,u,[t],i,null,l).then(($)=>{let w=typeof $==="function"?$():$;if(!w){d();return}if(c=w,c.on("close",d),c.on("error",()=>{this.invalidateRecord(f),d()}),E)try{c.close()}catch{}}).catch(($)=>{console.warn(`[${a1}] port-forward to ${u}:${t} failed: ${rHf($)}`),this.invalidateRecord(f),d()})}closeForwarder(i){i.server.close((u)=>{if(u)console.warn(`[${a1}] port-forward close on :${i.localPort} errored: ${u instanceof Error?u.message:String(u)}`)})}close(){if(this.closed)return;this.closed=!0,this.claimWatchAbort.abort();for(let i of this.records.values())this.closeForwarder(i.daemonForward);this.records.clear()}}function lbf(i){return{active:i.createUpDownCounter("studio.sandbox.active",{description:"Active sandbox count, by runner kind and owning org. Cross-checks the cAdvisor-derived count from the cluster \u2014 divergence between the two indicates orphaned claims (mesh deleted but K8s didn't reap) or unattributed pods.",unit:"{sandbox}"}),ensureOutcome:i.createCounter("studio.sandbox.ensure.outcome",{description:"Outcome of each ensure() call: fresh provision, resume from state-store after restart, or adopt of a cluster-side claim mesh didn't know about. Cold-start ratio is the primary input for warm-pool sizing.",unit:"{call}"}),proxyDurationMs:i.createHistogram("studio.sandbox.proxy.duration_ms",{description:"Wall-clock latency of mesh-mediated requests to the sandbox daemon: tool exec proxies (source=daemon) and preview iframe traffic (source=preview).",unit:"ms"})}}function cbf(){let i=new AQ;return i.loadFromDefault(),i}function Sk0(i){return Boolean(i.status?.conditions?.some((u)=>u.type==="Ready"&&u.status==="True"))}function Ebf(i){let u=i.spec?.env;if(!u)return null;for(let t of u)if(t.name==="DAEMON_TOKEN"&&t.value)return t.value;return null}function dbf(i,u){let t=CHf("sha256").update(`${i}:${u}`).digest();return rlu+t.readUInt32BE(0)%Jk0}function Mlu(i,u){return new Response(JSON.stringify(u),{status:i,headers:{"content-type":"application/json","access-control-allow-origin":"*"}})}function jk0(i){let u=i.slice(0,wbf);return $bf.test(u)?u:""}function _bf(i){if(i===void 0)return null;let u=i.trim();if(u==="")return null;if(!hbf.test(u))throw Error(`AgentSandboxProvider: envName=${JSON.stringify(u)} is not a valid DNS-label-safe environment name (lowercase alphanumeric or '-', starts with a letter, ends alphanumeric, \u226432 chars). Mesh sets this from STUDIO_ENV; check the studio chart's configMap.`);return u}function qlu(i,u={}){let t={...u};if(i){let f=jk0(i.orgId),l=jk0(i.userId);if(f)t[S3.orgId]=f;if(l)t[S3.userId]=l}return t}function TK(i){let u="";for(let t of i){let f=t.codePointAt(0)??0;u+=f<32||f===127?" ":t}return u.slice(0,vbf)}function nbf(i){try{let u=new URL(i);return u.username="",u.password="",u.toString()}catch{return""}}function Dbf(i){let u={},t=i.tenant;if(t?.orgSlug)u[N_.orgSlug]=TK(t.orgSlug);if(t?.orgName)u[N_.orgName]=TK(t.orgName);if(t?.userEmail)u[N_.userEmail]=TK(t.userEmail);if(t?.userName)u[N_.userName]=TK(t.userName);let f=i.repo;if(f){if(f.displayName)u[N_.gitRepo]=TK(f.displayName);let l=nbf(f.cloneUrl);if(l)u[N_.gitRepoUrl]=TK(l);let c=i.branch??f.branch;if(c)u[N_.gitBranch]=TK(c)}return u}function gbf(i){let u=i.metadata?.labels;if(!u)return null;let t=u[S3.orgId],f=u[S3.userId];if(!t||!f)return null;let l=i.metadata?.annotations??{};return{orgId:t,userId:f,orgSlug:l[N_.orgSlug],orgName:l[N_.orgName],userEmail:l[N_.userEmail],userName:l[N_.userName]}}function Vlu(i){return{org_id:i?.orgId??"",user_id:i?.userId??"",runner_kind:D$}}function Obf(i){let u={};if(i.repo)u.repo=i.repo;if(i.workload)u.workload=i.workload;if(i.env&&Object.keys(i.env).length>0)u.env=i.env;if(i.tenant)u.tenant=i.tenant;return Object.keys(u).length>0?u:null}function Nbf(i,u){try{return new URL(s3i(i,u)).hostname||null}catch{return null}}var D$="agent-sandbox",a1="AgentSandboxProvider",BK="x-sandbox-preview-not-ready",mHf="agent-sandbox-system",eHf="studio-sandbox",A7=9000,aHf=3000,Clu="/app",oHf=32,sHf,pHf=900000,ibf=900000,ubf=1800000,tbf,Gk0,rlu=40000,Jk0=1e4,fbf=256,S3,N_,$bf,wbf=63,hbf,vbf=253;var Xk0=g(()=>{B4();Xlu();Pzi();p3i();JZi();aa();xk0();sHf=new Set(["DAEMON_TOKEN","DAEMON_BOOT_ID","APP_ROOT","PROXY_PORT"]),tbf=["cookie","host","connection","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","accept-encoding","content-length","upgrade"],Gk0=["connection","keep-alive","transfer-encoding","content-encoding","content-length"];S3={role:"studio.decocms.com/role",sandboxHandle:"studio.decocms.com/sandbox-handle",orgId:"studio.decocms.com/org-id",userId:"studio.decocms.com/user-id",env:"studio.decocms.com/env"},N_={orgSlug:"studio.decocms.com/org-slug",orgName:"studio.decocms.com/org-name",userEmail:"studio.decocms.com/user-email",userName:"studio.decocms.com/user-name",gitRepo:"studio.decocms.com/git-repo",gitRepoUrl:"studio.decocms.com/git-repo-url",gitBranch:"studio.decocms.com/git-branch"},$bf=/^([A-Za-z0-9]([-A-Za-z0-9_.]*[A-Za-z0-9])?)?$/;hbf=/^[a-z]([a-z0-9-]{0,30}[a-z0-9])?$/});var Lk0={};Yi(Lk0,{waitForSandboxReady:()=>KZi,getSandboxClaim:()=>KD,getHttpRoute:()=>Tk0,deleteSandboxClaim:()=>P7,deleteHttpRoute:()=>jZi,createSandboxClaim:()=>sa,applyHttpRoute:()=>SZi,SandboxTimeoutError:()=>yK,SandboxError:()=>e1,PREVIEW_NOT_READY_HEADER:()=>BK,KubeConfig:()=>AQ,K8S_CONSTANTS:()=>W1,HTTPROUTE_CONSTANTS:()=>pa,AgentSandboxProvider:()=>mlu});var elu=g(()=>{Xlu();aa();JZi();Xk0()});class LZi{kind=x7;userSub;dispatch;stateStore;records=new Map;constructor(i){if(!i.userSub)throw Error("DesktopSandboxProvider requires userSub");if(!i.dispatch)throw Error("DesktopSandboxProvider requires dispatch");this.userSub=i.userSub,this.dispatch=i.dispatch,this.stateStore=i.stateStore??null}async ensure(i,u={}){let t=u.branch??u.repo?.branch,f=h7(i,t),l=this.records.get(f);if(l){if(await this.probeHealth(f))return this.toSandbox(l);if(this.records.delete(f),this.stateStore)await this.stateStore.deleteByHandle(x7,f).catch(()=>{})}else if(this.stateStore){let v=(await this.stateStore.getByHandle(x7,f))?.state,n=v?.sandboxApiUrl;if(n){if(await this.probeHealth(f)){let D={handle:f,sandboxApiUrl:n,previewUrl:v?.previewUrl??n};return this.records.set(f,D),this.toSandbox(D)}await this.stateStore.deleteByHandle(x7,f).catch(()=>{})}}let c=fh({userName:u.tenant?.userName,userEmail:u.tenant?.userEmail}),E=JSON.stringify({handle:f,repo:u.repo,branch:t,...u.workload?{workload:u.workload}:{},...c?{operator:c}:{},...u.offloadAllowedHosts?{offloadAllowedHosts:u.offloadAllowedHosts}:{},...u.offloadAllowSameHostDev!==void 0?{offloadAllowSameHostDev:u.offloadAllowSameHostDev}:{},...u.orgFsConfigJson?{orgFsConfigJson:u.orgFsConfigJson}:{}}),d=await this.dispatchJson("POST","/api/sandboxes",E),$=JSON.parse(d);if(typeof $.sandboxApiUrl!=="string")throw Error("desktop ensure: daemon did not return a sandboxApiUrl string");let w=typeof $.previewUrl==="string"?$.previewUrl:$.sandboxApiUrl,h={handle:f,sandboxApiUrl:$.sandboxApiUrl,previewUrl:w};if(this.records.set(f,h),this.stateStore)await this.stateStore.put(i,x7,{handle:f,state:{handle:f,sandboxApiUrl:$.sandboxApiUrl,previewUrl:w}});return this.toSandbox(h)}async proxyDaemonRequest(i,u,t){let f=u.startsWith("/")?u:`/${u}`,l=f.startsWith("/_sandbox/")?f.slice(9):f,c=`/_sandbox/${encodeURIComponent(i)}${l}`,E=new Headers(t.headers);for(let y of["host","cookie","connection","keep-alive","transfer-encoding","upgrade","authorization"])E.delete(y);let d={};E.forEach((y,Z)=>{d[Z]=y});let $;if(t.body!=null)$=await Zbf(t.body);let h=this.dispatch(this.userSub,{method:t.method,path:c,headers:d,body:$},{signal:t.signal})[Symbol.asyncIterator](),_=ybf(),v=200,n={"content-type":"application/octet-stream"},D=[];try{while(!0){let y=await h.next();if(y.done)break;let Z=y.value;if(Z.headers){v=Z.headers.status,n=Z.headers.headers;break}if(Z.data!=null){let T=_.push(Z.data);if(T.length)D.push(T)}}}catch(y){let Z=y instanceof Error?y.message:"dispatch error";return new Response(JSON.stringify({error:Z}),{status:502,headers:{"content-type":"application/json"}})}let O=!1,N=new ReadableStream({async start(y){for(let Z of D)y.enqueue(Z)},async pull(y){try{while(!0){let Z=await h.next();if(O)return;if(Z.done){let B=_.flush();if(B.length)y.enqueue(B);y.close();return}let T=Z.value;if(T.data!=null){let B=_.push(T.data);if(B.length){y.enqueue(B);return}}}}catch(Z){if(!O)y.error(Z)}},cancel(){O=!0,h.return?.()}});return new Response(N,{status:v,headers:n})}async alive(i){return this.probeHealth(i)}async probeHealth(i){let u=new AbortController,t=setTimeout(()=>u.abort(),3000);try{return await this.dispatchJson("GET",`/api/sandboxes/${encodeURIComponent(i)}`,void 0,u.signal),!0}catch{return!1}finally{clearTimeout(t)}}async forgetHandle(i){if(this.records.delete(i),this.stateStore)await this.stateStore.deleteByHandle(x7,i).catch(()=>{})}async delete(i){if(this.records.delete(i),this.stateStore)await this.stateStore.deleteByHandle(x7,i).catch(()=>{});try{await this.dispatchJson("DELETE",`/api/sandboxes/${encodeURIComponent(i)}`)}catch(u){if(!(u instanceof Error?u.message:String(u)).includes("404"))throw u}}async getPreviewUrl(i){return(await this.resolveRecord(i))?.previewUrl??null}async localWorkdir(i){return null}async*watchClaimLifecycle(i,u){yield{kind:"ready"}}toSandbox(i){return{handle:i.handle,workdir:i.sandboxApiUrl,previewUrl:i.previewUrl}}async resolveRecord(i){let u=this.records.get(i);if(u)return u;if(!this.stateStore)return null;let f=(await this.stateStore.getByHandle(x7,i))?.state,l=f?.sandboxApiUrl;if(!l)return null;let c={handle:i,sandboxApiUrl:l,previewUrl:f?.previewUrl??l};return this.records.set(i,c),c}async dispatchJson(i,u,t,f){let l={accept:"application/json"};if(t!==void 0)l["content-type"]="application/json";let c=this.dispatch(this.userSub,{method:i,path:u,headers:l,body:t},{signal:f}),E=null,d="";for await(let w of c)if(w.headers)E=w.headers.status;else if(w.data!=null)d+=w.data;let $=Buffer.from(d,"base64").toString("utf8");if(E!