decocms 4.321.3 → 4.321.4

package/dist/server/cli.js

@@ -1524,7 +1524,7 @@ Usage: deco services <up|down|status>`),process.exit(1)}}var up1=L(()=>{rf()});f
       `.execute($);if(Number(W.rows[0]?.cnt)===0){console.warn(`Failed to migrate ${J}/${K}, keeping in old table`);continue}}await Py`
       DELETE FROM kysely_migration WHERE name = ${X}
     `.execute($)}}async function ma1($){await Ss8($),await Cs8($);let Z=new ca1({db:$,provider:{getMigrations:()=>Promise.resolve($n0)}}),{error:X,results:Q}=await Z.migrateToLatest(),Y=0;if(Q?.forEach((G)=>{if(G.status==="Success")Y++;else if(G.status==="Error")console.error(`Failed to execute migration "${G.migrationName}"`)}),X)throw console.error("Failed to migrate"),console.error(X),X;return Y}async function _s8($){let{keepOpen:Z=!1,database:X,skipBetterAuth:Q=!1}=$??{},Y="skipped";if(!Q&&!X)Y=await ll0();let G=X??h$(),J=async()=>{if(!Z&&!X)await ZO(G).catch((K)=>{console.warn("Warning: Error closing database:",K)})};try{let K=await ma1(G.db);return await J(),{betterAuth:Y,kysely:K}}catch(K){throw await J(),K}}async function vs8(){let $=h$(),Z=new ca1({db:$.db,provider:{getMigrations:()=>Promise.resolve($n0)}}),{error:X,results:Q}=await Z.migrateDown();if(Q?.forEach((Y)=>{if(Y.status==="Success")console.log(`\u2705 Migration "${Y.migrationName}" rolled back successfully`);else if(Y.status==="Error")console.error(`\u274C Failed to rollback migration "${Y.migrationName}"`)}),X)throw console.error("Failed to rollback migration"),console.error(X),X}var ia1=L(()=>{ua1();ml0();GX()});async function D70($){let Z={...process.env},X=W80($,Z);console.log(lw1(X.settings.encryptionKey));let Q=X.settings.betterAuthSecret||(X.settings.localMode?wt1(X.settings.dataDir):""),{ensureServices:Y}=await Promise.resolve().then(() => (zZ0(),jZ0)),{outputs:G,services:J}=await Y({home:X.settings.dataDir,externalDatabaseUrl:X.externalDatabaseUrl,externalNatsUrl:X.externalNatsUrl});if(!X.skipMigrations){let{migrateBetterAuth:W}=await Promise.resolve().then(() => (ml0(),jt1));await W(G.databaseUrl);let{createDatabase:H}=await Promise.resolve().then(() => (GX(),fn1)),{migrateToLatest:F}=await Promise.resolve().then(() => (ia1(),da1)),U=H(G.databaseUrl);await F({keepOpen:!0,database:U,skipBetterAuth:!0})}let K={...X.settings,betterAuthSecret:Q,databaseUrl:G.databaseUrl,natsUrls:G.natsUrls,...G.s3?{s3Endpoint:G.s3.endpoint,s3Bucket:G.s3.bucket,s3AccessKeyId:G.s3.accessKeyId,s3SecretAccessKey:G.s3.secretAccessKey,s3ForcePathStyle:G.s3.forcePathStyle}:{}};return cp1(K),{settings:K,services:J.map((W)=>({name:W.name==="PostgreSQL"?"Postgres":W.name,port:W.port})),managedServiceNames:J.filter((W)=>W.owner==="managed").map((W)=>W.name)}}var Zn0=L(()=>{rf();Et1();z$()});var oa1={};s(oa1,{updateService:()=>iE,subscribeCliState:()=>Yn0,setTuiConsoleIntercepted:()=>w70,setServerUrl:()=>Dp,setMigrationsDone:()=>Lp,setDevMode:()=>fs8,resetCliStateForTests:()=>xs8,isTuiConsoleIntercepted:()=>E70,getCliState:()=>Qn0,addLogEntry:()=>WO});function pa1(){return[{name:"Postgres",status:"pending",port:0},{name:"NATS",status:"pending",port:0}]}function na1(){return{services:pa1(),migrationsStatus:"pending",serverUrl:null,logs:[]}}function xs8(){dQ=na1()}function Op(){for(let $ of Xn0)$()}function Qn0(){return dQ}function Yn0($){return Xn0.add($),()=>Xn0.delete($)}function iE($){dQ={...dQ,services:dQ.services.map((Z)=>Z.name===$.name?$:Z)},Op()}function Lp(){dQ={...dQ,migrationsStatus:"done"},Op()}function Dp($){dQ={...dQ,serverUrl:$},Op()}function WO($){let Z=[...dQ.logs,$];dQ={...dQ,logs:Z.length>500?Z.slice(-500):Z},Op()}function fs8(){dQ={...dQ,services:[...pa1(),{name:"API",status:"pending",port:0},{name:"Vite",status:"pending",port:0}]},Op()}function w70($){ta1=$}function E70(){return ta1}var dQ,Xn0,ta1=!1;var pE=L(()=>{dQ=na1();Xn0=new Set});import{createServer as ra1}from"net";function bs8($){return new Promise((Z)=>{let X=ra1();X.once("error",()=>Z(!1)),X.listen($,"0.0.0.0",()=>{X.close(()=>Z(!0))})})}async function wp($){if(await bs8($))return $;let Z=await new Promise((X,Q)=>{let Y=ra1();Y.once("error",Q),Y.listen(0,"0.0.0.0",()=>{let G=Y.address(),J=typeof G==="object"&&G?G.port:0;Y.close(()=>X(J))})});return console.warn(`Port ${$} is in use, using port ${Z} instead.`),Z}var Gn0=()=>{};var Kn0={};s(Kn0,{startDevServer:()=>gs8,pipeToLogStore:()=>Jn0});import{join as ys8}from"path";function Jn0($){let Z=$.getReader(),X=new TextDecoder,Q="";function Y(){let G=Q.split(`
-`);Q=G.pop()??"";for(let J of G){let K=Bun.stripANSI(J).replace(/^\[\d+\]\s*/,"").trim();if(!K)continue;WO({method:"",path:"",status:0,duration:0,timestamp:new Date,rawLine:K})}}(async()=>{try{for(;;){let{done:G,value:J}=await Z.read();if(G)break;Q+=X.decode(J,{stream:!0}),Y()}}catch{}if(Q.trim()){let G=Bun.stripANSI(Q).replace(/^\[\d+\]\s*/,"").trim();if(G)WO({method:"",path:"",status:0,duration:0,timestamp:new Date,rawLine:G})}})()}async function gs8($){let{baseUrl:Z,noTui:X}=$,Q=process.env.HOST==="0.0.0.0"&&Boolean(process.env.PORT),Y=Q?process.env.PORT:$.vitePort,G=Z||`http://localhost:${Y}`,J=Q?await wp(Number(Y)+1):await wp(Number($.port)),{settings:K,services:W,managedServiceNames:H}=await D70({port:String(J),home:$.home,baseUrl:$.baseUrl,localMode:$.localMode,skipMigrations:$.skipMigrations,noTui:$.noTui,vitePort:$.vitePort});for(let D of W)iE({name:D.name,status:"ready",port:D.port});Lp();let F=ys8(import.meta.dir,"..","..","..","..",".."),U=X===!0,N=Bun.spawn(["bun","run","dev:servers"],{cwd:F,env:{...process.env,PORT:String(K.port),VITE_PORT:String(Y),DATABASE_URL:K.databaseUrl,NATS_URL:K.natsUrls.join(","),NODE_ENV:K.nodeEnv,BASE_URL:G,DECOCMS_LOCAL_MODE:String(K.localMode),DECOCMS_HOME:K.dataDir,DATA_DIR:K.dataDir,DECO_CLI:"1",...K.betterAuthSecret?{BETTER_AUTH_SECRET:K.betterAuthSecret}:{},...K.s3Endpoint?{S3_ENDPOINT:K.s3Endpoint,S3_BUCKET:K.s3Bucket??"",S3_ACCESS_KEY_ID:K.s3AccessKeyId??"",S3_SECRET_ACCESS_KEY:K.s3SecretAccessKey??"",S3_FORCE_PATH_STYLE:String(K.s3ForcePathStyle)}:{},...K.natsCredsPath?{NATS_CREDS:K.natsCredsPath}:{}},stdio:["inherit",U?"inherit":"pipe",U?"inherit":"pipe"]});if(!U)Jn0(N.stdout),Jn0(N.stderr);Dp(G),iE({name:"Vite",status:"ready",port:Number(Y)}),iE({name:"API",status:"ready",port:Number(K.port)});let O=async(D)=>{if(N.kill(D),await N.exited,H.length>0){let{stopServices:w}=await Promise.resolve().then(() => (zZ0(),jZ0));await w(K.dataDir)}};return process.on("SIGINT",()=>O("SIGINT")),process.on("SIGTERM",()=>O("SIGTERM")),{port:Number(Y),process:N}}var Wn0=L(()=>{Zn0();pE();Gn0()});var j70;var Hn0=L(()=>{j70={name:"decocms",version:"4.321.3",description:"Deco CMS \u2014 Self-hostable MCP Gateway for managing AI connections and tools",author:"Deco team",repository:{type:"git",url:"git+https://github.com/decocms/studio.git",directory:"apps/api"},bugs:{url:"https://github.com/decocms/studio/issues"},type:"module",bin:{deco:"./dist/server/cli.js"},files:["dist/**/*"],scripts:{dev:"bun run migrate && bun run dev:server","dev:server":"bun run --cwd=../../packages/sandbox build && NODE_ENV=development bun --env-file=.env --hot run src/index.ts",build:"bun run build:server","build:server":"bun run scripts/bundle-server-script.ts --dist ./dist/server","generate:tool-contracts":"bun run scripts/generate-tool-contracts.ts","db:migrate":"bun run ./dist/server/migrate.js","db:migrate:dbos":"bun run ./dist/server/migrate-dbos.js",check:"tsc --noEmit",start:"bun run ./dist/server/server.js",migrate:"bun run src/database/migrate.ts","migrate:dbos":"bun run src/database/migrate-dbos.ts",test:"bun test src","better-auth:migrate":"bunx --bun @better-auth/cli migrate -y --config src/auth/index.ts",prepublishOnly:"bun run --cwd=../.. build:studio"},optionalDependencies:{"@duckdb/node-api":"^1.5.0-r.1"},dependencies:{"@ai-sdk/anthropic":"^3.0.85","@ai-sdk/google":"^3.0.83","@ai-sdk/openai":"^3.0.73","@anthropic-ai/sdk":"^0.105.0","@aws-sdk/client-s3":"^3.1013.0","@aws-sdk/client-sts":"^3.1013.0","@aws-sdk/lib-storage":"^3.1013.0","@aws-sdk/s3-request-presigner":"^3.1013.0","@clickhouse/client":"^1.8.1","@dbos-inc/dbos-sdk":"^4.21.6","@inkjs/ui":"^2.0.0","@nats-io/jetstream":"3.4.0","@nats-io/kv":"3.4.0","@nats-io/nats-core":"3.4.0","@nats-io/transport-node":"3.4.0","@openrouter/ai-sdk-provider":"^2.9.1","@opentelemetry/core":"^2.6.0","embedded-postgres":"^18.3.0-beta.16",ink:"^6.8.0",kysely:"^0.28.12","posthog-node":"^5.0.0",react:"^19.2.6","react-dom":"^19.2.6"},devDependencies:{"@ai-sdk/provider":"^3.0.10","@better-auth/sso":"1.4.1","@decocms/better-auth":"1.5.17","@decocms/bindings":"workspace:*","@decocms/mcp-utils":"workspace:*","@decocms/runtime":"workspace:*","@decocms/sandbox":"workspace:*","@decocms/shared":"workspace:*","@jitl/quickjs-wasmfile-release-sync":"0.31.0","@modelcontextprotocol/sdk":"1.29.0","@opentelemetry/api":"^1.9.0","@opentelemetry/api-logs":"^0.211.0","@opentelemetry/exporter-logs-otlp-proto":"^0.211.0","@opentelemetry/exporter-prometheus":"^0.208.0","@opentelemetry/exporter-trace-otlp-proto":"^0.207.0","@opentelemetry/instrumentation-runtime-node":"^0.24.0","@opentelemetry/resources":"^2.6.0","@opentelemetry/sdk-logs":"^0.211.0","@opentelemetry/sdk-metrics":"^2.2.0","@opentelemetry/sdk-node":"^0.207.0","@opentelemetry/sdk-trace-base":"^2.5.0","@types/bun":"^1.3.1","@types/google.maps":"^3.65.2","@types/pg":"^8.15.6","@types/react-syntax-highlighter":"^15.5.13","@vercel/nft":"^1.1.1",ai:"^6.0.208","better-auth":"1.4.22",croner:"^9.1.0",degit:"^2.8.4",hono:"^4.10.7",jose:"^6.0.11",nanoid:"^5.1.6",pg:"^8.16.3",typescript:"^7.0.2",typescript5:"npm:typescript@^5.9.3",zod:"4.3.6"},homepage:"https://github.com/decocms/studio",keywords:["mcp","model-context-protocol","ai","gateway","self-hosted","tools"],license:"MIT",publishConfig:{access:"public"}}});import{Box as us8,Text as aa1}from"ink";import{jsx as cs8,jsxs as sa1}from"react/jsx-runtime";function ea1({version:$}){return sa1(us8,{flexDirection:"column",marginTop:1,children:[mZ0.map((Z,X)=>cs8(aa1,{color:dZ0[X],children:Z},X)),sa1(aa1,{dimColor:!0,children:[" v",$]})]})}var $s1=L(()=>{Xp()});import{Box as nE,Text as HO}from"ink";import{Spinner as ls8}from"@inkjs/ui";import{jsx as JG,jsxs as Ay}from"react/jsx-runtime";function Zs1({status:$}){if($==="pending")return JG(ls8,{label:""});return JG(HO,{color:"green",children:"\u2713"})}function ms8($){return`${$.name}: ${$.port||"...."}`}function Xs1({services:$,migrationsStatus:Z,home:X,serverUrl:Q}){return Ay(nE,{flexDirection:"column",paddingBottom:1,children:[JG(ea1,{version:j70.version}),JG(nE,{marginBottom:1,children:JG(HO,{dimColor:!0,children:"\u2500".repeat(80)})}),JG(nE,{children:Ay(HO,{dimColor:!0,children:["Home: ",X]})}),Ay(nE,{gap:2,children:[$.map((Y)=>Ay(nE,{gap:1,children:[JG(HO,{children:ms8(Y)}),JG(Zs1,{status:Y.status})]},Y.name)),Ay(nE,{gap:1,children:[JG(HO,{children:"Migrations"}),JG(Zs1,{status:Z})]})]}),JG(nE,{children:Q?Ay(HO,{children:["Open in browser: ",JG(HO,{color:"cyan",children:Q})]}):JG(HO,{dimColor:!0,children:"Starting..."})})]})}var Qs1=L(()=>{Hn0();$s1()});import{Box as ds8,Text as Ep}from"ink";import{jsx as Fn0,jsxs as Un0}from"react/jsx-runtime";function is8($){if($>=500)return"red";if($>=400)return"yellow";if($>=300)return"cyan";return"green"}function Ys1({logs:$}){return Fn0(ds8,{flexDirection:"column",children:$.map((Z,X)=>{if(Z.rawLine)return Fn0(Ep,{dimColor:!0,children:Z.rawLine},X);let Q=Z.duration<1000?`${Z.duration}ms`:`${(Z.duration/1000).toFixed(1)}s`;return Un0(Ep,{children:[Un0(Ep,{dimColor:!0,children:[Z.method.padEnd(6)," ",Z.path.padEnd(30)," "]}),Fn0(Ep,{color:is8(Z.status),children:Z.status}),Un0(Ep,{dimColor:!0,children:[" ",Q.padStart(8)]})]},X)})})}var Gs1=()=>{};var Nn0={};s(Nn0,{App:()=>ts8});import{Box as ps8}from"ink";import{useSyncExternalStore as ns8}from"react";import{jsx as Js1,jsxs as os8}from"react/jsx-runtime";function ts8({home:$}){let Z=ns8(Yn0,Qn0);return os8(ps8,{flexDirection:"column",children:[Js1(Xs1,{services:Z.services,migrationsStatus:Z.migrationsStatus,home:$,serverUrl:Z.serverUrl}),Js1(Ys1,{logs:Z.logs})]})}var Bn0=L(()=>{Qs1();Gs1();pE()});var m3="thread-gate",UU="decopilot-hosted-harness",NU="decopilot-hosted-harness-sandboxed",zJ="automations",FO="background-tools",tE="task-board-github-reads";var Ks1="11";function Ws1($){return{name:"decocms",systemDatabaseUrl:$.systemDatabaseUrl,systemDatabaseSchemaName:"dbos",systemDatabasePoolSize:$.poolSize,runAdminServer:!1,executorID:$.executorID,applicationVersion:Ks1,...$.listenQueues!==void 0?{listenQueues:$.listenQueues}:{}}}var Hs1=()=>{};import rs8 from"pg";async function Us1($,Z){let{databaseUrl:X,lockTimeoutMs:Q=as8}=$,Y=$.log??((W)=>console.log(W)),G=new rs8.Client({connectionString:X});await G.connect();let J=Date.now(),K=!1;try{while(!K){if(K=(await G.query("SELECT pg_try_advisory_lock($1) AS locked",[Fs1.toString()])).rows[0]?.locked===!0,K)break;if(Date.now()-J>=Q)throw Error(`Timed out after ${Q}ms waiting for the DBOS migration lock. Another process is still migrating the dbos schema; this pod will restart and retry.`);await H$(ss8)}let W=Date.now()-J;if(W>1000)Y(`[dbos] waited ${W}ms for the migration lock; another process migrated first`);return await Z()}finally{if(K)try{await G.query("SELECT pg_advisory_unlock($1)",[Fs1.toString()])}catch{}await G.end().catch(()=>{})}}var Fs1=8314027461559302n,as8=600000,ss8=500;var Ns1=L(()=>{Z4()});function es8(){let $=(process.env.BUN_OPTIONS??"").split(/\s+/).filter(Boolean);return[...process.argv.slice(1),...$]}function On0($,Z){for(let X=0;X<$.length;X++){let Q=$[X];if(Q===void 0)continue;if(Q===Z)return $[X+1];if(Q.startsWith(`${Z}=`))return Q.slice(Z.length+1)}return}function Bs1(){let $=es8();if($.includes("--cpu-prof")){console.log(JSON.stringify({msg:"cpu-profiling-active",dir:On0($,"--cpu-prof-dir")??process.cwd(),name:On0($,"--cpu-prof-name"),markdown:$.includes("--cpu-prof-md"),intervalUs:Number(On0($,"--cpu-prof-interval")??1000),note:"profile is written on process exit"}));return}if(process.env.CPU_PROFILE)console.warn(JSON.stringify({msg:"cpu-profiling-requested-but-inactive",hint:'CPU profiling is a Bun launch flag. Set BUN_OPTIONS="--cpu-prof --cpu-prof-md --cpu-prof-dir=/tmp" before starting the process.'}))}function Os1(){if(process.env.HEAP_WATCH!=="1")return()=>{};let $=Number(process.env.HEAP_WATCH_INTERVAL_MS??60000),Z=async()=>{let X=cE();if(!X)return;let Q={};try{let{heapStats:Y}=await import("bun:jsc"),G=Y(),J=Object.entries(G.objectTypeCounts).sort((K,W)=>W[1]-K[1]).slice(0,20);Q={objectCount:G.objectCount,heapSize:G.heapSize,top:Object.fromEntries(J)}}catch{}console.log(JSON.stringify({msg:"heap-watch",ts:new Date().toISOString(),uptimeS:Math.round(process.uptime()),rss:X.rss,heapUsed:X.heapUsed,heapTotal:X.heapTotal,external:X.external,arrayBuffers:X.arrayBuffers,...Q}))};return Z().catch(()=>{}),z70=setInterval(()=>void Z().catch(()=>{}),$),z70.unref?.(),process.on("SIGUSR2",()=>{try{let X=Bun.generateHeapSnapshot("v8"),Q=typeof X==="string"?X:JSON.stringify(X),Y=`/tmp/heap-${process.pid}-${Date.now()}.heapsnapshot`;Bun.write(Y,Q),console.log(JSON.stringify({msg:"heap-snapshot-written",path:Y}))}catch(X){console.error("[heap-watch] snapshot failed:",X)}}),()=>{if(z70)clearInterval(z70)}}var z70;var Ls1=()=>{};import*as $e8 from"bun:jsc";function Ds1(){if(process.env.STALL_WATCHDOG!=="1")return()=>{};let $=Number(process.env.STALL_WATCHDOG_MS??100),Z=Number(process.env.STALL_WATCHDOG_TICK_MS??50);try{Ze8()}catch(G){return console.error("[stall-watchdog] failed to start sampling profiler:",G),()=>{}}let X,Q=performance.now()+Z,Y=()=>{let G=performance.now(),J=G-Q;Q=G+Z;let K=[];try{K=Xe8()?.traces??[]}catch{}if(J>$&&K.length>0){let W=new Map;for(let F of K){let U=F.frames.find((O)=>O.sourceURL&&!/Unknown Executable/.test(O.category??""))??F.frames[0];if(!U)continue;let N=(U.sourceURL??"?").replace(/^.*\/node_modules\//,"node_modules/"),B=`${U.name??"?"} @ ${N}:${U.line??"?"}`;W.set(B,(W.get(B)??0)+1)}let H=[...W.entries()].sort((F,U)=>U[1]-F[1]).slice(0,8).map(([F,U])=>({frame:F,count:U}));console.warn(JSON.stringify({msg:"stall-stack",ts:new Date().toISOString(),lagMs:Math.round(J),samplesInWindow:K.length,top:H}))}X=setTimeout(Y,Z),X.unref?.()};return X=setTimeout(Y,Z),X.unref?.(),()=>{if(X)clearTimeout(X)}}var Ze8,Xe8;var ws1=L(()=>{({startSamplingProfiler:Ze8,samplingProfilerStackTraces:Xe8}=$e8)});function Es1(){Bs1();let $=[Os1(),Mn1(),Ds1()];return()=>{for(let Z of $)Z()}}var js1=L(()=>{vl0();Ls1();ws1()});var oE=v((zs1)=>{Object.defineProperty(zs1,"__esModule",{value:!0});zs1.RepublishHeaders=zs1.DirectMsgHeaders=zs1.JsHeaders=zs1.AdvisoryKind=void 0;zs1.isOrderedPushConsumerOptions=Qe8;zs1.isPullConsumer=Ye8;zs1.isPushConsumer=Ge8;zs1.isBoundPushConsumerOptions=Je8;function Qe8($){if($&&typeof $==="object")return"name_prefix"in $||"deliver_subject_prefix"in $||"filter_subjects"in $||"filter_subject"in $||"deliver_policy"in $||"opt_start_seq"in $||"opt_start_time"in $||"replay_policy"in $||"inactive_threshold"in $||"headers_only"in $||"deliver_prefix"in $;return!1}function Ye8($){return $.isPullConsumer()}function Ge8($){return $.isPushConsumer()}function Je8($){if($&&typeof $==="object")return"deliver_subject"in $||"deliver_group"in $||"idle_heartbeat"in $;return!1}zs1.AdvisoryKind={API:"api_audit",StreamAction:"stream_action",ConsumerAction:"consumer_action",SnapshotCreate:"snapshot_create",SnapshotComplete:"snapshot_complete",RestoreCreate:"restore_create",RestoreComplete:"restore_complete",MaxDeliver:"max_deliver",Terminated:"terminated",Ack:"consumer_ack",StreamLeaderElected:"stream_leader_elected",StreamQuorumLost:"stream_quorum_lost",ConsumerLeaderElected:"consumer_leader_elected",ConsumerQuorumLost:"consumer_quorum_lost"};zs1.JsHeaders={StreamSourceHdr:"Nats-Stream-Source",LastConsumerSeqHdr:"Nats-Last-Consumer",LastStreamSeqHdr:"Nats-Last-Stream",ConsumerStalledHdr:"Nats-Consumer-Stalled",MessageSizeHdr:"Nats-Msg-Size",RollupHdr:"Nats-Rollup",RollupValueSubject:"sub",RollupValueAll:"all",PendingMessagesHdr:"Nats-Pending-Messages",PendingBytesHdr:"Nats-Pending-Bytes",RequiredApiLevel:"Nats-Required-Api-Level"};zs1.DirectMsgHeaders={Stream:"Nats-Stream",Sequence:"Nats-Sequence",TimeStamp:"Nats-Time-Stamp",Subject:"Nats-Subject",LastSequence:"Nats-Last-Sequence",NumPending:"Nats-Num-Pending"};zs1.RepublishHeaders={Stream:"Nats-Stream",Subject:"Nats-Subject",Sequence:"Nats-Sequence",LastSequence:"Nats-Last-Sequence",Size:"Nats-Msg-Size"}});var KG=v((As1)=>{Object.defineProperty(As1,"__esModule",{value:!0});As1.TD=As1.TE=As1.Empty=void 0;As1.encode=Le8;As1.decode=De8;As1.Empty=new Uint8Array(0);As1.TE=new TextEncoder;As1.TD=new TextDecoder;function Oe8(...$){let Z=0;for(let Y=0;Y<$.length;Y++)Z+=$[Y].length;let X=new Uint8Array(Z),Q=0;for(let Y=0;Y<$.length;Y++)X.set($[Y],Q),Q+=$[Y].length;return X}function Le8(...$){let Z=[];for(let X=0;X<$.length;X++)Z.push(As1.TE.encode($[X]));if(Z.length===0)return As1.Empty;if(Z.length===1)return Z[0];return Oe8(...Z)}function De8($){if(!$||$.length===0)return"";return As1.TD.decode($)}});var WG=v((Is1)=>{Object.defineProperty(Is1,"__esModule",{value:!0});Is1.errors=Is1.PermissionViolationError=Is1.NoRespondersError=Is1.TimeoutError=Is1.RequestError=Is1.ProtocolError=Is1.ConnectionError=Is1.DrainingConnectionError=Is1.ClosedConnectionError=Is1.AuthorizationError=Is1.UserAuthenticationExpiredError=Is1.InvalidOperationError=Is1.InvalidArgumentError=Is1.InvalidSubjectError=void 0;class Dn0 extends Error{constructor($,Z){super(`illegal subject: '${$}'`,Z);this.name="InvalidSubjectError"}}Is1.InvalidSubjectError=Dn0;class P70 extends Error{constructor($,Z){super($,Z);this.name="InvalidArgumentError"}static format($,Z,X){if(Array.isArray(Z)&&Z.length>1)Z=Z[0];if(Array.isArray($))$=$.map((Q)=>`'${Q}'`),$=$.join(",");else $=`'${$}'`;return new P70(`${$} ${Z}`,X)}}Is1.InvalidArgumentError=P70;class wn0 extends Error{constructor($,Z){super($,Z);this.name="InvalidOperationError"}}Is1.InvalidOperationError=wn0;class A70 extends Error{constructor($,Z){super($,Z);this.name="UserAuthenticationExpiredError"}static parse($){if($.toLowerCase().indexOf("user authentication expired")!==-1)return new A70($);return null}}Is1.UserAuthenticationExpiredError=A70;class T70 extends Error{constructor($,Z){super($,Z);this.name="AuthorizationError"}static parse($){let Z=["authorization violation","account authentication expired","authentication timeout"],X=$.toLowerCase();for(let Q=0;Q<Z.length;Q++)if(X.indexOf(Z[Q])!==-1)return new T70($);return null}}Is1.AuthorizationError=T70;class En0 extends Error{constructor(){super("closed connection");this.name="ClosedConnectionError"}}Is1.ClosedConnectionError=En0;class jn0 extends Error{constructor(){super("connection draining");this.name="DrainingConnectionError"}}Is1.DrainingConnectionError=jn0;class zn0 extends Error{constructor($,Z){super($,Z);this.name="ConnectionError"}}Is1.ConnectionError=zn0;class Pn0 extends Error{constructor($,Z){super($,Z);this.name="ProtocolError"}}Is1.ProtocolError=Pn0;class An0 extends Error{constructor($="",Z){super($,Z);this.name="RequestError"}isNoResponders(){return this.cause instanceof R70}}Is1.RequestError=An0;class Tn0 extends Error{constructor($){super("timeout",$);this.name="TimeoutError"}}Is1.TimeoutError=Tn0;class R70 extends Error{subject;constructor($,Z){super(`no responders: '${$}'`,Z);this.subject=$,this.name="NoResponders"}}Is1.NoRespondersError=R70;class I70 extends Error{operation;subject;queue;constructor($,Z,X,Q,Y){super($,Y);this.name="PermissionViolationError",this.operation=Z,this.subject=X,this.queue=Q}static parse($){if(($?$.toLowerCase():"").indexOf("permissions violation")===-1)return null;let X="publish",Q="",Y=void 0,G=$.match(/(Publish|Subscription) to "(\S+)"/);if(G){if(X=G[1].toLowerCase(),Q=G[2],X==="subscription"){let J=$.match(/using queue "(\S+)"/);if(J)Y=J[1]}}return new I70($,X,Q,Y)}}Is1.PermissionViolationError=I70;Is1.errors={AuthorizationError:T70,ClosedConnectionError:En0,ConnectionError:zn0,DrainingConnectionError:jn0,InvalidArgumentError:P70,InvalidOperationError:wn0,InvalidSubjectError:Dn0,NoRespondersError:R70,PermissionViolationError:I70,ProtocolError:Pn0,RequestError:An0,TimeoutError:Tn0,UserAuthenticationExpiredError:A70}});var d3=v((Ss1)=>{Object.defineProperty(Ss1,"__esModule",{value:!0});Ss1.SimpleMutex=Ss1.Perf=void 0;Ss1.extend=ve8;Ss1.render=xe8;Ss1.timeout=fe8;Ss1.delay=be8;Ss1.deadline=ye8;Ss1.deferred=In0;Ss1.debugDeferred=ge8;Ss1.shuffle=he8;Ss1.collect=ue8;Ss1.jitter=ks1;Ss1.backoff=ce8;Ss1.nanos=le8;Ss1.millis=me8;Ss1.randomToken=pe8;var _e8=KG(),Rn0=WG();function ve8($,...Z){for(let X=0;X<Z.length;X++){let Q=Z[X];Object.keys(Q).forEach(function(Y){$[Y]=Q[Y]})}return $}function xe8($){return _e8.TD.decode($).replace(/\n/g,"\u240A").replace(/\r/g,"\u240D")}function fe8($,Z=!0){let X=Z?new Rn0.TimeoutError:null,Q,Y,G=new Promise((J,K)=>{Q={cancel:()=>{if(Y)clearTimeout(Y)}},Y=setTimeout(()=>{if(X===null)K(new Rn0.TimeoutError);else K(X)},$)});return Object.assign(G,Q)}function be8($=0){let Z,X=new Promise((Q)=>{let Y=setTimeout(()=>{Q()},$);Z={cancel:()=>{if(Y)clearTimeout(Y),Q()}}});return Object.assign(X,Z)}async function ye8($,Z=1000){let X=In0(),Q=setTimeout(()=>{X.reject(new Rn0.TimeoutError)},Z);try{return await Promise.race([$,X])}finally{clearTimeout(Q)}}function In0(){let $={},Z=new Promise((X,Q)=>{$={resolve:X,reject:Q}});return Object.assign(Z,$)}function ge8(){let $={},Z=new Promise((X,Q)=>{$={resolve:(Y)=>{console.trace("resolve",Y),X(Y)},reject:(Y)=>{console.trace("reject"),Q(Y)}}});return Object.assign(Z,$)}function he8($){for(let Z=$.length-1;Z>0;Z--){let X=Math.floor(Math.random()*(Z+1));[$[Z],$[X]]=[$[X],$[Z]]}return $}async function ue8($){let Z=[];for await(let X of $)Z.push(X);return Z}class Ms1{timers;measures;constructor(){this.timers=new Map,this.measures=new Map}mark($){this.timers.set($,performance.now())}measure($,Z,X){let Q=this.timers.get(Z);if(Q===void 0)throw Error(`${Z} is not defined`);let Y=this.timers.get(X);if(Y===void 0)throw Error(`${X} is not defined`);this.measures.set($,Y-Q)}getEntries(){let $=[];return this.measures.forEach((Z,X)=>{$.push({name:X,duration:Z})}),$}}Ss1.Perf=Ms1;class Vs1{max;current;waiting;constructor($=1){this.max=$,this.current=0,this.waiting=[]}lock(){if(this.current++,this.current<=this.max)return Promise.resolve();let $=In0();return this.waiting.push($),$}unlock(){this.current--,this.waiting.pop()?.resolve()}}Ss1.SimpleMutex=Vs1;function ks1($){if($===0)return 0;return Math.floor($/2+Math.random()*$)}function ce8($=[0,250,250,500,500,3000,5000]){if(!Array.isArray($))$=[0,250,250,500,500,3000,5000];let Z=$.length-1;return{backoff(X){return ks1(X>Z?$[Z]:$[X])}}}function le8($){return $*1e6}function me8($){return Math.floor($/1e6)}var de8="0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz",BU=new Uint8Array(62);for(let $=0;$<62;$++)BU[$]=de8.charCodeAt($);var ie8=218340105584896;function pe8(){let $=Math.floor(Math.random()*ie8),Z=$%62,X=BU[Z];$=($-Z)/62,Z=$%62;let Q=BU[Z];$=($-Z)/62,Z=$%62;let Y=BU[Z];$=($-Z)/62,Z=$%62;let G=BU[Z];$=($-Z)/62,Z=$%62;let J=BU[Z];$=($-Z)/62,Z=$%62;let K=BU[Z];$=($-Z)/62,Z=$%62;let W=BU[Z];$=($-Z)/62;let H=BU[$];return String.fromCharCode(X,Q,Y,G,J,K,W,H)}});var gs1=v((bs1)=>{Object.defineProperty(bs1,"__esModule",{value:!0});bs1.nuid=bs1.NuidImpl=void 0;var W04="0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz",UO=62,M70=12,xs1=10,_s1=33,H04=333,vs1=M70+xs1,Mn0=new Uint8Array(UO);for(let $=0;$<UO;$++)Mn0[$]=W04.charCodeAt($);var q70=4294967296,fs1=BigInt(UO)**BigInt(xs1),jp=Number(fs1/(1n<<32n)),qn0=Number(fs1%(1n<<32n));function F04($){for(let Z=0;Z<$.length;Z++)$[Z]=Math.floor(Math.random()*256)}function U04($){if(globalThis?.crypto?.getRandomValues)globalThis.crypto.getRandomValues($);else F04($)}class Vn0{buf;cbuf;seqHi;seqLo;inc;inited;constructor(){this.buf=new Uint8Array(vs1),this.cbuf=new Uint8Array(M70),this.inited=!1}init(){this.inited=!0,this.setPre(),this.initSeqAndInc(),this.fillSeq()}initSeqAndInc(){let $=0;do this.seqHi=Math.floor(Math.random()*(jp+1)),this.seqLo=Math.floor(Math.random()*q70);while($++<8&&this.seqHi===jp&&this.seqLo>=qn0);if(this.seqHi===jp&&this.seqLo>=qn0)this.seqLo=0;this.inc=Math.random()*(H04-_s1)+_s1|0}setPre(){U04(this.cbuf);for(let $=0;$<M70;$++)this.buf[$]=Mn0[this.cbuf[$]%UO]}fillSeq(){let $=this.seqHi,Z=this.seqLo;for(let X=vs1-1;X>=M70;X--){let Q=Math.floor($/UO),G=($-Q*UO)*q70+Z,J=Math.floor(G/UO),K=G-J*UO;this.buf[X]=Mn0[K],$=Q,Z=J}}next(){if(!this.inited)this.init();if(this.seqLo+=this.inc,this.seqLo>=q70)this.seqLo-=q70,this.seqHi+=1;if(this.seqHi>jp||this.seqHi===jp&&this.seqLo>=qn0)this.setPre(),this.initSeqAndInc();this.fillSeq();let $=this.buf;return String.fromCharCode($[0],$[1],$[2],$[3],$[4],$[5],$[6],$[7],$[8],$[9],$[10],$[11],$[12],$[13],$[14],$[15],$[16],$[17],$[18],$[19],$[20],$[21])}reset(){this.init()}}bs1.NuidImpl=Vn0;bs1.nuid=new Vn0});var ls1=v((us1)=>{Object.defineProperty(us1,"__esModule",{value:!0});us1.nuid=us1.Nuid=void 0;var hs1=gs1();us1.Nuid=hs1.NuidImpl;us1.nuid=hs1.nuid});var k70=v((V70)=>{Object.defineProperty(V70,"__esModule",{value:!0});V70.nuid=V70.Nuid=void 0;var ms1=ls1();Object.defineProperty(V70,"Nuid",{enumerable:!0,get:function(){return ms1.Nuid}});Object.defineProperty(V70,"nuid",{enumerable:!0,get:function(){return ms1.nuid}})});var NO=v((ds1)=>{Object.defineProperty(ds1,"__esModule",{value:!0});ds1.DEFAULT_HOST=ds1.DEFAULT_PORT=ds1.Match=void 0;ds1.syncIterator=w04;ds1.createInbox=E04;var L04=k70(),D04=WG();ds1.Match={Exact:"exact",CanonicalMIME:"canonical",IgnoreCase:"insensitive"};function w04($){let Z=$[Symbol.asyncIterator]();return{async next(){let X=await Z.next();if(X.done)return Promise.resolve(null);return Promise.resolve(X.value)}}}function E04($=""){if($=$||"_INBOX",typeof $!=="string")throw TypeError("prefix must be a string");return $.split(".").forEach((Z)=>{if(Z==="*"||Z===">")throw D04.InvalidArgumentError.format("prefix",`cannot have wildcards ('${$}')`)}),`${$}.${L04.nuid.next()}`}ds1.DEFAULT_PORT=4222;ds1.DEFAULT_HOST="127.0.0.1"});var zp=v((ts1)=>{Object.defineProperty(ts1,"__esModule",{value:!0});ts1.DataBuffer=void 0;var ps1=KG();class ns1{buffers;byteLength;constructor(){this.buffers=[],this.byteLength=0}static concat(...$){let Z=0;for(let Y=0;Y<$.length;Y++)Z+=$[Y].length;let X=new Uint8Array(Z),Q=0;for(let Y=0;Y<$.length;Y++)X.set($[Y],Q),Q+=$[Y].length;return X}static fromAscii($){if(!$)$="";return ps1.TE.encode($)}static toAscii($){return ps1.TD.decode($)}reset(){this.buffers.length=0,this.byteLength=0}pack(){if(this.buffers.length>1){let $=new Uint8Array(this.byteLength),Z=0;for(let X=0;X<this.buffers.length;X++)$.set(this.buffers[X],Z),Z+=this.buffers[X].length;this.buffers.length=0,this.buffers.push($)}}shift(){if(this.buffers.length){let $=this.buffers.shift();if($)return this.byteLength-=$.length,$}return new Uint8Array(0)}drain($){if(this.buffers.length){this.pack();let Z=this.buffers.pop();if(Z){let X=this.byteLength;if($===void 0||$>X)$=X;let Q=Z.subarray(0,$);if(X>$)this.buffers.push(Z.subarray($));return this.byteLength=X-$,Q}}return new Uint8Array(0)}fill($,...Z){if($)this.buffers.push($),this.byteLength+=$.length;for(let X=0;X<Z.length;X++)if(Z[X]&&Z[X].length)this.buffers.push(Z[X]),this.byteLength+=Z[X].length}peek(){if(this.buffers.length)return this.pack(),this.buffers[0];return new Uint8Array(0)}size(){return this.byteLength}length(){return this.buffers.length}}ts1.DataBuffer=ns1});var rE=v((as1)=>{Object.defineProperty(as1,"__esModule",{value:!0});as1.LF=as1.CR=as1.CRLF=as1.CR_LF_LEN=as1.CR_LF=void 0;as1.setTransportFactory=q04;as1.defaultPort=M04;as1.getUrlParseFn=V04;as1.newTransport=k04;as1.getResolveFn=S04;as1.protoLen=rs1;as1.extractProtocolMessage=C04;var T04=KG(),R04=NO(),I04=zp(),HG;function q04($){HG=$}function M04(){return HG!==void 0&&HG.defaultPort!==void 0?HG.defaultPort:R04.DEFAULT_PORT}function V04(){return HG!==void 0&&HG.urlParseFn?HG.urlParseFn:void 0}function k04(){if(!HG||typeof HG.factory!=="function")throw Error("transport fn is not set");return HG.factory()}function S04(){return HG!==void 0&&HG.dnsResolveFn?HG.dnsResolveFn:void 0}as1.CR_LF=`\r
+`);Q=G.pop()??"";for(let J of G){let K=Bun.stripANSI(J).replace(/^\[\d+\]\s*/,"").trim();if(!K)continue;WO({method:"",path:"",status:0,duration:0,timestamp:new Date,rawLine:K})}}(async()=>{try{for(;;){let{done:G,value:J}=await Z.read();if(G)break;Q+=X.decode(J,{stream:!0}),Y()}}catch{}if(Q.trim()){let G=Bun.stripANSI(Q).replace(/^\[\d+\]\s*/,"").trim();if(G)WO({method:"",path:"",status:0,duration:0,timestamp:new Date,rawLine:G})}})()}async function gs8($){let{baseUrl:Z,noTui:X}=$,Q=process.env.HOST==="0.0.0.0"&&Boolean(process.env.PORT),Y=Q?process.env.PORT:$.vitePort,G=Z||`http://localhost:${Y}`,J=Q?await wp(Number(Y)+1):await wp(Number($.port)),{settings:K,services:W,managedServiceNames:H}=await D70({port:String(J),home:$.home,baseUrl:$.baseUrl,localMode:$.localMode,skipMigrations:$.skipMigrations,noTui:$.noTui,vitePort:$.vitePort});for(let D of W)iE({name:D.name,status:"ready",port:D.port});Lp();let F=ys8(import.meta.dir,"..","..","..","..",".."),U=X===!0,N=Bun.spawn(["bun","run","dev:servers"],{cwd:F,env:{...process.env,PORT:String(K.port),VITE_PORT:String(Y),DATABASE_URL:K.databaseUrl,NATS_URL:K.natsUrls.join(","),NODE_ENV:K.nodeEnv,BASE_URL:G,DECOCMS_LOCAL_MODE:String(K.localMode),DECOCMS_HOME:K.dataDir,DATA_DIR:K.dataDir,DECO_CLI:"1",...K.betterAuthSecret?{BETTER_AUTH_SECRET:K.betterAuthSecret}:{},...K.s3Endpoint?{S3_ENDPOINT:K.s3Endpoint,S3_BUCKET:K.s3Bucket??"",S3_ACCESS_KEY_ID:K.s3AccessKeyId??"",S3_SECRET_ACCESS_KEY:K.s3SecretAccessKey??"",S3_FORCE_PATH_STYLE:String(K.s3ForcePathStyle)}:{},...K.natsCredsPath?{NATS_CREDS:K.natsCredsPath}:{}},stdio:["inherit",U?"inherit":"pipe",U?"inherit":"pipe"]});if(!U)Jn0(N.stdout),Jn0(N.stderr);Dp(G),iE({name:"Vite",status:"ready",port:Number(Y)}),iE({name:"API",status:"ready",port:Number(K.port)});let O=async(D)=>{if(N.kill(D),await N.exited,H.length>0){let{stopServices:w}=await Promise.resolve().then(() => (zZ0(),jZ0));await w(K.dataDir)}};return process.on("SIGINT",()=>O("SIGINT")),process.on("SIGTERM",()=>O("SIGTERM")),{port:Number(Y),process:N}}var Wn0=L(()=>{Zn0();pE();Gn0()});var j70;var Hn0=L(()=>{j70={name:"decocms",version:"4.321.4",description:"Deco CMS \u2014 Self-hostable MCP Gateway for managing AI connections and tools",author:"Deco team",repository:{type:"git",url:"git+https://github.com/decocms/studio.git",directory:"apps/api"},bugs:{url:"https://github.com/decocms/studio/issues"},type:"module",bin:{deco:"./dist/server/cli.js"},files:["dist/**/*"],scripts:{dev:"bun run migrate && bun run dev:server","dev:server":"bun run --cwd=../../packages/sandbox build && NODE_ENV=development bun --env-file=.env --hot run src/index.ts",build:"bun run build:server","build:server":"bun run scripts/bundle-server-script.ts --dist ./dist/server","generate:tool-contracts":"bun run scripts/generate-tool-contracts.ts","db:migrate":"bun run ./dist/server/migrate.js","db:migrate:dbos":"bun run ./dist/server/migrate-dbos.js",check:"tsc --noEmit",start:"bun run ./dist/server/server.js",migrate:"bun run src/database/migrate.ts","migrate:dbos":"bun run src/database/migrate-dbos.ts",test:"bun test src","better-auth:migrate":"bunx --bun @better-auth/cli migrate -y --config src/auth/index.ts",prepublishOnly:"bun run --cwd=../.. build:studio"},optionalDependencies:{"@duckdb/node-api":"^1.5.0-r.1"},dependencies:{"@ai-sdk/anthropic":"^3.0.85","@ai-sdk/google":"^3.0.83","@ai-sdk/openai":"^3.0.73","@anthropic-ai/sdk":"^0.105.0","@aws-sdk/client-s3":"^3.1013.0","@aws-sdk/client-sts":"^3.1013.0","@aws-sdk/lib-storage":"^3.1013.0","@aws-sdk/s3-request-presigner":"^3.1013.0","@clickhouse/client":"^1.8.1","@dbos-inc/dbos-sdk":"^4.21.6","@inkjs/ui":"^2.0.0","@nats-io/jetstream":"3.4.0","@nats-io/kv":"3.4.0","@nats-io/nats-core":"3.4.0","@nats-io/transport-node":"3.4.0","@openrouter/ai-sdk-provider":"^2.9.1","@opentelemetry/core":"^2.6.0","embedded-postgres":"^18.3.0-beta.16",ink:"^6.8.0",kysely:"^0.28.12","posthog-node":"^5.0.0",react:"^19.2.6","react-dom":"^19.2.6"},devDependencies:{"@ai-sdk/provider":"^3.0.10","@better-auth/sso":"1.4.1","@decocms/better-auth":"1.5.17","@decocms/bindings":"workspace:*","@decocms/mcp-utils":"workspace:*","@decocms/runtime":"workspace:*","@decocms/sandbox":"workspace:*","@decocms/shared":"workspace:*","@jitl/quickjs-wasmfile-release-sync":"0.31.0","@modelcontextprotocol/sdk":"1.29.0","@opentelemetry/api":"^1.9.0","@opentelemetry/api-logs":"^0.211.0","@opentelemetry/exporter-logs-otlp-proto":"^0.211.0","@opentelemetry/exporter-prometheus":"^0.208.0","@opentelemetry/exporter-trace-otlp-proto":"^0.207.0","@opentelemetry/instrumentation-runtime-node":"^0.24.0","@opentelemetry/resources":"^2.6.0","@opentelemetry/sdk-logs":"^0.211.0","@opentelemetry/sdk-metrics":"^2.2.0","@opentelemetry/sdk-node":"^0.207.0","@opentelemetry/sdk-trace-base":"^2.5.0","@types/bun":"^1.3.1","@types/google.maps":"^3.65.2","@types/pg":"^8.15.6","@types/react-syntax-highlighter":"^15.5.13","@vercel/nft":"^1.1.1",ai:"^6.0.208","better-auth":"1.4.22",croner:"^9.1.0",degit:"^2.8.4",hono:"^4.10.7",jose:"^6.0.11",nanoid:"^5.1.6",pg:"^8.16.3",typescript:"^7.0.2",typescript5:"npm:typescript@^5.9.3",zod:"4.3.6"},homepage:"https://github.com/decocms/studio",keywords:["mcp","model-context-protocol","ai","gateway","self-hosted","tools"],license:"MIT",publishConfig:{access:"public"}}});import{Box as us8,Text as aa1}from"ink";import{jsx as cs8,jsxs as sa1}from"react/jsx-runtime";function ea1({version:$}){return sa1(us8,{flexDirection:"column",marginTop:1,children:[mZ0.map((Z,X)=>cs8(aa1,{color:dZ0[X],children:Z},X)),sa1(aa1,{dimColor:!0,children:[" v",$]})]})}var $s1=L(()=>{Xp()});import{Box as nE,Text as HO}from"ink";import{Spinner as ls8}from"@inkjs/ui";import{jsx as JG,jsxs as Ay}from"react/jsx-runtime";function Zs1({status:$}){if($==="pending")return JG(ls8,{label:""});return JG(HO,{color:"green",children:"\u2713"})}function ms8($){return`${$.name}: ${$.port||"...."}`}function Xs1({services:$,migrationsStatus:Z,home:X,serverUrl:Q}){return Ay(nE,{flexDirection:"column",paddingBottom:1,children:[JG(ea1,{version:j70.version}),JG(nE,{marginBottom:1,children:JG(HO,{dimColor:!0,children:"\u2500".repeat(80)})}),JG(nE,{children:Ay(HO,{dimColor:!0,children:["Home: ",X]})}),Ay(nE,{gap:2,children:[$.map((Y)=>Ay(nE,{gap:1,children:[JG(HO,{children:ms8(Y)}),JG(Zs1,{status:Y.status})]},Y.name)),Ay(nE,{gap:1,children:[JG(HO,{children:"Migrations"}),JG(Zs1,{status:Z})]})]}),JG(nE,{children:Q?Ay(HO,{children:["Open in browser: ",JG(HO,{color:"cyan",children:Q})]}):JG(HO,{dimColor:!0,children:"Starting..."})})]})}var Qs1=L(()=>{Hn0();$s1()});import{Box as ds8,Text as Ep}from"ink";import{jsx as Fn0,jsxs as Un0}from"react/jsx-runtime";function is8($){if($>=500)return"red";if($>=400)return"yellow";if($>=300)return"cyan";return"green"}function Ys1({logs:$}){return Fn0(ds8,{flexDirection:"column",children:$.map((Z,X)=>{if(Z.rawLine)return Fn0(Ep,{dimColor:!0,children:Z.rawLine},X);let Q=Z.duration<1000?