decocms 4.393.2 → 4.394.0

package/dist/server/cli.js

@@ -2105,7 +2105,7 @@ Usage: deco services <up|down|status>`),process.exit(1)}}var t8$=L(()=>{ph()});f
       `.execute($);if(Number(W.rows[0]?.cnt)===0){console.warn(`Failed to migrate ${G}/${K}, keeping in old table`);continue}}await El`
       DELETE FROM kysely_migration WHERE name = ${Q}
     `.execute($)}}async function R7$($){await lK4($),await cK4($);let Z=new T7$({db:$,provider:{getMigrations:()=>Promise.resolve(O11)}}),{error:Q,results:X}=await Z.migrateToLatest(),Y=0;if(X?.forEach((J)=>{if(J.status==="Success")Y++;else if(J.status==="Error")console.error(`Failed to execute migration "${J.migrationName}"`)}),Q)throw console.error("Failed to migrate"),console.error(Q),Q;return Y}async function mK4($){let{keepOpen:Z=!1,database:Q,skipBetterAuth:X=!1}=$??{},Y="skipped";if(!X&&!Q)Y=await Ma0();let J=Q??W8(),G=async()=>{if(!Z&&!Q)await pD(J).catch((K)=>{console.warn("Warning: Error closing database:",K)})};try{let K=await R7$(J.db);return await G(),{betterAuth:Y,kysely:K}}catch(K){throw await G(),K}}async function dK4(){let $=W8(),Z=new T7$({db:$.db,provider:{getMigrations:()=>Promise.resolve(O11)}}),{error:Q,results:X}=await Z.migrateDown();if(X?.forEach((Y)=>{if(Y.status==="Success")console.log(`\u2705 Migration "${Y.migrationName}" rolled back successfully`);else if(Y.status==="Error")console.error(`\u274C Failed to rollback migration "${Y.migrationName}"`)}),Q)throw console.error("Failed to rollback migration"),console.error(Q),Q}var M7$=L(()=>{P7$();Ia0();LX()});async function N30($){let Z={...process.env},Q=Z70($,Z);console.log(aI1(Q.settings.encryptionKey));let X=Q.settings.betterAuthSecret||(Q.settings.localMode?M6$(Q.settings.dataDir):""),{ensureServices:Y}=await Promise.resolve().then(() => (BG0(),NG0)),{outputs:J,services:G}=await Y({home:Q.settings.dataDir,externalDatabaseUrl:Q.externalDatabaseUrl,externalNatsUrl:Q.externalNatsUrl});if(!Q.skipMigrations){let{migrateBetterAuth:W}=await Promise.resolve().then(() => (Ia0(),V6$));await W(J.databaseUrl);let{createDatabase:H}=await Promise.resolve().then(() => (LX(),d4$)),{migrateToLatest:F}=await Promise.resolve().then(() => (M7$(),q7$)),U=H(J.databaseUrl);await F({keepOpen:!0,database:U,skipBetterAuth:!0})}let K={...Q.settings,betterAuthSecret:X,databaseUrl:J.databaseUrl,natsUrls:J.natsUrls,...J.s3?{s3Endpoint:J.s3.endpoint,s3Bucket:J.s3.bucket,s3AccessKeyId:J.s3.accessKeyId,s3SecretAccessKey:J.s3.secretAccessKey,s3ForcePathStyle:J.s3.forcePathStyle}:{}};return o8$(K),{settings:K,services:G.map((W)=>({name:W.name==="PostgreSQL"?"Postgres":W.name,port:W.port})),managedServiceNames:G.filter((W)=>W.owner==="managed").map((W)=>W.name)}}var D11=L(()=>{ph();I6$();H$()});var S7$={};K0(S7$,{updateService:()=>KT,subscribeCliState:()=>E11,setTuiConsoleIntercepted:()=>B30,setServerUrl:()=>sa,setMigrationsDone:()=>ra,setDevMode:()=>pK4,resetCliStateForTests:()=>iK4,isTuiConsoleIntercepted:()=>L30,getCliState:()=>j11,addLogEntry:()=>sD});function I7$(){return[{name:"Postgres",status:"pending",port:0},{name:"NATS",status:"pending",port:0}]}function V7$(){return{services:I7$(),migrationsStatus:"pending",serverUrl:null,logs:[]}}function iK4(){NJ=V7$()}function aa(){for(let $ of w11)$()}function j11(){return NJ}function E11($){return w11.add($),()=>w11.delete($)}function KT($){NJ={...NJ,services:NJ.services.map((Z)=>Z.name===$.name?$:Z)},aa()}function ra(){NJ={...NJ,migrationsStatus:"done"},aa()}function sa($){NJ={...NJ,serverUrl:$},aa()}function sD($){let Z=[...NJ.logs,$];NJ={...NJ,logs:Z.length>500?Z.slice(-500):Z},aa()}function pK4(){NJ={...NJ,services:[...I7$(),{name:"API",status:"pending",port:0},{name:"Vite",status:"pending",port:0}]},aa()}function B30($){k7$=$}function L30(){return k7$}var NJ,w11,k7$=!1;var WT=L(()=>{NJ=V7$();w11=new Set});import{createServer as C7$}from"net";function nK4($){return new Promise((Z)=>{let Q=C7$();Q.once("error",()=>Z(!1)),Q.listen($,"0.0.0.0",()=>{Q.close(()=>Z(!0))})})}async function ea($){if(await nK4($))return $;let Z=await new Promise((Q,X)=>{let Y=C7$();Y.once("error",X),Y.listen(0,"0.0.0.0",()=>{let J=Y.address(),G=typeof J==="object"&&J?J.port:0;Y.close(()=>Q(G))})});return console.warn(`Port ${$} is in use, using port ${Z} instead.`),Z}var z11=()=>{};var T11={};K0(T11,{startDevServer:()=>oK4,pipeToLogStore:()=>P11});import{join as tK4}from"path";function P11($){let Z=$.getReader(),Q=new TextDecoder,X="";function Y(){let J=X.split(`
-`);X=J.pop()??"";for(let G of J){let K=Bun.stripANSI(G).replace(/^\[\d+\]\s*/,"").trim();if(!K)continue;sD({method:"",path:"",status:0,duration:0,timestamp:new Date,rawLine:K})}}(async()=>{try{for(;;){let{done:J,value:G}=await Z.read();if(J)break;X+=Q.decode(G,{stream:!0}),Y()}}catch{}if(X.trim()){let J=Bun.stripANSI(X).replace(/^\[\d+\]\s*/,"").trim();if(J)sD({method:"",path:"",status:0,duration:0,timestamp:new Date,rawLine:J})}})()}async function oK4($){let{baseUrl:Z,noTui:Q}=$,X=process.env.HOST==="0.0.0.0"&&Boolean(process.env.PORT),Y=X?process.env.PORT:$.vitePort,J=Z||`http://localhost:${Y}`,G=X?await ea(Number(Y)+1):await ea(Number($.port)),{settings:K,services:W,managedServiceNames:H}=await N30({port:String(G),home:$.home,baseUrl:$.baseUrl,localMode:$.localMode,skipMigrations:$.skipMigrations,noTui:$.noTui,vitePort:$.vitePort});for(let D of W)KT({name:D.name,status:"ready",port:D.port});ra();let F=tK4(import.meta.dir,"..","..","..","..",".."),U=Q===!0,N=Bun.spawn(["bun","run","dev:servers"],{cwd:F,env:{...process.env,PORT:String(K.port),VITE_PORT:String(Y),DATABASE_URL:K.databaseUrl,NATS_URL:K.natsUrls.join(","),NODE_ENV:K.nodeEnv,BASE_URL:J,DECOCMS_LOCAL_MODE:String(K.localMode),DECOCMS_HOME:K.dataDir,DATA_DIR:K.dataDir,DECO_CLI:"1",...K.betterAuthSecret?{BETTER_AUTH_SECRET:K.betterAuthSecret}:{},...K.s3Endpoint?{S3_ENDPOINT:K.s3Endpoint,S3_BUCKET:K.s3Bucket??"",S3_ACCESS_KEY_ID:K.s3AccessKeyId??"",S3_SECRET_ACCESS_KEY:K.s3SecretAccessKey??"",S3_FORCE_PATH_STYLE:String(K.s3ForcePathStyle)}:{},...K.natsCredsPath?{NATS_CREDS:K.natsCredsPath}:{}},stdio:["inherit",U?"inherit":"pipe",U?"inherit":"pipe"]});if(!U)P11(N.stdout),P11(N.stderr);sa(J),KT({name:"Vite",status:"ready",port:Number(Y)}),KT({name:"API",status:"ready",port:Number(K.port)});let O=async(D)=>{if(N.kill(D),await N.exited,H.length>0){let{stopServices:w}=await Promise.resolve().then(() => (BG0(),NG0));await w(K.dataDir)}};return process.on("SIGINT",()=>O("SIGINT")),process.on("SIGTERM",()=>O("SIGTERM")),{port:Number(Y),process:N}}var A11=L(()=>{D11();WT();z11()});var O30;var R11=L(()=>{O30={name:"decocms",version:"4.393.2",description:"Deco CMS \u2014 Self-hostable MCP Gateway for managing AI connections and tools",author:"Deco team",repository:{type:"git",url:"git+https://github.com/decocms/studio.git",directory:"apps/api"},bugs:{url:"https://github.com/decocms/studio/issues"},type:"module",bin:{deco:"./dist/server/cli.js"},files:["dist/**/*"],scripts:{dev:"bun run migrate && bun run dev:server","dev:server":"bun run --cwd=../../packages/sandbox build && NODE_ENV=development bun --env-file=.env --hot run src/index.ts",build:"bun run build:server","build:server":"bun run scripts/bundle-server-script.ts --dist ./dist/server","generate:tool-contracts":"bun run scripts/generate-tool-contracts.ts","db:migrate":"bun run ./dist/server/migrate.js","db:migrate:dbos":"bun run ./dist/server/migrate-dbos.js",check:"tsc --noEmit",start:"bun run ./dist/server/server.js",migrate:"bun run src/database/migrate.ts","migrate:dbos":"bun run src/database/migrate-dbos.ts",test:"bun test src","better-auth:migrate":"bunx --bun @better-auth/cli migrate -y --config src/auth/index.ts",prepublishOnly:"bun run --cwd=../.. build:studio"},optionalDependencies:{"@duckdb/node-api":"^1.5.0-r.1"},dependencies:{"@ai-sdk/anthropic":"^4.0.58","@ai-sdk/google":"^4.0.76","@ai-sdk/openai":"^4.0.71","@anthropic-ai/sdk":"^0.105.0","@aws-sdk/client-s3":"^3.1013.0","@aws-sdk/client-sts":"^3.1013.0","@aws-sdk/lib-storage":"^3.1013.0","@aws-sdk/s3-request-presigner":"^3.1013.0","@clickhouse/client":"^1.8.1","@dbos-inc/dbos-sdk":"^4.21.6","@inkjs/ui":"^2.0.0","@nats-io/jetstream":"3.4.0","@nats-io/kv":"3.4.0","@nats-io/nats-core":"3.4.0","@nats-io/transport-node":"3.4.0","@openrouter/ai-sdk-provider":"^3.1.0","@opentelemetry/core":"^2.6.0","embedded-postgres":"^18.3.0-beta.16",ink:"^6.8.0",kysely:"^0.28.12","posthog-node":"^5.0.0",react:"^19.2.6","react-dom":"^19.2.6"},devDependencies:{"@ai-sdk/provider":"^4.0.17","@better-auth/sso":"1.4.1","@decocms/better-auth":"1.5.17","@decocms/bindings":"workspace:*","@decocms/mcp-utils":"workspace:*","@decocms/runtime":"workspace:*","@decocms/sandbox":"workspace:*","@decocms/shared":"workspace:*","@jitl/quickjs-wasmfile-release-sync":"0.31.0","@modelcontextprotocol/sdk":"1.29.0","@opentelemetry/api":"^1.9.0","@opentelemetry/api-logs":"^0.211.0","@opentelemetry/exporter-logs-otlp-proto":"^0.211.0","@opentelemetry/exporter-prometheus":"^0.208.0","@opentelemetry/exporter-trace-otlp-proto":"^0.207.0","@opentelemetry/instrumentation-runtime-node":"^0.24.0","@opentelemetry/resources":"^2.6.0","@opentelemetry/sdk-logs":"^0.211.0","@opentelemetry/sdk-metrics":"^2.2.0","@opentelemetry/sdk-node":"^0.207.0","@opentelemetry/sdk-trace-base":"^2.5.0","@types/bun":"^1.3.1","@types/google.maps":"^3.65.2","@types/pg":"^8.15.6","@types/react-syntax-highlighter":"^15.5.13","@vercel/nft":"^1.1.1",ai:"^7.0.107","better-auth":"1.4.22",croner:"^9.1.0",degit:"^2.8.4",hono:"^4.10.7",jose:"^6.0.11",nanoid:"^5.1.6",pg:"^8.16.3",typescript:"^7.0.2",typescript5:"npm:typescript@^5.9.3",zod:"4.3.6"},homepage:"https://github.com/decocms/studio",keywords:["mcp","model-context-protocol","ai","gateway","self-hosted","tools"],license:"MIT",publishConfig:{access:"public"}}});import{Box as rK4,Text as _7$}from"ink";import{jsx as sK4,jsxs as v7$}from"react/jsx-runtime";function x7$({version:$}){return v7$(rK4,{flexDirection:"column",marginTop:1,children:[bG0.map((Z,Q)=>sK4(_7$,{color:yG0[Q],children:Z},Q)),v7$(_7$,{dimColor:!0,children:[" v",$]})]})}var f7$=L(()=>{fa()});import{Box as HT,Text as eD}from"ink";import{Spinner as eK4}from"@inkjs/ui";import{jsx as CG,jsxs as zl}from"react/jsx-runtime";function b7$({status:$}){if($==="pending")return CG(eK4,{label:""});return CG(eD,{color:"green",children:"\u2713"})}function $W4($){return`${$.name}: ${$.port||"...."}`}function y7$({services:$,migrationsStatus:Z,home:Q,serverUrl:X}){return zl(HT,{flexDirection:"column",paddingBottom:1,children:[CG(x7$,{version:O30.version}),CG(HT,{marginBottom:1,children:CG(eD,{dimColor:!0,children:"\u2500".repeat(80)})}),CG(HT,{children:zl(eD,{dimColor:!0,children:["Home: ",Q]})}),zl(HT,{gap:2,children:[$.map((Y)=>zl(HT,{gap:1,children:[CG(eD,{children:$W4(Y)}),CG(b7$,{status:Y.status})]},Y.name)),zl(HT,{gap:1,children:[CG(eD,{children:"Migrations"}),CG(b7$,{status:Z})]})]}),CG(HT,{children:X?zl(eD,{children:["Open in browser: ",CG(eD,{color:"cyan",children:X})]}):CG(eD,{dimColor:!0,children:"Starting..."})})]})}var g7$=L(()=>{R11();f7$()});import{Box as ZW4,Text as $r}from"ink";import{jsx as q11,jsxs as M11}from"react/jsx-runtime";function QW4($){if($>=500)return"red";if($>=400)return"yellow";if($>=300)return"cyan";return"green"}function h7$({logs:$}){return q11(ZW4,{flexDirection:"column",children:$.map((Z,Q)=>{if(Z.rawLine)return q11($r,{dimColor:!0,children:Z.rawLine},Q);let X=Z.duration<1000?`${Z.duration}ms`:`${(Z.duration/1000).toFixed(1)}s`;return M11($r,{children:[M11($r,{dimColor:!0,children:[Z.method.padEnd(6)," ",Z.path.padEnd(30)," "]}),q11($r,{color:QW4(Z.status),children:Z.status}),M11($r,{dimColor:!0,children:[" ",X.padStart(8)]})]},Q)})})}var u7$=()=>{};var I11={};K0(I11,{App:()=>JW4});import{Box as XW4}from"ink";import{useSyncExternalStore as YW4}from"react";import{jsx as l7$,jsxs as GW4}from"react/jsx-runtime";function JW4({home:$}){let Z=YW4(E11,j11);return GW4(XW4,{flexDirection:"column",children:[l7$(y7$,{services:Z.services,migrationsStatus:Z.migrationsStatus,home:$,serverUrl:Z.serverUrl}),l7$(h7$,{logs:Z.logs})]})}var V11=L(()=>{g7$();u7$();WT()});var WK="thread-gate",fB="decopilot-hosted-harness",bB="decopilot-hosted-harness-sandboxed",HK="automations",$w="background-tools",FT="task-board-github-reads";var c7$="13";function m7$($){return{name:"decocms",systemDatabaseUrl:$.systemDatabaseUrl,systemDatabaseSchemaName:"dbos",systemDatabasePoolSize:$.poolSize,runAdminServer:!1,executorID:$.executorID,applicationVersion:c7$,...$.listenQueues!==void 0?{listenQueues:$.listenQueues}:{}}}var d7$=()=>{};import KW4 from"pg";async function p7$($,Z){let{databaseUrl:Q,lockTimeoutMs:X=WW4}=$,Y=$.log??((W)=>console.log(W)),J=new KW4.Client({connectionString:Q});await J.connect();let G=Date.now(),K=!1;try{while(!K){if(K=(await J.query("SELECT pg_try_advisory_lock($1) AS locked",[i7$.toString()])).rows[0]?.locked===!0,K)break;if(Date.now()-G>=X)throw Error(`Timed out after ${X}ms waiting for the DBOS migration lock. Another process is still migrating the dbos schema; this pod will restart and retry.`);await k$(HW4)}let W=Date.now()-G;if(W>1000)Y(`[dbos] waited ${W}ms for the migration lock; another process migrated first`);return await Z()}finally{if(K)try{await J.query("SELECT pg_advisory_unlock($1)",[i7$.toString()])}catch{}await J.end().catch(()=>{})}}var i7$=8314027461559302n,WW4=600000,HW4=500;var n7$=L(()=>{O8()});function FW4(){let $=(process.env.BUN_OPTIONS??"").split(/\s+/).filter(Boolean);return[...process.argv.slice(1),...$]}function k11($,Z){for(let Q=0;Q<$.length;Q++){let X=$[Q];if(X===void 0)continue;if(X===Z)return $[Q+1];if(X.startsWith(`${Z}=`))return X.slice(Z.length+1)}return}function t7$(){let $=FW4();if($.includes("--cpu-prof")){console.log(JSON.stringify({msg:"cpu-profiling-active",dir:k11($,"--cpu-prof-dir")??process.cwd(),name:k11($,"--cpu-prof-name"),markdown:$.includes("--cpu-prof-md"),intervalUs:Number(k11($,"--cpu-prof-interval")??1000),note:"profile is written on process exit"}));return}if(process.env.CPU_PROFILE)console.warn(JSON.stringify({msg:"cpu-profiling-requested-but-inactive",hint:'CPU profiling is a Bun launch flag. Set BUN_OPTIONS="--cpu-prof --cpu-prof-md --cpu-prof-dir=/tmp" before starting the process.'}))}function o7$(){if(process.env.HEAP_WATCH!=="1")return()=>{};let $=Number(process.env.HEAP_WATCH_INTERVAL_MS??60000),Z=async()=>{let Q=XT();if(!Q)return;let X={};try{let{heapStats:Y}=await import("bun:jsc"),J=Y(),G=Object.entries(J.objectTypeCounts).sort((K,W)=>W[1]-K[1]).slice(0,20);X={objectCount:J.objectCount,heapSize:J.heapSize,top:Object.fromEntries(G)}}catch{}console.log(JSON.stringify({msg:"heap-watch",ts:new Date().toISOString(),uptimeS:Math.round(process.uptime()),rss:Q.rss,heapUsed:Q.heapUsed,heapTotal:Q.heapTotal,external:Q.external,arrayBuffers:Q.arrayBuffers,...X}))};return Z().catch(()=>{}),D30=setInterval(()=>void Z().catch(()=>{}),$),D30.unref?.(),process.on("SIGUSR2",()=>{try{let Q=Bun.generateHeapSnapshot("v8"),X=typeof Q==="string"?Q:JSON.stringify(Q),Y=`/tmp/heap-${process.pid}-${Date.now()}.heapsnapshot`;Bun.write(Y,X),console.log(JSON.stringify({msg:"heap-snapshot-written",path:Y}))}catch(Q){console.error("[heap-watch] snapshot failed:",Q)}}),()=>{if(D30)clearInterval(D30)}}var D30;var a7$=()=>{};import*as UW4 from"bun:jsc";function r7$(){if(process.env.STALL_WATCHDOG!=="1")return()=>{};let $=Number(process.env.STALL_WATCHDOG_MS??100),Z=Number(process.env.STALL_WATCHDOG_TICK_MS??50);try{NW4()}catch(J){return console.error("[stall-watchdog] failed to start sampling profiler:",J),()=>{}}let Q,X=performance.now()+Z,Y=()=>{let J=performance.now(),G=J-X;X=J+Z;let K=[];try{K=BW4()?.traces??[]}catch{}if(G>$&&K.length>0){let W=new Map;for(let F of K){let U=F.frames.find((O)=>O.sourceURL&&!/Unknown Executable/.test(O.category??""))??F.frames[0];if(!U)continue;let N=(U.sourceURL??"?").replace(/^.*\/node_modules\//,"node_modules/"),B=`${U.name??"?"} @ ${N}:${U.line??"?"}`;W.set(B,(W.get(B)??0)+1)}let H=[...W.entries()].sort((F,U)=>U[1]-F[1]).slice(0,8).map(([F,U])=>({frame:F,count:U}));console.warn(JSON.stringify({msg:"stall-stack",ts:new Date().toISOString(),lagMs:Math.round(G),samplesInWindow:K.length,top:H}))}Q=setTimeout(Y,Z),Q.unref?.()};return Q=setTimeout(Y,Z),Q.unref?.(),()=>{if(Q)clearTimeout(Q)}}var NW4,BW4;var s7$=L(()=>{({startSamplingProfiler:NW4,samplingProfilerStackTraces:BW4}=UW4)});function e7$(){t7$();let $=[o7$(),b4$(),r7$()];return()=>{for(let Z of $)Z()}}var $Q$=L(()=>{ja0();a7$();s7$()});var UT=b((ZQ$)=>{Object.defineProperty(ZQ$,"__esModule",{value:!0});ZQ$.RepublishHeaders=ZQ$.DirectMsgHeaders=ZQ$.JsHeaders=ZQ$.AdvisoryKind=void 0;ZQ$.isOrderedPushConsumerOptions=LW4;ZQ$.isPullConsumer=OW4;ZQ$.isPushConsumer=DW4;ZQ$.isBoundPushConsumerOptions=wW4;function LW4($){if($&&typeof $==="object")return"name_prefix"in $||"deliver_subject_prefix"in $||"filter_subjects"in $||"filter_subject"in $||"deliver_policy"in $||"opt_start_seq"in $||"opt_start_time"in $||"replay_policy"in $||"inactive_threshold"in $||"headers_only"in $||"deliver_prefix"in $;return!1}function OW4($){return $.isPullConsumer()}function DW4($){return $.isPushConsumer()}function wW4($){if($&&typeof $==="object")return"deliver_subject"in $||"deliver_group"in $||"idle_heartbeat"in $;return!1}ZQ$.AdvisoryKind={API:"api_audit",StreamAction:"stream_action",ConsumerAction:"consumer_action",SnapshotCreate:"snapshot_create",SnapshotComplete:"snapshot_complete",RestoreCreate:"restore_create",RestoreComplete:"restore_complete",MaxDeliver:"max_deliver",Terminated:"terminated",Ack:"consumer_ack",StreamLeaderElected:"stream_leader_elected",StreamQuorumLost:"stream_quorum_lost",ConsumerLeaderElected:"consumer_leader_elected",ConsumerQuorumLost:"consumer_quorum_lost"};ZQ$.JsHeaders={StreamSourceHdr:"Nats-Stream-Source",LastConsumerSeqHdr:"Nats-Last-Consumer",LastStreamSeqHdr:"Nats-Last-Stream",ConsumerStalledHdr:"Nats-Consumer-Stalled",MessageSizeHdr:"Nats-Msg-Size",RollupHdr:"Nats-Rollup",RollupValueSubject:"sub",RollupValueAll:"all",PendingMessagesHdr:"Nats-Pending-Messages",PendingBytesHdr:"Nats-Pending-Bytes",RequiredApiLevel:"Nats-Required-Api-Level"};ZQ$.DirectMsgHeaders={Stream:"Nats-Stream",Sequence:"Nats-Sequence",TimeStamp:"Nats-Time-Stamp",Subject:"Nats-Subject",LastSequence:"Nats-Last-Sequence",NumPending:"Nats-Num-Pending"};ZQ$.RepublishHeaders={Stream:"Nats-Stream",Subject:"Nats-Subject",Sequence:"Nats-Sequence",LastSequence:"Nats-Last-Sequence",Size:"Nats-Msg-Size"}});var _G=b((XQ$)=>{Object.defineProperty(XQ$,"__esModule",{value:!0});XQ$.TD=XQ$.TE=XQ$.Empty=void 0;XQ$.encode=MW4;XQ$.decode=IW4;XQ$.Empty=new Uint8Array(0);XQ$.TE=new TextEncoder;XQ$.TD=new TextDecoder;function qW4(...$){let Z=0;for(let Y=0;Y<$.length;Y++)Z+=$[Y].length;let Q=new Uint8Array(Z),X=0;for(let Y=0;Y<$.length;Y++)Q.set($[Y],X),X+=$[Y].length;return Q}function MW4(...$){let Z=[];for(let Q=0;Q<$.length;Q++)Z.push(XQ$.TE.encode($[Q]));if(Z.length===0)return XQ$.Empty;if(Z.length===1)return Z[0];return qW4(...Z)}function IW4($){if(!$||$.length===0)return"";return XQ$.TD.decode($)}});var vG=b((GQ$)=>{Object.defineProperty(GQ$,"__esModule",{value:!0});GQ$.errors=GQ$.PermissionViolationError=GQ$.NoRespondersError=GQ$.TimeoutError=GQ$.RequestError=GQ$.ProtocolError=GQ$.ConnectionError=GQ$.DrainingConnectionError=GQ$.ClosedConnectionError=GQ$.AuthorizationError=GQ$.UserAuthenticationExpiredError=GQ$.InvalidOperationError=GQ$.InvalidArgumentError=GQ$.InvalidSubjectError=void 0;class C11 extends Error{constructor($,Z){super(`illegal subject: '${$}'`,Z);this.name="InvalidSubjectError"}}GQ$.InvalidSubjectError=C11;class w30 extends Error{constructor($,Z){super($,Z);this.name="InvalidArgumentError"}static format($,Z,Q){if(Array.isArray(Z)&&Z.length>1)Z=Z[0];if(Array.isArray($))$=$.map((X)=>`'${X}'`),$=$.join(",");else $=`'${$}'`;return new w30(`${$} ${Z}`,Q)}}GQ$.InvalidArgumentError=w30;class _11 extends Error{constructor($,Z){super($,Z);this.name="InvalidOperationError"}}GQ$.InvalidOperationError=_11;class j30 extends Error{constructor($,Z){super($,Z);this.name="UserAuthenticationExpiredError"}static parse($){if($.toLowerCase().indexOf("user authentication expired")!==-1)return new j30($);return null}}GQ$.UserAuthenticationExpiredError=j30;class E30 extends Error{constructor($,Z){super($,Z);this.name="AuthorizationError"}static parse($){let Z=["authorization violation","account authentication expired","authentication timeout"],Q=$.toLowerCase();for(let X=0;X<Z.length;X++)if(Q.indexOf(Z[X])!==-1)return new E30($);return null}}GQ$.AuthorizationError=E30;class v11 extends Error{constructor(){super("closed connection");this.name="ClosedConnectionError"}}GQ$.ClosedConnectionError=v11;class x11 extends Error{constructor(){super("connection draining");this.name="DrainingConnectionError"}}GQ$.DrainingConnectionError=x11;class f11 extends Error{constructor($,Z){super($,Z);this.name="ConnectionError"}}GQ$.ConnectionError=f11;class b11 extends Error{constructor($,Z){super($,Z);this.name="ProtocolError"}}GQ$.ProtocolError=b11;class y11 extends Error{constructor($="",Z){super($,Z);this.name="RequestError"}isNoResponders(){return this.cause instanceof z30}}GQ$.RequestError=y11;class g11 extends Error{constructor($){super("timeout",$);this.name="TimeoutError"}}GQ$.TimeoutError=g11;class z30 extends Error{subject;constructor($,Z){super(`no responders: '${$}'`,Z);this.subject=$,this.name="NoResponders"}}GQ$.NoRespondersError=z30;class P30 extends Error{operation;subject;queue;constructor($,Z,Q,X,Y){super($,Y);this.name="PermissionViolationError",this.operation=Z,this.subject=Q,this.queue=X}static parse($){if(($?