=null&&(E<200||E>=300))throw Error(`daemon returned ${E}: ${$}`);return $}}function Wk0(i){return new LZi(i)}function ybf(){let i="";return{push(u){if(u.length===0)return alu;i+=u;let t=i.length-i.length%4;if(t===0)return alu;let f=i.slice(0,t);return i=i.slice(t),new Uint8Array(Buffer.from(f,"base64"))},flush(){if(i.length===0)return alu;let u=i;return i="",new Uint8Array(Buffer.from(u,"base64"))}}}async function Zbf(i){if(typeof i==="string")return i;if(i instanceof ArrayBuffer)return Buffer.from(i).toString("utf8");if(ArrayBuffer.isView(i))return Buffer.from(i.buffer,i.byteOffset,i.byteLength).toString("utf8");if(i instanceof URLSearchParams)return i.toString();return await new Response(i).text()}var x7="user-desktop",alu;var Yk0=g(()=>{p3i();s4i();alu=new Uint8Array(0)});var zk0={};Yi(zk0,{createDesktopProvider:()=>Wk0,DesktopSandboxProvider:()=>LZi});var Qk0=g(()=>{Yk0()});var qk0={};Yi(qk0,{subscribeLifecycle:()=>io,getSandboxProviderByKind:()=>slu,getOrInitSharedRunner:()=>xbf,buildDesktopProvider:()=>WZi,__resetSharedLifecyclesForTesting:()=>Kbf});function Ck0(i,u){let t=Hk0[i];if(t)return Promise.resolve(t);let f=olu[i];if(f)return f;let l=u().then((c)=>{return Hk0[i]=c,c}).finally(()=>{delete olu[i]});return olu[i]=l,l}function Fbf(){let i=process.env.STUDIO_SANDBOX_PREVIEW_URL_PATTERN;return i&&i.trim()!==""?i:void 0}function Ubf(){let i=process.env.STUDIO_SANDBOX_TEMPLATE_NAME;return i&&i.trim()!==""?i:void 0}function Ibf(){let i=process.env.STUDIO_ENV;return i&&i.trim()!==""?i:void 0}function Pbf(){let i=process.env.STUDIO_SANDBOX_SENTINEL_TOKEN;return i&&i.trim()!==""?i:void 0}function Abf(){let i=process.env.STUDIO_SANDBOX_PREVIEW_GATEWAY_NAME?.trim(),u=process.env.STUDIO_SANDBOX_PREVIEW_GATEWAY_NAMESPACE?.trim();if(!i&&!u)return;if(!i||!u)throw Error("STUDIO_SANDBOX_PREVIEW_GATEWAY_NAME and STUDIO_SANDBOX_PREVIEW_GATEWAY_NAMESPACE must both be set, or both unset. Half-configured per-claim HTTPRoute routing would silently fail to attach.");return{name:i,namespace:u}}async function Mk0(i,u){let t=new n7(u),f=Fbf();switch(i){case"agent-sandbox":{let{AgentSandboxProvider:l}=await Promise.resolve().then(() => (elu(),Lk0)),c=new bn(Zu().encryptionKey);return new l({stateStore:t,previewUrlPattern:f,sandboxTemplateName:Ubf(),envName:Ibf(),previewGateway:Abf(),sentinelToken:Pbf(),meter:qt,mintCloneUrl:async(E,d)=>{if(!E.connectionId)return null;let $=RB0(E.cloneUrl);if(!$)return null;let{cloneUrl:w}=await D7(E.connectionId,$.owner,$.name,u,c,{bufferMs:d?.bufferMs});return w}})}case"user-desktop":throw Error("user-desktop provider cannot be instantiated without a per-run link claim \u2014 call resolveSandboxProvider, which binds the link before constructing the provider.");default:throw Error(`Unknown sandbox provider kind: ${String(i)}`)}}async function WZi(i,u){let{DesktopSandboxProvider:t}=await Promise.resolve().then(() => (Qk0(),zk0)),{getProxyDispatch:f}=await Promise.resolve().then(() => (i1u(),plu)),l=new n7(i.db);if(!u)throw Error("buildDesktopProvider: userSub must be a non-empty string");let c=f();return new t({userSub:u,dispatch:c,stateStore:l})}function slu(i,u){return Ck0(u,()=>Mk0(u,i.db))}async function xbf(){let i;try{i=UD()}catch(t){return console.warn("[lifecycle] cannot resolve sandbox runner:",t instanceof Error?t.message:String(t)),null}return await Ck0(i,()=>Mk0(i,Vt().db))}function io(i,u,t){let f=k7.get(u);if(f){if(f.terminated){if(f.lastPhase)try{t(f.lastPhase)}catch{}return{unsubscribe:Sbf}}if(f.listeners.add(t),f.lastPhase)try{t(f.lastPhase)}catch{}return bk0(u,f,t)}let l=new AbortController,c={lastPhase:null,terminated:!1,listeners:new Set([t]),abort:l};return k7.set(u,c),jbf(i,u,c),bk0(u,c,t)}function Sbf(){}function bk0(i,u,t){return{unsubscribe(){if(k7.get(i)!==u)return;if(u.listeners.delete(t),u.listeners.size===0)k7.delete(i),u.abort.abort()}}}async function jbf(i,u,t){let f=null;try{for await(let l of i.watchClaimLifecycle(u,t.abort.signal)){if(t.abort.signal.aborted)break;t.lastPhase=l;let c=l.kind==="ready"||l.kind==="failed";if(c)t.terminated=!0;let E=Array.from(t.listeners);for(let d of E)try{d(l)}catch{}if(c)break}}catch(l){f=l}finally{if(!t.terminated&&!t.abort.signal.aborted&&t.listeners.size>0){let l={kind:"failed",reason:"unknown",message:f instanceof Error?f.message:"Lifecycle watcher ended unexpectedly"};t.lastPhase=l,t.terminated=!0;for(let c of Array.from(t.listeners))try{c(l)}catch{}}if(k7.get(u)===t)k7.delete(u)}}function Kbf(){for(let i of k7.values())i.abort.abort();k7.clear()}var Tbf,Bbf,Rk0,Hk0,olu,kbf,Gbf,k7;var uo=g(()=>{vw();QE();Hl();vhi();Sa();ZV();Zt();Tbf=Symbol.for("decocms.sandbox.lifecycle.runners"),Bbf=Symbol.for("decocms.sandbox.lifecycle.inflight"),Rk0=globalThis,Hk0=Rk0[Tbf]??={},olu=Rk0[Bbf]??={};kbf=Symbol.for("decocms.sandbox.lifecycle.shared-lifecycles"),Gbf=globalThis,k7=Gbf[kbf]??=new Map});async function y_(i,u){let{userId:t,branch:f,virtualMcpMetadata:l,explicitKind:c}=u;if(c)return{provider:await to(i,t,c),kind:c};if(i.sandboxPreference==="agent-sandbox")return{provider:await to(i,t,"agent-sandbox"),kind:"agent-sandbox"};if(i.sandboxPreference==="user-desktop")return{provider:await WZi(i,t),kind:"user-desktop"};if(i.sandboxPreference==="cluster-default"){let h=UD();return{provider:await to(i,t,h),kind:h}}let[E,...d]=Jbf(l,t,f);if(E){let h=d.length===0?E:Xbf(E,d);return{provider:await to(i,t,h),kind:h}}let $=Vk0();return{provider:await to(i,t,$),kind:$}}function Jbf(i,u,t){let f=Fc(i)[u]?.[t];if(!f)return[];let l=t3(f);return Object.keys(l)}function Xbf(i,u){let t=Vk0();if(t===i||u.includes(t))return t;return i}function Vk0(){return UD()}async function to(i,u,t){if(t!=="user-desktop")return slu(i,t);return WZi(i,u)}var jQ=g(()=>{ff();vw();k3();uo()});var fo;var u1u=g(()=>{fo={npm:{install:"npm install",run:(i)=>`npm run ${i}`,runtime:"node"},pnpm:{install:"pnpm install",run:(i)=>`pnpm run ${i}`,runtime:"node"},yarn:{install:"yarn install",run:(i)=>`yarn run ${i}`,runtime:"node"},bun:{install:"bun install",run:(i)=>`bun run ${i}`,runtime:"bun"},deno:{install:"deno install",run:(i)=>`deno task ${i}`,runtime:"deno"}}});function YZi(i){if(!i)return null;let u=i.runtime;if(!u||typeof u!=="object")return null;let t=u.env;if(!Array.isArray(t))return null;let f=[];for(let l of t){if(!l||typeof l!=="object")continue;let c=l;if(typeof c.key!=="string"||!Yq.test(c.key))continue;if(c.kind==="literal"&&typeof c.value==="string"){f.push({key:c.key,kind:"literal",value:c.value});continue}if(c.kind==="secret"&&typeof c.secretId==="string"&&c.secretId.length>0)f.push({key:c.key,kind:"secret",secretId:c.secretId})}return f.length===0?null:f}async function rk0(i,u){Gi(u);let t=yi(u);await u.access.check();let f=Hu(u);if(!f)throw Error("User ID required");let l=await u.storage.virtualMcps.findById(i.virtualMcpId);if(!l||l.organization_id!==t.id)throw Error("Virtual MCP not found");let c=l.metadata??{},E=Fc(c),d=PD(E,f,i.branch,i.sandboxProviderKind);return{virtualMcp:l,metadata:c,userId:f,entry:d,organization:t}}function zZi(i){let u=i.runtime??null,f=u?.selected??null,l=u?.port??null,c=u?.path??null;if(!f||!(f in fo))return{packageManager:null,runtime:null,port:l,packageManagerPath:c,runtimeBinPath:null};let E=fo[f].runtime;return{packageManager:f,runtime:E,port:l,packageManagerPath:c,runtimeBinPath:E==="deno"?"/opt/deno/bin":E==="bun"?"/opt/bun/bin":null}}var KQ=g(()=>{ff();u1u();k3()});async function QZi({ctx:i,runner:u,handle:t,orgId:f,userId:l,entries:c}){if(!c||c.length===0)return;let E={};for(let $ of c){if($.kind==="literal"){E[$.key]=$.value;continue}try{let{value:w}=await i.storage.secrets.resolveById($.secretId,f,l);E[$.key]=w}catch(w){if(w instanceof Sv||w instanceof fz){console.warn(`[SANDBOX_START] skipping env ${$.key}: ${w.message}. Re-link or recreate the secret to restore.`);continue}throw w}}if(Object.keys(E).length===0)return;let d=await u.proxyDaemonRequest(t,"/_sandbox/config",{method:"PUT",headers:new Headers({"content-type":"application/json"}),body:JSON.stringify({env:E})});if(!d.ok){let $=await d.text().catch(()=>d.statusText);console.warn(`[SANDBOX_START] daemon rejected env patch (${d.status}): ${$}`)}}var t1u=g(()=>{d$i()});async function ak0(i,u,t,f,l){let c=await mg({connectionId:i,tokenStorage:new Vl(f,l)});if(!c.accessToken)return null;return sk0(u,t,c.accessToken)}function ok0(i,u){return sk0(i,u,null)}async function sk0(i,u,t){let f=new Map,l=new Set(mk0.map(($)=>$.path));for(let $ of Object.values(ek0))for(let w of $??[])l.add(w);await Promise.all(Array.from(l).map(async($)=>{f.set($,await Wbf(i,u,$,t))}));let c=mk0.find(({path:$})=>f.get($)!==null);if(!c)return null;let E=ek0[c.pm]??[],d=null;for(let $ of E)if(d=Ybf(f.get($)??null),d)break;return{packageManager:c.pm,devPort:d}}async function Wbf(i,u,t,f){let l=`https://api.github.com/repos/${i}/${u}/contents/${encodeURIComponent(t)}`;try{let c={Accept:"application/vnd.github+json","User-Agent":"mesh-runtime-detect"};if(f)c.Authorization=`token ${f}`;let E=await fetch(l,{headers:c,signal:AbortSignal.timeout(5000)});if(!E.ok)return null;let d=await E.json();if(!d.content||d.encoding!=="base64")return null;return Buffer.from(d.content,"base64").toString("utf8")}catch{return null}}function Ybf(i){if(!i)return null;try{let u=JSON.parse(i),t=u.tasks??u.scripts??{};return(t.dev??t.start??"").match(Lbf)?.[1]??null}catch{return null}}var mk0,ek0,Lbf;var pk0=g(()=>{eg();l_();mk0=[{path:"deno.json",pm:"deno"},{path:"deno.jsonc",pm:"deno"},{path:"bun.lock",pm:"bun"},{path:"bunfig.toml",pm:"bun"},{path:"pnpm-lock.yaml",pm:"pnpm"},{path:"yarn.lock",pm:"yarn"},{path:"package-lock.json",pm:"npm"},{path:"package.json",pm:"bun"}],ek0={deno:["deno.json","deno.jsonc"],bun:["package.json"],pnpm:["package.json"],yarn:["package.json"],npm:["package.json"]},Lbf=/(?:--port|PORT=|:)(\d{4,5})/});async function HZi(i,u){if(!i)return{hosts:[],allowSameHostDev:!1};let t;try{t=await i.presignedGetUrl("link-dispatch/_allowlist_probe",60,{requireFetchable:!0})}catch{return{hosts:[],allowSameHostDev:!1}}let f;try{f=new URL(t)}catch{return{hosts:[],allowSameHostDev:!1}}if(f.protocol!