`${Z.duration}ms`:`${(Z.duration/1000).toFixed(1)}s`;return Un0(Ep,{children:[Un0(Ep,{dimColor:!0,children:[Z.method.padEnd(6)," ",Z.path.padEnd(30)," "]}),Fn0(Ep,{color:is8(Z.status),children:Z.status}),Un0(Ep,{dimColor:!0,children:[" ",Q.padStart(8)]})]},X)})})}var Gs1=()=>{};var Nn0={};s(Nn0,{App:()=>ts8});import{Box as ps8}from"ink";import{useSyncExternalStore as ns8}from"react";import{jsx as Js1,jsxs as os8}from"react/jsx-runtime";function ts8({home:$}){let Z=ns8(Yn0,Qn0);return os8(ps8,{flexDirection:"column",children:[Js1(Xs1,{services:Z.services,migrationsStatus:Z.migrationsStatus,home:$,serverUrl:Z.serverUrl}),Js1(Ys1,{logs:Z.logs})]})}var Bn0=L(()=>{Qs1();Gs1();pE()});var m3="thread-gate",UU="decopilot-hosted-harness",NU="decopilot-hosted-harness-sandboxed",zJ="automations",FO="background-tools",tE="task-board-github-reads";var Ks1="11";function Ws1($){return{name:"decocms",systemDatabaseUrl:$.systemDatabaseUrl,systemDatabaseSchemaName:"dbos",systemDatabasePoolSize:$.poolSize,runAdminServer:!1,executorID:$.executorID,applicationVersion:Ks1,...$.listenQueues!==void 0?{listenQueues:$.listenQueues}:{}}}var Hs1=()=>{};import rs8 from"pg";async function Us1($,Z){let{databaseUrl:X,lockTimeoutMs:Q=as8}=$,Y=$.log??((W)=>console.log(W)),G=new rs8.Client({connectionString:X});await G.connect();let J=Date.now(),K=!1;try{while(!K){if(K=(await G.query("SELECT pg_try_advisory_lock($1) AS locked",[Fs1.toString()])).rows[0]?.locked===!0,K)break;if(Date.now()-J>=Q)throw Error(`Timed out after ${Q}ms waiting for the DBOS migration lock. Another process is still migrating the dbos schema; this pod will restart and retry.`);await H$(ss8)}let W=Date.now()-J;if(W>1000)Y(`[dbos] waited ${W}ms for the migration lock; another process migrated first`);return await Z()}finally{if(K)try{await G.query("SELECT pg_advisory_unlock($1)",[Fs1.toString()])}catch{}await G.end().catch(()=>{})}}var Fs1=8314027461559302n,as8=600000,ss8=500;var Ns1=L(()=>{Z4()});function es8(){let $=(process.env.BUN_OPTIONS??"").split(/\s+/).filter(Boolean);return[...process.argv.slice(1),...$]}function On0($,Z){for(let X=0;X<$.length;X++){let Q=$[X];if(Q===void 0)continue;if(Q===Z)return $[X+1];if(Q.startsWith(`${Z}=`))return Q.slice(Z.length+1)}return}function Bs1(){let $=es8();if($.includes("--cpu-prof")){console.log(JSON.stringify({msg:"cpu-profiling-active",dir:On0($,"--cpu-prof-dir")??process.cwd(),name:On0($,"--cpu-prof-name"),markdown:$.includes("--cpu-prof-md"),intervalUs:Number(On0($,"--cpu-prof-interval")??1000),note:"profile is written on process exit"}));return}if(process.env.CPU_PROFILE)console.warn(JSON.stringify({msg:"cpu-profiling-requested-but-inactive",hint:'CPU profiling is a Bun launch flag. Set BUN_OPTIONS="--cpu-prof --cpu-prof-md --cpu-prof-dir=/tmp" before starting the process.'}))}function Os1(){if(process.env.HEAP_WATCH!=="1")return()=>{};let $=Number(process.env.HEAP_WATCH_INTERVAL_MS??60000),Z=async()=>{let X=cE();if(!X)return;let Q={};try{let{heapStats:Y}=await import("bun:jsc"),G=Y(),J=Object.entries(G.objectTypeCounts).sort((K,W)=>W[1]-K[1]).slice(0,20);Q={objectCount:G.objectCount,heapSize:G.heapSize,top:Object.fromEntries(J)}}catch{}console.log(JSON.stringify({msg:"heap-watch",ts:new Date().toISOString(),uptimeS:Math.round(process.uptime()),rss:X.rss,heapUsed:X.heapUsed,heapTotal:X.heapTotal,external:X.external,arrayBuffers:X.arrayBuffers,...Q}))};return Z().catch(()=>{}),z70=setInterval(()=>void Z().catch(()=>{}),$),z70.unref?.(),process.on("SIGUSR2",()=>{try{let X=Bun.generateHeapSnapshot("v8"),Q=typeof X==="string"?X:JSON.stringify(X),Y=`/tmp/heap-${process.pid}-${Date.now()}.heapsnapshot`;Bun.write(Y,Q),console.log(JSON.stringify({msg:"heap-snapshot-written",path:Y}))}catch(X){console.error("[heap-watch] snapshot failed:",X)}}),()=>{if(z70)clearInterval(z70)}}var z70;var Ls1=()=>{};import*as $e8 from"bun:jsc";function Ds1(){if(process.env.STALL_WATCHDOG!=="1")return()=>{};let $=Number(process.env.STALL_WATCHDOG_MS??100),Z=Number(process.env.STALL_WATCHDOG_TICK_MS??50);try{Ze8()}catch(G){return console.error("[stall-watchdog] failed to start sampling profiler:",G),()=>{}}let X,Q=performance.now()+Z,Y=()=>{let G=performance.now(),J=G-Q;Q=G+Z;let K=[];try{K=Xe8()?.traces??[]}catch{}if(J>$&&K.length>0){let W=new Map;for(let F of K){let U=F.frames.find((O)=>O.sourceURL&&!/Unknown Executable/.test(O.category??""))??F.frames[0];if(!U)continue;let N=(U.sourceURL??"?").replace(/^.*\/node_modules\//,"node_modules/"),B=`${U.name??"?"} @ ${N}:${U.line??"?"}`;W.set(B,(W.get(B)??0)+1)}let H=[...W.entries()].sort((F,U)=>U[1]-F[1]).slice(0,8).map(([F,U])=>({frame:F,count:U}));console.warn(JSON.stringify({msg:"stall-stack",ts:new Date().toISOString(),lagMs:Math.round(J),samplesInWindow:K.length,top:H}))}X=setTimeout(Y,Z),X.unref?.()};return X=setTimeout(Y,Z),X.unref?.(),()=>{if(X)clearTimeout(X)}}var Ze8,Xe8;var ws1=L(()=>{({startSamplingProfiler:Ze8,samplingProfilerStackTraces:Xe8}=$e8)});function Es1(){Bs1();let $=[Os1(),Mn1(),Ds1()];return()=>{for(let Z of $)Z()}}var js1=L(()=>{vl0();Ls1();ws1()});var oE=v((zs1)=>{Object.defineProperty(zs1,"__esModule",{value:!0});zs1.RepublishHeaders=zs1.DirectMsgHeaders=zs1.JsHeaders=zs1.AdvisoryKind=void 0;zs1.isOrderedPushConsumerOptions=Qe8;zs1.isPullConsumer=Ye8;zs1.isPushConsumer=Ge8;zs1.isBoundPushConsumerOptions=Je8;function Qe8($){if($&&typeof $==="object")return"name_prefix"in $||"deliver_subject_prefix"in $||"filter_subjects"in $||"filter_subject"in $||"deliver_policy"in $||"opt_start_seq"in $||"opt_start_time"in $||"replay_policy"in $||"inactive_threshold"in $||"headers_only"in $||"deliver_prefix"in $;return!1}function Ye8($){return $.isPullConsumer()}function Ge8($){return $.isPushConsumer()}function Je8($){if($&&typeof $==="object")return"deliver_subject"in $||"deliver_group"in $||"idle_heartbeat"in $;return!1}zs1.AdvisoryKind={API:"api_audit",StreamAction:"stream_action",ConsumerAction:"consumer_action",SnapshotCreate:"snapshot_create",SnapshotComplete:"snapshot_complete",RestoreCreate:"restore_create",RestoreComplete:"restore_complete",MaxDeliver:"max_deliver",Terminated:"terminated",Ack:"consumer_ack",StreamLeaderElected:"stream_leader_elected",StreamQuorumLost:"stream_quorum_lost",ConsumerLeaderElected:"consumer_leader_elected",ConsumerQuorumLost:"consumer_quorum_lost"};zs1.JsHeaders={StreamSourceHdr:"Nats-Stream-Source",LastConsumerSeqHdr:"Nats-Last-Consumer",LastStreamSeqHdr:"Nats-Last-Stream",ConsumerStalledHdr:"Nats-Consumer-Stalled",MessageSizeHdr:"Nats-Msg-Size",RollupHdr:"Nats-Rollup",RollupValueSubject:"sub",RollupValueAll:"all",PendingMessagesHdr:"Nats-Pending-Messages",PendingBytesHdr:"Nats-Pending-Bytes",RequiredApiLevel:"Nats-Required-Api-Level"};zs1.DirectMsgHeaders={Stream:"Nats-Stream",Sequence:"Nats-Sequence",TimeStamp:"Nats-Time-Stamp",Subject:"Nats-Subject",LastSequence:"Nats-Last-Sequence",NumPending:"Nats-Num-Pending"};zs1.RepublishHeaders={Stream:"Nats-Stream",Subject:"Nats-Subject",Sequence:"Nats-Sequence",LastSequence:"Nats-Last-Sequence",Size:"Nats-Msg-Size"}});var KG=v((As1)=>{Object.defineProperty(As1,"__esModule",{value:!0});As1.TD=As1.TE=As1.Empty=void 0;As1.encode=Le8;As1.decode=De8;As1.Empty=new Uint8Array(0);As1.TE=new TextEncoder;As1.TD=new TextDecoder;function Oe8(...$){let Z=0;for(let Y=0;Y<$.length;Y++)Z+=$[Y].length;let X=new Uint8Array(Z),Q=0;for(let Y=0;Y<$.length;Y++)X.set($[Y],Q),Q+=$[Y].length;return X}function Le8(...$){let Z=[];for(let X=0;X<$.length;X++)Z.push(As1.TE.encode($[X]));if(Z.length===0)return As1.Empty;if(Z.length===1)return Z[0];return Oe8(...Z)}function De8($){if(!$||$.length===0)return"";return As1.TD.decode($)}});var WG=v((Is1)=>{Object.defineProperty(Is1,"__esModule",{value:!0});Is1.errors=Is1.PermissionViolationError=Is1.NoRespondersError=Is1.TimeoutError=Is1.RequestError=Is1.ProtocolError=Is1.ConnectionError=Is1.DrainingConnectionError=Is1.ClosedConnectionError=Is1.AuthorizationError=Is1.UserAuthenticationExpiredError=Is1.InvalidOperationError=Is1.InvalidArgumentError=Is1.InvalidSubjectError=void 0;class Dn0 extends Error{constructor($,Z){super(`illegal subject: '${$}'`,Z);this.name="InvalidSubjectError"}}Is1.InvalidSubjectError=Dn0;class P70 extends Error{constructor($,Z){super($,Z);this.name="InvalidArgumentError"}static format($,Z,X){if(Array.isArray(Z)&&Z.length>1)Z=Z[0];if(Array.isArray($))$=$.map((Q)=>`'${Q}'`),$=$.join(",");else $=`'${$}'`;return new P70(`${$} ${Z}`,X)}}Is1.InvalidArgumentError=P70;class wn0 extends Error{constructor($,Z){super($,Z);this.name="InvalidOperationError"}}Is1.InvalidOperationError=wn0;class A70 extends Error{constructor($,Z){super($,Z);this.name="UserAuthenticationExpiredError"}static parse($){if($.toLowerCase().indexOf("user authentication expired")!==-1)return new A70($);return null}}Is1.UserAuthenticationExpiredError=A70;class T70 extends Error{constructor($,Z){super($,Z);this.name="AuthorizationError"}static parse($){let Z=["authorization violation","account authentication expired","authentication timeout"],X=$.toLowerCase();for(let Q=0;Q<Z.length;Q++)if(X.indexOf(Z[Q])!==-1)return new T70($);return null}}Is1.AuthorizationError=T70;class En0 extends Error{constructor(){super("closed connection");this.name="ClosedConnectionError"}}Is1.ClosedConnectionError=En0;class jn0 extends Error{constructor(){super("connection draining");this.name="DrainingConnectionError"}}Is1.DrainingConnectionError=jn0;class zn0 extends Error{constructor($,Z){super($,Z);this.name="ConnectionError"}}Is1.ConnectionError=zn0;class Pn0 extends Error{constructor($,Z){super($,Z);this.name="ProtocolError"}}Is1.ProtocolError=Pn0;class An0 extends Error{constructor($="",Z){super($,Z);this.name="RequestError"}isNoResponders(){return this.cause instanceof R70}}Is1.RequestError=An0;class Tn0 extends Error{constructor($){super("timeout",$);this.name="TimeoutError"}}Is1.TimeoutError=Tn0;class R70 extends Error{subject;constructor($,Z){super(`no responders: '${$}'`,Z);this.subject=$,this.name="NoResponders"}}Is1.NoRespondersError=R70;class I70 extends Error{operation;subject;queue;constructor($,Z,X,Q,Y){super($,Y);this.name="PermissionViolationError",this.operation=Z,this.subject=X,this.queue=Q}static parse($){if(($?$.toLowerCase():"").indexOf("permissions violation")===-1)return null;let X="publish",Q="",Y=void 0,G=$.match(/(Publish|Subscription) to "(\S+)"/);if(G){if(X=G[1].toLowerCase(),Q=G[2],X==="subscription"){let J=$.match(/using queue "(\S+)"/);if(J)Y=J[1]}}return new I70($,X,Q,Y)}}Is1.PermissionViolationError=I70;Is1.errors={AuthorizationError:T70,ClosedConnectionError:En0,ConnectionError:zn0,DrainingConnectionError:jn0,InvalidArgumentError:P70,InvalidOperationError:wn0,InvalidSubjectError:Dn0,NoRespondersError:R70,PermissionViolationError:I70,ProtocolError:Pn0,RequestError:An0,TimeoutError:Tn0,UserAuthenticationExpiredError:A70}});var d3=v((Ss1)=>{Object.defineProperty(Ss1,"__esModule",{value:!0});Ss1.SimpleMutex=Ss1.Perf=void 0;Ss1.extend=ve8;Ss1.render=xe8;Ss1.timeout=fe8;Ss1.delay=be8;Ss1.deadline=ye8;Ss1.deferred=In0;Ss1.debugDeferred=ge8;Ss1.shuffle=he8;Ss1.collect=ue8;Ss1.jitter=ks1;Ss1.backoff=ce8;Ss1.nanos=le8;Ss1.millis=me8;Ss1.randomToken=pe8;var _e8=KG(),Rn0=WG();function ve8($,...Z){for(let X=0;X<Z.length;X++){let Q=Z[X];Object.keys(Q).forEach(function(Y){$[Y]=Q[Y]})}return $}function xe8($){return _e8.TD.decode($).replace(/\n/g,"\u240A").replace(/\r/g,"\u240D")}function fe8($,Z=!0){let X=Z?new Rn0.TimeoutError:null,Q,Y,G=new Promise((J,K)=>{Q={cancel:()=>{if(Y)clearTimeout(Y)}},Y=setTimeout(()=>{if(X===null)K(new Rn0.TimeoutError);else K(X)},$)});return Object.assign(G,Q)}function be8($=0){let Z,X=new Promise((Q)=>{let Y=setTimeout(()=>{Q()},$);Z={cancel:()=>{if(Y)clearTimeout(Y),Q()}}});return Object.assign(X,Z)}async function ye8($,Z=1000){let X=In0(),Q=setTimeout(()=>{X.reject(new Rn0.TimeoutError)},Z);try{return await Promise.race([$,X])}finally{clearTimeout(Q)}}function In0(){let $={},Z=new Promise((X,Q)=>{$={resolve:X,reject:Q}});return Object.assign(Z,$)}function ge8(){let $={},Z=new Promise((X,Q)=>{$={resolve:(Y)=>{console.trace("resolve",Y),X(Y)},reject:(Y)=>{console.trace("reject"),Q(Y)}}});return Object.assign(Z,$)}function he8($){for(let Z=$.length-1;Z>0;Z--){let X=Math.floor(Math.random()*(Z+1));[$[Z],$[X]]=[$[X],$[Z]]}return $}async function ue8($){let Z=[];for await(let X of $)Z.push(X);return Z}class Ms1{timers;measures;constructor(){this.timers=new Map,this.measures=new Map}mark($){this.timers.set($,performance.now())}measure($,Z,X){let Q=this.timers.get(Z);if(Q===void 0)throw Error(`${Z} is not defined`);let Y=this.timers.get(X);if(Y===void 0)throw Error(`${X} is not defined`);this.measures.set($,Y-Q)}getEntries(){let $=[];return this.measures.forEach((Z,X)=>{$.push({name:X,duration:Z})}),$}}Ss1.Perf=Ms1;class Vs1{max;current;waiting;constructor($=1){this.max=$,this.current=0,this.waiting=[]}lock(){if(this.current++,this.current<=this.max)return Promise.resolve();let $=In0();return this.waiting.push($),$}unlock(){this.current--,this.waiting.pop()?.resolve()}}Ss1.SimpleMutex=Vs1;function ks1($){if($===0)return 0;return Math.floor($/2+Math.random()*$)}function ce8($=[0,250,250,500,500,3000,5000]){if(!Array.isArray($))$=[0,250,250,500,500,3000,5000];let Z=$.length-1;return{backoff(X){return ks1(X>Z?$[Z]:$[X])}}}function le8($){return $*1e6}function me8($){return Math.floor($/1e6)}var de8="0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz",BU=new Uint8Array(62);for(let $=0;$<62;$++)BU[$]=de8.charCodeAt($);var ie8=218340105584896;function pe8(){let $=Math.floor(Math.random()*ie8),Z=$%62,X=BU[Z];$=($-Z)/62,Z=$%62;let Q=BU[Z];$=($-Z)/62,Z=$%62;let Y=BU[Z];$=($-Z)/62,Z=$%62;let G=BU[Z];$=($-Z)/62,Z=$%62;let J=BU[Z];$=($-Z)/62,Z=$%62;let K=BU[Z];$=($-Z)/62,Z=$%62;let W=BU[Z];$=($-Z)/62;let H=BU[$];return String.fromCharCode(X,Q,Y,G,J,K,W,H)}});var gs1=v((bs1)=>{Object.defineProperty(bs1,"__esModule",{value:!0});bs1.nuid=bs1.NuidImpl=void 0;var W04="0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz",UO=62,M70=12,xs1=10,_s1=33,H04=333,vs1=M70+xs1,Mn0=new Uint8Array(UO);for(let $=0;$<UO;$++)Mn0[$]=W04.charCodeAt($);var q70=4294967296,fs1=BigInt(UO)**BigInt(xs1),jp=Number(fs1/(1n<<32n)),qn0=Number(fs1%(1n<<32n));function F04($){for(let Z=0;Z<$.length;Z++)$[Z]=Math.floor(Math.random()*256)}function U04($){if(globalThis?.crypto?.getRandomValues)globalThis.crypto.getRandomValues($);else F04($)}class Vn0{buf;cbuf;seqHi;seqLo;inc;inited;constructor(){this.buf=new Uint8Array(vs1),this.cbuf=new Uint8Array(M70),this.inited=!1}init(){this.inited=!0,this.setPre(),this.initSeqAndInc(),this.fillSeq()}initSeqAndInc(){let $=0;do this.seqHi=Math.floor(Math.random()*(jp+1)),this.seqLo=Math.floor(Math.random()*q70);while($++<8&&this.seqHi===jp&&this.seqLo>=qn0);if(this.seqHi===jp&&this.seqLo>=qn0)this.seqLo=0;this.inc=Math.random()*(H04-_s1)+_s1|0}setPre(){U04(this.cbuf);for(let $=0;$<M70;$++)this.buf[$]=Mn0[this.cbuf[$]%UO]}fillSeq(){let $=this.seqHi,Z=this.seqLo;for(let X=vs1-1;X>=M70;X--){let Q=Math.floor($/UO),G=($-Q*UO)*q70+Z,J=Math.floor(G/UO),K=G-J*UO;this.buf[X]=Mn0[K],$=Q,Z=J}}next(){if(!this.inited)this.init();if(this.seqLo+=this.inc,this.seqLo>=q70)this.seqLo-=q70,this.seqHi+=1;if(this.seqHi>jp||this.seqHi===jp&&this.seqLo>=qn0)this.setPre(),this.initSeqAndInc();this.fillSeq();let $=this.buf;return String.fromCharCode($[0],$[1],$[2],$[3],$[4],$[5],$[6],$[7],$[8],$[9],$[10],$[11],$[12],$[13],$[14],$[15],$[16],$[17],$[18],$[19],$[20],$[21])}reset(){this.init()}}bs1.NuidImpl=Vn0;bs1.nuid=new Vn0});var ls1=v((us1)=>{Object.defineProperty(us1,"__esModule",{value:!0});us1.nuid=us1.Nuid=void 0;var hs1=gs1();us1.Nuid=hs1.NuidImpl;us1.nuid=hs1.nuid});var k70=v((V70)=>{Object.defineProperty(V70,"__esModule",{value:!0});V70.nuid=V70.Nuid=void 0;var ms1=ls1();Object.defineProperty(V70,"Nuid",{enumerable:!0,get:function(){return ms1.Nuid}});Object.defineProperty(V70,"nuid",{enumerable:!0,get:function(){return ms1.nuid}})});var NO=v((ds1)=>{Object.defineProperty(ds1,"__esModule",{value:!0});ds1.DEFAULT_HOST=ds1.DEFAULT_PORT=ds1.Match=void 0;ds1.syncIterator=w04;ds1.createInbox=E04;var L04=k70(),D04=WG();ds1.Match={Exact:"exact",CanonicalMIME:"canonical",IgnoreCase:"insensitive"};function w04($){let Z=$[Symbol.asyncIterator]();return{async next(){let X=await Z.next();if(X.done)return Promise.resolve(null);return Promise.resolve(X.value)}}}function E04($=""){if($=$||"_INBOX",typeof $!=="string")throw TypeError("prefix must be a string");return $.split(".").forEach((Z)=>{if(Z==="*"||Z===">")throw D04.InvalidArgumentError.format("prefix",`cannot have wildcards ('${$}')`)}),`${$}.${L04.nuid.next()}`}ds1.DEFAULT_PORT=4222;ds1.DEFAULT_HOST="127.0.0.1"});var zp=v((ts1)=>{Object.defineProperty(ts1,"__esModule",{value:!0});ts1.DataBuffer=void 0;var ps1=KG();class ns1{buffers;byteLength;constructor(){this.buffers=[],this.byteLength=0}static concat(...$){let Z=0;for(let Y=0;Y<$.length;Y++)Z+=$[Y].length;let X=new Uint8Array(Z),Q=0;for(let Y=0;Y<$.length;Y++)X.set($[Y],Q),Q+=$[Y].length;return X}static fromAscii($){if(!$)$="";return ps1.TE.encode($)}static toAscii($){return ps1.TD.decode($)}reset(){this.buffers.length=0,this.byteLength=0}pack(){if(this.buffers.length>1){let $=new Uint8Array(this.byteLength),Z=0;for(let X=0;X<this.buffers.length;X++)$.set(this.buffers[X],Z),Z+=this.buffers[X].length;this.buffers.length=0,this.buffers.push($)}}shift(){if(this.buffers.length){let $=this.buffers.shift();if($)return this.byteLength-=$.length,$}return new Uint8Array(0)}drain($){if(this.buffers.length){this.pack();let Z=this.buffers.pop();if(Z){let X=this.byteLength;if($===void 0||$>X)$=X;let Q=Z.subarray(0,$);if(X>$)this.buffers.push(Z.subarray($));return this.byteLength=X-$,Q}}return new Uint8Array(0)}fill($,...Z){if($)this.buffers.push($),this.byteLength+=$.length;for(let X=0;X<Z.length;X++)if(Z[X]&&Z[X].length)this.buffers.push(Z[X]),this.byteLength+=Z[X].length}peek(){if(this.buffers.length)return this.pack(),this.buffers[0];return new Uint8Array(0)}size(){return this.byteLength}length(){return this.buffers.length}}ts1.DataBuffer=ns1});var rE=v((as1)=>{Object.defineProperty(as1,"__esModule",{value:!0});as1.LF=as1.CR=as1.CRLF=as1.CR_LF_LEN=as1.CR_LF=void 0;as1.setTransportFactory=q04;as1.defaultPort=M04;as1.getUrlParseFn=V04;as1.newTransport=k04;as1.getResolveFn=S04;as1.protoLen=rs1;as1.extractProtocolMessage=C04;var T04=KG(),R04=NO(),I04=zp(),HG;function q04($){HG=$}function M04(){return HG!==void 0&&HG.defaultPort!==void 0?HG.defaultPort:R04.DEFAULT_PORT}function V04(){return HG!==void 0&&HG.urlParseFn?HG.urlParseFn:void 0}function k04(){if(!HG||typeof HG.factory!=="function")throw Error("transport fn is not set");return HG.factory()}function S04(){return HG!==void 0&&HG.dnsResolveFn?HG.dnsResolveFn:void 0}as1.CR_LF=`\r
 `;as1.CR_LF_LEN=as1.CR_LF.length;as1.CRLF=I04.DataBuffer.fromAscii(as1.CR_LF);as1.CR=new Uint8Array(as1.CRLF)[0];as1.LF=new Uint8Array(as1.CRLF)[1];function rs1($){for(let Z=0;Z<$.length;Z++){let X=Z+1;if($.byteLength>X&&$[Z]===as1.CR&&$[X]===as1.LF)return X+1}return 0}function C04($){let Z=rs1($);if(Z>0){let Q=new Uint8Array($).slice(0,Z);return T04.TD.decode(Q)}return""}});var vn0=v((Ge1)=>{Object.defineProperty(Ge1,"__esModule",{value:!0});Ge1.ipV4=Xe1;Ge1.isIP=l04;Ge1.parseIP=Qe1;var Pp=4,aE=16,S70=48,Ze1=57,es1=65,u04=70,$e1=97,c04=102,_n0=16777215;function Xe1($,Z,X,Q){let Y=new Uint8Array(aE);return[0,0,0,0,0,0,0,0,0,0,255,255].forEach((J,K)=>{Y[K]=J}),Y[12]=$,Y[13]=Z,Y[14]=X,Y[15]=Q,Y}function l04($){return Qe1($)!==void 0}function Qe1($){for(let Z=0;Z<$.length;Z++)switch($[Z]){case".":return Ye1($);case":":return m04($)}return}function Ye1($){let Z=new Uint8Array(Pp);for(let X=0;X<Pp;X++){if($.length===0)return;if(X>0){if($[0]!==".")return;$=$.substring(1)}let{n:Q,c:Y,ok:G}=d04($);if(!G||Q>255)return;$=$.substring(Y),Z[X]=Q}return Xe1(Z[0],Z[1],Z[2],Z[3])}function m04($){let Z=new Uint8Array(aE),X=-1;if($.length>=2&&$[0]===":"&&$[1]===":"){if(X=0,$=$.substring(2),$.length===0)return Z}let Q=0;while(Q<aE){let{n:Y,c:G,ok:J}=i04($);if(!J||Y>65535)return;if(G<$.length&&$[G]==="."){if(X<0&&Q!=aE-Pp)return;if(Q+Pp>aE)return;let K=Ye1($);if(K===void 0)return;Z[Q]=K[12],Z[Q+1]=K[13],Z[Q+2]=K[14],Z[Q+3]=K[15],$="",Q+=Pp;break}if(Z[Q]=Y>>8,Z[Q+1]=Y,Q+=2,$=$.substring(G),$.length===0)break;if($[0]!==":"||$.length==1)return;if($=$.substring(1),$[0]===":"){if(X>=0)return;if(X=Q,$=$.substring(1),$.length===0)break}}if($.length!==0)return;if(Q<aE){if(X<0)return;let Y=aE-Q;for(let G=Q-1;G>=X;G--)Z[G+Y]=Z[G];for(let G=X+Y-1;G>=X;G--)Z[G]=0}else if(X>=0)return;return Z}function d04($){let Z=0,X=0;for(Z=0;Z<$.length&&S70<=$.charCodeAt(Z)&&$.charCodeAt(Z)<=Ze1;Z++)if(X=X*10+($.charCodeAt(Z)-S70),X>=_n0)return{n:_n0,c:Z,ok:!1};if(Z===0)return{n:0,c:0,ok:!1};return{n:X,c:Z,ok:!0}}function i04($){let Z=0,X=0;for(X=0;X<$.length;X++){if(S70<=$.charCodeAt(X)&&$.charCodeAt(X)<=Ze1)Z*=16,Z+=$.charCodeAt(X)-S70;else if($e1<=$.charCodeAt(X)&&$.charCodeAt(X)<=c04)Z*=16,Z+=$.charCodeAt(X)-$e1+10;else if(es1<=$.charCodeAt(X)&&$.charCodeAt(X)<=u04)Z*=16,Z+=$.charCodeAt(X)-es1+10;else break;if(Z>=_n0)return{n:0,c:X,ok:!1}}if(X===0)return{n:0,c:X,ok:!1};return{n:Z,c:X,ok:!0}}});var hn0=v((Ke1)=>{Object.defineProperty(Ke1,"__esModule",{value:!0});Ke1.Servers=Ke1.ServerImpl=void 0;Ke1.isIPV4OrHostname=Je1;Ke1.hostPort=gn0;var xn0=rE(),fn0=d3(),bn0=vn0(),o04=NO(),r04=WG();function Je1($){if($.indexOf("[")!==-1||$.indexOf("::")!==-1)return!1;if($.indexOf(".")!==-1)return!0;if($.split(":").length<=2)return!0;return!1}function yn0($){return!Je1($)}function a04($){let X=$.toUpperCase().indexOf("::FFFF:");if(X!==-1&&$.indexOf(".")!==-1){let Q=$.substring(X+7);return Q=Q.replace("[",""),Q.replace("]","")}return $}function gn0($){if($=$.trim(),$.match(/^(.*:\/\/)(.*)/m))$=$.replace(/^(.*:\/\/)(.*)/gm,"$2");if($=a04($),yn0($)&&$.indexOf("[")===-1)$=`[${$}]`;let Z=yn0($)?$.match(/(]:)(\d+)/):$.match(/(:)(\d+)/),X=Z&&Z.length===3&&Z[1]&&Z[2]?parseInt(Z[2]):o04.DEFAULT_PORT,Y=new URL(`${X===80?"https":"http"}://${$}`);Y.port=`${X}`;let G=Y.hostname;if(G.charAt(0)==="[")G=G.substring(1,G.length-1);return{listen:Y.host,hostname:G,port:X}}class Ty{src;listen;hostname;port;didConnect;reconnects;lastConnect;gossiped;tlsName;resolves;constructor($,Z=!1){this.src=$,this.tlsName="";let X=gn0($);this.listen=X.listen,this.hostname=X.hostname,this.port=X.port,this.didConnect=!1,this.reconnects=0,this.lastConnect=0,this.gossiped=Z}toString(){return this.listen}async resolve($){if(!$.fn||$.resolve===!1)return[this];let Z=[];if((0,bn0.isIP)(this.hostname))return[this];else{let X=await $.fn(this.hostname);if($.debug)console.log(`resolve ${this.hostname} = ${X.join(",")}`);for(let Q of X){let Y=this.port===80?"https":"http",G=new URL(`${Y}://${yn0(Q)?"["+Q+"]":Q}`);G.port=`${this.port}`;let J=new Ty(G.host,!1);J.tlsName=this.hostname,Z.push(J)}}if($.randomize)(0,fn0.shuffle)(Z);return this.resolves=Z,Z}}Ke1.ServerImpl=Ty;class C70{firstSelect;servers;currentServer;tlsName;randomize;constructor($={}){this.firstSelect=!0,this.servers=[],this.tlsName="",this.randomize=$.randomize||!1}setServers($){if(!Array.isArray($)||$.length===0)throw r04.InvalidArgumentError.format("servers","cannot be empty");let Z=(0,xn0.getUrlParseFn)(),X=new Map;for(let Y of this.servers)X.set(Y.listen,Y);let Q=[];for(let Y of $){Y=Z?Z(Y):Y;let{listen:G}=gn0(Y),J=X.get(G);if(J)J.gossiped=!1,Q.push(J);else Q.push(new Ty(Y))}if(this.randomize)(0,fn0.shuffle)(Q);if(this.servers=Q,this.currentServer===void 0||!Q.includes(this.currentServer))this.currentServer=Q[0],this.firstSelect=!0}clear(){this.servers.length=0}updateTLSName(){let $=this.getCurrentServer();if(!(0,bn0.isIP)($.hostname))this.tlsName=$.hostname,this.servers.forEach((Z)=>{if(Z.gossiped)Z.tlsName=this.tlsName})}getCurrentServer(){return this.currentServer}addServer($,Z=!1){let X=(0,xn0.getUrlParseFn)();$=X?X($):$;let Q=new Ty($,Z);if((0,bn0.isIP)(Q.hostname))Q.tlsName=this.tlsName;this.servers.push(Q)}selectServer(){if(this.firstSelect)return this.firstSelect=!1,this.currentServer;let $=this.servers.shift();if($)this.servers.push($),this.currentServer=$;return $}removeCurrentServer(){this.removeServer(this.currentServer)}removeServer($){if($){let Z=this.servers.indexOf($);this.servers.splice(Z,1)}}snapshot(){return C70.freezeAll(this.servers)}snapshotForHandler(){let $=this.currentServer;if(!$)return this.snapshot();let Z=this.servers.indexOf($);if(Z<=0)return this.snapshot();return C70.freezeAll([$,...this.servers.slice(0,Z),...this.servers.slice(Z+1)])}static freezeAll($){return $.map((Z)=>Object.freeze({hostname:Z.hostname,port:Z.port,listen:Z.listen,src:Z.src,tlsName:Z.tlsName,reconnects:Z.reconnects,lastConnect:Z.lastConnect,gossiped:Z.gossiped,didConnect:Z.didConnect}))}find($){return this.servers.find((Z)=>Z.listen===$.listen)}setCurrent($){this.currentServer=$}length(){return this.servers.length}next(){return this.servers.length?this.servers[0]:void 0}getServers(){return this.servers}update($,Z){let X=[],Q=[],Y=(0,xn0.getUrlParseFn)(),G=new Map;if($.connect_urls&&$.connect_urls.length>0)$.connect_urls.forEach((K)=>{K=Y?Y(K,Z):K;let W=new Ty(K,!0);G.set(K,W)});let J=[];if(this.servers.forEach((K,W)=>{let H=K.listen;if(K.gossiped&&this.currentServer.listen!==H&&G.get(H)===void 0)J.push(W);G.delete(H)}),J.reverse(),J.forEach((K)=>{let W=this.servers.splice(K,1);Q=Q.concat(W[0].listen)}),G.forEach((K,W)=>{this.servers.push(K),X.push(W)}),this.randomize&&X.length>0){let K=this.currentServer,W=this.servers.filter((H)=>H!==K);(0,fn0.shuffle)(W),this.servers=K?[K,...W]:W}return{added:X,deleted:Q}}}Ke1.Servers=C70});var _70=v((Ue1)=>{Object.defineProperty(Ue1,"__esModule",{value:!0});Ue1.QueuedIteratorImpl=void 0;var un0=d3(),He1=WG();class Fe1{inflight;processed;received;noIterator;iterClosed;done;signal;yields;filtered;pendingFiltered;ctx;_data;err;time;profile;yielding;didBreak;constructor(){this.inflight=0,this.filtered=0,this.pendingFiltered=0,this.processed=0,this.received=0,this.noIterator=!1,this.done=!1,this.signal=(0,un0.deferred)(),this.yields=[],this.iterClosed=(0,un0.deferred)(),this.time=0,this.yielding=!1,this.didBreak=!1,this.profile=!1}[Symbol.asyncIterator](){return this.iterate()}push($){if(this.done)return;if(this.didBreak){if(typeof $==="function"){let Z=$;try{Z()}catch(X){}}return}if(typeof $==="function")this.pendingFiltered++;this.yields.push($),this.signal.resolve()}async*iterate(){if(this.noIterator)throw new He1.InvalidOperationError("iterator cannot be used when a callback is registered");if(this.yielding)throw new He1.InvalidOperationError("iterator is already yielding");this.yielding=!0;try{while(!0){if(this.yields.length===0)await this.signal;if(this.err)throw this.err;let $=this.yields;this.inflight=$.length,this.yields=[];for(let Z=0;Z<$.length;Z++){if(typeof $[Z]==="function"){this.pendingFiltered--;let Q=$[Z];try{Q()}catch(Y){throw Y}if(this.err)throw this.err;continue}this.processed++,this.inflight--;let X=this.profile?Date.now():0;yield $[Z],this.time=this.profile?Date.now()-X:0}if(this.done)break;else if(this.yields.length===0)$.length=0,this.yields=$,this.signal=(0,un0.deferred)()}}finally{this.didBreak=!0,this.stop()}}stop($){if(this.done)return;this.err=$,this.done=!0,this.signal.resolve(),this.iterClosed.resolve($)}getProcessed(){return this.noIterator?this.received:this.processed}getPending(){return this.yields.length+this.inflight-this.pendingFiltered}getReceived(){return this.received-this.filtered}}Ue1.QueuedIteratorImpl=Fe1});var cn0=v((Le1)=>{Object.defineProperty(Le1,"__esModule",{value:!0});Le1.MuxSubscription=void 0;var Z14=NO(),Be1=WG();class Oe1{baseInbox;reqs;constructor(){this.reqs=new Map}size(){return this.reqs.size}init($){return this.baseInbox=`${(0,Z14.createInbox)($)}.`,this.baseInbox}add($){if(!isNaN($.received))$.received=0;this.reqs.set($.token,$)}get($){return this.reqs.get($)}cancel($){this.reqs.delete($.token)}getToken($){let Z=$.subject||"";if(Z.indexOf(this.baseInbox)===0)return Z.substring(this.baseInbox.length);return null}all(){return Array.from(this.reqs.values())}handleError($,Z){if($)return this.all().forEach((X)=>{X.resolver(Z,{})}),!0;if(Z.operation==="publish"){let X=this.all().find((Q)=>{return Q.requestSubject===Z.subject});if(X)return X.resolver(Z,{}),!0}return!1}dispatcher(){return($,Z)=>{let X=this.getToken(Z);if(X){let Q=this.get(X);if(Q){if($===null)$=Z?.data?.length===0&&Z.headers?.code===503?new Be1.NoRespondersError(Q.requestSubject):null;Q.resolver($,Z)}}}}close(){let $=new Be1.RequestError("connection closed");this.reqs.forEach((Z)=>{Z.resolver($,{})})}}Le1.MuxSubscription=Oe1});var ln0=v((Ee1)=>{Object.defineProperty(Ee1,"__esModule",{value:!0});Ee1.Heartbeat=void 0;var X14=d3();class we1{ph;interval;maxOut;timer;pendings;constructor($,Z,X){this.ph=$,this.interval=Z,this.maxOut=X,this.pendings=[]}start(){this.cancel(),this._schedule()}cancel($){if(this.timer)clearTimeout(this.timer),this.timer=void 0;if(this._reset(),$)this.ph.disconnect()}_schedule(){this.timer=setTimeout(()=>{if(this.ph.dispatchStatus({type:"ping",pendingPings:this.pendings.length+1}),this.pendings.length===this.maxOut){this.cancel(!0);return}let $=(0,X14.deferred)();this.ph.flush($).then(()=>{this._reset()}).catch(()=>{this.cancel()}),this.pendings.push($),this._schedule()},this.interval)}_reset(){this.pendings=this.pendings.filter(($)=>{return $.resolve(),!1})}}Ee1.Heartbeat=we1});var in0=v((Te1)=>{Object.defineProperty(Te1,"__esModule",{value:!0});Te1.DenoBuffer=Te1.MAX_SIZE=Te1.AssertionError=void 0;Te1.assert=Pe1;Te1.concat=Ae1;Te1.append=Y14;Te1.readAll=G14;Te1.writeAll=J14;var Q14=KG();class mn0 extends Error{constructor($){super($);this.name="AssertionError"}}Te1.AssertionError=mn0;function Pe1($,Z="Assertion failed."){if(!$)throw new mn0(Z)}var ze1=32768;Te1.MAX_SIZE=4294967294;function v70($,Z,X=0){let Q=Z.byteLength-X;if($.byteLength>Q)$=$.subarray(0,Q);return Z.set($,X),$.byteLength}function Ae1($,Z){if($===void 0&&Z===void 0)return new Uint8Array(0);if($===void 0)return Z;if(Z===void 0)return $;let X=new Uint8Array($.length+Z.length);return X.set($,0),X.set(Z,$.length),X}function Y14($,Z){return Ae1($,Uint8Array.of(Z))}class dn0{_buf;_off;constructor($){if(this._off=0,$==null){this._buf=new Uint8Array(0);return}this._buf=new Uint8Array($)}bytes($={copy:!0}){if($.copy===!1)return this._buf.subarray(this._off);return this._buf.slice(this._off)}empty(){return this._buf.byteLength<=this._off}get length(){return this._buf.byteLength-this._off}get capacity(){return this._buf.buffer.byteLength}truncate($){if($===0){this.reset();return}if($<0||$>this.length)throw Error("bytes.Buffer: truncation out of range");this._reslice(this._off+$)}reset(){this._reslice(0),this._off=0}_tryGrowByReslice($){let Z=this._buf.byteLength;if($<=this.capacity-Z)return this._reslice(Z+$),Z;return-1}_reslice($){Pe1($<=this._buf.buffer.byteLength),this._buf=new Uint8Array(this._buf.buffer,0,$)}readByte(){let $=new Uint8Array(1);if(this.read($))return $[0];return null}read($){if(this.empty()){if(this.reset(),$.byteLength===0)return 0;return null}let Z=v70(this._buf.subarray(this._off),$);return this._off+=Z,Z}writeByte($){return this.write(Uint8Array.of($))}writeString($){return this.write(Q14.TE.encode($))}write($){let Z=this._grow($.byteLength);return v70($,this._buf,Z)}_grow($){let Z=this.length;if(Z===0&&this._off!==0)this.reset();let X=this._tryGrowByReslice($);if(X>=0)return X;let Q=this.capacity;if($<=Math.floor(Q/2)-Z)v70(this._buf.subarray(this._off),this._buf);else if(Q+$>Te1.MAX_SIZE)throw Error("The buffer cannot be grown beyond the maximum size.");else{let Y=new Uint8Array(Math.min(2*Q+$,Te1.MAX_SIZE));v70(this._buf.subarray(this._off),Y),this._buf=Y}return this._off=0,this._reslice(Math.min(Z+$,Te1.MAX_SIZE)),Z}grow($){if($<0)throw Error("Buffer._grow: negative count");let Z=this._grow($);this._reslice(Z)}readFrom($){let Z=0,X=new Uint8Array(ze1);while(!0){let Q=this.capacity-this.length<ze1,Y=Q?X:new Uint8Array(this._buf.buffer,this.length),G=$.read(Y);if(G===null)return Z;if(Q)this.write(Y.subarray(0,G));else this._reslice(this.length+G);Z+=G}}}Te1.DenoBuffer=dn0;function G14($){let Z=new dn0;return Z.readFrom($),Z.bytes()}function J14($,Z){let X=0;while(X<Z.length)X+=$.write(Z.subarray(X))}});var tn0=v((Ve1)=>{Object.defineProperty(Ve1,"__esModule",{value:!0});Ve1.cc=Ve1.State=Ve1.Parser=Ve1.Kind=void 0;Ve1.describe=B14;var pn0=in0(),nn0=KG();Ve1.Kind={OK:0,ERR:1,MSG:2,INFO:3,PING:4,PONG:5};function B14($){let Z,X="";switch($.kind){case Ve1.Kind.MSG:Z="MSG";break;case Ve1.Kind.OK:Z="OK";break;case Ve1.Kind.ERR:Z="ERR",X=nn0.TD.decode($.data);break;case Ve1.Kind.PING:Z="PING";break;case Ve1.Kind.PONG:Z="PONG";break;case Ve1.Kind.INFO:Z="INFO",X=nn0.TD.decode($.data)}return`${Z}: ${X}`}function Ie1(){let $={};return $.sid=-1,$.hdr=-1,$.size=-1,$}var qe1=48,O14=57,Ry=67108864;class Me1{dispatcher;state;as;drop;hdr;ma;argBuf;msgBuf;constructor($){this.dispatcher=$,this.state=Ve1.State.OP_START,this.as=0,this.drop=0,this.hdr=0}parse($){let Z;for(Z=0;Z<$.length;Z++){let X=$[Z];switch(this.state){case Ve1.State.OP_START:switch(X){case Ve1.cc.M:case Ve1.cc.m:this.state=Ve1.State.OP_M,this.hdr=-1,this.ma=Ie1();break;case Ve1.cc.H:case Ve1.cc.h:this.state=Ve1.State.OP_H,this.hdr=0,this.ma=Ie1();break;case Ve1.cc.P:case Ve1.cc.p:this.state=Ve1.State.OP_P;break;case Ve1.cc.PLUS:this.state=Ve1.State.OP_PLUS;break;case Ve1.cc.MINUS:this.state=Ve1.State.OP_MINUS;break;case Ve1.cc.I:case Ve1.cc.i:this.state=Ve1.State.OP_I;break;default:throw this.fail($.subarray(Z))}break;case Ve1.State.OP_H:switch(X){case Ve1.cc.M:case Ve1.cc.m:this.state=Ve1.State.OP_M;break;default:throw this.fail($.subarray(Z))}break;case Ve1.State.OP_M:switch(X){case Ve1.cc.S:case Ve1.cc.s:this.state=Ve1.State.OP_MS;break;default:throw this.fail($.subarray(Z))}break;case Ve1.State.OP_MS:switch(X){case Ve1.cc.G:case Ve1.cc.g:this.state=Ve1.State.OP_MSG;break;default:throw this.fail($.subarray(Z))}break;case Ve1.State.OP_MSG:switch(X){case Ve1.cc.SPACE:case Ve1.cc.TAB:this.state=Ve1.State.OP_MSG_SPC;break;default:throw this.fail($.subarray(Z))}break;case Ve1.State.OP_MSG_SPC:switch(X){case Ve1.cc.SPACE:case Ve1.cc.TAB:continue;default:this.state=Ve1.State.MSG_ARG,this.as=Z}break;case Ve1.State.MSG_ARG:switch(X){case Ve1.cc.CR:this.drop=1;break;case Ve1.cc.NL:{let Q=this.argBuf?this.argBuf.bytes():$.subarray(this.as,Z-this.drop);this.processMsgArgs(Q),this.drop=0,this.as=Z+1,this.state=Ve1.State.MSG_PAYLOAD,Z=this.as+this.ma.size-1;break}default:if(this.argBuf)this.argBuf.writeByte(X)}break;case Ve1.State.MSG_PAYLOAD:if(this.msgBuf)if(this.msgBuf.length>=this.ma.size){let Q=this.msgBuf.bytes({copy:!1});this.dispatcher.push({kind:Ve1.Kind.MSG,msg:this.ma,data:Q}),this.argBuf=void 0,this.msgBuf=void 0,this.state=Ve1.State.MSG_END}else{let Q=this.ma.size-this.msgBuf.length,Y=$.length-Z;if(Y<Q)Q=Y;if(Q>0)this.msgBuf.write($.subarray(Z,Z+Q)),Z=Z+Q-1;else this.msgBuf.writeByte(X)}else if(Z-this.as>=this.ma.size)this.dispatcher.push({kind:Ve1.Kind.MSG,msg:this.ma,data:$.subarray(this.as,Z)}),this.argBuf=void 0,this.msgBuf=void 0,this.state=Ve1.State.MSG_END;break;case Ve1.State.MSG_END:switch(X){case Ve1.cc.NL:this.drop=0,this.as=Z+1,this.state=Ve1.State.OP_START;break;default:continue}break;case Ve1.State.OP_PLUS:switch(X){case Ve1.cc.O:case Ve1.cc.o:this.state=Ve1.State.OP_PLUS_O;break;default:throw this.fail($.subarray(Z))}break;case Ve1.State.OP_PLUS_O:switch(X){case Ve1.cc.K:case Ve1.cc.k:this.state=Ve1.State.OP_PLUS_OK;break;default:throw this.fail($.subarray(Z))}break;case Ve1.State.OP_PLUS_OK:switch(X){case Ve1.cc.NL:this.dispatcher.push({kind:Ve1.Kind.OK}),this.drop=0,this.state=Ve1.State.OP_START;break}break;case Ve1.State.OP_MINUS:switch(X){case Ve1.cc.E:case Ve1.cc.e:this.state=Ve1.State.OP_MINUS_E;break;default:throw this.fail($.subarray(Z))}break;case Ve1.State.OP_MINUS_E:switch(X){case Ve1.cc.R:case Ve1.cc.r:this.state=Ve1.State.OP_MINUS_ER;break;default:throw this.fail($.subarray(Z))}break;case Ve1.State.OP_MINUS_ER:switch(X){case Ve1.cc.R:case Ve1.cc.r:this.state=Ve1.State.OP_MINUS_ERR;break;default:throw this.fail($.subarray(Z))}break;case Ve1.State.OP_MINUS_ERR:switch(X){case Ve1.cc.SPACE:case Ve1.cc.TAB:this.state=Ve1.State.OP_MINUS_ERR_SPC;break;default:throw this.fail($.subarray(Z))}break;case Ve1.State.OP_MINUS_ERR_SPC:switch(X){case Ve1.cc.SPACE:case Ve1.cc.TAB:continue;default:this.state=Ve1.State.MINUS_ERR_ARG,this.as=Z}break;case Ve1.State.MINUS_ERR_ARG:switch(X){case Ve1.cc.CR:this.drop=1;break;case Ve1.cc.NL:{let Q;if(this.argBuf)Q=this.argBuf.bytes(),this.argBuf=void 0;else Q=$.subarray(this.as,Z-this.drop);this.dispatcher.push({kind:Ve1.Kind.ERR,data:Q}),this.drop=0,this.as=Z+1,this.state=Ve1.State.OP_START;break}default:if(this.argBuf)this.argBuf.write(Uint8Array.of(X))}break;case Ve1.State.OP_P:switch(X){case Ve1.cc.I:case Ve1.cc.i:this.state=Ve1.State.OP_PI;break;case Ve1.cc.O:case Ve1.cc.o:this.state=Ve1.State.OP_PO;break;default:throw this.fail($.subarray(Z))}break;case Ve1.State.OP_PO:switch(X){case Ve1.cc.N:case Ve1.cc.n:this.state=Ve1.State.OP_PON;break;default:throw this.fail($.subarray(Z))}break;case Ve1.State.OP_PON:switch(X){case Ve1.cc.G:case Ve1.cc.g:this.state=Ve1.State.OP_PONG;break;default:throw this.fail($.subarray(Z))}break;case Ve1.State.OP_PONG:switch(X){case Ve1.cc.NL:this.dispatcher.push({kind:Ve1.Kind.PONG}),this.drop=0,this.state=Ve1.State.OP_START;break}break;case Ve1.State.OP_PI:switch(X){case Ve1.cc.N:case Ve1.cc.n:this.state=Ve1.State.OP_PIN;break;default:throw this.fail($.subarray(Z))}break;case Ve1.State.OP_PIN:switch(X){case Ve1.cc.G:case Ve1.cc.g:this.state=Ve1.State.OP_PING;break;default:throw this.fail($.subarray(Z))}break;case Ve1.State.OP_PING:switch(X){case Ve1.cc.NL:this.dispatcher.push({kind:Ve1.Kind.PING}),this.drop=0,this.state=Ve1.State.OP_START;break}break;case Ve1.State.OP_I:switch(X){case Ve1.cc.N:case Ve1.cc.n:this.state=Ve1.State.OP_IN;break;default:throw this.fail($.subarray(Z))}break;case Ve1.State.OP_IN:switch(X){case Ve1.cc.F:case Ve1.cc.f:this.state=Ve1.State.OP_INF;break;default:throw this.fail($.subarray(Z))}break;case Ve1.State.OP_INF:switch(X){case Ve1.cc.O:case Ve1.cc.o:this.state=Ve1.State.OP_INFO;break;default:throw this.fail($.subarray(Z))}break;case Ve1.State.OP_INFO:switch(X){case Ve1.cc.SPACE:case Ve1.cc.TAB:this.state=Ve1.State.OP_INFO_SPC;break;default:throw this.fail($.subarray(Z))}break;case Ve1.State.OP_INFO_SPC:switch(X){case Ve1.cc.SPACE:case Ve1.cc.TAB:continue;default:this.state=Ve1.State.INFO_ARG,this.as=Z}break;case Ve1.State.INFO_ARG:switch(X){case Ve1.cc.CR:this.drop=1;break;case Ve1.cc.NL:{let Q;if(this.argBuf)Q=this.argBuf.bytes(),this.argBuf=void 0;else Q=$.subarray(this.as,Z-this.drop);this.dispatcher.push({kind:Ve1.Kind.INFO,data:Q}),this.drop=0,this.as=Z+1,this.state=Ve1.State.OP_START;break}default:if(this.argBuf)this.argBuf.writeByte(X)}break;default:throw this.fail($.subarray(Z))}}if((this.state===Ve1.State.MSG_ARG||this.state===Ve1.State.MINUS_ERR_ARG||this.state===Ve1.State.INFO_ARG)&&!this.argBuf)this.argBuf=new pn0.DenoBuffer($.subarray(this.as,Z-this.drop));if(this.state===Ve1.State.MSG_PAYLOAD&&!this.msgBuf){if(!this.argBuf)this.cloneMsgArg();this.msgBuf=new pn0.DenoBuffer($.subarray(this.as))}}cloneMsgArg(){let $=this.ma.subject.length,Z=this.ma.reply?this.ma.reply.length:0,X=new Uint8Array($+Z);if(X.set(this.ma.subject),this.ma.reply)X.set(this.ma.reply,$);if(this.argBuf=new pn0.DenoBuffer(X),this.ma.subject=X.subarray(0,$),this.ma.reply)this.ma.reply=X.subarray($)}processMsgArgs($){if(this.hdr>=0)return this.processHeaderMsgArgs($);let Z=[],X=-1;for(let Q=0;Q<$.length;Q++)switch($[Q]){case Ve1.cc.SPACE:case Ve1.cc.TAB:case Ve1.cc.CR:case Ve1.cc.NL:if(X>=0)Z.push($.subarray(X,Q)),X=-1;break;default:if(X<0)X=Q}if(X>=0)Z.push($.subarray(X));switch(Z.length){case 3:this.ma.subject=Z[0],this.ma.sid=this.protoParseInt(Z[1]),this.ma.reply=void 0,this.ma.size=this.protoParseInt(Z[2],Ry);break;case 4:this.ma.subject=Z[0],this.ma.sid=this.protoParseInt(Z[1]),this.ma.reply=Z[2],this.ma.size=this.protoParseInt(Z[3],Ry);break;default:throw this.fail($,"processMsgArgs Parse Error")}if(this.ma.sid<0)throw this.fail($,"processMsgArgs Bad or Missing Sid Error");if(this.ma.size<0)throw this.fail($,"processMsgArgs Bad or Missing Size Error")}fail($,Z=""){if(!Z)Z=`parse error [${this.state}]`;else Z=`${Z} [${this.state}]`;return Error(`${Z}: ${nn0.TD.decode($)}`)}processHeaderMsgArgs($){let Z=[],X=-1;for(let Q=0;Q<$.length;Q++)switch($[Q]){case Ve1.cc.SPACE:case Ve1.cc.TAB:case Ve1.cc.CR:case Ve1.cc.NL:if(X>=0)Z.push($.subarray(X,Q)),X=-1;break;default:if(X<0)X=Q}if(X>=0)Z.push($.subarray(X));switch(Z.length){case 4:this.ma.subject=Z[0],this.ma.sid=this.protoParseInt(Z[1]),this.ma.reply=void 0,this.ma.hdr=this.protoParseInt(Z[2],Ry),this.ma.size=this.protoParseInt(Z[3],Ry);break;case 5:this.ma.subject=Z[0],this.ma.sid=this.protoParseInt(Z[1]),this.ma.reply=Z[2],this.ma.hdr=this.protoParseInt(Z[3],Ry),this.ma.size=this.protoParseInt(Z[4],Ry);break;default:throw this.fail($,"processHeaderMsgArgs Parse Error")}if(this.ma.sid<0)throw this.fail($,"processHeaderMsgArgs Bad or Missing Sid Error");if(this.ma.hdr<0||this.ma.hdr>this.ma.size)throw this.fail($,"processHeaderMsgArgs Bad or Missing Header Size Error");if(this.ma.size<0)throw this.fail($,"processHeaderMsgArgs Bad or Missing Size Error")}protoParseInt($,Z){if($.length===0||$.length>15)return-1;let X=0;for(let Q=0;Q<$.length;Q++){if($[Q]<qe1||$[Q]>O14)return-1;X=X*10+($[Q]-qe1)}return Z!