$.toLowerCase():"").indexOf("permissions violation")===-1)return null;let Q="publish",X="",Y=void 0,J=$.match(/(Publish|Subscription) to "(\S+)"/);if(J){if(Q=J[1].toLowerCase(),X=J[2],Q==="subscription"){let G=$.match(/using queue "(\S+)"/);if(G)Y=G[1]}}return new P30($,Q,X,Y)}}GQ$.PermissionViolationError=P30;GQ$.errors={AuthorizationError:E30,ClosedConnectionError:v11,ConnectionError:f11,DrainingConnectionError:x11,InvalidArgumentError:w30,InvalidOperationError:_11,InvalidSubjectError:C11,NoRespondersError:z30,PermissionViolationError:P30,ProtocolError:b11,RequestError:y11,TimeoutError:g11,UserAuthenticationExpiredError:j30}});var iW=b((UQ$)=>{Object.defineProperty(UQ$,"__esModule",{value:!0});UQ$.SimpleMutex=UQ$.Perf=void 0;UQ$.extend=dW4;UQ$.render=iW4;UQ$.timeout=pW4;UQ$.delay=nW4;UQ$.deadline=tW4;UQ$.deferred=u11;UQ$.debugDeferred=oW4;UQ$.shuffle=aW4;UQ$.collect=rW4;UQ$.jitter=FQ$;UQ$.backoff=sW4;UQ$.nanos=eW4;UQ$.millis=$H4;UQ$.randomToken=XH4;var mW4=_G(),h11=vG();function dW4($,...Z){for(let Q=0;Q<Z.length;Q++){let X=Z[Q];Object.keys(X).forEach(function(Y){$[Y]=X[Y]})}return $}function iW4($){return mW4.TD.decode($).replace(/\n/g,"\u240A").replace(/\r/g,"\u240D")}function pW4($,Z=!0){let Q=Z?new h11.TimeoutError:null,X,Y,J=new Promise((G,K)=>{X={cancel:()=>{if(Y)clearTimeout(Y)}},Y=setTimeout(()=>{if(Q===null)K(new h11.TimeoutError);else K(Q)},$)});return Object.assign(J,X)}function nW4($=0){let Z,Q=new Promise((X)=>{let Y=setTimeout(()=>{X()},$);Z={cancel:()=>{if(Y)clearTimeout(Y),X()}}});return Object.assign(Q,Z)}async function tW4($,Z=1000){let Q=u11(),X=setTimeout(()=>{Q.reject(new h11.TimeoutError)},Z);try{return await Promise.race([$,Q])}finally{clearTimeout(X)}}function u11(){let $={},Z=new Promise((Q,X)=>{$={resolve:Q,reject:X}});return Object.assign(Z,$)}function oW4(){let $={},Z=new Promise((Q,X)=>{$={resolve:(Y)=>{console.trace("resolve",Y),Q(Y)},reject:(Y)=>{console.trace("reject"),X(Y)}}});return Object.assign(Z,$)}function aW4($){for(let Z=$.length-1;Z>0;Z--){let Q=Math.floor(Math.random()*(Z+1));[$[Z],$[Q]]=[$[Q],$[Z]]}return $}async function rW4($){let Z=[];for await(let Q of $)Z.push(Q);return Z}class WQ${timers;measures;constructor(){this.timers=new Map,this.measures=new Map}mark($){this.timers.set($,performance.now())}measure($,Z,Q){let X=this.timers.get(Z);if(X===void 0)throw Error(`${Z} is not defined`);let Y=this.timers.get(Q);if(Y===void 0)throw Error(`${Q} is not defined`);this.measures.set($,Y-X)}getEntries(){let $=[];return this.measures.forEach((Z,Q)=>{$.push({name:Q,duration:Z})}),$}}UQ$.Perf=WQ$;class HQ${max;current;waiting;constructor($=1){this.max=$,this.current=0,this.waiting=[]}lock(){if(this.current++,this.current<=this.max)return Promise.resolve();let $=u11();return this.waiting.push($),$}unlock(){this.current--,this.waiting.pop()?.resolve()}}UQ$.SimpleMutex=HQ$;function FQ$($){if($===0)return 0;return Math.floor($/2+Math.random()*$)}function sW4($=[0,250,250,500,500,3000,5000]){if(!Array.isArray($))$=[0,250,250,500,500,3000,5000];let Z=$.length-1;return{backoff(Q){return FQ$(Q>Z?$[Z]:$[Q])}}}function eW4($){return $*1e6}function $H4($){return Math.floor($/1e6)}var ZH4="0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz",yB=new Uint8Array(62);for(let $=0;$<62;$++)yB[$]=ZH4.charCodeAt($);var QH4=218340105584896;function XH4(){let $=Math.floor(Math.random()*QH4),Z=$%62,Q=yB[Z];$=($-Z)/62,Z=$%62;let X=yB[Z];$=($-Z)/62,Z=$%62;let Y=yB[Z];$=($-Z)/62,Z=$%62;let J=yB[Z];$=($-Z)/62,Z=$%62;let G=yB[Z];$=($-Z)/62,Z=$%62;let K=yB[Z];$=($-Z)/62,Z=$%62;let W=yB[Z];$=($-Z)/62;let H=yB[$];return String.fromCharCode(Q,X,Y,J,G,K,W,H)}});var EQ$=b((wQ$)=>{Object.defineProperty(wQ$,"__esModule",{value:!0});wQ$.nuid=wQ$.NuidImpl=void 0;var EH4="0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz",Zw=62,A30=12,OQ$=10,BQ$=33,zH4=333,LQ$=A30+OQ$,c11=new Uint8Array(Zw);for(let $=0;$<Zw;$++)c11[$]=EH4.charCodeAt($);var T30=4294967296,DQ$=BigInt(Zw)**BigInt(OQ$),Zr=Number(DQ$/(1n<<32n)),l11=Number(DQ$%(1n<<32n));function PH4($){for(let Z=0;Z<$.length;Z++)$[Z]=Math.floor(Math.random()*256)}function TH4($){if(globalThis?.crypto?.getRandomValues)globalThis.crypto.getRandomValues($);else PH4($)}class m11{buf;cbuf;seqHi;seqLo;inc;inited;constructor(){this.buf=new Uint8Array(LQ$),this.cbuf=new Uint8Array(A30),this.inited=!1}init(){this.inited=!0,this.setPre(),this.initSeqAndInc(),this.fillSeq()}initSeqAndInc(){let $=0;do this.seqHi=Math.floor(Math.random()*(Zr+1)),this.seqLo=Math.floor(Math.random()*T30);while($++<8&&this.seqHi===Zr&&this.seqLo>=l11);if(this.seqHi===Zr&&this.seqLo>=l11)this.seqLo=0;this.inc=Math.random()*(zH4-BQ$)+BQ$|0}setPre(){TH4(this.cbuf);for(let $=0;$<A30;$++)this.buf[$]=c11[this.cbuf[$]%Zw]}fillSeq(){let $=this.seqHi,Z=this.seqLo;for(let Q=LQ$-1;Q>=A30;Q--){let X=Math.floor($/Zw),J=($-X*Zw)*T30+Z,G=Math.floor(J/Zw),K=J-G*Zw;this.buf[Q]=c11[K],$=X,Z=G}}next(){if(!this.inited)this.init();if(this.seqLo+=this.inc,this.seqLo>=T30)this.seqLo-=T30,this.seqHi+=1;if(this.seqHi>Zr||this.seqHi===Zr&&this.seqLo>=l11)this.setPre(),this.initSeqAndInc();this.fillSeq();let $=this.buf;return String.fromCharCode($[0],$[1],$[2],$[3],$[4],$[5],$[6],$[7],$[8],$[9],$[10],$[11],$[12],$[13],$[14],$[15],$[16],$[17],$[18],$[19],$[20],$[21])}reset(){this.init()}}wQ$.NuidImpl=m11;wQ$.nuid=new m11});var AQ$=b((PQ$)=>{Object.defineProperty(PQ$,"__esModule",{value:!0});PQ$.nuid=PQ$.Nuid=void 0;var zQ$=EQ$();PQ$.Nuid=zQ$.NuidImpl;PQ$.nuid=zQ$.nuid});var q30=b((R30)=>{Object.defineProperty(R30,"__esModule",{value:!0});R30.nuid=R30.Nuid=void 0;var RQ$=AQ$();Object.defineProperty(R30,"Nuid",{enumerable:!0,get:function(){return RQ$.Nuid}});Object.defineProperty(R30,"nuid",{enumerable:!0,get:function(){return RQ$.nuid}})});var Qw=b((qQ$)=>{Object.defineProperty(qQ$,"__esModule",{value:!0});qQ$.DEFAULT_HOST=qQ$.DEFAULT_PORT=qQ$.Match=void 0;qQ$.syncIterator=VH4;qQ$.createInbox=kH4;var MH4=q30(),IH4=vG();qQ$.Match={Exact:"exact",CanonicalMIME:"canonical",IgnoreCase:"insensitive"};function VH4($){let Z=$[Symbol.asyncIterator]();return{async next(){let Q=await Z.next();if(Q.done)return Promise.resolve(null);return Promise.resolve(Q.value)}}}function kH4($=""){if($=$||"_INBOX",typeof $!=="string")throw TypeError("prefix must be a string");return $.split(".").forEach((Z)=>{if(Z==="*"||Z===">")throw IH4.InvalidArgumentError.format("prefix",`cannot have wildcards ('${$}')`)}),`${$}.${MH4.nuid.next()}`}qQ$.DEFAULT_PORT=4222;qQ$.DEFAULT_HOST="127.0.0.1"});var Qr=b((kQ$)=>{Object.defineProperty(kQ$,"__esModule",{value:!0});kQ$.DataBuffer=void 0;var IQ$=_G();class VQ${buffers;byteLength;constructor(){this.buffers=[],this.byteLength=0}static concat(...$){let Z=0;for(let Y=0;Y<$.length;Y++)Z+=$[Y].length;let Q=new Uint8Array(Z),X=0;for(let Y=0;Y<$.length;Y++)Q.set($[Y],X),X+=$[Y].length;return Q}static fromAscii($){if(!$)$="";return IQ$.TE.encode($)}static toAscii($){return IQ$.TD.decode($)}reset(){this.buffers.length=0,this.byteLength=0}pack(){if(this.buffers.length>1){let $=new Uint8Array(this.byteLength),Z=0;for(let Q=0;Q<this.buffers.length;Q++)$.set(this.buffers[Q],Z),Z+=this.buffers[Q].length;this.buffers.length=0,this.buffers.push($)}}shift(){if(this.buffers.length){let $=this.buffers.shift();if($)return this.byteLength-=$.length,$}return new Uint8Array(0)}drain($){if(this.buffers.length){this.pack();let Z=this.buffers.pop();if(Z){let Q=this.byteLength;if($===void 0||$>Q)$=Q;let X=Z.subarray(0,$);if(Q>$)this.buffers.push(Z.subarray($));return this.byteLength=Q-$,X}}return new Uint8Array(0)}fill($,...Z){if($)this.buffers.push($),this.byteLength+=$.length;for(let Q=0;Q<Z.length;Q++)if(Z[Q]&&Z[Q].length)this.buffers.push(Z[Q]),this.byteLength+=Z[Q].length}peek(){if(this.buffers.length)return this.pack(),this.buffers[0];return new Uint8Array(0)}size(){return this.byteLength}length(){return this.buffers.length}}kQ$.DataBuffer=VQ$});var NT=b((_Q$)=>{Object.defineProperty(_Q$,"__esModule",{value:!0});_Q$.LF=_Q$.CR=_Q$.CRLF=_Q$.CR_LF_LEN=_Q$.CR_LF=void 0;_Q$.setTransportFactory=yH4;_Q$.defaultPort=gH4;_Q$.getUrlParseFn=hH4;_Q$.newTransport=uH4;_Q$.getResolveFn=lH4;_Q$.protoLen=CQ$;_Q$.extractProtocolMessage=cH4;var xH4=_G(),fH4=Qw(),bH4=Qr(),xG;function yH4($){xG=$}function gH4(){return xG!==void 0&&xG.defaultPort!==void 0?xG.defaultPort:fH4.DEFAULT_PORT}function hH4(){return xG!==void 0&&xG.urlParseFn?xG.urlParseFn:void 0}function uH4(){if(!xG||typeof xG.factory!=="function")throw Error("transport fn is not set");return xG.factory()}function lH4(){return xG!==void 0&&xG.dnsResolveFn?xG.dnsResolveFn:void 0}_Q$.CR_LF=`\r
+`);X=J.pop()??"";for(let G of J){let K=Bun.stripANSI(G).replace(/^\[\d+\]\s*/,"").trim();if(!K)continue;sD({method:"",path:"",status:0,duration:0,timestamp:new Date,rawLine:K})}}(async()=>{try{for(;;){let{done:J,value:G}=await Z.read();if(J)break;X+=Q.decode(G,{stream:!0}),Y()}}catch{}if(X.trim()){let J=Bun.stripANSI(X).replace(/^\[\d+\]\s*/,"").trim();if(J)sD({method:"",path:"",status:0,duration:0,timestamp:new Date,rawLine:J})}})()}async function oK4($){let{baseUrl:Z,noTui:Q}=$,X=process.env.HOST==="0.0.0.0"&&Boolean(process.env.PORT),Y=X?process.env.PORT:$.vitePort,J=Z||`http://localhost:${Y}`,G=X?await ea(Number(Y)+1):await ea(Number($.port)),{settings:K,services:W,managedServiceNames:H}=await N30({port:String(G),home:$.home,baseUrl:$.baseUrl,localMode:$.localMode,skipMigrations:$.skipMigrations,noTui:$.noTui,vitePort:$.vitePort});for(let D of W)KT({name:D.name,status:"ready",port:D.port});ra();let F=tK4(import.meta.dir,"..","..","..","..",".."),U=Q===!0,N=Bun.spawn(["bun","run","dev:servers"],{cwd:F,env:{...process.env,PORT:String(K.port),VITE_PORT:String(Y),DATABASE_URL:K.databaseUrl,NATS_URL:K.natsUrls.join(","),NODE_ENV:K.nodeEnv,BASE_URL:J,DECOCMS_LOCAL_MODE:String(K.localMode),DECOCMS_HOME:K.dataDir,DATA_DIR:K.dataDir,DECO_CLI:"1",...K.betterAuthSecret?{BETTER_AUTH_SECRET:K.betterAuthSecret}:{},...K.s3Endpoint?{S3_ENDPOINT:K.s3Endpoint,S3_BUCKET:K.s3Bucket??"",S3_ACCESS_KEY_ID:K.s3AccessKeyId??"",S3_SECRET_ACCESS_KEY:K.s3SecretAccessKey??"",S3_FORCE_PATH_STYLE:String(K.s3ForcePathStyle)}:{},...K.natsCredsPath?{NATS_CREDS:K.natsCredsPath}:{}},stdio:["inherit",U?"inherit":"pipe",U?"inherit":"pipe"]});if(!U)P11(N.stdout),P11(N.stderr);sa(J),KT({name:"Vite",status:"ready",port:Number(Y)}),KT({name:"API",status:"ready",port:Number(K.port)});let O=async(D)=>{if(N.kill(D),await N.exited,H.length>0){let{stopServices:w}=await Promise.resolve().then(() => (BG0(),NG0));await w(K.dataDir)}};return process.on("SIGINT",()=>O("SIGINT")),process.on("SIGTERM",()=>O("SIGTERM")),{port:Number(Y),process:N}}var A11=L(()=>{D11();WT();z11()});var O30;var R11=L(()=>{O30={name:"decocms",version:"4.394.0",description:"Deco CMS \u2014 Self-hostable MCP Gateway for managing AI connections and tools",author:"Deco team",repository:{type:"git",url:"git+https://github.com/decocms/studio.git",directory:"apps/api"},bugs:{url:"https://github.com/decocms/studio/issues"},type:"module",bin:{deco:"./dist/server/cli.js"},files:["dist/**/*"],scripts:{dev:"bun run migrate && bun run dev:server","dev:server":"bun run --cwd=../../packages/sandbox build && NODE_ENV=development bun --env-file=.env --hot run src/index.ts",build:"bun run build:server","build:server":"bun run scripts/bundle-server-script.ts --dist ./dist/server","generate:tool-contracts":"bun run scripts/generate-tool-contracts.ts","db:migrate":"bun run ./dist/server/migrate.js","db:migrate:dbos":"bun run ./dist/server/migrate-dbos.js",check:"tsc --noEmit",start:"bun run ./dist/server/server.js",migrate:"bun run src/database/migrate.ts","migrate:dbos":"bun run src/database/migrate-dbos.ts",test:"bun test src","better-auth:migrate":"bunx --bun @better-auth/cli migrate -y --config src/auth/index.ts",prepublishOnly:"bun run --cwd=../.. build:studio"},optionalDependencies:{"@duckdb/node-api":"^1.5.0-r.1"},dependencies:{"@ai-sdk/anthropic":"^4.0.58","@ai-sdk/google":"^4.0.76","@ai-sdk/openai":"^4.0.71","@anthropic-ai/sdk":"^0.105.0","@aws-sdk/client-s3":"^3.1013.0","@aws-sdk/client-sts":"^3.1013.0","@aws-sdk/lib-storage":"^3.1013.0","@aws-sdk/s3-request-presigner":"^3.1013.0","@clickhouse/client":"^1.8.1","@dbos-inc/dbos-sdk":"^4.21.6","@inkjs/ui":"^2.0.0","@nats-io/jetstream":"3.4.0","@nats-io/kv":"3.4.0","@nats-io/nats-core":"3.4.0","@nats-io/transport-node":"3.4.0","@openrouter/ai-sdk-provider":"^3.1.0","@opentelemetry/core":"^2.6.0","embedded-postgres":"^18.3.0-beta.16",ink:"^6.8.0",kysely:"^0.28.12","posthog-node":"^5.0.0",react:"^19.2.6","react-dom":"^19.2.6"},devDependencies:{"@ai-sdk/provider":"^4.0.17","@better-auth/sso":"1.4.1","@decocms/better-auth":"1.5.17","@decocms/bindings":"workspace:*","@decocms/mcp-utils":"workspace:*","@decocms/runtime":"workspace:*","@decocms/sandbox":"workspace:*","@decocms/shared":"workspace:*","@jitl/quickjs-wasmfile-release-sync":"0.31.0","@modelcontextprotocol/sdk":"1.29.0","@opentelemetry/api":"^1.9.0","@opentelemetry/api-logs":"^0.211.0","@opentelemetry/exporter-logs-otlp-proto":"^0.211.0","@opentelemetry/exporter-prometheus":"^0.208.0","@opentelemetry/exporter-trace-otlp-proto":"^0.207.0","@opentelemetry/instrumentation-runtime-node":"^0.24.0","@opentelemetry/resources":"^2.6.0","@opentelemetry/sdk-logs":"^0.211.0","@opentelemetry/sdk-metrics":"^2.2.0","@opentelemetry/sdk-node":"^0.207.0","@opentelemetry/sdk-trace-base":"^2.5.0","@types/bun":"^1.3.1","@types/google.maps":"^3.65.2","@types/pg":"^8.15.6","@types/react-syntax-highlighter":"^15.5.13","@vercel/nft":"^1.1.1",ai:"^7.0.107","better-auth":"1.4.22",croner:"^9.1.0",degit:"^2.8.4",hono:"^4.10.7",jose:"^6.0.11",nanoid:"^5.1.6",pg:"^8.16.3",typescript:"^7.0.2",typescript5:"npm:typescript@^5.9.3",zod:"4.3.6"},homepage:"https://github.com/decocms/studio",keywords:["mcp","model-context-protocol","ai","gateway","self-hosted","tools"],license:"MIT",publishConfig:{access:"public"}}});import{Box as rK4,Text as _7$}from"ink";import{jsx as sK4,jsxs as v7$}from"react/jsx-runtime";function x7$({version:$}){return v7$(rK4,{flexDirection:"column",marginTop:1,children:[bG0.map((Z,Q)=>sK4(_7$,{color:yG0[Q],children:Z},Q)),v7$(_7$,{dimColor:!0,children:[" v",$]})]})}var f7$=L(()=>{fa()});import{Box as HT,Text as eD}from"ink";import{Spinner as eK4}from"@inkjs/ui";import{jsx as CG,jsxs as zl}from"react/jsx-runtime";function b7$({status:$}){if($==="pending")return CG(eK4,{label:""});return CG(eD,{color:"green",children:"\u2713"})}function $W4($){return`${$.name}: ${$.port||"...."}`}function y7$({services:$,migrationsStatus:Z,home:Q,serverUrl:X}){return zl(HT,{flexDirection:"column",paddingBottom:1,children:[CG(x7$,{version:O30.version}),CG(HT,{marginBottom:1,children:CG(eD,{dimColor:!0,children:"\u2500".repeat(80)})}),CG(HT,{children:zl(eD,{dimColor:!0,children:["Home: ",Q]})}),zl(HT,{gap:2,children:[$.map((Y)=>zl(HT,{gap:1,children:[CG(eD,{children:$W4(Y)}),CG(b7$,{status:Y.status})]},Y.name)),zl(HT,{gap:1,children:[CG(eD,{children:"Migrations"}),CG(b7$,{status:Z})]})]}),CG(HT,{children:X?zl(eD,{children:["Open in browser: ",CG(eD,{color:"cyan",children:X})]}):CG(eD,{dimColor:!0,children:"Starting..."})})]})}var g7$=L(()=>{R11();f7$()});import{Box as ZW4,Text as $r}from"ink";import{jsx as q11,jsxs as M11}from"react/jsx-runtime";function QW4($){if($>=500)return"red";if($>=400)return"yellow";if($>=300)return"cyan";return"green"}function h7$({logs:$}){return q11(ZW4,{flexDirection:"column",children:$.map((Z,Q)=>{if(Z.rawLine)return q11($r,{dimColor:!0,children:Z.rawLine},Q);let X=Z.duration<1000?`${Z.duration}ms`:`${(Z.duration/1000).toFixed(1)}s`;return M11($r,{children:[M11($r,{dimColor:!0,children:[Z.method.padEnd(6)," ",Z.path.padEnd(30)," "]}),q11($r,{color:QW4(Z.status),children:Z.status}),M11($r,{dimColor:!0,children:[" ",X.padStart(8)]})]},Q)})})}var u7$=()=>{};var I11={};K0(I11,{App:()=>JW4});import{Box as XW4}from"ink";import{useSyncExternalStore as YW4}from"react";import{jsx as l7$,jsxs as GW4}from"react/jsx-runtime";function JW4({home:$}){let Z=YW4(E11,j11);return GW4(XW4,{flexDirection:"column",children:[l7$(y7$,{services:Z.services,migrationsStatus:Z.migrationsStatus,home:$,serverUrl:Z.serverUrl}),l7$(h7$,{logs:Z.logs})]})}var V11=L(()=>{g7$();u7$();WT()});var WK="thread-gate",fB="decopilot-hosted-harness",bB="decopilot-hosted-harness-sandboxed",HK="automations",$w="background-tools",FT="task-board-github-reads";var c7$="13";function m7$($){return{name:"decocms",systemDatabaseUrl:$.systemDatabaseUrl,systemDatabaseSchemaName:"dbos",systemDatabasePoolSize:$.poolSize,runAdminServer:!1,executorID:$.executorID,applicationVersion:c7$,...$.listenQueues!==void 0?{listenQueues:$.listenQueues}:{}}}var d7$=()=>{};import KW4 from"pg";async function p7$($,Z){let{databaseUrl:Q,lockTimeoutMs:X=WW4}=$,Y=$.log??((W)=>console.log(W)),J=new KW4.Client({connectionString:Q});await J.connect();let G=Date.now(),K=!1;try{while(!K){if(K=(await J.query("SELECT pg_try_advisory_lock($1) AS locked",[i7$.toString()])).rows[0]?.locked===!0,K)break;if(Date.now()-G>=X)throw Error(`Timed out after ${X}ms waiting for the DBOS migration lock. Another process is still migrating the dbos schema; this pod will restart and retry.`);await k$(HW4)}let W=Date.now()-G;if(W>1000)Y(`[dbos] waited ${W}ms for the migration lock; another process migrated first`);return await Z()}finally{if(K)try{await J.query("SELECT pg_advisory_unlock($1)",[i7$.toString()])}catch{}await J.end().catch(()=>{})}}var i7$=8314027461559302n,WW4=600000,HW4=500;var n7$=L(()=>{O8()});function FW4(){let $=(process.env.BUN_OPTIONS??"").split(/\s+/).filter(Boolean);return[...process.argv.slice(1),...$]}function k11($,Z){for(let Q=0;Q<$.length;Q++){let X=$[Q];if(X===void 0)continue;if(X===Z)return $[Q+1];if(X.startsWith(`${Z}=`))return X.slice(Z.length+1)}return}function t7$(){let $=FW4();if($.includes("--cpu-prof")){console.log(JSON.stringify({msg:"cpu-profiling-active",dir:k11($,"--cpu-prof-dir")??process.cwd(),name:k11($,"--cpu-prof-name"),markdown:$.includes("--cpu-prof-md"),intervalUs:Number(k11($,"--cpu-prof-interval")??1000),note:"profile is written on process exit"}));return}if(process.env.CPU_PROFILE)console.warn(JSON.stringify({msg:"cpu-profiling-requested-but-inactive",hint:'CPU profiling is a Bun launch flag. Set BUN_OPTIONS="--cpu-prof --cpu-prof-md --cpu-prof-dir=/tmp" before starting the process.'}))}function o7$(){if(process.env.HEAP_WATCH!=="1")return()=>{};let $=Number(process.env.HEAP_WATCH_INTERVAL_MS??60000),Z=async()=>{let Q=XT();if(!Q)return;let X={};try{let{heapStats:Y}=await import("bun:jsc"),J=Y(),G=Object.entries(J.objectTypeCounts).sort((K,W)=>W[1]-K[1]).slice(0,20);X={objectCount:J.objectCount,heapSize:J.heapSize,top:Object.fromEntries(G)}}catch{}console.log(JSON.stringify({msg:"heap-watch",ts:new Date().toISOString(),uptimeS:Math.round(process.uptime()),rss:Q.rss,heapUsed:Q.heapUsed,heapTotal:Q.heapTotal,external:Q.external,arrayBuffers:Q.arrayBuffers,...X}))};return Z().catch(()=>{}),D30=setInterval(()=>void Z().catch(()=>{}),$),D30.unref?.(),process.on("SIGUSR2",()=>{try{let Q=Bun.generateHeapSnapshot("v8"),X=typeof Q==="string"?Q:JSON.stringify(Q),Y=`/tmp/heap-${process.pid}-${Date.now()}.heapsnapshot`;Bun.write(Y,X),console.log(JSON.stringify({msg:"heap-snapshot-written",path:Y}))}catch(Q){console.error("[heap-watch] snapshot failed:",Q)}}),()=>{if(D30)clearInterval(D30)}}var D30;var a7$=()=>{};import*as UW4 from"bun:jsc";function r7$(){if(process.env.STALL_WATCHDOG!=="1")return()=>{};let $=Number(process.env.STALL_WATCHDOG_MS??100),Z=Number(process.env.STALL_WATCHDOG_TICK_MS??50);try{NW4()}catch(J){return console.error("[stall-watchdog] failed to start sampling profiler:",J),()=>{}}let Q,X=performance.now()+Z,Y=()=>{let J=performance.now(),G=J-X;X=J+Z;let K=[];try{K=BW4()?.traces??[]}catch{}if(G>$&&K.length>0){let W=new Map;for(let F of K){let U=F.frames.find((O)=>O.sourceURL&&!/Unknown Executable/.test(O.category??""))??F.frames[0];if(!U)continue;let N=(U.sourceURL??"?").replace(/^.*\/node_modules\//,"node_modules/"),B=`${U.name??"?"} @ ${N}:${U.line??"?"}`;W.set(B,(W.get(B)??0)+1)}let H=[...W.entries()].sort((F,U)=>U[1]-F[1]).slice(0,8).map(([F,U])=>({frame:F,count:U}));console.warn(JSON.stringify({msg:"stall-stack",ts:new Date().toISOString(),lagMs:Math.round(G),samplesInWindow:K.length,top:H}))}Q=setTimeout(Y,Z),Q.unref?.()};return Q=setTimeout(Y,Z),Q.unref?.(),()=>{if(Q)clearTimeout(Q)}}var NW4,BW4;var s7$=L(()=>{({startSamplingProfiler:NW4,samplingProfilerStackTraces:BW4}=UW4)});function e7$(){t7$();let $=[o7$(),b4$(),r7$()];return()=>{for(let Z of $)Z()}}var $Q$=L(()=>{ja0();a7$();s7$()});var UT=b((ZQ$)=>{Object.defineProperty(ZQ$,"__esModule",{value:!0});ZQ$.RepublishHeaders=ZQ$.DirectMsgHeaders=ZQ$.JsHeaders=ZQ$.AdvisoryKind=void 0;ZQ$.isOrderedPushConsumerOptions=LW4;ZQ$.isPullConsumer=OW4;ZQ$.isPushConsumer=DW4;ZQ$.isBoundPushConsumerOptions=wW4;function LW4($){if($&&typeof $==="object")return"name_prefix"in $||"deliver_subject_prefix"in $||"filter_subjects"in $||"filter_subject"in $||"deliver_policy"in $||"opt_start_seq"in $||"opt_start_time"in $||"replay_policy"in $||"inactive_threshold"in $||"headers_only"in $||"deliver_prefix"in $;return!1}function OW4($){return $.isPullConsumer()}function DW4($){return $.isPushConsumer()}function wW4($){if($&&typeof $==="object")return"deliver_subject"in $||"deliver_group"in $||"idle_heartbeat"in $;return!1}ZQ$.AdvisoryKind={API:"api_audit",StreamAction:"stream_action",ConsumerAction:"consumer_action",SnapshotCreate:"snapshot_create",SnapshotComplete:"snapshot_complete",RestoreCreate:"restore_create",RestoreComplete:"restore_complete",MaxDeliver:"max_deliver",Terminated:"terminated",Ack:"consumer_ack",StreamLeaderElected:"stream_leader_elected",StreamQuorumLost:"stream_quorum_lost",ConsumerLeaderElected:"consumer_leader_elected",ConsumerQuorumLost:"consumer_quorum_lost"};ZQ$.JsHeaders={StreamSourceHdr:"Nats-Stream-Source",LastConsumerSeqHdr:"Nats-Last-Consumer",LastStreamSeqHdr:"Nats-Last-Stream",ConsumerStalledHdr:"Nats-Consumer-Stalled",MessageSizeHdr:"Nats-Msg-Size",RollupHdr:"Nats-Rollup",RollupValueSubject:"sub",RollupValueAll:"all",PendingMessagesHdr:"Nats-Pending-Messages",PendingBytesHdr:"Nats-Pending-Bytes",RequiredApiLevel:"Nats-Required-Api-Level"};ZQ$.DirectMsgHeaders={Stream:"Nats-Stream",Sequence:"Nats-Sequence",TimeStamp:"Nats-Time-Stamp",Subject:"Nats-Subject",LastSequence:"Nats-Last-Sequence",NumPending:"Nats-Num-Pending"};ZQ$.RepublishHeaders={Stream:"Nats-Stream",Subject:"Nats-Subject",Sequence:"Nats-Sequence",LastSequence:"Nats-Last-Sequence",Size:"Nats-Msg-Size"}});var _G=b((XQ$)=>{Object.defineProperty(XQ$,"__esModule",{value:!0});XQ$.TD=XQ$.TE=XQ$.Empty=void 0;XQ$.encode=MW4;XQ$.decode=IW4;XQ$.Empty=new Uint8Array(0);XQ$.TE=new TextEncoder;XQ$.TD=new TextDecoder;function qW4(...$){let Z=0;for(let Y=0;Y<$.length;Y++)Z+=$[Y].length;let Q=new Uint8Array(Z),X=0;for(let Y=0;Y<$.length;Y++)Q.set($[Y],X),X+=$[Y].length;return Q}function MW4(...$){let Z=[];for(let Q=0;Q<$.length;Q++)Z.push(XQ$.TE.encode($[Q]));if(Z.length===0)return XQ$.Empty;if(Z.length===1)return Z[0];return qW4(...Z)}function IW4($){if(!