=="https:"&&f.protocol!=="http:")return{hosts:[],allowSameHostDev:!1};let l=f.hostname,c=zbf.has(l);return{hosts:[l],allowSameHostDev:c&&!u.isProduction}}var zbf;var f1u=g(()=>{zbf=new Set(["127.0.0.1","localhost","::1","[::1]","0.0.0.0"])});import{z as $5}from"zod";async function iG0(i,u){Gi(u);let t=yi(u),f=Hu(u);if(!f)throw Error("User ID required");let l=await u.storage.virtualMcps.findById(i.virtualMcpId);if(!l||l.organization_id!==t.id)throw Error("Virtual MCP not found");let c=l.metadata??{},E=PD(Fc(c),f,i.branch,i.sandboxProviderKind),d=i.sandboxProviderKind,{provider:$}=await y_(u,{userId:f,branch:i.branch,virtualMcpMetadata:c,explicitKind:d});if(E){if(d!=="user-desktop")return E;if(await $.alive(E.sandboxHandle).catch(()=>!1))return E;await v7(u.storage.virtualMcps,i.virtualMcpId,f,f,i.branch,d).catch((v)=>{console.warn("[ensureSandbox] failed to reap stale user-desktop entry",v)})}let w=c.githubRepo??null,{entry:h}=await uG0({ctx:u,userId:f,orgId:t.id,virtualMcpId:i.virtualMcpId,branch:i.branch,metadata:c,githubRepo:w,existing:null,providerKind:d,runner:$});return h}async function uG0(i){let{ctx:u,userId:t,orgId:f,virtualMcpId:l,branch:c,metadata:E,githubRepo:d,existing:$,runner:w}=i,{runtime:h,packageManager:_,port:v,packageManagerPath:n}=zZi(E),D;if(d){if(d.connectionId)await gQ({ctx:u,connectionId:d.connectionId,organizationId:f,forceRefresh:!0,onLegacyMintError:(wi)=>{console.error("[provisionSandbox] repo-scoped legacy token mint failed",{connectionId:d.connectionId,error:wi.message})}});let{cloneUrl:m,gitUserName:z,gitUserEmail:di}=d.connectionId?await D7(d.connectionId,d.owner,d.name,u.db,u.vault):nhi(d.owner,d.name);if(!_){let wi=d.connectionId?await ak0(d.connectionId,d.owner,d.name,u.db,u.vault):await ok0(d.owner,d.name);if(wi)_=wi.packageManager,h=fo[wi.packageManager].runtime,v=wi.devPort??v,await Hbf(u,l,t,wi.packageManager,wi.devPort)}D={cloneUrl:m,...d.connectionId?{connectionId:d.connectionId}:{},userName:z,userEmail:di,branch:c,displayName:`${d.owner}/${d.name}`}}let O=h&&_?{runtime:h,packageManager:_,...v!==null?{devPort:Number(v)}:{},...n?{packageManagerPath:n}:{}}:void 0,N=FD({orgId:f,virtualMcpId:l,branch:c}),y=w.kind==="user-desktop"?await HZi(u.objectStorage,{isProduction:Zu().nodeEnv==="production"}):null,Z=(w.kind==="user-desktop"||w.kind==="agent-sandbox")&&!Zu().orgFsMountsDisabled,T;if(Z){let m=u.organization?.slug??(await u.db.selectFrom("organization").select(["slug"]).where("id","=",f).executeTakeFirst())?.slug;if(m)T=await Lwi(u,{orgSlug:m,orgId:f,baseUrl:r_()})}let B=await w.ensure({userId:t,projectRef:N},{branch:c,repo:D,workload:O,tenant:{orgId:f,userId:t,...u.organization?.slug?{orgSlug:u.organization.slug}:{},...u.organization?.name?{orgName:u.organization.name}:{},...u.auth.user?.email?{userEmail:u.auth.user.email}:{},...u.auth.user?.name?{userName:u.auth.user.name}:{}},...y?{offloadAllowedHosts:y.hosts,offloadAllowSameHostDev:y.allowSameHostDev}:{},...T?{orgFsConfigJson:T}:{}}),F=E.runtime?.env??null;await QZi({ctx:u,runner:w,handle:B.handle,orgId:f,userId:t,entries:F});let S=!!$&&$.sandboxHandle===B.handle&&$?.createdAt?$.createdAt:Date.now(),A=E.runtime?.selected??null,k=E.runtime?.port??null,M=E.runtime?.path??null,J={sandboxHandle:B.handle,previewUrl:B.previewUrl,sandboxApiUrl:B.previewUrl,sandboxProviderKind:w.kind,createdAt:S,startedWith:{packageManager:A,port:k,path:M}};await KB0(u.storage.virtualMcps,l,t,t,c,i.providerKind,J);let L=!$||$.sandboxHandle!==B.handle;return{entry:J,isNewVm:L}}async function Hbf(i,u,t,f,l){let c=await i.storage.virtualMcps.findById(u);if(!c)return;let E=c.metadata??{};await i.storage.virtualMcps.update(u,t,{metadata:{...E,runtime:{selected:f,port:l}}})}var Qbf,l1u;var c1u=g(()=>{vw();cu();KQ();t1u();k3();Sa();pk0();u1u();jQ();f1u();Zt();bE();Cz();k3();Qbf=$5.enum(["agent-sandbox","user-desktop","cluster"]),l1u=fi({name:"SANDBOX_START",description:"Start a sandbox with the connected GitHub repo and dev server.",annotations:{title:"Start VM Preview",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!1,openWorldHint:!0},_meta:{ui:{visibility:"app"}},inputSchema:$5.object({virtualMcpId:$5.string().describe("Virtual MCP ID"),branch:$5.string().min(1).optional().describe("Optional git branch to check out. When omitted the handler generates a Bayer-style `<greek-letter>-<constellation>` name (e.g. `alpha-centauri`) and uses it. The resolved branch is returned in the response so callers can persist it."),sandboxProviderKind:Qbf.optional().describe("Explicit runtime choice. Hosted provider is `agent-sandbox`; legacy `cluster` input is accepted only for compatibility and normalized to `agent-sandbox`. When omitted, defaults to `user-desktop` if the acting user's link daemon is online, else the env kind.")}),outputSchema:$5.object({previewUrl:$5.string().nullable(),sandboxHandle:$5.string(),branch:$5.string(),isNewVm:$5.boolean(),sandboxProviderKind:$5.enum(["agent-sandbox","user-desktop"])}),handler:async(i,u)=>{Gi(u);let t=yi(u);await u.access.check();let f=i.branch??n3i(u.auth.user?.name??u.auth.user?.email?.split("@")[0]),l=Hu(u);if(!l)throw Error("User ID required");let c=await u.storage.virtualMcps.findById(i.virtualMcpId);if(!c||c.organization_id!==t.id)throw Error("Virtual MCP not found");let E=c.metadata??{},d=i.sandboxProviderKind?BD(i.sandboxProviderKind):void 0,{provider:$,kind:w}=await y_(u,{userId:l,branch:f,virtualMcpMetadata:E,explicitKind:d}),h=PD(Fc(E),l,f,w),_=E.githubRepo??null,{entry:v,isNewVm:n}=await uG0({ctx:u,userId:l,orgId:t.id,virtualMcpId:i.virtualMcpId,branch:f,metadata:E,githubRepo:_,existing:h,providerKind:w,runner:$});return{...v,branch:f,isNewVm:n,sandboxProviderKind:w}}})});async function E1u(i,u){let{provider:t,kind:f}=await y_(i,{userId:u.userId,branch:u.branch,virtualMcpMetadata:null}),l=null,c=()=>{if(!l)l=iG0({virtualMcpId:u.virtualMcpId,branch:u.branch,sandboxProviderKind:f},i).then(($)=>$.sandboxHandle),l.catch(()=>{l=null});return l},E=u.branch==="ephemeral"||f==="user-desktop";return Sfu(t,{ensureHandle:c,invalidateHandle:async()=>{let $=l;if(l=null,!E)return;try{await v7(i.storage.virtualMcps,u.virtualMcpId,u.userId,u.userId,u.branch,f)}catch(w){console.warn("[cluster-sandbox-fs] failed to reap vmMap entry",w)}if($&&typeof t.forgetHandle==="function")try{let w=await $;await t.forgetHandle(w)}catch(w){console.warn("[cluster-sandbox-fs] forgetHandle failed",w)}},canAutoRestart:E})}async function tG0(i,u){try{let t=await E1u(i,u),{stdout:f}=await t.onBash("test -d .deco && echo __DECO_SITE__");return f.includes("__DECO_SITE__")}catch(t){return console.warn("[cluster-sandbox-fs] .deco probe failed; assuming deco site",t),!0}}var d1u=g(()=>{vw();jQ();c1u();k3()});function JQ(i){let u=i.toISOString();return`<current-context>
+`))>=0){let $=f.slice(0,d).trim();if(f=f.slice(d+1),!$)continue;yield JSON.parse($)}}let l=f.trim();if(l)yield JSON.parse(l)}finally{u.releaseLock()}}var nk0,Dk0,Nk0="gateway.networking.k8s.io",yk0="v1",Zk0="httproutes",LHf,pa,Bk0="mesh-sandbox-runner";var JZi=g(()=>{B4();aa();nk0=class nk0 extends Error{status;body;constructor(i,u,t){super(t);this.status=i;this.body=u;this.name="KubeHttpError"}};Dk0=`/apis/${W1.CLAIM_API_GROUP}/${W1.CLAIM_API_VERSION}/namespaces`;LHf=`/apis/${Nk0}/${yk0}/namespaces`;pa={API_GROUP:Nk0,API_VERSION:yk0,PLURAL:Zk0}});async function*Pk0(i){let u=i.now??(()=>Date.now()),t=u(),f=i.schedulingTimeoutMs??zHf,l={pod:{},sandbox:{},events:{hasPulling:!1,hasPulled:!1},startedAt:t},c=[],E=null,d=!1,$=(Z)=>{if(d)return;if(E){let T=E;E=null,T(Z)}else c.push(Z)},w=()=>{if(c.length>0)return Promise.resolve(c.shift());if(d)return Promise.resolve(null);return new Promise((Z)=>{E=Z})},h=()=>{if(d)return;if(d=!0,E){let Z=E;E=null,Z(null)}},_=new AbortController,v=()=>{_.abort(),h()};if(i.signal)if(i.signal.aborted)_.abort(),h();else i.signal.addEventListener("abort",v,{once:!0});let n=Math.max(0,f-(u()-t)),D=setTimeout(()=>$("tick"),n+100),O,N=new Promise((Z)=>{O=Z}),y=Promise.allSettled([QHf(i.kc,i.namespace,i.claimName,_.signal,l,$,u,O),bHf(i.kc,i.namespace,i.claimName,_.signal,l,$),RHf(i.kc,i.namespace,i.claimName,N,_.signal,l,$,u)]);try{let Z=null,T=-1,B=Uk0(l,f,u);if(Z=Rlu(B),!blu(B))T=Ik0(B);if(yield B,blu(B))return;while(!d){if(await w()===null)break;let P=Uk0(l,f,u);if(blu(P)){let k=Rlu(P);if(k!==Z)Z=k,yield P;return}let S=Ik0(P);if(S<T)continue;let A=Rlu(P);if(A!==Z)Z=A,T=S,yield P}}finally{if(clearTimeout(D),_.abort(),i.signal)i.signal.removeEventListener("abort",v);h(),await y.catch(()=>{})}}function Uk0(i,u,t){let{pod:f,sandbox:l,events:c,startedAt:E}=i;if(l.ready)return{kind:"ready"};let d=f.containerWaitingReason;if(d==="ImagePullBackOff"||d==="ErrImagePull")return{kind:"failed",reason:"image-pull-backoff",message:"Sandbox image failed to download. The cluster may be missing pull credentials or the image tag may not exist."};if(d==="CrashLoopBackOff")return{kind:"failed",reason:"crash-loop-backoff",message:"Sandbox crashed during startup and is now in CrashLoopBackOff. Check pod logs."};if(!f.scheduled&&c.lastFailedSchedulingAt!==void 0&&t()-E>u)return{kind:"failed",reason:"scheduling-timeout",message:c.failedSchedulingMessage??`Pod could not be scheduled within ${Math.round(u/1000)}s.`};if(f.containerRunning&&!f.containerReady)return{kind:"warming-daemon",since:E};if(c.hasPulling&&!c.hasPulled)return{kind:"pulling-image",since:E};if(d==="ContainerCreating"||d==="PodInitializing"||f.scheduled&&!f.containerRunning)return{kind:"starting-container",since:E};if(f.scheduledFalseReason==="Unschedulable"||c.lastFailedSchedulingAt!