==void 0&&X>Z?-1:X}}Ve1.Parser=Me1;Ve1.State={OP_START:0,OP_PLUS:1,OP_PLUS_O:2,OP_PLUS_OK:3,OP_MINUS:4,OP_MINUS_E:5,OP_MINUS_ER:6,OP_MINUS_ERR:7,OP_MINUS_ERR_SPC:8,MINUS_ERR_ARG:9,OP_M:10,OP_MS:11,OP_MSG:12,OP_MSG_SPC:13,MSG_ARG:14,MSG_PAYLOAD:15,MSG_END:16,OP_H:17,OP_P:18,OP_PI:19,OP_PIN:20,OP_PING:21,OP_PO:22,OP_PON:23,OP_PONG:24,OP_I:25,OP_IN:26,OP_INF:27,OP_INFO:28,OP_INFO_SPC:29,INFO_ARG:30};Ve1.cc={CR:13,E:69,e:101,F:70,f:102,G:71,g:103,H:72,h:104,I:73,i:105,K:75,k:107,M:77,m:109,MINUS:45,N:78,n:110,NL:10,O:79,o:111,P:80,p:112,PLUS:43,R:82,r:114,S:83,s:115,SPACE:32,TAB:9}});var b70=v((Se1)=>{Object.defineProperty(Se1,"__esModule",{value:!0});Se1.MsgHdrsImpl=void 0;Se1.canonicalMIMEHeaderKey=rn0;Se1.headers=w14;var ke1=KG(),i3=NO(),f70=WG();function rn0($){let F=!0,U=Array($.length);for(let N=0;N<$.length;N++){let B=$.charCodeAt(N);if(B===58||B<33||B>126)throw f70.InvalidArgumentError.format("header",`'${$[N]}' is not a valid character in a header name`);if(F&&97<=B&&B<=122)B-=32;else if(!F&&65<=B&&B<=90)B+=32;U[N]=B,F=B==45}return String.fromCharCode(...U)}function w14($=0,Z=""){if($===0&&Z!=="")throw f70.InvalidArgumentError.format("code","is required");else if($>0&&Z==="")throw f70.InvalidArgumentError.format("description","is required");return new Iy($,Z)}var on0="NATS/1.0";class Iy{_code;headers;_description;constructor($=0,Z=""){this._code=$,this._description=Z,this.headers=new Map}[Symbol.iterator](){return this.headers.entries()}size(){return this.headers.size}equals($){if($&&this.headers.size===$.headers.size&&this._code===$._code){for(let[Z,X]of this.headers){let Q=$.values(Z);if(X.length!==Q.length)return!1;let Y=[...X].sort(),G=[...Q].sort();for(let J=0;J<Y.length;J++)if(Y[J]!==G[J])return!1}return!0}return!1}static decode($){let Z=new Iy,Q=ke1.TD.decode($).split(`\r
 `),Y=Q[0];if(Y!==on0){let G=Y.replace(on0,"").trim();if(G.length>0){if(Z._code=parseInt(G,10),isNaN(Z._code))Z._code=0;let J=Z._code.toString();G=G.replace(J,""),Z._description=G.trim()}}if(Q.length>=1)Q.slice(1).map((G)=>{if(G){let J=G.indexOf(":");if(J>-1){let K=G.slice(0,J),W=G.slice(J+1).trim();Z.append(K,W)}}});return Z}toString(){if(this.headers.size===0&&this._code===0)return"";let $=on0;if(this._code>0&&this._description!=="")$+=` ${this._code} ${this._description}`;for(let[Z,X]of this.headers)for(let Q=0;Q<X.length;Q++)$=`${$}\r
 ${Z}: ${X[Q]}`;return`${$}\r
@@ -2449,7 +2449,7 @@ Caused by: ${Z.stack}`}};$a=class $a extends IZ{constructor($,Z){super($,Z);this
 `).some((X)=>X.indexOf("(https.js:")!==-1||X.indexOf("node:https:")!==-1)}incrementSockets($){if(this.maxSockets===1/0&&this.maxTotalSockets===1/0)return null;if(!this.sockets[$])this.sockets[$]=[];let Z=new Yu4.Socket({writable:!1});return this.sockets[$].push(Z),this.totalSocketCount++,Z}decrementSockets($,Z){if(!this.sockets[$]||Z===null)return;let X=this.sockets[$],Q=X.indexOf(Z);if(Q!==-1){if(X.splice(Q,1),this.totalSocketCount--,X.length===0)delete this.sockets[$]}}getName($){if(this.isSecureEndpoint($))return Gu4.Agent.prototype.getName.call(this,$);return super.getName($)}createSocket($,Z,X){let Q={...Z,secureEndpoint:this.isSecureEndpoint(Z)},Y=this.getName(Q),G=this.incrementSockets(Y);Promise.resolve().then(()=>this.connect($,Q)).then((J)=>{if(this.decrementSockets(Y,G),J instanceof Uq$.Agent)try{return J.addRequest($,Q)}catch(K){return X(K)}this[gH].currentSocket=J,super.createSocket($,Z,X)},(J)=>{this.decrementSockets(Y,G),X(J)})}createConnection(){let $=this[gH].currentSocket;if(this[gH].currentSocket=void 0,!$)throw Error("No socket was returned in the `connect()` function");return $}get defaultPort(){return this[gH].defaultPort??(this.protocol==="https:"?443:80)}set defaultPort($){if(this[gH])this[gH].defaultPort=$}get protocol(){return this[gH].protocol??(this.isSecureEndpoint()?"https:":"http:")}set protocol($){if(this[gH])this[gH].protocol=$}}CG.Agent=Oq$});var Dq$=v((nJ)=>{var Ju4=nJ&&nJ.__createBinding||(Object.create?function($,Z,X,Q){if(Q===void 0)Q=X;var Y=Object.getOwnPropertyDescriptor(Z,X);if(!Y||("get"in Y?!Z.__esModule:Y.writable||Y.configurable))Y={enumerable:!0,get:function(){return Z[X]}};Object.defineProperty($,Q,Y)}:function($,Z,X,Q){if(Q===void 0)Q=X;$[Q]=Z[X]}),Ku4=nJ&&nJ.__setModuleDefault||(Object.create?function($,Z){Object.defineProperty($,"default",{enumerable:!0,value:Z})}:function($,Z){$.default=Z}),t51=nJ&&nJ.__importStar||function($){if($&&$.__esModule)return $;var Z={};if($!=null){for(var X in $)if(X!=="default"&&Object.prototype.hasOwnProperty.call($,X))Ju4(Z,$,X)}return Ku4(Z,$),Z},Wu4=nJ&&nJ.__importDefault||function($){return $&&$.__esModule?$:{default:$}};Object.defineProperty(nJ,"__esModule",{value:!0});nJ.SocksProxyAgent=void 0;var Hu4=Kq$(),Fu4=Lq$(),Uu4=Wu4(J0("debug")),Nu4=t51(J0("dns")),Bu4=t51(J0("net")),Ou4=t51(J0("tls")),Lu4=J0("url"),SP0=(0,Uu4.default)("socks-proxy-agent"),Du4=($)=>{if($.servername===void 0&&$.host&&!Bu4.isIP($.host))return{...$,servername:$.host};return $};function wu4($){let Z=!1,X=5,Q=$.hostname,Y=parseInt($.port,10)||1080;switch($.protocol.replace(":","")){case"socks4":Z=!0,X=4;break;case"socks4a":X=4;break;case"socks5":Z=!0,X=5;break;case"socks":X=5;break;case"socks5h":X=5;break;default:throw TypeError(`A "socks" protocol must be specified! Got: ${String($.protocol)}`)}let G={host:Q,port:Y,type:X};if($.username)Object.defineProperty(G,"userId",{value:decodeURIComponent($.username),enumerable:!1});if($.password!=null)Object.defineProperty(G,"password",{value:decodeURIComponent($.password),enumerable:!1});return{lookup:Z,proxy:G}}class o51 extends Fu4.Agent{constructor($,Z){super(Z);let X=typeof $==="string"?new Lu4.URL($):$,{proxy:Q,lookup:Y}=wu4(X);this.shouldLookup=Y,this.proxy=Q,this.timeout=Z?.timeout??null,this.socketOptions=Z?.socketOptions??null}async connect($,Z){let{shouldLookup:X,proxy:Q,timeout:Y}=this;if(!Z.host)throw Error("No `host` defined!");let{host:G}=Z,{port:J,lookup:K=Nu4.lookup}=Z;if(X)G=await new Promise((U,N)=>{K(G,{},(B,O)=>{if(B)N(B);else U(O)})});let W={proxy:Q,destination:{host:G,port:typeof J==="number"?J:parseInt(J,10)},command:"connect",timeout:Y??void 0,socket_options:this.socketOptions??void 0},H=(U)=>{if($.destroy(),F.destroy(),U)U.destroy()};SP0("Creating socks proxy connection: %o",W);let{socket:F}=await Hu4.SocksClient.createConnection(W);if(SP0("Successfully created socks proxy connection"),Y!==null)F.setTimeout(Y),F.on("timeout",()=>H());if(Z.secureEndpoint){SP0("Upgrading socket connection to TLS");let U=Ou4.connect({...Eu4(Du4(Z),"host","path","port"),socket:F});return U.once("error",(N)=>{SP0("Socket TLS error",N.message),H(U)}),U}return F}}o51.protocols=["socks","socks4","socks4a","socks5","socks5h"];nJ.SocksProxyAgent=o51;function Eu4($,...Z){let X={},Q;for(Q in $)if(!Z.includes(Q))X[Q]=$[Q];return X}});var Pq$=v((o4Z,zq$)=>{var r51=J0("https"),a51=J0("http"),{URL:wq$}=J0("url");class Eq$ extends a51.Agent{constructor($){let{proxy:Z,proxyRequestOptions:X,...Q}=$;super(Q);this.proxy=typeof Z==="string"?new wq$(Z):Z,this.proxyRequestOptions=X||{}}createConnection($,Z){let X={...this.proxyRequestOptions,method:"CONNECT",host:this.proxy.hostname,port:this.proxy.port,path:`${$.host}:${$.port}`,setHost:!1,headers:{...this.proxyRequestOptions.headers,connection:this.keepAlive?"keep-alive":"close",host:`${$.host}:${$.port}`},agent:!1,timeout:$.timeout||0};if(this.proxy.username||this.proxy.password){let Y=Buffer.from(`${decodeURIComponent(this.proxy.username||"")}:${decodeURIComponent(this.proxy.password||"")}`).toString("base64");X.headers["proxy-authorization"]=`Basic ${Y}`}if(this.proxy.protocol==="https:")X.servername=this.proxy.hostname;let Q=(this.proxy.protocol==="http:"?a51:r51).request(X);Q.once("connect",(Y,G,J)=>{if(Q.removeAllListeners(),G.removeAllListeners(),Y.statusCode===200)Z(null,G);else G.destroy(),Z(Error(`Bad response: ${Y.statusCode}`),null)}),Q.once("timeout",()=>{Q.destroy(Error("Proxy timeout"))}),Q.once("error",(Y)=>{Q.removeAllListeners(),Z(Y,null)}),Q.end()}}class jq$ extends r51.Agent{constructor($){let{proxy:Z,proxyRequestOptions:X,...Q}=$;super(Q);this.proxy=typeof Z==="string"?new wq$(Z):Z,this.proxyRequestOptions=X||{}}createConnection($,Z){let X={...this.proxyRequestOptions,method:"CONNECT",host:this.proxy.hostname,port:this.proxy.port,path:`${$.host}:${$.port}`,setHost:!1,headers:{...this.proxyRequestOptions.headers,connection:this.keepAlive?"keep-alive":"close",host:`${$.host}:${$.port}`},agent:!1,timeout:$.timeout||0};if(this.proxy.username||this.proxy.password){let Y=Buffer.from(`${decodeURIComponent(this.proxy.username||"")}:${decodeURIComponent(this.proxy.password||"")}`).toString("base64");X.headers["proxy-authorization"]=`Basic ${Y}`}if(this.proxy.protocol==="https:")X.servername=this.proxy.hostname;let Q=(this.proxy.protocol==="http:"?a51:r51).request(X);Q.once("connect",(Y,G,J)=>{if(Q.removeAllListeners(),G.removeAllListeners(),Y.statusCode===200){let K=super.createConnection({...$,socket:G});Z(null,K)}else G.destroy(),Z(Error(`Bad response: ${Y.statusCode}`),null)}),Q.once("timeout",()=>{Q.destroy(Error("Proxy timeout"))}),Q.once("error",(Y)=>{Q.removeAllListeners(),Z(Y,null)}),Q.end()}}zq$.exports={HttpProxyAgent:Eq$,HttpsProxyAgent:jq$}});var s51,Aq$,Tq$;var Rq$=L(()=>{s51=k(Pq$(),1),Aq$=s51.default.HttpProxyAgent,Tq$=s51.default.HttpsProxyAgent});import KN from"fs";import ju4 from"https";import zu4 from"http";import Pu4 from"net";import wv from"path";import{Headers as Au4}from"node-fetch";import CP0 from"child_process";function e51($){try{return KN.accessSync($),!0}catch{return!1}}class _P0{addAuthenticator($){this.custom_authenticators.push($)}constructor(){this.authenticators=[new e61,new Q51,new Z51,new X51,new La],this.custom_authenticators=[],this.contexts=[],this.clusters=[],this.users=[]}getContexts(){return this.contexts}getClusters(){return this.clusters}getUsers(){return this.users}getCurrentContext(){return this.currentContext}setCurrentContext($){this.currentContext=$}getContextObject($){if(!this.contexts)return null;return X91(this.contexts,$,"context")}getCurrentCluster(){let $=this.getCurrentContextObject();if(!$)return null;return this.getCluster($.cluster)}getCluster($){return X91(this.clusters,$,"cluster")}getCurrentUser(){let $=this.getCurrentContextObject();if(!$)return null;return this.getUser($.user)}getUser($){return X91(this.users,$,"user")}loadFromFile($,Z){let X=wv.dirname($);this.loadFromString(KN.readFileSync($).toString("utf-8"),Z),this.makePathsAbsolute(X)}async applyToFetchOptions($){await this.applyToHTTPSOptions($);let Z=new Au4;for(let[X,Q]of Object.entries($.headers||{}))if(Array.isArray(Q))Q.forEach((Y)=>{Z.append(X,Y)});else if(typeof Q==="number"||typeof Q==="string")Z.set(X,Q.toString());if($.auth)Z.set("Authorization","Basic "+Buffer.from($.auth).toString("base64"));return{agent:$.agent,headers:Z,method:$.method,timeout:$.timeout}}async applyToHTTPSOptions($){let Z=this.getCurrentUser(),X=this.getCurrentCluster();if(await this.applyOptions($),Z&&Z.username)$.auth=`${Z.username}:${Z.password}`;let Q={};if(Q.ca=$.ca,Q.cert=$.cert,Q.key=$.key,Q.pfx=$.pfx,Q.passphrase=$.passphrase,$.rejectUnauthorized!==void 0)Q.rejectUnauthorized=$.rejectUnauthorized;Q.timeout=$.timeout,Q.servername=$.servername,Q.ciphers=$.ciphers,Q.honorCipherOrder=$.honorCipherOrder,Q.ecdhCurve=$.ecdhCurve,Q.clientCertEngine=$.clientCertEngine,Q.crl=$.crl,Q.dhparam=$.dhparam,Q.secureOptions=$.secureOptions,Q.secureProtocol=$.secureProtocol,Q.sessionIdContext=$.sessionIdContext,$.agent=this.createAgent(X,Q)}async applySecurityAuthentication($){let Z=this.getCurrentCluster(),X=this.getCurrentUser(),Q={},Y={};if(await this.applyOptions(Y),Z&&Z.skipTLSVerify)Q.rejectUnauthorized=!1;if(Z&&Z.tlsServerName)Q.servername=Z.tlsServerName;if(X&&X.username){let J=Buffer.from(`${X.username}:${X.password}`).toString("base64");$.setHeaderParam("Authorization",`Basic ${J}`)}let G=Y.headers||{};if(Object.entries(G).forEach(([J,K])=>{$.setHeaderParam(J,`${K}`)}),Q.ca=Y.ca,Q.cert=Y.cert,Q.key=Y.key,Q.pfx=Y.pfx,Q.passphrase=Y.passphrase,Y.rejectUnauthorized!==void 0)Q.rejectUnauthorized=Y.rejectUnauthorized;$.setAgent(this.createAgent(Z,Q))}getName(){return"kubeconfig authentication"}loadFromString($,Z){let X=t61.load($);this.clusters=aT$(X.clusters,Z),this.contexts=Z2$(X.contexts,Z),this.users=eT$(X.users,Z),this.currentContext=X["current-context"]}loadFromOptions($){this.clusters=$.clusters,this.contexts=$.contexts,this.users=$.users,this.currentContext=$.currentContext}loadFromClusterAndUser($,Z){this.clusters=[$],this.users=[Z],this.currentContext="loaded-context",this.contexts=[{cluster:$.name,user:Z.name,name:this.currentContext}]}loadFromCluster($=""){let Z=process.env.KUBERNETES_SERVICE_HOST,X=process.env.KUBERNETES_SERVICE_PORT,Q="inCluster",Y="inClusterUser",G="inClusterContext",J="https";if(X==="80"||X==="8080"||X==="8001")J="http";let K=Z;if(Z&&Pu4.isIPv6(Z))K=`[${Z}]`;this.clusters=[{name:"inCluster",caFile:`${$}${Tu4}`,server:`${J}://${K}:${X}`,skipTLSVerify:!1}],this.users=[{name:"inClusterUser",authProvider:{name:"tokenFile",config:{tokenFile:`${$}${Iq$}`}}}];let W=`${$}${Ru4}`,H;if(e51(W))H=KN.readFileSync(W).toString("utf-8");this.contexts=[{cluster:"inCluster",name:"inClusterContext",user:"inClusterUser",namespace:H}],this.currentContext="inClusterContext"}mergeConfig($,Z=!1){if(!Z&&$.currentContext)this.currentContext=$.currentContext;$.clusters.forEach((X)=>{this.addCluster(X)}),$.users.forEach((X)=>{this.addUser(X)}),$.contexts.forEach((X)=>{this.addContext(X)})}addCluster($){if(!this.clusters)this.clusters=[];this.clusters.forEach((Z,X)=>{if(Z.name===$.name)throw Error(`Duplicate cluster: ${Z.name}`)}),this.clusters.push($)}addUser($){if(!this.users)this.users=[];this.users.forEach((Z,X)=>{if(Z.name===$.name)throw Error(`Duplicate user: ${Z.name}`)}),this.users.push($)}addContext($){if(!this.contexts)this.contexts=[];this.contexts.forEach((Z,X)=>{if(Z.name===$.name)throw Error(`Duplicate context: ${Z.name}`)}),this.contexts.push($)}loadFromDefault($,Z=!1,X=process.platform){if(process.env.KUBECONFIG&&process.env.KUBECONFIG.length>0){let Y=process.env.KUBECONFIG.split(wv.delimiter).filter((G)=>G);this.loadFromFile(Y[0],$);for(let G=1;G<Y.length;G++){let J=new _P0;J.loadFromFile(Y[G],$),this.mergeConfig(J,Z)}return}let Q=Iu4(X);if(Q){let Y=wv.join(Q,".kube","config");if(e51(Y)){this.loadFromFile(Y,$);return}}if(X==="win32"){try{let Y=CP0.spawnSync("wsl.exe",["bash","-c","printenv KUBECONFIG"]);if(Y.status===0&&Y.stdout.length>0){let G=CP0.spawnSync("wsl.exe",["cat",Y.stdout.toString("utf8")]);if(G.status===0){this.loadFromString(G.stdout.toString("utf8"),$);return}}}catch{}try{let Y=CP0.spawnSync("wsl.exe",["cat","~/.kube/config"]);if(Y.status===0){this.loadFromString(Y.stdout.toString("utf8"),$);let G=CP0.spawnSync("wsl.exe",["wslpath","-w","~/.kube"]);if(G.status===0)this.makePathsAbsolute(G.stdout.toString("utf8"));return}}catch{}}if(e51(Iq$)){this.loadFromCluster();return}this.loadFromClusterAndUser({name:"cluster",server:"http://localhost:8080"},{name:"user"})}makeApiClient($){let Z=this.getCurrentCluster();if(!Z)throw Error("No active cluster!");let X={default:this},Q=new ZP0(Z.server,{}),Y=F51({baseServer:Q,authMethods:X});return new $(Y)}makePathsAbsolute($){this.clusters.forEach((Z)=>{if(Z.caFile)Z.caFile=$91($,Z.caFile)}),this.users.forEach((Z)=>{if(Z.certFile)Z.certFile=$91($,Z.certFile);if(Z.keyFile)Z.keyFile=$91($,Z.keyFile)})}exportConfig(){let $={apiVersion:"v1",kind:"Config",clusters:this.clusters.map(sT$),users:this.users.map($2$),contexts:this.contexts.map(X2$),preferences:{},"current-context":this.getCurrentContext()};return JSON.stringify($)}getCurrentContextObject(){return this.getContextObject(this.currentContext)}createAgent($,Z){var X,Q;let Y;if($&&$.proxyUrl)if($.proxyUrl.startsWith("socks"))Y=new Mq$.SocksProxyAgent($.proxyUrl,Z);else if($.server.startsWith("https")){let G=Z;G.proxy=$.proxyUrl,Y=new Tq$(G)}else if($.server.startsWith("http")){let G=Z;G.proxy=$.proxyUrl,Y=new Aq$(G)}else throw Error("Unsupported proxy type");else if(((X=$===null||$===void 0?void 0:$.server)===null||X===void 0?void 0:X.startsWith("http:"))&&$.skipTLSVerify)Y=new zu4.Agent(Z);else if(((Q=$===null||$===void 0?void 0:$.server)===null||Q===void 0?void 0:Q.startsWith("http:"))&&!$.skipTLSVerify)throw Error("HTTP protocol is not allowed when skipTLSVerify is not set or false");else Y=new ju4.Agent(Z);return Y}applyHTTPSOptions($){var Z;let X=this.getCurrentCluster(),Q=this.getCurrentUser();if(!Q)return;if(X!=null&&X.skipTLSVerify)$.rejectUnauthorized=!1;if(X!=null&&X.tlsServerName)$.servername=X.tlsServerName;let Y=X!=null?Z91(X.caFile,X.caData):null;if(Y)$.ca=Y;let G=Z91(Q.certFile,Q.certData);if(G)$.cert=G;let J=Z91(Q.keyFile,Q.keyData);if(J)$.key=J;if(Q.impersonateUser!=null)(Z=$.headers)!==null&&Z!==void 0||($.headers={}),$.headers["Impersonate-User"]=Q.impersonateUser}async applyAuthorizationHeader($){let Z=this.getCurrentUser();if(!Z)return;let X=this.authenticators.find((Q)=>{return Q.isAuthProvider(Z)});if(!X)X=this.custom_authenticators.find((Q)=>{return Q.isAuthProvider(Z)});if(!$.headers)$.headers={};if(X)await X.applyAuthentication(Z,$);if(Z.token)$.headers.Authorization=`Bearer ${Z.token}`}async applyOptions($){this.applyHTTPSOptions($),await this.applyAuthorizationHeader($)}}function $91($,Z){if(!$||wv.isAbsolute(Z))return Z;return wv.join($,Z)}function Z91($,Z){if($)return KN.readFileSync($);if(Z)return Buffer.from(Z,"base64");return null}function qq$($){return $.reduce((Z,X)=>{if(X&&!Z.includes(X))return Z.concat(X);else return Z},[])}function Iu4($=process.platform){if($!=="win32"){if(process.env.HOME)try{return KN.accessSync(process.env.HOME),process.env.HOME}catch{}return null}let Z=process.env.HOMEDRIVE&&process.env.HOMEPATH?wv.join(process.env.HOMEDRIVE,process.env.HOMEPATH):"",X=process.env.HOME||"",Q=process.env.USERPROFILE||"",Y=qq$([X,Z,Q]),G=qq$([X,Q,Z]);for(let J of Y)try{return KN.accessSync(wv.join(J,".kube","config")),J}catch{}for(let J of G)try{return KN.accessSync(J,KN.constants.W_OK),J}catch{}for(let J of G)try{return KN.accessSync(J),J}catch{}return G[0]||null}function X91($,Z,X){if(!$)return null;for(let Q of $)if(Q.name===Z){if(Q[X])return Q[X].name=Z,Q[X];return Q}return null}var Mq$,Q91="/var/run/secrets/kubernetes.io/serviceaccount",Tu4,Iq$,Ru4;var Vq$=L(()=>{o61();rT$();Q2$();Y2$();G2$();J2$();KP0();FI$();Rq$();Mq$=k(Dq$(),1),Tu4=Q91+"/ca.crt",Iq$=Q91+"/token",Ru4=Q91+"/namespace"});import{STATUS_CODES as qu4}from"http";import{createInterface as Mu4}from"readline";import Vu4 from"node-fetch";class Y91{constructor($){this.config=$}async watch($,Z,X,Q){let Y=this.config.getCurrentCluster();if(!Y)throw Error("No currently active cluster");let G=new URL(Y.server+$);G.searchParams.set("watch","true");for(let[U,N]of Object.entries(Z||{}))if(N!==void 0)G.searchParams.set(U,N.toString());let J=await this.config.applyToFetchOptions({}),K=new AbortController,W=AbortSignal.timeout(30000);J.signal=AbortSignal.any([K.signal,W]),J.signal=K.signal,J.method="GET";let H=!1,F=(U)=>{if(!H)H=!0,K.abort(),Q(U)};try{let U=await Vu4(G,J);if(J.agent&&typeof J.agent==="object")for(let N of Object.values(J.agent.sockets).flat())N===null||N===void 0||N.setKeepAlive(!0,30000);if(U.status===200){let N=U.body;N.on("error",F),N.on("close",()=>F(null)),N.on("finish",()=>F(null));let B=Mu4(N);B.on("error",F),B.on("close",()=>F(null)),B.on("finish",()=>F(null)),B.on("line",(O)=>{try{let D=JSON.parse(O.toString());X(D.type,D.object,D)}catch{}})}else{let N=U.statusText||qu4[U.status]||"Internal Server Error",B=Error(N);throw B.statusCode=U.status,B}}catch(U){F(U)}return K}}var G91=L(()=>{Y91.SERVER_SIDE_CLOSE={error:"Connection closed on server"}});var J91=L(()=>{K91();G91()});class yK{serialize(){let $={};for(let Z of yK.attributeTypeMap)if(this[Z.baseName]!==void 0)$[Z.name]=q1.serialize(this[Z.baseName],Z.type,Z.format);for(let[Z,X]of Object.entries(this)){if(yK.attributeTypeMap.find((Q)=>Q.name===Z))continue;$[Z]=X}return $}static fromUnknown($){if(!vP0($))throw Error(`Unable to deseriliaze non-Kubernetes object ${$}.`);let Z=new yK;for(let X of yK.attributeTypeMap)if($[X.baseName]!==void 0)Z[X.name]=q1.deserialize($[X.baseName],X.type,X.format);for(let[X,Q]of Object.entries($)){if(yK.attributeTypeMap.find((Y)=>Y.name===X))continue;Z[X]=Q}return Z}}var vP0=($)=>!!$&&typeof $==="object"&&("apiVersion"in $)&&("kind"in $),kq$=({group:$,version:Z})=>[$,Z].join("/"),ku4=($)=>{let[Z,X]=$.apiVersion.split("/");return{kind:$.kind,group:X?Z:"",version:X?X:Z}},zD;var xP0=L(()=>{e1();yK.attributeTypeMap=[{name:"apiVersion",baseName:"apiVersion",type:"string",format:""},{name:"kind",baseName:"kind",type:"string",format:""},{name:"metadata",baseName:"metadata",type:"V1ObjectMeta",format:""}];zD=class zD extends q1{static registerModel($,Z){var X,Q;let Y=kq$($),G=(X=(Q=this.modelRegistry)[Y])!==null&&X!==void 0?X:Q[Y]={};if(G[$.kind])throw Error(`Kind ${$.kind} of ${Y} is already defined`);G[$.kind]=Z}static clearModelRegistry(){this.modelRegistry={}}static getSerializerForObject($){var Z;if(!vP0($))return;let X=ku4($);return(Z=zD.modelRegistry[kq$(X)])===null||Z===void 0?void 0:Z[X.kind]}static serialize($,Z,X=""){let Q=zD.getSerializerForObject($);if(Q)return Q.serialize($,Z,X);if($ instanceof yK)return $.serialize();let Y=q1.serialize($,Z,X);if(Y!==$)return Y;if(!vP0($))return Y;let G={};for(let J of yK.attributeTypeMap)if($[J.baseName]!==void 0)G[J.name]=q1.serialize($[J.baseName],J.type,J.format);for(let[J,K]of Object.entries($)){if(yK.attributeTypeMap.find((W)=>W.name===J))continue;G[J]=K}return G}static deserialize($,Z,X=""){let Q=zD.getSerializerForObject($);if(Q)return Q.deserialize($,Z,X);let Y=q1.deserialize($,Z,X);if(Y!==$)return Y;if(!vP0($))return Y;return yK.fromUnknown($)}};zD.modelRegistry={}});var K91=L(()=>{J91();xP0()});var fP0=L(()=>{KP0()});var W91=()=>{};import Sq$ from"ws"with{type:"jsx"};class k5{static supportsClose($){return $==="v5.channel.k8s.io"}static closeStream($,Z){switch($){case k5.StdinStream:Z.stdin.pause();break;case k5.StdoutStream:Z.stdout.end();break;case k5.StderrStream:Z.stderr.end();break}}static handleStandardStreams($,Z,X,Q){if(Z.length<1)return null;if(X&&$===k5.StdoutStream)X.write(Z);else if(Q&&$===k5.StderrStream)Q.write(Z);else if($===k5.StatusStream){if(X&&X!==process.stdout)X.end();if(Q&&Q!==process.stderr)Q.end();return JSON.parse(Z.toString("utf8"))}else throw Error("Unknown stream: "+$);return null}static handleStandardInput($,Z,X=0){return Z.on("data",(Q)=>{$.send(_q$(X,Q,Z.readableEncoding))}),Z.on("end",()=>{if(k5.supportsClose($.protocol)){let Q=Buffer.alloc(2);Q.writeUint8(this.CloseStream,0),Q.writeUint8(this.StdinStream,1),$.send(Q);return}$.close()}),!0}static async processData($,Z,X,Q=0,Y=3,G){let J=_q$(Q,$,G),K=0;for(;K<Y;++K)if(Z!==null&&Z.readyState===Sq$.OPEN){Z.send(J);break}else Z=await X();if(K>=Y)throw Error("can't send data to ws");return Z}static restartableHandleStandardInput($,Z,X=0,Q=3,Y=!1){if(Q<0)throw Error("retryCount can't be lower than 0.");let G=Promise.resolve(),J=null;if(Z.on("data",(K)=>{G=G.then(async()=>{J=await k5.processData(K,J,$,X,Q,Z.readableEncoding)})}),Y)Z.on("flush",async()=>{await G});return Z.on("end",()=>{if(J!==null)J.close()}),()=>J}constructor($,Z,X={stdin:process.stdin,stdout:process.stdout,stderr:process.stderr}){this.config=$,this.socketFactory=Z,this.streams=X}async connect($,Z,X){let Q=this.config.getCurrentCluster();if(!Q)throw Error("No cluster is defined.");let Y=Q.server,G=Y.startsWith("https://"),J=G?Y.substr(8):Y.substr(7),W=`${G?"wss":"ws"}://${J}${$}`,H={};return await this.config.applyToHTTPSOptions(H),await new Promise((F,U)=>{let N=this.socketFactory?this.socketFactory(W,Cq$,H):new Sq$(W,Cq$,H),B=!1;N.onopen=()=>{B=!0,F(N)},N.onerror=(O)=>{if(!B)U(O)},N.onmessage=({data:O})=>{if(typeof O==="string"){if(O.charCodeAt(0)===k5.CloseStream)k5.closeStream(O.charCodeAt(1),this.streams);if(Z&&!Z(O))N.close()}else if(O instanceof Buffer){let D=O.readUint8(0);if(D===k5.CloseStream)k5.closeStream(O.readInt8(1),this.streams);if(X&&!X(D,O.slice(1)))N.close()}}})}}function _q$($,Z,X){let Q;if(Z instanceof Buffer)Q=Buffer.alloc(Z.length+1),Z.copy(Q,1);else{X!==null&&X!==void 0||(X="utf-8");let Y=Buffer.byteLength(Z,X);Q=Buffer.alloc(Y+1),Q.write(Z,1,Y,X)}return Q.writeInt8($,0),Q}var Cq$;var bP0=L(()=>{Cq$=["v5.channel.k8s.io","v4.channel.k8s.io","v3.channel.k8s.io","v2.channel.k8s.io","channel.k8s.io"];k5.StdinStream=0;k5.StdoutStream=1;k5.StderrStream=2;k5.StatusStream=3;k5.ResizeStream=4;k5.CloseStream=255});var vq$=L(()=>{W91();bP0()});var H91=L(()=>{W91();bP0()});import _u4 from"querystring";class F91{constructor($,Z,X){this.handler=X||new k5($),this.disconnectOnErr=Z===void 0?!0:Z}async portForward($,Z,X,Q,Y,G,J=0){if(X.length===0)throw Error("You must provide at least one port to forward to.");if(X.length>1)throw Error("Only one port is currently supported for port-forward");let K={ports:X[0]},W=_u4.stringify(K),H=[];X.forEach((N,B)=>{H[B*2]=!0,H[B*2+1]=!0});let F=`/api/v1/namespaces/${$}/pods/${Z}/portforward?${W}`,U=()=>{return this.handler.connect(F,null,(N,B)=>{if(N>=X.length*2)return!this.disconnectOnErr;if(H[N])B=B.slice(2),H[N]=!1;if(N%2===1){if(Y)Y.write(B)}else Q.write(B);return!0})};if(J<1){let N=await U();return k5.handleStandardInput(N,G,0),N}return k5.restartableHandleStandardInput(U,G,0,J)}}var xq$=L(()=>{bP0()});var fq$=()=>{};var bq$=L(()=>{o61();xP0()});var yq$=L(()=>{fP0()});var gq$=()=>{};var yP0=v((U5Z,hq$)=>{hq$.exports={DEFAULT_INITIAL_SIZE:8192,DEFAULT_INCREMENT_AMOUNT:8192,DEFAULT_FREQUENCY:1,DEFAULT_CHUNK_SIZE:1024}});var lq$=v((N5Z,cq$)=>{var uq$=J0("stream"),gP0=yP0(),fu4=J0("util"),bu4=cq$.exports=function($){var Z=this;$=$||{},uq$.Readable.call(this,$),this.stopped=!1;var X=$.hasOwnProperty("frequency")?$.frequency:gP0.DEFAULT_FREQUENCY,Q=$.chunkSize||gP0.DEFAULT_CHUNK_SIZE,Y=$.initialSize||gP0.DEFAULT_INITIAL_SIZE,G=$.incrementAmount||gP0.DEFAULT_INCREMENT_AMOUNT,J=0,K=new Buffer(Y),W=!1,H=function(){var N=Math.min(Q,J),B=!1;if(N>0){var O=null;O=new Buffer(N),K.copy(O,0,0,N),B=Z.push(O)!==!1,W=B,K.copy(K,0,N,J),J-=N}if(J===0&&Z.stopped)Z.push(null);if(B)H.timeout=setTimeout(H,X);else H.timeout=null};this.stop=function(){if(this.stopped)throw Error("stop() called on already stopped ReadableStreamBuffer");if(this.stopped=!0,J===0)this.push(null)},this.size=function(){return J},this.maxSize=function(){return K.length};var F=function(N){if(K.length-J<N){var B=Math.ceil((N-(K.length-J))/G),O=new Buffer(K.length+G*B);K.copy(O,0,0,J),K=O}},U=function(){if(!H.timeout&&W)H.timeout=setTimeout(H,X)};this.put=function(N,B){if(Z.stopped)throw Error("Tried to write data to a stopped ReadableStreamBuffer");if(Buffer.isBuffer(N))F(N.length),N.copy(K,J,0),J+=N.length;else{N=N+"";var O=Buffer.byteLength(N);F(O),K.write(N,J,B||"utf8"),J+=O}U()},this._read=function(){W=!0,U()}};fu4.inherits(bu4,uq$.Readable)});var pq$=v((B5Z,iq$)=>{var yu4=J0("util"),dq$=J0("stream"),mq$=yP0(),gu4=iq$.exports=function($){$=$||{},$.decodeStrings=!0,dq$.Writable.call(this,$);var Z=$.initialSize||mq$.DEFAULT_INITIAL_SIZE,X=$.incrementAmount||mq$.DEFAULT_INCREMENT_AMOUNT,Q=new Buffer(Z),Y=0;this.size=function(){return Y},this.maxSize=function(){return Q.length},this.getContents=function(J){if(!Y)return!1;var K=new Buffer(Math.min(J||Y,Y));if(Q.copy(K,0,0,K.length),K.length<Y)Q.copy(Q,0,K.length);return Y-=K.length,K},this.getContentsAsString=function(J,K){if(!Y)return!1;var W=Q.toString(J||"utf8",0,Math.min(K||Y,Y)),H=Buffer.byteLength(W);if(H<Y)Q.copy(Q,0,H);return Y-=H,W};var G=function(J){if(Q.length-Y<J){var K=Math.ceil((J-(Q.length-Y))/X),W=new Buffer(Q.length+X*K);Q.copy(W,0,0,Y),Q=W}};this._write=function(J,K,W){G(J.length),J.copy(Q,Y,0),Y+=J.length,W()}};yu4.inherits(gu4,dq$.Writable)});var nq$=v((O5Z,hP0)=>{hP0.exports=yP0();hP0.exports.ReadableStreamBuffer=lq$();hP0.exports.WritableStreamBuffer=pq$()});var oq$=v((L5Z,tq$)=>{tq$.exports=class{constructor(Z){if(!(Z>0)||(Z-1&Z)!==0)throw Error("Max size for a FixedFIFO should be a power of two");this.buffer=Array(Z),this.mask=Z-1,this.top=0,this.btm=0,this.next=null}clear(){this.top=this.btm=0,this.next=null,this.buffer.fill(void 0)}push(Z){if(this.buffer[this.top]!==void 0)return!1;return this.buffer[this.top]=Z,this.top=this.top+1&this.mask,!0}shift(){let Z=this.buffer[this.btm];if(Z===void 0)return;return this.buffer[this.btm]=void 0,this.btm=this.btm+1&this.mask,Z}peek(){return this.buffer[this.btm]}isEmpty(){return this.buffer[this.btm]===void 0}}});var U91=v((D5Z,aq$)=>{var rq$=oq$();aq$.exports=class{constructor(Z){this.hwm=Z||16,this.head=new rq$(this.hwm),this.tail=this.head,this.length=0}clear(){this.head=this.tail,this.head.clear(),this.length=0}push(Z){if(this.length++,!this.head.push(Z)){let X=this.head;this.head=X.next=new rq$(2*this.head.buffer.length),this.head.push(Z)}}shift(){if(this.length!==0)this.length--;let Z=this.tail.shift();if(Z===void 0&&this.tail.next){let X=this.tail.next;return this.tail.next=null,this.tail=X,this.tail.shift()}return Z}peek(){let Z=this.tail.peek();if(Z===void 0&&this.tail.next)return this.tail.next.peek();return Z}isEmpty(){return this.length===0}}});var xu=v((w5Z,sq$)=>{function hu4($){return Buffer.isBuffer($)||$ instanceof Uint8Array}function uu4($){return Buffer.isEncoding($)}function cu4($,Z,X){return Buffer.alloc($,Z,X)}function lu4($){return Buffer.allocUnsafe($)}function mu4($){return Buffer.allocUnsafeSlow($)}function du4($,Z){return Buffer.byteLength($,Z)}function iu4($,Z){return Buffer.compare($,Z)}function pu4($,Z){return Buffer.concat($,Z)}function nu4($,Z,X,Q,Y){return m6($).copy(Z,X,Q,Y)}function tu4($,Z){return m6($).equals(Z)}function ou4($,Z,X,Q,Y){return m6($).fill(Z,X,Q,Y)}function ru4($,Z,X){return Buffer.from($,Z,X)}function au4($,Z,X,Q){return m6($).includes(Z,X,Q)}function su4($,Z,X,Q){return m6($).indexOf(Z,X,Q)}function eu4($,Z,X,Q){return m6($).lastIndexOf(Z,X,Q)}function $c4($){return m6($).swap16()}function Zc4($){return m6($).swap32()}function Xc4($){return m6($).swap64()}function m6($){if(Buffer.isBuffer($))return $;return Buffer.from($.buffer,$.byteOffset,$.byteLength)}function Qc4($,Z,X,Q){return m6($).toString(Z,X,Q)}function Yc4($,Z,X,Q,Y){return m6($).write(Z,X,Q,Y)}function Gc4($,Z){return m6($).readDoubleBE(Z)}function Jc4($,Z){return m6($).readDoubleLE(Z)}function Kc4($,Z){return m6($).readFloatBE(Z)}function Wc4($,Z){return m6($).readFloatLE(Z)}function Hc4($,Z){return m6($).readInt32BE(Z)}function Fc4($,Z){return m6($).readInt32LE(Z)}function Uc4($,Z){return m6($).readUInt32BE(Z)}function Nc4($,Z){return m6($).readUInt32LE(Z)}function Bc4($,Z,X){return m6($).writeDoubleBE(Z,X)}function Oc4($,Z,X){return m6($).writeDoubleLE(Z,X)}function Lc4($,Z,X){return m6($).writeFloatBE(Z,X)}function Dc4($,Z,X){return m6($).writeFloatLE(Z,X)}function wc4($,Z,X){return m6($).writeInt32BE(Z,X)}function Ec4($,Z,X){return m6($).writeInt32LE(Z,X)}function jc4($,Z,X){return m6($).writeUInt32BE(Z,X)}function zc4($,Z,X){return m6($).writeUInt32LE(Z,X)}sq$.exports={isBuffer:hu4,isEncoding:uu4,alloc:cu4,allocUnsafe:lu4,allocUnsafeSlow:mu4,byteLength:du4,compare:iu4,concat:pu4,copy:nu4,equals:tu4,fill:ou4,from:ru4,includes:au4,indexOf:su4,lastIndexOf:eu4,swap16:$c4,swap32:Zc4,swap64:Xc4,toBuffer:m6,toString:Qc4,write:Yc4,readDoubleBE:Gc4,readDoubleLE:Jc4,readFloatBE:Kc4,readFloatLE:Wc4,readInt32BE:Hc4,readInt32LE:Fc4,readUInt32BE:Uc4,readUInt32LE:Nc4,writeDoubleBE:Bc4,writeDoubleLE:Oc4,writeFloatBE:Lc4,writeFloatLE:Dc4,writeInt32BE:wc4,writeInt32LE:Ec4,writeUInt32BE:jc4,writeUInt32LE:zc4}});var $M$=v((E5Z,eq$)=>{var Pc4=xu();eq$.exports=class{constructor(Z){this.encoding=Z}get remaining(){return 0}decode(Z){return Pc4.toString(Z,this.encoding)}flush(){return""}}});var YM$=v((j5Z,QM$)=>{var ZM$=xu();QM$.exports=class{constructor(){this._reset()}get remaining(){return this.bytesSeen}decode(Z){if(Z.byteLength===0)return"";if(this.bytesNeeded===0&&XM$(Z,0)===0)return this.bytesSeen=Ac4(Z),ZM$.toString(Z,"utf8");let X="",Q=0;if(this.bytesNeeded>0){while(Q<Z.byteLength){let J=Z[Q];if(J<this.lowerBoundary||J>this.upperBoundary){X+="\uFFFD",this._reset();break}if(this.lowerBoundary=128,this.upperBoundary=191,this.codePoint=this.codePoint<<6|J&63,this.bytesSeen++,Q++,this.bytesSeen===this.bytesNeeded){X+=String.fromCodePoint(this.codePoint),this._reset();break}}if(this.bytesNeeded>0)return X}let Y=XM$(Z,Q),G=Z.byteLength-Y;if(G>Q)X+=ZM$.toString(Z,"utf8",Q,G);for(let J=G;J<Z.byteLength;J++){let K=Z[J];if(this.bytesNeeded===0){if(K<=127)this.bytesSeen=0,X+=String.fromCharCode(K);else if(K>=194&&K<=223)this.bytesNeeded=2,this.bytesSeen=1,this.codePoint=K&31;else if(K>=224&&K<=239){if(K===224)this.lowerBoundary=160;else if(K===237)this.upperBoundary=159;this.bytesNeeded=3,this.bytesSeen=1,this.codePoint=K&15}else if(K>=240&&K<=244){if(K===240)this.lowerBoundary=144;else if(K===244)this.upperBoundary=143;this.bytesNeeded=4,this.bytesSeen=1,this.codePoint=K&7}else this.bytesSeen=1,X+="\uFFFD";continue}if(K<this.lowerBoundary||K>this.upperBoundary){X+="\uFFFD",J--,this._reset();continue}if(this.lowerBoundary=128,this.upperBoundary=191,this.codePoint=this.codePoint<<6|K&63,this.bytesSeen++,this.bytesSeen===this.bytesNeeded)X+=String.fromCodePoint(this.codePoint),this._reset()}return X}flush(){let Z=this.bytesNeeded>0?"