$||$.length===0)return"";return XQ$.TD.decode($)}});var vG=b((GQ$)=>{Object.defineProperty(GQ$,"__esModule",{value:!0});GQ$.errors=GQ$.PermissionViolationError=GQ$.NoRespondersError=GQ$.TimeoutError=GQ$.RequestError=GQ$.ProtocolError=GQ$.ConnectionError=GQ$.DrainingConnectionError=GQ$.ClosedConnectionError=GQ$.AuthorizationError=GQ$.UserAuthenticationExpiredError=GQ$.InvalidOperationError=GQ$.InvalidArgumentError=GQ$.InvalidSubjectError=void 0;class C11 extends Error{constructor($,Z){super(`illegal subject: '${$}'`,Z);this.name="InvalidSubjectError"}}GQ$.InvalidSubjectError=C11;class w30 extends Error{constructor($,Z){super($,Z);this.name="InvalidArgumentError"}static format($,Z,Q){if(Array.isArray(Z)&&Z.length>1)Z=Z[0];if(Array.isArray($))$=$.map((X)=>`'${X}'`),$=$.join(",");else $=`'${$}'`;return new w30(`${$} ${Z}`,Q)}}GQ$.InvalidArgumentError=w30;class _11 extends Error{constructor($,Z){super($,Z);this.name="InvalidOperationError"}}GQ$.InvalidOperationError=_11;class j30 extends Error{constructor($,Z){super($,Z);this.name="UserAuthenticationExpiredError"}static parse($){if($.toLowerCase().indexOf("user authentication expired")!==-1)return new j30($);return null}}GQ$.UserAuthenticationExpiredError=j30;class E30 extends Error{constructor($,Z){super($,Z);this.name="AuthorizationError"}static parse($){let Z=["authorization violation","account authentication expired","authentication timeout"],Q=$.toLowerCase();for(let X=0;X<Z.length;X++)if(Q.indexOf(Z[X])!==-1)return new E30($);return null}}GQ$.AuthorizationError=E30;class v11 extends Error{constructor(){super("closed connection");this.name="ClosedConnectionError"}}GQ$.ClosedConnectionError=v11;class x11 extends Error{constructor(){super("connection draining");this.name="DrainingConnectionError"}}GQ$.DrainingConnectionError=x11;class f11 extends Error{constructor($,Z){super($,Z);this.name="ConnectionError"}}GQ$.ConnectionError=f11;class b11 extends Error{constructor($,Z){super($,Z);this.name="ProtocolError"}}GQ$.ProtocolError=b11;class y11 extends Error{constructor($="",Z){super($,Z);this.name="RequestError"}isNoResponders(){return this.cause instanceof z30}}GQ$.RequestError=y11;class g11 extends Error{constructor($){super("timeout",$);this.name="TimeoutError"}}GQ$.TimeoutError=g11;class z30 extends Error{subject;constructor($,Z){super(`no responders: '${$}'`,Z);this.subject=$,this.name="NoResponders"}}GQ$.NoRespondersError=z30;class P30 extends Error{operation;subject;queue;constructor($,Z,Q,X,Y){super($,Y);this.name="PermissionViolationError",this.operation=Z,this.subject=Q,this.queue=X}static parse($){if(($?$.toLowerCase():"").indexOf("permissions violation")===-1)return null;let Q="publish",X="",Y=void 0,J=$.match(/(Publish|Subscription) to "(\S+)"/);if(J){if(Q=J[1].toLowerCase(),X=J[2],Q==="subscription"){let G=$.match(/using queue "(\S+)"/);if(G)Y=G[1]}}return new P30($,Q,X,Y)}}GQ$.PermissionViolationError=P30;GQ$.errors={AuthorizationError:E30,ClosedConnectionError:v11,ConnectionError:f11,DrainingConnectionError:x11,InvalidArgumentError:w30,InvalidOperationError:_11,InvalidSubjectError:C11,NoRespondersError:z30,PermissionViolationError:P30,ProtocolError:b11,RequestError:y11,TimeoutError:g11,UserAuthenticationExpiredError:j30}});var iW=b((UQ$)=>{Object.defineProperty(UQ$,"__esModule",{value:!0});UQ$.SimpleMutex=UQ$.Perf=void 0;UQ$.extend=dW4;UQ$.render=iW4;UQ$.timeout=pW4;UQ$.delay=nW4;UQ$.deadline=tW4;UQ$.deferred=u11;UQ$.debugDeferred=oW4;UQ$.shuffle=aW4;UQ$.collect=rW4;UQ$.jitter=FQ$;UQ$.backoff=sW4;UQ$.nanos=eW4;UQ$.millis=$H4;UQ$.randomToken=XH4;var mW4=_G(),h11=vG();function dW4($,...Z){for(let Q=0;Q<Z.length;Q++){let X=Z[Q];Object.keys(X).forEach(function(Y){$[Y]=X[Y]})}return $}function iW4($){return mW4.TD.decode($).replace(/\n/g,"\u240A").replace(/\r/g,"\u240D")}function pW4($,Z=!0){let Q=Z?new h11.TimeoutError:null,X,Y,J=new Promise((G,K)=>{X={cancel:()=>{if(Y)clearTimeout(Y)}},Y=setTimeout(()=>{if(Q===null)K(new h11.TimeoutError);else K(Q)},$)});return Object.assign(J,X)}function nW4($=0){let Z,Q=new Promise((X)=>{let Y=setTimeout(()=>{X()},$);Z={cancel:()=>{if(Y)clearTimeout(Y),X()}}});return Object.assign(Q,Z)}async function tW4($,Z=1000){let Q=u11(),X=setTimeout(()=>{Q.reject(new h11.TimeoutError)},Z);try{return await Promise.race([$,Q])}finally{clearTimeout(X)}}function u11(){let $={},Z=new Promise((Q,X)=>{$={resolve:Q,reject:X}});return Object.assign(Z,$)}function oW4(){let $={},Z=new Promise((Q,X)=>{$={resolve:(Y)=>{console.trace("resolve",Y),Q(Y)},reject:(Y)=>{console.trace("reject"),X(Y)}}});return Object.assign(Z,$)}function aW4($){for(let Z=$.length-1;Z>0;Z--){let Q=Math.floor(Math.random()*(Z+1));[$[Z],$[Q]]=[$[Q],$[Z]]}return $}async function rW4($){let Z=[];for await(let Q of $)Z.push(Q);return Z}class WQ${timers;measures;constructor(){this.timers=new Map,this.measures=new Map}mark($){this.timers.set($,performance.now())}measure($,Z,Q){let X=this.timers.get(Z);if(X===void 0)throw Error(`${Z} is not defined`);let Y=this.timers.get(Q);if(Y===void 0)throw Error(`${Q} is not defined`);this.measures.set($,Y-X)}getEntries(){let $=[];return this.measures.forEach((Z,Q)=>{$.push({name:Q,duration:Z})}),$}}UQ$.Perf=WQ$;class HQ${max;current;waiting;constructor($=1){this.max=$,this.current=0,this.waiting=[]}lock(){if(this.current++,this.current<=this.max)return Promise.resolve();let $=u11();return this.waiting.push($),$}unlock(){this.current--,this.waiting.pop()?.resolve()}}UQ$.SimpleMutex=HQ$;function FQ$($){if($===0)return 0;return Math.floor($/2+Math.random()*$)}function sW4($=[0,250,250,500,500,3000,5000]){if(!Array.isArray($))$=[0,250,250,500,500,3000,5000];let Z=$.length-1;return{backoff(Q){return FQ$(Q>Z?$[Z]:$[Q])}}}function eW4($){return $*1e6}function $H4($){return Math.floor($/1e6)}var ZH4="0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz",yB=new Uint8Array(62);for(let $=0;$<62;$++)yB[$]=ZH4.charCodeAt($);var QH4=218340105584896;function XH4(){let $=Math.floor(Math.random()*QH4),Z=$%62,Q=yB[Z];$=($-Z)/62,Z=$%62;let X=yB[Z];$=($-Z)/62,Z=$%62;let Y=yB[Z];$=($-Z)/62,Z=$%62;let J=yB[Z];$=($-Z)/62,Z=$%62;let G=yB[Z];$=($-Z)/62,Z=$%62;let K=yB[Z];$=($-Z)/62,Z=$%62;let W=yB[Z];$=($-Z)/62;let H=yB[$];return String.fromCharCode(Q,X,Y,J,G,K,W,H)}});var EQ$=b((wQ$)=>{Object.defineProperty(wQ$,"__esModule",{value:!0});wQ$.nuid=wQ$.NuidImpl=void 0;var EH4="0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz",Zw=62,A30=12,OQ$=10,BQ$=33,zH4=333,LQ$=A30+OQ$,c11=new Uint8Array(Zw);for(let $=0;$<Zw;$++)c11[$]=EH4.charCodeAt($);var T30=4294967296,DQ$=BigInt(Zw)**BigInt(OQ$),Zr=Number(DQ$/(1n<<32n)),l11=Number(DQ$%(1n<<32n));function PH4($){for(let Z=0;Z<$.length;Z++)$[Z]=Math.floor(Math.random()*256)}function TH4($){if(globalThis?.crypto?.getRandomValues)globalThis.crypto.getRandomValues($);else PH4($)}class m11{buf;cbuf;seqHi;seqLo;inc;inited;constructor(){this.buf=new Uint8Array(LQ$),this.cbuf=new Uint8Array(A30),this.inited=!1}init(){this.inited=!0,this.setPre(),this.initSeqAndInc(),this.fillSeq()}initSeqAndInc(){let $=0;do this.seqHi=Math.floor(Math.random()*(Zr+1)),this.seqLo=Math.floor(Math.random()*T30);while($++<8&&this.seqHi===Zr&&this.seqLo>=l11);if(this.seqHi===Zr&&this.seqLo>=l11)this.seqLo=0;this.inc=Math.random()*(zH4-BQ$)+BQ$|0}setPre(){TH4(this.cbuf);for(let $=0;$<A30;$++)this.buf[$]=c11[this.cbuf[$]%Zw]}fillSeq(){let $=this.seqHi,Z=this.seqLo;for(let Q=LQ$-1;Q>=A30;Q--){let X=Math.floor($/Zw),J=($-X*Zw)*T30+Z,G=Math.floor(J/Zw),K=J-G*Zw;this.buf[Q]=c11[K],$=X,Z=G}}next(){if(!this.inited)this.init();if(this.seqLo+=this.inc,this.seqLo>=T30)this.seqLo-=T30,this.seqHi+=1;if(this.seqHi>Zr||this.seqHi===Zr&&this.seqLo>=l11)this.setPre(),this.initSeqAndInc();this.fillSeq();let $=this.buf;return String.fromCharCode($[0],$[1],$[2],$[3],$[4],$[5],$[6],$[7],$[8],$[9],$[10],$[11],$[12],$[13],$[14],$[15],$[16],$[17],$[18],$[19],$[20],$[21])}reset(){this.init()}}wQ$.NuidImpl=m11;wQ$.nuid=new m11});var AQ$=b((PQ$)=>{Object.defineProperty(PQ$,"__esModule",{value:!0});PQ$.nuid=PQ$.Nuid=void 0;var zQ$=EQ$();PQ$.Nuid=zQ$.NuidImpl;PQ$.nuid=zQ$.nuid});var q30=b((R30)=>{Object.defineProperty(R30,"__esModule",{value:!0});R30.nuid=R30.Nuid=void 0;var RQ$=AQ$();Object.defineProperty(R30,"Nuid",{enumerable:!0,get:function(){return RQ$.Nuid}});Object.defineProperty(R30,"nuid",{enumerable:!0,get:function(){return RQ$.nuid}})});var Qw=b((qQ$)=>{Object.defineProperty(qQ$,"__esModule",{value:!0});qQ$.DEFAULT_HOST=qQ$.DEFAULT_PORT=qQ$.Match=void 0;qQ$.syncIterator=VH4;qQ$.createInbox=kH4;var MH4=q30(),IH4=vG();qQ$.Match={Exact:"exact",CanonicalMIME:"canonical",IgnoreCase:"insensitive"};function VH4($){let Z=$[Symbol.asyncIterator]();return{async next(){let Q=await Z.next();if(Q.done)return Promise.resolve(null);return Promise.resolve(Q.value)}}}function kH4($=""){if($=$||"_INBOX",typeof $!=="string")throw TypeError("prefix must be a string");return $.split(".").forEach((Z)=>{if(Z==="*"||Z===">")throw IH4.InvalidArgumentError.format("prefix",`cannot have wildcards ('${$}')`)}),`${$}.${MH4.nuid.next()}`}qQ$.DEFAULT_PORT=4222;qQ$.DEFAULT_HOST="127.0.0.1"});var Qr=b((kQ$)=>{Object.defineProperty(kQ$,"__esModule",{value:!0});kQ$.DataBuffer=void 0;var IQ$=_G();class VQ${buffers;byteLength;constructor(){this.buffers=[],this.byteLength=0}static concat(...$){let Z=0;for(let Y=0;Y<$.length;Y++)Z+=$[Y].length;let Q=new Uint8Array(Z),X=0;for(let Y=0;Y<$.length;Y++)Q.set($[Y],X),X+=$[Y].length;return Q}static fromAscii($){if(!$)$="";return IQ$.TE.encode($)}static toAscii($){return IQ$.TD.decode($)}reset(){this.buffers.length=0,this.byteLength=0}pack(){if(this.buffers.length>1){let $=new Uint8Array(this.byteLength),Z=0;for(let Q=0;Q<this.buffers.length;Q++)$.set(this.buffers[Q],Z),Z+=this.buffers[Q].length;this.buffers.length=0,this.buffers.push($)}}shift(){if(this.buffers.length){let $=this.buffers.shift();if($)return this.byteLength-=$.length,$}return new Uint8Array(0)}drain($){if(this.buffers.length){this.pack();let Z=this.buffers.pop();if(Z){let Q=this.byteLength;if($===void 0||$>Q)$=Q;let X=Z.subarray(0,$);if(Q>$)this.buffers.push(Z.subarray($));return this.byteLength=Q-$,X}}return new Uint8Array(0)}fill($,...Z){if($)this.buffers.push($),this.byteLength+=$.length;for(let Q=0;Q<Z.length;Q++)if(Z[Q]&&Z[Q].length)this.buffers.push(Z[Q]),this.byteLength+=Z[Q].length}peek(){if(this.buffers.length)return this.pack(),this.buffers[0];return new Uint8Array(0)}size(){return this.byteLength}length(){return this.buffers.length}}kQ$.DataBuffer=VQ$});var NT=b((_Q$)=>{Object.defineProperty(_Q$,"__esModule",{value:!0});_Q$.LF=_Q$.CR=_Q$.CRLF=_Q$.CR_LF_LEN=_Q$.CR_LF=void 0;_Q$.setTransportFactory=yH4;_Q$.defaultPort=gH4;_Q$.getUrlParseFn=hH4;_Q$.newTransport=uH4;_Q$.getResolveFn=lH4;_Q$.protoLen=CQ$;_Q$.extractProtocolMessage=cH4;var xH4=_G(),fH4=Qw(),bH4=Qr(),xG;function yH4($){xG=$}function gH4(){return xG!==void 0&&xG.defaultPort!==void 0?xG.defaultPort:fH4.DEFAULT_PORT}function hH4(){return xG!==void 0&&xG.urlParseFn?xG.urlParseFn:void 0}function uH4(){if(!xG||typeof xG.factory!=="function")throw Error("transport fn is not set");return xG.factory()}function lH4(){return xG!==void 0&&xG.dnsResolveFn?xG.dnsResolveFn:void 0}_Q$.CR_LF=`\r
 `;_Q$.CR_LF_LEN=_Q$.CR_LF.length;_Q$.CRLF=bH4.DataBuffer.fromAscii(_Q$.CR_LF);_Q$.CR=new Uint8Array(_Q$.CRLF)[0];_Q$.LF=new Uint8Array(_Q$.CRLF)[1];function CQ$($){for(let Z=0;Z<$.length;Z++){let Q=Z+1;if($.byteLength>Q&&$[Z]===_Q$.CR&&$[Q]===_Q$.LF)return Q+1}return 0}function cH4($){let Z=CQ$($);if(Z>0){let X=new Uint8Array($).slice(0,Z);return xH4.TD.decode(X)}return""}});var t11=b((uQ$)=>{Object.defineProperty(uQ$,"__esModule",{value:!0});uQ$.ipV4=yQ$;uQ$.isIP=eH4;uQ$.parseIP=gQ$;var Xr=4,BT=16,M30=48,bQ$=57,xQ$=65,rH4=70,fQ$=97,sH4=102,n11=16777215;function yQ$($,Z,Q,X){let Y=new Uint8Array(BT);return[0,0,0,0,0,0,0,0,0,0,255,255].forEach((G,K)=>{Y[K]=G}),Y[12]=$,Y[13]=Z,Y[14]=Q,Y[15]=X,Y}function eH4($){return gQ$($)!==void 0}function gQ$($){for(let Z=0;Z<$.length;Z++)switch($[Z]){case".":return hQ$($);case":":return $F4($)}return}function hQ$($){let Z=new Uint8Array(Xr);for(let Q=0;Q<Xr;Q++){if($.length===0)return;if(Q>0){if($[0]!==".")return;$=$.substring(1)}let{n:X,c:Y,ok:J}=ZF4($);if(!J||X>255)return;$=$.substring(Y),Z[Q]=X}return yQ$(Z[0],Z[1],Z[2],Z[3])}function $F4($){let Z=new Uint8Array(BT),Q=-1;if($.length>=2&&$[0]===":"&&$[1]===":"){if(Q=0,$=$.substring(2),$.length===0)return Z}let X=0;while(X<BT){let{n:Y,c:J,ok:G}=QF4($);if(!G||Y>65535)return;if(J<$.length&&$[J]==="."){if(Q<0&&X!=BT-Xr)return;if(X+Xr>BT)return;let K=hQ$($);if(K===void 0)return;Z[X]=K[12],Z[X+1]=K[13],Z[X+2]=K[14],Z[X+3]=K[15],$="",X+=Xr;break}if(Z[X]=Y>>8,Z[X+1]=Y,X+=2,$=$.substring(J),$.length===0)break;if($[0]!==":"||$.length==1)return;if($=$.substring(1),$[0]===":"){if(Q>=0)return;if(Q=X,$=$.substring(1),$.length===0)break}}if($.length!==0)return;if(X<BT){if(Q<0)return;let Y=BT-X;for(let J=X-1;J>=Q;J--)Z[J+Y]=Z[J];for(let J=Q+Y-1;J>=Q;J--)Z[J]=0}else if(Q>=0)return;return Z}function ZF4($){let Z=0,Q=0;for(Z=0;Z<$.length&&M30<=$.charCodeAt(Z)&&$.charCodeAt(Z)<=bQ$;Z++)if(Q=Q*10+($.charCodeAt(Z)-M30),Q>=n11)return{n:n11,c:Z,ok:!1};if(Z===0)return{n:0,c:0,ok:!1};return{n:Q,c:Z,ok:!0}}function QF4($){let Z=0,Q=0;for(Q=0;Q<$.length;Q++){if(M30<=$.charCodeAt(Q)&&$.charCodeAt(Q)<=bQ$)Z*=16,Z+=$.charCodeAt(Q)-M30;else if(fQ$<=$.charCodeAt(Q)&&$.charCodeAt(Q)<=sH4)Z*=16,Z+=$.charCodeAt(Q)-fQ$+10;else if(xQ$<=$.charCodeAt(Q)&&$.charCodeAt(Q)<=rH4)Z*=16,Z+=$.charCodeAt(Q)-xQ$+10;else break;if(Z>=n11)return{n:0,c:Q,ok:!1}}if(Q===0)return{n:0,c:Q,ok:!1};return{n:Z,c:Q,ok:!0}}});var $$1=b((cQ$)=>{Object.defineProperty(cQ$,"__esModule",{value:!0});cQ$.Servers=cQ$.ServerImpl=void 0;cQ$.isIPV4OrHostname=lQ$;cQ$.hostPort=e11;var o11=NT(),a11=iW(),r11=t11(),GF4=Qw(),KF4=vG();function lQ$($){if($.indexOf("[")!==-1||$.indexOf("::")!==-1)return!1;if($.indexOf(".")!==-1)return!0;if($.split(":").length<=2)return!0;return!1}function s11($){return!lQ$($)}function WF4($){let Q=$.toUpperCase().indexOf("::FFFF:");if(Q!==-1&&$.indexOf(".")!==-1){let X=$.substring(Q+7);return X=X.replace("[",""),X.replace("]","")}return $}function e11($){if($=$.trim(),$.match(/^(.*:\/\/)(.*)/m))$=$.replace(/^(.*:\/\/)(.*)/gm,"$2");if($=WF4($),s11($)&&$.indexOf("[")===-1)$=`[${$}]`;let Z=s11($)?$.match(/(]:)(\d+)/):$.match(/(:)(\d+)/),Q=Z&&Z.length===3&&Z[1]&&Z[2]?parseInt(Z[2]):GF4.DEFAULT_PORT,Y=new URL(`${Q===80?"https":"http"}://${$}`);Y.port=`${Q}`;let J=Y.hostname;if(J.charAt(0)==="[")J=J.substring(1,J.length-1);return{listen:Y.host,hostname:J,port:Q}}class Pl{src;listen;hostname;port;didConnect;reconnects;lastConnect;gossiped;tlsName;resolves;constructor($,Z=!1){this.src=$,this.tlsName="";let Q=e11($);this.listen=Q.listen,this.hostname=Q.hostname,this.port=Q.port,this.didConnect=!1,this.reconnects=0,this.lastConnect=0,this.gossiped=Z}toString(){return this.listen}async resolve($){if(!$.fn||$.resolve===!1)return[this];let Z=[];if((0,r11.isIP)(this.hostname))return[this];else{let Q=await $.fn(this.hostname);if($.debug)console.log(`resolve ${this.hostname} = ${Q.join(",")}`);for(let X of Q){let Y=this.port===80?"https":"http",J=new URL(`${Y}://${s11(X)?"["+X+"]":X}`);J.port=`${this.port}`;let G=new Pl(J.host,!1);G.tlsName=this.hostname,Z.push(G)}}if($.randomize)(0,a11.shuffle)(Z);return this.resolves=Z,Z}}cQ$.ServerImpl=Pl;class I30{firstSelect;servers;currentServer;tlsName;randomize;constructor($={}){this.firstSelect=!0,this.servers=[],this.tlsName="",this.randomize=$.randomize||!1}setServers($){if(!Array.isArray($)||$.length===0)throw KF4.InvalidArgumentError.format("servers","cannot be empty");let Z=(0,o11.getUrlParseFn)(),Q=new Map;for(let Y of this.servers)Q.set(Y.listen,Y);let X=[];for(let Y of $){Y=Z?Z(Y):Y;let{listen:J}=e11(Y),G=Q.get(J);if(G)G.gossiped=!1,X.push(G);else X.push(new Pl(Y))}if(this.randomize)(0,a11.shuffle)(X);if(this.servers=X,this.currentServer===void 0||!X.includes(this.currentServer))this.currentServer=X[0],this.firstSelect=!0}clear(){this.servers.length=0}updateTLSName(){let $=this.getCurrentServer();if(!(0,r11.isIP)($.hostname))this.tlsName=$.hostname,this.servers.forEach((Z)=>{if(Z.gossiped)Z.tlsName=this.tlsName})}getCurrentServer(){return this.currentServer}addServer($,Z=!1){let Q=(0,o11.getUrlParseFn)();$=Q?Q($):$;let X=new Pl($,Z);if((0,r11.isIP)(X.hostname))X.tlsName=this.tlsName;this.servers.push(X)}selectServer(){if(this.firstSelect)return this.firstSelect=!1,this.currentServer;let $=this.servers.shift();if($)this.servers.push($),this.currentServer=$;return $}removeCurrentServer(){this.removeServer(this.currentServer)}removeServer($){if($){let Z=this.servers.indexOf($);this.servers.splice(Z,1)}}snapshot(){return I30.freezeAll(this.servers)}snapshotForHandler(){let $=this.currentServer;if(!$)return this.snapshot();let Z=this.servers.indexOf($);if(Z<=0)return this.snapshot();return I30.freezeAll([$,...this.servers.slice(0,Z),...this.servers.slice(Z+1)])}static freezeAll($){return $.map((Z)=>Object.freeze({hostname:Z.hostname,port:Z.port,listen:Z.listen,src:Z.src,tlsName:Z.tlsName,reconnects:Z.reconnects,lastConnect:Z.lastConnect,gossiped:Z.gossiped,didConnect:Z.didConnect}))}find($){return this.servers.find((Z)=>Z.listen===$.listen)}setCurrent($){this.currentServer=$}length(){return this.servers.length}next(){return this.servers.length?this.servers[0]:void 0}getServers(){return this.servers}update($,Z){let Q=[],X=[],Y=(0,o11.getUrlParseFn)(),J=new Map;if($.connect_urls&&$.connect_urls.length>0)$.connect_urls.forEach((K)=>{K=Y?Y(K,Z):K;let W=new Pl(K,!0);J.set(K,W)});let G=[];if(this.servers.forEach((K,W)=>{let H=K.listen;if(K.gossiped&&this.currentServer.listen!==H&&J.get(H)===void 0)G.push(W);J.delete(H)}),G.reverse(),G.forEach((K)=>{let W=this.servers.splice(K,1);X=X.concat(W[0].listen)}),J.forEach((K,W)=>{this.servers.push(K),Q.push(W)}),this.randomize&&Q.length>0){let K=this.currentServer,W=this.servers.filter((H)=>H!==K);(0,a11.shuffle)(W),this.servers=K?[K,...W]:W}return{added:Q,deleted:X}}}cQ$.Servers=I30});var V30=b((pQ$)=>{Object.defineProperty(pQ$,"__esModule",{value:!0});pQ$.QueuedIteratorImpl=void 0;var Z$1=iW(),dQ$=vG();class iQ${inflight;processed;received;noIterator;iterClosed;done;signal;yields;filtered;pendingFiltered;ctx;_data;err;time;profile;yielding;didBreak;constructor(){this.inflight=0,this.filtered=0,this.pendingFiltered=0,this.processed=0,this.received=0,this.noIterator=!1,this.done=!1,this.signal=(0,Z$1.deferred)(),this.yields=[],this.iterClosed=(0,Z$1.deferred)(),this.time=0,this.yielding=!1,this.didBreak=!1,this.profile=!1}[Symbol.asyncIterator](){return this.iterate()}push($){if(this.done)return;if(this.didBreak){if(typeof $==="function"){let Z=$;try{Z()}catch(Q){}}return}if(typeof $==="function")this.pendingFiltered++;this.yields.push($),this.signal.resolve()}async*iterate(){if(this.noIterator)throw new dQ$.InvalidOperationError("iterator cannot be used when a callback is registered");if(this.yielding)throw new dQ$.InvalidOperationError("iterator is already yielding");this.yielding=!0;try{while(!0){if(this.yields.length===0)await this.signal;if(this.err)throw this.err;let $=this.yields;this.inflight=$.length,this.yields=[];for(let Z=0;Z<$.length;Z++){if(typeof $[Z]==="function"){this.pendingFiltered--;let X=$[Z];try{X()}catch(Y){throw Y}if(this.err)throw this.err;continue}this.processed++,this.inflight--;let Q=this.profile?Date.now():0;yield $[Z],this.time=this.profile?Date.now()-Q:0}if(this.done)break;else if(this.yields.length===0)$.length=0,this.yields=$,this.signal=(0,Z$1.deferred)()}}finally{this.didBreak=!0,this.stop()}}stop($){if(this.done)return;this.err=$,this.done=!0,this.signal.resolve(),this.iterClosed.resolve($)}getProcessed(){return this.noIterator?this.received:this.processed}getPending(){return this.yields.length+this.inflight-this.pendingFiltered}getReceived(){return this.received-this.filtered}}pQ$.QueuedIteratorImpl=iQ$});var Q$1=b((aQ$)=>{Object.defineProperty(aQ$,"__esModule",{value:!0});aQ$.MuxSubscription=void 0;var NF4=Qw(),tQ$=vG();class oQ${baseInbox;reqs;constructor(){this.reqs=new Map}size(){return this.reqs.size}init($){return this.baseInbox=`${(0,NF4.createInbox)($)}.`,this.baseInbox}add($){if(!isNaN($.received))$.received=0;this.reqs.set($.token,$)}get($){return this.reqs.get($)}cancel($){this.reqs.delete($.token)}getToken($){let Z=$.subject||"";if(Z.indexOf(this.baseInbox)===0)return Z.substring(this.baseInbox.length);return null}all(){return Array.from(this.reqs.values())}handleError($,Z){if($)return this.all().forEach((Q)=>{Q.resolver(Z,{})}),!0;if(Z.operation==="publish"){let Q=this.all().find((X)=>{return X.requestSubject===Z.subject});if(Q)return Q.resolver(Z,{}),!0}return!1}dispatcher(){return($,Z)=>{let Q=this.getToken(Z);if(Q){let X=this.get(Q);if(X){if($===null)$=Z?.data?.length===0&&Z.headers?.code===503?new tQ$.NoRespondersError(X.requestSubject):null;X.resolver($,Z)}}}}close(){let $=new tQ$.RequestError("connection closed");this.reqs.forEach((Z)=>{Z.resolver($,{})})}}aQ$.MuxSubscription=oQ$});var X$1=b((eQ$)=>{Object.defineProperty(eQ$,"__esModule",{value:!0});eQ$.Heartbeat=void 0;var BF4=iW();class sQ${ph;interval;maxOut;timer;pendings;constructor($,Z,Q){this.ph=$,this.interval=Z,this.maxOut=Q,this.pendings=[]}start(){this.cancel(),this._schedule()}cancel($){if(this.timer)clearTimeout(this.timer),this.timer=void 0;if(this._reset(),$)this.ph.disconnect()}_schedule(){this.timer=setTimeout(()=>{if(this.ph.dispatchStatus({type:"ping",pendingPings:this.pendings.length+1}),this.pendings.length===this.maxOut){this.cancel(!0);return}let $=(0,BF4.deferred)();this.ph.flush($).then(()=>{this._reset()}).catch(()=>{this.cancel()}),this.pendings.push($),this._schedule()},this.interval)}_reset(){this.pendings=this.pendings.filter(($)=>{return $.resolve(),!1})}}eQ$.Heartbeat=sQ$});var G$1=b((YX$)=>{Object.defineProperty(YX$,"__esModule",{value:!0});YX$.DenoBuffer=YX$.MAX_SIZE=YX$.AssertionError=void 0;YX$.assert=QX$;YX$.concat=XX$;YX$.append=OF4;YX$.readAll=DF4;YX$.writeAll=wF4;var LF4=_G();class Y$1 extends Error{constructor($){super($);this.name="AssertionError"}}YX$.AssertionError=Y$1;function QX$($,Z="Assertion failed."){if(!$)throw new Y$1(Z)}var ZX$=32768;YX$.MAX_SIZE=4294967294;function k30($,Z,Q=0){let X=Z.byteLength-Q;if($.byteLength>X)$=$.subarray(0,X);return Z.set($,Q),$.byteLength}function XX$($,Z){if($===void 0&&Z===void 0)return new Uint8Array(0);if($===void 0)return Z;if(Z===void 0)return $;let Q=new Uint8Array($.length+Z.length);return Q.set($,0),Q.set(Z,$.length),Q}function OF4($,Z){return XX$($,Uint8Array.of(Z))}class J$1{_buf;_off;constructor($){if(this._off=0,$==null){this._buf=new Uint8Array(0);return}this._buf=new Uint8Array($)}bytes($={copy:!0}){if($.copy===!1)return this._buf.subarray(this._off);return this._buf.slice(this._off)}empty(){return this._buf.byteLength<=this._off}get length(){return this._buf.byteLength-this._off}get capacity(){return this._buf.buffer.byteLength}truncate($){if($===0){this.reset();return}if($<0||$>this.length)throw Error("bytes.Buffer: truncation out of range");this._reslice(this._off+$)}reset(){this._reslice(0),this._off=0}_tryGrowByReslice($){let Z=this._buf.byteLength;if($<=this.capacity-Z)return this._reslice(Z+$),Z;return-1}_reslice($){QX$($<=this._buf.buffer.byteLength),this._buf=new Uint8Array(this._buf.buffer,0,$)}readByte(){let $=new Uint8Array(1);if(this.read($))return $[0];return null}read($){if(this.empty()){if(this.reset(),$.byteLength===0)return 0;return null}let Z=k30(this._buf.subarray(this._off),$);return this._off+=Z,Z}writeByte($){return this.write(Uint8Array.of($))}writeString($){return this.write(LF4.TE.encode($))}write($){let Z=this._grow($.byteLength);return k30($,this._buf,Z)}_grow($){let Z=this.length;if(Z===0&&this._off!