==void 0&&!f.scheduled)return{kind:"waiting-for-capacity",since:E,message:c.failedSchedulingMessage??f.scheduledFalseMessage,nodeClaim:c.nominatedNodeClaim};return{kind:"claiming",since:E}}function blu(i){return i.kind==="ready"||i.kind==="failed"}function Ik0(i){switch(i.kind){case"claiming":return 0;case"waiting-for-capacity":return 1;case"pulling-image":return 2;case"starting-container":return 3;case"warming-daemon":return 4;case"ready":case"failed":return 99}}function Rlu(i){switch(i.kind){case"claiming":case"pulling-image":case"starting-container":case"warming-daemon":return i.kind;case"waiting-for-capacity":return`waiting-for-capacity:${i.message??""}:${i.nodeClaim??""}`;case"ready":return"ready";case"failed":return`failed:${i.reason}:${i.message}`}}async function QHf(i,u,t,f,l,c,E,d){let $=`/api/v1/namespaces/${encodeURIComponent(u)}/pods?watch=true&labelSelector=${encodeURIComponent(`${WHf}=${t}`)}`;return XZi({kc:i,path:$,signal:f,label:`pod/${t}`,onEvent:(w)=>{if(w.type!=="ADDED"&&w.type!=="MODIFIED")return;let h=w.object;if(h.metadata?.name)d(h.metadata.name);HHf(h,l,E),c("pod")}})}function HHf(i,u,t){let l=(i.status?.conditions??[]).find((E)=>E.type==="PodScheduled");if(l?.status==="True")u.pod.scheduled=!0,u.pod.scheduledFalseReason=void 0,u.pod.scheduledFalseMessage=void 0;else if(l?.status==="False")u.pod.scheduled=!1,u.pod.scheduledFalseReason=l.reason,u.pod.scheduledFalseMessage=l.message;let c=(i.status?.containerStatuses??[]).find((E)=>E.name===YHf);if(c)u.pod.containerWaitingReason=c.state?.waiting?.reason,u.pod.containerRunning=!!c.state?.running,u.pod.containerReady=c.ready===!0}async function bHf(i,u,t,f,l,c){let E=`/apis/${W1.CLAIM_API_GROUP}/${W1.CLAIM_API_VERSION}/namespaces/${encodeURIComponent(u)}/${W1.CLAIM_PLURAL}?watch=true&fieldSelector=${encodeURIComponent(`metadata.name=${t}`)}`;return XZi({kc:i,path:E,signal:f,label:`sandboxclaim/${t}`,onEvent:(d)=>{if(d.type!=="ADDED"&&d.type!=="MODIFIED")return;let w=d.object.status?.conditions?.find((h)=>h.type==="Ready");if(!w)return;if(w.status==="True")l.sandbox.ready=!0,l.sandbox.notReadyReason=void 0,l.sandbox.notReadyMessage=void 0;else l.sandbox.ready=!1,l.sandbox.notReadyReason=w.reason,l.sandbox.notReadyMessage=w.message;c("sandbox")}})}async function RHf(i,u,t,f,l,c,E,d){let $=await Promise.race([f,new Promise((h)=>{if(l.aborted){h(t);return}l.addEventListener("abort",()=>h(t),{once:!0})})]);if(l.aborted)return;let w=`/api/v1/namespaces/${encodeURIComponent(u)}/events?watch=true&fieldSelector=${encodeURIComponent(`involvedObject.name=${$},involvedObject.kind=Pod`)}`;return XZi({kc:i,path:w,signal:l,label:`events/${t}`,onEvent:(h)=>{if(h.type!=="ADDED"&&h.type!=="MODIFIED")return;let _=h.object,v=_.reason;if(!v)return;switch(v){case"Pulling":c.events.hasPulling=!0;break;case"Pulled":c.events.hasPulling=!0,c.events.hasPulled=!0;break;case"FailedScheduling":c.events.lastFailedSchedulingAt=d(),c.events.failedSchedulingMessage=_.message;break;case"Nominated":{let n=_.message?.match(/nodeclaim\/([\w-]+)/);if(n)c.events.nominatedNodeClaim=n[1];break}default:return}E("event")}})}async function Ak0(i){let{kc:u,namespace:t,labelSelector:f,signal:l,onDelete:c}=i,E=`/apis/${W1.CLAIM_API_GROUP}/${W1.CLAIM_API_VERSION}/namespaces/${encodeURIComponent(t)}/${W1.CLAIM_PLURAL}?watch=true&labelSelector=${encodeURIComponent(f)}`;return XZi({kc:u,path:E,signal:l,label:"sandboxclaim-reaper",onEvent:(d)=>{if(d.type!=="DELETED")return;let $=d.object.metadata?.name;if($)c($)}})}async function XZi(i){let{kc:u,path:t,signal:f,label:l,onEvent:c}=i,E=0;while(!f.aborted){try{let $=await ZK(u,{method:"GET",path:t,signal:f,headers:{accept:"application/json"},stream:!0});if(!$.ok||!$.body){try{await $.body?.cancel()}catch{}if($.status===401||$.status===403){console.warn(`[lifecycle-watcher] ${l} stopped: watch denied (${$.status} ${$.statusText}). `+"The kubeconfig in use cannot watch SandboxClaims \u2014 if you are running locally, "+"this provider should not be active (check STUDIO_SANDBOX_PROVIDER / your sandbox preference).");return}throw Error(`watch handshake failed: ${$.status} ${$.statusText}`)}E=0;for await(let w of Hlu($.body)){if(f.aborted)return;try{c(w)}catch(h){console.warn(`[lifecycle-watcher] ${l} onEvent threw: ${h instanceof Error?h.message:String(h)}`)}}}catch($){if(f.aborted)return;let w=$ instanceof Error?$.message:String($);console.warn(`[lifecycle-watcher] ${l} watch ended: ${w}`)}if(f.aborted)return;let d=t6(5000,250,E,2,0);E+=1,await F0(d,{signal:f}).catch(()=>{})}}var WHf="studio.decocms.com/sandbox-handle",YHf="sandbox",zHf=300000;var xk0=g(()=>{B4();aa();JZi()});async function kk0(i,u,t){let f=new Map;for(let l of i){let c=u(l);if(!c)continue;let E=f.get(c);if(E)E.push(l);else f.set(c,[l])}await Promise.allSettled([...f.values()].map(async(l)=>{for(let c of l)await t(c).catch(()=>{})}))}import{createHash as CHf,randomBytes as MHf,randomUUID as qHf}from"crypto";import*as Kk0 from"net";import{PassThrough as VHf}from"stream";function rHf(i){if(i instanceof Error)return i.message;if(i&&typeof i==="object"){let u=i;if(u.error instanceof Error)return u.error.message;if(typeof u.message==="string"&&u.message)return u.message}return String(i)}class mlu{kind=D$;records=new Map;inflight=new a3i;stateStore;previewUrlPattern;kubeConfig;portForward;namespace;sandboxTemplateName;envName;tokenGenerator;idleTtlMs;metrics;previewGateway;sentinelToken;mintCloneUrl;closed=!1;claimWatchAbort=new AbortController;constructor(i={}){this.stateStore=i.stateStore??null,this.previewUrlPattern=i.previewUrlPattern??null,this.kubeConfig=i.kubeConfig??cbf(),this.portForward=new ylu(this.kubeConfig),this.namespace=i.namespace??mHf,this.sandboxTemplateName=i.sandboxTemplateName??eHf,this.envName=_bf(i.envName),this.tokenGenerator=i.tokenGenerator??(()=>MHf(oHf).toString("hex")),this.idleTtlMs=i.idleTtlMs??pHf,this.metrics=i.meter?lbf(i.meter):null,this.previewGateway=i.previewGateway&&i.previewUrlPattern?{...i.previewGateway}:null;let u=i.sentinelToken?.trim()??"";this.sentinelToken=u.length>0?u:null,this.mintCloneUrl=i.mintCloneUrl,this.startClaimReaper(),this.startCredentialRefresher()}startClaimReaper(){let i=["app.kubernetes.io/managed-by=studio","app.kubernetes.io/name=studio-sandbox",...this.envName?[`${S3.env}=${this.envName}`]:[]].join(",");Ak0({kc:this.kubeConfig,namespace:this.namespace,labelSelector:i,signal:this.claimWatchAbort.signal,onDelete:(u)=>this.invalidateRecord(u)})}async ensure(i,u={}){let t=h7(i,u.branch??u.repo?.branch??null);return this.inflight.run(t,()=>o3i(this.stateStore,i,D$,(f)=>this.ensureLocked(i,t,u,f)))}async delete(i){let u=await this.getRecord(i);if(this.records.delete(i),u)this.closeForwarder(u.daemonForward),this.metrics?.active.add(-1,Vlu(u.tenant));if(await this.deleteHttpRouteIfManaged(i).catch((t)=>{console.warn(`[${a1}] HTTPRoute delete failed for ${i}: ${t instanceof Error?t.message:String(t)}`)}),await P7(this.kubeConfig,this.namespace,i),this.stateStore)if(u)await this.stateStore.delete(u.id,D$);else await this.stateStore.deleteByHandle(D$,i)}async alive(i){return await KD(this.kubeConfig,this.namespace,i)!==void 0}watchClaimLifecycle(i,u){return Pk0({kc:this.kubeConfig,namespace:this.namespace,claimName:i,signal:u})}async getPreviewUrl(i){let u=await this.getRecord(i);if(!u)return null;return this.composePreviewUrl(u)}async proxyDaemonRequest(i,u,t){let f=await this.getRecord(i);if(!f&&this.previewUrlPattern&&this.stateStore){let $=await this.stateStore.getByHandle(D$,i),w=$?.state,h=w?.token;if($&&h){let v=`http://${w?.adoptedSandboxName??i}.${this.namespace}.svc.cluster.local:${A7}`;try{let n=await VC(v,h,u,t);if(n.status!==404)return n;try{await n.body?.cancel()}catch{}}catch{}}}if(!f)f=await this.resurrectByHandle(i);if(!f)return new Response(JSON.stringify({error:"sandbox not found"}),{status:404,headers:{"content-type":"application/json"}});let l=f,c=performance.now(),E=0,d=!(t.body instanceof ReadableStream);try{let $=await VC(f.daemonUrl,f.token,u,t);if($.status===401&&d){this.invalidateRecord(i);let w=await this.getRecord(i).catch(()=>null)??await this.resurrectByHandle(i).catch(()=>null);if(w)l=w,$=await VC(w.daemonUrl,w.token,u,t)}return E=$.status,$}catch($){if(!d)throw $;this.invalidateRecord(i);let w=await this.resurrectByHandle(i)??await this.getRecord(i).catch(()=>null);if(!w)throw $;l=w;let h=await VC(w.daemonUrl,w.token,u,t);return E=h.status,h}finally{this.recordProxyDuration("daemon",E,l,performance.now()-c)}}async adoptLiveClaim(i,u){if(this.records.has(u))return!0;let t=await KD(this.kubeConfig,this.namespace,u).catch(()=>{return});if(!t||t.metadata?.deletionTimestamp)return!1;return await this.inflight.run(u,async()=>{let l=this.records.get(u);if(l)return this.toSandbox(l);let c=await this.adopt(i,u,t);if(!c)throw Error(`cannot adopt live claim ${u}`);return o3i(this.stateStore,i,D$,(E)=>this.finish(c,E,!0,!0,"adopt"))}).catch(()=>null)!=null}async resolvePreviewUpstreamUrl(i){if(this.previewUrlPattern)return`http://${await this.resolveServiceNameForHandle(i)}.${this.namespace}.svc.cluster.local:${A7}`;let u=await this.getRecord(i);if(u)return u.daemonUrl;let t=await this.resurrectByHandle(i);return t?t.daemonUrl:null}async resolveServiceNameForHandle(i){let u=this.records.get(i);if(u)return u.adoptedSandboxName;if(this.stateStore){let f=(await this.stateStore.getByHandle(D$,i).catch(()=>null))?.state?.adoptedSandboxName;if(f)return f}return i}async proxyPreviewRequest(i,u){let t=performance.now(),f=this.records.get(i)??null,l=0;try{let c=await this.resolvePreviewUpstreamUrl(i);if(!c){l=404;let D=Mlu(404,{error:"sandbox not found"});return D.headers.set(BK,"1"),D}let E=new URL(u.url);if((E.pathname==="/_sandbox"||E.pathname.startsWith("/_sandbox/")||E.pathname==="/_decopilot_vm"||E.pathname.startsWith("/_decopilot_vm/"))&&u.method!=="GET")return l=404,Mlu(404,{error:"not found"});let $=(D)=>`${D}${E.pathname}${E.search}`,w=new Headers(u.headers);for(let D of tbf)w.delete(D);let h=u.method!=="GET"&&u.method!