\uFFFD":"";return this._reset(),Z}_reset(){this.codePoint=0,this.bytesNeeded=0,this.bytesSeen=0,this.lowerBoundary=128,this.upperBoundary=191}};function XM$($,Z){let X=$.byteLength;if(X<=Z)return 0;let Q=Math.max(Z,X-4),Y=X-1;while(Y>Q&&($[Y]&192)===128)Y--;if(Y<Z)return 0;let G=$[Y],J;if(G<=127)return 0;if(G>=194&&G<=223)J=2;else if(G>=224&&G<=239)J=3;else if(G>=240&&G<=244)J=4;else return 0;let K=X-Y;return K<J?K:0}function Ac4($){let Z=$.byteLength;if(Z===0)return 0;let X=$[Z-1];if(X<=127)return 0;if((X&192)!==128)return 1;let Q=Math.max(0,Z-4),Y=Z-2;while(Y>=Q&&($[Y]&192)===128)Y--;if(Y<0)return 1;let G=$[Y],J;if(G>=194&&G<=223)J=2;else if(G>=224&&G<=239)J=3;else if(G>=240&&G<=244)J=4;else return 1;if(Z-Y!==J)return 1;if(J>=3){let K=$[Y+1];if(G===224&&K<160)return 1;if(G===237&&K>159)return 1;if(G===240&&K<144)return 1;if(G===244&&K>143)return 1}return 0}});var JM$=v((z5Z,GM$)=>{var Tc4=$M$(),Rc4=YM$();GM$.exports=class{constructor(Z="utf8"){switch(this.encoding=Ic4(Z),this.encoding){case"utf8":this.decoder=new Rc4;break;case"utf16le":case"base64":throw Error("Unsupported encoding: "+this.encoding);default:this.decoder=new Tc4(this.encoding)}}get remaining(){return this.decoder.remaining}push(Z){if(typeof Z==="string")return Z;return this.decoder.decode(Z)}write(Z){return this.push(Z)}end(Z){let X="";if(Z)X=this.push(Z);return X+=this.decoder.flush(),X}};function Ic4($){switch($=$.toLowerCase(),$){case"utf8":case"utf-8":return"utf8";case"ucs2":case"ucs-2":case"utf16le":case"utf-16le":return"utf16le";case"latin1":case"binary":return"latin1";case"base64":case"ascii":case"hex":return $;default:throw Error("Unknown encoding: "+$)}}});var w91=v((P5Z,EM$)=>{var{EventEmitter:qc4}=J0("events"),cP0=Error("Stream was destroyed"),N91=Error("Premature close"),WM$=U91(),Mc4=JM$(),B91=typeof queueMicrotask>"u"?($)=>global.process.nextTick($):queueMicrotask,uP0=Symbol.asyncIterator||Symbol("asyncIterator");class O91{constructor($,{highWaterMark:Z=16384,map:X=null,mapWritable:Q,byteLength:Y,byteLengthWritable:G}={}){this.stream=$,this.queue=new WM$,this.highWaterMark=Z,this.buffered=0,this.error=null,this.pipeline=null,this.drains=null,this.byteLength=G||Y||wM$,this.map=Q||X,this.afterWrite=Sc4.bind(this),this.afterUpdateNextTick=vc4.bind(this)}get ending(){return(this.stream._duplexState&134217728)!==0}get ended(){return(this.stream._duplexState&8388608)!==0}push($){if((this.stream._duplexState&142606350)!==0)return!1;if(this.map!==null)$=this.map($);if(this.buffered+=this.byteLength($),this.queue.push($),this.buffered<this.highWaterMark)return this.stream._duplexState|=2097152,!0;return this.stream._duplexState|=6291456,!1}shift(){let $=this.queue.shift();if(this.buffered-=this.byteLength($),this.buffered===0)this.stream._duplexState&=534773759;return $}end($){if(typeof $==="function")this.stream.once("finish",$);else if($!==void 0&&$!==null)this.push($);this.stream._duplexState=(this.stream._duplexState|134217728)&535822335}autoBatch($,Z){let X=[],Q=this.stream;X.push($);while((Q._duplexState&270794767)===2359296)X.push(Q._writableState.shift());if((Q._duplexState&15)!==0)return Z(null);Q._writev(X,Z)}update(){let $=this.stream;$._duplexState|=524288;do{while(($._duplexState&270794767)===2097152){let Z=this.shift();$._duplexState|=67371008,$._write(Z,this.afterWrite)}if(($._duplexState&1310720)===0)this.updateNonPrimary()}while(this.continueUpdate()===!0);$._duplexState&=536346623}updateNonPrimary(){let $=this.stream;if(($._duplexState&144965647)===134217728){$._duplexState=$._duplexState|262144,$._final(kc4.bind(this));return}if(($._duplexState&14)===4){if(($._duplexState&33587200)===0)$._duplexState|=262160,$._destroy(NM$.bind(this));return}if(($._duplexState&33587215)===1)$._duplexState=($._duplexState|262160)&536870910,$._open(BM$.bind(this))}continueUpdate(){if((this.stream._duplexState&33554432)===0)return!1;return this.stream._duplexState&=503316479,!0}updateCallback(){if((this.stream._duplexState&35127311)===1048576)this.update();else this.updateNextTick()}updateNextTick(){if((this.stream._duplexState&33554432)!==0)return;if(this.stream._duplexState|=33554432,(this.stream._duplexState&524288)===0)B91(this.afterUpdateNextTick)}}class HM${constructor($,{highWaterMark:Z=16384,map:X=null,mapReadable:Q,byteLength:Y,byteLengthReadable:G}={}){this.stream=$,this.queue=new WM$,this.highWaterMark=Z===0?1:Z,this.buffered=0,this.readAhead=Z>0,this.error=null,this.pipeline=null,this.byteLength=G||Y||wM$,this.map=Q||X,this.pipeTo=null,this.afterRead=Cc4.bind(this),this.afterUpdateNextTick=_c4.bind(this)}get ending(){return(this.stream._duplexState&1024)!==0}get ended(){return(this.stream._duplexState&16384)!==0}pipe($,Z){if(this.pipeTo!==null)throw Error("Can only pipe to one destination");if(typeof Z!=="function")Z=null;if(this.stream._duplexState|=512,this.pipeTo=$,this.pipeline=new UM$(this.stream,$,Z),Z)this.stream.on("error",KM$);if(Ea($)){if($._writableState.pipeline=this.pipeline,Z)$.on("error",KM$);$.on("finish",this.pipeline.finished.bind(this.pipeline))}else{let X=this.pipeline.done.bind(this.pipeline,$),Q=this.pipeline.done.bind(this.pipeline,$,null);$.on("error",X),$.on("close",Q),$.on("finish",this.pipeline.finished.bind(this.pipeline))}$.on("drain",Vc4.bind(this)),this.stream.emit("piping",$),$.emit("pipe",this.stream)}push($){let Z=this.stream;if($===null)return this.highWaterMark=0,Z._duplexState=(Z._duplexState|1024)&536805311,!1;if(this.map!==null){if($=this.map($),$===null)return Z._duplexState&=536805375,this.buffered<this.highWaterMark}return this.buffered+=this.byteLength($),this.queue.push($),Z._duplexState=(Z._duplexState|128)&536805375,this.buffered<this.highWaterMark}shift(){let $=this.queue.shift();if(this.buffered-=this.byteLength($),this.buffered===0)this.stream._duplexState&=536862591;return $}unshift($){let Z=[this.map!==null?this.map($):$];while(this.buffered>0)Z.push(this.shift());for(let X=0;X<Z.length-1;X++){let Q=Z[X];this.buffered+=this.byteLength(Q),this.queue.push(Q)}this.push(Z[Z.length-1])}read(){let $=this.stream;if(($._duplexState&16527)===128){let Z=this.shift();if(this.pipeTo!==null&&this.pipeTo.write(Z)===!1)$._duplexState&=536870143;if(($._duplexState&2048)!==0)$.emit("data",Z);return Z}if(this.readAhead===!1)$._duplexState|=131072,this.updateNextTick();return null}drain(){let $=this.stream;while(($._duplexState&16527)===128&&($._duplexState&768)!==0){let Z=this.shift();if(this.pipeTo!==null&&this.pipeTo.write(Z)===!1)$._duplexState&=536870143;if(($._duplexState&2048)!==0)$.emit("data",Z)}}update(){let $=this.stream;$._duplexState|=32;do{this.drain();while(this.buffered<this.highWaterMark&&($._duplexState&214047)===131072)$._duplexState|=65552,$._read(this.afterRead),this.drain();if(($._duplexState&12431)===4224)$._duplexState|=8192,$.emit("readable");if(($._duplexState&80)===0)this.updateNonPrimary()}while(this.continueUpdate()===!0);$._duplexState&=536870879}updateNonPrimary(){let $=this.stream;if(($._duplexState&1167)===1024){if($._duplexState=($._duplexState|16384)&536869887,$.emit("end"),($._duplexState&8405006)===8404992)$._duplexState|=4;if(this.pipeTo!==null)this.pipeTo.end()}if(($._duplexState&14)===4){if(($._duplexState&33587200)===0)$._duplexState|=262160,$._destroy(NM$.bind(this));return}if(($._duplexState&33587215)===1)$._duplexState=($._duplexState|262160)&536870910,$._open(BM$.bind(this))}continueUpdate(){if((this.stream._duplexState&32768)===0)return!1;return this.stream._duplexState&=536838143,!0}updateCallback(){if((this.stream._duplexState&32879)===64)this.update();else this.updateNextTick()}updateNextTickIfOpen(){if((this.stream._duplexState&32769)!==0)return;if(this.stream._duplexState|=32768,(this.stream._duplexState&32)===0)B91(this.afterUpdateNextTick)}updateNextTick(){if((this.stream._duplexState&32768)!==0)return;if(this.stream._duplexState|=32768,(this.stream._duplexState&32)===0)B91(this.afterUpdateNextTick)}}class FM${constructor($){this.data=null,this.afterTransform=fc4.bind($),this.afterFinal=null}}class UM${constructor($,Z,X){this.from=$,this.to=Z,this.afterPipe=X,this.error=null,this.pipeToFinished=!1}finished(){this.pipeToFinished=!0}done($,Z){if(Z)this.error=Z;if($===this.to){if(this.to=null,this.from!==null){if((this.from._duplexState&16384)===0||!this.pipeToFinished)this.from.destroy(this.error||Error("Writable stream closed prematurely"));return}}if($===this.from){if(this.from=null,this.to!==null){if(($._duplexState&16384)===0)this.to.destroy(this.error||Error("Readable stream closed before ending"));return}}if(this.afterPipe!==null)this.afterPipe(this.error);this.to=this.from=this.afterPipe=null}}function Vc4(){this.stream._duplexState|=512,this.updateCallback()}function kc4($){let Z=this.stream;if($)Z.destroy($);if((Z._duplexState&14)===0)Z._duplexState|=8388608,Z.emit("finish");if((Z._duplexState&8405006)===8404992)Z._duplexState|=4;if(Z._duplexState&=402391039,(Z._duplexState&524288)===0)this.update();else this.updateNextTick()}function NM$($){let Z=this.stream;if(!$&&this.error!==cP0)$=this.error;if($)Z.emit("error",$);Z._duplexState|=8,Z.emit("close");let{_readableState:X,_writableState:Q}=Z;if(X!==null&&X.pipeline!==null)X.pipeline.done(Z,$);if(Q!==null){while(Q.drains!==null&&Q.drains.length>0)Q.drains.shift().resolve(!1);if(Q.pipeline!==null)Q.pipeline.done(Z,$)}}function Sc4($){let Z=this.stream;if($)Z.destroy($);if(Z._duplexState&=469499903,this.drains!==null)xc4(this.drains);if((Z._duplexState&6553615)===4194304){if(Z._duplexState&=532676607,(Z._duplexState&16777216)===16777216)Z.emit("drain")}this.updateCallback()}function Cc4($){if($)this.stream.destroy($);if(this.stream._duplexState&=536870895,this.readAhead===!1&&(this.stream._duplexState&256)===0)this.stream._duplexState&=536739839;this.updateCallback()}function _c4(){if((this.stream._duplexState&32)===0)this.stream._duplexState&=536838143,this.update()}function vc4(){if((this.stream._duplexState&524288)===0)this.stream._duplexState&=503316479,this.update()}function xc4($){for(let Z=0;Z<$.length;Z++)if(--$[Z].writes===0)$.shift().resolve(!0),Z--}function BM$($){let Z=this.stream;if($)Z.destroy($);if((Z._duplexState&4)===0){if((Z._duplexState&17423)===0)Z._duplexState|=64;if((Z._duplexState&142606351)===0)Z._duplexState|=1048576;Z.emit("open")}if(Z._duplexState&=536608751,Z._writableState!==null)Z._writableState.updateCallback();if(Z._readableState!==null)Z._readableState.updateCallback()}function fc4($,Z){if(Z!==void 0&&Z!==null)this.push(Z);this._writableState.afterWrite($)}function bc4($){if(this._readableState!==null){if($==="data")this._duplexState|=133376,this._readableState.updateNextTick();if($==="readable")this._duplexState|=4096,this._readableState.updateNextTick()}if(this._writableState!==null){if($==="drain")this._duplexState|=16777216,this._writableState.updateNextTick()}}class lP0 extends qc4{constructor($){super();if(this._duplexState=0,this._readableState=null,this._writableState=null,$){if($.open)this._open=$.open;if($.destroy)this._destroy=$.destroy;if($.predestroy)this._predestroy=$.predestroy;if($.signal)$.signal.addEventListener("abort",tc4.bind(this))}this.on("newListener",bc4)}_open($){$(null)}_destroy($){$(null)}_predestroy(){}get readable(){return this._readableState!==null?!0:void 0}get writable(){return this._writableState!==null?!0:void 0}get destroyed(){return(this._duplexState&8)!==0}get destroying(){return(this._duplexState&14)!==0}destroy($){if((this._duplexState&14)===0){if(!$)$=cP0;if(this._duplexState=(this._duplexState|4)&535822271,this._readableState!==null)this._readableState.highWaterMark=0,this._readableState.error=$;if(this._writableState!==null)this._writableState.highWaterMark=0,this._writableState.error=$;if(this._duplexState|=2,this._predestroy(),this._duplexState&=536870909,this._readableState!==null)this._readableState.updateNextTick();if(this._writableState!==null)this._writableState.updateNextTick()}}}class wa extends lP0{constructor($){super($);if(this._duplexState|=8519681,this._readableState=new HM$(this,$),$){if(this._readableState.readAhead===!1)this._duplexState&=536739839;if($.read)this._read=$.read;if($.eagerOpen)this._readableState.updateNextTick();if($.encoding)this.setEncoding($.encoding)}}setEncoding($){let Z=new Mc4($),X=this._readableState.map||hc4;return this._readableState.map=Q,this;function Q(Y){let G=Z.push(Y);return G===""&&(Y.byteLength!==0||Z.remaining>0)?null:X(G)}}_read($){$(null)}pipe($,Z){return this._readableState.updateNextTick(),this._readableState.pipe($,Z),$}read(){return this._readableState.updateNextTick(),this._readableState.read()}push($){return this._readableState.updateNextTickIfOpen(),this._readableState.push($)}unshift($){return this._readableState.updateNextTickIfOpen(),this._readableState.unshift($)}resume(){return this._duplexState|=131328,this._readableState.updateNextTick(),this}pause(){return this._duplexState&=this._readableState.readAhead===!1?536739583:536870655,this}static _fromAsyncIterator($,Z){let X,Q=new wa({...Z,read(G){$.next().then(Y).then(G.bind(null,null)).catch(G)},predestroy(){X=$.return()},destroy(G){if(!X)return G(null);X.then(G.bind(null,null)).catch(G)}});return Q;function Y(G){if(G.done)Q.push(null);else Q.push(G.value)}}static from($,Z){if(ic4($))return $;if($[uP0])return this._fromAsyncIterator($[uP0](),Z);if(!Array.isArray($))$=$===void 0?[]:[$];let X=0;return new wa({...Z,read(Q){this.push(X===$.length?null:$[X++]),Q(null)}})}static isBackpressured($){return($._duplexState&17422)!==0||$._readableState.buffered>=$._readableState.highWaterMark}static isPaused($){return($._duplexState&256)===0}[uP0](){let $=this,Z=null,X=null,Q=null;return this.on("error",(W)=>{Z=W}),this.on("readable",Y),this.on("close",G),{[uP0](){return this},next(){return new Promise(function(W,H){X=W,Q=H;let F=$.read();if(F!==null)J(F);else if(($._duplexState&8)!==0)J(null)})},return(){return K(null)},throw(W){return K(W)}};function Y(){if(X!==null)J($.read())}function G(){if(X!==null)J(null)}function J(W){if(Q===null)return;if(Z)Q(Z);else if(W===null&&($._duplexState&16384)===0)Q(cP0);else X({value:W,done:W===null});Q=X=null}function K(W){return $.destroy(W),new Promise((H,F)=>{if($._duplexState&8)return H({value:void 0,done:!0});$.once("close",function(){if(W)F(W);else H({value:void 0,done:!0})})})}}}class L91 extends lP0{constructor($){super($);if(this._duplexState|=16385,this._writableState=new O91(this,$),$){if($.writev)this._writev=$.writev;if($.write)this._write=$.write;if($.final)this._final=$.final;if($.eagerOpen)this._writableState.updateNextTick()}}cork(){this._duplexState|=268435456}uncork(){this._duplexState&=268435455,this._writableState.updateNextTick()}_writev($,Z){Z(null)}_write($,Z){this._writableState.autoBatch($,Z)}_final($){$(null)}static isBackpressured($){return($._duplexState&146800654)!==0}static drained($){if($.destroyed)return Promise.resolve(!1);let Z=$._writableState,Q=(oc4($)?Math.min(1,Z.queue.length):Z.queue.length)+($._duplexState&67108864?1:0);if(Q===0)return Promise.resolve(!0);if(Z.drains===null)Z.drains=[];return new Promise((Y)=>{Z.drains.push({writes:Q,resolve:Y})})}write($){return this._writableState.updateNextTick(),this._writableState.push($)}end($){return this._writableState.updateNextTick(),this._writableState.end($),this}}class mP0 extends wa{constructor($){super($);if(this._duplexState=1|this._duplexState&131072,this._writableState=new O91(this,$),$){if($.writev)this._writev=$.writev;if($.write)this._write=$.write;if($.final)this._final=$.final}}cork(){this._duplexState|=268435456}uncork(){this._duplexState&=268435455,this._writableState.updateNextTick()}_writev($,Z){Z(null)}_write($,Z){this._writableState.autoBatch($,Z)}_final($){$(null)}write($){return this._writableState.updateNextTick(),this._writableState.push($)}end($){return this._writableState.updateNextTick(),this._writableState.end($),this}}class D91 extends mP0{constructor($){super($);if(this._transformState=new FM$(this),$){if($.transform)this._transform=$.transform;if($.flush)this._flush=$.flush}}_write($,Z){if(this._readableState.buffered>=this._readableState.highWaterMark)this._transformState.data=$;else this._transform($,this._transformState.afterTransform)}_read($){if(this._transformState.data!==null){let Z=this._transformState.data;this._transformState.data=null,$(null),this._transform(Z,this._transformState.afterTransform)}else $(null)}destroy($){if(super.destroy($),this._transformState.data!==null)this._transformState.data=null,this._transformState.afterTransform()}_transform($,Z){Z(null,$)}_flush($){$(null)}_final($){this._transformState.afterFinal=$,this._flush(yc4.bind(this))}}class OM$ extends D91{}function yc4($,Z){let X=this._transformState.afterFinal;if($)return X($);if(Z!==null&&Z!==void 0)this.push(Z);this.push(null),X(null)}function gc4(...$){return new Promise((Z,X)=>{return LM$(...$,(Q)=>{if(Q)return X(Q);Z()})})}function LM$($,...Z){let X=Array.isArray($)?[...$,...Z]:[$,...Z],Q=X.length&&typeof X[X.length-1]==="function"?X.pop():null;if(X.length<2)throw Error("Pipeline requires at least 2 streams");let Y=X[0],G=null,J=null;for(let H=1;H<X.length;H++){if(G=X[H],Ea(Y))Y.pipe(G,W);else K(Y,!0,H>1,W),Y.pipe(G);Y=G}if(Q){let H=!1,F=Ea(G)||!!(G._writableState&&G._writableState.autoDestroy);if(G.on("error",(U)=>{if(J===null)J=U}),G.on("finish",()=>{if(H=!0,!F)Q(J)}),F)G.on("close",()=>Q(J||(H?null:N91)))}return G;function K(H,F,U,N){H.on("error",N),H.on("close",B);function B(){if(F&&H._readableState&&!H._readableState.ended)return N(N91);if(U&&H._writableState&&!H._writableState.ended)return N(N91)}}function W(H){if(!H||J)return;J=H;for(let F of X)F.destroy(H)}}function hc4($){return $}function DM$($){return!!$._readableState||!!$._writableState}function Ea($){return typeof $._duplexState==="number"&&DM$($)}function uc4($){return!!$._readableState&&$._readableState.ending}function cc4($){return!!$._readableState&&$._readableState.ended}function lc4($){return!!$._writableState&&$._writableState.ending}function mc4($){return!!$._writableState&&$._writableState.ended}function dc4($,Z={}){let X=$._readableState&&$._readableState.error||$._writableState&&$._writableState.error;return!Z.all&&X===cP0?null:X}function ic4($){return Ea($)&&$.readable}function pc4($){return($._duplexState&1)!==1||($._duplexState&4)===4||($._duplexState&33587200)!==0}function nc4($){return typeof $==="object"&&$!==null&&typeof $.byteLength==="number"}function wM$($){return nc4($)?$.byteLength:1024}function KM$(){}function tc4(){this.destroy(Error("Stream aborted."))}function oc4($){return $._writev!==L91.prototype._writev&&$._writev!==mP0.prototype._writev}EM$.exports={pipeline:LM$,pipelinePromise:gc4,isStream:DM$,isStreamx:Ea,isEnding:uc4,isEnded:cc4,isFinishing:lc4,isFinished:mc4,isDisturbed:pc4,getStreamError:dc4,Stream:lP0,Writable:L91,Readable:wa,Duplex:mP0,Transform:D91,PassThrough:OM$}});var j91=v((Kl4)=>{var l4=xu(),jM$=l4.from([117,115,116,97,114,0]),rc4=l4.from([48,48]),ac4=l4.from([117,115,116,97,114,32]),sc4=l4.from([32,0]);Kl4.decodeLongPath=function(Z,X){return fu(Z,0,Z.length,X)};Kl4.encodePax=function(Z){let X="";if(Z.name)X+=E91(" path="+Z.name+`
 `);if(Z.linkname)X+=E91(" linkpath="+Z.linkname+`
 `);let Q=Z.pax;if(Q)for(let Y in Q)X+=E91(" "+Y+"="+Q[Y]+`
-`);return l4.from(X)};Kl4.decodePax=function(Z){let X={};while(Z.length){let Q=0;while(Q<Z.length&&Z[Q]!==32)Q++;let Y=parseInt(l4.toString(Z.subarray(0,Q)),10);if(!Y)return X;let G=l4.toString(Z.subarray(Q+1,Y-1)),J=G.indexOf("=");if(J===-1)return X;X[G.slice(0,J)]=G.slice(J+1),Z=Z.subarray(Y)}return X};Kl4.encode=function(Z){let X=l4.alloc(512),Q=Z.name,Y="";if(Z.typeflag===5&&Q[Q.length-1]!=="/")Q+="/";if(l4.byteLength(Q)!==Q.length)return null;while(l4.byteLength(Q)>100){let G=Q.indexOf("/");if(G===-1)return null;Y+=Y?"/"+Q.slice(0,G):Q.slice(0,G),Q=Q.slice(G+1)}if(l4.byteLength(Q)>100||l4.byteLength(Y)>155)return null;if(Z.linkname&&l4.byteLength(Z.linkname)>100)return null;if(l4.write(X,Q),l4.write(X,AD(Z.mode&4095,6),100),l4.write(X,AD(Z.uid,6),108),l4.write(X,AD(Z.gid,6),116),Gl4(Z.size,X,124),l4.write(X,AD(Z.mtime.getTime()/1000|0,11),136),X[156]=48+Ql4(Z.type),Z.linkname)l4.write(X,Z.linkname,157);if(l4.copy(jM$,X,257),l4.copy(rc4,X,263),Z.uname)l4.write(X,Z.uname,265);if(Z.gname)l4.write(X,Z.gname,297);if(l4.write(X,AD(Z.devmajor||0,6),329),l4.write(X,AD(Z.devminor||0,6),337),Y)l4.write(X,Y,345);return l4.write(X,AD(PM$(X),6),148),X};Kl4.decode=function(Z,X,Q){let Y=Z[156]===0?0:Z[156]-48,G=fu(Z,0,100,X),J=PD(Z,100,8),K=PD(Z,108,8),W=PD(Z,116,8),H=PD(Z,124,12),F=PD(Z,136,12),U=Xl4(Y),N=Z[157]===0?null:fu(Z,157,100,X),B=fu(Z,265,32),O=fu(Z,297,32),D=PD(Z,329,8),w=PD(Z,337,8),E=PM$(Z);if(E===256)return null;if(E!==PD(Z,148,8))throw Error("Invalid tar header. Maybe the tar is corrupted or it needs to be gunzipped?");if(ec4(Z)){if(Z[345])G=fu(Z,345,155,X)+"/"+G}else if($l4(Z));else if(!Q)throw Error("Invalid tar header: unknown format.");if(Y===0&&G&&G[G.length-1]==="/")Y=5;return{name:G,mode:J,uid:K,gid:W,size:H,mtime:new Date(1000*F),type:U,linkname:N,uname:B,gname:O,devmajor:D,devminor:w,pax:null}};function ec4($){return l4.equals(jM$,$.subarray(257,263))}function $l4($){return l4.equals(ac4,$.subarray(257,263))&&l4.equals(sc4,$.subarray(263,265))}function Zl4($,Z,X){if(typeof $!=="number")return X;if($=~~$,$>=Z)return Z;if($>=0)return $;if($+=Z,$>=0)return $;return 0}function Xl4($){switch($){case 0:return"file";case 1:return"link";case 2:return"symlink";case 3:return"character-device";case 4:return"block-device";case 5:return"directory";case 6:return"fifo";case 7:return"contiguous-file";case 72:return"pax-header";case 55:return"pax-global-header";case 27:return"gnu-long-link-path";case 28:case 30:return"gnu-long-path"}return null}function Ql4($){switch($){case"file":return 0;case"link":return 1;case"symlink":return 2;case"character-device":return 3;case"block-device":return 4;case"directory":return 5;case"fifo":return 6;case"contiguous-file":return 7;case"pax-header":return 72}return 0}function zM$($,Z,X,Q){for(;X<Q;X++)if($[X]===Z)return X;return Q}function PM$($){let Z=256;for(let X=0;X<148;X++)Z+=$[X];for(let X=156;X<512;X++)Z+=$[X];return Z}function AD($,Z){if($=$.toString(8),$.length>Z)return"7777777777777777777".slice(0,Z)+" ";return"0000000000000000000".slice(0,Z-$.length)+$+" "}function Yl4($,Z,X){Z[X]=128;for(let Q=11;Q>0;Q--)Z[X+Q]=$&255,$=Math.floor($/256)}function Gl4($,Z,X){if($.toString(8).length>11)Yl4($,Z,X);else l4.write(Z,AD($,11),X)}function Jl4($){let Z;if($[0]===128)Z=!0;else if($[0]===255)Z=!1;else return null;let X=[],Q;for(Q=$.length-1;Q>0;Q--){let J=$[Q];if(Z)X.push(J);else X.push(255-J)}let Y=0,G=X.length;for(Q=0;Q<G;Q++)Y+=X[Q]*Math.pow(256,Q);return Z?Y:-1*Y}function PD($,Z,X){if($=$.subarray(Z,Z+X),Z=0,$[Z]&128)return Jl4($);else{while(Z<$.length&&$[Z]===32)Z++;let Q=Zl4(zM$($,32,Z,$.length),$.length,$.length);while(Z<Q&&$[Z]===0)Z++;if(Q===Z)return 0;return parseInt(l4.toString($.subarray(Z,Q)),8)}}function fu($,Z,X,Q){return l4.toString($.subarray(Z,zM$($,0,Z,Z+X)),Q)}function E91($){let Z=l4.byteLength($),X=Math.floor(Math.log(Z)/Math.log(10))+1;if(Z+X>=Math.pow(10,X))X++;return Z+X+$}});var kM$=v((T5Z,VM$)=>{var{Writable:Bl4,Readable:Ol4,getStreamError:AM$}=w91(),Ll4=U91(),TM$=xu(),bu=j91(),Dl4=TM$.alloc(0);class RM${constructor(){this.buffered=0,this.shifted=0,this.queue=new Ll4,this._offset=0}push($){this.buffered+=$.byteLength,this.queue.push($)}shiftFirst($){return this._buffered===0?null:this._next($)}shift($){if($>this.buffered)return null;if($===0)return Dl4;let Z=this._next($);if($===Z.byteLength)return Z;let X=[Z];while(($-=Z.byteLength)>0)Z=this._next($),X.push(Z);return TM$.concat(X)}_next($){let Z=this.queue.peek(),X=Z.byteLength-this._offset;if($>=X){let Q=this._offset?Z.subarray(this._offset,Z.byteLength):Z;return this.queue.shift(),this._offset=0,this.buffered-=X,this.shifted+=X,Q}return this.buffered-=$,this.shifted+=$,Z.subarray(this._offset,this._offset+=$)}}class IM$ extends Ol4{constructor($,Z,X){super();this.header=Z,this.offset=X,this._parent=$}_read($){if(this.header.size===0)this.push(null);if(this._parent._stream===this)this._parent._update();$(null)}_predestroy(){this._parent.destroy(AM$(this))}_detach(){if(this._parent._stream===this)this._parent._stream=null,this._parent._missing=MM$(this.header.size),this._parent._update()}_destroy($){this._detach(),$(null)}}class qM$ extends Bl4{constructor($){super($);if(!$)$={};this._buffer=new RM$,this._offset=0,this._header=null,this._stream=null,this._missing=0,this._longHeader=!1,this._callback=z91,this._locked=!1,this._finished=!1,this._pax=null,this._paxGlobal=null,this._gnuLongPath=null,this._gnuLongLinkPath=null,this._filenameEncoding=$.filenameEncoding||"utf-8",this._allowUnknownFormat=!!$.allowUnknownFormat,this._unlockBound=this._unlock.bind(this)}_unlock($){if(this._locked=!1,$){this.destroy($),this._continueWrite($);return}this._update()}_consumeHeader(){if(this._locked)return!1;this._offset=this._buffer.shifted;try{this._header=bu.decode(this._buffer.shift(512),this._filenameEncoding,this._allowUnknownFormat)}catch($){return this._continueWrite($),!1}if(!this._header)return!0;switch(this._header.type){case"gnu-long-path":case"gnu-long-link-path":case"pax-global-header":case"pax-header":return this._longHeader=!0,this._missing=this._header.size,!0}if(this._locked=!0,this._applyLongHeaders(),this._header.size===0||this._header.type==="directory")return this.emit("entry",this._header,this._createStream(),this._unlockBound),!0;return this._stream=this._createStream(),this._missing=this._header.size,this.emit("entry",this._header,this._stream,this._unlockBound),!0}_applyLongHeaders(){if(this._gnuLongPath)this._header.name=this._gnuLongPath,this._gnuLongPath=null;if(this._gnuLongLinkPath)this._header.linkname=this._gnuLongLinkPath,this._gnuLongLinkPath=null;if(this._pax){if(this._pax.path)this._header.name=this._pax.path;if(this._pax.linkpath)this._header.linkname=this._pax.linkpath;if(this._pax.size)this._header.size=parseInt(this._pax.size,10);this._header.pax=this._pax,this._pax=null}}_decodeLongHeader($){switch(this._header.type){case"gnu-long-path":this._gnuLongPath=bu.decodeLongPath($,this._filenameEncoding);break;case"gnu-long-link-path":this._gnuLongLinkPath=bu.decodeLongPath($,this._filenameEncoding);break;case"pax-global-header":this._paxGlobal=bu.decodePax($);break;case"pax-header":this._pax=this._paxGlobal===null?bu.decodePax($):Object.assign({},this._paxGlobal,bu.decodePax($));break}}_consumeLongHeader(){this._longHeader=!1,this._missing=MM$(this._header.size);let $=this._buffer.shift(this._header.size);try{this._decodeLongHeader($)}catch(Z){return this._continueWrite(Z),!1}return!0}_consumeStream(){let $=this._buffer.shiftFirst(this._missing);if($===null)return!1;this._missing-=$.byteLength;let Z=this._stream.push($);if(this._missing===0){if(this._stream.push(null),Z)this._stream._detach();return Z&&this._locked===!1}return Z}_createStream(){return new IM$(this,this._header,this._offset)}_update(){while(this._buffer.buffered>0&&!this.destroying){if(this._missing>0){if(this._stream!==null){if(this._consumeStream()===!1)return;continue}if(this._longHeader===!0){if(this._missing>this._buffer.buffered)break;if(this._consumeLongHeader()===!1)return!1;continue}let $=this._buffer.shiftFirst(this._missing);if($!==null)this._missing-=$.byteLength;continue}if(this._buffer.buffered<512)break;if(this._stream!==null||this._consumeHeader()===!1)return}this._continueWrite(null)}_continueWrite($){let Z=this._callback;this._callback=z91,Z($)}_write($,Z){this._callback=Z,this._buffer.push($),this._update()}_final($){this._finished=this._missing===0&&this._buffer.buffered===0,$(this._finished?null:Error("Unexpected end of data"))}_predestroy(){this._continueWrite(null)}_destroy($){if(this._stream)this._stream.destroy(AM$(this));$(null)}[Symbol.asyncIterator](){let $=null,Z=null,X=null,Q=null,Y=null,G=this;return this.on("entry",W),this.on("error",(U)=>{$=U}),this.on("close",H),{[Symbol.asyncIterator](){return this},next(){return new Promise(K)},return(){return F(null)},throw(U){return F(U)}};function J(U){if(!Y)return;let N=Y;Y=null,N(U)}function K(U,N){if($)return N($);if(Q){U({value:Q,done:!1}),Q=null;return}if(Z=U,X=N,J(null),G._finished&&Z)Z({value:void 0,done:!0}),Z=X=null}function W(U,N,B){if(Y=B,N.on("error",z91),Z)Z({value:N,done:!1}),Z=X=null;else Q=N}function H(){if(J($),!Z)return;if($)X($);else Z({value:void 0,done:!0});Z=X=null}function F(U){return G.destroy(U),J(U),new Promise((N,B)=>{if(G.destroyed)return N({value:void 0,done:!0});G.once("close",function(){if(U)B(U);else N({value:void 0,done:!0})})})}}}VM$.exports=function(Z){return new qM$(Z)};function z91(){}function MM$($){return $&=511,$&&512-$}});var CM$=v((R5Z,P91)=>{var SM$={S_IFMT:61440,S_IFDIR:16384,S_IFCHR:8192,S_IFBLK:24576,S_IFIFO:4096,S_IFLNK:40960};try{P91.exports=J0("fs").constants||SM$}catch{P91.exports=SM$}});var gM$=v((I5Z,yM$)=>{var{Readable:wl4,Writable:El4,getStreamError:_M$}=w91(),Ev=xu(),yu=CM$(),dP0=j91(),vM$=Ev.alloc(1024);class xM$ extends El4{constructor($,Z,X){super({mapWritable:zl4,eagerOpen:!0});if(this.written=0,this.header=Z,this._callback=X,this._linkname=null,this._isLinkname=Z.type==="symlink"&&!Z.linkname,this._isVoid=Z.type!=="file"&&Z.type!=="contiguous-file",this._finished=!1,this._pack=$,this._openCallback=null,this._pack._stream===null)this._pack._stream=this;else this._pack._pending.push(this)}_open($){if(this._openCallback=$,this._pack._stream===this)this._continueOpen()}_continuePack($){if(this._callback===null)return;let Z=this._callback;this._callback=null,Z($)}_continueOpen(){if(this._pack._stream===null)this._pack._stream=this;let $=this._openCallback;if(this._openCallback=null,$===null)return;if(this._pack.destroying)return $(Error("pack stream destroyed"));if(this._pack._finalized)return $(Error("pack stream is already finalized"));if(this._pack._stream=this,!this._isLinkname)this._pack._encode(this.header);if(this._isVoid)this._finish(),this._continuePack(null);$(null)}_write($,Z){if(this._isLinkname)return this._linkname=this._linkname?Ev.concat([this._linkname,$]):$,Z(null);if(this._isVoid){if($.byteLength>0)return Z(Error("No body allowed for this entry"));return Z()}if(this.written+=$.byteLength,this._pack.push($))return Z();this._pack._drain=Z}_finish(){if(this._finished)return;if(this._finished=!0,this._isLinkname)this.header.linkname=this._linkname?Ev.toString(this._linkname,"utf-8"):"",this._pack._encode(this.header);bM$(this._pack,this.header.size),this._pack._done(this)}_final($){if(this.written!==this.header.size)return $(Error("Size mismatch"));this._finish(),$(null)}_getError(){return _M$(this)||Error("tar entry destroyed")}_predestroy(){this._pack.destroy(this._getError())}_destroy($){this._pack._done(this),this._continuePack(this._finished?null:this._getError()),$()}}class fM$ extends wl4{constructor($){super($);this._drain=A91,this._finalized=!1,this._finalizing=!1,this._pending=[],this._stream=null}entry($,Z,X){if(this._finalized||this.destroying)throw Error("already finalized or destroyed");if(typeof Z==="function")X=Z,Z=null;if(!X)X=A91;if(!$.size||$.type==="symlink")$.size=0;if(!$.type)$.type=jl4($.mode);if(!$.mode)$.mode=$.type==="directory"?493:420;if(!$.uid)$.uid=0;if(!$.gid)$.gid=0;if(!$.mtime)$.mtime=new Date;if(typeof Z==="string")Z=Ev.from(Z);let Q=new xM$(this,$,X);if(Ev.isBuffer(Z))return $.size=Z.byteLength,Q.write(Z),Q.end(),Q;if(Q._isVoid)return Q;return Q}finalize(){if(this._stream||this._pending.length>0){this._finalizing=!0;return}if(this._finalized)return;this._finalized=!0,this.push(vM$),this.push(null)}_done($){if($!==this._stream)return;if(this._stream=null,this._finalizing)this.finalize();if(this._pending.length)this._pending.shift()._continueOpen()}_encode($){if(!$.pax){let Z=dP0.encode($);if(Z){this.push(Z);return}}this._encodePax($)}_encodePax($){let Z=dP0.encodePax({name:$.name,linkname:$.linkname,pax:$.pax}),X={name:"PaxHeader",mode:$.mode,uid:$.uid,gid:$.gid,size:Z.byteLength,mtime:$.mtime,type:"pax-header",linkname:$.linkname&&"PaxHeader",uname:$.uname,gname:$.gname,devmajor:$.devmajor,devminor:$.devminor};this.push(dP0.encode(X)),this.push(Z),bM$(this,Z.byteLength),X.size=$.size,X.type=$.type,this.push(dP0.encode(X))}_doDrain(){let $=this._drain;this._drain=A91,$()}_predestroy(){let $=_M$(this);if(this._stream)this._stream.destroy($);while(this._pending.length){let Z=this._pending.shift();Z.destroy($),Z._continueOpen()}this._doDrain()}_read($){this._doDrain(),$()}}yM$.exports=function(Z){return new fM$(Z)};function jl4($){switch($&yu.S_IFMT){case yu.S_IFBLK:return"block-device";case yu.S_IFCHR:return"character-device";case yu.S_IFDIR:return"directory";case yu.S_IFIFO:return"fifo";case yu.S_IFLNK:return"symlink"}return"file"}function A91(){}function bM$($,Z){if(Z&=511,Z)$.push(vM$.subarray(0,512-Z))}function zl4($){return Ev.isBuffer($)?$:Ev.from($)}});var hM$=v((Pl4)=>{Pl4.extract=kM$();Pl4.pack=gM$()});var lM$=v((M5Z,cM$)=>{cM$.exports=uM$;function uM$($,Z){if($&&Z)return uM$($)(Z);if(typeof $!=="function")throw TypeError("need wrapper function");return Object.keys($).forEach(function(Q){X[Q]=$[Q]}),X;function X(){var Q=Array(arguments.length);for(var Y=0;Y<Q.length;Y++)Q[Y]=arguments[Y];var G=$.apply(this,Q),J=Q[Q.length-1];if(typeof G==="function"&&G!==J)Object.keys(J).forEach(function(K){G[K]=J[K]});return G}}});var R91=v((V5Z,T91)=>{var mM$=lM$();T91.exports=mM$(iP0);T91.exports.strict=mM$(dM$);iP0.proto=iP0(function(){Object.defineProperty(Function.prototype,"once",{value:function(){return iP0(this)},configurable:!0}),Object.defineProperty(Function.prototype,"onceStrict",{value:function(){return dM$(this)},configurable:!0})});function iP0($){var Z=function(){if(Z.called)return Z.value;return Z.called=!0,Z.value=$.apply(this,arguments)};return Z.called=!1,Z}function dM$($){var Z=function(){if(Z.called)throw Error(Z.onceError);return Z.called=!0,Z.value=$.apply(this,arguments)},X=$.name||"Function wrapped with `once`";return Z.onceError=X+" shouldn't be called more than once",Z.called=!1,Z}});var nM$=v((k5Z,pM$)=>{var Rl4=R91(),Il4=function(){},ql4=global.Bare?queueMicrotask:process.nextTick.bind(process),Ml4=function($){return $.setHeader&&typeof $.abort==="function"},Vl4=function($){return $.stdio&&Array.isArray($.stdio)&&$.stdio.length===3},iM$=function($,Z,X){if(typeof Z==="function")return iM$($,null,Z);if(!Z)Z={};X=Rl4(X||Il4);var{_writableState:Q,_readableState:Y}=$,G=Z.readable||Z.readable!==!1&&$.readable,J=Z.writable||Z.writable!==!1&&$.writable,K=!1,W=function(){if(!$.writable)H()},H=function(){if(J=!1,!G)X.call($)},F=function(){if(G=!1,!J)X.call($)},U=function(w){X.call($,w?Error("exited with error code: "+w):null)},N=function(w){X.call($,w)},B=function(){ql4(O)},O=function(){if(K)return;if(G&&!(Y&&(Y.ended&&!Y.destroyed)))return X.call($,Error("premature close"));if(J&&!(Q&&(Q.ended&&!Q.destroyed)))return X.call($,Error("premature close"))},D=function(){$.req.on("finish",H)};if(Ml4($))if($.on("complete",H),$.on("abort",B),$.req)D();else $.on("request",D);else if(J&&!Q)$.on("end",W),$.on("close",W);if(Vl4($))$.on("exit",U);if($.on("end",F),$.on("finish",H),Z.error!==!1)$.on("error",N);return $.on("close",B),function(){if(K=!0,$.removeListener("complete",H),$.removeListener("abort",B),$.removeListener("request",D),$.req)$.req.removeListener("finish",H);$.removeListener("end",W),$.removeListener("close",W),$.removeListener("finish",H),$.removeListener("exit",U),$.removeListener("end",F),$.removeListener("error",N),$.removeListener("close",B)}};pM$.exports=iM$});var rM$=v((S5Z,oM$)=>{var kl4=R91(),Sl4=nM$(),pP0;try{pP0=J0("fs")}catch($){}var ja=function(){},Cl4=typeof process>"u"?!1:/^v?