==0)this.reset();let Q=this._tryGrowByReslice($);if(Q>=0)return Q;let X=this.capacity;if($<=Math.floor(X/2)-Z)k30(this._buf.subarray(this._off),this._buf);else if(X+$>YX$.MAX_SIZE)throw Error("The buffer cannot be grown beyond the maximum size.");else{let Y=new Uint8Array(Math.min(2*X+$,YX$.MAX_SIZE));k30(this._buf.subarray(this._off),Y),this._buf=Y}return this._off=0,this._reslice(Math.min(Z+$,YX$.MAX_SIZE)),Z}grow($){if($<0)throw Error("Buffer._grow: negative count");let Z=this._grow($);this._reslice(Z)}readFrom($){let Z=0,Q=new Uint8Array(ZX$);while(!0){let X=this.capacity-this.length<ZX$,Y=X?Q:new Uint8Array(this._buf.buffer,this.length),J=$.read(Y);if(J===null)return Z;if(X)this.write(Y.subarray(0,J));else this._reslice(this.length+J);Z+=J}}}YX$.DenoBuffer=J$1;function DF4($){let Z=new J$1;return Z.readFrom($),Z.bytes()}function wF4($,Z){let Q=0;while(Q<Z.length)Q+=$.write(Z.subarray(Q))}});var H$1=b((HX$)=>{Object.defineProperty(HX$,"__esModule",{value:!0});HX$.cc=HX$.State=HX$.Parser=HX$.Kind=void 0;HX$.describe=RF4;var K$1=G$1(),W$1=_G();HX$.Kind={OK:0,ERR:1,MSG:2,INFO:3,PING:4,PONG:5};function RF4($){let Z,Q="";switch($.kind){case HX$.Kind.MSG:Z="MSG";break;case HX$.Kind.OK:Z="OK";break;case HX$.Kind.ERR:Z="ERR",Q=W$1.TD.decode($.data);break;case HX$.Kind.PING:Z="PING";break;case HX$.Kind.PONG:Z="PONG";break;case HX$.Kind.INFO:Z="INFO",Q=W$1.TD.decode($.data)}return`${Z}: ${Q}`}function GX$(){let $={};return $.sid=-1,$.hdr=-1,$.size=-1,$}var KX$=48,qF4=57,Tl=67108864;class WX${dispatcher;state;as;drop;hdr;ma;argBuf;msgBuf;constructor($){this.dispatcher=$,this.state=HX$.State.OP_START,this.as=0,this.drop=0,this.hdr=0}parse($){let Z;for(Z=0;Z<$.length;Z++){let Q=$[Z];switch(this.state){case HX$.State.OP_START:switch(Q){case HX$.cc.M:case HX$.cc.m:this.state=HX$.State.OP_M,this.hdr=-1,this.ma=GX$();break;case HX$.cc.H:case HX$.cc.h:this.state=HX$.State.OP_H,this.hdr=0,this.ma=GX$();break;case HX$.cc.P:case HX$.cc.p:this.state=HX$.State.OP_P;break;case HX$.cc.PLUS:this.state=HX$.State.OP_PLUS;break;case HX$.cc.MINUS:this.state=HX$.State.OP_MINUS;break;case HX$.cc.I:case HX$.cc.i:this.state=HX$.State.OP_I;break;default:throw this.fail($.subarray(Z))}break;case HX$.State.OP_H:switch(Q){case HX$.cc.M:case HX$.cc.m:this.state=HX$.State.OP_M;break;default:throw this.fail($.subarray(Z))}break;case HX$.State.OP_M:switch(Q){case HX$.cc.S:case HX$.cc.s:this.state=HX$.State.OP_MS;break;default:throw this.fail($.subarray(Z))}break;case HX$.State.OP_MS:switch(Q){case HX$.cc.G:case HX$.cc.g:this.state=HX$.State.OP_MSG;break;default:throw this.fail($.subarray(Z))}break;case HX$.State.OP_MSG:switch(Q){case HX$.cc.SPACE:case HX$.cc.TAB:this.state=HX$.State.OP_MSG_SPC;break;default:throw this.fail($.subarray(Z))}break;case HX$.State.OP_MSG_SPC:switch(Q){case HX$.cc.SPACE:case HX$.cc.TAB:continue;default:this.state=HX$.State.MSG_ARG,this.as=Z}break;case HX$.State.MSG_ARG:switch(Q){case HX$.cc.CR:this.drop=1;break;case HX$.cc.NL:{let X=this.argBuf?this.argBuf.bytes():$.subarray(this.as,Z-this.drop);this.processMsgArgs(X),this.drop=0,this.as=Z+1,this.state=HX$.State.MSG_PAYLOAD,Z=this.as+this.ma.size-1;break}default:if(this.argBuf)this.argBuf.writeByte(Q)}break;case HX$.State.MSG_PAYLOAD:if(this.msgBuf)if(this.msgBuf.length>=this.ma.size){let X=this.msgBuf.bytes({copy:!1});this.dispatcher.push({kind:HX$.Kind.MSG,msg:this.ma,data:X}),this.argBuf=void 0,this.msgBuf=void 0,this.state=HX$.State.MSG_END}else{let X=this.ma.size-this.msgBuf.length,Y=$.length-Z;if(Y<X)X=Y;if(X>0)this.msgBuf.write($.subarray(Z,Z+X)),Z=Z+X-1;else this.msgBuf.writeByte(Q)}else if(Z-this.as>=this.ma.size)this.dispatcher.push({kind:HX$.Kind.MSG,msg:this.ma,data:$.subarray(this.as,Z)}),this.argBuf=void 0,this.msgBuf=void 0,this.state=HX$.State.MSG_END;break;case HX$.State.MSG_END:switch(Q){case HX$.cc.NL:this.drop=0,this.as=Z+1,this.state=HX$.State.OP_START;break;default:continue}break;case HX$.State.OP_PLUS:switch(Q){case HX$.cc.O:case HX$.cc.o:this.state=HX$.State.OP_PLUS_O;break;default:throw this.fail($.subarray(Z))}break;case HX$.State.OP_PLUS_O:switch(Q){case HX$.cc.K:case HX$.cc.k:this.state=HX$.State.OP_PLUS_OK;break;default:throw this.fail($.subarray(Z))}break;case HX$.State.OP_PLUS_OK:switch(Q){case HX$.cc.NL:this.dispatcher.push({kind:HX$.Kind.OK}),this.drop=0,this.state=HX$.State.OP_START;break}break;case HX$.State.OP_MINUS:switch(Q){case HX$.cc.E:case HX$.cc.e:this.state=HX$.State.OP_MINUS_E;break;default:throw this.fail($.subarray(Z))}break;case HX$.State.OP_MINUS_E:switch(Q){case HX$.cc.R:case HX$.cc.r:this.state=HX$.State.OP_MINUS_ER;break;default:throw this.fail($.subarray(Z))}break;case HX$.State.OP_MINUS_ER:switch(Q){case HX$.cc.R:case HX$.cc.r:this.state=HX$.State.OP_MINUS_ERR;break;default:throw this.fail($.subarray(Z))}break;case HX$.State.OP_MINUS_ERR:switch(Q){case HX$.cc.SPACE:case HX$.cc.TAB:this.state=HX$.State.OP_MINUS_ERR_SPC;break;default:throw this.fail($.subarray(Z))}break;case HX$.State.OP_MINUS_ERR_SPC:switch(Q){case HX$.cc.SPACE:case HX$.cc.TAB:continue;default:this.state=HX$.State.MINUS_ERR_ARG,this.as=Z}break;case HX$.State.MINUS_ERR_ARG:switch(Q){case HX$.cc.CR:this.drop=1;break;case HX$.cc.NL:{let X;if(this.argBuf)X=this.argBuf.bytes(),this.argBuf=void 0;else X=$.subarray(this.as,Z-this.drop);this.dispatcher.push({kind:HX$.Kind.ERR,data:X}),this.drop=0,this.as=Z+1,this.state=HX$.State.OP_START;break}default:if(this.argBuf)this.argBuf.write(Uint8Array.of(Q))}break;case HX$.State.OP_P:switch(Q){case HX$.cc.I:case HX$.cc.i:this.state=HX$.State.OP_PI;break;case HX$.cc.O:case HX$.cc.o:this.state=HX$.State.OP_PO;break;default:throw this.fail($.subarray(Z))}break;case HX$.State.OP_PO:switch(Q){case HX$.cc.N:case HX$.cc.n:this.state=HX$.State.OP_PON;break;default:throw this.fail($.subarray(Z))}break;case HX$.State.OP_PON:switch(Q){case HX$.cc.G:case HX$.cc.g:this.state=HX$.State.OP_PONG;break;default:throw this.fail($.subarray(Z))}break;case HX$.State.OP_PONG:switch(Q){case HX$.cc.NL:this.dispatcher.push({kind:HX$.Kind.PONG}),this.drop=0,this.state=HX$.State.OP_START;break}break;case HX$.State.OP_PI:switch(Q){case HX$.cc.N:case HX$.cc.n:this.state=HX$.State.OP_PIN;break;default:throw this.fail($.subarray(Z))}break;case HX$.State.OP_PIN:switch(Q){case HX$.cc.G:case HX$.cc.g:this.state=HX$.State.OP_PING;break;default:throw this.fail($.subarray(Z))}break;case HX$.State.OP_PING:switch(Q){case HX$.cc.NL:this.dispatcher.push({kind:HX$.Kind.PING}),this.drop=0,this.state=HX$.State.OP_START;break}break;case HX$.State.OP_I:switch(Q){case HX$.cc.N:case HX$.cc.n:this.state=HX$.State.OP_IN;break;default:throw this.fail($.subarray(Z))}break;case HX$.State.OP_IN:switch(Q){case HX$.cc.F:case HX$.cc.f:this.state=HX$.State.OP_INF;break;default:throw this.fail($.subarray(Z))}break;case HX$.State.OP_INF:switch(Q){case HX$.cc.O:case HX$.cc.o:this.state=HX$.State.OP_INFO;break;default:throw this.fail($.subarray(Z))}break;case HX$.State.OP_INFO:switch(Q){case HX$.cc.SPACE:case HX$.cc.TAB:this.state=HX$.State.OP_INFO_SPC;break;default:throw this.fail($.subarray(Z))}break;case HX$.State.OP_INFO_SPC:switch(Q){case HX$.cc.SPACE:case HX$.cc.TAB:continue;default:this.state=HX$.State.INFO_ARG,this.as=Z}break;case HX$.State.INFO_ARG:switch(Q){case HX$.cc.CR:this.drop=1;break;case HX$.cc.NL:{let X;if(this.argBuf)X=this.argBuf.bytes(),this.argBuf=void 0;else X=$.subarray(this.as,Z-this.drop);this.dispatcher.push({kind:HX$.Kind.INFO,data:X}),this.drop=0,this.as=Z+1,this.state=HX$.State.OP_START;break}default:if(this.argBuf)this.argBuf.writeByte(Q)}break;default:throw this.fail($.subarray(Z))}}if((this.state===HX$.State.MSG_ARG||this.state===HX$.State.MINUS_ERR_ARG||this.state===HX$.State.INFO_ARG)&&!this.argBuf)this.argBuf=new K$1.DenoBuffer($.subarray(this.as,Z-this.drop));if(this.state===HX$.State.MSG_PAYLOAD&&!this.msgBuf){if(!this.argBuf)this.cloneMsgArg();this.msgBuf=new K$1.DenoBuffer($.subarray(this.as))}}cloneMsgArg(){let $=this.ma.subject.length,Z=this.ma.reply?this.ma.reply.length:0,Q=new Uint8Array($+Z);if(Q.set(this.ma.subject),this.ma.reply)Q.set(this.ma.reply,$);if(this.argBuf=new K$1.DenoBuffer(Q),this.ma.subject=Q.subarray(0,$),this.ma.reply)this.ma.reply=Q.subarray($)}processMsgArgs($){if(this.hdr>=0)return this.processHeaderMsgArgs($);let Z=[],Q=-1;for(let X=0;X<$.length;X++)switch($[X]){case HX$.cc.SPACE:case HX$.cc.TAB:case HX$.cc.CR:case HX$.cc.NL:if(Q>=0)Z.push($.subarray(Q,X)),Q=-1;break;default:if(Q<0)Q=X}if(Q>=0)Z.push($.subarray(Q));switch(Z.length){case 3:this.ma.subject=Z[0],this.ma.sid=this.protoParseInt(Z[1]),this.ma.reply=void 0,this.ma.size=this.protoParseInt(Z[2],Tl);break;case 4:this.ma.subject=Z[0],this.ma.sid=this.protoParseInt(Z[1]),this.ma.reply=Z[2],this.ma.size=this.protoParseInt(Z[3],Tl);break;default:throw this.fail($,"processMsgArgs Parse Error")}if(this.ma.sid<0)throw this.fail($,"processMsgArgs Bad or Missing Sid Error");if(this.ma.size<0)throw this.fail($,"processMsgArgs Bad or Missing Size Error")}fail($,Z=""){if(!Z)Z=`parse error [${this.state}]`;else Z=`${Z} [${this.state}]`;return Error(`${Z}: ${W$1.TD.decode($)}`)}processHeaderMsgArgs($){let Z=[],Q=-1;for(let X=0;X<$.length;X++)switch($[X]){case HX$.cc.SPACE:case HX$.cc.TAB:case HX$.cc.CR:case HX$.cc.NL:if(Q>=0)Z.push($.subarray(Q,X)),Q=-1;break;default:if(Q<0)Q=X}if(Q>=0)Z.push($.subarray(Q));switch(Z.length){case 4:this.ma.subject=Z[0],this.ma.sid=this.protoParseInt(Z[1]),this.ma.reply=void 0,this.ma.hdr=this.protoParseInt(Z[2],Tl),this.ma.size=this.protoParseInt(Z[3],Tl);break;case 5:this.ma.subject=Z[0],this.ma.sid=this.protoParseInt(Z[1]),this.ma.reply=Z[2],this.ma.hdr=this.protoParseInt(Z[3],Tl),this.ma.size=this.protoParseInt(Z[4],Tl);break;default:throw this.fail($,"processHeaderMsgArgs Parse Error")}if(this.ma.sid<0)throw this.fail($,"processHeaderMsgArgs Bad or Missing Sid Error");if(this.ma.hdr<0||this.ma.hdr>this.ma.size)throw this.fail($,"processHeaderMsgArgs Bad or Missing Header Size Error");if(this.ma.size<0)throw this.fail($,"processHeaderMsgArgs Bad or Missing Size Error")}protoParseInt($,Z){if($.length===0||$.length>15)return-1;let Q=0;for(let X=0;X<$.length;X++){if($[X]<KX$||$[X]>qF4)return-1;Q=Q*10+($[X]-KX$)}return Z!==void 0&&Q>Z?-1:Q}}HX$.Parser=WX$;HX$.State={OP_START:0,OP_PLUS:1,OP_PLUS_O:2,OP_PLUS_OK:3,OP_MINUS:4,OP_MINUS_E:5,OP_MINUS_ER:6,OP_MINUS_ERR:7,OP_MINUS_ERR_SPC:8,MINUS_ERR_ARG:9,OP_M:10,OP_MS:11,OP_MSG:12,OP_MSG_SPC:13,MSG_ARG:14,MSG_PAYLOAD:15,MSG_END:16,OP_H:17,OP_P:18,OP_PI:19,OP_PIN:20,OP_PING:21,OP_PO:22,OP_PON:23,OP_PONG:24,OP_I:25,OP_IN:26,OP_INF:27,OP_INFO:28,OP_INFO_SPC:29,INFO_ARG:30};HX$.cc={CR:13,E:69,e:101,F:70,f:102,G:71,g:103,H:72,h:104,I:73,i:105,K:75,k:107,M:77,m:109,MINUS:45,N:78,n:110,NL:10,O:79,o:111,P:80,p:112,PLUS:43,R:82,r:114,S:83,s:115,SPACE:32,TAB:9}});var _30=b((UX$)=>{Object.defineProperty(UX$,"__esModule",{value:!0});UX$.MsgHdrsImpl=void 0;UX$.canonicalMIMEHeaderKey=U$1;UX$.headers=VF4;var FX$=_G(),pW=Qw(),C30=vG();function U$1($){let F=!0,U=Array($.length);for(let N=0;N<$.length;N++){let B=$.charCodeAt(N);if(B===58||B<33||B>126)throw C30.InvalidArgumentError.format("header",`'${$[N]}' is not a valid character in a header name`);if(F&&97<=B&&B<=122)B-=32;else if(!F&&65<=B&&B<=90)B+=32;U[N]=B,F=B==45}return String.fromCharCode(...U)}function VF4($=0,Z=""){if($===0&&Z!=="")throw C30.InvalidArgumentError.format("code","is required");else if($>0&&Z==="")throw C30.InvalidArgumentError.format("description","is required");return new Al($,Z)}var F$1="NATS/1.0";class Al{_code;headers;_description;constructor($=0,Z=""){this._code=$,this._description=Z,this.headers=new Map}[Symbol.iterator](){return this.headers.entries()}size(){return this.headers.size}equals($){if($&&this.headers.size===$.headers.size&&this._code===$._code){for(let[Z,Q]of this.headers){let X=$.values(Z);if(Q.length!==X.length)return!1;let Y=[...Q].sort(),J=[...X].sort();for(let G=0;G<Y.length;G++)if(Y[G]!==J[G])return!1}return!0}return!1}static decode($){let Z=new Al,X=FX$.TD.decode($).split(`\r
 `),Y=X[0];if(Y!==F$1){let J=Y.replace(F$1,"").trim();if(J.length>0){if(Z._code=parseInt(J,10),isNaN(Z._code))Z._code=0;let G=Z._code.toString();J=J.replace(G,""),Z._description=J.trim()}}if(X.length>=1)X.slice(1).map((J)=>{if(J){let G=J.indexOf(":");if(G>-1){let K=J.slice(0,G),W=J.slice(G+1).trim();Z.append(K,W)}}});return Z}toString(){if(this.headers.size===0&&this._code===0)return"";let $=F$1;if(this._code>0&&this._description!=="")$+=` ${this._code} ${this._description}`;for(let[Z,Q]of this.headers)for(let X=0;X<Q.length;X++)$=`${$}\r
 ${Z}: ${Q[X]}`;return`${$}\r
@@ -3271,7 +3271,7 @@ Caused by: ${Z.stack}`}};Fi=class Fi extends uX{constructor($,Z){super($,Z);this
 ${Y}`:Y}var Nm$,tW6;var lH1=L(()=>{Nm$=/[\r\n<>]/,tW6=/^[^\s@<>]+@[^\s@<>]+\.[^\s@<>]+$/});var PV0=L(()=>{O8();lH1()});function aW6($){if($ instanceof TypeError)return!0;if($ instanceof Error&&!($ instanceof DOMException)&&typeof $.code==="string")return!0;if($ instanceof DOMException&&$.name==="AbortError")return!0;return!1}async function cH1($,Z,Q,X){try{return await V8(async()=>{let J=await fetch($,{...Z,signal:AbortSignal.timeout(X)});return{status:J.status,ok:J.ok,body:await J.text()}},{maxAttempts:3,minTimeout:50,maxTimeout:500,multiplier:2,jitter:0.5,isRetriable:aW6})}catch(Y){let J=Y instanceof Error?Y.message:String(Y);throw Error(`[SANDBOX_UNREACHABLE] sandbox daemon ${Q} request failed: ${J}`,{cause:Y})}}async function TV0($){try{let Z=await fetch(`${$}/health`,{signal:AbortSignal.timeout(rW6)});if(!Z.ok){try{await Z.text()}catch{}return null}let Q=await Z.json();if(typeof Q==="object"&&Q!==null&&typeof Q.bootId==="string"&&typeof Q.ready==="boolean"&&Q.setup&&typeof Q.setup.running==="boolean"&&typeof Q.setup.done==="boolean")return Q;return null}catch{return null}}async function dH1($){for(let Z=0;Z<Lm$;Z++){if(await TV0($)!==null)return;let Q=(Math.random()*2-1)*sW6;await k$(Om$+Q)}throw Error(`sandbox daemon at ${$} did not respond on /health within ${Lm$*Om$/1000}s`)}async function jy($,Z,Q,X,Y){return eW6($,Z,"POST",Q,X,Y)}async function eW6($,Z,Q,X,Y,J){let G={...X};if(Y&&Y.rotateToken!==void 0)G.auth=Y;let K=await cH1(`${$}/_sandbox/config`,{method:Q,headers:{"Content-Type":"application/json",Authorization:`Bearer ${Z}`},body:JSON.stringify(G)},"/_sandbox/config",J?.timeoutMs??mH1);if(!K.ok)throw new wy(K.status,K.body);return jm$(K.body,"/_sandbox/config")}async function Dm$($,Z,Q){let X=await cH1(`${$}/_sandbox/setup/${Q}`,{method:"POST",headers:{Authorization:`Bearer ${Z}`}},`/_sandbox/setup/${Q}`,mH1);if(!X.ok)throw Error(`sandbox daemon /_sandbox/setup/${Q} returned ${X.status}: ${X.body}`)}async function wm$($,Z,Q){let X=await cH1(`${$}/_sandbox/orgfs-config`,{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${Z}`},body:Q},"/_sandbox/orgfs-config",mH1);if(!X.ok)throw Error(`sandbox daemon /_sandbox/orgfs-config returned ${X.status}: ${X.body}`);return jm$(X.body,"/_sandbox/orgfs-config")}function jm$($,Z){try{return JSON.parse($)}catch(Q){throw Error(`sandbox daemon ${Z} returned a malformed JSON body: ${$.slice(0,200)}`,{cause:Q})}}async function g80($,Z,Q,X){let Y=new Headers(X.headers);for(let K of $H6)Y.delete(K);Y.set("authorization",`Bearer ${Z}`);let J=X.method!=="GET"&&X.method!=="HEAD",G=`${$}${Q.startsWith("/")?Q:`/${Q}`}`;return fetch(G,{method:X.method,headers:Y,body:J?X.body:void 0,redirect:"manual",signal:X.signal,duplex:J?"half":void 0})}var wy,rW6=500,mH1=30000,Lm$=25,Om$=200,sW6=50,$H6;var iH1=L(()=>{PV0();O8();wy=class wy extends Error{status;constructor($,Z){super(`sandbox daemon /_sandbox/config returned ${$}: ${Z}`);this.status=$;this.name="ConfigRequestError"}};$H6=["cookie","host","connection","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","accept-encoding","content-length"]});class AV0{counted=new Set;markCounted($){this.counted.add($)}consume($){return this.counted.delete($)}}class RV0{map=new Map;async run($,Z){let Q=this.map.get($);if(Q)return Q;let X=Z();this.map.set($,X);try{return await X}finally{this.map.delete($)}}}function qV0($,Z,Q){if(!$)return Q(null);if(!$.withLock)return Q($);return $.withLock(Z,Q)}function h80($){if(!$.orgId||!$.virtualMcpId||!$.branch)throw Error("composeSandboxRef: orgId, virtualMcpId and branch are all required for agent refs");return`agent:${$.orgId}:${$.virtualMcpId}:${$.branch}`}function Em$($){if(!$.startsWith("agent:"))return"";let Z=$.split(":");return Z.length>=4?Z.slice(3).join(":"):""}function zm$($){return`${$.userId}:${$.projectRef}`}import{hash as ZH6}from"crypto";function QH6($,Z=16){return ZH6("sha256",zm$($),"hex").slice(0,Z)}function Ey($){let Z=QH6($),Q=XH6(Em$($.projectRef));return Q?`${Q}-${Z}`:`s-${Z}`}function XH6($){if(!$)return"";let Z=$.split("/").pop()??"",Q="",X=!1;for(let Y of Z.toLowerCase()){let J=Y.charCodeAt(0),G=J>=97&&J<=122,K=J>=48&&J<=57;if(!G&&!K){X||=Q.length>0;continue}if(X){if(Q.length+1>=Pm$)break;Q+="-",X=!1}if(Q+=Y,Q.length===Pm$)break}return Q}var Pm$=24;var Tm$=()=>{};function MV0($,Z){let Q=$.replace(/\/+$/,"");if(Q.includes("{handle}"))return`${Q.replace("{handle}",Z)}/`;try{let X=new URL(Q);return X.hostname=`${Z}.${X.hostname}`,`${X.toString()}/`}catch{return`${Q}/${Z}/`}}function IV0($){let Z=$.repo,Q=Z?{repository:{cloneUrl:Z.cloneUrl,repoName:Z.displayName??YH6(Z.cloneUrl),...Z.branch?{branch:Z.branch}:{},submoduleCredentials:Z.submoduleCredentials??[]},repositories:($.extraRepos??[]).filter((W)=>!!W.directoryName).map((W)=>({cloneUrl:W.cloneUrl,repoName:W.directoryName,...W.branch?{branch:W.branch}:{},submoduleCredentials:W.submoduleCredentials??[]})),...Z.userName.trim()||Z.userEmail.trim()?{identity:{userName:Z.userName,userEmail:Z.userEmail}}:{}}:void 0,X=$.tenant,Y=qi({userName:X?.userName,userEmail:X?.userEmail})??void 0,J=$.packageManager?{name:$.packageManager.name,...$.packageManager.path?{path:$.packageManager.path}:{}}:void 0,G=J?{packageManager:J,runtime:$.runtime,...$.port!==void 0?{port:$.port}:{}}:void 0,K=X?.orgId;if(!Q&&!G&&!Y&&$.cloneOnly===void 0&&!K)return null;return{...Q?{git:Q}:{},...Y?{operator:Y}:{},...K?{orgId:K}:{},...$.cloneOnly!==void 0?{cloneOnly:$.cloneOnly}:{},...G?{application:G}:{}}}function YH6($){try{let Z=new URL($);return Z.pathname.replace(/^\/+/,"").replace(/\.git$/,"")||Z.hostname}catch{return $}}var Am$=L(()=>{lH1()});function JH6($){try{return new URL($).username.length>0}catch{return!1}}function pH1($){let Z=$.repo?.cloneUrl;if(!Z||!JH6(Z))return null;return{git:{repository:{cloneUrl:Z}}}}var nH1=L(()=>{Tm$();Am$()});async function*Mm$($){let Z=$.now??(()=>Date.now()),Q=Z(),X=$.schedulingTimeoutMs??KH6,Y={pod:{},sandbox:{},events:{hasPulling:!1,hasPulled:!1},startedAt:Q},J=[],G=null,K=!1,W=(E)=>{if(K)return;if(G){let z=G;G=null,z(E)}else J.push(E)},H=()=>{if(J.length>0)return Promise.resolve(J.shift());if(K)return Promise.resolve(null);return new Promise((E)=>{G=E})},F=()=>{if(K)return;if(K=!0,G){let E=G;G=null,E(null)}},U=new AbortController,N=()=>{U.abort(),F()};if($.signal)if($.signal.aborted)U.abort(),F();else $.signal.addEventListener("abort",N,{once:!0});let B=Math.max(0,X-(Z()-Q)),O=setTimeout(()=>W("tick"),B+100),D,w=new Promise((E)=>{D=E}),j=Promise.allSettled([HH6($.kc,$.namespace,$.claimName,U.signal,Y,W,Z,D),UH6($.kc,$.namespace,$.claimName,U.signal,Y,W),NH6($.kc,$.namespace,$.claimName,w,U.signal,Y,W,Z)]);try{let E=null,z=-1,A=Rm$(Y,X,Z);if(E=oH1(A),!tH1(A))z=qm$(A);if(yield A,tH1(A))return;while(!K){if(await H()===null)break;let T=Rm$(Y,X,Z);if(tH1(T)){let C=oH1(T);if(C!==E)E=C,yield T;return}let q=qm$(T);if(q<z)continue;let f=oH1(T);if(f!==E)E=f,z=q,yield T}}finally{if(clearTimeout(O),U.abort(),$.signal)$.signal.removeEventListener("abort",N);F(),await j.catch(()=>{})}}async function Im$($,Z=WH6){let Q=new AbortController,X="claiming",Y,J=()=>{clearTimeout(Y),Y=setTimeout(()=>Q.abort(),Z)};try{J();for await(let G of $(Q.signal)){if(G.kind==="ready")return;if(G.kind==="failed")throw new uX(G.message);X=G.kind,J()}}finally{clearTimeout(Y),Q.abort()}throw new Fi(`Sandbox did not become ready: no progress for ${Math.round(Z/1000)}s while ${X}`)}function Rm$($,Z,Q){let{pod:X,sandbox:Y,events:J,startedAt:G}=$;if(Y.ready)return{kind:"ready"};let K=X.containerWaitingReason;if(K==="ImagePullBackOff"||K==="ErrImagePull")return{kind:"failed",reason:"image-pull-backoff",message:"Sandbox image failed to download. The cluster may be missing pull credentials or the image tag may not exist."};if(K==="CrashLoopBackOff")return{kind:"failed",reason:"crash-loop-backoff",message:"Sandbox crashed during startup and is now in CrashLoopBackOff. Check pod logs."};if(!X.scheduled&&J.lastFailedSchedulingAt!==void 0&&Q()-G>Z)return{kind:"failed",reason:"scheduling-timeout",message:J.failedSchedulingMessage??`Pod could not be scheduled within ${Math.round(Z/1000)}s.`};if(X.containerRunning&&!X.containerReady)return{kind:"warming-daemon",since:G};if(J.hasPulling&&!J.hasPulled)return{kind:"pulling-image",since:G};if(K==="ContainerCreating"||K==="PodInitializing"||X.scheduled&&!X.containerRunning)return{kind:"starting-container",since:G};if(X.scheduledFalseReason==="Unschedulable"||J.lastFailedSchedulingAt!==void 0&&!X.scheduled)return{kind:"waiting-for-capacity",since:G,message:J.failedSchedulingMessage??X.scheduledFalseMessage,nodeClaim:J.nominatedNodeClaim};return{kind:"claiming",since:G}}function tH1($){return $.kind==="ready"||$.kind==="failed"}function qm$($){switch($.kind){case"claiming":return 0;case"waiting-for-capacity":return 1;case"pulling-image":return 2;case"starting-container":return 3;case"warming-daemon":return 4;case"ready":case"failed":return 99}}function oH1($){switch($.kind){case"claiming":case"pulling-image":case"starting-container":case"warming-daemon":return $.kind;case"waiting-for-capacity":return`waiting-for-capacity:${$.message??""}:${$.nodeClaim??""