=="HEAD",_={method:u.method,headers:w,body:h?u.body:void 0,redirect:"manual",signal:u.signal,duplex:h?"half":void 0},v;try{v=await fetch($(c),_)}catch(D){let O=`${c}${E.pathname}`;if(console.warn(`[${a1}] preview fetch to ${O} failed: ${D instanceof Error?D.message:String(D)}`),u.method==="GET"||u.method==="HEAD"){if(this.invalidateRecord(i),await this.resurrectByHandle(i).catch(()=>null)){let Z=await this.resolvePreviewUpstreamUrl(i);if(Z)try{v=await fetch($(Z),_);let T=new Headers;for(let[B,F]of v.headers.entries())if(!Gk0.includes(B.toLowerCase()))T.set(B,F);return l=v.status,new Response(v.body,{status:v.status,statusText:v.statusText,headers:T})}catch(T){console.warn(`[${a1}] preview fetch retry to ${O} failed: ${T instanceof Error?T.message:String(T)}`)}}}else this.invalidateRecord(i);l=502;let N=Mlu(502,{error:"sandbox daemon unreachable"});return N.headers.set(BK,"1"),N}let n=new Headers;for(let[D,O]of v.headers.entries())if(!Gk0.includes(D.toLowerCase()))n.set(D,O);return l=v.status,new Response(v.body,{status:v.status,statusText:v.statusText,headers:n})}finally{this.recordProxyDuration("preview",l,f,performance.now()-t,i)}}async ensureLocked(i,u,t,f){if(t.image)console.warn(`[${a1}] opts.image ignored (template ${this.sandboxTemplateName} pins image): got ${t.image}`);if(f){let E=await f.get(i,D$);if(E){let d=await this.rehydrate(i,u,E);if(d)return await this.refreshDaemonGitCredential(d,t),this.finish(d,f,!1,!0,"resume");await f.delete(i,D$)}}let l=await KD(this.kubeConfig,this.namespace,u).catch(()=>{return});if(l)if(l.metadata?.deletionTimestamp)await GZi(this.kubeConfig,this.namespace,u).catch((E)=>{console.warn(`[${a1}] wait for terminating claim ${u} failed: ${E instanceof Error?E.message:String(E)}`)});else{let E=await this.adopt(i,u,l).catch((d)=>{return console.warn(`[${a1}] adopt ${u} failed, recreating: ${d instanceof Error?d.message:String(d)}`),null});if(E)return await this.refreshDaemonGitCredential(E,t),this.finish(E,f,!0,!0,"adopt");await P7(this.kubeConfig,this.namespace,u).catch(()=>{}),await GZi(this.kubeConfig,this.namespace,u).catch((d)=>{console.warn(`[${a1}] wait for deleted claim ${u} failed: ${d instanceof Error?d.message:String(d)}`)})}let c=await this.provision(i,u,t);return this.finish(c,f,!0,!1,"fresh")}async finish(i,u,t,f,l){let c=this.records.get(i.handle),E=c!==void 0;if(c&&c.daemonForward!==i.daemonForward)this.closeForwarder(c.daemonForward);if(this.records.set(i.handle,i),t)await this.persist(u,i);if(f)await gk0(this.kubeConfig,this.namespace,i.handle,this.computeShutdownTime()).catch((d)=>console.warn(`[${a1}] TTL refresh failed for ${i.handle}: ${d instanceof Error?d.message:String(d)}`));if(this.metrics){let d=Vlu(i.tenant);if(this.metrics.ensureOutcome.add(1,{...d,outcome:l}),!E)this.metrics.active.add(1,d)}return this.toSandbox(i)}buildEnvMap(i,u){let t={},f=[];for(let[l,c]of Object.entries(i.env??{}))if(sHf.has(l))f.push(l);else t[l]=c;if(f.length>0)console.warn(`[${a1}] opts.env keys overlap reserved bootstrap names and were dropped: ${f.join(",")}`);return{...t,DAEMON_TOKEN:u.token,DAEMON_BOOT_ID:u.daemonBootId,APP_ROOT:u.workdir,PROXY_PORT:String(A7)}}buildClaim(i,u,t){let f=this.sentinelToken!==null,l=f?[]:Object.entries(this.buildEnvMap(u,t)).sort(([d],[$])=>d<$?-1:d>$?1:0).map(([d,$])=>({name:d,value:$})),c=Dbf(u),E=Object.keys(c).length>0;return{apiVersion:`${W1.CLAIM_API_GROUP}/${W1.CLAIM_API_VERSION}`,kind:"SandboxClaim",metadata:{name:i,namespace:this.namespace,labels:{"app.kubernetes.io/name":"studio-sandbox","app.kubernetes.io/managed-by":"studio",...this.envName?{[S3.env]:this.envName}:{},...qlu(u.tenant)},...E?{annotations:c}:{}},spec:{sandboxTemplateRef:{name:this.sandboxTemplateName},additionalPodMetadata:{labels:qlu(u.tenant,{[S3.role]:"claimed",[S3.sandboxHandle]:i,...this.envName?{[S3.env]:this.envName}:{}}),...E?{annotations:c}:{}},env:l,warmpool:f?"default":"none",lifecycle:{shutdownPolicy:"Delete",shutdownTime:this.computeShutdownTime()}}}}async provision(i,u,t){let f=this.tokenGenerator(),l=qHf(),c=Clu,E=this.buildClaim(u,t,{token:f,daemonBootId:l,workdir:c});try{await sa(this.kubeConfig,this.namespace,E)}catch(v){if(v instanceof ea)await GZi(this.kubeConfig,this.namespace,u),await sa(this.kubeConfig,this.namespace,E);else throw v}let d;try{d=await Ok0(this.kubeConfig,this.namespace,u),await KZi(this.kubeConfig,this.namespace,d)}catch(v){throw await P7(this.kubeConfig,this.namespace,u).catch(()=>{}),v}try{await this.ensureServicePortForAdoptedSandbox(d),await this.ensureHttpRouteForHandle(u,d,t.tenant??null)}catch(v){throw await P7(this.kubeConfig,this.namespace,u).catch(()=>{}),v}let $=await this.openForwarder(d,A7,u),w=`http://127.0.0.1:${$.localPort}`,h=this.workloadConfigPayload(t),_=l;try{if(await uli(w),this.sentinelToken!==null){let v=await ili(w);if(v)_=v.bootId;await s8(w,this.sentinelToken,h??{},{rotateToken:f})}else if(h)await s8(w,f,h);if(t.orgFsConfigJson)await Zbu(w,f,t.orgFsConfigJson).catch((v)=>console.warn("[org-fs] sidecar config relay failed",v))}catch(v){throw this.closeForwarder($),await this.deleteHttpRouteIfManaged(u).catch(()=>{}),await P7(this.kubeConfig,this.namespace,u).catch(()=>{}),v}return{id:i,handle:u,adoptedSandboxName:d,token:f,workdir:c,daemonUrl:w,daemonForward:$,workload:t.workload??null,daemonBootId:_,tenant:t.tenant??null,ensureOpts:Obf(t)}}workloadConfigPayload(i){return kfu({runtime:i?.workload?.runtime??"node",packageManager:i?.workload?.packageManager?{name:i.workload.packageManager,...i.workload.packageManagerPath?{path:i.workload.packageManagerPath}:{}}:null,repo:i?.repo??null,port:i?.workload?.devPort??aHf,tenant:i?.tenant??void 0})}async refreshDaemonGitCredential(i,u){let t=Gfu(u);if(!t)return;try{await s8(i.daemonUrl,i.token,t)}catch(f){console.warn(`[${a1}] git credential refresh failed for ${i.handle}: ${f instanceof Error?f.message:String(f)}`)}}async withFreshCloneUrl(i,u){if(!this.mintCloneUrl)return i;try{let t=await this.mintCloneUrl(i,u!==void 0?{bufferMs:u}:void 0);return t?{...i,cloneUrl:t}:i}catch(t){return console.warn(`[${a1}] clone credential re-mint failed: ${t instanceof Error?t.message:String(t)}`),i}}startCredentialRefresher(){if(!this.mintCloneUrl)return;let{signal:i}=this.claimWatchAbort;(async()=>{while(!i.aborted){if(await F0(ibf,{signal:i}).catch(()=>{}),i.aborted)break;try{await this.refreshAllGitCredentials()}catch(u){console.warn(`[${a1}] periodic credential refresh failed: ${u instanceof Error?u.message:String(u)}`)}}})()}async refreshAllGitCredentials(){await kk0(this.records.values(),(i)=>i.ensureOpts?.repo?.connectionId,async(i)=>{if(this.claimWatchAbort.signal.aborted)return;let u=i.ensureOpts?.repo;if(!u)return;let t=await this.withFreshCloneUrl(u,ubf);await this.refreshDaemonGitCredential(i,{...i.ensureOpts,repo:t}),i.ensureOpts={...i.ensureOpts,repo:t}})}async rebootstrapDaemon(i,u,t){if(this.sentinelToken===null)return!1;let f=this.workloadConfigPayload(t)??{};try{return await s8(i,this.sentinelToken,f,{rotateToken:u}),!0}catch(l){if(l instanceof p4i&&l.status===401)try{return await s8(i,u,f,{rotateToken:u}),!0}catch(c){return console.warn(`[${a1}] re-bootstrap retry with claim token failed: ${c instanceof Error?c.message:String(c)}`),!1}return console.warn(`[${a1}] re-bootstrap failed: ${l instanceof Error?l.message:String(l)}`),!1}}async ensureServicePortForAdoptedSandbox(i){if(!this.previewGateway||!this.previewUrlPattern)return;await Fk0(this.kubeConfig,this.namespace,i,{name:"daemon",port:A7,targetPort:A7})}async ensureHttpRouteForHandle(i,u,t){if(!this.previewGateway||!this.previewUrlPattern)return;let f=Nbf(this.previewUrlPattern,i);if(!f)throw new e1(`Unable to derive preview hostname for ${i} from pattern: ${this.previewUrlPattern}`);let l={apiVersion:`${pa.API_GROUP}/${pa.API_VERSION}`,kind:"HTTPRoute",metadata:{name:i,namespace:this.namespace,labels:qlu(t??void 0,{[S3.role]:"claimed",[S3.sandboxHandle]:i,"app.kubernetes.io/name":"studio-sandbox","app.kubernetes.io/managed-by":"studio",...this.envName?{[S3.env]:this.envName}:{}})},spec:{parentRefs:[{kind:"Gateway",group:"gateway.networking.k8s.io",name:this.previewGateway.name,namespace:this.previewGateway.namespace}],hostnames:[f],rules:[{backendRefs:[{group:"",kind:"Service",name:u,port:A7}]}]}};await SZi(this.kubeConfig,this.namespace,l)}async deleteHttpRouteIfManaged(i){if(!this.previewGateway)return;await jZi(this.kubeConfig,this.namespace,i)}async rehydrate(i,u,t){let f=t.state;if(!f.adoptedSandboxName&&!f.podName||!f.token)return null;let l=await KD(this.kubeConfig,this.namespace,u).catch(()=>{return});if(!l||!Sk0(l))return null;let c=l.status?.sandbox?.name??f.adoptedSandboxName??f.podName??u,E=await this.openAndProbeDaemon(c,u);if(!E)return null;if(f.daemonBootId&&f.daemonBootId!==E.bootId){if(this.sentinelToken!==null){let d=f.ensureOpts?.repo?{...f.ensureOpts,repo:await this.withFreshCloneUrl(f.ensureOpts.repo)}:f.ensureOpts??null;if(!await this.rebootstrapDaemon(E.daemonUrl,f.token,d))return this.closeForwarder(E.daemonForward),null}else console.warn(`[${a1}] daemon restart detected (handle=${u}): stored bootId=${f.daemonBootId} live bootId=${E.bootId}`);await this.stateStore?.put(i,D$,{handle:u,state:{...f,daemonBootId:E.bootId}}).catch((d)=>console.warn(`[${a1}] bootId persist failed for ${u}: ${d instanceof Error?d.message:String(d)}`))}return{id:i,handle:u,adoptedSandboxName:c,token:f.token,workdir:f.workdir??Clu,daemonUrl:E.daemonUrl,daemonForward:E.daemonForward,workload:f.workload??null,daemonBootId:E.bootId,tenant:f.tenant??null,ensureOpts:f.ensureOpts??null}}async adopt(i,u,t){if(!Sk0(t))return null;let f=t.status?.sandbox?.name??u;if(this.sentinelToken!