\.0/.test(process.version),nP0=function($){return typeof $==="function"},_l4=function($){if(!Cl4)return!1;if(!pP0)return!1;return($ instanceof(pP0.ReadStream||ja)||$ instanceof(pP0.WriteStream||ja))&&nP0($.close)},vl4=function($){return $.setHeader&&nP0($.abort)},xl4=function($,Z,X,Q){Q=kl4(Q);var Y=!1;$.on("close",function(){Y=!0}),Sl4($,{readable:Z,writable:X},function(J){if(J)return Q(J);Y=!0,Q()});var G=!1;return function(J){if(Y)return;if(G)return;if(G=!0,_l4($))return $.close(ja);if(vl4($))return $.abort();if(nP0($.destroy))return $.destroy();Q(J||Error("stream was destroyed"))}},tM$=function($){$()},fl4=function($,Z){return $.pipe(Z)},bl4=function(){var $=Array.prototype.slice.call(arguments),Z=nP0($[$.length-1]||ja)&&$.pop()||ja;if(Array.isArray($[0]))$=$[0];if($.length<2)throw Error("pump requires two streams per minimum");var X,Q=$.map(function(Y,G){var J=G<$.length-1,K=G>0;return xl4(Y,J,K,function(W){if(!X)X=W;if(W)Q.forEach(tM$);if(J)return;Q.forEach(tM$),Z(X)})});return $.reduce(fl4)};oM$.exports=bl4});var GV$=v((ul4)=>{var aM$=hM$(),sM$=rM$(),eM$=J0("fs"),z9=J0("path"),za=(global.Bare?global.Bare.platform:process.platform)==="win32";ul4.pack=function(Z,X){if(!Z)Z=".";if(!X)X={};let Q=X.fs||eM$,Y=X.ignore||X.filter||Pa,G=X.mapStream||QV$,J=hl4(Q,X.dereference?Q.stat:Q.lstat,Z,Y,X.entries,X.sort),K=X.strict!==!1,W=typeof X.umask==="number"?~X.umask:~$V$(),H=X.pack||aM$.pack(),F=X.finish||Pa,U=X.map||Pa,N=typeof X.dmode==="number"?X.dmode:0,B=typeof X.fmode==="number"?X.fmode:0;if(X.strip)U=YV$(U,X.strip);if(X.readable)N|=parseInt(555,8),B|=parseInt(444,8);if(X.writable)N|=parseInt(333,8),B|=parseInt(222,8);w();function O(E,j){Q.readlink(z9.join(Z,E),function(z,P){if(z)return H.destroy(z);j.linkname=I91(P),H.entry(j,w)})}function D(E,j,z){if(H.destroyed)return;if(E)return H.destroy(E);if(!j){if(X.finalize!==!1)H.finalize();return F(H)}if(z.isSocket())return w();let P={name:I91(j),mode:(z.mode|(z.isDirectory()?N:B))&W,mtime:z.mtime,size:z.size,type:"file",uid:z.uid,gid:z.gid};if(z.isDirectory())return P.size=0,P.type="directory",P=U(P)||P,H.entry(P,w);if(z.isSymbolicLink())return P.size=0,P.type="symlink",P=U(P)||P,O(j,P);if(P=U(P)||P,!z.isFile()){if(K)return H.destroy(Error("unsupported type for "+j));return w()}let A=H.entry(P,w),I=G(Q.createReadStream(z9.join(Z,j),{start:0,end:P.size>0?P.size-1:P.size}),P);I.on("error",function(V){A.destroy(V)}),sM$(I,A)}function w(E){if(E)return H.destroy(E);J(D)}return H};function yl4($){return $.length?$[$.length-1]:null}function gl4(){return!global.Bare&&process.getuid?process.getuid():-1}function $V$(){return!global.Bare&&process.umask?process.umask():0}ul4.extract=function(Z,X){if(!Z)Z=".";if(!X)X={};Z=z9.resolve(Z);let Q=X.fs||eM$,Y=X.ignore||X.filter||Pa,G=X.mapStream||QV$,J=X.chown!==!1&&!za&&gl4()===0,K=X.extract||aM$.extract(),W=[],H=new Date,F=typeof X.umask==="number"?~X.umask:~$V$(),U=X.strict!==!1,N=X.validateSymlinks!==!1,B=X.map||Pa,O=typeof X.dmode==="number"?X.dmode:0,D=typeof X.fmode==="number"?X.fmode:0;if(X.strip)B=YV$(B,X.strip);if(X.readable)O|=parseInt(555,8),D|=parseInt(444,8);if(X.writable)O|=parseInt(333,8),D|=parseInt(222,8);if(K.on("entry",w),X.finish)K.on("finish",X.finish);return K;function w(A,I,V){A=B(A)||A,A.name=I91(A.name);let q=z9.join(Z,z9.join("/",A.name));if(Y(q,A))return I.resume(),V();let S=z9.join(q,".")===z9.join(Z,".")?Z:z9.dirname(q);XV$(Q,S,z9.join(Z,"."),function(p,Q0){if(p)return V(p);if(!Q0)return V(Error(S+" is not a valid path"));if(A.type==="directory")return W.push([q,A.mtime]),P(q,{fs:Q,own:J,uid:A.uid,gid:A.gid,mode:A.mode},d);P(S,{fs:Q,own:J,uid:A.uid,gid:A.gid,mode:493},function(L0){if(L0)return V(L0);switch(A.type){case"file":return y();case"link":return b();case"symlink":return f()}if(U)return V(Error("unsupported type for "+q+" ("+A.type+")"));I.resume(),V()})});function d(p){if(p)return V(p);j(q,A,function(Q0){if(Q0)return V(Q0);if(za)return V();z(q,A,V)})}function f(){if(za)return V();Q.unlink(q,function(){let p=z9.resolve(z9.dirname(q),A.linkname);if(!l(p)&&N)return V(Error(q+" is not a valid symlink"));ZV$(Q,p,z9.join(Z,"."),function(Q0,L0){if(Q0)return V(Q0);if(!L0&&N)return V(Error(q+" is not a valid symlink"));Q.symlink(A.linkname,q,d)})})}function b(){if(za)return V();Q.unlink(q,function(){let p=z9.join(Z,z9.join("/",A.linkname));Q.realpath(p,function(Q0,L0){if(Q0||!l(L0))return V(Error(q+" is not a valid hardlink"));Q.link(L0,q,function(o){if(o&&o.code==="EPERM"&&X.hardlinkAsFilesFallback)return I=Q.createReadStream(L0),y();d(o)})})})}function l(p){return p===Z||p.startsWith(Z+z9.sep)}function y(){let p=Q.createWriteStream(q),Q0=G(I,A);p.on("error",function(L0){Q0.destroy(L0)}),sM$(Q0,p,function(L0){if(L0)return V(L0);p.on("close",d)})}}function E(A,I){let V;while((V=yl4(W))&&A.slice(0,V[0].length)!==V[0])W.pop();if(!V)return I();Q.utimes(V[0],H,V[1],I)}function j(A,I,V){if(X.utimes===!1)return V();if(I.type==="directory")return Q.utimes(A,H,I.mtime,V);if(I.type==="symlink")return E(A,V);Q.utimes(A,H,I.mtime,function(q){if(q)return V(q);E(A,V)})}function z(A,I,V){let q=I.type==="symlink",S=q?Q.lchmod:Q.chmod,d=q?Q.lchown:Q.chown;if(!S)return V();let f=(I.mode|(I.type==="directory"?O:D))&F;if(d&&J)d.call(Q,A,I.uid,I.gid,b);else b(null);function b(l){if(l)return V(l);if(!S)return V();S.call(Q,A,f,V)}}function P(A,I,V){Q.stat(A,function(q){if(!q)return V(null);if(q.code!=="ENOENT")return V(q);Q.mkdir(A,{mode:I.mode,recursive:!0},function(S,d){if(S)return V(S);z(A,I,V)})})}};function ZV$($,Z,X,Q){if(Z===X)return Q(null,!0);if(!Z.startsWith(X+z9.sep))return Q(null,!1);$.lstat(Z,function(Y,G){if(Y&&Y.code!=="ENOENT"&&Y.code!=="EPERM")return Q(Y);if(Y||!G.isSymbolicLink())return ZV$($,z9.join(Z,".."),X,Q);Q(null,!1)})}function XV$($,Z,X,Q){if(Z===X)return Q(null,!0);$.lstat(Z,function(Y,G){if(Y&&Y.code!=="ENOENT"&&Y.code!=="EPERM")return Q(Y);if(Y||G.isDirectory())return XV$($,z9.join(Z,".."),X,Q);Q(null,!1)})}function Pa(){}function QV$($){return $}function I91($){return za?$.replace(/\\/g,"/").replace(/[:?<>|]/g,"_"):$}function hl4($,Z,X,Q,Y,G){if(!Y)Y=["."];let J=Y.slice(0);return function(W){if(!J.length)return W(null);let H=J.shift(),F=z9.join(X,H);Z.call($,F,function(U,N){if(U)return W(Y.indexOf(H)===-1&&U.code==="ENOENT"?null:U);if(!N.isDirectory())return W(null,H,N);$.readdir(F,function(B,O){if(B)return W(B);if(G)O.sort();for(let D=0;D<O.length;D++)if(!Q(z9.join(X,H,O[D])))J.push(z9.join(H,O[D]));W(null,H,N)})})}}function YV$($,Z){return function(X){X.name=X.name.split("/").slice(Z).join("/");let Q=X.linkname;if(Q&&(X.type==="link"||z9.isAbsolute(Q)))X.linkname=Q.split("/").slice(Z).join("/");return $(X)}}});var ml4,dl4;var JV$=L(()=>{H91();ml4=k(nq$(),1),dl4=k(GV$(),1)});var tP0=()=>{};var KV$=L(()=>{KP0()});var WV$=L(()=>{fP0();xP0();tP0()});var HV$=()=>{};var FV$=()=>{};var UV$=L(()=>{Vq$();K91();fP0();vq$();G91();H91();xq$();fq$();bq$();yq$();J91();gq$();JV$();tP0();KV$();WV$();HV$();FV$();tP0()});var oP0=L(()=>{Z4();F61()});function il4($){if($ instanceof TypeError)return!0;if($ instanceof DOMException&&$.name==="AbortError")return!0;return!1}async function q91($,Z,X){try{return await G6(async()=>{let Y=await fetch($,Z);return{status:Y.status,ok:Y.ok,body:await Y.text()}},{maxAttempts:3,minTimeout:50,maxTimeout:500,multiplier:2,jitter:0.5,isRetriable:il4})}catch(Q){let Y=Q instanceof Error?Q.message:String(Q);throw Error(`[SANDBOX_UNREACHABLE] sandbox daemon ${X} request failed: ${Y}`,{cause:Q})}}async function aP0($){try{let Z=await fetch(`${$}/health`,{signal:AbortSignal.timeout(pl4)});if(!Z.ok)return null;let X=await Z.json();if(typeof X==="object"&&X!==null&&typeof X.bootId==="string"&&typeof X.ready==="boolean"&&X.setup&&typeof X.setup.running==="boolean"&&typeof X.setup.done==="boolean")return X;return null}catch{return null}}async function V91($){for(let Z=0;Z<NV$;Z++){if(await aP0($)!==null)return;let X=(Math.random()*2-1)*nl4;await H$(BV$+X)}throw Error(`sandbox daemon at ${$} did not respond on /health within ${NV$*BV$/1000}s`)}async function jv($,Z,X,Q,Y){return tl4($,Z,"POST",X,Q,Y)}async function tl4($,Z,X,Q,Y,G){let J={...Q};if(Y&&Y.rotateToken!==void 0)J.auth=Y;let K=await q91(`${$}/_sandbox/config`,{method:X,headers:{"Content-Type":"application/json",Authorization:`Bearer ${Z}`},body:JSON.stringify(J),signal:AbortSignal.timeout(G?.timeoutMs??M91)},"/_sandbox/config");if(!K.ok)throw new rP0(K.status,K.body);return DV$(K.body,"/_sandbox/config")}async function OV$($,Z,X){let Q=await q91(`${$}/_sandbox/setup/${X}`,{method:"POST",headers:{Authorization:`Bearer ${Z}`},signal:AbortSignal.timeout(M91)},`/_sandbox/setup/${X}`);if(!Q.ok)throw Error(`sandbox daemon /_sandbox/setup/${X} returned ${Q.status}: ${Q.body}`)}async function LV$($,Z,X){let Q=await q91(`${$}/_sandbox/orgfs-config`,{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${Z}`},body:X,signal:AbortSignal.timeout(M91)},"/_sandbox/orgfs-config");if(!Q.ok)throw Error(`sandbox daemon /_sandbox/orgfs-config returned ${Q.status}: ${Q.body}`);return DV$(Q.body,"/_sandbox/orgfs-config")}function DV$($,Z){try{return JSON.parse($)}catch(X){throw Error(`sandbox daemon ${Z} returned a malformed JSON body: ${$.slice(0,200)}`,{cause:X})}}async function Aa($,Z,X,Q){let Y=new Headers(Q.headers);for(let K of ol4)Y.delete(K);Y.set("authorization",`Bearer ${Z}`);let G=Q.method!=="GET"&&Q.method!=="HEAD",J=`${$}${X.startsWith("/")?X:`/${X}`}`;return fetch(J,{method:Q.method,headers:Y,body:G?Q.body:void 0,redirect:"manual",signal:Q.signal,duplex:G?"half":void 0})}var rP0,pl4=500,M91=30000,NV$=25,BV$=200,nl4=50,ol4;var wV$=L(()=>{oP0();Z4();rP0=class rP0 extends Error{status;constructor($,Z){super(`sandbox daemon /_sandbox/config returned ${$}: ${Z}`);this.status=$;this.name="ConfigRequestError"}};ol4=["cookie","host","connection","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","accept-encoding","content-length"]});async function*zV$($){let Z=$.now??(()=>Date.now()),X=Z(),Q=$.schedulingTimeoutMs??al4,Y={pod:{},sandbox:{},events:{hasPulling:!1,hasPulled:!1},startedAt:X},G=[],J=null,K=!1,W=(j)=>{if(K)return;if(J){let z=J;J=null,z(j)}else G.push(j)},H=()=>{if(G.length>0)return Promise.resolve(G.shift());if(K)return Promise.resolve(null);return new Promise((j)=>{J=j})},F=()=>{if(K)return;if(K=!0,J){let j=J;J=null,j(null)}},U=new AbortController,N=()=>{U.abort(),F()};if($.signal)if($.signal.aborted)U.abort(),F();else $.signal.addEventListener("abort",N,{once:!0});let B=Math.max(0,Q-(Z()-X)),O=setTimeout(()=>W("tick"),B+100),D,w=new Promise((j)=>{D=j}),E=Promise.allSettled([sl4($.kc,$.namespace,$.claimName,U.signal,Y,W,Z,D),$m4($.kc,$.namespace,$.claimName,U.signal,Y,W),Zm4($.kc,$.namespace,$.claimName,w,U.signal,Y,W,Z)]);try{let j=null,z=-1,P=EV$(Y,Q,Z);if(j=S91(P),!k91(P))z=jV$(P);if(yield P,k91(P))return;while(!K){if(await H()===null)break;let I=EV$(Y,Q,Z);if(k91(I)){let S=S91(I);if(S!==j)j=S,yield I;return}let V=jV$(I);if(V<z)continue;let q=S91(I);if(q!==j)j=q,z=V,yield I}}finally{if(clearTimeout(O),U.abort(),$.signal)$.signal.removeEventListener("abort",N);F(),await E.catch(()=>{})}}function EV$($,Z,X){let{pod:Q,sandbox:Y,events:G,startedAt:J}=$;if(Y.ready)return{kind:"ready"};let K=Q.containerWaitingReason;if(K==="ImagePullBackOff"||K==="ErrImagePull")return{kind:"failed",reason:"image-pull-backoff",message:"Sandbox image failed to download. The cluster may be missing pull credentials or the image tag may not exist."};if(K==="CrashLoopBackOff")return{kind:"failed",reason:"crash-loop-backoff",message:"Sandbox crashed during startup and is now in CrashLoopBackOff. Check pod logs."};if(!Q.scheduled&&G.lastFailedSchedulingAt!==void 0&&X()-J>Z)return{kind:"failed",reason:"scheduling-timeout",message:G.failedSchedulingMessage??`Pod could not be scheduled within ${Math.round(Z/1000)}s.`};if(Q.containerRunning&&!Q.containerReady)return{kind:"warming-daemon",since:J};if(G.hasPulling&&!G.hasPulled)return{kind:"pulling-image",since:J};if(K==="ContainerCreating"||K==="PodInitializing"||Q.scheduled&&!Q.containerRunning)return{kind:"starting-container",since:J};if(Q.scheduledFalseReason==="Unschedulable"||G.lastFailedSchedulingAt!==void 0&&!Q.scheduled)return{kind:"waiting-for-capacity",since:J,message:G.failedSchedulingMessage??Q.scheduledFalseMessage,nodeClaim:G.nominatedNodeClaim};return{kind:"claiming",since:J}}function k91($){return $.kind==="ready"||$.kind==="failed"}function jV$($){switch($.kind){case"claiming":return 0;case"waiting-for-capacity":return 1;case"pulling-image":return 2;case"starting-container":return 3;case"warming-daemon":return 4;case"ready":case"failed":return 99}}function S91($){switch($.kind){case"claiming":case"pulling-image":case"starting-container":case"warming-daemon":return $.kind;case"waiting-for-capacity":return`waiting-for-capacity:${$.message??""}:${$.nodeClaim??""}`;case"ready":return"ready";case"failed":return`failed:${$.reason}:${$.message}`}}async function sl4($,Z,X,Q,Y,G,J,K){let W=`/api/v1/namespaces/${encodeURIComponent(Z)}/pods?watch=true&labelSelector=${encodeURIComponent(`${rl4}=${X}`)}`;return sP0({kc:$,path:W,signal:Q,label:`pod/${X}`,onEvent:(H)=>{if(H.type!=="ADDED"&&H.type!=="MODIFIED")return;let F=H.object;if(F.metadata?.name)K(F.metadata.name);el4(F,Y,J),G("pod")}})}function el4($,Z,X){let Y=($.status?.conditions??[]).find((J)=>J.type==="PodScheduled");if(Y?.status==="True")Z.pod.scheduled=!0,Z.pod.scheduledFalseReason=void 0,Z.pod.scheduledFalseMessage=void 0;else if(Y?.status==="False")Z.pod.scheduled=!1,Z.pod.scheduledFalseReason=Y.reason,Z.pod.scheduledFalseMessage=Y.message;let G=($.status?.containerStatuses??[]).find((J)=>J.name===j9.MAIN_CONTAINER_NAME);if(G)Z.pod.containerWaitingReason=G.state?.waiting?.reason,Z.pod.containerRunning=!!G.state?.running,Z.pod.containerReady=G.ready===!0}async function $m4($,Z,X,Q,Y,G){let J=`/apis/${j9.CLAIM_API_GROUP}/${j9.CLAIM_API_VERSION}/namespaces/${encodeURIComponent(Z)}/${j9.CLAIM_PLURAL}?watch=true&fieldSelector=${encodeURIComponent(`metadata.name=${X}`)}`;return sP0({kc:$,path:J,signal:Q,label:`sandboxclaim/${X}`,onEvent:(K)=>{if(K.type!=="ADDED"&&K.type!=="MODIFIED")return;let H=K.object.status?.conditions?.find((F)=>F.type==="Ready");if(!H)return;if(H.status==="True")Y.sandbox.ready=!0,Y.sandbox.notReadyReason=void 0,Y.sandbox.notReadyMessage=void 0;else Y.sandbox.ready=!1,Y.sandbox.notReadyReason=H.reason,Y.sandbox.notReadyMessage=H.message;G("sandbox")}})}async function Zm4($,Z,X,Q,Y,G,J,K){let W=await Promise.race([Q,new Promise((F)=>{if(Y.aborted){F(X);return}Y.addEventListener("abort",()=>F(X),{once:!0})})]);if(Y.aborted)return;let H=`/api/v1/namespaces/${encodeURIComponent(Z)}/events?watch=true&fieldSelector=${encodeURIComponent(`involvedObject.name=${W},involvedObject.kind=Pod`)}`;return sP0({kc:$,path:H,signal:Y,label:`events/${X}`,onEvent:(F)=>{if(F.type!=="ADDED"&&F.type!=="MODIFIED")return;let U=F.object,N=U.reason;if(!N)return;switch(N){case"Pulling":G.events.hasPulling=!0;break;case"Pulled":G.events.hasPulling=!0,G.events.hasPulled=!0;break;case"FailedScheduling":G.events.lastFailedSchedulingAt=K(),G.events.failedSchedulingMessage=U.message;break;case"Nominated":{let B=U.message?.match(/nodeclaim\/([\w-]+)/);if(B)G.events.nominatedNodeClaim=B[1];break}default:return}J("event")}})}async function PV$($){let{kc:Z,namespace:X,labelSelector:Q,signal:Y,onDelete:G}=$,J=`/apis/${j9.CLAIM_API_GROUP}/${j9.CLAIM_API_VERSION}/namespaces/${encodeURIComponent(X)}/${j9.CLAIM_PLURAL}?watch=true&labelSelector=${encodeURIComponent(Q)}`;return sP0({kc:Z,path:J,signal:Y,label:"sandboxclaim-reaper",onEvent:(K)=>{if(K.type!=="DELETED")return;let W=K.object.metadata?.name;if(W)G(W)}})}async function sP0($){let{kc:Z,path:X,signal:Q,label:Y,onEvent:G}=$,J=0;while(!Q.aborted){try{let W=await VG(Z,{method:"GET",path:X,signal:Q,headers:{accept:"application/json"},stream:!0});if(!W.ok||!W.body){try{await W.body?.cancel()}catch{}if(W.status===401||W.status===403){console.warn(`[lifecycle-watcher] ${Y} stopped: watch denied (${W.status} ${W.statusText}). `+"The kubeconfig in use cannot watch SandboxClaims \u2014 if you are running locally, "+"this provider should not be active (check STUDIO_AGENT_SANDBOX_ENABLED).");return}throw Error(`watch handshake failed: ${W.status} ${W.statusText}`)}J=0;for await(let H of v61(W.body)){if(Q.aborted)return;try{G(H)}catch(F){console.warn(`[lifecycle-watcher] ${Y} onEvent threw: ${F instanceof Error?F.message:String(F)}`)}}}catch(W){if(Q.aborted)return;let H=W instanceof Error?W.message:String(W);console.warn(`[lifecycle-watcher] ${Y} watch ended: ${H}`)}if(Q.aborted)return;let K=B7(5000,250,J,2,0);J+=1,await H$(K,{signal:Q}).catch(()=>{})}}var rl4="studio.decocms.com/sandbox-handle",al4=300000;var AV$=L(()=>{Z4();VK0();_K0()});import{z as tJ}from"zod";function TV$($){if(!$||$.trim()==="")return[];let Z=tJ.array(Xm4).parse(JSON.parse($)),X=new Set;for(let Q of Z){if(X.has(Q.name))throw Error(`STUDIO_SANDBOX_TENANT_POOLS: duplicate pool name ${Q.name}`);X.add(Q.name)}return Z}function Qm4($){try{let[Z,X]=new URL($).pathname.replace(/^\/+/,"").split("/"),Q=X?.replace(/\.git$/,"");return Z&&Q?`${Z}/${Q}`.toLowerCase():null}catch{return null}}function RV$($,Z){let{orgId:X,cloneUrl:Q}=Z;if(Z.purpose==="harness-run")return null;if(!X||!Q)return null;let Y=Qm4(Q);if(!Y)return null;return $.find((G)=>G.orgId===X&&G.repo.toLowerCase()===Y)??null}function IV$($,Z,X){return $?.name??(Z?X:"none")}function Ym4($,Z){return $==="harness-run"?`${Z}-medium`:Z}async function qV$($){let Z=Ym4($.purpose,$.templateName);if(Z===$.templateName)return{name:Z,probe:$.probe};let X=$.probe!==null&&$.now-$.probe.checkedAt<$.ttlMs?$.probe:{checkedAt:$.now,present:await $.exists(Z)};if(X.present)return{name:Z,probe:X};if($.probe?.present!==!1)$.onAbsent?.(Z);return{name:$.templateName,probe:X}}function MV$($,Z,X){let Q=X.replace(/^refs\/heads\//,"");return $.filter((Y)=>Y.repo.toLowerCase()===Z.toLowerCase()&&Y.branch===Q)}function VV$($){return`https://github.com/${$.repo}.git`}var Xm4;var C91=L(()=>{Xm4=tJ.object({name:tJ.string().regex(/^[a-z0-9]([-a-z0-9]*[a-z0-9])?$/,"pool name must be a DNS label (lowercase alphanumeric and '-')"),orgId:tJ.string().min(1),repo:tJ.string().regex(/^[^/\s]+\/[^/\s]+$/,"repo must be `owner/name`"),connectionId:tJ.string().min(1).optional(),branch:tJ.string().min(1).default("main"),workload:tJ.object({runtime:tJ.enum(["node","bun","deno"]).default("node"),packageManager:tJ.enum(["npm","pnpm","yarn","bun","deno"]).optional(),packageManagerPath:tJ.string().optional(),devPort:tJ.number().int().positive().optional()}).default({runtime:"node"})})});async function kV$($,Z,X){let Q=new Map;for(let Y of $){let G=Z(Y);if(!G)continue;let J=Q.get(G);if(J)J.push(Y);else Q.set(G,[Y])}await Promise.allSettled([...Q.values()].map(async(Y)=>{for(let G of Y)await X(G).catch(()=>{})}))}import{createHash as Gm4,randomBytes as Jm4,randomUUID as Km4}from"crypto";import*as bV$ from"net";import{PassThrough as Wm4}from"stream";function SV$($){if($ instanceof Error)return $.message;if($&&typeof $==="object"){let Z=$;if(Z.error instanceof Error)return Z.error.message;if(typeof Z.message==="string"&&Z.message)return Z.message}return String($)}class g91{records=new Map;inflight=new FK0;activeGauge=new HK0;stateStore;previewUrlPattern;kubeConfig;capacityProbe;portForward;namespace;sandboxTemplateName;envName;tokenGenerator;idleTtlMs;metrics;previewGateway;sentinelToken;mintCloneUrl;mintOrgFsConfig;tenantPools;tenantPoolRefreshMs;poolPods=new Map;mediumTemplateProbe=null;dirtyPools=new Set;closed=!1;claimWatchAbort=new AbortController;constructor($={}){this.stateStore=$.stateStore??null,this.previewUrlPattern=$.previewUrlPattern??null,this.kubeConfig=$.kubeConfig??Am4(),this.portForward=new F91(this.kubeConfig),this.namespace=$.namespace??Hm4,this.sandboxTemplateName=$.sandboxTemplateName??Fm4,this.envName=Vm4($.envName),this.tokenGenerator=$.tokenGenerator??(()=>Jm4(Nm4).toString("hex")),this.idleTtlMs=$.idleTtlMs??Om4,this.metrics=$.meter?Pm4($.meter):null,this.previewGateway=$.previewGateway&&$.previewUrlPattern?{...$.previewGateway}:null;let Z=$.sentinelToken?.trim()??"";if(this.sentinelToken=Z.length>0?Z:null,this.mintCloneUrl=$.mintCloneUrl,this.mintOrgFsConfig=$.mintOrgFsConfig,this.tenantPools=this.sentinelToken!==null?$.tenantPools??[]:[],this.sentinelToken===null&&($.tenantPools?.length??0)>0)console.warn(`[${w6}] tenant pools configured without a sentinel token \u2014 ignoring them (warm-pool mode is off)`);this.tenantPoolRefreshMs=$.tenantPoolRefreshMs??Dm4,this.startClaimReaper(),this.startCredentialRefresher(),this.startTenantPoolReconciler()}startClaimReaper(){let $=["app.kubernetes.io/managed-by=studio","app.kubernetes.io/name=studio-sandbox",...this.envName?[`${qQ.env}=${this.envName}`]:[]].join(",");PV$({kc:this.kubeConfig,namespace:this.namespace,labelSelector:$,signal:this.claimWatchAbort.signal,onDelete:(Z)=>this.invalidateRecord(Z)})}async ensure($,Z={}){let X=cz($);if(X.startsWith("s-"))throw Error(`ensure: projectRef has no slug source: ${$.projectRef}`);return this.inflight.run(X,()=>UK0(this.stateStore,$,(Q)=>this.ensureLocked($,X,Z,Q)))}async delete($){let Z=await this.getRecord($);if(this.records.delete($),Z)this.dropRecord(Z);if(await this.deleteHttpRouteIfManaged($).catch((X)=>{console.warn(`[${w6}] HTTPRoute delete failed for ${$}: ${X instanceof Error?X.message:String(X)}`)}),await Tu(this.kubeConfig,this.namespace,$),this.stateStore)if(Z)await this.stateStore.delete(Z.id);else await this.stateStore.deleteByHandle($)}lastTermination($){return VA$(this.kubeConfig,this.namespace,qQ.sandboxHandle,$,j9.MAIN_CONTAINER_NAME)}async alive($){return await ZN(this.kubeConfig,this.namespace,$)!==void 0}watchClaimLifecycle($,Z){return zV$({kc:this.kubeConfig,namespace:this.namespace,claimName:$,signal:Z})}hasSchedulableCapacity(){return this.capacityProbe??=hA$(this.kubeConfig,this.namespace),this.capacityProbe()}async getPreviewUrl($){let Z=await this.getRecord($);if(!Z)return null;return this.composePreviewUrl(Z)}async proxyDaemonRequest($,Z,X){let Q=await this.getRecord($);if(!Q&&this.previewUrlPattern&&this.stateStore){let W=await this.stateStore.getByHandle($),H=W?.state,F=H?.token;if(W&&F){let N=`http://${H?.adoptedSandboxName??$}.${this.namespace}.svc.cluster.local:${WN}`;try{let B=await Aa(N,F,Z,X);if(B.status!==404)return B;try{await B.body?.cancel()}catch{}}catch{}}}if(!Q)Q=await this.resurrectByHandle($);if(!Q)return new Response(JSON.stringify({error:"sandbox not found"}),{status:404,headers:{"content-type":"application/json"}});let Y=Q,G=performance.now(),J=0,K=!(X.body instanceof ReadableStream);try{let W=await Aa(Q.daemonUrl,Q.token,Z,X);if(W.status===401&&K){this.invalidateRecord($);let H=await this.getRecord($).catch(()=>null)??await this.resurrectByHandle($).catch(()=>null);if(H){try{await W.body?.cancel()}catch{}Y=H,W=await Aa(H.daemonUrl,H.token,Z,X)}}return J=W.status,W}catch(W){if(!K)throw W;this.invalidateRecord($);let H=await this.resurrectByHandle($)??await this.getRecord($).catch(()=>null);if(!H)throw W;Y=H;let F=await Aa(H.daemonUrl,H.token,Z,X);return J=F.status,F}finally{this.recordProxyDuration("daemon",J,Y,performance.now()-G)}}async adoptLiveClaim($,Z){if(this.records.has(Z))return!0;let X=await ZN(this.kubeConfig,this.namespace,Z).catch(()=>{return});if(!X||X.metadata?.deletionTimestamp)return!1;return await this.inflight.run(Z,async()=>{let Y=this.records.get(Z);if(Y)return this.toSandbox(Y);let G=await this.adopt($,Z,X);if(!G)throw Error(`cannot adopt live claim ${Z}`);return UK0(this.stateStore,$,(J)=>this.finish(G,J,!0,!0,"adopt"))}).catch(()=>null)!=null}async resolvePreviewUpstreamUrl($){if(this.previewUrlPattern)return`http://${await this.resolveServiceNameForHandle($)}.${this.namespace}.svc.cluster.local:${WN}`;let Z=await this.getRecord($);if(Z)return Z.daemonUrl;let X=await this.resurrectByHandle($);return X?X.daemonUrl:null}async resolveServiceNameForHandle($){let Z=this.records.get($);if(Z)return Z.adoptedSandboxName;if(this.stateStore){let Q=(await this.stateStore.getByHandle($).catch(()=>null))?.state?.adoptedSandboxName;if(Q)return Q}return $}async proxyPreviewRequest($,Z){let X=performance.now(),Q=this.records.get($)??null,Y=0;try{let G=await this.resolvePreviewUpstreamUrl($);if(!G){Y=404;let O=v91(404,{error:"sandbox not found"});return O.headers.set(Pv,"1"),O}let J=new URL(Z.url);if((J.pathname==="/_sandbox"||J.pathname.startsWith("/_sandbox/"))&&Z.method!=="GET")return Y=404,v91(404,{error:"not found"});let W=(O)=>`${O}${J.pathname}${J.search}`,H=new Headers(Z.headers);for(let O of jm4)H.delete(O);let F=Z.method!=="GET"&&Z.method!=="HEAD",U={method:Z.method,headers:H,body:F?Z.body:void 0,redirect:"manual",signal:Z.signal,duplex:F?"half":void 0},N;try{N=await fetch(W(G),U)}catch(O){let D=`${G}${J.pathname}`;if(console.warn(`[${w6}] preview fetch to ${D} failed: ${O instanceof Error?O.message:String(O)}`),Z.method==="GET"||Z.method==="HEAD"){if(this.invalidateRecord($),await this.resurrectByHandle($).catch(()=>null)){let j=await this.resolvePreviewUpstreamUrl($);if(j)try{N=await fetch(W(j),U);let z=new Headers;for(let[P,A]of N.headers.entries())if(!vV$.includes(P.toLowerCase()))z.set(P,A);return Y=N.status,new Response(N.body,{status:N.status,statusText:N.statusText,headers:z})}catch(z){console.warn(`[${w6}] preview fetch retry to ${D} failed: ${z instanceof Error?z.message:String(z)}`)}}}else this.invalidateRecord($);Y=502;let w=v91(502,{error:"sandbox daemon unreachable"});return w.headers.set(Pv,"1"),w}let B=new Headers;for(let[O,D]of N.headers.entries())if(!vV$.includes(O.toLowerCase()))B.set(O,D);return Y=N.status,new Response(N.body,{status:N.status,statusText:N.statusText,headers:B})}finally{this.recordProxyDuration("preview",Y,Q,performance.now()-X,$)}}async ensureLocked($,Z,X,Q){if(X.image)console.warn(`[${w6}] opts.image ignored (template ${this.sandboxTemplateName} pins image): got ${X.image}`);if(Q){let J=await Q.get($);if(J){let K=await this.rehydrate($,Z,J);if(K)return await this.refreshDaemonGitCredential(K,X),await this.relayOrgFsConfig(K.daemonUrl,K.token,X.orgFsConfigJson),this.finish(K,Q,!1,!0,"resume");await Q.delete($)}}let Y=await ZN(this.kubeConfig,this.namespace,Z).catch(()=>{return});if(Y)if(Y.metadata?.deletionTimestamp)await SK0(this.kubeConfig,this.namespace,Z).catch((J)=>{console.warn(`[${w6}] wait for terminating claim ${Z} failed: ${J instanceof Error?J.message:String(J)}`)});else{let J=await this.adopt($,Z,Y).catch((K)=>{return console.warn(`[${w6}] adopt ${Z} failed, recreating: ${K instanceof Error?K.message:String(K)}`),null});if(J)return await this.refreshDaemonGitCredential(J,X),await this.relayOrgFsConfig(J.daemonUrl,J.token,X.orgFsConfigJson),this.finish(J,Q,!0,!0,"adopt");await Tu(this.kubeConfig,this.namespace,Z).catch(()=>{}),await SK0(this.kubeConfig,this.namespace,Z).catch((K)=>{console.warn(`[${w6}] wait for deleted claim ${Z} failed: ${K instanceof Error?K.message:String(K)}`)})}let G=await this.provision($,Z,X);return this.finish(G,Q,!0,!1,"fresh")}async finish($,Z,X,Q,Y){let G=this.records.get($.handle),J=G!==void 0;if(G&&G.daemonForward!==$.daemonForward)this.closeForwarder(G.daemonForward);if(this.records.set($.handle,$),X)await this.persist(Z,$);if(Q)await CK0(this.kubeConfig,this.namespace,$.handle,this.computeShutdownTime()).catch((K)=>console.warn(`[${w6}] TTL refresh failed for ${$.handle}: ${K instanceof Error?K.message:String(K)}`));if(this.metrics){let K=f91($.tenant);if(this.metrics.ensureOutcome.add(1,{...K,outcome:Y}),!J)this.metrics.active.add(1,K),this.activeGauge.markCounted($.handle)}return this.toSandbox($)}buildEnvMap($,Z){let X={},Q=[];for(let[Y,G]of Object.entries($.env??{}))if(Bm4.has(Y))Q.push(Y);else X[Y]=G;if(Q.length>0)console.warn(`[${w6}] opts.env keys overlap reserved bootstrap names and were dropped: ${Q.join(",")}`);return{...X,DAEMON_TOKEN:Z.token,DAEMON_BOOT_ID:Z.daemonBootId,APP_ROOT:Z.workdir,PROXY_PORT:String(WN)}}async resolveTemplateName($){let{name:Z,probe:X}=await qV$({purpose:$,templateName:this.sandboxTemplateName,probe:this.mediumTemplateProbe,now:Date.now(),ttlMs:Um4,exists:(Q)=>RA$(this.kubeConfig,this.namespace,Q),onAbsent:(Q)=>console.warn(`[${w6}] SandboxTemplate ${Q} not found (or not readable) \u2014 harness-run claims fall back to ${this.sandboxTemplateName}. Upgrade the sandbox-env chart to the version that renders it.`)});return this.mediumTemplateProbe=X,Z}buildClaim($,Z,X,Q){let Y=this.sentinelToken!==null,G=RV$(this.tenantPools,{orgId:Z.tenant?.orgId,cloneUrl:Z.repo?.cloneUrl,purpose:Z.purpose}),J=Y?[]:Object.entries(this.buildEnvMap(Z,X)).sort(([H],[F])=>H<F?-1:H>F?1:0).map(([H,F])=>({name:H,value:F})),K=Cm4(Z),W=Object.keys(K).length>0;return{apiVersion:`${j9.CLAIM_API_GROUP}/${j9.CLAIM_API_VERSION}`,kind:"SandboxClaim",metadata:{name:$,namespace:this.namespace,labels:{"app.kubernetes.io/name":"studio-sandbox","app.kubernetes.io/managed-by":"studio",...this.envName?{[qQ.env]:this.envName}:{},...x91(Z.tenant)},...W?{annotations:K}:{}},spec:{sandboxTemplateRef:{name:Q},additionalPodMetadata:{labels:x91(Z.tenant,{[qQ.role]:"claimed",[qQ.sandboxHandle]:$,...this.envName?{[qQ.env]:this.envName}:{}}),...W?{annotations:K}:{}},env:J,warmpool:IV$(G,Y,Q),lifecycle:{shutdownPolicy:"Delete",shutdownTime:this.computeShutdownTime()}}}}async provision($,Z,X){let Q=this.tokenGenerator(),Y=Km4(),G=_91,J=this.buildClaim(Z,X,{token:Q,daemonBootId:Y,workdir:G},await this.resolveTemplateName(X.purpose));try{await S61(this.kubeConfig,this.namespace,J)}catch(N){if(N instanceof Za)await SK0(this.kubeConfig,this.namespace,Z),await S61(this.kubeConfig,this.namespace,J);else throw N}let K;try{K=await IA$(this.kubeConfig,this.namespace,Z),await yA$(this.kubeConfig,this.namespace,K)}catch(N){throw await Tu(this.kubeConfig,this.namespace,Z).catch(()=>{}),N}try{await this.ensureServicePortForAdoptedSandbox(K),await this.ensureHttpRouteForHandle(Z,K,X.tenant??null)}catch(N){throw await Tu(this.kubeConfig,this.namespace,Z).catch(()=>{}),N}let W=await this.openForwarder(K,WN,Z),H=`http://127.0.0.1:${W.localPort}`,F=this.workloadConfigPayload(X),U=Y;try{if(await V91(H),this.sentinelToken!==null){let N=await aP0(H);if(N)U=N.bootId;await jv(H,this.sentinelToken,F??{},{rotateToken:Q})}else if(F)await jv(H,Q,F);await this.relayOrgFsConfig(H,Q,X.orgFsConfigJson)}catch(N){throw this.closeForwarder(W),await this.deleteHttpRouteIfManaged(Z).catch(()=>{}),await Tu(this.kubeConfig,this.namespace,Z).catch(()=>{}),N}return{id:$,handle:Z,adoptedSandboxName:K,token:Q,workdir:G,daemonUrl:H,daemonForward:W,workload:X.workload??null,daemonBootId:U,tenant:X.tenant??null,ensureOpts:bm4(X)}}workloadConfigPayload($){return BK0({runtime:$?.workload?.runtime??"node",packageManager:$?.workload?.packageManager?{name:$.workload.packageManager,...$.workload.packageManagerPath?{path:$.workload.packageManagerPath}:{}}:null,repo:$?.repo??null,extraRepos:$?.extraRepos??[],port:$?.workload?.devPort??CV$,tenant:$?.tenant??void 0,...$?{cloneOnly:$.cloneOnly===!0}:{}})}async relayOrgFsConfig($,Z,X){if(!X)return;await LV$($,Z,X).catch((Q)=>console.warn("[org-fs] sidecar config relay failed",Q))}async refreshDaemonGitCredential($,Z){let X=U61(Z);if(!X)return;try{await jv($.daemonUrl,$.token,X)}catch(Q){console.warn(`[${w6}] git credential refresh failed for ${$.handle}: ${Q instanceof Error?Q.message:String(Q)}`)}}async withFreshCloneUrl($,Z){if(!this.mintCloneUrl)return $;try{let X=await this.mintCloneUrl($,Z!==void 0?{bufferMs:Z}:void 0);return X?{...$,cloneUrl:X}:$}catch(X){return console.warn(`[${w6}] clone credential re-mint failed: ${X instanceof Error?X.message:String(X)}`),$}}async withFreshCredentials($){return{...$,...$.repo?{repo:await this.withFreshCloneUrl($.repo)}:{},...$.orgFsConfigJson?{orgFsConfigJson:await fm4($,this.mintOrgFsConfig)}:{}}}startCredentialRefresher(){if(!this.mintCloneUrl)return;let{signal:$}=this.claimWatchAbort;(async()=>{while(!$.aborted){if(await H$(wm4,{signal:$}).catch(()=>{}),$.aborted)break;try{await this.refreshAllGitCredentials()}catch(Z){console.warn(`[${w6}] periodic credential refresh failed: ${Z instanceof Error?Z.message:String(Z)}`)}}})()}startTenantPoolReconciler(){if(this.tenantPools.length===0)return;let{signal:$}=this.claimWatchAbort;(async()=>{while(!$.aborted){try{await this.reconcileTenantPools()}catch(Z){console.warn(`[${w6}] tenant pool reconcile failed: ${Z instanceof Error?Z.message:String(Z)}`)}await H$(Lm4,{signal:$}).catch(()=>{})}})()}markTenantPoolsDirty($,Z){let X=MV$(this.tenantPools,$,Z);for(let Q of X)this.dirtyPools.add(Q.name);return X.map((Q)=>Q.name)}async reconcileTenantPools(){for(let $ of this.tenantPools){let Z=await qA$(this.kubeConfig,this.namespace,$.name);if(Z===null){console.warn(`[${w6}] tenant pool ${$.name}: no SandboxWarmPool (or no selector yet) in ${this.namespace}`);continue}let X=this.dirtyPools.delete($.name),Q=Z.filter((Y)=>!Y.labels[qQ.sandboxHandle]);for(let[Y]of this.poolPods)if(!Z.some((G)=>G.uid===Y))this.poolPods.delete(Y);for(let Y of Q){if(this.claimWatchAbort.signal.aborted)return;await this.warmPoolPod($,Y,X)}this.recordPoolDepth($,Z,Q)}}recordPoolDepth($,Z,X){let Q=this.metrics?.poolPods;if(!Q)return;let Y=0,G=0;for(let K of X){let W=this.poolPods.get(K.uid);if(!W)continue;if(W.failures>=eP0)G++;else if(W.lastConfigAt>0)Y++}let J={pool:$.name,org:$.orgId};Q.record(Y,{...J,state:"ready"}),Q.record(Z.length-X.length,{...J,state:"bound"}),Q.record(X.length-Y-G,{...J,state:"pending"}),Q.record(G,{...J,state:"failed"})}async warmPoolPod($,Z,X){let Q=this.poolPods.get(Z.uid);if(Q&&Q.failures>=eP0){if(Date.now()-Q.lastFailureAt<_V$)return;this.poolPods.set(Z.uid,{...Q,failures:0})}let Y=X||Q!==void 0&&Date.now()-Q.lastConfigAt>=this.tenantPoolRefreshMs;if(Q&&!Y)return;let G={cloneUrl:VV$($),connectionId:$.connectionId,branch:$.branch,userName:"",userEmail:""},J=await this.withFreshCloneUrl(G);if($.connectionId&&J.cloneUrl===G.cloneUrl){this.recordPoolFailure(Z,$,"clone credential mint failed");return}let K=await this.openForwarder(Z.name,WN,Z.name).catch(()=>null);if(!K){this.recordPoolFailure(Z,$,"port-forward failed");return}let W=`http://127.0.0.1:${K.localPort}`;try{await V91(W);let H=this.sentinelToken;if(!H)return;if(!await this.isPoolPodUnbound(Z))return;let F=BK0({runtime:$.workload.runtime,packageManager:$.workload.packageManager?{name:$.workload.packageManager,...$.workload.packageManagerPath?{path:$.workload.packageManagerPath}:{}}:null,repo:J,port:$.workload.devPort??CV$})??{},{transition:U}=await jv(W,H,F);if(Y&&U!=="bootstrap"&&await this.isPoolPodUnbound(Z))await OV$(W,H,"clone");this.poolPods.set(Z.uid,{lastConfigAt:Date.now(),lastFailureAt:0,failures:0}),console.log(`[${w6}] tenant pool ${$.name}: warmed ${Z.name} (${U})`)}catch(H){this.recordPoolFailure(Z,$,H instanceof Error?H.message:String(H))}finally{this.closeForwarder(K)}}isPoolPodUnbound($){return MA$(this.kubeConfig,this.namespace,$.name,qQ.sandboxHandle)}recordPoolFailure($,Z,X){let Q=this.poolPods.get($.uid),Y=(Q?.failures??0)+1;this.poolPods.set($.uid,{lastConfigAt:Q?.lastConfigAt??0,lastFailureAt:Date.now(),failures:Y});let G=Y>=eP0?` \u2014 backing off ${_V$/60000}min`:"";console.warn(`[${w6}] tenant pool ${Z.name}: warming ${$.name} failed (${Y}/${eP0})${G}: ${X}`)}async refreshAllGitCredentials(){await kV$(this.records.values(),($)=>$.ensureOpts?.repo?.connectionId,async($)=>{if(this.claimWatchAbort.signal.aborted)return;let Z=$.ensureOpts?.repo;if(!Z)return;let X=await this.withFreshCloneUrl(Z,Em4);await this.refreshDaemonGitCredential($,{...$.ensureOpts,repo:X}),$.ensureOpts={...$.ensureOpts,repo:X}})}async rebootstrapDaemon($,Z,X){if(this.sentinelToken===null)return!1;let Q=this.workloadConfigPayload(X)??{};try{return await jv($,this.sentinelToken,Q,{rotateToken:Z}),await this.relayOrgFsConfig($,Z,X?.orgFsConfigJson),!0}catch(Y){if(Y instanceof rP0&&Y.status===401)try{return await jv($,Z,Q,{rotateToken:Z}),await this.relayOrgFsConfig($,Z,X?.orgFsConfigJson),!0}catch(G){return console.warn(`[${w6}] re-bootstrap retry with claim token failed: ${G instanceof Error?G.message:String(G)}`),!1}return console.warn(`[${w6}] re-bootstrap failed: ${Y instanceof Error?Y.message:String(Y)}`),!1}}async ensureServicePortForAdoptedSandbox($){if(!this.previewGateway||!this.previewUrlPattern)return;await bA$(this.kubeConfig,this.namespace,$,{name:"daemon",port:WN,targetPort:WN})}async ensureHttpRouteForHandle($,Z,X){if(!this.previewGateway||!this.previewUrlPattern)return;let Q=ym4(this.previewUrlPattern,$);if(!Q)throw new IZ(`Unable to derive preview hostname for ${$} from pattern: ${this.previewUrlPattern}`);let Y={apiVersion:`${_61.API_GROUP}/${_61.API_VERSION}`,kind:"HTTPRoute",metadata:{name:$,namespace:this.namespace,labels:x91(X??void 0,{[qQ.role]:"claimed",[qQ.sandboxHandle]:$,"app.kubernetes.io/name":"studio-sandbox","app.kubernetes.io/managed-by":"studio",...this.envName?