}`;case"ready":return"ready";case"failed":return`failed:${$.reason}:${$.message}`}}async function HH6($,Z,Q,X,Y,J,G,K){let W=`/api/v1/namespaces/${encodeURIComponent(Z)}/pods?watch=true&labelSelector=${encodeURIComponent(`${GH6}=${Q}`)}`;return VV0({kc:$,path:W,signal:X,label:`pod/${Q}`,onEvent:(H)=>{if(H.type!=="ADDED"&&H.type!=="MODIFIED")return;let F=H.object;if(F.metadata?.name)K(F.metadata.name);FH6(F,Y,G),J("pod")}})}function FH6($,Z,Q){let Y=($.status?.conditions??[]).find((G)=>G.type==="PodScheduled");if(Y?.status==="True")Z.pod.scheduled=!0,Z.pod.scheduledFalseReason=void 0,Z.pod.scheduledFalseMessage=void 0;else if(Y?.status==="False")Z.pod.scheduled=!1,Z.pod.scheduledFalseReason=Y.reason,Z.pod.scheduledFalseMessage=Y.message;let J=($.status?.containerStatuses??[]).find((G)=>G.name===JQ.MAIN_CONTAINER_NAME);if(J)Z.pod.containerWaitingReason=J.state?.waiting?.reason,Z.pod.containerRunning=!!J.state?.running,Z.pod.containerReady=J.ready===!0}async function UH6($,Z,Q,X,Y,J){let G=`/apis/${JQ.CLAIM_API_GROUP}/${JQ.CLAIM_API_VERSION}/namespaces/${encodeURIComponent(Z)}/${JQ.CLAIM_PLURAL}?watch=true&fieldSelector=${encodeURIComponent(`metadata.name=${Q}`)}`;return VV0({kc:$,path:G,signal:X,label:`sandboxclaim/${Q}`,onEvent:(K)=>{if(K.type!=="ADDED"&&K.type!=="MODIFIED")return;let H=K.object.status?.conditions?.find((F)=>F.type==="Ready");if(!H)return;if(H.status==="True")Y.sandbox.ready=!0,Y.sandbox.notReadyReason=void 0,Y.sandbox.notReadyMessage=void 0;else Y.sandbox.ready=!1,Y.sandbox.notReadyReason=H.reason,Y.sandbox.notReadyMessage=H.message;J("sandbox")}})}async function NH6($,Z,Q,X,Y,J,G,K){let W=await Promise.race([X,new Promise((F)=>{if(Y.aborted){F(Q);return}Y.addEventListener("abort",()=>F(Q),{once:!0})})]);if(Y.aborted)return;let H=`/api/v1/namespaces/${encodeURIComponent(Z)}/events?watch=true&fieldSelector=${encodeURIComponent(`involvedObject.name=${W},involvedObject.kind=Pod`)}`;return VV0({kc:$,path:H,signal:Y,label:`events/${Q}`,onEvent:(F)=>{if(F.type!=="ADDED"&&F.type!=="MODIFIED")return;let U=F.object,N=U.reason;if(!N)return;switch(N){case"Pulling":J.events.hasPulling=!0;break;case"Pulled":J.events.hasPulling=!0,J.events.hasPulled=!0;break;case"FailedScheduling":J.events.lastFailedSchedulingAt=K(),J.events.failedSchedulingMessage=U.message;break;case"Nominated":{let B=U.message?.match(/nodeclaim\/([\w-]+)/);if(B)J.events.nominatedNodeClaim=B[1];break}default:return}G("event")}})}async function Vm$($){let{kc:Z,namespace:Q,labelSelector:X,signal:Y,onDelete:J}=$,G=`/apis/${JQ.CLAIM_API_GROUP}/${JQ.CLAIM_API_VERSION}/namespaces/${encodeURIComponent(Q)}/${JQ.CLAIM_PLURAL}?watch=true&labelSelector=${encodeURIComponent(X)}`;return VV0({kc:Z,path:G,signal:Y,label:"sandboxclaim-reaper",onEvent:(K)=>{if(K.type!=="DELETED")return;let W=K.object.metadata?.name;if(W)J(W)}})}async function VV0($){let{kc:Z,path:Q,signal:X,label:Y,onEvent:J}=$,G=0;while(!X.aborted){try{let W=await eK(Z,{method:"GET",path:Q,signal:X,headers:{accept:"application/json"},stream:!0});if(!W.ok||!W.body){try{await W.body?.cancel()}catch{}if(W.status===401||W.status===403){console.warn(`[lifecycle-watcher] ${Y} stopped: watch denied (${W.status} ${W.statusText}). `+"The kubeconfig in use cannot watch SandboxClaims \u2014 if you are running locally, "+"this provider should not be active (check STUDIO_AGENT_SANDBOX_ENABLED).");return}throw Error(`watch handshake failed: ${W.status} ${W.statusText}`)}G=0;for await(let H of yb$(W.body)){if(X.aborted)return;try{J(H)}catch(F){console.warn(`[lifecycle-watcher] ${Y} onEvent threw: ${F instanceof Error?F.message:String(F)}`)}}}catch(W){if(X.aborted)return;let H=W instanceof Error?W.message:String(W);console.warn(`[lifecycle-watcher] ${Y} watch ended: ${H}`)}if(X.aborted)return;let K=LQ(5000,250,G,2,0);G+=1,await k$(K,{signal:X}).catch(()=>{})}}var GH6="studio.decocms.com/sandbox-handle",KH6=300000,WH6=600000;var km$=L(()=>{O8();ZO0();YO0()});import{z as ZW}from"zod";function Sm$($){if(!$||$.trim()==="")return[];let Z=ZW.array(BH6).parse(JSON.parse($)),Q=new Set;for(let X of Z){if(Q.has(X.name))throw Error(`STUDIO_SANDBOX_TENANT_POOLS: duplicate pool name ${X.name}`);Q.add(X.name)}return Z}function LH6($){try{let Z=new URL($);if(Z.hostname.toLowerCase()!=="github.com")return null;let[Q,X]=Z.pathname.replace(/^\/+/,"").split("/"),Y=X?.replace(/\.git$/,"");return Q&&Y?`${Q}/${Y}`.toLowerCase():null}catch{return null}}function aH1($,Z){let{orgId:Q,cloneUrl:X}=Z;if(!Q||!X)return null;let Y=LH6(X);if(!Y)return null;return $.find((J)=>J.orgId===Q&&J.repo.toLowerCase()===Y)??null}function Cm$($,Z,Q){return $?.name??(Z?Q:"none")}function OH6($,Z,Q,X){let Y=X&&X!=="default"?`-${X}`:"";return`${Z}${Y}${$==="harness-run"||Q?"-medium":""}`}async function rH1($){let Z=OH6($.purpose,$.templateName,$.tenantPool,$.sandboxImage);if(Z===$.templateName)return{name:Z,probes:$.probes};let Q=$.probes[Z]??null,X=Q!==null&&$.now-Q.checkedAt<$.ttlMs?Q:{checkedAt:$.now,present:await $.exists(Z)},Y={...$.probes,[Z]:X};if(X.present)return{name:Z,probes:Y};if(Q?.present!==!1)$.onAbsent?.(Z);if($.sandboxImage&&$.sandboxImage!=="default")return rH1({...$,sandboxImage:void 0,probes:Y});return{name:$.templateName,probes:Y}}function _m$($,Z,Q){let X=Q.replace(/^refs\/heads\//,"");return $.filter((Y)=>Y.repo.toLowerCase()===Z.toLowerCase()&&Y.branch===X)}function vm$($){return`https://github.com/${$.repo}.git`}var BH6;var sH1=L(()=>{BH6=ZW.object({name:ZW.string().regex(/^[a-z0-9]([-a-z0-9]*[a-z0-9])?$/,"pool name must be a DNS label (lowercase alphanumeric and '-')"),orgId:ZW.string().min(1),repo:ZW.string().regex(/^[^/\s]+\/[^/\s]+$/,"repo must be `owner/name`"),connectionId:ZW.string().min(1).optional(),branch:ZW.string().min(1).default("main"),workload:ZW.object({runtime:ZW.enum(["node","bun","deno"]).default("node"),packageManager:ZW.enum(["npm","pnpm","yarn","bun","deno"]).optional(),packageManagerPath:ZW.string().optional(),devPort:ZW.number().int().positive().optional()}).default({runtime:"node"})})});async function xm$($,Z,Q){let X=new Map;for(let Y of $){let J=Z(Y);if(!J)continue;let G=X.get(J);if(G)G.push(Y);else X.set(J,[Y])}await Promise.allSettled([...X.values()].map(async(Y)=>{for(let J of Y)await Q(J).catch(()=>{})}))}import{createHash as DH6,randomBytes as wH6,randomUUID as fm$}from"crypto";import*as lm$ from"net";import{PassThrough as jH6}from"stream";function bm$($){if($ instanceof Error)return $.message;if($&&typeof $==="object"){let Z=$;if(Z.error instanceof Error)return Z.error.message;if(typeof Z.message==="string"&&Z.message)return Z.message}return String($)}class GF1{records=new Map;inflight=new RV0;activeGauge=new AV0;stateStore;previewUrlPattern;kubeConfig;capacityProbe;portForward;namespace;sandboxTemplateName;envName;tokenGenerator;idleTtlMs;metrics;previewGateway;sentinelToken;mintCloneUrl;mintOrgFsConfig;tenantPools;tenantPoolRefreshMs;poolPods=new Map;templateProbes={};dirtyPools=new Set;closed=!1;claimWatchAbort=new AbortController;constructor($={}){this.stateStore=$.stateStore??null,this.previewUrlPattern=$.previewUrlPattern??null,this.kubeConfig=$.kubeConfig??_H6(),this.portForward=new RH1(this.kubeConfig),this.namespace=$.namespace??EH6,this.sandboxTemplateName=$.sandboxTemplateName??zH6,this.envName=yH6($.envName),this.tokenGenerator=$.tokenGenerator??(()=>wH6(TH6).toString("hex")),this.idleTtlMs=$.idleTtlMs??RH6,this.metrics=$.meter?CH6($.meter):null,this.previewGateway=$.previewGateway&&$.previewUrlPattern?{...$.previewGateway}:null;let Z=$.sentinelToken?.trim()??"";if(this.sentinelToken=Z.length>0?Z:null,this.mintCloneUrl=$.mintCloneUrl,this.mintOrgFsConfig=$.mintOrgFsConfig,this.tenantPools=this.sentinelToken!==null?$.tenantPools??[]:[],this.sentinelToken===null&&($.tenantPools?.length??0)>0)console.warn(`[${R6}] tenant pools configured without a sentinel token \u2014 ignoring them (warm-pool mode is off)`);this.tenantPoolRefreshMs=$.tenantPoolRefreshMs??MH6,this.startClaimReaper(),this.startCredentialRefresher(),this.startTenantPoolReconciler()}startClaimReaper(){let $=["app.kubernetes.io/managed-by=studio","app.kubernetes.io/name=studio-sandbox",...this.envName?[`${iY.env}=${this.envName}`]:[]].join(",");Vm$({kc:this.kubeConfig,namespace:this.namespace,labelSelector:$,signal:this.claimWatchAbort.signal,onDelete:(Z)=>this.invalidateRecord(Z)})}async ensure($,Z={}){let Q=Ey($);if(Q.startsWith("s-"))throw Error(`ensure: projectRef has no slug source: ${$.projectRef}`);return this.inflight.run(Q,()=>qV0(this.stateStore,$,(X)=>this.ensureLocked($,Q,Z,X)))}async delete($){let Z=await this.getRecord($);if(this.records.delete($),Z)this.dropRecord(Z);if(await this.deleteHttpRouteIfManaged($).catch((Q)=>{console.warn(`[${R6}] HTTPRoute delete failed for ${$}: ${Q instanceof Error?Q.message:String(Q)}`)}),await m2(this.kubeConfig,this.namespace,$),this.stateStore)if(Z)await this.stateStore.delete(Z.id);else await this.stateStore.deleteByHandle($)}lastTermination($){return Vb$(this.kubeConfig,this.namespace,iY.sandboxHandle,$,JQ.MAIN_CONTAINER_NAME)}async alive($){return await rL(this.kubeConfig,this.namespace,$)!==void 0}watchClaimLifecycle($,Z){return Mm$({kc:this.kubeConfig,namespace:this.namespace,claimName:$,signal:Z})}hasSchedulableCapacity(){return this.capacityProbe??=hb$(this.kubeConfig,this.namespace),this.capacityProbe()}async getPreviewUrl($){let Z=await this.getRecord($);if(!Z)return null;return this.composePreviewUrl(Z)}async proxyDaemonRequest($,Z,Q){let X=await this.getRecord($);if(!X&&this.previewUrlPattern&&this.stateStore){let W=await this.stateStore.getByHandle($),H=W?.state,F=H?.token;if(W&&F){let N=`http://${H?.adoptedSandboxName??$}.${this.namespace}.svc.cluster.local:${YO}`;try{let B=await g80(N,F,Z,Q);if(B.status!==404)return B;try{await B.body?.cancel()}catch{}}catch{}}}if(!X)X=await this.resurrectByHandle($);if(!X)return new Response(JSON.stringify({error:"sandbox not found"}),{status:404,headers:{"content-type":"application/json"}});let Y=X,J=performance.now(),G=0,K=!(Q.body instanceof ReadableStream);try{let W=await g80(X.daemonUrl,X.token,Z,Q);if(W.status===401&&K){this.invalidateRecord($);let H=await this.getRecord($).catch(()=>null)??await this.resurrectByHandle($).catch(()=>null);if(H){try{await W.body?.cancel()}catch{}Y=H,W=await g80(H.daemonUrl,H.token,Z,Q)}}return G=W.status,W}catch(W){if(!K)throw W;this.invalidateRecord($);let H=await this.resurrectByHandle($)??await this.getRecord($).catch(()=>null);if(!H)throw W;Y=H;let F=await g80(H.daemonUrl,H.token,Z,Q);return G=F.status,F}finally{this.recordProxyDuration("daemon",G,Y,performance.now()-J)}}async adoptLiveClaim($,Z){if(this.records.has(Z))return!0;let Q=await rL(this.kubeConfig,this.namespace,Z).catch(()=>{return});if(!Q||Q.metadata?.deletionTimestamp)return!1;return await this.inflight.run(Z,async()=>{let Y=this.records.get(Z);if(Y)return this.toSandbox(Y);let J=await this.adopt($,Z,Q);if(!J)throw Error(`cannot adopt live claim ${Z}`);return qV0(this.stateStore,$,(G)=>this.finish(J,G,!0,!0,"adopt"))}).catch(()=>null)!=null}async resolvePreviewUpstreamUrl($){if(this.previewUrlPattern)return`http://${await this.resolveServiceNameForHandle($)}.${this.namespace}.svc.cluster.local:${YO}`;let Z=await this.getRecord($);if(Z)return Z.daemonUrl;let Q=await this.resurrectByHandle($);return Q?Q.daemonUrl:null}async resolveServiceNameForHandle($){let Z=this.records.get($);if(Z)return Z.adoptedSandboxName;if(this.stateStore){let X=(await this.stateStore.getByHandle($).catch(()=>null))?.state?.adoptedSandboxName;if(X)return X}return $}async proxyPreviewRequest($,Z){let Q=performance.now(),X=this.records.get($)??null,Y=0;try{let J=await this.resolvePreviewUpstreamUrl($);if(!J){Y=404;let O=ZF1(404,{error:"sandbox not found"});return O.headers.set(Py,"1"),O}let G=new URL(Z.url);if((G.pathname==="/_sandbox"||G.pathname.startsWith("/_sandbox/"))&&Z.method!=="GET")return Y=404,ZF1(404,{error:"not found"});let W=(O)=>`${O}${G.pathname}${G.search}`,H=new Headers(Z.headers);for(let O of kH6)H.delete(O);let F=Z.method!=="GET"&&Z.method!=="HEAD",U={method:Z.method,headers:H,body:F?Z.body:void 0,redirect:"manual",signal:Z.signal,duplex:F?"half":void 0},N;try{N=await fetch(W(J),U)}catch(O){let D=`${J}${G.pathname}`;if(console.warn(`[${R6}] preview fetch to ${D} failed: ${O instanceof Error?O.message:String(O)}`),Z.method==="GET"||Z.method==="HEAD"){if(this.invalidateRecord($),await this.resurrectByHandle($).catch(()=>null)){let E=await this.resolvePreviewUpstreamUrl($);if(E)try{N=await fetch(W(E),U);let z=new Headers;for(let[A,P]of N.headers.entries())if(!hm$.includes(A.toLowerCase()))z.set(A,P);return Y=N.status,new Response(N.body,{status:N.status,statusText:N.statusText,headers:z})}catch(z){console.warn(`[${R6}] preview fetch retry to ${D} failed: ${z instanceof Error?z.message:String(z)}`)}}}else this.invalidateRecord($);Y=502;let w=ZF1(502,{error:"sandbox daemon unreachable"});return w.headers.set(Py,"1"),w}let B=new Headers;for(let[O,D]of N.headers.entries())if(!hm$.includes(O.toLowerCase()))B.set(O,D);return Y=N.status,new Response(N.body,{status:N.status,statusText:N.statusText,headers:B})}finally{this.recordProxyDuration("preview",Y,X,performance.now()-Q,$)}}async ensureLocked($,Z,Q,X){if(Q.image)console.warn(`[${R6}] opts.image ignored (template ${this.sandboxTemplateName} pins image): got ${Q.image}`);if(X){let G=await X.get($);if(G){let K=await this.rehydrate($,Z,G);if(K)return await this.refreshDaemonGitCredential(K,Q),await this.relayOrgFsConfig(K.daemonUrl,K.token,Q.orgFsConfigJson),this.finish(K,X,!1,!0,"resume");await X.delete($)}}let Y=await rL(this.kubeConfig,this.namespace,Z).catch(()=>{return});if(Y)if(Y.metadata?.deletionTimestamp)await E80(this.kubeConfig,this.namespace,Z).catch((G)=>{console.warn(`[${R6}] wait for terminating claim ${Z} failed: ${G instanceof Error?G.message:String(G)}`)});else if(!eH1(Y)){let G=await this.join($,Z,Q,Y).catch((K)=>{return console.warn(`[${R6}] join of starting claim ${Z} failed, recreating: ${K instanceof Error?K.message:String(K)}`),null});if(G)return this.finish(G,X,!0,!0,"adopt");await m2(this.kubeConfig,this.namespace,Z).catch(()=>{}),await E80(this.kubeConfig,this.namespace,Z).catch((K)=>{console.warn(`[${R6}] wait for deleted claim ${Z} failed: ${K instanceof Error?K.message:String(K)}`)})}else{let G=await this.adopt($,Z,Y).catch((K)=>{return console.warn(`[${R6}] adopt ${Z} failed, recreating: ${K instanceof Error?K.message:String(K)}`),null});if(G)return await this.refreshDaemonGitCredential(G,Q),await this.relayOrgFsConfig(G.daemonUrl,G.token,Q.orgFsConfigJson),this.finish(G,X,!0,!0,"adopt");await m2(this.kubeConfig,this.namespace,Z).catch(()=>{}),await E80(this.kubeConfig,this.namespace,Z).catch((K)=>{console.warn(`[${R6}] wait for deleted claim ${Z} failed: ${K instanceof Error?K.message:String(K)}`)})}let J=await this.provision($,Z,Q);return this.finish(J,X,!0,!1,"fresh")}async finish($,Z,Q,X,Y){let J=this.records.get($.handle),G=J!==void 0;if(J&&J.daemonForward!==$.daemonForward)this.closeForwarder(J.daemonForward);if(this.records.set($.handle,$),Q)await this.persist(Z,$);if(X)await XO0(this.kubeConfig,this.namespace,$.handle,this.computeShutdownTime()).catch((K)=>console.warn(`[${R6}] TTL refresh failed for ${$.handle}: ${K instanceof Error?K.message:String(K)}`));if(this.metrics){let K=XF1($.tenant);if(this.metrics.ensureOutcome.add(1,{...K,outcome:Y}),!G)this.metrics.active.add(1,K),this.activeGauge.markCounted($.handle)}return this.toSandbox($)}buildEnvMap($,Z){let Q={},X=[];for(let[Y,J]of Object.entries($.env??{}))if(AH6.has(Y))X.push(Y);else Q[Y]=J;if(X.length>0)console.warn(`[${R6}] opts.env keys overlap reserved bootstrap names and were dropped: ${X.join(",")}`);return{...Q,DAEMON_TOKEN:Z.token,DAEMON_BOOT_ID:Z.daemonBootId,APP_ROOT:Z.workdir,PROXY_PORT:String(YO)}}async resolveTemplateName($,Z,Q){let{name:X,probes:Y}=await rH1({purpose:$,tenantPool:Z,...Q?{sandboxImage:Q}:{},templateName:this.sandboxTemplateName,probes:this.templateProbes,now:Date.now(),ttlMs:PH6,exists:(J)=>Rb$(this.kubeConfig,this.namespace,J),onAbsent:(J)=>console.warn(`[${R6}] SandboxTemplate ${J} not found (or not readable) \u2014 this claim falls back to a template without that suffix. Upgrade the sandbox-env chart to the version that renders it.`)});return this.templateProbes=Y,X}buildClaim($,Z,Q,X){let Y=this.sentinelToken!==null,J=aH1(this.tenantPools,{orgId:Z.tenant?.orgId,cloneUrl:Z.repo?.cloneUrl}),G=Y?[]:Object.entries(this.buildEnvMap(Z,Q)).sort(([H],[F])=>H<F?-1:H>F?1:0).map(([H,F])=>({name:H,value:F})),K=uH6(Z),W=Object.keys(K).length>0;return{apiVersion:`${JQ.CLAIM_API_GROUP}/${JQ.CLAIM_API_VERSION}`,kind:"SandboxClaim",metadata:{name:$,namespace:this.namespace,labels:{"app.kubernetes.io/name":"studio-sandbox","app.kubernetes.io/managed-by":"studio",...this.envName?{[iY.env]:this.envName}:{},...QF1(Z.tenant)},...W?{annotations:K}:{}},spec:{sandboxTemplateRef:{name:X},additionalPodMetadata:{labels:QF1(Z.tenant,{[iY.role]:"claimed",[iY.sandboxHandle]:$,...this.envName?{[iY.env]:this.envName}:{}}),...W?{annotations:K}:{}},env:G,warmpool:Cm$(J,Y,X),lifecycle:{shutdownPolicy:"Delete",shutdownTime:this.computeShutdownTime()}}}}async provision($,Z,Q){let X=this.tokenGenerator(),Y=fm$(),J=kV0,G=this.claimTenantPool(Q),K=this.buildClaim(Z,Q,{token:X,daemonBootId:Y,workdir:J},await this.resolveTemplateName(Q.purpose,G,Q.sandboxImage));try{await iK1(this.kubeConfig,this.namespace,K)}catch(W){if(W instanceof D80)await E80(this.kubeConfig,this.namespace,Z),await iK1(this.kubeConfig,this.namespace,K);else throw W}return this.bind($,Z,Q,G,{token:X,daemonBootId:Y,workdir:J})}claimTenantPool($){return!$.sandboxImage||$.sandboxImage==="default"?aH1(this.tenantPools,{orgId:$.tenant?.orgId,cloneUrl:$.repo?.cloneUrl}):null}async bind($,Z,Q,X,{token:Y,daemonBootId:J,workdir:G}){let K;try{K=await qb$(this.kubeConfig,this.namespace,Z),await Im$((B)=>this.watchClaimLifecycle(Z,B))}catch(B){throw await m2(this.kubeConfig,this.namespace,Z).catch(()=>{}),B}try{await this.ensureServicePortForAdoptedSandbox(K),await this.ensureHttpRouteForHandle(Z,K,Q.tenant??null)}catch(B){throw await m2(this.kubeConfig,this.namespace,Z).catch(()=>{}),B}let W=await this.openForwarder(K,YO,Z),H=`http://127.0.0.1:${W.localPort}`,F=X!==null&&K!==Z,U=this.workloadConfigPayload(Q,F),N=J;try{if(await dH1(H),this.sentinelToken!==null){let B=await TV0(H);if(B)N=B.bootId;try{await jy(H,this.sentinelToken,U??{},{rotateToken:Y})}catch(O){if(O instanceof wy&&O.status===401)console.warn(`[${R6}] sentinel rejected by adopted pod (handle=${Z}, sandbox=${K}): pod belongs to another claim; tearing down and reprovisioning`);throw O}}else if(U)await jy(H,Y,U);await this.relayOrgFsConfig(H,Y,Q.orgFsConfigJson)}catch(B){throw this.closeForwarder(W),await this.deleteHttpRouteIfManaged(Z).catch(()=>{}),await m2(this.kubeConfig,this.namespace,Z).catch(()=>{}),B}return{id:$,handle:Z,adoptedSandboxName:K,token:Y,workdir:G,daemonUrl:H,daemonForward:W,workload:Q.workload??null,daemonBootId:N,tenant:Q.tenant??null,tenantPoolPodBound:F,ensureOpts:iH6(Q)}}workloadConfigPayload($,Z){return IV0({runtime:$?.workload?.runtime??"node",packageManager:$?.workload?.packageManager?{name:$.workload.packageManager,...$.workload.packageManagerPath?{path:$.workload.packageManagerPath}:{}}:null,repo:$?.repo??null,extraRepos:$?.extraRepos??[],port:$?.workload?.devPort??ym$,tenant:$?.tenant??void 0,...$?{cloneOnly:$.cloneOnly===!0&&!Z}:{}})}async relayOrgFsConfig($,Z,Q){if(!Q)return;await wm$($,Z,Q).catch((X)=>console.warn("[org-fs] sidecar config relay failed",X))}async refreshDaemonGitCredential($,Z){let Q=pH1(Z);if(!Q)return;try{await jy($.daemonUrl,$.token,Q)}catch(X){console.warn(`[${R6}] git credential refresh failed for ${$.handle}: ${X instanceof Error?X.message:String(X)}`)}}async withFreshCloneUrl($,Z){if(!this.mintCloneUrl)return $;try{let Q=await this.mintCloneUrl($,Z!==void 0?{bufferMs:Z}:void 0);return Q?{...$,cloneUrl:Q}:$}catch(Q){return console.warn(`[${R6}] clone credential re-mint failed: ${Q instanceof Error?Q.message:String(Q)}`),$}}async withFreshCredentials($){return{...$,...$.repo?{repo:await this.withFreshCloneUrl($.repo)}:{},...$.orgFsConfigJson?{orgFsConfigJson:await dH6($,this.mintOrgFsConfig)}:{}}}startCredentialRefresher(){if(!this.mintCloneUrl)return;let{signal:$}=this.claimWatchAbort;(async()=>{while(!$.aborted){if(await k$(IH6,{signal:$}).catch(()=>{}),$.aborted)break;try{await this.refreshAllGitCredentials()}catch(Z){console.warn(`[${R6}] periodic credential refresh failed: ${Z instanceof Error?Z.message:String(Z)}`)}}})()}startTenantPoolReconciler(){if(this.tenantPools.length===0)return;let{signal:$}=this.claimWatchAbort;(async()=>{while(!$.aborted){try{await this.reconcileTenantPools()}catch(Z){console.warn(`[${R6}] tenant pool reconcile failed: ${Z instanceof Error?Z.message:String(Z)}`)}await k$(qH6,{signal:$}).catch(()=>{})}})()}markTenantPoolsDirty($,Z){let Q=_m$(this.tenantPools,$,Z);for(let X of Q)this.dirtyPools.add(X.name);return Q.map((X)=>X.name)}async reconcileTenantPools(){for(let $ of this.tenantPools){let Z=await Mb$(this.kubeConfig,this.namespace,$.name);if(Z===null){console.warn(`[${R6}] tenant pool ${$.name}: no SandboxWarmPool (or no selector yet) in ${this.namespace}`);continue}let Q=this.dirtyPools.delete($.name),X=Z.filter((Y)=>!Y.labels[iY.sandboxHandle]);for(let[Y]of this.poolPods)if(!Z.some((J)=>J.uid===Y))this.poolPods.delete(Y);for(let Y of X){if(this.claimWatchAbort.signal.aborted)return;await this.warmPoolPod($,Y,Q)}this.recordPoolDepth($,Z,X)}}recordPoolDepth($,Z,Q){let X=this.metrics?.poolPods;if(!X)return;let Y=0,J=0;for(let K of Q){let W=this.poolPods.get(K.uid);if(!W)continue;if(W.failures>=SV0)J++;else if(W.lastConfigAt>0)Y++}let G={pool:$.name,org:$.orgId};X.record(Y,{...G,state:"ready"}),X.record(Z.length-Q.length,{...G,state:"bound"}),X.record(Q.length-Y-J,{...G,state:"pending"}),X.record(J,{...G,state:"failed"})}async warmPoolPod($,Z,Q){let X=this.poolPods.get(Z.uid);if(X&&X.failures>=SV0){if(Date.now()-X.lastFailureAt<gm$)return;this.poolPods.set(Z.uid,{...X,failures:0})}let Y=Q||X!==void 0&&Date.now()-X.lastConfigAt>=this.tenantPoolRefreshMs;if(X&&!Y)return;let J={cloneUrl:vm$($),connectionId:$.connectionId,branch:$.branch,userName:"",userEmail:""},G=await this.withFreshCloneUrl(J);if($.connectionId&&G.cloneUrl===J.cloneUrl){this.recordPoolFailure(Z,$,"clone credential mint failed");return}let K=await this.openForwarder(Z.name,YO,Z.name).catch(()=>null);if(!K){this.recordPoolFailure(Z,$,"port-forward failed");return}let W=`http://127.0.0.1:${K.localPort}`;try{await dH1(W);let H=this.sentinelToken;if(!H)return;if(!await this.isPoolPodUnbound(Z))return;let F=IV0({runtime:$.workload.runtime,packageManager:$.workload.packageManager?