==null)return null;let l=Ebf(t);if(!l)return null;let c=await this.openAndProbeDaemon(f,u);if(!c)return null;let E=gbf(t);if(this.previewGateway)await this.ensureServicePortForAdoptedSandbox(f).catch((d)=>{console.warn(`[${a1}] Service port backfill failed for ${u}: ${d instanceof Error?d.message:String(d)}`)}),await this.ensureHttpRouteForHandle(u,f,E).catch((d)=>{console.warn(`[${a1}] HTTPRoute backfill failed for ${u}: ${d instanceof Error?d.message:String(d)}`)});return{id:i,handle:u,adoptedSandboxName:f,token:l,workdir:Clu,daemonUrl:c.daemonUrl,daemonForward:c.daemonForward,workload:null,daemonBootId:c.bootId,tenant:E,ensureOpts:null}}async openAndProbeDaemon(i,u){let t=await this.openForwarder(i,A7,u).catch(()=>null);if(!t)return null;let f=`http://127.0.0.1:${t.localPort}`,l=await ili(f);if(!l)return this.closeForwarder(t),null;return{daemonForward:t,daemonUrl:f,bootId:l.bootId}}async getRecord(i){let u=this.records.get(i);if(u)return u;if(!this.stateStore)return null;let t=await this.stateStore.getByHandle(D$,i);if(!t)return null;let f=await this.rehydrate(t.id,i,t);if(f)this.records.set(i,f);return f}async resurrectByHandle(i){if(!this.stateStore)return null;let u=await this.stateStore.getByHandle(D$,i);if(!u)return null;let t=u.state.ensureOpts;if(!t)return null;let f=t.repo?{...t,repo:await this.withFreshCloneUrl(t.repo)}:t;return await this.ensure(u.id,f),this.records.get(i)??null}invalidateRecord(i){let u=this.records.get(i);if(!u)return;this.records.delete(i),this.closeForwarder(u.daemonForward)}recordProxyDuration(i,u,t,f,l){if(!this.metrics)return;this.metrics.proxyDurationMs.record(f,{...Vlu(t?.tenant??null),source:i,sandbox_handle:t?.handle??l??"",status_code:u||0})}composePreviewUrl(i){if(this.previewUrlPattern)return s3i(this.previewUrlPattern,i.handle);return`http://127.0.0.1:${i.daemonForward.localPort}/`}toSandbox(i){return{handle:i.handle,workdir:i.workdir,previewUrl:this.composePreviewUrl(i)}}async persist(i,u){if(!i)return;let t={adoptedSandboxName:u.adoptedSandboxName,token:u.token,workdir:u.workdir,workload:u.workload,daemonBootId:u.daemonBootId,tenant:u.tenant,...u.ensureOpts?{ensureOpts:u.ensureOpts}:{}};await i.put(u.id,D$,{handle:u.handle,state:t})}computeShutdownTime(){return new Date(Date.now()+this.idleTtlMs).toISOString()}openForwarder(i,u,t=i){let f=dbf(t,u);return new Promise((l,c)=>{let E=(d,$)=>{let w=Kk0.createServer((h)=>this.handleForwardedConnection(h,i,u,t));w.once("error",(h)=>{if(h.code==="EADDRINUSE"&&$<fbf){try{w.close()}catch{}let _=rlu+(d-rlu+1)%Jk0;E(_,$+1);return}c(h)}),w.listen(d,"127.0.0.1",()=>{let h=w.address();if(!h||typeof h==="string"){w.close(),c(Error("port-forward listener failed to bind"));return}l({server:w,localPort:h.port})})};E(f,0)})}handleForwardedConnection(i,u,t,f){let l=new VHf,c=null,E=!1,d=()=>{if(E)return;if(E=!0,l.destroy(),c)try{c.close()}catch{}if(!i.destroyed)i.destroy()};i.pipe(l),i.on("error",d),i.on("close",d),this.portForward.portForward(this.namespace,u,[t],i,null,l).then(($)=>{let w=typeof $==="function"?$():$;if(!w){d();return}if(c=w,c.on("close",d),c.on("error",()=>{this.invalidateRecord(f),d()}),E)try{c.close()}catch{}}).catch(($)=>{console.warn(`[${a1}] port-forward to ${u}:${t} failed: ${rHf($)}`),this.invalidateRecord(f),d()})}closeForwarder(i){i.server.close((u)=>{if(u)console.warn(`[${a1}] port-forward close on :${i.localPort} errored: ${u instanceof Error?u.message:String(u)}`)})}close(){if(this.closed)return;this.closed=!0,this.claimWatchAbort.abort();for(let i of this.records.values())this.closeForwarder(i.daemonForward);this.records.clear()}}function lbf(i){return{active:i.createUpDownCounter("studio.sandbox.active",{description:"Active sandbox count, by runner kind and owning org. Cross-checks the cAdvisor-derived count from the cluster \u2014 divergence between the two indicates orphaned claims (mesh deleted but K8s didn't reap) or unattributed pods.",unit:"{sandbox}"}),ensureOutcome:i.createCounter("studio.sandbox.ensure.outcome",{description:"Outcome of each ensure() call: fresh provision, resume from state-store after restart, or adopt of a cluster-side claim mesh didn't know about. Cold-start ratio is the primary input for warm-pool sizing.",unit:"{call}"}),proxyDurationMs:i.createHistogram("studio.sandbox.proxy.duration_ms",{description:"Wall-clock latency of mesh-mediated requests to the sandbox daemon: tool exec proxies (source=daemon) and preview iframe traffic (source=preview).",unit:"ms"})}}function cbf(){let i=new AQ;return i.loadFromDefault(),i}function Sk0(i){return Boolean(i.status?.conditions?.some((u)=>u.type==="Ready"&&u.status==="True"))}function Ebf(i){let u=i.spec?.env;if(!u)return null;for(let t of u)if(t.name==="DAEMON_TOKEN"&&t.value)return t.value;return null}function dbf(i,u){let t=CHf("sha256").update(`${i}:${u}`).digest();return rlu+t.readUInt32BE(0)%Jk0}function Mlu(i,u){return new Response(JSON.stringify(u),{status:i,headers:{"content-type":"application/json","access-control-allow-origin":"*"}})}function jk0(i){let u=i.slice(0,wbf);return $bf.test(u)?u:""}function _bf(i){if(i===void 0)return null;let u=i.trim();if(u==="")return null;if(!hbf.test(u))throw Error(`AgentSandboxProvider: envName=${JSON.stringify(u)} is not a valid DNS-label-safe environment name (lowercase alphanumeric or '-', starts with a letter, ends alphanumeric, \u226432 chars). Mesh sets this from STUDIO_ENV; check the studio chart's configMap.`);return u}function qlu(i,u={}){let t={...u};if(i){let f=jk0(i.orgId),l=jk0(i.userId);if(f)t[S3.orgId]=f;if(l)t[S3.userId]=l}return t}function TK(i){let u="";for(let t of i){let f=t.codePointAt(0)??0;u+=f<32||f===127?" ":t}return u.slice(0,vbf)}function nbf(i){try{let u=new URL(i);return u.username="",u.password="",u.toString()}catch{return""}}function Dbf(i){let u={},t=i.tenant;if(t?.orgSlug)u[N_.orgSlug]=TK(t.orgSlug);if(t?.orgName)u[N_.orgName]=TK(t.orgName);if(t?.userEmail)u[N_.userEmail]=TK(t.userEmail);if(t?.userName)u[N_.userName]=TK(t.userName);let f=i.repo;if(f){if(f.displayName)u[N_.gitRepo]=TK(f.displayName);let l=nbf(f.cloneUrl);if(l)u[N_.gitRepoUrl]=TK(l);let c=i.branch??f.branch;if(c)u[N_.gitBranch]=TK(c)}return u}function gbf(i){let u=i.metadata?.labels;if(!u)return null;let t=u[S3.orgId],f=u[S3.userId];if(!t||!f)return null;let l=i.metadata?.annotations??{};return{orgId:t,userId:f,orgSlug:l[N_.orgSlug],orgName:l[N_.orgName],userEmail:l[N_.userEmail],userName:l[N_.userName]}}function Vlu(i){return{org_id:i?.orgId??"",user_id:i?.userId??"",runner_kind:D$}}function Obf(i){let u={};if(i.repo)u.repo=i.repo;if(i.workload)u.workload=i.workload;if(i.env&&Object.keys(i.env).length>0)u.env=i.env;if(i.tenant)u.tenant=i.tenant;return Object.keys(u).length>0?u:null}function Nbf(i,u){try{return new URL(s3i(i,u)).hostname||null}catch{return null}}var D$="agent-sandbox",a1="AgentSandboxProvider",BK="x-sandbox-preview-not-ready",mHf="agent-sandbox-system",eHf="studio-sandbox",A7=9000,aHf=3000,Clu="/app",oHf=32,sHf,pHf=900000,ibf=900000,ubf=1800000,tbf,Gk0,rlu=40000,Jk0=1e4,fbf=256,S3,N_,$bf,wbf=63,hbf,vbf=253;var Xk0=g(()=>{B4();Xlu();Pzi();p3i();JZi();aa();xk0();sHf=new Set(["DAEMON_TOKEN","DAEMON_BOOT_ID","APP_ROOT","PROXY_PORT"]),tbf=["cookie","host","connection","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","accept-encoding","content-length","upgrade"],Gk0=["connection","keep-alive","transfer-encoding","content-encoding","content-length"];S3={role:"studio.decocms.com/role",sandboxHandle:"studio.decocms.com/sandbox-handle",orgId:"studio.decocms.com/org-id",userId:"studio.decocms.com/user-id",env:"studio.decocms.com/env"},N_={orgSlug:"studio.decocms.com/org-slug",orgName:"studio.decocms.com/org-name",userEmail:"studio.decocms.com/user-email",userName:"studio.decocms.com/user-name",gitRepo:"studio.decocms.com/git-repo",gitRepoUrl:"studio.decocms.com/git-repo-url",gitBranch:"studio.decocms.com/git-branch"},$bf=/^([A-Za-z0-9]([-A-Za-z0-9_.]*[A-Za-z0-9])?)?$/;hbf=/^[a-z]([a-z0-9-]{0,30}[a-z0-9])?$/});var Lk0={};Yi(Lk0,{waitForSandboxReady:()=>KZi,getSandboxClaim:()=>KD,getHttpRoute:()=>Tk0,deleteSandboxClaim:()=>P7,deleteHttpRoute:()=>jZi,createSandboxClaim:()=>sa,applyHttpRoute:()=>SZi,SandboxTimeoutError:()=>yK,SandboxError:()=>e1,PREVIEW_NOT_READY_HEADER:()=>BK,KubeConfig:()=>AQ,K8S_CONSTANTS:()=>W1,HTTPROUTE_CONSTANTS:()=>pa,AgentSandboxProvider:()=>mlu});var elu=g(()=>{Xlu();aa();JZi();Xk0()});class LZi{kind=x7;userSub;dispatch;stateStore;records=new Map;constructor(i){if(!i.userSub)throw Error("DesktopSandboxProvider requires userSub");if(!i.dispatch)throw Error("DesktopSandboxProvider requires dispatch");this.userSub=i.userSub,this.dispatch=i.dispatch,this.stateStore=i.stateStore??null}async ensure(i,u={}){let t=u.branch??u.repo?.branch,f=h7(i,t),l=this.records.get(f);if(l){if(await this.probeHealth(f))return this.toSandbox(l);if(this.records.delete(f),this.stateStore)await this.stateStore.deleteByHandle(x7,f).catch(()=>{})}else if(this.stateStore){let v=(await this.stateStore.getByHandle(x7,f))?.state,n=v?.sandboxApiUrl;if(n){if(await this.probeHealth(f)){let D={handle:f,sandboxApiUrl:n,previewUrl:v?.previewUrl??n};return this.records.set(f,D),this.toSandbox(D)}await this.stateStore.deleteByHandle(x7,f).catch(()=>{})}}let c=fh({userName:u.tenant?.userName,userEmail:u.tenant?.userEmail}),E=JSON.stringify({handle:f,repo:u.repo,branch:t,...u.workload?{workload:u.workload}:{},...c?{operator:c}:{},...u.offloadAllowedHosts?{offloadAllowedHosts:u.offloadAllowedHosts}:{},...u.offloadAllowSameHostDev!==void 0?{offloadAllowSameHostDev:u.offloadAllowSameHostDev}:{},...u.orgFsConfigJson?{orgFsConfigJson:u.orgFsConfigJson}:{}}),d=await this.dispatchJson("POST","/api/sandboxes",E),$=JSON.parse(d);if(typeof $.sandboxApiUrl!=="string")throw Error("desktop ensure: daemon did not return a sandboxApiUrl string");let w=typeof $.previewUrl==="string"?$.previewUrl:$.sandboxApiUrl,h={handle:f,sandboxApiUrl:$.sandboxApiUrl,previewUrl:w};if(this.records.set(f,h),this.stateStore)await this.stateStore.put(i,x7,{handle:f,state:{handle:f,sandboxApiUrl:$.sandboxApiUrl,previewUrl:w}});return this.toSandbox(h)}async proxyDaemonRequest(i,u,t){let f=u.startsWith("/")?u:`/${u}`,l=f.startsWith("/_sandbox/")?f.slice(9):f,c=`/_sandbox/${encodeURIComponent(i)}${l}`,E=new Headers(t.headers);for(let y of["host","cookie","connection","keep-alive","transfer-encoding","upgrade","authorization"])E.delete(y);let d={};E.forEach((y,Z)=>{d[Z]=y});let $;if(t.body!