{[qQ.env]:this.envName}:{}})},spec:{parentRefs:[{kind:"Gateway",group:"gateway.networking.k8s.io",name:this.previewGateway.name,namespace:this.previewGateway.namespace}],hostnames:[Q],rules:[{backendRefs:[{group:"",kind:"Service",name:Z,port:WN}]}]}};await vA$(this.kubeConfig,this.namespace,Y)}async deleteHttpRouteIfManaged($){if(!this.previewGateway)return;await xA$(this.kubeConfig,this.namespace,$)}async rehydrate($,Z,X){let Q=X.state;if(!Q.adoptedSandboxName&&!Q.podName||!Q.token)return null;let Y=await ZN(this.kubeConfig,this.namespace,Z).catch(()=>{return});if(!Y||!xV$(Y))return null;let G=Y.status?.sandbox?.name??Q.adoptedSandboxName??Q.podName??Z,J=await this.openAndProbeDaemon(G,Z);if(!J)return null;if(Q.daemonBootId&&Q.daemonBootId!==J.bootId){if(this.sentinelToken!==null){let K=Q.ensureOpts?await this.withFreshCredentials(Q.ensureOpts):null;if(!await this.rebootstrapDaemon(J.daemonUrl,Q.token,K))return this.closeForwarder(J.daemonForward),null}else console.warn(`[${w6}] daemon restart detected (handle=${Z}): stored bootId=${Q.daemonBootId} live bootId=${J.bootId}`);await this.stateStore?.put($,{handle:Z,state:{...Q,daemonBootId:J.bootId}}).catch((K)=>console.warn(`[${w6}] bootId persist failed for ${Z}: ${K instanceof Error?K.message:String(K)}`))}return{id:$,handle:Z,adoptedSandboxName:G,token:Q.token,workdir:Q.workdir??_91,daemonUrl:J.daemonUrl,daemonForward:J.daemonForward,workload:Q.workload??null,daemonBootId:J.bootId,tenant:Q.tenant??null,ensureOpts:Q.ensureOpts??null}}async adopt($,Z,X){if(!xV$(X))return null;let Q=X.status?.sandbox?.name??Z;if(this.sentinelToken!==null)return null;let Y=Tm4(X);if(!Y)return null;let G=await this.openAndProbeDaemon(Q,Z);if(!G)return null;let J=_m4(X);if(this.previewGateway)await this.ensureServicePortForAdoptedSandbox(Q).catch((K)=>{console.warn(`[${w6}] Service port backfill failed for ${Z}: ${K instanceof Error?K.message:String(K)}`)}),await this.ensureHttpRouteForHandle(Z,Q,J).catch((K)=>{console.warn(`[${w6}] HTTPRoute backfill failed for ${Z}: ${K instanceof Error?K.message:String(K)}`)});return{id:$,handle:Z,adoptedSandboxName:Q,token:Y,workdir:_91,daemonUrl:G.daemonUrl,daemonForward:G.daemonForward,workload:null,daemonBootId:G.bootId,tenant:J,ensureOpts:null}}async openAndProbeDaemon($,Z){let X=await this.openForwarder($,WN,Z).catch(()=>null);if(!X)return null;let Q=`http://127.0.0.1:${X.localPort}`,Y=await aP0(Q);if(!Y)return this.closeForwarder(X),null;return{daemonForward:X,daemonUrl:Q,bootId:Y.bootId}}async getRecord($){let Z=this.records.get($);if(Z)return Z;if(!this.stateStore)return null;let X=await this.stateStore.getByHandle($);if(!X)return null;let Q=await this.rehydrate(X.id,$,X);if(Q)this.records.set($,Q);return Q}async resurrectByHandle($){if(!this.stateStore)return null;let Z=await this.stateStore.getByHandle($);if(!Z)return null;let X=Z.state.ensureOpts;if(!X)return null;let Q=await this.withFreshCredentials(X);if(cz(Z.id)!==$)return null;return await this.ensure(Z.id,Q),this.records.get($)??null}invalidateRecord($){let Z=this.records.get($);if(!Z)return;this.records.delete($),this.dropRecord(Z)}dropRecord($){if(this.closeForwarder($.daemonForward),this.metrics&&this.activeGauge.consume($.handle))this.metrics.active.add(-1,f91($.tenant))}recordProxyDuration($,Z,X,Q,Y){if(!this.metrics)return;this.metrics.proxyDurationMs.record(Q,{...f91(X?.tenant??null),source:$,sandbox_handle:X?.handle??Y??"",status_code:Z||0})}composePreviewUrl($){if(this.previewUrlPattern)return NK0(this.previewUrlPattern,$.handle);return`http://127.0.0.1:${$.daemonForward.localPort}/`}toSandbox($){return{handle:$.handle,workdir:$.workdir,previewUrl:this.composePreviewUrl($)}}async persist($,Z){if(!$)return;let X={adoptedSandboxName:Z.adoptedSandboxName,token:Z.token,workdir:Z.workdir,workload:Z.workload,daemonBootId:Z.daemonBootId,tenant:Z.tenant,...Z.ensureOpts?{ensureOpts:Z.ensureOpts}:{}};await $.put(Z.id,{handle:Z.handle,state:X})}computeShutdownTime(){return new Date(Date.now()+this.idleTtlMs).toISOString()}async releaseAfter($,Z){let X=await ZN(this.kubeConfig,this.namespace,$);if(!X)return;let Q=vm4(X.spec?.lifecycle?.shutdownTime,new Date(Date.now()+Z));if(!Q)return;await CK0(this.kubeConfig,this.namespace,$,Q).catch((Y)=>console.warn(`[${w6}] release failed for ${$}: ${Y instanceof Error?Y.message:String(Y)}`))}async renewTtl($){let Z=await ZN(this.kubeConfig,this.namespace,$);if(!Z)return;let X=xm4(Z.spec?.lifecycle?.shutdownTime,new Date(Date.now()+this.idleTtlMs));if(!X)return;await CK0(this.kubeConfig,this.namespace,$,X).catch((Q)=>console.warn(`[${w6}] TTL renew failed for ${$}: ${Q instanceof Error?Q.message:String(Q)}`))}openForwarder($,Z,X=$){let Q=Rm4(X,Z);return new Promise((Y,G)=>{let J=(K,W)=>{let H=bV$.createServer((F)=>this.handleForwardedConnection(F,$,Z,X));H.once("error",(F)=>{if(F.code==="EADDRINUSE"&&W<zm4){try{H.close()}catch{}let U=b91+(K-b91+1)%yV$;J(U,W+1);return}G(F)}),H.listen(K,"127.0.0.1",()=>{let F=H.address();if(!F||typeof F==="string"){H.close(),G(Error("port-forward listener failed to bind"));return}Y({server:H,localPort:F.port})})};J(Q,0)})}handleForwardedConnection($,Z,X,Q){let Y=new Wm4,G=null,J=!1,K=()=>{if(J)return;if(J=!0,Y.destroy(),G)try{G.close()}catch{}if(!$.destroyed)$.destroy()};$.pipe(Y),$.on("error",K),$.on("close",K),this.portForward.portForward(this.namespace,Z,[X],$,null,Y).then((W)=>{let H=typeof W==="function"?W():W;if(!H){K();return}if(G=H,G.on("close",K),G.on("error",(F)=>{console.warn(`[${w6}] port-forward to ${Z}:${X} dropped mid-connection: ${SV$(F)}`,JSON.stringify(y91(F))),this.invalidateRecord(Q),K()}),J)try{G.close()}catch{}}).catch((W)=>{console.warn(`[${w6}] port-forward to ${Z}:${X} failed: ${SV$(W)}`,JSON.stringify(y91(W))),this.invalidateRecord(Q),K()})}closeForwarder($){$.server.close((Z)=>{if(Z)console.warn(`[${w6}] port-forward close on :${$.localPort} errored: ${Z instanceof Error?Z.message:String(Z)}`)})}close(){if(this.closed)return;this.closed=!0,this.claimWatchAbort.abort();for(let $ of this.records.values())this.dropRecord($);this.records.clear()}}function Pm4($){return{active:$.createUpDownCounter("studio.sandbox.active",{description:"Active sandbox count, by runner kind, owning org, and daemon impl. Cross-checks the cAdvisor-derived count from the cluster \u2014 divergence between the two indicates orphaned claims (studio deleted but K8s didn't reap) or unattributed pods.",unit:"{sandbox}"}),ensureOutcome:$.createCounter("studio.sandbox.ensure.outcome",{description:"Outcome of each ensure() call: fresh provision, resume from state-store after restart, or adopt of a cluster-side claim studio didn't know about. Cold-start ratio is the primary input for warm-pool sizing.",unit:"{call}"}),proxyDurationMs:$.createHistogram("studio.sandbox.proxy.duration_ms",{description:"Wall-clock latency of studio-mediated requests to the sandbox daemon: tool exec proxies (source=daemon) and preview iframe traffic (source=preview).",unit:"ms"}),poolPods:$.createGauge("studio.sandbox.pool.pods",{description:"Tenant warm pool depth by pool and state: ready (warmed and unbound \u2014 what a claim can actually bind instantly), bound (serving a user), pending (unbound, not yet warmed), failed (gave up after repeated bootstrap failures). Alert on sustained ready=0: a pool that is always empty is doing nothing while costing N pods.",unit:"{pod}"})}}function y91($){let Z=[],X=$;for(let Q=0;Q<5&&X instanceof Error;Q++){let Y=X;if(Z.push({name:Y.name,message:Y.message,...Y.code!==void 0?{code:Y.code}:{},...Y.errno!==void 0?{errno:Y.errno}:{}}),Y.cause===X)break;X=Y.cause}if(X!==void 0&&!(X instanceof Error)&&X!==null){let Q=X,Y=Q.error instanceof Error?y91(Q.error).chain:void 0;Z.push({nonError:String(X),...typeof Q.type==="string"?{type:Q.type}:{},...typeof Q.message==="string"?{message:Q.message}:{},...Q.code!==void 0?{code:Q.code}:{},...typeof Q.reason==="string"?{reason:Q.reason}:{},...Y?{error:Y}:{},...Y===void 0&&Q.error!==void 0?{rawError:String(Q.error)}:{},keys:Object.keys(Q)})}return{chain:Z}}function Am4(){let $=new _P0;return $.loadFromDefault(),$}function xV$($){return Boolean($.status?.conditions?.some((Z)=>Z.type==="Ready"&&Z.status==="True"))}function Tm4($){let Z=$.spec?.env;if(!Z)return null;for(let X of Z)if(X.name==="DAEMON_TOKEN"&&X.value)return X.value;return null}function Rm4($,Z){let X=Gm4("sha256").update(`${$}:${Z}`).digest();return b91+X.readUInt32BE(0)%yV$}function v91($,Z){return new Response(JSON.stringify(Z),{status:$,headers:{"content-type":"application/json","access-control-allow-origin":"*"}})}function fV$($){let Z=$.slice(0,qm4);return Im4.test(Z)?Z:""}function Vm4($){if($===void 0)return null;let Z=$.trim();if(Z==="")return null;if(!Mm4.test(Z))throw Error(`AgentSandboxProvider: envName=${JSON.stringify(Z)} is not a valid DNS-label-safe environment name (lowercase alphanumeric or '-', starts with a letter, ends alphanumeric, \u226432 chars). Studio sets this from STUDIO_ENV; check the studio chart's configMap.`);return Z}function x91($,Z={}){let X={...Z};if($){let Q=fV$($.orgId),Y=fV$($.userId);if(Q)X[qQ.orgId]=Q;if(Y)X[qQ.userId]=Y}return X}function zv($){let Z="";for(let X of $){let Q=X.codePointAt(0)??0;Z+=Q<32||Q===127?" ":X}return Z.slice(0,km4)}function Sm4($){try{let Z=new URL($);return Z.username="",Z.password="",Z.toString()}catch{return""}}function Cm4($){let Z={},X=$.tenant;if(X?.orgSlug)Z[gK.orgSlug]=zv(X.orgSlug);if(X?.orgName)Z[gK.orgName]=zv(X.orgName);if(X?.userEmail)Z[gK.userEmail]=zv(X.userEmail);if(X?.userName)Z[gK.userName]=zv(X.userName);let Q=$.repo;if(Q){if(Q.displayName)Z[gK.gitRepo]=zv(Q.displayName);let Y=Sm4(Q.cloneUrl);if(Y)Z[gK.gitRepoUrl]=zv(Y);let G=$.branch??Q.branch;if(G)Z[gK.gitBranch]=zv(G)}return Z}function _m4($){let Z=$.metadata?.labels;if(!Z)return null;let X=Z[qQ.orgId],Q=Z[qQ.userId];if(!X||!Q)return null;let Y=$.metadata?.annotations??{};return{orgId:X,userId:Q,orgSlug:Y[gK.orgSlug],orgName:Y[gK.orgName],userEmail:Y[gK.userEmail],userName:Y[gK.userName]}}function vm4($,Z){if($){let X=new Date($).getTime();if(Number.isFinite(X)&&X<=Z.getTime())return null}return Z.toISOString()}function xm4($,Z){if($){let X=new Date($).getTime();if(Number.isFinite(X)&&X>=Z.getTime())return null}return Z.toISOString()}function f91($){return{org_id:$?.orgId??"",user_id:$?.userId??"",runner_kind:"agent-sandbox"}}async function fm4($,Z){if(!Z||!$.tenant)return $.orgFsConfigJson;try{return await Z($.tenant)??$.orgFsConfigJson}catch(X){return console.warn(`[${w6}] org-fs credential re-mint failed: ${X instanceof Error?X.message:String(X)}`),$.orgFsConfigJson}}function bm4($){let Z={};if($.branch)Z.branch=$.branch;if($.repo)Z.repo=$.repo;if($.workload)Z.workload=$.workload;if($.env&&Object.keys($.env).length>0)Z.env=$.env;if($.tenant)Z.tenant=$.tenant;if($.cloneOnly)Z.cloneOnly=!0;if($.purpose)Z.purpose=$.purpose;if($.orgFsConfigJson)Z.orgFsConfigJson=$.orgFsConfigJson;return Object.keys(Z).length>0?Z:null}function ym4($,Z){try{return new URL(NK0($,Z)).hostname||null}catch{return null}}var w6="AgentSandboxProvider",Pv="x-sandbox-preview-not-ready",Hm4="agent-sandbox-system",Fm4="studio-sandbox",Um4=300000,WN=9000,CV$=3000,_91="/app",Nm4=32,Bm4,Om4=900000,Lm4=60000,Dm4=1800000,eP0=3,_V$=1800000,wm4=900000,Em4=1800000,jm4,vV$,b91=40000,yV$=1e4,zm4=256,qQ,gK,Im4,qm4=63,Mm4,km4=253;var gV$=L(()=>{Z4();uA$();UV$();wV$();N61();_K0();VK0();AV$();C91();Bm4=new Set(["DAEMON_TOKEN","DAEMON_BOOT_ID","APP_ROOT","PROXY_PORT"]),jm4=["cookie","host","connection","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","accept-encoding","content-length","upgrade"],vV$=["connection","keep-alive","transfer-encoding","content-encoding","content-length"];qQ={role:"studio.decocms.com/role",sandboxHandle:"studio.decocms.com/sandbox-handle",orgId:"studio.decocms.com/org-id",userId:"studio.decocms.com/user-id",env:"studio.decocms.com/env"},gK={orgSlug:"studio.decocms.com/org-slug",orgName:"studio.decocms.com/org-name",userEmail:"studio.decocms.com/user-email",userName:"studio.decocms.com/user-name",gitRepo:"studio.decocms.com/git-repo",gitRepoUrl:"studio.decocms.com/git-repo-url",gitBranch:"studio.decocms.com/git-branch"},Im4=/^([A-Za-z0-9]([-A-Za-z0-9_.]*[A-Za-z0-9])?)?$/;Mm4=/^[a-z]([a-z0-9-]{0,30}[a-z0-9])?$/});var hV$={};s(hV$,{parseTenantPools:()=>TV$,PREVIEW_NOT_READY_HEADER:()=>Pv,AgentSandboxProvider:()=>g91});var h91=L(()=>{gV$();C91()});var lV$={};s(lV$,{subscribeLifecycle:()=>i91,getOrInitSharedRunner:()=>d91,getAgentSandboxProviderForTeardown:()=>m91,getAgentSandboxProvider:()=>MQ,__resetSharedLifecyclesForTesting:()=>nm4});function c91($){let Z=Ta[uV$];if(Z)return Promise.resolve(Z);let X=Ta[u91];if(X)return X;let Q=$().then((Y)=>{return Ta[uV$]=Y,Y}).finally(()=>{delete Ta[u91]});return Ta[u91]=Q,Q}function gm4(){let $=process.env.STUDIO_SANDBOX_PREVIEW_URL_PATTERN;return $&&$.trim()!==""?$:void 0}function hm4(){let $=process.env.STUDIO_SANDBOX_TEMPLATE_NAME;return $&&$.trim()!==""?$:void 0}function um4(){let $=process.env.STUDIO_ENV;return $&&$.trim()!==""?$:void 0}function cm4(){let $=process.env.STUDIO_SANDBOX_SENTINEL_TOKEN;return $&&$.trim()!==""?$:void 0}function lm4(){let $=process.env.STUDIO_SANDBOX_PREVIEW_GATEWAY_NAME?.trim(),Z=process.env.STUDIO_SANDBOX_PREVIEW_GATEWAY_NAMESPACE?.trim();if(!$&&!Z)return;if(!$||!Z)throw Error("STUDIO_SANDBOX_PREVIEW_GATEWAY_NAME and STUDIO_SANDBOX_PREVIEW_GATEWAY_NAMESPACE must both be set, or both unset. Half-configured per-claim HTTPRoute routing would silently fail to attach.");return{name:$,namespace:Z}}async function l91($){let Z=new sr($),X=gm4(),{AgentSandboxProvider:Q,parseTenantPools:Y}=await Promise.resolve().then(() => (h91(),hV$)),G=new zU(x0().encryptionKey);return new Q({stateStore:Z,previewUrlPattern:X,sandboxTemplateName:hm4(),envName:um4(),previewGateway:lm4(),sentinelToken:cm4(),tenantPools:Y(process.env.STUDIO_SANDBOX_TENANT_POOLS),meter:F$,mintCloneUrl:async(J,K)=>{if(!J.connectionId)return null;let W=zA$(J.cloneUrl);if(!W)return null;let{cloneUrl:H}=await _H(J.connectionId,W.owner,W.name,$,G,{bufferMs:K?.bufferMs});return H},mintOrgFsConfig:async(J)=>{if(!J.orgSlug)return null;return await MK0({boundAuth:{apiKey:{create:(W)=>X8.api.createApiKey({body:{...W,userId:J.userId}})}},storage:{orgRepoSyncs:new pz($)}},{orgSlug:J.orgSlug,orgId:J.orgId,baseUrl:p9()})??null}})}function MQ($){if(!x0().agentSandboxEnabled)throw Error("Agent sandbox is disabled. Set STUDIO_AGENT_SANDBOX_ENABLED=true to enable it.");return c91(()=>l91($.db))}function m91($){return c91(()=>l91($.db))}async function d91(){if(!x0().agentSandboxEnabled)return null;return c91(()=>l91(h$().db))}function i91($,Z,X){let Q=TD.get(Z);if(Q){if(Q.terminated){if(Q.lastPhase)try{X(Q.lastPhase)}catch{}return{unsubscribe:im4}}if(Q.listeners.add(X),Q.lastPhase)try{X(Q.lastPhase)}catch{}return cV$(Z,Q,X)}let Y=new AbortController,G={lastPhase:null,terminated:!1,listeners:new Set([X]),abort:Y};return TD.set(Z,G),pm4($,Z,G),cV$(Z,G,X)}function im4(){}function cV$($,Z,X){return{unsubscribe(){if(TD.get($)!==Z)return;if(Z.listeners.delete(X),Z.listeners.size===0)TD.delete($),Z.abort.abort()}}}async function pm4($,Z,X){let Q=null;try{for await(let Y of $.watchClaimLifecycle(Z,X.abort.signal)){if(X.abort.signal.aborted)break;X.lastPhase=Y;let G=Y.kind==="ready"||Y.kind==="failed";if(G)X.terminated=!0;let J=Array.from(X.listeners);for(let K of J)try{K(Y)}catch{}if(G)break}}catch(Y){Q=Y}finally{if(!X.terminated&&!X.abort.signal.aborted&&X.listeners.size>0){let Y={kind:"failed",reason:"unknown",message:Q instanceof Error?Q.message:"Lifecycle watcher ended unexpectedly"};X.lastPhase=Y,X.terminated=!0;for(let G of Array.from(X.listeners))try{G(Y)}catch{}}if(TD.get(Z)===X)TD.delete(Z)}}function nm4(){for(let $ of TD.values())$.abort.abort();TD.clear()}var uV$,u91,Ta,mm4,dm4,TD;var hK=L(()=>{GX();O6();I61();Pu();op();z$();iz();PG();o5();uV$=Symbol.for("decocms.sandbox.lifecycle.agent-sandbox-runner"),u91=Symbol.for("decocms.sandbox.lifecycle.agent-sandbox-inflight"),Ta=globalThis;mm4=Symbol.for("decocms.sandbox.lifecycle.shared-lifecycles"),dm4=globalThis,TD=dm4[mm4]??=new Map});async function Ra($,Z,X){try{await $.storage.threads.stampRuntimeIfAbsent(Z,X)}catch(Q){console.warn(`[stampRuntimeIfAbsent] ${Z}: ${Q instanceof Error?Q.message:String(Q)}`)}}function mV$($){let Z=$?.trim();if(!Z)return null;try{let X=new URL(Z);if(X.protocol!=="http:"&&X.protocol!=="https:")return null;return X.href}catch{return null}}function $A0($){return mV$($?.previewServerUrl)??mV$($?.productionUrl)}var p91=()=>{};function Av($){return $==="cms"||$==="sandbox"?$:null}function tm4($){return!!$A0($)&&$?.fastPreview===!0}function ZA0($){return tm4($)?"cms":"sandbox"}var n91;var gu=L(()=>{p91();n91=["cms","sandbox"]});function dV$($){let{current:Z,detached:X,base:Q}=$.status??{};if(typeof Z!=="string"||Z.length===0)return null;if(X===!0)return null;if(Z===$.requestedRef)return null;if(om4.has(Z))return null;if(typeof Q==="string"&&Q.length>0&&Z===Q)return null;return Z}function XA0($){if(!$.branch.startsWith("thread:"))return $.branch;if($.sticky&&$.recordedHeadRef)return $.recordedHeadRef;return $.derivedRef}var om4;var QA0=L(()=>{om4=new Set(["main","master","trunk","develop","HEAD"])});import{z as HN}from"zod";async function hu($,Z){a(Z);let X=r(Z),Q=a0(Z);if(!Q)throw Error("User ID required");let Y=await Z.storage.virtualMcps.findById($.virtualMcpId);if(!Y||Y.organization_id!==X.id)throw Error("Virtual MCP not found");let G=Y.metadata??{},J=await lz(Z,$.branch,Q),K=CH(g9(G),J,$.branch),W=await MQ(Z);if(K){if(await W.alive(K.sandboxHandle).catch(()=>!0))return K;await KD(Z.storage.virtualMcps,$.virtualMcpId,Q,J,$.branch).catch((O)=>{console.warn("[ensureSandbox] failed to reap stale entry",O)})}let H=dJ($.branch)??Z.metadata?.threadId;if(H)Ra(Z,H,"sandbox");let U=await HD(Z,H)??G.githubRepo??null;await $.onColdStart?.().catch(()=>{});let{entry:N}=await pV$({ctx:Z,userId:Q,sandboxUserId:J,orgId:X.id,virtualMcpId:$.virtualMcpId,branch:$.branch,metadata:G,githubRepo:U,threadRepos:await w61(Z,H),existing:null,runner:W,...$.purpose?{purpose:$.purpose}:{}});return N}async function rm4($){let Z=$.primary?`${$.primary.owner}/${$.primary.name}`.toLowerCase():null,X=$.repos.filter((G)=>`${G.owner}/${G.name}`.toLowerCase()!==Z),Q=ir(X),Y=[];for(let[G,J]of X.entries()){if(!J.connectionId)continue;try{let{cloneUrl:K}=await _H(J.connectionId,J.owner,J.name,$.ctx.db,$.ctx.vault);Y.push({cloneUrl:K,connectionId:J.connectionId,userName:$.gitUserName,userEmail:$.gitUserEmail,displayName:`${J.owner}/${J.name}`,directoryName:Q[G],submoduleCredentials:[]})}catch(K){console.warn(`[provisionSandbox] skipping secondary ${J.owner}/${J.name}:`,K instanceof Error?K.message:K)}}return Y}async function pV$($){let{ctx:Z,userId:X,sandboxUserId:Q,orgId:Y,virtualMcpId:G,branch:J,metadata:K,threadRepos:W,existing:H,runner:F,purpose:U}=$,N=U==="harness-run",B=$.githubRepo?await am4({ctx:Z,orgId:Y,virtualMcpId:G,userId:X,githubRepo:$.githubRepo}):null,{runtime:O,packageManager:D,port:w,packageManagerPath:E}=sP$(K),j;if(B){if(B.connectionId)await ND({ctx:Z,connectionId:B.connectionId,organizationId:Y,forceRefresh:!0,onLegacyMintError:(M0)=>{console.error("[provisionSandbox] repo-scoped legacy token mint failed",{connectionId:B.connectionId,error:M0.message})}});let{cloneUrl:o,gitUserName:t,gitUserEmail:D0}=B.connectionId?await _H(B.connectionId,B.owner,B.name,Z.db,Z.vault):KA$(B.owner,B.name);if(!D){let M0=B.connectionId?await FA$(B.connectionId,B.owner,B.name,Z.db,Z.vault):await UA$(B.owner,B.name);if(M0)D=M0.packageManager,O=pr[M0.packageManager].runtime,w=M0.devPort??w,await sm4(Z,G,X,M0.packageManager,M0.devPort)}let e=x0().sandboxStickyHeadRefEnabled,E0=XA0({branch:J,derivedRef:$N(J),recordedHeadRef:e?await pP$(Z,dJ(J)):null,sticky:e}),u0=await ZA$({ctx:Z,orgId:Y,userId:X,entries:rP$(K)});j={cloneUrl:o,...B.connectionId?{connectionId:B.connectionId}:{},userName:t,userEmail:D0,branch:E0,displayName:`${B.owner}/${B.name}`,submoduleCredentials:u0}}let z=await rm4({ctx:Z,orgId:Y,repos:W??[],primary:B,gitUserName:j?.userName??"",gitUserEmail:j?.userEmail??""}),P=O&&D&&!N?{runtime:O,packageManager:D,...w!==null?{devPort:Number(w)}:{},...E?{packageManagerPath:E}:{}}:void 0,A=lr({orgId:Y,virtualMcpId:G,branch:J}),I=!x0().orgFsMountsDisabled,V;if(I){let o=Z.organization?.slug??(await Z.db.selectFrom("organization").select(["slug"]).where("id","=",Y).executeTakeFirst())?.slug;if(o)V=await MK0(Z,{orgSlug:o,orgId:Y,baseUrl:p9()})}await $d4(F);let q=await F.ensure({userId:Q,projectRef:A},{branch:J,repo:j,extraRepos:z,workload:P,cloneOnly:N,...U?{purpose:U}:{},tenant:{orgId:Y,userId:Q,...Z.organization?.slug?{orgSlug:Z.organization.slug}:{},...Z.organization?.name?{orgName:Z.organization.name}:{},...Z.auth.user?.email?{userEmail:Z.auth.user.email}:{},...Z.auth.user?.name?{userName:Z.auth.user.name}:{}},...V?{orgFsConfigJson:V}:{}}),S=ju(K);await wK0({ctx:Z,runner:F,handle:q.handle,orgId:Y,userId:X,entries:S});let f=!!H&&H.sandboxHandle===q.handle&&H?.createdAt?H.createdAt:Date.now(),b=K.runtime?.selected??null,l=K.runtime?.port??null,y=K.runtime?.path??null,p={sandboxHandle:q.handle,previewUrl:q.previewUrl,createdAt:f,startedWith:{packageManager:b,port:l,path:y}};await fP$(Z.storage.virtualMcps,G,X,Q,J,p);let Q0=dJ(J)??Z.metadata?.threadId;if(Q0)await tP$(Z,Q0,Q,J,p);let L0=!H||H.sandboxHandle!==q.handle;return{entry:p,isNewVm:L0}}async function am4($){let{ctx:Z,orgId:X,virtualMcpId:Q,userId:Y,githubRepo:G}=$;if(!G.connectionId)return G;if(await Z.storage.connections.findById(G.connectionId,X))return G;let{items:K}=await Z.storage.connections.list(X),W=T30(K,G.owner,G.name);if(!W)return console.warn("[provisionSandbox] recorded repo connection no longer exists and no live connection covers the repo",{virtualMcpId:Q,connectionId:G.connectionId}),G;console.warn("[provisionSandbox] healed dangling repo connection",{virtualMcpId:Q,staleConnectionId:G.connectionId,connectionId:W.id});try{let F=(await Z.storage.virtualMcps.findById(Q))?.metadata??{},U=F.githubRepo;if(U?.connectionId===G.connectionId){let N=h5(W);await Z.storage.virtualMcps.update(Q,Y,{metadata:{...F,githubRepo:{...U,connectionId:W.id,...N?{installationId:N.installationId}:{}}}})}}catch(H){console.warn("[provisionSandbox] failed to persist healed repo connection",{virtualMcpId:Q,error:H.message})}return{...G,connectionId:W.id}}async function sm4($,Z,X,Q,Y){let G=await $.storage.virtualMcps.findById(Z);if(!G)return;let J=G.metadata??{};await $.storage.virtualMcps.update(Z,X,{metadata:{...J,runtime:{selected:Q,port:Y}}})}async function $d4($){let Z=Date.now()+iV$,X=!1;while(!await $.hasSchedulableCapacity()){if(Date.now()>=Z)throw Error(`sandbox provisioning failed: the cluster has had no room to schedule another sandbox for ${Math.round(iV$/1000)}s`);if(!X)X=!0,console.warn("[ensureSandbox] waiting for cluster capacity \u2014 a sandbox pod cannot be scheduled right now");await H$(em4)}}var t91,iV$=150000,em4=5000;var Ia=L(()=>{dr();Z4();k0();nr();P61();XA$();zY();WY();Pu();BA$();O61();hK();gu();xK();QA0();z$();o5();iz();zY();t91=c({name:"SANDBOX_START",description:"Start a sandbox with the connected GitHub repo and dev server.",annotations:{title:"Start VM Preview",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!1,openWorldHint:!0},_meta:{ui:{visibility:"app"}},inputSchema:HN.object({virtualMcpId:HN.string().describe("Virtual MCP ID"),branch:HN.string().min(1).optional().describe("Git branch to check out. Pass the thread's branch whenever the caller has one: when omitted the handler mints a fresh `<user-slug>-<timestamp>` name, which becomes a SEPARATE sandbox from the one the thread's own branch resolves to. The resolved branch is returned in the response so callers can persist it."),threadId:HN.string().optional().describe("The session asking for a sandbox. A thread stamped `cms` is refused \u2014 that session reads and writes over the decofile API and a pod would be invisible to it. Optional: an unstamped (legacy) thread is always allowed, and so is a caller with no thread.")}),outputSchema:HN.object({previewUrl:HN.string().nullable(),sandboxHandle:HN.string(),branch:HN.string(),isNewVm:HN.boolean()}),handler:async($,Z)=>{a(Z);let X=r(Z);await Z.access.check();let Q=$.branch??PK0(zK0(Z.auth.user)),Y=dJ(Q)??$.threadId??Z.metadata?.threadId;if(Y){let D=await Z.storage.threads.get(Y).catch(()=>null);if(Av(D?.metadata?.runtime)==="cms")throw Error("This chat is a CMS session and does not use a sandbox. Start a coding session to get one.")}let G=a0(Z);if(!G)throw Error("User ID required");let J=await lz(Z,Q,G),K=await Z.storage.virtualMcps.findById($.virtualMcpId);if(!K||K.organization_id!==X.id)throw Error("Virtual MCP not found");let W=K.metadata??{},H=await MQ(Z),F=CH(g9(W),J,Q),N=await HD(Z,dJ(Q)??Z.metadata?.threadId)??W.githubRepo??null,{entry:B,isNewVm:O}=await pV$({ctx:Z,userId:G,sandboxUserId:J,orgId:X.id,virtualMcpId:$.virtualMcpId,branch:Q,metadata:W,githubRepo:N,threadRepos:await w61(Z,dJ(Q)??Z.metadata?.threadId),existing:F,runner:H});if(Y)Ra(Z,Y,"sandbox");return{...B,branch:Q,isNewVm:O}}})});function Zd4($){let{publicUrl:Z,agentId:X,organization:Q,target:Y,threadId:G}=$;if(Y==="agent-tools")return`${Z}/mcp/virtual-mcp/${encodeURIComponent(X)}`;if(!Q.slug)throw new tV$(Q.id,Y);if(Y==="task-run"){if(!G)throw Error("a task-run MCP endpoint is scoped to a run: threadId is required");return`${Z}/api/${Q.slug}/mcp/task-run/${encodeURIComponent(G)}`}return`${Z}/api/${Q.slug}/mcp/self`}async function YA0($,Z,X,Q,Y="agent-tools",G,J={"*":["*"]}){let K=Zd4({publicUrl:p9(),agentId:Z,organization:X,target:Y,...G?{threadId:G}:{}}),W=await $.boundAuth.apiKey.create({name:Q,permissions:J,expiresIn:nV$,metadata:{organization:{id:X.id,slug:X.slug,name:X.name}}});return{url:K,headers:{Authorization:`Bearer ${W.key}`,"x-org-id":X.id},expiresAt:Date.now()+nV$*1000}}function oV$($){let{publicUrl:Z,organizationSlug:X,headers:Q,connections:Y}=$,G=new Set;return Y.map((J)=>{let K=Xd4(J.slug??J.title??"")||"mcp",W=K;for(let H=2;G.has(W);H++)W=`${K}-${H}`;return G.add(W),{name:W,url:`${Z}/api/${X}/mcp/${encodeURIComponent(J.id)}`,headers:Q}})}function Xd4($){return $.toLowerCase().replace(/[^a-z0-9]+/g,"-").replace(/^-+|-+$/g,"")}function rV$($){return{self:[...$.toolNames],...$.grants}}var nV$=3600,tV$;var o91=L(()=>{o5();tV$=class tV$ extends Error{constructor($,Z){super(`cannot mint a "${Z}" MCP endpoint for organization "${$}": the org-scoped path needs the org slug, which was not loaded.`);this.name="MissingOrganizationSlugError"}}});async function Qd4($,Z,X,Q){try{let Y=$.organization;if(!Y)return;let G=await YA0($,Q.virtualMcpId,Y,"tool-scripting"),J=await Z.proxyDaemonRequest(X,"/_sandbox/tools/sync",{method:"POST",headers:new Headers({"content-type":"application/json"}),body:JSON.stringify(G)});if(!J.ok)console.warn("[agent-sandbox-fs] tools/sync failed",J.status,await J.text().catch(()=>""))}catch(Y){console.warn("[agent-sandbox-fs] tools/sync failed",Y)}}async function uu($,Z){let X=await MQ($),Q=null,Y=()=>{if(!Q){if(Q=hu({virtualMcpId:Z.virtualMcpId,branch:Z.branch},$).then((K)=>K.sandboxHandle),Q.catch(()=>{Q=null}),Z.syncTools)Q.then((K)=>Qd4($,X,K,{virtualMcpId:Z.virtualMcpId})).catch(()=>{})}return Q},G=Z.branch==="ephemeral";return B61(X,{ensureHandle:Y,invalidateHandle:async(K)=>{if(Q=null,!G&&!K?.force)return;try{await KD($.storage.virtualMcps,Z.virtualMcpId,Z.userId,Z.userId,Z.branch)}catch(W){console.warn("[agent-sandbox-fs] failed to reap vmMap entry",W)}},canAutoRestart:G,threadId:Z.threadId})}async function aV$($,Z){try{let X=await uu($,Z),{stdout:Q}=await X.onBash("test -d .deco && echo __DECO_SITE__");return Q.includes("__DECO_SITE__")}catch(X){return console.warn("[agent-sandbox-fs] .deco probe failed; assuming deco site",X),!0}}var GA0=L(()=>{dr();o91();hK();Ia();zY()});import{z as sV$}from"zod";function cu($){let Z=[];for(let X of $){if(X.status!=="active")continue;let Q=h5(X);if(!Q)continue;Z.push({connectionId:X.id,owner:Q.owner,repo:Q.repo,installationId:Q.installationId})}return Z}async function Gd4($,Z){let{items:X}=await $.storage.connections.list(Z,{slug:"mcp-github"});return cu(X)}function Jd4($){let Z=$.split(`
+`);return l4.from(X)};Kl4.decodePax=function(Z){let X={};while(Z.length){let Q=0;while(Q<Z.length&&Z[Q]!==32)Q++;let Y=parseInt(l4.toString(Z.subarray(0,Q)),10);if(!Y)return X;let G=l4.toString(Z.subarray(Q+1,Y-1)),J=G.indexOf("=");if(J===-1)return X;X[G.slice(0,J)]=G.slice(J+1),Z=Z.subarray(Y)}return X};Kl4.encode=function(Z){let X=l4.alloc(512),Q=Z.name,Y="";if(Z.typeflag===5&&Q[Q.length-1]!=="/")Q+="/";if(l4.byteLength(Q)!==Q.length)return null;while(l4.byteLength(Q)>100){let G=Q.indexOf("/");if(G===-1)return null;Y+=Y?"/"+Q.slice(0,G):Q.slice(0,G),Q=Q.slice(G+1)}if(l4.byteLength(Q)>100||l4.byteLength(Y)>155)return null;if(Z.linkname&&l4.byteLength(Z.linkname)>100)return null;if(l4.write(X,Q),l4.write(X,AD(Z.mode&4095,6),100),l4.write(X,AD(Z.uid,6),108),l4.write(X,AD(Z.gid,6),116),Gl4(Z.size,X,124),l4.write(X,AD(Z.mtime.getTime()/1000|0,11),136),X[156]=48+Ql4(Z.type),Z.linkname)l4.write(X,Z.linkname,157);if(l4.copy(jM$,X,257),l4.copy(rc4,X,263),Z.uname)l4.write(X,Z.uname,265);if(Z.gname)l4.write(X,Z.gname,297);if(l4.write(X,AD(Z.devmajor||0,6),329),l4.write(X,AD(Z.devminor||0,6),337),Y)l4.write(X,Y,345);return l4.write(X,AD(PM$(X),6),148),X};Kl4.decode=function(Z,X,Q){let Y=Z[156]===0?0:Z[156]-48,G=fu(Z,0,100,X),J=PD(Z,100,8),K=PD(Z,108,8),W=PD(Z,116,8),H=PD(Z,124,12),F=PD(Z,136,12),U=Xl4(Y),N=Z[157]===0?null:fu(Z,157,100,X),B=fu(Z,265,32),O=fu(Z,297,32),D=PD(Z,329,8),w=PD(Z,337,8),E=PM$(Z);if(E===256)return null;if(E!==PD(Z,148,8))throw Error("Invalid tar header. Maybe the tar is corrupted or it needs to be gunzipped?");if(ec4(Z)){if(Z[345])G=fu(Z,345,155,X)+"/"+G}else if($l4(Z));else if(!Q)throw Error("Invalid tar header: unknown format.");if(Y===0&&G&&G[G.length-1]==="/")Y=5;return{name:G,mode:J,uid:K,gid:W,size:H,mtime:new Date(1000*F),type:U,linkname:N,uname:B,gname:O,devmajor:D,devminor:w,pax:null}};function ec4($){return l4.equals(jM$,$.subarray(257,263))}function $l4($){return l4.equals(ac4,$.subarray(257,263))&&l4.equals(sc4,$.subarray(263,265))}function Zl4($,Z,X){if(typeof $!=="number")return X;if($=~~$,$>=Z)return Z;if($>=0)return $;if($+=Z,$>=0)return $;return 0}function Xl4($){switch($){case 0:return"file";case 1:return"link";case 2:return"symlink";case 3:return"character-device";case 4:return"block-device";case 5:return"directory";case 6:return"fifo";case 7:return"contiguous-file";case 72:return"pax-header";case 55:return"pax-global-header";case 27:return"gnu-long-link-path";case 28:case 30:return"gnu-long-path"}return null}function Ql4($){switch($){case"file":return 0;case"link":return 1;case"symlink":return 2;case"character-device":return 3;case"block-device":return 4;case"directory":return 5;case"fifo":return 6;case"contiguous-file":return 7;case"pax-header":return 72}return 0}function zM$($,Z,X,Q){for(;X<Q;X++)if($[X]===Z)return X;return Q}function PM$($){let Z=256;for(let X=0;X<148;X++)Z+=$[X];for(let X=156;X<512;X++)Z+=$[X];return Z}function AD($,Z){if($=$.toString(8),$.length>Z)return"7777777777777777777".slice(0,Z)+" ";return"0000000000000000000".slice(0,Z-$.length)+$+" "}function Yl4($,Z,X){Z[X]=128;for(let Q=11;Q>0;Q--)Z[X+Q]=$&255,$=Math.floor($/256)}function Gl4($,Z,X){if($.toString(8).length>11)Yl4($,Z,X);else l4.write(Z,AD($,11),X)}function Jl4($){let Z;if($[0]===128)Z=!0;else if($[0]===255)Z=!1;else return null;let X=[],Q;for(Q=$.length-1;Q>0;Q--){let J=$[Q];if(Z)X.push(J);else X.push(255-J)}let Y=0,G=X.length;for(Q=0;Q<G;Q++)Y+=X[Q]*Math.pow(256,Q);return Z?Y:-1*Y}function PD($,Z,X){if($=$.subarray(Z,Z+X),Z=0,$[Z]&128)return Jl4($);else{while(Z<$.length&&$[Z]===32)Z++;let Q=Zl4(zM$($,32,Z,$.length),$.length,$.length);while(Z<Q&&$[Z]===0)Z++;if(Q===Z)return 0;return parseInt(l4.toString($.subarray(Z,Q)),8)}}function fu($,Z,X,Q){return l4.toString($.subarray(Z,zM$($,0,Z,Z+X)),Q)}function E91($){let Z=l4.byteLength($),X=Math.floor(Math.log(Z)/Math.log(10))+1;if(Z+X>=Math.pow(10,X))X++;return Z+X+$}});var kM$=v((T5Z,VM$)=>{var{Writable:Bl4,Readable:Ol4,getStreamError:AM$}=w91(),Ll4=U91(),TM$=xu(),bu=j91(),Dl4=TM$.alloc(0);class RM${constructor(){this.buffered=0,this.shifted=0,this.queue=new Ll4,this._offset=0}push($){this.buffered+=$.byteLength,this.queue.push($)}shiftFirst($){return this._buffered===0?null:this._next($)}shift($){if($>this.buffered)return null;if($===0)return Dl4;let Z=this._next($);if($===Z.byteLength)return Z;let X=[Z];while(($-=Z.byteLength)>0)Z=this._next($),X.push(Z);return TM$.concat(X)}_next($){let Z=this.queue.peek(),X=Z.byteLength-this._offset;if($>=X){let Q=this._offset?Z.subarray(this._offset,Z.byteLength):Z;return this.queue.shift(),this._offset=0,this.buffered-=X,this.shifted+=X,Q}return this.buffered-=$,this.shifted+=$,Z.subarray(this._offset,this._offset+=$)}}class IM$ extends Ol4{constructor($,Z,X){super();this.header=Z,this.offset=X,this._parent=$}_read($){if(this.header.size===0)this.push(null);if(this._parent._stream===this)this._parent._update();$(null)}_predestroy(){this._parent.destroy(AM$(this))}_detach(){if(this._parent._stream===this)this._parent._stream=null,this._parent._missing=MM$(this.header.size),this._parent._update()}_destroy($){this._detach(),$(null)}}class qM$ extends Bl4{constructor($){super($);if(!$)$={};this._buffer=new RM$,this._offset=0,this._header=null,this._stream=null,this._missing=0,this._longHeader=!1,this._callback=z91,this._locked=!1,this._finished=!1,this._pax=null,this._paxGlobal=null,this._gnuLongPath=null,this._gnuLongLinkPath=null,this._filenameEncoding=$.filenameEncoding||"utf-8",this._allowUnknownFormat=!!$.allowUnknownFormat,this._unlockBound=this._unlock.bind(this)}_unlock($){if(this._locked=!1,$){this.destroy($),this._continueWrite($);return}this._update()}_consumeHeader(){if(this._locked)return!1;this._offset=this._buffer.shifted;try{this._header=bu.decode(this._buffer.shift(512),this._filenameEncoding,this._allowUnknownFormat)}catch($){return this._continueWrite($),!1}if(!this._header)return!0;switch(this._header.type){case"gnu-long-path":case"gnu-long-link-path":case"pax-global-header":case"pax-header":return this._longHeader=!0,this._missing=this._header.size,!0}if(this._locked=!0,this._applyLongHeaders(),this._header.size===0||this._header.type==="directory")return this.emit("entry",this._header,this._createStream(),this._unlockBound),!0;return this._stream=this._createStream(),this._missing=this._header.size,this.emit("entry",this._header,this._stream,this._unlockBound),!0}_applyLongHeaders(){if(this._gnuLongPath)this._header.name=this._gnuLongPath,this._gnuLongPath=null;if(this._gnuLongLinkPath)this._header.linkname=this._gnuLongLinkPath,this._gnuLongLinkPath=null;if(this._pax){if(this._pax.path)this._header.name=this._pax.path;if(this._pax.linkpath)this._header.linkname=this._pax.linkpath;if(this._pax.size)this._header.size=parseInt(this._pax.size,10);this._header.pax=this._pax,this._pax=null}}_decodeLongHeader($){switch(this._header.type){case"gnu-long-path":this._gnuLongPath=bu.decodeLongPath($,this._filenameEncoding);break;case"gnu-long-link-path":this._gnuLongLinkPath=bu.decodeLongPath($,this._filenameEncoding);break;case"pax-global-header":this._paxGlobal=bu.decodePax($);break;case"pax-header":this._pax=this._paxGlobal===null?bu.decodePax($):Object.assign({},this._paxGlobal,bu.decodePax($));break}}_consumeLongHeader(){this._longHeader=!1,this._missing=MM$(this._header.size);let $=this._buffer.shift(this._header.size);try{this._decodeLongHeader($)}catch(Z){return this._continueWrite(Z),!1}return!0}_consumeStream(){let $=this._buffer.shiftFirst(this._missing);if($===null)return!1;this._missing-=$.byteLength;let Z=this._stream.push($);if(this._missing===0){if(this._stream.push(null),Z)this._stream._detach();return Z&&this._locked===!1}return Z}_createStream(){return new IM$(this,this._header,this._offset)}_update(){while(this._buffer.buffered>0&&!this.destroying){if(this._missing>0){if(this._stream!==null){if(this._consumeStream()===!1)return;continue}if(this._longHeader===!0){if(this._missing>this._buffer.buffered)break;if(this._consumeLongHeader()===!1)return!1;continue}let $=this._buffer.shiftFirst(this._missing);if($!==null)this._missing-=$.byteLength;continue}if(this._buffer.buffered<512)break;if(this._stream!