{name:$.workload.packageManager,...$.workload.packageManagerPath?{path:$.workload.packageManagerPath}:{}}:null,repo:G,port:$.workload.devPort??ym$})??{},{transition:U}=await jy(W,H,F);if(Y&&U!=="bootstrap"&&await this.isPoolPodUnbound(Z))await Dm$(W,H,"clone");this.poolPods.set(Z.uid,{lastConfigAt:Date.now(),lastFailureAt:0,failures:0}),console.log(`[${R6}] tenant pool ${$.name}: warmed ${Z.name} (${U})`)}catch(H){this.recordPoolFailure(Z,$,H instanceof Error?H.message:String(H))}finally{this.closeForwarder(K)}}isPoolPodUnbound($){return Ib$(this.kubeConfig,this.namespace,$.name,iY.sandboxHandle)}recordPoolFailure($,Z,Q){let X=this.poolPods.get($.uid),Y=(X?.failures??0)+1;this.poolPods.set($.uid,{lastConfigAt:X?.lastConfigAt??0,lastFailureAt:Date.now(),failures:Y});let J=Y>=SV0?` \u2014 backing off ${gm$/60000}min`:"";console.warn(`[${R6}] tenant pool ${Z.name}: warming ${$.name} failed (${Y}/${SV0})${J}: ${Q}`)}async refreshAllGitCredentials(){await xm$(this.records.values(),($)=>$.ensureOpts?.repo?.connectionId,async($)=>{if(this.claimWatchAbort.signal.aborted)return;let Z=$.ensureOpts?.repo;if(!Z)return;let Q=await this.withFreshCloneUrl(Z,VH6);await this.refreshDaemonGitCredential($,{...$.ensureOpts,repo:Q}),$.ensureOpts={...$.ensureOpts,repo:Q}})}async rebootstrapDaemon($,Z,Q){if(this.sentinelToken===null)return!1;let X=this.workloadConfigPayload(Q,!1)??{};try{return await jy($,this.sentinelToken,X,{rotateToken:Z}),await this.relayOrgFsConfig($,Z,Q?.orgFsConfigJson),!0}catch(Y){if(Y instanceof wy&&Y.status===401)try{return await jy($,Z,X,{rotateToken:Z}),await this.relayOrgFsConfig($,Z,Q?.orgFsConfigJson),!0}catch(J){return console.warn(`[${R6}] re-bootstrap retry with claim token failed: ${J instanceof Error?J.message:String(J)}`),!1}return console.warn(`[${R6}] re-bootstrap failed: ${Y instanceof Error?Y.message:String(Y)}`),!1}}async ensureServicePortForAdoptedSandbox($){if(!this.previewGateway||!this.previewUrlPattern)return;await bb$(this.kubeConfig,this.namespace,$,{name:"daemon",port:YO,targetPort:YO})}async ensureHttpRouteForHandle($,Z,Q){if(!this.previewGateway||!this.previewUrlPattern)return;let X=pH6(this.previewUrlPattern,$);if(!X)throw new uX(`Unable to derive preview hostname for ${$} from pattern: ${this.previewUrlPattern}`);let Y={apiVersion:`${nK1.API_GROUP}/${nK1.API_VERSION}`,kind:"HTTPRoute",metadata:{name:$,namespace:this.namespace,labels:QF1(Q??void 0,{[iY.role]:"claimed",[iY.sandboxHandle]:$,"app.kubernetes.io/name":"studio-sandbox","app.kubernetes.io/managed-by":"studio",...this.envName?{[iY.env]:this.envName}:{}})},spec:{parentRefs:[{kind:"Gateway",group:"gateway.networking.k8s.io",name:this.previewGateway.name,namespace:this.previewGateway.namespace}],hostnames:[X],rules:[{backendRefs:[{group:"",kind:"Service",name:Z,port:YO}]}]}};await vb$(this.kubeConfig,this.namespace,Y)}async deleteHttpRouteIfManaged($){if(!this.previewGateway)return;await xb$(this.kubeConfig,this.namespace,$)}async rehydrate($,Z,Q){let X=Q.state;if(!X.adoptedSandboxName&&!X.podName||!X.token)return null;let Y=await rL(this.kubeConfig,this.namespace,Z).catch(()=>{return});if(!Y||!eH1(Y))return null;let J=Y.status?.sandbox?.name??X.adoptedSandboxName??X.podName??Z,G=await this.openAndProbeDaemon(J,Z);if(!G)return null;if(X.daemonBootId&&X.daemonBootId!==G.bootId){if(this.sentinelToken!==null){let K=X.ensureOpts?await this.withFreshCredentials(X.ensureOpts):null;if(!await this.rebootstrapDaemon(G.daemonUrl,X.token,K))return this.closeForwarder(G.daemonForward),null}else console.warn(`[${R6}] daemon restart detected (handle=${Z}): stored bootId=${X.daemonBootId} live bootId=${G.bootId}`);await this.stateStore?.put($,{handle:Z,state:{...X,daemonBootId:G.bootId}}).catch((K)=>console.warn(`[${R6}] bootId persist failed for ${Z}: ${K instanceof Error?K.message:String(K)}`))}return{id:$,handle:Z,adoptedSandboxName:J,tenantPoolPodBound:!1,token:X.token,workdir:X.workdir??kV0,daemonUrl:G.daemonUrl,daemonForward:G.daemonForward,workload:X.workload??null,daemonBootId:G.bootId,tenant:X.tenant??null,ensureOpts:X.ensureOpts??null}}join($,Z,Q,X){let Y=this.sentinelToken!==null,J=Y?this.tokenGenerator():$F1(X,"DAEMON_TOKEN"),G=Y?fm$():$F1(X,"DAEMON_BOOT_ID");if(!J||!G)throw new uX(`claim ${Z} carries no daemon token`);return this.bind($,Z,Q,this.claimTenantPool(Q),{token:J,daemonBootId:G,workdir:kV0})}async adopt($,Z,Q){if(!eH1(Q))return null;let X=Q.status?.sandbox?.name??Z;if(this.sentinelToken!==null)return null;let Y=$F1(Q,"DAEMON_TOKEN");if(!Y)return null;let J=await this.openAndProbeDaemon(X,Z);if(!J)return null;let G=lH6(Q);if(this.previewGateway)await this.ensureServicePortForAdoptedSandbox(X).catch((K)=>{console.warn(`[${R6}] Service port backfill failed for ${Z}: ${K instanceof Error?K.message:String(K)}`)}),await this.ensureHttpRouteForHandle(Z,X,G).catch((K)=>{console.warn(`[${R6}] HTTPRoute backfill failed for ${Z}: ${K instanceof Error?K.message:String(K)}`)});return{id:$,handle:Z,adoptedSandboxName:X,tenantPoolPodBound:!1,token:Y,workdir:kV0,daemonUrl:J.daemonUrl,daemonForward:J.daemonForward,workload:null,daemonBootId:J.bootId,tenant:G,ensureOpts:null}}async openAndProbeDaemon($,Z){let Q=await this.openForwarder($,YO,Z).catch(()=>null);if(!Q)return null;let X=`http://127.0.0.1:${Q.localPort}`,Y=await TV0(X);if(!Y)return this.closeForwarder(Q),null;return{daemonForward:Q,daemonUrl:X,bootId:Y.bootId}}async getRecord($){let Z=this.records.get($);if(Z)return Z;if(!this.stateStore)return null;let Q=await this.stateStore.getByHandle($);if(!Q)return null;let X=await this.rehydrate(Q.id,$,Q);if(X)this.records.set($,X);return X}async resurrectByHandle($){if(!this.stateStore)return null;let Z=await this.stateStore.getByHandle($);if(!Z)return null;let Q=Z.state.ensureOpts;if(!Q)return null;let X=await this.withFreshCredentials(Q);if(Ey(Z.id)!==$)return null;return await this.ensure(Z.id,X),this.records.get($)??null}invalidateRecord($){let Z=this.records.get($);if(!Z)return;this.records.delete($),this.dropRecord(Z)}dropRecord($){if(this.closeForwarder($.daemonForward),this.metrics&&this.activeGauge.consume($.handle))this.metrics.active.add(-1,XF1($.tenant))}recordProxyDuration($,Z,Q,X,Y){if(!this.metrics)return;this.metrics.proxyDurationMs.record(X,{...XF1(Q?.tenant??null),source:$,sandbox_handle:Q?.handle??Y??"",status_code:Z||0})}composePreviewUrl($){if(this.previewUrlPattern)return MV0(this.previewUrlPattern,$.handle);return`http://127.0.0.1:${$.daemonForward.localPort}/`}toSandbox($){return{handle:$.handle,workdir:$.workdir,previewUrl:this.composePreviewUrl($),warmPoolAdopted:$.tenantPoolPodBound===!0}}async persist($,Z){if(!$)return;let Q={adoptedSandboxName:Z.adoptedSandboxName,token:Z.token,workdir:Z.workdir,workload:Z.workload,daemonBootId:Z.daemonBootId,tenant:Z.tenant,...Z.ensureOpts?{ensureOpts:Z.ensureOpts}:{}};await $.put(Z.id,{handle:Z.handle,state:Q})}computeShutdownTime(){return new Date(Date.now()+this.idleTtlMs).toISOString()}async releaseAfter($,Z){let Q=await rL(this.kubeConfig,this.namespace,$);if(!Q)return;let X=cH6(Q.spec?.lifecycle?.shutdownTime,new Date(Date.now()+Z));if(!X)return;await XO0(this.kubeConfig,this.namespace,$,X).catch((Y)=>console.warn(`[${R6}] release failed for ${$}: ${Y instanceof Error?Y.message:String(Y)}`))}async renewTtl($){let Z=await rL(this.kubeConfig,this.namespace,$);if(!Z)return;let Q=mH6(Z.spec?.lifecycle?.shutdownTime,new Date(Date.now()+this.idleTtlMs));if(!Q)return;await XO0(this.kubeConfig,this.namespace,$,Q).catch((X)=>console.warn(`[${R6}] TTL renew failed for ${$}: ${X instanceof Error?X.message:String(X)}`))}openForwarder($,Z,Q=$){let X=vH6(Q,Z);return new Promise((Y,J)=>{let G=(K,W)=>{let H=lm$.createServer((F)=>this.handleForwardedConnection(F,$,Z,Q));H.once("error",(F)=>{if(F.code==="EADDRINUSE"&&W<SH6){try{H.close()}catch{}let U=YF1+(K-YF1+1)%cm$;G(U,W+1);return}J(F)}),H.listen(K,"127.0.0.1",()=>{let F=H.address();if(!F||typeof F==="string"){H.close(),J(Error("port-forward listener failed to bind"));return}Y({server:H,localPort:F.port})})};G(X,0)})}handleForwardedConnection($,Z,Q,X){let Y=new jH6,J=null,G=!1,K=()=>{if(G)return;if(G=!0,Y.destroy(),J)try{J.close()}catch{}if(!$.destroyed)$.destroy()};$.pipe(Y),$.on("error",K),$.on("close",K),this.portForward.portForward(this.namespace,Z,[Q],$,null,Y).then((W)=>{let H=typeof W==="function"?W():W;if(!H){K();return}if(J=H,J.on("close",K),J.on("error",(F)=>{console.warn(`[${R6}] port-forward to ${Z}:${Q} dropped mid-connection: ${bm$(F)}`,JSON.stringify(JF1(F))),this.invalidateRecord(X),K()}),G)try{J.close()}catch{}}).catch((W)=>{console.warn(`[${R6}] port-forward to ${Z}:${Q} failed: ${bm$(W)}`,JSON.stringify(JF1(W))),this.invalidateRecord(X),K()})}closeForwarder($){$.server.close((Z)=>{if(Z)console.warn(`[${R6}] port-forward close on :${$.localPort} errored: ${Z instanceof Error?Z.message:String(Z)}`)})}close(){if(this.closed)return;this.closed=!0,this.claimWatchAbort.abort();for(let $ of this.records.values())this.dropRecord($);this.records.clear()}}function CH6($){return{active:$.createUpDownCounter("studio.sandbox.active",{description:"Active sandbox count, by runner kind, owning org, and daemon impl. Cross-checks the cAdvisor-derived count from the cluster \u2014 divergence between the two indicates orphaned claims (studio deleted but K8s didn't reap) or unattributed pods.",unit:"{sandbox}"}),ensureOutcome:$.createCounter("studio.sandbox.ensure.outcome",{description:"Outcome of each ensure() call: fresh provision, resume from state-store after restart, or adopt of a cluster-side claim studio didn't know about. Cold-start ratio is the primary input for warm-pool sizing.",unit:"{call}"}),proxyDurationMs:$.createHistogram("studio.sandbox.proxy.duration_ms",{description:"Wall-clock latency of studio-mediated requests to the sandbox daemon: tool exec proxies (source=daemon) and preview iframe traffic (source=preview).",unit:"ms"}),poolPods:$.createGauge("studio.sandbox.pool.pods",{description:"Tenant warm pool depth by pool and state: ready (warmed and unbound \u2014 what a claim can actually bind instantly), bound (serving a user), pending (unbound, not yet warmed), failed (gave up after repeated bootstrap failures). Alert on sustained ready=0: a pool that is always empty is doing nothing while costing N pods.",unit:"{pod}"})}}function JF1($){let Z=[],Q=$;for(let X=0;X<5&&Q instanceof Error;X++){let Y=Q;if(Z.push({name:Y.name,message:Y.message,...Y.code!==void 0?{code:Y.code}:{},...Y.errno!==void 0?{errno:Y.errno}:{}}),Y.cause===Q)break;Q=Y.cause}if(Q!==void 0&&!(Q instanceof Error)&&Q!==null){let X=Q,Y=X.error instanceof Error?JF1(X.error).chain:void 0;Z.push({nonError:String(Q),...typeof X.type==="string"?{type:X.type}:{},...typeof X.message==="string"?{message:X.message}:{},...X.code!==void 0?{code:X.code}:{},...typeof X.reason==="string"?{reason:X.reason}:{},...Y?{error:Y}:{},...Y===void 0&&X.error!==void 0?{rawError:String(X.error)}:{},keys:Object.keys(X)})}return{chain:Z}}function _H6(){let $=new YV0;return $.loadFromDefault(),$}function eH1($){return Boolean($.status?.conditions?.some((Z)=>Z.type==="Ready"&&Z.status==="True"))}function $F1($,Z){let Q=$.spec?.env;if(!Q)return null;for(let X of Q)if(X.name===Z&&X.value)return X.value;return null}function vH6($,Z){let Q=DH6("sha256").update(`${$}:${Z}`).digest();return YF1+Q.readUInt32BE(0)%cm$}function ZF1($,Z){return new Response(JSON.stringify(Z),{status:$,headers:{"content-type":"application/json","access-control-allow-origin":"*"}})}function um$($){let Z=$.slice(0,fH6);return xH6.test(Z)?Z:""}function yH6($){if($===void 0)return null;let Z=$.trim();if(Z==="")return null;if(!bH6.test(Z))throw Error(`AgentSandboxProvider: envName=${JSON.stringify(Z)} is not a valid DNS-label-safe environment name (lowercase alphanumeric or '-', starts with a letter, ends alphanumeric, \u226432 chars). Studio sets this from STUDIO_ENV; check the studio chart's configMap.`);return Z}function QF1($,Z={}){let Q={...Z};if($){let X=um$($.orgId),Y=um$($.userId);if(X)Q[iY.orgId]=X;if(Y)Q[iY.userId]=Y}return Q}function zy($){let Z="";for(let Q of $){let X=Q.codePointAt(0)??0;Z+=X<32||X===127?" ":Q}return Z.slice(0,gH6)}function hH6($){try{let Z=new URL($);return Z.username="",Z.password="",Z.toString()}catch{return""}}function uH6($){let Z={},Q=$.tenant;if(Q?.orgSlug)Z[tH.orgSlug]=zy(Q.orgSlug);if(Q?.orgName)Z[tH.orgName]=zy(Q.orgName);if(Q?.userEmail)Z[tH.userEmail]=zy(Q.userEmail);if(Q?.userName)Z[tH.userName]=zy(Q.userName);let X=$.repo;if(X){if(X.displayName)Z[tH.gitRepo]=zy(X.displayName);let Y=hH6(X.cloneUrl);if(Y)Z[tH.gitRepoUrl]=zy(Y);let J=$.branch??X.branch;if(J)Z[tH.gitBranch]=zy(J)}return Z}function lH6($){let Z=$.metadata?.labels;if(!Z)return null;let Q=Z[iY.orgId],X=Z[iY.userId];if(!Q||!X)return null;let Y=$.metadata?.annotations??{};return{orgId:Q,userId:X,orgSlug:Y[tH.orgSlug],orgName:Y[tH.orgName],userEmail:Y[tH.userEmail],userName:Y[tH.userName]}}function cH6($,Z){if($){let Q=new Date($).getTime();if(Number.isFinite(Q)&&Q<=Z.getTime())return null}return Z.toISOString()}function mH6($,Z){if($){let Q=new Date($).getTime();if(Number.isFinite(Q)&&Q>=Z.getTime())return null}return Z.toISOString()}function XF1($){return{org_id:$?.orgId??"",user_id:$?.userId??"",runner_kind:"agent-sandbox"}}async function dH6($,Z){if(!Z||!$.tenant)return $.orgFsConfigJson;try{return await Z($.tenant)??$.orgFsConfigJson}catch(Q){return console.warn(`[${R6}] org-fs credential re-mint failed: ${Q instanceof Error?Q.message:String(Q)}`),$.orgFsConfigJson}}function iH6($){let Z={};if($.branch)Z.branch=$.branch;if($.repo)Z.repo=$.repo;if($.workload)Z.workload=$.workload;if($.env&&Object.keys($.env).length>0)Z.env=$.env;if($.tenant)Z.tenant=$.tenant;if($.cloneOnly)Z.cloneOnly=!0;if($.purpose)Z.purpose=$.purpose;if($.sandboxImage)Z.sandboxImage=$.sandboxImage;if($.orgFsConfigJson)Z.orgFsConfigJson=$.orgFsConfigJson;return Object.keys(Z).length>0?Z:null}function pH6($,Z){try{return new URL(MV0($,Z)).hostname||null}catch{return null}}var R6="AgentSandboxProvider",Py="x-sandbox-preview-not-ready",EH6="agent-sandbox-system",zH6="studio-sandbox",PH6=300000,YO=9000,ym$=3000,kV0="/app",TH6=32,AH6,RH6=900000,qH6=60000,MH6=1800000,SV0=3,gm$=1800000,IH6=900000,VH6=1800000,kH6,hm$,YF1=40000,cm$=1e4,SH6=256,iY,tH,xH6,fH6=63,bH6,gH6=253;var mm$=L(()=>{O8();ub$();Um$();iH1();nH1();YO0();ZO0();km$();sH1();AH6=new Set(["DAEMON_TOKEN","DAEMON_BOOT_ID","APP_ROOT","PROXY_PORT"]),kH6=["cookie","host","connection","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","accept-encoding","content-length","upgrade"],hm$=["connection","keep-alive","transfer-encoding","content-encoding","content-length"];iY={role:"studio.decocms.com/role",sandboxHandle:"studio.decocms.com/sandbox-handle",orgId:"studio.decocms.com/org-id",userId:"studio.decocms.com/user-id",env:"studio.decocms.com/env"},tH={orgSlug:"studio.decocms.com/org-slug",orgName:"studio.decocms.com/org-name",userEmail:"studio.decocms.com/user-email",userName:"studio.decocms.com/user-name",gitRepo:"studio.decocms.com/git-repo",gitRepoUrl:"studio.decocms.com/git-repo-url",gitBranch:"studio.decocms.com/git-branch"},xH6=/^([A-Za-z0-9]([-A-Za-z0-9_.]*[A-Za-z0-9])?)?$/;bH6=/^[a-z]([a-z0-9-]{0,30}[a-z0-9])?$/});var dm$={};K0(dm$,{parseTenantPools:()=>Sm$,PREVIEW_NOT_READY_HEADER:()=>Py,AgentSandboxProvider:()=>GF1});var KF1=L(()=>{mm$();sH1()});var nm$={};K0(nm$,{subscribeLifecycle:()=>BF1,getOrInitSharedRunner:()=>NF1,getAgentSandboxProviderForTeardown:()=>UF1,getAgentSandboxProvider:()=>pY,__resetSharedLifecyclesForTesting:()=>QF6});function HF1($){let Z=u80[im$];if(Z)return Promise.resolve(Z);let Q=u80[WF1];if(Q)return Q;let X=$().then((Y)=>{return u80[im$]=Y,Y}).finally(()=>{delete u80[WF1]});return u80[WF1]=X,X}function nH6(){let $=process.env.STUDIO_SANDBOX_PREVIEW_URL_PATTERN;return $&&$.trim()!==""?$:void 0}function tH6(){let $=process.env.STUDIO_SANDBOX_TEMPLATE_NAME;return $&&$.trim()!==""?$:void 0}function oH6(){let $=process.env.STUDIO_ENV;return $&&$.trim()!==""?$:void 0}function aH6(){let $=process.env.STUDIO_SANDBOX_SENTINEL_TOKEN;return $&&$.trim()!==""?$:void 0}function rH6(){let $=process.env.STUDIO_SANDBOX_PREVIEW_GATEWAY_NAME?.trim(),Z=process.env.STUDIO_SANDBOX_PREVIEW_GATEWAY_NAMESPACE?.trim();if(!$&&!Z)return;if(!$||!Z)throw Error("STUDIO_SANDBOX_PREVIEW_GATEWAY_NAME and STUDIO_SANDBOX_PREVIEW_GATEWAY_NAMESPACE must both be set, or both unset. Half-configured per-claim HTTPRoute routing would silently fail to attach.");return{name:$,namespace:Z}}async function FF1($){let Z=new N80($),Q=nH6(),{AgentSandboxProvider:X,parseTenantPools:Y}=await Promise.resolve().then(() => (KF1(),dm$)),J=new gG(T0().encryptionKey);return new X({stateStore:Z,previewUrlPattern:Q,sandboxTemplateName:tH6(),envName:oH6(),previewGateway:rH6(),sentinelToken:aH6(),tenantPools:Y(process.env.STUDIO_SANDBOX_TENANT_POOLS),meter:A$,mintCloneUrl:async(G,K)=>{if(G.repositoryId){let F=await new t$0($).getUnscoped(G.repositoryId);if(!F)return null;let{cloneUrl:U}=await QN({db:$,vault:J},F,{bufferMs:K?.bufferMs});return U}if(!G.connectionId)return null;let W=Eb$(G.cloneUrl);if(!W)return null;let{cloneUrl:H}=await XN(G.connectionId,W.owner,W.name,$,J,{bufferMs:K?.bufferMs});return H},mintOrgFsConfig:async(G)=>{if(!G.orgSlug)return null;return await $O0({boundAuth:{apiKey:{create:(W)=>x8.api.createApiKey({body:{...W,userId:G.userId}})}},storage:{orgRepoSyncs:new c2($)}},{orgSlug:G.orgSlug,orgId:G.orgId,baseUrl:h5()})??null}})}function pY($){if(!T0().agentSandboxEnabled)throw Error("Agent sandbox is disabled. Set STUDIO_AGENT_SANDBOX_ENABLED=true to enable it.");return HF1(()=>FF1($.db))}function UF1($){return HF1(()=>FF1($.db))}async function NF1(){if(!T0().agentSandboxEnabled)return null;return HF1(()=>FF1(W8().db))}function BF1($,Z,Q){let X=cE.get(Z);if(X){if(X.terminated){if(X.lastPhase)try{Q(X.lastPhase)}catch{}return{unsubscribe:$F6}}if(X.listeners.add(Q),X.lastPhase)try{Q(X.lastPhase)}catch{}return pm$(Z,X,Q)}let Y=new AbortController,J={lastPhase:null,terminated:!1,listeners:new Set([Q]),abort:Y};return cE.set(Z,J),ZF6($,Z,J),pm$(Z,J,Q)}function $F6(){}function pm$($,Z,Q){return{unsubscribe(){if(cE.get($)!==Z)return;if(Z.listeners.delete(Q),Z.listeners.size===0)cE.delete($),Z.abort.abort()}}}async function ZF6($,Z,Q){let X=null;try{for await(let Y of $.watchClaimLifecycle(Z,Q.abort.signal)){if(Q.abort.signal.aborted)break;Q.lastPhase=Y;let J=Y.kind==="ready"||Y.kind==="failed";if(J)Q.terminated=!0;let G=Array.from(Q.listeners);for(let K of G)try{K(Y)}catch{}if(J)break}}catch(Y){X=Y}finally{if(!Q.terminated&&!Q.abort.signal.aborted&&Q.listeners.size>0){let Y={kind:"failed",reason:"unknown",message:X instanceof Error?X.message:"Lifecycle watcher ended unexpectedly"};Q.lastPhase=Y,Q.terminated=!0;for(let J of Array.from(Q.listeners))try{J(Y)}catch{}}if(cE.get(Z)===Q)cE.delete(Z)}}function QF6(){for(let $ of cE.values())$.abort.abort();cE.clear()}var im$,WF1,u80,sH6,eH6,cE;var oH=L(()=>{LX();f6();lK1();L80();rZ();sd();MT();H$();l2();N3();B9();im$=Symbol.for("decocms.sandbox.lifecycle.agent-sandbox-runner"),WF1=Symbol.for("decocms.sandbox.lifecycle.agent-sandbox-inflight"),u80=globalThis;sH6=Symbol.for("decocms.sandbox.lifecycle.shared-lifecycles"),eH6=globalThis,cE=eH6[sH6]??=new Map});import{sql as XF6}from"kysely";function tm$($){return $ instanceof Date?$.toISOString():String($)}class LF1{db;vault;constructor($,Z){this.db=$;this.vault=Z}rowToInfo($){return{id:$.id,organizationId:$.organization_id,scope:$.scope,userId:$.user_id,name:$.name,description:$.description,createdBy:$.created_by,createdAt:tm$($.created_at),updatedBy:$.updated_by,updatedAt:tm$($.updated_at)}}assertVisible($,Z){if($.scope==="user"&&$.user_id!==Z)throw new mE($.id)}async create($){let Z=Z4("sec"),Q=await this.vault.encrypt($.value),X=new Date,Y=await this.db.insertInto("secrets").values({id:Z,organization_id:$.organizationId,scope:$.scope.kind,user_id:$.scope.kind==="user"?$.scope.userId:null,name:$.name,encrypted_value:Q,description:$.description??null,created_by:$.createdBy,created_at:X,updated_by:$.createdBy,updated_at:X}).returning(CV0).executeTakeFirstOrThrow();return this.rowToInfo(Y)}async update($){let Z=await this.db.selectFrom("secrets").where("id","=",$.id).where("organization_id","=",$.organizationId).select(["id","scope","user_id"]).executeTakeFirst();if(!Z)throw new QW($.id);this.assertVisible(Z,$.callerUserId);let Q={updated_by:$.updatedBy,updated_at:new Date};if($.value!==void 0)Q.encrypted_value=await this.vault.encrypt($.value);if($.description!==void 0)Q.description=$.description;let X=await this.db.updateTable("secrets").set(Q).where("id","=",$.id).where("organization_id","=",$.organizationId).returning(CV0).executeTakeFirstOrThrow();return this.rowToInfo(X)}async delete($,Z,Q){let X=await this.db.selectFrom("secrets").where("id","=",$).where("organization_id","=",Z).select(["id","scope","user_id"]).executeTakeFirst();if(!X)throw new QW($);this.assertVisible(X,Q),await this.db.deleteFrom("secrets").where("id","=",$).where("organization_id","=",Z).execute()}async list($){let Z=this.db.selectFrom("secrets").where("organization_id","=",$.organizationId).select(CV0);if($.scope?.kind==="user")Z=Z.where("scope","=","user").where("user_id","=",$.scope.userId);else if($.scope?.kind==="organization")Z=Z.where("scope","=","organization");else Z=Z.where((X)=>X.or([X("scope","=","organization"),X.and([X("scope","=","user"),X("user_id","=",$.callerUserId)])]));return(await Z.orderBy("created_at","desc").execute()).map((X)=>this.rowToInfo(X))}async findById($,Z,Q){let X=await this.db.selectFrom("secrets").where("id","=",$).where("organization_id","=",Z).select(CV0).executeTakeFirst();if(!X)throw new QW($);return this.assertVisible(X,Q),this.rowToInfo(X)}async resolveById($,Z,Q){let X=await this.db.selectFrom("secrets").where("id","=",$).where("organization_id","=",Z).selectAll().executeTakeFirst();if(!X)throw new QW($);this.assertVisible(X,Q);let Y=await this.vault.decrypt(X.encrypted_value);return{info:this.rowToInfo(X),value:Y}}async resolveByName($){let Z=this.db.selectFrom("secrets").where("organization_id","=",$.organizationId).where("scope","=",$.scope.kind).where(XF6`lower(name) = lower(${$.name})`).selectAll();if($.scope.kind==="user")Z=Z.where("user_id","=",$.scope.userId);let Q=await Z.executeTakeFirst();if(!Q)throw new QW(`${$.scope.kind}:${$.name}`);let X=await this.vault.decrypt(Q.encrypted_value);return{info:this.rowToInfo(Q),value:X}}}var CV0,QW,mE;var l80=L(()=>{jX();CV0=["id","organization_id","scope","user_id","name","description","created_by","created_at","updated_by","updated_at"];QW=class QW extends Error{constructor($){super(`Secret ${$} not found`);this.name="SecretNotFoundError"}};mE=class mE extends Error{constructor($){super(`Access denied for secret ${$}`);this.name="SecretAccessDeniedError"}}});async function _V0({ctx:$,orgId:Z,userId:Q,entries:X}){if(!X||X.length===0)return[];let Y=[];for(let J of X)try{let{value:G}=await $.storage.secrets.resolveById(J.secretId,Z,Q);Y.push({host:J.host,token:G})}catch(G){if(G instanceof QW||G instanceof mE){console.warn(`[SANDBOX_START] skipping submodule credential for ${J.host}: ${G.message}. Re-link or recreate the secret to restore.