=null)$=await Zbf(t.body);let h=this.dispatch(this.userSub,{method:t.method,path:c,headers:d,body:$},{signal:t.signal})[Symbol.asyncIterator](),_=ybf(),v=200,n={"content-type":"application/octet-stream"},D=[];try{while(!0){let y=await h.next();if(y.done)break;let Z=y.value;if(Z.headers){v=Z.headers.status,n=Z.headers.headers;break}if(Z.data!=null){let T=_.push(Z.data);if(T.length)D.push(T)}}}catch(y){let Z=y instanceof Error?y.message:"dispatch error";return new Response(JSON.stringify({error:Z}),{status:502,headers:{"content-type":"application/json"}})}let O=!1,N=new ReadableStream({async start(y){for(let Z of D)y.enqueue(Z)},async pull(y){try{while(!0){let Z=await h.next();if(O)return;if(Z.done){let B=_.flush();if(B.length)y.enqueue(B);y.close();return}let T=Z.value;if(T.data!=null){let B=_.push(T.data);if(B.length){y.enqueue(B);return}}}}catch(Z){if(!O)y.error(Z)}},cancel(){O=!0,h.return?.()}});return new Response(N,{status:v,headers:n})}async alive(i){return this.probeHealth(i)}async probeHealth(i){let u=new AbortController,t=setTimeout(()=>u.abort(),3000);try{return await this.dispatchJson("GET",`/api/sandboxes/${encodeURIComponent(i)}`,void 0,u.signal),!0}catch{return!1}finally{clearTimeout(t)}}async forgetHandle(i){if(this.records.delete(i),this.stateStore)await this.stateStore.deleteByHandle(x7,i).catch(()=>{})}async delete(i){if(this.records.delete(i),this.stateStore)await this.stateStore.deleteByHandle(x7,i).catch(()=>{});try{await this.dispatchJson("DELETE",`/api/sandboxes/${encodeURIComponent(i)}`)}catch(u){if(!(u instanceof Error?u.message:String(u)).includes("404"))throw u}}async getPreviewUrl(i){return(await this.resolveRecord(i))?.previewUrl??null}async localWorkdir(i){return null}async*watchClaimLifecycle(i,u){yield{kind:"ready"}}toSandbox(i){return{handle:i.handle,workdir:i.sandboxApiUrl,previewUrl:i.previewUrl}}async resolveRecord(i){let u=this.records.get(i);if(u)return u;if(!this.stateStore)return null;let f=(await this.stateStore.getByHandle(x7,i))?.state,l=f?.sandboxApiUrl;if(!l)return null;let c={handle:i,sandboxApiUrl:l,previewUrl:f?.previewUrl??l};return this.records.set(i,c),c}async dispatchJson(i,u,t,f){let l={accept:"application/json"};if(t!==void 0)l["content-type"]="application/json";let c=this.dispatch(this.userSub,{method:i,path:u,headers:l,body:t},{signal:f}),E=null,d="";for await(let w of c)if(w.headers)E=w.headers.status;else if(w.data!=null)d+=w.data;let $=Buffer.from(d,"base64").toString("utf8");if(E!=null&&(E<200||E>=300))throw Error(`daemon returned ${E}: ${$}`);return $}}function Wk0(i){return new LZi(i)}function ybf(){let i="";return{push(u){if(u.length===0)return alu;i+=u;let t=i.length-i.length%4;if(t===0)return alu;let f=i.slice(0,t);return i=i.slice(t),new Uint8Array(Buffer.from(f,"base64"))},flush(){if(i.length===0)return alu;let u=i;return i="",new Uint8Array(Buffer.from(u,"base64"))}}}async function Zbf(i){if(typeof i==="string")return i;if(i instanceof ArrayBuffer)return Buffer.from(i).toString("utf8");if(ArrayBuffer.isView(i))return Buffer.from(i.buffer,i.byteOffset,i.byteLength).toString("utf8");if(i instanceof URLSearchParams)return i.toString();return await new Response(i).text()}var x7="user-desktop",alu;var Yk0=g(()=>{p3i();s4i();alu=new Uint8Array(0)});var zk0={};Yi(zk0,{createDesktopProvider:()=>Wk0,DesktopSandboxProvider:()=>LZi});var Qk0=g(()=>{Yk0()});var qk0={};Yi(qk0,{subscribeLifecycle:()=>io,getSandboxProviderByKind:()=>slu,getOrInitSharedRunner:()=>xbf,buildDesktopProvider:()=>WZi,__resetSharedLifecyclesForTesting:()=>Kbf});function Ck0(i,u){let t=Hk0[i];if(t)return Promise.resolve(t);let f=olu[i];if(f)return f;let l=u().then((c)=>{return Hk0[i]=c,c}).finally(()=>{delete olu[i]});return olu[i]=l,l}function Fbf(){let i=process.env.STUDIO_SANDBOX_PREVIEW_URL_PATTERN;return i&&i.trim()!==""?i:void 0}function Ubf(){let i=process.env.STUDIO_SANDBOX_TEMPLATE_NAME;return i&&i.trim()!==""?i:void 0}function Ibf(){let i=process.env.STUDIO_ENV;return i&&i.trim()!==""?i:void 0}function Pbf(){let i=process.env.STUDIO_SANDBOX_SENTINEL_TOKEN;return i&&i.trim()!==""?i:void 0}function Abf(){let i=process.env.STUDIO_SANDBOX_PREVIEW_GATEWAY_NAME?.trim(),u=process.env.STUDIO_SANDBOX_PREVIEW_GATEWAY_NAMESPACE?.trim();if(!i&&!u)return;if(!i||!u)throw Error("STUDIO_SANDBOX_PREVIEW_GATEWAY_NAME and STUDIO_SANDBOX_PREVIEW_GATEWAY_NAMESPACE must both be set, or both unset. Half-configured per-claim HTTPRoute routing would silently fail to attach.");return{name:i,namespace:u}}async function Mk0(i,u){let t=new n7(u),f=Fbf();switch(i){case"agent-sandbox":{let{AgentSandboxProvider:l}=await Promise.resolve().then(() => (elu(),Lk0)),c=new bn(Zu().encryptionKey);return new l({stateStore:t,previewUrlPattern:f,sandboxTemplateName:Ubf(),envName:Ibf(),previewGateway:Abf(),sentinelToken:Pbf(),meter:qt,mintCloneUrl:async(E,d)=>{if(!E.connectionId)return null;let $=RB0(E.cloneUrl);if(!$)return null;let{cloneUrl:w}=await D7(E.connectionId,$.owner,$.name,u,c,{bufferMs:d?.bufferMs});return w}})}case"user-desktop":throw Error("user-desktop provider cannot be instantiated without a per-run link claim \u2014 call resolveSandboxProvider, which binds the link before constructing the provider.");default:throw Error(`Unknown sandbox provider kind: ${String(i)}`)}}async function WZi(i,u){let{DesktopSandboxProvider:t}=await Promise.resolve().then(() => (Qk0(),zk0)),{getProxyDispatch:f}=await Promise.resolve().then(() => (i1u(),plu)),l=new n7(i.db);if(!u)throw Error("buildDesktopProvider: userSub must be a non-empty string");let c=f();return new t({userSub:u,dispatch:c,stateStore:l})}function slu(i,u){return Ck0(u,()=>Mk0(u,i.db))}async function xbf(){let i;try{i=UD()}catch(t){return console.warn("[lifecycle] cannot resolve sandbox runner:",t instanceof Error?t.message:String(t)),null}return await Ck0(i,()=>Mk0(i,Vt().db))}function io(i,u,t){let f=k7.get(u);if(f){if(f.terminated){if(f.lastPhase)try{t(f.lastPhase)}catch{}return{unsubscribe:Sbf}}if(f.listeners.add(t),f.lastPhase)try{t(f.lastPhase)}catch{}return bk0(u,f,t)}let l=new AbortController,c={lastPhase:null,terminated:!1,listeners:new Set([t]),abort:l};return k7.set(u,c),jbf(i,u,c),bk0(u,c,t)}function Sbf(){}function bk0(i,u,t){return{unsubscribe(){if(k7.get(i)!==u)return;if(u.listeners.delete(t),u.listeners.size===0)k7.delete(i),u.abort.abort()}}}async function jbf(i,u,t){let f=null;try{for await(let l of i.watchClaimLifecycle(u,t.abort.signal)){if(t.abort.signal.aborted)break;t.lastPhase=l;let c=l.kind==="ready"||l.kind==="failed";if(c)t.terminated=!0;let E=Array.from(t.listeners);for(let d of E)try{d(l)}catch{}if(c)break}}catch(l){f=l}finally{if(!t.terminated&&!t.abort.signal.aborted&&t.listeners.size>0){let l={kind:"failed",reason:"unknown",message:f instanceof Error?f.message:"Lifecycle watcher ended unexpectedly"};t.lastPhase=l,t.terminated=!0;for(let c of Array.from(t.listeners))try{c(l)}catch{}}if(k7.get(u)===t)k7.delete(u)}}function Kbf(){for(let i of k7.values())i.abort.abort();k7.clear()}var Tbf,Bbf,Rk0,Hk0,olu,kbf,Gbf,k7;var uo=g(()=>{vw();QE();Hl();vhi();Sa();ZV();Zt();Tbf=Symbol.for("decocms.sandbox.lifecycle.runners"),Bbf=Symbol.for("decocms.sandbox.lifecycle.inflight"),Rk0=globalThis,Hk0=Rk0[Tbf]??={},olu=Rk0[Bbf]??={};kbf=Symbol.for("decocms.sandbox.lifecycle.shared-lifecycles"),Gbf=globalThis,k7=Gbf[kbf]??=new Map});async function y_(i,u){let{userId:t,branch:f,virtualMcpMetadata:l,explicitKind:c}=u;if(c)return{provider:await to(i,t,c),kind:c};if(i.sandboxPreference==="agent-sandbox")return{provider:await to(i,t,"agent-sandbox"),kind:"agent-sandbox"};if(i.sandboxPreference==="user-desktop")return{provider:await WZi(i,t),kind:"user-desktop"};if(i.sandboxPreference==="cluster-default"){let h=UD();return{provider:await to(i,t,h),kind:h}}let[E,...d]=Jbf(l,t,f);if(E){let h=d.length===0?E:Xbf(E,d);return{provider:await to(i,t,h),kind:h}}let $=Vk0();return{provider:await to(i,t,$),kind:$}}function Jbf(i,u,t){let f=Fc(i)[u]?.[t];if(!f)return[];let l=t3(f);return Object.keys(l)}function Xbf(i,u){let t=Vk0();if(t===i||u.includes(t))return t;return i}function Vk0(){return UD()}async function to(i,u,t){if(t!=="user-desktop")return slu(i,t);return WZi(i,u)}var jQ=g(()=>{ff();vw();k3();uo()});var fo;var u1u=g(()=>{fo={npm:{install:"npm install",run:(i)=>`npm run ${i}`,runtime:"node"},pnpm:{install:"pnpm install",run:(i)=>`pnpm run ${i}`,runtime:"node"},yarn:{install:"yarn install",run:(i)=>`yarn run ${i}`,runtime:"node"},bun:{install:"bun install",run:(i)=>`bun run ${i}`,runtime:"bun"},deno:{install:"deno install",run:(i)=>`deno task ${i}`,runtime:"deno"}}});function YZi(i){if(!i)return null;let u=i.runtime;if(!u||typeof u!=="object")return null;let t=u.env;if(!Array.isArray(t))return null;let f=[];for(let l of t){if(!l||typeof l!=="object")continue;let c=l;if(typeof c.key!=="string"||!Yq.test(c.key))continue;if(c.kind==="literal"&&typeof c.value==="string"){f.push({key:c.key,kind:"literal",value:c.value});continue}if(c.kind==="secret"&&typeof c.secretId==="string"&&c.secretId.length>0)f.push({key:c.key,kind:"secret",secretId:c.secretId})}return f.length===0?null:f}async function rk0(i,u){Gi(u);let t=yi(u);await u.access.check();let f=Hu(u);if(!f)throw Error("User ID required");let l=await u.storage.virtualMcps.findById(i.virtualMcpId);if(!l||l.organization_id!==t.id)throw Error("Virtual MCP not found");let c=l.metadata??{},E=Fc(c),d=PD(E,f,i.branch,i.sandboxProviderKind);return{virtualMcp:l,metadata:c,userId:f,entry:d,organization:t}}function zZi(i){let u=i.runtime??null,f=u?.selected??null,l=u?.port??null,c=u?.path??null;if(!f||!(f in fo))return{packageManager:null,runtime:null,port:l,packageManagerPath:c,runtimeBinPath:null};let E=fo[f].runtime;return{packageManager:f,runtime:E,port:l,packageManagerPath:c,runtimeBinPath:E==="deno"?"/opt/deno/bin":E==="bun"?"