==null||this._consumeHeader()===!1)return}this._continueWrite(null)}_continueWrite($){let Z=this._callback;this._callback=z91,Z($)}_write($,Z){this._callback=Z,this._buffer.push($),this._update()}_final($){this._finished=this._missing===0&&this._buffer.buffered===0,$(this._finished?null:Error("Unexpected end of data"))}_predestroy(){this._continueWrite(null)}_destroy($){if(this._stream)this._stream.destroy(AM$(this));$(null)}[Symbol.asyncIterator](){let $=null,Z=null,X=null,Q=null,Y=null,G=this;return this.on("entry",W),this.on("error",(U)=>{$=U}),this.on("close",H),{[Symbol.asyncIterator](){return this},next(){return new Promise(K)},return(){return F(null)},throw(U){return F(U)}};function J(U){if(!Y)return;let N=Y;Y=null,N(U)}function K(U,N){if($)return N($);if(Q){U({value:Q,done:!1}),Q=null;return}if(Z=U,X=N,J(null),G._finished&&Z)Z({value:void 0,done:!0}),Z=X=null}function W(U,N,B){if(Y=B,N.on("error",z91),Z)Z({value:N,done:!1}),Z=X=null;else Q=N}function H(){if(J($),!Z)return;if($)X($);else Z({value:void 0,done:!0});Z=X=null}function F(U){return G.destroy(U),J(U),new Promise((N,B)=>{if(G.destroyed)return N({value:void 0,done:!0});G.once("close",function(){if(U)B(U);else N({value:void 0,done:!0})})})}}}VM$.exports=function(Z){return new qM$(Z)};function z91(){}function MM$($){return $&=511,$&&512-$}});var CM$=v((R5Z,P91)=>{var SM$={S_IFMT:61440,S_IFDIR:16384,S_IFCHR:8192,S_IFBLK:24576,S_IFIFO:4096,S_IFLNK:40960};try{P91.exports=J0("fs").constants||SM$}catch{P91.exports=SM$}});var gM$=v((I5Z,yM$)=>{var{Readable:wl4,Writable:El4,getStreamError:_M$}=w91(),Ev=xu(),yu=CM$(),dP0=j91(),vM$=Ev.alloc(1024);class xM$ extends El4{constructor($,Z,X){super({mapWritable:zl4,eagerOpen:!0});if(this.written=0,this.header=Z,this._callback=X,this._linkname=null,this._isLinkname=Z.type==="symlink"&&!Z.linkname,this._isVoid=Z.type!=="file"&&Z.type!=="contiguous-file",this._finished=!1,this._pack=$,this._openCallback=null,this._pack._stream===null)this._pack._stream=this;else this._pack._pending.push(this)}_open($){if(this._openCallback=$,this._pack._stream===this)this._continueOpen()}_continuePack($){if(this._callback===null)return;let Z=this._callback;this._callback=null,Z($)}_continueOpen(){if(this._pack._stream===null)this._pack._stream=this;let $=this._openCallback;if(this._openCallback=null,$===null)return;if(this._pack.destroying)return $(Error("pack stream destroyed"));if(this._pack._finalized)return $(Error("pack stream is already finalized"));if(this._pack._stream=this,!this._isLinkname)this._pack._encode(this.header);if(this._isVoid)this._finish(),this._continuePack(null);$(null)}_write($,Z){if(this._isLinkname)return this._linkname=this._linkname?Ev.concat([this._linkname,$]):$,Z(null);if(this._isVoid){if($.byteLength>0)return Z(Error("No body allowed for this entry"));return Z()}if(this.written+=$.byteLength,this._pack.push($))return Z();this._pack._drain=Z}_finish(){if(this._finished)return;if(this._finished=!0,this._isLinkname)this.header.linkname=this._linkname?Ev.toString(this._linkname,"utf-8"):"",this._pack._encode(this.header);bM$(this._pack,this.header.size),this._pack._done(this)}_final($){if(this.written!==this.header.size)return $(Error("Size mismatch"));this._finish(),$(null)}_getError(){return _M$(this)||Error("tar entry destroyed")}_predestroy(){this._pack.destroy(this._getError())}_destroy($){this._pack._done(this),this._continuePack(this._finished?null:this._getError()),$()}}class fM$ extends wl4{constructor($){super($);this._drain=A91,this._finalized=!1,this._finalizing=!1,this._pending=[],this._stream=null}entry($,Z,X){if(this._finalized||this.destroying)throw Error("already finalized or destroyed");if(typeof Z==="function")X=Z,Z=null;if(!X)X=A91;if(!$.size||$.type==="symlink")$.size=0;if(!$.type)$.type=jl4($.mode);if(!$.mode)$.mode=$.type==="directory"?493:420;if(!$.uid)$.uid=0;if(!$.gid)$.gid=0;if(!$.mtime)$.mtime=new Date;if(typeof Z==="string")Z=Ev.from(Z);let Q=new xM$(this,$,X);if(Ev.isBuffer(Z))return $.size=Z.byteLength,Q.write(Z),Q.end(),Q;if(Q._isVoid)return Q;return Q}finalize(){if(this._stream||this._pending.length>0){this._finalizing=!0;return}if(this._finalized)return;this._finalized=!0,this.push(vM$),this.push(null)}_done($){if($!==this._stream)return;if(this._stream=null,this._finalizing)this.finalize();if(this._pending.length)this._pending.shift()._continueOpen()}_encode($){if(!$.pax){let Z=dP0.encode($);if(Z){this.push(Z);return}}this._encodePax($)}_encodePax($){let Z=dP0.encodePax({name:$.name,linkname:$.linkname,pax:$.pax}),X={name:"PaxHeader",mode:$.mode,uid:$.uid,gid:$.gid,size:Z.byteLength,mtime:$.mtime,type:"pax-header",linkname:$.linkname&&"PaxHeader",uname:$.uname,gname:$.gname,devmajor:$.devmajor,devminor:$.devminor};this.push(dP0.encode(X)),this.push(Z),bM$(this,Z.byteLength),X.size=$.size,X.type=$.type,this.push(dP0.encode(X))}_doDrain(){let $=this._drain;this._drain=A91,$()}_predestroy(){let $=_M$(this);if(this._stream)this._stream.destroy($);while(this._pending.length){let Z=this._pending.shift();Z.destroy($),Z._continueOpen()}this._doDrain()}_read($){this._doDrain(),$()}}yM$.exports=function(Z){return new fM$(Z)};function jl4($){switch($&yu.S_IFMT){case yu.S_IFBLK:return"block-device";case yu.S_IFCHR:return"character-device";case yu.S_IFDIR:return"directory";case yu.S_IFIFO:return"fifo";case yu.S_IFLNK:return"symlink"}return"file"}function A91(){}function bM$($,Z){if(Z&=511,Z)$.push(vM$.subarray(0,512-Z))}function zl4($){return Ev.isBuffer($)?$:Ev.from($)}});var hM$=v((Pl4)=>{Pl4.extract=kM$();Pl4.pack=gM$()});var lM$=v((M5Z,cM$)=>{cM$.exports=uM$;function uM$($,Z){if($&&Z)return uM$($)(Z);if(typeof $!=="function")throw TypeError("need wrapper function");return Object.keys($).forEach(function(Q){X[Q]=$[Q]}),X;function X(){var Q=Array(arguments.length);for(var Y=0;Y<Q.length;Y++)Q[Y]=arguments[Y];var G=$.apply(this,Q),J=Q[Q.length-1];if(typeof G==="function"&&G!==J)Object.keys(J).forEach(function(K){G[K]=J[K]});return G}}});var R91=v((V5Z,T91)=>{var mM$=lM$();T91.exports=mM$(iP0);T91.exports.strict=mM$(dM$);iP0.proto=iP0(function(){Object.defineProperty(Function.prototype,"once",{value:function(){return iP0(this)},configurable:!0}),Object.defineProperty(Function.prototype,"onceStrict",{value:function(){return dM$(this)},configurable:!0})});function iP0($){var Z=function(){if(Z.called)return Z.value;return Z.called=!0,Z.value=$.apply(this,arguments)};return Z.called=!1,Z}function dM$($){var Z=function(){if(Z.called)throw Error(Z.onceError);return Z.called=!0,Z.value=$.apply(this,arguments)},X=$.name||"Function wrapped with `once`";return Z.onceError=X+" shouldn't be called more than once",Z.called=!1,Z}});var nM$=v((k5Z,pM$)=>{var Rl4=R91(),Il4=function(){},ql4=global.Bare?queueMicrotask:process.nextTick.bind(process),Ml4=function($){return $.setHeader&&typeof $.abort==="function"},Vl4=function($){return $.stdio&&Array.isArray($.stdio)&&$.stdio.length===3},iM$=function($,Z,X){if(typeof Z==="function")return iM$($,null,Z);if(!Z)Z={};X=Rl4(X||Il4);var{_writableState:Q,_readableState:Y}=$,G=Z.readable||Z.readable!==!1&&$.readable,J=Z.writable||Z.writable!==!1&&$.writable,K=!1,W=function(){if(!$.writable)H()},H=function(){if(J=!1,!G)X.call($)},F=function(){if(G=!1,!J)X.call($)},U=function(w){X.call($,w?Error("exited with error code: "+w):null)},N=function(w){X.call($,w)},B=function(){ql4(O)},O=function(){if(K)return;if(G&&!(Y&&(Y.ended&&!Y.destroyed)))return X.call($,Error("premature close"));if(J&&!(Q&&(Q.ended&&!Q.destroyed)))return X.call($,Error("premature close"))},D=function(){$.req.on("finish",H)};if(Ml4($))if($.on("complete",H),$.on("abort",B),$.req)D();else $.on("request",D);else if(J&&!Q)$.on("end",W),$.on("close",W);if(Vl4($))$.on("exit",U);if($.on("end",F),$.on("finish",H),Z.error!==!1)$.on("error",N);return $.on("close",B),function(){if(K=!0,$.removeListener("complete",H),$.removeListener("abort",B),$.removeListener("request",D),$.req)$.req.removeListener("finish",H);$.removeListener("end",W),$.removeListener("close",W),$.removeListener("finish",H),$.removeListener("exit",U),$.removeListener("end",F),$.removeListener("error",N),$.removeListener("close",B)}};pM$.exports=iM$});var rM$=v((S5Z,oM$)=>{var kl4=R91(),Sl4=nM$(),pP0;try{pP0=J0("fs")}catch($){}var ja=function(){},Cl4=typeof process>"u"?!1:/^v?\.0/.test(process.version),nP0=function($){return typeof $==="function"},_l4=function($){if(!Cl4)return!1;if(!pP0)return!1;return($ instanceof(pP0.ReadStream||ja)||$ instanceof(pP0.WriteStream||ja))&&nP0($.close)},vl4=function($){return $.setHeader&&nP0($.abort)},xl4=function($,Z,X,Q){Q=kl4(Q);var Y=!1;$.on("close",function(){Y=!0}),Sl4($,{readable:Z,writable:X},function(J){if(J)return Q(J);Y=!0,Q()});var G=!1;return function(J){if(Y)return;if(G)return;if(G=!0,_l4($))return $.close(ja);if(vl4($))return $.abort();if(nP0($.destroy))return $.destroy();Q(J||Error("stream was destroyed"))}},tM$=function($){$()},fl4=function($,Z){return $.pipe(Z)},bl4=function(){var $=Array.prototype.slice.call(arguments),Z=nP0($[$.length-1]||ja)&&$.pop()||ja;if(Array.isArray($[0]))$=$[0];if($.length<2)throw Error("pump requires two streams per minimum");var X,Q=$.map(function(Y,G){var J=G<$.length-1,K=G>0;return xl4(Y,J,K,function(W){if(!X)X=W;if(W)Q.forEach(tM$);if(J)return;Q.forEach(tM$),Z(X)})});return $.reduce(fl4)};oM$.exports=bl4});var GV$=v((ul4)=>{var aM$=hM$(),sM$=rM$(),eM$=J0("fs"),z9=J0("path"),za=(global.Bare?global.Bare.platform:process.platform)==="win32";ul4.pack=function(Z,X){if(!Z)Z=".";if(!X)X={};let Q=X.fs||eM$,Y=X.ignore||X.filter||Pa,G=X.mapStream||QV$,J=hl4(Q,X.dereference?Q.stat:Q.lstat,Z,Y,X.entries,X.sort),K=X.strict!==!1,W=typeof X.umask==="number"?~X.umask:~$V$(),H=X.pack||aM$.pack(),F=X.finish||Pa,U=X.map||Pa,N=typeof X.dmode==="number"?X.dmode:0,B=typeof X.fmode==="number"?X.fmode:0;if(X.strip)U=YV$(U,X.strip);if(X.readable)N|=parseInt(555,8),B|=parseInt(444,8);if(X.writable)N|=parseInt(333,8),B|=parseInt(222,8);w();function O(E,j){Q.readlink(z9.join(Z,E),function(z,P){if(z)return H.destroy(z);j.linkname=I91(P),H.entry(j,w)})}function D(E,j,z){if(H.destroyed)return;if(E)return H.destroy(E);if(!j){if(X.finalize!==!1)H.finalize();return F(H)}if(z.isSocket())return w();let P={name:I91(j),mode:(z.mode|(z.isDirectory()?N:B))&W,mtime:z.mtime,size:z.size,type:"file",uid:z.uid,gid:z.gid};if(z.isDirectory())return P.size=0,P.type="directory",P=U(P)||P,H.entry(P,w);if(z.isSymbolicLink())return P.size=0,P.type="symlink",P=U(P)||P,O(j,P);if(P=U(P)||P,!z.isFile()){if(K)return H.destroy(Error("unsupported type for "+j));return w()}let A=H.entry(P,w),I=G(Q.createReadStream(z9.join(Z,j),{start:0,end:P.size>0?P.size-1:P.size}),P);I.on("error",function(V){A.destroy(V)}),sM$(I,A)}function w(E){if(E)return H.destroy(E);J(D)}return H};function yl4($){return $.length?$[$.length-1]:null}function gl4(){return!global.Bare&&process.getuid?process.getuid():-1}function $V$(){return!global.Bare&&process.umask?process.umask():0}ul4.extract=function(Z,X){if(!Z)Z=".";if(!X)X={};Z=z9.resolve(Z);let Q=X.fs||eM$,Y=X.ignore||X.filter||Pa,G=X.mapStream||QV$,J=X.chown!==!1&&!za&&gl4()===0,K=X.extract||aM$.extract(),W=[],H=new Date,F=typeof X.umask==="number"?~X.umask:~$V$(),U=X.strict!==!1,N=X.validateSymlinks!==!1,B=X.map||Pa,O=typeof X.dmode==="number"?X.dmode:0,D=typeof X.fmode==="number"?X.fmode:0;if(X.strip)B=YV$(B,X.strip);if(X.readable)O|=parseInt(555,8),D|=parseInt(444,8);if(X.writable)O|=parseInt(333,8),D|=parseInt(222,8);if(K.on("entry",w),X.finish)K.on("finish",X.finish);return K;function w(A,I,V){A=B(A)||A,A.name=I91(A.name);let q=z9.join(Z,z9.join("/",A.name));if(Y(q,A))return I.resume(),V();let S=z9.join(q,".")===z9.join(Z,".")?Z:z9.dirname(q);XV$(Q,S,z9.join(Z,"."),function(p,Q0){if(p)return V(p);if(!Q0)return V(Error(S+" is not a valid path"));if(A.type==="directory")return W.push([q,A.mtime]),P(q,{fs:Q,own:J,uid:A.uid,gid:A.gid,mode:A.mode},d);P(S,{fs:Q,own:J,uid:A.uid,gid:A.gid,mode:493},function(L0){if(L0)return V(L0);switch(A.type){case"file":return y();case"link":return b();case"symlink":return f()}if(U)return V(Error("unsupported type for "+q+" ("+A.type+")"));I.resume(),V()})});function d(p){if(p)return V(p);j(q,A,function(Q0){if(Q0)return V(Q0);if(za)return V();z(q,A,V)})}function f(){if(za)return V();Q.unlink(q,function(){let p=z9.resolve(z9.dirname(q),A.linkname);if(!l(p)&&N)return V(Error(q+" is not a valid symlink"));ZV$(Q,p,z9.join(Z,"."),function(Q0,L0){if(Q0)return V(Q0);if(!L0&&N)return V(Error(q+" is not a valid symlink"));Q.symlink(A.linkname,q,d)})})}function b(){if(za)return V();Q.unlink(q,function(){let p=z9.join(Z,z9.join("/",A.linkname));Q.realpath(p,function(Q0,L0){if(Q0||!l(L0))return V(Error(q+" is not a valid hardlink"));Q.link(L0,q,function(o){if(o&&o.code==="EPERM"&&X.hardlinkAsFilesFallback)return I=Q.createReadStream(L0),y();d(o)})})})}function l(p){return p===Z||p.startsWith(Z+z9.sep)}function y(){let p=Q.createWriteStream(q),Q0=G(I,A);p.on("error",function(L0){Q0.destroy(L0)}),sM$(Q0,p,function(L0){if(L0)return V(L0);p.on("close",d)})}}function E(A,I){let V;while((V=yl4(W))&&A.slice(0,V[0].length)!==V[0])W.pop();if(!V)return I();Q.utimes(V[0],H,V[1],I)}function j(A,I,V){if(X.utimes===!1)return V();if(I.type==="directory")return Q.utimes(A,H,I.mtime,V);if(I.type==="symlink")return E(A,V);Q.utimes(A,H,I.mtime,function(q){if(q)return V(q);E(A,V)})}function z(A,I,V){let q=I.type==="symlink",S=q?Q.lchmod:Q.chmod,d=q?Q.lchown:Q.chown;if(!S)return V();let f=(I.mode|(I.type==="directory"?O:D))&F;if(d&&J)d.call(Q,A,I.uid,I.gid,b);else b(null);function b(l){if(l)return V(l);if(!S)return V();S.call(Q,A,f,V)}}function P(A,I,V){Q.stat(A,function(q){if(!q)return V(null);if(q.code!=="ENOENT")return V(q);Q.mkdir(A,{mode:I.mode,recursive:!0},function(S,d){if(S)return V(S);z(A,I,V)})})}};function ZV$($,Z,X,Q){if(Z===X)return Q(null,!0);if(!Z.startsWith(X+z9.sep))return Q(null,!1);$.lstat(Z,function(Y,G){if(Y&&Y.code!=="ENOENT"&&Y.code!=="EPERM")return Q(Y);if(Y||!G.isSymbolicLink())return ZV$($,z9.join(Z,".."),X,Q);Q(null,!1)})}function XV$($,Z,X,Q){if(Z===X)return Q(null,!0);$.lstat(Z,function(Y,G){if(Y&&Y.code!=="ENOENT"&&Y.code!=="EPERM")return Q(Y);if(Y||G.isDirectory())return XV$($,z9.join(Z,".."),X,Q);Q(null,!1)})}function Pa(){}function QV$($){return $}function I91($){return za?$.replace(/\\/g,"/").replace(/[:?<>|]/g,"_"):$}function hl4($,Z,X,Q,Y,G){if(!Y)Y=["."];let J=Y.slice(0);return function(W){if(!J.length)return W(null);let H=J.shift(),F=z9.join(X,H);Z.call($,F,function(U,N){if(U)return W(Y.indexOf(H)===-1&&U.code==="ENOENT"?null:U);if(!N.isDirectory())return W(null,H,N);$.readdir(F,function(B,O){if(B)return W(B);if(G)O.sort();for(let D=0;D<O.length;D++)if(!Q(z9.join(X,H,O[D])))J.push(z9.join(H,O[D]));W(null,H,N)})})}}function YV$($,Z){return function(X){X.name=X.name.split("/").slice(Z).join("/");let Q=X.linkname;if(Q&&(X.type==="link"||z9.isAbsolute(Q)))X.linkname=Q.split("/").slice(Z).join("/");return $(X)}}});var ml4,dl4;var JV$=L(()=>{H91();ml4=k(nq$(),1),dl4=k(GV$(),1)});var tP0=()=>{};var KV$=L(()=>{KP0()});var WV$=L(()=>{fP0();xP0();tP0()});var HV$=()=>{};var FV$=()=>{};var UV$=L(()=>{Vq$();K91();fP0();vq$();G91();H91();xq$();fq$();bq$();yq$();J91();gq$();JV$();tP0();KV$();WV$();HV$();FV$();tP0()});var oP0=L(()=>{Z4();F61()});function il4($){if($ instanceof TypeError)return!0;if($ instanceof DOMException&&$.name==="AbortError")return!0;return!1}async function q91($,Z,X,Q){try{return await G6(async()=>{let G=await fetch($,{...Z,signal:AbortSignal.timeout(Q)});return{status:G.status,ok:G.ok,body:await G.text()}},{maxAttempts:3,minTimeout:50,maxTimeout:500,multiplier:2,jitter:0.5,isRetriable:il4})}catch(Y){let G=Y instanceof Error?Y.message:String(Y);throw Error(`[SANDBOX_UNREACHABLE] sandbox daemon ${X} request failed: ${G}`,{cause:Y})}}async function aP0($){try{let Z=await fetch(`${$}/health`,{signal:AbortSignal.timeout(pl4)});if(!Z.ok){try{await Z.text()}catch{}return null}let X=await Z.json();if(typeof X==="object"&&X!==null&&typeof X.bootId==="string"&&typeof X.ready==="boolean"&&X.setup&&typeof X.setup.running==="boolean"&&typeof X.setup.done==="boolean")return X;return null}catch{return null}}async function V91($){for(let Z=0;Z<NV$;Z++){if(await aP0($)!==null)return;let X=(Math.random()*2-1)*nl4;await H$(BV$+X)}throw Error(`sandbox daemon at ${$} did not respond on /health within ${NV$*BV$/1000}s`)}async function jv($,Z,X,Q,Y){return tl4($,Z,"POST",X,Q,Y)}async function tl4($,Z,X,Q,Y,G){let J={...Q};if(Y&&Y.rotateToken!==void 0)J.auth=Y;let K=await q91(`${$}/_sandbox/config`,{method:X,headers:{"Content-Type":"application/json",Authorization:`Bearer ${Z}`},body:JSON.stringify(J)},"/_sandbox/config",G?.timeoutMs??M91);if(!K.ok)throw new rP0(K.status,K.body);return DV$(K.body,"/_sandbox/config")}async function OV$($,Z,X){let Q=await q91(`${$}/_sandbox/setup/${X}`,{method:"POST",headers:{Authorization:`Bearer ${Z}`}},`/_sandbox/setup/${X}`,M91);if(!Q.ok)throw Error(`sandbox daemon /_sandbox/setup/${X} returned ${Q.status}: ${Q.body}`)}async function LV$($,Z,X){let Q=await q91(`${$}/_sandbox/orgfs-config`,{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${Z}`},body:X},"/_sandbox/orgfs-config",M91);if(!Q.ok)throw Error(`sandbox daemon /_sandbox/orgfs-config returned ${Q.status}: ${Q.body}`);return DV$(Q.body,"/_sandbox/orgfs-config")}function DV$($,Z){try{return JSON.parse($)}catch(X){throw Error(`sandbox daemon ${Z} returned a malformed JSON body: ${$.slice(0,200)}`,{cause:X})}}async function Aa($,Z,X,Q){let Y=new Headers(Q.headers);for(let K of ol4)Y.delete(K);Y.set("authorization",`Bearer ${Z}`);let G=Q.method!=="GET"&&Q.method!=="HEAD",J=`${$}${X.startsWith("/")?X:`/${X}`}`;return fetch(J,{method:Q.method,headers:Y,body:G?Q.body:void 0,redirect:"manual",signal:Q.signal,duplex:G?"half":void 0})}var rP0,pl4=500,M91=30000,NV$=25,BV$=200,nl4=50,ol4;var wV$=L(()=>{oP0();Z4();rP0=class rP0 extends Error{status;constructor($,Z){super(`sandbox daemon /_sandbox/config returned ${$}: ${Z}`);this.status=$;this.name="ConfigRequestError"}};ol4=["cookie","host","connection","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","accept-encoding","content-length"]});async function*zV$($){let Z=$.now??(()=>Date.now()),X=Z(),Q=$.schedulingTimeoutMs??al4,Y={pod:{},sandbox:{},events:{hasPulling:!1,hasPulled:!1},startedAt:X},G=[],J=null,K=!1,W=(j)=>{if(K)return;if(J){let z=J;J=null,z(j)}else G.push(j)},H=()=>{if(G.length>0)return Promise.resolve(G.shift());if(K)return Promise.resolve(null);return new Promise((j)=>{J=j})},F=()=>{if(K)return;if(K=!0,J){let j=J;J=null,j(null)}},U=new AbortController,N=()=>{U.abort(),F()};if($.signal)if($.signal.aborted)U.abort(),F();else $.signal.addEventListener("abort",N,{once:!0});let B=Math.max(0,Q-(Z()-X)),O=setTimeout(()=>W("tick"),B+100),D,w=new Promise((j)=>{D=j}),E=Promise.allSettled([sl4($.kc,$.namespace,$.claimName,U.signal,Y,W,Z,D),$m4($.kc,$.namespace,$.claimName,U.signal,Y,W),Zm4($.kc,$.namespace,$.claimName,w,U.signal,Y,W,Z)]);try{let j=null,z=-1,P=EV$(Y,Q,Z);if(j=S91(P),!k91(P))z=jV$(P);if(yield P,k91(P))return;while(!K){if(await H()===null)break;let I=EV$(Y,Q,Z);if(k91(I)){let S=S91(I);if(S!==j)j=S,yield I;return}let V=jV$(I);if(V<z)continue;let q=S91(I);if(q!==j)j=q,z=V,yield I}}finally{if(clearTimeout(O),U.abort(),$.signal)$.signal.removeEventListener("abort",N);F(),await E.catch(()=>{})}}function EV$($,Z,X){let{pod:Q,sandbox:Y,events:G,startedAt:J}=$;if(Y.ready)return{kind:"ready"};let K=Q.containerWaitingReason;if(K==="ImagePullBackOff"||K==="ErrImagePull")return{kind:"failed",reason:"image-pull-backoff",message:"Sandbox image failed to download. The cluster may be missing pull credentials or the image tag may not exist."};if(K==="CrashLoopBackOff")return{kind:"failed",reason:"crash-loop-backoff",message:"Sandbox crashed during startup and is now in CrashLoopBackOff. Check pod logs."};if(!Q.scheduled&&G.lastFailedSchedulingAt!==void 0&&X()-J>Z)return{kind:"failed",reason:"scheduling-timeout",message:G.failedSchedulingMessage??`Pod could not be scheduled within ${Math.round(Z/1000)}s.`};if(Q.containerRunning&&!Q.containerReady)return{kind:"warming-daemon",since:J};if(G.hasPulling&&!G.hasPulled)return{kind:"pulling-image",since:J};if(K==="ContainerCreating"||K==="PodInitializing"||Q.scheduled&&!Q.containerRunning)return{kind:"starting-container",since:J};if(Q.scheduledFalseReason==="Unschedulable"||G.lastFailedSchedulingAt!==void 0&&!Q.scheduled)return{kind:"waiting-for-capacity",since:J,message:G.failedSchedulingMessage??Q.scheduledFalseMessage,nodeClaim:G.nominatedNodeClaim};return{kind:"claiming",since:J}}function k91($){return $.kind==="ready"||$.kind==="failed"}function jV$($){switch($.kind){case"claiming":return 0;case"waiting-for-capacity":return 1;case"pulling-image":return 2;case"starting-container":return 3;case"warming-daemon":return 4;case"ready":case"failed":return 99}}function S91($){switch($.kind){case"claiming":case"pulling-image":case"starting-container":case"warming-daemon":return $.kind;case"waiting-for-capacity":return`waiting-for-capacity:${$.message??""}:${$.nodeClaim??""}`;case"ready":return"ready";case"failed":return`failed:${$.reason}:${$.message}`}}async function sl4($,Z,X,Q,Y,G,J,K){let W=`/api/v1/namespaces/${encodeURIComponent(Z)}/pods?watch=true&labelSelector=${encodeURIComponent(`${rl4}=${X}`)}`;return sP0({kc:$,path:W,signal:Q,label:`pod/${X}`,onEvent:(H)=>{if(H.type!=="ADDED"&&H.type!=="MODIFIED")return;let F=H.object;if(F.metadata?.name)K(F.metadata.name);el4(F,Y,J),G("pod")}})}function el4($,Z,X){let Y=($.status?.conditions??[]).find((J)=>J.type==="PodScheduled");if(Y?.status==="True")Z.pod.scheduled=!0,Z.pod.scheduledFalseReason=void 0,Z.pod.scheduledFalseMessage=void 0;else if(Y?.status==="False")Z.pod.scheduled=!1,Z.pod.scheduledFalseReason=Y.reason,Z.pod.scheduledFalseMessage=Y.message;let G=($.status?.containerStatuses??[]).find((J)=>J.name===j9.MAIN_CONTAINER_NAME);if(G)Z.pod.containerWaitingReason=G.state?.waiting?.reason,Z.pod.containerRunning=!!G.state?.running,Z.pod.containerReady=G.ready===!0}async function $m4($,Z,X,Q,Y,G){let J=`/apis/${j9.CLAIM_API_GROUP}/${j9.CLAIM_API_VERSION}/namespaces/${encodeURIComponent(Z)}/${j9.CLAIM_PLURAL}?watch=true&fieldSelector=${encodeURIComponent(`metadata.name=${X}`)}`;return sP0({kc:$,path:J,signal:Q,label:`sandboxclaim/${X}`,onEvent:(K)=>{if(K.type!=="ADDED"&&K.type!=="MODIFIED")return;let H=K.object.status?.conditions?.find((F)=>F.type==="Ready");if(!H)return;if(H.status==="True")Y.sandbox.ready=!0,Y.sandbox.notReadyReason=void 0,Y.sandbox.notReadyMessage=void 0;else Y.sandbox.ready=!1,Y.sandbox.notReadyReason=H.reason,Y.sandbox.notReadyMessage=H.message;G("sandbox")}})}async function Zm4($,Z,X,Q,Y,G,J,K){let W=await Promise.race([Q,new Promise((F)=>{if(Y.aborted){F(X);return}Y.addEventListener("abort",()=>F(X),{once:!0})})]);if(Y.aborted)return;let H=`/api/v1/namespaces/${encodeURIComponent(Z)}/events?watch=true&fieldSelector=${encodeURIComponent(`involvedObject.name=${W},involvedObject.kind=Pod`)}`;return sP0({kc:$,path:H,signal:Y,label:`events/${X}`,onEvent:(F)=>{if(F.type!=="ADDED"&&F.type!=="MODIFIED")return;let U=F.object,N=U.reason;if(!N)return;switch(N){case"Pulling":G.events.hasPulling=!0;break;case"Pulled":G.events.hasPulling=!0,G.events.hasPulled=!0;break;case"FailedScheduling":G.events.lastFailedSchedulingAt=K(),G.events.failedSchedulingMessage=U.message;break;case"Nominated":{let B=U.message?.match(/nodeclaim\/([\w-]+)/);if(B)G.events.nominatedNodeClaim=B[1];break}default:return}J("event")}})}async function PV$($){let{kc:Z,namespace:X,labelSelector:Q,signal:Y,onDelete:G}=$,J=`/apis/${j9.CLAIM_API_GROUP}/${j9.CLAIM_API_VERSION}/namespaces/${encodeURIComponent(X)}/${j9.CLAIM_PLURAL}?watch=true&labelSelector=${encodeURIComponent(Q)}`;return sP0({kc:Z,path:J,signal:Y,label:"sandboxclaim-reaper",onEvent:(K)=>{if(K.type!=="DELETED")return;let W=K.object.metadata?.name;if(W)G(W)}})}async function sP0($){let{kc:Z,path:X,signal:Q,label:Y,onEvent:G}=$,J=0;while(!Q.aborted){try{let W=await VG(Z,{method:"GET",path:X,signal:Q,headers:{accept:"application/json"},stream:!0});if(!W.ok||!W.body){try{await W.body?.cancel()}catch{}if(W.status===401||W.status===403){console.warn(`[lifecycle-watcher] ${Y} stopped: watch denied (${W.status} ${W.statusText}). `+"The kubeconfig in use cannot watch SandboxClaims \u2014 if you are running locally, "+"this provider should not be active (check STUDIO_AGENT_SANDBOX_ENABLED).");return}throw Error(`watch handshake failed: ${W.status} ${W.statusText}`)}J=0;for await(let H of v61(W.body)){if(Q.aborted)return;try{G(H)}catch(F){console.warn(`[lifecycle-watcher] ${Y} onEvent threw: ${F instanceof Error?F.message:String(F)}`)}}}catch(W){if(Q.aborted)return;let H=W instanceof Error?W.message:String(W);console.warn(`[lifecycle-watcher] ${Y} watch ended: ${H}`)}if(Q.aborted)return;let K=B7(5000,250,J,2,0);J+=1,await H$(K,{signal:Q}).catch(()=>{})}}var rl4="studio.decocms.com/sandbox-handle",al4=300000;var AV$=L(()=>{Z4();VK0();_K0()});import{z as tJ}from"zod";function TV$($){if(!$||$.trim()==="")return[];let Z=tJ.array(Xm4).parse(JSON.parse($)),X=new Set;for(let Q of Z){if(X.has(Q.name))throw Error(`STUDIO_SANDBOX_TENANT_POOLS: duplicate pool name ${Q.name}`);X.add(Q.name)}return Z}function Qm4($){try{let[Z,X]=new URL($).pathname.replace(/^\/+/,"").split("/"),Q=X?.replace(/\.git$/,"");return Z&&Q?`${Z}/${Q}`.toLowerCase():null}catch{return null}}function RV$($,Z){let{orgId:X,cloneUrl:Q}=Z;if(Z.purpose==="harness-run")return null;if(!X||!Q)return null;let Y=Qm4(Q);if(!Y)return null;return $.find((G)=>G.orgId===X&&G.repo.toLowerCase()===Y)??null}function IV$($,Z,X){return $?.name??(Z?X:"none")}function Ym4($,Z){return $==="harness-run"?`${Z}-medium`:Z}async function qV$($){let Z=Ym4($.purpose,$.templateName);if(Z===$.templateName)return{name:Z,probe:$.probe};let X=$.probe!==null&&$.now-$.probe.checkedAt<$.ttlMs?$.probe:{checkedAt:$.now,present:await $.exists(Z)};if(X.present)return{name:Z,probe:X};if($.probe?.present!==!1)$.onAbsent?.(Z);return{name:$.templateName,probe:X}}function MV$($,Z,X){let Q=X.replace(/^refs\/heads\//,"");return $.filter((Y)=>Y.repo.toLowerCase()===Z.toLowerCase()&&Y.branch===Q)}function VV$($){return`https://github.com/${$.repo}.git`}var Xm4;var C91=L(()=>{Xm4=tJ.object({name:tJ.string().regex(/^[a-z0-9]([-a-z0-9]*[a-z0-9])?$/,"pool name must be a DNS label (lowercase alphanumeric and '-')"),orgId:tJ.string().min(1),repo:tJ.string().regex(/^[^/\s]+\/[^/\s]+$/,"repo must be `owner/name`"),connectionId:tJ.string().min(1).optional(),branch:tJ.string().min(1).default("main"),workload:tJ.object({runtime:tJ.enum(["node","bun","deno"]).default("node"),packageManager:tJ.enum(["npm","pnpm","yarn","bun","deno"]).optional(),packageManagerPath:tJ.string().optional(),devPort:tJ.number().int().positive().optional()}).default({runtime:"node"})})});async function kV$($,Z,X){let Q=new Map;for(let Y of $){let G=Z(Y);if(!G)continue;let J=Q.get(G);if(J)J.push(Y);else Q.set(G,[Y])}await Promise.allSettled([...Q.values()].map(async(Y)=>{for(let G of Y)await X(G).catch(()=>{})}))}import{createHash as Gm4,randomBytes as Jm4,randomUUID as Km4}from"crypto";import*as bV$ from"net";import{PassThrough as Wm4}from"stream";function SV$($){if($ instanceof Error)return $.message;if($&&typeof $==="object"){let Z=$;if(Z.error instanceof Error)return Z.error.message;if(typeof Z.message==="string"&&Z.message)return Z.message}return String($)}class g91{records=new Map;inflight=new FK0;activeGauge=new HK0;stateStore;previewUrlPattern;kubeConfig;capacityProbe;portForward;namespace;sandboxTemplateName;envName;tokenGenerator;idleTtlMs;metrics;previewGateway;sentinelToken;mintCloneUrl;mintOrgFsConfig;tenantPools;tenantPoolRefreshMs;poolPods=new Map;mediumTemplateProbe=null;dirtyPools=new Set;closed=!1;claimWatchAbort=new AbortController;constructor($={}){this.stateStore=$.stateStore??null,this.previewUrlPattern=$.previewUrlPattern??null,this.kubeConfig=$.kubeConfig??Am4(),this.portForward=new F91(this.kubeConfig),this.namespace=$.namespace??Hm4,this.sandboxTemplateName=$.sandboxTemplateName??Fm4,this.envName=Vm4($.envName),this.tokenGenerator=$.tokenGenerator??(()=>Jm4(Nm4).toString("hex")),this.idleTtlMs=$.idleTtlMs??Om4,this.metrics=$.meter?Pm4($.meter):null,this.previewGateway=$.previewGateway&&$.previewUrlPattern?{...$.previewGateway}:null;let Z=$.sentinelToken?.trim()??"";if(this.sentinelToken=Z.length>0?Z:null,this.mintCloneUrl=$.mintCloneUrl,this.mintOrgFsConfig=$.mintOrgFsConfig,this.tenantPools=this.sentinelToken!==null?$.tenantPools??[]:[],this.sentinelToken===null&&($.tenantPools?.length??0)>0)console.warn(`[${w6}] tenant pools configured without a sentinel token \u2014 ignoring them (warm-pool mode is off)`);this.tenantPoolRefreshMs=$.tenantPoolRefreshMs??Dm4,this.startClaimReaper(),this.startCredentialRefresher(),this.startTenantPoolReconciler()}startClaimReaper(){let $=["app.kubernetes.io/managed-by=studio","app.kubernetes.io/name=studio-sandbox",...this.envName?[`${qQ.env}=${this.envName}`]:[]].join(",");PV$({kc:this.kubeConfig,namespace:this.namespace,labelSelector:$,signal:this.claimWatchAbort.signal,onDelete:(Z)=>this.invalidateRecord(Z)})}async ensure($,Z={}){let X=cz($);if(X.startsWith("s-"))throw Error(`ensure: projectRef has no slug source: ${$.projectRef}`);return this.inflight.run(X,()=>UK0(this.stateStore,$,(Q)=>this.ensureLocked($,X,Z,Q)))}async delete($){let Z=await this.getRecord($);if(this.records.delete($),Z)this.dropRecord(Z);if(await this.deleteHttpRouteIfManaged($).catch((X)=>{console.warn(`[${w6}] HTTPRoute delete failed for ${$}: ${X instanceof Error?X.message:String(X)}`)}),await Tu(this.kubeConfig,this.namespace,$),this.stateStore)if(Z)await this.stateStore.delete(Z.id);else await this.stateStore.deleteByHandle($)}lastTermination($){return VA$(this.kubeConfig,this.namespace,qQ.sandboxHandle,$,j9.MAIN_CONTAINER_NAME)}async alive($){return await ZN(this.kubeConfig,this.namespace,$)!==void 0}watchClaimLifecycle($,Z){return zV$({kc:this.kubeConfig,namespace:this.namespace,claimName:$,signal:Z})}hasSchedulableCapacity(){return this.capacityProbe??=hA$(this.kubeConfig,this.namespace),this.capacityProbe()}async getPreviewUrl($){let Z=await this.getRecord($);if(!Z)return null;return this.composePreviewUrl(Z)}async proxyDaemonRequest($,Z,X){let Q=await this.getRecord($);if(!Q&&this.previewUrlPattern&&this.stateStore){let W=await this.stateStore.getByHandle($),H=W?.state,F=H?.token;if(W&&F){let N=`http://${H?.adoptedSandboxName??$}.${this.namespace}.svc.cluster.local:${WN}`;try{let B=await Aa(N,F,Z,X);if(B.status!==404)return B;try{await B.body?.cancel()}catch{}}catch{}}}if(!Q)Q=await this.resurrectByHandle($);if(!Q)return new Response(JSON.stringify({error:"sandbox not found"}),{status:404,headers:{"content-type":"application/json"}});let Y=Q,G=performance.now(),J=0,K=!(X.body instanceof ReadableStream);try{let W=await Aa(Q.daemonUrl,Q.token,Z,X);if(W.status===401&&K){this.invalidateRecord($);let H=await this.getRecord($).catch(()=>null)??await this.resurrectByHandle($).catch(()=>null);if(H){try{await W.body?.cancel()}catch{}Y=H,W=await Aa(H.daemonUrl,H.token,Z,X)}}return J=W.status,W}catch(W){if(!K)throw W;this.invalidateRecord($);let H=await this.resurrectByHandle($)??await this.getRecord($).catch(()=>null);if(!H)throw W;Y=H;let F=await Aa(H.daemonUrl,H.token,Z,X);return J=F.status,F}finally{this.recordProxyDuration("daemon",J,Y,performance.now()-G)}}async adoptLiveClaim($,Z){if(this.records.has(Z))return!0;let X=await ZN(this.kubeConfig,this.namespace,Z).catch(()=>{return});if(!X||X.metadata?.deletionTimestamp)return!1;return await this.inflight.run(Z,async()=>{let Y=this.records.get(Z);if(Y)return this.toSandbox(Y);let G=await this.adopt($,Z,X);if(!G)throw Error(`cannot adopt live claim ${Z}`);return UK0(this.stateStore,$,(J)=>this.finish(G,J,!0,!0,"adopt"))}).catch(()=>null)!=null}async resolvePreviewUpstreamUrl($){if(this.previewUrlPattern)return`http://${await this.resolveServiceNameForHandle($)}.${this.namespace}.svc.cluster.local:${WN}`;let Z=await this.getRecord($);if(Z)return Z.daemonUrl;let X=await this.resurrectByHandle($);return X?X.daemonUrl:null}async resolveServiceNameForHandle($){let Z=this.records.get($);if(Z)return Z.adoptedSandboxName;if(this.stateStore){let Q=(await this.stateStore.getByHandle($).catch(()=>null))?.state?.adoptedSandboxName;if(Q)return Q}return $}async proxyPreviewRequest($,Z){let X=performance.now(),Q=this.records.get($)??null,Y=0;try{let G=await this.resolvePreviewUpstreamUrl($);if(!G){Y=404;let O=v91(404,{error:"sandbox not found"});return O.headers.set(Pv,"1"),O}let J=new URL(Z.url);if((J.pathname==="/_sandbox"||J.pathname.startsWith("/_sandbox/"))&&Z.method!=="GET")return Y=404,v91(404,{error:"not found"});let W=(O)=>`${O}${J.pathname}${J.search}`,H=new Headers(Z.headers);for(let O of jm4)H.delete(O);let F=Z.method!=="GET"&&Z.method!=="HEAD",U={method:Z.method,headers:H,body:F?Z.body:void 0,redirect:"manual",signal:Z.signal,duplex:F?"half":void 0},N;try{N=await fetch(W(G),U)}catch(O){let D=`${G}${J.pathname}`;if(console.warn(`[${w6}] preview fetch to ${D} failed: ${O instanceof Error?O.message:String(O)}`),Z.method==="GET"||Z.method==="HEAD"){if(this.invalidateRecord($),await this.resurrectByHandle($).catch(()=>null)){let j=await this.resolvePreviewUpstreamUrl($);if(j)try{N=await fetch(W(j),U);let z=new Headers;for(let[P,A]of N.headers.entries())if(!vV$.includes(P.toLowerCase()))z.set(P,A);return Y=N.status,new Response(N.body,{status:N.status,statusText:N.statusText,headers:z})}catch(z){console.warn(`[${w6}] preview fetch retry to ${D} failed: ${z instanceof Error?z.message:String(z)}`)}}}else this.invalidateRecord($);Y=502;let w=v91(502,{error:"sandbox daemon unreachable"});return w.headers.set(Pv,"1"),w}let B=new Headers;for(let[O,D]of N.headers.entries())if(!vV$.includes(O.toLowerCase()))B.set(O,D);return Y=N.status,new Response(N.body,{status:N.status,statusText:N.statusText,headers:B})}finally{this.recordProxyDuration("preview",Y,Q,performance.now()-X,$)}}async ensureLocked($,Z,X,Q){if(X.image)console.warn(`[${w6}] opts.image ignored (template ${this.sandboxTemplateName} pins image): got ${X.image}`);if(Q){let J=await Q.get($);if(J){let K=await this.rehydrate($,Z,J);if(K)return await this.refreshDaemonGitCredential(K,X),await this.relayOrgFsConfig(K.daemonUrl,K.token,X.orgFsConfigJson),this.finish(K,Q,!1,!0,"resume");await Q.delete($)}}let Y=await ZN(this.kubeConfig,this.namespace,Z).catch(()=>{return});if(Y)if(Y.metadata?.deletionTimestamp)await SK0(this.kubeConfig,this.namespace,Z).catch((J)=>{console.warn(`[${w6}] wait for terminating claim ${Z} failed: ${J instanceof Error?J.message:String(J)}`)});else{let J=await this.adopt($,Z,Y).catch((K)=>{return console.warn(`[${w6}] adopt ${Z} failed, recreating: ${K instanceof Error?K.message:String(K)}`),null});if(J)return await this.refreshDaemonGitCredential(J,X),await this.relayOrgFsConfig(J.daemonUrl,J.token,X.orgFsConfigJson),this.finish(J,Q,!0,!0,"adopt");await Tu(this.kubeConfig,this.namespace,Z).catch(()=>{}),await SK0(this.kubeConfig,this.namespace,Z).catch((K)=>{console.warn(`[${w6}] wait for deleted claim ${Z} failed: ${K instanceof Error?K.message:String(K)}`)})}let G=await this.provision($,Z,X);return this.finish(G,Q,!0,!1,"fresh")}async finish($,Z,X,Q,Y){let G=this.records.get($.handle),J=G!==void 0;if(G&&G.daemonForward!==$.daemonForward)this.closeForwarder(G.daemonForward);if(this.records.set($.handle,$),X)await this.persist(Z,$);if(Q)await CK0(this.kubeConfig,this.namespace,$.handle,this.computeShutdownTime()).catch((K)=>console.warn(`[${w6}] TTL refresh failed for ${$.handle}: ${K instanceof Error?K.message:String(K)}`));if(this.metrics){let K=f91($.tenant);if(this.metrics.ensureOutcome.add(1,{...K,outcome:Y}),!J)this.metrics.active.add(1,K),this.activeGauge.markCounted($.handle)}return this.toSandbox($)}buildEnvMap($,Z){let X={},Q=[];for(let[Y,G]of Object.entries($.env??{}))if(Bm4.has(Y))Q.push(Y);else X[Y]=G;if(Q.length>0)console.warn(`[${w6}] opts.env keys overlap reserved bootstrap names and were dropped: ${Q.join(",")}`);return{...X,DAEMON_TOKEN:Z.token,DAEMON_BOOT_ID:Z.daemonBootId,APP_ROOT:Z.workdir,PROXY_PORT:String(WN)}}async resolveTemplateName($){let{name:Z,probe:X}=await qV$({purpose:$,templateName:this.sandboxTemplateName,probe:this.mediumTemplateProbe,now:Date.now(),ttlMs:Um4,exists:(Q)=>RA$(this.kubeConfig,this.namespace,Q),onAbsent:(Q)=>console.warn(`[${w6}] SandboxTemplate ${Q} not found (or not readable) \u2014 harness-run claims fall back to ${this.sandboxTemplateName}. Upgrade the sandbox-env chart to the version that renders it.`)});return this.mediumTemplateProbe=X,Z}buildClaim($,Z,X,Q){let Y=this.sentinelToken!==null,G=RV$(this.tenantPools,{orgId:Z.tenant?.orgId,cloneUrl:Z.repo?.cloneUrl,purpose:Z.purpose}),J=Y?[]:Object.entries(this.buildEnvMap(Z,X)).sort(([H],[F])=>H<F?-1:H>F?1:0).map(([H,F])=>({name:H,value:F})),K=Cm4(Z),W=Object.keys(K).length>0;return{apiVersion:`${j9.CLAIM_API_GROUP}/${j9.CLAIM_API_VERSION}`,kind:"SandboxClaim",metadata:{name:$,namespace:this.namespace,labels:{"app.kubernetes.io/name":"studio-sandbox","app.kubernetes.io/managed-by":"studio",...this.envName?