`);continue}throw G}return Y}var OF1=L(()=>{l80()});function lZ($){if(!$||typeof $!=="object")return{};let Z=$.sandboxMap;if(!Z||typeof Z!=="object")return{};return Z}function FN($,Z,Q){let X=$[Z]?.[Q];if(!X)return null;return oB(X)[iQ]??null}function c80($,Z,Q,X){let J={...oB($[Z]?.[Q]),[iQ]:X};return{...$,[Z]:{...$[Z]??{},[Q]:J}}}async function om$($,Z,Q,X,Y,J){let G=await $.findById(Z);if(!G)return;let K=G.metadata??{},W=c80(lZ(K),X,Y,J);await $.update(Z,Q,{metadata:{...K,sandboxMap:W}})}function DF1($,Z,Q){let X=oB($[Z]?.[Q]);if(!X[iQ])return null;let Y={...X};delete Y[iQ];let J={...$[Z]??{}};if(Object.keys(Y).length===0)delete J[Q];else J[Q]=Y;let G={...$};if(Object.keys(J).length===0)delete G[Z];else G[Z]=J;return G}async function dE($,Z,Q,X,Y){let J=await $.findById(Z);if(!J)return;let G=J.metadata??{},K=DF1(lZ(G),X,Y);if(!K)return;await $.update(Z,Q,{metadata:{...G,sandboxMap:K}})}var iQ="agent-sandbox";var aJ=L(()=>{Q4()});function JO($,Z){return Z?`thread:${$}/${Z}`:`thread:${$}`}function aH($){return`sandbox/thread-${$.replace(/^thread:/,"").replace(/\//g,"-")}`}function UN($){if(!$||!$.startsWith("thread:"))return null;return $.slice(7).split("/")[0]||null}async function Ty($,Z,Q){return jF1(await wF1($,Z),Q)}async function wF1($,Z){let Q=UN(Z);if(!Q)return null;return await $.storage.threads.get(Q).catch(()=>null)}function jF1($,Z){return $?.created_by??Z}async function iE($,Z){if(!Z)return null;let Q=await $.storage.threads.get(Z).catch(()=>null);if(!Q)return null;return Q.metadata??{}}async function vV0($,Z){let X=(await iE($,Z))?.headRef;return typeof X==="string"&&X.length>0?X:null}async function am$($,Z,Q){let X=await iE($,Z);if(!X)return;if(X.headRef===Q)return;await $.storage.threads.update(Z,{metadata:{...X,headRef:Q}}).catch((Y)=>console.warn("[thread-repo] setThreadHeadRef failed",Y))}function YF6($,Z){let Q=HL0(Z,$.owner,$.name);if(!Q||Q.id===$.connectionId)return null;let X=t9(Q);return{...$,connectionId:Q.id,...X?.installationId?{installationId:X.installationId}:{}}}async function EF1($,Z){let X=(await iE($,Z))?.githubRepos;return Array.isArray(X)?X.filter((Y)=>Y?.owner&&Y?.name):[]}async function NN($,Z){let Q=await iE($,Z),X=Q?.githubRepo??null;if(!Z||!Q||!X?.connectionId)return X;try{let Y=$.storage.threads.getOrganizationId();if(!Y)return X;if(await $.storage.connections.findById(X.connectionId,Y))return X;let{items:J}=await $.storage.connections.list(Y),G=YF6(X,J);if(!G)return X;return await $.storage.threads.update(Z,{metadata:{...Q,githubRepo:G}}),console.warn("[thread-repo] re-pointed thread at a live repo connection",{threadId:Z,from:X.connectionId,to:G.connectionId}),G}catch(Y){return console.warn("[thread-repo] repoint check failed",Y),X}}function zF1($){if($.pinnedRef)return $.pinnedRef;if($.runBranch&&$.runBranch===JO($.threadId))return $.runBranch;if($.threadRepo)return JO($.threadId,$.threadRepo.connectionId);if(!$.agentRepo)return"ephemeral";return $.runBranch??`thread:${$.threadId}`}async function PF1($,Z){let X=(await iE($,Z))?.pinnedRef;return typeof X==="string"&&X.length>0?X:null}async function Mi($,Z){let[Q,X]=await Promise.all([NN($,Z.threadId),PF1($,Z.threadId)]);return zF1({...Z,threadRepo:Q,pinnedRef:X})}async function rm$($,Z,Q,X,Y){let J=await iE($,Z);if(!J)return;let G=c80(lZ(J),Q,X,Y);await $.storage.threads.update(Z,{metadata:{...J,sandboxMap:G}}).catch((K)=>console.warn("[thread-repo] setThreadSandboxMapEntry failed",K))}async function xV0($,Z){return lZ(await iE($,Z))}async function sm$($,Z,Q,X){let Y=await iE($,Z);if(!Y)return;let J=DF1(lZ(Y),Q,X);if(!J)return;await $.storage.threads.update(Z,{metadata:{...Y,sandboxMap:J}}).catch((G)=>console.warn("[thread-repo] removeThreadSandboxMapEntry failed",G))}var XW=L(()=>{lJ();aJ()});function m80($){let Z=new Set($.map((Y)=>Y.name.toLowerCase()).filter((Y,J,G)=>G.indexOf(Y)!==J)),Q=$.map((Y)=>Z.has(Y.name.toLowerCase())),X=(Y)=>{let J=$[Y];return em$(Q[Y]?`${J.owner}-${J.name}`:J.name).toLowerCase()};for(let Y=0;Y<$.length;Y++){let J=new Map,G=!1;for(let K=0;K<$.length;K++){let W=X(K),H=J.get(W);if(H!==void 0){if(!Q[K])Q[K]=!0,G=!0;if(!Q[H])Q[H]=!0,G=!0}J.set(W,K)}if(!G)break}return $.map((Y,J)=>em$(Q[J]?`${Y.owner}-${Y.name}`:Y.name))}function $d$($,Z){let Q=`${Z.owner}/${Z.name}`.toLowerCase(),X=$.findIndex((Y)=>`${Y.owner}/${Y.name}`.toLowerCase()===Q);return X===-1?null:m80($)[X]??null}function em$($){return $.replace(/[^A-Za-z0-9._-]/g,"-").replace(/^[^A-Za-z0-9]+/,"")||"repo"}import{AsyncLocalStorage as JF6}from"async_hooks";function fV0(){let $=z3.getStore();if(!$)throw Error("This tool is only available on a task run's MCP endpoint (/api/<org>/mcp/task-run/<threadId>).");return $}function bV0($){if($?.metadata?.source==="jira")return KF6;return tK.some((Q)=>NE($?.title,Q))?GF6:Zd$}var z3,Zd$,GF6,KF6;var GO=L(()=>{x4();z3=new JF6;Zd$=["TASK_ADD_REPO","TASK_BOARD_ITEM_LIST","TASK_BOARD_ITEM_UPDATE","TASK_BOARD_ACTIVITY_LIST","TASK_BOARD_COMMENT_LIST","TASK_BOARD_COMMENT_CREATE","TASK_BOARD_COMMENT_UPDATE"],GF6=[...Zd$,"TASK_BOARD_ITEM_PRS_GET","TASK_BOARD_REVIEW_DECISION"],KF6=["TASK_ADD_REPO","JIRA_ISSUE_GET","JIRA_COMMENT_ADD","JIRA_ISSUE_TRANSITION","JIRA_ATTACHMENT_DOWNLOAD","JIRA_REMOTE_LINK_ADD"]});import{z as P3}from"zod";async function UF6($,Z,Q,X){return V8(async()=>{let Y=FN(await xV0($,Z),Q,X);if(!Y)throw Error("sandbox record not written yet");return Y},{maxAttempts:WF6,minTimeout:HF6,maxTimeout:FF6,jitter:0}).catch(()=>null)}function BF6($,Z,Q=Jd$){let X=(J)=>`${J.owner}/${J.name}`.toLowerCase(),Y=X(Z);if($.some((J)=>X(J)===Y))return!1;return $.length>=Q}async function Yd$($,Z,Q,X){let Y=await $.proxyDaemonRequest(Z,"/_sandbox/bash",{method:"POST",headers:new Headers({"content-type":"application/json","x-thread-id":Q}),body:JSON.stringify({command:X})});if(!Y.ok)throw Error(`sandbox bash failed (${Y.status} ${Y.statusText})`);let J=await Y.json();return{stdout:J.stdout??"",exitCode:J.exitCode??0}}function LF6($){let Z=$.split(`
 `).map((Y)=>Y.trim()),Q=Z.includes("__CLONED__"),X=Z.filter((Y)=>Y&&Y!==".git"&&Y!=="__CLONED__");return{cloned:Q,listing:X.join(`
 `)}}function OF6($){return[...$?[`cd ${JSON.stringify($)} || exit 0`]:[],...DF6].join(`
-`)}async function wF6($,Z,Q){if(Q.repository)return QN($,Q.repository,{bufferMs:yV0});return await Hi({ctx:$,connectionId:Q.connectionId,organizationId:Z,forceRefresh:!0,onLegacyMintError:(X)=>console.error("[TASK_ADD_REPO] legacy repo-scoped mint failed",{connectionId:Q.connectionId,error:X.message})}),XN(Q.connectionId,Q.owner,Q.name,$.db,$.vault,{bufferMs:yV0})}async function jF6($,Z,Q){let X=await $.storage.organizationSettings.get(Z);return _V0({ctx:$,orgId:Z,userId:Q,entries:X?.submodule_credentials})}function EF6($){return{git:{...$.primary?{repository:{...$.primary,submoduleCredentials:$.submoduleCredentials}}:{repositories:$.secondaries??[]},identity:{userName:$.gitUserName,userEmail:$.gitUserEmail}}}}async function zF6($,Z,Q,X){let Y=m80(Q);return(await Promise.all(Q.map(async(G,K)=>{let W=await SE($.storage,Z,G),H=W&&await aL($.storage,W)?W:null;if(!H&&!G.connectionId)return null;try{let{cloneUrl:F}=H?await QN($,H,{bufferMs:yV0}):await XN(G.connectionId,G.owner,G.name,$.db,$.vault,{bufferMs:yV0});return{cloneUrl:F,repoName:Y[K],submoduleCredentials:X}}catch(F){return console.warn(`[TASK_ADD_REPO] skipping secondary ${G.owner}/${G.name}:`,F instanceof Error?F.message:F),null}}))).filter((G)=>G!==null)}var yV0=3300000,WF6=4,HF6=250,FF6=2000,Qd$=45000,Xd$=1500,NF6=5,Jd$=20,DF6,TF1;var Gd$=L(()=>{x0();rZ();U80();nL0();oH();L80();OF1();aJ();XW();O8();GO();DF6=["origin=$(git remote get-url origin)",'token=$(printf %s "$origin" | sed -n "s|.*://[^:]*:\\([^@]*\\)@.*|\\1|p")','[ -n "$token" ] || exit 0','user=$(printf %s "$origin" | sed -n "s|.*://\\([^:]*\\):.*|\\1|p")','host=$(printf %s "$origin" | sed -n "s|.*@\\([^/]*\\)/.*|\\1|p")','[ -n "$host" ] || exit 0',"umask 077",'if [ "$user" = "oauth2" ]; then','  mkdir -p "${HOME:-/root}/.config/glab-cli"','  printf "hosts:\\n  %s:\\n    token: %s\\n    api_host: %s\\n    api_protocol: https\\n    is_oauth2: true\\n" "$host" "$token" "$host" > "${HOME:-/root}/.config/glab-cli/config.yml"','  chmod 600 "${HOME:-/root}/.config/glab-cli/config.yml"','elif [ "$user" = "x-access-token" ]; then','  mkdir -p "${HOME:-/root}/.config/gh"','  printf "%s:\\n  oauth_token: %s\\n  git_protocol: https\\n" "$host" "$token" > "${HOME:-/root}/.config/gh/hosts.yml"',"fi"];TF1=p({name:"TASK_ADD_REPO",description:"Clone one of this organization's repositories into your working directory. "+"Your working directory is EMPTY until you call this \u2014 do not look for "+"files, and do not run git, before it returns. Call it once, with the repository the task is about; it waits for the checkout and returns the repository root listing, so you can start reading files immediately after. `git` and the repository's CLI (`gh` for GitHub, `glab` for GitLab; Bitbucket has "+"no CLI \u2014 its token is the password in `git remote get-url origin`, for `curl` "+"against api.bitbucket.org) are authenticated once it returns. Call TASK_ADD_REPO with no arguments to list the repositories available.",annotations:{title:"Add Repository",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!0},inputSchema:P3.object({id:P3.string().optional().describe("id of the repository to clone, as returned by the listing. Omit to list the available repositories."),connectionId:P3.string().optional().describe("Deprecated alias for `id`.")}),outputSchema:P3.object({success:P3.boolean(),repositories:P3.array(P3.object({id:P3.string(),repo:P3.string()})).optional(),repo:P3.string().optional(),cloned:P3.boolean().optional(),files:P3.string().optional(),message:P3.string()}),handler:async($,Z)=>{$0(Z),await Z.access.check();let Q=U0(Z),X=t0(Z);if(!X)throw Error("User ID required");let{threadId:Y}=fV0(),J=await CE(Z,Q.id),G=$.id??$.connectionId,K=G?J.find((W0)=>W0.id===G):void 0;if(!K){let W0=J.map((P0)=>({id:P0.id,repo:P0.label}));return{success:!1,repositories:W0,message:G?`No repository for id "${G}". Pick one of the repositories listed.`:W0.length===0?"This organization has no repositories linked, so none can be cloned.":"Pick a repository and call TASK_ADD_REPO again with its id."}}let W=await Z.storage.threads.get(Y);if(!W)throw Error(`Thread not found: ${Y}`);let H=await Mi(Z,{threadId:Y,runBranch:W.branch}),F=await Ty(Z,H,X),U=await pY(Z),N=await UF6(Z,Y,F,H);if(!N)throw Error(`No sandbox is registered for this run (thread ${Y}), so there is nowhere to clone into.`);let B=W.metadata?.githubRepo,O=W.metadata?.githubRepos??[],D=B&&B.owner===K.owner&&B.name?.toLowerCase()===K.name.toLowerCase();if(B&&(D||BF6(O,{owner:K.owner,name:K.name})))return{success:!1,repo:`${K.owner}/${K.name}`,cloned:!1,message:D?`${K.label} is already checked out at your working directory.`:`This run already has ${Jd$} additional repositories checked out, which is the limit. Work with what's already checked out instead of adding another.`};let{cloneUrl:w,gitUserName:j,gitUserEmail:E}=await wF6(Z,Q.id,K),z={url:K.webUrl,owner:K.owner,name:K.name,...K.installationId!==void 0?{installationId:K.installationId}:{},...K.connectionId?{connectionId:K.connectionId}:{},...K.repository?{repositoryId:K.repository.id}:{}},A=!B,P=A?[]:await Z.storage.threads.appendThreadGithubRepo(Y,z);if(A)await Z.storage.threads.update(Y,{metadata:{...W.metadata??{},githubRepo:z},updated_by:X});let T=pL0({branch:H,derivedRef:aH(H),recordedHeadRef:null,sticky:!1}),q=await jF6(Z,Q.id,X),f=await U.proxyDaemonRequest(N.sandboxHandle,"/_sandbox/config",{method:"PUT",headers:new Headers({"content-type":"application/json"}),body:JSON.stringify(EF6({...A?{primary:{cloneUrl:w,branch:T,repoName:`${K.owner}/${K.name}`}}:{secondaries:await zF6(Z,Q.id,P,q)},submoduleCredentials:q,gitUserName:j,gitUserEmail:E}))});if(!f.ok)throw Error(`the sandbox rejected the repository (${f.status} ${f.statusText})`);await U.proxyDaemonRequest(N.sandboxHandle,"/_sandbox/setup/clone",{method:"POST",headers:new Headers({"content-type":"application/json"}),body:"{}"}).catch((W0)=>{console.warn("[TASK_ADD_REPO] explicit clone kick failed",W0)});let C=A?null:$d$(P,{owner:K.owner,name:K.name}),V=A||!C?".":`"$(dirname "$PWD")/repos/${C}"`,h=Date.now()+Qd$,g=!1,l="",u=0,d=null;while(Date.now()<h){let W0=await Yd$(U,N.sandboxHandle,Y,`cd ${V} 2>/dev/null || exit 1; if [ -n "$(git ls-files 2>/dev/null | head -1)" ]; then echo __CLONED__; fi; ls -A 2>/dev/null`).catch(()=>null);if(!W0){if(++u>=NF6)break;await k$(Xd$);continue}u=0;let P0=LF6(W0.stdout);if(P0.cloned&&P0.listing===d){g=!0,l=P0.listing;break}d=P0.cloned?P0.listing:null,await k$(Xd$)}if(g)await Yd$(U,N.sandboxHandle,Y,OF6(A?null:`../repos/${C}`)).catch((W0)=>console.warn("[TASK_ADD_REPO] CLI auth setup failed",W0));return{success:g,repo:`${K.owner}/${K.name}`,cloned:g,files:l,message:g?A?`${K.label} is checked out at your working directory on branch ${T}. \`git\` and its CLI are authenticated. Start working.`:`${K.label} is checked out at ../repos/${C}, beside your working directory, on its default branch. \`git\` and its CLI are authenticated there too. Your first checkout is untouched \u2014 commit and open a change request in each repository you change.`:`The clone of ${K.owner}/${K.name} did not finish within ${Math.round(Qd$/1000)}s. It may still be in progress \u2014 check your working directory before calling this again.`}}})});import{z as f1}from"zod";var Ii=50000,Vi=500,gV0=200,ki=50000,KO,d80,Ay,PF6,TF6,AF6,Kd$,Si,RF6,qF6,Wd$;var rJ=L(()=>{x4();x4();KO=f1.enum(cH),d80=f1.enum(["bug","feature","chore","spike","security"]),Ay=f1.enum(["none","low","medium","high","urgent"]),PF6=f1.object({threadId:f1.string(),virtualMcpId:f1.string().nullable(),status:f1.enum(["in_progress","requires_action","failed","completed","expired"]).nullable(),title:f1.string().nullable(),lastMessage:f1.string().nullable(),hasPreview:f1.boolean(),failureKind:f1.string().nullable(),hasMessages:f1.boolean(),costUsd:f1.number().nullable(),costProvider:f1.string().nullable(),createdAt:f1.string(),lastActiveAt:f1.string()}),TF6=f1.object({reviewer:f1.enum(tK),verdict:f1.enum(["approved","changes_requested"]),verified:f1.boolean()}),AF6=f1.object({id:f1.string(),name:f1.string(),color:f1.string().nullable().describe('Hex color, e.g. "#3b82f6"'),createdBy:f1.string(),createdAt:f1.string().datetime()}),Kd$=f1.object({url:f1.string(),number:f1.number(),repoOwner:f1.string(),repoName:f1.string(),createdAt:f1.string(),updatedAt:f1.string().nullable(),title:f1.string().nullable(),body:f1.string().nullable(),state:f1.enum(["open","closed"]).nullable(),draft:f1.boolean().nullable(),merged:f1.boolean().nullable(),mergeable:f1.boolean().nullable(),checksStatus:f1.enum(["pending","passing","failing"]).nullable(),checks:f1.array(f1.object({name:f1.string(),status:f1.string(),conclusion:f1.string().nullable(),detailsUrl:f1.string().nullable(),summary:f1.string().nullable()})),previewUrl:f1.string().nullable()}),Si=f1.object({id:f1.string(),organizationId:f1.string(),title:f1.string(),description:f1.string().nullable(),status:KO,priority:Ay,type:d80,assigneeId:f1.string().nullable(),assignedBy:f1.string().nullable(),repo:f1.string().nullable(),repositoryId:f1.string().nullable(),dueDate:f1.string().datetime().nullable(),sortOrder:f1.number(),keySeq:f1.number().nullable(),externalUrl:f1.string().nullable(),previewRoutes:f1.array(f1.string()),source:f1.enum(["jira"]).nullable(),retryAttempts:f1.number(),reviewCycleStartedAt:f1.string().datetime().nullable(),threads:f1.array(PF6),tags:f1.array(AF6),reviewVerdicts:f1.array(TF6),createdBy:f1.string(),createdAt:f1.string().datetime(),updatedBy:f1.string(),updatedAt:f1.string().datetime()}),RF6=["created","status_changed","assignee_changed","priority_changed","due_date_changed","title_changed","description_changed","tags_changed","review_requested","review_approved","review_changes_requested","review_verdict_requested","merge_conflict_resolution","merge_failed","type_changed","duplicate_reported"],qF6=f1.enum(RF6),Wd$=f1.object({id:f1.string(),taskBoardItemId:f1.string(),action:qF6,actorId:f1.string().nullable(),data:f1.record(f1.string(),f1.unknown()),occurredAt:f1.string().datetime()})});async function hV0($,Z,Q){if(Q===I8)return;let{members:X}=await $.boundAuth.organization.listMembers({organizationId:Z,filterField:"userId",filterValue:Q});if(!X.some((Y)=>Y.userId===Q))throw Error("assigneeId is not a member of the organization")}var AF1=L(()=>{rJ()});function Ud$($){let Z={};for(let[Q,X]of Object.entries($)){if(Q.startsWith(MF6))continue;Z[Q]=X}return Z}function uV0($){return{taskBoardItemId:$.id,...yX($)&&{[Hd$]:Fd$}}}function IF6($){return $?.[Hd$]===Fd$}function VF6($){if(/[:\s]/.test($))throw Error("organization id unsuitable for the subsidy key scheme");return`subsidy:${$}`}async function kF6($,Z){let Q=T0();try{let X=await $.storage.subsidizedGatewayKeys.get(Z);if(X)return X;let Y=$.auth?.user?.id;if(Y&&Q.aiGatewayEnabled&&Q.studioProvisionSecretKey&&jj.provisionKey){let J=await MQ(Y,$.auth?.user?.email),G=await jj.provisionKey(J,VF6(Z));return await $.storage.subsidizedGatewayKeys.put(Z,G),G}}catch(X){console.error("[subsidized-runs] subsidy key unavailable \u2014 run stays on the org's key:",X)}return}async function Nd$($,Z,Q){if(!T0().taskQuotaEnforced)return;if(!IF6(Q))return;let X=Q?.taskBoardItemId;if(!X)return;let Y=await $.storage.taskBoard.getById(X,Z);if(!Y||!yX(Y))return;if(!await xx$($,X))return;return await kF6($,Z)}function Bd$($,Z){if(!Z)return $;if($.providerId!=="deco")return $;return{...$,apiKey:Z}}var MF6="srv.",Hd$="srv.billing",Fd$="subscription";var i80=L(()=>{hm();$H();H$();oK()});function p80($){let Z=$?.runClass;return Z&&Z in RF1?RF1[Z]:RF1.interactive}var RF1,Ci="runClass";var _i=L(()=>{RF1={interactive:10,reviewer:20,retry:30,new_task:40}});async function lV0($,Z,Q){let X;try{return await Promise.race([$.aiProviders.listModels(Z,Q),new Promise((J,G)=>{X=setTimeout(()=>G(Error("listModels timeout")),SF6)})])}finally{if(X)clearTimeout(X)}}function CF6($,Z){switch($){case"fast":return Z.chat.fast;case"smart":return Z.chat.smart;case"thinking":return Z.chat.thinking;case"image":return Z.image;case"web_search":return Z.webSearch;case"deep_research":return Z.deepResearch}}function cV0($,Z,Q){let X=$.find((Y)=>Y.modelId===Z);return{title:X?.title??Q??Z,providerId:X?.providerId,capabilities:X?.capabilities,limits:X?.limits??null}}async function q6($,Z,Q){let X=$.organization?.id;if(!X)throw Error("resolveTier called without an organization");let J=(await $.storage.organizationSettings.get(X))?.simple_mode?.tiers?.[Z]??null,G=$.auth?.user?.id,K=JE.safeParse(Z),W=Q?.applyUserPrefs&&K.success&&G?(await $.storage.userModelPreferences.get(G,X))?.tiers?.[K.data]??null:null,H=(await $.storage.aiProviderKeys.list({organizationId:X})).filter((w)=>VT(w.providerId)),F=await hS$($,X,Z),U=F?H.find((w)=>w.providerId==="deco"):void 0;if(F&&U){let w=await lV0($,U.id,X).catch(()=>[]);return{credentialId:U.id,modelId:F,modelMeta:cV0(w,F)}}for(let w of[W,J])if(w&&H.some((j)=>j.id===w.keyId)){let j=await lV0($,w.keyId,X).catch(()=>[]);return{credentialId:w.keyId,modelId:w.modelId,modelMeta:cV0(j,w.modelId,w.title)}}if(H.length===0)throw new vi(Z);let N={};await Promise.all(H.map(async(w)=>{N[w.id]=await lV0($,w.id,X).catch(()=>[])}));let B=H.map((w)=>({id:w.id,providerId:w.providerId,label:w.label,presetId:w.presetId,createdBy:w.createdBy,createdAt:w.createdAt})),O=M3$(B,N),D=CF6(Z,O);if(!D)throw new vi(Z);return{credentialId:D.keyId,modelId:D.modelId,modelMeta:cV0(N[D.keyId]??[],D.modelId,D.title)}}async function Ld$($,Z,Q){let X=$.organization?.id;if(!X)throw Error("resolveSpecificModel called without an organization");let Y=await $.storage.aiProviderKeys.findById(Z,X).catch((G)=>{if(G instanceof Error&&G.message==="Provider key not found")throw new n80(`AI provider credential "${Z}" was not found`,{cause:G});throw G});if(!VT(Y.providerId))throw new n80(`AI provider credential "${Z}" uses native-only provider "${Y.providerId}" and cannot run a hosted model`);let J=await lV0($,Z,X).catch(()=>[]);return{credentialId:Z,modelId:Q,modelMeta:cV0(J,Q)}}async function mX($,Z){try{return await q6($,Z)}catch(Q){if(Q instanceof vi)return null;return console.warn(`[resolveTier] tier "${Z}" resolution failed:`,Q),null}}var vi,n80,SF6=5000;var dX=L(()=>{lU();xZ();Q4();vi=class vi extends Error{tier;constructor($){super(`No model available for tier "${$}". Connect a provider or configure the tier in organization settings.`);this.tier=$;this.name="TierUnavailableError"}};n80=class n80 extends Error{constructor($,Z){super($,Z);this.name="SpecificModelCredentialUnavailableError"}}});function Od$($){return $ instanceof rH||typeof $==="object"&&$!==null&&$.permanent===!0}var rH;var qF1=L(()=>{rH=class rH extends Error{permanent=!0;code;constructor($,Z){super(Z);this.name="PermanentRunError",this.code=$}}});function wd$($){if($==="reviewer")return"reviewer";if($==="conflict")return"conflict";return"default"}function Ed$($,Z="default"){let{providerId:Q,apiKey:X,baseUrl:Y}=$,J=vF6[Z],G={CLAUDE_CODE_MAX_OUTPUT_TOKENS:`${_F6}`,CLAUDE_CODE_MAX_TURNS:J===null?null:`${J}`,ENABLE_TOOL_SEARCH:xF6};if(Q==="anthropic")return{...G,CLAUDE_CODE_MODEL:MF1.anthropic[Z],ANTHROPIC_API_KEY:X,ANTHROPIC_AUTH_TOKEN:null,CLAUDE_CODE_OAUTH_TOKEN:null,ANTHROPIC_BASE_URL:Y??null};if(Q==="claude-subscription")return{...G,CLAUDE_CODE_MODEL:MF1.anthropic[Z],CLAUDE_CODE_OAUTH_TOKEN:X,ANTHROPIC_API_KEY:null,ANTHROPIC_AUTH_TOKEN:null,ANTHROPIC_BASE_URL:null};if(Q==="openrouter"||Q==="deco")return{...G,CLAUDE_CODE_MODEL:MF1.openrouter[Z],ANTHROPIC_API_KEY:"",ANTHROPIC_AUTH_TOKEN:X,CLAUDE_CODE_OAUTH_TOKEN:null,ANTHROPIC_BASE_URL:Y??"https://openrouter.ai/api"};throw new jd$(Q)}var Dd$="claude-subscription",MF1,mV0="claudeCodeModelClass",_F6=32000,vF6,xF6="1",jd$;var dV0=L(()=>{MF1={anthropic:{default:"claude-opus-5",reviewer:"claude-sonnet-5",conflict:"claude-sonnet-5"},openrouter:{default:"anthropic/claude-opus-5",reviewer:"anthropic/claude-sonnet-5",conflict:"anthropic/claude-sonnet-5"}};vF6={default:null,reviewer:60,conflict:60};jd$=class jd$ extends Error{constructor($){super(`the claude-code harness needs an Anthropic, OpenRouter or Deco model credential; this run's model resolves to "${$}". Point the agent's thinking model at one of those, or run it with Decopilot.