/opt/bun/bin":null}}var KQ=g(()=>{ff();u1u();k3()});async function QZi({ctx:i,runner:u,handle:t,orgId:f,userId:l,entries:c}){if(!c||c.length===0)return;let E={};for(let $ of c){if($.kind==="literal"){E[$.key]=$.value;continue}try{let{value:w}=await i.storage.secrets.resolveById($.secretId,f,l);E[$.key]=w}catch(w){if(w instanceof Sv||w instanceof fz){console.warn(`[SANDBOX_START] skipping env ${$.key}: ${w.message}. Re-link or recreate the secret to restore.`);continue}throw w}}if(Object.keys(E).length===0)return;let d=await u.proxyDaemonRequest(t,"/_sandbox/config",{method:"PUT",headers:new Headers({"content-type":"application/json"}),body:JSON.stringify({env:E})});if(!d.ok){let $=await d.text().catch(()=>d.statusText);console.warn(`[SANDBOX_START] daemon rejected env patch (${d.status}): ${$}`)}}var t1u=g(()=>{d$i()});async function ak0(i,u,t,f,l){let c=await mg({connectionId:i,tokenStorage:new Vl(f,l)});if(!c.accessToken)return null;return sk0(u,t,c.accessToken)}function ok0(i,u){return sk0(i,u,null)}async function sk0(i,u,t){let f=new Map,l=new Set(mk0.map(($)=>$.path));for(let $ of Object.values(ek0))for(let w of $??[])l.add(w);await Promise.all(Array.from(l).map(async($)=>{f.set($,await Wbf(i,u,$,t))}));let c=mk0.find(({path:$})=>f.get($)!==null);if(!c)return null;let E=ek0[c.pm]??[],d=null;for(let $ of E)if(d=Ybf(f.get($)??null),d)break;return{packageManager:c.pm,devPort:d}}async function Wbf(i,u,t,f){let l=`https://api.github.com/repos/${i}/${u}/contents/${encodeURIComponent(t)}`;try{let c={Accept:"application/vnd.github+json","User-Agent":"mesh-runtime-detect"};if(f)c.Authorization=`token ${f}`;let E=await fetch(l,{headers:c,signal:AbortSignal.timeout(5000)});if(!E.ok)return null;let d=await E.json();if(!d.content||d.encoding!=="base64")return null;return Buffer.from(d.content,"base64").toString("utf8")}catch{return null}}function Ybf(i){if(!i)return null;try{let u=JSON.parse(i),t=u.tasks??u.scripts??{};return(t.dev??t.start??"").match(Lbf)?.[1]??null}catch{return null}}var mk0,ek0,Lbf;var pk0=g(()=>{eg();l_();mk0=[{path:"deno.json",pm:"deno"},{path:"deno.jsonc",pm:"deno"},{path:"bun.lock",pm:"bun"},{path:"bunfig.toml",pm:"bun"},{path:"pnpm-lock.yaml",pm:"pnpm"},{path:"yarn.lock",pm:"yarn"},{path:"package-lock.json",pm:"npm"},{path:"package.json",pm:"bun"}],ek0={deno:["deno.json","deno.jsonc"],bun:["package.json"],pnpm:["package.json"],yarn:["package.json"],npm:["package.json"]},Lbf=/(?:--port|PORT=|:)(\d{4,5})/});async function HZi(i,u){if(!i)return{hosts:[],allowSameHostDev:!1};let t;try{t=await i.presignedGetUrl("link-dispatch/_allowlist_probe",60,{requireFetchable:!0})}catch{return{hosts:[],allowSameHostDev:!1}}let f;try{f=new URL(t)}catch{return{hosts:[],allowSameHostDev:!1}}if(f.protocol!=="https:"&&f.protocol!=="http:")return{hosts:[],allowSameHostDev:!1};let l=f.hostname,c=zbf.has(l);return{hosts:[l],allowSameHostDev:c&&!u.isProduction}}var zbf;var f1u=g(()=>{zbf=new Set(["127.0.0.1","localhost","::1","[::1]","0.0.0.0"])});import{z as $5}from"zod";async function iG0(i,u){Gi(u);let t=yi(u),f=Hu(u);if(!f)throw Error("User ID required");let l=await u.storage.virtualMcps.findById(i.virtualMcpId);if(!l||l.organization_id!==t.id)throw Error("Virtual MCP not found");let c=l.metadata??{},E=PD(Fc(c),f,i.branch,i.sandboxProviderKind),d=i.sandboxProviderKind,{provider:$}=await y_(u,{userId:f,branch:i.branch,virtualMcpMetadata:c,explicitKind:d});if(E){if(d!=="user-desktop")return E;if(await $.alive(E.sandboxHandle).catch(()=>!1))return E;await v7(u.storage.virtualMcps,i.virtualMcpId,f,f,i.branch,d).catch((v)=>{console.warn("[ensureSandbox] failed to reap stale user-desktop entry",v)})}let w=c.githubRepo??null,{entry:h}=await uG0({ctx:u,userId:f,orgId:t.id,virtualMcpId:i.virtualMcpId,branch:i.branch,metadata:c,githubRepo:w,existing:null,providerKind:d,runner:$});return h}async function uG0(i){let{ctx:u,userId:t,orgId:f,virtualMcpId:l,branch:c,metadata:E,githubRepo:d,existing:$,runner:w}=i,{runtime:h,packageManager:_,port:v,packageManagerPath:n}=zZi(E),D;if(d){if(d.connectionId)await gQ({ctx:u,connectionId:d.connectionId,organizationId:f,forceRefresh:!0,onLegacyMintError:(wi)=>{console.error("[provisionSandbox] repo-scoped legacy token mint failed",{connectionId:d.connectionId,error:wi.message})}});let{cloneUrl:m,gitUserName:z,gitUserEmail:di}=d.connectionId?await D7(d.connectionId,d.owner,d.name,u.db,u.vault):nhi(d.owner,d.name);if(!_){let wi=d.connectionId?await ak0(d.connectionId,d.owner,d.name,u.db,u.vault):await ok0(d.owner,d.name);if(wi)_=wi.packageManager,h=fo[wi.packageManager].runtime,v=wi.devPort??v,await Hbf(u,l,t,wi.packageManager,wi.devPort)}D={cloneUrl:m,...d.connectionId?{connectionId:d.connectionId}:{},userName:z,userEmail:di,branch:c,displayName:`${d.owner}/${d.name}`}}let O=h&&_?{runtime:h,packageManager:_,...v!==null?{devPort:Number(v)}:{},...n?{packageManagerPath:n}:{}}:void 0,N=FD({orgId:f,virtualMcpId:l,branch:c}),y=w.kind==="user-desktop"?await HZi(u.objectStorage,{isProduction:Zu().nodeEnv==="production"}):null,Z=(w.kind==="user-desktop"||w.kind==="agent-sandbox")&&!Zu().orgFsMountsDisabled,T;if(Z){let m=u.organization?.slug??(await u.db.selectFrom("organization").select(["slug"]).where("id","=",f).executeTakeFirst())?.slug;if(m)T=await Lwi(u,{orgSlug:m,orgId:f,baseUrl:r_()})}let B=await w.ensure({userId:t,projectRef:N},{branch:c,repo:D,workload:O,tenant:{orgId:f,userId:t,...u.organization?.slug?{orgSlug:u.organization.slug}:{},...u.organization?.name?{orgName:u.organization.name}:{},...u.auth.user?.email?{userEmail:u.auth.user.email}:{},...u.auth.user?.name?{userName:u.auth.user.name}:{}},...y?{offloadAllowedHosts:y.hosts,offloadAllowSameHostDev:y.allowSameHostDev}:{},...T?{orgFsConfigJson:T}:{}}),F=E.runtime?.env??null;await QZi({ctx:u,runner:w,handle:B.handle,orgId:f,userId:t,entries:F});let S=!!$&&$.sandboxHandle===B.handle&&$?.createdAt?$.createdAt:Date.now(),A=E.runtime?.selected??null,k=E.runtime?.port??null,M=E.runtime?.path??null,J={sandboxHandle:B.handle,previewUrl:B.previewUrl,sandboxApiUrl:B.previewUrl,sandboxProviderKind:w.kind,createdAt:S,startedWith:{packageManager:A,port:k,path:M}};await KB0(u.storage.virtualMcps,l,t,t,c,i.providerKind,J);let L=!$||$.sandboxHandle!==B.handle;return{entry:J,isNewVm:L}}async function Hbf(i,u,t,f,l){let c=await i.storage.virtualMcps.findById(u);if(!c)return;let E=c.metadata??{};await i.storage.virtualMcps.update(u,t,{metadata:{...E,runtime:{selected:f,port:l}}})}var Qbf,l1u;var c1u=g(()=>{vw();cu();KQ();t1u();k3();Sa();pk0();u1u();jQ();f1u();Zt();bE();Cz();k3();Qbf=$5.enum(["agent-sandbox","user-desktop","cluster"]),l1u=fi({name:"SANDBOX_START",description:"Start a sandbox with the connected GitHub repo and dev server.",annotations:{title:"Start VM Preview",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!1,openWorldHint:!0},_meta:{ui:{visibility:"app"}},inputSchema:$5.object({virtualMcpId:$5.string().describe("Virtual MCP ID"),branch:$5.string().min(1).optional().describe("Optional git branch to check out. When omitted the handler generates a Bayer-style `<greek-letter>-<constellation>` name (e.g. `alpha-centauri`) and uses it. The resolved branch is returned in the response so callers can persist it."),sandboxProviderKind:Qbf.optional().describe("Explicit runtime choice. Hosted provider is `agent-sandbox`; legacy `cluster` input is accepted only for compatibility and normalized to `agent-sandbox`. When omitted, defaults to `user-desktop` if the acting user's link daemon is online, else the env kind.")}),outputSchema:$5.object({previewUrl:$5.string().nullable(),sandboxHandle:$5.string(),branch:$5.string(),isNewVm:$5.boolean(),sandboxProviderKind:$5.enum(["agent-sandbox","user-desktop"])}),handler:async(i,u)=>{Gi(u);let t=yi(u);await u.access.check();let f=i.branch??n3i(u.auth.user?.name??u.auth.user?.email?.split("@")[0]),l=Hu(u);if(!l)throw Error("User ID required");let c=await u.storage.virtualMcps.findById(i.virtualMcpId);if(!c||c.organization_id!==t.id)throw Error("Virtual MCP not found");let E=c.metadata??{},d=i.sandboxProviderKind?BD(i.sandboxProviderKind):void 0,{provider:$,kind:w}=await y_(u,{userId:l,branch:f,virtualMcpMetadata:E,explicitKind:d}),h=PD(Fc(E),l,f,w),_=E.githubRepo??null,{entry:v,isNewVm:n}=await uG0({ctx:u,userId:l,orgId:t.id,virtualMcpId:i.virtualMcpId,branch:f,metadata:E,githubRepo:_,existing:h,providerKind:w,runner:$});return{...v,branch:f,isNewVm:n,sandboxProviderKind:w}}})});async function E1u(i,u){let{provider:t,kind:f}=await y_(i,{userId:u.userId,branch:u.branch,virtualMcpMetadata:null}),l=null,c=()=>{if(!l)l=iG0({virtualMcpId:u.virtualMcpId,branch:u.branch,sandboxProviderKind:f},i).then(($)=>$.sandboxHandle),l.catch(()=>{l=null});return l},E=u.branch==="ephemeral"||f==="user-desktop";return Sfu(t,{ensureHandle:c,invalidateHandle:async()=>{let $=l;if(l=null,!E)return;try{await v7(i.storage.virtualMcps,u.virtualMcpId,u.userId,u.userId,u.branch,f)}catch(w){console.warn("[cluster-sandbox-fs] failed to reap vmMap entry",w)}if($&&typeof t.forgetHandle==="function")try{let w=await $;await t.forgetHandle(w)}catch(w){console.warn("[cluster-sandbox-fs] forgetHandle failed",w)}},canAutoRestart:E})}async function tG0(i,u){try{let t=await E1u(i,u),{stdout:f}=await t.onBash("test -d .deco && echo __DECO_SITE__");return f.includes("__DECO_SITE__")}catch(t){return console.warn("[cluster-sandbox-fs] .deco probe failed; assuming deco site",t),!0}}var d1u=g(()=>{vw();jQ();c1u();k3()});function JQ(i){let u=i.toISOString();return`<current-context>
 Current date: ${u.slice(0,10)}
 Current time: ${u.slice(11,16)} UTC
 </current-context>`}var fG0,lG0;var $1u=g(()=>{fG0={type:"ephemeral",ttl:"5m"},lG0={openrouter:{cache_control:{type:"ephemeral",ttl:"5m"}}}});function cG0(i,u){let t=[],f=i.length-1,l=i.length-2;for(let c=0;c<i.length;c++){let E=c===l||c===f;t.push({role:"system",content:i[c],...E?{providerOptions:bbf}:{}})}return t.push({role:"system",content:JQ(u)}),t}var bbf;var EG0=g(()=>{$1u();bbf={anthropic:{cacheControl:fG0}}});function dG0(i){if(i.length===0)return null;return`