{[qQ.env]:this.envName}:{},...x91(Z.tenant)},...W?{annotations:K}:{}},spec:{sandboxTemplateRef:{name:Q},additionalPodMetadata:{labels:x91(Z.tenant,{[qQ.role]:"claimed",[qQ.sandboxHandle]:$,...this.envName?{[qQ.env]:this.envName}:{}}),...W?{annotations:K}:{}},env:J,warmpool:IV$(G,Y,Q),lifecycle:{shutdownPolicy:"Delete",shutdownTime:this.computeShutdownTime()}}}}async provision($,Z,X){let Q=this.tokenGenerator(),Y=Km4(),G=_91,J=this.buildClaim(Z,X,{token:Q,daemonBootId:Y,workdir:G},await this.resolveTemplateName(X.purpose));try{await S61(this.kubeConfig,this.namespace,J)}catch(N){if(N instanceof Za)await SK0(this.kubeConfig,this.namespace,Z),await S61(this.kubeConfig,this.namespace,J);else throw N}let K;try{K=await IA$(this.kubeConfig,this.namespace,Z),await yA$(this.kubeConfig,this.namespace,K)}catch(N){throw await Tu(this.kubeConfig,this.namespace,Z).catch(()=>{}),N}try{await this.ensureServicePortForAdoptedSandbox(K),await this.ensureHttpRouteForHandle(Z,K,X.tenant??null)}catch(N){throw await Tu(this.kubeConfig,this.namespace,Z).catch(()=>{}),N}let W=await this.openForwarder(K,WN,Z),H=`http://127.0.0.1:${W.localPort}`,F=this.workloadConfigPayload(X),U=Y;try{if(await V91(H),this.sentinelToken!==null){let N=await aP0(H);if(N)U=N.bootId;await jv(H,this.sentinelToken,F??{},{rotateToken:Q})}else if(F)await jv(H,Q,F);await this.relayOrgFsConfig(H,Q,X.orgFsConfigJson)}catch(N){throw this.closeForwarder(W),await this.deleteHttpRouteIfManaged(Z).catch(()=>{}),await Tu(this.kubeConfig,this.namespace,Z).catch(()=>{}),N}return{id:$,handle:Z,adoptedSandboxName:K,token:Q,workdir:G,daemonUrl:H,daemonForward:W,workload:X.workload??null,daemonBootId:U,tenant:X.tenant??null,ensureOpts:bm4(X)}}workloadConfigPayload($){return BK0({runtime:$?.workload?.runtime??"node",packageManager:$?.workload?.packageManager?{name:$.workload.packageManager,...$.workload.packageManagerPath?{path:$.workload.packageManagerPath}:{}}:null,repo:$?.repo??null,extraRepos:$?.extraRepos??[],port:$?.workload?.devPort??CV$,tenant:$?.tenant??void 0,...$?{cloneOnly:$.cloneOnly===!0}:{}})}async relayOrgFsConfig($,Z,X){if(!X)return;await LV$($,Z,X).catch((Q)=>console.warn("[org-fs] sidecar config relay failed",Q))}async refreshDaemonGitCredential($,Z){let X=U61(Z);if(!X)return;try{await jv($.daemonUrl,$.token,X)}catch(Q){console.warn(`[${w6}] git credential refresh failed for ${$.handle}: ${Q instanceof Error?Q.message:String(Q)}`)}}async withFreshCloneUrl($,Z){if(!this.mintCloneUrl)return $;try{let X=await this.mintCloneUrl($,Z!==void 0?{bufferMs:Z}:void 0);return X?{...$,cloneUrl:X}:$}catch(X){return console.warn(`[${w6}] clone credential re-mint failed: ${X instanceof Error?X.message:String(X)}`),$}}async withFreshCredentials($){return{...$,...$.repo?{repo:await this.withFreshCloneUrl($.repo)}:{},...$.orgFsConfigJson?{orgFsConfigJson:await fm4($,this.mintOrgFsConfig)}:{}}}startCredentialRefresher(){if(!this.mintCloneUrl)return;let{signal:$}=this.claimWatchAbort;(async()=>{while(!$.aborted){if(await H$(wm4,{signal:$}).catch(()=>{}),$.aborted)break;try{await this.refreshAllGitCredentials()}catch(Z){console.warn(`[${w6}] periodic credential refresh failed: ${Z instanceof Error?Z.message:String(Z)}`)}}})()}startTenantPoolReconciler(){if(this.tenantPools.length===0)return;let{signal:$}=this.claimWatchAbort;(async()=>{while(!$.aborted){try{await this.reconcileTenantPools()}catch(Z){console.warn(`[${w6}] tenant pool reconcile failed: ${Z instanceof Error?Z.message:String(Z)}`)}await H$(Lm4,{signal:$}).catch(()=>{})}})()}markTenantPoolsDirty($,Z){let X=MV$(this.tenantPools,$,Z);for(let Q of X)this.dirtyPools.add(Q.name);return X.map((Q)=>Q.name)}async reconcileTenantPools(){for(let $ of this.tenantPools){let Z=await qA$(this.kubeConfig,this.namespace,$.name);if(Z===null){console.warn(`[${w6}] tenant pool ${$.name}: no SandboxWarmPool (or no selector yet) in ${this.namespace}`);continue}let X=this.dirtyPools.delete($.name),Q=Z.filter((Y)=>!Y.labels[qQ.sandboxHandle]);for(let[Y]of this.poolPods)if(!Z.some((G)=>G.uid===Y))this.poolPods.delete(Y);for(let Y of Q){if(this.claimWatchAbort.signal.aborted)return;await this.warmPoolPod($,Y,X)}this.recordPoolDepth($,Z,Q)}}recordPoolDepth($,Z,X){let Q=this.metrics?.poolPods;if(!Q)return;let Y=0,G=0;for(let K of X){let W=this.poolPods.get(K.uid);if(!W)continue;if(W.failures>=eP0)G++;else if(W.lastConfigAt>0)Y++}let J={pool:$.name,org:$.orgId};Q.record(Y,{...J,state:"ready"}),Q.record(Z.length-X.length,{...J,state:"bound"}),Q.record(X.length-Y-G,{...J,state:"pending"}),Q.record(G,{...J,state:"failed"})}async warmPoolPod($,Z,X){let Q=this.poolPods.get(Z.uid);if(Q&&Q.failures>=eP0){if(Date.now()-Q.lastFailureAt<_V$)return;this.poolPods.set(Z.uid,{...Q,failures:0})}let Y=X||Q!==void 0&&Date.now()-Q.lastConfigAt>=this.tenantPoolRefreshMs;if(Q&&!Y)return;let G={cloneUrl:VV$($),connectionId:$.connectionId,branch:$.branch,userName:"",userEmail:""},J=await this.withFreshCloneUrl(G);if($.connectionId&&J.cloneUrl===G.cloneUrl){this.recordPoolFailure(Z,$,"clone credential mint failed");return}let K=await this.openForwarder(Z.name,WN,Z.name).catch(()=>null);if(!K){this.recordPoolFailure(Z,$,"port-forward failed");return}let W=`http://127.0.0.1:${K.localPort}`;try{await V91(W);let H=this.sentinelToken;if(!H)return;if(!await this.isPoolPodUnbound(Z))return;let F=BK0({runtime:$.workload.runtime,packageManager:$.workload.packageManager?{name:$.workload.packageManager,...$.workload.packageManagerPath?{path:$.workload.packageManagerPath}:{}}:null,repo:J,port:$.workload.devPort??CV$})??{},{transition:U}=await jv(W,H,F);if(Y&&U!=="bootstrap"&&await this.isPoolPodUnbound(Z))await OV$(W,H,"clone");this.poolPods.set(Z.uid,{lastConfigAt:Date.now(),lastFailureAt:0,failures:0}),console.log(`[${w6}] tenant pool ${$.name}: warmed ${Z.name} (${U})`)}catch(H){this.recordPoolFailure(Z,$,H instanceof Error?H.message:String(H))}finally{this.closeForwarder(K)}}isPoolPodUnbound($){return MA$(this.kubeConfig,this.namespace,$.name,qQ.sandboxHandle)}recordPoolFailure($,Z,X){let Q=this.poolPods.get($.uid),Y=(Q?.failures??0)+1;this.poolPods.set($.uid,{lastConfigAt:Q?.lastConfigAt??0,lastFailureAt:Date.now(),failures:Y});let G=Y>=eP0?` \u2014 backing off ${_V$/60000}min`:"";console.warn(`[${w6}] tenant pool ${Z.name}: warming ${$.name} failed (${Y}/${eP0})${G}: ${X}`)}async refreshAllGitCredentials(){await kV$(this.records.values(),($)=>$.ensureOpts?.repo?.connectionId,async($)=>{if(this.claimWatchAbort.signal.aborted)return;let Z=$.ensureOpts?.repo;if(!Z)return;let X=await this.withFreshCloneUrl(Z,Em4);await this.refreshDaemonGitCredential($,{...$.ensureOpts,repo:X}),$.ensureOpts={...$.ensureOpts,repo:X}})}async rebootstrapDaemon($,Z,X){if(this.sentinelToken===null)return!1;let Q=this.workloadConfigPayload(X)??{};try{return await jv($,this.sentinelToken,Q,{rotateToken:Z}),await this.relayOrgFsConfig($,Z,X?.orgFsConfigJson),!0}catch(Y){if(Y instanceof rP0&&Y.status===401)try{return await jv($,Z,Q,{rotateToken:Z}),await this.relayOrgFsConfig($,Z,X?.orgFsConfigJson),!0}catch(G){return console.warn(`[${w6}] re-bootstrap retry with claim token failed: ${G instanceof Error?G.message:String(G)}`),!1}return console.warn(`[${w6}] re-bootstrap failed: ${Y instanceof Error?Y.message:String(Y)}`),!1}}async ensureServicePortForAdoptedSandbox($){if(!this.previewGateway||!this.previewUrlPattern)return;await bA$(this.kubeConfig,this.namespace,$,{name:"daemon",port:WN,targetPort:WN})}async ensureHttpRouteForHandle($,Z,X){if(!this.previewGateway||!this.previewUrlPattern)return;let Q=ym4(this.previewUrlPattern,$);if(!Q)throw new IZ(`Unable to derive preview hostname for ${$} from pattern: ${this.previewUrlPattern}`);let Y={apiVersion:`${_61.API_GROUP}/${_61.API_VERSION}`,kind:"HTTPRoute",metadata:{name:$,namespace:this.namespace,labels:x91(X??void 0,{[qQ.role]:"claimed",[qQ.sandboxHandle]:$,"app.kubernetes.io/name":"studio-sandbox","app.kubernetes.io/managed-by":"studio",...this.envName?{[qQ.env]:this.envName}:{}})},spec:{parentRefs:[{kind:"Gateway",group:"gateway.networking.k8s.io",name:this.previewGateway.name,namespace:this.previewGateway.namespace}],hostnames:[Q],rules:[{backendRefs:[{group:"",kind:"Service",name:Z,port:WN}]}]}};await vA$(this.kubeConfig,this.namespace,Y)}async deleteHttpRouteIfManaged($){if(!this.previewGateway)return;await xA$(this.kubeConfig,this.namespace,$)}async rehydrate($,Z,X){let Q=X.state;if(!Q.adoptedSandboxName&&!Q.podName||!Q.token)return null;let Y=await ZN(this.kubeConfig,this.namespace,Z).catch(()=>{return});if(!Y||!xV$(Y))return null;let G=Y.status?.sandbox?.name??Q.adoptedSandboxName??Q.podName??Z,J=await this.openAndProbeDaemon(G,Z);if(!J)return null;if(Q.daemonBootId&&Q.daemonBootId!==J.bootId){if(this.sentinelToken!==null){let K=Q.ensureOpts?await this.withFreshCredentials(Q.ensureOpts):null;if(!await this.rebootstrapDaemon(J.daemonUrl,Q.token,K))return this.closeForwarder(J.daemonForward),null}else console.warn(`[${w6}] daemon restart detected (handle=${Z}): stored bootId=${Q.daemonBootId} live bootId=${J.bootId}`);await this.stateStore?.put($,{handle:Z,state:{...Q,daemonBootId:J.bootId}}).catch((K)=>console.warn(`[${w6}] bootId persist failed for ${Z}: ${K instanceof Error?K.message:String(K)}`))}return{id:$,handle:Z,adoptedSandboxName:G,token:Q.token,workdir:Q.workdir??_91,daemonUrl:J.daemonUrl,daemonForward:J.daemonForward,workload:Q.workload??null,daemonBootId:J.bootId,tenant:Q.tenant??null,ensureOpts:Q.ensureOpts??null}}async adopt($,Z,X){if(!xV$(X))return null;let Q=X.status?.sandbox?.name??Z;if(this.sentinelToken!==null)return null;let Y=Tm4(X);if(!Y)return null;let G=await this.openAndProbeDaemon(Q,Z);if(!G)return null;let J=_m4(X);if(this.previewGateway)await this.ensureServicePortForAdoptedSandbox(Q).catch((K)=>{console.warn(`[${w6}] Service port backfill failed for ${Z}: ${K instanceof Error?K.message:String(K)}`)}),await this.ensureHttpRouteForHandle(Z,Q,J).catch((K)=>{console.warn(`[${w6}] HTTPRoute backfill failed for ${Z}: ${K instanceof Error?K.message:String(K)}`)});return{id:$,handle:Z,adoptedSandboxName:Q,token:Y,workdir:_91,daemonUrl:G.daemonUrl,daemonForward:G.daemonForward,workload:null,daemonBootId:G.bootId,tenant:J,ensureOpts:null}}async openAndProbeDaemon($,Z){let X=await this.openForwarder($,WN,Z).catch(()=>null);if(!X)return null;let Q=`http://127.0.0.1:${X.localPort}`,Y=await aP0(Q);if(!Y)return this.closeForwarder(X),null;return{daemonForward:X,daemonUrl:Q,bootId:Y.bootId}}async getRecord($){let Z=this.records.get($);if(Z)return Z;if(!this.stateStore)return null;let X=await this.stateStore.getByHandle($);if(!X)return null;let Q=await this.rehydrate(X.id,$,X);if(Q)this.records.set($,Q);return Q}async resurrectByHandle($){if(!this.stateStore)return null;let Z=await this.stateStore.getByHandle($);if(!Z)return null;let X=Z.state.ensureOpts;if(!X)return null;let Q=await this.withFreshCredentials(X);if(cz(Z.id)!==$)return null;return await this.ensure(Z.id,Q),this.records.get($)??null}invalidateRecord($){let Z=this.records.get($);if(!Z)return;this.records.delete($),this.dropRecord(Z)}dropRecord($){if(this.closeForwarder($.daemonForward),this.metrics&&this.activeGauge.consume($.handle))this.metrics.active.add(-1,f91($.tenant))}recordProxyDuration($,Z,X,Q,Y){if(!this.metrics)return;this.metrics.proxyDurationMs.record(Q,{...f91(X?.tenant??null),source:$,sandbox_handle:X?.handle??Y??"",status_code:Z||0})}composePreviewUrl($){if(this.previewUrlPattern)return NK0(this.previewUrlPattern,$.handle);return`http://127.0.0.1:${$.daemonForward.localPort}/`}toSandbox($){return{handle:$.handle,workdir:$.workdir,previewUrl:this.composePreviewUrl($)}}async persist($,Z){if(!$)return;let X={adoptedSandboxName:Z.adoptedSandboxName,token:Z.token,workdir:Z.workdir,workload:Z.workload,daemonBootId:Z.daemonBootId,tenant:Z.tenant,...Z.ensureOpts?{ensureOpts:Z.ensureOpts}:{}};await $.put(Z.id,{handle:Z.handle,state:X})}computeShutdownTime(){return new Date(Date.now()+this.idleTtlMs).toISOString()}async releaseAfter($,Z){let X=await ZN(this.kubeConfig,this.namespace,$);if(!X)return;let Q=vm4(X.spec?.lifecycle?.shutdownTime,new Date(Date.now()+Z));if(!Q)return;await CK0(this.kubeConfig,this.namespace,$,Q).catch((Y)=>console.warn(`[${w6}] release failed for ${$}: ${Y instanceof Error?Y.message:String(Y)}`))}async renewTtl($){let Z=await ZN(this.kubeConfig,this.namespace,$);if(!Z)return;let X=xm4(Z.spec?.lifecycle?.shutdownTime,new Date(Date.now()+this.idleTtlMs));if(!X)return;await CK0(this.kubeConfig,this.namespace,$,X).catch((Q)=>console.warn(`[${w6}] TTL renew failed for ${$}: ${Q instanceof Error?Q.message:String(Q)}`))}openForwarder($,Z,X=$){let Q=Rm4(X,Z);return new Promise((Y,G)=>{let J=(K,W)=>{let H=bV$.createServer((F)=>this.handleForwardedConnection(F,$,Z,X));H.once("error",(F)=>{if(F.code==="EADDRINUSE"&&W<zm4){try{H.close()}catch{}let U=b91+(K-b91+1)%yV$;J(U,W+1);return}G(F)}),H.listen(K,"127.0.0.1",()=>{let F=H.address();if(!F||typeof F==="string"){H.close(),G(Error("port-forward listener failed to bind"));return}Y({server:H,localPort:F.port})})};J(Q,0)})}handleForwardedConnection($,Z,X,Q){let Y=new Wm4,G=null,J=!1,K=()=>{if(J)return;if(J=!0,Y.destroy(),G)try{G.close()}catch{}if(!$.destroyed)$.destroy()};$.pipe(Y),$.on("error",K),$.on("close",K),this.portForward.portForward(this.namespace,Z,[X],$,null,Y).then((W)=>{let H=typeof W==="function"?W():W;if(!H){K();return}if(G=H,G.on("close",K),G.on("error",(F)=>{console.warn(`[${w6}] port-forward to ${Z}:${X} dropped mid-connection: ${SV$(F)}`,JSON.stringify(y91(F))),this.invalidateRecord(Q),K()}),J)try{G.close()}catch{}}).catch((W)=>{console.warn(`[${w6}] port-forward to ${Z}:${X} failed: ${SV$(W)}`,JSON.stringify(y91(W))),this.invalidateRecord(Q),K()})}closeForwarder($){$.server.close((Z)=>{if(Z)console.warn(`[${w6}] port-forward close on :${$.localPort} errored: ${Z instanceof Error?Z.message:String(Z)}`)})}close(){if(this.closed)return;this.closed=!0,this.claimWatchAbort.abort();for(let $ of this.records.values())this.dropRecord($);this.records.clear()}}function Pm4($){return{active:$.createUpDownCounter("studio.sandbox.active",{description:"Active sandbox count, by runner kind, owning org, and daemon impl. Cross-checks the cAdvisor-derived count from the cluster \u2014 divergence between the two indicates orphaned claims (studio deleted but K8s didn't reap) or unattributed pods.",unit:"{sandbox}"}),ensureOutcome:$.createCounter("studio.sandbox.ensure.outcome",{description:"Outcome of each ensure() call: fresh provision, resume from state-store after restart, or adopt of a cluster-side claim studio didn't know about. Cold-start ratio is the primary input for warm-pool sizing.",unit:"{call}"}),proxyDurationMs:$.createHistogram("studio.sandbox.proxy.duration_ms",{description:"Wall-clock latency of studio-mediated requests to the sandbox daemon: tool exec proxies (source=daemon) and preview iframe traffic (source=preview).",unit:"ms"}),poolPods:$.createGauge("studio.sandbox.pool.pods",{description:"Tenant warm pool depth by pool and state: ready (warmed and unbound \u2014 what a claim can actually bind instantly), bound (serving a user), pending (unbound, not yet warmed), failed (gave up after repeated bootstrap failures). Alert on sustained ready=0: a pool that is always empty is doing nothing while costing N pods.",unit:"{pod}"})}}function y91($){let Z=[],X=$;for(let Q=0;Q<5&&X instanceof Error;Q++){let Y=X;if(Z.push({name:Y.name,message:Y.message,...Y.code!==void 0?{code:Y.code}:{},...Y.errno!==void 0?{errno:Y.errno}:{}}),Y.cause===X)break;X=Y.cause}if(X!==void 0&&!(X instanceof Error)&&X!==null){let Q=X,Y=Q.error instanceof Error?y91(Q.error).chain:void 0;Z.push({nonError:String(X),...typeof Q.type==="string"?{type:Q.type}:{},...typeof Q.message==="string"?{message:Q.message}:{},...Q.code!==void 0?{code:Q.code}:{},...typeof Q.reason==="string"?{reason:Q.reason}:{},...Y?{error:Y}:{},...Y===void 0&&Q.error!==void 0?{rawError:String(Q.error)}:{},keys:Object.keys(Q)})}return{chain:Z}}function Am4(){let $=new _P0;return $.loadFromDefault(),$}function xV$($){return Boolean($.status?.conditions?.some((Z)=>Z.type==="Ready"&&Z.status==="True"))}function Tm4($){let Z=$.spec?.env;if(!Z)return null;for(let X of Z)if(X.name==="DAEMON_TOKEN"&&X.value)return X.value;return null}function Rm4($,Z){let X=Gm4("sha256").update(`${$}:${Z}`).digest();return b91+X.readUInt32BE(0)%yV$}function v91($,Z){return new Response(JSON.stringify(Z),{status:$,headers:{"content-type":"application/json","access-control-allow-origin":"*"}})}function fV$($){let Z=$.slice(0,qm4);return Im4.test(Z)?Z:""}function Vm4($){if($===void 0)return null;let Z=$.trim();if(Z==="")return null;if(!Mm4.test(Z))throw Error(`AgentSandboxProvider: envName=${JSON.stringify(Z)} is not a valid DNS-label-safe environment name (lowercase alphanumeric or '-', starts with a letter, ends alphanumeric, \u226432 chars). Studio sets this from STUDIO_ENV; check the studio chart's configMap.`);return Z}function x91($,Z={}){let X={...Z};if($){let Q=fV$($.orgId),Y=fV$($.userId);if(Q)X[qQ.orgId]=Q;if(Y)X[qQ.userId]=Y}return X}function zv($){let Z="";for(let X of $){let Q=X.codePointAt(0)??0;Z+=Q<32||Q===127?" ":X}return Z.slice(0,km4)}function Sm4($){try{let Z=new URL($);return Z.username="",Z.password="",Z.toString()}catch{return""}}function Cm4($){let Z={},X=$.tenant;if(X?.orgSlug)Z[gK.orgSlug]=zv(X.orgSlug);if(X?.orgName)Z[gK.orgName]=zv(X.orgName);if(X?.userEmail)Z[gK.userEmail]=zv(X.userEmail);if(X?.userName)Z[gK.userName]=zv(X.userName);let Q=$.repo;if(Q){if(Q.displayName)Z[gK.gitRepo]=zv(Q.displayName);let Y=Sm4(Q.cloneUrl);if(Y)Z[gK.gitRepoUrl]=zv(Y);let G=$.branch??Q.branch;if(G)Z[gK.gitBranch]=zv(G)}return Z}function _m4($){let Z=$.metadata?.labels;if(!Z)return null;let X=Z[qQ.orgId],Q=Z[qQ.userId];if(!X||!Q)return null;let Y=$.metadata?.annotations??{};return{orgId:X,userId:Q,orgSlug:Y[gK.orgSlug],orgName:Y[gK.orgName],userEmail:Y[gK.userEmail],userName:Y[gK.userName]}}function vm4($,Z){if($){let X=new Date($).getTime();if(Number.isFinite(X)&&X<=Z.getTime())return null}return Z.toISOString()}function xm4($,Z){if($){let X=new Date($).getTime();if(Number.isFinite(X)&&X>=Z.getTime())return null}return Z.toISOString()}function f91($){return{org_id:$?.orgId??"",user_id:$?.userId??"",runner_kind:"agent-sandbox"}}async function fm4($,Z){if(!Z||!$.tenant)return $.orgFsConfigJson;try{return await Z($.tenant)??$.orgFsConfigJson}catch(X){return console.warn(`[${w6}] org-fs credential re-mint failed: ${X instanceof Error?X.message:String(X)}`),$.orgFsConfigJson}}function bm4($){let Z={};if($.branch)Z.branch=$.branch;if($.repo)Z.repo=$.repo;if($.workload)Z.workload=$.workload;if($.env&&Object.keys($.env).length>0)Z.env=$.env;if($.tenant)Z.tenant=$.tenant;if($.cloneOnly)Z.cloneOnly=!0;if($.purpose)Z.purpose=$.purpose;if($.orgFsConfigJson)Z.orgFsConfigJson=$.orgFsConfigJson;return Object.keys(Z).length>0?Z:null}function ym4($,Z){try{return new URL(NK0($,Z)).hostname||null}catch{return null}}var w6="AgentSandboxProvider",Pv="x-sandbox-preview-not-ready",Hm4="agent-sandbox-system",Fm4="studio-sandbox",Um4=300000,WN=9000,CV$=3000,_91="/app",Nm4=32,Bm4,Om4=900000,Lm4=60000,Dm4=1800000,eP0=3,_V$=1800000,wm4=900000,Em4=1800000,jm4,vV$,b91=40000,yV$=1e4,zm4=256,qQ,gK,Im4,qm4=63,Mm4,km4=253;var gV$=L(()=>{Z4();uA$();UV$();wV$();N61();_K0();VK0();AV$();C91();Bm4=new Set(["DAEMON_TOKEN","DAEMON_BOOT_ID","APP_ROOT","PROXY_PORT"]),jm4=["cookie","host","connection","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","accept-encoding","content-length","upgrade"],vV$=["connection","keep-alive","transfer-encoding","content-encoding","content-length"];qQ={role:"studio.decocms.com/role",sandboxHandle:"studio.decocms.com/sandbox-handle",orgId:"studio.decocms.com/org-id",userId:"studio.decocms.com/user-id",env:"studio.decocms.com/env"},gK={orgSlug:"studio.decocms.com/org-slug",orgName:"studio.decocms.com/org-name",userEmail:"studio.decocms.com/user-email",userName:"studio.decocms.com/user-name",gitRepo:"studio.decocms.com/git-repo",gitRepoUrl:"studio.decocms.com/git-repo-url",gitBranch:"studio.decocms.com/git-branch"},Im4=/^([A-Za-z0-9]([-A-Za-z0-9_.]*[A-Za-z0-9])?)?$/;Mm4=/^[a-z]([a-z0-9-]{0,30}[a-z0-9])?$/});var hV$={};s(hV$,{parseTenantPools:()=>TV$,PREVIEW_NOT_READY_HEADER:()=>Pv,AgentSandboxProvider:()=>g91});var h91=L(()=>{gV$();C91()});var lV$={};s(lV$,{subscribeLifecycle:()=>i91,getOrInitSharedRunner:()=>d91,getAgentSandboxProviderForTeardown:()=>m91,getAgentSandboxProvider:()=>MQ,__resetSharedLifecyclesForTesting:()=>nm4});function c91($){let Z=Ta[uV$];if(Z)return Promise.resolve(Z);let X=Ta[u91];if(X)return X;let Q=$().then((Y)=>{return Ta[uV$]=Y,Y}).finally(()=>{delete Ta[u91]});return Ta[u91]=Q,Q}function gm4(){let $=process.env.STUDIO_SANDBOX_PREVIEW_URL_PATTERN;return $&&$.trim()!==""?$:void 0}function hm4(){let $=process.env.STUDIO_SANDBOX_TEMPLATE_NAME;return $&&$.trim()!==""?$:void 0}function um4(){let $=process.env.STUDIO_ENV;return $&&$.trim()!==""?$:void 0}function cm4(){let $=process.env.STUDIO_SANDBOX_SENTINEL_TOKEN;return $&&$.trim()!==""?$:void 0}function lm4(){let $=process.env.STUDIO_SANDBOX_PREVIEW_GATEWAY_NAME?.trim(),Z=process.env.STUDIO_SANDBOX_PREVIEW_GATEWAY_NAMESPACE?.trim();if(!$&&!Z)return;if(!$||!Z)throw Error("STUDIO_SANDBOX_PREVIEW_GATEWAY_NAME and STUDIO_SANDBOX_PREVIEW_GATEWAY_NAMESPACE must both be set, or both unset. Half-configured per-claim HTTPRoute routing would silently fail to attach.");return{name:$,namespace:Z}}async function l91($){let Z=new sr($),X=gm4(),{AgentSandboxProvider:Q,parseTenantPools:Y}=await Promise.resolve().then(() => (h91(),hV$)),G=new zU(x0().encryptionKey);return new Q({stateStore:Z,previewUrlPattern:X,sandboxTemplateName:hm4(),envName:um4(),previewGateway:lm4(),sentinelToken:cm4(),tenantPools:Y(process.env.STUDIO_SANDBOX_TENANT_POOLS),meter:F$,mintCloneUrl:async(J,K)=>{if(!J.connectionId)return null;let W=zA$(J.cloneUrl);if(!W)return null;let{cloneUrl:H}=await _H(J.connectionId,W.owner,W.name,$,G,{bufferMs:K?.bufferMs});return H},mintOrgFsConfig:async(J)=>{if(!J.orgSlug)return null;return await MK0({boundAuth:{apiKey:{create:(W)=>X8.api.createApiKey({body:{...W,userId:J.userId}})}},storage:{orgRepoSyncs:new pz($)}},{orgSlug:J.orgSlug,orgId:J.orgId,baseUrl:p9()})??null}})}function MQ($){if(!x0().agentSandboxEnabled)throw Error("Agent sandbox is disabled. Set STUDIO_AGENT_SANDBOX_ENABLED=true to enable it.");return c91(()=>l91($.db))}function m91($){return c91(()=>l91($.db))}async function d91(){if(!x0().agentSandboxEnabled)return null;return c91(()=>l91(h$().db))}function i91($,Z,X){let Q=TD.get(Z);if(Q){if(Q.terminated){if(Q.lastPhase)try{X(Q.lastPhase)}catch{}return{unsubscribe:im4}}if(Q.listeners.add(X),Q.lastPhase)try{X(Q.lastPhase)}catch{}return cV$(Z,Q,X)}let Y=new AbortController,G={lastPhase:null,terminated:!1,listeners:new Set([X]),abort:Y};return TD.set(Z,G),pm4($,Z,G),cV$(Z,G,X)}function im4(){}function cV$($,Z,X){return{unsubscribe(){if(TD.get($)!==Z)return;if(Z.listeners.delete(X),Z.listeners.size===0)TD.delete($),Z.abort.abort()}}}async function pm4($,Z,X){let Q=null;try{for await(let Y of $.watchClaimLifecycle(Z,X.abort.signal)){if(X.abort.signal.aborted)break;X.lastPhase=Y;let G=Y.kind==="ready"||Y.kind==="failed";if(G)X.terminated=!0;let J=Array.from(X.listeners);for(let K of J)try{K(Y)}catch{}if(G)break}}catch(Y){Q=Y}finally{if(!X.terminated&&!X.abort.signal.aborted&&X.listeners.size>0){let Y={kind:"failed",reason:"unknown",message:Q instanceof Error?Q.message:"Lifecycle watcher ended unexpectedly"};X.lastPhase=Y,X.terminated=!0;for(let G of Array.from(X.listeners))try{G(Y)}catch{}}if(TD.get(Z)===X)TD.delete(Z)}}function nm4(){for(let $ of TD.values())$.abort.abort();TD.clear()}var uV$,u91,Ta,mm4,dm4,TD;var hK=L(()=>{GX();O6();I61();Pu();op();z$();iz();PG();o5();uV$=Symbol.for("decocms.sandbox.lifecycle.agent-sandbox-runner"),u91=Symbol.for("decocms.sandbox.lifecycle.agent-sandbox-inflight"),Ta=globalThis;mm4=Symbol.for("decocms.sandbox.lifecycle.shared-lifecycles"),dm4=globalThis,TD=dm4[mm4]??=new Map});async function Ra($,Z,X){try{await $.storage.threads.stampRuntimeIfAbsent(Z,X)}catch(Q){console.warn(`[stampRuntimeIfAbsent] ${Z}: ${Q instanceof Error?Q.message:String(Q)}`)}}function mV$($){let Z=$?.trim();if(!Z)return null;try{let X=new URL(Z);if(X.protocol!=="http:"&&X.protocol!=="https:")return null;return X.href}catch{return null}}function $A0($){return mV$($?.previewServerUrl)??mV$($?.productionUrl)}var p91=()=>{};function Av($){return $==="cms"||$==="sandbox"?$:null}function tm4($){return!!$A0($)&&$?.fastPreview===!0}function ZA0($){return tm4($)?"cms":"sandbox"}var n91;var gu=L(()=>{p91();n91=["cms","sandbox"]});function dV$($){let{current:Z,detached:X,base:Q}=$.status??{};if(typeof Z!=="string"||Z.length===0)return null;if(X===!0)return null;if(Z===$.requestedRef)return null;if(om4.has(Z))return null;if(typeof Q==="string"&&Q.length>0&&Z===Q)return null;return Z}function XA0($){if(!$.branch.startsWith("thread:"))return $.branch;if($.sticky&&$.recordedHeadRef)return $.recordedHeadRef;return $.derivedRef}var om4;var QA0=L(()=>{om4=new Set(["main","master","trunk","develop","HEAD"])});import{z as HN}from"zod";async function hu($,Z){a(Z);let X=r(Z),Q=a0(Z);if(!Q)throw Error("User ID required");let Y=await Z.storage.virtualMcps.findById($.virtualMcpId);if(!Y||Y.organization_id!==X.id)throw Error("Virtual MCP not found");let G=Y.metadata??{},J=await lz(Z,$.branch,Q),K=CH(g9(G),J,$.branch),W=await MQ(Z);if(K){if(await W.alive(K.sandboxHandle).catch(()=>!0))return K;await KD(Z.storage.virtualMcps,$.virtualMcpId,Q,J,$.branch).catch((O)=>{console.warn("[ensureSandbox] failed to reap stale entry",O)})}let H=dJ($.branch)??Z.metadata?.threadId;if(H)Ra(Z,H,"sandbox");let U=await HD(Z,H)??G.githubRepo??null;await $.onColdStart?.().catch(()=>{});let{entry:N}=await pV$({ctx:Z,userId:Q,sandboxUserId:J,orgId:X.id,virtualMcpId:$.virtualMcpId,branch:$.branch,metadata:G,githubRepo:U,threadRepos:await w61(Z,H),existing:null,runner:W,...$.purpose?{purpose:$.purpose}:{}});return N}async function rm4($){let Z=$.primary?`${$.primary.owner}/${$.primary.name}`.toLowerCase():null,X=$.repos.filter((G)=>`${G.owner}/${G.name}`.toLowerCase()!==Z),Q=ir(X),Y=[];for(let[G,J]of X.entries()){if(!J.connectionId)continue;try{let{cloneUrl:K}=await _H(J.connectionId,J.owner,J.name,$.ctx.db,$.ctx.vault);Y.push({cloneUrl:K,connectionId:J.connectionId,userName:$.gitUserName,userEmail:$.gitUserEmail,displayName:`${J.owner}/${J.name}`,directoryName:Q[G],submoduleCredentials:[]})}catch(K){console.warn(`[provisionSandbox] skipping secondary ${J.owner}/${J.name}:`,K instanceof Error?K.message:K)}}return Y}async function pV$($){let{ctx:Z,userId:X,sandboxUserId:Q,orgId:Y,virtualMcpId:G,branch:J,metadata:K,threadRepos:W,existing:H,runner:F,purpose:U}=$,N=U==="harness-run",B=$.githubRepo?await am4({ctx:Z,orgId:Y,virtualMcpId:G,userId:X,githubRepo:$.githubRepo}):null,{runtime:O,packageManager:D,port:w,packageManagerPath:E}=sP$(K),j;if(B){if(B.connectionId)await ND({ctx:Z,connectionId:B.connectionId,organizationId:Y,forceRefresh:!0,onLegacyMintError:(M0)=>{console.error("[provisionSandbox] repo-scoped legacy token mint failed",{connectionId:B.connectionId,error:M0.message})}});let{cloneUrl:o,gitUserName:t,gitUserEmail:D0}=B.connectionId?await _H(B.connectionId,B.owner,B.name,Z.db,Z.vault):KA$(B.owner,B.name);if(!D){let M0=B.connectionId?await FA$(B.connectionId,B.owner,B.name,Z.db,Z.vault):await UA$(B.owner,B.name);if(M0)D=M0.packageManager,O=pr[M0.packageManager].runtime,w=M0.devPort??w,await sm4(Z,G,X,M0.packageManager,M0.devPort)}let e=x0().sandboxStickyHeadRefEnabled,E0=XA0({branch:J,derivedRef:$N(J),recordedHeadRef:e?await pP$(Z,dJ(J)):null,sticky:e}),u0=await ZA$({ctx:Z,orgId:Y,userId:X,entries:rP$(K)});j={cloneUrl:o,...B.connectionId?{connectionId:B.connectionId}:{},userName:t,userEmail:D0,branch:E0,displayName:`${B.owner}/${B.name}`,submoduleCredentials:u0}}let z=await rm4({ctx:Z,orgId:Y,repos:W??[],primary:B,gitUserName:j?.userName??"",gitUserEmail:j?.userEmail??""}),P=O&&D&&!N?{runtime:O,packageManager:D,...w!==null?{devPort:Number(w)}:{},...E?{packageManagerPath:E}:{}}:void 0,A=lr({orgId:Y,virtualMcpId:G,branch:J}),I=!x0().orgFsMountsDisabled,V;if(I){let o=Z.organization?.slug??(await Z.db.selectFrom("organization").select(["slug"]).where("id","=",Y).executeTakeFirst())?.slug;if(o)V=await MK0(Z,{orgSlug:o,orgId:Y,baseUrl:p9()})}await $d4(F);let q=await F.ensure({userId:Q,projectRef:A},{branch:J,repo:j,extraRepos:z,workload:P,cloneOnly:N,...U?{purpose:U}:{},tenant:{orgId:Y,userId:Q,...Z.organization?.slug?{orgSlug:Z.organization.slug}:{},...Z.organization?.name?{orgName:Z.organization.name}:{},...Z.auth.user?.email?{userEmail:Z.auth.user.email}:{},...Z.auth.user?.name?{userName:Z.auth.user.name}:{}},...V?{orgFsConfigJson:V}:{}}),S=ju(K);await wK0({ctx:Z,runner:F,handle:q.handle,orgId:Y,userId:X,entries:S});let f=!!H&&H.sandboxHandle===q.handle&&H?.createdAt?H.createdAt:Date.now(),b=K.runtime?.selected??null,l=K.runtime?.port??null,y=K.runtime?.path??null,p={sandboxHandle:q.handle,previewUrl:q.previewUrl,createdAt:f,startedWith:{packageManager:b,port:l,path:y}};await fP$(Z.storage.virtualMcps,G,X,Q,J,p);let Q0=dJ(J)??Z.metadata?.threadId;if(Q0)await tP$(Z,Q0,Q,J,p);let L0=!H||H.sandboxHandle!==q.handle;return{entry:p,isNewVm:L0}}async function am4($){let{ctx:Z,orgId:X,virtualMcpId:Q,userId:Y,githubRepo:G}=$;if(!G.connectionId)return G;if(await Z.storage.connections.findById(G.connectionId,X))return G;let{items:K}=await Z.storage.connections.list(X),W=T30(K,G.owner,G.name);if(!W)return console.warn("[provisionSandbox] recorded repo connection no longer exists and no live connection covers the repo",{virtualMcpId:Q,connectionId:G.connectionId}),G;console.warn("[provisionSandbox] healed dangling repo connection",{virtualMcpId:Q,staleConnectionId:G.connectionId,connectionId:W.id});try{let F=(await Z.storage.virtualMcps.findById(Q))?.metadata??{},U=F.githubRepo;if(U?.connectionId===G.connectionId){let N=h5(W);await Z.storage.virtualMcps.update(Q,Y,{metadata:{...F,githubRepo:{...U,connectionId:W.id,...N?{installationId:N.installationId}:{}}}})}}catch(H){console.warn("[provisionSandbox] failed to persist healed repo connection",{virtualMcpId:Q,error:H.message})}return{...G,connectionId:W.id}}async function sm4($,Z,X,Q,Y){let G=await $.storage.virtualMcps.findById(Z);if(!G)return;let J=G.metadata??{};await $.storage.virtualMcps.update(Z,X,{metadata:{...J,runtime:{selected:Q,port:Y}}})}async function $d4($){let Z=Date.now()+iV$,X=!1;while(!await $.hasSchedulableCapacity()){if(Date.now()>=Z)throw Error(`sandbox provisioning failed: the cluster has had no room to schedule another sandbox for ${Math.round(iV$/1000)}s`);if(!X)X=!0,console.warn("[ensureSandbox] waiting for cluster capacity \u2014 a sandbox pod cannot be scheduled right now");await H$(em4)}}var t91,iV$=150000,em4=5000;var Ia=L(()=>{dr();Z4();k0();nr();P61();XA$();zY();WY();Pu();BA$();O61();hK();gu();xK();QA0();z$();o5();iz();zY();t91=c({name:"SANDBOX_START",description:"Start a sandbox with the connected GitHub repo and dev server.",annotations:{title:"Start VM Preview",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!1,openWorldHint:!0},_meta:{ui:{visibility:"app"}},inputSchema:HN.object({virtualMcpId:HN.string().describe("Virtual MCP ID"),branch:HN.string().min(1).optional().describe("Git branch to check out. Pass the thread's branch whenever the caller has one: when omitted the handler mints a fresh `<user-slug>-<timestamp>` name, which becomes a SEPARATE sandbox from the one the thread's own branch resolves to. The resolved branch is returned in the response so callers can persist it."),threadId:HN.string().optional().describe("The session asking for a sandbox. A thread stamped `cms` is refused \u2014 that session reads and writes over the decofile API and a pod would be invisible to it. Optional: an unstamped (legacy) thread is always allowed, and so is a caller with no thread.")}),outputSchema:HN.object({previewUrl:HN.string().nullable(),sandboxHandle:HN.string(),branch:HN.string(),isNewVm:HN.boolean()}),handler:async($,Z)=>{a(Z);let X=r(Z);await Z.access.check();let Q=$.branch??PK0(zK0(Z.auth.user)),Y=dJ(Q)??$.threadId??Z.metadata?.threadId;if(Y){let D=await Z.storage.threads.get(Y).catch(()=>null);if(Av(D?.metadata?.runtime)==="cms")throw Error("This chat is a CMS session and does not use a sandbox. Start a coding session to get one.")}let G=a0(Z);if(!G)throw Error("User ID required");let J=await lz(Z,Q,G),K=await Z.storage.virtualMcps.findById($.virtualMcpId);if(!K||K.organization_id!==X.id)throw Error("Virtual MCP not found");let W=K.metadata??{},H=await MQ(Z),F=CH(g9(W),J,Q),N=await HD(Z,dJ(Q)??Z.metadata?.threadId)??W.githubRepo??null,{entry:B,isNewVm:O}=await pV$({ctx:Z,userId:G,sandboxUserId:J,orgId:X.id,virtualMcpId:$.virtualMcpId,branch:Q,metadata:W,githubRepo:N,threadRepos:await w61(Z,dJ(Q)??Z.metadata?.threadId),existing:F,runner:H});if(Y)Ra(Z,Y,"sandbox");return{...B,branch:Q,isNewVm:O}}})});function Zd4($){let{publicUrl:Z,agentId:X,organization:Q,target:Y,threadId:G}=$;if(Y==="agent-tools")return`${Z}/mcp/virtual-mcp/${encodeURIComponent(X)}`;if(!Q.slug)throw new tV$(Q.id,Y);if(Y==="task-run"){if(!G)throw Error("a task-run MCP endpoint is scoped to a run: threadId is required");return`${Z}/api/${Q.slug}/mcp/task-run/${encodeURIComponent(G)}`}return`${Z}/api/${Q.slug}/mcp/self`}async function YA0($,Z,X,Q,Y="agent-tools",G,J={"*":["*"]}){let K=Zd4({publicUrl:p9(),agentId:Z,organization:X,target:Y,...G?{threadId:G}:{}}),W=await $.boundAuth.apiKey.create({name:Q,permissions:J,expiresIn:nV$,metadata:{organization:{id:X.id,slug:X.slug,name:X.name}}});return{url:K,headers:{Authorization:`Bearer ${W.key}`,"x-org-id":X.id},expiresAt:Date.now()+nV$*1000}}function oV$($){let{publicUrl:Z,organizationSlug:X,headers:Q,connections:Y}=$,G=new Set;return Y.map((J)=>{let K=Xd4(J.slug??J.title??"")||"mcp",W=K;for(let H=2;G.has(W);H++)W=`${K}-${H}`;return G.add(W),{name:W,url:`${Z}/api/${X}/mcp/${encodeURIComponent(J.id)}`,headers:Q}})}function Xd4($){return $.toLowerCase().replace(/[^a-z0-9]+/g,"-").replace(/^-+|-+$/g,"")}function rV$($){return{self:[...$.toolNames],...$.grants}}var nV$=3600,tV$;var o91=L(()=>{o5();tV$=class tV$ extends Error{constructor($,Z){super(`cannot mint a "${Z}" MCP endpoint for organization "${$}": the org-scoped path needs the org slug, which was not loaded.`);this.name="MissingOrganizationSlugError"}}});async function Qd4($,Z,X,Q){try{let Y=$.organization;if(!Y)return;let G=await YA0($,Q.virtualMcpId,Y,"tool-scripting"),J=await Z.proxyDaemonRequest(X,"/_sandbox/tools/sync",{method:"POST",headers:new Headers({"content-type":"application/json"}),body:JSON.stringify(G)});if(!J.ok)console.warn("[agent-sandbox-fs] tools/sync failed",J.status,await J.text().catch(()=>""))}catch(Y){console.warn("[agent-sandbox-fs] tools/sync failed",Y)}}async function uu($,Z){let X=await MQ($),Q=null,Y=()=>{if(!Q){if(Q=hu({virtualMcpId:Z.virtualMcpId,branch:Z.branch},$).then((K)=>K.sandboxHandle),Q.catch(()=>{Q=null}),Z.syncTools)Q.then((K)=>Qd4($,X,K,{virtualMcpId:Z.virtualMcpId})).catch(()=>{})}return Q},G=Z.branch==="ephemeral";return B61(X,{ensureHandle:Y,invalidateHandle:async(K)=>{if(Q=null,!G&&!K?.force)return;try{await KD($.storage.virtualMcps,Z.virtualMcpId,Z.userId,Z.userId,Z.branch)}catch(W){console.warn("[agent-sandbox-fs] failed to reap vmMap entry",W)}},canAutoRestart:G,threadId:Z.threadId})}async function aV$($,Z){try{let X=await uu($,Z),{stdout:Q}=await X.onBash("test -d .deco && echo __DECO_SITE__");return Q.includes("__DECO_SITE__")}catch(X){return console.warn("[agent-sandbox-fs] .deco probe failed; assuming deco site",X),!0}}var GA0=L(()=>{dr();o91();hK();Ia();zY()});import{z as sV$}from"zod";function cu($){let Z=[];for(let X of $){if(X.status!=="active")continue;let Q=h5(X);if(!Q)continue;Z.push({connectionId:X.id,owner:Q.owner,repo:Q.repo,installationId:Q.installationId})}return Z}async function Gd4($,Z){let{items:X}=await $.storage.connections.list(Z,{slug:"mcp-github"});return cu(X)}function Jd4($){let Z=$.split(`
 `).map((Q)=>Q.trim()).filter((Q)=>Q&&Q!==".git"&&Q!=="__CLONED__"),X=Z.length>0;return{cloned:X,listing:X?Z.join(`
 `):""}}function Kd4($){let Z="Load a GitHub repository into this conversation's sandbox so the file tools (read/write/edit/bash/grep/glob) and dev server operate on that repo, and open its live Preview. Waits until the repo is cloned before returning. Calling it again switches the repo. File tools operate on the loaded repo from your NEXT message (this turn's tools are still bound to the previous workspace), so after loading, prefer the file listing this tool returns over re-running bash in the same turn.",X=$.map((Q)=>`- ${Q.owner}/${Q.repo} (connectionId: ${Q.connectionId})`).join(`
 `);return`${Z}