`);this.name="UnsupportedClaudeCodeProviderError"}}});import{z as G$}from"zod";var zd$,fF6,t80,bF6,yF6,QiZ;var Pd$=L(()=>{zd$=G$.object({chunks:G$.array(G$.unknown()),done:G$.boolean().nullish().transform(($)=>$??!1),error:G$.object({code:G$.string(),message:G$.string()}).nullish().transform(($)=>$??null)}),fF6=G$.record(G$.string(),G$.unknown()),t80=G$.object({id:G$.string(),title:G$.string().optional(),provider:G$.string().nullable().optional(),credentialId:G$.string(),limits:G$.object({contextWindow:G$.number().int().positive().optional(),maxOutputTokens:G$.number().int().positive().optional()}).optional(),capabilities:G$.object({vision:G$.boolean().optional(),text:G$.boolean().optional(),reasoning:G$.boolean().optional()}).optional()}).strict(),bF6=G$.object({thinking:t80.extend({title:G$.string()}),fast:t80.optional(),smart:t80.optional(),image:t80.optional(),deepResearch:t80.optional()}).strict(),yF6=G$.discriminatedUnion("cwd",[G$.object({cwd:G$.literal("/repo"),repo:G$.object({owner:G$.string(),name:G$.string(),connectedGithub:G$.boolean()}).strict().optional(),branch:G$.string().nullable()}).strict(),G$.object({cwd:G$.null()}).strict()]),QiZ=G$.object({threadId:G$.string(),userMessage:fF6,harness:G$.object({sessionId:G$.string().optional()}).strict(),workspace:yF6,models:bF6,mcp:G$.object({url:G$.string().url(),headers:G$.record(G$.string(),G$.string()),expiresAt:G$.number().int().positive()}).strict(),orgMcps:G$.array(G$.object({name:G$.string(),url:G$.string().url(),headers:G$.record(G$.string(),G$.string())}).strict()).optional(),mode:G$.enum(["default","plan","web-search","gen-image"]),temperature:G$.number(),toolApprovalLevel:G$.enum(["auto","readonly"]),toolAllowlist:G$.array(G$.string()).nullable().optional(),maxAgentSteps:G$.number().int().optional(),user:G$.object({id:G$.string(),email:G$.string()}).strict(),organizationId:G$.string(),agent:G$.object({id:G$.string(),instructions:G$.string().optional(),disallowedTools:G$.array(G$.string()).optional()}).strict(),currentThreadTitle:G$.string().optional(),resume:G$.object({reason:G$.string()}).strict().optional()}).strict()});var Td$="sandbox_gone",Ad$="superseded",iV0="[SANDBOX_UNREACHABLE]";function gF6($){let Z=[$.contentType??"file"];if($.size!=null)Z.push(`${$.size} bytes`);return Z.join(", ")}function hF6($){let Z=($??[]).filter((X)=>X.kind!=="skill");if(Z.length===0)return null;return["<knowledge>","The following files are attached to you as reference knowledge. They are mounted in your sandbox at the paths below; read them with your file tools when relevant to the task, and treat them as authoritative reference material.","","Attached files:",Z.map((X)=>`- ${X.name} (${gF6(X)}), read it at \`${YN(X.volume,X.path)}\``).join(`
+`)}async function wF6($,Z,Q){if(Q.repository)return QN($,Q.repository,{bufferMs:yV0});return await Hi({ctx:$,connectionId:Q.connectionId,organizationId:Z,forceRefresh:!0,onLegacyMintError:(X)=>console.error("[TASK_ADD_REPO] legacy repo-scoped mint failed",{connectionId:Q.connectionId,error:X.message})}),XN(Q.connectionId,Q.owner,Q.name,$.db,$.vault,{bufferMs:yV0})}async function jF6($,Z,Q){let X=await $.storage.organizationSettings.get(Z);return _V0({ctx:$,orgId:Z,userId:Q,entries:X?.submodule_credentials})}function EF6($){return{git:{...$.primary?{repository:{...$.primary,submoduleCredentials:$.submoduleCredentials}}:{repositories:$.secondaries??[]},identity:{userName:$.gitUserName,userEmail:$.gitUserEmail}}}}async function zF6($,Z,Q,X){let Y=m80(Q);return(await Promise.all(Q.map(async(G,K)=>{let W=await SE($.storage,Z,G),H=W&&await aL($.storage,W)?W:null;if(!H&&!G.connectionId)return null;try{let{cloneUrl:F}=H?await QN($,H,{bufferMs:yV0}):await XN(G.connectionId,G.owner,G.name,$.db,$.vault,{bufferMs:yV0});return{cloneUrl:F,repoName:Y[K],submoduleCredentials:X}}catch(F){return console.warn(`[TASK_ADD_REPO] skipping secondary ${G.owner}/${G.name}:`,F instanceof Error?F.message:F),null}}))).filter((G)=>G!==null)}var yV0=3300000,WF6=4,HF6=250,FF6=2000,Qd$=45000,Xd$=1500,NF6=5,Jd$=20,DF6,TF1;var Gd$=L(()=>{x0();rZ();U80();nL0();oH();L80();OF1();aJ();XW();O8();GO();DF6=["origin=$(git remote get-url origin)",'token=$(printf %s "$origin" | sed -n "s|.*://[^:]*:\\([^@]*\\)@.*|\\1|p")','[ -n "$token" ] || exit 0','user=$(printf %s "$origin" | sed -n "s|.*://\\([^:]*\\):.*|\\1|p")','host=$(printf %s "$origin" | sed -n "s|.*@\\([^/]*\\)/.*|\\1|p")','[ -n "$host" ] || exit 0',"umask 077",'if [ "$user" = "oauth2" ]; then','  mkdir -p "${HOME:-/root}/.config/glab-cli"','  printf "hosts:\\n  %s:\\n    token: %s\\n    api_host: %s\\n    api_protocol: https\\n    is_oauth2: true\\n" "$host" "$token" "$host" > "${HOME:-/root}/.config/glab-cli/config.yml"','  chmod 600 "${HOME:-/root}/.config/glab-cli/config.yml"','elif [ "$user" = "x-access-token" ]; then','  mkdir -p "${HOME:-/root}/.config/gh"','  printf "%s:\\n  oauth_token: %s\\n  git_protocol: https\\n" "$host" "$token" > "${HOME:-/root}/.config/gh/hosts.yml"',"fi"];TF1=p({name:"TASK_ADD_REPO",description:"Clone one of this organization's repositories into your working directory. "+"Your working directory is EMPTY until you call this \u2014 do not look for "+"files, and do not run git, before it returns. Call it once, with the repository the task is about; it waits for the checkout and returns the repository root listing, so you can start reading files immediately after. `git` and the repository's CLI (`gh` for GitHub, `glab` for GitLab; Bitbucket has "+"no CLI \u2014 its token is the password in `git remote get-url origin`, for `curl` "+"against api.bitbucket.org) are authenticated once it returns. Call TASK_ADD_REPO with no arguments to list the repositories available.",annotations:{title:"Add Repository",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!0},inputSchema:P3.object({id:P3.string().optional().describe("id of the repository to clone, as returned by the listing. Omit to list the available repositories."),connectionId:P3.string().optional().describe("Deprecated alias for `id`.")}),outputSchema:P3.object({success:P3.boolean(),repositories:P3.array(P3.object({id:P3.string(),repo:P3.string()})).optional(),repo:P3.string().optional(),cloned:P3.boolean().optional(),files:P3.string().optional(),message:P3.string()}),handler:async($,Z)=>{$0(Z),await Z.access.check();let Q=U0(Z),X=t0(Z);if(!X)throw Error("User ID required");let{threadId:Y}=fV0(),J=await CE(Z,Q.id),G=$.id??$.connectionId,K=G?J.find((W0)=>W0.id===G):void 0;if(!K){let W0=J.map((P0)=>({id:P0.id,repo:P0.label}));return{success:!1,repositories:W0,message:G?`No repository for id "${G}". Pick one of the repositories listed.`:W0.length===0?"This organization has no repositories linked, so none can be cloned.":"Pick a repository and call TASK_ADD_REPO again with its id."}}let W=await Z.storage.threads.get(Y);if(!W)throw Error(`Thread not found: ${Y}`);let H=await Mi(Z,{threadId:Y,runBranch:W.branch}),F=await Ty(Z,H,X),U=await pY(Z),N=await UF6(Z,Y,F,H);if(!N)throw Error(`No sandbox is registered for this run (thread ${Y}), so there is nowhere to clone into.`);let B=W.metadata?.githubRepo,O=W.metadata?.githubRepos??[],D=B&&B.owner===K.owner&&B.name?.toLowerCase()===K.name.toLowerCase();if(B&&(D||BF6(O,{owner:K.owner,name:K.name})))return{success:!1,repo:`${K.owner}/${K.name}`,cloned:!1,message:D?`${K.label} is already checked out at your working directory.`:`This run already has ${Jd$} additional repositories checked out, which is the limit. Work with what's already checked out instead of adding another.`};let{cloneUrl:w,gitUserName:j,gitUserEmail:E}=await wF6(Z,Q.id,K),z={url:K.webUrl,owner:K.owner,name:K.name,...K.installationId!==void 0?{installationId:K.installationId}:{},...K.connectionId?{connectionId:K.connectionId}:{},...K.repository?{repositoryId:K.repository.id}:{}},A=!B,P=A?[]:await Z.storage.threads.appendThreadGithubRepo(Y,z);if(A)await Z.storage.threads.update(Y,{metadata:{...W.metadata??{},githubRepo:z},updated_by:X});let T=pL0({branch:H,derivedRef:aH(H),recordedHeadRef:null,sticky:!1}),q=await jF6(Z,Q.id,X),f=await U.proxyDaemonRequest(N.sandboxHandle,"/_sandbox/config",{method:"PUT",headers:new Headers({"content-type":"application/json"}),body:JSON.stringify(EF6({...A?{primary:{cloneUrl:w,branch:T,repoName:`${K.owner}/${K.name}`}}:{secondaries:await zF6(Z,Q.id,P,q)},submoduleCredentials:q,gitUserName:j,gitUserEmail:E}))});if(!f.ok)throw Error(`the sandbox rejected the repository (${f.status} ${f.statusText})`);await U.proxyDaemonRequest(N.sandboxHandle,"/_sandbox/setup/clone",{method:"POST",headers:new Headers({"content-type":"application/json"}),body:"{}"}).catch((W0)=>{console.warn("[TASK_ADD_REPO] explicit clone kick failed",W0)});let C=A?null:$d$(P,{owner:K.owner,name:K.name}),V=A||!C?".":`"$(dirname "$PWD")/repos/${C}"`,h=Date.now()+Qd$,g=!1,l="",u=0,d=null;while(Date.now()<h){let W0=await Yd$(U,N.sandboxHandle,Y,`cd ${V} 2>/dev/null || exit 1; if [ -n "$(git ls-files 2>/dev/null | head -1)" ]; then echo __CLONED__; fi; ls -A 2>/dev/null`).catch(()=>null);if(!W0){if(++u>=NF6)break;await k$(Xd$);continue}u=0;let P0=LF6(W0.stdout);if(P0.cloned&&P0.listing===d){g=!0,l=P0.listing;break}d=P0.cloned?P0.listing:null,await k$(Xd$)}if(g)await Yd$(U,N.sandboxHandle,Y,OF6(A?null:`../repos/${C}`)).catch((W0)=>console.warn("[TASK_ADD_REPO] CLI auth setup failed",W0));return{success:g,repo:`${K.owner}/${K.name}`,cloned:g,files:l,message:g?A?`${K.label} is checked out at your working directory on branch ${T}. \`git\` and its CLI are authenticated. Start working.`:`${K.label} is checked out at ../repos/${C}, beside your working directory, on its default branch. \`git\` and its CLI are authenticated there too. Your first checkout is untouched \u2014 commit and open a change request in each repository you change.`:`The clone of ${K.owner}/${K.name} did not finish within ${Math.round(Qd$/1000)}s. It may still be in progress \u2014 check your working directory before calling this again.`}}})});import{z as f1}from"zod";var Ii=50000,Vi=500,gV0=200,ki=50000,KO,d80,Ay,PF6,TF6,AF6,Kd$,Si,RF6,qF6,Wd$;var rJ=L(()=>{x4();x4();KO=f1.enum(cH),d80=f1.enum(["bug","feature","chore","spike","security"]),Ay=f1.enum(["none","low","medium","high","urgent"]),PF6=f1.object({threadId:f1.string(),virtualMcpId:f1.string().nullable(),status:f1.enum(["in_progress","requires_action","failed","completed","expired"]).nullable(),title:f1.string().nullable(),lastMessage:f1.string().nullable(),hasPreview:f1.boolean(),failureKind:f1.string().nullable(),hasMessages:f1.boolean(),costUsd:f1.number().nullable(),costProvider:f1.string().nullable(),createdAt:f1.string(),lastActiveAt:f1.string()}),TF6=f1.object({reviewer:f1.enum(tK),verdict:f1.enum(["approved","changes_requested"]),verified:f1.boolean()}),AF6=f1.object({id:f1.string(),name:f1.string(),color:f1.string().nullable().describe('Hex color, e.g. "#3b82f6"'),createdBy:f1.string(),createdAt:f1.string().datetime()}),Kd$=f1.object({url:f1.string(),number:f1.number(),repoOwner:f1.string(),repoName:f1.string(),createdAt:f1.string(),updatedAt:f1.string().nullable(),title:f1.string().nullable(),body:f1.string().nullable(),state:f1.enum(["open","closed"]).nullable(),draft:f1.boolean().nullable(),merged:f1.boolean().nullable(),mergeable:f1.boolean().nullable(),checksStatus:f1.enum(["pending","passing","failing"]).nullable(),checks:f1.array(f1.object({name:f1.string(),status:f1.string(),conclusion:f1.string().nullable(),detailsUrl:f1.string().nullable(),summary:f1.string().nullable()})),previewUrl:f1.string().nullable()}),Si=f1.object({id:f1.string(),organizationId:f1.string(),title:f1.string(),description:f1.string().nullable(),status:KO,priority:Ay,type:d80,assigneeId:f1.string().nullable(),assignedBy:f1.string().nullable(),repo:f1.string().nullable(),repositoryId:f1.string().nullable(),dueDate:f1.string().datetime().nullable(),sortOrder:f1.number(),keySeq:f1.number().nullable(),externalUrl:f1.string().nullable(),previewRoutes:f1.array(f1.string()),source:f1.enum(["jira"]).nullable(),retryAttempts:f1.number(),reviewCycleStartedAt:f1.string().datetime().nullable(),threads:f1.array(PF6),tags:f1.array(AF6),reviewVerdicts:f1.array(TF6),createdBy:f1.string(),createdAt:f1.string().datetime(),updatedBy:f1.string(),updatedAt:f1.string().datetime()}),RF6=["created","status_changed","assignee_changed","priority_changed","due_date_changed","title_changed","description_changed","tags_changed","review_requested","review_approved","review_changes_requested","review_verdict_requested","merge_conflict_resolution","merge_failed","type_changed","duplicate_reported"],qF6=f1.enum(RF6),Wd$=f1.object({id:f1.string(),taskBoardItemId:f1.string(),action:qF6,actorId:f1.string().nullable(),data:f1.record(f1.string(),f1.unknown()),occurredAt:f1.string().datetime()})});async function hV0($,Z,Q){if(Q===I8)return;let{members:X}=await $.boundAuth.organization.listMembers({organizationId:Z,filterField:"userId",filterValue:Q});if(!X.some((Y)=>Y.userId===Q))throw Error("assigneeId is not a member of the organization")}var AF1=L(()=>{rJ()});function Ud$($){let Z={};for(let[Q,X]of Object.entries($)){if(Q.startsWith(MF6))continue;Z[Q]=X}return Z}function uV0($){return{taskBoardItemId:$.id,...yX($)&&{[Hd$]:Fd$}}}function IF6($){return $?.[Hd$]===Fd$}function VF6($){if(/[:\s]/.test($))throw Error("organization id unsuitable for the subsidy key scheme");return`subsidy:${$}`}async function kF6($,Z){let Q=T0();try{let X=await $.storage.subsidizedGatewayKeys.get(Z);if(X)return X;let Y=$.auth?.user?.id;if(Y&&Q.aiGatewayEnabled&&Q.studioProvisionSecretKey&&jj.provisionKey){let J=await MQ(Y,$.auth?.user?.email),G=await jj.provisionKey(J,VF6(Z));return await $.storage.subsidizedGatewayKeys.put(Z,G),G}}catch(X){console.error("[subsidized-runs] subsidy key unavailable \u2014 run stays on the org's key:",X)}return}async function Nd$($,Z,Q){if(!T0().taskQuotaEnforced)return;if(!IF6(Q))return;let X=Q?.taskBoardItemId;if(!X)return;let Y=await $.storage.taskBoard.getById(X,Z);if(!Y||!yX(Y))return;if(!await xx$($,X))return;return await kF6($,Z)}function Bd$($,Z){if(!Z)return $;if($.providerId!=="deco")return $;return{...$,apiKey:Z}}var MF6="srv.",Hd$="srv.billing",Fd$="subscription";var i80=L(()=>{hm();$H();H$();oK()});function p80($){let Z=$?.runClass;return Z&&Z in RF1?RF1[Z]:RF1.interactive}var RF1,Ci="runClass";var _i=L(()=>{RF1={interactive:10,reviewer:20,retry:30,new_task:40}});async function lV0($,Z,Q){let X;try{return await Promise.race([$.aiProviders.listModels(Z,Q),new Promise((J,G)=>{X=setTimeout(()=>G(Error("listModels timeout")),SF6)})])}finally{if(X)clearTimeout(X)}}function CF6($,Z){switch($){case"fast":return Z.chat.fast;case"smart":return Z.chat.smart;case"thinking":return Z.chat.thinking;case"image":return Z.image;case"web_search":return Z.webSearch;case"deep_research":return Z.deepResearch}}function cV0($,Z,Q){let X=$.find((Y)=>Y.modelId===Z);return{title:X?.title??Q??Z,providerId:X?.providerId,capabilities:X?.capabilities,limits:X?.limits??null}}async function q6($,Z,Q){let X=$.organization?.id;if(!X)throw Error("resolveTier called without an organization");let J=(await $.storage.organizationSettings.get(X))?.simple_mode?.tiers?.[Z]??null,G=$.auth?.user?.id,K=JE.safeParse(Z),W=Q?.applyUserPrefs&&K.success&&G?(await $.storage.userModelPreferences.get(G,X))?.tiers?.[K.data]??null:null,H=(await $.storage.aiProviderKeys.list({organizationId:X})).filter((w)=>VT(w.providerId)),F=await hS$($,X,Z),U=F?H.find((w)=>w.providerId==="deco"):void 0;if(F&&U){let w=await lV0($,U.id,X).catch(()=>[]);return{credentialId:U.id,modelId:F,modelMeta:cV0(w,F)}}for(let w of[W,J])if(w&&H.some((j)=>j.id===w.keyId)){let j=await lV0($,w.keyId,X).catch(()=>[]);return{credentialId:w.keyId,modelId:w.modelId,modelMeta:cV0(j,w.modelId,w.title)}}if(H.length===0)throw new vi(Z);let N={};await Promise.all(H.map(async(w)=>{N[w.id]=await lV0($,w.id,X).catch(()=>[])}));let B=H.map((w)=>({id:w.id,providerId:w.providerId,label:w.label,presetId:w.presetId,createdBy:w.createdBy,createdAt:w.createdAt})),O=M3$(B,N),D=CF6(Z,O);if(!D)throw new vi(Z);return{credentialId:D.keyId,modelId:D.modelId,modelMeta:cV0(N[D.keyId]??[],D.modelId,D.title)}}async function Ld$($,Z,Q){let X=$.organization?.id;if(!X)throw Error("resolveSpecificModel called without an organization");let Y=await $.storage.aiProviderKeys.findById(Z,X).catch((G)=>{if(G instanceof Error&&G.message==="Provider key not found")throw new n80(`AI provider credential "${Z}" was not found`,{cause:G});throw G});if(!VT(Y.providerId))throw new n80(`AI provider credential "${Z}" uses native-only provider "${Y.providerId}" and cannot run a hosted model`);let J=await lV0($,Z,X).catch(()=>[]);return{credentialId:Z,modelId:Q,modelMeta:cV0(J,Q)}}async function mX($,Z){try{return await q6($,Z)}catch(Q){if(Q instanceof vi)return null;return console.warn(`[resolveTier] tier "${Z}" resolution failed:`,Q),null}}var vi,n80,SF6=5000;var dX=L(()=>{lU();xZ();Q4();vi=class vi extends Error{tier;constructor($){super(`No model available for tier "${$}". Connect a provider or configure the tier in organization settings.`);this.tier=$;this.name="TierUnavailableError"}};n80=class n80 extends Error{constructor($,Z){super($,Z);this.name="SpecificModelCredentialUnavailableError"}}});function Od$($){return $ instanceof rH||typeof $==="object"&&$!==null&&$.permanent===!0}var rH;var qF1=L(()=>{rH=class rH extends Error{permanent=!0;code;constructor($,Z){super(Z);this.name="PermanentRunError",this.code=$}}});function wd$($){if($==="reviewer")return"reviewer";if($==="conflict")return"conflict";return"default"}function Ed$($,Z="default"){let{providerId:Q,apiKey:X,baseUrl:Y}=$,J=vF6[Z],G={CLAUDE_CODE_MAX_OUTPUT_TOKENS:`${_F6}`,CLAUDE_CODE_MAX_TURNS:J===null?null:`${J}`,ENABLE_TOOL_SEARCH:xF6};if(Q==="anthropic")return{...G,CLAUDE_CODE_MODEL:MF1.anthropic[Z],ANTHROPIC_API_KEY:X,ANTHROPIC_AUTH_TOKEN:null,CLAUDE_CODE_OAUTH_TOKEN:null,ANTHROPIC_BASE_URL:Y??null};if(Q==="claude-subscription")return{...G,CLAUDE_CODE_MODEL:MF1.anthropic[Z],CLAUDE_CODE_OAUTH_TOKEN:X,ANTHROPIC_API_KEY:null,ANTHROPIC_AUTH_TOKEN:null,ANTHROPIC_BASE_URL:null};if(Q==="openrouter"||Q==="deco")return{...G,CLAUDE_CODE_MODEL:MF1.openrouter[Z],ANTHROPIC_API_KEY:"",ANTHROPIC_AUTH_TOKEN:X,CLAUDE_CODE_OAUTH_TOKEN:null,ANTHROPIC_BASE_URL:Y??"https://openrouter.ai/api"};throw new jd$(Q)}var Dd$="claude-subscription",MF1,mV0="claudeCodeModelClass",_F6=32000,vF6,xF6="1",jd$;var dV0=L(()=>{MF1={anthropic:{default:"claude-opus-5-5",reviewer:"claude-sonnet-5",conflict:"claude-sonnet-5"},openrouter:{default:"anthropic/claude-opus-5.5",reviewer:"anthropic/claude-sonnet-5",conflict:"anthropic/claude-sonnet-5"}};vF6={default:null,reviewer:60,conflict:60};jd$=class jd$ extends Error{constructor($){super(`the claude-code harness needs an Anthropic, OpenRouter or Deco model credential; this run's model resolves to "${$}". Point the agent's thinking model at one of those, or run it with Decopilot.`);this.name="UnsupportedClaudeCodeProviderError"}}});import{z as G$}from"zod";var zd$,fF6,t80,bF6,yF6,QiZ;var Pd$=L(()=>{zd$=G$.object({chunks:G$.array(G$.unknown()),done:G$.boolean().nullish().transform(($)=>$??!1),error:G$.object({code:G$.string(),message:G$.string()}).nullish().transform(($)=>$??null)}),fF6=G$.record(G$.string(),G$.unknown()),t80=G$.object({id:G$.string(),title:G$.string().optional(),provider:G$.string().nullable().optional(),credentialId:G$.string(),limits:G$.object({contextWindow:G$.number().int().positive().optional(),maxOutputTokens:G$.number().int().positive().optional()}).optional(),capabilities:G$.object({vision:G$.boolean().optional(),text:G$.boolean().optional(),reasoning:G$.boolean().optional()}).optional()}).strict(),bF6=G$.object({thinking:t80.extend({title:G$.string()}),fast:t80.optional(),smart:t80.optional(),image:t80.optional(),deepResearch:t80.optional()}).strict(),yF6=G$.discriminatedUnion("cwd",[G$.object({cwd:G$.literal("/repo"),repo:G$.object({owner:G$.string(),name:G$.string(),connectedGithub:G$.boolean()}).strict().optional(),branch:G$.string().nullable()}).strict(),G$.object({cwd:G$.null()}).strict()]),QiZ=G$.object({threadId:G$.string(),userMessage:fF6,harness:G$.object({sessionId:G$.string().optional()}).strict(),workspace:yF6,models:bF6,mcp:G$.object({url:G$.string().url(),headers:G$.record(G$.string(),G$.string()),expiresAt:G$.number().int().positive()}).strict(),orgMcps:G$.array(G$.object({name:G$.string(),url:G$.string().url(),headers:G$.record(G$.string(),G$.string())}).strict()).optional(),mode:G$.enum(["default","plan","web-search","gen-image"]),temperature:G$.number(),toolApprovalLevel:G$.enum(["auto","readonly"]),toolAllowlist:G$.array(G$.string()).nullable().optional(),maxAgentSteps:G$.number().int().optional(),user:G$.object({id:G$.string(),email:G$.string()}).strict(),organizationId:G$.string(),agent:G$.object({id:G$.string(),instructions:G$.string().optional(),disallowedTools:G$.array(G$.string()).optional()}).strict(),currentThreadTitle:G$.string().optional(),resume:G$.object({reason:G$.string()}).strict().optional()}).strict()});var Td$="sandbox_gone",Ad$="superseded",iV0="[SANDBOX_UNREACHABLE]";function gF6($){let Z=[$.contentType??"file"];if($.size!=null)Z.push(`${$.size} bytes`);return Z.join(", ")}function hF6($){let Z=($??[]).filter((X)=>X.kind!=="skill");if(Z.length===0)return null;return["<knowledge>","The following files are attached to you as reference knowledge. They are mounted in your sandbox at the paths below; read them with your file tools when relevant to the task, and treat them as authoritative reference material.","","Attached files:",Z.map((X)=>`- ${X.name} (${gF6(X)}), read it at \`${YN(X.volume,X.path)}\``).join(`
 `),"</knowledge>"].join(`
 `)}function Rd$($,Z){let Q=hF6(Z);if(!Q)return $;return $?`${$}